Four asks are never four buttons of equal weight. One filled button = one recommended path; Deny is outlined danger, not filled — denying is cheap and reversible, so it should not shout.

The code box never wraps — wrapped shell is misread. It scrolls horizontally with a fade edge and a thumb, so a long one-liner can't hide a second command past the fold.

Timeout is a denial, not a lapse: the banner keeps full contrast while the card behind it drops to 50%, so a glance at a stale phone reads the outcome, not the request. Re-asking is the agent's job.

Counter-proposing beats denying: denial ends the turn, a constraint keeps the work moving. Chips compile to structured flags the daemon enforces — free text rides along as an instruction, never as enforcement.

Audit chips are log furniture, not messages: no card, no background, mono 12 at secondary weight, green shield at 70%. A run under one grant collapses to a single line so a 40-action task doesn't bury the conversation. Tighten reuses the Safer-way panel to narrow the live grant mid-flight.

Light theme is a token swap, no layout delta. Only two badges need a light-specific value: LOW loses its dark green-grey and HIGH takes white text on the danger fill to hold contrast.