@sleepy_panda_srl/portulan 0.3.0 → 0.4.1

package/evals/ab/personas/reviewer.md

@@ -0,0 +1,22 @@
+# reviewer — acquired routing comparison
+
+Host: 2.1.321 (Claude Code). Concrete model: claude-sonnet-5-5.
+
+A uses the shipped inherited model and undeclared child effort (observed high). B requests medium through the native child tool. Each case has one attempt per arm.
+
+| Arm | Semantic passes | Observed cost index | Cold-normalized cost index |
+|---|---:|---:|---:|
+| A | 3/3 | 150520.60 | 426477.60 |
+| B | 3/3 | 161948.05 | 426186.55 |
+
+Medium wins this observed corpus: **yes**. The shipped policy remains inherited model, undeclared effort, instruction floor retained and five-minute cache lifetime.
+
+These are three observations, not a reliability estimate. A result on this concrete model does not establish medium effort for other inherited models. Cost indexes use the frozen declared vector, include parent and child requests, and are not subscription bills. First-request input is normalized separately in each fresh parent and child context.
+
+| Case | A | B |
+|---|---|---|
+| reviewer-verdict | PASS | PASS |
+| reviewer-clean | PASS | PASS |
+| reviewer-boundaries | PASS | PASS |
+
+The common acquisition record accounts for both mechanism probes and discloses the one retained-answer decoder repair after the first outcome. The original failed decode score and the repaired score are both retained; that child was never rerun.

package/evals/releases/0.4.0.json

@@ -0,0 +1,154 @@
+{
+    "portulan": {
+        "releaseEval": "1"
+    },
+    "version": "0.4.0",
+    "captured": "2026-11-11",
+    "source": {
+        "commit": "660cbbfd7c9a4cf234e5a85d82d2ae21d248d3b1",
+        "clean": true
+    },
+    "host": {
+        "node": "v26.13.0",
+        "platform": "darwin"
+    },
+    "recipes": [
+        {
+            "id": "cache-stability",
+            "exit": 0
+        },
+        {
+            "id": "docs",
+            "exit": 0
+        },
+        {
+            "id": "json",
+            "exit": 0
+        },
+        {
+            "id": "doctor",
+            "exit": 0
+        },
+        {
+            "id": "tests",
+            "exit": 0
+        },
+        {
+            "id": "plugin",
+            "exit": 0
+        },
+        {
+            "id": "compile",
+            "exit": 0
+        },
+        {
+            "id": "workflow-filters",
+            "exit": 0
+        },
+        {
+            "id": "index",
+            "exit": 0
+        },
+        {
+            "id": "context",
+            "exit": 0
+        },
+        {
+            "id": "ledger",
+            "exit": 0
+        },
+        {
+            "id": "control-chars",
+            "exit": 0
+        },
+        {
+            "id": "comments",
+            "exit": 0
+        },
+        {
+            "id": "rule-carriers",
+            "exit": 0
+        },
+        {
+            "id": "pack-version",
+            "exit": 0
+        },
+        {
+            "id": "pack-identity",
+            "exit": 0
+        },
+        {
+            "id": "payload",
+            "exit": 0
+        },
+        {
+            "id": "eval-bundle",
+            "exit": 0
+        },
+        {
+            "id": "goldens",
+            "exit": 0
+        },
+        {
+            "id": "mutants",
+            "exit": 0
+        },
+        {
+            "id": "fuzz-shell",
+            "exit": 0
+        },
+        {
+            "id": "version-carriers",
+            "exit": 0
+        },
+        {
+            "id": "skill-goldens",
+            "exit": 0
+        },
+        {
+            "id": "review-loop",
+            "exit": 0
+        },
+        {
+            "id": "telemetry",
+            "exit": 0
+        },
+        {
+            "id": "drills",
+            "exit": 0
+        },
+        {
+            "id": "ab",
+            "exit": 0
+        },
+        {
+            "id": "ab-grade",
+            "exit": 0
+        },
+        {
+            "id": "ab-run",
+            "exit": 0
+        },
+        {
+            "id": "tools/github:actions-pinned",
+            "exit": 0
+        },
+        {
+            "id": "tools/local-llm:runner-rails",
+            "exit": 0
+        }
+    ],
+    "excluded": [
+        {
+            "id": "release-eval",
+            "why": "a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file."
+        }
+    ],
+    "abBaseline": {
+        "snapshot": "evals/ab/baseline.json",
+        "register": "evals/ab/baseline.md",
+        "captured": "2026-08-31T09:05:32.699Z",
+        "commit": "a642d551eec6c146c67ef0acfe3f8ba535c5ce6e",
+        "clean": false
+    }
+}

package/evals/releases/0.4.0.md

@@ -0,0 +1,69 @@
+# Eval result — Portulan 0.4.0
+
+> **Generated. Do not edit.** Rendered from [`evals/releases/0.4.0.json`](0.4.0.json) by [`cli/release-eval.mjs`](../../cli/release-eval.mjs) and byte-compared by the `release-eval` verify recipe. This is the eval result milestone 8 requires a release to carry — `docs/plan.md`, Protocol → Versioning.
+
+## What this release was measured at
+
+| | |
+|---|---|
+| Version | `0.4.0` |
+| Captured | 2026-11-11 |
+| Commit | `660cbbfd7c9a4cf234e5a85d82d2ae21d248d3b1` |
+| Tree at capture | clean |
+| Node | `v26.13.0` |
+| Platform | `darwin` |
+
+## The rails, and what each returned
+
+31 of the 32 recipes this workspace yielded at capture. The set is derived from [`cli/recipe-set.mjs`](../../cli/recipe-set.mjs) and never listed by hand.
+
+| Recipe | Verdict |
+|---|---|
+| `cache-stability` | green |
+| `docs` | green |
+| `json` | green |
+| `doctor` | green |
+| `tests` | green |
+| `plugin` | green |
+| `compile` | green |
+| `workflow-filters` | green |
+| `index` | green |
+| `context` | green |
+| `ledger` | green |
+| `control-chars` | green |
+| `comments` | green |
+| `rule-carriers` | green |
+| `pack-version` | green |
+| `pack-identity` | green |
+| `payload` | green |
+| `eval-bundle` | green |
+| `goldens` | green |
+| `mutants` | green |
+| `fuzz-shell` | green |
+| `version-carriers` | green |
+| `skill-goldens` | green |
+| `review-loop` | green |
+| `telemetry` | green |
+| `drills` | green |
+| `ab` | green |
+| `ab-grade` | green |
+| `ab-run` | green |
+| `tools/github:actions-pinned` | green |
+| `tools/local-llm:runner-rails` | green |
+
+**`release-eval` is excluded**, and the reason is printed rather than the row silently dropped: a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file.
+
+## The A/B baseline this release ships against
+
+[`evals/ab/baseline.md`](https://github.com/sleepy-panda-srl/portulan/blob/v0.4.0/evals/ab/baseline.md), rendered from `evals/ab/baseline.json` — captured 2026-08-31T09:05:32.699Z at `a642d551eec6c146c67ef0acfe3f8ba535c5ce6e`, over a tree that was **not clean**.
+
+**Its figures are not repeated here.** They have one carrier and this is not it.
+
+## What this record does not establish
+
+- **A green says this record agrees with its own capture — never that the release is good.** Every line below is what the recipes returned at one commit, and a recipe's own green establishes only what that recipe's documentation says it establishes.
+- **The recipes were not run at the tag.** They ran at `660cbbfd7c9a4cf234e5a85d82d2ae21d248d3b1`, and this record is committed *in* the cut change — so the tagged tree is this commit plus whatever that change still adds after the capture, the record itself at minimum. A record cannot be captured at a commit that does not exist yet, and printing the one it was captured at is the only honest form.
+- **`release-eval` is excluded from the rows above**, because a capture cannot be accurate about the record it is inside. Its verdict for this release is the rail's own run on the pull request that carries this file.
+- **This record measures the Portulan repository's own build**, at the commit named above — never the workspace, project or package this release is installed into. Nothing here has looked at your tree.
+- **The tree was clean at capture**, so the commit named above is what was measured.
+- **The A/B baseline's figures are NOT restated here.** This record names which baseline the release ships against; the figures and everything that may not be concluded from them live in that register alone.

package/evals/releases/0.4.1.json

@@ -0,0 +1,154 @@
+{
+    "portulan": {
+        "releaseEval": "1"
+    },
+    "version": "0.4.1",
+    "captured": "2026-11-11",
+    "source": {
+        "commit": "a83966a56af78bd76a63c48afdce457aa3c5b0d5",
+        "clean": true
+    },
+    "host": {
+        "node": "v26.13.0",
+        "platform": "darwin"
+    },
+    "recipes": [
+        {
+            "id": "cache-stability",
+            "exit": 0
+        },
+        {
+            "id": "docs",
+            "exit": 0
+        },
+        {
+            "id": "json",
+            "exit": 0
+        },
+        {
+            "id": "doctor",
+            "exit": 0
+        },
+        {
+            "id": "tests",
+            "exit": 0
+        },
+        {
+            "id": "plugin",
+            "exit": 0
+        },
+        {
+            "id": "compile",
+            "exit": 0
+        },
+        {
+            "id": "workflow-filters",
+            "exit": 0
+        },
+        {
+            "id": "index",
+            "exit": 0
+        },
+        {
+            "id": "context",
+            "exit": 0
+        },
+        {
+            "id": "ledger",
+            "exit": 0
+        },
+        {
+            "id": "control-chars",
+            "exit": 0
+        },
+        {
+            "id": "comments",
+            "exit": 0
+        },
+        {
+            "id": "rule-carriers",
+            "exit": 0
+        },
+        {
+            "id": "pack-version",
+            "exit": 0
+        },
+        {
+            "id": "pack-identity",
+            "exit": 0
+        },
+        {
+            "id": "payload",
+            "exit": 0
+        },
+        {
+            "id": "eval-bundle",
+            "exit": 0
+        },
+        {
+            "id": "goldens",
+            "exit": 0
+        },
+        {
+            "id": "mutants",
+            "exit": 0
+        },
+        {
+            "id": "fuzz-shell",
+            "exit": 0
+        },
+        {
+            "id": "version-carriers",
+            "exit": 0
+        },
+        {
+            "id": "skill-goldens",
+            "exit": 0
+        },
+        {
+            "id": "review-loop",
+            "exit": 0
+        },
+        {
+            "id": "telemetry",
+            "exit": 0
+        },
+        {
+            "id": "drills",
+            "exit": 0
+        },
+        {
+            "id": "ab",
+            "exit": 0
+        },
+        {
+            "id": "ab-grade",
+            "exit": 0
+        },
+        {
+            "id": "ab-run",
+            "exit": 0
+        },
+        {
+            "id": "tools/github:actions-pinned",
+            "exit": 0
+        },
+        {
+            "id": "tools/local-llm:runner-rails",
+            "exit": 0
+        }
+    ],
+    "excluded": [
+        {
+            "id": "release-eval",
+            "why": "a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file."
+        }
+    ],
+    "abBaseline": {
+        "snapshot": "evals/ab/baseline.json",
+        "register": "evals/ab/baseline.md",
+        "captured": "2026-08-31T09:05:32.699Z",
+        "commit": "a642d551eec6c146c67ef0acfe3f8ba535c5ce6e",
+        "clean": false
+    }
+}

package/evals/releases/0.4.1.md

@@ -0,0 +1,69 @@
+# Eval result — Portulan 0.4.1
+
+> **Generated. Do not edit.** Rendered from [`evals/releases/0.4.1.json`](0.4.1.json) by [`cli/release-eval.mjs`](../../cli/release-eval.mjs) and byte-compared by the `release-eval` verify recipe. This is the eval result milestone 8 requires a release to carry — `docs/plan.md`, Protocol → Versioning.
+
+## What this release was measured at
+
+| | |
+|---|---|
+| Version | `0.4.1` |
+| Captured | 2026-11-11 |
+| Commit | `a83966a56af78bd76a63c48afdce457aa3c5b0d5` |
+| Tree at capture | clean |
+| Node | `v26.13.0` |
+| Platform | `darwin` |
+
+## The rails, and what each returned
+
+31 of the 32 recipes this workspace yielded at capture. The set is derived from [`cli/recipe-set.mjs`](../../cli/recipe-set.mjs) and never listed by hand.
+
+| Recipe | Verdict |
+|---|---|
+| `cache-stability` | green |
+| `docs` | green |
+| `json` | green |
+| `doctor` | green |
+| `tests` | green |
+| `plugin` | green |
+| `compile` | green |
+| `workflow-filters` | green |
+| `index` | green |
+| `context` | green |
+| `ledger` | green |
+| `control-chars` | green |
+| `comments` | green |
+| `rule-carriers` | green |
+| `pack-version` | green |
+| `pack-identity` | green |
+| `payload` | green |
+| `eval-bundle` | green |
+| `goldens` | green |
+| `mutants` | green |
+| `fuzz-shell` | green |
+| `version-carriers` | green |
+| `skill-goldens` | green |
+| `review-loop` | green |
+| `telemetry` | green |
+| `drills` | green |
+| `ab` | green |
+| `ab-grade` | green |
+| `ab-run` | green |
+| `tools/github:actions-pinned` | green |
+| `tools/local-llm:runner-rails` | green |
+
+**`release-eval` is excluded**, and the reason is printed rather than the row silently dropped: a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file.
+
+## The A/B baseline this release ships against
+
+[`evals/ab/baseline.md`](https://github.com/sleepy-panda-srl/portulan/blob/v0.4.1/evals/ab/baseline.md), rendered from `evals/ab/baseline.json` — captured 2026-08-31T09:05:32.699Z at `a642d551eec6c146c67ef0acfe3f8ba535c5ce6e`, over a tree that was **not clean**.
+
+**Its figures are not repeated here.** They have one carrier and this is not it.
+
+## What this record does not establish
+
+- **A green says this record agrees with its own capture — never that the release is good.** Every line below is what the recipes returned at one commit, and a recipe's own green establishes only what that recipe's documentation says it establishes.
+- **The recipes were not run at the tag.** They ran at `a83966a56af78bd76a63c48afdce457aa3c5b0d5`, and this record is committed *in* the cut change — so the tagged tree is this commit plus whatever that change still adds after the capture, the record itself at minimum. A record cannot be captured at a commit that does not exist yet, and printing the one it was captured at is the only honest form.
+- **`release-eval` is excluded from the rows above**, because a capture cannot be accurate about the record it is inside. Its verdict for this release is the rail's own run on the pull request that carries this file.
+- **This record measures the Portulan repository's own build**, at the commit named above — never the workspace, project or package this release is installed into. Nothing here has looked at your tree.
+- **The tree was clean at capture**, so the commit named above is what was measured.
+- **The A/B baseline's figures are NOT restated here.** This record names which baseline the release ships against; the figures and everything that may not be concluded from them live in that register alone.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleepy_panda_srl/portulan",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Portulan — an agentic-engineering framework whose product is its files. The CLI wraps the file-based mechanics for hosts beyond Claude Code.",
   "license": "Apache-2.0",
   "type": "module",
@@ -16,6 +16,7 @@
     "spec/",
     "packs/",
     "evals/releases/",
+    "evals/ab/personas/",
     "README.md",
     "LICENSE",
     "NOTICE",
@@ -27,9 +28,12 @@
     "!cli/ab-run.mjs",
     "!cli/ab-grade.mjs",
     "!cli/local-routing.mjs",
+    "!cli/acquire-personas.mjs",
+    "!cli/normalize-personas.mjs",
     "!cli/warm.mjs",
     "!cli/payload.mjs",
-    "!cli/roster.mjs"
+    "!cli/roster.mjs",
+    "!cli/cache-stability.mjs"
   ],
   "repository": {
     "type": "git",

package/packs/rituals/checkpoints/README.md

@@ -18,8 +18,43 @@ sentence reads as a citation now and did not before.
 |---|---|
 | Skills | [`session-open`](skills/session-open/SKILL.md) · [`pre-commit`](skills/pre-commit/SKILL.md) · [`milestone-close`](skills/milestone-close/SKILL.md) |
 | Persona | [`supervisor`](personas/supervisor.md) — grades, never implements or merges |
+| Context admission | One ordinary fresh native Agent at a time per Claude session; see the scope below. |
 | Gate fragments | `commit-without-the-hooks` (gated) · `self-certify-a-checkpoint` (prohibited) |
 
+## Context admission
+
+Pack Definition 1.1 declares `contributes.contexts.max_concurrent_subagents: 1`.
+One supervisor at a time fits this sequential ritual; the three checkpoints can
+still open three or more contexts over the work's lifetime. The ledger reports
+actual contexts separately. Composed ritual counts tighten by minimum, independent
+of pack order. An unresolved pack beside a known cap refuses compilation because
+its contribution is unknown. No workspace `rituals` slot is introduced.
+
+Claude compilation writes project `env.CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS`, even
+without a gate policy. It applies across rituals within one session and excludes
+the parent. It governs **ordinary fresh native Agent admission**, not all child
+activity: completed-agent resumes and `/subtask` forks can exceed it; workflow
+agents and team teammates have independent limits. Higher-precedence settings,
+experimental flags and ultracode paths can bypass the guard. It bounds neither
+lifetime children nor requests, time or tokens. Other adapters report the count
+as not compiled; that is a limit of these adapters, not a claim about their hosts.
+
+The [native trace](../../../cli/fixtures/ritual-cap/README.md) tests Claude Code
+2.1.321 with synthetic loopback responses. The [current host documentation](https://code.claude.com/docs/en/sub-agents#concurrent-subagent-limit)
+was checked on 2026-11-11. Neither establishes a universal hard ceiling. The
+compiler composes caps with default restart advice in authored governing workspaces,
+independently of a gate policy. It owns this dedicated native settings artifact
+only while its complete payload, internal marker and digest remain intact; this
+is accidental-edit detection, not authentication. Foreign content, additions,
+links and old policy settings refuse before any output write. Formatting and key
+order may normalize. Exact legacy cap-only output can migrate after validating
+its shape and source/count consistency; it has no historical digest to authenticate
+plausible edits. Removing a cap leaves advice settings in place. Missing manifests
+and pointers do not adopt or remove those settings. The legacy internal cap-only
+path removes its own file when its cap disappears. Normal policy compilation
+retains its existing ownership. Removing both policy and cap while normal settings
+still carry a cap refuses in every mode and preserves the file for explicit resolution.
+
 ## The three checkpoints
 
 | Checkpoint | When | What it grades |

package/packs/rituals/checkpoints/pack.json

@@ -1,7 +1,7 @@
 {
   "portulan": {
-    "pack": "1.0",
-    "version": "0.3.0"
+    "pack": "1.1",
+    "version": "0.3.1"
   },
 
   "name": "checkpoints",
@@ -10,6 +10,7 @@
   "doc": "README.md",
 
   "contributes": {
+    "contexts": { "max_concurrent_subagents": 1 },
     "skills": ["skills/"],
 
     "personas": ["personas/supervisor.md"],

package/packs/tools/local-llm/README.md

@@ -1,6 +1,6 @@
 # `tools/local-llm` — Hybrid local-model execution under Portulan's rails
 
-A tool pack for **Hybrid AI Orchestration**, argued in Proposal [`0039`](../../../.portulan/proposals/0039-a-local-model-runs-without-the-host-floor-and-under-a-thinking-cap.md). It lets a frontier orchestrator session offload bounded code transformations, verify-gated red→green retries and a screen of a curated slot for duplicate files to a local OpenAI-compatible runtime (such as **LM Studio** on `http://127.0.0.1:1234/v1` or **Ollama** on `http://127.0.0.1:11434/v1`) at **zero API token cost** and with a **zero-floor prompt prefix**.
+A tool pack for **Hybrid AI Orchestration**, argued in Proposal [`0039`](../../../.portulan/proposals/0039-a-local-model-runs-without-the-host-floor-and-under-a-thinking-cap.md). It lets a frontier orchestrator session offload bounded code transformations, verify-gated red→green retries and a screen of a curated slot for duplicate files to a local OpenAI-compatible runtime (such as **LM Studio** on `http://127.0.0.1:1234/v1` or **Ollama** on `http://127.0.0.1:11434/v1`) with **no API tokens for the local model's own work** and a **zero-floor prompt prefix**. Each call to it is still a parent request, which re-reads the parent's context like any other (fact 1 below).
 
 Composed through a workspace's `packs` array as `tools/local-llm`.
 
@@ -19,24 +19,58 @@ this one.
 
 Proposal [`0036`](../../../.portulan/proposals/0036-what-a-host-loads-into-every-context-is-budgeted.md) budgets what a host loads into every fresh context, and Proposal [`0038`](../../../.portulan/proposals/0038-what-a-change-spends-is-measured.md) prices what a change spends across turns (`m_r × (F·T + g·T²/2)`). Together they expose two structural facts about hybrid local+cloud development:
 
-1. **Parent-context turns are quadratic; surgical local calls are flat and free.** Every tool call in a frontier session re-reads the entire session history. Offloading a 10-file comment cleanup, a test-fixture draft, or a file summary to a local 27B–31B model (`qwen/qwen3.8-27b`, `google/gemma-4-31b`) keeps intermediate turns and raw file reads out of the frontier context window completely.
+1. **Parent-context turns are quadratic, and a local call is one of them.** Every tool call in a frontier session re-reads the entire session history, the one that runs the runner included, so a local call costs nothing only in the local model's own tokens. A one-span `transform` that replaces one parent Edit saves the few hundred output tokens between writing the instruction and writing the code, and a miss, a call that keeps nothing or a kept edit the parent then touches up, adds a whole request. One run measured in [#583](https://github.com/sleepy-panda-srl/portulan/issues/583) missed 20% of its calls, against a break-even of 5–12% at a 236k-token context and the price ratios the skill's [*When it pays*](skills/delegate-local/SKILL.md#when-it-pays) states, and spent more parent tokens than it saved. A 10-file comment cleanup sent as ten `transform` calls, each its own tool call, is ten parent requests; a loop over the ten inside one Bash call is one, and that batching is not measured.
 2. **Local models choke on the host floor (`F`), not on the task.** A cloud subagent inherits a 44k–85k token prefix (`F`) subsidized by provider prompt caching. On local hardware, pre-filling 85k tokens into a 30B model's KV cache takes tens of seconds before the first token appears, whereas a **surgical prompt of a few hundred tokens** (built using [`cli/symbols.mjs`](../../../cli/symbols.mjs) spans) pre-filled in 0.85–1.9 seconds in proposal 0039's measurement.
 
 ## What the runner enforces in code
 
-[`runner/local-llm.mjs`](runner/local-llm.mjs) has **zero npm dependencies** (Node.js `>=20` built-in `fetch` and `node:child_process`) and enforces five rails:
+[`runner/local-llm.mjs`](runner/local-llm.mjs) has **zero npm dependencies** (Node.js `>=20` built-in HTTP, `fetch` and `node:child_process`) and enforces these rails:
 
 1. **Loopback-only by default.** Only `127.0.0.1`, `localhost`, and `[::1]` are permitted unless `--allow-remote` is explicitly passed, and a redirect is refused rather than followed off the machine. A proxy listening on loopback that forwards elsewhere is not visible to it, which is what the `local-llm-off-loopback` gate fragment records.
 2. **Zero-floor input budget (`--max-input-bytes`, default `32768`).** Refuses oversized prompts, and for `dedup` any file over the ceiling, before hitting the local server, directing the caller to scope with [`cli/symbols.mjs`](../../../cli/symbols.mjs) and `--lines` first. A value that is not a whole number is refused rather than read as no limit.
-3. **Explicit thinking cap (`--effort low`).** Passes `reasoning_effort: "low"` and `enable_thinking: false` by default so models whose chat templates default to `'xhigh'` thinking do not exhaust `max_tokens` inside `<think>` blocks.
+3. **Explicit thinking request (`--effort low`).** Passes `reasoning_effort: "low"` and `enable_thinking: false` by default. Backend/template support determines their effect; sending these fields is not a hard reasoning-token cap or a guarantee against output-budget exhaustion.
 4. **Verify-gated transforms (`transform --file <path> --verify <cmd>`, `--verify` required).** Applies the local model's edit, runs the verify command, retries with the end of its output on exit `1`, and **restores the original file byte-for-byte** unless the command reaches exit `0`. Any exit other than `0` or `1` — `2`, a missing command, a signal — is no verdict: the file is restored at once and the runner exits `2`. SIGINT, SIGTERM and SIGHUP, whether they arrive during the model call or while the verify command runs, stop the verify, restore the file and exit `2`. **The limits:** this is a rollback, not an atomic write — any other signal that ends the runner (SIGKILL and SIGQUIT among them) or a power loss between the edit and its verdict leaves the edit in place, and since the verify runs in a process group of its own, such a signal leaves the verify running too, even one sent to the runner's whole group. Signal handling is POSIX's: on Windows no SIGTERM arrives, and stopping the verify stops only its shell.
 5. **Role screening (`eval`).** Grades an installed local model against Portulan's own [`cli/comments.mjs`](../../../cli/comments.mjs), [`cli/doctor.mjs`](../../../cli/doctor.mjs), and [`cli/skill-goldens.mjs`](../../../cli/skill-goldens.mjs) predicates across `code`, `codify`, and `handoff` tasks. It takes **one sample per task and has no baseline arm**, so it is a screen, not the A/B run `0038` requires before a role is routed: a model that fails it is not routed, and passing it earns nothing. It needs `cli/` beside `packs/`, as the repository and the npm package carry it, exiting `2` where only `packs/` was installed. The A/B run is [*The A/B record*](#the-ab-record) below.
 
-A receipt prints a figure the server did not report as `?`, never as `0`, and `time=` is the model's request time, summed over a transform's attempts like `in=` and `out=`: the runner does not stream, so it cannot see a first token.
+Default loopback `/chat/completions` calls use a finite 15-minute deadline over the
+connection, headers and complete response body, with a 256-KiB response limit.
+This avoids Node fetch's five-minute header wait for non-streaming thinking models.
+`localhost` is pinned to 127.0.0.1 without DNS; `[::1]` remains available. Redirects
+are refused. Explicit injected fetches, authorized remote calls and embeddings
+retain their existing transport behavior and response capacity. A caller injecting
+its own transport can explicitly use the exported `localModelFetch`; the default
+repair cannot change a transport hidden inside an injection.
+
+A response ending with `finish_reason: length` is incomplete and is rejected before
+a replacement or verifier can run. Workspaces may enforce stronger completion or
+slice limits without changing earned routing or model profiles. The code extractor
+accepts valid whitespace/language fences, preserves inline backticks, and rejects
+an unfinished fence. Provenance: owner Marius, November 5, 2026; local thinking
+generations were interrupted by a client deadline and valid generated fences were
+misparsed. These repairs change transport/completion handling, not model quality.
+
+A receipt prints `reasoning=` as a subset of `out=` and `cached-in=` as a subset
+of `in=`; neither is added to its parent. Counts must be safe nonnegative integers
+and subsets cannot exceed their reported parent. Missing, invalid or unverifiable
+counts print `?`; reported zero stays zero. Transform attempts sum each measurement
+once, with an unknown attempt making that sum unknown. `time=` is summed model
+request time: the runner does not stream, so it cannot see a first token. The ledger
+accepts both historical and extended receipts and continues counting parent totals.
+Update runner and ledger together: older strict receipt readers do not understand
+the added fields.
+
+On `length`, the diagnostic distinguishes a measured all-reasoning response from
+other combined-budget exhaustion. A short input does not cap thinking. Inspect the
+backend's actual thinking controls and the task contract before another request;
+do not silently lower a pinned profile, retry identical work, or accept truncated
+output. An advertised reasoning-budget parameter needs a binding runtime test,
+not just a short successful response. Provenance: the November 6 Q06 investigation
+on [#578](https://github.com/sleepy-panda-srl/portulan/issues/578#issuecomment-6695966000),
+with accounting on [#571](https://github.com/sleepy-panda-srl/portulan/issues/571).
 
 ## Screening a slot for duplicates
 
-`dedup --dir <slot-dir> [--threshold 0.80] [--model <id>] [--max-input-bytes <per file>]` embeds every file directly in the directory whose name ends in `.md`, in any letter case, sorted by name, in one `POST /v1/embeddings` request to the loopback endpoint, with `text-embedding-nomic-embed-text-v1.5` (`PORTULAN_LOCAL_EMBED_MODEL`) unless `--model` names another; `--role` picks a chat model and is refused here. It prints each pair whose cosine similarity is at or above the threshold, highest first and ties in file-name order, one line each, `0.829 0036-….md 0038-….md`, and two lines on stderr: `dedup files=8 pairs=1 threshold=0.8`, followed by the shared receipt `OK mode=dedup model=… attempts=1 in=…t out=? time=…ms rate=? spend=$0.00`. The ledger reads the receipt as embedding work at $0.00; output tokens and rate are unreported, never zero.
+`dedup --dir <slot-dir> [--threshold 0.80] [--model <id>] [--max-input-bytes <per file>]` embeds every file directly in the directory whose name ends in `.md`, in any letter case, sorted by name, in one `POST /v1/embeddings` request to the loopback endpoint, with `text-embedding-nomic-embed-text-v1.5` (`PORTULAN_LOCAL_EMBED_MODEL`) unless `--model` names another; `--role` picks a chat model and is refused here. It prints each pair whose cosine similarity is at or above the threshold, highest first and ties in file-name order, one line each, `0.829 0036-….md 0038-….md`, and two lines on stderr: `dedup files=8 pairs=1 threshold=0.8`, followed by the shared receipt `OK mode=dedup model=… attempts=1 in=…t out=? time=…ms rate=? reasoning=? cached-in=? spend=$0.00`. The ledger reads the receipt as embedding work at $0.00; output tokens and rate are unreported, never zero.
 
 - **A slot's `README.md` is left out**, in any letter case: it describes the slot rather than being one of its entries, and would rank against every entry it summarizes. Subdirectories, symbolic links and other files are left out too.
 - **The ceiling is per file**, since the model embeds each input on its own, and it measures the file's text: its size on disk before it is read, and its UTF-8 bytes after. A file over it refuses the run with exit `1`, naming every such file with its size, and nothing is truncated. The request as a whole is not capped: a slot of `n` files sends at most `n` times the ceiling of file text, which JSON escaping can enlarge in the request body, to about six times for control characters. Raise `--max-input-bytes` only as far as the embedding model's context holds.
@@ -53,6 +87,12 @@ supported role by task shape, gate every edit with `--verify`, and read only the
 The acquired [record](../../../evals/ab/local-worker.md) supports `code` at low effort; shared `prose`
 is disabled because codify failed all five local turns. `summarize` defaults to that disabled role and
 refuses. An explicit `--model` without `--role` is an operator-selected candidate, not automatic routing.
+Delegate one complete function or a small test group per call, specify one observable change, prefer
+serial calls, and keep output to the selected replacement. On truncated output inspect the diagnostic and task contract; on transport
+failure inspect the transport; on verifier failure inspect code. For reasoning-only
+exhaustion, investigate backend/profile/task behavior before selecting another span.
+Do not lower an operator-pinned
+model/effort or bypass verification. This advice reduces failures, does not guarantee completion.
 
 ## The A/B record