feat(inbox): C2.5 — inbox hardening + SDK version guard (closes C-F7, C-N3, R-6)

- File-layer decision vocabulary (§4.2 set) with SKIP semantics — an unknown
  decision never reaches the store (C-F7, the review's run proof is the fixture)
- Fail-fast caps (max_files / max_rationale_chars) via InboxLimitError raised
  OUTSIDE the tolerant try — a cap breach is never swallowed as a skip
- R-6 id grammar (mirrors ingest _ID_RE) as a pydantic pattern on
  VerdictDocument.id AND re-checked in write_verdict, since model_copy(update=)
  bypasses model validation — traversal ids can no longer write outside the inbox
- promotion._filename_token: any sanitised id maps to a content hash — 'e/vil'
  can no longer clobber the distinct id 'evil' (restarbeid-funn 2)
- SDK pinned >=0.2.111,<0.3 + version guard test naming the sdk_client.py
  attribute premises; resolved 0.2.120, all premises re-verified against it
- sdk_client read loop bound offline with REAL SDK message types (R-4/R-5):
  text aggregation, error fail-paths, usage/cost extraction, _total_tokens
  fail-closed, non-positive budget guard
- test_sdk_isolation comment no longer claims the --system-prompt ""
  serialization the test body does not bind (honesty rule §1)

Guard-G2 assessment (guard-plan §4): the allowlist + caps + id grammar landed
here are G2's necessary part; an optional scan_output depth pass over
rationale (still a verbatim prose channel into the fold prompt, R-9) remains
relevant as a later additive session — the trigger picture is unchanged.

4 detach proofs red → restored green. Full gate: 389 passed (365→389),
ruff+format+mypy clean; golden + shared/ + runs/s10/ byte-untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/portfolio_optimiser_claude/inbox.py

@@ -7,14 +7,20 @@ Role split (§3 Step 7, unwaivable): the system READS the inbox (tolerant load,
 merge into the store); writing is the authoring primitive's job, used only by
 the expert/persona side — a run never persists its own captured verdict back.
 
-Decision vocabulary at this layer: the file carries the expert decision as a
-plain string — the run-path feedback contract (§4.1) and the promotion gate's
-accepted set (§6) are where the vocabulary is policed, not the raw file layer.
+Decision vocabulary at this layer (C2.5, C-F7): loading polices the §4.2 set
+{approved, rejected, approved_with_adjustment} with SKIP semantics — an
+unknown decision never reaches the store, but never raises either (the raw
+layer is written out of band). The run-path feedback contract (§4.1) and the
+promotion gate's accepted set (§6) police their own vocabularies on top.
+Capacity is the exception to tolerance: an inbox over the file cap, or a
+rationale over the length cap, FAILS FAST with a precise error — a silent
+skip there would silently drop expert knowledge (never a silent cut).
 """
 
 from __future__ import annotations
 
 import json
+import re
 from pathlib import Path
 
 from pydantic import BaseModel, Field, ValidationError
@@ -26,6 +32,23 @@ from portfolio_optimiser_claude.experience import (
     mint_verdict_id,
 )
 
+# R-6 id grammar — mirrors ingest.py's _ID_RE: lowercase alphanumerics and
+# hyphens only, so a verdict id can NEVER traverse paths (no dots, no
+# separators). Minted ids (16 hex chars, §4.2) always match.
+_ID_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
+
+# §4.2: the file layer's full decision vocabulary.
+_FILE_DECISIONS = frozenset({"approved", "rejected", "approved_with_adjustment"})
+
+# Fail-fast capacity defaults — generous for any real expert inbox, small
+# enough that a runaway writer cannot flood the fold.
+_DEFAULT_MAX_FILES = 1_000
+_DEFAULT_MAX_RATIONALE_CHARS = 20_000
+
+
+class InboxLimitError(ValueError):
+    """An inbox cap was exceeded — refusing to load (fail-fast, never a silent cut)."""
+
 
 class ProposalFeatures(BaseModel):
     """§4.2 ``proposal_features``: the structural features of the judged candidate.
@@ -43,7 +66,7 @@ class ProposalFeatures(BaseModel):
 class VerdictDocument(BaseModel):
     """One verdict file (§4.2). A LOADED ``id`` is kept verbatim — never re-minted."""
 
-    id: str = Field(min_length=1)
+    id: str = Field(min_length=1, pattern=_ID_RE.pattern)
     decision: str = Field(min_length=1)
     rationale: str = Field(min_length=1)
     proposal_features: ProposalFeatures
@@ -90,8 +113,16 @@ def write_verdict(inbox_dir: Path, verdict: VerdictDocument) -> Path:
     """The authoring primitive (§5): ``{id}.json``, written deterministically.
 
     Creates the directory if needed; sorted keys, 2-space indent. The disk
-    layer is LAST-write-wins per file (§4.2).
+    layer is LAST-write-wins per file (§4.2). The id grammar is re-checked
+    HERE (R-6): ``model_copy(update=...)`` bypasses model validation, so the
+    write seam fails closed on its own — nothing is ever written outside
+    ``inbox_dir``.
     """
+    if _ID_RE.fullmatch(verdict.id) is None:
+        raise ValueError(
+            f"refusing to write verdict: id {verdict.id!r} violates the id grammar "
+            f"{_ID_RE.pattern!r} (R-6 path safety)"
+        )
     inbox_dir.mkdir(parents=True, exist_ok=True)
     path = inbox_dir / f"{verdict.id}.json"
     payload = json.dumps(verdict.model_dump(), sort_keys=True, indent=2)
@@ -99,34 +130,67 @@ def write_verdict(inbox_dir: Path, verdict: VerdictDocument) -> Path:
     return path
 
 
-def load_inbox(inbox_dir: Path) -> list[VerdictDocument]:
+def load_inbox(
+    inbox_dir: Path,
+    *,
+    max_files: int = _DEFAULT_MAX_FILES,
+    max_rationale_chars: int = _DEFAULT_MAX_RATIONALE_CHARS,
+) -> list[VerdictDocument]:
     """Tolerant load (§5): the raw layer is written out of band — skip, never raise.
 
     A missing folder yields zero verdicts; files that are not ``.json``, fail
-    to parse, or lack a required top-level key are SKIPPED. Deterministic
-    order: sorted by filename.
+    to parse, lack a required top-level key, violate the id grammar, or carry
+    a decision outside the §4.2 vocabulary are SKIPPED. Deterministic order:
+    sorted by filename. The caps are the one place tolerance ends: more
+    candidate files than ``max_files``, or a rationale longer than
+    ``max_rationale_chars``, raises :class:`InboxLimitError` (C2.5).
     """
     if not inbox_dir.is_dir():
         return []
+    paths = [
+        path
+        for path in sorted(inbox_dir.iterdir(), key=lambda p: p.name)
+        if path.suffix == ".json" and path.is_file()
+    ]
+    if len(paths) > max_files:
+        raise InboxLimitError(
+            f"inbox {inbox_dir} holds {len(paths)} verdict files, over the cap of "
+            f"{max_files} — refusing to load"
+        )
     verdicts: list[VerdictDocument] = []
-    for path in sorted(inbox_dir.iterdir(), key=lambda p: p.name):
-        if path.suffix != ".json" or not path.is_file():
-            continue
+    for path in paths:
         try:
-            verdicts.append(VerdictDocument.model_validate(json.loads(path.read_text("utf-8"))))
+            document = VerdictDocument.model_validate(json.loads(path.read_text("utf-8")))
         except (OSError, ValueError, ValidationError):
             continue
+        if document.decision not in _FILE_DECISIONS:
+            continue  # §4.2 vocabulary (C-F7): unknown decision → SKIP, never the store
+        # Outside the tolerant try on purpose — a cap breach must NEVER be
+        # swallowed as one more skipped file.
+        if len(document.rationale) > max_rationale_chars:
+            raise InboxLimitError(
+                f"verdict file {path.name} carries a rationale of "
+                f"{len(document.rationale)} chars, over the cap of "
+                f"{max_rationale_chars} — refusing to load"
+            )
+        verdicts.append(document)
     return verdicts
 
 
-def merge_inbox_into_store(store: VerdictStore, inbox_dir: Path) -> int:
+def merge_inbox_into_store(
+    store: VerdictStore,
+    inbox_dir: Path,
+    *,
+    max_files: int = _DEFAULT_MAX_FILES,
+    max_rationale_chars: int = _DEFAULT_MAX_RATIONALE_CHARS,
+) -> int:
     """Merge, never replace (§5): per-verdict add, first-write-wins per id.
 
     Runs BEFORE the Step-1 fold, so a passed-in store's existing verdicts
     survive (cross-project threading) and repeated merges are idempotent.
     Returns the number of inbox verdicts ingested; never writes anything.
     """
-    verdicts = load_inbox(inbox_dir)
+    verdicts = load_inbox(inbox_dir, max_files=max_files, max_rationale_chars=max_rationale_chars)
     for verdict in verdicts:
         store.add(verdict.to_record())
     return len(verdicts)

src/portfolio_optimiser_claude/promotion.py

@@ -32,10 +32,12 @@ class PromotionError(ValueError):
 
 
 def _filename_token(verdict_id: str) -> str:
-    # Path-safe, fail-closed against escaping names: sanitise to the safe
-    # alphabet; a degenerate token falls back to a content hash.
+    # Path-safe, fail-closed against escaping names: an id that survives the
+    # safe alphabet unchanged keeps its name; ANY id the sanitiser had to
+    # touch maps to a content hash instead (C2.5) — stripping alone let
+    # 'e/vil' collide onto the same promoted file as the distinct id 'evil'.
     token = _TOKEN_UNSAFE.sub("", verdict_id)
-    if not token.strip("."):
+    if token != verdict_id or not token.strip("."):
         token = hashlib.sha256(verdict_id.encode("utf-8")).hexdigest()[:16]
     return token
 

src/portfolio_optimiser_claude/sdk_client.py

@@ -9,11 +9,13 @@ turn, a first-class USD cap (``ClaudeAgentOptions.max_budget_usd``) ON TOP of
 the §8 token/round meter that the loop already charges, and NO filesystem
 settings (``setting_sources=[]``).
 
-Verified against claude-agent-sdk 0.2.110: ``query()`` yields
-``AssistantMessage`` (text blocks + real model id) and a closing
-``ResultMessage`` (provider-reported ``usage`` + ``total_cost_usd``). A reply
-without usage is passed through as ``None`` so the meter fails CLOSED (§8) —
-this client never invents a count.
+Verified against claude-agent-sdk 0.2.110 at source level and release notes
+through 0.2.120 — pinned ``>=0.2.111,<0.3`` with a version guard
+(``tests/test_sdk_version_guard.py``) that forces re-verification of these
+premises before any widening: ``query()`` yields ``AssistantMessage`` (text
+blocks + real model id) and a closing ``ResultMessage`` (provider-reported
+``usage`` + ``total_cost_usd``). A reply without usage is passed through as
+``None`` so the meter fails CLOSED (§8) — this client never invents a count.
 """
 
 from __future__ import annotations