@gaunt-sloth/core 2.0.0-beta.0 → 2.0.0-beta.2

package/dist/core/GthAgentRunner.js

@@ -1,4 +1,4 @@
-import { DEFAULT_APPROVAL_RUNG, describeGrantedBuiltInTools, isNegotiatingRung, isRatedRung, isToolGatedAtRung, resolveApprovals, resolveGatedToolNames, resolveShellApprovalGate, SHELL_TOOL_NAME, TOOL_ANNOTATION_HINTS, } from '#src/config.js';
+import { APPROVAL_RUNG_LABELS, DEFAULT_APPROVAL_RUNG, describeGrantedBuiltInTools, isNegotiatingRung, isRatedRung, commandCarriesUserProvenance, isToolGatedAtRung, resolveApprovals, resolveGatedToolNames, resolveShellApprovalGate, SHELL_TOOL_NAME, TOOL_ANNOTATION_HINTS, } from '#src/config.js';
 import { StatusLevel, } from '#src/core/types.js';
 import { GthLangChainAgent } from '#src/core/GthLangChainAgent.js';
 import { annotationWeakenings, ApprovalGrantStore, describeWeakenedGrant, PersistedApprovalGrants, shellGrantEntry, toolGrantEntry, trustWithdrawalWeakens, } from '#src/core/approvals/grants.js';
@@ -7,10 +7,15 @@ import { classifyCommand } from '#src/core/shell/arity.js';
 import { describeAbstention } from '#src/core/shell/abstention.js';
 import { normalizeCommand } from '#src/core/shell/normalize.js';
 import { ApprovalStopError, AttackHaltError, NonInteractiveEscalationError, } from '#src/core/shell/approvalStop.js';
-import { applyDestructiveFloor, isBelowDestructiveFloor, isRaterTimeout, mapAllowMatchedVerdictToAction, mapVerdictToAction, openWorldToolFloorReason, preflightFloorFinding, RATER_DEFAULT_TIMEOUT_MS, rateShellCommand, } from '#src/core/shell/rater.js';
+import { applyDestructiveFloor, effectivePreflightFloorFinding, isBelowDestructiveFloor, isNegotiableCall, isRaterTimeout, mapAllowMatchedVerdictToAction, mapVerdictToAction, openWorldToolFloorReason, preflightFloorFinding, RATER_DEFAULT_TIMEOUT_MS, rateShellCommand, } from '#src/core/shell/rater.js';
+import { RaterHealth } from '#src/core/shell/raterHealth.js';
+import { alignmentApprovalNotice, isAlignmentFailClosed, runAlignmentCheck, } from '#src/core/shell/alignment.js';
 import { ApprovalCaptureLog, } from '#src/core/shell/approvalCapture.js';
 import { buildHardlineRefusal, checkHardline } from '#src/core/shell/hardline.js';
-import { renderNegotiationTranscript, ShellNegotiationState } from '#src/core/shell/negotiation.js';
+import { NEGOTIATED_APPROVAL_COOLDOWN_MS, renderNegotiationTranscript, ShellNegotiationState, } from '#src/core/shell/negotiation.js';
+// [[EXT-106]] §4.6 — the user-provenance carve-out, read once per decision and handed to every
+// reader of it (the floor, the negotiation test, the rating prompt, the archive and the warning).
+import { carvedOpenWorldHosts } from '#src/core/shell/provenance.js';
 import { buildRejectionMessage } from '#src/core/shell/rejection.js';
 import { describeApprovalEntry, resolveApprovalRules, } from '#src/core/approvals/matcher.js';
 import { createEffectiveToolAnnotationSource, trustedAnnotationHints, } from '#src/core/approvals/annotations.js';
@@ -20,7 +25,7 @@ import { builtInToolAnnotations, mcpDeclaredAnnotationLookup, } from '#src/core/
 import { resolveRaterModel } from '#src/core/shell/raterModel.js';
 import { env } from '#src/utils/systemUtils.js';
 import { getGslothConfigWritePath } from '#src/utils/fileUtils.js';
-import { SHELL_ALLOWLIST_FILE } from '#src/constants.js';
+import { SHELL_ALLOWLIST_FILE, SHELL_DENYLIST_FILE } from '#src/constants.js';
 import { enhanceVertexUnauthorizedMessage } from '#src/utils/vertexaiUtils.js';
 import { getNewRunnableConfig } from '#src/utils/llmUtils.js';
 import { initDebugLogging, debugLog, debugLogError, debugLogObject, } from '#src/utils/debugUtils.js';
@@ -64,13 +69,46 @@ function shellJustification(args) {
         return undefined;
     return value.trim().length === 0 ? undefined : value;
 }
+/**
+ * §3.1 — **the one `approvals.allow` entry that would cover this shell command**, or `undefined`
+ * when the grammar cannot hold one.
+ *
+ * Two readers, one answer: what the escalation menu's *always approve* control would store
+ * ({@link GthAgentRunner.stickyGrantFor}), and what [[EXT-106]] §4's refusal tells a user to add to
+ * their config. Those are the same entry, and deriving it twice is how a menu and a message come to
+ * promise different things about one command.
+ *
+ * **`exact`, never a pattern.** The entry has to be correct enough to paste, and a `glob` inferred
+ * from a command is a guess about which part of it may vary: widened one token too far it grants
+ * more than the user was ever shown. A subtly-too-broad pasteable entry is worse than none, so the
+ * breadth stays where {@link shellGrantEntry} puts it — this command, and only this command.
+ *
+ * `undefined` for a command the allow classifier cannot resolve, because **no allow entry of any
+ * matcher would match it**: rendering one would hand someone a line that changes nothing and looks
+ * as though it should.
+ */
+function shellApprovalEntryFor(command) {
+    if (classifyCommand(command, normalizeCommand) === null)
+        return undefined;
+    return shellGrantEntry(command);
+}
 /**
  * [[EXT-29]] §5.1 — the text of the human messages in a turn's input, for the rater's last-5 window.
  *
  * Structural and fail-soft, like `runStats`'s accumulator: the runner is handed `BaseMessage`s from
  * several surfaces (readline, TUI, ACP, AG-UI) and a multimodal turn's `content` is an array of
- * blocks rather than a string. Only the text is taken — §4.3 admits no file contents, no tool
- * output and no fetched pages, and an image block is none of the three.
+ * blocks rather than a string. Only the text of a `human` message is taken, and the filter beside
+ * the loop is why: a multimodal turn's non-text blocks (an image) contribute nothing.
+ *
+ * **What this does NOT do is exclude file contents, tool output or fetched pages, and the
+ * distinction matters.** §4.3 admits none of those *as messages of their own*, and none of them
+ * arrives as one — but a `human` message's own text is taken whole, whatever put it there. On the
+ * file-fed verbs that is a great deal: `exec` reads a prompt FILE from disk, `ask -f` reads a file
+ * and piped stdin, and `review`/`pr` carry the entire diff — all of them as `human` messages, all of
+ * them therefore in this window. Anything that treats these strings as *"what the user typed"* is
+ * treating a file the agent was pointed at as the user's own words; [[EXT-106]] §4.6's provenance
+ * carve-out does exactly that, deliberately and only at `auto`, and it is documented as such in
+ * `docs/guides/shell-tool-and-approvals.md`.
  */
 function humanMessageTexts(messages) {
     const texts = [];
@@ -130,6 +168,12 @@ export class GthAgentRunner {
      * for non-interactive entrypoints (a scripted `exec` run with no TTY to prompt on).
      */
     toolApprovalCallback = null;
+    /**
+     * [[EXT-150]] — consumer hook invoked once per human-answered approval, AFTER the answer has been
+     * recorded, carrying the lifetime it landed with. Set via {@link setApprovalOutcomeCallback}; when
+     * unset the outcome is simply not reported, which is where every surface was before this existed.
+     */
+    approvalOutcomeCallback = null;
     /**
      * [[TUI-C68]] §6.1 — consumer hook invoked when the rater rates a command an `attack`, so an
      * interactive surface can show the red banner before the run ends. Set via
@@ -138,6 +182,22 @@ export class GthAgentRunner {
      * therefore keeps the halt rather than losing it.
      */
     attackHaltCallback = null;
+    /**
+     * [[TUI-C69]] §5.4/§5.5 — **the surface showing this negotiation while it happens**, when one
+     * is. Set via {@link setNegotiationDisplay}.
+     *
+     * Its presence is the answer to *"is anyone watching?"*, and BOTH halves of the visible
+     * negotiation are keyed on it: the rounds are handed over as they are decided, and a negotiated
+     * approval is held on screen for {@link NEGOTIATED_APPROVAL_COOLDOWN_MS} before it takes effect.
+     *
+     * **`null` means neither happens, and that is the point.** An `exec` or CI run has nobody to
+     * show an approval to, so an 800 ms hold there would tax every headless run and every gate for a
+     * display that does not exist. Deliberately NOT keyed on {@link toolApprovalCallback}: that one
+     * answers *"is there a human to ASK"*, a different question with a different answer — a piped
+     * readline session can have one wired and no live display, and the §6.2 non-interactive path has
+     * a display and no one to ask.
+     */
+    negotiationDisplay = null;
     /** The command the runner was initialized for; selects which `devTools` config applies. */
     command = undefined;
     /**
@@ -171,12 +231,24 @@ export class GthAgentRunner {
      * `undefined` means no profile is configured and the rater uses the session model.
      */
     raterModel;
+    /**
+     * [[EXT-127]] — the model the ALIGNMENT CHECKER runs on, when `approvals.alignmentChecker` (or, by
+     * its read-site default, `approvals.rater`) names an identity profile. Resolved ONCE at
+     * {@link init}, exactly as {@link raterModel} is; `undefined` means the session model.
+     */
+    alignmentCheckerModel;
     /**
      * EXT-66 — how many rating calls this session gave up on. Counted so the notice can say "3 times
      * this session" rather than repeating an identical line, and so a silent drift toward
      * escalate-everything has a number attached to it.
      */
     raterTimeouts = 0;
+    /**
+     * [[EXT-82]] — the consecutive-failure tracker behind the session-level signal, per runner and
+     * therefore per session (the ACP surface runs several at once). See
+     * {@link import('#src/core/shell/raterHealth.js').RaterHealth}.
+     */
+    raterHealth = new RaterHealth();
     /**
      * EXT-71 §3.1/§6 — what the escalation menu granted at run time, for the life of THIS runner
      * instance: {@link ApprovalEntry} objects, never prefixes, and never anything from config (the
@@ -198,6 +270,19 @@ export class GthAgentRunner {
      */
     persistedGrants = null;
     persistedGrantsLoaded = false;
+    /**
+     * [[EXT-107]] — the persisted (`always`) **refusal** store, from
+     * `.gsloth/.gsloth-settings/shell-denylist.json`. The mirror of {@link persistedGrants}, and the
+     * reason the menu's most emphatic answer is no longer its most forgetful one.
+     *
+     * Null when the file cannot be loaded at all, in which case an `always` refusal degrades to a
+     * session one. **Not "a re-prompt next session, never an execution":** nothing in the unreadable
+     * file applies to any call, so next session a call it covered is left to the rest of the gate — it
+     * may be refused by another rule, it may be prompted for, or it may run without asking, under
+     * `bypass` or a matching saved allow. The user is told at load time.
+     */
+    persistedDenials = null;
+    persistedDenialsLoaded = false;
     /**
      * [[EXT-29]] §5 — the state of the agent↔rater negotiation at `auto`: the transcript, §5.3's
      * consecutive-rejection counter and the reachability bound. Instance-scoped for the same reason
@@ -230,6 +315,23 @@ export class GthAgentRunner {
     setToolApprovalCallback(callback) {
         this.toolApprovalCallback = callback;
     }
+    /**
+     * [[EXT-150]] — register the handler that is told **what a human's answer actually landed as**.
+     * Pass `null` to clear.
+     *
+     * Separate from {@link setToolApprovalCallback} for the reason {@link setAttackHaltCallback} is
+     * separate: it is a different question asked at a different moment. The approval callback is
+     * consulted *before* anything is written and returns the human's REQUEST; the scope that survives
+     * is decided here afterwards, because [[EXT-149]] degrades an `always` whose write did not reach
+     * disk to the `session` answer it really is. A surface with no way to hear that can only confirm
+     * the key that was pressed — and core's own ERROR naming the unwritten file then contradicts it.
+     *
+     * It reports; it never decides. Nothing downstream reads it, so a surface that ignores it, or
+     * never wires it, changes no behaviour of the gate.
+     */
+    setApprovalOutcomeCallback(callback) {
+        this.approvalOutcomeCallback = callback;
+    }
     /**
      * [[TUI-C68]] §6.1 — register the handler that shows the **attack banner**, the one way a human
      * gets past an `attack` verdict. Pass `null` to clear.
@@ -242,6 +344,19 @@ export class GthAgentRunner {
     setAttackHaltCallback(callback) {
         this.attackHaltCallback = callback;
     }
+    /**
+     * [[TUI-C69]] §5.4/§5.5 — **declare that this surface is showing the negotiation as it happens.**
+     * Pass `null` to clear.
+     *
+     * §5.4's requirement is not decoration: *"the spec's own justification for letting the agent
+     * argue with the rater at all is that a human can watch it, and an argument conducted in the dark
+     * is a different thing from one that can be interrupted."* Wiring this is a surface saying it
+     * has somewhere to draw that, which is also what makes §5.5's hold meaningful — see
+     * {@link negotiationDisplay} for why one seam carries both.
+     */
+    setNegotiationDisplay(display) {
+        this.negotiationDisplay = display;
+    }
     /**
      * §6.1 — **the single seam between an `attack` verdict and the end of the run.** Both rating
      * paths — the §3.2 allow-match tripwire and the ordinary rater decision — go through here, so the
@@ -264,7 +379,16 @@ export class GthAgentRunner {
      */
     async haltOrRunAnyway(command, reason, 
     /** [[TUI-C27]] — this decision's record; the banner's answer is a HUMAN's answer. */
-    record) {
+    record, 
+    /**
+     * [[EXT-115]] — the subject the gate decided this call on, so the halt names what it actually
+     * halted rather than calling everything a `Command`. **Required, not optional**: both call
+     * sites hold the decision's own subject, and the type system is what keeps a future one from
+     * quietly reaching the class's hand-built fallback. Today every caller is on the shell arm —
+     * §4.3 keeps the rater on the shell until [[EXT-30]] — so this changes no message that exists
+     * yet; what it changes is that the halt stays correct when that arm widens.
+     */
+    subject) {
         if (this.attackHaltCallback) {
             const answer = await this.attackHaltCallback({ command, reason });
             // [[TUI-C27]] — **recorded here, or a run-anyway is indistinguishable from a `safe`
@@ -280,7 +404,7 @@ export class GthAgentRunner {
             // §6.2 — no surface wired the banner, so nobody was asked and the run ends.
             record.humanAnswer = 'no-human';
         }
-        throw new AttackHaltError(command, reason);
+        throw new AttackHaltError(command, reason, subject);
     }
     /**
      * CFG-27 — switch the session-scoped rung (`/approvals <rung>`). Idempotent; returns the NEW
@@ -327,12 +451,107 @@ export class GthAgentRunner {
         return { session, always };
     }
     /**
-     * CFG-27 — the session's deny entries for display: the declared `approvals.deny` entries
-     * (rendered one line each) followed by whatever the escalation menu's *always reject* added at
-     * run time. Both refuse a call, so both are shown.
+     * CFG-27/[[EXT-107]] — **every refusal in force, and which of the three lists holds it**: the
+     * declared `approvals.deny` entries, the escalation menu's session-scoped refusals, and the ones
+     * saved to the project's deny file.
+     *
+     * The origins are kept apart rather than concatenated into one list of strings, because they have
+     * different lifetimes and different owners and only two of the three can be lifted from here.
+     * A merged list makes {@link liftRefusal} impossible to describe honestly.
+     *
+     * **This is the one list.** {@link liftRefusal} resolves its argument against exactly this
+     * sequence, so the number a user reads and the number they type cannot name different entries.
+     *
+     * Numbering is 1-based, and the order is config → saved → session: the entries a user cannot lift
+     * here come first and stay put, so the numbers of the ones they can are not reshuffled by a
+     * config edit between two renderings.
+     */
+    getRefusals() {
+        return this.refusalRecords().map((held, position) => ({
+            index: position + 1,
+            description: describeApprovalEntry(held.entry),
+            origin: held.origin,
+            ...(held.recordedAt !== undefined ? { recordedAt: held.recordedAt } : {}),
+        }));
+    }
+    /**
+     * [[EXT-107]] — the refusals in force with their entries attached, which is what
+     * {@link liftRefusal} needs and {@link getRefusals} renders. ONE builder, so the displayed order
+     * and the removal order are the same order by construction rather than by two functions agreeing.
+     *
+     * A saved refusal is held in both runtime stores ({@link recordDenial} writes both), so the
+     * session list is filtered against the saved one by entry identity — the same de-duplication
+     * {@link getGrants} does. A configured entry is NOT de-duplicated against them: it is a different
+     * thing with a different owner, and hiding it would let a lift report success while the config
+     * line went on refusing the call.
+     */
+    refusalRecords() {
+        const saved = this.getPersistedDenials()?.list() ?? [];
+        const savedKeys = new Set(saved.map((grant) => renderApprovalEntryObject(grant.entry)));
+        return [
+            ...this.sessionApprovals.deny.map((entry) => ({ entry, origin: 'config' })),
+            ...saved.map((grant) => ({
+                entry: grant.entry,
+                origin: 'persisted',
+                recordedAt: grant.grantedAt,
+            })),
+            ...this.denyGrants
+                .list()
+                .filter((grant) => !savedKeys.has(renderApprovalEntryObject(grant.entry)))
+                .map((grant) => ({
+                entry: grant.entry,
+                origin: 'session',
+                recordedAt: grant.grantedAt,
+            })),
+        ];
+    }
+    /**
+     * [[EXT-107]] — **lift one refusal**, by its number in {@link getRefusals}. The escape hatch, and
+     * the reason persisting a refusal is safe to ship: a saved refusal the user cannot find or undo
+     * is a trap, and the person who hits it first is whoever pressed `[d]` by reflex and needed the
+     * command an hour later. Telling them to delete a file they have not been told exists is not an
+     * answer.
+     *
+     * A saved refusal is removed from the file AND from the in-memory store, because it is in both —
+     * dropping only the file would leave the call refused for the rest of the session by a rule the
+     * display no longer shows.
+     *
+     * **A configured entry is reported, never removed.** `approvals.deny` is something the user
+     * wrote; rewriting their config file out from under them is not a thing a session command may do,
+     * and silently no-oping would be worse. They are told where it lives.
+     *
+     * **`stillSaved` is the deletion that did not reach disk** ([[EXT-149]]). The file rewrite can
+     * fail after the in-memory removal has succeeded — a checkout that is not writable, a settings
+     * directory that has gone — and the entry then comes back in the next session. The store now
+     * answers that question ({@link PersistedApprovalGrants.remove}) instead of reporting every
+     * removal as landed, so the notice can stop promising *it will not come back*.
      */
-    getDenylist() {
-        return [...this.sessionApprovals.deny, ...this.denyGrants.entries()].map(describeApprovalEntry);
+    liftRefusal(index) {
+        const held = this.refusalRecords();
+        const target = held[index - 1];
+        if (!target || !Number.isInteger(index)) {
+            return { outcome: 'unknown', index, count: held.length };
+        }
+        const description = describeApprovalEntry(target.entry);
+        if (target.origin === 'config')
+            return { outcome: 'configured', description };
+        this.denyGrants.remove(target.entry);
+        const removedFromFile = target.origin === 'persisted'
+            ? (this.getPersistedDenials()?.remove(target.entry) ?? false)
+            : false;
+        const key = renderApprovalEntryObject(target.entry);
+        return {
+            outcome: 'lifted',
+            description,
+            origin: target.origin,
+            // A session refusal was never in a file, so there is nothing left there — the flag is about
+            // the file keeping an entry the user was told had gone, and only a saved one can.
+            stillSaved: target.origin === 'persisted' && !removedFromFile,
+            // The other half of not de-duplicating config entries above: a call refused by BOTH a saved
+            // entry and a config line is still refused after this, and a notice that did not say so would
+            // report a lift the gate did not perform.
+            stillConfigured: this.sessionApprovals.deny.some((entry) => renderApprovalEntryObject(entry) === key),
+        };
     }
     /**
      * §3/§4.7.4 — **the grants themselves**, for an approvals view that shows *what* was granted,
@@ -503,6 +722,20 @@ export class GthAgentRunner {
         // remains switchable (`/approvals write`). Resolved per-command, mirroring where the shell
         // tool is actually emitted; no effect where the tool is ungated.
         this.sessionApprovals = resolveApprovals(configIn, command);
+        // [[EXT-106]] §4.6 — **whose words this session's human messages are.** The provenance carve-out
+        // reads the retained human turns as *"the user's own verbatim words"*, and on `review` and `pr`
+        // they are nothing of the kind: the product itself fetched the diff and the PR description and
+        // then framed them as a human message, and the review prompt tells the agent to EXAMINE that
+        // content. Material under examination is not the voice of the person who asked for the
+        // examination, so admitting it would make the product contradict itself about identical input.
+        //
+        // **Decided from the VERB and never from anything inside a message.** Those bytes are
+        // attacker-controlled, so a marker in them can be forged by the text it is meant to classify;
+        // out-of-band metadata is the only admissible key. `owningCommand` is the fallback because a
+        // command-less helper agent — the `gth pr` discovery run — must be classified by the verb it
+        // serves rather than by the absence of one. Both the predicate and the window's own default
+        // fail closed, so a driver nobody has classified floors exactly as it did before the carve-out.
+        this.negotiation.admitUserProvenance(commandCarriesUserProvenance(command ?? options?.owningCommand));
         // §3/§9.1 — the DECLARED lists are read-only config input, consulted through the EXT-71 rule
         // matcher (`core/approvals/matcher.ts`) and NEVER copied into the runtime stores, which hold
         // only what the escalation menu grants at run time. Both are handed to the same matcher, so
@@ -522,7 +755,18 @@ export class GthAgentRunner {
         // `assisted` mid-session with `/approvals`), and a broken profile should still fail loudly at
         // startup rather than at the moment they switch.
         const raterProfile = this.sessionApprovals.rater;
-        this.raterModel = raterProfile ? await resolveRaterModel(raterProfile) : undefined;
+        this.raterModel = raterProfile
+            ? await resolveRaterModel(raterProfile, 'approvals.rater')
+            : undefined;
+        // [[EXT-127]] — and the same for the alignment checker, which is a second model with a second
+        // profile. `resolveApprovals` has already defaulted the key to the rater's profile, so the
+        // common case resolves the SAME name twice rather than branching here: two loads of one profile
+        // at startup is cheaper than a shortcut that would silently stop working the moment the two
+        // names differ, which is the configuration the key exists for.
+        const checkerProfile = this.sessionApprovals.alignmentChecker;
+        this.alignmentCheckerModel = checkerProfile
+            ? await resolveRaterModel(checkerProfile, 'approvals.alignmentChecker')
+            : undefined;
         // Initialize debug logging
         initDebugLogging(configIn.debugLog ?? false);
         debugLog(`Initializing GthAgentRunner with command: ${command || 'default'}`);
@@ -575,7 +819,11 @@ export class GthAgentRunner {
         // standing from the previous one and clears BOTH bounds. The turn's own messages then enter
         // §5.1's last-5 window, which is what makes "just the last two" reach the rater at all — the
         // reply that narrows what the agent proposes is worthless to the gate if only the agent hears it.
-        this.negotiation.humanReached();
+        this.endNegotiation();
+        // [[TUI-C69]] §5.4 — and the tone hints go with it. The ids matter only while the results
+        // carrying them are on screen; the previous turn's are spent, and an id that outlived its turn
+        // could only ever mis-tone a later row.
+        this.clearRaterClarifications();
         this.negotiation.noteUserMessages(humanMessageTexts(messages));
         debugLog('Processing messages...');
         debugLogObject('Input Messages', messages);
@@ -667,6 +915,14 @@ export class GthAgentRunner {
             const enhancedMessage = enhanceVertexUnauthorizedMessage(originalMessage, this.config?.llm);
             throw new Error(`Agent processing failed: ${enhancedMessage}`, error instanceof Error ? { cause: error } : undefined);
         }
+        finally {
+            // [[TUI-C69]] §5.4 — the turn is over, so the argument is over. The reasoning is the same as
+            // in {@link processMessagesWithEvents}; it is here too so the seam is a property of *ending a
+            // turn* rather than of the event path, and a string-path surface that grows an `end` is not
+            // the one place the panel outlives its turn. Display-only, and a no-op on today's readline
+            // surface, which appends to scrollback and implements no `end`.
+            this.clearNegotiationDisplay();
+        }
     }
     /**
      * Accumulate a text stream into a single string. Extracted so {@link processMessages} and
@@ -868,6 +1124,166 @@ export class GthAgentRunner {
             this.negotiation.noteProgress();
         return decision;
     }
+    /**
+     * [[EXT-29]] §5.3 / [[TUI-C69]] §5.4 — **a person was reached, so the exchange is over**: the
+     * gate's own transcript is spent and the surface showing it is told, on the same event.
+     *
+     * Every direct `humanReached()` in this class goes through here, which is what keeps the two from
+     * drifting: a new site that spent the transcript without telling the display would leave a
+     * finished argument standing on screen, and at an escalation it would put the same exchange on an
+     * unscrollable dialog twice — once live, once in the prompt about to render all of it.
+     */
+    endNegotiation() {
+        this.negotiation.humanReached();
+        this.clearNegotiationDisplay();
+    }
+    /**
+     * [[TUI-C69]] §5.4 — **take the finished argument off the screen WITHOUT spending the gate's
+     * transcript.**
+     *
+     * The two are separate on purpose. `humanReached()` clears the rounds *and* the reachability
+     * bound, which is correct only when a person was actually reached; calling it merely to tidy the
+     * panel would hand the agent a fresh {@link MAX_REJECTIONS_BEFORE_HUMAN} budget it had already
+     * spent, turning a display concern into a way to argue indefinitely. [[EXT-108]] made an approved
+     * call stop clearing the transcript for exactly this reason, so the tidy-up cannot be the thing
+     * that puts it back.
+     *
+     * Guarded, like {@link showNegotiationRound}: a surface that throws while clearing must never
+     * change what the gate decided, or become the reason a turn ends.
+     */
+    clearNegotiationDisplay() {
+        try {
+            this.negotiationDisplay?.end?.();
+        }
+        catch (e) {
+            debugLogError('negotiation display end', e);
+        }
+    }
+    /**
+     * [[TUI-C69]] §5.4 — **tell the agent to forget the tool-call ids the rater bounced**, on every
+     * event that ends a turn's display state: a new turn, and `/clear`.
+     *
+     * The runner decides *when* because it owns the turn boundary; the agent holds the set because it
+     * owns the rendering. Fail-soft in the shape {@link resetRunStats} uses — an agent without the
+     * method (a test double, a renderer-less agent) is simply skipped, and a tone hint must never be
+     * the reason a turn fails to start.
+     */
+    clearRaterClarifications() {
+        try {
+            this.agent?.clearRaterClarifications?.();
+        }
+        catch (e) {
+            debugLogError('clear rater clarifications', e);
+        }
+    }
+    /**
+     * [[TUI-C69]] §5.4 — **hand one round of the argument to the surface that is showing it**, the
+     * moment the gate decided it.
+     *
+     * The round travels raw. Every surface lays it out from the SAME rows the escalation prompt
+     * draws, at its own terminal width, so the rounds a person watches and the rounds they later rule
+     * on cannot be two different renderings of one exchange — and the rater's turns are yellow in
+     * both because the rows carry the voice rather than a colour.
+     *
+     * No-ops when no surface is watching, which is the §5.5 seam as well as this one.
+     */
+    showNegotiationRound(event) {
+        const display = this.negotiationDisplay;
+        if (!display)
+            return;
+        try {
+            display.round(event);
+        }
+        catch (e) {
+            // A surface that throws while drawing must never change what the gate decided.
+            debugLogError('negotiation display round', e);
+        }
+    }
+    /**
+     * [[TUI-C69]] §5.4/§5.5 — **the rater agreeing is the last round of the argument, and it is held
+     * on screen before it takes effect.**
+     *
+     * Two things, in this order, because the order is the requirement: the approving round is drawn,
+     * and only then does the minimum visible interval run. A hold before the draw would be a pause
+     * over nothing.
+     *
+     * **It is a visibility pause, not a reading window**, and it must never be relied on as an
+     * opportunity to evaluate the command — nobody reads a command in 800 ms. What it buys is that
+     * the approving round is on screen as its own event instead of being overwritten by the tool
+     * output that follows it immediately.
+     *
+     * **What it is NOT, on either surface, is a guaranteed abort window — do not restore that claim
+     * without building the mechanism.** Stated precisely, because the previous wording asserted a
+     * mechanism that is not here and a comment like that stops the next reader checking:
+     *
+     * - **Event/TUI path.** An abort raised during the hold does end the run with the tool unrun, but
+     *   *this code is not why*. The runner never re-checks the signal after the hold — it issues the
+     *   approving resume regardless — and what stops the tool is that LangGraph refuses an
+     *   already-aborted signal downstream. True today, and true by someone else's invariant.
+     * - **Plain/readline path.** Not true at all. `resolveToolInterrupts` threads no signal, and
+     *   `waitForEscape` is armed inside `streamFromInput` and torn down before the hold begins — the
+     *   hold happens *between* streams. Esc during it is not handled, so the command runs. The pause
+     *   still buys the visibility above, which is why it is not conditioned on the surface.
+     *
+     * Making the affordance real by construction — checking the signal here, and threading one into
+     * the readline path so there is something to check — is deliberately left out of scope rather
+     * than half-built, since a window honoured on one surface and not the other is the more dangerous
+     * shape: it is what teaches the user the gesture that then silently fails.
+     *
+     * **Both halves are gated on a surface being wired**, so a headless `exec`/CI run neither draws
+     * nor sleeps and pays nothing. See {@link negotiationDisplay}.
+     */
+    async showNegotiatedApproval(command, justification, verdict) {
+        if (!this.negotiationDisplay)
+            return;
+        // **A negotiated approval is one that ANSWERS A REFUSAL THAT IS STILL STANDING** — not merely
+        // one that happens later in a turn where something was refused.
+        //
+        // `consecutiveRejections` is exactly that question, already maintained for §5.3: it counts
+        // rejections since the last approval, so it is non-zero only while the argument is unanswered
+        // and `noteProgress()` puts it back to zero the moment any call gets through. Testing the
+        // TRANSCRIPT instead is what made this wrong — since [[EXT-108]] an approved call deliberately
+        // leaves the rounds standing, so a transcript test stays true for the whole rest of the turn,
+        // and the six read-only commands an agent runs after one refusal each got a hold and a row
+        // claiming the rater had agreed to them.
+        //
+        // Not cosmetic: it inverts §5.5. The hold exists to give the approval an argument produced its
+        // own salience, and a window that opens on everything marks nothing.
+        //
+        // **Deliberately NOT "the transcript contains this exact command".** That reads well and is
+        // wrong: the case this node exists for is a negotiation that CONVERGES, and an agent converges
+        // by narrowing — `git reset --hard origin/main` becomes `git reset --soft HEAD~2`, which the
+        // transcript has never held. Gating on an exact match would make the node's own canonical
+        // scenario draw nothing at all. The exact match decides the LABEL below, where being wrong
+        // costs a word instead of the feature.
+        //
+        // A first attempt rated `safe` is not a negotiated approval either: nothing was refused, so
+        // there is no argument for a person to have watched, and the counter is zero.
+        if (this.negotiation.counters().consecutiveRejections === 0)
+            return;
+        const transcript = this.negotiation.transcript();
+        const rejections = transcript.length;
+        // Did the rater refuse THIS command and then pass it, or pass something else? Only the first is
+        // the rater agreeing; the second is it accepting a different command. Saying "Agreed" over a
+        // command nobody argued about prints a false statement about the auto-rater.
+        const revised = !transcript.some((round) => round.command === command);
+        // The approving round sits AFTER every rejection, so the whole transcript precedes it — but it
+        // is `agreed`, so it is LABELLED rather than numbered. A number here would be the very one the
+        // next rejection takes: this call never joins the transcript, and the escalation prompt renders
+        // that transcript, so the two views would give one number to two different commands.
+        this.showNegotiationRound({
+            round: {
+                command,
+                ...(justification ? { justification } : {}),
+                outcome: verdict?.outcome ?? 'safe',
+                reason: verdict?.reason ?? '',
+            },
+            position: rejections,
+            agreed: true,
+            ...(revised ? { revised: true } : {}),
+        });
+        await new Promise((resolve) => setTimeout(resolve, NEGOTIATED_APPROVAL_COOLDOWN_MS));
+    }
     /**
      * [[TUI-C27]] — {@link decideToolApprovalInner} with the record closed off on EVERY exit.
      *
@@ -954,24 +1370,30 @@ export class GthAgentRunner {
         });
         // (1) Deny — before everything, including `bypass`.
         if (rule?.action === 'deny') {
-            // [[TUI-C26]] §6 — the message names the refusal the user actually made. A deny entry now has
-            // two possible authors: a line in `approvals.deny`, and the escalation menu's *always reject*
-            // choice earlier in this session. Telling the model (and, through it, the user) to edit a
-            // config file that the second kind was never written to is the same class of wrongness as
-            // confirming a persistence that did not happen. The declared list is checked FIRST so an
-            // entry a user wrote is described as theirs even when the menu recorded the identical one.
-            const declared = this.sessionApprovals.deny.some((entry) => renderApprovalEntryObject(entry) === renderApprovalEntryObject(rule.entry));
+            // [[TUI-C26]] §6/[[EXT-107]] — the message names the refusal the user actually made, and each
+            // of the three authors is undone somewhere different: a line in `approvals.deny` is edited
+            // out of a config file, a saved refusal is lifted from the project's deny file, and a session
+            // one simply ends with the session. Telling the model (and, through it, the user) to edit a
+            // file the refusal was never written to is the same class of wrongness as confirming a
+            // persistence that did not happen. The declared list is checked FIRST so an entry a user
+            // wrote is described as theirs even when the menu recorded the identical one.
             const described = describeApprovalEntry(rule.entry);
+            const key = renderApprovalEntryObject(rule.entry);
+            const declared = this.sessionApprovals.deny.some((entry) => renderApprovalEntryObject(entry) === key);
+            const saved = !declared &&
+                (this.getPersistedDenials()?.list() ?? []).some((grant) => renderApprovalEntryObject(grant.entry) === key);
             record.ruleMatch = { action: 'deny', entry: described };
-            return this.stage(record, 'deny-list', {
-                type: 'reject',
-                message: declared
-                    ? `Refused: your deny list forbids this call (matched "${described}"). ` +
-                        'Remove the entry from approvals.deny if you want it to run.'
+            const message = declared
+                ? `Refused: your deny list forbids this call (matched "${described}"). ` +
+                    'Remove the entry from approvals.deny if you want it to run.'
+                : saved
+                    ? `Refused: the user chose to always refuse this, and it was saved to this project ` +
+                        `(matched "${described}"). The refusal stands in new sessions too; ask the user if ` +
+                        'you believe it should be lifted, which they can do with the /approvals command.'
                     : `Refused: the user chose to always refuse this earlier in this session (matched ` +
                         `"${described}"). That refusal lasts until the session ends; ask the user if you ` +
-                        'believe it should be lifted.',
-            });
+                        'believe it should be lifted.';
+            return this.stage(record, 'deny-list', { type: 'reject', message });
         }
         // (2) `bypass` (config or `/approvals bypass`): approve a gated shell command WITHOUT
         // prompting or rating. Scope `once` so nothing is written to the allow-list (the bypass is
@@ -1088,7 +1510,7 @@ export class GthAgentRunner {
                 // entry does not decide whether the banner appears. The entry has already been overruled by
                 // the time this line is reached; letting it also silence the one way out would make the
                 // recovery depend on a match the human cannot see from the banner.
-                return await this.haltOrRunAnyway(command, tripwire.verdict?.reason ?? '', record);
+                return await this.haltOrRunAnyway(command, tripwire.verdict?.reason ?? '', record, subject);
             }
             // `catastrophic` — the one outcome the tripwire escalates. Fall through to the human.
             safetyVerdict = tripwire.verdict;
@@ -1123,11 +1545,61 @@ export class GthAgentRunner {
                 // in the rating prompt (`buildRaterPrompt`) and nothing else.
                 // [[EXT-29]] §5.1 — the negotiation this rating is a round of. At `assisted` the context is
                 // empty and `negotiable` is false, so the whole call is byte-identical to what it was.
-                const negotiable = isNegotiatingRung(approvals.rung);
+                //
+                // [[EXT-106]] §3 — and it is false at `auto` too for a command §4.6's preflight floors,
+                // through the SAME `isNegotiableCall` the decision below reads. Telling the rater to word a
+                // rejection "for an agent that may answer it" is simply FALSE there: nothing it writes can
+                // move an outcome the floor recomputes from the raw command every round. Two writers of one
+                // fact is what this shares a function to avoid.
+                //
+                // **It also withholds the justification and the transcript from that rating**, and that
+                // follows rather than being a side effect: both exist so a rating can be revised in the
+                // light of an argument, and there is no argument on this path — the call goes to a person
+                // on its first round instead.
+                //
+                // [[EXT-106]] §4.6 — **the provenance is read ONCE here, and every reader of the carve-out
+                // is given that one snapshot.** `this.negotiation` is mutable and the rating below is
+                // awaited, so three separate reads of it — the negotiability test before the call, the
+                // decision after it, the archive after that — would be the two-writer hazard these doc
+                // blocks exist to prevent, rebuilt around an await. One read fixes the input; the derivation
+                // itself is then a pure function of (rung, raw command, snapshot) that each reader runs
+                // through the one shared helper, exactly as both readers already recompute the preflight
+                // from the raw command rather than being handed a result to trust. That is also what makes
+                // the rung scope unforgeable: `carvedOpenWorldHosts` enforces `auto` itself, so this call
+                // site cannot widen it by forgetting.
+                //
+                // **NOT `contextFor()`.** That returns no user messages at round 1 by design (§5.1), and
+                // round 1 — the user asks, the agent proposes, nothing has been refused yet — is the round
+                // the carve-out exists to act on. §5.1 bounds what the RATER may see; the floor is not the
+                // rater.
+                //
+                // **And "was this call carved?" is asked of the DECISION's own reader, once.** The carve is
+                // one arm of a floor with two, and only `effectivePreflightFloorFinding` resolves which arm
+                // wins: a command that trips the script-env-leak arm as well is floored by that one and is
+                // not carved at all, whatever the open-world arm would have said on its own. Reading
+                // `carvedOpenWorldHosts` directly for the archive, the prompt or the warning is a SECOND
+                // derivation of the same fact that does not know about arm precedence — so those three would
+                // report a carve on a command that was floored and did go to a human. Deriving the hosts
+                // from the effective finding keeps them empty whenever the floor stood, which is what makes
+                // "carved" mean the same thing to every reader of it.
+                const provenance = this.negotiation.retainedUserMessages();
+                const effectiveFloor = effectivePreflightFloorFinding(subject.command, {
+                    rung: approvals.rung,
+                    provenance,
+                });
+                const carvedHosts = effectiveFloor === null
+                    ? carvedOpenWorldHosts(approvals.rung, subject.command, provenance)
+                    : [];
+                const negotiable = isNegotiableCall(approvals.rung, subject.command, provenance);
                 const justification = negotiable ? shellJustification(tool.args) : undefined;
-                const context = negotiable
-                    ? this.negotiation.contextFor(justification)
-                    : undefined;
+                // [[EXT-127]] — **the checker gets the justification whatever the rung said**, because it is
+                // a different reader with a different framing. §5.1's gate above existed to keep the one
+                // channel that can LOWER a rating out of a round-1 rating; the classifier can no longer see
+                // it at any round, so that gate now protects nothing there. The checker reads it as what it
+                // is — agent-authored text in the tool-result role — where nothing about it is trusted.
+                // Kept as a separate read so the variable the ROUND RECORD and the negotiated-approval
+                // display use is byte-for-byte what it was.
+                const agentJustification = shellJustification(tool.args);
                 // [[TUI-C27]] — attributed BEFORE the call, and ONCE. Before, because `attack` throws out
                 // of the decision below and a record left unattributed would say a halt came from nowhere.
                 // Once, because a second assignment on each `return` would make the first unfalsifiable:
@@ -1136,28 +1608,194 @@ export class GthAgentRunner {
                 record.stage = 'rater';
                 const verdict = await this.rateCommand(subject.command, {
                     allowMatched: false,
-                    negotiation: context,
                     negotiable,
+                    // [[EXT-106]] §4.6 — the rating PROMPT has to know too. Two of its blocks assert that
+                    // §4.6's floor already fired and that the rater's hostname judgement is therefore not
+                    // what decides; on a carved command both are backwards, and on this one command the
+                    // rater's assessment really is the last line.
+                    carved: carvedHosts.length > 0,
                 }, record);
-                const decision = mapVerdictToAction(subject.command, verdict, { rung: approvals.rung });
+                const decision = mapVerdictToAction(subject.command, verdict, {
+                    rung: approvals.rung,
+                    provenance,
+                });
                 // [[TUI-C27]] — WHICH deterministic preflight fired, and whether it actually rewrote the
                 // rating. The two are separate facts: a preflight only ever RAISES, and only `safe` sits
                 // below the floor, so a finding on a `destructive` verdict is the floor AGREEING with the
                 // rater rather than overriding it — and attributing the decision to the floor in that case
                 // would be wrong. Recomputed from the same raw command `mapVerdictToAction` recomputes it
                 // from, through the same one function, so the two cannot disagree.
+                //
+                // [[EXT-106]] §4.6 — **the PURE finding, deliberately, so a carve does not empty the
+                // archive.** The decision above reads the carve-aware form; this reads what the preflights
+                // found in the string, and the carve is recorded BESIDE it as its own two facts. A user
+                // opening a dump of their own session most needs to find the case where an open-world
+                // command ran with nobody asked, and a record nulled out by the carve is precisely the one
+                // that would be missing.
+                //
+                // **`floorApplied` is read off the decision's own reader, not derived a second time.** It
+                // answers "did the readers act on this finding?", which is `effectivePreflightFloorFinding`
+                // and nothing else: computing it from the carved hosts instead would say "carved, not
+                // floored" about a command whose script-env-leak arm floored it and sent it to a human. Both
+                // fields therefore come from `effectiveFloor`, which is also what the decision, the
+                // negotiability test and the prompt above were built from.
                 const preflight = preflightFloorFinding(subject.command);
                 if (preflight) {
                     record.preflight = {
                         ...preflight,
                         rewroteRating: isBelowDestructiveFloor(verdict.outcome),
+                        floorApplied: effectiveFloor !== null,
+                        ...(carvedHosts.length > 0 ? { carvedHosts: [...carvedHosts] } : {}),
                     };
                 }
-                if (decision.action === 'approve') {
+                // [[EXT-127]] — **THE ALIGNMENT CHECK: a second model, reached only once the classifier has
+                // declined.** The classifier rated the command; this asks the different question the
+                // classifier can no longer see the context for — *is this what the user asked for?*
+                //
+                // **It is a stage AFTER `mapVerdictToAction`, never a branch inside it, and that placement
+                // is the design.** The classifier's mapping stays a pure function of the rung, the raw
+                // command and the outcome, so the eval target, the corpus and every unit assertion keep
+                // measuring the same thing they measured before; what the check does is take that decision
+                // and, on exactly the outcomes the node grants it authority over, replace it.
+                //
+                // **What it is allowed to reach.** Only a `destructive` decision, and only at a negotiating
+                // rung. `attack` has already halted above the return below; `catastrophic` returns its own
+                // escalation from the mapping and is never offered here; and both are refused a second time
+                // by the tool contract itself (`alignmentApprovalRefusal`), because a limit the rest of the
+                // ladder relies on must not be reachable by a call site forgetting.
+                //
+                // **The floored arm is included, and it has to be.** §4.6's open-world floor is one of the
+                // two things an aligned approval MAY lift, and a floored command reaches this line as an
+                // `escalate` rather than a `reject` — so a check keyed on `reject` alone would make the
+                // single largest piece of authority this feature has unreachable. The SCRIPT-ENV-LEAK arm is
+                // deliberately not included: it is a fact about the command's own text (an interpreter
+                // expanding a secret into a script), nothing about who asked for it speaks to it, and the
+                // node grants no authority over it.
+                let action = decision.action;
+                let alignment;
+                const alignmentReachable = isNegotiatingRung(approvals.rung) &&
+                    decision.verdict?.outcome === 'destructive' &&
+                    (decision.action === 'reject' ||
+                        (decision.action === 'escalate' && effectiveFloor?.kind === 'open-world'));
+                if (alignmentReachable) {
+                    alignment = await this.checkAlignment({
+                        command: subject.command,
+                        outcome: 'destructive',
+                        reason: decision.verdict?.reason ?? '',
+                        ...(agentJustification ? { justification: agentJustification } : {}),
+                    }, provenance, record);
+                    // The three tools ARE the three actions, which is why there is no fourth.
+                    //
+                    // **A check that never happened changes nothing**, which is a stronger contract than "it
+                    // fails closed" and is the one that matters here: the classifier's action stands, so a
+                    // missing or broken checker model leaves `auto` behaving exactly as it did before this
+                    // feature existed rather than quietly turning every negotiation into an interruption. See
+                    // {@link ALIGNMENT_FAIL_CLOSED}.
+                    if (!isAlignmentFailClosed(alignment)) {
+                        action =
+                            alignment.kind === 'approve'
+                                ? 'approve'
+                                : alignment.kind === 'suggest'
+                                    ? 'reject'
+                                    : 'escalate';
+                    }
+                    else {
+                        // Not recorded on the round either: a check that did not happen is not one the next
+                        // round should replay as its own earlier turn.
+                        alignment = undefined;
+                    }
+                }
+                if (action === 'approve') {
+                    // [[EXT-106]] §4.6 — **a carved command that RUNS is announced.** The carve-out removes
+                    // the confirmation dialog; it must never remove the visibility, or an open-world fetch
+                    // reaches the network with the user told nothing at all. Visible for the same reason the
+                    // hardline refusal above is: an event the user never sees reads as the agent quietly
+                    // deciding things on their behalf.
+                    //
+                    // **The trigger is carved AND approved AND not lifted by the alignment check.** This
+                    // sentence tells the user *"the auto-rater found nothing wrong with it"*, and the residual
+                    // risk it covers is exactly the one case the rater saw nothing in — so it is true of a
+                    // carved command the classifier itself cleared, and false of one the classifier rated
+                    // `destructive` and the check below lifted. [[EXT-127]] made that second path reachable,
+                    // so this branch now states the case it was always describing rather than assuming it.
+                    // The lifted path is announced ONCE, by the merged arm of `alignmentApprovalNotice`, which
+                    // names the same host this line would have.
+                    const alignmentLifted = alignment?.kind === 'approve';
+                    if (carvedHosts.length > 0 && !alignmentLifted) {
+                        this.statusUpdate(StatusLevel.WARNING, `\n⚠ Ran a command that reaches ${carvedHosts.join(', ')} without asking you, ` +
+                            'because your own message named that host and approvals is set to ' +
+                            // §10 rule 4 — the resolved rung is rendered in its DISPLAY spelling wherever the
+                            // mode is stated, never in the §9.1 identifier. This branch is reachable only at
+                            // that rung, so the label is read from the map rather than spelled here: a table
+                            // nobody has to remember to update is what keeps the two from drifting.
+                            `${APPROVAL_RUNG_LABELS.auto}. The auto-rater found nothing wrong with it. ` +
+                            'Check the host is the one you meant.');
+                    }
+                    // [[EXT-127]] — **and an announcement whenever the ALIGNMENT CHECK is what let the
+                    // command run**, which is the other way a command now runs at `auto` with nobody asked.
+                    // The two notices are separate wherever the two causes are, because they are two
+                    // different claims about why nothing interrupted: the one above says the user typed the
+                    // host, this one says a second model read their messages and concluded the command
+                    // matches what they asked for. A user auditing their own session must be able to tell
+                    // those apart, and a shared sentence would let the weaker of the two stand in for the
+                    // stronger.
+                    //
+                    // **Where BOTH applied, one merged notice says both**, which is why the hosts are handed
+                    // to the renderer. `reachesNetwork` cannot carry them: it reads which FLOOR stood, and a
+                    // carved command is precisely one where none did — so a merged line keyed on it would drop
+                    // the host guidance on the one path where the user's own message authorised the fetch.
+                    //
+                    // **Both arms of it, not only the floored one.** A plain `destructive` lifted by the
+                    // checker is the COMMON case and reaches the screen through nothing else:
+                    // `showNegotiatedApproval` below gates on §5.3's `consecutiveRejections`, which is zero on
+                    // round 1 — the round most of these approvals happen on — so that path returns without
+                    // drawing. Announcing the rare floored arm and staying silent on the common one would put
+                    // the weaker guarantee on screen and leave the stronger one invisible.
+                    //
+                    // Rendered by the alignment module's own one renderer rather than spelled here, so the
+                    // two arms cannot come to describe one event two ways.
+                    if (alignmentLifted) {
+                        this.statusUpdate(StatusLevel.WARNING, alignmentApprovalNotice({
+                            command: subject.command,
+                            rungLabel: APPROVAL_RUNG_LABELS.auto,
+                            reachesNetwork: effectiveFloor?.kind === 'open-world',
+                            carvedHosts,
+                        }));
+                    }
+                    // [[TUI-C69]] §5.4/§5.5 — **the round that ENDS a negotiation is a round too**, and it
+                    // is the one §5.5 holds on screen. What makes an approval *negotiated* is that an
+                    // argument is STILL UNANSWERED when it arrives — `showNegotiatedApproval` gates on
+                    // §5.3's `consecutiveRejections` — and **not** that this exact command is on the
+                    // transcript. Read that method's docblock before changing anything here; the two
+                    // statements below are the ones people get wrong.
+                    //
+                    // **What is and is not held.** A first attempt rated `safe` is not held: nothing was
+                    // refused, so the counter is zero and there is no argument anyone could have watched.
+                    // But a command that merely follows someone else's argument **is** held and **is**
+                    // drawn — labelled `Accepted:` rather than `Agreed:`, because the rater never refused
+                    // that particular command. That is deliberate. The unit of the feature is the ARGUMENT,
+                    // and whichever call gets through is the one that ends it.
+                    //
+                    // **The exact-command rule was rejected on measurement, not taste.** An agent converges
+                    // by NARROWING, so the node's own canonical scenario is approved on a command the
+                    // transcript has never held (`git reset --hard origin/main` → `git reset --soft
+                    // HEAD~2`). Gating on a literal match would make that case draw nothing at all, firing
+                    // only when the agent FAILS to narrow — the inverse of what §5.5 is for. The match still
+                    // decides the LABEL below, where being wrong costs a word instead of the feature.
+                    //
+                    // **Read BEFORE `decideToolApproval`'s wrapper calls `noteProgress()` — this ordering is
+                    // REQUIRED, not defensive.** That wrapper resets §5.3's consecutive counter on every
+                    // approve, and this call site sits inside the decision it wraps, so the reset lands just
+                    // after the `approve` returned below. The counter it zeroes is the exact one the gate
+                    // reads: run it first and `showNegotiatedApproval` returns at that gate without drawing
+                    // or sleeping, so the hold never fires on any path — no row, no error, every surface.
+                    // The negotiation specs pin it (moving the reset above this call reds the §5.4/§5.5
+                    // cells), which is the only reason a silent, total failure is catchable here.
+                    await this.showNegotiatedApproval(subject.command, justification, decision.verdict);
                     // Scope `once`: rater approvals are NEVER persisted to the allow-list.
                     return { type: 'approve', scope: 'once' };
                 }
-                if (decision.action === 'halt') {
+                if (action === 'halt') {
                     // §4.2 — not a rejection the model can respond to. It ends the agent loop.
                     //
                     // **`neg-04d`: a negotiation already in flight ends here too**, mid-way and without a
@@ -1170,37 +1808,107 @@ export class GthAgentRunner {
                     // sees this state again — which is not the same as it being unobservable**, and the
                     // difference decides whether the line is pinned. `neg-04d` asserts both halves through
                     // the spec harness's private-state cast: the cleared transcript, and `sinceHuman` back at
-                    // zero. That second one is what distinguishes this call from `noteProgress()`, which
-                    // clears the transcript and the consecutive count and deliberately leaves the
+                    // zero. Since [[EXT-108]] both halves distinguish this call from `noteProgress()`, which
+                    // resets the consecutive count alone and deliberately leaves the rounds and the
                     // reachability bound standing.
-                    this.negotiation.humanReached();
+                    this.endNegotiation();
                     // §6.1 — the banner, when an interactive surface wired one, and the halt otherwise. It
                     // sits AFTER the reset above on purpose: a human is reached either way (that is what the
                     // banner is), so the negotiation ends here whichever answer comes back, and neither
                     // answer leaves a transcript behind for a later turn to argue from.
-                    return await this.haltOrRunAnyway(subject.command, decision.verdict?.reason ?? '', record);
+                    return await this.haltOrRunAnyway(subject.command, decision.verdict?.reason ?? '', record, subject);
                 }
-                if (decision.action === 'reject') {
-                    // §5 — `destructive` at `auto`. The round is recorded first, so the attempt being ruled
-                    // on is itself on the transcript the human sees (§5.6).
-                    const outcome = this.negotiation.recordRejection({
-                        command: subject.command,
-                        ...(justification ? { justification } : {}),
-                        outcome: decision.verdict?.outcome ?? 'destructive',
-                        reason: decision.verdict?.reason ?? '',
+                // §5 — the attempt just ruled on, as the transcript records it.
+                //
+                // **ONE builder for both of the paths that record a round**, because it is one fact: an
+                // attempt was made, the gate refused to let it run, and this is what each party said about
+                // it. Two literal copies would be two writers of the transcript's own shape, and the copy
+                // that got forgotten would be the escalating one — which is exactly the round a person is
+                // being asked to rule on.
+                //
+                // [[EXT-127]] — the checker's own decision rides on the round, so the NEXT round's check
+                // can replay it as its own turn. Absent when no check was made, which is what keeps an
+                // `assisted` rejection and a floored one out of the checker's replayed history.
+                const negotiationRound = () => ({
+                    command: subject.command,
+                    ...(justification ? { justification } : {}),
+                    outcome: decision.verdict?.outcome ?? 'destructive',
+                    reason: decision.verdict?.reason ?? '',
+                    ...(alignment ? { alignment } : {}),
+                });
+                /**
+                 * [[TUI-C69]] §5.4 — record the round and put it on the screen, in that order.
+                 *
+                 * The position is read AFTER `recordRejection`, so the count carries this round: the k-th
+                 * rejection sits at position k-1, which numbers it `Round k` on screen — the number the
+                 * escalation transcript would give the same round.
+                 *
+                 * **The round reaches the screen HERE, as it happens**, not only at the escalation this
+                 * argument may never reach. Emitted for the escalating round too: the exchange is rendered
+                 * as it happens, and the round that spends a bound is part of it. The prompt's own
+                 * transcript is then the summary a person rules on, which is a different job from watching
+                 * the argument run.
+                 */
+                const recordAndShow = (round) => {
+                    const verdict = this.negotiation.recordRejection(round);
+                    this.showNegotiationRound({
+                        round,
+                        position: this.negotiation.counters().rejectionsSinceHuman - 1,
                     });
+                    return verdict;
+                };
+                // [[EXT-127]] — **an escalation the CHECKER decided is a round, and is recorded as one.**
+                //
+                // `action` is `escalate` here, so the `reject` block below is skipped entirely and nothing
+                // else on this path would record anything. Two things were lost with it, and both are the
+                // reject path's stated reason for recording first: the attempt being ruled on was absent
+                // from the transcript the human is shown (§5.6), and the checker's own decision — the
+                // thing that ended the argument — was carried nowhere, so neither the next round, the
+                // escalation prompt's payload nor the archive could say what it decided or why.
+                //
+                // **Only a check that actually ran and actually escalated.** A fail-closed check has
+                // already been erased to `undefined` above, deliberately — a check that did not happen is
+                // not a round the next one should replay as its own turn — and a floored `escalate` the
+                // checker never lifted is the classifier's decision, not the checker's.
+                //
+                // **The verdict `recordRejection` returns is deliberately ignored**, which is the one way
+                // this differs from the reject path. That return answers *"may another round be served?"*,
+                // and the checker has just ruled that a person decides; letting a spare bound turn its
+                // escalation back into another agent round would reverse the decision this line exists to
+                // record.
+                if (alignment?.kind === 'escalate')
+                    recordAndShow(negotiationRound());
+                if (action === 'reject') {
+                    const outcome = recordAndShow(negotiationRound());
                     if (outcome === 'reject') {
-                        // §7 — the refusal PLUS the moves: re-call with a justification (the tool argument
-                        // exists for this), call a different command, or ask the user. Rendered through the
-                        // one builder the human's own "no" uses, differing only in who refused, so the model
-                        // never meets two shapes of the same event.
+                        // [[TUI-C69]] §5.4 — name the call the gate is about to refuse BACK TO THE AGENT, so
+                        // both surfaces tone its result row as a clarification request rather than as a failed
+                        // tool. Only this branch: an escalation, a human's "no", a deny entry and the §8
+                        // floor's refusal are all refusals rather than rounds of an argument.
+                        if (tool.id)
+                            this.agent?.noteRaterClarification?.(tool.id);
+                        // §7 — the refusal PLUS the moves the model actually has: re-call with a
+                        // justification (the tool argument exists for this), or call a different command.
+                        // Rendered through the one builder the human's own "no" uses, differing only in who
+                        // refused, so the model never meets two shapes of the same event.
+                        // [[EXT-127]] — **the checker's requested change is APPENDED to the rater's rejection,
+                        // never substituted for it.** The two say different things and the agent needs both:
+                        // the rater says what is wrong with the command, the checker says what would make it
+                        // match what the user asked for. Substituting would also silently change who the
+                        // rejection is attributed to on every surface that renders it, which is a display
+                        // decision this node deliberately does not make.
+                        const rejection = buildRejectionMessage({
+                            source: 'rater',
+                            toolName: tool.name,
+                            verdict: decision.verdict,
+                        });
                         return {
                             type: 'reject',
-                            message: buildRejectionMessage({
-                                source: 'rater',
-                                toolName: tool.name,
-                                verdict: decision.verdict,
-                            }),
+                            message: alignment?.kind === 'suggest' && alignment.reason.trim().length > 0
+                                ? `${rejection}\n\nThe alignment check also asked for a change: ${alignment.reason.trim()}${alignment.suggestedCommand
+                                    ? `\nIt suggested: ${alignment.suggestedCommand.trim()}`
+                                    : ''}`
+                                : rejection,
                         };
                     }
                     // A bound is spent — the agent and the rater cannot agree, and that is a human's call.
@@ -1247,21 +1955,38 @@ export class GthAgentRunner {
         // recorder having failed, which is the opposite of what happened.
         record.stage ??= 'unrated-rung';
         const negotiationRounds = this.negotiation.transcript();
-        // §5.3 — **the count the human is given, and it is NOT the transcript's length.** An approved
-        // call clears the transcript, so the rounds above are the attempts since the last approval
-        // while the fact the reader is weighing is how hard the agent pushed since the last person:
-        // the agent that stashed between refusals had five refused attempts and three surviving
-        // rounds. Read HERE, one line before `humanReached()` spends it — after, it is zero.
+        // §5.3 — **the count the human is given: how hard the agent pushed since the last person.**
+        // [[EXT-108]] brought it into agreement with the transcript's length, because an approved call
+        // now erases no rounds and reaching a person clears both together. It is still passed rather
+        // than left to the renderer's fallback: a screen too small for every round prints a slice, and
+        // this is the number the heading over that slice has to carry. Read HERE, one line before
+        // `humanReached()` spends it — after, it is zero.
         const negotiationAttempts = this.negotiation.counters().rejectionsSinceHuman;
         // Reaching a person ends the negotiation (§5.3) and is the ONE thing that clears the
         // reachability bound: an escalation the human is about to answer is exactly the event that
         // bound exists to make happen, so it is spent here rather than accumulated across it.
-        this.negotiation.humanReached();
+        this.endNegotiation();
         if (!this.toolApprovalCallback) {
             // §6.2 — no one to ask. Exit non-zero with everything a person needs, rather than handing
             // the model a rejection it would just work around. The transcript goes into the message
             // because that message is the only thing anyone sees on this path.
-            throw new NonInteractiveEscalationError(command ?? tool.name, safetyVerdict?.outcome, safetyVerdict?.reason, escalatedBy, renderNegotiationTranscript(negotiationRounds, negotiationAttempts) ?? undefined);
+            //
+            // [[EXT-106]] §4 — including the `approvals.allow` entry that would let this run, derived
+            // HERE because only this scope knows the SUBJECT.
+            //
+            // [[EXT-115]] — **each kind through its own derivation, and both through the SAME ones the
+            // escalation menu stores.** A shell command resolves to its normalized self; a tool or MCP
+            // call resolves to the tool's identity plus the host it named, which is what §4.7.4 says a
+            // grant for one records. Deriving a `shell` entry from a tool name — the shape this used to
+            // be unable to avoid — would be a pasteable line that `matchEntry` refuses outright on the
+            // type alone. `toolGrantEntry` answers `null` for a call whose MCP server could not be
+            // attributed, which the ternary below already turns into the general form: an entry naming
+            // the unresolved sentinel would be written and then dropped by the grammar's own validator.
+            const allowEntry = subject.kind === 'shell' ? shellApprovalEntryFor(subject.command) : toolGrantEntry(subject);
+            throw new NonInteractiveEscalationError(command ?? tool.name, safetyVerdict?.outcome, safetyVerdict?.reason, escalatedBy, renderNegotiationTranscript(negotiationRounds, negotiationAttempts) ?? undefined, allowEntry ? renderApprovalEntryObject(allowEntry) : undefined, 
+            // [[EXT-115]] — the discriminator the whole decision above ran on, so the message names
+            // what it gated instead of calling a `write_file` or an MCP call a `Command`.
+            subject);
         }
         // §4.2 — **a `catastrophic` approval is NEVER sticky.** "The human may approve this one
         // invocation, and only this one": no always-allow, and no session-scoped allow either. The
@@ -1328,16 +2053,37 @@ export class GthAgentRunner {
         // they said" are two different questions, and collapsing them into one field is what makes a
         // dump unable to tell a rater escalation from a declared one.
         record.humanAnswer = decision.type === 'approve' ? 'approve' : 'reject';
+        // [[EXT-150]] — **what the answer landed as**, which is not what the answer asked for. It starts
+        // at `once` and only a record that was actually made moves it, so the three paths that store
+        // nothing report the one-shot answer they really are: an approve with no grant on offer (a
+        // `catastrophic` verdict, a command that does not statically resolve, a call nothing can
+        // attribute), a reject carrying no scope, and a reject at a scope for a call with no deny entry.
+        let lifetime = 'once';
         // Record the human's scoped grant so the same call stops re-prompting.
         if (decision.type === 'approve' && grant) {
-            this.recordApproval(grant, decision.scope ?? 'once');
+            lifetime = this.recordApproval(grant, decision.scope ?? 'once');
         }
         // §6 — and the mirror: *always reject* records the refusal, so the next identical call is
-        // refused by rule at step (1) without reaching a person. Scoped `session` and nothing else,
-        // because that is the only lifetime the store has (see {@link ToolRejectScope}).
-        if (decision.type === 'reject' && decision.scope === 'session' && denyEntry) {
-            this.recordDenial(denyEntry);
+        // refused by rule at step (1) without reaching a person. [[EXT-107]] — at the scope the surface
+        // asked for, which for every escalation menu's `[d]` is `always`; the lifetime that LANDS is
+        // `recordDenial`'s to decide and to report.
+        if (decision.type === 'reject' && decision.scope !== undefined && denyEntry) {
+            lifetime = this.recordDenial(denyEntry, decision.scope);
         }
+        return this.reportOutcome(pending, decision, lifetime);
+    }
+    /**
+     * [[EXT-150]] — tell the surface what its own answer landed as, and hand the decision straight
+     * back.
+     *
+     * A one-liner returning the decision, exactly as {@link stage} is, and for the identical reason:
+     * the report happens ON the return that carries the decision rather than on the line above it, so
+     * no early return can later be inserted between the two and leave a surface waiting for an answer
+     * that never comes. There is one return out of {@link decideToolApprovalInner} after the callback
+     * is awaited, and this is it.
+     */
+    reportOutcome(pending, decision, lifetime) {
+        this.approvalOutcomeCallback?.({ pending, decision: decision.type, lifetime });
         return decision;
     }
     /**
@@ -1362,8 +2108,8 @@ export class GthAgentRunner {
         const approvals = this.sessionApprovals;
         const verdict = await rateShellCommand(command, this.config, {
             home: env?.HOME,
-            negotiation: opts.negotiation,
             negotiable: opts.negotiable,
+            carved: opts.carved,
             // [[TUI-C27]] — the sink fires BEFORE the model is invoked, with the prompt that is about to
             // be sent, so the record carries what the rater was SHOWN rather than a later re-render of
             // it. Assigning it here (rather than pushing a finished record afterwards) is what makes a
@@ -1404,8 +2150,61 @@ export class GthAgentRunner {
                 (this.raterTimeouts > 1 ? ` — ${this.raterTimeouts} times this session` : '') +
                 '. Raise approvals.raterTimeoutMs if the rater is a local model.');
         }
+        // [[EXT-82]] — the RATE, not the call. EXT-66's notice above explains ONE occurrence and says
+        // nothing about a session in which the rater never answers at all; this one says that, once,
+        // and the tracker is what makes it a rate rather than a latch. The inputs come from the call's
+        // own capture rather than from the verdict's wording: the rater is itself instructed to say it
+        // could not assess a command, so a reason-prefix test would count a model that obeyed as a gate
+        // that failed.
+        const rating = record.rating;
+        if (rating) {
+            const signal = this.raterHealth.record({
+                failClosed: rating.failClosed,
+                failure: rating.providerError,
+                model: rating.model,
+                // §3.2 — an allow match already decided this call, so a failed tripwire rating did not make
+                // a verdict default and must not be counted as though it had.
+                countsTowardRate: !opts.allowMatched,
+            });
+            if (signal)
+                this.statusUpdate(StatusLevel.WARNING, signal);
+        }
         return verdict;
     }
+    /**
+     * [[EXT-127]] — **one alignment check**, with the `user` role fed from the settled provenance
+     * channel and nothing else.
+     *
+     * **`provenance` is `ShellNegotiationState.retainedUserMessages()`, read ONCE by the caller and
+     * handed down**, exactly as §4.6's floor reads it. Three things are true of it and only of it: it
+     * is EMPTY until `admitUserProvenance` positively established that this session's human turns are
+     * the user's own words (so `review` and `pr`, which fold a fetched diff into a human message,
+     * contribute nothing); it is not `noteUserMessages`' raw store, which answers a different question
+     * for a different reader; and it is not `humanMessageTexts`, the unfiltered upstream. Reading any
+     * of the other three here would make the one place this design says provenance is structural the
+     * one place it is not.
+     *
+     * The prior rounds come from the transcript's own alignment decisions, so the checker meets its
+     * earlier turns as its own turns rather than as a quoted summary of them.
+     */
+    async checkAlignment(subject, provenance, record) {
+        const approvals = this.sessionApprovals;
+        return await runAlignmentCheck(subject, this.config, {
+            // The checker's own model when a profile resolved one; `undefined` falls back to the session
+            // model, exactly as the classifier's does.
+            model: this.alignmentCheckerModel,
+            userMessages: provenance,
+            priorRounds: this.negotiation.alignmentRounds(),
+            home: env?.HOME,
+            // ONE budget for ONE gate decision. There is deliberately no second timeout: `raterTimeoutMs`
+            // is what the user owns, and a check is one call.
+            timeoutMs: approvals.raterTimeoutMs,
+            ...(approvals.alignmentChecker ? { profile: approvals.alignmentChecker } : {}),
+            onCapture: (capture) => {
+                record.alignment = capture;
+            },
+        });
+    }
     /**
      * EXT-58 (§4.3/§4.4) — the built-in tools already granted at the session's CURRENT rung, as
      * names plus one-line locally-authored descriptions, for the rater prompt.
@@ -1458,7 +2257,22 @@ export class GthAgentRunner {
         const approvals = this.sessionApprovals;
         const persisted = approvals.rung === 'bypass' ? null : this.getPersistedGrants();
         return {
-            deny: [...approvals.deny, ...this.denyGrants.entries()],
+            // [[EXT-107]] — three sources of refusal, and the persisted one is read at EVERY rung,
+            // `bypass` included. That is not an oversight of the allow side's guard, it is the opposite
+            // of it: deny is resolved at step (1) of `decideToolApprovalInner`, *before* the `bypass`
+            // return, so a saved refusal that switched itself off at `bypass` would be a promise the file
+            // stops keeping the moment someone relaxes the gate — the one direction this design never
+            // fails in. Reading it there is also side-effect-free: the deny store runs no migration, so
+            // its load never writes (see `PersistedApprovalGrantsOptions.legacyPrefixMigration`).
+            //
+            // Concatenation order decides nothing about deny-vs-allow — `resolveApprovalRules` consults
+            // the whole deny list before any allow entry — so a command matching a saved allow AND a
+            // saved deny is refused, whichever file was written first.
+            deny: [
+                ...approvals.deny,
+                ...this.denyGrants.entries(),
+                ...(this.getPersistedDenials()?.entries() ?? []),
+            ],
             escalate: approvals.escalate,
             allow: [...approvals.allow, ...this.sessionGrants.entries(), ...(persisted?.entries() ?? [])],
         };
@@ -1482,6 +2296,9 @@ export class GthAgentRunner {
             const filePath = getGslothConfigWritePath(SHELL_ALLOWLIST_FILE);
             this.persistedGrants = new PersistedApprovalGrants(filePath, {
                 onNotice: (notice) => this.statusUpdate(notice.level, notice.message),
+                // [[EXT-143]] — the word a load-failure notice uses for what this file holds. The store is
+                // list-agnostic and stays so; only the message needs to know, and only the caller can say.
+                holds: 'approvals',
             });
         }
         catch (e) {
@@ -1491,6 +2308,50 @@ export class GthAgentRunner {
         }
         return this.persistedGrants;
     }
+    /**
+     * [[EXT-107]] — lazily load (once per instance) the persisted **refusal** store, the mirror of
+     * {@link getPersistedGrants}. Returns null when it cannot be loaded at all, in which case an
+     * `always` refusal degrades to `session`.
+     *
+     * **No `bypass` guard, and no v1 migration**, and the two are the same decision. The allow side
+     * skips the file at `bypass` so a session with the gate switched off neither reads nor *rewrites*
+     * the project's grants; the only thing that rewrites on load is the v1 `prefixes` migration, and
+     * turning it off here makes this store's load a pure read. That is what lets it be consulted at
+     * every rung — which it must be, because a refusal is resolved before the `bypass` return and a
+     * saved refusal that lapsed when the gate was relaxed would be worthless.
+     *
+     * It is also loaded by the `/approvals` DISPLAY, unlike its allow-side twin. The rule there — a
+     * display must not create the store in order to show it — is a rule about writing, and this load
+     * cannot write. The reason to break the symmetry is that the display is the escape hatch: a saved
+     * refusal a user cannot see is one they cannot lift, and a fresh session has made no gated call
+     * yet.
+     */
+    getPersistedDenials() {
+        if (this.persistedDenialsLoaded)
+            return this.persistedDenials;
+        this.persistedDenialsLoaded = true;
+        try {
+            const filePath = getGslothConfigWritePath(SHELL_DENYLIST_FILE);
+            this.persistedDenials = new PersistedApprovalGrants(filePath, {
+                onNotice: (notice) => this.statusUpdate(notice.level, notice.message),
+                legacyPrefixMigration: false,
+                // [[EXT-143]] — the mirror of the allow store's word, and the reason the store takes one at
+                // all: a broken deny file loses refusals, and a message that said "approvals" would name
+                // the wrong loss in the one place the user has to act on it.
+                holds: 'refusals',
+            });
+        }
+        catch (e) {
+            // Path/IO failure → behave as no persisted refusals. This one is NOT safe in the way the
+            // allow side's failure is: it loses refusals rather than approvals, so nothing here refuses
+            // any more and the call falls to whatever else covers it — a prompt at most rungs, and no
+            // prompt at all at `bypass` or under a matching allow entry, where it simply runs. It still
+            // degrades rather than ending the run, and [[EXT-143]]'s notice is what makes it visible.
+            debugLogError('Loading persisted shell refusals', e);
+            this.persistedDenials = null;
+        }
+        return this.persistedDenials;
+    }
     /**
      * §3.1/§4.7.4/§6 — **the grant a sticky choice would write for this call**, or `undefined` when
      * none is on offer. The one place that question is answered, so the menu's *this is what will be
@@ -1540,9 +2401,8 @@ export class GthAgentRunner {
         if (this.sessionApprovals.rung === 'bypass')
             return undefined;
         if (subject.kind === 'shell') {
-            if (classifyCommand(subject.command, normalizeCommand) === null)
-                return undefined;
-            return { entry: shellGrantEntry(subject.command) };
+            const entry = shellApprovalEntryFor(subject.command);
+            return entry ? { entry } : undefined;
         }
         if (subject.name === SHELL_TOOL_NAME)
             return undefined;
@@ -1585,7 +2445,7 @@ export class GthAgentRunner {
      * - **`run_shell_command` arriving as a TOOL subject gets a tool entry** — a shell call whose
      *   `command` argument cannot even be read. On the allow side that entry would auto-approve every
      *   future unreadable shell call, which is why it is excluded there; as a refusal it stops the
-     *   shell tool for the session, and the dialog says so in the words the entry is written in.
+     *   shell tool outright, and the dialog says so in the words the entry is written in.
      *
      * The one genuine exclusion is an **MCP call whose server could not be attributed**
      * ({@link toolGrantEntry} returns `null`): the grammar's `server` cannot be the empty string, so
@@ -1601,19 +2461,51 @@ export class GthAgentRunner {
         return toolGrantEntry(subject) ?? undefined;
     }
     /**
-     * §6 — record the menu's *always reject* choice, for the life of this runner instance.
+     * §6/[[EXT-107]] — record the menu's *always reject* choice at the given scope. `once` remembers
+     * nothing; `session` holds the refusal for the life of this runner instance; `always` additionally
+     * writes it to the project's deny file, so it is still in force after a restart.
+     *
+     * It lands in the same lists `approvals.deny` entries are matched from ({@link approvalRuleLists}
+     * concatenates the three), so a refusal the human made at the prompt and one they wrote in their
+     * config are one list to the matcher.
+     *
+     * **The recorded scope is derived from whether the entry REACHED THE FILE** ([[EXT-149]]) — what
+     * {@link PersistedApprovalGrants.add} returns — and not from whether the store was allowed to try.
+     * Those differ on a read-only checkout, where the file is simply absent, so the load did not fail,
+     * `canPersist()` is true, and every write throws: asking permission stamped `always` on an answer
+     * that reached no disk, and nothing told the user. **Do not describe that gap's cost as "one
+     * re-prompt next session":** the entry is not on disk, so next session it applies to nothing and
+     * the call is left to the rest of the gate — another rule may refuse it, it may be prompted for,
+     * or it may run without asking under `bypass` or a matching saved allow.
      *
-     * It lands in the same store `approvals.deny` entries are matched from ({@link approvalRuleLists}
-     * concatenates the two), so a refusal the human made at the prompt and one they wrote in their
-     * config are one list to the matcher and one list to `/approvals`.
+     * **Two records, not one patched afterwards.** {@link ApprovalGrantStore.add} holds the very
+     * object it is handed whenever the grant carries no annotation snapshot — which every refusal
+     * does, since {@link denyEntryFor} builds an entry and never a snapshot — so stamping one object
+     * `always` and correcting it after the write would reach inside whatever {@link denyGrants}
+     * already holds and whatever the display renders from it. The persisted store is handed the
+     * `always` record it will hold if the write lands (and takes back if it does not); the session
+     * store is handed its own record, stamped from the answer.
      *
-     * **Session-lifetime, and there is nothing else to choose.** There is no persisted deny file;
-     * whether there should be is a question about a file users live with, not about this prompt. What
-     * the surfaces must not do is say otherwise — a confirmation promising a persistence that did not
-     * happen is §6's *offered and then refused* with the evidence hidden.
+     * The persisted store is still told even when it cannot write, because telling it is what reports
+     * the refused or failed write to the user, and it declines to hold what it did not write.
+     *
+     * **It RETURNS the lifetime it recorded** ([[EXT-150]]) — the same value it stamps the record with,
+     * handed back rather than left for a caller to re-derive. The surface that asked has to say what
+     * happened, and re-deriving it there would put the "did the write land" question in two places
+     * that could come to disagree, which is the whole failure this and [[EXT-149]] are about.
      */
-    recordDenial(entry) {
-        this.denyGrants.add({ entry, grantedAt: new Date().toISOString(), scope: 'session' });
+    recordDenial(entry, scope) {
+        if (scope === 'once')
+            return 'once';
+        const persisted = scope === 'always' ? this.getPersistedDenials() : null;
+        const grantedAt = new Date().toISOString();
+        const saved = persisted?.add({ entry, grantedAt, scope: 'always' }) ?? false;
+        const landed = saved ? 'always' : 'session';
+        // Both stores, exactly as `recordApproval` writes both: the in-memory copy is what keeps the
+        // refusal in force for this run even when the file cannot be written, and the display
+        // de-duplicates by entry identity.
+        this.denyGrants.add({ entry, grantedAt, scope: landed });
+        return landed;
     }
     /**
      * §3.1/§6 — record a human-granted approval at the given scope. `once` remembers nothing.
@@ -1622,20 +2514,34 @@ export class GthAgentRunner {
      *
      * What is recorded was decided by {@link stickyGrantFor} and shown to the human before they
      * answered; this only stamps it with when and at what scope.
+     *
+     * **The stamped scope says whether this grant REACHED THE FILE**, the mirror of
+     * {@link recordDenial} and derived the same way ([[EXT-149]]): an `always` whose store is absent,
+     * whose file could not be read and so must not be rewritten ([[EXT-144]]), or whose write threw on
+     * a checkout nothing can write, is recorded as the `session` grant it actually is — and the store
+     * reports the last of those rather than swallowing it.
+     *
+     * Two records rather than one patched afterwards, for the reason argued in {@link recordDenial}:
+     * {@link ApprovalGrantStore.add} holds the object it is handed for a grant with no annotation
+     * snapshot — every shell grant — so a scope corrected after the write would be corrected inside
+     * {@link sessionGrants}.
+     *
+     * The store is still loaded only for `always`, unchanged: a display must not create the file in
+     * order to show it, and a `session` grant has no business opening it.
+     *
+     * **It RETURNS the lifetime it recorded** ([[EXT-150]]), the mirror of {@link recordDenial} and for
+     * the same reason: the surface's confirmation is written from this value rather than from the key
+     * the human pressed.
      */
     recordApproval(grant, scope) {
         if (scope === 'once')
-            return;
-        const grantScope = scope;
-        const record = {
-            ...grant,
-            grantedAt: new Date().toISOString(),
-            scope: grantScope,
-        };
-        this.sessionGrants.add(record);
-        if (scope === 'always') {
-            this.getPersistedGrants()?.add(record);
-        }
+            return 'once';
+        const persisted = scope === 'always' ? this.getPersistedGrants() : null;
+        const grantedAt = new Date().toISOString();
+        const saved = persisted?.add({ ...grant, grantedAt, scope: 'always' }) ?? false;
+        const grantScope = saved ? 'always' : 'session';
+        this.sessionGrants.add({ ...grant, grantedAt, scope: grantScope });
+        return grantScope;
     }
     /**
      * §4.7.4 — **drop a tool grant the tool has since weakened out from under, with a notice naming
@@ -1729,12 +2635,32 @@ export class GthAgentRunner {
         // standing from the previous one and clears BOTH bounds. The turn's own messages then enter
         // §5.1's last-5 window, which is what makes "just the last two" reach the rater at all — the
         // reply that narrows what the agent proposes is worthless to the gate if only the agent hears it.
-        this.negotiation.humanReached();
+        this.endNegotiation();
+        // [[TUI-C69]] §5.4 — and the tone hints go with it. The ids matter only while the results
+        // carrying them are on screen; the previous turn's are spent, and an id that outlived its turn
+        // could only ever mis-tone a later row.
+        this.clearRaterClarifications();
         this.negotiation.noteUserMessages(humanMessageTexts(messages));
         debugLog('Processing messages (event stream)...');
         debugLogObject('Input Messages', messages);
-        yield* this.agent.streamWithEvents(messages, this.runConfig, signal);
-        yield* this.resolveToolInterruptsWithEvents(signal);
+        try {
+            yield* this.agent.streamWithEvents(messages, this.runConfig, signal);
+            yield* this.resolveToolInterruptsWithEvents(signal);
+        }
+        finally {
+            // [[TUI-C69]] §5.4 — **the turn is over, so the argument is over.** Until this existed the
+            // panel was cleared only by the NEXT turn's `endNegotiation`, so a negotiation that CONVERGED
+            // — the case this node exists to make visible — left its rounds pinned in the non-scrolling
+            // dock across exactly the idle period in which the user is trying to type into a prompt those
+            // rows have pushed off the screen. An escalation cleared itself; success did not.
+            //
+            // Display-only: see {@link clearNegotiationDisplay}. The gate's transcript belongs to the
+            // negotiation, not to the screen, and the next turn spends it on the human being reached.
+            //
+            // In `finally` because an abort and a thrown stream end the turn just as much as a return
+            // does, and those are the paths where rows left standing are least likely to be noticed.
+            this.clearNegotiationDisplay();
+        }
     }
     /**
      * Event-stream counterpart to {@link resolveToolInterrupts}: after a streamed run ends,
@@ -1831,6 +2757,11 @@ export class GthAgentRunner {
         // last-5 window is conversation context; leaving it behind a `/clear` would quote the user's
         // previous conversation into a rating made after they asked for it to be forgotten.
         this.negotiation.clear();
+        this.clearNegotiationDisplay();
+        // [[TUI-C69]] §5.4 — the noted tool-call ids are state from before the `/clear` too, and the
+        // sentence above is the whole argument for dropping them: they would decide how rows are drawn
+        // in a conversation the user has just asked to start fresh.
+        this.clearRaterClarifications();
         this.runConfig = getNewRunnableConfig();
         debugLogObject('Reset Runnable Config', this.runConfig);
     }