On-device UAT hit an infinite politeness loop: 'every write requires a human confirmation you cannot bypass' read to the model as 'collect consent in text first', so it never called restart_app, the confirm gate never engaged, and each stateless turn (history is 13-10) dropped the user's 'confirmed' into a void. The preamble now states the intended contract: the node presents the trusted dialog the moment the tool is called; a text pre-ask stalls the action and trains rubber-stamping. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>