@r1z4x/tezgah 1.5.1 → 1.7.0

package/hooks/tezgah_integrity.py

@@ -37,8 +37,8 @@ try:
 except ImportError:  # not POSIX: a legacy JSONL ledger was appended unlocked
     fcntl = None
 
-from tezgah_paths import (SWITCHES, _toplevel, cache_dir, latch, off, reply_lang,
-                          root_for)
+from tezgah_paths import (SWITCHES, _toplevel, alts, cache_dir, language, latch,
+                          off, pack_values, packs, root_for, say, spend_cap)
 import tezgah_store as ts
 
 # A command that actually checks the change, as opposed to one that merely runs.
@@ -254,8 +254,10 @@ LITERALS = re.compile(
     r"'(?:\\.|[^'\\\n])*'|\"(?:\\.|[^\"\\\n])*\"|"
     r"/\*(?:.|\n)*?\*/|//[^\n]*|#[^\n]*")
 HEREDOC = re.compile(r"<<-?\s*['\"]?([A-Za-z_][A-Za-z0-9_]*)['\"]?")
-# a completion / verification claim, English and Turkish. The forms are the ones
-# the machine's own transcripts were measured to use (161 final replies in
+# a completion / verification claim, in every shipped language: the fragments
+# live in hooks/lang/<code>.json (`done`, `verified`), and `alts` joins every
+# pack's into one alternation (S5). The forms are the ones the machine's own
+# transcripts were measured to use (161 final replies in
 # ~/.omp/agent/sessions/-Projects-tezgah, 2026-09-19): the completed-state
 # spelling is the common one and the list this replaces missed 13 of 15
 # hand-drawn completions - "güncellendi", "Push tamam", "kuruldu", "eklendi",
@@ -264,26 +266,26 @@ HEREDOC = re.compile(r"<<-?\s*['\"]?([A-Za-z_][A-Za-z0-9_]*)['\"]?")
 # is refused on its evidence whatever the vocabulary says (the trigger below),
 # so this list is read for the claim row's detail - and therefore for the
 # false-completion denominator - not for the verdict.
-DONE = re.compile(
-    r"\b(done|complete[d]?|finished|implemented|fixed|shipped|landed|merged|"
-    r"wired up|wired into|all tests? pass|all checks? pass|"
-    r"(?:tests?|checks?|suite) (?:is |are )?(?:green|passing)|"
-    r"build (?:passes|is green)|"
-    r"yaptım|tamamladım|tamamlandı|bitirdim|bitirildi|ekledim|eklendi|"
-    r"düzelttim|düzeltildi|hallettim|güncellendi|kuruldu|uygulandı|"
-    r"yayına girdi|kapatıldı|yüklendi|"
-    r"tüm testler geçti|testler geçti|testler yeşil|çalışıyor)\b", re.I)
-VERIFIED = re.compile(
-    r"\b(tested|verified|i ran|ran the (?:tests?|suite|build|lint|checks?)|"
-    r"doğruladım|test ettim|kontrol ettim|denetledim|doğrulandı|test edildi)\b",
-    re.I)
+DONE = re.compile(r"\b(%s)\b" % alts("done"), re.I)
+VERIFIED = re.compile(r"\b(%s)\b" % alts("verified"), re.I)
 # The DONE forms that say a check passed ("all tests pass", "testler yeşil"):
 # such a claim rests on a pass even when the turn only edited prose.
 TESTED_WORD = re.compile(r"test|check|suite", re.I)
-# an explicit admission that removes the lie: an unverified claim is allowed
-NEGATED = re.compile(
-    r"doğrulanmadı|doğrulamadım|unverified|not verified|could ?n[o']t verify|"
-    r"verification (?:was )?skipped|kontrol edilmedi|test edilmedi", re.I)
+# An explicit admission that the work is unverified. Until plan 080 the word
+# alone cleared every claim branch, so writing it was cheaper than verifying;
+# it now clears only a class whose repair is a check (ADMITTED_CLASSES), and
+# only when a check ran and failed after the turn's newest change
+# (`_failed_since_change`, applied by `_admitted`).
+NEGATED = re.compile(alts("negated"), re.I)
+ADMITTED_CLASSES = frozenset(("check failed", "partial failure", "stale evidence",
+                              "no verify_ok"))
+# What the evidence classes tell the model the admission takes, in one place.
+# The admission word and the blocker tokens are the contract's own, filled from
+# the configured language's pack when the refusal is written (`_said`).
+ADMISSION = ('"{UNVERIFIED}" ends the turn only after a check that ran and failed '
+             'since the newest change; quote its error line. A failing check of '
+             'your own code is work to fix, not a blocker: list it under '
+             '"{BLOCKERS_HEADING}" only when it truly is {ACCESS} or {ENV}, typed so')
 # Rule 10 of skills/i-have-adhd/SKILL.md - "No preamble, no recap, no closer" -
 # names the forms a reply may neither open nor close on. Each alternative below
 # is quoted from that rule's own lines; none is invented:
@@ -304,13 +306,9 @@ NEGATED = re.compile(
 # carve-out does not reopen the end: "The user asks to explain or walk through:
 # explain fully. No preamble, no closer, but the body runs as long as the topic
 # needs" - only the body's length is freed.
-SYCOPHANT = re.compile(
-    r"^\s*(?:(?:evet|yes|ah|oh|hmm)[,!\s]+)?"
-    r"(?:haklısın|haklısınız|you'?re (?:absolutely )?right|you are right|"
-    r"absolutely right|good catch|great catch|iyi yakaladın|"
-    r"detaylı bakmadım|i didn'?t look closely|i should have checked|"
-    r"my mistake|my bad|sorry, i|"
-    r"great question|let me\b|i['’]ll\b|sure[!,.]|looking at your\b)", re.I)
+SYCOPHANT = re.compile(r"^\s*(?:(?:%s)[,!\s]+)?(?:%s)"
+                       % (alts("sycophant", "interjection"), alts("sycophant", "opener")),
+                       re.I)
 # The closer half of the same rule. Read on the reply's last PROSE line only
 # (`_closing_prose`), so a reply that ends on a code block, a heading or a table
 # ends on structure and is not judged here at all. Accepted false positive: a
@@ -318,9 +316,7 @@ SYCOPHANT = re.compile(
 # reads the same as making the sign-off. The skill's carve-out does not reopen
 # this end either: an explain/walkthrough run keeps "No preamble, no closer", and
 # the question rule 5 surfaces at the end is the user's question, not a sign-off.
-CLOSER = re.compile(
-    r"let me know if you need anything else|hope (?:this|that) helps|"
-    r"happy to clarify", re.I)
+CLOSER = re.compile(alts("closer"), re.I)
 # The reply shapes the contract bans and nothing counted: a reply that opens on a
 # table, and one that closes on a recap instead of a next action. Read by
 # `shape_flags` for a report-only row - a table is sometimes the right answer and
@@ -331,9 +327,7 @@ HEADING = re.compile(r"^\s*#{1,6}\s")
 FENCE = re.compile(r"^\s*(?:```|~~~)")
 # A closing line that names what comes next is the shape the contract asks for,
 # so its absence on a long reply's last line is what `recap-close` records.
-NEXT_ACTION = re.compile(
-    r"(?i)(?:next (?:step|action|up)|sıradaki adım|sonraki adım|next:)"
-    r"|^\s*(?:→|->)\s")
+NEXT_ACTION = re.compile(r"(?i)(?:%s)|^\s*(?:→|->)\s" % alts("next_action"))
 # A reply longer than this that closes on a recap is `recap-close`.
 SHAPE_LINES = 15
 # A top-level list item: a marker in column 0, the shape rules 2 and 8 count (a
@@ -345,22 +339,19 @@ ITEM = re.compile(r"^(?:\d+[.)]|[-*+])\s")
 # escape for a list whose completeness is the point is "headers so it can be
 # skimmed", and a heading ends the run below, as does any prose line.
 LIST_CAP = 5
-# The reply-language half of the exec rule ("Every user-facing reply in
-# Turkish"). A word list and six letters are not a language detector; they only
-# have to separate Turkish prose from English prose, which differ sharply on
-# both. Calibrated on the owner's omp transcripts (2026-09-27: 16,511 assistant
-# messages, 1,495 with at least LANG_MIN_WORDS prose words): English prose
-# scored 0.000-0.026, the most English-heavy Turkish reply 0.077 and the bulk
-# 0.3-0.7, so the cut sits between the two; 24 of the 1,495 fall under it, all
-# English or Chinese prose. Prose shorter than LANG_MIN_WORDS is not judged - a
-# one-line answer, a path or a command list is too short to call.
-TR_LETTERS = re.compile(r"[çğıöşüÇĞİÖŞÜ]")
-TR_WORDS = frozenset((
-    "ve", "bir", "bu", "şu", "için", "ile", "da", "de", "ama", "fakat", "ya",
-    "veya", "ne", "mi", "mı", "mu", "mü", "çok", "daha", "en", "gibi", "kadar",
-    "sonra", "önce", "var", "yok", "değil", "olarak", "olan", "her", "hem",
-    "ise", "ki", "artık", "hâlâ", "hala", "şimdi", "yani", "diye", "tüm",
-    "bütün", "kalan", "neden", "nasıl", "yeni", "eski", "evet", "hayır"))
+# The reply-language half of the exec rule. A word list and a letter set are
+# not a language detector; they only have to separate the configured
+# language's prose from English, which differ sharply on both: a pack's
+# `markers` (`reply_share`), and a language whose pack ships none is not
+# judged. The tr markers are calibrated on the owner's omp transcripts
+# (2026-09-27: 16,511 assistant messages, 1,495 with at least LANG_MIN_WORDS
+# prose words): English prose scored 0.000-0.026, the most English-heavy
+# Turkish reply 0.077 and the bulk 0.3-0.7, so the cut sits between the two;
+# 24 of the 1,495 fall under it, all English or Chinese prose. The short words
+# Spanish, French and Dutch share with Turkish (de, da, en, ne, ya, her, mi)
+# left the list (S5 F8: they passed those replies as Turkish at 0.07-0.31).
+# Prose shorter than LANG_MIN_WORDS is not judged - a one-line answer, a path
+# or a command list is too short to call.
 PROSE_WORD = re.compile(r"[^\W\d_]+", re.U)
 # Text inside a reply that is not prose in any language: inline code, a URL,
 # a path, a dotted or snake_case identifier, a `path:line` citation.
@@ -370,14 +361,18 @@ LANG_MIN_SHARE = 0.06
 # A lead that announces what follows instead of being it (rule 1 "Lead with the
 # answer", rule 10 "No preamble"). Report-only: "Sonuç:" over a list is an
 # answer label, not a preamble, and the two read the same to a regex.
-PREAMBLE = re.compile(
-    r"(?i)^\s*(?:here(?:'s| is| are)\b|below\b|the following\b|"
-    r"aşağıda|şöyle\b|öncelikle\b|şimdi\b)")
+PREAMBLE = re.compile(r"(?i)^\s*(?:%s)" % alts("preamble"))
 # The Stop classes that judge how a reply is written, not whether its claim has
 # evidence. They stay `claim` rows (the verdict is one row per reply) but are not
 # false completions: counters folds them into `shape_blocked` instead.
 SHAPE_BLOCKS = frozenset(("placating opener", "forbidden closer", "list cap",
                           "reply language"))
+# The Stop classes that refuse the work a reply left, not its claim: a backed
+# "testler geçti" beside "Açık kalanlar", a stopped slice or a question the
+# agent could decide is no false completion. Counted in `blocked_claims` under
+# their own class, kept out of `false_completion`.
+LIST_BLOCKS = frozenset(("residual work", "ready steps", "stopped slice",
+                         "needless ask"))
 
 WRITE_TOOLS = ("edit", "write", "multiedit", "notebookedit", "apply_patch",
                "str_replace_editor", "create_file", "str_replace", "edit_file",
@@ -428,7 +423,9 @@ USER_ERROR = re.compile(
     r"authentication (?:failed|required)|"
     r"(?:invalid|missing|no|bad|expired) (?:api[ _-]?key|credentials?)|"
     r"(?:api[ _-]?key|token|credentials?) (?:is |are |has )?(?:invalid|missing|expired)|"
-    r"not logged in|login required", re.I)
+    r"not logged in|login required|"
+    # a spent quota is a grant only the user can renew (S4 finding 6)
+    r"quota|key limit exceeded|usage limit", re.I)
 PERMANENT_ERROR = re.compile(
     r"command not found|no such file|not found|cannot find|permission denied|"
     r"unrecognized|unknown option|invalid|syntax error|does not exist|"
@@ -483,6 +480,18 @@ PERMANENT_ERROR = re.compile(
 # made mid-session only when one of these rows names it. `inflight` marks a
 # `turn` row written while a call was still unanswered (`_in_flight`): it
 # slices the turn like any other, and it is no boundary for `_in_flight`.
+# `reask` is a Stop refusal row's `_prompt_key` of its own text: the key the
+# `turn` row carries when a host hands the refusal back as a prompt (plan 083).
+# `open`, `ready` and `blocked` are a `todo` row's counts of the host's todo list
+# (`note_todo`), and `heads` the list of its ready items' heads, each redacted:
+# `detail` holds the same heads, one per line, under the row's cut.
+# `residual` is a `subagent_end` row's count of residual items no blocker type
+# accounts for (`unblocked_items`): the parent's Stop owes them (S4 finding 2).
+# `questions` and `defaults` are an `ask` row's counts (`note_ask`): the
+# questions an ask-tool call put to the user and how many carried a
+# recommended option. A `grant` row's `target` is the outward class a user's
+# grant covers (`all`, or an OUTWARD key), or `lift:<class>` when a prompt took
+# it back (`grants_in_force`).
 LEDGER_FIELDS = frozenset(("id", "exit", "out_bytes", "fail_class", "workspace",
                            "source", "hash", "changed", "tool", "target",
                            "lines", "chars", "items", "longest_list",
@@ -490,7 +499,9 @@ LEDGER_FIELDS = frozenset(("id", "exit", "out_bytes", "fail_class", "workspace",
                            "summary_chars", "summary_hash",
                            "constraint_found", "constraint_expected", "parent", "agent",
                            "check", "key", "block", "repo", "empty_run", "cause",
-                           "host", "switches", "harness", "authorized", "inflight"))
+                           "host", "switches", "harness", "authorized", "inflight",
+                           "reask", "open", "ready", "blocked", "heads", "residual",
+                           "questions", "defaults"))
 
 # The row contract's own version, stamped by the writer beside `kind` and `ts` so
 # it is not a caller field. It exists because a row is read back to decide a
@@ -900,8 +911,9 @@ DAMAGE_KIND = "ledger_damage"
 TAMPERED = (
     "Evidence tampered: a line of this session's evidence ledger is not a row "
     "(recorded as `ledger_damage`), so the ledger cannot carry a done or tested "
-    "claim this turn. Say what is unverified (\"doğrulanmadı\") and tell the "
-    "user the ledger was damaged; the ledger is theirs to inspect.")
+    "claim this turn, nor the failed check an admission rests on. Drop the "
+    "claim, say what is unverified and tell the user the ledger was damaged; "
+    "the ledger is theirs to inspect.")
 # The damaged lines this process already recorded, so a reader that parses the
 # same tail on every gated call scans the file for the row once, not each time.
 _DAMAGE_SEEN = set()
@@ -1167,9 +1179,10 @@ def scratch_target(path, cwd=None):
     return False
 
 
-def writers_elsewhere(path, session_id, minutes=10, cwd=None):
+def writers_elsewhere(path, session_id, minutes=10, cwd=None, lineage=False):
     """The other sessions that recorded a write of `path` in the last `minutes`,
-    newest first, as ledger ids.
+    newest first, as ledger ids. With `lineage`, each one is a (ledger id,
+    relation, agent, newest write ts) tuple instead (`_relation`).
 
     `path` is resolved against `cwd` (`_abs_target`) and matched against the
     `target` the writing session's PostToolUse hook stored, which is that
@@ -1214,7 +1227,74 @@ def writers_elsewhere(path, session_id, minutes=10, cwd=None):
             continue
         if isinstance(row, dict) and row.get("target") == want:
             found[stem] = max(found.get(stem, stamp), stamp)
-    return sorted(found, key=lambda stem: -found[stem])
+    stems = sorted(found, key=lambda stem: -found[stem])
+    return [(stem,) + _relation(stem, session_id) + (found[stem],)
+            for stem in stems] if lineage else stems
+
+
+# The rows that name a session's lineage at its start: `spawned` (a subagent's
+# parent, written by the hosts' subagent start) and `forked` (an omp fork's
+# parent, written by the omp hook from the session header's `parentSession`).
+LINEAGE_KINDS = ("spawned", "forked")
+
+
+def _lineage(stem):
+    """{kind: (parent ledger id, raw parent id, agent)} of the first row of each
+    LINEAGE_KINDS in ledger `stem`; {} when it has none or cannot be read."""
+    out = {}
+    for kind in LINEAGE_KINDS:
+        try:
+            texts = ts.evidence_rows(os.path.join(cache_dir(), "evidence",
+                                                  stem + ".jsonl"), kind=kind)
+        except ts.ERRORS:
+            continue
+        for text in texts:
+            try:
+                row = json.loads(text)
+            except ValueError:
+                continue
+            if isinstance(row, dict) and row.get("parent"):
+                raw = str(row["parent"])
+                out[kind] = (_slug(raw), raw, str(row.get("agent") or ""))
+                break
+    return out
+
+
+def _relation(stem, session_id):
+    """(relation, agent) of writer ledger `stem` to session `session_id`: `child`
+    (its `spawned` row names this session; agent is the child's name),
+    `parent`, `sibling` (both spawned by one parent), `fork` (an omp fork of
+    this session), `forked-from` (the session this one was forked from), else
+    `unrelated`. The race rule names it and exempts a child that has ended
+    (research orchestrator-flow-audit S7, findings 3 and 4)."""
+    theirs, mine = _lineage(stem), _lineage(_slug(session_id))
+    spawn, fork = theirs.get("spawned"), theirs.get("forked")
+    if spawn and spawn[1] == session_id:
+        return "child", spawn[2]
+    if fork and fork[1] == session_id:
+        return "fork", ""
+    own_spawn, own_fork = mine.get("spawned"), mine.get("forked")
+    if own_spawn and own_spawn[0] == stem:
+        return "parent", ""
+    if own_fork and own_fork[0] == stem:
+        return "forked-from", ""
+    if spawn and own_spawn and spawn[1] == own_spawn[1]:
+        return "sibling", spawn[2]
+    return "unrelated", ""
+
+
+def spawn_of(session_id):
+    """(raw parent session id, spawned name) from this session's `spawned` row,
+    else None: how a subagent's own session finds its slice record (the lease
+    rule, `tezgah_gate.lease_reason`). The name is omp's child file stem, so a
+    re-dispatch reads `<name>-2`."""
+    hit = _lineage(_slug(session_id)).get("spawned") if session_id else None
+    return (hit[1], hit[2]) if hit and hit[2] else None
+
+
+def _prompt_key(text):
+    """The key a `turn` row stores for one prompt text (`note_turn`)."""
+    return hashlib.sha1(text.encode("utf-8", "replace")).hexdigest()[:12]
 
 
 def note_turn(session_id, prompt, workspace=None):
@@ -1246,7 +1326,7 @@ def note_turn(session_id, prompt, workspace=None):
     written in between, resets nothing - that direction can only deny too much,
     never too little."""
     text = str(prompt or "")
-    key = hashlib.sha1(text.encode("utf-8", "replace")).hexdigest()[:12]
+    key = _prompt_key(text)
     rows = events(session_id, tail=1)
     if rows and rows[-1].get("kind") == "turn" and rows[-1].get("detail") == key:
         return
@@ -1563,10 +1643,12 @@ def counters(session_id, weeks=False, tools=False):
     carries, because a host that reports none would otherwise read as a perfect
     success rate while opencode's real process codes (2, 127, 130) count in
     neither half. `steps` counts the work rows only (STEP_KINDS); and
-    `false_completion` counts the claim rows a stop refused, so the rate is
-    false_completion / claims. `judge` counts the seam's own rows by kind: a
-    judgement is a cost, so it is in neither STEP_KINDS nor the check set - it
-    can never make a "done" claim look backed. `shape` counts the report-only
+    `false_completion` counts the claim rows a stop refused for their evidence
+    - not for their shape (`SHAPE_BLOCKS`) or the work they leave
+    (`LIST_BLOCKS`) - so the rate is false_completion / claims. `judge` counts
+    the seam's own rows by kind: a judgement is a cost, so it is in neither
+    STEP_KINDS nor the check set - it can never make a "done" claim look
+    backed. `shape` counts the report-only
     reply-shape rows (`shape_flags`) by kind for the same reason: a flag nothing
     counted was indistinguishable from a flag that never fires.
 
@@ -1734,8 +1816,9 @@ def _counts(rows, weeks=False, tools=False):
                     cls = detail[len("blocked: "):]
                     out["blocked_claims"][cls] = \
                         out["blocked_claims"].get(cls, 0) + 1
-                    out["false_completion"] += 1
-                    refused = True
+                    if cls not in LIST_BLOCKS:
+                        out["false_completion"] += 1
+                        refused = True
             if weeks:
                 # the same bucket this row's events went into, so a claim cannot
                 # sit in a week's total and outside its ratio
@@ -3178,9 +3261,55 @@ def unanswered(rows, delivered=()):
     return sum(1 for row in waiting if row.get("tool") in seen)
 
 
+# The host todo list is the orchestrator's step queue (plan 086, S1): each open
+# item is ready, in progress or blocked. These tools carry the whole list: omp's
+# `todo` in its result (`details.phases`, which the bridge sends as `todo`, since
+# the call holds one op), Claude's and dsh's `TodoWrite`, opencode's `todowrite`
+# and Cursor's `todo_write` in `todos[]`, Codex's `update_plan` in `plan[]`.
+TODO_TOOLS = frozenset(("todo", "todowrite", "todo_write", "update_plan"))
+# The statuses that close an item. `pending` is ready; `in_progress` is open and
+# taken, so it is not ready; omp's `blocked` (an item with a `blocker`) is open
+# and waits on something named.
+TODO_CLOSED = frozenset(("completed", "done", "cancelled", "abandoned"))
+TODO_ROW = re.compile(r'"kind"\s*:\s*"todo"')
+# How much of each ready item the row keeps: a head that names it in a refusal.
+TODO_HEAD = 60
+
+
+def note_todo(session_id, tool, inp, snapshot=None, cwd=None, agent=None):
+    """Write one `todo` row for a todo call: the `open`, `ready` and `blocked`
+    counts, every ready item's head in `heads` (redacted, TODO_HEAD characters
+    each) and the same heads in `detail`, one per line, which the row's cut may
+    shorten. A call whose list is not in hand (an omp `todo` result without
+    its `details`) writes nothing, so it cannot read as an empty queue. An item
+    whose own text types a blocker (KARAR, YETKİ, GERİ ALINAMAZ, ORTAM, or
+    `blocked`) counts as blocked: Claude's and Codex's lists have no blocked
+    status. `agent` is the host's subagent id: a subagent's list is its own,
+    and the readers skip it. ponytail: a Cursor `merge: true` call carries
+    only the items it changes and is recorded as the whole list, so its counts
+    can run low."""
+    raw = snapshot if snapshot is not None else inp.get("todos", inp.get("plan"))
+    if not isinstance(raw, list):
+        return
+    items = [(str(i.get("content") or i.get("step") or "").strip(),
+              "blocked" if i.get("blocker") else str(i.get("status") or "pending").lower())
+             for i in raw if isinstance(i, dict)]
+    items = [(text, status) for text, status in items
+             if text and status not in TODO_CLOSED]
+    blocked = [text for text, status in items if status == "blocked" or
+               BLOCKER_SAID.search(text) or BLOCKER_TRIED.search(text)
+               or re.search(r"\bblocked\b", text, re.I)]
+    heads = [_stored_text(" ".join(text.split()))[:TODO_HEAD] for text, status in items
+             if status == "pending" and text not in blocked]
+    note(session_id, "todo", "\n".join(heads),
+         id=call_id(tool, inp), tool=str(tool or "").strip() or None,
+         workspace=root_for(cwd) if cwd else None, agent=agent or None,
+         open=len(items), ready=len(heads), blocked=len(blocked), heads=heads)
+
+
 def note_tool(session_id, tool, inp, failed=None, *, interrupted=False,
               out_bytes=None, error=None, cwd=None, source=None, empty_run=False,
-              agent=None):
+              agent=None, host=None, todo=None, child=None):
     """Record the evidence kind for one tool call (host PostToolUse hooks).
 
     `failed=None` is the default because a host that passes no argument reported
@@ -3224,8 +3353,24 @@ def note_tool(session_id, tool, inp, failed=None, *, interrupted=False,
     check exited 0 over nothing, so it records as one that RAN (`verify`), the
     piped check's kind, and the turn still owes a pass.
     `agent` is the host's subagent id (Claude's `agent_id`), written into the
-    row's `agent` field so the turn readers can key on (session, agent)."""
+    row's `agent` field so the turn readers can key on (session, agent).
+    `host` names the calling host for the slice journal (`_note_slice`); None
+    reads it off the hook process (`_hook_host`). `child` is the id a spawn's
+    result gave a background child (Claude's `agentId`), stored on its slice
+    record so the lease rule finds it. A todo call (TODO_TOOLS)
+    writes its `todo` row instead (`note_todo`), from `todo` when the host's
+    list is in the result rather than the call (omp). omp's `wait` writes a
+    `wait` row: no step, the call the idle-wait warning counts as idle."""
     inp = inp or {}
+    name = str(tool or "").strip().lower()
+    if name in TODO_TOOLS:
+        if not failed and not interrupted:
+            note_todo(session_id, tool, inp, todo, cwd, agent)
+        return
+    if name == "wait":
+        note(session_id, "wait", "", id=call_id(tool, inp), tool="wait",
+             workspace=root_for(cwd) if cwd else None)
+        return
     cmd = str(inp.get("command") or inp.get("cmd") or "")
     kind = classify(tool, inp)
     if kind == "verify":
@@ -3314,6 +3459,7 @@ def note_tool(session_id, tool, inp, failed=None, *, interrupted=False,
         fields["repo"] = _check_repo(cmd, cwd, inp)
         fields["empty_run"] = True if empty_run else None
     note(session_id, kind, detail, **fields)
+    _note_slice(session_id, tool, inp, failed, interrupted, error, cwd, host, child)
     if kind == "edit" and not failed:
         # the taste capture (tezgah_taste, opt-in): the edit's text under this
         # row's id, and the bytes it left - read here because only PostToolUse
@@ -3325,6 +3471,84 @@ def note_tool(session_id, tool, inp, failed=None, *, interrupted=False,
         tezgah_taste.note_write(session_id, fields["id"], inp, cwd)
 
 
+# The hosts whose post event for a spawn call arrives once the child finished,
+# so the call's outcome is the slice's: Claude/dsh/Cursor `Agent`/`Task`. omp's
+# `task` and Codex `spawn_agent` return while the child still runs (a Codex
+# rollout shows the call answered with its `task_name` alone), so their records
+# stay open: omp's for `tezgah_task.pending` to close from the child
+# transcripts, Codex's until `pending` closes them `stale`.
+SYNC_SPAWN_HOSTS = frozenset(("claude", "dsh", "cursor"))
+
+
+def _journal():
+    """The slice journal module (tezgah_task), or None when it is missing or
+    broken: the journal is a record, and the post-tool path must never pay for
+    it. Imported here, not at the top: tezgah_task is newer than some checkouts."""
+    try:
+        import tezgah_task
+    except Exception:
+        return None
+    return tezgah_task
+
+
+def _hook_host():
+    """The host this hook process runs for (`tezgah_guard._host`): `hosts/<name>/`
+    by its directory, and the shared Claude/dsh script told apart by the dsh
+    manifest's `TEZGAH_CALL_OUTCOME=none`."""
+    try:
+        from tezgah_guard import _host
+        name = _host()
+    except Exception:
+        return ""
+    if name == "claude/dsh":
+        return "dsh" if os.environ.get("TEZGAH_CALL_OUTCOME") == "none" else "claude"
+    return name
+
+
+def _note_slice(session_id, tool, inp, failed, interrupted, error, cwd, host,
+                child=None):
+    """Hand a spawn call to the slice journal (`tezgah_task.note_spawn`), and
+    open a `job` record for an omp `bash` call sent to the background, so a
+    `/clear` keeps the pointer to the run. Swallows every exception.
+
+    On a synchronous host the slice is closed here: the event arriving means
+    the child is no longer running, so a call with no failure signal (dsh's
+    bridge sends none) closes as done rather than staying open forever - a
+    journal entry, never a pass on the ledger. A Claude call sent with
+    `run_in_background`, or whose result names a background `child`, returns
+    before its child ends and stays open."""
+    name = str(tool or "").strip().lower()
+    if not cwd:
+        return
+    try:
+        tt = _journal()
+        host = host or _hook_host()
+        if name in SUBAGENT_TOOLS:
+            spawn = getattr(tt, "note_spawn", None)
+            if spawn is None:
+                return
+            sync = (host in SYNC_SPAWN_HOSTS and inp.get("run_in_background") is not True
+                    and not child)
+            text = str(error or "") or ("aborted" if interrupted else "")
+            # Codex's hook maps `spawn_agent` onto `Task` before this row; the
+            # journal parses the call by the host's own name and fields
+            spawn(cwd, session_id, host,
+                  "spawn_agent" if host == "codex" else tool, inp,
+                  failed=bool(failed or interrupted or error) if sync else None,
+                  result_text=text, **({"child": child} if child else {}))
+        elif host == "omp" and name == "bash" and inp.get("async") is True:
+            opener = getattr(tt, "open_slice", None)
+            root = _toplevel(os.path.realpath(cwd))
+            cmd = str(inp.get("command") or "")
+            if opener is None or not root or not cmd or off("slices-off"):
+                return
+            opener(root, "job-" + hashlib.sha1(cmd.encode()).hexdigest()[:10],
+                   kind="job", host="omp", brief=cmd, parent=str(session_id or ""),
+                   cwd=cwd)
+    except Exception:
+        pass
+
+
 # One leading step a check's command opens with: a subshell paren, an
 # assignment (`export X=1`, `X=1`) or a `cd X`, closed by `&&` or `;`.
 LEAD_STEP = re.compile(r"\s*\(?\s*(?:(?:export\s+)?\w+=\S*|cd\s+(\S+))\s*(?:&&|;)")
@@ -3399,9 +3623,7 @@ def ran_nothing(result):
 # `claims` is the false-done reader the benchmarks count with; the Stop verdict
 # and its claim row read the vocabulary (`asserted_claims`), where an admitted
 # claim is a claim NEGATED lets through.
-ADMITTED = re.compile(
-    r"contradict|çeliş|unsatisfiable|(?:can ?not|can't|can ?never|never) pass|"
-    r"geçemez|impossible|imk[aâ]nsız", re.I)
+ADMITTED = re.compile(alts("admitted"), re.I)
 
 
 def claims(text):
@@ -3420,10 +3642,10 @@ def claims(text):
 # the clause after it. So "Don't worry, it's done.", "All tests pass so should
 # I open the PR?", "Done (no regressions?)" and "Tamamlandı, push edeyim mi?"
 # all still assert.
-NEGATION_BEFORE = re.compile(r"(?:\bnot|n't|\bnever|\bdeğil)(?:\s+\S+){0,2}\s+\Z",
+NEGATION_BEFORE = re.compile(r"(?:%s)(?:\s+\S+){0,2}\s+\Z" % alts("negation_before"),
                              re.I)
-QUESTION_PARTICLE = re.compile(r"\s*(?:m[ıiuü]|değil)\b", re.I)
-CLAUSE_END = re.compile(r"[.!?\n,;:\u2014\u2013()]|\b(?:so|and|but|ama|ve)\b",
+QUESTION_PARTICLE = re.compile(r"\s*(?:%s)\b" % alts("question_particle"), re.I)
+CLAUSE_END = re.compile(r"[.!?\n,;:\u2014\u2013()]|\b(?:%s)\b" % alts("clause_join"),
                         re.I)
 
 
@@ -3763,9 +3985,11 @@ def last_verify(session_id):
     return _last_verify(events(session_id))
 
 
-def last_check(session_id):
+def last_check(session_id, repo=None):
     """The newest verification row the ledger holds - a `verify_ok` or a
     `verify_fail`, with its command in `detail` - or None when no check ran.
+    With `repo`, a check whose own `repo` names another repository is skipped
+    (`_same_repo`): a check run in another project says nothing about this one.
 
     `last_verify` answers the same question as a state; this hands the row back
     for a reader that has to name the command the state came from, the way the
@@ -3775,7 +3999,8 @@ def last_check(session_id):
     buys out of."""
     newest = None
     for row in events(session_id, tail=SCRATCH_TAIL):
-        if row.get("kind") in ("verify_ok", "verify_fail"):
+        if row.get("kind") in ("verify_ok", "verify_fail") \
+                and _same_repo(row.get("repo"), repo):
             newest = row
     return newest
 
@@ -3935,15 +4160,34 @@ def prose_words(text):
     return words
 
 
-def turkish_share(words):
-    """The share of `words` that mark Turkish: a Turkish letter in the word, or
-    a word from TR_WORDS. None for an empty list."""
-    if not words:
+def _markers(code):
+    """Pack `code`'s reply markers as (words, letters), or None when it ships
+    none: only such a language's replies are held to it."""
+    marks = packs().get(code, {}).get("markers") or {}
+    words, letters = frozenset(marks.get("words", ())), "".join(marks.get("letters", ()))
+    return (words, letters) if words or letters else None
+
+
+def reply_share(words, code="tr"):
+    """The share of `words` that mark language `code` (`_markers`): a marker
+    letter in the word, or a marker word. None for an empty list or a language
+    with no markers."""
+    marks = _markers(code)
+    if not words or not marks:
         return None
-    hits = sum(1 for w in words if w in TR_WORDS or TR_LETTERS.search(w))
+    hits = sum(1 for w in words if w in marks[0] or any(c in marks[1] for c in w))
     return round(hits / len(words), 3)
 
 
+def _said(text):
+    """`text` with each `{WORD}` placeholder filled with the configured
+    language's contract word (`tezgah_paths.say`): the refusal names the
+    tokens the contract the model was given names."""
+    for key, word in say().items():
+        text = text.replace("{%s}" % key.upper(), word)
+    return text
+
+
 def reply_shape(text):
     """The reply's size and lead, as the `shape` row records them for every
     judged reply and the `claim` row beside its verdict: `lines` (line count),
@@ -3971,7 +4215,7 @@ def reply_shape(text):
     return {"lines": len(lines), "chars": len(text),
             "items": sum(1 for line in lines if ITEM.match(line)),
             "longest_list": longest_list(text),
-            "tr_share": turkish_share(prose_words(text)),
+            "tr_share": reply_share(prose_words(text)),
             "answer_first": answer_first}
 
 
@@ -4045,8 +4289,7 @@ def _shape_block(text, cwd):
                     "Start with the answer: \"Great question\" / \"Let me...\" / "
                     "\"I'll...\" / \"Sure!\" / \"Looking at your...\" are never "
                     "the first line. If the user is right, state the fact and the "
-                    "fix in one plain sentence - never \"haklısın\" / \"you're "
-                    "right\" / \"detaylı bakmadım\" / an apology.")
+                    "fix in one plain sentence - {OPENER_BAN}.")
         # only the last prose line is read, so a reply that ends on a code
         # block, a heading or a table is not judged here at all
         last = _closing_prose(lines)
@@ -4055,8 +4298,8 @@ def _shape_block(text, cwd):
                     "Reply closes with a sign-off the output contract bans "
                     "(rule 10: no preamble, no recap, no closer): \"Let me know "
                     "if you need anything else\" / \"Hope this helps\" / \"Happy "
-                    "to clarify\". End when the answer is done; if something is "
-                    "still open, name the one next step instead.")
+                    "to clarify\". End when the answer is done; what is left is "
+                    "done now, or named under \"{BLOCKERS_HEADING}\" as a blocker.")
         longest = longest_list(text)
         if longest > LIST_CAP:
             return ("list cap",
@@ -4067,25 +4310,97 @@ def _shape_block(text, cwd):
                     "whole enumeration is the point, split it under headings of "
                     "at most five items each, or give it as a table."
                     % (longest, LIST_CAP))
-    # `reply_lang` is the switch, and only `tr` is judged: this is a Turkish
-    # detector, and an English reply carries the contract's own hedge word or
-    # quotes the user's Turkish, so it cannot hold a reply to English (`en`).
-    if reply_lang() == "tr" and not off("exec-mode.off"):
+    # `language` is the switch, and only a pack that ships reply markers (tr)
+    # is judged: the markers tell that language from English, and an English
+    # reply quotes the user's other language, so English is not held to.
+    if _markers(language()) and not off("exec-mode.off"):
         words = prose_words(text)
-        share = turkish_share(words)
+        share = reply_share(words, language())
+        name = packs()[language()]["name"]
         if len(words) >= LANG_MIN_WORDS and share < LANG_MIN_SHARE:
             return ("reply language",
-                    "Reply prose is not in Turkish (%d prose words, %.0f%% of "
-                    "them Turkish). The contract's first rule: every user-facing "
-                    "reply is in Turkish, even when the user writes English. "
-                    "Rewrite the prose in Turkish; code, commands, paths, "
+                    "Reply prose is not in %s (%d prose words, %.0f%% of "
+                    "them %s). The contract's first rule: every user-facing "
+                    "reply is in %s, even when the user writes English. "
+                    "Rewrite the prose in %s; code, commands, paths, "
                     "identifiers and quoted output stay as they are (put them in "
-                    "backticks or a code block)." % (len(words), share * 100))
+                    "backticks or a code block)."
+                    % (name, len(words), share * 100, name, name, name))
     return (None, None)
 
 
-def stop_reason(text, session_id, cwd=None, record_only=False,
-                subagent=False, agent=None):
+# How many times the Stop rule may refuse inside one user turn (plan 083): the
+# reply after a block is judged again and refused once more only for a class
+# the turn has not been refused for. Counted from the ledger's own `blocked:`
+# rows (`_turn_refusals`, `_record_only`), so every host gets the same budget
+# whatever its payload says about earlier blocks.
+STOP_REASKS = 2
+
+
+def _blocked(entry):
+    """True for a Stop refusal row: a `blocked:` claim or refusal."""
+    return (entry.get("kind") in ("claim", "refusal")
+            and str(entry.get("detail", "")).startswith("blocked:"))
+
+
+def _turn_refusals(session_id, rows):
+    """(this rule's refusal rows in the user turn `rows` belongs to, that turn's
+    rows).
+
+    omp hands a Stop block back to the model as a queued message, and its
+    prompt hook records that text as a new `turn` row (`note_turn`), so the
+    reply after a block sits in a turn of its own. Such a marker carries the
+    key of the refusal text (`_prompt_key`), which the refusal row stores as
+    `reask`: a marker equal to the `reask` of the refusal just before it is no
+    new user turn, and that turn's refusals count too. Read back no further
+    than STOP_REASKS refusals, and only the lines that carry a `reask` key are
+    parsed: the Stop path stays a read of the turn, not of the session
+    (StopReadBound). When the chain reaches back, the rows returned run from
+    the chain's first turn with the re-ask markers left out, so the reply after
+    a block is judged on the turn's whole work, as on a host that writes no
+    such marker (S4 finding 1)."""
+    refused = [entry for entry in rows if _blocked(entry)]
+    path = _path(session_id)
+    lines = _ledger_lines(path)
+    end = first = _turn_line(lines)
+    while end and len(refused) < STOP_REASKS:
+        marker = _parse([lines[end - 1]])
+        start = _turn_line(lines[:end - 1])
+        before = [entry for entry in _parse([line for line in lines[start:end - 1]
+                                             if '"reask"' in line])
+                  if _blocked(entry)]
+        if not (marker and before
+                and before[-1].get("reask") == marker[0].get("detail")):
+            break
+        refused = before + refused
+        end = start
+    if end != first:
+        rows = [row for row in _pair(_parse(lines[end:], path), path, lines,
+                                     lines[:end])
+                if row.get("kind") != TURN_KIND]
+    return refused, rows
+
+
+def _record_only(refused, turns, after_block, cls):
+    """True when this reply is recorded and not refused (plan 083).
+
+    `refused` holds the classes this rule refused in the user turn so far. A
+    reply is refused only while there are fewer than STOP_REASKS of them and
+    none is its class, so a class is refused at most once per turn and a
+    third refusal cannot happen. `after_block` is the host's own count of the
+    blocks before this reply - 1 for Claude's, Codex's and omp's
+    `stop_hook_active`, Cursor's `loop_count` - and it rules only where the
+    ledger cannot: a session with no `turn` row has no turn to count in, so
+    there any earlier block makes the reply record-only (the one-nudge rule
+    before plan 083), and a host count at the budget is record-only too."""
+    if not turns:
+        return bool(after_block)
+    return (int(after_block or 0) >= STOP_REASKS or cls in refused
+            or len(refused) >= STOP_REASKS)
+
+
+def stop_reason(text, session_id, cwd=None, after_block=0,
+                subagent=False, agent=None, parent=None):
     """Why this turn must not end yet, or None. Used by the Stop hooks (Claude,
     Codex, omp and Cursor, which share the payload fields and the block envelope).
     `cwd` is the session's directory, read for the repo's `.no-adhd` mark.
@@ -4094,8 +4409,8 @@ def stop_reason(text, session_id, cwd=None, record_only=False,
     whole ledger: the file grows with the session, the handler runs once per
     turn, and the question - did this turn leave work unverified - is about the
     turn. A host that writes no `turn` row (no prompt hook) gets the whole
-    ledger here, which is what it got before the scope; it loses the bound and
-    nothing else.
+    ledger here, which is what it got before the scope; it loses the bound, and
+    `residual work` (which needs the turn's own steps) is not asked of it.
 
     The verdict is recorded as a `claim` row when the reply is in the claim
     vocabulary - a DONE/VERIFIED word (`asserted_claims`), blocked or not,
@@ -4106,8 +4421,8 @@ def stop_reason(text, session_id, cwd=None, record_only=False,
     `detail` carries the reason class - `blocked: no verify_ok`, `blocked: check
     failed`, `blocked: partial failure`, `blocked: stale evidence`, `blocked: no
     ui_ok` (both halves of the UI rule: the screen proof and the design-contract
-    floor), `blocked: no external read`, `blocked: evidence tampered`, the shape
-    classes in SHAPE_BLOCKS, or
+    floor), `blocked: no external read`, `blocked: evidence tampered`,
+    `blocked: residual work` (plan 080), the shape classes in SHAPE_BLOCKS, or
     `ok` - so which branch refused a turn is readable; a `no verify_ok` row also
     carries `cause` (`_no_pass_cause`). One row per reply per turn: an identical
     row for the same key is skipped.
@@ -4117,26 +4432,35 @@ def stop_reason(text, session_id, cwd=None, record_only=False,
     list and language numbers the rule refuses on have a published rate over
     every reply, not only over the ones that made a claim.
 
-    `record_only` is the reply after a block (`stop_hook_active`): it is judged
-    the same way but never refused a second time, and its verdict goes to an
+    The reply after one of this rule's blocks - the turn already holds a
+    `blocked:` claim or refusal row, or, in a session with no `turn` row, the
+    host's `after_block` count says a block came before - is judged the same
+    way. `_record_only` decides whether it may be refused again: once more in
+    the turn, for a class not refused yet (plan 083). A refused one is a
+    refusal like the first, `shape` row included; every other one goes to an
     `after_block` row - `would block: <class>`, `ok` or `no claim`, one per
     reply - so what a block led to is on the record without counting as a
-    claim or as a second reply in the shape rate. Only a turn this rule
-    refused has one: the flag says some Stop hook blocked, not that this one
-    did. `subagent` is a subagent's end (ADR 011): judged the same way, never
-    refused, recorded as a `subagent_end` row with the same detail vocabulary,
-    the host's subagent id in `agent` when it sent one, and no turn
-    precondition. Both return None. A reply counts as claiming only with
-    `asserted_claims`: "Testler geçti mi?" leaves no `claim ok` row."""
+    claim or as a second reply in the shape rate. A host count with no refusal
+    of this rule in the turn writes nothing: the host says some Stop hook
+    blocked, not that this one did. `subagent` is a subagent's end (ADR 011):
+    judged the same way, never refused, recorded as a `subagent_end` row with
+    the same detail vocabulary, the host's subagent id in `agent` when it sent
+    one, and no turn precondition. `parent` is the ledger that row goes to when
+    the child keeps a ledger of its own (omp's task sessions); the child's own
+    rows still judge it. Both return None. A reply counts as
+    claiming only with `asserted_claims`: "Testler geçti mi?" leaves no
+    `claim ok` row."""
     rows, turns = turn_rows(session_id, turns=True)
-    record_only = record_only or subagent
-    if record_only and not subagent and not any(
-            entry.get("kind") in ("claim", "refusal")
-            and str(entry.get("detail", "")).startswith("blocked:")
-            for entry in rows):
+    chain, rows = (_turn_refusals(session_id, rows) if turns
+                   else (list(filter(_blocked, rows)), rows))
+    refused = [str(entry.get("detail"))[len("blocked: "):] for entry in chain]
+    if after_block and not subagent and not refused:
         return None
     cls, reason = _stop_block(text, session_id, rows=rows, cwd=cwd,
                               shape=not subagent)
+    record_only = subagent or bool(
+        (refused if turns else after_block)
+        and (not reason or _record_only(refused, turns, after_block, cls)))
     key = _claim_key(text, turns)
     # Keyed like the claim row, so Cursor's re-run of the handler on a follow-up
     # does not count the same reply twice; above the early return, so a reply
@@ -4173,12 +4497,28 @@ def stop_reason(text, session_id, cwd=None, record_only=False,
         except Exception:
             if os.environ.get("TEZGAH_STOPSPEC_STRICT"):
                 raise
+    # A refusal is skipped only as the same verdict on the same reply: the same
+    # reply text refused for a new class is the turn's next refusal, and
+    # `_record_only` counts refusals by these rows. A row bound for a parent's
+    # ledger is looked up there, so one child's end is one row.
     if not any(entry.get("kind") == kind and entry.get("id") == key
-               for entry in rows):
+               and (entry.get("detail") == detail or not reason)
+               and (not parent or entry.get("agent") == (str(agent) if agent else None))
+               for entry in (turn_rows(parent) if parent else rows)):
         if cls == "no verify_ok" and not record_only:
             shape = dict(shape, cause=_no_pass_cause(rows))
+        if reason:
+            # the key omp's continuation turn will carry (`_turn_refusals`)
+            shape = dict(shape, reask=_prompt_key(str(reason).strip()))
         if subagent and agent:
             shape = dict(shape, agent=str(agent))
+        if subagent:
+            # the child is never refused (ADR 011); the parent's Stop reads
+            # this count (`_residual_block`), so an untyped item handed up
+            # still owes a type before the user's turn ends
+            handed = len(unblocked_items(text, rows))
+            if handed:
+                shape = dict(shape, residual=handed)
         if kind == "claim":
             # "harness drifted" rides on the claim as a record, read from the
             # mark the session start left; it never refuses the turn. Imported
@@ -4190,7 +4530,7 @@ def stop_reason(text, session_id, cwd=None, record_only=False,
                 drifted = ""
             if drifted:
                 shape = dict(shape, harness="drifted: " + drifted)
-        note(session_id, kind, detail, id=key, **shape)
+        note(parent or session_id, kind, detail, id=key, **shape)
     return reason
 
 
@@ -4231,18 +4571,59 @@ WORK_KINDS = frozenset(STEP_KINDS) - {"verify_ok"}
 # that writes would excuse an unverified change.
 READ_ONLY_PROGRAMS = frozenset((
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "printf", "which", "stat",
-    "du", "df", "date", "whoami", "grep", "rg", "cd", "true"))
+    "du", "df", "date", "whoami", "grep", "rg", "cd", "true", "find", "jq", "sort",
+    "diff", "ps", "curl"))
 GIT_BOOKKEEPING = frozenset((
     "status", "log", "diff", "show", "add", "commit", "push", "fetch", "branch",
     "tag", "remote", "rev-parse", "describe", "shortlog", "blame", "ls-files"))
+# The git subcommands that only read: a turn made of these and READ_ONLY_PROGRAMS
+# owes no check at all (`_stop_block`, S4 finding 3). A command not on the lists
+# is work - an unknown program owes the check, a known one never excuses a write.
+GIT_READS = GIT_BOOKKEEPING - {"add", "commit", "push", "fetch", "branch", "tag",
+                               "remote"}
+# ssh's options that take the next word, so the host is read after them
+SSH_VALUE_OPTS = frozenset(("-b", "-c", "-D", "-E", "-e", "-F", "-I", "-i", "-J",
+                            "-L", "-l", "-m", "-O", "-o", "-p", "-Q", "-R", "-S",
+                            "-W", "-w"))
+# sqlite3 arguments that write a file or run a script even on a read-only open:
+# a dot-command that writes, runs or reads one, an init script, a second
+# database, a vacuum into a file
+SQLITE_WRITE = re.compile(r"^\s*\.(?:output|once|shell|system|save|backup|import|"
+                          r"excel|clone|log|trace|cd|open|read)\b|^-{1,2}init\b|"
+                          r"\battach\b|\bvacuum\b", re.I | re.M)
+# sqlite3's options that take the next word, so the database is read after them
+SQLITE_VALUE_OPTS = frozenset(("cmd", "init", "separator", "newline", "nullvalue",
+                               "vfs", "lookaside", "pagecache", "mmap", "heap",
+                               "maxsize", "escape"))
+# A script argument of sed or awk that writes a file or runs a command: sed's
+# `w`/`W`/`e` commands and flags, awk's redirect, pipe, system() and getline.
+SCRIPT_WRITE = {"sed": re.compile(r"(?:^|[;}/\n$\d])\s*[wWe]\b"),
+                "awk": re.compile(r"[>|]|\b(?:system|getline)\b"),
+                "gawk": re.compile(r"[>|]|\b(?:system|getline)\b")}
+# The read verbs of a program whose subcommand decides what it does
+SUBCOMMAND_READS = {"gh": (("pr", "view"), ("pr", "list"), ("issue", "view"),
+                           ("issue", "list")),
+                    "codegraph": (("explore",), ("callers",), ("callees",),
+                                  ("impact",), ("search",), ("node",), ("files",),
+                                  ("status",))}
 # The options that make an allowlisted program write a file or run one after
-# all (review F6): git's `--output` and external diff/textconv drivers,
-# ripgrep's `--pre`. A word that starts with one of these is not a read.
-# `tree` and `file` left the list instead of growing one here: tree writes
-# through clustered short options (`-fo out`) and `-R -H`, file through `-C`
-# (review N4).
-WRITING_OPTIONS = {"git": ("--output", "--ext-diff", "--textconv"),
-                   "rg": ("--pre",)}
+# all (review F6), as a pattern read at an argument's start: git's `--output`
+# and external diff/textconv drivers, ripgrep's `--pre`, find's actions, a
+# short-option cluster holding sort's `-o`, sed's `-i`/`-f`, awk's `-i`/`-f`,
+# and curl's writes to a file and non-GET requests. `tree` and `file` left the
+# list instead of growing one here: tree writes through clustered short options
+# (`-fo out`) and `-R -H`, file through `-C` (review N4).
+WRITING_OPTIONS = {
+    "git": re.compile(r"--(?:output|ext-diff|textconv)"),
+    "rg": re.compile(r"--pre"),
+    "find": re.compile(r"-(?:delete|exec|execdir|ok|okdir|fprint0?|fprintf|fls)$"),
+    "sort": re.compile(r"-[^-]*o|--output"),
+    "sed": re.compile(r"-[^-]*[if]|--(?:in-place|file)"),
+    "awk": re.compile(r"-[^-]*[if]|--(?:include|file|load)"),
+    "gawk": re.compile(r"-[^-]*[if]|--(?:include|file|load|inplace)"),
+    "curl": re.compile(r"-[^-]*[oOdTFKXcD]|--(?:output|remote-name|data|upload-file|"
+                       r"form|json|request|config|cookie-jar|dump-header|trace|"
+                       r"stderr|libcurl|etag-save|hsts|alt-svc|create-dirs)")}
 # git global options that set configuration or the program path, and so can
 # name a program a read subcommand then runs (`git -c diff.external=./x diff`)
 GIT_CONFIG_OPTS = ("-c", "--config-env", "--exec-path")
@@ -4324,12 +4705,18 @@ def _shell_read(cmd):
     return ">" in text or "<(" in text, "".join(out).replace("<", " ")
 
 
-def _bookkeeping_command(cmd):
-    """True when every simple command of `cmd` reads, or does VCS bookkeeping
-    that changes no working-tree file. A redirect, a substitution, an env
-    assignment in front of a program, a git config override and an option that
-    makes a reader write (`WRITING_OPTIONS`) are never bookkeeping: each can
-    write or run something this reader does not follow.
+def _bookkeeping_command(cmd, git=GIT_BOOKKEEPING):
+    """True when every simple command of `cmd` reads, or runs a git subcommand
+    in `git` (VCS bookkeeping that changes no working-tree file by default,
+    GIT_READS for a pure read). A redirect, a substitution, an env assignment
+    in front of a program, a git config override and an option that makes a
+    reader write (`WRITING_OPTIONS`) are never bookkeeping: each can write or
+    run something this reader does not follow. `sed` and `awk` read with no
+    writing script (`SCRIPT_WRITE`), `uniq` with one operand, `gh` and
+    `codegraph` with a read verb (`SUBCOMMAND_READS`). `sqlite3` reads with a
+    read-only open (the option, or `mode=ro` in the database URI) and no
+    writing dot-command or stdin (`SQLITE_WRITE`), `ssh` with a remote command
+    that is itself one of these reads.
 
     ponytail: `git commit` and `git push` run the repository's hooks, and a
     pre-commit autofixer can rewrite files the row never names. They stay on
@@ -4351,10 +4738,45 @@ def _bookkeeping_command(cmd):
         if "/" in words[i]:
             return False
         program, args = words[i], words[i + 1:]
-        if any(a.startswith(WRITING_OPTIONS.get(program, ("\0",))) for a in args):
+        writes = WRITING_OPTIONS.get(program)
+        if writes and any(writes.match(a) for a in args):
             return False
         if program in READ_ONLY_PROGRAMS:
             continue
+        plain = [a for a in args if not a.startswith("-")]
+        if program in SCRIPT_WRITE:
+            if any(SCRIPT_WRITE[program].search(a) for a in plain):
+                return False
+            continue
+        if program == "uniq":
+            # `uniq IN OUT` writes its second operand
+            if len(plain) > 1:
+                return False
+            continue
+        if program in SUBCOMMAND_READS:
+            if not any(tuple(plain[:len(verb)]) == verb
+                       for verb in SUBCOMMAND_READS[program]):
+                return False
+            continue
+        if program == "sqlite3":
+            j, ro = 0, False
+            while j < len(args) and args[j].startswith("-"):
+                ro = ro or args[j].lstrip("-") == "readonly"
+                j += 2 if args[j].lstrip("-") in SQLITE_VALUE_OPTS else 1
+            db = args[j] if j < len(args) else ""
+            # read-only from the option or the database URI itself, never
+            # from words in the SQL
+            ro = ro or (db.startswith("file:") and "mode=ro" in db.partition("?")[2])
+            if "<" in raw or not ro or any(SQLITE_WRITE.search(a) for a in args):
+                return False
+            continue
+        if program == "ssh":
+            j = 0
+            while j < len(args) and args[j].startswith("-"):
+                j += 2 if args[j][:2] in SSH_VALUE_OPTS and len(args[j]) == 2 else 1
+            if j + 1 >= len(args) or not _bookkeeping_command(" ".join(args[j + 1:]), git):
+                return False
+            continue
         if program != "git":
             return False
         j = 0
@@ -4362,14 +4784,15 @@ def _bookkeeping_command(cmd):
             if args[j].startswith(GIT_CONFIG_OPTS):
                 return False
             j += 2 if args[j] in GIT_VALUE_OPTS else 1
-        if j >= len(args) or args[j].lower() not in GIT_BOOKKEEPING:
+        if j >= len(args) or args[j].lower() not in git:
             return False
     return bool(segs)
 
 
-def _bookkeeping_turn(rows):
-    """True when every work row in `rows` is a shell call that read or did VCS
-    bookkeeping and was not seen to change a file.
+def _bookkeeping_turn(rows, git=GIT_BOOKKEEPING):
+    """True when every work row in `rows` is a shell call that read or ran a
+    git subcommand in `git` (`_bookkeeping_command`) and was not seen to
+    change a file.
 
     A detail of DETAIL_MAX characters or more is never bookkeeping: the ledger
     cut it there, and the command after the cut is unread (review F1). Nor is
@@ -4380,7 +4803,7 @@ def _bookkeeping_turn(rows):
         r.get("kind") == "run" and not _change_row(r)
         and len(str(r.get("detail") or "")) < DETAIL_MAX
         and "[redacted:" not in str(r.get("detail") or "")
-        and _bookkeeping_command(r.get("detail")) for r in steps)
+        and _bookkeeping_command(r.get("detail"), git) for r in steps)
 
 
 def _settled(rows):
@@ -4405,13 +4828,14 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
     passed before the newest write that changed the tree, or a turn that
     recorded a step and has no passing check - that last half is the
     evidence-shaped trigger, so the same unfounded state stated as a plain
-    description is refused too. An explicit 'doğrulanmadı' clears the claim
-    branches, so honest uncertainty is always allowed.
+    description is refused too. An explicit 'doğrulanmadı' clears a class whose
+    repair is a check, and only after a check that ran and failed since the
+    newest change (`_admitted`, plan 080): the word alone ended every turn.
 
     The shape is judged before any evidence is read: it is a rule about how the
     reply is written, so it holds for a turn with no work in it too, has no
-    repair that depends on the ledger, and is not cleared by the admission
-    below - "doğrulanmadı" excuses an unverified claim, not a sign-off.
+    repair that depends on the ledger, and is not cleared by the admission -
+    "doğrulanmadı" excuses an unverified claim, not a sign-off.
 
     Branch order is the reason classes' contract: a new branch goes after the
     ones it overlaps, so it cannot swallow their class - the partial-failure
@@ -4427,12 +4851,21 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
     above it carries the one exemption - an advice-only turn is exactly the
     shape that stated both of the claims this class was written for.
 
+    `residual work` (plan 080) is asked after all of them, at every exit that
+    would end the turn (`_residual_block`): a turn that did work and ends on a
+    list of what is left, with an item no blocker accounts for. It never takes
+    a turn another class refused. `stopped slice` (plan 081) is asked at the
+    same exits after it: a slice this session spawned that the journal holds as
+    stopped, worked turn or not.
+
     "Evidence tampered" is the first evidence class: a `ledger_damage` row in
     the turn (`_parse`) means a line of the ledger is not a row, and no fold
     over it can carry a claim - corrupting a `verify_fail` row would otherwise
     turn `check failed` into an allow. It sits after the shape check (a rule
-    about the reply, not the ledger) and after NEGATED: an admission that the
-    work is unverified claims nothing the damage could carry.
+    about the reply, not the ledger) and before the admission: a done or tested
+    claim on a damaged ledger is refused before the admission is read, since
+    that admission now rests on the ledger's own rows (plan 080). A reply with
+    no claim word is not this class's, damaged ledger or not.
 
     `rows` is this turn's own rows, read once by `stop_reason`: the fold is
     scoped the way `_partial_state`'s already was, and the Stop path still reads
@@ -4447,7 +4880,7 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
         if os.environ.get("TEZGAH_STOPSPEC_STRICT"):
             import tezgah_stopspec
             tezgah_stopspec.check(verdict[0], text, session_id, rows, cwd, shape)
-        return verdict
+        return (verdict[0], verdict[1] and _said(verdict[1]))
     t = str(text or "")
     shaped = _shape_block(t, cwd) if shape else (None, None)
     if shaped[0]:
@@ -4455,19 +4888,19 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
     # the raw vocabulary, not `claims`: what a damaged ledger could carry is any
     # claim word, an admitted conflict included (plan 067 leaves verdicts alone)
     done, verified = bool(DONE.search(t)), bool(VERIFIED.search(t))
-    if NEGATED.search(t):
-        return (None, None)
     rows = events(session_id) if rows is None else rows
     if (done or verified) and any(r.get("kind") == DAMAGE_KIND for r in rows):
         return ("evidence tampered", TAMPERED)
     if (done or verified) and any(r.get(ORPHAN) for r in rows):
         return ("evidence tampered", ORPHANED)
+    fold = _admitted(fold, t)
     # The trigger is the turn's own evidence, not its words. The claim vocabulary
     # below catches a claim-shaped reply; it missed the same unfounded state
     # stated as a description ("the parser is wired up now"), which is what E2
     # measured at 0 refused of 10 replies. A turn that recorded a step - an edit,
     # a command, a check - and never saw a check pass is refused whatever it
-    # says, and the reply's own "doğrulanmadı" (above) is the only exemption.
+    # says; the reply's own "doğrulanmadı" clears it only after a check that ran
+    # and failed since the newest change (`_admitted`, above).
     # `run`/`verify_fail` are steps here for the same reason: work the turn did
     # and left unverified is exactly the state this refuses.
     # `interrupted` too: the call was stopped, so the turn did that much work and
@@ -4480,7 +4913,13 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
     if not worked and any(_prose_edit(r) for r in rows) and (
             verified or any(TESTED_WORD.search(m.group(0)) for m in DONE.finditer(t))):
         worked = {"edit"}
-    if not worked:
+    # A turn whose steps are only reads - every simple command a known reader
+    # or a git read (`_bookkeeping_turn` with GIT_READS), no change row - is
+    # judged like a turn that did no work (S4 finding 3): a `git status`, a
+    # `tail` or a read-only query owes no check. Its claim words are read the
+    # same way, and a claim is judged against the session's earlier turns below.
+    quiet = _bookkeeping_turn(rows, GIT_READS)
+    if not worked or quiet:
         # With no work, the words are the whole trigger, so a question or a
         # negation is not read as the claim it names (`asserted_claims`).
         done, verified = asserted_claims(t)
@@ -4504,10 +4943,12 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
     # exit below - "nothing was done and nothing was claimed" - is exactly the
     # shape that used to leave such a claim unjudged.
     external = _external_claim(t)
-    if not worked and not (done or verified) and not external:
-        return (None, None)
+    if (not worked or quiet) and not (done or verified) and not external:
+        return _residual_block(t, rows, shape, session_id=session_id, cwd=cwd)
     if lost:
-        return fold(rows, worked | {BEGAN_KIND}, external)
+        return _residual_block(t, rows, shape,
+                               fold(rows, worked | {BEGAN_KIND}, external),
+                               session_id, cwd)
     # Two shapes the turn's own rows cannot judge, so they are judged against
     # the session's (the contract says "no successful check recorded in the
     # session"). Read only for these two, so every other turn still pays for
@@ -4530,8 +4971,10 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
             # the turn fold below, which asks for a fresh check.
             srows = events(session_id)
             if not external and _settled(srows):
-                return fold(_before_turn(srows), True, None, "this session")
-        elif not worked and (done or verified):
+                return _residual_block(t, rows, shape, fold(
+                    _before_turn(srows), True, None, "this session"),
+                    session_id, cwd)
+        if (not worked or quiet) and (done or verified):
             # A claim in a turn that did nothing: "Tamamlandı, tüm testler
             # geçti" after a turn that edited and ended "doğrulanmadı" was
             # allowed on all five Stop hosts (audit INT-01 / M-2).
@@ -4541,7 +4984,15 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None):
                 "this session")
             if refused[0]:
                 return refused
-    return fold(rows, worked, external)
+    judged = rows
+    if quiet:
+        # the fold reads work off the rows too (the spec's `W` atom), so a turn
+        # of reads hands it none - only an external read, the one thing such a
+        # turn can prove
+        judged, worked = [r for r in rows if not _work_row(r) or (
+            external and _external_read_row([r]) == 0)], set()
+    return _residual_block(t, rows, shape, fold(judged, worked, external),
+                           session_id, cwd)
 
 
 def _before_turn(rows):
@@ -4578,7 +5029,8 @@ def _evidence_block(rows, worked, external, where="this turn"):
         return ("check failed",
                 "A check failed in %s and the reply claims success. "
                 "Report the failure with its exact error line, or fix it and "
-                "re-run; do not describe a failed check as passing." % where)
+                "re-run; do not describe a failed check as passing. %s."
+                % (where, ADMISSION))
     # a failure the turn never resolved: the newest check is not a pass, so an
     # earlier green run over a different command does not license the claim
     state = _partial_state(rows)
@@ -4588,15 +5040,16 @@ def _evidence_block(rows, worked, external, where="this turn"):
                 "an earlier green run does not cover it. Report that failure "
                 "with its exact error line, or fix it and re-run the check; do "
                 "not describe a partial result as done. If you are deliberately "
-                "stopping on the failure, say what is still broken and mark the "
-                "claim \"doğrulanmadı\"."
+                "stopping on the failure, say what is still broken; %s."
                 % (_failed_check(rows),
-                   "after %s's edits" % where if state["edited"] else "in " + where))
+                   "after %s's edits" % where if state["edited"] else "in " + where,
+                   ADMISSION))
     # A passing check licenses the claim only when it is newer than the newest
     # write the gate saw change the tree: a green run over the previous revision
     # is not evidence about this one, and the ledger already carries both sides
-    # (the check's position, and `changed` on the write). The escape is the
-    # reply's own "doğrulanmadı", which returns above. The pass has to be one
+    # (the check's position, and `changed` on the write). The admission is the
+    # reply's own "doğrulanmadı" after a check that failed since that write
+    # (`_admitted`). The pass has to be one
     # run in the newest change's own repository (`_last_pass`'s `repo`).
     last_change = _last_change(rows)
     last_pass = _last_pass(rows, _change_repo(rows, last_change))
@@ -4621,8 +5074,11 @@ def _evidence_block(rows, worked, external, where="this turn"):
                 "its output, or read the rendered screen (`analyze-app`: the "
                 "accessibility/DOM tree, a screenshot at the widths in scope) "
                 "and say what it showed. A green unit suite does not cover "
-                "what a person sees; if you are stopping short, mark the "
-                "claim \"doğrulanmadı\"." % (where, shown or "a UI file"))
+                "what a person sees, and \"{UNVERIFIED}\" does not stand in for "
+                "the screen; if nothing can render it here, write "
+                "\"{UNVERIFIED}\" and name it under \"{BLOCKERS_HEADING}\" as {ENV} "
+                "with the command that failed."
+                % (where, shown or "a UI file"))
     if ui_write >= 0:
         # The floor, asked of a component turn on top of the screen proof: a
         # screenshot or a rendered check says what the thing looks like and
@@ -4644,7 +5100,9 @@ def _evidence_block(rows, worked, external, where="this turn"):
                     "(`tezgah-design derive` writes the contract when the repo "
                     "has none; the measurement is the per-component styles and "
                     "states the analyze-app loop produces) and report every "
-                    "violation it prints, or mark the claim \"doğrulanmadı\"."
+                    "violation it prints; if the check cannot run here, write "
+                    "\"{UNVERIFIED}\" and name it under \"{BLOCKERS_HEADING}\" as {ENV} "
+                    "with the command that failed."
                     % (where, shown or "a component file"))
     # A screen proof stands where a unit pass stands for the rest of this fold,
     # so a UI turn whose UI work is proven is not asked for a check it already
@@ -4670,12 +5128,12 @@ def _evidence_block(rows, worked, external, where="this turn"):
         return ("stale evidence",
                 "Stale evidence: the newest check that passed ran before %s %s "
                 "written, so it verified an earlier revision of the tree than the "
-                "one this reply is about. Re-run the smallest check that covers "
-                "the files written since (their own tests, not the whole suite) "
-                "and report its output, or mark the claim \"doğrulanmadı\". "
+                "one this reply is about. Run the tests of the files written since "
+                "(`python3 tests/impacted.py --run <paths>` where the repo has "
+                "it; not the whole suite) and report its output; %s. "
                 "A green run over the previous revision does not cover this one."
                 % (shown or "a file this session wrote",
-                   "was" if len(names) <= 1 else "were"))
+                   "was" if len(names) <= 1 else "were", ADMISSION))
     elif worked and _last_pass(rows) > last_change:
         # a pass newer than the change exists, only in another repository: the
         # class stays (ledger continuity), the text names the real reason
@@ -4683,34 +5141,39 @@ def _evidence_block(rows, worked, external, where="this turn"):
                 "%s changed %s, and the check that passed after it ran in "
                 "another repository (%s), so it says nothing about this one. "
                 "Run the check in the repository you changed and report its "
-                "output, or mark the claim \"doğrulanmadı\"."
+                "output; %s."
                 % (where.capitalize(), _change_repo(rows, last_change),
                    rows[max(i for i, r in enumerate(rows)
-                            if passing_check(r))].get("repo")))
+                            if passing_check(r))].get("repo"), ADMISSION))
     elif worked:
         return ("no verify_ok",
                 "%s did work (edits or commands) and no check ran "
                 "successfully in it (nothing recorded as verify_ok with a "
                 "real result and an unmasked command), so nothing here supports "
-                "calling it done, complete or verified. Run the smallest check "
-                "that proves the change (the tests of what changed, not the "
-                "whole suite) and report its output, or mark the claim "
-                "\"doğrulanmadı\". Do not "
+                "calling it done, complete or verified. Run the tests of the "
+                "files written (`python3 tests/impacted.py --run <paths>` where "
+                "the repo has it; not the whole suite) and report its output; "
+                "%s. Do not "
                 "describe a check you did not run as if it ran."
-                % where.capitalize())
+                % (where.capitalize(), ADMISSION))
     # Last, so none of the classes above loses its turn to it: every shape this
     # one refuses is a shape the fold was about to allow. That is the whole
     # ordering rule of this function - the branch is asked only where the answer
     # would otherwise be "this turn may end".
     if unread:
-        return ("no external read",
-                "The reply states the state of a system tezgah does not own (%s) "
-                "and no read of that system ran in %s. Only the system "
-                "itself knows: a local client's cache, a stale checkout and a "
-                "memory of what used to be published all answer this wrongly. Run "
-                "the read and report its output - %s - or mark the claim "
-                "\"doğrulanmadı\"." % (cut(external.strip(), 80), where,
-                                       _external_command(external)))
+        return ("no external read", _external_text(external, where))
+    return (None, None)
+
+
+def _external_text(external, where="this turn"):
+    """The `no external read` refusal text, for the fold and for `_admitted`."""
+    return ("The reply states the state of a system tezgah does not own (%s) "
+            "and no read of that system ran in %s. Only the system "
+            "itself knows: a local client's cache, a stale checkout and a "
+            "memory of what used to be published all answer this wrongly. Run "
+            "the read and report its output - %s; a read that fails is an "
+            "answer too, quote it." % (cut(external.strip(), 80), where,
+                                      _external_command(external)))
     return (None, None)
 
 
@@ -4748,18 +5211,13 @@ EXTERNAL_SYSTEM = re.compile(
     r"\b(?:npm|yarn|pnpm|pip|pypi|py ?pi|crates(?:\.io)?|rubygems|gem|"
     r"brew|homebrew|formula|tap|dist-tag|tarball|registry|releases?|tags?|"
     r"workflow|pipeline|ci|github)\b", re.I)
-EXTERNAL_STATE = re.compile(
-    r"\b(?:missing|absent|unpublished|exists?|not (?:published|released|found|"
-    r"there|listed|present)|published|released|deprecated|outdated|stale|"
-    r"yok|eksik|yayımlan|yayınlan)\b", re.I)
+EXTERNAL_STATE = re.compile(r"\b(?:%s)\b" % alts("external_state"), re.I)
 # The status of a run, which pairs with a CI subject alone: "the workflow is red"
 # and "CI passed" are claims about a system tezgah does not own, while the same
 # words beside `release` are prose ("Suite green, release ready"), which is what
 # the split is for.
 EXTERNAL_CI = re.compile(r"\b(?:workflow|pipeline|ci|github)\b", re.I)
-EXTERNAL_CI_STATE = re.compile(
-    r"\b(?:green|red|passing|passes|passed|failing|fails|failed|behind|flaky|"
-    r"geçti|başarısız)\b", re.I)
+EXTERNAL_CI_STATE = re.compile(r"\b(?:%s)\b" % alts("external_ci_state"), re.I)
 # How far apart, on one line, the two halves of a claim may sit. 45 characters
 # holds every form the incident took ("npm 0.22.0 yayımlanmadı" is 12 apart,
 # "the registry has no such version published" is 30) and drops the long report
@@ -4771,10 +5229,8 @@ EXTERNAL_GAP = 45
 # numbers in prose. A two-part number was the single largest source of false
 # positives in the measurement above.
 EXTERNAL_VERSION = re.compile(
-    r"\bv\d+\.\d+\.\d+[^\n]{0,40}?\b(?:missing|absent|unpublished|exists?|"
-    r"published|released|yok|eksik|yayımlan|yayınlan)\b"
-    r"|\b(?:missing|absent|unpublished|exists?|published|released|yok|eksik|"
-    r"yayımlan|yayınlan)\b[^\n]{0,40}?v\d+\.\d+\.\d+", re.I)
+    r"\bv\d+\.\d+\.\d+[^\n]{{0,40}}?\b(?:{0})\b|\b(?:{0})\b[^\n]{{0,40}}?v\d+\.\d+\.\d+"
+    .format(alts("publish_state")), re.I)
 # The read that answers it, at a command position on the masked text - the
 # convention `UI_CHECK` and `NETWORK_READ` follow - so a reply that merely names
 # `npm view`, and the search whose pattern is that name, are not reads of
@@ -4886,6 +5342,833 @@ def _external_read_row(rows):
     return -1
 
 
+def _failed_since_change(rows):
+    """True when a check ran and failed after the newest write that changed the
+    tree (`_last_change`): the attempt the admission rests on. A failure before
+    that write is about the tree the write replaced."""
+    return any(r.get("kind") == "verify_fail" for r in rows[_last_change(rows) + 1:])
+
+
+def _proof_attempt_failed(rows):
+    """True when the proof `no ui_ok` asks of `rows` was attempted and failed
+    after the write it is about: a check that sees the screen (`UI_CHECK`) after
+    the newest UI write - the design check measures that rendered screen, so a
+    screen that did not render leaves it nothing to run on - or, with the screen
+    proven, the design check (`DESIGN_CHECK`) after the newest component write.
+    A failed screen check is the attempt the admission rests on there; a failed
+    unit check is not."""
+    def failed_after(i, check):
+        return any(r.get("kind") == "verify_fail"
+                   and check.search(mask(str(r.get("detail") or "")))
+                   for r in rows[i + 1:])
+    write, proof = _ui_evidence(rows)
+    if write >= 0 and proof <= write:
+        return failed_after(write, UI_CHECK)
+    return failed_after(_design_evidence(rows)[0], DESIGN_CHECK)
+
+
+def _prose(text):
+    """`text` with its fenced blocks and inline code blanked: a test selector
+    (`pytest -k unverified`), a file name (`DECISION.md`) or a pasted log line is
+    no word of the reply's own."""
+    return CODE_SPAN.sub(" ", FENCED_BODY.sub(" ", str(text or "")))
+
+
+def _admitted(fold, text):
+    """`fold` with the admission applied (plan 080). A verdict in
+    ADMITTED_CLASSES is cleared when the reply's prose admits the work is
+    unverified (NEGATED) and the rows that fold judged hold a check that failed
+    since their newest change. The failure is the part admitted, and nothing
+    else: the fold is asked again without the failed checks, so a screen or
+    design proof the turn owes still comes back (`no ui_ok`) unless that proof
+    is the check that ran and failed (`_proof_attempt_failed`), and an external
+    claim with no read of its system still owes the read (`no external read`) -
+    otherwise a failed unit check would end a turn its passing twin cannot.
+    Wrapped around whichever fold the selector was given, so the live rule and
+    the temporal spec read the admission the same way."""
+    if not NEGATED.search(_prose(text)):
+        return fold
+
+    def admitted(rows, worked, external, *where):
+        verdict = fold(rows, worked, external, *where)
+        if not verdict[0] or not _failed_since_change(rows):
+            return verdict
+        owed = fold([r for r in rows if r.get("kind") != "verify_fail"],
+                    worked, external, *where)
+        if owed[0] and owed[0] not in ADMITTED_CLASSES and not (
+                owed[0] == "no ui_ok" and _proof_attempt_failed(rows)):
+            return owed
+        if external is not None and _external_read_row(rows) < 0:
+            return ("no external read", _external_text(external, *where))
+        return (None, None)
+    return admitted
+
+
+# The eleventh Stop class, `residual work` (plan 080): a turn that did work and
+# ends on a list of what is left - "Açık kalanlar", "Doğrulanmadı:", "Sıradaki
+# adım" - instead of doing it. Before the class, 503 of 1876 final replies in
+# the owner's omp and Claude transcripts carried such a label at a line start,
+# 467 of them in a turn that called a non-read tool: a section that reported
+# the work was the cheapest end of a turn. An item stays only when something
+# accounts for it: a KARAR or GERİ ALINAMAZ token (a choice or a consent, which
+# no ledger row can prove), or a YETKİ or ORTAM token together with a quote of a
+# command that failed in the turn - the type, and the attempt and its error the
+# request asks for; either alone keeps nothing, so an untyped "Doğrulanmadı:
+# `pytest` ..." is refused like any other item. Asked only in
+# a turn that did work - a spec, an answer or a plan proposal lists
+# assumptions, non-goals and next steps as its content - and only at an exit
+# that would end the turn, so it never takes a turn another class refused.
+# Labels the other rules ask for stay out of the list: a spec's assumptions and
+# alternatives, a measurement's limits ("Ölçüm sınırı"), risks ("Riskler",
+# "Regresyon riski": the reply keeps its risks) and a bare recommendation
+# ("Önerim"); suggested improvements are work left and stay in. ponytail: a word
+# list read at line starts, not a reader of what an item means - a doable item
+# typed KARAR passes, which the question endings `tezgah-gate replay` counts are
+# there to watch.
+# The first-person negatives ("Yapamadım", "Bakmadıklarım", "Test etmedim"),
+# the passive stems "kontrol edil-", "incelen-", "ölçül-", "çözül-", "denen-" and
+# the English forms after them were added from the S4 corpus (finding 4).
+RESIDUAL_LABEL = re.compile(r"(?:%s)" % alts("residual_label"))
+# "Kalan" is also an adjective ("Kalan riskler", "Kalan süre", "Ayakta kalan
+# tek şey"): it opens a list only as the label's first word and on the work it
+# names - "Kalan:", "Kalanlar", "Kalan iş", "Kalan adımlar", "Kalan tek şey".
+RESIDUAL_FIRST = alts("residual_first")
+# At most three words may lead any other stem: "Bu turda açık kalanlar", "Henüz
+# yapılmayanlar", "Bu turda henüz bakılmayanlar".
+RESIDUAL_AT = re.compile(r"(?:%s)|(?:[^\W\d][\w'’-]*\s+){0,3}(?:%s)"
+                         % (RESIDUAL_FIRST, RESIDUAL_LABEL.pattern))
+# A label whose own words close the list: a claim word (`asserted_claims`), or
+# a completion verb or participle the claim vocabulary does not carry ("Eksik
+# kapandı", "Düzeltilen eksik", "Doğrulanmayan kalmadı", "Eksik olan kanıt artık
+# var"). "Kısmen ..." stays open.
+LABEL_DONE = re.compile(r"\b(?:%s)\b" % alts("label_done"))
+PARTIAL = re.compile(r"(?:%s)\b" % alts("partial"))
+# A short label that says nothing is left - it ends on "yok"/"none" or opens on
+# "no"/"none" - is no list ("Eksik yok"); in a longer one, or after a comma, the
+# "yok" is about something else ("Doğrulanmadı, kanıt yok"). A word in a
+# parenthesis is a comment on the label.
+NOTHING_LEFT = re.compile(r"(?:%s)\W*$|^(?:%s)\b"
+                          % (alts("nothing_left"), alts("nothing_lead")))
+NOTHING_SHORT = 4
+PARENTHESIS = re.compile(r"\([^)]*\)")
+# An item that is only that word, or opens on it before a stop ("yok, iş
+# bitti."), or is a bare zero, is no item; a "yok" inside an item ("playwright
+# yok") is content and is judged like the rest.
+EMPTY_ITEM = re.compile(r"\W*(?:(?:%s)(?:\s*[.,;:!—–-][^\n]*)?|0)\W*"
+                        % alts("empty_item"), re.I)
+# The blocker tokens, as the capitalised token the contract names them by, in
+# every pack's spelling (`blockers.<kind>.pattern`: DECISION and KARAR alike), a
+# suffix allowed ("KARARI senin"); a token negated by the next word ("KARAR
+# gerekmiyor") is none, and code is blanked first (`_prose`).
+# BLOCKER_SAID needs no ledger row: a choice or a consent leaves none to check.
+# BLOCKER_TRIED is the attempt that failed - it counts only beside the error
+# its type names (ENV_ERROR for the env token, ACCESS_ERROR for the access one,
+# read off the match's group name) and its ledger evidence: a quote of a
+# command that failed in the turn (`_quotes_failure`), or a spawn call of the
+# turn the host answered with a provider failure (`_spawn_failed`: a 429, a
+# quota, a credential).
+
+
+def _tokens(kind):
+    """Every pack's spelling of blocker `kind`, as one alternation."""
+    return "|".join(pack_values("blockers", kind, "pattern")) or "(?!)"
+
+
+BLOCKER_NOT = r"(?!\s+(?:%s))" % alts("blockers", "said_not")
+BLOCKER_SAID = re.compile(r"\b(?:%s|%s)[A-ZÇĞİIÖŞÜ]*\b"
+                          % (_tokens("decision"), _tokens("irreversible")) + BLOCKER_NOT)
+# BLOCKER_SAID's consent half: a GERİ ALINAMAZ item needs no options.
+IRREVERSIBLE_SAID = re.compile(BLOCKER_SAID.pattern.replace(_tokens("decision") + "|", "", 1))
+# After the access or env token, "yok" and "not" describe the blocker ("YETKİ
+# yok", "ENV not set"), so only a pack's `tried_not` words negate them; the
+# suffix is read on the stems a pack spells with one, so ACCESSIBILITY or
+# ENVELOPE is no type, while the plural ENVIRONMENTS is.
+BLOCKER_TRIED = re.compile(r"(?:\b(?P<access>%s)|\b(?P<env>%s))\b(?!\s+(?:%s))"
+                           % (_tokens("access"), _tokens("env"),
+                              alts("blockers", "tried_not")))
+# The word after the token that says the grant or tool is absent ("YETKİ yok").
+BLOCKER_ABSENT = r"(?:\s+(?:%s)\b)?" % alts("blockers", "absent")
+ENV_ERROR = re.compile(alts("env_error"), re.I)
+ACCESS_ERROR = re.compile(USER_ERROR.pattern + "|" + alts("access_error"), re.I)
+# A spawn call's failure classes that are the provider's, not the brief's: a
+# rate limit or a timeout (`transient`) and a quota or a credential (`user`).
+SPAWN_FAIL_CLASSES = frozenset(("transient", "user"))
+# The words that tie an item to a spawn call: only such an item borrows a
+# failed spawn's row as its evidence (`_tried_holds`).
+SPAWN_WORDS = re.compile(alts("spawn_words"))
+# A search that matched nothing exits 1 and failed nothing (`_failed_commands`).
+NO_MATCH_PROGRAMS = frozenset(("grep", "egrep", "fgrep", "rg", "ag"))
+LIST_MARK = re.compile(r"\s*(?:\d+[.)]|[-*+])\s+")
+QUOTE_MARK = re.compile(r"^(\s*)>\s?")
+LEAD_SYMBOLS = re.compile(r"^[^\w#*_`]+")
+CODE_SPAN = re.compile(r"`([^`\n]+)`")
+FENCED_BODY = re.compile(r"^\s*(?:```|~~~)[^\n]*\n(.*?)^\s*(?:```|~~~)", re.M | re.S)
+COMMAND_SPLIT = re.compile(r"&&|\|\||;|\|")
+# The refusal leads and blocker tokens are the configured language's
+# (`{RESIDUAL_LEAD}`, `{DECISION}`..., filled by `_said`): the owner's tr pack
+# opens in Turkish because Claude Code shows the refusal's first line to the
+# user; the canonical English pack adds no lead.
+RESIDUAL_WORK = (
+    "{RESIDUAL_LEAD}The reply lists "
+    "work that is left (%s) at the end of a turn that did work. Do each item "
+    "now with the tools you have: a local merge of a branch this session made "
+    "and the removal of its worktree are such steps. A step that is outward or "
+    "cannot be undone (a push or a release with no grant from the user this "
+    "session, a force push, a delete of what the session did not make) is never "
+    "taken to clear this list - it is {IRREVERSIBLE}, and you ask. An item may "
+    "stay only as one of four "
+    "blockers, named in capitals: {DECISION} (a choice only the user can make, "
+    "with its options and a \"{RECOMMENDED}:\" default - never \"which first\" or "
+    "\"shall I go on\"), {ACCESS} (a credential or grant "
+    "no tool supplies), {IRREVERSIBLE} (needs consent), {ENV} (a tool or "
+    "environment is missing); a {ACCESS} or {ENV} item quotes, in backticks, the "
+    "command that failed in this turn and its error - a quote with no type, "
+    "or a type with no quote, is not one. \"Out of "
+    "scope\", \"later\", \"time\" and \"could be added\" are not blockers. Report "
+    "what is left under one heading, \"{BLOCKERS_HEADING}\", at most three lines: item - "
+    "blocker - evidence - what unblocks it.")
+# The `stopped slice` class (plan 081): a subagent slice this session spawned
+# ended stopped - a quota, a 429, an abort, a cut-off - and the turn would end
+# with its work unresumed. Filled with the slice id, its failure class and the id
+# twice more.
+STOPPED_SLICE = (
+    "{SLICE_LEAD}Slice %s, spawned by this session, stopped (%s) and "
+    "its work is not resumed. Resume it with `tezgah-task slice resume %s` - "
+    "the native path first, else the re-dispatch brief it prints - or, if the "
+    "work was finished another way, record that with `tezgah-task slice done "
+    "%s`.")
+
+# The `ready steps` class (plan 086, S1): the newest todo list (`note_todo`)
+# holds a pending item, not taken and not blocked, and the reply ends the turn
+# without it. Filled with the count and up to three heads.
+READY_STEPS = (
+    "{READY_LEAD}The newest todo list holds %d ready step(s) this "
+    "turn neither did nor typed as a blocker: %s. Dispatch every ready step "
+    "now - independent ones as subagents in one message - and tick each one "
+    "you finish. A step that waits on a running slice or on the user is marked "
+    "blocked in the todo list (omp `block`, naming the slice or the blocker), "
+    "or named in the reply on one line with its {DECISION}, {ACCESS}, {IRREVERSIBLE} "
+    "or {ENV}. End the turn only when no step is ready.")
+
+
+def _tr_lower(text):
+    """`text` lowercased the Turkish way (I -> ı, İ -> i): `str.lower` reads
+    "DOĞRULANMADI" as "doğrulanmadi" and "İleride" with a combining dot."""
+    return text.replace("I", "ı").replace("İ", "i").lower()
+
+
+def _label(line):
+    """(label, rest) when `line` opens with a label - a markdown heading, a bold
+    or italic lead (cut at its own colon), or at most six words before a colon -
+    after an optional list marker, quote marker or leading symbol (an emoji),
+    else None. `rest` is what follows the label on its line."""
+    s = QUOTE_MARK.sub("", line).strip()
+    marker = LIST_MARK.match(s)
+    if marker:
+        s = s[marker.end():]
+    s = LEAD_SYMBOLS.sub("", s)
+    m = re.match(r"#{1,6}\s+(.+)$", s)
+    if m:
+        return LEAD_SYMBOLS.sub("", m.group(1)).strip(" *_:"), ""
+    m = re.match(r"(\*\*|__|\*|_)(.+?)\1(.*)$", s)
+    if m:
+        head, colon, inner = m.group(2).partition(":")
+        rest = (inner + " " + m.group(3).strip().lstrip(":")) if colon \
+            else m.group(3).strip().lstrip(":")
+        return head.strip(), rest.strip()
+    head, colon, rest = s.partition(":")
+    if colon and head.strip() and len(head.split()) <= 6 and "`" not in head:
+        return head.strip(), rest.strip()
+    return None
+
+
+def _residual(label):
+    """True when `label` names work that is left: it opens, after at most two
+    words, with a RESIDUAL_LABEL form (TODO only in capitals, the marker), its
+    own words close nothing ("Eksikler giderildi" is done, "Kısmen güncellendi"
+    is not) and it does not say nothing is left - in a few words, or after its
+    last colon ("Engeller: yok")."""
+    if label.startswith("TODO"):
+        return True
+    for low in (_tr_lower(label), label.lower()):
+        core = " ".join(PARENTHESIS.sub(" ", low).split())
+        _head, colon, after = core.rpartition(":")
+        if not RESIDUAL_AT.match(core) or (colon and EMPTY_ITEM.fullmatch(after)) or (
+                NOTHING_LEFT.search(core) and len(core.split()) <= NOTHING_SHORT
+                and not re.search(r"[,;:—–]", core)):
+            continue
+        if PARTIAL.match(core) or not (any(asserted_claims(core))
+                                       or LABEL_DONE.search(core)):
+            return True
+    return False
+
+
+def _bare_label(line):
+    """The text of a plain line that is a label with no colon, else "": at most
+    four words that open on a RESIDUAL_FIRST or RESIDUAL_LABEL form with only a
+    suffix after it ("Açık kalanlar", "Unresolved"). "Pending changes" and
+    "Kod değişikliği yapılmadı" name something else and are no label."""
+    s = LEAD_SYMBOLS.sub("", line.strip()).strip()
+    if not s or ":" in s or len(s.split()) > 4:
+        return ""
+    for low in (_tr_lower(s), s.lower()):
+        core = " ".join(PARENTHESIS.sub(" ", low).split())
+        m = re.match(RESIDUAL_FIRST, core) or RESIDUAL_LABEL.match(core)
+        if m and not re.search(r"\s", core[m.end():]):
+            return s
+    return ""
+
+
+def _indent(line):
+    return len(line) - len(line.lstrip())
+
+
+def _sections(text):
+    """[(label, intro, items)] for every residual section, outside fences and
+    tables, a quote marker read as plain text. A list item that opens with the
+    label holds itself alone - its rest and its deeper lines. A markdown heading
+    holds the lines up to the next heading of its level or above, or prose after
+    a blank line once it holds something. Any other label line holds its rest
+    and the lines under it, up to the next heading, the next label at its
+    depth, or that prose. The list entries at the shallowest depth are the
+    items, and what comes before the first is the intro; with no list,
+    everything is one item. A fenced block belongs to the item it follows,
+    list-shaped lines inside it included."""
+    lines = [QUOTE_MARK.sub(r"\1", ln) for ln in str(text or "").split("\n")]
+    out, i, inside = [], 0, False
+    while i < len(lines):
+        line = lines[i]
+        i += 1
+        if FENCE.match(line):
+            inside = not inside
+            continue
+        found = None if inside or TABLE_ROW.match(line) else _label(line)
+        if (not found and not inside and not TABLE_ROW.match(line)
+                and not LIST_MARK.match(line) and i < len(lines)
+                and LIST_MARK.match(lines[i]) and _bare_label(line)):
+            # a label line with no colon right over a list ("Açık kalanlar\n-
+            # ...", S4 finding 4)
+            found = (_bare_label(line), "")
+        if not found or not _residual(found[0]):
+            continue
+        label, rest = found
+        depth, own = _indent(line), bool(LIST_MARK.match(line))
+        level = HEADING.match(line) and len(line.strip()) - len(line.strip().lstrip("#"))
+        body, blank, fenced = [], False, False
+        while i < len(lines):
+            nxt = lines[i]
+            if FENCE.match(nxt):
+                fenced = not fenced
+            elif not fenced:
+                if not nxt.strip():
+                    blank = True
+                    i += 1
+                    continue
+                deeper = _indent(nxt) > depth
+                if own and not deeper:
+                    break
+                held = rest or any(b.strip() for b in body)
+                prose_after = (not deeper and not LIST_MARK.match(nxt)
+                               and blank and held)
+                head = HEADING.match(nxt) and len(nxt.strip()) - len(nxt.strip().lstrip("#"))
+                if level:
+                    if (head and head <= level) or (not head and prose_after):
+                        break
+                elif not deeper and (head or prose_after or (
+                        not LIST_MARK.match(nxt) and _label(nxt))):
+                    break
+            body.append(nxt)
+            i += 1
+        out.append(_items(label, rest, body, own))
+    return out
+
+
+def _items(label, rest, body, own):
+    """(label, intro, items) for one section's body (`_sections`)."""
+    marks, fenced = [], False
+    for b in body:
+        if FENCE.match(b):
+            fenced = not fenced
+        marks.append(not fenced and not FENCE.match(b) and bool(LIST_MARK.match(b)))
+    top = min((_indent(b) for b, m in zip(body, marks) if m), default=None)
+    pre, entries = [], []
+    for b, m in zip(body, marks):
+        if m and _indent(b) == top:
+            entries.append(b[LIST_MARK.match(b).end():])
+        elif entries:
+            entries[-1] += "\n" + b
+        else:
+            pre.append(b)
+    if entries and not own:
+        return (label, " ".join([rest] + pre).strip(), entries)
+    return (label, "", ["\n".join([rest] + body).strip()])
+
+
+def residual_sections(text):
+    """[(label, items)] for every residual section of a reply (`_sections`):
+    what the Stop rule's `residual work` class and the replay's per-turn count
+    both read."""
+    return [(label, items) for label, _intro, items in _sections(text)]
+
+
+def residual_text(text):
+    """The residual sections of `text` written back out - each as a heading,
+    which holds a label of any length and its code, then its intro and one `- `
+    line per item - so a store that keeps only part of a reply (Cursor's head
+    and tail) still hands the Stop rule what the cut would drop. Reads back
+    through `_sections` as the same sections."""
+    return "".join("## %s\n%s%s\n\n" % (label, intro + "\n" if intro else "", "\n".join(
+        "- " + item.replace("\n", "\n  ") for item in items))
+        for label, intro, items in _sections(text))
+
+
+def _quotes_failure(item, failed):
+    """True when a code span or a fenced line of `item` quotes a command that
+    failed: the span is one of its commands, holds one whole (two words at
+    least, so a bare `git` that failed is not `git push`), or opens one word for
+    word (`pytest` for `pytest -q`). A span cut short with `…` or `...` opens
+    one with what is left of it, two words at least (`tezgah-task note 001
+    state …`). A fragment such as `src` of `ls src/e2e` quotes nothing."""
+    spans = CODE_SPAN.findall(item) + [
+        ln for body in FENCED_BODY.findall(item) for ln in body.split("\n")]
+    for span in (re.sub(r"^\$\s+", "", s.strip()) for s in spans):
+        head = re.sub(r"\s*(?:…|\.\.\.)$", "", span)
+        shortened = head != span and len(head.split()) >= 2
+        for cmd in failed:
+            for seg in (s.strip() for s in COMMAND_SPLIT.split(cmd)):
+                if not seg or not span:
+                    continue
+                if seg == span or (seg in span and len(seg.split()) >= 2) or (
+                        seg.startswith(span) and seg[len(span)].isspace()) or (
+                        shortened and seg.startswith(head)):
+                    return True
+    return False
+
+
+def _failed_commands(rows):
+    """The commands that failed in `rows`: a `verify_fail`, or a shell row with
+    exit 1. A write tool's `edit` row is none (its detail is a path), and
+    neither is a search alone that matched nothing (NO_MATCH_PROGRAMS: grep's
+    exit 1 is its "no"); a grep after `&&`, `;` or a pipe reports the line's
+    exit, so that row stays a failure."""
+    out = []
+    for r in rows:
+        if r.get("kind") == "edit" or not (r.get("exit") == 1
+                                           or r.get("kind") == "verify_fail"):
+            continue
+        cmd = str(r.get("detail") or "").replace(FAILED_MARK, "").strip()
+        segs = [words for words in _shell_segments(cmd) if words]
+        if (r.get("kind") != "verify_fail" and len(segs) == 1
+                and segs[0][0] in NO_MATCH_PROGRAMS):
+            continue
+        out.append(cmd)
+    return out
+
+
+def _spawn_failed(rows):
+    """True when `rows` hold a spawn call (SUBAGENT_TOOLS) the host answered
+    with a provider failure (SPAWN_FAIL_CLASSES): the ledger's evidence for a
+    YETKİ or ORTAM that no shell command shows."""
+    return any(str(r.get("tool") or "").lower() in SUBAGENT_TOOLS
+               and r.get("fail_class") in SPAWN_FAIL_CLASSES for r in rows)
+
+
+def _tried_holds(item, said, failed, spawn_failed=False):
+    """True when a YETKİ or ORTAM item carries its evidence: the error its type
+    names (ENV_ERROR for ORTAM/ENV, ACCESS_ERROR for YETKİ/ACCESS), read in the
+    item outside the type token and the quoted command, beside a quote of a
+    command that failed (`_quotes_failure`), or - for an item that names a
+    subagent, an agent, a provider or a model (SPAWN_WORDS) - in a turn whose
+    spawn call failed at the provider (`spawn_failed`). A failure of another
+    kind - an assertion, a typo, a grep that matched nothing - is doable work,
+    whatever it is typed. So is a quota or rate limit on a model provider
+    while another family the routing allows is up (`_limit_move`)."""
+    kinds = {m.lastgroup for m in BLOCKER_TRIED.finditer(said)}
+    rest = re.sub(BLOCKER_TRIED.pattern + BLOCKER_ABSENT, " ", item)
+    rest = CODE_SPAN.sub(lambda m: " " if _quotes_failure(m.group(0), failed)
+                         else m.group(0), rest)
+    if not any((ENV_ERROR if k == "env" else ACCESS_ERROR).search(rest)
+               for k in kinds):
+        return False
+    if _limit_move(item, failed, spawn_failed):
+        return False
+    return bool(spawn_failed and SPAWN_WORDS.search(_tr_lower(item))) or \
+        _quotes_failure(item, failed)
+
+
+# The move a refused limit item can make (`_limit_move`), added to the
+# residual-work refusal so the reply knows what satisfies it.
+LIMIT_MOVE = (" A quota or rate limit on one model family is no {ACCESS} or {ENV} "
+              "while another is up: the work can move to %s - re-dispatch the "
+              "slice there.")
+
+
+def _limit_move(item, failed=(), spawn_failed=False):
+    """The family the work of `item` can move to, else None (research
+    orchestrator-flow-audit S2, F3b): the item quotes a quota or rate limit
+    (`tezgah_task.classify`) of a model provider - it names a family
+    (`tezgah_models.named_families`), or the turn's spawn failed at the provider
+    and the item quotes no failed command - and a family the routing allows is
+    up (`tezgah_models.other_family_up`), never one the item names. A GitHub
+    or npm rate limit stays a blocker: words such as "agent" or "provider" tie
+    nothing ("user-agent", "registry provider"). Fails open: None on any error."""
+    try:
+        import tezgah_task
+        if tezgah_task.classify(item) not in ("quota", "rate_limit"):
+            return None
+        import tezgah_models
+        if not (tezgah_models.named_families(item)
+                or (spawn_failed and not _quotes_failure(item, failed))):
+            return None
+        return tezgah_models.other_family_up(item)
+    except Exception:  # noqa: BLE001 - a health read never refuses on its own failure
+        return None
+
+
+# An item under a blocker label that tells a blocker it already removed: an
+# earlier sentence in the past ("reddediyordu", "yoktu") and a last sentence
+# that opens on "Artık" with a present verb ("Artık var", "Artık
+# reddedilmiyor", S4 finding 10). A negative past ("güncellenmedi") reports work
+# not done, and "şimdi"/"kendi" only end like a past tense, so neither is WAS.
+# A last sentence that still names work left (a RESIDUAL_LABEL stem) or a
+# future ("koşulacak") keeps the item open. ponytail: one adverb rule, not a
+# tense reader.
+BLOCKER_LABEL = re.compile(r"\W*(?:%s)" % alts("blocker_labels"))
+WAS = re.compile(r"\b(?!(?:%s)\b)(?:%s)\b" % (alts("was_exclude"), alts("was")))
+NOW = re.compile(alts("now"), re.S)
+FUTURE = re.compile(alts("future"))
+
+
+def _now_closed(item, label):
+    """True when `item`, under a blocker `label`, reports a blocker that is
+    gone (WAS, then NOW, with nothing left or due in the last sentence)."""
+    if not BLOCKER_LABEL.match(_tr_lower(label)):
+        return False
+    sentences = re.split(r"(?<=[.!?])\s+", _tr_lower(_prose(item)).strip())
+    last = sentences[-1].strip(" *_")
+    return (len(sentences) > 1 and bool(NOW.search(last))
+            and not RESIDUAL_LABEL.search(last) and not FUTURE.search(last)
+            and any(WAS.search(s) for s in sentences[:-1]))
+
+
+# The ask policy (plan 086, S3; the CORE integrity paragraph's "Ask policy").
+# Its vocabulary is the packs' `ask` map: the process-question shapes
+# (PROCESS_ASK: "Başlayayım mı?", "shall I proceed?", "which first?"), the
+# never-default class (NEVER_DEFAULT, and SPEND over `spend_cap`), a
+# recommended default (DEFAULT_MARK), a decision's options (OPTIONS_MARK), a
+# bare approval (CHEAP_ANSWER) and the outward classes a grant covers
+# (OUTWARD). QUESTION_END is a last line asking the user (`?`, or a pack's
+# question particle). ponytail: word lists read on the last line, not a reader
+# of what the question means; `tezgah-gate replay` counts what it refuses
+# (`process_questions`) to measure its precision.
+QUESTION_END = re.compile(r"(?:\?|\b(?:%s)[.!]?)$" % alts("question_end"))
+PROCESS_ASK = re.compile(alts("ask", "process"), re.I)
+NEVER_DEFAULT = re.compile(alts("ask", "never_default"), re.I)
+SPEND = re.compile(alts("ask", "spend"), re.I)
+AMOUNT = re.compile(r"\$\s?(\d+(?:\.\d+)?)|(\d+(?:\.\d+)?)\s?(?:\$|usd\b|dolar)", re.I)
+DEFAULT_MARK = re.compile(alts("ask", "default_mark"), re.I)
+OPTIONS_MARK = re.compile(alts("ask", "options"), re.I)
+CHEAP_ANSWER = re.compile(r"\W*(?:%s)\W*" % alts("ask", "cheap_answer"), re.I)
+OUTWARD = {cls: re.compile("|".join(
+    p for out in pack_values("ask", "outward") for c, p in out.items() if c == cls), re.I)
+    for cls in dict.fromkeys(c for out in pack_values("ask", "outward") for c in out)}
+GRANT_KIND = "grant"
+GRANT_ROW = re.compile(r'"kind"\s*:\s*"%s"' % GRANT_KIND)
+ASK_TOOLS = ("ask", "askuserquestion")
+# Filled with the question the reply ends on. No grant shape in it ("without
+# asking"): omp hands a refusal back as a prompt, and the prompt hook reads
+# grants off every prompt (`tezgah_context.user_grants`).
+NEEDLESS_ASK = (
+    "{ASK_LEAD}The reply ends on a question the agent can decide (\"%s\"). "
+    "Work and process steps - the order, \"shall I go on\", a check, a local "
+    "merge, a run parameter within the standing spend cap - are taken and "
+    "stated in one line, and an outward step the user granted this session is "
+    "taken, not asked again. An outward step the user has not granted waits "
+    "for the answer and never proceeds on a default. Do it now, or, when only "
+    "the user can decide it, put it under a \"{APPROVAL_HEADING}\" heading with "
+    "a \"{RECOMMENDED}:\" default and proceed on that default.")
+
+
+def outward_classes(text):
+    """The OUTWARD classes `text` names (push, release, publish, pr)."""
+    low = _tr_lower(str(text or ""))
+    return {cls for cls, rx in OUTWARD.items() if rx.search(low)}
+
+
+def never_default(text):
+    """True when `text` names a class-F step - one no default may take: a
+    force push, a delete of what the session did not make, production, a
+    credential or an account, a send to a third party (NEVER_DEFAULT), or a
+    spend (SPEND) with no amount or one over `spend_cap`."""
+    low = _tr_lower(str(text or ""))
+    if NEVER_DEFAULT.search(low):
+        return True
+    if not SPEND.search(low):
+        return False
+    amounts = [float(a or b) for a, b in AMOUNT.findall(low)]
+    return not amounts or max(amounts) > spend_cap()
+
+
+def grants_in_force(session_id):
+    """The OUTWARD classes the user granted this session and has not lifted,
+    folded oldest first over the session's `grant` rows (`target`: a class,
+    `all`, or `lift:<class|all>`). Only the lines in the row's serialized shape
+    are parsed, as `ready_left` reads `todo` rows."""
+    granted = set()
+    lines = [line for line in _ledger_lines(_path(session_id)) if GRANT_ROW.search(line)] \
+        if session_id else []
+    for row in _parse(lines):
+        target = str(row.get("target") or "")
+        if target == "all":
+            granted = set(OUTWARD)
+        elif target == "lift:all":
+            granted = set()
+        elif target.startswith("lift:"):
+            granted.discard(target[len("lift:"):])
+        elif target in OUTWARD:
+            granted.add(target)
+    return granted
+
+
+def needless_ask(text, granted=frozenset):
+    """The question the reply ends on when the agent can decide it, else None.
+
+    The last line asks (QUESTION_END), its paragraph carries no recommended
+    default (DEFAULT_MARK) and it names no class-F step (`never_default`); it
+    is then needless when it names an outward step (OUTWARD) the user granted
+    this session, every one it names (`granted()`, called only then, so a reply
+    that ends on no question reads no ledger), or, naming none, when it asks a
+    process question (PROCESS_ASK). A question about an ungranted outward step
+    is the one the policy asks: "push edip PR açayım mı?" waits."""
+    t = str(text or "").strip()
+    lines = [ln.strip().rstrip("*_` ") for ln in t.splitlines() if ln.strip()]
+    if not lines or not QUESTION_END.search(lines[-1]):
+        return None
+    last = lines[-1]
+    if never_default(last) or DEFAULT_MARK.search(_tr_lower(re.split(r"\n\s*\n", t)[-1])):
+        return None
+    low = _tr_lower(last)
+    outward = outward_classes(low)
+    if outward:
+        return last if outward <= set(granted()) else None
+    if PROCESS_ASK.search(low):
+        return last
+    return None
+
+
+def undefaulted(inp):
+    """(questions, with a default) of an ask-tool payload: omp's `ask` marks
+    the default with a question's `recommended` index, Claude's
+    AskUserQuestion with an option label or description that names it
+    (DEFAULT_MARK: "(Recommended)", "(önerilen)")."""
+    inp = inp if isinstance(inp, dict) else {}
+    qs = inp.get("questions") if isinstance(inp.get("questions"), list) else [inp]
+    qs = [q for q in qs if isinstance(q, dict) and q.get("question")]
+
+    def has_default(q):
+        if isinstance(q.get("recommended"), int) and not isinstance(q.get("recommended"), bool):
+            return True
+        return any(isinstance(o, dict) and DEFAULT_MARK.search(_tr_lower(
+            "%s %s" % (o.get("label") or "", o.get("description") or "")))
+            for o in q.get("options") or ())
+    return len(qs), sum(1 for q in qs if has_default(q))
+
+
+# A blocker heading with nothing under it lists no blocker ("## Engeller" last).
+BLOCKERS_ONLY = re.compile(r"\s*(?:%s)\s*" % alts("blockers_only"))
+
+
+def unblocked_items(text, rows):
+    """[(label, item)] for every residual item nothing accounts for. A GERİ
+    ALINAMAZ token in the label, the intro or the item accounts for it, and so
+    does a KARAR token beside the decision's options or a recommended default
+    (`BLOCKER_SAID`, OPTIONS_MARK, DEFAULT_MARK, on the prose): a choice with
+    neither is one the agent can make (the ask policy). A YETKİ or ORTAM token
+    does only with its
+    evidence (`_tried_holds`: the error of its type and its ledger evidence) -
+    the type and its evidence, never one of the two. An empty blocker list
+    (BLOCKERS_ONLY), an item that says nothing is left and one that reports a
+    blocker already gone (`_now_closed`) are none; an empty item under any other
+    label is the label itself ("**V4 ölçülmedi.**")."""
+    failed = _failed_commands(rows)
+    spawn_failed = _spawn_failed(rows)
+    out = []
+    for label, intro, items in _sections(text):
+        for item in items:
+            if (EMPTY_ITEM.fullmatch(item.strip()) or _now_closed(item, label) or (
+                    not item.strip() and BLOCKERS_ONLY.fullmatch(_tr_lower(label)))):
+                continue
+            said = _prose(" ".join((label, intro, item)))
+            if BLOCKER_SAID.search(said) and (
+                    IRREVERSIBLE_SAID.search(said) or OPTIONS_MARK.search(_tr_lower(said))
+                    or DEFAULT_MARK.search(_tr_lower(said))):
+                continue
+            if BLOCKER_TRIED.search(said) and _tried_holds(item, said, failed,
+                                                           spawn_failed):
+                continue
+            out.append((label, item))
+    return out
+
+
+def _residual_block(text, rows, shape, verdict=(None, None), session_id=None,
+                    cwd=None):
+    """`verdict` when it refuses; else, in a turn that did work (a STEP_KINDS
+    row), the `residual work` class when `unblocked_items` names one, or when a
+    subagent ended in the turn handing up items no type accounts for (the
+    `residual` count on its `subagent_end` row) and this reply types none; else
+    the `needless ask` class when `needless_ask` names the question the reply
+    ends on (any turn, worked or not: the plan proposal that ends "Başlayayım
+    mı?" is its measured case); else the `ready steps` class when `ready_left`
+    names one; else the
+    `stopped slice` class when `_stopped_slice` finds one; else `verdict`. Not
+    asked for a subagent's end (`shape` false) or a nested session: both
+    replies are read by code, not by the user (`_shape_block`). Residual work
+    is not asked of a session whose ledger holds no turn marker either:
+    `turn_rows` hands it the whole ledger as the turn, so the steps it sees are
+    not this turn's. ponytail: one typed item in the reply covers every item
+    handed up - the rule cannot tell which child item a parent item answers."""
+    if verdict[0] or not shape or os.environ.get("TEZGAH_NESTED"):
+        return verdict
+    left = []
+    # the newest end of each child counts once (`agent`): a child that ended
+    # twice, or a re-sent end, is one hand-up
+    handed = sum({r.get("agent") or id(r): int(r.get("residual") or 0)
+                  for r in rows if r.get("kind") == "subagent_end"}.values())
+    if handed or any(str(r.get("kind")) in STEP_KINDS for r in rows):
+        _settle_slices(cwd)
+        left = unblocked_items(text, rows)
+        if handed and not left and not any(
+                item.strip() and not EMPTY_ITEM.fullmatch(item.strip())
+                for _label, _intro, entries in _sections(text) for item in entries):
+            left = [("subagent report", "%d untyped item(s) handed up" % handed)]
+        if left and session_id and not _turn_count(_ledger_lines(_path(session_id))):
+            left = []
+    if left:
+        named = "; ".join("%s: %s" % (label, cut(" ".join(item.split()), 48))
+                          for label, item in left[:3])
+        failed, spawn_failed = _failed_commands(rows), _spawn_failed(rows)
+        move = next(filter(None, (_limit_move(item, failed, spawn_failed)
+                                  for _label, item in left)), None)
+        return ("residual work", RESIDUAL_WORK % named + (LIMIT_MOVE % move if move else ""))
+    asked = needless_ask(text, lambda: grants_in_force(session_id))
+    if asked:
+        return ("needless ask", NEEDLESS_ASK % cut(asked, 80))
+    ready = ready_left(text, rows, session_id, cwd)
+    if ready:
+        return ("ready steps", READY_STEPS % (
+            len(ready), "; ".join(cut(head, 48) for head in ready[:3])))
+    stopped = _stopped_slice(session_id, cwd)
+    if not stopped:
+        return verdict
+    sid = str(stopped.get("id") or "")
+    return ("stopped slice", STOPPED_SLICE % (
+        sid, stopped.get("failure") or "error", sid, sid))
+
+
+def ready_heads(row, session_id, cwd):
+    """A `todo` row's ready heads (`note_todo`), less each one an open slice of
+    this session is working on: the slice id appears in the head, or the whole
+    head in the slice's own task (`task`, without an omp batch's shared
+    context), each as a word-bounded match of two characters or more,
+    case-insensitive. omp's `todo start` sets every other `in_progress` item
+    back to `pending`, so a dispatched item reads as ready in the list while
+    its slice runs. ponytail: a record written before `task` existed falls
+    back to its brief's last paragraph. Read from `tezgah_task.pending`, off
+    under `slices-off`, and fail open to the row's own heads."""
+    heads = [str(h) for h in row.get("heads") or () if str(h).strip()]
+    if not (heads and session_id and cwd) or off("slices-off"):
+        return heads
+    try:
+        pending = getattr(_journal(), "pending", None)
+        root = _toplevel(os.path.realpath(cwd))
+        running = [(str(r.get("id") or "").lower(), " ".join(str(
+                    r.get("task") or str(r.get("brief") or "").rsplit("\n\n", 1)[-1]
+                    ).split()).lower())
+                   for r in (pending(root) if pending and root else [])
+                   if r.get("status") == "open" and r.get("parent") == session_id]
+    except Exception:
+        return heads
+
+    def word(needle, hay):
+        return len(needle) > 1 and re.search(
+            r"(?<![\w-])%s(?![\w-])" % re.escape(needle), hay)
+    return [h for h in heads
+            if not any(word(sid, h.lower()) or word(h.lower(), task)
+                       for sid, task in running)]
+
+
+def newest_todo(rows):
+    """The first `todo` row of the session's own list in `rows`, which run
+    newest first, else None: a subagent's row (`agent`) is its own queue,
+    never the parent's. Lazy, so a generator stops at the row it needs."""
+    return next((r for r in rows if r.get("kind") == "todo" and not r.get("agent")), None)
+
+
+def ready_left(text, rows, session_id, cwd=None):
+    """The heads of the ready steps the reply leaves: the newest `todo` row's
+    ready items (`ready_heads`), less each one a line of the reply names (its
+    first 24 characters, inline code kept) beside a KARAR, YETKİ, GERİ ALINAMAZ
+    or ORTAM token outside code. Asked like `residual work`: in a turn that
+    did work, of a ledger with a turn marker, off under `orchestrate-off`. The
+    row may come from an earlier turn: an unfinished step carries over. It is
+    found by its serialized shape and only the lines back to the newest
+    parent `todo` row are parsed, so the Stop path still parses the turn and
+    not the session (StopReadBound). A done item is gone from the list, so it
+    never needs the reply."""
+    if not session_id or off("orchestrate-off"):
+        return []
+    if not any(str(r.get("kind")) in STEP_KINDS for r in rows):
+        return []
+    lines = _ledger_lines(_path(session_id))
+    if not _turn_count(lines):
+        return []
+    row = newest_todo(r for line in reversed(lines) if TODO_ROW.search(line)
+                      for r in _parse([line]))
+    if not row or not row.get("ready"):
+        return []
+    typed = [_tr_lower(" ".join(line.split())) for line in str(text or "").splitlines()
+             if BLOCKER_SAID.search(_prose(line)) or BLOCKER_TRIED.search(_prose(line))]
+    return [h for h in ready_heads(row, session_id, cwd)
+            if not any(_tr_lower(h)[:24] in line for line in typed)]
+
+
+def _settle_slices(cwd):
+    """Close the journal's ended omp records (`tezgah_task.pending`) before the
+    residual rule picks a move, so a child's limit stop already holds its
+    family (`close_slice`) and the move never names it. Off under
+    `slices-off`; fails open."""
+    if not cwd or off("slices-off"):
+        return
+    try:
+        pending = getattr(_journal(), "pending", None)
+        root = _toplevel(os.path.realpath(cwd))
+        if pending and root:
+            pending(root)
+    except Exception:  # noqa: BLE001 - a broken journal costs the hold, never the Stop
+        pass
+
+
+def _stopped_slice(session_id, cwd):
+    """The newest slice record this session spawned that the journal holds as
+    stopped (`tezgah_task.pending`), else None. A turn that did no work is
+    asked too: the turn after an omp `/clear` is exactly the one that has
+    forgotten the slice. Its own record only (`parent`), so a sibling
+    session's stopped slice never refuses this one. Off under `slices-off`,
+    and fail open: a broken journal costs the class, never the Stop. Refused
+    once per turn like every class (`_record_only`)."""
+    if not (session_id and cwd) or off("slices-off"):
+        return None
+    try:
+        pending = getattr(_journal(), "pending", None)
+        root = _toplevel(os.path.realpath(cwd))
+        for rec in (pending(root) if pending and root else []):
+            if rec.get("status") == "stopped" and rec.get("parent") == session_id:
+                return rec
+    except Exception:
+        return None
+    return None
+
+
 # The workspaces a probe or a benchmark runs in rather than a user: the temp
 # trees (/tmp, macOS's /var/folders), an OpenResearch run copy (`local-runs/`)
 # and the arm-bench instrument's run tree. tezgah's own cache is the fourth,
@@ -4961,8 +6244,8 @@ ORPHANED = (
     "Evidence tampered: a passing check in this turn has no `began` row from the "
     "gate before it (counted as an orphan), so it was written outside the hooks "
     "or the rows of its call were removed, and the ledger cannot carry a done or "
-    "tested claim this turn. Run the check again through the tool, or say what "
-    "is unverified (\"doğrulanmadı\"); the ledger is the user's to inspect.")
+    "tested claim this turn. Run the check again through the tool, or drop the "
+    "claim and say what is unverified; the ledger is the user's to inspect.")
 BEGAN_ROW = re.compile(r'"kind"\s*:\s*"%s"' % BEGAN_KIND)
 UNLOCKED_ROW = re.compile(r'"%s"\s*:\s*1\b' % UNLOCKED)
 # How many rows before a `turn_rows` slice seed `_pair`'s waiting `began` rows: