Say "cannot run here" and why, instead of "off" #8

Merged

LNK merged 1 commit from claude/refusal-reason into main

2026-09-04 19:40:34 +00:00

LNK commented

2026-09-04 19:40:33 +00:00

Contributor

The last item on the review's list. A signal the machine refused at startup reached the console as off, the same word as one the person switched off, beside a switch that would record a grant and then do nothing.

What changes. Refusals are written to signal_state at startup with the machine's own sentence. The snapshot reports refused ahead of every other state, the console shows "cannot run here" with the sentence and disables the switch, and SetGrant for a refused signal answers with the sentence instead of recording a grant. The pill leaves refused signals out of its chips and its screen-reader summary says "cannot run here". A refusal from a previous run is cleared at the next start if it no longer applies.

Proof. A refused signal reports itself refused with the sentence while an ordinary ungranted one is still off; switching it on is answered with the sentence and records no grant; a stale refusal is cleared; the status line does not count a refused signal as on. Linux verifier green on the pinned toolchain.

The last item on the review's list. A signal the machine refused at startup reached the console as `off`, the same word as one the person switched off, beside a switch that would record a grant and then do nothing. **What changes.** Refusals are written to `signal_state` at startup with the machine's own sentence. The snapshot reports `refused` ahead of every other state, the console shows "cannot run here" with the sentence and disables the switch, and `SetGrant` for a refused signal answers with the sentence instead of recording a grant. The pill leaves refused signals out of its chips and its screen-reader summary says "cannot run here". A refusal from a previous run is cleared at the next start if it no longer applies. **Proof.** A refused signal reports itself refused with the sentence while an ordinary ungranted one is still off; switching it on is answered with the sentence and records no grant; a stale refusal is cleared; the status line does not count a refused signal as on. Linux verifier green on the pinned toolchain.

LNK added 1 commit

2026-09-04 19:40:33 +00:00

Say "cannot run here" and why, instead of "off" fff915a661

At startup the gate asks the machine what it cannot do and refuses those grants, with a
sentence somebody can act on — grant Screen Recording, install the extension, this desktop
cannot confirm the indicator is visible. The sentence went to stderr. The console then read
the grant row, found it false, and showed the signal as `off`: the same word as a signal the
person switched off themselves, beside a switch that, flipped, would record a grant and do
nothing. Since the last change added a second class of refusal — a signal that would record
people who never pressed Start — the console had two things it could not explain.

The refusals are written to `signal_state` at startup, state `refused` with the machine's
own sentence as the reason. The snapshot reports that state ahead of everything else, the
console shows "cannot run here" with the sentence underneath and disables the switch, and
`SetGrant` for a refused signal answers with the sentence instead of a grant — the same
refusal for the switch that startup already applied to the environment. The pill leaves a
refused signal out of its chips the way it leaves out one that is off, and its screen-reader
summary says "cannot run here" rather than "off". A refusal from a previous run on a machine
that has since changed is cleared at the next start, so a permission granted overnight does
not stay refused.

Tests: a refused signal reports itself refused with the sentence while an ordinary ungranted
one is still just off, switching it on is answered with the sentence and records no grant,
and a refusal that no longer applies is cleared. The console's status line does not count a
refused signal as on.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

LNK merged commit 2bd3424ffa into main

2026-09-04 19:40:34 +00:00

LNK referenced this pull request from a commit

2026-09-04 19:40:34 +00:00

Merge pull request #8 from claude/refusal-reason

LNK referenced this pull request

2026-09-07 10:02:12 +00:00

WIP: integrate native Capture, private insights and HERE Capture Rooms #22