[AnthonyRonning]

Pairing could permit ordinary remote access while every remote update failed: the controller discarded its confirmed outgoing pairing grant, then sent zero or the opposite direction's grant. “Refresh update status” also only reread the remote desktop's cached status. This prepares Agent 0.0.9 with durable directional grants, authenticated recovery of existing 0.0.8 pairings, and an explicit remote signed-feed check.

Known refusals now stay distinct from lost acknowledgements. Uncertain requests retain their operation ID through disconnects and re-pairing and are never automatically resent. Account, revocation, password-store, exact-candidate and installer guards remain enforced; the refresh capability is optional management 7.1 on wire 7. Previous tests checked pairing and installation separately using supplied authority; the new composed regression consumes the actual pairing-produced records without overwriting them.

Validation:

• Added CI coverage combining real CPace/ConfirmGrant over loopback Iroh with two durable stores, restart, lost acknowledgement, mutual pairing and the production install-grant policy. Added actual GPUI click, controlled refusal, stale callback, password-policy, and bounded QUIC reply regressions.
• macOS nix develop --no-update-lock-file -c just ci passed: format, nine metadata checks, all four strict Clippy feature configurations, warning-denied workspace build, workspace tests (including 767 runtime and 1,050 desktop tests), and 320 headless tests. The normal pre-commit hook also passed; commit is signed.
• Reproduced the old failure in two native 0.0.7 apps using normal Local login and pairing, a real signed feed/download/native preparation, and one actual remote-install UI confirmation. The host rejected the mismatched grant before creating a receipt. A real Refresh click after the feed changed issued no HTTP check and still showed “Up to date.”
• Exercised an actual unfixed 0.0.8 pairing, upgraded only its controller through the native updater to this 0.0.9 code, recovered its saved grant without re-pairing or store edits, and completed one real UI-requested remote 0.0.8 → 0.0.9 update. Verified signed payload bytes, native build, new host and usable desktop, retained account/store/pairing, durable success receipt, and unchanged controller binary/processes.
• Verified native 0.0.9 Refresh made its HTTP request from the execution desktop's PID, observed its connection while the owned test feed was paused, honestly reported a subsequent failed check as historical information, and recovered after restoring the feed. The server-pause duration is not a measurement of client request latency; delayed and timed-out replies have a separate real QUIC regression.
• Independently reproduced the bad 0.0.7 pairing on Linux, then exercised an actual unfixed 0.0.8 pair and signed 0.0.9 remote payload lifecycle there: authenticated legacy recovery, exactly one install RPC, atomic swap/native restart, success receipt, retained account/store/endpoint and unchanged controller. The Linux controller was deliberately bootstrapped from the signed fixture bundle; Linux coverage uses native launch/RPC rather than GUI input.

Native rehearsals use isolated Local accounts, the existing public test signer, loopback feeds and explicit private fixture adapters. macOS retains strict native signature/runtime validation under an ad-hoc fixture identity; these tests do not establish production Developer ID/notarization or public release qualification. Fixture adapters, credentials and machine-specific harnesses are not part of this PR. Published 0.0.8 is unchanged.

The published 0.0.7 wire-6 → wire-7 break is preserved: an already-upgraded controller cannot bootstrap an old wire-6 peer. Those peers still need a direct local update. This PR repairs compatible 0.0.8 pairings and future wire-7 upgrades without a protocol downgrade or cross-major bridge.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}