feat(focus): fail-close send-safety gate on approve (C-SEND-1)

[Victor "David" Medina (Victor-David-Medina)]

C-SEND-1 — fail-close send-safety gate on approve

Designed by an 8-agent understand→design→adversarial-verify workflow before any code. The key finding reframed the task:

The dry-run preview already exists and is correct (WouldSendPreview + resolveProvenance + TrustStrip + silent-pilot.test.tsx). So C-SEND-1 is not a preview build — do not rebuild those.

The real gap = a safety hole

app/api/v1/focus/decide/route.ts queued a real outreach send gated only by the OUTREACH_CONSUMER_ENABLED env var — with zero awareness of card provenance or PILOT_LOCK. Approving a sample/shadow card could queue a real send if that one flag flipped. That is unsafe-by-config, not safe-by-contract — and it means the eventual First-Light send is not yet a tested one-click.

The fix (smallest honest change, reuses every existing primitive)

• lib/outreach/safety.ts — new pure resolveSendDecision({ sends, pilotLocked, consumerEnabled }). An external send is queued ONLY when live AND pilot-unlocked AND consumer-enabled; any missing condition holds it. Precedence pilot_lock → not_live_provenance → consumer_paused. It can never become true by a single env flip.
• decide route — computes sends by reusing the pure provenance guards (isDataProvenance/isSideEffectMode, mirroring resolveProvenance's live-rule) read defensively off the row (recovery_items has no provenance column today → absent → not live → held = fail-close), plus isPilotLockEnabled(). The approval (outcome_receipts) is always recorded even when the send is held. Adds structured would_send + send_blocked_reason to the response (assert on fields, not prose).
• No new lock/provenance definition, no new table — outcome_receipts already IS the approval log; proof_events stays Pulse-owned.

Tests

• lib/outreach/safety.test.ts — full 8-combo truth table (exactly one allowed; pilot lock always dominates).
• __tests__/focus-decide-route.test.ts — live-queues / sample-held (not_live_provenance) / pilot-held (pilot_lock) / consumer-held (consumer_paused); approval receipt recorded in every held case.
• __tests__/csend-proof-invariant.test.ts — approve never writes proof_events; empty ledger = 0 proof_events / 0 wins. Codifies the proof=0 honesty invariant.

Honesty / safety

Makes the console consistent with Pulse's PILOT_LOCK fail-close boundary (defense in depth). At proof_events=0 with HRC pilot-locked, nothing queues — by contract, not by luck. Built off fresh origin/main in an isolated worktree; the parked console dev branch was untouched. node_modules absent in the worktree → console CI (Build+Lint+Test, Quality Gate) is the test gate.

Generated with Claude Code by RelayLaunch

[github-actions]

🛡️ Cascade Quality Score: 100/100

Category	Score	Status
TypeScript	20/20	✅
ESLint	20/20	✅
Brand Compliance	15/15	✅
Test Suite	25/25	✅
Build	20/20	✅

Threshold: 85/100 | Result: PASS ✅

[Victor "David" Medina (Victor-David-Medina)]

Extended: added the owner-visible held-state that completes C-SEND-1. The gate now returns send_blocked_reason, but the Deck was ignoring it - an approved-but-held card just showed "Approved", which (while PILOT_LOCK holds every send at First Light) implies it was delivered. Now handleDecision (single + bulk-approve) captures the reason and the card shows an honest "Prepared, not sent" chip with a plain reason on hover (pilot lock on / preview only / delivery paused). Neutral stone chip + amber-300 accent (held = informational, not interactive/error); extends the existing status row next to "Queued", no new component. This makes the send-safety gate visible so an approval is never mistaken for a send.

[Victor "David" Medina (Victor-David-Medina)]

Extended (rank-2 from the pre-First-Light gate): the held-state reason was tooltip-only (invisible on touch), jargon, and gave no next-step. Now plain-English reassuring labels ("Saved. It sends once testing wraps up; nothing has gone out yet" - no "pilot lock" jargon) rendered as a visible inline line under the card (works on Elaine's touch device), alongside the glanceable "Prepared, not sent" chip. This closes the C-SEND-1 arc + the last Claude gate item.