@gaunt-sloth/core 2.0.0-alpha.29 → 2.0.0-alpha.30

package/dist/core/GthAgentRunner.js

@@ -1,12 +1,17 @@
-import { DEFAULT_APPROVAL_RUNG, describeGrantedBuiltInTools, isRatedRung, resolveApprovals, resolveShellApprovalGate, SHELL_TOOL_NAME, TOOL_ANNOTATION_HINTS, } from '#src/config.js';
+import { DEFAULT_APPROVAL_RUNG, describeGrantedBuiltInTools, isNegotiatingRung, isRatedRung, isToolGatedAtRung, resolveApprovals, resolveGatedToolNames, resolveShellApprovalGate, SHELL_TOOL_NAME, TOOL_ANNOTATION_HINTS, } from '#src/config.js';
 import { StatusLevel, } from '#src/core/types.js';
 import { GthLangChainAgent } from '#src/core/GthLangChainAgent.js';
 import { annotationWeakenings, ApprovalGrantStore, describeWeakenedGrant, PersistedApprovalGrants, shellGrantEntry, toolGrantEntry, trustWithdrawalWeakens, } from '#src/core/approvals/grants.js';
 import { renderApprovalEntryObject } from '#src/config/schema.js';
 import { classifyCommand } from '#src/core/shell/arity.js';
+import { describeAbstention } from '#src/core/shell/abstention.js';
 import { normalizeCommand } from '#src/core/shell/normalize.js';
 import { ApprovalStopError, AttackHaltError, NonInteractiveEscalationError, } from '#src/core/shell/approvalStop.js';
-import { applyDestructiveFloor, isRaterTimeout, mapAllowMatchedVerdictToAction, mapVerdictToAction, openWorldToolFloorReason, RATER_DEFAULT_TIMEOUT_MS, rateShellCommand, } from '#src/core/shell/rater.js';
+import { applyDestructiveFloor, isBelowDestructiveFloor, isRaterTimeout, mapAllowMatchedVerdictToAction, mapVerdictToAction, openWorldToolFloorReason, preflightFloorFinding, RATER_DEFAULT_TIMEOUT_MS, rateShellCommand, } from '#src/core/shell/rater.js';
+import { ApprovalCaptureLog, } from '#src/core/shell/approvalCapture.js';
+import { buildHardlineRefusal, checkHardline } from '#src/core/shell/hardline.js';
+import { renderNegotiationTranscript, ShellNegotiationState } from '#src/core/shell/negotiation.js';
+import { buildRejectionMessage } from '#src/core/shell/rejection.js';
 import { describeApprovalEntry, resolveApprovalRules, } from '#src/core/approvals/matcher.js';
 import { createEffectiveToolAnnotationSource, trustedAnnotationHints, } from '#src/core/approvals/annotations.js';
 import { approvalSubjectForToolName } from '#src/core/approvals/mcpSubjects.js';
@@ -37,6 +42,80 @@ function copyApprovalEntry(entry) {
         return { ...entry };
     return { ...entry, pattern: { ...entry.pattern } };
 }
+/**
+ * [[EXT-29]] §5.1 — the `justification` argument of a `run_shell_command` call, when the model
+ * supplied a usable one.
+ *
+ * Read defensively for the same reason `command` is: these are model-authored arguments arriving
+ * through a schema the graph validated but that this method does not re-validate, so a non-string
+ * or a whitespace-only value is *absent* rather than a second spelling of empty.
+ *
+ * **What the trim buys is the RECORDED ROUND, not the prompt.** The rating prompt is already safe
+ * without it — `buildNegotiationContextBlock` drops a blank justification before it renders a fence,
+ * and `renderNegotiationTranscript` drops one before it renders a line. What only this can do is
+ * keep the round itself honest at the point it is written: a round carrying a whitespace-only
+ * justification asserts that the agent argued something it did not, to everything that later reads
+ * the transcript rather than a rendering of it. Both downstream guards then stay defence in depth
+ * instead of being the only thing between a blank string and that claim.
+ */
+function shellJustification(args) {
+    const value = args?.justification;
+    if (typeof value !== 'string')
+        return undefined;
+    return value.trim().length === 0 ? undefined : value;
+}
+/**
+ * [[EXT-29]] §5.1 — the text of the human messages in a turn's input, for the rater's last-5 window.
+ *
+ * Structural and fail-soft, like `runStats`'s accumulator: the runner is handed `BaseMessage`s from
+ * several surfaces (readline, TUI, ACP, AG-UI) and a multimodal turn's `content` is an array of
+ * blocks rather than a string. Only the text is taken — §4.3 admits no file contents, no tool
+ * output and no fetched pages, and an image block is none of the three.
+ */
+function humanMessageTexts(messages) {
+    const texts = [];
+    for (const message of messages) {
+        try {
+            const type = message?.getType?.();
+            if (type !== 'human')
+                continue;
+            const content = message.content;
+            if (typeof content === 'string') {
+                texts.push(content);
+                continue;
+            }
+            if (!Array.isArray(content))
+                continue;
+            const parts = content
+                .filter((block) => typeof block === 'object' &&
+                block !== null &&
+                block.type === 'text' &&
+                typeof block.text === 'string')
+                .map((block) => block.text);
+            if (parts.length > 0)
+                texts.push(parts.join('\n'));
+        }
+        catch {
+            /* fail-soft: an odd message shape just means that message contributes nothing */
+        }
+    }
+    return texts;
+}
+/**
+ * GS2-81 — the page carrying WHICH commands honor `agent.backend`, pointed at rather than
+ * enumerated in the notice itself.
+ *
+ * The list belongs in exactly one place. A copy of it inside a runtime string is a second source of
+ * truth with nothing pinning it: the first draft of this notice already disagreed with the docs
+ * table written in the same commit (it omitted `workflow` agent steps), and no test could tell,
+ * because a sentence is not a claim a test can check. The docs table is checkable, and
+ * `agentBackendScope.spec.ts` pins that this URL's anchor still resolves to a real heading in it.
+ *
+ * **A GitHub blob URL, matching the other user-facing runtime doc links in this repo** (the
+ * approvals-protection pointer in `config/shell-policy.ts` and the 2.0 migration pointer in
+ * `config/schema.ts`) — a running CLI's user has no checkout for a relative path to resolve in.
+ */
+export const AGENT_BACKEND_SCOPE_DOCS_URL = 'https://github.com/pukeko-robotics/gaunt-sloth/blob/main/docs/configuration/profiles.md#which-commands-honour-it';
 /**
  * Agent simplifies interaction with LLM and reduces it to calling a few methods
  * {@link GthAgentRunner#init} and {@link GthAgentRunner#processMessages}.
@@ -55,6 +134,14 @@ export class GthAgentRunner {
      * for non-interactive entrypoints (a scripted `exec` run with no TTY to prompt on).
      */
     toolApprovalCallback = null;
+    /**
+     * [[TUI-C68]] §6.1 — consumer hook invoked when the rater rates a command an `attack`, so an
+     * interactive surface can show the red banner before the run ends. Set via
+     * {@link setAttackHaltCallback}; **when unset the runner halts immediately**, which is the
+     * behaviour every surface had before a banner existed. A surface that forgets to wire it
+     * therefore keeps the halt rather than losing it.
+     */
+    attackHaltCallback = null;
     /** The command the runner was initialized for; selects which `devTools` config applies. */
     command = undefined;
     /**
@@ -67,9 +154,11 @@ export class GthAgentRunner {
     /**
      * CFG-27 — the runtime, session-scoped approvals posture, seeded at {@link init} from
      * {@link resolveApprovals} and thereafter switchable for the session by `/approvals <rung>`.
-     * The shell tool stays gated (in `interruptOn`) at EVERY rung, so this is consulted at the top
-     * of {@link decideToolApproval} and a config that pre-selects `bypass` remains switchable back
-     * mid-session. Never persisted.
+     * **This field, not the interrupt wiring, is where the rung lives.** The backends wire the
+     * interrupt rung-independently, so every tool any rung could gate arrives at the top of
+     * {@link decideToolApproval} and is judged against the rung recorded here — which is what makes
+     * `/approvals manual` take effect mid-session, and what keeps a config that pre-selects
+     * `bypass` switchable back. Never persisted.
      *
      * It does NOT disable the hardline floor — catastrophic commands are still refused at exec time
      * in `GthDevToolkit.executeCommand` under every rung.
@@ -113,15 +202,38 @@ export class GthAgentRunner {
      */
     persistedGrants = null;
     persistedGrantsLoaded = false;
+    /**
+     * [[EXT-29]] §5 — the state of the agent↔rater negotiation at `auto`: the transcript, §5.3's
+     * consecutive-rejection counter and the reachability bound. Instance-scoped for the same reason
+     * the grant stores are — a concurrent ACP / AG-UI session must not inherit another's argument.
+     */
+    negotiation = new ShellNegotiationState();
+    /**
+     * [[TUI-C27]] — the diagnostic record of every gated decision this session made, for
+     * `/debug-dump`. Instance-scoped for the same reason the negotiation and the grant stores are: a
+     * concurrent ACP / AG-UI session must not inherit another's approvals history, and a dump taken
+     * in one must not describe the other.
+     */
+    approvalCaptures = new ApprovalCaptureLog();
+    /**
+     * GS2-81 — whether the caller supplied a backend factory. When it did NOT, this runner is
+     * hard-wired to the lean default below, so a config asking for `agent.backend: 'deep'` cannot be
+     * honored no matter what it says. Recorded here (rather than inferred later) because by then the
+     * fallback has already collapsed both cases into one function.
+     */
+    backendFactorySupplied;
     /**
      * @param agentFactory Produces the {@link GthAgentInterface} the runner drives.
      *   Defaults to the lean {@link GthLangChainAgent} (core). `@gaunt-sloth/agent`
      *   passes a factory returning a deep `GthDeepAgent` so the same runner can drive a
      *   `createDeepAgent` graph without core depending on deepagents.
+     *   **Omitting it opts the caller out of `agent.backend`** — see {@link init}, which says so out
+     *   loud rather than letting the key be dropped in silence.
      */
     constructor(statusUpdate, resolvers, agentFactory) {
         this.statusUpdate = statusUpdate;
         this.resolvers = resolvers;
+        this.backendFactorySupplied = agentFactory !== undefined;
         this.agentFactory =
             agentFactory ?? ((status, agentResolvers) => new GthLangChainAgent(status, agentResolvers));
     }
@@ -133,6 +245,58 @@ export class GthAgentRunner {
     setToolApprovalCallback(callback) {
         this.toolApprovalCallback = callback;
     }
+    /**
+     * [[TUI-C68]] §6.1 — register the handler that shows the **attack banner**, the one way a human
+     * gets past an `attack` verdict. Pass `null` to clear.
+     *
+     * Separate from {@link setToolApprovalCallback} because it is a separate question with an
+     * inverted default: an absent approval callback means *this session has nobody to ask*, and an
+     * absent one here means *end the run*. Wiring it is what an interactive surface opts into; every
+     * other surface keeps the halt (see {@link attackHaltCallback}).
+     */
+    setAttackHaltCallback(callback) {
+        this.attackHaltCallback = callback;
+    }
+    /**
+     * §6.1 — **the single seam between an `attack` verdict and the end of the run.** Both rating
+     * paths — the §3.2 allow-match tripwire and the ordinary rater decision — go through here, so the
+     * banner cannot be present on one and missing on the other, which is the shape of bug that leaves
+     * a halt answerable in some sessions and not others with nothing on screen to tell them apart.
+     *
+     * It returns a decision for the one answer that grants and throws for everything else:
+     *
+     * - **no callback → throw**, immediately and unchanged. §6.2's rule is that a run with nobody to
+     *   ask never blocks and never times out into a grant; the way that is guaranteed is that waiting
+     *   is something only a wired surface can cause.
+     * - **`run-anyway` → approve, scope `once`.** Exactly one command runs. `once` is not a default
+     *   restated: it is what keeps §6.1's three "never"s true. Returning here is also returning from
+     *   *before* the block that records a sticky grant, so no allow-list entry and no session grant
+     *   can be written on this path — the next identical call is rated again and reaches this banner
+     *   again. Nothing here touches the rung, and nothing disables the rater, the escalation or the
+     *   halt for anything else.
+     * - **anything else → throw.** `stop`, and equally a value a surface invents or forgets to
+     *   return: the grant is one exact answer and everything else is a refusal.
+     */
+    async haltOrRunAnyway(command, reason, 
+    /** [[TUI-C27]] — this decision's record; the banner's answer is a HUMAN's answer. */
+    record) {
+        if (this.attackHaltCallback) {
+            const answer = await this.attackHaltCallback({ command, reason });
+            // [[TUI-C27]] — **recorded here, or a run-anyway is indistinguishable from a `safe`
+            // rating.** The banner returns an ordinary approval, so without this line the archive would
+            // show `approve` at the `rater` stage with nobody named — i.e. the rater appearing to have
+            // approved a command it called an attack. That is precisely the misattribution this node
+            // exists to remove, on the branch where it costs the most.
+            record.humanAnswer = answer === 'run-anyway' ? 'approve' : 'reject';
+            if (answer === 'run-anyway')
+                return { type: 'approve', scope: 'once' };
+        }
+        else {
+            // §6.2 — no surface wired the banner, so nobody was asked and the run ends.
+            record.humanAnswer = 'no-human';
+        }
+        throw new AttackHaltError(command, reason);
+    }
     /**
      * CFG-27 — switch the session-scoped rung (`/approvals <rung>`). Idempotent; returns the NEW
      * rung so the caller can render a notice. Session-scoped only — nothing is written to config,
@@ -146,6 +310,17 @@ export class GthAgentRunner {
     getSessionApprovals() {
         return this.sessionApprovals;
     }
+    /**
+     * [[TUI-C27]] — every gated decision this session made, oldest first, for the `/debug-dump`
+     * archive.
+     *
+     * Threaded by each surface into `writeDebugDump`, exactly as `agent.lastModelRequest` is: the
+     * writer redacts it with the same pass it applies to every other artifact, and a surface that
+     * does not thread it simply omits the file.
+     */
+    getApprovalCaptures() {
+        return this.approvalCaptures.snapshot();
+    }
     /**
      * CFG-26 — the allow-list sizes for the `/approvals` display: how many command prefixes the
      * human has trusted this session, and how many are persisted in the project file.
@@ -327,7 +502,7 @@ export class GthAgentRunner {
      * and we'd better have an instance by that moment, for the case things will go wrong,
      * so we can wrap init into try-catch and then call {@link #cleanup} within finally.
      */
-    async init(command, configIn, checkpointSaver) {
+    async init(command, configIn, checkpointSaver, options) {
         this.config = configIn;
         this.command = command;
         // GS2-48 — register the effective config with the crash handler so an uncaughtException /
@@ -359,7 +534,7 @@ export class GthAgentRunner {
         //
         // Loaded whenever a profile is NAMED, without a second "will the rater actually run?" gate:
         // naming a rater profile at an unrated rung is a config the user can hold (they may switch to
-        // `auto-safe` mid-session with `/approvals`), and a broken profile should still fail loudly at
+        // `assisted` mid-session with `/approvals`), and a broken profile should still fail loudly at
         // startup rather than at the moment they switch.
         const raterProfile = this.sessionApprovals.rater;
         this.raterModel = raterProfile ? await resolveRaterModel(raterProfile) : undefined;
@@ -368,12 +543,37 @@ export class GthAgentRunner {
         debugLog(`Initializing GthAgentRunner with command: ${command || 'default'}`);
         this.runConfig = getNewRunnableConfig();
         debugLogObject('Runnable Config', this.runConfig);
+        this.warnIfBackendCannotBeHonored(configIn, command ?? options?.owningCommand);
         this.agent = this.agentFactory(this.statusUpdate, this.resolvers);
         // Initialize the agent
         debugLog('Initializing agent...');
         await this.agent.init(command, configIn, checkpointSaver);
         debugLog('Agent initialization complete');
     }
+    /**
+     * GS2-81 — `agent.backend` is a COMMAND-SCOPED key, and this is where a command opts out of it.
+     *
+     * A caller that hands the runner no factory gets the lean {@link GthLangChainAgent}, whatever the
+     * config asked for: `agent.backend: 'deep'` is then accepted by the schema, resolved into the
+     * config, and dropped on the floor. `gth review` and `gth pr` are in exactly that position — the
+     * review module builds its runner without one, and `@gaunt-sloth/review` does not depend on
+     * `@gaunt-sloth/agent`, so the deep backend is out of its reach — as is the `gth pr` change-
+     * requirements discovery agent.
+     *
+     * The check lives HERE, on the `agentFactory ?? lean` fallback itself, rather than in a list of
+     * verbs that cannot honor the key: a list is a second source of truth that goes stale the first
+     * time someone adds a command, whereas anything that reaches this fallback is by construction a
+     * run the key cannot reach. `lean` and the unset default need no warning — that IS what runs.
+     */
+    warnIfBackendCannotBeHonored(config, command) {
+        if (this.backendFactorySupplied || config.agent?.backend !== 'deep') {
+            return;
+        }
+        const scope = command ? `the ${command} command` : 'this run';
+        this.statusUpdate(StatusLevel.WARNING, `Config sets agent.backend: deep, but ${scope} always runs the lean backend, so the ` +
+            'setting has no effect here. Which commands honor it: ' +
+            AGENT_BACKEND_SCOPE_DOCS_URL);
+    }
     /**
      * processMessages deals with both streaming and non-streaming approaches.
      */
@@ -385,6 +585,12 @@ export class GthAgentRunner {
         this.resetRunStats();
         // GS2-48 — record this turn's transcript tail for the crash handler.
         updateCrashContext({ transcriptTail: messages.slice(-CRASH_TRANSCRIPT_TAIL_MESSAGES) });
+        // [[EXT-29]] §5 — a new user turn is the human being reached, so it ends any negotiation still
+        // standing from the previous one and clears BOTH bounds. The turn's own messages then enter
+        // §5.1's last-5 window, which is what makes "just the last two" reach the rater at all — the
+        // reply that narrows what the agent proposes is worthless to the gate if only the agent hears it.
+        this.negotiation.humanReached();
+        this.negotiation.noteUserMessages(humanMessageTexts(messages));
         debugLog('Processing messages...');
         debugLogObject('Input Messages', messages);
         try {
@@ -599,19 +805,19 @@ export class GthAgentRunner {
      *    prohibition that catches something unresolvable errs in the direction that costs nothing.
      * 2. **`bypass`** — the gate is off for this session; approve at scope `once`.
      * 3. **escalate** (§3.2) — a declared entry always asks the human, whatever the rung would have
-     *    done, **including outranking the automatic grants of `read-only` and `write`** and any allow
+     *    done, **including outranking the automatic grants of `manual` and `write`** and any allow
      *    entry that also matched. It goes straight to the human with **no rating call**, and it never
-     *    enters the `full-auto` negotiation. It is **inert at `bypass`**, which is why it sits below
+     *    enters the `auto` negotiation. It is **inert at `bypass`**, which is why it sits below
      *    the rung check: the rung chosen for this session wins, and a stop that must survive `bypass`
      *    is a deny entry and only that.
      * 4. **allow** (§3, §3.2) — a declared entry or a grant the human made at an earlier prompt this
      *    session (or persisted), matched against the whole normalized command and only when that
      *    command statically resolves. An allow match settles the human's part: no prompt. Whether the rater
      *    still reviews the call is the entry's own `rate` (§3.2) — honored at the rater rungs and
-     *    inert at the deterministic ones, so no entry can smuggle a model call into `read-only` or
+     *    inert at the deterministic ones, so no entry can smuggle a model call into `manual` or
      *    `write` — and a rated allow match is a TRIPWIRE, not a re-adjudication
      *    ({@link mapAllowMatchedVerdictToAction}).
-     * 5. **auto-rater** (`auto-safe` / `full-auto` only) — `safe` approves, `destructive` and
+     * 5. **auto-rater** (`assisted` / `auto` only) — `safe` approves, `destructive` and
      *    `catastrophic` escalate, and `attack` HALTS the run ({@link AttackHaltError}). The other
      *    three rungs consult no model at all. A command whose target the gate cannot statically
      *    resolve is rated **exactly like any other** ([[EXT-81]]), with a neutral note in the rating
@@ -636,11 +842,100 @@ export class GthAgentRunner {
      * Hardline catastrophic commands remain refused at exec time regardless of any approval here
      * (defense in depth in `GthDevToolkit.executeCommand`), so an allow-listed `rm -rf /` still
      * cannot run.
+     *
+     * **Step 0 is the rung.** The backends wire the interrupt over every tool ANY rung could gate,
+     * because the graph is built once and `/approvals <rung>` moves the rung under it for the rest of
+     * the session. So a call arriving here has not yet been judged against the rung in force: this is
+     * where that happens, on `sessionApprovals.rung`, which a mid-session switch has already updated.
+     * A call the live rung does not gate is approved on the spot — no rule matching, no rating, no
+     * prompt — which is what keeps `assisted`, `auto` and `bypass` behaving exactly as they did
+     * when the interrupt held the shell alone. It sits ABOVE the deny check for the same reason: an
+     * ungated call never reached this method at all before, so a deny entry could not fire on one, and
+     * a security fix for two rungs is not the place to change that. (The shell is gated at every rung
+     * whenever the shell gate is on, so §2.5's rule that the deny list survives `bypass` is untouched.)
      */
     async decideToolApproval(tool) {
+        // [[TUI-C27]] — the record is opened (and already in the log) BEFORE the decision runs, and
+        // filled in as it goes. Assembling it at the end would lose the calls most worth keeping: an
+        // `attack` verdict throws `AttackHaltError` out of the decision, so a halted run would carry no
+        // record of the rating that halted it — and an approval, which relays nothing to anyone, is
+        // exactly the branch that used to leave no trace at all.
+        const record = this.approvalCaptures.begin({
+            at: new Date().toISOString(),
+            tool: tool.name,
+            ...(typeof tool.args?.command === 'string' ? { command: tool.args.command } : {}),
+            rung: this.sessionApprovals.rung,
+            budget: this.negotiation.counters(),
+        });
+        const decision = await this.recordedDecision(tool, record);
+        // [[EXT-29]] §5.3 — **the reset, at the one site that sees every approval.** "A successful
+        // intervening tool call — the agent going away to gather information and returning better
+        // informed — resets [the count], because that is progress, not ping-pong." Every way a call can
+        // be let through arrives here: the rung not gating it, an allow entry, the §3.2 tripwire, a
+        // `safe` rating, the human saying yes. Wrapping is what makes that exhaustive — an approval
+        // added below cannot forget to reset, and the alternative (a call at each of the six `approve`
+        // returns) is a §5.3 hole that is invisible the day it opens.
+        //
+        // Nothing else resets: a `reject` (the negotiation's own rounds, and the §8 floor's refusal)
+        // must not, or the bound it is counted against could never be reached.
+        if (decision.type === 'approve')
+            this.negotiation.noteProgress();
+        return decision;
+    }
+    /**
+     * [[TUI-C27]] — {@link decideToolApprovalInner} with the record closed off on EVERY exit.
+     *
+     * The final action is written here rather than at each of the decision's many returns, because
+     * "what became of the call" is one fact with one source: what this method returns or throws. A
+     * per-return assignment is a list that a new branch joins without noticing, and the branch that
+     * would be forgotten is the one that ends the run.
+     */
+    async recordedDecision(tool, record) {
+        try {
+            const decision = await this.decideToolApprovalInner(tool, record);
+            record.action = decision.type === 'approve' ? 'approve' : 'reject';
+            if (decision.type === 'approve' && decision.scope)
+                record.scope = decision.scope;
+            return decision;
+        }
+        catch (error) {
+            if (error instanceof AttackHaltError) {
+                record.action = 'halt';
+            }
+            else if (error instanceof NonInteractiveEscalationError) {
+                // §6.2 — there was nobody to ask, so the escalation ended the run instead of reaching one.
+                record.action = 'escalate';
+                record.humanAnswer = 'no-human';
+            }
+            else {
+                record.action = 'error';
+            }
+            record.error = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+            throw error;
+        }
+    }
+    /** The decision itself; {@link decideToolApproval} wraps it with §5.3's reset. */
+    async decideToolApprovalInner(tool, record) {
         const command = typeof tool.args?.command === 'string' ? tool.args.command : null;
         const isShellCommand = tool.name === SHELL_TOOL_NAME && command !== null;
         const approvals = this.sessionApprovals;
+        // (0) Does the rung IN FORCE gate this tool at all? Same shared predicate the backends built the
+        // interrupt from, asked about this one call, so the wiring and the decision cannot disagree.
+        // Scope `once`, so nothing is written to any allow-list: this is not a grant, it is the absence
+        // of a gate.
+        const { gateShell } = resolveShellApprovalGate(this.config ?? undefined, this.command);
+        if (!isToolGatedAtRung({ toolName: tool.name, rung: approvals.rung, gateShell })) {
+            return this.stage(record, 'not-gated', { type: 'approve', scope: 'once' });
+        }
+        // [[TUI-C27]] — [[EXT-81]]'s surviving observable: what the gate's own parser made of the
+        // command, recorded whether or not a rating follows. Computed once here rather than at the
+        // rating site, so a call the floor or a list settles still says whether the command was one the
+        // parser could resolve.
+        if (isShellCommand && command !== null) {
+            const defect = describeAbstention(command);
+            if (defect)
+                record.parserUnresolved = defect;
+        }
         // ONE subject and ONE annotation source per decision, shared by the rule matcher and the
         // §4.7.3 floor below. Building a second source for the floor would let a `hint` entry and the
         // floor read different effective values for the same call — the two-derivations-disagreeing
@@ -673,50 +968,138 @@ export class GthAgentRunner {
         });
         // (1) Deny — before everything, including `bypass`.
         if (rule?.action === 'deny') {
-            return {
+            // [[TUI-C26]] §6 — the message names the refusal the user actually made. A deny entry now has
+            // two possible authors: a line in `approvals.deny`, and the escalation menu's *always reject*
+            // choice earlier in this session. Telling the model (and, through it, the user) to edit a
+            // config file that the second kind was never written to is the same class of wrongness as
+            // confirming a persistence that did not happen. The declared list is checked FIRST so an
+            // entry a user wrote is described as theirs even when the menu recorded the identical one.
+            const declared = this.sessionApprovals.deny.some((entry) => renderApprovalEntryObject(entry) === renderApprovalEntryObject(rule.entry));
+            const described = describeApprovalEntry(rule.entry);
+            record.ruleMatch = { action: 'deny', entry: described };
+            return this.stage(record, 'deny-list', {
                 type: 'reject',
-                message: `Refused: your deny list forbids this call (matched "${describeApprovalEntry(rule.entry)}"). ` +
-                    'Remove the entry from approvals.deny if you want it to run.',
-            };
+                message: declared
+                    ? `Refused: your deny list forbids this call (matched "${described}"). ` +
+                        'Remove the entry from approvals.deny if you want it to run.'
+                    : `Refused: the user chose to always refuse this earlier in this session (matched ` +
+                        `"${described}"). That refusal lasts until the session ends; ask the user if you ` +
+                        'believe it should be lifted.',
+            });
         }
         // (2) `bypass` (config or `/approvals bypass`): approve a gated shell command WITHOUT
         // prompting or rating. Scope `once` so nothing is written to the allow-list (the bypass is
         // intentionally ephemeral and reversible). The hardline floor is NOT bypassed here — it is
         // enforced at exec time in GthDevToolkit.executeCommand regardless of this decision.
         if (isShellCommand && approvals.rung === 'bypass') {
-            return { type: 'approve', scope: 'once' };
+            return this.stage(record, 'bypass', { type: 'approve', scope: 'once' });
+        }
+        // (2b) [[EXT-29]] §4.2/§8 — **the hardline floor, consulted BEFORE anything opens.** "If the
+        // deterministic floor matches, the command is refused at execution regardless of rating, rung,
+        // or approval — so it MUST NOT be negotiated and SHOULD NOT be escalated."
+        //
+        // **This is a second call site, not the exec-time one, and the promise is different.** The
+        // toolkit's check guarantees such a command never RUNS; it does nothing about what happens on
+        // the way there, so without this line `auto` spends three rating calls and a human dialog
+        // arguing about a fork bomb that was never going to run — and "asking a human to approve
+        // something that is then refused anyway teaches them their answer does not count, which is
+        // worse than a flat refusal". The exec-time check stays exactly where it is: it is the
+        // guarantee, this is the courtesy of not wasting a decision on it.
+        //
+        // **Scoped to the rated rungs, which is where §4.2 speaks.** `bypass` has already returned
+        // above, and at `manual`/`write` the human is the gate rather than a second opinion on a
+        // rating; neither is a path §5 or §4.2's table governs. It sits above the allow branch because
+        // the floor is unappealable — an allow entry cannot buy past it — and below the deny check
+        // because a deny match refuses the same call for the user's own reason.
+        //
+        // **`checkHardline` is asked, not `catastrophic`.** They are different predicates and the
+        // difference is measured: EXT-60 recorded `chown -R /` as missing from the floor, so "the floor
+        // matched" and "the rater said catastrophic" name overlapping, non-identical sets. A
+        // `catastrophic` rating still escalates (§4.2 settled that deliberately); only a floor match
+        // refuses here.
+        //
+        // **A floor match refuses; it never halts, whichever of §8's two subsets matched.** The floor is
+        // a lexical test with no notion of direction or role, so it fires on ordinary work — the deploy
+        // authenticated by an identity file, the fetch that writes a credential INBOUND — and ending the
+        // session on one leaves a restart as the only recovery. The run-ending halt stays where a model
+        // has actually said the command is an attack (the rating path below): a floor match is a
+        // model-free assertion, and the model-free consequence is the floor's own refusal, reached
+        // earlier here than at exec and without spending a prompt on it.
+        //
+        // **Both rated rungs, deliberately.** `assisted` gets the refusal without a prompt for the same
+        // reason `auto` gets it without a round: §4.2 is a statement about the command, not about who
+        // was going to be asked about it.
+        if (isShellCommand && command !== null && isRatedRung(approvals.rung)) {
+            const floor = checkHardline(command);
+            if (floor) {
+                // [[TUI-C27]] — **the archive names the matched pattern; the refusal below does not.**
+                // §8.1 ("the floor is never advertised") and [[CFG-31]] bind USER-FACING rung copy —
+                // text inviting someone to feel safe — and the resolution taken here is that a diagnostic
+                // archive a user opens about their own session is not that surface: "a floor matched"
+                // without saying which rule leaves nobody able to act on it. `buildHardlineRefusal` is
+                // untouched and still carries only the description.
+                record.hardline = { description: floor.description, pattern: floor.pattern };
+                const refusal = buildHardlineRefusal(command, floor);
+                // Visible, because the exec-time refusal is: a refusal the user never sees reads as the
+                // agent quietly deciding not to do what it was asked.
+                this.statusUpdate(StatusLevel.WARNING, `\n⛔ ${refusal}`);
+                // §7's moves are deliberately absent — see `buildHardlineRefusal`. Neither bound moves
+                // either: this refusal opens no round, so counting it would walk an unappealable refusal
+                // toward the human escalation §4.2 says it must not reach. It follows that a model spamming
+                // a floor-matching command is bounded only by the tool-loop guard and `recursionLimit`,
+                // which is the right place for "the model did something unproductive" to end and the wrong
+                // place for a fork bomb to acquire an audience.
+                return this.stage(record, 'hardline-floor', { type: 'reject', message: refusal });
+            }
         }
         // (3) Escalate — §3.2 sends it straight to the human with no rating call, outranking any allow
         // entry that also matched.
         //
         // The `bypass` term is deliberate and not redundant with the early return above. That return
         // only covers a SHELL call, so without this term a non-shell subject would still carry an
-        // escalate match into the prompt at `bypass` — unreachable while `run_shell_command` is the
-        // only gated tool, but §2.5's rule is about the rung, not about which tool asked. Make the
-        // invariant true rather than incidentally true, so [[EXT-30]] widening the gate cannot quietly
-        // break it.
+        // escalate match into the prompt at `bypass`, and §2.5's rule is about the rung, not about which
+        // tool asked. Non-shell subjects do reach this line — the deterministic rungs gate the write
+        // built-ins, MCP and custom tools — so the term is doing work rather than guarding a hypothesis.
         const escalatedBy = rule?.action === 'escalate' && approvals.rung !== 'bypass'
             ? describeApprovalEntry(rule.entry)
             : undefined;
+        if (escalatedBy) {
+            record.ruleMatch = { action: 'escalate', entry: escalatedBy };
+            record.stage = 'escalate-entry';
+        }
         // (4) Approve from the allow list without prompting. It ALWAYS wins over the rater — a
         // human-trusted call shouldn't pay for an LLM call on every variant — but never over escalate.
         const allowlistApplies = approvals.rung !== 'bypass' && escalatedBy === undefined;
         let safetyVerdict;
         if (allowlistApplies && rule?.action === 'allow') {
+            record.ruleMatch = {
+                action: 'allow',
+                entry: describeApprovalEntry(rule.entry),
+                rate: rule.rate === true,
+            };
             // §3.2 — `rate` is honored at the rater rungs and INERT at the deterministic ones, so an
-            // entry can never smuggle a model call into `read-only` or `write`. A tool subject is not
+            // entry can never smuggle a model call into `manual` or `write`. A tool subject is not
             // rated either: the rater's first implementation covers the shell only (§4.3, [[EXT-30]]).
             if (!rule.rate || !isRatedRung(approvals.rung) || !isShellCommand || command === null) {
-                return { type: 'approve', scope: 'session' };
+                return this.stage(record, 'allow-list', { type: 'approve', scope: 'session' });
             }
-            const verdict = await this.rateCommand(command, { allowMatched: true });
+            // Attributed once, before the call, for the reason the rater path below is: the tripwire's
+            // own `attack` arm throws, and a second writer on the return would make this one unfalsifiable.
+            record.stage = 'allow-tripwire';
+            const verdict = await this.rateCommand(command, { allowMatched: true }, record);
             const tripwire = mapAllowMatchedVerdictToAction(verdict);
-            if (tripwire.action === 'approve')
+            if (tripwire.action === 'approve') {
                 return { type: 'approve', scope: 'session' };
+            }
             if (tripwire.action === 'halt') {
                 // §3.2/§4.2 — `attack` halts exactly as it would have without the match. A standing human
                 // grant answers "may this run"; it does not answer "is this command's structure hostile".
-                throw new AttackHaltError(command, tripwire.verdict?.reason ?? '');
+                //
+                // §6.1 — and it halts through the SAME seam as the rater's own path below, so an allow
+                // entry does not decide whether the banner appears. The entry has already been overruled by
+                // the time this line is reached; letting it also silence the one way out would make the
+                // recovery depend on a match the human cannot see from the banner.
+                return await this.haltOrRunAnyway(command, tripwire.verdict?.reason ?? '', record);
             }
             // `catastrophic` — the one outcome the tripwire escalates. Fall through to the human.
             safetyVerdict = tripwire.verdict;
@@ -749,15 +1132,90 @@ export class GthAgentRunner {
                 // how to rewrite it, and the rewrite it named turned `cd src && ls` into a no-op plus a
                 // listing of the wrong directory, both exit 0. The parser's finding is now a neutral note
                 // in the rating prompt (`buildRaterPrompt`) and nothing else.
-                const verdict = await this.rateCommand(subject.command, { allowMatched: false });
+                // [[EXT-29]] §5.1 — the negotiation this rating is a round of. At `assisted` the context is
+                // empty and `negotiable` is false, so the whole call is byte-identical to what it was.
+                const negotiable = isNegotiatingRung(approvals.rung);
+                const justification = negotiable ? shellJustification(tool.args) : undefined;
+                const context = negotiable
+                    ? this.negotiation.contextFor(justification)
+                    : undefined;
+                // [[TUI-C27]] — attributed BEFORE the call, and ONCE. Before, because `attack` throws out
+                // of the decision below and a record left unattributed would say a halt came from nowhere.
+                // Once, because a second assignment on each `return` would make the first unfalsifiable:
+                // deleting either would leave the other still writing 'rater', and a fact with two writers
+                // is one no test can pin.
+                record.stage = 'rater';
+                const verdict = await this.rateCommand(subject.command, {
+                    allowMatched: false,
+                    negotiation: context,
+                    negotiable,
+                }, record);
                 const decision = mapVerdictToAction(subject.command, verdict, { rung: approvals.rung });
+                // [[TUI-C27]] — WHICH deterministic preflight fired, and whether it actually rewrote the
+                // rating. The two are separate facts: a preflight only ever RAISES, and only `safe` sits
+                // below the floor, so a finding on a `destructive` verdict is the floor AGREEING with the
+                // rater rather than overriding it — and attributing the decision to the floor in that case
+                // would be wrong. Recomputed from the same raw command `mapVerdictToAction` recomputes it
+                // from, through the same one function, so the two cannot disagree.
+                const preflight = preflightFloorFinding(subject.command);
+                if (preflight) {
+                    record.preflight = {
+                        ...preflight,
+                        rewroteRating: isBelowDestructiveFloor(verdict.outcome),
+                    };
+                }
                 if (decision.action === 'approve') {
                     // Scope `once`: rater approvals are NEVER persisted to the allow-list.
                     return { type: 'approve', scope: 'once' };
                 }
                 if (decision.action === 'halt') {
                     // §4.2 — not a rejection the model can respond to. It ends the agent loop.
-                    throw new AttackHaltError(subject.command, decision.verdict?.reason ?? '');
+                    //
+                    // **`neg-04d`: a negotiation already in flight ends here too**, mid-way and without a
+                    // further round. `attack` is exempt from the whole mechanism (§5.1), so the counter, the
+                    // transcript and the loop all stop together rather than the argument continuing around a
+                    // halt that only ended one call.
+                    //
+                    // The reset itself is defence in depth: the throw ends `processMessages`, and a later
+                    // turn would clear the negotiation on its own first line anyway. **No PRODUCTION reader
+                    // sees this state again — which is not the same as it being unobservable**, and the
+                    // difference decides whether the line is pinned. `neg-04d` asserts both halves through
+                    // the spec harness's private-state cast: the cleared transcript, and `sinceHuman` back at
+                    // zero. That second one is what distinguishes this call from `noteProgress()`, which
+                    // clears the transcript and the consecutive count and deliberately leaves the
+                    // reachability bound standing.
+                    this.negotiation.humanReached();
+                    // §6.1 — the banner, when an interactive surface wired one, and the halt otherwise. It
+                    // sits AFTER the reset above on purpose: a human is reached either way (that is what the
+                    // banner is), so the negotiation ends here whichever answer comes back, and neither
+                    // answer leaves a transcript behind for a later turn to argue from.
+                    return await this.haltOrRunAnyway(subject.command, decision.verdict?.reason ?? '', record);
+                }
+                if (decision.action === 'reject') {
+                    // §5 — `destructive` at `auto`. The round is recorded first, so the attempt being ruled
+                    // on is itself on the transcript the human sees (§5.6).
+                    const outcome = this.negotiation.recordRejection({
+                        command: subject.command,
+                        ...(justification ? { justification } : {}),
+                        outcome: decision.verdict?.outcome ?? 'destructive',
+                        reason: decision.verdict?.reason ?? '',
+                    });
+                    if (outcome === 'reject') {
+                        // §7 — the refusal PLUS the moves: re-call with a justification (the tool argument
+                        // exists for this), call a different command, or ask the user. Rendered through the
+                        // one builder the human's own "no" uses, differing only in who refused, so the model
+                        // never meets two shapes of the same event.
+                        return {
+                            type: 'reject',
+                            message: buildRejectionMessage({
+                                source: 'rater',
+                                toolName: tool.name,
+                                verdict: decision.verdict,
+                            }),
+                        };
+                    }
+                    // A bound is spent — the agent and the rater cannot agree, and that is a human's call.
+                    // Falls through to the escalation below, carrying this last round's verdict.
                 }
                 // Escalate: carry the verdict (the honest one — see mapVerdictToAction) to the human.
                 safetyVerdict = decision.verdict;
@@ -782,13 +1240,33 @@ export class GthAgentRunner {
                 //
                 // Reached only when no allow entry claimed the call: §4.6's fourth bullet makes an allow
                 // match lift this floor, and step (4) above has already returned in that case.
-                safetyVerdict = applyDestructiveFloor(safetyVerdict, openWorldToolFloorReason(effective));
+                const toolFloor = openWorldToolFloorReason(effective);
+                if (toolFloor !== null)
+                    record.stage = 'tool-open-world-floor';
+                safetyVerdict = applyDestructiveFloor(safetyVerdict, toolFloor);
             }
         }
+        // [[EXT-29]] §6 — **the human is shown the whole negotiation, not the last attempt.** Snapshot
+        // it BEFORE the state is cleared, because "that the agent proposed the same command three times
+        // unchanged, against two rejections that each told it what to fix, is itself the most important
+        // thing on the screen". Empty for every escalation that had no negotiation — `catastrophic`
+        // (which §4.2 gives no rounds at all), a declared escalate entry, an unrated rung, a tool
+        // subject — so nothing renders a heading over an argument that never happened.
+        // [[TUI-C27]] — everything that reaches a person has an attribution by now EXCEPT the plainest
+        // case of all: a deterministic rung, no rule matched, no rating made. That is a decision the
+        // rung itself made, so it is named rather than left blank — a record with no stage reads as the
+        // recorder having failed, which is the opposite of what happened.
+        record.stage ??= 'unrated-rung';
+        const negotiationRounds = this.negotiation.transcript();
+        // Reaching a person ends the negotiation (§5.3) and is the ONE thing that clears the
+        // reachability bound: an escalation the human is about to answer is exactly the event that
+        // bound exists to make happen, so it is spent here rather than accumulated across it.
+        this.negotiation.humanReached();
         if (!this.toolApprovalCallback) {
             // §6.2 — no one to ask. Exit non-zero with everything a person needs, rather than handing
-            // the model a rejection it would just work around.
-            throw new NonInteractiveEscalationError(command ?? tool.name, safetyVerdict?.outcome, safetyVerdict?.reason, escalatedBy);
+            // the model a rejection it would just work around. The transcript goes into the message
+            // because that message is the only thing anyone sees on this path.
+            throw new NonInteractiveEscalationError(command ?? tool.name, safetyVerdict?.outcome, safetyVerdict?.reason, escalatedBy, renderNegotiationTranscript(negotiationRounds) ?? undefined);
         }
         // §4.2 — **a `catastrophic` approval is NEVER sticky.** "The human may approve this one
         // invocation, and only this one": no always-allow, and no session-scoped allow either. The
@@ -811,23 +1289,61 @@ export class GthAgentRunner {
         // two ways. For a tool call this is where "the stored thing is the tool, not the arguments"
         // becomes visible: it names the tool, its server and the host bound, and nothing else.
         const grantSummary = grant ? describeApprovalEntry(grant.entry) : undefined;
-        // Surface the rater's verdict, the escalate entry that fired as provenance (§3.2), and what a
-        // sticky choice would store (§6) — without mutating the original interrupt object the caller
-        // holds.
-        const pending = safetyVerdict || escalatedBy || grantPreview
+        // [[TUI-C26]] §6 — the deny half, computed SEPARATELY rather than read off the grant. The two
+        // are available under different conditions and `grant === undefined` is the wrong test for
+        // both: a command that does not statically resolve, and every `catastrophic` verdict, have no
+        // grant on offer and a perfectly good deny entry.
+        const denyEntry = this.denyEntryFor(subject);
+        const denyPreview = denyEntry ? renderApprovalEntryObject(denyEntry) : undefined;
+        const denySummary = denyEntry ? describeApprovalEntry(denyEntry) : undefined;
+        // Surface the rater's verdict, the escalate entry that fired as provenance (§3.2), and what
+        // each sticky choice would store (§6) — without mutating the original interrupt object the
+        // caller holds.
+        //
+        // **`denyPreview` belongs in this condition, and leaving it out is a silent hole rather than a
+        // tidiness question.** The most ordinary prompt in the system — a deterministic rung, no
+        // rating, no escalate entry, no negotiation, a command that does not statically resolve — has
+        // none of the other four, so without this term the interrupt would pass through unchanged and
+        // the *always reject* control would vanish from exactly the case it exists for.
+        const pending = safetyVerdict || escalatedBy || grantPreview || denyPreview || negotiationRounds.length > 0
             ? {
                 ...tool,
                 ...(safetyVerdict ? { safetyVerdict } : {}),
                 ...(escalatedBy ? { escalatedBy } : {}),
                 ...(grantPreview ? { grantPreview } : {}),
                 ...(grantSummary ? { grantSummary } : {}),
+                ...(denyPreview ? { denyPreview } : {}),
+                ...(denySummary ? { denySummary } : {}),
+                ...(negotiationRounds.length > 0 ? { negotiationRounds } : {}),
             }
             : tool;
         const decision = await this.toolApprovalCallback(pending);
+        // [[TUI-C27]] — a person was reached and answered. The STAGE stays whatever decided to ask
+        // them (a rating, an escalate entry, an unrated rung): "who decided to interrupt" and "what
+        // they said" are two different questions, and collapsing them into one field is what makes a
+        // dump unable to tell a rater escalation from a declared one.
+        record.humanAnswer = decision.type === 'approve' ? 'approve' : 'reject';
         // Record the human's scoped grant so the same call stops re-prompting.
         if (decision.type === 'approve' && grant) {
             this.recordApproval(grant, decision.scope ?? 'once');
         }
+        // §6 — and the mirror: *always reject* records the refusal, so the next identical call is
+        // refused by rule at step (1) without reaching a person. Scoped `session` and nothing else,
+        // because that is the only lifetime the store has (see {@link ToolRejectScope}).
+        if (decision.type === 'reject' && decision.scope === 'session' && denyEntry) {
+            this.recordDenial(denyEntry);
+        }
+        return decision;
+    }
+    /**
+     * [[TUI-C27]] — attribute the deciding stage and hand the decision straight back.
+     *
+     * A one-liner so a stage can be recorded ON the `return` that carries it rather than on the line
+     * above: two statements let an early return be added between them, and the record would then name
+     * a stage that did not decide.
+     */
+    stage(record, stage, decision) {
+        record.stage = stage;
         return decision;
     }
     /**
@@ -835,10 +1351,22 @@ export class GthAgentRunner {
      * rated allow match) and the ordinary rater path cannot drift apart in WHAT they hand the rater —
      * only in what they do with the answer.
      */
-    async rateCommand(command, opts) {
+    async rateCommand(command, opts, 
+    /** [[TUI-C27]] — the decision's record; the rating attaches itself to it at the send site. */
+    record) {
         const approvals = this.sessionApprovals;
         const verdict = await rateShellCommand(command, this.config, {
             home: env?.HOME,
+            negotiation: opts.negotiation,
+            negotiable: opts.negotiable,
+            // [[TUI-C27]] — the sink fires BEFORE the model is invoked, with the prompt that is about to
+            // be sent, so the record carries what the rater was SHOWN rather than a later re-render of
+            // it. Assigning it here (rather than pushing a finished record afterwards) is what makes a
+            // hung, timed-out or halting call still leave the question behind.
+            onCapture: (capture) => {
+                record.rating = capture;
+            },
+            raterProfile: approvals.rater,
             // The profile's model when one is configured; undefined lets rateShellCommand use the
             // session model. `init` throws rather than leaving this undefined for a NAMED profile, so
             // a configured profile can never silently degrade to the session model here.
@@ -850,7 +1378,7 @@ export class GthAgentRunner {
             grantedTools: this.getGrantedBuiltInTools(),
             // EXT-66 — the user-owned budget for ONE rating call, `undefined` when unset so
             // rateShellCommand applies RATER_DEFAULT_TIMEOUT_MS. 30s is a hosted-model number and a
-            // local rater is knowably slower; without this a local `full-auto` session drifts toward
+            // local rater is knowably slower; without this a local `auto` session drifts toward
             // escalating everything, which is the failure the rung exists to prevent.
             timeoutMs: approvals.raterTimeoutMs,
         });
@@ -891,10 +1419,23 @@ export class GthAgentRunner {
         const registered = this.agent?.getRegisteredToolNames?.() ?? [];
         if (registered.length === 0)
             return [];
-        // The gated set is resolved from the SAME shared policy both backends wire their interrupt
-        // from, so "granted" here means exactly what it means at tool-registration time (§4.5).
+        // The LIVE gated set, from the SAME shared policy `decideToolApproval` decides on and the
+        // backends derive their interrupt from, so "granted" here means exactly what it means at
+        // tool-registration time (§4.5) and at the gate.
+        //
+        // EXT-80 makes this non-drift property load-bearing rather than incidental. At `manual` the
+        // write built-ins are gated, so they are NOT granted, and a summary still offering `write_file`
+        // there would tell the model a tool is free while the gate stops and asks for it — the rater
+        // suggesting the one thing guaranteed to interrupt the user. It is computed per rating from
+        // `sessionApprovals.rung`, so it follows a mid-session `/approvals` change — unlike the
+        // interrupt set, which is fixed when the graph is built and is rung-independent for exactly
+        // that reason.
         const { gateShell } = resolveShellApprovalGate(this.config ?? undefined, this.command);
-        const gatedTools = gateShell ? [SHELL_TOOL_NAME] : [];
+        const gatedTools = resolveGatedToolNames({
+            rung: this.sessionApprovals.rung,
+            gateShell,
+            boundToolNames: registered,
+        });
         return describeGrantedBuiltInTools(registered, this.sessionApprovals.rung, gatedTools);
     }
     /**
@@ -1013,6 +1554,62 @@ export class GthAgentRunner {
         // later one against it, and the store copies it so the record is private to this grant.
         return { entry, annotations: effective };
     }
+    /**
+     * [[TUI-C26]] §6 — **the entry the escalation menu's *always reject* choice would record**, or
+     * `undefined` when the grammar cannot hold one. The deny mirror of {@link stickyGrantFor}, and a
+     * separate function rather than a flag on it, because the two answer different questions.
+     *
+     * **Nearly every reason an allow entry is withheld does not apply here.** §3 has one rule for
+     * this and it runs the other way — *undecidable is a non-match on the allow side and a match on
+     * the deny side* — so:
+     *
+     * - **A command that does not statically resolve gets an entry.** `stickyGrantFor` refuses one
+     *   because no allow entry of any matcher would ever match it, making the entry inert; a deny
+     *   entry for the same command is matched against the whole normalized command *and* every
+     *   segment a shell would run, so it is the opposite of inert.
+     * - **A `catastrophic` verdict changes nothing.** §4.2 withdraws the sticky grants there; it says
+     *   nothing about refusals, and refusing more is never the direction that needs withdrawing.
+     * - **`bypass` changes nothing either**, and that is a positive statement rather than a gap. Deny
+     *   is resolved at step (1) of {@link decideToolApprovalInner}, *before* the `bypass` return, so
+     *   a recorded refusal is in force at every rung — which is why this does not copy the allow
+     *   side's `bypass` guard.
+     * - **A call naming several hosts gets the host-less entry.** On the allow side that would show a
+     *   bound the grant does not have; here the entry covers every host of that tool, which is
+     *   broader than the call and safe in the direction breadth is safe. The menu shows exactly that
+     *   entry, so the breadth is on screen rather than inferred.
+     * - **`run_shell_command` arriving as a TOOL subject gets a tool entry** — a shell call whose
+     *   `command` argument cannot even be read. On the allow side that entry would auto-approve every
+     *   future unreadable shell call, which is why it is excluded there; as a refusal it stops the
+     *   shell tool for the session, and the dialog says so in the words the entry is written in.
+     *
+     * The one genuine exclusion is an **MCP call whose server could not be attributed**
+     * ({@link toolGrantEntry} returns `null`): the grammar's `server` cannot be the empty string, so
+     * the entry would be dropped by its own validator and the human would be told a refusal had been
+     * recorded when none was. A shell command that normalizes to nothing is excluded for the same
+     * reason — an empty `pattern` is not a legal entry.
+     */
+    denyEntryFor(subject) {
+        if (subject.kind === 'shell') {
+            const entry = shellGrantEntry(subject.command);
+            return entry.pattern.length > 0 ? entry : undefined;
+        }
+        return toolGrantEntry(subject) ?? undefined;
+    }
+    /**
+     * §6 — record the menu's *always reject* choice, for the life of this runner instance.
+     *
+     * It lands in the same store `approvals.deny` entries are matched from ({@link approvalRuleLists}
+     * concatenates the two), so a refusal the human made at the prompt and one they wrote in their
+     * config are one list to the matcher and one list to `/approvals`.
+     *
+     * **Session-lifetime, and there is nothing else to choose.** There is no persisted deny file;
+     * whether there should be is a question about a file users live with, not about this prompt. What
+     * the surfaces must not do is say otherwise — a confirmation promising a persistence that did not
+     * happen is §6's *offered and then refused* with the evidence hidden.
+     */
+    recordDenial(entry) {
+        this.denyGrants.add({ entry, grantedAt: new Date().toISOString(), scope: 'session' });
+    }
     /**
      * §3.1/§6 — record a human-granted approval at the given scope. `once` remembers nothing.
      * `session` adds the entry to the in-memory store; `always` additionally persists it (falling
@@ -1123,6 +1720,12 @@ export class GthAgentRunner {
         this.resetRunStats();
         // GS2-48 — record this turn's transcript tail for the crash handler.
         updateCrashContext({ transcriptTail: messages.slice(-CRASH_TRANSCRIPT_TAIL_MESSAGES) });
+        // [[EXT-29]] §5 — a new user turn is the human being reached, so it ends any negotiation still
+        // standing from the previous one and clears BOTH bounds. The turn's own messages then enter
+        // §5.1's last-5 window, which is what makes "just the last two" reach the rater at all — the
+        // reply that narrows what the agent proposes is worthless to the gate if only the agent hears it.
+        this.negotiation.humanReached();
+        this.negotiation.noteUserMessages(humanMessageTexts(messages));
         debugLog('Processing messages (event stream)...');
         debugLogObject('Input Messages', messages);
         yield* this.agent.streamWithEvents(messages, this.runConfig, signal);
@@ -1219,6 +1822,10 @@ export class GthAgentRunner {
      * of any checkpointer-specific delete API, mirroring how `init()` mints the initial config.
      */
     resetThread() {
+        // [[EXT-29]] §5.1 — the negotiation goes with the thread, user messages included. The rater's
+        // last-5 window is conversation context; leaving it behind a `/clear` would quote the user's
+        // previous conversation into a rating made after they asked for it to be forgotten.
+        this.negotiation.clear();
         this.runConfig = getNewRunnableConfig();
         debugLogObject('Reset Runnable Config', this.runConfig);
     }