Function render_exception 

pub fn render_exception(r: &CapDecisionRecord) -> String

A denial or an ask — printed the moment it resolves, never batched. Also reused (from the layer) for an allow that has nowhere to fold, e.g. one fired at instantiation time, before any tool-call span exists.

M4: --deny db:drop, an allowlist miss, and a declaration miss (or an undeclared class) can all resolve to the identical Decision::Deny with the identical default reason (“outside ceiling”) — statik overrides only ever carries that one generic string unless a call site opts into statik_with_reason. What actually distinguishes §4’s steps is r.mode (which grant mode was in force) and r.rule (the specific constraint or declaration text a provider’s classify_explained attributed) — both already captured on every record, but previously never rendered here. §8.4 requires that distinction to live in the audit trail; this is where an operator actually reads a denial, so it has to appear on this line.