# Engagement run contract corrections

Read-only inspection reproduced the reported disagreement: the running CLI had trusted authorization set to true while its existing checkpoint retained false. Hydration only copied authorization when absent. It now accepts a current explicit boolean from the trusted run config after workspace/engagement binding validation. True can refresh historical false, false can revoke historical true, and missing/non-boolean values never grant approval. Files, historical messages and blocked objectives are not rewritten. The next trusted run refreshes context; existing pending work remains subject to the same machine scope and dispatch gates.

Direct-scope context now identifies the declared primary target as a display anchor and points to canonical operator-provisioned RoE for the complete scope/windows. It no longer mislabels every direct engagement as an Autohunt single-target bootstrap. Current trusted approval supersedes old assistant prose; missing approval still requires one question and waiting.

`commit_opplan` previously advertised `list[dict[str, Any]]`; models could not see enum/integer constraints until runtime rejection. Its wire schema now derives from canonical Objective fields, with optional server-issued IDs and positional dependency references. Runtime validation and structured tool errors remain compatible. OPPLAN instructions explicitly separate greetings/interface questions from an assessment request. Revision conflicts and the review-search executable-objective guard remain valid protections; they are not bypassed. New tool presentation separately avoids `[object Object]` in the UI work.

The compaction wrapper previously caught errors from the downstream generation handler as if the summarizer had failed, emitted a misleading skipped warning, then called the same handler again. Sync and async paths now propagate generation errors once. Genuine summarizer failure retains the original-context fallback. A compaction check finishes when generation starts, rather than leaving its footer in checking state throughout generation; a completed check is not proof that tokens were reduced.

Validation: 123 affected engagement/compaction/OPPLAN tests passed, including a real in-memory LangGraph checkpoint with false→true→false trusted approval, invalid/missing config, main-model failure invoked once in both sync/async paths, genuine summary failure fallback and actual provider tool-schema conversion. Full repository Ruff and the required basedpyright gate passed with zero errors (820 non-blocking warnings). No target-facing operation or real blocked provider request was run for these regressions; real source-product acceptance is tracked separately.