Record privileged action failure evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306

SCOPE.md

@@ -110,6 +110,10 @@ cannot be recovered through that AppRole.
   event on a best-effort basis. Each requested State Hub delivery receives an
   append-only local `delivered`, `failed`, or `skipped-no-topic` companion
   record.
+- Every live privileged CLI handler records an attempt before lane-approval
+  resolution and a terminal success, verification failure, rejection,
+  interruption, or typed backend/input failure. Failure evidence contains the
+  exception class and approval state, never exception prose.
 - `audit` summarizes allowlisted local lane evidence: action/result counts,
   canonical decision references, session cleanup outcomes, and State Hub
   delivery outcomes. It never re-emits arbitrary evidence detail.
@@ -117,7 +121,7 @@ cannot be recovered through that AppRole.
 
 State Hub evidence delivery is not queued or transactional; the local receipt
 makes failure visible but does not replay it. Route and audit do not replace
-authorization, OpenBao audit logs, or unrelated-identity denial evidence.
+exact-action authorization or OpenBao audit logs.
 Treat their output as operational guidance, not complete attestation for
 high-risk lanes.