@robmclarty/volley 0.8.0 → 0.10.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { accessSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { accessSync, constants, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { cac } from "cac";
@@ -15,9 +15,9 @@ import { parseHTML } from "linkedom";
 import TurndownService from "turndown";
 import { Agent, buildConnector, interceptors, request } from "undici";
 import { z } from "zod";
-import { randomUUID } from "node:crypto";
-import { filesystem_logger, tee_logger } from "fascicle/adapters";
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import pc from "picocolors";
+import { filesystem_logger, tee_logger } from "fascicle/adapters";
 //#region src/builder/context_check.ts
 /** Below this, tool schemas start getting truncated for volley's tool set. */
 const MIN_RECOMMENDED_NUM_CTX = 16384;
@@ -73,6 +73,34 @@ async function warn_small_local_context(provider, model, base_url, warn, abort)
 	if (warning !== null) warn(warning);
 }
 //#endregion
+//#region src/builder/countdown.ts
+/** How many of a session's last steps carry the countdown: five, or a tenth
+* of a long budget, but never more than half of it, so a short session still
+* starts without one. */
+function countdown_window(max_steps) {
+	return Math.min(Math.max(5, Math.ceil(max_steps / 10)), Math.floor(max_steps / 2));
+}
+/** The note for a turn with `steps_left` steps left, this one included.
+* `check` names how to run the check. On the last step fascicle runs only a
+* call that ends the session, which for the builder is `finish`. */
+function countdown_note(steps_left, check) {
+	if (steps_left <= 1) return "[volley] This is the last step of this session, and only finish runs on it. Call finish now, with a summary that says what's done and what isn't verified.";
+	return `[volley] ${String(steps_left)} steps left in this session, this one included, and on the last one only finish runs. If you haven't run ${check} since your last edit, run it now, then fix what it reports or call finish.`;
+}
+/** The `prepare_step` hook that adds the countdown to a session of
+* `max_steps` steps. */
+function step_countdown(max_steps, check) {
+	const window = countdown_window(max_steps);
+	return ({ step_index, messages }) => {
+		const steps_left = max_steps - step_index;
+		if (steps_left > window) return void 0;
+		return { messages: [...messages, {
+			role: "user",
+			content: countdown_note(steps_left, check)
+		}] };
+	};
+}
+//#endregion
 //#region src/workspace_tools.ts
 /**
 * Shared workspace tools: `contain()` path confinement plus the read-only
@@ -103,7 +131,7 @@ const IGNORED_DIRS = /* @__PURE__ */ new Set([
 * escape. Returns the absolute path; throws on containment violation. The
 * `workspace` root passed here is the build root, which is the per-run git
 * worktree under `--worktree` (`build_root`), not necessarily the
-* control-plane workspace that holds `.volley/`. */
+* workspace the run was started on. */
 function contain(workspace, rel) {
 	const root = resolve(workspace);
 	const candidate = isAbsolute(rel) ? resolve(rel) : resolve(root, rel);
@@ -142,6 +170,25 @@ function walk(root, start, limit) {
 	}
 	return out;
 }
+/** The files a read tool's optional `path` covers: the whole tree, the tree
+* under a directory, or the one file it names. A path that doesn't exist
+* throws, so the seat reads why rather than an empty result that looks like
+* "nothing matched". */
+function scoped_files(workspace, path, limit) {
+	const root = resolve(workspace);
+	if (path === void 0) return walk(root, root, limit);
+	const start = contain(workspace, path);
+	let is_dir;
+	try {
+		is_dir = statSync(start).isDirectory();
+	} catch (err) {
+		throw new Error(`no such file or directory: ${path}`, { cause: err });
+	}
+	return is_dir ? walk(root, start, limit) : [{
+		rel: relative(root, start),
+		abs: start
+	}];
+}
 function build_regex(pattern, flags) {
 	try {
 		return new RegExp(pattern, flags);
@@ -153,17 +200,18 @@ function build_regex(pattern, flags) {
 const read_file_input = z.object({ path: z.string().describe("Workspace-relative path to the file to read.") });
 const search_files_input = z.object({
 	pattern: z.string().describe("JavaScript regular expression to match against each line."),
-	path: z.string().optional().describe("Optional workspace-relative subdirectory to limit the search to."),
+	path: z.string().optional().describe("Optional workspace-relative directory or file to limit the search to."),
 	ignore_case: z.boolean().optional().describe("Case-insensitive match. Default false.")
 });
 const list_files_input = z.object({
-	path: z.string().optional().describe("Optional workspace-relative subdirectory. Default: the workspace root."),
+	path: z.string().optional().describe("Optional workspace-relative directory or file. Default: the workspace root."),
 	contains: z.string().optional().describe("Optional substring filter applied to each relative path.")
 });
 function read_only_tools(workspace) {
 	return [
 		{
 			name: "read_file",
+			read_only: true,
 			description: `Read a UTF-8 text file from the workspace. Returns the file content (truncated at ${String(READ_FILE_MAX_BYTES)} bytes).`,
 			input_schema: read_file_input,
 			execute: (raw) => {
@@ -174,13 +222,13 @@ function read_only_tools(workspace) {
 		},
 		{
 			name: "search_files",
+			read_only: true,
 			description: `Search workspace files for lines matching a regular expression. Returns up to ${String(200)} "relative/path:line: text" hits.`,
 			input_schema: search_files_input,
 			execute: (raw) => {
 				const input = search_files_input.parse(raw);
-				const start = input.path !== void 0 ? contain(workspace, input.path) : resolve(workspace);
 				const regex = build_regex(input.pattern, input.ignore_case === true ? "i" : "");
-				const files = walk(resolve(workspace), start, LIST_MAX_ENTRIES);
+				const files = scoped_files(workspace, input.path, LIST_MAX_ENTRIES);
 				const hits = [];
 				for (const file of files) {
 					if (hits.length >= 200) break;
@@ -204,12 +252,12 @@ function read_only_tools(workspace) {
 		},
 		{
 			name: "list_files",
+			read_only: true,
 			description: "List files under a workspace directory (recursively; skips node_modules, .git, and other build/output directories).",
 			input_schema: list_files_input,
 			execute: (raw) => {
 				const input = list_files_input.parse(raw);
-				const start = input.path !== void 0 ? contain(workspace, input.path) : resolve(workspace);
-				let files = walk(resolve(workspace), start, LIST_MAX_ENTRIES).map((f) => f.rel);
+				let files = scoped_files(workspace, input.path, LIST_MAX_ENTRIES).map((f) => f.rel);
 				if (input.contains !== void 0) {
 					const needle = input.contains;
 					files = files.filter((f) => f.includes(needle));
@@ -625,6 +673,273 @@ function finish_tool() {
 	};
 }
 //#endregion
+//#region src/types.ts
+function config_error(message) {
+	return Object.assign(new Error(message), { kind: "config_error" });
+}
+function check_error(message) {
+	return Object.assign(new Error(message), { kind: "check_error" });
+}
+/** Wraps a provider/schema failure with the phase and iteration it hit. */
+function phase_error(phase, iteration, cause) {
+	const detail = cause instanceof Error ? cause.message : String(cause);
+	return Object.assign(/* @__PURE__ */ new Error(`${phase} failed on iteration ${iteration}: ${detail}`), {
+		kind: "phase_error",
+		phase,
+		iteration,
+		cause
+	});
+}
+function error_kind(err) {
+	if (typeof err === "object" && err !== null && "kind" in err) {
+		const kind = err.kind;
+		return typeof kind === "string" ? kind : null;
+	}
+	return null;
+}
+//#endregion
+//#region src/check/checkride.ts
+/**
+* checkride runner: spawn `pnpm exec checkride --json --digest`, gate on the
+* `.check/summary.json` contract (`schema_version: 1`), and collect raw
+* failing-slot artifacts for the critic — the critic reads what the tool
+* actually said, not a normalized digest. The digest checkride writes on a red
+* run is kept beside them for the next builder, which needs a short list of
+* what to fix more than the whole of every slot's output.
+*/
+const CHECK_ARTIFACT_MAX_CHARS = 8e3;
+const CHECKRIDE_SCHEMA_VERSION = 1;
+/** How long a check's output may stay open after its shell exits, while
+* something that escaped its process group still holds it, before the reads
+* stop so the check can finish. */
+const OUTPUT_GRACE_MS = 2e3;
+/** Kill a check's whole process group with SIGKILL. A test runner's workers,
+* and anything the check started in the background, sit in the shell's group,
+* so killing the shell alone would leave them running. Windows has no process
+* groups to signal, so there only the shell goes. */
+function kill_group(proc) {
+	if (proc.pid === void 0) return;
+	try {
+		if (process.platform === "win32") proc.kill("SIGKILL");
+		else process.kill(-proc.pid, "SIGKILL");
+	} catch {}
+}
+/** Run a check to its end in a process group of its own, capturing its
+* output. The abort kills the whole group and rejects with `aborted_error`,
+* and the shell's exit kills whatever it left behind, so a stopped run leaves
+* no test workers or servers running. */
+function spawn_capture(cmd, args, options) {
+	const { abort } = options;
+	if (abort?.aborted === true) return Promise.reject(new aborted_error("check aborted"));
+	return new Promise((resolve_promise, reject) => {
+		const proc = spawn(cmd, args, {
+			cwd: options.cwd,
+			...options.env !== void 0 ? { env: options.env } : {},
+			detached: process.platform !== "win32",
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let stdout = "";
+		let stderr = "";
+		let grace;
+		const on_abort = () => {
+			kill_group(proc);
+			reject(new aborted_error("check aborted"));
+		};
+		const finish = () => {
+			clearTimeout(grace);
+			abort?.removeEventListener("abort", on_abort);
+		};
+		proc.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		proc.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		proc.on("error", (err) => {
+			finish();
+			reject(check_error(`check command failed to start: ${err.message}`));
+		});
+		proc.on("exit", () => {
+			kill_group(proc);
+			grace = setTimeout(() => {
+				proc.stdout.destroy();
+				proc.stderr.destroy();
+			}, OUTPUT_GRACE_MS);
+		});
+		proc.on("close", (code) => {
+			finish();
+			resolve_promise({
+				exit_code: code,
+				stdout,
+				stderr
+			});
+		});
+		abort?.addEventListener("abort", on_abort, { once: true });
+	});
+}
+/** Best-effort parse of the summary contract. `pnpm exec` talks over the
+* command's stdout (pnpm 11's dep-verify prints an "Already up to date"
+* install line ahead of the JSON), so the object is extracted between the
+* first `{` and the last `}` rather than parsed from byte 0. An unexpected
+* schema_version warns and still parses; no JSON object at all is a harness
+* error (exit 4). */
+function parse_checkride_summary(stdout) {
+	const start = stdout.indexOf("{");
+	const end = stdout.lastIndexOf("}");
+	let raw;
+	try {
+		if (start === -1 || end < start) throw new Error("no JSON object in stdout");
+		raw = JSON.parse(stdout.slice(start, end + 1));
+	} catch {
+		throw check_error("checkride --json produced unparseable stdout");
+	}
+	if (typeof raw !== "object" || raw === null || !Array.isArray(raw.checks)) throw check_error("checkride summary missing checks array");
+	const summary = raw;
+	return {
+		summary,
+		warning: summary.schema_version === CHECKRIDE_SCHEMA_VERSION ? null : `checkride summary schema_version ${String(summary.schema_version)} != ${String(CHECKRIDE_SCHEMA_VERSION)}; parsing best-effort`
+	};
+}
+/** Parse the summary from stdout, falling back to the on-disk contract:
+* `.check/summary.json` is what checkride documents; stdout is its mirror and
+* wrappers may talk over it beyond what the tolerant slice can recover. */
+function parse_summary_with_fallback(stdout, workspace) {
+	try {
+		return parse_checkride_summary(stdout);
+	} catch (err) {
+		const file = join(workspace, ".check", "summary.json");
+		if (!existsSync(file)) throw err;
+		return parse_checkride_summary(readFileSync(file, "utf8"));
+	}
+}
+function failing_checks(summary) {
+	return summary.checks.filter((c) => !c.ok && c.skipped !== true);
+}
+/** Whether `path` sits under `dir`. */
+function within(dir, path) {
+	const from_dir = relative(dir, path);
+	return from_dir !== ".." && !from_dir.startsWith(`..${sep}`) && !isAbsolute(from_dir);
+}
+/** Per failing slot: the raw artifact (`<output_file>` when present, else
+* `<slot>.stdout.txt`) in `check_dir`, a workspace's `.check/` or an archived
+* iteration's copy of it, truncated with a pointer to the file. The names come
+* from a summary the builder could have written, so a path that leaves
+* `check_dir` has no artifact, rather than putting a file from elsewhere in
+* front of a model. */
+function read_failing_artifacts(check_dir, failing) {
+	return failing.map((check) => {
+		const file = check.output_file ?? `${check.name}.stdout.txt`;
+		const path = join(check_dir, file);
+		if (!within(check_dir, path) || !existsSync(path) || !statSync(path).isFile()) return {
+			slot: check.name,
+			path: null,
+			content: "(no artifact found)",
+			truncated: false
+		};
+		const raw = readFileSync(path, "utf8");
+		const truncated = raw.length > CHECK_ARTIFACT_MAX_CHARS;
+		return {
+			slot: check.name,
+			path,
+			content: truncated ? raw.slice(0, CHECK_ARTIFACT_MAX_CHARS) : raw,
+			truncated
+		};
+	});
+}
+/** checkride's digest of a red run (`.check/digest.md`, written under
+* `--digest` and removed on a green one), or undefined when there is none. It
+* is capped by checkride itself, at 8 kB. */
+function read_digest(workspace) {
+	const path = join(workspace, ".check", "digest.md");
+	return existsSync(path) ? readFileSync(path, "utf8") : void 0;
+}
+async function run_checkride(opts) {
+	const { workspace, ...spawn_options } = opts;
+	const proc = await spawn_capture("pnpm", [
+		"exec",
+		"checkride",
+		"--json",
+		"--digest"
+	], {
+		...spawn_options,
+		cwd: workspace
+	});
+	if (proc.exit_code === 2) throw check_error(`checkride harness error: ${proc.stderr.trim()}`);
+	const { summary } = parse_summary_with_fallback(proc.stdout, opts.workspace);
+	const failing = failing_checks(summary);
+	const digest = summary.ok ? void 0 : read_digest(opts.workspace);
+	return {
+		ran: true,
+		runner: "checkride",
+		ok: summary.ok,
+		exit_code: proc.exit_code,
+		duration_ms: summary.total_duration_ms,
+		failing_slots: failing.map((c) => c.name),
+		detail: read_failing_artifacts(join(opts.workspace, ".check"), failing),
+		summary,
+		...digest !== void 0 ? { digest } : {}
+	};
+}
+//#endregion
+//#region src/check/command.ts
+/**
+* Generic command runner: `sh -c <command>`, combined
+* output captured, exit-0 semantics. Command-not-found is an operator error
+* (exit 4), not an iterable failure.
+*/
+async function run_command_check(opts) {
+	const { command, workspace, ...spawn_options } = opts;
+	const started = Date.now();
+	const proc = await spawn_capture("sh", ["-c", command], {
+		...spawn_options,
+		cwd: workspace
+	});
+	if (proc.exit_code === 127 || proc.exit_code === 126) throw check_error(`check command failed to start (exit ${String(proc.exit_code)}): ${command}`);
+	const log = `${proc.stdout}${proc.stderr}`;
+	return {
+		ran: true,
+		runner: "command",
+		ok: proc.exit_code === 0,
+		exit_code: proc.exit_code,
+		duration_ms: Date.now() - started,
+		failing_slots: [],
+		detail: [],
+		log
+	};
+}
+function skipped_check(reason) {
+	return {
+		ran: false,
+		runner: "none",
+		ok: reason === "none",
+		exit_code: null,
+		duration_ms: 0,
+		failing_slots: [],
+		detail: []
+	};
+}
+/** What a rejected check says in place of its output. */
+const CHECK_REJECTED = "the check was rejected when it asked to run, so it never ran";
+/** A check the user rejected when it asked to run: recorded as a failed
+* check, with the refusal as its output, so a round can't converge on work
+* nothing checked, and the critic hears why there's no result. */
+function rejected_check(runner) {
+	return {
+		ran: true,
+		runner,
+		ok: false,
+		exit_code: null,
+		duration_ms: 0,
+		failing_slots: [],
+		detail: [],
+		log: CHECK_REJECTED
+	};
+}
+//#endregion
 //#region src/cost.ts
 /**
 * Cost and usage accumulation. All pricing knowledge lives in
@@ -664,6 +979,7 @@ function cost_source_of(result) {
 * its whole degradation ladder. */
 function phase_record(result, model, duration_ms = result.timing?.duration_ms ?? 0) {
 	const rate = throughput(result);
+	const truncated = result.steps.filter((step) => step.truncated === true).length;
 	return {
 		provider: result.model_resolved.provider,
 		model,
@@ -675,6 +991,7 @@ function phase_record(result, model, duration_ms = result.timing?.duration_ms ??
 		finish_reason: result.finish_reason,
 		tool_calls: result.tool_calls.length,
 		salvaged_tool_calls: result.tool_calls.filter((call) => call.salvaged === true).length,
+		...truncated > 0 ? { truncated_turns: truncated } : {},
 		...rate !== void 0 ? { throughput: rate } : {}
 	};
 }
@@ -698,31 +1015,6 @@ function cost_cap_hit(config, state) {
 	return config.max_cost_usd !== null && state.total_cost_usd >= config.max_cost_usd;
 }
 //#endregion
-//#region src/types.ts
-function config_error(message) {
-	return Object.assign(new Error(message), { kind: "config_error" });
-}
-function check_error(message) {
-	return Object.assign(new Error(message), { kind: "check_error" });
-}
-/** Wraps a provider/schema failure with the phase and iteration it hit. */
-function phase_error(phase, iteration, cause) {
-	const detail = cause instanceof Error ? cause.message : String(cause);
-	return Object.assign(/* @__PURE__ */ new Error(`${phase} failed on iteration ${iteration}: ${detail}`), {
-		kind: "phase_error",
-		phase,
-		iteration,
-		cause
-	});
-}
-function error_kind(err) {
-	if (typeof err === "object" && err !== null && "kind" in err) {
-		const kind = err.kind;
-		return typeof kind === "string" ? kind : null;
-	}
-	return null;
-}
-//#endregion
 //#region src/engine.ts
 /**
 * The ONLY module that calls fascicle's `create_engine`. Every
@@ -986,14 +1278,130 @@ async function prewarm_ollama_model(base_url, model, abort) {
 	} catch {}
 }
 //#endregion
+//#region src/containment.ts
+/**
+* Whether volley is running inside its sandbox container. A leaf, so the
+* config resolution, the preflight, and the run-config signing can all ask
+* without importing one another.
+*/
+/** volley *detects* it is running inside its sandbox container rather than
+* starting the container itself. The signal is the `VOLLEY_CONTAINED=1` marker
+* volley's own image bakes in (`Dockerfile` `ENV`), so a `docker run <hardened
+* flags> <image> volley run …` is recognized as contained out of the box. Kept
+* env-only — no ambient `/.dockerenv` probe — so the safety gate is deterministic
+* and testable, and so a CI job that itself runs in an unrelated container does
+* not silently satisfy the gate; a hand-rolled sandbox must set the marker (or
+* the operator uses `--allow-unsandboxed-builder`). */
+function detect_containment(env) {
+	const value = env["VOLLEY_CONTAINED"];
+	return value === "1" || value === "true";
+}
+//#endregion
+//#region src/trust.ts
+/**
+* Which run configs a host-side resume may trust. A resume runs what a run's
+* `config.json` says: its check, a shell command, and its seats, permission
+* mode and prompt included. Inside the sandbox the builder runs arbitrary
+* commands with write access to its own run's state, so a contained run's
+* config is the builder's to rewrite, and resuming it on the host would run
+* whatever the builder left there.
+*
+* So volley on the host signs each config it writes, an HMAC under a key of
+* this machine's that never enters the container, and a host-side resume
+* trusts only a config whose signature holds. Inside the sandbox nothing is
+* signed, since the key isn't there and one made there would be in the
+* builder's reach, so a contained run's config never carries a signature the
+* host accepts, and the builder can't forge one without the key.
+*/
+/** Prefixed to what is signed, so a signature over a run config can't pass for
+* one over anything else under the same key. */
+const DOMAIN = "volley run config v1\n";
+/** Where this machine's key lives: `$XDG_CONFIG_HOME/volley/run-key`, else
+* `~/.config/volley/run-key`, outside every state root, so a container a run
+* root is mounted into still can't read it. A relative `XDG_CONFIG_HOME` is
+* ignored, as the XDG spec says. */
+function trust_key_path(env, home = homedir()) {
+	const xdg = env["XDG_CONFIG_HOME"];
+	const base = xdg !== void 0 && isAbsolute(xdg) ? xdg : join(home, ".config");
+	return join(base, "volley", "run-key");
+}
+function error_code(err) {
+	return err.code;
+}
+/** The key as stored, or null when there is none or it isn't one. */
+function read_key(path) {
+	try {
+		const hex = readFileSync(path, "utf8").trim();
+		return /^[0-9a-f]{64}$/.test(hex) ? Buffer.from(hex, "hex") : null;
+	} catch {
+		return null;
+	}
+}
+/** The key, created on first use: 32 random bytes in a file only its user can
+* read, in a directory only its user can enter. Two runs that start together
+* race to create it; the loser reads the winner's. */
+function machine_key(env) {
+	const path = trust_key_path(env);
+	const existing = read_key(path);
+	if (existing !== null) return existing;
+	try {
+		mkdirSync(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(path, `${randomBytes(32).toString("hex")}\n`, {
+			flag: "wx",
+			mode: 384
+		});
+	} catch (err) {
+		if (error_code(err) !== "EEXIST") return null;
+	}
+	return read_key(path);
+}
+function hmac(key, config_text) {
+	return createHmac("sha256", key).update(DOMAIN).update(config_text).digest("hex");
+}
+/** This machine's signature over a run's `config.json` text, or null where
+* there's none to give: inside the sandbox, or when the key can't be read or
+* created. */
+function sign_config(config_text, env = process.env) {
+	if (detect_containment(env)) return null;
+	const key = machine_key(env);
+	return key === null ? null : hmac(key, config_text);
+}
+/** Does `signature` hold for `config_text` under this machine's key? Never
+* creates the key: with none there's nothing it could hold under. */
+function config_signed(config_text, signature, env = process.env) {
+	if (signature === null) return false;
+	const key = read_key(trust_key_path(env));
+	if (key === null) return false;
+	const expected = Buffer.from(hmac(key, config_text), "hex");
+	const given = Buffer.from(signature.trim(), "hex");
+	return given.length === expected.length && timingSafeEqual(given, expected);
+}
+//#endregion
 //#region src/workspace.ts
 /**
 * Workspace lifecycle: run-state initialization, stale-run
 * backup rotation, path helpers, and optional git checkpoints.
 */
+/** A run id names the run's `volley/<run id>` branch and its state directory,
+* so it is held to what both take without quoting: letters, digits, `-`, and
+* `_`, starting with a letter or digit, so it never reads as an option and
+* never climbs out of the directory it names. */
+const RUN_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** The root each run's state sits under when `--state-dir` names none:
+* `$XDG_STATE_HOME/volley`, else `<home>/.local/state/volley`. A relative
+* `XDG_STATE_HOME` is ignored, as the XDG spec says. `home` is the host's by
+* default; the sandbox passes its container's to spell the same root inside. */
+function default_state_root(env, home = homedir()) {
+	const xdg = env["XDG_STATE_HOME"];
+	const base = xdg !== void 0 && isAbsolute(xdg) ? xdg : join(home, ".local", "state");
+	return join(base, "volley");
+}
 /** Where a run keeps its config, summary, trajectory, feedback, verdict, and
-* iterations: `<state_dir>/<run_id>/` under a state root, else
-* `<workspace>/.volley/`. */
+* iterations: `<state_dir>/<run_id>/` under its state root, or, in the layout
+* older runs used (`state_dir` null), `<workspace>/.volley/`. */
 function run_state_dir(run) {
 	return run.state_dir === null ? join(run.workspace, ".volley") : join(run.state_dir, run.run_id);
 }
@@ -1003,6 +1411,17 @@ function state_path(run, ...parts) {
 function iteration_dir(run, iteration) {
 	return state_path(run, "iterations", String(iteration).padStart(3, "0"));
 }
+/** A state root that sits inside `root` (the build root), as the path from
+* there in git's `/`-separated vocabulary, or null when it sits outside. A
+* root inside the tree would otherwise pass for the builder's work: listed in
+* the changes the critic reads, and committed by every `--git` checkpoint.
+* The legacy `.volley/` (`state_dir` null) is excluded by name already. */
+function state_root_within(root, state_dir) {
+	if (state_dir === null) return null;
+	const path = relative(resolve(root), resolve(state_dir));
+	if (path === "" || path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) return null;
+	return path.split(sep).join("/");
+}
 /** Filesystem-safe timestamp for `.bak.<stamp>` rotation names. Shared by the
 * run-state rotation here and the worktree rotation so both preserve
 * prior state under the same never-destroy naming. */
@@ -1012,18 +1431,33 @@ function backup_stamp(date = /* @__PURE__ */ new Date()) {
 /** Fresh-run initialization: rotate a stale state directory aside (a prior
 * `.volley/` becomes `.volley.bak.<stamp>`), then create the directory tree.
 * Under a state root each run has a directory of its own, so only a reused
-* `--run-id` ever finds one to rotate. Resume runs skip rotation
-* (`preserve: true`). */
+* `--run-id` ever finds one to rotate. An empty one is used as it is: that is
+* what a contained run is handed when its run directory is the mount, which
+* can't be renamed. Resume runs skip rotation (`preserve: true`). */
 function initialize_run_state(run, options = {}) {
 	const dir = run_state_dir(run);
-	if (existsSync(dir) && options.preserve !== true) renameSync(dir, `${dir}.bak.${backup_stamp()}`);
+	if (existsSync(dir) && options.preserve !== true && readdirSync(dir).length > 0) renameSync(dir, `${dir}.bak.${backup_stamp()}`);
+	if (run.state_dir !== null && !existsSync(run.state_dir)) mkdirSync(run.state_dir, {
+		recursive: true,
+		mode: 448
+	});
 	mkdirSync(join(dir, "iterations"), { recursive: true });
 }
-function write_resolved_config(config) {
+/** Beside a run's `config.json`: this machine's signature over it
+* (`./trust.ts`), which a host-side resume checks before it trusts the
+* config. */
+const CONFIG_SIGNATURE = "config.sig";
+/** Record the run's config, signed when volley runs on the host. Returns
+* whether it was signed: inside the sandbox it never is, and on the host only
+* when the machine's key can't be read or created. A signature a reused run
+* directory held from before is removed rather than left to vouch for this
+* config. */
+function write_resolved_config(config, env = process.env) {
 	const record = {
 		version: config.version,
 		run_id: config.run_id,
 		started_at: config.started_at,
+		mode: config.mode,
 		prompt: config.prompt,
 		criteria: config.criteria,
 		check: config.check,
@@ -1032,6 +1466,8 @@ function write_resolved_config(config) {
 		builder_provider: config.builder_provider,
 		builder_url: config.builder_url,
 		builder_max_steps: config.builder_max_steps,
+		builder_max_tool_calls: config.builder_max_tool_calls,
+		builder_max_output_tokens: config.builder_max_output_tokens,
 		critic_model: config.critic_model,
 		critic_provider: config.critic_provider,
 		critic_url: config.critic_url,
@@ -1049,7 +1485,38 @@ function write_resolved_config(config) {
 		state_dir: config.state_dir,
 		workspace: config.workspace
 	};
-	writeFileSync(state_path(config, "config.json"), `${JSON.stringify(record, null, 2)}\n`);
+	const text = `${JSON.stringify(record, null, 2)}\n`;
+	writeFileSync(state_path(config, "config.json"), text);
+	const signature = sign_config(text, env);
+	if (signature === null) {
+		rmSync(state_path(config, CONFIG_SIGNATURE), { force: true });
+		return false;
+	}
+	writeFileSync(state_path(config, CONFIG_SIGNATURE), `${signature}\n`);
+	return true;
+}
+/** The identity volley's own commits fall back to. git won't commit without a
+* name and an email, and the sandbox image carries no git config, so inside
+* it a checkpoint or a worktree's salvage commit failed outright; a machine
+* never set up for git can be the same. `.invalid` is reserved, so the email
+* can't reach anyone. */
+const FALLBACK_IDENTITY = [["user.name", "volley"], ["user.email", "volley@volley.invalid"]];
+/** The `-c` flags that give a commit in `cwd` the fallback identity for each
+* part git has no value for. One the repo or the user configured wins, and so
+* does a `GIT_AUTHOR_*` or `GIT_COMMITTER_*` variable, which git ranks above
+* any config. Put them ahead of the subcommand. */
+function commit_identity(cwd) {
+	return FALLBACK_IDENTITY.flatMap(([key, value]) => {
+		const set = spawnSync("git", [
+			"config",
+			"--get",
+			key
+		], {
+			cwd,
+			encoding: "utf8"
+		});
+		return set.status === 0 && set.stdout.trim() !== "" ? [] : ["-c", `${key}=${value}`];
+	});
 }
 /**
 * `--git`: commit everything under `root` after a phase (`git -C <root>`, run
@@ -1057,13 +1524,26 @@ function write_resolved_config(config) {
 * workspace on the default path, or the per-run worktree under `--worktree`, so
 * checkpoints land on the worktree branch rather than the workspace's.
 * A checkpoint with nothing to commit is fine; a missing git binary or repo is
-* not.
+* not. `excluded_dir` (from `state_root_within`) keeps a state root inside the
+* tree out of the commit; `:/` keeps the rest of the staging repo-wide, as a
+* bare `git add -A` is, and `literal` reads the path as written, wildcards and
+* all.
 */
-function git_checkpoint(root, message) {
+function git_checkpoint(root, message, excluded_dir = null) {
 	if (!existsSync(join(root, ".git"))) throw config_error(`git checkpoints require a git repository: ${root}`);
-	const add = spawnSync("git", ["add", "-A"], { cwd: root });
+	const pathspec = excluded_dir === null ? [] : [
+		"--",
+		":/",
+		`:(exclude,literal)${excluded_dir}`
+	];
+	const add = spawnSync("git", [
+		"add",
+		"-A",
+		...pathspec
+	], { cwd: root });
 	if (add.error !== void 0 || add.status !== 0) throw check_error(`git add failed: ${add.stderr?.toString() ?? String(add.error)}`);
 	const commit = spawnSync("git", [
+		...commit_identity(root),
 		"commit",
 		"-m",
 		message,
@@ -1071,7 +1551,7 @@ function git_checkpoint(root, message) {
 	], { cwd: root });
 	if (commit.error !== void 0) throw check_error(`git commit failed to start: ${String(commit.error)}`);
 	const out = `${commit.stdout?.toString() ?? ""}${commit.stderr?.toString() ?? ""}`;
-	if (commit.status !== 0 && !out.includes("nothing to commit")) throw check_error(`git commit failed: ${out.trim()}`);
+	if (commit.status !== 0 && !/nothing (?:added )?to commit/.test(out)) throw check_error(`git commit failed: ${out.trim()}`);
 }
 /**
 * Integration — bring a successful `--worktree --git` run's effects onto the
@@ -1097,6 +1577,7 @@ function integrate_worktree(workspace, branch, message) {
 	if (squash.error !== void 0) throw check_error(`git merge --squash failed to start: ${String(squash.error)}`);
 	if (squash.status !== 0) throw check_error(`git merge --squash ${branch} failed: ${(squash.stderr || squash.stdout).trim()}`);
 	const commit = spawnSync("git", [
+		...commit_identity(workspace),
 		"commit",
 		"-m",
 		message,
@@ -1142,9 +1623,8 @@ function worktree_branch(run_id) {
 * when `--worktree` is on, else the workspace itself. This is the containment
 * root the builder/critic file tools resolve through `contain()` and the
 * `bash` tool's cwd — re-pointing it moves writes into the worktree without
-* disturbing the workspace. `.volley/` state, the resolved config, and the
-* deterministic check stay under the workspace (the control plane), so only the
-* model-driven effect surface moves.
+* disturbing the workspace. The check, the change report, and the checkpoints
+* follow it there; the run's state stays wherever `state_dir` puts it.
 */
 function build_root(workspace, worktree) {
 	return worktree ? worktree_path(workspace) : workspace;
@@ -1362,6 +1842,7 @@ function salvage_worktree(repo, path, branch) {
 	if (existsSync(path)) {
 		git_quiet(path, ["add", "-A"]);
 		git_quiet(path, [
+			...commit_identity(path),
 			"commit",
 			"-m",
 			`volley: salvage unintegrated worktree (${branch})`,
@@ -1485,12 +1966,22 @@ const HARNESS_APPENDS = {
 	volley: "harness_append_local.md",
 	acp: "harness_append_acp.md"
 };
-function compose_builder_system_local(tool_set = "volley") {
-	return `${[
+/** Step 2 of "Work this way", as both harness appends word it for a builder
+* held to one tool call a turn. */
+const ONE_CALL_A_TURN = "2. Call one tool at a time and read its result before deciding the next\n   call.";
+/** Step 2 for a builder that may make several calls a turn: fascicle runs a
+* turn's calls in order, so a read can't race an edit, but each change or
+* command is still worth reading before the next. Reads don't count toward
+* the cap, so the step names no number. */
+const BATCHED_CALLS = ["2. Batch independent reads into one turn, but make one change or command per", "   turn, and read its result before deciding the next call."].join("\n");
+function compose_builder_system_local(tool_set = "volley", max_tool_calls = 1) {
+	const identity = [
 		"You are the builder inside the volley harness: an autonomous agent",
 		"iterating on a workspace until it satisfies a task and its acceptance",
 		"criteria."
-	].join("\n")}\n\n${readFileSync(join(builder_presets_dir(), HARNESS_APPENDS[tool_set]), "utf8").trimEnd()}`;
+	].join("\n");
+	const append = readFileSync(join(builder_presets_dir(), HARNESS_APPENDS[tool_set]), "utf8");
+	return `${identity}\n\n${(max_tool_calls > 1 ? append.replace(ONE_CALL_A_TURN, BATCHED_CALLS) : append).trimEnd()}`;
 }
 /** The builder system prompt for the active provider: the `claude_cli`
 * prompt (implicit built-in tools, "the current working directory") for the
@@ -1498,18 +1989,28 @@ function compose_builder_system_local(tool_set = "volley") {
 * the seat's tool set for every provider that runs volley's tool loop,
 * `openrouter` included. Mirrors the critic's `resolve_critic_prompt`. */
 function resolve_builder_system(config, tool_set) {
-	return config.builder_provider === "claude_cli" ? compose_builder_system() : compose_builder_system_local(tool_set);
+	return config.builder_provider === "claude_cli" ? compose_builder_system() : compose_builder_system_local(tool_set, config.builder_max_tool_calls);
 }
 const BUILDER_TOOL_CALL_REPAIR_ATTEMPTS = 3;
+/** How the step countdown tells the builder to run the check: the command
+* volley gates on, with the digest and without `--json`, the configured
+* command, or the project's own tests when no check gates the run. A
+* workspace can hold checkride with no `check` script, so not `pnpm check`. */
+function check_hint(config) {
+	if (config.check_resolved === "checkride") return "the check (`pnpm exec checkride --digest`)";
+	if (config.check_resolved === "command") return `the check (\`${config.check}\`)`;
+	return "the project's tests";
+}
 /** Per-provider tool wiring for the builder, mirroring `critic_tool_options`.
 * The `claude_cli` builder is confined at the CLI permission layer (allowlist +
 * permission mode) and brings its own built-in tools — this arm is unchanged
 * from v2, and takes no injected tools or approval handler. Every other
 * builder, local or `openrouter`, brings none, so volley supplies its whole
 * workspace tool surface (or the set the caller injected in its place, with
-* the handler that answers its approvals) plus the five per-call loop knobs
-* and **no** schema (it produces a workspace, not a verdict); per-call values
-* win over engine defaults. */
+* the handler that answers its approvals), the per-call loop knobs, the step
+* countdown (`./builder/countdown.ts`), the output cap when one is set, and
+* **no** schema (it produces a workspace, not a verdict); per-call values win
+* over engine defaults. */
 function builder_tool_options(deps) {
 	const { config } = deps;
 	const bash_executor = deps.bash_executor ?? null;
@@ -1523,9 +2024,75 @@ function builder_tool_options(deps) {
 		max_steps: config.builder_max_steps,
 		tool_error_policy: "feed_back",
 		tool_call_repair_attempts: BUILDER_TOOL_CALL_REPAIR_ATTEMPTS,
-		max_tool_calls_per_step: 1
+		max_tool_calls_per_step: config.builder_max_tool_calls,
+		prepare_step: step_countdown(config.builder_max_steps, check_hint(config)),
+		...config.builder_max_output_tokens !== null ? {
+			max_tokens: config.builder_max_output_tokens,
+			truncated_turn_policy: "continue"
+		} : {}
 	};
 }
+/** How much of the last check's output the builder's prompt carries: a few KB,
+* whatever the runner. checkride's digest already fits in 8 kB, and the builder
+* can run the check again for the rest. */
+const PREVIOUS_CHECK_MAX_CHARS = 6e3;
+/** The first `max` characters of `text`, saying where it was cut. */
+function head(text, max, rest) {
+	return text.length <= max ? text : `${text.slice(0, max)}\n… (cut at ${String(max)} characters; ${rest})`;
+}
+/** The last `max` characters of `text`, saying what came before was cut. */
+function tail(text, max) {
+	return text.length <= max ? text : `… (the last ${String(max)} characters of ${String(text.length)})\n${text.slice(-max)}`;
+}
+/** The part of a failed check the builder reads first: checkride's digest,
+* else the start of each failing slot's raw output, else the end of a
+* command's output, where test runners and compilers sum up. */
+function check_excerpt(check) {
+	const max = PREVIOUS_CHECK_MAX_CHARS;
+	if (check.digest !== void 0) return head(check.digest.trimEnd(), max, ".check/digest.md has the rest");
+	if (check.detail.length > 0) return head(check.detail.map((artifact) => {
+		const source = artifact.path === null ? "" : ` (.check/${basename(artifact.path)})`;
+		return `${artifact.slot}${source}:\n${artifact.content.trimEnd()}`;
+	}).join("\n\n"), max, "each slot's raw output under .check/ has the rest");
+	return tail((check.log ?? "").trimEnd(), max);
+}
+/** The check section of a later iteration's prompt: what the deterministic
+* gate itself said about the last session's work, so the builder starts from
+* its words rather than the critic's account of them, or re-running it to
+* find out. Empty unless that check ran and failed. A check the user rejected
+* when it asked to run is recorded as failed but said nothing, and the
+* section says so rather than call the work failed. */
+function previous_check_section(check) {
+	if (check === null || !check.ran || check.ok) return [];
+	const heading = [
+		"",
+		"PREVIOUS CHECK RESULT",
+		"---------------------"
+	];
+	if (check.log === "the check was rejected when it asked to run, so it never ran") return [
+		...heading,
+		"The check never ran on the work your last session left: it was rejected when it",
+		"asked to run, so nothing has verified that work yet."
+	];
+	const runner = check.runner === "checkride" ? "checkride, " : "";
+	const exit = check.exit_code === null ? "no exit code" : `exit ${String(check.exit_code)}`;
+	const lines = [...heading, `The check failed on the work your last session left (${runner}${exit}).`];
+	if (check.failing_slots.length > 0) lines.push(`Failing slots: ${check.failing_slots.join(", ")}.`);
+	const excerpt = check_excerpt(check);
+	if (excerpt.length > 0) lines.push("", excerpt);
+	return lines;
+}
+/** The line a later iteration's prompt carries when the last session ran out
+* of steps: it never got to verify, so this one should check first. */
+function step_limit_lines(step_limit_hit) {
+	if (step_limit_hit === null) return [];
+	return [
+		"",
+		`Your last session hit its ${String(step_limit_hit)}-step limit before it called finish, so`,
+		"it may never have verified its work. Run the check first this time, and keep",
+		"enough steps in hand to verify again before you finish."
+	];
+}
 function compose_builder_prompt(input) {
 	const parts = [
 		"TASK",
@@ -1539,7 +2106,8 @@ function compose_builder_prompt(input) {
 		`ITERATION: ${input.iteration}`
 	];
 	if (input.iteration > 1 && input.feedback !== null) parts.push("", "PREVIOUS CRITIC FEEDBACK", "------------------------", input.feedback, "", "Address the feedback above. The workspace already contains your prior work;", "read the current state, then make the necessary changes.");
-	if (input.checkride) parts.push("", "The definition of done for this workspace includes `pnpm check` (checkride)", "exiting 0. Run it yourself before finishing; on failure, read", ".check/summary.json, then the failing slot's raw output, fix, and re-run.");
+	if (input.iteration > 1 && input.previous !== null) parts.push(...previous_check_section(input.previous.check), ...step_limit_lines(input.previous.step_limit_hit));
+	if (input.checkride) parts.push("", "The definition of done for this workspace includes checkride exiting 0. Run", "`pnpm exec checkride --digest`, the check volley gates on, after each batch of", "edits and again before you finish. When it fails, read .check/digest.md", "first: it lists each failing slot's first findings. Open a slot's raw", "output under .check/ only if the digest isn't enough, then fix and re-run.");
 	return parts.join("\n");
 }
 function builder_max_steps_warning(max_steps) {
@@ -1561,7 +2129,9 @@ function make_builder_step(deps) {
 		...builder_tool_options(deps)
 	});
 }
-async function run_builder(deps, state, ctx) {
+/** Run one builder session on the opened iteration `state`, told what the
+* iteration before it left behind (`previous`, null on the first). */
+async function run_builder(deps, state, previous, ctx) {
 	const { config } = deps;
 	try {
 		if (config.builder_provider === "ollama") {
@@ -1574,10 +2144,16 @@ async function run_builder(deps, state, ctx) {
 			criteria: config.criteria,
 			feedback: state.feedback,
 			iteration: state.iteration,
-			checkride: config.check_resolved === "checkride"
+			checkride: config.check_resolved === "checkride",
+			previous
 		}));
-		if (result.finish_reason === "max_steps") deps.warn(builder_max_steps_warning(config.builder_max_steps));
-		return accumulate(state, "builder", result, config.builder_model);
+		const built = accumulate(state, "builder", result, config.builder_model);
+		if (result.finish_reason !== "max_steps") return built;
+		deps.warn(builder_max_steps_warning(config.builder_max_steps));
+		return {
+			...built,
+			builder_max_steps_hits: built.builder_max_steps_hits + 1
+		};
 	} catch (err) {
 		throw phase_error("builder", state.iteration, err);
 	}
@@ -1687,6 +2263,29 @@ function capture_baseline(root) {
 	const sha = head.stdout.trim();
 	return sha.length > 0 ? sha : null;
 }
+/**
+* The commit a critique's change is measured from: `rev` (`--baseline`)
+* resolved in `root`, so the change is everything that differs from it,
+* committed or not, untracked files included. With no revision named it's
+* HEAD, so the uncommitted and untracked edits are the change, and, as for a
+* run, null where there's no repository or no commit yet. A named revision
+* that isn't a commit there, or one named where there's no repository, is a
+* config error.
+*/
+function resolve_baseline(root, rev) {
+	if (rev === void 0) return capture_baseline(root);
+	if (!in_git_repo(root)) throw config_error(`--baseline needs the workspace to be a git repository: ${root}`);
+	const resolved = git(root, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"--end-of-options",
+		`${rev}^{commit}`
+	]);
+	const sha = resolved.stdout.trim();
+	if (resolved.status !== 0 || sha.length === 0) throw config_error(`--baseline names no commit in ${root}: ${rev}`);
+	return sha;
+}
 /** git's status letters, folded onto the four cases worth naming. Rename and
 * copy both record the destination path — where the content lives now. */
 function change_status(code) {
@@ -1723,7 +2322,8 @@ function parse_name_status(stdout) {
 function parse_paths(stdout) {
 	return stdout.split("\0").filter((path) => path.length > 0);
 }
-function excluded(path) {
+function excluded(path, excluded_dir) {
+	if (excluded_dir !== null && path.startsWith(`${excluded_dir}/`)) return true;
 	return EXCLUDED_PREFIXES.some((prefix) => path.startsWith(prefix));
 }
 /**
@@ -1803,244 +2403,24 @@ function collect_changes(options) {
 		path,
 		status: "added"
 	}));
+	const excluded_dir = options.excluded_dir ?? null;
 	const seen = /* @__PURE__ */ new Set();
 	const files = [];
-	for (const change of [...tracked, ...untracked]) {
-		if (excluded(change.path) || seen.has(change.path)) continue;
-		seen.add(change.path);
-		files.push({
-			...change,
-			gate: matches_any(change.path, options.gate_patterns)
-		});
-	}
-	const sorted = files.toSorted(by_path);
-	return {
-		baseline,
-		gate_edits: sorted.filter((file) => file.gate).map((file) => file.path),
-		total: sorted.length,
-		files: sorted.slice(0, limit),
-		truncated: sorted.length > limit
-	};
-}
-//#endregion
-//#region src/check/checkride.ts
-/**
-* checkride runner: spawn `pnpm exec checkride --json`, gate on the
-* `.check/summary.json` contract (`schema_version: 1`), and collect raw
-* failing-slot artifacts for the critic — the critic reads what the tool
-* actually said, not a normalized digest.
-*/
-const CHECK_ARTIFACT_MAX_CHARS = 8e3;
-const CHECKRIDE_SCHEMA_VERSION = 1;
-/** How long a check's output may stay open after its shell exits, while
-* something that escaped its process group still holds it, before the reads
-* stop so the check can finish. */
-const OUTPUT_GRACE_MS = 2e3;
-/** Kill a check's whole process group with SIGKILL. A test runner's workers,
-* and anything the check started in the background, sit in the shell's group,
-* so killing the shell alone would leave them running. Windows has no process
-* groups to signal, so there only the shell goes. */
-function kill_group(proc) {
-	if (proc.pid === void 0) return;
-	try {
-		if (process.platform === "win32") proc.kill("SIGKILL");
-		else process.kill(-proc.pid, "SIGKILL");
-	} catch {}
-}
-/** Run a check to its end in a process group of its own, capturing its
-* output. The abort kills the whole group and rejects with `aborted_error`,
-* and the shell's exit kills whatever it left behind, so a stopped run leaves
-* no test workers or servers running. */
-function spawn_capture(cmd, args, options) {
-	const { abort } = options;
-	if (abort?.aborted === true) return Promise.reject(new aborted_error("check aborted"));
-	return new Promise((resolve_promise, reject) => {
-		const proc = spawn(cmd, args, {
-			cwd: options.cwd,
-			...options.env !== void 0 ? { env: options.env } : {},
-			detached: process.platform !== "win32",
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		});
-		let stdout = "";
-		let stderr = "";
-		let grace;
-		const on_abort = () => {
-			kill_group(proc);
-			reject(new aborted_error("check aborted"));
-		};
-		const finish = () => {
-			clearTimeout(grace);
-			abort?.removeEventListener("abort", on_abort);
-		};
-		proc.stdout.on("data", (chunk) => {
-			stdout += chunk.toString();
-		});
-		proc.stderr.on("data", (chunk) => {
-			stderr += chunk.toString();
-		});
-		proc.on("error", (err) => {
-			finish();
-			reject(check_error(`check command failed to start: ${err.message}`));
-		});
-		proc.on("exit", () => {
-			kill_group(proc);
-			grace = setTimeout(() => {
-				proc.stdout.destroy();
-				proc.stderr.destroy();
-			}, OUTPUT_GRACE_MS);
-		});
-		proc.on("close", (code) => {
-			finish();
-			resolve_promise({
-				exit_code: code,
-				stdout,
-				stderr
-			});
-		});
-		abort?.addEventListener("abort", on_abort, { once: true });
-	});
-}
-/** Best-effort parse of the summary contract. `pnpm exec` talks over the
-* command's stdout (pnpm 11's dep-verify prints an "Already up to date"
-* install line ahead of the JSON), so the object is extracted between the
-* first `{` and the last `}` rather than parsed from byte 0. An unexpected
-* schema_version warns and still parses; no JSON object at all is a harness
-* error (exit 4). */
-function parse_checkride_summary(stdout) {
-	const start = stdout.indexOf("{");
-	const end = stdout.lastIndexOf("}");
-	let raw;
-	try {
-		if (start === -1 || end < start) throw new Error("no JSON object in stdout");
-		raw = JSON.parse(stdout.slice(start, end + 1));
-	} catch {
-		throw check_error("checkride --json produced unparseable stdout");
-	}
-	if (typeof raw !== "object" || raw === null || !Array.isArray(raw.checks)) throw check_error("checkride summary missing checks array");
-	const summary = raw;
-	return {
-		summary,
-		warning: summary.schema_version === CHECKRIDE_SCHEMA_VERSION ? null : `checkride summary schema_version ${String(summary.schema_version)} != ${String(CHECKRIDE_SCHEMA_VERSION)}; parsing best-effort`
-	};
-}
-/** Parse the summary from stdout, falling back to the on-disk contract:
-* `.check/summary.json` is what checkride documents; stdout is its mirror and
-* wrappers may talk over it beyond what the tolerant slice can recover. */
-function parse_summary_with_fallback(stdout, workspace) {
-	try {
-		return parse_checkride_summary(stdout);
-	} catch (err) {
-		const file = join(workspace, ".check", "summary.json");
-		if (!existsSync(file)) throw err;
-		return parse_checkride_summary(readFileSync(file, "utf8"));
-	}
-}
-function failing_checks(summary) {
-	return summary.checks.filter((c) => !c.ok && c.skipped !== true);
-}
-/** Per failing slot: the raw artifact (`.check/<output_file>` when present,
-* else `.check/<slot>.stdout.txt`), truncated with a pointer to the file. */
-function read_failing_artifacts(workspace, failing) {
-	return failing.map((check) => {
-		const file = check.output_file ?? `${check.name}.stdout.txt`;
-		const path = join(workspace, ".check", file);
-		if (!existsSync(path)) return {
-			slot: check.name,
-			path: null,
-			content: "(no artifact found)",
-			truncated: false
-		};
-		const raw = readFileSync(path, "utf8");
-		const truncated = raw.length > CHECK_ARTIFACT_MAX_CHARS;
-		return {
-			slot: check.name,
-			path,
-			content: truncated ? raw.slice(0, CHECK_ARTIFACT_MAX_CHARS) : raw,
-			truncated
-		};
-	});
-}
-async function run_checkride(opts) {
-	const { workspace, ...spawn_options } = opts;
-	const proc = await spawn_capture("pnpm", [
-		"exec",
-		"checkride",
-		"--json"
-	], {
-		...spawn_options,
-		cwd: workspace
-	});
-	if (proc.exit_code === 2) throw check_error(`checkride harness error: ${proc.stderr.trim()}`);
-	const { summary } = parse_summary_with_fallback(proc.stdout, opts.workspace);
-	const failing = failing_checks(summary);
-	return {
-		ran: true,
-		runner: "checkride",
-		ok: summary.ok,
-		exit_code: proc.exit_code,
-		duration_ms: summary.total_duration_ms,
-		failing_slots: failing.map((c) => c.name),
-		detail: read_failing_artifacts(opts.workspace, failing),
-		summary
-	};
-}
-//#endregion
-//#region src/check/command.ts
-/**
-* Generic command runner: `sh -c <command>`, combined
-* output captured, exit-0 semantics. Command-not-found is an operator error
-* (exit 4), not an iterable failure.
-*/
-async function run_command_check(opts) {
-	const { command, workspace, ...spawn_options } = opts;
-	const started = Date.now();
-	const proc = await spawn_capture("sh", ["-c", command], {
-		...spawn_options,
-		cwd: workspace
-	});
-	if (proc.exit_code === 127 || proc.exit_code === 126) throw check_error(`check command failed to start (exit ${String(proc.exit_code)}): ${command}`);
-	const log = `${proc.stdout}${proc.stderr}`;
-	return {
-		ran: true,
-		runner: "command",
-		ok: proc.exit_code === 0,
-		exit_code: proc.exit_code,
-		duration_ms: Date.now() - started,
-		failing_slots: [],
-		detail: [],
-		log
-	};
-}
-function skipped_check(reason) {
-	return {
-		ran: false,
-		runner: "none",
-		ok: reason === "none",
-		exit_code: null,
-		duration_ms: 0,
-		failing_slots: [],
-		detail: []
-	};
-}
-/** What a rejected check says in place of its output. */
-const CHECK_REJECTED = "the check was rejected when it asked to run, so it never ran";
-/** A check the user rejected when it asked to run: recorded as a failed
-* check, with the refusal as its output, so a round can't converge on work
-* nothing checked, and the critic hears why there's no result. */
-function rejected_check(runner) {
+	for (const change of [...tracked, ...untracked]) {
+		if (excluded(change.path, excluded_dir) || seen.has(change.path)) continue;
+		seen.add(change.path);
+		files.push({
+			...change,
+			gate: matches_any(change.path, options.gate_patterns)
+		});
+	}
+	const sorted = files.toSorted(by_path);
 	return {
-		ran: true,
-		runner,
-		ok: false,
-		exit_code: null,
-		duration_ms: 0,
-		failing_slots: [],
-		detail: [],
-		log: CHECK_REJECTED
+		baseline,
+		gate_edits: sorted.filter((file) => file.gate).map((file) => file.path),
+		total: sorted.length,
+		files: sorted.slice(0, limit),
+		truncated: sorted.length > limit
 	};
 }
 //#endregion
@@ -2169,7 +2549,7 @@ function compose_critic_prompt(input) {
 * Critic invocation: a read-only session (`claude_cli`, or a local or
 * `openrouter` model with volley's read tools) returning a schema-validated
 * structured verdict. The
-* harness — not the critic — writes `.volley/feedback.md` and `.volley/verdict`.
+* harness — not the critic — writes the run's `feedback.md` and `verdict`.
 */
 const CRITIC_ALLOWED_TOOLS = [
 	"Read",
@@ -2177,10 +2557,16 @@ const CRITIC_ALLOWED_TOOLS = [
 	"Glob"
 ];
 const CRITIC_DISALLOWED_TOOLS = "Write,Edit,MultiEdit,NotebookEdit,Bash";
+/** A critic that holds tools isn't constrain-decoded, so nothing stops it
+* answering null for the feedback or the unmet list, as GLM did on approving.
+* Both fields allow null and read it as empty, so that answer is a verdict
+* rather than a schema failure that ends the run. fascicle sends the schema's
+* input side, so the model sees each field as its type or null, still
+* required; `.describe()` comes last so the description stays on the field. */
 const verdict_schema = z.object({
 	verdict: z.enum(["approved", "changes_requested"]),
-	feedback: z.string().describe("Free-form markdown for the builder. Concrete and actionable. Will be passed verbatim into the next iteration."),
-	unmet_criteria: z.array(z.string()).describe("The specific acceptance criteria judged unmet, verbatim. Empty when approved.")
+	feedback: z.string().nullable().transform((feedback) => feedback ?? "").describe("Free-form markdown for the builder. Concrete and actionable. Will be passed verbatim into the next iteration."),
+	unmet_criteria: z.array(z.string()).nullable().transform((unmet) => unmet ?? []).describe("The specific acceptance criteria judged unmet, verbatim. Empty when approved.")
 });
 /** Read-only tool wiring per provider. The claude_cli critic is confined at
 * the CLI permission layer (allowlist + explicit disallow); every other critic,
@@ -2483,6 +2869,62 @@ async function run_critic(deps, state, ctx) {
 	}
 }
 //#endregion
+//#region src/render/format.ts
+/**
+* Display formatting: glyph taxonomy, role colors, truncation.
+* All human output goes to stderr; these helpers only build strings.
+*/
+const GLYPH_TOOL = "🔧";
+const GLYPH_COST = "💰";
+const VERBOSE_TRUNCATE_CHARS = 4e3;
+function colors_enabled(env = process.env, is_tty = process.stderr.isTTY === true) {
+	if (env["NO_COLOR"] !== void 0 || env["VOLLEY_NO_COLOR"] !== void 0) return false;
+	return is_tty;
+}
+function paint(role, text, color) {
+	if (!color) return text;
+	switch (role) {
+		case "builder": return pc.cyan(text);
+		case "critic": return pc.yellow(text);
+		case "check": return pc.green(text);
+		case "cost": return pc.magenta(text);
+		case "error": return pc.bold(pc.red(text));
+	}
+}
+function dim(text, color) {
+	return color ? pc.dim(text) : text;
+}
+function truncate(text, max, pointer) {
+	if (text.length <= max) return text;
+	return `${text.slice(0, max)}\n… [truncated at ${String(max)} chars; ${pointer}]`;
+}
+/** Controls, format characters (bidi overrides, zero-widths), and line and
+* paragraph separators: what can move the cursor, hide text, or reorder a line
+* in a terminal. */
+const UNSAFE_CHARACTERS = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+/** A value from a file volley can't vouch for, quoted for a person to judge,
+* with every character that could redraw or reorder the line escaped, so a
+* rewritten config can't make the warning about it say something else. JSON
+* quoting escapes the C0 controls, the quote, and the backslash; the rest are
+* written as `\u{…}`. */
+function shown(value) {
+	return JSON.stringify(value).replace(UNSAFE_CHARACTERS, (character) => `\\u{${(character.codePointAt(0) ?? 0).toString(16)}}`);
+}
+function format_usd(value) {
+	return value === null ? "$?" : `$${value.toFixed(3)}`;
+}
+/** One-line summary of a tool input for the default streaming mode. */
+function summarize_value(value, max = 120) {
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value) ?? "";
+	} catch {
+		text = String(value);
+	}
+	const flat = text.replace(/\s+/g, " ");
+	return flat.length > max ? `${flat.slice(0, max)}…` : flat;
+}
+//#endregion
 //#region src/iteration.ts
 /**
 * Iteration archiving, run-level summary, and resume-state recovery.
@@ -2510,6 +2952,7 @@ function phase_summary(record) {
 		tool_calls: record.tool_calls,
 		salvaged_tool_calls: record.salvaged_tool_calls,
 		salvage_rate: record.tool_calls === 0 ? 0 : record.salvaged_tool_calls / record.tool_calls,
+		...record.truncated_turns !== void 0 ? { truncated_turns: record.truncated_turns } : {},
 		...record.retries !== void 0 ? { retries: record.retries } : {},
 		...record.retry_cause_kind !== void 0 ? { retry_cause_kind: record.retry_cause_kind } : {},
 		...record.critic_degraded === true ? { critic_degraded: true } : {},
@@ -2532,6 +2975,8 @@ function archive_iteration(config, state) {
 		if (check.runner === "checkride") {
 			if (check.summary !== void 0) write_json(join(dir, "check", "summary.json"), check.summary);
 			for (const artifact of check.detail) if (artifact.path !== null && existsSync(artifact.path)) writeFileSync(join(dir, "check", basename(artifact.path)), readFileSync(artifact.path));
+			if (check.digest !== void 0) writeFileSync(join(dir, "check", "digest.md"), check.digest);
+			if (check.log !== void 0) writeFileSync(join(dir, "check", "check.log"), check.log);
 		} else {
 			writeFileSync(join(dir, "check", "check.log"), check.log ?? "");
 			writeFileSync(join(dir, "check", "check.exit"), `${String(check.exit_code)}\n`);
@@ -2572,24 +3017,177 @@ function run_result_from_state(config, state, status, completed_at) {
 		builder_cost_usd: state.builder_cost_usd,
 		critic_cost_usd: state.critic_cost_usd,
 		check_duration_ms: state.check_duration_ms,
+		builder_max_steps_hits: state.builder_max_steps_hits,
 		final_verdict: state.verdict,
-		salvaged_branch: null
+		salvaged_branch: null,
+		run_state_dir: run_state_dir(config),
+		mode: config.mode
+	};
+}
+/** Why a host-side resume won't run a config this machine didn't sign. */
+function untrusted_config(run_id, config_path) {
+	return config_error(`run ${run_id}'s config.json has no signature from volley on this machine, so a resume here won't run it: inside the sandbox a run's builder can rewrite its config, and a resume runs the check and the seats it names. Resume a contained run inside its container, with the same mount. If ${config_path} is another machine's, an older volley's, or one you edited, read it, then pass --trust-config.`);
+}
+/** Whether a host-side resume may run the config in `text`: signed by this
+* machine, or trusted by the caller. Inside the sandbox nothing is checked: a
+* resume there runs only within the container, as the builder already does. */
+function check_config_trust(text, run, options) {
+	const env = options.env ?? process.env;
+	if (detect_containment(env)) return null;
+	const signature_path = state_path(run, CONFIG_SIGNATURE);
+	const signed = config_signed(text, existsSync(signature_path) ? readFileSync(signature_path, "utf8") : null, env);
+	if (!signed && options.trust_config !== true) throw untrusted_config(run.run_id, state_path(run, "config.json"));
+	return signed;
+}
+/** The run id an older volley's `.volley/config.json` records, or null when
+* there is none to read. */
+function legacy_run_id(workspace) {
+	try {
+		const recorded = JSON.parse(readFileSync(join(workspace, ".volley", "config.json"), "utf8"));
+		return typeof recorded.run_id === "string" ? recorded.run_id : null;
+	} catch {
+		return null;
+	}
+}
+/** Where `volley resume <run_id>` finds a run: under `root` (`--state-dir`,
+* else the default root) at `<root>/<run_id>/`, returned as that root, or, for
+* a run an older volley kept in the workspace, `.volley/`, returned as null so
+* the resumed run stays there. Finding neither is a config error naming both
+* places it looked. The id becomes a path, so it must be one a run could have
+* had. */
+function find_run_state(workspace, run_id, root) {
+	if (!RUN_ID_PATTERN.test(run_id)) throw config_error(`not a run id: ${run_id} (letters, digits, '-', and '_', starting with a letter or digit)`);
+	if (existsSync(join(root, run_id, "config.json"))) return root;
+	const legacy = legacy_run_id(workspace);
+	if (legacy === run_id) return null;
+	const holds = legacy === null ? "" : ` (it holds run ${shown(legacy)})`;
+	throw config_error(`run ${run_id} not found in ${join(root, run_id)} or in ${join(resolve(workspace), ".volley")}${holds}; pass --state-dir for the root it ran under, or --workspace for a run kept in .volley/`);
+}
+/** A resumed run writes into its state directory, and a contained run's
+* builder could have written there first, so a symlink anywhere in it would
+* aim the resume's writes, or its pruning of a half-finished iteration, at a
+* file of the host's. volley never makes one, so any is refused. The walk
+* reads each entry's own type and never descends a link, which Node's
+* recursive `readdirSync` would. */
+function refuse_symlinks(dir) {
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		const path = join(dir, entry.name);
+		if (entry.isSymbolicLink()) throw config_error(`refusing to resume: ${path} is a symbolic link, which volley never writes`);
+		if (entry.isDirectory()) refuse_symlinks(path);
+	}
+}
+/** An archived file's text, or undefined when there's no file to read there. */
+function read_text(path) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return;
+	}
+}
+function read_json(path) {
+	const text = read_text(path);
+	if (text === void 0) return null;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+/** The failing slots' raw artifacts from an archived iteration's `check/`,
+* which holds each under its base name, found through the archived checkride
+* summary. */
+function archived_artifacts(check_dir, failing_slots) {
+	const summary = read_json(join(check_dir, "summary.json"));
+	const checks = Array.isArray(summary?.checks) ? summary.checks : [];
+	return read_failing_artifacts(check_dir, failing_slots.map((name) => {
+		const output_file = checks.find((check) => check.name === name)?.output_file;
+		return {
+			name,
+			adapter: null,
+			ok: false,
+			exit_code: null,
+			duration_ms: 0,
+			output_file: typeof output_file === "string" ? basename(output_file) : null
+		};
+	}));
+}
+/** The check an archived iteration ran, rebuilt from its directory with the
+* output its failure is shown by: the digest and the failing slots' artifacts
+* for checkride, the log for a command or a rejected check. Null when it ran
+* none. */
+function archived_check(dir, recorded) {
+	if (recorded?.ran !== true || typeof recorded.ok !== "boolean") return null;
+	const runner = recorded.runner === "checkride" ? "checkride" : "command";
+	const failing_slots = Array.isArray(recorded.failing_slots) ? recorded.failing_slots.filter((slot) => typeof slot === "string") : [];
+	const check = {
+		ran: true,
+		runner,
+		ok: recorded.ok,
+		exit_code: typeof recorded.exit_code === "number" ? recorded.exit_code : null,
+		duration_ms: typeof recorded.duration_ms === "number" ? recorded.duration_ms : 0,
+		failing_slots,
+		detail: []
+	};
+	if (check.ok) return check;
+	const check_dir = join(dir, "check");
+	const log = read_text(join(check_dir, "check.log"));
+	const logged = log === void 0 ? check : {
+		...check,
+		log
+	};
+	if (runner === "command") return logged;
+	const digest = read_text(join(check_dir, "digest.md"));
+	return {
+		...logged,
+		detail: archived_artifacts(check_dir, failing_slots),
+		...digest !== void 0 ? { digest } : {}
+	};
+}
+/** An archived builder record, as `archive_iteration` wrote it from the
+* phase's own, or null when there is none with a finish reason. */
+function archived_builder(recorded) {
+	if (typeof recorded !== "object" || recorded === null) return null;
+	return typeof recorded.finish_reason === "string" ? recorded : null;
+}
+/** What the last completed iteration left for the next build: its check and
+* its builder's record, which tell the resumed run's first builder what the
+* gate said and whether the last session ran out of steps, as a run that never
+* stopped would have. Null for both before the first iteration. */
+function archived_round(run, completed) {
+	if (completed === 0) return {
+		check: null,
+		builder: null
+	};
+	const dir = iteration_dir(run, completed);
+	const recorded = read_json(join(dir, "summary.json"));
+	return {
+		check: archived_check(dir, recorded?.check),
+		builder: archived_builder(recorded?.builder)
 	};
 }
 /** Recover a resumable run from its state directory (`.volley/`, or
 * `<state_dir>/<run_id>/` under a state root): settings from config.json,
 * totals from summary.json, feedback from feedback.md. An iteration directory
-* without a summary.json was interrupted mid-phase and is discarded. */
-function load_resume_state(workspace, run_id, state_dir = null) {
+* without a summary.json was interrupted mid-phase and is discarded. A
+* directory with a symlink in it is refused before anything is read. */
+function load_resume_state(workspace, run_id, state_dir = null, options = {}) {
 	const run = {
 		workspace,
 		state_dir,
 		run_id
 	};
+	const run_dir = run_state_dir(run);
+	if (existsSync(run_dir)) {
+		if (lstatSync(run_dir).isSymbolicLink()) throw config_error(`refusing to resume: ${run_dir} is a symbolic link, which volley never writes`);
+		refuse_symlinks(run_dir);
+	}
 	const config_path = state_path(run, "config.json");
 	if (!existsSync(config_path)) throw config_error(`no resumable run found: ${config_path} missing`);
-	const recorded = JSON.parse(readFileSync(config_path, "utf8"));
+	const config_text = readFileSync(config_path, "utf8");
+	const signed = check_config_trust(config_text, run, options);
+	const recorded = JSON.parse(config_text);
 	if (recorded["run_id"] !== run_id) throw config_error(`run ${run_id} not found in ${run_state_dir(run)} (recorded run: ${String(recorded["run_id"])})`);
+	if (recorded["mode"] === "critique") throw config_error(`run ${run_id} is a critique, which has one round and nothing to resume; run volley critique again`);
 	const iterations_root = state_path(run, "iterations");
 	const dirs = existsSync(iterations_root) ? readdirSync(iterations_root).filter((d) => /^\d{3}$/.test(d)).toSorted() : [];
 	let completed = 0;
@@ -2614,6 +3212,8 @@ function load_resume_state(workspace, run_id, state_dir = null) {
 		builder_provider: recorded["builder_provider"] ?? "claude_cli",
 		...typeof recorded["builder_url"] === "string" ? { builder_url: recorded["builder_url"] } : {},
 		...recorded["builder_max_steps"] === void 0 ? {} : { builder_max_steps: Number(recorded["builder_max_steps"]) },
+		...recorded["builder_max_tool_calls"] === void 0 ? {} : { builder_max_tool_calls: Number(recorded["builder_max_tool_calls"]) },
+		...typeof recorded["builder_max_output_tokens"] === "number" ? { builder_max_output_tokens: recorded["builder_max_output_tokens"] } : {},
 		critic_model: String(recorded["critic_model"]),
 		critic_provider: recorded["critic_provider"] ?? "claude_cli",
 		...typeof recorded["critic_url"] === "string" ? { critic_url: recorded["critic_url"] } : {},
@@ -2635,15 +3235,15 @@ function load_resume_state(workspace, run_id, state_dir = null) {
 		feedback,
 		verdict: null,
 		unmet_criteria: [],
-		check: null,
+		...archived_round(run, completed),
 		changes: null,
-		builder: null,
 		critic: null,
 		total_usage: summary?.total_usage ?? EMPTY_USAGE,
 		total_cost_usd: summary?.total_cost_usd ?? 0,
 		builder_cost_usd: summary?.builder_cost_usd ?? 0,
 		critic_cost_usd: summary?.critic_cost_usd ?? 0,
 		check_duration_ms: summary?.check_duration_ms ?? 0,
+		builder_max_steps_hits: summary?.builder_max_steps_hits ?? 0,
 		iteration_cost_usd: 0,
 		halt: null,
 		cost_warned: false
@@ -2653,7 +3253,8 @@ function load_resume_state(workspace, run_id, state_dir = null) {
 		run_id,
 		started_at: String(recorded["started_at"]),
 		state,
-		iterations_completed: completed
+		iterations_completed: completed,
+		config_signed: signed
 	};
 }
 //#endregion
@@ -2753,7 +3354,7 @@ function build_run_summary(config, result) {
 	return {
 		...result,
 		comparison: {
-			builder_transport: transport_of(config.builder_provider),
+			builder_transport: config.mode === "critique" ? null : transport_of(config.builder_provider),
 			critic_transport: transport_of(config.critic_provider),
 			iterations_to_converge: result.status === "success" ? result.iterations_completed : null,
 			wall_clock_ms,
@@ -2809,7 +3410,7 @@ function record_check_chunk(ctx, chunk) {
 }
 /** The command line the check runs, or null when no check is configured. */
 function check_command(config) {
-	if (config.check_resolved === "checkride") return "pnpm exec checkride --json";
+	if (config.check_resolved === "checkride") return "pnpm exec checkride --json --digest";
 	if (config.check_resolved === "command") return config.check;
 	return null;
 }
@@ -2828,7 +3429,16 @@ function report_changes(config, renderer, changes) {
 	if (changes.gate_edits.length === 0) return;
 	const hidden = changes.gate_edits.length - LISTED_GATE_EDITS;
 	const listed = changes.gate_edits.slice(0, LISTED_GATE_EDITS).join(", ");
-	renderer.warn(`gate edit: the builder changed ${String(changes.gate_edits.length)} file(s) that decide whether its work passes — ${listed}${hidden > 0 ? ` (+${String(hidden)} more)` : ""}. A green check proves less when the builder can edit the gate; the critic is told about this and the run summary records it.` + (config.fail_on_gate_edit ? " This run will end without success (--fail-on-gate-edit, exit 8)." : ""));
+	const [who, whose, edits] = config.mode === "critique" ? [
+		"the change under review touches",
+		"whether it passes",
+		"the change edits"
+	] : [
+		"the builder changed",
+		"whether its work passes",
+		"the builder can edit"
+	];
+	renderer.warn(`gate edit: ${who} ${String(changes.gate_edits.length)} file(s) that decide ${whose} — ${listed}${hidden > 0 ? ` (+${String(hidden)} more)` : ""}. A green check proves less when ${edits} the gate; the critic is told about this and the run summary records it.` + (config.fail_on_gate_edit ? " This run will end without success (--fail-on-gate-edit, exit 8)." : ""));
 }
 /** Run the configured check, checkride or a command, with the environment
 * the caller set for it, else volley's own. */
@@ -2882,6 +3492,33 @@ function next_iteration(s) {
 		unmet_criteria: []
 	};
 }
+/** What the builder of the iteration after `s` hears about it beyond the
+* critic's feedback: its check, and whether its builder ran out of steps. Null
+* before the first iteration. A resumed run's state carries both, read back
+* from the last archived iteration. */
+function previous_round(config, s) {
+	if (s.iteration === 0) return null;
+	return {
+		check: s.check,
+		step_limit_hit: s.builder?.finish_reason === "max_steps" ? config.builder_max_steps : null
+	};
+}
+/** What changed in the build root since the baseline, reported as it's
+* measured: the count, and a warning for any gate edit. A run measures the
+* builder's work this way after every build, and a critique measures the
+* change under review the same way, so the critic is shown one shape either
+* way. */
+function measure_changes(deps, root) {
+	const { config, renderer } = deps;
+	const changes = collect_changes({
+		root,
+		baseline: deps.baseline,
+		gate_patterns: config.gate_paths,
+		excluded_dir: state_root_within(root, config.state_dir)
+	});
+	report_changes(config, renderer, changes);
+	return changes;
+}
 /** `build`: one builder session edits the build root, then volley measures what
 * it changed and, under `--git`, checkpoints it. */
 async function build_phase(deps, builder, s, ctx) {
@@ -2896,22 +3533,32 @@ async function build_phase(deps, builder, s, ctx) {
 		builder,
 		config,
 		warn: renderer.warn
-	}, next, ctx);
+	}, next, previous_round(config, s), ctx);
 	renderer.phase_end(built.iteration, "builder", true);
 	renderer.cost_line(built.iteration, "builder", built.builder?.cost_usd ?? null, built.total_cost_usd);
 	if (built.cost_warned && !s.cost_warned) renderer.warn("cost unavailable for this phase; recording null (run totals sum what is known)");
-	const changes = collect_changes({
-		root: build_root(config.workspace, config.worktree),
-		baseline: deps.baseline,
-		gate_patterns: config.gate_paths
-	});
-	report_changes(config, renderer, changes);
-	if (config.git_checkpoints) git_checkpoint(build_root(config.workspace, config.worktree), `volley iter ${String(built.iteration)}: build`);
+	const root = build_root(config.workspace, config.worktree);
+	const changes = measure_changes(deps, root);
+	if (config.git_checkpoints) git_checkpoint(root, `volley iter ${String(built.iteration)}: build`, state_root_within(root, config.state_dir));
 	return {
 		...built,
 		changes
 	};
 }
+/** `measure`: a critique's one round opens, and the change under review is
+* measured from the baseline, as a run measures the builder's work. */
+function measure_phase(deps, s, ctx) {
+	const next = next_iteration(s);
+	emit(ctx, {
+		volley: "round_start",
+		round: next.iteration
+	});
+	const root = build_root(deps.config.workspace, deps.config.worktree);
+	return {
+		...next,
+		changes: measure_changes(deps, root)
+	};
+}
 /** `skip_verify`: the build alone crossed the cost cap, so the check is recorded
 * as skipped and no critic is called — a doomed iteration spends nothing more.
 * The loop guard then halts the run on the cap. */
@@ -3025,7 +3672,10 @@ function record_phase(deps, s) {
 	const { config } = deps;
 	archive_iteration(config, s);
 	write_run_summary(config, run_result_from_state(config, s, "running", null));
-	if (config.git_checkpoints) git_checkpoint(build_root(config.workspace, config.worktree), `volley iter ${String(s.iteration)}: critique (${s.verdict ?? "skipped"})`);
+	if (config.git_checkpoints) {
+		const root = build_root(config.workspace, config.worktree);
+		git_checkpoint(root, `volley iter ${String(s.iteration)}: critique (${s.verdict ?? "skipped"})`, state_root_within(root, config.state_dir));
+	}
 	return s;
 }
 //#endregion
@@ -3406,6 +4056,7 @@ function resolve_check_runner(check, workspace) {
 	return /(^|\s)checkride(\s|$)/.test(check.trim()) ? "checkride" : "command";
 }
 const DEFAULT_CRITIC_MODEL = "opus";
+const DEFAULT_BUILDER_MAX_OUTPUT_TOKENS = 16384;
 const DEFAULT_CHECK = "auto";
 const DEFAULT_CRITIC = "reviewer";
 const DEFAULT_BUILDER_PROVIDER = "claude_cli";
@@ -3488,17 +4139,66 @@ function resolve_critic(critic, cwd) {
 		critic_prompt_path: path
 	};
 }
-/** `--builder-max-steps` (a merged flag/config value) wins over the
-* `VOLLEY_BUILDER_MAX_STEPS` env var, which wins over the default. Local
-* builder only; ignored by the `claude_cli` arm. */
-function resolve_builder_max_steps(raw, env) {
-	if (raw.builder_max_steps !== void 0) return validate_builder_max_steps(raw.builder_max_steps, raw.builder_max_steps);
-	const env_value = env["VOLLEY_BUILDER_MAX_STEPS"];
-	if (env_value !== void 0 && env_value !== "") return validate_builder_max_steps(Number(env_value), env_value);
-	return 50;
-}
-function validate_builder_max_steps(value, original) {
-	if (!Number.isInteger(value) || value < 1) throw config_error(`--builder-max-steps / VOLLEY_BUILDER_MAX_STEPS must be a positive integer; got: ${String(original)}`);
+/** What only a builder, or the loop around it, uses, with the flag that sets
+* each: a critique has no use for any of them, so naming one is an error
+* rather than something quietly ignored. */
+const CRITIQUE_REFUSED = [
+	["builder_model", "--builder-model"],
+	["builder_provider", "--builder-provider"],
+	["builder_url", "--builder-url"],
+	["builder_max_steps", "--builder-max-steps"],
+	["builder_max_tool_calls", "--builder-max-tool-calls"],
+	["builder_max_output_tokens", "--builder-max-output-tokens"],
+	["builder_permission_mode", "--builder-permission-mode"],
+	["allow_unsandboxed_builder", "--allow-unsandboxed-builder"],
+	["sandbox_image", "--sandbox-image"],
+	["max_iterations", "--max-iterations"],
+	["max_cost_usd", "--max-cost-usd"],
+	["git_checkpoints", "--git"],
+	["worktree", "--worktree"],
+	["discard_worktree", "--discard-worktree"],
+	["fail_on_gate_edit", "--fail-on-gate-edit"]
+];
+function refuse_builder_settings(raw) {
+	for (const [field, flag] of CRITIQUE_REFUSED) if (raw[field] !== void 0 && raw[field] !== false) throw config_error(`volley critique refuses ${flag} (${field}): a critique runs no builder and no loop`);
+}
+const BUILDER_MAX_STEPS = {
+	flag: "--builder-max-steps",
+	env_var: "VOLLEY_BUILDER_MAX_STEPS",
+	fallback: 50
+};
+const BUILDER_MAX_TOOL_CALLS = {
+	flag: "--builder-max-tool-calls",
+	env_var: "VOLLEY_BUILDER_MAX_TOOL_CALLS",
+	fallback: 1
+};
+/** The builders whose turns are capped when nothing sets a cap: the local
+* ones, where nothing else bounds a turn. Ollama's MLX runner lets an unset
+* `num_predict` run to the model's trained context less the prompt, which is
+* how one qwen3.8 turn spent 30,847 tokens thinking. A hosted model on
+* OpenRouter has its own output limit, and a request for more than it allows
+* can be refused, so it's capped only when asked. */
+const CAPPED_BY_DEFAULT = ["ollama", "lmstudio"];
+/** The output cap's flag and env var, and its default for `provider`: 16k
+* tokens on a local builder, else the provider's own limit (null). */
+function builder_max_output_tokens_count(provider) {
+	return {
+		flag: "--builder-max-output-tokens",
+		env_var: "VOLLEY_BUILDER_MAX_OUTPUT_TOKENS",
+		fallback: CAPPED_BY_DEFAULT.includes(provider) ? DEFAULT_BUILDER_MAX_OUTPUT_TOKENS : null
+	};
+}
+/** A builder count's flag or config value wins over its env var, which wins
+* over the default, and either must be a positive integer. Local builder
+* only; ignored by the `claude_cli` arm. */
+function resolve_builder_count(value, env, count) {
+	if (value !== void 0) return positive_count(value, value, count);
+	const env_value = env[count.env_var];
+	if (env_value !== void 0 && env_value !== "") return positive_count(Number(env_value), env_value, count);
+	return count.fallback;
+}
+function positive_count(value, original, count) {
+	if (!Number.isInteger(value) || value < 1) throw config_error(`${count.flag} / ${count.env_var} must be a positive integer; got: ${String(original)}`);
 	return value;
 }
 /** `--sandbox-image` (a merged flag/config value) wins over the
@@ -3548,25 +4248,36 @@ function resolve_seat_url(seat, value, provider) {
 }
 /** `--state-dir` (`state_dir`): the root each run's state sits under at
 * `<root>/<run_id>/`, resolved against `cwd` so a resumed run finds the same
-* place, or null to keep `<workspace>/.volley/`. An empty value counts as unset,
-* as it does for a seat URL. */
-function resolve_state_dir(value, cwd) {
-	if (value === void 0 || value === null) return null;
+* place. Unset, or empty as a seat URL may be, it's the default root,
+* `$XDG_STATE_HOME/volley`, else `~/.local/state/volley`: outside the
+* workspace, where no check that reads every file can trip over the run's own
+* feedback. */
+function resolve_state_dir(value, cwd, env) {
+	if (value === void 0 || value === null) return default_state_root(env);
 	if (typeof value !== "string") throw config_error(`--state-dir (state_dir) must be a path string; got a ${typeof value}`);
 	const path = value.trim();
-	return path === "" ? null : resolve(cwd, path);
+	return path === "" ? default_state_root(env) : resolve(cwd, path);
 }
-/** volley *detects* it is running inside its sandbox container rather than
-* starting the container itself. The signal is the `VOLLEY_CONTAINED=1` marker
-* volley's own image bakes in (`Dockerfile` `ENV`), so a `docker run <hardened
-* flags> <image> volley run …` is recognized as contained out of the box. Kept
-* env-only — no ambient `/.dockerenv` probe — so the safety gate is deterministic
-* and testable, and so a CI job that itself runs in an unrelated container does
-* not silently satisfy the gate; a hand-rolled sandbox must set the marker (or
-* the operator uses `--allow-unsandboxed-builder`). */
-function detect_containment(env) {
-	const value = env["VOLLEY_CONTAINED"];
-	return value === "1" || value === "true";
+function is_writable_dir(path) {
+	try {
+		if (!statSync(path).isDirectory()) return false;
+		accessSync(path, constants.W_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** The run's state directory must be one volley can write: the directory
+* itself when it's there, as a contained run's mount is, else the nearest
+* directory above it, where volley creates it. Checked before any spend,
+* because otherwise the run dies as it starts on a raw EROFS or EACCES. Inside
+* the sandbox the root filesystem is read-only, so that is what an unmounted
+* run directory looks like, and the message says what to mount. */
+function validate_run_state_dir(dir, contained) {
+	let existing = dir;
+	while (!existsSync(existing) && dirname(existing) !== existing) existing = dirname(existing);
+	if (is_writable_dir(existing)) return;
+	throw config_error(contained ? `run state directory not writable: ${dir}. Inside the sandbox, mount the run's own host directory there (sandbox_run_args run_state, or -v <root>/<run id>:${dir}), created on the host first, and pass volley the same --run-id; or point --state-dir at a writable mount` : `run state directory not writable: ${dir}. Point --state-dir at a directory volley can write`);
 }
 /** Whether a tool-loop builder's commands would reach the host with nothing in
 * between: volley isn't contained, and the operator hasn't opted out with
@@ -3574,10 +4285,7 @@ function detect_containment(env) {
 function unguarded_builder(raw, env) {
 	return !detect_containment(env) && !resolve_allow_unsandboxed_builder(raw, env);
 }
-/** A caller's run id names the run's `volley/<run id>` branch, so it is held to
-* what a branch name accepts without quoting: letters, digits, `-`, and `_`,
-* starting with a letter or digit so it never reads as an option. */
-const RUN_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** A caller's run id, held to `RUN_ID_PATTERN`; none gets a fresh UUID. */
 function resolve_run_id(run_id) {
 	if (run_id === void 0) return randomUUID();
 	if (!RUN_ID_PATTERN.test(run_id)) throw config_error(`--run-id must be letters, digits, '-', and '_', starting with a letter or digit; got: ${run_id}`);
@@ -3589,13 +4297,17 @@ function resolve_run_id(run_id) {
 function resolve_config(raw, options = {}) {
 	const cwd = options.cwd ?? process.cwd();
 	const env = options.env ?? process.env;
-	if (typeof raw.prompt !== "string" || raw.prompt.length === 0) throw config_error("missing required option: --prompt");
+	const critique = options.mode === "critique";
+	if (critique) refuse_builder_settings(raw);
+	const builder_env = critique ? {} : env;
+	const has_prompt = typeof raw.prompt === "string" && raw.prompt.length > 0;
+	if (!has_prompt && !critique) throw config_error("missing required option: --prompt");
 	if (typeof raw.workspace !== "string" || raw.workspace.length === 0) throw config_error("missing required option: --workspace");
 	if (typeof raw.criteria !== "string" || raw.criteria.length === 0) throw config_error("missing required option: --criteria");
 	const workspace = validate_workspace(resolve(cwd, raw.workspace));
-	const prompt = expand_at_file(raw.prompt, cwd);
+	const prompt = has_prompt ? expand_at_file(raw.prompt, cwd) : "";
 	const criteria = expand_at_file(raw.criteria, cwd);
-	const max_iterations = raw.max_iterations ?? 10;
+	const max_iterations = raw.max_iterations ?? (critique ? 1 : 10);
 	if (!Number.isInteger(max_iterations) || max_iterations < 1) throw config_error(`--max-iterations must be a positive integer; got: ${String(raw.max_iterations)}`);
 	const max_cost_usd = raw.max_cost_usd ?? null;
 	if (max_cost_usd !== null && !(typeof max_cost_usd === "number" && max_cost_usd > 0)) throw config_error(`--max-cost-usd must be a positive number; got: ${String(raw.max_cost_usd)}`);
@@ -3604,17 +4316,19 @@ function resolve_config(raw, options = {}) {
 	const { critic_preset, critic_prompt_path } = resolve_critic(raw.critic ?? DEFAULT_CRITIC, cwd);
 	const builder_provider = raw.builder_provider ?? DEFAULT_BUILDER_PROVIDER;
 	if (!BUILDER_PROVIDERS.includes(builder_provider)) throw config_error(`--builder-provider must be one of ${BUILDER_PROVIDERS.join(", ")}; got: ${String(raw.builder_provider)}`);
-	const allow_unsandboxed_builder = resolve_allow_unsandboxed_builder(raw, env);
+	const allow_unsandboxed_builder = resolve_allow_unsandboxed_builder(raw, builder_env);
 	const contained = detect_containment(env);
-	if (TOOL_LOOP_BUILDER_PROVIDERS.includes(builder_provider) && options.uncontained_builder !== "ask" && unguarded_builder(raw, env)) throw config_error(`builder-provider '${builder_provider}' runs volley's tool loop with a real bash (write + exec) — refused unless contained. Launch volley inside its sandbox container (docker run <hardened flags> <image> volley run …, which sets VOLLEY_CONTAINED=1), or pass --allow-unsandboxed-builder (VOLLEY_ALLOW_UNSANDBOXED_BUILDER=1) to run uncontained on the host.`);
-	const builder_max_steps = resolve_builder_max_steps(raw, env);
+	if (TOOL_LOOP_BUILDER_PROVIDERS.includes(builder_provider) && options.uncontained_builder !== "ask" && unguarded_builder(raw, builder_env)) throw config_error(`builder-provider '${builder_provider}' runs volley's tool loop with a real bash (write + exec) — refused unless contained. Launch volley inside its sandbox container (docker run <hardened flags> <image> volley run …, which sets VOLLEY_CONTAINED=1), or pass --allow-unsandboxed-builder (VOLLEY_ALLOW_UNSANDBOXED_BUILDER=1) to run uncontained on the host.`);
+	const builder_max_steps = resolve_builder_count(raw.builder_max_steps, builder_env, BUILDER_MAX_STEPS);
+	const builder_max_tool_calls = resolve_builder_count(raw.builder_max_tool_calls, builder_env, BUILDER_MAX_TOOL_CALLS);
+	const builder_max_output_tokens = resolve_builder_count(raw.builder_max_output_tokens, builder_env, builder_max_output_tokens_count(builder_provider));
 	const critic_provider = raw.critic_provider ?? DEFAULT_CRITIC_PROVIDER;
 	if (!CRITIC_PROVIDERS.includes(critic_provider)) throw config_error(`--critic-provider must be one of ${CRITIC_PROVIDERS.join(", ")}; got: ${String(raw.critic_provider)}`);
 	const builder_url = resolve_seat_url("builder", raw.builder_url, builder_provider);
 	const critic_url = resolve_seat_url("critic", raw.critic_url, critic_provider);
 	if (builder_provider === "openrouter" || critic_provider === "openrouter") openrouter_api_key(env);
 	if (contained) {
-		const claude_roles = [builder_provider === "claude_cli" ? "builder" : null, critic_provider === "claude_cli" ? "critic" : null].filter((role) => role !== null);
+		const claude_roles = [builder_provider === "claude_cli" && !critique ? "builder" : null, critic_provider === "claude_cli" ? "critic" : null].filter((role) => role !== null);
 		const auth_mode = env["VOLLEY_AUTH_MODE"] ?? "auto";
 		if (claude_roles.length > 0 && auth_mode !== "api_key") throw config_error(`claude_cli (${claude_roles.join(", ")}) cannot use its subscription/OAuth token inside a container — it is mangled there. Set VOLLEY_AUTH_MODE=api_key (with ANTHROPIC_API_KEY) to drive Claude contained, or run claude_cli on the host uncontained.`);
 	}
@@ -3625,14 +4339,17 @@ function resolve_config(raw, options = {}) {
 	if (discard_worktree && !worktree) throw config_error("--discard-worktree applies only to a --worktree run: there is no worktree to discard");
 	const gate_paths = raw.gate_paths ?? DEFAULT_GATE_PATTERNS;
 	if (!Array.isArray(gate_paths) || gate_paths.some((glob) => typeof glob !== "string")) throw config_error("gate_paths must be an array of glob strings");
-	const sandbox_image = resolve_sandbox_image(raw, env);
-	const state_dir = resolve_state_dir(raw.state_dir, cwd);
+	const sandbox_image = resolve_sandbox_image(raw, builder_env);
+	const state_dir = options.state_dir !== void 0 ? options.state_dir : resolve_state_dir(raw.state_dir, cwd, env);
+	if (state_dir === workspace) throw config_error(`--state-dir (state_dir) can't be the workspace itself: ${workspace}`);
 	const run_id = resolve_run_id(options.run_id);
+	if (state_dir !== null) validate_run_state_dir(join(state_dir, run_id), contained);
 	const check = raw.check ?? "auto";
 	return {
 		version: 2,
 		run_id,
 		started_at: options.started_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		mode: critique ? "critique" : "run",
 		prompt,
 		criteria,
 		check,
@@ -3641,6 +4358,8 @@ function resolve_config(raw, options = {}) {
 		builder_provider,
 		builder_url,
 		builder_max_steps,
+		builder_max_tool_calls,
+		builder_max_output_tokens,
 		allow_unsandboxed_builder,
 		critic_model: raw.critic_model ?? DEFAULT_CRITIC_MODEL,
 		critic_provider,
@@ -3688,6 +4407,7 @@ function initial_state() {
 		builder_cost_usd: 0,
 		critic_cost_usd: 0,
 		check_duration_ms: 0,
+		builder_max_steps_hits: 0,
 		iteration_cost_usd: 0,
 		halt: null,
 		cost_warned: false
@@ -3739,6 +4459,11 @@ function status_of(value, converged) {
 * around the flow (workspace setup, the worktree lifecycle, `run`, the final
 * summary) in `./orchestrator.ts`.
 *
+* A critique (`build_critique_flow`) is one round over a change already made,
+* so it has no builder, no loop, and no guard: `measure`, which opens the
+* round and measures the change from its baseline, then the same `check`,
+* `critique`, and `record` a run's round ends with.
+*
 * fascicle's `describe.diagram` draws the tree below from the flow itself, and
 * `test/unit/flow_diagram.test.ts` holds it to the code: change a row by changing
 * its step's `description`, then paste `pnpm diagram --prefix ' *   '` over it.
@@ -3782,6 +4507,24 @@ function build_critic(deps) {
 		project: with_fallback_cause
 	});
 }
+/** The steps a run and a critique share, built one way for both. */
+function check_step(deps) {
+	return step("check", (s, ctx) => check_phase(deps, s, ctx), { description: "the deterministic gate: checkride, a command, or none" });
+}
+function critique_step(deps, seat) {
+	const critic = build_critic({
+		...seat,
+		config: deps.config,
+		on_chunk: deps.renderer.critic_chunk
+	});
+	return step("critique", (s, ctx) => critique_phase(deps, critic, s, ctx), {
+		description: "the read-only critic's verdict and feedback",
+		arm: critic
+	});
+}
+function record_step(deps) {
+	return step("record", (s) => record_phase(deps, s), { description: "archive the iteration and rewrite the run summary" });
+}
 function build_flow(deps, resume_from) {
 	const { config, renderer } = deps;
 	const builder = make_builder_step({
@@ -3790,22 +4533,14 @@ function build_flow(deps, resume_from) {
 		on_chunk: renderer.builder_chunk,
 		bash_executor: deps.bash_executor
 	});
-	const critic = build_critic({
-		...deps.seats.critic,
-		config,
-		on_chunk: renderer.critic_chunk
-	});
 	const build = step("build", (s, ctx) => build_phase(deps, builder, s, ctx), {
 		description: "open the iteration, run the builder, measure the change",
 		arm: builder
 	});
 	const skip_verify = step("skip_verify", (s) => skip_verify_phase(deps, s), { description: "record the check as skipped and call no critic" });
-	const check = step("check", (s, ctx) => check_phase(deps, s, ctx), { description: "the deterministic gate: checkride, a command, or none" });
-	const critique = step("critique", (s, ctx) => critique_phase(deps, critic, s, ctx), {
-		description: "the read-only critic's verdict and feedback",
-		arm: critic
-	});
-	const record = step("record", (s) => record_phase(deps, s), { description: "archive the iteration and rewrite the run summary" });
+	const check = check_step(deps);
+	const critique = critique_step(deps, deps.seats.critic);
+	const record = record_step(deps);
 	const verify = branch({
 		name: "verify",
 		description: "did the build alone cross the cost cap?",
@@ -3831,6 +4566,19 @@ function build_flow(deps, resume_from) {
 		max_rounds: remaining_iterations(config, resume_from)
 	});
 }
+/** A critique: one round over a change already made. `measure` opens it and
+* measures the change from the baseline, then the check, the critic, and the
+* record, as in a run's round. No loop and no guard: there is nothing to
+* iterate on, and the caller reads the outcome off the final state. */
+function build_critique_flow(deps) {
+	const measure = step("measure", (s, ctx) => measure_phase(deps, s, ctx), { description: "open the round and measure the change under review" });
+	return sequence([
+		measure,
+		check_step(deps),
+		critique_step(deps, deps.critic),
+		record_step(deps)
+	], { name: "critique_run" });
+}
 //#endregion
 //#region src/orchestrator.ts
 /**
@@ -3847,13 +4595,19 @@ function build_flow(deps, resume_from) {
 *   │  ├─ run_loop                      run the flow (streamed when a sink is given), then the final summary
 *   │  └─ integrate                     a successful --worktree --git run only
 *   └─ report a kept checkout, or a salvaged branch (re-stamping the summary)
+*
+*   run_critique
+*   ├─ resolve the baseline              --baseline, else HEAD; a bad revision exits 5
+*   ├─ initialize the run's state
+*   └─ run the critique flow             one round on the critic's engine alone, then the final summary
 */
 async function run_volley(config, deps, resume_from = null) {
 	const { renderer } = deps;
 	if (resume_from === null) {
 		initialize_run_state(config);
-		write_resolved_config(config);
+		if (!write_resolved_config(config) && !detect_containment(process.env)) renderer.warn(`could not sign this run's config with this machine's key (${trust_key_path(process.env)}), so resuming it here will need --trust-config`);
 	} else initialize_run_state(config, { preserve: true });
+	renderer.info(`state: ${run_state_dir(config)}`);
 	report_worktree_fate(config, renderer);
 	const branch = worktree_branch(config.run_id);
 	const fate = worktree_fate(config);
@@ -3969,63 +4723,65 @@ function finalize_failed_run(config, err) {
 	const status = kind === "aborted_error" || cause === "aborted_error" ? "interrupted" : "error";
 	try {
 		const summary_path = state_path(config, "summary.json");
+		const prior = existsSync(summary_path) ? JSON.parse(readFileSync(summary_path, "utf8")) : run_result_from_state(config, initial_state(), status, null);
 		write_run_summary(config, {
-			...existsSync(summary_path) ? JSON.parse(readFileSync(summary_path, "utf8")) : run_result_from_state(config, initial_state(), status, null),
+			...prior,
+			builder_max_steps_hits: prior.builder_max_steps_hits ?? 0,
+			run_state_dir: run_state_dir(config),
 			status,
 			completed_at: (/* @__PURE__ */ new Date()).toISOString()
 		});
 	} catch {}
 }
-//#endregion
-//#region src/render/format.ts
 /**
-* Display formatting: glyph taxonomy, role colors, truncation.
-* All human output goes to stderr; these helpers only build strings.
+* `volley critique`: the check and the critic, once, over a change already
+* made. No builder is constructed, and the engine serves the critic's seat
+* alone, so a critic can be measured on fixed, labeled changes without paying
+* for builder turns. It writes the state a one-round run does, with the mode
+* recorded, and ends `success` on approval over a green check, else
+* `rejected`.
 */
-const GLYPH_TOOL = "🔧";
-const GLYPH_COST = "💰";
-const VERBOSE_TRUNCATE_CHARS = 4e3;
-function colors_enabled(env = process.env, is_tty = process.stderr.isTTY === true) {
-	if (env["NO_COLOR"] !== void 0 || env["VOLLEY_NO_COLOR"] !== void 0) return false;
-	return is_tty;
-}
-function paint(role, text, color) {
-	if (!color) return text;
-	switch (role) {
-		case "builder": return pc.cyan(text);
-		case "critic": return pc.yellow(text);
-		case "check": return pc.green(text);
-		case "cost": return pc.magenta(text);
-		case "error": return pc.bold(pc.red(text));
-	}
-}
-function dim(text, color) {
-	return color ? pc.dim(text) : text;
-}
-function truncate(text, max, pointer) {
-	if (text.length <= max) return text;
-	return `${text.slice(0, max)}\n… [truncated at ${String(max)} chars; ${pointer}]`;
-}
-function format_usd(value) {
-	return value === null ? "$?" : `$${value.toFixed(3)}`;
-}
-/** One-line summary of a tool input for the default streaming mode. */
-function summarize_value(value, max = 120) {
-	let text;
+async function run_critique(config, deps) {
+	if (config.mode !== "critique") throw config_error("run_critique needs a config resolved with mode 'critique'");
+	const { renderer } = deps;
+	const baseline = resolve_baseline(config.workspace, deps.baseline);
+	initialize_run_state(config);
+	write_resolved_config(config);
+	renderer.info(`state: ${run_state_dir(config)}`);
+	renderer.info(baseline === null ? "baseline: none (not a git repository, or no commit yet); the critic reviews the tree" : `baseline: ${baseline}`);
+	const engine = deps.engine ?? create_volley_engine({
+		workspace: config.workspace,
+		critic_provider: config.critic_provider,
+		critic_url: config.critic_url
+	});
+	const flow = build_critique_flow({
+		config,
+		renderer,
+		baseline,
+		critic: {
+			...deps.critic,
+			engine
+		},
+		...deps.check !== void 0 ? { check: deps.check } : {}
+	});
 	try {
-		text = typeof value === "string" ? value : JSON.stringify(value) ?? "";
-	} catch {
-		text = String(value);
+		const value = await execute_flow(config, deps, flow, initial_state());
+		const result = run_result_from_state(config, value, value.check?.ok === true && value.verdict === "approved" ? "success" : "rejected", (/* @__PURE__ */ new Date()).toISOString());
+		write_run_summary(config, result);
+		return result;
+	} catch (err) {
+		finalize_failed_run(config, err);
+		throw err;
+	} finally {
+		await engine.dispose();
 	}
-	const flat = text.replace(/\s+/g, " ");
-	return flat.length > max ? `${flat.slice(0, max)}…` : flat;
 }
 //#endregion
 //#region src/render/renderer.ts
 function create_renderer(options) {
 	const write = options.write ?? ((text) => process.stderr.write(text));
 	const { mode, color } = options;
-	const see_trajectory = `see ${options.trajectory_path ?? ".volley/trajectory.jsonl"}`;
+	const see_trajectory = `see ${options.trajectory_path ?? "the run's trajectory.jsonl"}`;
 	const silent = mode === "json";
 	const streaming = mode === "default" || mode === "verbose";
 	let mid_line = false;
@@ -4103,6 +4859,7 @@ function create_renderer(options) {
 			line(`iterations: ${String(result.iterations_completed)} | verdict: ${result.final_verdict ?? "n/a"}`);
 			line(paint("cost", `${GLYPH_COST} total: ${format_usd(result.total_cost_usd)} (builder ${format_usd(result.builder_cost_usd)}, critic ${format_usd(result.critic_cost_usd)})`, color));
 			line(`tokens: ${String(result.total_usage.input_tokens)} in / ${String(result.total_usage.output_tokens)} out`);
+			line(`state: ${result.run_state_dir}`);
 		}
 	};
 }
@@ -4146,14 +4903,6 @@ const REFUSED_FLAGS = [
 /** What the startup check resolves in place of a prompt, which no session has
 * sent yet. */
 const STAND_IN_TASK = "volley acp: startup check";
-/** The root each run's state sits under when `--state-dir` names none:
-* `$XDG_STATE_HOME/volley`, else `~/.local/state/volley`. A relative
-* `XDG_STATE_HOME` is ignored, as the XDG spec says. */
-function acp_state_root(env) {
-	const xdg = env["XDG_STATE_HOME"];
-	const base = xdg !== void 0 && isAbsolute(xdg) ? xdg : join(homedir(), ".local", "state");
-	return join(base, "volley");
-}
 /** Unset, or set to nothing but whitespace. Any other value goes on to
 * `resolve_config`, which says what's wrong with it. */
 function is_blank(value) {
@@ -4166,17 +4915,18 @@ function refuse_unservable(raw) {
 	if (missing.length > 0) throw config_error(`volley acp requires every seat flag, and these are missing: ${missing.join(", ")}`);
 	if (raw.builder_provider === "claude_cli") throw config_error("volley acp refuses a claude_cli builder: the Claude CLI runs its own tools under its own permission model, so its edits would never reach the editor's prompts");
 }
-/** The flags `volley acp` was started with, with acp's defaults filled in:
-* three rounds, and state outside the workspace. Each refusal, a missing seat
-* flag, and any other config error throws here, before serving: the whole
-* config resolves once against the system temp directory with a stand-in
-* task, since no session has named a workspace yet. */
+/** The flags `volley acp` was started with, with acp's default filled in:
+* three rounds. Run state goes under the default root, outside the workspace,
+* unless `--state-dir` names one, as it does for any run. Each refusal, a
+* missing seat flag, and any other config error, an unwritable state root
+* among them, throws here, before serving: the whole config resolves once
+* against the system temp directory with a stand-in task, since no session has
+* named a workspace yet. */
 function acp_base_config(raw, env = process.env) {
 	refuse_unservable(raw);
 	const base = {
 		...raw,
-		max_iterations: raw.max_iterations ?? 3,
-		state_dir: raw.state_dir === void 0 || is_blank(raw.state_dir) ? acp_state_root(env) : raw.state_dir
+		max_iterations: raw.max_iterations ?? 3
 	};
 	resolve_config({
 		...base,
@@ -4290,7 +5040,8 @@ function acp_serve_config(base, options) {
 function exit_code_for_status(status) {
 	switch (status) {
 		case "success": return 0;
-		case "budget_exhausted": return 2;
+		case "budget_exhausted":
+		case "rejected": return 2;
 		case "cost_cap_reached": return 7;
 		case "gate_edit_blocked": return 8;
 		case "interrupted": return 130;
@@ -4537,10 +5288,10 @@ function combo_dir(matrix_dir, combo) {
 function slug(model) {
 	return model.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
-/** One attempt's run summary, copied out of the run's own state before the
-* next attempt rotates a shared `.volley/` aside. Every attempt gets its own
-* `run-NN/` so a repeated seat keeps all of its evidence, not just the last
-* run's. */
+/** One attempt's run summary, copied out of the run's own state into the
+* sweep, so the sweep keeps its evidence beside its table. Every attempt gets
+* its own `run-NN/` so a repeated seat keeps all of its evidence, not just the
+* last run's. */
 function persist_attempt(matrix_dir, combo, attempt, summary) {
 	const dir = join(combo_dir(matrix_dir, combo), `run-${String(attempt).padStart(2, "0")}`);
 	mkdirSync(dir, { recursive: true });
@@ -4854,7 +5605,8 @@ function report_gate_posture(config, renderer) {
 		return;
 	}
 	if (config.gate_paths.length === 0) {
-		renderer.info("gate: no gate paths configured; builder edits to tests and check config are not flagged.");
+		const edits = config.mode === "critique" ? "changes" : "builder edits";
+		renderer.info(`gate: no gate paths configured; ${edits} to tests and check config are not flagged.`);
 		return;
 	}
 	renderer.info(`gate: watching ${String(config.gate_paths.length)} path pattern(s)` + (config.fail_on_gate_edit ? " — a builder edit to any of them halts the run (--fail-on-gate-edit, exit 8)." : " — edits are reported to the critic and recorded in the summary, not refused."));
@@ -4883,11 +5635,17 @@ async function preflight(config, renderer, env, probes = {}) {
 	const tool_loop_builder = is_tool_loop_builder(config.builder_provider);
 	renderer.info(`dry run: config valid (run ${config.run_id})`);
 	renderer.info(`workspace: ${config.workspace}`);
+	renderer.info(config.state_dir === null ? `state: ${run_state_dir(config)}` : `state root: ${config.state_dir}`);
 	renderer.info(`check: ${config.check} (resolved: ${config.check_resolved})`);
-	renderer.info(seat_line("builder", config.builder_model, config.builder_provider, config.builder_url, env));
-	renderer.info(`builder max steps: ${config.builder_max_steps}`);
+	if (config.mode === "critique") renderer.info("builder: none (a critique checks and critiques the change once)");
+	else {
+		renderer.info(seat_line("builder", config.builder_model, config.builder_provider, config.builder_url, env));
+		renderer.info(`builder max steps: ${config.builder_max_steps}`);
+		renderer.info(`builder tool calls per turn: ${config.builder_max_tool_calls}`);
+		renderer.info(`builder output tokens per turn: ${config.builder_max_output_tokens ?? "the provider's limit"}`);
+	}
 	if (tool_loop_builder) {
-		const contained = env["VOLLEY_CONTAINED"] === "1" || env["VOLLEY_CONTAINED"] === "true";
+		const contained = detect_containment(env);
 		renderer.info(contained ? "containment: inside the sandbox container (VOLLEY_CONTAINED)" : "containment: uncontained on the host (--allow-unsandboxed-builder)");
 		renderer.info(`sandbox image: ${config.sandbox_image}`);
 	}
@@ -4942,6 +5700,8 @@ async function preflight(config, renderer, env, probes = {}) {
 * CLI entry point: cac argv parsing, dispatch, exit-code mapping.
 * Human progress goes to stderr; stdout carries machine output only.
 */
+/** One help string for every command that takes a state root. */
+const STATE_DIR_HELP = "Keep each run's state under <path>/<run id>/ (default: $XDG_STATE_HOME/volley, else ~/.local/state/volley)";
 /**
 * volley's own version for `--version`, read from the manifest rather than
 * repeated here — a literal drifts silently, since `pnpm version` bumps only
@@ -4976,19 +5736,18 @@ function render_mode(config) {
 	if (config.verbose) return "verbose";
 	return "default";
 }
-/** `run_id` names the run whose trajectory the verbose hint points at under a
-* state root; a sweep passes a placeholder, since each seat has an id of its
-* own. */
+/** `run_id` names the run whose trajectory the verbose hint points at; a
+* sweep passes a placeholder, since each seat has an id of its own. */
 function make_renderer(config, run_id = config.run_id) {
 	return create_renderer({
 		mode: render_mode(config),
 		show_thinking: config.show_thinking,
 		color: colors_enabled(),
 		max_cost_usd: config.max_cost_usd,
-		...config.state_dir === null ? {} : { trajectory_path: state_path({
+		trajectory_path: state_path({
 			...config,
 			run_id
-		}, "trajectory.jsonl") }
+		}, "trajectory.jsonl")
 	});
 }
 function warn_api_key_meter(renderer) {
@@ -5001,6 +5760,13 @@ function warn_api_key_meter(renderer) {
 function warn_unsandboxed_builder(config, renderer) {
 	if (config.builder_provider !== "claude_cli" && config.allow_unsandboxed_builder) renderer.warn(`UNSANDBOXED BUILDER: '${config.builder_provider}' runs volley's tool loop with a real bash (write + exec) directly on this machine in ${config.workspace} — no container isolation. Proceeding because --allow-unsandboxed-builder / VOLLEY_ALLOW_UNSANDBOXED_BUILDER is set; run volley inside its sandbox container for blast-radius containment instead.`);
 }
+/** The critic seat's options: its model, provider, and URL. `required` marks
+* the model and provider as having no default, as under `acp`. */
+function with_critic_options(command, required = false) {
+	const model_note = required ? " (required)" : "";
+	const provider_note = required ? "required" : "default: claude_cli";
+	return command.option("--critic-model <model>", `Critic model${model_note}`).option("--critic-provider <name>", `claude_cli | ollama | lmstudio | openrouter (${provider_note})`).option("--critic-url <url>", "Critic's model server base URL, ollama, lmstudio, or openrouter only (default: VOLLEY_OLLAMA_URL / VOLLEY_LMSTUDIO_URL / VOLLEY_OPENROUTER_URL)");
+}
 /** The seat options, declared once for every command that runs seats: each
 * seat's model, provider, and URL, the tool-loop builder's step cap, and the
 * unsandboxed opt-out. `required` marks each seat's model and provider as
@@ -5008,8 +5774,29 @@ function warn_unsandboxed_builder(config, renderer) {
 function with_seat_options(command, required = false) {
 	const model_note = required ? " (required)" : "";
 	const provider_note = required ? "required" : "default: claude_cli";
-	return command.option("--builder-model <model>", `Builder model${model_note}`).option("--builder-provider <name>", `claude_cli | ollama | lmstudio | openrouter (${provider_note})`).option("--builder-url <url>", "Builder's model server base URL, ollama, lmstudio, or openrouter only (default: VOLLEY_OLLAMA_URL / VOLLEY_LMSTUDIO_URL / VOLLEY_OPENROUTER_URL)").option("--builder-max-steps <n>", "Tool-loop builder step cap per iteration, any provider but claude_cli (default: 50)").option("--allow-unsandboxed-builder", "Permit a builder other than claude_cli to run without a sandbox (real host bash + write)").option("--critic-model <model>", `Critic model${model_note}`).option("--critic-provider <name>", `claude_cli | ollama | lmstudio | openrouter (${provider_note})`).option("--critic-url <url>", "Critic's model server base URL, ollama, lmstudio, or openrouter only (default: VOLLEY_OLLAMA_URL / VOLLEY_LMSTUDIO_URL / VOLLEY_OPENROUTER_URL)");
-}
+	return with_critic_options(command.option("--builder-model <model>", `Builder model${model_note}`).option("--builder-provider <name>", `claude_cli | ollama | lmstudio | openrouter (${provider_note})`).option("--builder-url <url>", "Builder's model server base URL, ollama, lmstudio, or openrouter only (default: VOLLEY_OLLAMA_URL / VOLLEY_LMSTUDIO_URL / VOLLEY_OPENROUTER_URL)").option("--builder-max-steps <n>", "Tool-loop builder step cap per iteration, any provider but claude_cli (default: 50)").option("--builder-max-tool-calls <n>", "Tool calls a tool-loop builder may make per turn, reads aside, any provider but claude_cli (default: 1)").option("--builder-max-output-tokens <n>", "Output tokens a tool-loop builder may generate per turn, reasoning included, any provider but claude_cli (default: 16384 on ollama and lmstudio, the provider's on openrouter)").option("--allow-unsandboxed-builder", "Permit a builder other than claude_cli to run without a sandbox (real host bash + write)"), required);
+}
+/** What a critique declares only so that it can refuse each by name, with
+* exit 5: cac would answer an undeclared one with a bare "Unknown option".
+* `resolve_config` refuses all but `--config`, which the command does. */
+const CRITIQUE_REFUSED_OPTIONS = [
+	"--builder-model <model>",
+	"--builder-provider <name>",
+	"--builder-url <url>",
+	"--builder-max-steps <n>",
+	"--builder-max-tool-calls <n>",
+	"--builder-max-output-tokens <n>",
+	"--builder-permission-mode <mode>",
+	"--allow-unsandboxed-builder",
+	"--sandbox-image <tag>",
+	"--max-iterations <n>",
+	"--max-cost-usd <usd>",
+	"--git",
+	"--worktree",
+	"--discard-worktree",
+	"--fail-on-gate-edit",
+	"--config <path>"
+];
 function merge_flags(base, flags) {
 	return {
 		...base,
@@ -5021,6 +5808,8 @@ function merge_flags(base, flags) {
 		...flags.builderProvider !== void 0 ? { builder_provider: flags.builderProvider } : {},
 		...flags.builderUrl !== void 0 ? { builder_url: flags.builderUrl } : {},
 		...flags.builderMaxSteps !== void 0 ? { builder_max_steps: Number(flags.builderMaxSteps) } : {},
+		...flags.builderMaxToolCalls !== void 0 ? { builder_max_tool_calls: Number(flags.builderMaxToolCalls) } : {},
+		...flags.builderMaxOutputTokens !== void 0 ? { builder_max_output_tokens: Number(flags.builderMaxOutputTokens) } : {},
 		...flags.allowUnsandboxedBuilder === true ? { allow_unsandboxed_builder: true } : {},
 		...flags.criticModel !== void 0 ? { critic_model: flags.criticModel } : {},
 		...flags.criticProvider !== void 0 ? { critic_provider: flags.criticProvider } : {},
@@ -5043,6 +5832,20 @@ function merge_flags(base, flags) {
 		...flags.thinking === false ? { show_thinking: false } : {}
 	};
 }
+/** What a resume is about to run on a config this machine didn't sign, said
+* once before it runs, so `--trust-config` is never a blind yes. Every value
+* came from that config, so each is quoted with its control characters
+* escaped, and can't redraw the line it's warned on. */
+function warn_trusted_config(config, renderer) {
+	renderer.warn(`resuming on a config volley on this machine didn't sign (--trust-config): check ${shown(config.check)} (resolved: ${config.check_resolved}), builder ${config.builder_provider} ${shown(config.builder_model)} (${config.builder_permission_mode}), critic ${config.critic_provider} ${shown(config.critic_model)}, workspace ${shown(config.workspace)}`);
+}
+/** A flag's value as typed. cac reads an all-digit value as a number, which
+* drops leading zeros, so a coerced id or revision would silently name another
+* run or commit: refused rather than guessed at. */
+function not_a_bare_number(name, value) {
+	if (typeof value === "number") throw config_error(`${name} must not be a bare number (read as ${String(value)})`);
+	return value;
+}
 function emit_result(config, result, renderer) {
 	renderer.final_summary(result);
 	if (config.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
@@ -5060,10 +5863,10 @@ function report_error(err) {
 async function main(argv) {
 	const cli = cac("volley");
 	let exit_code = 0;
-	with_seat_options(cli.command("", "Run the builder/critic loop").option("--prompt <prompt>", "Task prompt (string or @file)").option("--workspace <path>", "Workspace directory (must exist and be writable)").option("--criteria <criteria>", "Acceptance criteria (string or @file)").option("--check <check>", `auto | none | shell command (default: ${DEFAULT_CHECK})`)).option("--builder-permission-mode <mode>", "acceptEdits | bypassPermissions").option("--critic <critic>", "reviewer | optimizer | researcher | path to prompt file").option("--max-iterations <n>", "Iteration cap").option("--max-cost-usd <usd>", "Hard USD ceiling, enforced in the loop guard").option("--git", "Auto-commit after each phase (workspace must be a git repo)").option("--worktree", "Isolate the builder run in a per-run git worktree (workspace must be a git repo)").option("--discard-worktree", "Throw a --worktree run's effects away at teardown instead of keeping them on the run branch").option("--gate-paths <globs>", "Comma-separated globs naming the gate (tests, fixtures, check config); replaces the defaults").option("--fail-on-gate-edit", "Halt the run if the builder edits a gate path (exit 8) instead of reporting it").option("--sandbox-image <tag>", `Container image for the local-builder sandbox (default: ${DEFAULT_SANDBOX_IMAGE})`).option("--state-dir <path>", "Keep each run's state under <path>/<run id>/ instead of the workspace's .volley/").option("--run-id <id>", "The run's id, naming its volley/<id> branch (default: a fresh UUID)").option("--dry-run", "Validate config (and checkride doctor) without running").option("--config <path>", "TypeScript config file exporting a VolleyConfig").option("--json", "Machine mode: final summary JSON on stdout, no streaming").option("--verbose", "Show full tool inputs/outputs (truncated at 4000 chars)").option("--quiet", "Only phase transitions, cost updates, and the final summary").option("--no-thinking", "Hide reasoning chunks (still recorded in the trajectory)").action(async (flags) => {
+	with_seat_options(cli.command("", "Run the builder/critic loop").option("--prompt <prompt>", "Task prompt (string or @file)").option("--workspace <path>", "Workspace directory (must exist and be writable)").option("--criteria <criteria>", "Acceptance criteria (string or @file)").option("--check <check>", `auto | none | shell command (default: ${DEFAULT_CHECK})`)).option("--builder-permission-mode <mode>", "acceptEdits | bypassPermissions").option("--critic <critic>", "reviewer | optimizer | researcher | path to prompt file").option("--max-iterations <n>", "Iteration cap").option("--max-cost-usd <usd>", "Hard USD ceiling, enforced in the loop guard").option("--git", "Auto-commit after each phase (workspace must be a git repo)").option("--worktree", "Isolate the builder run in a per-run git worktree (workspace must be a git repo)").option("--discard-worktree", "Throw a --worktree run's effects away at teardown instead of keeping them on the run branch").option("--gate-paths <globs>", "Comma-separated globs naming the gate (tests, fixtures, check config); replaces the defaults").option("--fail-on-gate-edit", "Halt the run if the builder edits a gate path (exit 8) instead of reporting it").option("--sandbox-image <tag>", `Container image for the local-builder sandbox (default: ${DEFAULT_SANDBOX_IMAGE})`).option("--state-dir <path>", STATE_DIR_HELP).option("--run-id <id>", "The run's id, naming its volley/<id> branch (default: a fresh UUID)").option("--dry-run", "Validate config (and checkride doctor) without running").option("--config <path>", "TypeScript config file exporting a VolleyConfig").option("--json", "Machine mode: final summary JSON on stdout, no streaming").option("--verbose", "Show full tool inputs/outputs (truncated at 4000 chars)").option("--quiet", "Only phase transitions, cost updates, and the final summary").option("--no-thinking", "Hide reasoning chunks (still recorded in the trajectory)").action(async (flags) => {
 		const merged = merge_flags(flags.config !== void 0 ? await load_config_file(flags.config) : {}, flags);
-		if (typeof flags.runId === "number") throw config_error(`--run-id must not be a bare number (read as ${String(flags.runId)})`);
-		const config = resolve_config(merged, flags.runId !== void 0 ? { run_id: flags.runId } : {});
+		const run_id = not_a_bare_number("--run-id", flags.runId);
+		const config = resolve_config(merged, run_id !== void 0 ? { run_id } : {});
 		const renderer = make_renderer(config);
 		warn_api_key_meter(renderer);
 		warn_unsandboxed_builder(config, renderer);
@@ -5073,24 +5876,48 @@ async function main(argv) {
 		}
 		exit_code = emit_result(config, await run_volley(config, { renderer }), renderer);
 	});
-	cli.command("resume <run_id>", "Resume a run from its last completed iteration").option("--workspace <path>", "Workspace containing the .volley run state", { default: "." }).option("--state-dir <path>", "State root the run was started under; finds it at <path>/<run_id>/ instead of in the workspace").option("--json", "Machine mode: final summary JSON on stdout, no streaming").option("--verbose", "Show full tool inputs/outputs").option("--quiet", "Only phase transitions, cost updates, and the final summary").option("--no-thinking", "Hide reasoning chunks").action(async (run_id, flags) => {
-		const { workspace = ".", stateDir, ...output } = flags;
-		const state_dir = stateDir === void 0 ? null : resolve(stateDir);
-		const resume = load_resume_state(workspace, run_id, state_dir);
-		const config = resolve_config(merge_flags(resume.raw_config, {
-			...output,
-			...state_dir !== null ? { stateDir: state_dir } : {}
-		}), {
+	cli.command("resume <run_id>", "Resume a run from its last completed iteration").option("--workspace <path>", "Where a run an older volley started keeps its .volley/ state", { default: "." }).option("--state-dir <path>", "State root the run was started under (default: $XDG_STATE_HOME/volley, else ~/.local/state/volley)").option("--trust-config", "Resume a config volley on this machine didn't sign: another machine's, an older volley's, or one you edited. Read it first").option("--json", "Machine mode: final summary JSON on stdout, no streaming").option("--verbose", "Show full tool inputs/outputs").option("--quiet", "Only phase transitions, cost updates, and the final summary").option("--no-thinking", "Hide reasoning chunks").action(async (run_id, flags) => {
+		const { workspace = ".", stateDir, trustConfig, ...output } = flags;
+		const state_dir = find_run_state(workspace, run_id, stateDir === void 0 ? default_state_root(process.env) : resolve(stateDir));
+		const resume = load_resume_state(workspace, run_id, state_dir, { trust_config: trustConfig === true });
+		const config = resolve_config(merge_flags(resume.raw_config, output), {
 			run_id: resume.run_id,
-			started_at: resume.started_at
+			started_at: resume.started_at,
+			state_dir
 		});
 		if (resume.iterations_completed >= config.max_iterations) throw config_error(`run already completed ${String(resume.iterations_completed)} of ${String(config.max_iterations)} iterations`);
 		const renderer = make_renderer(config);
 		warn_api_key_meter(renderer);
 		warn_unsandboxed_builder(config, renderer);
+		if (resume.config_signed === false) warn_trusted_config(config, renderer);
 		renderer.info(`resuming run ${run_id} at iteration ${String(resume.iterations_completed + 1)}`);
 		exit_code = emit_result(config, await run_volley(config, { renderer }, resume.state), renderer);
 	});
+	const critique_command = cli.command("critique", "Check and critique a change already made, once, with no builder").option("--workspace <path>", "The repository whose change is reviewed", { default: "." }).option("--baseline <rev>", "Review everything that differs from this revision, committed or not (default: HEAD)").option("--criteria <criteria>", "Acceptance criteria (string or @file)").option("--prompt <prompt>", "The task the change answers, recorded with the run; the critic judges against --criteria").option("--check <check>", `auto | none | shell command (default: ${DEFAULT_CHECK})`);
+	with_critic_options(critique_command).option("--critic <critic>", "reviewer | optimizer | researcher | path to prompt file").option("--gate-paths <globs>", "Comma-separated globs naming the gate (tests, fixtures, check config); replaces the defaults").option("--state-dir <path>", STATE_DIR_HELP).option("--run-id <id>", "The run's id, naming its state directory (default: a fresh UUID)").option("--dry-run", "Validate config and the baseline, run checkride doctor, and probe the critic seat, then exit").option("--json", "Machine mode: final summary JSON on stdout, no streaming").option("--verbose", "Show full tool inputs/outputs (truncated at 4000 chars)").option("--quiet", "Only phase transitions, cost updates, and the final summary").option("--no-thinking", "Hide reasoning chunks (still recorded in the trajectory)");
+	for (const refused of CRITIQUE_REFUSED_OPTIONS) critique_command.option(refused, "Refused: a critique runs no builder and no loop");
+	critique_command.action(async (flags) => {
+		if (flags.config !== void 0) throw config_error("volley critique refuses --config: a run's config file sets a builder; pass the critique's settings as flags");
+		const run_id = not_a_bare_number("--run-id", flags.runId);
+		const baseline = not_a_bare_number("--baseline", flags.baseline);
+		const merged = merge_flags({}, flags);
+		const config = resolve_config(merged, {
+			mode: "critique",
+			...run_id !== void 0 ? { run_id } : {}
+		});
+		const renderer = make_renderer(config);
+		warn_api_key_meter(renderer);
+		if (merged.dry_run === true) {
+			const sha = resolve_baseline(config.workspace, baseline);
+			renderer.info(`baseline: ${sha ?? "none (not a git repository, or no commit yet)"}`);
+			exit_code = await preflight(config, renderer, process.env);
+			return;
+		}
+		exit_code = emit_result(config, await run_critique(config, {
+			renderer,
+			...baseline !== void 0 ? { baseline } : {}
+		}), renderer);
+	});
 	cli.command("matrix", "Sweep builder×critic model combos serially over one config").option("--config <path>", "Base VolleyConfig (TS/JS): the task, workspace, providers, and caps held fixed").option("--builders <models>", "Comma-separated builder models to sweep").option("--critics <models>", "Comma-separated critic models to sweep").option("--workspace <path>", "Override the base config workspace").option("--repeat <n>", "Attempts per seat (default: 1); a pass rate needs more than one").option("--json", "Machine mode: aggregate JSON on stdout, no table").option("--verbose", "Show full builder/critic streams per combo").option("--quiet", "Per-combo phase transitions and the final table only").action(async (flags) => {
 		if (flags.config === void 0) throw config_error("volley matrix requires --config <path> (the base task to sweep)");
 		const builders = parse_model_list(flags.builders, "--builders");
@@ -5121,7 +5948,7 @@ async function main(argv) {
 		if (base_config.json) process.stdout.write(`${JSON.stringify({ combos: outcome.rows }, null, 2)}\n`);
 		exit_code = outcome.ok ? 0 : 1;
 	});
-	with_seat_options(cli.command("acp", "Serve volley to an editor as an ACP agent over stdio"), true).option("--critic <critic>", "reviewer | optimizer | researcher | path to prompt file").option("--check <check>", `auto | none | shell command (default: ${DEFAULT_CHECK})`).option("--max-iterations <n>", `Iteration cap per prompt (default: ${String(3)})`).option("--max-cost-usd <usd>", "Hard USD ceiling per prompt, enforced in the loop guard").option("--state-dir <path>", "Keep each run's state under <path>/<run id>/ (default: $XDG_STATE_HOME/volley, else ~/.local/state/volley)").option("--worktree", "Refused: a sibling worktree sits outside the project the editor has open").option("--git", "Refused: phase commits would bypass the permission prompts").option("--json", "Refused: stdout carries the protocol").action(async (flags) => {
+	with_seat_options(cli.command("acp", "Serve volley to an editor as an ACP agent over stdio"), true).option("--critic <critic>", "reviewer | optimizer | researcher | path to prompt file").option("--check <check>", `auto | none | shell command (default: ${DEFAULT_CHECK})`).option("--max-iterations <n>", `Iteration cap per prompt (default: ${String(3)})`).option("--max-cost-usd <usd>", "Hard USD ceiling per prompt, enforced in the loop guard").option("--state-dir <path>", STATE_DIR_HELP).option("--worktree", "Refused: a sibling worktree sits outside the project the editor has open").option("--git", "Refused: phase commits would bypass the permission prompts").option("--json", "Refused: stdout carries the protocol").action(async (flags) => {
 		const base = acp_base_config(merge_flags({}, flags));
 		await serve_acp(acp_serve_config(base, { version: package_version() }));
 	});