dsh-confirm-gate

DeepSeek Harness gate - per-turn persistent-operation counter: remind, instruct the model to stop, then ask for confirmation. Steps aside under sandbox/read-only modes; follows a live permission switch without restart. Verified on real hardware (full -> workspace-write -> read-only -> full). Crafted on an estimated 0.27 USD of model spend.

The gate now stays active under sandbox modes too. Previously it stepped aside in read-only and workspace-write, on the reasoning that a sandbox already bounds what the model can do. That reasoning covered what the model can touch, not how many times it touches it: 40 file edits inside a workspace-write session are still 40 edits, and still worth a nudge before the 41st.