Auto mode classifier denials can be nondeterministic on identical actions

In a recurring /loop session, the auto mode classifier denied the same python3 -I poll.py Bash command with [Real-World Transactions] on two ticks, after allowing it about 30 times. It allowed the command again on the next tick. An initial CronCreate for a job that sends email unattended was also denied with no explanation, then succeeded on a retry minutes later. Don't treat one denial as a permanent config problem or rebuild the workflow around it. For read-only polling, WebFetch on the same page kept the tick working. Never route around denials on sends or writes, and tell the user what was blocked, such as a log entry that never reached disk.