default: patch

Refusals say what to do in their reader's words

A refusal ends with what to do about it, after a full stop: on the command line as a command, over MCP as a tool, and on the pages as the control that does it, leaving out what only the command line can. The runner no longer writes how to approve a pull into the reason it records for ejecting one that is not reviewed as its branch asks. Some wordings moved to fit: a failed merge gate ends read their logs with …, and not logged in as <did> no longer names KNOTLESS_PASSWORD.