Scope, SSH-only, read-only, disabled, admin and pending refusals ran before --json was stripped, so a scripted caller got plain text on stderr exactly when it needed the envelope. The flag is stripped right after lookup now. TestRefusalsHonourJSON covers four of the refusals.
Stacked on !202; no code dependency.
Closes #109
retargeted from drain-idle-conns to main: !202 merged
2026-09-04 00:10 UTC