# Forge 4.0.9 — restore existing checkout workflows

Removes the unintended mandatory re-approval workflow introduced alongside memory bounding. Existing Anvil rules with complete content and matching hash remain usable when newer disposition/reviewer metadata is absent. No records are silently approved, rewritten or reclassified. Explicit pending/rejected rules, missing safety context, invalid hashes and explicit revocations remain enforced.

Native user-directed work does not require a separately created or reviewed database mission. A successful checkout reconstructs context; the current user's instruction supplies the task within existing permissions and restrictions. Ownership is not permission to invent work. Removed assignments are explicitly removed on refresh; old conversation does not restore them. Hammer likewise accepts current Director instructions without requiring a stored mission.

Legacy classification queues remain available on demand, not automatic context or blanket startup gates. No bulk historical review is required to start unrelated work. Relevant evidence and any real conflict still need evaluation before the affected action. The optional administration review API and its history remain preserved; explicit assignment revocations stay binding.

Invitation failures report a safe connection stage and HTTP status when available, without claiming that engineer authority was invalidated. An unreachable endpoint is reported as ANVIL_CONNECTION_FAILED; this can include missing VPN, routing or TLS problems and does not by itself identify which. Existing connections are not reset. No credentials or invitation contents are returned in diagnostics.

Archive/restore from 4.0.8 is retained. Output bounds, mandatory context completeness, access control, organization isolation, exclusive leases, TLS pinning and existing SSH host-key checking are unchanged. No Spark enrollment or new connection approval is required.

Install the matched Anvil, Hammer and Connect 4.0.9 payloads after backing up the existing Anvil database and binaries. Open a fresh Codex session after updating Connect so the corrected skill/tools load. Do not reapprove rules, bulk-reclassify history or create fake missions simply to make checkout pass.

Rollback: retain the complete pre-upgrade database and matched prior binaries. Review/archive evidence must not be deleted to manufacture downgrade compatibility. This release makes no customer-data migration. Publication and customer deployment require authorization; controlled staging is not external-customer acceptance.