Tool calls no longer fail sporadically while the database is opening or briefly busy; saved session confinement stays enforced, and expired waits still fail closed.
Carries in-memory confinement answers through to admission, along with the policy generation, so a busy database slot cannot turn an unconfined call into confine_policy_unavailable; carried answers are rejected once a confining save invalidates them.
Waits off-loop for keyed calls' opening policy store, shares the existing persistence deadline, and bounds blocking reads with permits held until completion; unreadable policies, exhausted wait budgets, and over-limit concurrent reads fail closed.
Rejects untrusted shell capabilities before any confinement or database lookup, and treats never-configured persistence as unconfined even behind a busy slot.
Adds deterministic tests for held slots, slow opens, wait-budget exhaustion, refusal ordering, and reads that finish after their caller times out.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable issues were found.
Summary
The PR keeps confinement checks off the frame loop while the database opens or stays busy.
Scoped tool calls wait for their saved confinement policy.
Untrusted shell calls are refused before policy lookup.
Both earlier findings are addressed in the current code. Both threads were manually resolved without explanatory replies.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Tool call] --> B{Shell capability refused?}
B -->|Yes| R[Return error]
B -->|No| C{Policy known in memory?}
C -->|Yes| D[Carry answer and generation]
C -->|No| E{Budget and read permit available?}
E -->|No| R
E -->|Yes| F[Wait for database opening]
F --> G[Read policy off-loop]
G --> D
D --> H[Ledger admission wait]
H --> I{Current policy answer available?}
I -->|No| R
I -->|Yes| J[Apply confinement and admit]
