[dmoliveira]

V2 does not expose the host's plain permission-decline constructor, so the existing experimental error redactor cannot safely construct that control-flow cause in production. Add an unconfigured alternative that replaces the error with a generic host tool error, interrupts the affected session, and quarantines model requests until the accepted interruption settles. Failed or unverified interruption remains quarantined; an unknown session or exhausted bound closes the guard.

The full validation exposed a pre-existing watchdog race in the dependency probe. The probe now refuses to start an already-expired or cancelled runtime, and deterministic deadline tests cover both an active controller and expiry during setup.

The interruption is session-wide. The guard is process-local and is lost on unload or restart; it is not an independent security boundary and remains unconfigured while V2 gateway and shell parity are incomplete.

Validation:

• Gateway lint and 1,463 Node tests (Node 22).
• Full private OpenCode 2.2.5 and 2.2.6 permission smoke, including normal and forged declines, redacted feedback, a failed interruption, blocked retry/generate/compaction, and a concurrent peer session.
• Repository pre-commit validation and 20 repetitions of the deadline regressions.