[aruintelligence]

Change

• Recheck host policy and target after approval before issuing an ALLOW receipt.
• Consume a one-use grant when dispatch observes a policy or target change, so restoring the earlier state cannot revive it.
• Snapshot the resolved arguments and keep the registered proposal independent from the caller's receipt.

Reproducible evidence

• Two regressions failed on the old adapter: a revoked grant dispatched after policy restoration, and approval-time revocation still minted ALLOW.
• The new four-record report covers email, HTTP, database, and UI: 16 blocked revocation steps, zero local callbacks.
• Four receipts append to the registry; all prior 500 rows remain unchanged. The original eight-path adapter report retains its existing SHA-256.
• Local: npm test 1,086 passed; deep registry verification, full one-command reproduction, report/manifest checks, and local link check passed.

These are project-authored local callbacks and a public fixture key. Unobserved policy changes that return to identical bytes still require a host epoch or durable revocation record.