diff --git a/CHANGELOG.md b/CHANGELOG.md
index 10062cc..87675bd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -99,6 +99,37 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   silently stops being reachable for a device that did not already know it was
   there. Verified discriminating with a reworded negative control.
 
+### Changed
+
+- **`confirm-destructive` steps aside when another extension claims the bash
+  check** (pi-extensions `7237855`; CI resolves `main` at build time). pi runs
+  `tool_call` hooks one after another until one blocks. With a second command
+  gate loaded, `confirm-destructive` still asked about every command that
+  gate let through, and its question has no time limit. So an unattended
+  session could stop at it anyway. Every new `devbox-pi-config` volume gets
+  `confirm-destructive` switched on. Such a second gate exists: the fleet's
+  `erdc-guard` (private, mounted from `/opt/fleet-pi`).
+  - **How the claim works.** An extension sets
+    `globalThis[Symbol.for("pi-extensions.bash-gate")] = { owner: "<name>" }`.
+    While it is set, `confirm-destructive` skips its bash check. Its `/new`,
+    `/resume` and `/fork` questions are unchanged. With no claim it behaves
+    exactly as before. `confirm-destructive.ts` now also exports
+    `BASH_GATE_KEY`, which tells a claimer this version honours the claim.
+  - **An outside user of `matchesDangerous()`.** The file now notes that
+    `erdc-guard` imports it, as its fallback, from
+    `/opt/pi-extensions/extensions/confirm-destructive.ts`. That path and both
+    names must stay.
+  - **Tests.** `node --test test/confirm-destructive.test.mjs` in pi-extensions
+    `7237855` runs the real default export with a stand-in for pi: 4 tests, 4
+    pass. Without the line that steps aside, 3 pass and 1 fails. Whole suite:
+    51 pass.
+  - **Measured in pi 1.4.0 (2026-10-24),** with both extensions loaded in
+    either order: `sudo -n true` ran with `7237855` and was blocked by
+    v1.12.2's `4c1d28d`.
+  - **On v1.12.2 and older images** `confirm-destructive` ignores the claim.
+    There, switch it off once per volume with `/ext`; the image keeps a
+    `.ts.off` link off at every start.
+
 ### Fixed
 
 - **CI: a smoke job's image could be deleted mid-test by another job's disk