[NanaseInori]

Current v2 Full preferences previously failed the native user-terminal path because it still required legacy Debug permission. A16 requires explicit process-local Full activation, retains Code/Local/Debug interaction and user confirmation, and checks shared authorization at native start, input and resize. Exact bindings and runtime epoch/generation prevent revoked or cold authority from reviving an old session; legacy Debug records remain readable and revocable.

Review scope and frozen references

• Target branch: codex/uc-b12-review-699f26c0, frozen at 699f26c0329805658806f060d155c4f8e9486795.
• Published head: 6355b865a9f108c5074119237cae4dc97c805f74; tree: 3d553f9a326f8d69c0c332a520d4096c075d420f.
• The PR comparison is cumulative: 31 commits, 23 changed files, +1744/-261 relative to B12. It includes prior A14 historical migration fixtures, A15 checksum/Desktop/v177 recovery work, and C's reviewed historical Run-seeding helper/integration commits. These are not all A16 changes.
• A16 itself is exactly the six-file increment 0dd06ca1324a7b52f1c401c8249b83dbf8e0c1c4 → 6355b865a9f108c5074119237cae4dc97c805f74 (+903/-164). Review only A16.
• C may already contain the same A14/A15/helper changes. Reconcile commit and tree ancestry before integration; do not merge or replay the cumulative content twice.
• PR235 remains frozen at its original B12 head. This publication does not update it or include C's later application test WIP.

A16 implementation and retired entry points

• Desktop injects the existing PolicyAuthorizer through the new host-only terminal.StartRequest.Authorizer field. The resolver reloads current Run, workspace, mode, profile, interaction, permission and runtime activation; the field is excluded from JSON.
• Manager pins the original authorization reference, fingerprints the final native operation, and consumes its dispatch guard before starting a process, writing input or resizing. Terminal input uses a process-keyed HMAC and is not persisted.
• Manager.ReconcileBindings(ctx) closes invalid sessions and revokes their leases; the existing Run-wide termination revocation remains. Cancelling one input request does not revoke an otherwise valid user-owned session.
• Retired Desktop's persistent-terminal use of the legacy evaluator, persisted capability-flag authority, unconditional native writes/resize, and fresh legacy Debug starts or input-lease authorization. Historical validation/read/revoke support remains. No parallel Run/Session database was added.

Verification and remaining work

• Targeted Windows race checks: 26 top-level tests / 91 pass events including subtests, 0 failures and 0 skips, across internal/terminal and internal/executionauth.
• One real Windows ConPTY smoke also passed under race: actual PowerShell start, fixed marker input, observed output and zero exit. Its host resolver is a package fixture using the real shared policy/runtime authority; it is not Desktop SQLite integration acceptance.
• internal/app, internal/desktop and internal/sandbox: compile-only passed. Their test binaries and ACL TestMain functions were not executed.
• Tested source bytes match the frozen commit. Local toolchain: Go 1.26.5, Windows amd64. No macOS runtime, complete-suite or CI-green claim. The branch may have inherited failures outside this increment.
• C still owns the application Agent-input evaluator/audit migration and its terminal test fixture authorizer injection. A16 does not complete that application path.
• A shared authorization check cannot lock across an OS syscall. In-flight effects are not claimed rolled back; partial native writes are reported without automatic retry. Interactive authorization throughput has not been benchmarked.
• No extra WIP, raw runtime logs, credentials or evidence archives are included. New reachable blobs received a limited credential-pattern/path scan, including the decompressed historical fixture; this is not an exhaustive guarantee.

Draft review checkpoint: A16 has not yet been personally reviewed by dot. Keep C integration blocked until dot approves the actual diff. Do not mark ready or merge.