@@ -335,15 +335,15 @@ The storage schema is intentionally narrow:
 ### Protobuf API and storage boundaries
 
 Public RPC contracts and durable protobuf formats have separate ownership. The
-`openshell.v1.OpenShell` service currently has 74 RPCs. Their request and
+`openshell.v1.OpenShell` service currently has 75 RPCs. Their request and
 response roots, streaming flags, and transitive message closure come from the
 public descriptor set generated by `openshell-core`; a fingerprint test in
 `openshell-server` requires this inventory to be reviewed whenever it changes.
 Compute-driver, credential-driver, gateway-interceptor, and
 supervisor-middleware services are compiled contracts for internal extension
-boundaries, not public gateway RPCs. The current public inventory has 74
-methods, 278 messages, and 12 enums
-(`8ac68c71d93e6a5e56406b8df1882ee40c6066270969e03eb99803f0e6396fc1`).
+boundaries, not public gateway RPCs. The current public inventory has 75
+methods, 281 messages, and 13 enums
+(`068073560e3ae5164826a2cae4f72095cabaac5011516aedb3c72f6c78e2867b`).
 The removed `NetworkBinary.harness` field remains reserved by number and name,
 so protobuf implementations cannot reuse its wire slot or source identifier.
 The durable-policy compatibility decoder reads the former boolean before Prost
@@ -363,13 +363,21 @@ Go, Python, and TypeScript client generation inputs do not advertise them.
 | Public messages used directly as encoded storage roots | `Sandbox`, `SandboxWorkloadTemplate`, `Provider`, `Workspace`, `WorkspaceMember`, `SshSession`, `ServiceEndpoint` | The generated public type is also the persisted payload. `SshSession` is not in the current public RPC message closure. |
 | Embedded encoded root | `SandboxPolicy` | Stored in policy rows and inside the JSON settings envelope. |
 
-The 12 encoded durable roots above have a closure of 81 messages and eight
-enums (`369b36511c2e38b9df9621704a00123516c7538d8ee89a499158d7de5cee1882`).
-Its intersection with the public RPC closure contains 71 messages and eight
-enums (`05add438ba041defc98d791038ae593d3f09352677cae43f2276d494205ce415`).
+The 12 encoded durable roots above have a closure of 82 messages and nine
+enums (`19ea13ee6ca6d84beb8e2b4aa3d6532fabd44b6e88c315879b23ffc4987266d3`).
+Its intersection with the public RPC closure contains 72 messages and nine
+enums (`68127e24cdb88b67433f68c4a1443c22a322f37ed1225b7547614a96f768cfac`).
 The descriptor-derived test owns these full inventories; the tables here record
 the reviewed roots and classifications.
 
+Configuration admission adds `SandboxStatus.configuration_admission` at field
+10 and optional `configuration_activated` at field 11, extending the public and
+durable closures. New sandboxes explicitly store `false` until first acceptance;
+acceptance stores `true` permanently, including across restart. Legacy rows
+have neither field and conservatively retain static-policy restrictions. No
+database rewrite is required. A pre-admission byte fixture verifies that legacy
+phase and policy-version fields survive without fabricated admission or activation.
+
 | Dual-purpose encoded root | Current decision |
 |---|---|
 | `Sandbox` | Defer a storage twin; govern its complete dependency closure as durable. |
 
@@ -488,6 +488,9 @@ condition, even when the container backend reports readiness. Gateway management
 operations remain available. Replacing the policy or repairing providers allows
 the same supervisor to reconcile and launch; it does not recreate the sandbox.
 Static policy fields can be replaced before the first accepted activation.
+A durable first-activation marker closes this repair window permanently, including
+across stop/start and later rejected configurations. Legacy records without the
+marker retain static-field immutability.
 Admission validates policy composition; image and host setup failures, such as
 an unresolved OCI user or unavailable isolation facilities, retain their existing
 startup error behavior.
@@ -497,7 +500,10 @@ provider-environment revision, and reporting supervisor instance. Startup captur
 the matching provider environment and constructs the runtime before reporting
 acceptance. Live reconciliation begins only after the main process has spawned,
 so it cannot replace the configuration captured for that launch. Restart resets
-admission and requires a fresh accepted configuration.
+admission and requires a fresh accepted configuration. Permanent gateway errors
+and exhausted transient retries terminate startup; only acknowledged configuration
+rejections wait indefinitely for repair. Process-sidecar discovery uses the
+existing sidecar readiness timeout.
 
 Policy and provider refreshes are prepared before publication. Publication
 invalidates prior policy guards before exposing new provider material and swaps
 
@@ -39,6 +39,15 @@ use tonic::service::interceptor::InterceptedService;
 use tonic::transport::{Certificate, Channel, ClientTlsConfig, Endpoint, Identity};
 use tracing::{debug, info, warn};
 
+/// Preserve the gRPC status as a source so callers can classify retryable errors.
+/// `IntoDiagnostic` alone hides the wrapped error's concrete type.
+pub fn grpc_status_error(status: Status) -> miette::Report {
+    #[derive(Debug, thiserror::Error, miette::Diagnostic)]
+    #[error("{0}")]
+    struct GrpcStatusError(#[source] Status);
+    GrpcStatusError(status).into()
+}
+
 /// Channel type after the [`AuthInterceptor`] is applied. Aliased so the
 /// generated client type signatures stay readable.
 pub type AuthedChannel = InterceptedService<Channel, AuthInterceptor>;
@@ -720,7 +729,7 @@ async fn fetch_settings_snapshot_with_client(
             sandbox_id: sandbox_id.to_string(),
         })
         .await
-        .into_diagnostic()?;
+        .map_err(grpc_status_error)?;
 
     Ok(settings_poll_result(response.into_inner()))
 }
@@ -757,7 +766,7 @@ async fn sync_policy_with_client(
             ..Default::default()
         })
         .await
-        .into_diagnostic()
+        .map_err(grpc_status_error)
         .wrap_err("failed to sync policy to server")?;
 
     Ok(())
@@ -852,7 +861,7 @@ pub async fn report_sandbox_configuration(
             }),
         })
         .await
-        .into_diagnostic()?;
+        .map_err(grpc_status_error)?;
     Ok(())
 }
 
@@ -875,7 +884,7 @@ pub async fn fetch_provider_environment(
             supports_static_credential_bindings: true,
         })
         .await
-        .into_diagnostic()?;
+        .map_err(grpc_status_error)?;
 
     let inner = response.into_inner();
     Ok(ProviderEnvironmentResult {