@wildorder/nightshift 0.16.0 → 0.17.0

package/dist/run-program.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
-import { readFile, writeFile } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { defaultAgentRunner, defaultVerifyRunner, describeAgent, invokeAgent, resolveAgent, resolveAuthorAgent, resolveDeciderAgent, resolveRecoveryAgent, resolveReviewerAgent, tail, } from "./agent-runner.js";
@@ -18,9 +19,21 @@ import { defaultPrerequisiteRunner, runPreflight, } from "./preflight.js";
 import { restoreProgramsDir, snapshotProgramsDir } from "./programs-dir.js";
 import { buildPermitsContext } from "./permits.js";
 import { CouldNotStartError } from "./exit-codes.js";
+import { clippedInputPoint, createBriefBuilder, promptComponentSizePoints, } from "./prompt-telemetry.js";
+import { NOOP_RUN_RECORDER, readPriorRunId, RunRecorder, } from "./run-analytics.js";
+import { renderAnalyticsSection } from "./run-analytics-report.js";
 import { runReportPath } from "./report-path.js";
 import { AS_BUILT_PATH, runWholeProgramReview, renderWholeProgramReview, } from "./whole-program-review.js";
+import { runCausalAnalysis, renderCausalAnalysisSection, } from "./causal-analysis.js";
 const execFileAsync = promisify(execFile);
+/** The attempt-loop seat label to its stage (WS-02) — the role-derived
+ *  `STAGE_FOR_ROLE` default in `agent-runner.ts` cannot distinguish these
+ *  three, since `agent` drives both `implementer` and `informed-retry`. */
+const STAGE_FOR_SEAT = {
+    implementer: "implementer",
+    recovery: "recovery",
+    "informed retry": "informed-retry",
+};
 /** Matches every wording git uses to report an empty commit attempt. */
 const NOTHING_TO_COMMIT = /nothing to commit|nothing added to commit|no changes added to commit/u;
 /**
@@ -224,6 +237,38 @@ export const defaultGitOps = {
         await execFileAsync("git", ["update-ref", ref, commit], { cwd });
     },
 };
+/**
+ * Fail-open span wrapper for a runner-owned git-and-persistence operation
+ * (WS-02): opens a span, awaits `fn`, closes it `success` on completion or
+ * `interrupted` on a throw (re-thrown unchanged, via `finally`) — this
+ * module's stage functions already guard the *run* error a wrapped call can
+ * raise, so this wrapper only ever adds an observation, never changes what
+ * the caller sees. `evidenceFor`, when given, derives an evidence reference
+ * from the successful result (e.g. a commit sha) rather than every call
+ * needing to know the schema's evidence-kind vocabulary itself. Shared by
+ * `run-program.ts`'s own git/manifest/ledger call sites and imported by
+ * `author.ts` and `decider-review.ts` for theirs, so every runner-owned
+ * commit, large diff, and manifest/ledger persist is instrumented through
+ * one implementation.
+ */
+export async function timed(recorder, dims, fn, evidenceFor) {
+    const span = recorder.span(dims);
+    let result;
+    try {
+        result = await fn();
+    }
+    catch (error) {
+        span.close({ outcome: "interrupted" });
+        throw error;
+    }
+    const evidence = evidenceFor?.(result);
+    span.close({ outcome: "success", ...(evidence && evidence.length > 0 ? { evidence } : {}) });
+    return result;
+}
+/** `timed`'s `evidenceFor` for a git commit call: a defined, non-empty sha becomes a `commit` evidence ref; "nothing to commit" (`undefined`) carries none. */
+export function commitEvidence(sha) {
+    return sha === undefined ? undefined : [{ kind: "commit", locality: "local", ref: sha }];
+}
 /**
  * Ledger decisions for one workstream, projected into its brief. A
  * human-decided record is binding — the implementer is told to build that
@@ -311,6 +356,13 @@ function shellPolicySection(shellPolicy) {
         "",
     ];
 }
+/**
+ * Builds the implementer's brief, byte-for-byte identical to the plain
+ * `array.join("\n")` this produced before WS-03 — but through a
+ * `BriefBuilder` so every line is also classified into an SC-07 prompt
+ * component, with `components` summing exactly to the joined brief's byte
+ * length.
+ */
 function implementerBrief(manifest, workstream, spec, ledger, shellPolicy, priorFailure, priorDiagnosis) {
     const roster = manifest.workstreams
         .map((entry) => {
@@ -321,64 +373,46 @@ function implementerBrief(manifest, workstream, spec, ledger, shellPolicy, prior
     const relevantDecisions = ledger.decisions.filter((record) => record.workstream === workstream.id &&
         (record.status === "human-decided" || record.status === "ratified"));
     const relevantFindings = ledger.findings.filter((record) => record.workstream === workstream.id && record.status === "human-decided");
-    return [
-        `# Workstream ${workstream.id}: ${workstream.name}`,
-        "",
-        `Program: ${manifest.program.id} — ${manifest.program.name}`,
-        "",
-        "You are implementing exactly one workstream of a larger program. The",
-        "full roster, so you know what exists and do not rebuild another",
-        "workstream's work (conform only to your declared dependencies):",
-        "",
-        roster,
-        "",
-        ...decisionsRuledOnSection(relevantDecisions),
-        ...findingsRuledOnSection(relevantFindings),
-        ...(priorFailure
-            ? [
-                "## Previous attempt failed",
-                "",
-                "A previous attempt at this workstream failed. The verify output:",
-                "",
-                priorFailure,
-                "",
-                ...(priorDiagnosis
-                    ? [
-                        "An independent reviewer read the failing tree before you were",
-                        "spawned. Its diagnosis:",
-                        "",
-                        priorDiagnosis,
-                        "",
-                        "The tests in the tree were written by the failed attempt, not",
-                        "by a human. When the diagnosis says an assertion is wrong,",
-                        "rewrite or delete that assertion rather than bending the",
-                        "implementation to satisfy it — the spec, not the failing",
-                        "test, is the contract.",
-                        "",
-                    ]
-                    : []),
-                "Start from the diagnosis; the working tree may already contain",
-                "partial work from that attempt.",
-                "",
-            ]
-            : []),
-        "## Specification",
-        "",
-        spec.trim(),
-        "",
-        "## Rules",
-        "",
-        "- Never commit; the runner owns commits and commits only verified work.",
-        "- Follow the repository's AGENTS.md if present.",
-        "- Run the project's checks yourself as you work; the runner verifies",
-        "  independently afterwards and your claim of success is never trusted",
-        "  without it.",
-        "",
-        ...shellPolicySection(shellPolicy),
-        decisionContract(),
-        "",
-        summaryContract(),
-    ].join("\n");
+    const builder = createBriefBuilder();
+    builder.push("framing", `# Workstream ${workstream.id}: ${workstream.name}`, "");
+    builder.push("program-narrative", `Program: ${manifest.program.id} — ${manifest.program.name}`);
+    builder.push("framing", "", "You are implementing exactly one workstream of a larger program. The", "full roster, so you know what exists and do not rebuild another", "workstream's work (conform only to your declared dependencies):", "");
+    builder.push("roster", roster);
+    builder.push("framing", "");
+    builder.push("ledger-rulings", ...decisionsRuledOnSection(relevantDecisions), ...findingsRuledOnSection(relevantFindings));
+    builder.push("prior-diagnostics", ...(priorFailure
+        ? [
+            "## Previous attempt failed",
+            "",
+            "A previous attempt at this workstream failed. The verify output:",
+            "",
+            priorFailure,
+            "",
+            ...(priorDiagnosis
+                ? [
+                    "An independent reviewer read the failing tree before you were",
+                    "spawned. Its diagnosis:",
+                    "",
+                    priorDiagnosis,
+                    "",
+                    "The tests in the tree were written by the failed attempt, not",
+                    "by a human. When the diagnosis says an assertion is wrong,",
+                    "rewrite or delete that assertion rather than bending the",
+                    "implementation to satisfy it — the spec, not the failing",
+                    "test, is the contract.",
+                    "",
+                ]
+                : []),
+            "Start from the diagnosis; the working tree may already contain",
+            "partial work from that attempt.",
+            "",
+        ]
+        : []));
+    builder.push("framing", "## Specification", "");
+    builder.push("workstream-spec", spec.trim());
+    builder.push("framing", "", "## Rules", "", "- Never commit; the runner owns commits and commits only verified work.", "- Follow the repository's AGENTS.md if present.", "- Run the project's checks yourself as you work; the runner verifies", "  independently afterwards and your claim of success is never trusted", "  without it.", "");
+    builder.push("runner-instructions", ...shellPolicySection(shellPolicy), decisionContract(), "", summaryContract());
+    return { brief: builder.join(), components: builder.components() };
 }
 /** Known `docs/programs/` artifact suffixes, longest-specific first is not required — each is checked independently. */
 const DOCS_PROGRAMS_SUFFIXES = [
@@ -386,6 +420,7 @@ const DOCS_PROGRAMS_SUFFIXES = [
     "-manifest.json",
     "-run-report.md",
     "-decisions.jsonl",
+    "-run-analytics.json",
 ];
 /**
  * The program id a planning-artifact path belongs to, or undefined when the
@@ -527,6 +562,46 @@ async function runProgramWith(options, permits) {
     const git = options.git ?? defaultGitOps;
     const log = options.log ?? ((line) => console.log(line));
     const now = options.now ?? (() => new Date());
+    const monotonic = options.monotonic ?? (() => performance.now());
+    // Read before anything durable happens (a plain read, safe before the
+    // could-not-start gate): a prior finalized artifact's run id becomes this
+    // run's `parentRunId`, so a resumed invocation carries explicit lineage
+    // instead of silently blending its elapsed time with a prior attempt
+    // (SC-14). Created here — before the gate — so pre-gate stages (preflight,
+    // baseline verification) can be buffered in memory; it stays disarmed,
+    // writing nothing durable, until `arm()` is called below.
+    const priorRunId = await readPriorRunId(root, options.programId);
+    const recorder = options.recorder ??
+        RunRecorder.create({
+            clock: { now, monotonic },
+            root,
+            programId: options.programId,
+            ...(priorRunId === undefined ? {} : { parentRunId: priorRunId }),
+            log,
+        });
+    // The run-level reference span (WS-01's own; the fourth reference span
+    // alongside the three named seams — see the WS-01/WS-02 emission-boundary
+    // decision). Opened here, at the very first monotonic tick this function
+    // can observe — before preflight, before baseline verification, before the
+    // could-not-start gate — so it covers the true run start, not merely the
+    // portion after arming. `span()` buffers in memory regardless of arm
+    // state, so a could-not-start throw before `arm()` simply discards it,
+    // same as every other pre-gate observation (SC-02). Its bucket is
+    // `unattributed` by construction — see STAGE_BUCKET's doc comment.
+    //
+    // It is deliberately never closed on the normal-completion path (see the
+    // `report-commit` span below for why): the reconciled numbers stop at the
+    // pre-render snapshot (SC-03, SC-14), but the run's true end is the report
+    // commit, and closing this span before the report is written and
+    // committed would stamp an end that has not happened — exactly the defect
+    // an earlier version of
+    // this design had, closing here and silently excluding the trailing write
+    // and commit from every span instead of from just this one. Leaving it
+    // open is not a special case for that fix: it is the same "true end not
+    // observed" semantics the schema already uses for a crashed run, applied
+    // honestly to the one boundary this recorder can never observe closing
+    // even on success.
+    const runSpan = recorder.span({ stage: "run" });
     let manifest;
     try {
         manifest = await loadManifest(root, options.programId);
@@ -654,8 +729,10 @@ async function runProgramWith(options, permits) {
     // The run's own identity — distinct from runStartCommit, which two
     // invocations can share (the same commit) or lack entirely (no
     // repository). Stamped on each `prerequisite-verified` ledger event so the
-    // ledger records which run verified a prerequisite.
-    const runId = now().toISOString();
+    // ledger records which run verified a prerequisite. Promoted from the
+    // recorder's identity (SC-14) rather than minted separately, so the ledger
+    // and the analytics artifact always carry the same run id.
+    const runId = recorder.runId;
     // Preflight: every *pending* prerequisite's verifyCommand executes here —
     // before baseline verification and before any agent spawns (SC-03). This
     // mutates manifest.prerequisites in memory (pending -> satisfied on a met
@@ -670,6 +747,7 @@ async function runProgramWith(options, permits) {
         runId,
         runStartCommit,
         log,
+        recorder,
     });
     // Baseline verification: the verify suite on the untouched tree, before
     // the first agent is spawned. A red baseline on a fresh start means the
@@ -690,7 +768,7 @@ async function runProgramWith(options, permits) {
     let baselineFingerprint;
     if (Object.keys(config.verify).length > 0) {
         log("baseline: running the verify commands on the untouched tree");
-        const baselineFailure = await verifyAttempt(config, verifyRunner, root, 0);
+        const baselineFailure = await verifyAttempt(config, verifyRunner, root, 0, recorder, "baseline-verification", { programId: options.programId, phase: "baseline" });
         if (baselineFailure === undefined) {
             log("baseline: clean");
         }
@@ -715,10 +793,14 @@ async function runProgramWith(options, permits) {
     // makes the only crash-between-writes residue a harmless idempotent
     // duplicate event, never a lost one. A could-not-start throw above has
     // already unwound the process before reaching here, so an exit-3 run
-    // mutates neither the manifest nor the ledger.
+    // mutates neither the manifest nor the ledger — nor, from this line on, the
+    // analytics artifact: `arm()` enables the recorder's durable writes, so a
+    // could-not-start run leaves no working log and no finalized artifact
+    // (SC-02).
+    recorder.arm();
     if (preflight.events.length > 0) {
-        await appendLedgerEvents(root, options.programId, preflight.events);
-        await saveManifest(root, options.programId, manifest, { log });
+        await timed(recorder, { stage: "ledger-persist" }, () => appendLedgerEvents(root, options.programId, preflight.events));
+        await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
     }
     // Subject ids already sent to the decider this run — shared across the
     // authoring and build stages (a run is one process) and across the
@@ -732,671 +814,870 @@ async function runProgramWith(options, permits) {
     // report's "this run" triage ratio — see decider-review.ts's doc comment
     // on `triaged`.
     const triaged = new Set();
-    // Authoring runs before building: every workstream whose spec is missing
-    // gets one, in dependency order, before anything is implemented. It
-    // reloads the manifest afterward because authoring may have merged
-    // discovered dependency edges or parked workstreams it could not author.
-    const authorResult = await authorProgram({
-        cwd: options.cwd,
-        programId: options.programId,
-        config,
-        agentRunner,
-        permits,
-        git,
-        log,
-        now,
-        reviewed,
-        triaged,
-    });
-    manifest = await loadManifest(root, options.programId);
-    // Loaded once so every brief in this run projects the same picture of
-    // human-decided and ratified choices; decisions this run itself journals
-    // are picked up fresh by `readDecisionLedger` at the end, for escalations.
-    const ledgerAtStart = await readDecisionLedger(root, options.programId);
-    const ordered = stableTopologicalOrder(manifest.workstreams);
-    const results = [];
-    // Every workstream whose spec authoring failed or parked. Seeds `blocked`
-    // below (their briefs would be missing a producer's spec) and also guards
-    // the awaiting_human branch in the build loop: an authoring failure must
-    // never be repainted as a planned wait — see that branch's own comment.
-    const authoringFailed = new Set(authorResult.results
-        .filter((entry) => entry.outcome.status === "failed" || entry.outcome.status === "parked")
-        .map((entry) => entry.id));
-    const blocked = new Set(authoringFailed);
-    // The awaiting cone: every workstream directly referencing an unmet
-    // prerequisite, plus everything transitively downstream of one — the same
-    // downstream-cone machinery failure isolation uses, with the semantics
-    // inverted (no agent spawned, no retry, no diagnosis; see the build loop).
-    const unmetPrerequisiteIds = new Set(preflight.checks.filter((check) => !check.met).map((check) => check.id));
-    const directlyAwaiting = new Set(manifest.workstreams
-        .filter((workstream) => workstream.prerequisites.some((id) => unmetPrerequisiteIds.has(id)))
-        .map((workstream) => workstream.id));
-    const awaitingCone = new Set([
-        ...directlyAwaiting,
-        ...downstreamCone(manifest.workstreams, [...directlyAwaiting]),
-    ]);
-    // Set when a workstream's verify failure reproduced the pre-run baseline:
-    // the environment is broken, so every remaining workstream parks instead
-    // of spending its budget on the same crash.
-    let environmentalHalt = false;
-    for (const workstream of ordered) {
-        if (workstream.status === "complete") {
-            results.push({
-                id: workstream.id,
-                name: workstream.name,
-                outcome: { status: "skipped", reason: "already complete" },
-                decisionIds: [],
-                decisionErrors: [],
-            });
-            continue;
-        }
-        if (environmentalHalt) {
-            workstream.status = "parked";
-            results.push({
-                id: workstream.id,
-                name: workstream.name,
-                outcome: {
-                    status: "parked",
-                    reason: "the run halted on an environmental verification failure; parked, not attempted",
-                },
-                decisionIds: [],
-                decisionErrors: [],
-            });
-            continue;
-        }
-        // Authoring failures take precedence over awaiting: a workstream whose
-        // spec authoring failed or parked must fall through to the `blocked`
-        // branch below and render as the genuine failure it is, never be
-        // repainted `awaiting_human` — an authoring failure has no other
-        // representation in `results` than that branch's own `parked` result, so
-        // rewriting it here would erase the only trace of it and the run would
-        // wrongly look like a pure intermission. A workstream that is merely
-        // downstream of a *build* failure and also in the awaiting cone still
-        // resolves to awaiting_human here; that is safe because the build
-        // failure self-reports `failed` in `results`, so the run is classified a
-        // partial regardless (see the intermission classification below).
-        if (awaitingCone.has(workstream.id) && !authoringFailed.has(workstream.id)) {
-            workstream.status = "awaiting_human";
-            await saveManifest(root, options.programId, manifest, { log });
-            const ownUnmet = workstream.prerequisites.filter((id) => unmetPrerequisiteIds.has(id));
-            const reason = ownUnmet.length > 0
-                ? `waiting on human prerequisite ${ownUnmet.join(", ")}; not attempted.`
-                : "an upstream workstream is awaiting a human prerequisite; not attempted.";
-            results.push({
-                id: workstream.id,
-                name: workstream.name,
-                outcome: { status: "awaiting_human", reason },
-                decisionIds: [],
-                decisionErrors: [],
-            });
-            continue;
-        }
-        if (blocked.has(workstream.id)) {
-            workstream.status = "parked";
-            results.push({
-                id: workstream.id,
-                name: workstream.name,
-                outcome: {
-                    status: "parked",
-                    reason: "an upstream dependency failed; parked, not attempted",
-                },
-                decisionIds: [],
-                decisionErrors: [],
-            });
-            continue;
-        }
-        const result = await runWorkstream(workstream);
-        results.push(result);
-        if (result.environmental === true)
-            environmentalHalt = true;
-        if (result.outcome.status === "failed") {
-            // Failure isolation: park the downstream cone, keep building the rest.
-            for (const id of downstreamCone(manifest.workstreams, [workstream.id])) {
-                blocked.add(id);
-            }
-        }
-    }
-    const complete = results.every((result) => result.outcome.status === "complete" ||
-        result.outcome.status === "skipped");
-    const anyAwaiting = results.some((result) => result.outcome.status === "awaiting_human");
-    const anyFailedOrParked = results.some((result) => result.outcome.status === "failed" || result.outcome.status === "parked");
-    // Author-stage failures are counted too: an authoring failure the awaiting
-    // guard did NOT catch — e.g. a workstream that authored fine but sits
-    // downstream of an authoring failure — must still sink the intermission.
-    // Same set that seeded `blocked`/guarded the awaiting branch above;
-    // classifying on it here as well makes "any genuine failure => ordinary
-    // partial" true independent of how the cone painted it.
-    const anyAuthoringFailure = authorResult.results.some((entry) => entry.outcome.status === "failed" || entry.outcome.status === "parked");
-    // A planned intermission: nothing failed anywhere (build or authoring), at
-    // least one workstream is waiting on a human, and not everything built. A
-    // genuine failure makes it an ordinary partial instead — the human should
-    // read a diagnosis, not a checklist.
-    const intermission = !complete && anyAwaiting && !anyFailedOrParked && !anyAuthoringFailure;
-    manifest.program.status = complete
-        ? "complete"
-        : intermission
-            ? "awaiting_human"
-            : "partial";
-    await saveManifest(root, options.programId, manifest, { log });
-    const wholeProgram = await runWholeProgramStage({
-        root,
-        programId: options.programId,
-        manifest,
-        config,
-        agentRunner,
-        permits,
-        git,
-        isRepository,
-        results,
-        authorResult,
-        runStartCommit,
-        decider,
-        reviewed,
-        triaged,
-        now,
-        log,
-    });
-    const ledger = await readDecisionLedger(root, options.programId);
-    const escalations = escalatedRecords(ledger);
-    const reportPath = runReportPath(root, options.programId);
-    // Every workstream verdict, `complete`, and the exit-code mapping are
-    // already settled above; writing and committing the report is bookkeeping
-    // that must not be able to reject `runProgram` after the fact (SC-05,
-    // SC-12) — a full disk or an EISDIR here is a logged line, not a thrown
-    // run.
+    // Everything from here through the run's return is wrapped in one more
+    // level of function nesting so a thrown crash still finalizes the
+    // analytics artifact before control leaves (SC-02) without pulling any of
+    // this region's locals out of scope of the stage functions declared after
+    // its `return` (they are hoisted declarations inside `runProgramBody`,
+    // exactly as they were inside `runProgramWith` before this wrapping).
+    // `finalize()` is fail-open and cannot itself throw or mask the original
+    // error. On the normal path the artifact is finalized explicitly, below,
+    // before the report is written and committed, so it rides into the same
+    // `docs/programs` commit as the report; this catch exists only for the
+    // crash path.
     try {
-        await writeFile(reportPath, 
-        // `triaged` is the run-local set of subject ids the decider actually
-        // ruled on this run (built up across the authoring, build, and
-        // whole-program stages, see its declaration above) — exactly the
-        // `triagedThisRun` basis the "this run" triage ratio needs, since the
-        // projected ledger carries no run identifier of its own. It excludes
-        // ids that were merely sent but whose invocation failed or returned no
-        // valid verdict.
-        renderRunReport(manifest, results, ledger, triaged, authorResult, now(), wholeProgram, preflight, options.resumeCommand, manifestMergeCount(root, options.programId) > mergesAtStart), "utf8");
-        if (isRepository) {
-            await git.commitPaths(root, `nightshift(${options.programId}): run report and decision ledger`, ["docs/programs"]);
-        }
+        return await runProgramBody();
     }
     catch (error) {
-        log(`run report: could not write or commit ${reportPath}: ${error.message}`);
-    }
-    log(`run report: ${reportPath}`);
-    return {
-        programId: options.programId,
-        complete,
-        intermission,
-        workstreams: results,
-        escalations,
-        reportPath,
-        wholeProgramReview: wholeProgram,
-    };
-    async function runWorkstream(workstream) {
-        const base = {
-            id: workstream.id,
-            name: workstream.name,
-            outcome: { status: "failed", reason: "not attempted" },
-            decisionIds: [],
-            decisionErrors: [],
-            buildAgentCommand: describeAgent(agent),
-        };
-        /** Every build-role spawn's transcript, for the report's per-workstream
-         *  Commands subsection (WS-02). Reviewer/decider spawns are excluded. */
-        function recordTranscript(transcript) {
-            if (transcript)
-                (base.transcripts ??= []).push(transcript);
-        }
-        /** Names the JSONL file under build-logs/<programId>/, distinctly per spawn label. */
-        function transcriptSink(label) {
-            return { root, programId: options.programId, label: `${workstream.id}-${label}`, log };
-        }
-        let spec;
-        try {
-            spec = await readFile(join(root, workstream.taskFile), "utf8");
-        }
-        catch {
-            base.outcome = {
-                status: "parked",
-                reason: `spec not found at ${workstream.taskFile}`,
-            };
-            return base;
-        }
-        workstream.status = "in_progress";
-        await saveManifest(root, options.programId, manifest, { log });
-        const baseCommit = isRepository
-            ? await git.currentCommit(root)
-            : undefined;
-        let priorFailure;
-        let priorDiagnosis;
-        let implementerFingerprint;
-        const attempts = [
-            { agent, label: "implementer", role: "agent" },
-        ];
-        if (recovery && !recovery.borrowedImplementer) {
-            attempts.push({ agent: recovery.agent, label: "recovery", role: "recoveryAgent" });
-            // The third seat exists only when a reviewer can inform it. An
-            // uninformed retry has already been spent (recovery); running the
-            // roster again blind is a coin flip the ledger should hear about
-            // instead. Alternation is deliberate — the implementer returns with
-            // the reviewer's diagnosis in hand, a composition neither prior
-            // attempt had.
-            if (reviewer)
-                attempts.push({ agent, label: "informed retry", role: "agent" });
-        }
-        for (const [index, attempt] of attempts.entries()) {
-            log(`${workstream.id} ${workstream.name}: ${attempt.label} attempt`);
-            const brief = implementerBrief(manifest, workstream, spec, ledgerAtStart, config.permits?.policy, priorFailure, priorDiagnosis);
-            let invocation;
-            let spawnFailure;
-            try {
-                invocation = await invokeAgent(agentRunner, attempt.agent, brief, root, permits, attempt.role, transcriptSink(attempt.label.replaceAll(" ", "-")));
-            }
-            catch (error) {
-                // The agent process never started — its command is wrong, missing,
-                // or unrunnable. Nothing was built; this is the captured
-                // silent-exit incident (SC-12). Make it a diagnosed failure via the
-                // existing retry/park machinery below, never a process exit.
-                spawnFailure =
-                    `the ${attempt.label} agent could not be spawned: ` +
-                        `${error.message}. The configured command ` +
-                        `\`${describeAgent(attempt.agent)}\` did not start, so nothing was built.`;
-                invocation = { exitCode: 1, output: "" };
-            }
-            recordTranscript(invocation.transcript);
-            const summary = resolveSummary(invocation.output);
-            base.summary = summary.text;
-            await journalDenials(workstream.id, attempt.label, invocation.transcript, summary.needsPermission);
-            const parsed = extractDecisions(invocation.output);
-            base.decisionErrors.push(...parsed.errors);
-            await journalDecisions(workstream, parsed.decisions, baseCommit);
-            base.decisionIds = parsed.decisions.map((decision) => decisionFingerprint(workstream.id, decision));
-            let failure = await verifyAttempt(config, verifyRunner, root, invocation.exitCode);
-            // Deterministic protocol failures the runner can see without a model:
-            // no diagnosis is spent on them, because no read of the tree could add
-            // anything to what the runner already knows.
-            let deterministicFailure = false;
-            // A spawn failure takes precedence over whatever verifyAttempt saw
-            // (the untouched tree can verify green on its own) — no reviewer
-            // diagnosis is spent reading an empty diff.
-            if (spawnFailure !== undefined) {
-                failure = spawnFailure;
-                deterministicFailure = true;
-            }
-            // A brief that never reached the agent's stdin means the process
-            // crashed at startup — whatever it printed was not an answer to the
-            // brief, even when it exited 0.
-            if (failure === undefined && invocation.inputError !== undefined) {
-                failure =
-                    `the brief could not be delivered to the agent's stdin ` +
-                        `(${invocation.inputError}) — the agent likely crashed at startup, ` +
-                        `so its reply answered nothing.`;
-                deterministicFailure = true;
-            }
-            // A green verify over an unchanged tree is just the baseline passing
-            // again, not built work. Without this, an agent that crashes at
-            // startup while exiting 0 (or replies without working) sweeps only
-            // the runner's own in_progress manifest write into a metadata-only
-            // commit and walks through the gate as "complete". A reply that never
-            // produces the work is a protocol failure, not an empty result.
-            if (failure === undefined && isRepository) {
-                const dirty = await git.dirtyPaths(root);
-                const meaningful = dirty.some((path) => !path.replaceAll("\\", "/").startsWith("docs/programs/"));
-                if (!meaningful) {
-                    failure =
-                        "the attempt verified green but changed nothing outside " +
-                            "docs/programs/ — nothing was built, and the passing verify was " +
-                            "the untouched baseline. A no-op attempt is a protocol failure " +
-                            "(the agent may have crashed at startup or replied without " +
-                            "working), not a completed workstream.";
-                    deterministicFailure = true;
-                }
-            }
-            if (failure === undefined) {
-                let c0;
-                if (isRepository) {
-                    // Unlike the authoring, run-report, and replay commits, this one
-                    // stays a whole-tree sweep: an implementing agent touches whatever
-                    // files the work required, and that set is exactly what the
-                    // runner cannot know in advance. c0 is the green anchor the test
-                    // critique's fix loop resets to on a failing fix (SC-07).
-                    c0 = await git.commitAll(root, `nightshift(${options.programId}): ${workstream.id} ${workstream.name}`);
-                }
-                const critique = isRepository && c0 !== undefined
-                    ? await runTestCritique({
-                        root,
-                        manifest,
-                        workstream,
-                        spec,
-                        config,
-                        agentRunner,
-                        permits,
-                        verifyRunner,
-                        git,
-                        reviewer,
-                        agent,
-                        baseCommit,
-                        greenCommit: c0,
-                        now,
-                        log,
-                        transcriptSink,
-                    })
-                    : undefined;
-                // The manifest's single commit field records the workstream's final
-                // verified state — after any kept fix, that is the fix commit, not
-                // the earlier green one.
-                let finalCommit = critique?.finalCommit ?? c0;
-                if (critique && critique.stageErrors.length > 0) {
-                    (base.stageErrors ??= []).push(...critique.stageErrors);
-                }
-                for (const transcript of critique?.transcripts ?? [])
-                    recordTranscript(transcript);
-                // Findings anchor to c0 (the green, pre-critique commit) — the
-                // honest rollback point — while the decider below diffs from
-                // baseCommit (pre-workstream), so it sees the whole workstream.
-                const findingEvents = findingsToLedgerEvents({
-                    workstreamId: workstream.id,
-                    findings: (critique?.outcome.open ?? []).filter(hasRoutableEvidence),
-                    ...(c0 === undefined ? {} : { baseCommit: c0 }),
-                    now,
+        const finalizeStart = monotonic();
+        await recorder.finalize();
+        recorder.point({
+            kind: "analytics-overhead",
+            coverage: "observed",
+            value: monotonic() - finalizeStart,
+            unit: "ms",
+            label: "finalize",
+        });
+        throw error;
+    }
+    async function runProgramBody() {
+        // Authoring runs before building: every workstream whose spec is missing
+        // gets one, in dependency order, before anything is implemented. It
+        // reloads the manifest afterward because authoring may have merged
+        // discovered dependency edges or parked workstreams it could not author.
+        const authorResult = await authorProgram({
+            cwd: options.cwd,
+            programId: options.programId,
+            config,
+            agentRunner,
+            permits,
+            git,
+            log,
+            now,
+            reviewed,
+            triaged,
+            recorder,
+        });
+        manifest = await loadManifest(root, options.programId);
+        // Loaded once so every brief in this run projects the same picture of
+        // human-decided and ratified choices; decisions this run itself journals
+        // are picked up fresh by `readDecisionLedger` at the end, for escalations.
+        const ledgerAtStart = await readDecisionLedger(root, options.programId);
+        const ordered = stableTopologicalOrder(manifest.workstreams);
+        const results = [];
+        // Every workstream whose spec authoring failed or parked. Seeds `blocked`
+        // below (their briefs would be missing a producer's spec) and also guards
+        // the awaiting_human branch in the build loop: an authoring failure must
+        // never be repainted as a planned wait — see that branch's own comment.
+        const authoringFailed = new Set(authorResult.results
+            .filter((entry) => entry.outcome.status === "failed" || entry.outcome.status === "parked")
+            .map((entry) => entry.id));
+        const blocked = new Set(authoringFailed);
+        // The awaiting cone: every workstream directly referencing an unmet
+        // prerequisite, plus everything transitively downstream of one — the same
+        // downstream-cone machinery failure isolation uses, with the semantics
+        // inverted (no agent spawned, no retry, no diagnosis; see the build loop).
+        const unmetPrerequisiteIds = new Set(preflight.checks.filter((check) => !check.met).map((check) => check.id));
+        const directlyAwaiting = new Set(manifest.workstreams
+            .filter((workstream) => workstream.prerequisites.some((id) => unmetPrerequisiteIds.has(id)))
+            .map((workstream) => workstream.id));
+        const awaitingCone = new Set([
+            ...directlyAwaiting,
+            ...downstreamCone(manifest.workstreams, [...directlyAwaiting]),
+        ]);
+        // Set when a workstream's verify failure reproduced the pre-run baseline:
+        // the environment is broken, so every remaining workstream parks instead
+        // of spending its budget on the same crash.
+        let environmentalHalt = false;
+        for (const workstream of ordered) {
+            if (workstream.status === "complete") {
+                results.push({
+                    id: workstream.id,
+                    name: workstream.name,
+                    outcome: { status: "skipped", reason: "already complete" },
+                    decisionIds: [],
+                    decisionErrors: [],
                 });
-                await appendLedgerEvents(root, options.programId, findingEvents);
-                // The commit's own sha cannot be part of the tree it commits, so the
-                // manifest records it only now — swept forward into whatever commits
-                // next. Replay reads the manifest's current state, not the commit
-                // that last touched it, so this lag is harmless.
-                workstream.status = "complete";
-                if (finalCommit !== undefined)
-                    workstream.commit = finalCommit;
-                await saveManifest(root, options.programId, manifest, { log });
-                {
-                    const spawnErrors = await reviewWorkstreamDecisions(workstream.id, parsed.decisions, baseCommit);
-                    if (spawnErrors.length > 0)
-                        (base.stageErrors ??= []).push(...spawnErrors);
-                }
-                // Findings are triaged against the pre-workstream diff (baseCommit),
-                // the same one the decider reviews decisions against — c0/finalCommit
-                // are the fix loop's own rollback anchors, a different thing.
-                {
-                    const spawnErrors = await reviewWorkstreamFindings(workstream.id, findingEvents, baseCommit);
-                    if (spawnErrors.length > 0)
-                        (base.stageErrors ??= []).push(...spawnErrors);
-                }
-                // A fix-now triage drives exactly one bounded fix attempt, here —
-                // after the triage that produced it, before the run advances. Only
-                // reachable when there is a green commit to attempt from and a
-                // decider that could have produced a fix-now verdict in the first
-                // place (SC-13).
-                if (finalCommit !== undefined && decider) {
-                    const driven = await driveFixNowFindings(workstream, spec, critique?.outcome.open ?? [], finalCommit, transcriptSink("fix-now-fix"));
-                    recordTranscript(driven.transcript);
-                    if (driven.spawnError !== undefined) {
-                        (base.stageErrors ??= []).push(driven.spawnError);
-                    }
-                    if (driven.commit !== finalCommit) {
-                        finalCommit = driven.commit;
-                        workstream.commit = finalCommit;
-                        await saveManifest(root, options.programId, manifest, { log });
-                    }
-                }
-                if (critique)
-                    base.testCritique = critique.outcome;
-                base.testCritiqueDiffClipped = critique?.diffClipped ?? false;
-                base.outcome = {
-                    status: "complete",
-                    ...(finalCommit === undefined ? {} : { commit: finalCommit }),
-                };
-                return base;
-            }
-            priorFailure = failure;
-            log(`${workstream.id}: ${attempt.label} attempt failed — ${failure}`);
-            // A failure identical to the pre-run baseline (up to counts and
-            // timings) was there before any workstream ran: environmental, not
-            // this workstream's work. No retry or diagnosis is spent on it, and
-            // the caller halts the run — every later workstream would be charged
-            // for the same broken environment. Workstreams resumed with their own
-            // leftover failure in the tree are exempt (see resumedIds).
-            if (baselineFingerprint !== undefined &&
-                !resumedIds.has(workstream.id) &&
-                failureFingerprint(failure) === baselineFingerprint) {
-                workstream.status = "failed";
-                await saveManifest(root, options.programId, manifest, { log });
-                {
-                    const spawnErrors = await reviewWorkstreamDecisions(workstream.id, parsed.decisions, baseCommit);
-                    if (spawnErrors.length > 0)
-                        (base.stageErrors ??= []).push(...spawnErrors);
-                }
-                base.environmental = true;
-                base.outcome = {
-                    status: "failed",
-                    reason: failure +
-                        "\n\nThis failure is identical (up to counts and timings) to the " +
-                        "verification failure recorded on the untouched tree before the " +
-                        "run began — the environment was broken before this workstream " +
-                        "ran. No retry was spent, and the run halted here.",
-                };
-                return base;
-            }
-            // The informed retry is spent only when the diagnosed recovery attempt
-            // moved the failure at all. A failure reproduced identically after a
-            // diagnosis says the roster is stuck, not unlucky — that belongs in
-            // the ledger, not in a third spawn.
-            const stuck = attempt.label === "recovery" &&
-                index < attempts.length - 1 &&
-                implementerFingerprint !== undefined &&
-                failureFingerprint(failure) === implementerFingerprint;
-            if (index === attempts.length - 1 || stuck) {
-                workstream.status = "failed";
-                await saveManifest(root, options.programId, manifest, { log });
-                // The work stays in the tree for a resume; decisions made on the way
-                // to a failure are still journaled and still reviewable.
-                {
-                    const spawnErrors = await reviewWorkstreamDecisions(workstream.id, parsed.decisions, baseCommit);
-                    if (spawnErrors.length > 0)
-                        (base.stageErrors ??= []).push(...spawnErrors);
-                }
-                base.outcome = {
-                    status: "failed",
-                    reason: stuck
-                        ? failure +
-                            "\n\nThe recovery attempt, briefed with a reviewer diagnosis, " +
-                            "reproduced the implementer's failure (identical up to counts " +
-                            "and timings), so the final retry was not spent."
-                        : failure,
-                };
-                return base;
-            }
-            if (attempt.label === "implementer") {
-                implementerFingerprint = failureFingerprint(failure);
+                continue;
             }
-            // Diagnose the failure for the next attempt's brief. Overwrites any
-            // prior diagnosis — a read of an older failure must not be pinned to
-            // a newer one. Deterministic failures (no-op, undelivered brief) are
-            // never diagnosed: the runner already knows exactly what happened,
-            // and a reviewer read of an empty diff could only muddy it.
-            if (reviewer && !deterministicFailure) {
-                const diagnosed = await diagnoseFailure({
-                    root,
-                    manifest,
-                    workstream,
-                    spec,
-                    agentRunner,
-                    permits,
-                    reviewer,
-                    git,
-                    baseCommit,
-                    failure,
-                    observe: transcriptSink(`diagnose-${attempt.label.replaceAll(" ", "-")}`),
+            if (environmentalHalt) {
+                workstream.status = "parked";
+                results.push({
+                    id: workstream.id,
+                    name: workstream.name,
+                    outcome: {
+                        status: "parked",
+                        reason: "the run halted on an environmental verification failure; parked, not attempted",
+                    },
+                    decisionIds: [],
+                    decisionErrors: [],
                 });
-                priorDiagnosis = diagnosed.diagnosis;
-                if (diagnosed.spawnError !== undefined) {
-                    (base.stageErrors ??= []).push(diagnosed.spawnError);
-                    log(`${workstream.id}: ${diagnosed.spawnError}`);
-                }
-                await journalDenials(workstream.id, "reviewer", diagnosed.transcript);
-            }
-            else {
-                priorDiagnosis = undefined;
+                continue;
             }
-            if (priorDiagnosis !== undefined) {
-                (base.failureDiagnoses ??= []).push({
-                    attempt: attempt.label,
-                    verdict: priorDiagnosis,
+            // Authoring failures take precedence over awaiting: a workstream whose
+            // spec authoring failed or parked must fall through to the `blocked`
+            // branch below and render as the genuine failure it is, never be
+            // repainted `awaiting_human` — an authoring failure has no other
+            // representation in `results` than that branch's own `parked` result, so
+            // rewriting it here would erase the only trace of it and the run would
+            // wrongly look like a pure intermission. A workstream that is merely
+            // downstream of a *build* failure and also in the awaiting cone still
+            // resolves to awaiting_human here; that is safe because the build
+            // failure self-reports `failed` in `results`, so the run is classified a
+            // partial regardless (see the intermission classification below).
+            if (awaitingCone.has(workstream.id) && !authoringFailed.has(workstream.id)) {
+                workstream.status = "awaiting_human";
+                await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
+                const ownUnmet = workstream.prerequisites.filter((id) => unmetPrerequisiteIds.has(id));
+                const reason = ownUnmet.length > 0
+                    ? `waiting on human prerequisite ${ownUnmet.join(", ")}; not attempted.`
+                    : "an upstream workstream is awaiting a human prerequisite; not attempted.";
+                results.push({
+                    id: workstream.id,
+                    name: workstream.name,
+                    outcome: { status: "awaiting_human", reason },
+                    decisionIds: [],
+                    decisionErrors: [],
                 });
-                log(`${workstream.id}: reviewer diagnosed the ${attempt.label} failure`);
+                continue;
             }
-        }
-        return base;
-    }
-    async function journalDecisions(workstream, decisions, baseCommit) {
-        const events = decisions.map((decision) => ({
-            kind: "decision-recorded",
-            at: now().toISOString(),
-            id: decisionFingerprint(workstream.id, decision),
-            workstream: workstream.id,
-            decision,
-            ...(baseCommit === undefined ? {} : { baseCommit }),
-            decidedBy: "implementer",
-        }));
-        await appendLedgerEvents(root, options.programId, events);
-        for (const decision of decisions) {
-            log(`${workstream.id} decision: ${decision.title} -> ${decision.chosen}`);
-        }
-    }
-    /**
-     * Journals `permission-denied` events for one spawn (WS-03) — every
-     * workstream-attributed spawn calls this once, passing its own transcript
-     * and (for build roles only) the agent's `needsPermission` self-reports.
-     * A no-op when the spawn produced neither.
-     */
-    async function journalDenials(workstreamId, attempt, transcript, needsPermission = []) {
-        const events = buildDenialEvents(workstreamId, attempt, transcript?.denials ?? [], needsPermission, config.permits?.deny ?? [], now().toISOString());
-        if (events.length === 0)
-            return;
-        await appendLedgerEvents(root, options.programId, events);
-        for (const event of events) {
-            if (event.kind !== "permission-denied")
+            if (blocked.has(workstream.id)) {
+                workstream.status = "parked";
+                results.push({
+                    id: workstream.id,
+                    name: workstream.name,
+                    outcome: {
+                        status: "parked",
+                        reason: "an upstream dependency failed; parked, not attempted",
+                    },
+                    decisionIds: [],
+                    decisionErrors: [],
+                });
                 continue;
-            log(`${workstreamId} ${attempt}: denied \`${event.command}\` (${event.source})`);
+            }
+            const result = await runWorkstream(workstream);
+            results.push(result);
+            if (result.environmental === true)
+                environmentalHalt = true;
+            if (result.outcome.status === "failed") {
+                // Failure isolation: park the downstream cone, keep building the rest.
+                for (const id of downstreamCone(manifest.workstreams, [workstream.id])) {
+                    blocked.add(id);
+                }
+            }
         }
-    }
-    function reviewWorkstreamDecisions(workstreamId, decisions, baseCommit) {
-        return reviewDecisions({
+        const complete = results.every((result) => result.outcome.status === "complete" ||
+            result.outcome.status === "skipped");
+        const anyAwaiting = results.some((result) => result.outcome.status === "awaiting_human");
+        const anyFailedOrParked = results.some((result) => result.outcome.status === "failed" || result.outcome.status === "parked");
+        // Author-stage failures are counted too: an authoring failure the awaiting
+        // guard did NOT catch — e.g. a workstream that authored fine but sits
+        // downstream of an authoring failure — must still sink the intermission.
+        // Same set that seeded `blocked`/guarded the awaiting branch above;
+        // classifying on it here as well makes "any genuine failure => ordinary
+        // partial" true independent of how the cone painted it.
+        const anyAuthoringFailure = authorResult.results.some((entry) => entry.outcome.status === "failed" || entry.outcome.status === "parked");
+        // A planned intermission: nothing failed anywhere (build or authoring), at
+        // least one workstream is waiting on a human, and not everything built. A
+        // genuine failure makes it an ordinary partial instead — the human should
+        // read a diagnosis, not a checklist.
+        const intermission = !complete && anyAwaiting && !anyFailedOrParked && !anyAuthoringFailure;
+        manifest.program.status = complete
+            ? "complete"
+            : intermission
+                ? "awaiting_human"
+                : "partial";
+        await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
+        const wholeProgram = await runWholeProgramStage({
             root,
             programId: options.programId,
             manifest,
-            workstreamId,
-            decisions,
-            baseCommit,
-            decider,
+            config,
             agentRunner,
             permits,
             git,
             isRepository,
+            results,
+            authorResult,
+            runStartCommit,
+            decider,
             reviewed,
-            onTranscript: (transcript) => journalDenials(workstreamId, "decider", transcript),
             triaged,
             now,
             log,
-            observe: { root, programId: options.programId, label: `${workstreamId}-decider-decision`, log },
+            recorder,
         });
-    }
-    function reviewWorkstreamFindings(workstreamId, findings, baseCommit) {
-        return triageFindings({
+        const ledger = await readDecisionLedger(root, options.programId);
+        const escalations = escalatedRecords(ledger);
+        // Runs after the ledger read above, so its brief already sees this run's
+        // own whole-program findings/rulings, and before report assembly, so its
+        // section renders next to WS-04's own (§3.2 of the WS-05 spec). Read-only
+        // and fail-open: nothing here can change `results`, `ledger`, the run's
+        // outcome, or the exit code.
+        const causalAnalysis = await runCausalAnalysisStage({
             root,
             programId: options.programId,
             manifest,
-            workstreamId,
-            findings,
-            baseCommit,
-            decider,
+            config,
             agentRunner,
             permits,
             git,
             isRepository,
-            reviewed,
-            observe: { root, programId: options.programId, label: `${workstreamId}-decider-finding`, log },
-            onTranscript: (transcript) => journalDenials(workstreamId, "decider", transcript),
-            triaged,
-            now,
+            results,
+            runStartCommit,
+            ledger,
             log,
+            recorder,
         });
-    }
-    /**
-     * Drives the one bounded fix attempt a `fix-now` triage earns (WS-06).
-     * Selects findings from the ledger projection — never from any in-memory
-     * disposition — so a human-decided finding (status `"human-decided"`, not
-     * `"fix-now"`) is never handed to the fix seam (SC-14). A workstream's
-     * `fix-now` findings are fixed together, in one `attemptFix` call, then
-     * recorded as one `finding-fix-attempted` event per finding id — a ledger
-     * entry, never a re-triage (SC-14). Returns the (possibly unchanged) green
-     * commit; never throws, never blocks the run (SC-15).
-     */
-    async function driveFixNowFindings(workstream, spec, openFindings, greenCommit, observe) {
-        const ledger = await readDecisionLedger(root, options.programId);
-        const fixNowIds = new Set(ledger.findings
-            .filter((record) => record.workstream === workstream.id && record.status === "fix-now")
-            .map((record) => record.id));
-        if (fixNowIds.size === 0)
-            return { commit: greenCommit };
-        const toFix = [];
-        const matchedIds = [];
-        for (const candidate of openFindings) {
-            const id = fingerprint({ ...candidate, workstreamId: workstream.id });
-            if (!fixNowIds.has(id))
-                continue;
-            toFix.push(candidate);
-            matchedIds.push(id);
+        const reportPath = runReportPath(root, options.programId);
+        // Rendering is the last stage the recorder can actually observe (SC-03):
+        // captured as its own span, nested under the run span, rather than folded
+        // silently into it. Kept in its own try/catch, separate from the write and
+        // commit below, so a rendering bug still lets `finalize()` run and still
+        // lets the write/commit attempt proceed against whatever report content
+        // *is* available — a rendering failure is a logged line, not a thrown run,
+        // exactly like the write/commit failure path below (SC-05, SC-12).
+        let reportContent;
+        try {
+            const reportSpan = recorder.span({ stage: "report-assembly" });
+            // `triaged` is the run-local set of subject ids the decider actually
+            // ruled on this run (built up across the authoring, build, and
+            // whole-program stages, see its declaration above) — exactly the
+            // `triagedThisRun` basis the "this run" triage ratio needs, since the
+            // projected ledger carries no run identifier of its own. It excludes
+            // ids that were merely sent but whose invocation failed or returned no
+            // valid verdict.
+            // Computed before renderRunReport (§3.2/§3.9): renderAnalyticsSection is
+            // WS-04's own never-throwing isolation boundary, so an analytics bug can
+            // never propagate into this try's catch below and leave reportContent
+            // undefined — which would suppress the entire report (SC-13). The
+            // recorder's snapshot, not the finalized file, is the only artifact that
+            // exists at this point in the sequence (finalize() runs later, below).
+            // Passed as a thunk, not called eagerly here: `recorder.snapshot()` is
+            // documented as non-throwing, but evaluating it as a plain argument would
+            // run it *before* renderAnalyticsSection's own try/catch is reached, so a
+            // violation of that contract would still escape this boundary.
+            const analyticsSection = renderAnalyticsSection(() => recorder.snapshot());
+            // The causal section's own "observed measurements" layer is rendered
+            // from a *later* snapshot than the one the analyzer was briefed with
+            // (`causalAnalysis` above) — one that now includes the analyzer's own
+            // `causal-analysis` span — exactly as WS-04's own section above it does.
+            // The two differ by exactly the analyzer's own cost; the section states
+            // that boundary explicitly (§3.2).
+            const causalAnalysisSection = renderCausalAnalysisSection(causalAnalysis.outcome, () => recorder.snapshot());
+            reportContent = renderRunReport(manifest, results, ledger, triaged, authorResult, now(), wholeProgram, preflight, options.resumeCommand, manifestMergeCount(root, options.programId) > mergesAtStart, analyticsSection, causalAnalysisSection);
+            reportSpan.close({ outcome: "success" });
         }
-        // An id triaged fix-now but absent from the open set (should not
-        // happen — it is where the id came from) is skipped, fail-open.
-        if (toFix.length === 0)
-            return { commit: greenCommit };
-        const fix = await attemptFix({
-            root,
-            programId: options.programId,
-            workstream,
-            spec,
-            config,
-            agentRunner,
-            permits,
-            verifyRunner,
-            git,
-            agent,
-            findings: toFix,
-            greenCommit,
-            label: "fix-now fix",
-            log,
-            now,
-            observe,
+        catch (error) {
+            log(`run report: could not render ${reportPath}: ${error.message}`);
+        }
+        // The `report-commit` span (the stage STAGE_BUCKET already reserves for
+        // exactly this) covers writing the report to disk and committing
+        // docs/programs, nested explicitly under `runSpan` rather than the
+        // implicit stack, since `reportSpan` above has already closed and popped
+        // itself. Both this span and its parent `runSpan` are opened/left open
+        // rather than closed here, because the write and the commit they describe
+        // happen *after* `finalize()` below persists this very artifact — closing
+        // them now would stamp an `endOffsetMs` that is a lie the moment the write
+        // or commit takes any measurable time at all. An absent `endOffsetMs` is
+        // exactly the schema's existing "true end not observed" semantics; the
+        // run's actual outcome classification is recorded as a point observation
+        // instead of a span-close result, since it — unlike an interval's end — is
+        // a fact already known at this instant.
+        runSpan.child({ stage: "report-commit" });
+        recorder.point({
+            kind: "run-outcome",
+            coverage: "observed",
+            dimensions: { stage: "run", outcome: complete ? "success" : intermission ? "no-op" : "failed" },
         });
-        // "kept" only when the attempt both verified clean and actually landed a
-        // commit — a clean-but-empty attempt is a decline, not a fix, and must
-        // reach the human exactly like a failed verification does.
-        const kept = fix.outcome === "kept" && fix.commit !== undefined;
-        const note = kept
-            ? fix.summary
-            : fix.outcome === "kept"
-                ? `${fix.summary} (the attempt verified clean but made no change; no fix landed)`
-                : `${fix.summary} (fix failed verification and was discarded: ${fix.failure})`;
-        const events = matchedIds.map((id) => ({
-            kind: "finding-fix-attempted",
-            at: now().toISOString(),
-            id,
-            outcome: kept ? "kept" : "failed",
-            note,
-            ...(kept && fix.commit !== undefined ? { commit: fix.commit } : {}),
-            attemptedBy: "implementer",
-        }));
-        await appendLedgerEvents(root, options.programId, events);
-        log(kept
-            ? `${workstream.id}: fix-now fix verified and committed`
-            : `${workstream.id}: fix-now fix failed and was escalated — ${note}`);
-        const resultCommit = kept ? fix.greenCommit : greenCommit;
+        // Finalized once every stage the recorder can observe closing has closed
+        // (report-assembly above; report-commit and run intentionally remain
+        // open — see above). Still runs before the report is written and
+        // committed, so the artifact rides into the same `docs/programs` commit
+        // (SC-02, SC-14). Fail-open: never throws, never delays or blocks the
+        // report below.
+        const finalizeStart = monotonic();
+        await recorder.finalize();
+        // `finalize()` seals the point/span arrays before its own duration is
+        // known, so an overhead measure around it can never live in the artifact
+        // it measures (§3.4.d) — emitted after, as a non-conserved sidecar-only
+        // point: no `stage`, never summed into any bucket.
+        recorder.point({
+            kind: "analytics-overhead",
+            coverage: "observed",
+            value: monotonic() - finalizeStart,
+            unit: "ms",
+            label: "finalize",
+        });
+        // Every workstream verdict, `complete`, and the exit-code mapping are
+        // already settled above; writing and committing the report is bookkeeping
+        // that must not be able to reject `runProgram` after the fact (SC-05,
+        // SC-12) — a full disk or an EISDIR here is a logged line, not a thrown
+        // run.
+        if (reportContent !== undefined) {
+            try {
+                await writeFile(reportPath, reportContent, "utf8");
+                if (isRepository) {
+                    await git.commitPaths(root, `nightshift(${options.programId}): run report and decision ledger`, ["docs/programs"]);
+                }
+                // A best-effort forensic breadcrumb for the one boundary the
+                // already-committed canonical artifact can never describe: `point()`
+                // still appends to the gitignored sidecar once armed even though
+                // `finalize()` has already run, and never touches the canonical JSON
+                // again, so the working tree stays clean after a normal run.
+                recorder.point({
+                    kind: "report-commit-result",
+                    coverage: "observed",
+                    dimensions: { stage: "report-commit", outcome: "success" },
+                });
+            }
+            catch (error) {
+                log(`run report: could not write or commit ${reportPath}: ${error.message}`);
+                recorder.point({
+                    kind: "report-commit-result",
+                    coverage: "observed",
+                    dimensions: { stage: "report-commit", outcome: "failed" },
+                });
+            }
+        }
+        log(`run report: ${reportPath}`);
         return {
-            commit: resultCommit,
-            ...(fix.spawnError === undefined ? {} : { spawnError: fix.spawnError }),
-            ...(fix.transcript === undefined ? {} : { transcript: fix.transcript }),
+            programId: options.programId,
+            complete,
+            intermission,
+            workstreams: results,
+            escalations,
+            reportPath,
+            wholeProgramReview: wholeProgram,
+            causalAnalysis,
         };
+        async function runWorkstream(workstream) {
+            const base = {
+                id: workstream.id,
+                name: workstream.name,
+                outcome: { status: "failed", reason: "not attempted" },
+                decisionIds: [],
+                decisionErrors: [],
+                buildAgentCommand: describeAgent(agent),
+            };
+            /** Every build-role spawn's transcript, for the report's per-workstream
+             *  Commands subsection (WS-02). Reviewer/decider spawns are excluded. */
+            function recordTranscript(transcript) {
+                if (transcript)
+                    (base.transcripts ??= []).push(transcript);
+            }
+            /** Names the JSONL file under build-logs/<programId>/, distinctly per spawn label. */
+            function transcriptSink(label) {
+                return { root, programId: options.programId, label: `${workstream.id}-${label}`, log };
+            }
+            let spec;
+            try {
+                spec = await readFile(join(root, workstream.taskFile), "utf8");
+            }
+            catch {
+                base.outcome = {
+                    status: "parked",
+                    reason: `spec not found at ${workstream.taskFile}`,
+                };
+                return base;
+            }
+            workstream.status = "in_progress";
+            await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
+            const baseCommit = isRepository
+                ? await git.currentCommit(root)
+                : undefined;
+            let priorFailure;
+            let priorDiagnosis;
+            let implementerFingerprint;
+            const attempts = [
+                { agent, label: "implementer", role: "agent" },
+            ];
+            if (recovery && !recovery.borrowedImplementer) {
+                attempts.push({ agent: recovery.agent, label: "recovery", role: "recoveryAgent" });
+                // The third seat exists only when a reviewer can inform it. An
+                // uninformed retry has already been spent (recovery); running the
+                // roster again blind is a coin flip the ledger should hear about
+                // instead. Alternation is deliberate — the implementer returns with
+                // the reviewer's diagnosis in hand, a composition neither prior
+                // attempt had.
+                if (reviewer)
+                    attempts.push({ agent, label: "informed retry", role: "agent" });
+            }
+            for (const [index, attempt] of attempts.entries()) {
+                log(`${workstream.id} ${workstream.name}: ${attempt.label} attempt`);
+                const { brief, components } = implementerBrief(manifest, workstream, spec, ledgerAtStart, config.permits?.policy, priorFailure, priorDiagnosis);
+                for (const point of promptComponentSizePoints(components, { role: attempt.role })) {
+                    recorder.point(point);
+                }
+                // Why this repetition happened (WS-02, SC-05/SC-06): the first attempt
+                // is always `initial`; a later seat is `informed-by-diagnosis` when the
+                // prior attempt's failure was read by the reviewer, else a plain
+                // `verify-failure` retry (a deterministic failure skips diagnosis —
+                // see below — so the next seat still spawns, just undiagnosed).
+                const seatStage = STAGE_FOR_SEAT[attempt.label] ?? "implementer";
+                const attemptReason = index === 0 ? "initial" : priorDiagnosis !== undefined ? "informed-by-diagnosis" : "verify-failure";
+                /** This attempt's eventual `attempt-outcome` disposition (WS-02, §3.3)
+                 *  — distinct from the spawn span's own success/failed outcome (an
+                 *  undelivered-brief or green-but-empty attempt spawns "successfully"
+                 *  but disposes as `no-op`/`discarded`). Set once, at the point each
+                 *  failure reason is detected below; `undefined` means the attempt was
+                 *  kept. */
+                let dispositionOutcome;
+                const emitAttemptOutcome = (outcome, reasonOverride) => {
+                    recorder.point({
+                        kind: "attempt-outcome",
+                        coverage: "observed",
+                        dimensions: {
+                            stage: seatStage,
+                            workstream: workstream.id,
+                            role: attempt.role,
+                            attemptSeat: attempt.label,
+                            attemptIndex: index,
+                            attemptReason: reasonOverride ?? attemptReason,
+                            outcome,
+                        },
+                    });
+                };
+                let invocation;
+                let spawnFailure;
+                try {
+                    invocation = await invokeAgent(agentRunner, attempt.agent, brief, root, permits, attempt.role, transcriptSink(attempt.label.replaceAll(" ", "-")), recorder, { stage: seatStage, workstream: workstream.id, attemptSeat: attempt.label, attemptIndex: index, attemptReason });
+                }
+                catch (error) {
+                    // The agent process never started — its command is wrong, missing,
+                    // or unrunnable. Nothing was built; this is the captured
+                    // silent-exit incident (SC-12). Make it a diagnosed failure via the
+                    // existing retry/park machinery below, never a process exit.
+                    spawnFailure =
+                        `the ${attempt.label} agent could not be spawned: ` +
+                            `${error.message}. The configured command ` +
+                            `\`${describeAgent(attempt.agent)}\` did not start, so nothing was built.`;
+                    invocation = { exitCode: 1, output: "" };
+                }
+                recordTranscript(invocation.transcript);
+                const summary = resolveSummary(invocation.output);
+                base.summary = summary.text;
+                await journalDenials(workstream.id, attempt.label, invocation.transcript, summary.needsPermission);
+                const parsed = extractDecisions(invocation.output);
+                base.decisionErrors.push(...parsed.errors);
+                await journalDecisions(workstream, parsed.decisions, baseCommit);
+                base.decisionIds = parsed.decisions.map((decision) => decisionFingerprint(workstream.id, decision));
+                let failure = await verifyAttempt(config, verifyRunner, root, invocation.exitCode, recorder, "verification-command", {
+                    programId: options.programId,
+                    phase: `post-${attempt.label.replaceAll(" ", "-")}`,
+                    workstream: workstream.id,
+                    role: attempt.role,
+                    attemptSeat: attempt.label,
+                    attemptIndex: index,
+                });
+                // Deterministic protocol failures the runner can see without a model:
+                // no diagnosis is spent on them, because no read of the tree could add
+                // anything to what the runner already knows.
+                let deterministicFailure = false;
+                // A spawn failure takes precedence over whatever verifyAttempt saw
+                // (the untouched tree can verify green on its own) — no reviewer
+                // diagnosis is spent reading an empty diff.
+                if (spawnFailure !== undefined) {
+                    failure = spawnFailure;
+                    deterministicFailure = true;
+                    dispositionOutcome = "failed";
+                }
+                // A brief that never reached the agent's stdin means the process
+                // crashed at startup — whatever it printed was not an answer to the
+                // brief, even when it exited 0.
+                if (failure === undefined && invocation.inputError !== undefined) {
+                    failure =
+                        `the brief could not be delivered to the agent's stdin ` +
+                            `(${invocation.inputError}) — the agent likely crashed at startup, ` +
+                            `so its reply answered nothing.`;
+                    deterministicFailure = true;
+                    dispositionOutcome = "no-op";
+                }
+                // A green verify over an unchanged tree is just the baseline passing
+                // again, not built work. Without this, an agent that crashes at
+                // startup while exiting 0 (or replies without working) sweeps only
+                // the runner's own in_progress manifest write into a metadata-only
+                // commit and walks through the gate as "complete". A reply that never
+                // produces the work is a protocol failure, not an empty result.
+                if (failure === undefined && isRepository) {
+                    const dirty = await git.dirtyPaths(root);
+                    const meaningful = dirty.some((path) => !path.replaceAll("\\", "/").startsWith("docs/programs/"));
+                    if (!meaningful) {
+                        failure =
+                            "the attempt verified green but changed nothing outside " +
+                                "docs/programs/ — nothing was built, and the passing verify was " +
+                                "the untouched baseline. A no-op attempt is a protocol failure " +
+                                "(the agent may have crashed at startup or replied without " +
+                                "working), not a completed workstream.";
+                        deterministicFailure = true;
+                        dispositionOutcome = "discarded";
+                    }
+                }
+                // A genuine verify failure (not spawn/inputError/green-empty) disposes
+                // as `failed`, same as every other undetermined failure reason.
+                if (failure !== undefined && dispositionOutcome === undefined) {
+                    dispositionOutcome = "failed";
+                }
+                if (failure === undefined) {
+                    let c0;
+                    if (isRepository) {
+                        // Unlike the authoring, run-report, and replay commits, this one
+                        // stays a whole-tree sweep: an implementing agent touches whatever
+                        // files the work required, and that set is exactly what the
+                        // runner cannot know in advance. c0 is the green anchor the test
+                        // critique's fix loop resets to on a failing fix (SC-07).
+                        c0 = await timed(recorder, { stage: "git-commit", workstream: workstream.id }, () => git.commitAll(root, `nightshift(${options.programId}): ${workstream.id} ${workstream.name}`), commitEvidence);
+                    }
+                    const critique = isRepository && c0 !== undefined
+                        ? await runTestCritique({
+                            root,
+                            manifest,
+                            workstream,
+                            spec,
+                            config,
+                            agentRunner,
+                            permits,
+                            verifyRunner,
+                            git,
+                            reviewer,
+                            agent,
+                            baseCommit,
+                            greenCommit: c0,
+                            now,
+                            log,
+                            transcriptSink,
+                            recorder,
+                        })
+                        : undefined;
+                    // The manifest's single commit field records the workstream's final
+                    // verified state — after any kept fix, that is the fix commit, not
+                    // the earlier green one.
+                    let finalCommit = critique?.finalCommit ?? c0;
+                    if (critique && critique.stageErrors.length > 0) {
+                        (base.stageErrors ??= []).push(...critique.stageErrors);
+                    }
+                    for (const transcript of critique?.transcripts ?? [])
+                        recordTranscript(transcript);
+                    // Findings anchor to c0 (the green, pre-critique commit) — the
+                    // honest rollback point — while the decider below diffs from
+                    // baseCommit (pre-workstream), so it sees the whole workstream.
+                    const findingEvents = findingsToLedgerEvents({
+                        workstreamId: workstream.id,
+                        findings: (critique?.outcome.open ?? []).filter(hasRoutableEvidence),
+                        ...(c0 === undefined ? {} : { baseCommit: c0 }),
+                        now,
+                    });
+                    await timed(recorder, { stage: "ledger-persist", workstream: workstream.id }, () => appendLedgerEvents(root, options.programId, findingEvents));
+                    // The commit's own sha cannot be part of the tree it commits, so the
+                    // manifest records it only now — swept forward into whatever commits
+                    // next. Replay reads the manifest's current state, not the commit
+                    // that last touched it, so this lag is harmless.
+                    workstream.status = "complete";
+                    if (finalCommit !== undefined)
+                        workstream.commit = finalCommit;
+                    await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
+                    {
+                        const spawnErrors = await reviewWorkstreamDecisions(workstream.id, parsed.decisions, baseCommit);
+                        if (spawnErrors.length > 0)
+                            (base.stageErrors ??= []).push(...spawnErrors);
+                    }
+                    // Findings are triaged against the pre-workstream diff (baseCommit),
+                    // the same one the decider reviews decisions against — c0/finalCommit
+                    // are the fix loop's own rollback anchors, a different thing.
+                    {
+                        const spawnErrors = await reviewWorkstreamFindings(workstream.id, findingEvents, baseCommit);
+                        if (spawnErrors.length > 0)
+                            (base.stageErrors ??= []).push(...spawnErrors);
+                    }
+                    // A fix-now triage drives exactly one bounded fix attempt, here —
+                    // after the triage that produced it, before the run advances. Only
+                    // reachable when there is a green commit to attempt from and a
+                    // decider that could have produced a fix-now verdict in the first
+                    // place (SC-13).
+                    if (finalCommit !== undefined && decider) {
+                        const driven = await driveFixNowFindings(workstream, spec, critique?.outcome.open ?? [], finalCommit, transcriptSink("fix-now-fix"));
+                        recordTranscript(driven.transcript);
+                        if (driven.spawnError !== undefined) {
+                            (base.stageErrors ??= []).push(driven.spawnError);
+                        }
+                        if (driven.commit !== finalCommit) {
+                            finalCommit = driven.commit;
+                            workstream.commit = finalCommit;
+                            await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
+                        }
+                    }
+                    if (critique)
+                        base.testCritique = critique.outcome;
+                    base.testCritiqueDiffClipped = critique?.diffClipped ?? false;
+                    base.outcome = {
+                        status: "complete",
+                        ...(finalCommit === undefined ? {} : { commit: finalCommit }),
+                    };
+                    emitAttemptOutcome("success");
+                    return base;
+                }
+                priorFailure = failure;
+                log(`${workstream.id}: ${attempt.label} attempt failed — ${failure}`);
+                // A failure identical to the pre-run baseline (up to counts and
+                // timings) was there before any workstream ran: environmental, not
+                // this workstream's work. No retry or diagnosis is spent on it, and
+                // the caller halts the run — every later workstream would be charged
+                // for the same broken environment. Workstreams resumed with their own
+                // leftover failure in the tree are exempt (see resumedIds).
+                if (baselineFingerprint !== undefined &&
+                    !resumedIds.has(workstream.id) &&
+                    failureFingerprint(failure) === baselineFingerprint) {
+                    workstream.status = "failed";
+                    await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
+                    {
+                        const spawnErrors = await reviewWorkstreamDecisions(workstream.id, parsed.decisions, baseCommit);
+                        if (spawnErrors.length > 0)
+                            (base.stageErrors ??= []).push(...spawnErrors);
+                    }
+                    base.environmental = true;
+                    base.outcome = {
+                        status: "failed",
+                        reason: failure +
+                            "\n\nThis failure is identical (up to counts and timings) to the " +
+                            "verification failure recorded on the untouched tree before the " +
+                            "run began — the environment was broken before this workstream " +
+                            "ran. No retry was spent, and the run halted here.",
+                    };
+                    emitAttemptOutcome("failed", "environmental");
+                    return base;
+                }
+                // The informed retry is spent only when the diagnosed recovery attempt
+                // moved the failure at all. A failure reproduced identically after a
+                // diagnosis says the roster is stuck, not unlucky — that belongs in
+                // the ledger, not in a third spawn.
+                const stuck = attempt.label === "recovery" &&
+                    index < attempts.length - 1 &&
+                    implementerFingerprint !== undefined &&
+                    failureFingerprint(failure) === implementerFingerprint;
+                if (index === attempts.length - 1 || stuck) {
+                    workstream.status = "failed";
+                    await timed(recorder, { stage: "manifest-persist" }, () => saveManifest(root, options.programId, manifest, { log }));
+                    // The work stays in the tree for a resume; decisions made on the way
+                    // to a failure are still journaled and still reviewable.
+                    {
+                        const spawnErrors = await reviewWorkstreamDecisions(workstream.id, parsed.decisions, baseCommit);
+                        if (spawnErrors.length > 0)
+                            (base.stageErrors ??= []).push(...spawnErrors);
+                    }
+                    base.outcome = {
+                        status: "failed",
+                        reason: stuck
+                            ? failure +
+                                "\n\nThe recovery attempt, briefed with a reviewer diagnosis, " +
+                                "reproduced the implementer's failure (identical up to counts " +
+                                "and timings), so the final retry was not spent."
+                            : failure,
+                    };
+                    emitAttemptOutcome(stuck ? "failed" : (dispositionOutcome ?? "failed"), stuck ? "stuck" : undefined);
+                    return base;
+                }
+                if (attempt.label === "implementer") {
+                    implementerFingerprint = failureFingerprint(failure);
+                }
+                // Diagnose the failure for the next attempt's brief. Overwrites any
+                // prior diagnosis — a read of an older failure must not be pinned to
+                // a newer one. Deterministic failures (no-op, undelivered brief) are
+                // never diagnosed: the runner already knows exactly what happened,
+                // and a reviewer read of an empty diff could only muddy it.
+                if (reviewer && !deterministicFailure) {
+                    const diagnosed = await diagnoseFailure({
+                        root,
+                        manifest,
+                        workstream,
+                        spec,
+                        agentRunner,
+                        permits,
+                        reviewer,
+                        git,
+                        baseCommit,
+                        failure,
+                        attemptSeat: attempt.label,
+                        attemptIndex: index,
+                        observe: transcriptSink(`diagnose-${attempt.label.replaceAll(" ", "-")}`),
+                        recorder,
+                    });
+                    priorDiagnosis = diagnosed.diagnosis;
+                    if (diagnosed.spawnError !== undefined) {
+                        (base.stageErrors ??= []).push(diagnosed.spawnError);
+                        log(`${workstream.id}: ${diagnosed.spawnError}`);
+                    }
+                    await journalDenials(workstream.id, "reviewer", diagnosed.transcript);
+                }
+                else {
+                    priorDiagnosis = undefined;
+                }
+                if (priorDiagnosis !== undefined) {
+                    (base.failureDiagnoses ??= []).push({
+                        attempt: attempt.label,
+                        verdict: priorDiagnosis,
+                    });
+                    log(`${workstream.id}: reviewer diagnosed the ${attempt.label} failure`);
+                }
+                emitAttemptOutcome(dispositionOutcome ?? "failed");
+            }
+            return base;
+        }
+        async function journalDecisions(workstream, decisions, baseCommit) {
+            const events = decisions.map((decision) => ({
+                kind: "decision-recorded",
+                at: now().toISOString(),
+                id: decisionFingerprint(workstream.id, decision),
+                workstream: workstream.id,
+                decision,
+                ...(baseCommit === undefined ? {} : { baseCommit }),
+                decidedBy: "implementer",
+            }));
+            await timed(recorder, { stage: "ledger-persist", workstream: workstream.id }, () => appendLedgerEvents(root, options.programId, events));
+            for (const decision of decisions) {
+                log(`${workstream.id} decision: ${decision.title} -> ${decision.chosen}`);
+            }
+        }
+        /**
+         * Journals `permission-denied` events for one spawn (WS-03) — every
+         * workstream-attributed spawn calls this once, passing its own transcript
+         * and (for build roles only) the agent's `needsPermission` self-reports.
+         * A no-op when the spawn produced neither.
+         */
+        async function journalDenials(workstreamId, attempt, transcript, needsPermission = []) {
+            const events = buildDenialEvents(workstreamId, attempt, transcript?.denials ?? [], needsPermission, config.permits?.deny ?? [], now().toISOString());
+            if (events.length === 0)
+                return;
+            await timed(recorder, { stage: "ledger-persist", workstream: workstreamId }, () => appendLedgerEvents(root, options.programId, events));
+            for (const event of events) {
+                if (event.kind !== "permission-denied")
+                    continue;
+                log(`${workstreamId} ${attempt}: denied \`${event.command}\` (${event.source})`);
+            }
+        }
+        function reviewWorkstreamDecisions(workstreamId, decisions, baseCommit) {
+            return reviewDecisions({
+                root,
+                programId: options.programId,
+                manifest,
+                workstreamId,
+                decisions,
+                baseCommit,
+                decider,
+                agentRunner,
+                permits,
+                git,
+                isRepository,
+                reviewed,
+                onTranscript: (transcript) => journalDenials(workstreamId, "decider", transcript),
+                triaged,
+                now,
+                log,
+                observe: { root, programId: options.programId, label: `${workstreamId}-decider-decision`, log },
+                recorder,
+            });
+        }
+        function reviewWorkstreamFindings(workstreamId, findings, baseCommit) {
+            return triageFindings({
+                root,
+                programId: options.programId,
+                manifest,
+                workstreamId,
+                findings,
+                baseCommit,
+                decider,
+                agentRunner,
+                permits,
+                git,
+                isRepository,
+                reviewed,
+                observe: { root, programId: options.programId, label: `${workstreamId}-decider-finding`, log },
+                onTranscript: (transcript) => journalDenials(workstreamId, "decider", transcript),
+                triaged,
+                now,
+                log,
+                recorder,
+            });
+        }
+        /**
+         * Drives the one bounded fix attempt a `fix-now` triage earns (WS-06).
+         * Selects findings from the ledger projection — never from any in-memory
+         * disposition — so a human-decided finding (status `"human-decided"`, not
+         * `"fix-now"`) is never handed to the fix seam (SC-14). A workstream's
+         * `fix-now` findings are fixed together, in one `attemptFix` call, then
+         * recorded as one `finding-fix-attempted` event per finding id — a ledger
+         * entry, never a re-triage (SC-14). Returns the (possibly unchanged) green
+         * commit; never throws, never blocks the run (SC-15).
+         */
+        async function driveFixNowFindings(workstream, spec, openFindings, greenCommit, observe) {
+            const ledger = await readDecisionLedger(root, options.programId);
+            const fixNowIds = new Set(ledger.findings
+                .filter((record) => record.workstream === workstream.id && record.status === "fix-now")
+                .map((record) => record.id));
+            if (fixNowIds.size === 0)
+                return { commit: greenCommit };
+            const toFix = [];
+            const matchedIds = [];
+            for (const candidate of openFindings) {
+                const id = fingerprint({ ...candidate, workstreamId: workstream.id });
+                if (!fixNowIds.has(id))
+                    continue;
+                toFix.push(candidate);
+                matchedIds.push(id);
+            }
+            // An id triaged fix-now but absent from the open set (should not
+            // happen — it is where the id came from) is skipped, fail-open.
+            if (toFix.length === 0)
+                return { commit: greenCommit };
+            const fix = await attemptFix({
+                root,
+                programId: options.programId,
+                workstream,
+                spec,
+                config,
+                agentRunner,
+                permits,
+                verifyRunner,
+                git,
+                agent,
+                findings: toFix,
+                greenCommit,
+                label: "fix-now fix",
+                log,
+                now,
+                observe,
+                stage: "fix-now",
+                attemptIndex: 0,
+                recorder,
+            });
+            // "kept" only when the attempt both verified clean and actually landed a
+            // commit — a clean-but-empty attempt is a decline, not a fix, and must
+            // reach the human exactly like a failed verification does.
+            const kept = fix.outcome === "kept" && fix.commit !== undefined;
+            const note = kept
+                ? fix.summary
+                : fix.outcome === "kept"
+                    ? `${fix.summary} (the attempt verified clean but made no change; no fix landed)`
+                    : `${fix.summary} (fix failed verification and was discarded: ${fix.failure})`;
+            const events = matchedIds.map((id) => ({
+                kind: "finding-fix-attempted",
+                at: now().toISOString(),
+                id,
+                outcome: kept ? "kept" : "failed",
+                note,
+                ...(kept && fix.commit !== undefined ? { commit: fix.commit } : {}),
+                attemptedBy: "implementer",
+            }));
+            await timed(recorder, { stage: "ledger-persist", workstream: workstream.id }, () => appendLedgerEvents(root, options.programId, events));
+            log(kept
+                ? `${workstream.id}: fix-now fix verified and committed`
+                : `${workstream.id}: fix-now fix failed and was escalated — ${note}`);
+            const resultCommit = kept ? fix.greenCommit : greenCommit;
+            return {
+                commit: resultCommit,
+                ...(fix.spawnError === undefined ? {} : { spawnError: fix.spawnError }),
+                ...(fix.transcript === undefined ? {} : { transcript: fix.transcript }),
+            };
+        }
     }
 }
 /**
@@ -1487,6 +1768,7 @@ function notBuiltRoster(results, authorResult) {
  */
 export async function runWholeProgramStage(args) {
     const { root, programId, manifest, config, agentRunner, permits, git, isRepository, results, authorResult, runStartCommit, decider, reviewed, triaged, now, log, fs, } = args;
+    const recorder = args.recorder ?? NOOP_RUN_RECORDER;
     const errors = [];
     let commit;
     let commitSkipped = false;
@@ -1508,7 +1790,9 @@ export async function runWholeProgramStage(args) {
     try {
         safeLog("whole-program review: starting");
         const base = await resolveProgramDiffBase({ root, git, isRepository, runStartCommit });
-        const diff = base === undefined ? "" : await git.diffSince(root, base);
+        const diff = base === undefined
+            ? ""
+            : await timed(recorder, { stage: "git-diff" }, () => git.diffSince(root, base));
         const notBuilt = notBuiltRoster(results, authorResult);
         const reviewCommit = isRepository ? await git.currentCommit(root) : undefined;
         outcome = await runWholeProgramReview({
@@ -1523,6 +1807,7 @@ export async function runWholeProgramStage(args) {
             ...(notBuilt.length === 0 ? {} : { notBuilt }),
             ...(fs === undefined ? {} : { fs }),
             log,
+            recorder,
         });
         safeLog(outcome.status === "refreshed"
             ? `whole-program review: refreshed ${AS_BUILT_PATH}` +
@@ -1532,7 +1817,7 @@ export async function runWholeProgramStage(args) {
         if (outcome.writtenPaths.length > 0) {
             if (isRepository) {
                 try {
-                    commit = await git.commitPaths(root, `nightshift(${programId}): as-built snapshot`, outcome.writtenPaths);
+                    commit = await timed(recorder, { stage: "as-built-snapshot" }, () => git.commitPaths(root, `nightshift(${programId}): as-built snapshot`, outcome.writtenPaths), commitEvidence);
                 }
                 catch (error) {
                     errors.push(`could not commit the as-built snapshot: ${error.message}`);
@@ -1554,7 +1839,7 @@ export async function runWholeProgramStage(args) {
         }
         else {
             try {
-                await appendLedgerEvents(root, programId, events);
+                await timed(recorder, { stage: "ledger-persist", workstream: WHOLE_PROGRAM_SUBJECT }, () => appendLedgerEvents(root, programId, events));
                 journaled = true;
                 findingIds = events.map((event) => event.id);
             }
@@ -1580,6 +1865,7 @@ export async function runWholeProgramStage(args) {
                     triaged,
                     now,
                     log,
+                    recorder,
                 });
                 errors.push(...spawnErrors);
             }
@@ -1599,16 +1885,195 @@ export async function runWholeProgramStage(args) {
         errors,
     };
 }
-/** Undefined means the attempt verified clean; otherwise the diagnosis. */
-async function verifyAttempt(config, verifyRunner, root, agentExitCode) {
+function causalAnalysisStageFailure(reason) {
+    return {
+        ran: false,
+        status: "analyzer-error",
+        reason,
+        unresolvedQuestions: [],
+        parseErrors: [],
+        inputClipped: false,
+    };
+}
+/**
+ * Projects the run's own `WorkstreamResult[]` into WS-05's narrow,
+ * causal-analysis-owned timeline shape (mirrors `notBuiltRoster`'s mapping
+ * pattern) — `causal-analysis.ts` cannot import `WorkstreamResult` itself
+ * without creating a cycle back into this module.
+ */
+function causalAnalysisTimeline(results) {
+    return results.map((result) => ({
+        id: result.id,
+        name: result.name,
+        status: result.outcome.status,
+        ...(result.outcome.status === "complete" ? {} : { reason: result.outcome.reason }),
+        ...(result.failureDiagnoses === undefined ? {} : { failureDiagnoses: result.failureDiagnoses }),
+        ...(result.testCritique === undefined
+            ? {}
+            : {
+                testCritique: {
+                    stopReason: result.testCritique.stopReason,
+                    roundsRun: result.testCritique.roundsRun,
+                    openSubjects: result.testCritique.open.map((finding) => finding.subject),
+                    resolvedSubjects: result.testCritique.resolved.map((finding) => finding.subject),
+                },
+            }),
+    }));
+}
+/**
+ * The end-of-run causal-analysis stage (WS-05): resolves the same diff base
+ * the whole-program stage uses, takes the analytics snapshot *before*
+ * spawning the analyzer (so it never reasons about its own cost, §3.2),
+ * calls the never-throwing pass exactly once, and returns its outcome. Every
+ * risky step gets its own catch so a stage failure is a sentence in the
+ * report, never a change to the run's outcome (SC-13) — see the outer catch
+ * below for the belt-and-braces case where a bug in this function's own body
+ * throws before the pass has even run. Read-only: writes no file, journals
+ * no ledger event, and is never a gate.
+ */
+export async function runCausalAnalysisStage(args) {
+    const { root, programId, manifest, config, agentRunner, permits, git, isRepository, results, runStartCommit, ledger, log, } = args;
+    const recorder = args.recorder ?? NOOP_RUN_RECORDER;
+    const errors = [];
+    let outcome = causalAnalysisStageFailure("the causal analysis stage did not complete");
+    const safeLog = (line) => {
+        try {
+            log(line);
+        }
+        catch (error) {
+            errors.push(`the causal analysis logger failed: ${error.message}`);
+        }
+    };
+    try {
+        safeLog("causal analysis: starting");
+        const base = await resolveProgramDiffBase({ root, git, isRepository, runStartCommit });
+        const diff = base === undefined
+            ? ""
+            : await timed(recorder, { stage: "git-diff" }, () => git.diffSince(root, base));
+        // Taken before the analyzer spawns (§3.2 of the WS-05 spec): the pass is
+        // briefed from the run as it stood at this instant, so it never reasons
+        // about its own review time.
+        const snapshot = recorder.snapshot();
+        // The program document's own narrative — SC-12 requires the analyzer to
+        // consume the plan, not just the manifest's roster/success-criteria
+        // fields. Read fail-open: a missing or unreadable document is an honest
+        // gap in the brief, never a thrown stage (SC-13).
+        const programNarrative = await readFile(join(root, "docs", "programs", `${programId}-program.md`), "utf8").catch(() => undefined);
+        // Every workstream's own spec file — SC-12 requires the analyzer to
+        // consume the specifications themselves, not merely a path to them. Read
+        // fail-open per workstream: a missing or unreadable spec is an honest
+        // gap for that workstream, never a thrown stage (SC-13).
+        const workstreamSpecs = await Promise.all(manifest.workstreams.map(async (workstream) => {
+            const spec = await readFile(join(root, workstream.taskFile), "utf8").catch(() => undefined);
+            return {
+                id: workstream.id,
+                name: workstream.name,
+                taskFile: workstream.taskFile,
+                ...(spec === undefined ? {} : { spec }),
+            };
+        }));
+        outcome = await runCausalAnalysis({
+            root,
+            programId,
+            manifest,
+            config,
+            agentRunner,
+            permits,
+            recorder,
+            snapshot,
+            ledger,
+            workstreams: causalAnalysisTimeline(results),
+            diff,
+            workstreamSpecs,
+            ...(base === undefined ? {} : { baseCommit: base }),
+            ...(programNarrative === undefined ? {} : { programNarrative }),
+            log,
+        });
+        safeLog(`causal analysis: ${outcome.status}${outcome.reason ? ` — ${outcome.reason}` : ""}`);
+    }
+    catch (error) {
+        errors.push(`the causal analysis stage failed unexpectedly: ${error.message}`);
+    }
+    return { outcome, errors };
+}
+/**
+ * Fail-open durable write of one *executed* verify command's captured output
+ * (WS-02, SC-05) to a gitignored `build-logs/<programId>/verify/` file,
+ * returned as a `transcript` evidence ref for that command's span. Never
+ * throws: a write failure (full disk, EACCES) simply omits the evidence ref,
+ * never the span or the run (SC-13).
+ */
+async function writeVerifyOutputEvidence(root, programId, label, output) {
+    try {
+        const dir = join(root, "build-logs", programId, "verify");
+        await mkdir(dir, { recursive: true });
+        const fileName = `${label}-${randomBytes(4).toString("hex")}.log`;
+        await writeFile(join(dir, fileName), output, "utf8");
+        return {
+            kind: "transcript",
+            locality: "local",
+            ref: `build-logs/${programId}/verify/${fileName}`,
+            note: "verify output",
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Runs every configured verify command once, first non-zero wins — same
+ * behavior as before WS-02, but the emission model changed (§3.4.a): rather
+ * than one span for the whole pass, this emits one `verification-command` /
+ * `baseline-verification` span per *executed* command, as depth-1 tiling
+ * siblings (never a pass wrapper), so repeated full-suite cost and its
+ * evidence are visible per command. A non-zero `agentExitCode` runs no
+ * commands and emits no span at all — that attempt's failure is already
+ * carried by its own `attempt-outcome` point (§3.3), so there is no
+ * verification observation to fabricate. A command short-circuited by an
+ * earlier command's failure is likewise absent, never a measured zero.
+ * `stage` distinguishes the untouched-tree baseline check (preflight bucket)
+ * from every configured command that follows an agent's own attempt
+ * (verification bucket); `phase` names the invocation (`baseline`,
+ * `post-implementer`, `test-critique-fix`, …) as each command span's
+ * `attemptReason`. `programId`, when given, durably writes each executed
+ * command's captured output as `transcript` evidence; a caller with no
+ * `programId` (a bare test double) simply carries no evidence ref.
+ * `role`/`attemptSeat`/`attemptIndex` carry the triggering attempt's own
+ * dimensions (SC-05/SC-06) so a repeated verify pass can be uniquely
+ * correlated back to the attempt that provoked it, not just its phase.
+ */
+async function verifyAttempt(config, verifyRunner, root, agentExitCode, recorder = NOOP_RUN_RECORDER, stage = "verification-command", opts = {}) {
     if (agentExitCode !== 0) {
         return `agent exited with code ${agentExitCode}`;
     }
+    const { programId, phase, workstream, role, attemptSeat, attemptIndex } = opts;
     for (const [name, command] of Object.entries(config.verify)) {
-        const result = await verifyRunner(command, root);
+        const span = recorder.span({
+            stage,
+            verifyCommand: name,
+            ...(phase === undefined ? {} : { attemptReason: phase }),
+            ...(workstream === undefined ? {} : { workstream }),
+            ...(role === undefined ? {} : { role }),
+            ...(attemptSeat === undefined ? {} : { attemptSeat }),
+            ...(attemptIndex === undefined ? {} : { attemptIndex }),
+        });
+        let result;
+        try {
+            result = await verifyRunner(command, root);
+        }
+        catch (error) {
+            span.close({ outcome: "failed" });
+            throw error;
+        }
+        const evidenceRef = programId === undefined
+            ? undefined
+            : await writeVerifyOutputEvidence(root, programId, `${phase ?? stage}-${name}`, result.output);
+        const evidence = evidenceRef ? [evidenceRef] : undefined;
         if (result.exitCode !== 0) {
+            span.close({ outcome: "failed", ...(evidence ? { evidence } : {}) });
             return `verify \`${name}\` (${command}) exited ${result.exitCode}:\n${tail(result.output, 1500)}`;
         }
+        span.close({ outcome: "success", ...(evidence ? { evidence } : {}) });
     }
     return undefined;
 }
@@ -1693,11 +2158,23 @@ function failureDiagnosisBrief(manifest, workstream, spec, diff, failure) {
  */
 async function diagnoseFailure(options) {
     const { root, manifest, workstream, spec, agentRunner, permits, reviewer, git, baseCommit, failure, observe } = options;
-    const rawDiff = baseCommit !== undefined ? await git.diffSince(root, baseCommit) : "";
-    const brief = failureDiagnosisBrief(manifest, workstream, clipForReview(spec, "spec").text, clipForReview(rawDiff, "diff").text, failure);
+    const recorder = options.recorder ?? NOOP_RUN_RECORDER;
+    const rawDiff = baseCommit !== undefined
+        ? await timed(recorder, { stage: "git-diff", workstream: workstream.id }, () => git.diffSince(root, baseCommit))
+        : "";
+    const clippedSpec = clipForReview(spec, "spec");
+    const clippedDiff = clipForReview(rawDiff, "diff");
+    recorder.point(clippedInputPoint("failure-diagnosis-spec", spec, clippedSpec.text, { role: "reviewerAgent" }));
+    recorder.point(clippedInputPoint("failure-diagnosis-diff", rawDiff, clippedDiff.text, { role: "reviewerAgent" }));
+    const brief = failureDiagnosisBrief(manifest, workstream, clippedSpec.text, clippedDiff.text, failure);
     let invocation;
     try {
-        invocation = await invokeAgent(agentRunner, reviewer, brief, root, permits, "reviewerAgent", observe);
+        invocation = await invokeAgent(agentRunner, reviewer, brief, root, permits, "reviewerAgent", observe, recorder, {
+            stage: "failure-diagnosis",
+            workstream: workstream.id,
+            ...(options.attemptSeat === undefined ? {} : { attemptSeat: options.attemptSeat }),
+            ...(options.attemptIndex === undefined ? {} : { attemptIndex: options.attemptIndex }),
+        });
     }
     catch (error) {
         return {
@@ -1875,15 +2352,36 @@ function testCritiqueFixBrief(workstream, spec, findings) {
  * whether (and how many times) this is called.
  */
 async function attemptFix(options) {
-    const { root, programId, workstream, spec, config, agentRunner, permits, verifyRunner, git, agent, findings, greenCommit, label, log, now, observe, } = options;
+    const { root, programId, workstream, spec, config, agentRunner, permits, verifyRunner, git, agent, findings, greenCommit, label, log, now, observe, stage, attemptIndex, } = options;
+    const recorder = options.recorder ?? NOOP_RUN_RECORDER;
+    const attemptReason = stage === "fix-now" ? "fix-now-finding" : "critique-finding";
     const brief = testCritiqueFixBrief(workstream, spec, findings);
     let invocation;
     try {
-        invocation = await invokeAgent(agentRunner, agent, brief, root, permits, "agent", observe);
+        invocation = await invokeAgent(agentRunner, agent, brief, root, permits, "agent", observe, recorder, {
+            stage,
+            workstream: workstream.id,
+            attemptSeat: label,
+            attemptIndex,
+            attemptReason,
+        });
     }
     catch (error) {
         const spawnError = `the ${label} implementer could not be spawned: ${error.message}; ` +
             "the fix was not attempted and the green state was preserved.";
+        recorder.point({
+            kind: "attempt-outcome",
+            coverage: "observed",
+            dimensions: {
+                stage,
+                workstream: workstream.id,
+                role: "agent",
+                attemptSeat: label,
+                attemptIndex,
+                attemptReason,
+                outcome: "failed",
+            },
+        });
         return {
             outcome: "failed",
             greenCommit,
@@ -1897,14 +2395,36 @@ async function attemptFix(options) {
     const summary = resolvedSummary.text;
     const denialEvents = buildDenialEvents(workstream.id, label, transcript?.denials ?? [], resolvedSummary.needsPermission, config.permits?.deny ?? [], now().toISOString());
     if (denialEvents.length > 0) {
-        await appendLedgerEvents(root, programId, denialEvents);
+        await timed(recorder, { stage: "ledger-persist", workstream: workstream.id }, () => appendLedgerEvents(root, programId, denialEvents));
         for (const event of denialEvents) {
             if (event.kind !== "permission-denied")
                 continue;
             log(`${workstream.id} ${label}: denied \`${event.command}\` (${event.source})`);
         }
     }
-    const failure = await verifyAttempt(config, verifyRunner, root, invocation.exitCode);
+    const failure = await verifyAttempt(config, verifyRunner, root, invocation.exitCode, recorder, "verification-command", {
+        programId,
+        phase: stage,
+        workstream: workstream.id,
+        role: "agent",
+        attemptSeat: label,
+        attemptIndex,
+    });
+    const emitOutcome = (outcome) => {
+        recorder.point({
+            kind: "attempt-outcome",
+            coverage: "observed",
+            dimensions: {
+                stage,
+                workstream: workstream.id,
+                role: "agent",
+                attemptSeat: label,
+                attemptIndex,
+                attemptReason,
+                outcome,
+            },
+        });
+    };
     if (failure === undefined) {
         // The runner's own pending ledger and manifest writes under
         // docs/programs sit uncommitted in the tree until the run's final
@@ -1918,8 +2438,9 @@ async function attemptFix(options) {
         const dirty = await git.dirtyPaths(root);
         const meaningfulChange = dirty.some((path) => !path.replaceAll("\\", "/").startsWith("docs/programs/"));
         const commit = meaningfulChange
-            ? await git.commitAll(root, `nightshift(${programId}): ${workstream.id} ${label}`)
+            ? await timed(recorder, { stage: "git-commit", workstream: workstream.id }, () => git.commitAll(root, `nightshift(${programId}): ${workstream.id} ${label}`), commitEvidence)
             : undefined;
+        emitOutcome(commit === undefined ? "discarded" : "success");
         return {
             outcome: "kept",
             greenCommit: commit ?? greenCommit,
@@ -1941,6 +2462,7 @@ async function attemptFix(options) {
     const snapshot = await snapshotProgramsDir(root);
     await git.resetHard(root, greenCommit);
     await restoreProgramsDir(root, snapshot);
+    emitOutcome("failed");
     return { outcome: "failed", greenCommit, summary, failure, ...(transcript === undefined ? {} : { transcript }) };
 }
 /**
@@ -1952,6 +2474,7 @@ async function attemptFix(options) {
  */
 async function runTestCritique(options) {
     const { root, manifest, workstream, spec, config, agentRunner, permits, verifyRunner, git, reviewer, agent, baseCommit, now, log, transcriptSink, } = options;
+    const recorder = options.recorder ?? NOOP_RUN_RECORDER;
     let greenCommit = options.greenCommit;
     let diffClipped = false;
     const stageErrors = [];
@@ -1966,16 +2489,20 @@ async function runTestCritique(options) {
         };
     }
     const locate = (file) => locateInRepo(root, file);
-    const review = async (_round, priorOpen) => {
-        const rawDiff = baseCommit !== undefined ? await git.diffSince(root, baseCommit) : "";
+    const review = async (round, priorOpen) => {
+        const rawDiff = baseCommit !== undefined
+            ? await timed(recorder, { stage: "git-diff", workstream: workstream.id }, () => git.diffSince(root, baseCommit))
+            : "";
         const diff = clipForReview(rawDiff, "diff");
         const clippedSpec = clipForReview(spec, "spec");
         if (diff.clipped || clippedSpec.clipped)
             diffClipped = true;
+        recorder.point(clippedInputPoint("test-critique-diff", rawDiff, diff.text, { role: "reviewerAgent" }));
+        recorder.point(clippedInputPoint("test-critique-spec", spec, clippedSpec.text, { role: "reviewerAgent" }));
         const brief = testCritiqueReviewerBrief(manifest, workstream, clippedSpec.text, diff.text, priorOpen);
         let invocation;
         try {
-            invocation = await invokeAgent(agentRunner, reviewer, brief, root, permits, "reviewerAgent", transcriptSink("test-critique-reviewer"));
+            invocation = await invokeAgent(agentRunner, reviewer, brief, root, permits, "reviewerAgent", transcriptSink("test-critique-reviewer"), recorder, { workstream: workstream.id, attemptIndex: round });
         }
         catch (error) {
             // Fail open, matching the existing reviewer-error path: no findings
@@ -1987,7 +2514,7 @@ async function runTestCritique(options) {
         if (invocation.transcript) {
             const denialEvents = buildDenialEvents(workstream.id, "reviewer", invocation.transcript.denials, [], config.permits?.deny ?? [], now().toISOString());
             if (denialEvents.length > 0) {
-                await appendLedgerEvents(root, manifest.program.id, denialEvents);
+                await timed(recorder, { stage: "ledger-persist", workstream: workstream.id }, () => appendLedgerEvents(root, manifest.program.id, denialEvents));
                 for (const event of denialEvents) {
                     if (event.kind !== "permission-denied")
                         continue;
@@ -2000,7 +2527,7 @@ async function runTestCritique(options) {
         const ran = invocation.exitCode === 0 && hasFindingsBlock(invocation.output);
         return { findings, errors: parsed.errors, ran };
     };
-    const respond = async (_round, findings) => {
+    const respond = async (round, findings) => {
         const fix = await attemptFix({
             root,
             programId: manifest.program.id,
@@ -2018,6 +2545,9 @@ async function runTestCritique(options) {
             log,
             now,
             observe: transcriptSink("test-critique-fix"),
+            stage: "test-critique-fix",
+            attemptIndex: round,
+            recorder,
         });
         greenCommit = fix.greenCommit;
         if (fix.transcript)
@@ -2350,7 +2880,11 @@ function renderCommandsDeniedSection(results, ledger, programId) {
     }
     return lines;
 }
-export function renderRunReport(manifest, results, ledger, triagedThisRun, authorResult, at, wholeProgram, preflight, resumeCommand, manifestAmended) {
+export function renderRunReport(manifest, results, ledger, triagedThisRun, authorResult, at, wholeProgram, preflight, resumeCommand, manifestAmended, 
+/** Pre-rendered "Where the time went" lines (WS-04), computed and isolated by the caller via `renderAnalyticsSection`. Omitted entirely, this function's output is unchanged from before WS-04. */
+analyticsSection, 
+/** Pre-rendered "Why the time went there" lines (WS-05), computed and isolated by the caller via `renderCausalAnalysisSection`. Omitted entirely, this function's output is unchanged from before WS-05. */
+causalAnalysisSection) {
     const programId = manifest.program.id;
     const built = results.filter((result) => result.outcome.status === "complete" ||
         result.outcome.status === "skipped").length;
@@ -2459,6 +2993,12 @@ export function renderRunReport(manifest, results, ledger, triagedThisRun, autho
             "workstream's own outcome is unaffected, but the reason it fell " +
             "open belongs here.", "", ...stageErrors.map((error) => `- ${error}`), "");
     }
+    if (analyticsSection !== undefined) {
+        lines.push(...analyticsSection);
+    }
+    if (causalAnalysisSection !== undefined) {
+        lines.push(...causalAnalysisSection);
+    }
     return lines.join("\n");
 }
 //# sourceMappingURL=run-program.js.map