looply-cli 0.0.0-stage → 0.2.0

package/dist/run-cmd.js

@@ -0,0 +1,4418 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REPAIR_PROMPT_PATCH_MAX_CHARS = exports.REPAIR_PROMPT_OUTPUT_MAX_CHARS = exports.EXIT_ATTEMPT_CLAIMED = exports.EXIT_REFUSED = exports.RunRefused = void 0;
+exports.writeEndingBeforeFirstRound = writeEndingBeforeFirstRound;
+exports.describeRepair = describeRepair;
+exports.buildImplementerPrompt = buildImplementerPrompt;
+exports.runLoop = runLoop;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const workspace_1 = require("./workspace");
+const trusted_git_1 = require("./trusted-git");
+const core_1 = require("@looply/core");
+const config_1 = require("./config");
+const ledger_store_1 = require("./ledger-store");
+const run_ended_1 = require("./run-ended");
+const exemption_store_1 = require("./exemption-store");
+const queue_store_1 = require("./queue-store");
+const lane_claims_1 = require("./lane-claims");
+const run_delivery_1 = require("./run-delivery");
+const goal_met_target_1 = require("./goal-met-target");
+const reaper_1 = require("./reaper");
+const requirement_claims_1 = require("./requirement-claims");
+const evidence_cache_1 = require("./evidence-cache");
+const control_file_1 = require("./control-file");
+const git_driver_1 = require("./git-driver");
+const untrusted_gate_1 = require("./untrusted-gate");
+const model_transport_1 = require("./model-transport");
+const agent_envelope_1 = require("./agent-envelope");
+const provider_limit_1 = require("./provider-limit");
+const rejected_evidence_1 = require("./rejected-evidence");
+const owned_children_1 = require("./owned-children");
+const verify_cmd_1 = require("./verify-cmd");
+const verify_pass_1 = require("./verify-pass");
+const verify_cmd_2 = require("./verify-cmd");
+const gate_1 = require("./gate");
+const agent_driver_1 = require("./agent-driver");
+const prover_1 = require("./prover");
+const notify_channel_1 = require("./notify-channel");
+const notify_cadence_1 = require("./notify-cadence");
+const progress_view_1 = require("./progress-view");
+const signals_1 = require("./signals");
+const round_runner_1 = require("./round-runner");
+const syncing_ledger_1 = require("./syncing-ledger");
+const sync_1 = require("./sync");
+const settings_overlay_1 = require("./settings-overlay");
+const queue_summary_1 = require("./queue-summary");
+const run_lease_1 = require("./run-lease");
+const recovery_1 = require("./recovery");
+const run_start_marks_1 = require("./run-start-marks");
+const start_attempts_1 = require("./start-attempts");
+const recovery_io_1 = require("./recovery-io");
+const daemon_cmd_1 = require("./daemon-cmd");
+const goal_store_1 = require("./goal-store");
+const machine_store_1 = require("./machine-store");
+const server_client_1 = require("./server-client");
+const programme_mode_1 = require("./programme-mode");
+const partial_asker_1 = require("./partial-asker");
+const goal_ownership_1 = require("./goal-ownership");
+const goal_compile_1 = require("./goal-compile");
+const goal_execution_evidence_1 = require("./goal-execution-evidence");
+const round_records_1 = require("./round-records");
+const goal_gap_1 = require("./goal-gap");
+const goal_adaptive_1 = require("./goal-adaptive");
+const pending_action_1 = require("./pending-action");
+const approval_resolution_1 = require("./approval-resolution");
+const approval_gate_read_1 = require("./approval-gate-read");
+const approval_resumes_1 = require("./approval-resumes");
+const project_memory_store_1 = require("./project-memory-store");
+const project_index_store_1 = require("./project-index-store");
+const project_index_builder_1 = require("./project-index-builder");
+const index_for_head_1 = require("./index-for-head");
+const declared_surfaces_1 = require("./declared-surfaces");
+const packet_for_goal_1 = require("./packet-for-goal");
+const project_index_facts_1 = require("./project-index-facts");
+const project_graph_runtime_1 = require("./project-graph-runtime");
+const provider_identity_store_1 = require("./provider-identity-store");
+const agent_contained_1 = require("./agent-contained");
+const core_2 = require("@looply/core");
+const core_3 = require("@looply/core");
+const citation_readers_1 = require("./citation-readers");
+const compile_check_1 = require("./compile-check");
+const compile_store_1 = require("./compile-store");
+const provider_identity_1 = require("./provider-identity");
+const agent_exec_1 = require("./agent-exec");
+const providers_1 = require("./providers");
+const core_4 = require("@looply/core");
+const queue_write_lease_1 = require("./queue-write-lease");
+const surface_lease_1 = require("./surface-lease");
+const spend_ledger_1 = require("./spend-ledger");
+const integration_1 = require("./integration");
+/**
+ * How long a surface lease is good for without being renewed.
+ *
+ * ⚠️ GENEROUS, BECAUSE EXPIRY HERE IS A BACKSTOP AND NOT A CONTROL. A run
+ * inside a forty-five-minute model call is legitimately silent; the thing
+ * that actually stops a stale holder is the FENCE, checked at the write. The
+ * TTL exists so a surface is not held for ever by a machine that was
+ * unplugged, and six hours is past any run this product will start.
+ */
+const SURFACE_TTL_MS = 6 * 60 * 60 * 1000;
+const loop_safety_observer_1 = require("./loop-safety-observer");
+const governed_approvals_1 = require("./governed-approvals");
+const governed_broker_1 = require("./governed-broker");
+const git_push_executor_1 = require("./git-push-executor");
+const goal_depends_executor_1 = require("./goal-depends-executor");
+const governed_run_1 = require("./governed-run");
+const run_approval_1 = require("./run-approval");
+const rails_stores_1 = require("./rails-stores");
+/**
+ * A run that will not start, and that retrying cannot fix.
+ *
+ * Separate from every other failure because the daemon treats the two
+ * differently: an ordinary failure leaves the start-run queued to be offered
+ * again, and a command offered again every three seconds for an hour is noise
+ * rather than resilience. Carried out of the process as an exit code, since
+ * that is the only channel a detached child has.
+ */
+class RunRefused extends Error {
+    code;
+    branch;
+    delivery;
+    /**
+     * The same refusal, for a machine.
+     *
+     * Carried BESIDE the message, never derived from it. 6A3 gave a refusal a
+     * sentence a person reads; a second machine deciding whether to spend
+     * anything more needs to tell "the goal is met" from "a person has to decide
+     * something", and those two sentences deliberately share their opening words.
+     *
+     * Every site that throws names its own code, because the code that took the
+     * branch is the only thing that knows which branch it took.
+     */
+    constructor(message, code = 'run_refused', 
+    /**
+     * The run's branch, when the refusal came from a run that had one (M5-2).
+     * Carried so the mark can name whose branch the lane must publish before a
+     * met goal's grant closes; absent on every refusal made before a branch
+     * exists, and on every site that has nothing to say about one.
+     */
+    branch, 
+    /**
+     * What key 2 confirmed, on a `goal_satisfied` refusal only (L4b): the
+     * delivering run, the commit, and each required step's outcome. Carried to
+     * the mark so the daemon can settle the pursuit with facts, not a sentence.
+     */
+    delivery) {
+        super(message);
+        this.code = code;
+        this.branch = branch;
+        this.delivery = delivery;
+    }
+}
+exports.RunRefused = RunRefused;
+/** What `looply run` exits with when it refuses for good. */
+exports.EXIT_REFUSED = 3;
+/**
+ * THE ENDING OF A RUN THAT REGISTERED AND NEVER STARTED, WITH ITS REASON (M6-16).
+ *
+ * `releaseHold` below writes a bare `run.ended` for a run that took its slot
+ * and never reached its first round — a compile that produced nothing, a plan
+ * that came back empty, a refusal to start. M6-12 made the runner say why it
+ * halts; these endings never reach the runner, and until M6-16 their reason
+ * lived only in this process's log, which nobody reads: found live in M6-15,
+ * two machine Starts on a goal with nothing pickable each spent a minute
+ * compiling, ended `aborted` at zero rounds, and the server's feed showed the
+ * ending alone. The reason now travels the way the runner's does — one
+ * `alert { code: 'run-halted' }` immediately before the ending, on the same
+ * sink, so the phone reads "why" beside "ended" whichever half of the run
+ * wrote it. No reason recorded → no alert, never an invented sentence. Both
+ * writes are best-effort, each named in the log when it fails, and neither
+ * stops the hold being given back.
+ */
+async function writeEndingBeforeFirstRound(sink, facts, log) {
+    const now = facts.now ?? (() => Date.now());
+    if (facts.because !== null) {
+        try {
+            await sink.append({
+                ts: new Date(now()).toISOString(),
+                runId: facts.runId,
+                projectId: facts.projectId,
+                lane: 'feature',
+                kind: 'alert',
+                actor: 'runner',
+                data: { code: round_runner_1.RUN_HALTED_CODE, severity: 'warn', text: facts.because },
+            });
+        }
+        catch (e) {
+            log(`run     : could not record why this run ended before starting (${e.message})`);
+        }
+    }
+    try {
+        await sink.append({
+            ts: new Date(now()).toISOString(),
+            runId: facts.runId,
+            projectId: facts.projectId,
+            lane: 'feature',
+            kind: 'run.ended',
+            actor: 'runner',
+            data: {
+                runId: facts.runId,
+                elapsedMs: now() - facts.startedAtMs,
+                stopReason: 'aborted',
+                totals: { rounds: 0, committed: 0, discarded: 0, abandoned: 0 },
+            },
+        });
+    }
+    catch (e) {
+        log(`run     : could not record that this run ended before starting (${e.message})`);
+    }
+}
+/**
+ * The exit code for "somebody else is already executing this exact attempt".
+ *
+ * Distinct from {@link EXIT_REFUSED} on purpose, and the distinction is
+ * load-bearing. Exit 3 means the RUN decided something about the goal, and a
+ * controller may end a person's grant on it. This means nothing about the goal
+ * at all — another process got to the same attempt first — and a controller
+ * that read the two as one answer would report a goal finished because two
+ * daemons happened to tick at the same moment.
+ */
+exports.EXIT_ATTEMPT_CLAIMED = 4;
+const AGENT_TIMEOUT_MS = 45 * 60 * 1000;
+const PROVER_TIMEOUT_MS = 10 * 60 * 1000;
+function evidenceLines(evidence) {
+    if (!evidence.length)
+        return '(no evidence recorded — find it yourself, and record what you find)';
+    return evidence
+        .map((e) => `- ${e.path}${e.line ? `:${e.line}` : ''}${e.quote ? ` — ${e.quote}` : ''}`)
+        .join('\n');
+}
+/** How much of a failing step's output the repair prompt carries inline. */
+exports.REPAIR_PROMPT_OUTPUT_MAX_CHARS = 16 * 1024;
+/** How much of the previous patch the repair prompt carries inline, when it was not restored. */
+exports.REPAIR_PROMPT_PATCH_MAX_CHARS = 48 * 1024;
+/**
+ * The previous attempt, as prose the worker can act on.
+ *
+ * Three things a repair needs and the one-line `lastFailure` never carried:
+ * WHAT refused the candidate and what it printed, WHAT the candidate changed,
+ * and WHETHER that change is in the tree now. The last is stated either way —
+ * "restored, these files" or "not restored, because …, you start from the
+ * base" — so the worker is never handed an unexplained clean tree.
+ *
+ * Bounded again here, tighter than the evidence on disk: the full logs live in
+ * the evidence directory, and a prompt is not the place for 256K of jest.
+ */
+function describeRepair(repair) {
+    const p = repair.previous;
+    const lines = [];
+    lines.push(`This is attempt ${repair.attempt} of ${repair.maxAttempts} on this task. ` +
+        `Attempt ${p.attempt} (round ${p.round}) was rejected: ${p.why}`);
+    if (p.recoveredFrom !== undefined) {
+        lines.push(`That attempt was made by an earlier run (${p.recoveredFrom.runId}), which has since ended. ` +
+            'What follows was recovered from its retained evidence and checked against this task and this ' +
+            'tree before it was used.');
+    }
+    if (p.failedStep !== null)
+        lines.push(`The check that refused it was \`${p.failedStep}\`.`);
+    if (repair.restored.ok) {
+        lines.push('', 'The previous candidate has been RESTORED into the working tree, so the files it changed are ' +
+            'exactly as that attempt left them. Read them; fix what the check refused; keep what was right. ' +
+            `Restored files: ${repair.restored.paths.join(', ') || '(none)'}`);
+    }
+    else {
+        lines.push('', `The previous candidate is NOT in the working tree — ${repair.restored.because}. ` +
+            'The tree is at the base again. What follows is what that attempt changed, so you can ' +
+            'rebuild it rather than start from nothing.');
+    }
+    const ran = p.diagnostics.filter((d) => d.classification !== 'passed');
+    for (const d of ran) {
+        const exit = d.classification === 'timed_out'
+            ? 'timed out — a resource outcome, not necessarily the code'
+            : d.classification === 'unavailable'
+                ? 'could not run — the environment, not the code'
+                : `exited ${d.exitCode ?? '(unknown)'}`;
+        const out = (0, gate_1.boundText)(d.output, exports.REPAIR_PROMPT_OUTPUT_MAX_CHARS);
+        lines.push('', `### Output of \`${d.step}\` (\`${d.command}\`, ${exit})`, '', '```text', out.text.trimEnd(), '```');
+    }
+    const passed = p.diagnostics.filter((d) => d.classification === 'passed').map((d) => d.step);
+    if (passed.length > 0)
+        lines.push('', `Steps that passed on that candidate: ${passed.join(', ')}.`);
+    if (p.manifest.length > 0) {
+        lines.push('', 'Files that attempt changed:', ...p.manifest.map((m) => `- ${m.path} (${m.status.trim() || '??'})`));
+    }
+    if (!repair.restored.ok) {
+        if (p.patch !== null) {
+            const patch = (0, gate_1.boundText)(p.patch.text, exports.REPAIR_PROMPT_PATCH_MAX_CHARS);
+            const note = p.patch.truncated || patch.truncated ? ' (truncated — the full patch is in the evidence directory)' : '';
+            lines.push('', `The patch that attempt produced${note}:`, '', '```diff', patch.text.trimEnd(), '```');
+        }
+        else if (p.patchWithheld !== null) {
+            lines.push('', `Its patch is not shown: ${p.patchWithheld}.`);
+        }
+    }
+    if (p.evidencePath !== null) {
+        lines.push('', `Full evidence for that attempt is retained at ${p.evidencePath} (not readable from inside this task).`);
+    }
+    lines.push('', 'The acceptance criteria and the scope are unchanged from the previous attempt.');
+    return `\n## What happened to the previous attempt\n\n${lines.join('\n')}\n`;
+}
+/**
+ * The implementer prompt.
+ *
+ * Cached evidence goes in verbatim so the agent starts at the right file and
+ * line instead of re-searching for a defect somebody already located — that
+ * saving is most of what pays for the verification pass.
+ *
+ * A previous attempt's rejection reason goes in too: an item picked a second
+ * time with no memory of why the first attempt was thrown away will usually
+ * reproduce it.
+ */
+/**
+ * What this project has established, ready to embed in a prompt.
+ *
+ * 🔴 ONE PLACE DECIDES CURRENCY AND BUDGET. Two call sites need memory — the
+ * compiler and the implementer — and if each assembled its own, they would
+ * drift: one would read the tree and the other would not, and a fact stale in
+ * one prompt would be current in the next. The seam that produces the text is
+ * the seam that decides what is true enough to show.
+ *
+ * Reads the COMMITTED tree, because a fact was observed against a commit and
+ * `headTreeSha` is what a later run can compare it to. An unreadable tree
+ * yields null, which `currencyOf` treats as "cannot confirm" — so content facts
+ * are withheld rather than assumed, and decisions still come through.
+ */
+/**
+ * Record what a PERSON decided, from the one file only a person can write.
+ *
+ * 🔴 THE AUTHORITY COMES FROM THE CHANNEL, NOT FROM A FLAG. `.looply/config.yaml`
+ * is in `protectedPaths()`, so the container the model runs in cannot reach it.
+ * That is why these may be written as `source: 'human'` — the runtime knows the
+ * text came from a file the model has no path to, which is a stronger statement
+ * than any assertion carried on the record itself.
+ *
+ * Re-read every run, because the config is the truth and a decision removed
+ * from it should stop being asserted. Re-recording is free: the same claim
+ * collapses to one record by semantic identity, so a project that never edits
+ * its config appends nothing after the first run.
+ */
+async function rememberHumanDecisions(store, config, projectKey) {
+    if (store === null)
+        return;
+    for (const d of config.decisions) {
+        await store.remember({
+            kind: 'decision',
+            source: 'human',
+            subject: d.subject,
+            content: d.decision,
+            // The file IS the actor: it is tracked, diffable, and unreachable from
+            // the container. Naming a user we cannot verify would be worse.
+            provenance: { via: 'human-decision', refs: [], actor: 'config' },
+            scope: { projectKey },
+        }, false);
+    }
+    /**
+     * 🔴 AND WITHDRAW WHAT THE PERSON TOOK OUT. The comment above promised this
+     * and nothing implemented it: an adversarial review found that amending a
+     * decision left BOTH versions current for ever, so the model was handed two
+     * contradictory constraints with no way to tell which was live. Deleting one
+     * from the config did nothing at all.
+     *
+     * The config is the truth for decisions, so anything current that is no
+     * longer in it is withdrawn — by APPENDING a withdrawal, never by deleting.
+     * What a project used to hold is part of how it came to hold what it does.
+     */
+    const live = new Set(config.decisions.map((d) => `${d.subject}\u0000${d.decision}`));
+    for (const r of store.current(null, { kind: 'decision' })) {
+        if (live.has(`${r.subject}\u0000${r.content}`))
+            continue;
+        await store.remember({
+            kind: 'decision',
+            source: 'human',
+            subject: r.subject,
+            content: 'withdrawn from the project configuration',
+            provenance: { via: 'human-decision', refs: [], actor: 'config' },
+            scope: { projectKey },
+            supersedes: r.id,
+            withdrawn: true,
+        }, false);
+    }
+}
+/**
+ * Record that an approach was tried and failed.
+ *
+ * P11.21, and it is the reason memory matters most after Phase 9: a model with
+ * no recollection proposes the same failed approach again, and the loop-safety
+ * brake stops the machine without anybody learning why. This is what turns a
+ * repeated failure into something the NEXT plan can read.
+ *
+ * Keyed on the run, so two failures of one approach stay two records — that a
+ * thing failed twice is the whole signal, and collapsing them would erase it.
+ */
+async function rememberFailedAttempt(store, projectKey, facts) {
+    if (store === null)
+        return;
+    await store.remember({
+        kind: 'attempt',
+        source: 'deterministic',
+        subject: facts.subject,
+        // The STEP, never the output. A digest identifies which failure it was
+        // without carrying a line of it — see `failureOutputDigest`.
+        content: `the ${facts.failureStep} gate refused this approach`,
+        provenance: { via: 'gate-result', refs: [facts.runId] },
+        scope: { projectKey, ...(facts.goalId === undefined ? {} : { goalId: facts.goalId }) },
+        distinct: facts.runId,
+    }, false);
+}
+async function memoryFor(store, git, scope, 
+/**
+ * The current project graph, when one could be established.
+ *
+ * 🔴 IT REORDERS, IT NEVER FILTERS — see `rankWithin`. Null means no graph was
+ * current, and the ranking is then exactly what it was before Phase 13, which
+ * is why this is a widening rather than a change of behaviour.
+ */
+graph) {
+    if (store === null)
+        return null;
+    const tree = await git.headTreeSha().catch(() => null);
+    const records = [
+        ...store.current(tree, { kind: 'decision' }),
+        ...store.current(tree, { kind: 'fact' }),
+        ...store.current(tree, { kind: 'attempt', ...(scope.goalId === undefined ? {} : { goalId: scope.goalId }) }),
+        ...store.current(tree, { kind: 'inference' }),
+    ];
+    return (0, core_1.renderMemoryContext)((0, core_1.assembleMemoryContext)(records, undefined, relevantIds(graph, scope.goalId)));
+}
+/**
+ * Which remembered records the graph says are about the work in hand.
+ *
+ * Empty whenever there is no graph or no bound goal — an empty set makes the
+ * relevance clause a no-op rather than a special case, so there is one code path
+ * here and not two.
+ */
+function relevantIds(graph, goalId) {
+    if (graph === null || graph === undefined || goalId === undefined)
+        return new Set();
+    const context = (0, core_1.contextForGoal)(graph, goalId);
+    if (!context.found)
+        return new Set();
+    /**
+     * All four kinds, because relevance is not the same question as standing. A
+     * hypothesis about the file being changed is more worth the model's attention
+     * than one about an unrelated module — it is still labelled a hypothesis, by
+     * the section it lands in, which this cannot touch.
+     */
+    return new Set([
+        ...context.decisions,
+        ...context.facts,
+        ...context.attempts,
+        ...context.inferences,
+    ]);
+}
+/**
+ * WHAT THE COMMITTED REPOSITORY SAYS ABOUT THIS GOAL'S WORK.
+ *
+ * 🔴 THIS IS THE PHASE'S PRODUCTION CONSUMER, AND IT IS ONE LINE FROM A PROMPT.
+ *
+ * Everything else in Phase 13 — the authority classes, the freshness guard, the
+ * bounded queries — exists so that this function can put structural claims in
+ * front of a model without any of them being mistakable for a guess. If this
+ * were not wired, the phase would be the thing it was written to avoid: correct,
+ * tested, and consumed by nothing.
+ *
+ * Null when no graph is current. A refusal renders nothing rather than an empty
+ * heading, for the reason `renderMemoryContext` returns null.
+ */
+function structureFor(graph, goalId) {
+    if (graph === null || goalId === undefined)
+        return null;
+    return (0, core_1.renderGraphContext)((0, core_1.assembleGraphContext)((0, core_1.contextForGoal)(graph, goalId)));
+}
+function buildImplementerPrompt(item, attempt, cfg, 
+/**
+ * What a person refused, when this run is a resume after one.
+ *
+ * Rendered as labelled prose rather than as data, and that is a safety
+ * decision rather than a stylistic one: the transcript is scanned for a
+ * structured request for authority, and the scan takes the FIRST one it
+ * finds. A prompt that illustrated the shape of such a request would be a
+ * decoy that an echoing model files for real.
+ */
+resolution, 
+/**
+ * What a person approved that has already been DONE, when this run did it.
+ *
+ * Prose for the same reason, and the reason bites harder here: this block
+ * describes a consequential act that SUCCEEDED, and a model that read it as
+ * a template and echoed the shape back would be asking for that act again.
+ */
+governed, 
+/**
+ * What this project has already established, as labelled prose.
+ *
+ * Prose for the same reason the two blocks above are, and the reasoning is
+ * Phase 7's: a declaration of authority is a SHAPE on a structured channel,
+ * never a phrase, so nothing written here can become a request. What it must
+ * not do is show a TEMPLATE of that shape, which an echoing model could fill
+ * in for real — so memory is rendered as bulleted claims, never as data.
+ *
+ * Already sectioned and budgeted by `assembleMemoryContext`; this builder
+ * neither ranks nor trims, because one that re-decided what fits would be a
+ * second place the budget lives.
+ */
+memory, 
+/**
+ * What the committed repository establishes about this work, from the graph.
+ *
+ * 🔴 A SEPARATE PARAMETER FROM `memory`, AND SEPARATE ALL THE WAY TO THE
+ * PROMPT. Concatenating them here would put "the repository says these files
+ * import you" under the same heading as "a person decided you must not
+ * force-push" — two different authorities, and the whole of Phase 13 is that
+ * a reader can always tell which one is speaking.
+ */
+structure, 
+/**
+ * What the previous attempt did and what refused it, when this run saw it.
+ *
+ * 🔴 THE RETRY USED TO GET ONE LINE AND A CLEAN TREE. "gate red: step
+ * typecheck failed" was the whole briefing, and the work from the round
+ * before had been reset away without a word about it. A worker cannot
+ * repair what it has not been shown; it starts over. This renders the
+ * retained evidence — the failing step's output, the manifest, the patch or
+ * the fact that it was restored into the tree — as labelled prose.
+ *
+ * Prose, and never a template, for the same reason every block above is:
+ * the step output and the patch are fenced as text the model is to READ,
+ * and nothing here shows the shape of a structured request for authority.
+ */
+repair, 
+/**
+ * WHAT THE PERSON ACTUALLY ASKED FOR, WHICH NEVER GOT THIS FAR.
+ *
+ * 🔴 THE IMPLEMENTER WAS HANDED AN ITEM TITLE. A person types a goal of up to
+ * two thousand characters; the brain compiles it into items; and this builder
+ * emitted `item.title` and nothing else — so everything they wrote about what
+ * they want, why, and what would count as done stopped at the compile step.
+ * The capability audit's E-01, and the distance between it and what the
+ * product promises is the whole reason M8 exists: eleven cycles of M6 made
+ * the AUTHORITY to pursue a goal safe, while the thing being pursued was not
+ * being carried to the model doing the work.
+ *
+ * ⚠️ IT WAS ALWAYS ONE PROPERTY AWAY. The call site reads
+ * `binding.goal.id` off a `Goal` whose `text` is, in core's words, "the
+ * user's own wording, preserved verbatim". Nothing had to be carried here;
+ * the id was taken and the text was left behind.
+ *
+ * ⚠️ PROSE, AND NEVER A TEMPLATE, for the reason every block above says it:
+ * a declaration of authority is a SHAPE on a structured channel, never a
+ * phrase, and a prompt that showed that shape would be a decoy an echoing
+ * model could fill in for real. A goal is exactly where a person might write
+ * a sentence that READS like an instruction — "and then push it" — so the
+ * block introduces the text as something THEY wrote, and carries no
+ * structured shape at all.
+ *
+ * ⚠️ NOT TRIMMED HERE. The server caps a goal at `MAX_GOAL_TEXT` where it is
+ * created, and a goal reaches this machine only through the server. A second
+ * trim here would be a second place the budget lives — the same reason
+ * `memory` is neither ranked nor trimmed by this function.
+ */
+goal) {
+    const retry = repair === undefined && attempt > 0 && item.lastFailure
+        ? `\n## Why the last attempt was thrown away\n\n${item.lastFailure}\n\nDo not repeat it.\n`
+        : '';
+    const repairing = repair === undefined ? '' : describeRepair(repair);
+    const mustPass = cfg.gates.length === 0
+        ? ''
+        : `\n## What must pass before the change is kept\n\n${cfg.gates
+            .map((g) => `- ${g.name}: \`${g.run}\`${g.required ? ' (required)' : ''}`)
+            .join('\n')}\n\nThe runner executes these after you stop. A change that does not pass them is discarded.\n`;
+    const answered = resolution === undefined
+        ? ''
+        : `\n## What a person already decided\n\n${(0, approval_resolution_1.describeResolution)(resolution)}\n`;
+    const carriedOut = governed === undefined
+        ? ''
+        : `\n## What has already been done for you\n\n${(0, governed_run_1.describeGovernedResult)(governed)}\n`;
+    // Null when nothing has been remembered yet — an empty heading would tell the
+    // model that Looply looked and found nothing, which is false on a new project.
+    const known = memory === undefined || memory === null
+        ? ''
+        : `\n## What this project has already established\n\n${memory}\n`;
+    /**
+     * Null when no graph was current — which is the honest rendering of "Looply
+     * could not establish the structure this time", and is not the same claim as
+     * "this file is connected to nothing".
+     */
+    const shape = structure === undefined || structure === null
+        ? ''
+        : `\n## How this code is connected\n\n${structure}\n`;
+    /**
+     * Empty when this round is not working on a goal — a scan-seeded item, a
+     * manual run, a goal that lapsed — for the reason `memory` is empty when
+     * nothing is remembered: a heading with nothing under it would tell the model
+     * that Looply looked and found nothing, which is a different claim.
+     *
+     * The sentence around it names whose words these are. A model that cannot
+     * tell the person's wording from the runner's own instructions is one
+     * sentence away from treating the former as the latter.
+     */
+    const why = goal === undefined || goal === null || goal.trim() === ''
+        ? ''
+        : `\n## What this is for\n\nThe person who set this work going wrote this, and it is their wording, not Looply's:\n\n${goal}\n\nThe task above is one step towards it. Do that step; do not try to do the rest of it here.\n`;
+    return `You are one round of looply on the ${cfg.project.name} repository.
+
+Do exactly this one task, then stop.
+
+## The task
+
+${item.title}
+
+## Where it is
+
+${evidenceLines(item.evidence)}
+${why}${known}${shape}${retry}${repairing}${answered}${carriedOut}${mustPass}
+## Scope
+
+You may edit: ${cfg.scope.free.join(', ') || '(nothing declared)'}
+Additive only (new files): ${cfg.scope.additive.join(', ') || '(none)'}
+Never touch: ${cfg.rails.forbiddenPaths.join(', ') || '(no rails declared)'}
+
+If the task cannot be done without touching a railed path, do not touch it —
+report it as blocked with the path and the reason, and change nothing.
+
+## Rules
+
+- One concern. Keep the diff tight.
+- Add or extend a unit test covering the new behaviour. Assert the requirement,
+  not the implementation.
+- Never run git. The runner handles branching, committing and discarding.
+- Do not add a dependency unless this task explicitly calls for one.
+
+## When you are done
+
+Print exactly one JSON object, on its own line, and nothing after it:
+
+{"itemId":"${item.id}","outcome":"implemented","filesTouched":["..."],"testsAdded":0,"note":"one sentence","blocked":null}
+
+If you were blocked by a rail, use:
+
+{"itemId":"${item.id}","outcome":"blocked","filesTouched":[],"testsAdded":0,"note":"","blocked":{"path":"...","reason":"..."}}
+`;
+}
+function openGoalServer(cwd, goals, log) {
+    let identity;
+    const store = new machine_store_1.MachineStore((0, machine_store_1.machineFilePath)());
+    try {
+        identity = store.load();
+    }
+    catch {
+        return null;
+    }
+    if (!identity)
+        return null;
+    const projectId = store.projectFor((0, machine_store_1.repoPathHash)(cwd, (t) => (0, node_crypto_1.createHash)('sha256').update(t, 'utf8').digest('hex')));
+    if (!projectId)
+        return null;
+    const client = new server_client_1.ServerClient({ baseUrl: identity.serverUrl }).withToken(identity.token);
+    return {
+        projectId,
+        approvals: { createApproval: (p, input) => client.createApproval(p, input) },
+        resolution: { projectApproval: (p, id) => client.projectApproval(p, id) },
+        gate: { projectApprovals: (p, goal, limit) => client.projectApprovals(p, goal, limit) },
+        // ...and the governed surface, assembled where the vocabulary belongs.
+        governed: (0, governed_run_1.governedServerOf)(client),
+        sources: { sourceDetail: (p, id) => client.sourceDetail(p, id) },
+        servings: { forGoal: async (p, goalId) => (await client.goalServings(p, goalId)).servings },
+        questions: {
+            ask: async (body) => ({ id: (await client.askQuestion(body)).id }),
+            read: async (p, id) => (await client.questionById(p, id)).question,
+        },
+        edges: {
+            read: async (p, goalId) => {
+                const found = (await client.projectGoals(p)).goals.find((g) => g.id === goalId);
+                return found === undefined ? null : { version: found.version, dependsOn: found.dependsOn ?? [] };
+            },
+            setDependsOn: async (p, goalId, version, dependsOn, executionId) => {
+                await client.applyGovernedGoalEdge(p, executionId, { goalId, version, dependsOn });
+            },
+        },
+        refresh: async () => {
+            try {
+                const r = await client.projectGoals(projectId);
+                // A 200 is not an answer. A captive portal or a proxy interstitial
+                // arrives here as a successful response, and writing its body over the
+                // mirror would erase the very state this is trying to read.
+                const body = r;
+                if (typeof body !== 'object' || body === null || !Array.isArray(body.goals)) {
+                    log('goal    : the server answered with something that is not a goal list');
+                    return 'unreachable';
+                }
+                await goals.replace(body.goals);
+                return 'ok';
+            }
+            catch (e) {
+                log(`goal    : could not re-read your goals (${e.message})`);
+                return 'unreachable';
+            }
+        },
+    };
+}
+/**
+ * Assemble and run. Returns the summary the caller prints; every transition is
+ * already on disk in the ledger by the time this resolves.
+ */
+async function runLoop(opts) {
+    const { cwd, log } = opts;
+    // Reassigned once the phone's settings are read; see below.
+    let config = opts.config;
+    /**
+     * TWO DIRECTORIES, AND WHICH ONE A STORE GETS IS ITS INVARIANT'S ANSWER.
+     *
+     * `stateDir` is this EXECUTION's — one writer, one checkout. `projectDir` is
+     * the PROJECT's — the main worktree's, shared by every worktree of this
+     * repository. In an ordinary checkout they are the same path, so nothing about
+     * a normal `looply run` changes.
+     */
+    const stateDir = (0, git_driver_1.executionStateDir)(cwd);
+    const projectStateDirPath = (0, git_driver_1.projectStateDir)(cwd);
+    const ledger = new ledger_store_1.LedgerStore(stateDir, ledger_store_1.nodeLedgerFs);
+    const queue = new queue_store_1.QueueStore(stateDir, ledger_store_1.nodeLedgerFs);
+    const evidence = new evidence_cache_1.EvidenceCache(stateDir, ledger_store_1.nodeLedgerFs);
+    // PROJECT-SCOPED: the one channel the daemon, the run and the controller share
+    // about whether a person said stop. Per-worktree, `looply stop` would reach
+    // one execution and silently miss the rest.
+    const projectControl = new control_file_1.ControlStore(projectStateDirPath, ledger_store_1.nodeLedgerFs);
+    // Which of a person's answers have already been handed to a run. The daemon
+    // writes these at the Start boundary; a run only ever reads them, to tell a
+    // refusal nobody has heard yet from one this very run was told about.
+    //
+    // 🔴 PROJECT-SCOPED, BECAUSE THE DAEMON THAT WRITES THEM IS. The daemon
+    // claims an answer under `projectStateDir`; this read it from the EXECUTION
+    // state, so a run placed in another checkout looked in a directory the daemon
+    // never wrote to, saw no claim, and treated an answer it had just been handed
+    // as one nobody had heard. Same split as the start marks, same fix.
+    const resumes = new approval_resumes_1.ApprovalResumes(projectStateDirPath, start_attempts_1.nodeAttemptFs);
+    /**
+     * The safety history, opened once here and READ ONCE at the fence below.
+     *
+     * Null when it could not be read, and the fence then lets the run through —
+     * which is the opposite of the daemon's rule for the same file, and
+     * deliberately so. The daemon is deciding whether to spend a person's night
+     * unattended and must fail closed; this is a person at a terminal who has
+     * typed a command, and refusing them because a JSON file is corrupt would
+     * strand them with no way to work. The daemon's brake is still on.
+     */
+    const safety = await (async () => {
+        // MACHINE-SCOPED, keyed by the repository's identity. The history is
+        // bucketed on goalId alone, so the directory it sits in IS the other half
+        // of its key: a second worktree would be a fresh history, and since both
+        // detectors need three observations while a run contributes one,
+        // per-worktree histories mean they can never fire. Phase 1 fixed that by
+        // moving it to the project state directory; Phase 2 moved it out of the
+        // repository, where a re-clone or a `git clean -xfd` cannot take a live
+        // hold with it. See rails-home.ts.
+        const store = (0, rails_stores_1.railsSafetyStore)(cwd);
+        return (await store.open()) === 'ok' ? store : null;
+    })();
+    /**
+     * Project memory, opened the same way and for the same reason: a person at a
+     * keyboard is not refused because a JSON file is unreadable. Null simply
+     * means this run plans and works without what the project has learned — which
+     * is exactly how every run behaved before Phase 11.
+     */
+    const memoryKey = (0, project_memory_store_1.projectKeyFor)(cwd, (t) => (0, node_crypto_1.createHash)('sha256').update(t, 'utf8').digest('hex'));
+    const memoryStore = await (async () => {
+        const store = new project_memory_store_1.ProjectMemoryStore(stateDir, memoryKey, ledger_store_1.nodeLedgerFs);
+        return (await store.open()) === 'ok' ? store : null;
+    })();
+    // The person's decisions, before anything plans or works. A decision read
+    // after the plan is a constraint applied too late.
+    await rememberHumanDecisions(memoryStore, config, memoryKey);
+    const git = new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(cwd));
+    /**
+     * What the repository IS, established deterministically and remembered.
+     *
+     * 🔴 THIS IS THE HALF EACH OF THE LAST TWO PHASES WAS MISSING. Phase 11 froze
+     * with `fact` having no production producer; Phase 12 built an index nothing
+     * consumed. Each was the other's missing piece, and both were recorded as
+     * known limits rather than hidden — this is them being closed.
+     *
+     * Cached by tree, so the cost is paid once per revision rather than once per
+     * run. A failure here is not a reason to refuse a run: the index is a
+     * convenience for planning, not an authority over anything, so it fails
+     * silently and the run proceeds exactly as it did before Phase 12.
+     */
+    await (async () => {
+        if (memoryStore === null)
+            return;
+        try {
+            const tree = await git.headTreeSha();
+            const indexStore = new project_index_store_1.ProjectIndexStore(stateDir, ledger_store_1.nodeLedgerFs);
+            /**
+             * ⚠️ THE PACKAGE SET IS PART OF THE KEY, NOT JUST OF THE BUILD. Passing
+             * it is what stops a config edit — which no tree sha covers — being
+             * served a snapshot built under the previous workspace list. See
+             * `ProjectIndexStore.load`.
+             */
+            const packages = (0, index_for_head_1.workspacePackages)(config);
+            let snapshot = await indexStore.load(tree, packages.map((pkg) => pkg.name));
+            if (snapshot === null) {
+                snapshot = await (0, project_index_builder_1.buildProjectIndex)({ git, packages, treeSha: tree });
+                await indexStore.save(snapshot);
+            }
+            for (const draft of (0, project_index_facts_1.factsFromIndex)(snapshot, memoryKey)) {
+                await memoryStore.remember(draft, false);
+            }
+        }
+        catch {
+            // Deliberately silent. Nothing downstream depends on the index existing,
+            // and a run that refused to start because a derived cache failed would be
+            // trading a real capability for a convenience.
+        }
+    })();
+    await ledger.open();
+    await queue.open();
+    await evidence.open();
+    // The goal mirror the daemon keeps. Read here rather than fetched, because
+    // the daemon has almost certainly already pulled the version the phone was
+    // looking at, and a run that phoned home before it could begin would make
+    // the network a dependency of doing any work at all.
+    // PROJECT-SCOPED, read-only here; the daemon is the sole writer.
+    const goals = new goal_store_1.GoalStore(projectStateDirPath, ledger_store_1.nodeLedgerFs);
+    await goals.load();
+    const goalMirror = { get: (id) => goals.get(id) };
+    /**
+     * HOW STRUCTURE, KNOWLEDGE AND WORK RELATE — asked fresh, every time.
+     *
+     * 🔴 CONSTRUCTED HERE BECAUSE IT NEEDS ALL FIVE STORES, AND CONSULTED LATER
+     * BECAUSE THE WORLD MOVES WHILE A RUN WORKS. `round-runner` commits inside
+     * the loop below, so the committed tree is not the tree this line measured.
+     * The runtime asks that question again at every consumption and rebuilds
+     * when the answer changed — which is the half Phase 12 could not do, and why
+     * its index-derived facts fall silent after a run’s first commit.
+     *
+     * Nothing downstream is allowed to depend on it: every consumer treats null
+     * as "render nothing", exactly as it treated a missing memory store before.
+     */
+    const graphRuntime = new project_graph_runtime_1.ProjectGraphRuntime({
+        projectKey: memoryKey,
+        headTreeSha: () => git.headTreeSha(),
+        indexFor: async (tree) => {
+            const store = new project_index_store_1.ProjectIndexStore(stateDir, ledger_store_1.nodeLedgerFs);
+            const packages = (0, index_for_head_1.workspacePackages)(config);
+            // Same key as the block above, and for the same reason.
+            const cached = await store.load(tree, packages.map((pkg) => pkg.name));
+            if (cached !== null)
+                return cached;
+            const built = await (0, project_index_builder_1.buildProjectIndex)({
+                git,
+                packages,
+                treeSha: tree,
+            });
+            await store.save(built);
+            return built;
+        },
+        memory: () => (memoryStore === null ? [] : memoryStore.history()),
+        operational: () => ({
+            goals: goals.all().map((g) => ({ id: g.id, text: g.text, version: g.version })),
+            items: queue.list().map((i) => ({
+                id: i.id,
+                title: i.title,
+                goalId: i.goalId ?? null,
+                evidence: i.evidence.map((e) => ({ path: e.path })),
+            })),
+        }),
+    });
+    /**
+     * One question, asked once per consumption point, so a failure to establish
+     * the graph costs nothing and changes nothing. A run that cannot build one
+     * behaves exactly as every run behaved before this phase.
+     */
+    const currentGraph = async () => graphRuntime.current().catch(() => null);
+    /**
+     * IS THIS STILL THE AUTHORITY? Asked of the FILE, not of what we remember.
+     *
+     * `goals.get` answers from an array this process loaded once, which is right
+     * for the cheap questions a run asks constantly and wrong for this one:
+     * comparing that frozen snapshot against a binding taken from the same
+     * snapshot compares a value to itself and can never fail.
+     *
+     * Both compilations need it, and for the same reason. Each hands a goal's
+     * wording to an agent for up to ten minutes, then writes durable work stamped
+     * with the version it started under — while the daemon rewrites goals.json on
+     * its own poll cadence, holding no lease, so a person amending or abandoning
+     * the goal in that window is invisible to a run that only remembers.
+     *
+     * ONE function, because this was fixed for the adaptive compile and left
+     * undone for the first one, which is the same mistake this phase has now made
+     * four times: correcting a path and not its twin.
+     *
+     * Still local-first, and no server call. A machine whose mirror has not yet
+     * learned of a newer goal may go on working the one it knows; what this
+     * refuses is going on after the newer authority HAS arrived here.
+     */
+    const freshAuthority = async (goalId, boundVersion, boundText) => (0, goal_ownership_1.stillTheAuthority)(await goals.readFresh(), goalId, boundVersion, boundText);
+    // Built without starting a sync daemon: this needs one GET, not a flush loop,
+    // and the sync attaches much further down once the lease is held.
+    const goalServer = openGoalServer(cwd, goals, log);
+    // Resolved BEFORE the lease: this is read-only and may go to the network,
+    // and holding the working tree during a call that might time out would block
+    // every other run for no reason. A refusal here has taken nothing.
+    const binding = await (0, goal_ownership_1.resolveGoalBinding)({
+        ...(opts.goalId === undefined ? {} : { goalId: opts.goalId }),
+        ...(opts.goalVersion === undefined ? {} : { goalVersion: opts.goalVersion }),
+        // The SERVER's id for this repo, not the config's. They are different
+        // strings — the config's is a local name and every goal carries a `prj_`
+        // id — so checking against the wrong one would refuse every goal as
+        // belonging to somewhere else.
+        projectId: goalServer?.projectId ?? config.project.id ?? 'local',
+        mirror: goalMirror,
+        ...(goalServer === null ? {} : { refresh: goalServer.refresh }),
+    });
+    /**
+     * What a person has attested about the requirements this goal names, read off
+     * the binding this run is bound to.
+     *
+     * A function rather than a value because both endings ask for it at the
+     * moment they render, and because a goal can be amended while a run is going:
+     * asking then means the sentence describes the goal the reader is being told
+     * about. Null for a run with no goal, and for a goal that names no
+     * requirements — and then both endings are byte-identical to before.
+     */
+    const attestedNow = () => binding.kind === 'bound' ? (0, core_3.attestedStanding)(binding.goal) : null;
+    /**
+     * THE ITEM→REQUIREMENT CLAIMS THIS PLAN MAKES, validated before they are
+     * recorded.
+     *
+     * 🔴 THE MODEL'S PROPOSAL IS UNTRUSTED DATA ALL THE WAY TO ONE VALIDATOR.
+     * `normalizeStep` carries `serves` through without inspecting it;
+     * `produceClaims` filters step names against THIS project's gate — the one
+     * check core cannot make, because the gate configuration lives here — and
+     * then hands the remainder to `servedRequirementTrouble`, the same pure
+     * function the server's route calls. Nothing else decides.
+     *
+     * ⚠️ EVERY FAILURE PATH RECORDS NO CLAIMS, NEVER PARTIAL ONES. An unreadable
+     * source, an unbound goal or a server this run cannot reach all answer the
+     * empty list — because a claim silently missing is a requirement that blocks
+     * at the coverage gate, which is visible, while a claim wrongly recorded is
+     * evidence that is not.
+     *
+     * ⚠️ AND NO FALLBACK. A goal's requirements are NOT copied onto its items when
+     * the model named none: that would make every item claim everything and the
+     * per-requirement receipt would mean exactly what the whole-tree one already
+     * meant.
+     */
+    const claimsFor = async (steps, items, goalLinks) => {
+        if (goalServer === null || goalLinks.length === 0)
+            return [];
+        if (!steps.some((s) => s.serves !== undefined))
+            return [];
+        const sources = await (0, requirement_claims_1.linkableSourcesForGoal)(goalLinks, async (sourceId) => goalServer.sources.sourceDetail(projectId, sourceId));
+        if (sources === null) {
+            log('compile : a linked source could not be read, so no requirement claims were recorded');
+            return [];
+        }
+        const produced = (0, requirement_claims_1.produceClaims)({
+            steps,
+            itemIds: items.map((i) => i.id),
+            goalLinks,
+            sources,
+            gateStepNames: new Set(config.gates.map((g) => g.name)),
+        });
+        // Named, never silent: a refused claim is a model proposal this project
+        // declined, and the person reading the log is the one who can fix it.
+        for (const d of produced.dropped)
+            log(`compile : claim refused — ${d.because}`);
+        if (produced.servings.length > 0) {
+            log(`compile : ${produced.servings.length} item(s) claim a requirement`);
+        }
+        return [...produced.servings];
+    };
+    /**
+     * WHAT THIS DELIVERY FINISHED, FOR THE LANE TO JUDGE LATER.
+     *
+     * The claims say what each item was FOR; this says which of them the delivery
+     * actually finished, and at which tip. The lane cannot re-derive either — no
+     * commit trailer records an item id, and the run registry is released on a
+     * clean exit — so it is written where KEY 2 has already answered both, rather
+     * than derived a second time somewhere that could disagree.
+     *
+     * ⚠️ IT IS PROVENANCE, NOT ACCEPTANCE. `coverageNow` is this worker's verdict
+     * about its own checkout; the lane discards that and recomputes from its own
+     * gate on the commit it publishes. What travels is the claim.
+     *
+     * ⚠️ AN ARROW, LIKE `coverageNow`, AND FOR THE SAME TYPE-LEVEL REASON.
+     * `key2Saw` is a `let` filled inside a callback, so in the straight-line body
+     * TypeScript's flow analysis still holds it at its `null` initializer and
+     * narrows `!== null` to `never`. Read across a closure boundary it has its
+     * declared type, which is the honest one — the alternative was a non-null
+     * assertion, and that would be a claim where this needs a check.
+     */
+    /**
+     * 🔴 THE BRANCH THAT DELIVERED, NOT THIS START'S (F20). The goal-met question is
+     * asked by a Start whose plan had nothing left to pick, and that Start refuses
+     * before its runner ever creates `branch`. KEY 2's confirming round names the run
+     * that delivered; the lane-claims ledger names the branch that run cut
+     * (`deliveringBranchOf`). The checked-out branch is the fallback, `branch` the last.
+     *
+     * ⚠️ AN ARROW, for the same flow-analysis reason as `recordDelivery` below.
+     */
+    const deliveringBranch = async () => {
+        if (deliveringRunId === null)
+            return branch;
+        const cut = (0, run_delivery_1.deliveringBranchOf)((0, lane_claims_1.readLaneClaims)(cwd), deliveringRunId);
+        if (cut !== null)
+            return cut;
+        try {
+            const current = await git.currentBranch();
+            // F33: after a goal-met Start detached HEAD there is no branch to name; this Start's own is the honest fallback.
+            return current === '(detached)' || current === '(unknown)' ? branch : current;
+        }
+        catch {
+            return branch;
+        }
+    };
+    const recordDelivery = async (at, goalVersion) => {
+        if (key2Saw === null)
+            return;
+        // F31 (soun-4): only work the confirmed head's history contains — the rounds of THIS goal's items.
+        const confirmedAt = judged.kind === 'carried' ? judged.of : await git.headSha();
+        const mineIds = new Set(queue.list().filter((i) => i.goalId === at.goalId).map((i) => i.id));
+        const rounds = await (0, round_records_1.readRoundRecords)(stateDir, ledger_store_1.nodeLedgerFs);
+        const ours = rounds.ok ? rounds.rounds.filter((r) => mineIds.has(r.itemId)) : [];
+        const delivered = rounds.ok ? (0, run_delivery_1.onThisBranch)([...key2Saw.delivered], ours, await (0, run_delivery_1.reachableFrom)(git, confirmedAt, ours)) : [...key2Saw.delivered];
+        (0, lane_claims_1.recordLaneClaim)(cwd, {
+            schema: lane_claims_1.LANE_CLAIMS_SCHEMA,
+            kind: 'delivery',
+            at: new Date().toISOString(),
+            branch: await deliveringBranch(),
+            runId: deliveringRunId ?? runId,
+            goalId: at.goalId,
+            goalVersion,
+            planRevision: at.planRevision ?? core_1.FIRST_PLAN_REVISION,
+            // KEY 2's own sha — for a carried commit, the round the lane carried (F27).
+            commitSha: judged.kind === 'carried' ? judged.of : await git.headSha(),
+            ...(judged.kind === 'carried' ? { judgedAt: judged.sha } : {}),
+            delivered,
+            acceptanceDigest: (0, core_3.acceptanceMapDigest)(config.gates),
+        });
+    };
+    /**
+     * D3 — the fourth key, computed at the moment the claim would be made.
+     *
+     * 🔴 THE DIFFERENCE BETWEEN D3 IMPLEMENTED AND D3 WIRED. `coverageGate` is a
+     * pure fold; without a caller it decides nothing, and a rule nothing consults
+     * is the shape this programme keeps writing tests about.
+     *
+     * ⚠️ `deliveredUnderReceipt: true` IS NOT AN ASSUMPTION. This is only ever
+     * asked for a `satisfied` decision, and `satisfied` is reachable only when
+     * KEY 2 turned — a decision whose KEY 2 failed is `unconfirmed`, a different
+     * kind entirely. So the receipt is already established by the time this runs,
+     * and re-deriving it here would be a second implementation of the same
+     * question that could disagree with the first.
+     *
+     * ⚠️ UNDEFINED WHEN IT CANNOT BE ASKED, WHICH IS NOT THE SAME AS COVERED. No
+     * server, no linked requirements, or a source the server could not answer for
+     * all return undefined, and `describeAdaptive` then renders exactly what it
+     * always did. What it must never do is return an empty gate, because an empty
+     * gate says `ok` — granting coverage on the strength of a failed lookup.
+     */
+    const coverageNow = async () => {
+        if (binding.kind !== 'bound' || goalServer === null)
+            return undefined;
+        const links = binding.goal.requirements ?? [];
+        if (links.length === 0)
+            return undefined;
+        const classifications = new Map();
+        const dispositions = new Map();
+        const attestations = new Map();
+        let measuredTree = null;
+        for (const sourceId of new Set(links.map((l) => l.sourceId))) {
+            let detail;
+            try {
+                detail = await goalServer.sources.sourceDetail(projectId, sourceId);
+            }
+            catch {
+                // A source that could not be read is a coverage question this run
+                // cannot answer. Answering "covered" would be the lie; answering
+                // "blocked" for every one of its links would invent a measurement.
+                return undefined;
+            }
+            const key = (ordinal) => `${sourceId}#${ordinal}`;
+            for (const c of detail.classifications)
+                classifications.set(key(c.ordinal), c);
+            for (const d of detail.dispositions)
+                dispositions.set(key(d.ordinal), d);
+            for (const a of detail.attestations)
+                attestations.set(key(a.ordinal), a);
+            if (detail.reconciledAt !== null)
+                measuredTree = detail.reconciledAt.treeSha;
+        }
+        /**
+         * 🔴 THE FOURTH KEY'S STRONGER HALF, AND THE FIRST TIME IT CAN BE EARNED.
+         *
+         * `receiptedRequirements` has had a place in the gate and no producer:
+         * every measured grant came back `measured-under-whole-tree-receipt`
+         * because nothing recorded what an item was FOR. The claims are on the
+         * server; what the delivery did is what KEY 2 saw; the fold is the only
+         * thing that decides which claims survive both.
+         *
+         * ⚠️ A SERVER THAT CANNOT ANSWER LEAVES THE SET EMPTY, WHICH GRANTS
+         * NOTHING EXTRA. It is the weaker word again, never a stronger one on a
+         * failed lookup — the same rule the whole function already follows.
+         */
+        let receipted = new Set();
+        if (key2Saw !== null) {
+            try {
+                const rows = await goalServer.servings.forGoal(projectId, binding.goal.id);
+                const byItem = new Map();
+                for (const r of rows) {
+                    const list = byItem.get(r.itemId) ?? [];
+                    list.push({
+                        sourceId: r.sourceId,
+                        ordinal: r.ordinal,
+                        ...(r.row === undefined ? {} : { row: r.row }),
+                        provenBy: r.provenBy,
+                    });
+                    byItem.set(r.itemId, list);
+                }
+                const fold = (0, core_3.requirementReceipts)({
+                    servings: [...byItem].map(([itemId, serves]) => ({ itemId, serves })),
+                    deliveredItems: key2Saw.delivered,
+                    executedChecks: key2Saw.checks,
+                });
+                // A proven table row is receipted under its own address (F24); the gate never lets it speak for its statement.
+                receipted = new Set([...fold.receipted, ...fold.receiptedRows]);
+            }
+            catch {
+                // Unreadable claims prove nothing either way. An empty set is the
+                // honest input: the gate then says `measured-under-whole-tree-receipt`
+                // in simple mode and blocks in strict, which is what "we could not
+                // check" should do in each.
+            }
+        }
+        return (0, core_3.coverageGate)({
+            links,
+            classifications,
+            dispositions,
+            attestations,
+            measuredTree,
+            deliveredUnderReceipt: true,
+            receiptedRequirements: receipted,
+            /**
+             * 🔴 STRICT IS PROGRAMME MODE, AND SIMPLE IS EVERYTHING ELSE.
+             *
+             * A machine running as a programme decides its own completions with
+             * nobody reading each one, so a green tree around an unclaimed
+             * requirement must not settle it. Under a person's explicit Start the
+             * answer is unchanged, byte for byte — which is the "preserve D3,
+             * preserve Simple Mode" half of §6.B, and the reason this is a mode
+             * rather than a new rule for everybody.
+             */
+            mode: (0, programme_mode_1.programmeIsOn)(config) ? 'strict' : 'simple',
+        });
+    };
+    if (binding.kind === 'refused') {
+        // The binding says WHICH refusal it is; nothing here reads its sentence.
+        throw new RunRefused(binding.reason, binding.lapse === 'abandoned' ? 'goal_abandoned' : 'goal_superseded');
+    }
+    if (binding.kind === 'retry')
+        throw new Error(binding.reason);
+    /**
+     * The version AND THE REVISION are part of the scope.
+     *
+     * A run works the plan compiled for the goal AS IT IS NOW, plus anything a
+     * person adopted by hand. A previous version's plan stays owned and durable
+     * and is simply not this run's to work — and the same is now true one level
+     * down, of a previous REVISION of the current version.
+     *
+     * This was revision-blind, and the asymmetry it created is why 6D0 blocked:
+     * selection saw every revision as current while KEY 2 asked only about the
+     * newest, so a run could deliver revision 1 work that the completion check
+     * could not see. Under one explicit Start that cost a person one confusing
+     * refusal. Under an autonomous controller it is a dead end — Starts spent
+     * delivering work that can never satisfy the goal.
+     *
+     * `FIRST_PLAN_REVISION` when the goal owns nothing yet: this run is about to
+     * compile revision 1, and its rows have to be selectable when it does. It is
+     * the MAXIMUM present otherwise, which is what makes a "future" revision
+     * unreachable by construction rather than by luck.
+     */
+    let scope = binding.kind === 'bound'
+        ? {
+            goalId: binding.goal.id,
+            goalVersion: binding.goal.version,
+            planRevision: Math.max((0, goal_ownership_1.currentPlanRevision)(queue.list(), binding.goal.id, binding.goal.version), core_1.FIRST_PLAN_REVISION),
+        }
+        : null;
+    if (binding.kind === 'bound') {
+        log(`goal    : ${binding.goal.text}`);
+    }
+    // Scoped from here on. `list()` is filtered and nothing else is, so a run
+    // still reads and writes any item it is holding — see `scopedQueue`.
+    let runQueue = (0, goal_ownership_1.scopedQueue)(queue, scope);
+    const all = runQueue.list();
+    const ready = all.filter((i) => i.state === 'ready');
+    const baseSha = await git.headSha();
+    const runId = (0, core_1.newId)('run');
+    /**
+     * 🔴 AND AN ADDRESSED ONE, BECAUSE ONE SHARED FILE CANNOT BRAKE N RUNS.
+     *
+     * `ControlStore.consume()` writes `resume` into the file it read. With
+     * several executions running, the FIRST to reach a round boundary therefore
+     * cleared the instruction and the rest read `resume` and carried on — while
+     * `looply stop` had already printed "N executions are running; the request
+     * reaches all of them". It reached one.
+     *
+     * `looply stop` now also writes `control.<runId>.json` into each live
+     * execution's own state directory, and this reads its own alongside the
+     * shared one. An addressed instruction can only be consumed by the run it
+     * names, so no run's stop is destroyed by another run obeying.
+     *
+     * ⚠️ THE SHARED FILE IS STILL READ, AND FIRST-EQUAL. It is what the daemon and
+     * the phone write, what a `looply stop` typed while nothing was running
+     * leaves behind for the next run, and what Simple Mode has always used. This
+     * is additive: with one execution the two agree, and with none the addressed
+     * file is never written.
+     *
+     * ⚠️ AND `consume()` CLEARS BOTH, in that order. Clearing only the addressed
+     * one would leave a project-wide `stop` on disk for the next run to obey
+     * without explanation — the permanent-stop failure the runner documents.
+     */
+    const addressedControl = control_file_1.ControlStore.addressed(stateDir, runId, ledger_store_1.nodeLedgerFs);
+    const control = {
+        /**
+         * 🔴 `resume` IS THE CLEARED STATE, NOT AN INSTRUCTION, and the first version
+         * of this treated it as one. `??` falls through only on `null`, and every run
+         * CONSUMES at start — which WRITES `resume` into the addressed file. From
+         * that moment the addressed file always answered, the project's `control.json`
+         * was never read again, and no `looply stop`, no phone Stop and no phone
+         * Pause reached the run. Ever. Including in Simple Mode, where there is only
+         * ever one execution and the whole addressed mechanism is beside the point.
+         *
+         * Measured before the fix: after one start-consume, a project-wide `stop`
+         * read back as `resume` for ever.
+         *
+         * So an addressed file takes precedence only while it carries something to
+         * act on.
+         */
+        read: async () => {
+            const mine = await addressedControl.read();
+            if (mine !== null && mine.kind !== 'resume')
+                return mine;
+            return projectControl.read();
+        },
+        /**
+         * ⚠️ AND THE ADDRESSED FILE IS ONLY WRITTEN WHEN THERE IS SOMETHING IN IT TO
+         * CLEAR. Consuming unconditionally created a `control.<runId>.json` in every
+         * ordinary run's state directory, one per run, for ever — a file Simple Mode
+         * never had. Now only `looply stop` creates one, and only the run it names
+         * clears it.
+         */
+        consume: async () => {
+            const mine = await addressedControl.read();
+            if (mine !== null && mine.kind !== 'resume')
+                await addressedControl.consume();
+            await projectControl.consume();
+        },
+    };
+    /**
+     * 🔴 THE RUN ID IS IN THE BRANCH NAME, and it has to be.
+     *
+     * The stamp is second-resolution, so two runs starting in the same second
+     * produced the IDENTICAL branch — measured: two calls in one process returned
+     * `20260903222307` twice. `createBranch` treats an existing branch as a hard
+     * refusal (git-driver.ts), which is right, so the second run simply died.
+     *
+     * Today that is nearly unreachable, because one lease means one run per
+     * checkout. It stops being unreachable the moment two worktrees run at once:
+     * linked worktrees SHARE the ref namespace, so isolating the state
+     * directories does nothing for this. The stamp stays because it is what makes
+     * a branch list readable by a human; the id is what makes it unique.
+     */
+    const stamp = new Date().toISOString().replace(/[-:T]/g, '').slice(0, 14);
+    const branch = `looply/run-${stamp}-${runId.slice(-8)}`;
+    // Computed twice on purpose: the dry run reports the file, and the real run
+    // recomputes below once the phone's settings have been laid over it.
+    const fileMinHours = opts.hours ?? config.run.minHours;
+    if (opts.dryRun) {
+        log(`project : ${config.project.name}`);
+        log(`branch  : ${branch} (would be created from ${baseSha.slice(0, 7)})`);
+        log(`budget  : ${fileMinHours}h, up to ${config.run.maxRounds} rounds`);
+        log(`queue   : ${ready.length} ready`);
+        // Said plainly rather than quietly wrong: the overlay needs the server, and
+        // a dry run deliberately does not open one.
+        log('dry run: settings from your phone are read when the run actually starts.');
+        log(`proof   : ${config.proof.enabled ? 'on' : 'OFF — work would be kept on a passing build alone'}`);
+        log(`gates   : ${config.gates.map((g) => g.name).join(', ')}`);
+        log('');
+        if (!ready.length) {
+            // A dry run is precisely when an empty queue should be information rather
+            // than an error — you asked what would happen, and this is what would.
+            log(`dry run: nothing would run — ${(0, queue_summary_1.describeNoReady)(all)}`);
+        }
+        else {
+            log(`dry run: would start with "${ready[0].title}".`);
+        }
+        log('dry run: no branch created, no agent called.');
+        return { stopReason: 'command', totals: { rounds: 0, committed: 0, discarded: 0, abandoned: 0 }, elapsedMs: 0 };
+    }
+    /**
+     * The provider preset, resolved BEFORE the lease is taken.
+     *
+     * 🔴 POSITION IS THE POINT. A misspelled provider name is a configuration
+     * mistake, and the run must stop on it having done nothing — not after taking
+     * the working tree's lease, cutting a branch and spending the first model
+     * call. An earlier version of this sat beside the agent construction five
+     * hundred lines below, with a comment claiming it stopped before the lease.
+     * It did not; the lease is taken immediately after this line.
+     *
+     * ⚠️ THE WARNING IS PRINTED, NOT SWALLOWED. Two of the three presets have
+     * never been run by this repository's tests, and somebody starting a night's
+     * work on one should be told before it starts rather than after.
+     */
+    const resolved = (0, providers_1.resolveProvider)({
+        ...(config.provider === undefined ? {} : { provider: config.provider }),
+        spec: config.agent,
+    });
+    if (!('spec' in resolved)) {
+        log(resolved.message);
+        return {
+            stopReason: 'command',
+            totals: { rounds: 0, committed: 0, discarded: 0, abandoned: 0 },
+            elapsedMs: 0,
+        };
+    }
+    if (resolved.warning !== null)
+        log(`provider: ${resolved.warning}`);
+    // One working tree, one mutating runner — taken here, by the process that
+    // will do the mutating, and not by the daemon that may have asked for it. The
+    // daemon spawns a run detached and unrefs it, so a lease holding the daemon's
+    // pid would name a process that is dead while the run it describes is alive,
+    // and every reader of that lease would then act on "dead": start a second
+    // runner, rewrite a live run's queue, tell the phone a healthy run crashed.
+    // Taking it here also covers `looply run` typed by hand, which the daemon
+    // never sees at all.
+    const leases = new run_lease_1.RunLeaseStore(stateDir, run_lease_1.nodeLeaseFs);
+    const baseBranch = await git.currentBranch();
+    // What the last run left behind, judged before anything is taken or written.
+    // Read-only: this decides, the block below acts.
+    /**
+     * 🔴 A QUEUE WRITE IN PROGRESS BLOCKS A RUN, WHICH MAKES THE LOCK TWO-SIDED.
+     *
+     * Scan and verify take a write lock so a run cannot revert their work. That
+     * was only half the arrangement: a run started DURING a verify pass consulted
+     * only the run lease — free, because the pass never takes it — acquired it,
+     * re-opened the queue, and wrote its own snapshot back over every verdict the
+     * pass produced. Measured. The pass reported N confirmed and the items were
+     * all back to `draft`.
+     *
+     * ⚠️ REFUSED, NOT QUEUED. A run that waited would hold the lease while it
+     * waited, which is the deadlock the other direction.
+     */
+    const writing = (0, queue_write_lease_1.queueWriteInProgress)(cwd);
+    if (writing.busy) {
+        /**
+         * ⚠️ A PLAIN THROW, NOT A `RunRefused`. Every `RunRefusalCode` is TERMINAL —
+         * a controller that saw one would stop offering this goal — and "somebody is
+         * writing the queue right now" is the most retryable condition there is. It
+         * ends like a held lease does: exit 1, and the Start is redelivered.
+         *
+         * ⚠️ AND NOTHING IS RELEASED HERE, because nothing is held yet: this sits
+         * before the lease is inspected, let alone acquired.
+         */
+        throw new Error(`cannot start: ${writing.because}`);
+    }
+    const priorState = await leases.inspect();
+    const recovery = (0, recovery_1.classifyRecovery)({
+        lease: priorState.kind === 'dead' ? priorState.lease : null,
+        // The RAW queue, deliberately. Recovery is about what the LAST run left
+        // behind, and that run may have been bound to another goal or to none;
+        // asking a scoped view would hide exactly the stranded work it exists to
+        // find, and this run would then start on top of it.
+        /**
+         * 🔴 BOTH IN-FLIGHT STATES, NOT ONE. `round-runner` writes `verifying`
+         * before it writes `in_progress`, so a run that died between them left an
+         * item nothing could move and every later run in that checkout answered
+         * "nothing to do". See `ItemRepair.unverify` for the measurement.
+         */
+        stranded: queue.list().filter((i) => i.state === 'in_progress' || i.state === 'verifying'),
+        changedPaths: await git.changedPaths(),
+        currentBranch: baseBranch,
+        headSubject: await git.messageOf('HEAD'),
+        // F33: a goal-met Start that moved HEAD and died left it here on purpose.
+        judging: (0, goal_met_target_1.readJudgingMarker)(stateDir),
+        headSha: await git.headSha(),
+    });
+    if (recovery.kind === 'blocked') {
+        // Nothing has been touched: not the queue, not the tree, not a ref. The
+        // person is told what looply found and why it will not guess.
+        log('');
+        log(`recover : ${recovery.reason}`);
+        throw new Error(`cannot start: ${recovery.reason}`);
+    }
+    const lease = await leases.acquire({
+        runId,
+        branch,
+        baseBranch,
+        cliVersion: daemon_cmd_1.CLI_VERSION,
+        ...(opts.commandId === undefined ? {} : { startedByCommandId: opts.commandId }),
+        // Durable, and read by the daemon's launcher after a restart: it is how a
+        // second Start naming a different goal is told apart from a redelivery of
+        // this one.
+        ...(scope === null ? {} : { goalId: scope.goalId }),
+    });
+    /**
+     * CAPACITY, AFTER THE LEASE AND BEFORE ANY WORK.
+     *
+     * The lease answers "is THIS checkout busy" and structurally cannot answer
+     * anything else — leases live one per state directory and cannot see each
+     * other. The registry answers "what else is this PROJECT running", which is a
+     * question a second workspace makes askable for the first time.
+     *
+     * ⚠️ ORDERED AFTER THE LEASE. Taking the slot first would mean a run that then
+     * loses the lease race has to hand a slot back, and a crash between the two
+     * would leak one permanently.
+     *
+     * ⚠️ A PLAIN ERROR, NEVER `RunRefused`. Every `RunRefusalCode` is terminal —
+     * `isContinuableRefusal` returns false for all seven — and a controller that
+     * saw one would send the pursuit to `human_required`. "The machine is busy
+     * right now" is the most retryable condition there is, and it is refused the
+     * same way a held lease is refused: a sentence, and a non-zero exit.
+     */
+    const registry = new workspace_1.RunRegistry(projectStateDirPath);
+    const runRecord = {
+        runId,
+        workspace: cwd,
+        stateDir,
+        branch,
+        baseSha,
+        // The main checkout is not a workspace looply created, and the reaper must
+        // never treat it as one.
+        worktree: (0, node_path_1.resolve)(cwd) !== (0, node_path_1.resolve)((0, trusted_git_1.mainWorktreeRoot)(cwd) ?? cwd),
+        pid: process.pid,
+        host: (0, node_os_1.hostname)(),
+        startedAt: new Date().toISOString(),
+        // M4-2: who asked. `--autonomous` is the launcher's word for a machine start,
+        // and only such a run may ever be asked to stop for a higher-priority goal.
+        startedBy: opts.autonomous === true ? 'machine' : 'person',
+    };
+    /**
+     * CLAIMED, NOT COUNTED. Counting was check-then-act: two runs starting
+     * together both passed it and both proceeded. `claim` takes one of `limit`
+     * exclusively-created slots, so the filesystem decides — see `RunRegistry`.
+     */
+    /**
+     * 🔴 GUARDED, BECAUSE `claim` CAN THROW. Its contract is
+     * `{ ok: false, because }` and it keeps it for every decision — but a
+     * filesystem that refuses a mkdir, a write with an errno outside the
+     * lost-a-race set, or a full disk, all come out as exceptions. This sits forty
+     * lines below `leases.acquire`, so an exception here left the run lease held
+     * by a process that is about to exit, and the next start had to wait for the
+     * pid to be judged dead before it could take over.
+     */
+    let capacity;
+    try {
+        capacity = registry.claim(runRecord, config.run.maxConcurrentRuns ?? 1);
+    }
+    catch (e) {
+        await leases.release(lease.token);
+        throw e;
+    }
+    if (!capacity.ok) {
+        // No `registry.release` here: nothing is registered yet. Releasing would be
+        // harmless — it is idempotent — but it would read as if a slot had been
+        // taken and given back, which is the opposite of what happened.
+        await leases.release(lease.token);
+        throw new Error(capacity.because);
+    }
+    /**
+     * 🔴 GIVING THE HOLD BACK HAS ONE IMPLEMENTATION, AND EVERY EXIT USES IT.
+     *
+     * The first version released the lease, the registry entry and the slot as
+     * three lines copied to four places — and there were ELEVEN other ways out of
+     * the span between here and the try/finally far below, none of which released
+     * anything. Each one left a registry file naming a pid that had already gone.
+     *
+     * That was survivable only by accident: the probe reads a dead pid as dead, so
+     * the slot is reclaimed and the entry reads as an orphan. But it made
+     * `looply runs` report executions that never started, and it put the whole
+     * bound one recycled pid away from a machine that refuses to run at all —
+     * because a leaked record whose pid a later process inherits reads as ALIVE,
+     * forever, and nothing dead ever clears it.
+     *
+     * Idempotent on purpose: the teardown calls it too, and calling it twice must
+     * be as ordinary as calling it once.
+     */
+    let holdReleased = false;
+    /**
+     * The surfaces this run holds, readable from the teardown that is defined
+     * ABOVE the acquisition which fills it.
+     *
+     * A ref rather than a `let`, so there is one place the teardown reads and no
+     * chance of it closing over a stale value.
+     */
+    const heldSurfacesRef = { current: [] };
+    /**
+     * SETTLE THIS RUN'S BUDGET RESERVATION, once the admission below has made one.
+     *
+     * A ref-shaped hook for the same reason `heldSurfacesRef` is: the teardown is
+     * defined above the admission that fills it. Null until there is something to
+     * settle, and `Admission.settle` is itself idempotent, so a teardown that runs
+     * twice charges once.
+     */
+    let settleAdmission = null;
+    const startedAtMs = Date.now();
+    /**
+     * Whether this run has REGISTERED — taken a slot and written its start mark —
+     * and so is a run the daemon may be waiting on. Set once, below, after
+     * `registry.register` succeeds.
+     */
+    let registered = false;
+    /**
+     * The sync loop `attachSync` starts below, once it has — stopped as the LAST
+     * act of `releaseHold`, so every exit that gives the hold back also lets the
+     * process end. See the end of `releaseHold` for why that is not the teardown's
+     * job alone.
+     */
+    let stopSync = null;
+    /** Where the ending below is written: the synced ledger once it exists, the local one before. */
+    let endingSink = ledger;
+    let endingProjectId = config.project.id ?? 'local';
+    /**
+     * M6-16: WHY THIS RUN IS LEAVING BEFORE ITS FIRST ROUND, when it is. Set by
+     * `leaving(...)` at each exit that ends the run between registration and
+     * the runner's start, immediately before that exit's `releaseHold()` — so
+     * the ending written there can say why. Null for a run that started (its
+     * ending is the runner's) and for an exit nobody named.
+     */
+    let endedBefore = null;
+    /** What the compile pass concluded when it queued nothing — appended to the reason, if there is one. */
+    let compileNote = null;
+    const leaving = (because) => {
+        endedBefore = compileNote === null ? because : `${because} (${compileNote})`;
+    };
+    const releaseHold = async () => {
+        if (holdReleased)
+            return;
+        holdReleased = true;
+        /**
+         * 🔴 A RUN THAT REGISTERED AND NEVER STARTED LEAVES ITS OWN ENDING.
+         *
+         * The start mark is written at registration, and the daemon reads it as
+         * "a Run exists" — from then on the controller closes this Start only on a
+         * durable `run.ended` for this run id (`run-ended.ts`). But `run.started`
+         * is emitted after the compile pass and both verify passes, and six exits
+         * sit between registration and it: a superseded goal, an adoption that
+         * fails, a work set with nothing ready (`nothing to do — …`), a decision
+         * that cannot be picked up. The refusals among them write a refusal mark,
+         * which outranks the receipt. The plain errors wrote NOTHING: the run gave
+         * back its lease, its slot and its record and left, and the daemon waited
+         * on a ledger that never mentions it for the life of the grant. MEASURED
+         * end to end with the daemon's own reader in `scripts/coordinator-e2e.js`:
+         * every placed run left by `nothing to do` and no ordinal ever closed.
+         *
+         * So a registered run that leaves without ever having started says so, as
+         * its last act before the record is given back: `aborted`, because a living
+         * process wrote it, with totals that are exactly zero because no round
+         * began. A run that DID start is not touched here — its ending is the
+         * runner's to write, and recovery's when the runner could not.
+         *
+         * ⚠️ NEVER FATAL. A run that could not write its ending still gives
+         * everything back; the cost is the unclosed Start this exists to prevent,
+         * and the line below says so.
+         */
+        if (registered && ledger.currentStatus().runId !== runId) {
+            await writeEndingBeforeFirstRound(endingSink, { runId, projectId: endingProjectId, startedAtMs, because: endedBefore }, log);
+        }
+        /**
+         * 🔴 THE SLOT IS GIVEN BACK BY NAME, NOT BY NUMBER, and the difference is
+         * the whole concurrency bound. `releaseSlot` used to unlink `slot-N.json`
+         * unconditionally; because the lease was released first and `claim` treats
+         * a slot whose holder's lease is gone as free, another run could
+         * legitimately take slot N in between — and this teardown then deleted the
+         * NEW holder's claim. The limit was exceeded, and stayed exceeded, because
+         * the same window reopened at every teardown.
+         *
+         * ⚠️ AND EACH RELEASE IS INDEPENDENT. `holdReleased` is set FIRST so this
+         * stays idempotent under re-entry, which means a throw in one release would
+         * otherwise strand the other two for ever — the teardown's own call would
+         * return at the guard. The lease is last because it is the one whose
+         * absence lets a second run into THIS checkout.
+         */
+        /**
+         * 🔴 SURFACES GO BACK HERE TOO, BECAUSE THE ACQUIRE IS NOT INSIDE THE
+         * `finally` THAT WAS GIVING THEM BACK.
+         *
+         * MEASURED by reading the structure: `acquireSurfaces` runs at ~1782, and
+         * the teardown holding the only `releaseSurface` is the `finally` of a
+         * `try` that does not open until ~2930. Every refusal between those two
+         * points — a stale base, an unreadable safety history, a queue that will
+         * not open, an approval that is outstanding, a compile that fails, a
+         * `RunRefused` of any kind — returned or threw with the lease still held.
+         * A surface leaked that way is held until its TTL lapses: six hours of a
+         * project refusing to schedule itself, for a directory nobody is in.
+         *
+         * ⚠️ AND IT IS IDEMPOTENT, so the `finally` downstream may still call it.
+         * `releaseSurface` marks rather than deletes and matches on runId, so a
+         * second release is a no-op rather than a second writer.
+         *
+         * ⚠️ FIRST IN THE TEARDOWN, because a surface is the only thing here that
+         * blocks OTHER PROJECTS' runs rather than only this checkout's.
+         */
+        /**
+         * 🔴 THE BUDGET IS SETTLED FIRST, because a reservation left open holds an
+         * ESTIMATE against the window until its hold expires — and on a machine
+         * running near its ceiling that is the difference between the next goal
+         * starting and waiting five minutes for nothing.
+         */
+        try {
+            settleAdmission?.();
+        }
+        catch {
+            /* the hold expires by itself; a settlement that will not write is not fatal */
+        }
+        for (const fence of heldSurfacesRef.current) {
+            try {
+                (0, surface_lease_1.releaseSurface)(cwd, fence, runId);
+            }
+            catch {
+                /* a filesystem that said no. The TTL is the backstop. */
+            }
+        }
+        try {
+            registry.releaseSlot(capacity.slot, runId);
+        }
+        catch {
+            /* another run's slot, or a filesystem that said no. Never fatal here. */
+        }
+        try {
+            registry.release(runId);
+        }
+        catch {
+            /* the record is bookkeeping; the lease below is what matters. */
+        }
+        await leases.release(lease.token);
+        // Named for a runId that will never exist again, so nothing can ever read
+        // it. Left behind, `looply stop` would put one in an ordinary checkout's
+        // state directory every time a person pressed stop, for ever.
+        (0, workspace_1.clearAddressedControl)(stateDir, runId);
+        /**
+         * 🔴 AND THE SYNC LOOP STOPS, LAST — IT IS THE ONE THING HERE THAT KEEPS
+         * THE PROCESS ALIVE.
+         *
+         * `attachSync` starts a loop that polls on a timer until `stop()`. The
+         * teardown's `finally` and two early exits stopped it; the eight plain
+         * refusals between `attachSync` and the teardown's `try` gave back the
+         * lease, the slot, the record and the surfaces here, wrote their ending, and
+         * threw — and the loop went on polling for ever, so the process never
+         * exited. MEASURED live (LIVE-2): a run refused by the envelope wrote
+         * `run.ended` and was still alive minutes later with one live timer,
+         * `sleep ← Daemon.run`, and nothing else.
+         *
+         * ⚠️ AFTER the ending above, because stopping is what flushes it. `stop()`
+         * never rethrows and is idempotent, so the teardown's own stop after this
+         * one costs nothing.
+         */
+        if (stopSync !== null)
+            await stopSync();
+    };
+    /**
+     * 🔴 ANYTHING THAT THROWS OUT OF A CALL MUST STILL GIVE BACK WHAT THIS RUN
+     * IS HOLDING — AND SEVEN CALLS BETWEEN HERE AND THE ROUND LOOP DID NOT.
+     *
+     * Every `throw` STATEMENT in this stretch is preceded by `await releaseHold()`,
+     * and `run-hold-release.spec.ts` pins that. What neither the discipline nor
+     * the pin can see is an exception propagating out of a CALL: there is no
+     * `throw` token at the call site, so the guard was never written and the pin
+     * has nothing to match. Its own docblock says as much.
+     *
+     * What that costs, at the last of them (`exemptionStore.open()`): the run
+     * lease, the capacity slot, the registry record, every surface this run holds,
+     * AND AN OPEN BUDGET RESERVATION — which goes on charging its estimate against
+     * the window until the hold expires — plus the creation marker, whose absence
+     * leaves the checkout unreapable once the pid is recycled. At the earliest of
+     * them the queue is simply corrupt, which `QueueStore.open` throws on BY
+     * DESIGN, so this is not a hypothetical errno.
+     *
+     * ⚠️ IT RETHROWS, ALWAYS. This gives back a hold; it does not decide
+     * anything, and swallowing here would turn a broken machine into a silent one.
+     * `releaseHold` is idempotent, so a call that already released costs nothing.
+     */
+    /**
+     * Throws when this run was constructed to fail at `site`. See `RunFaultSite`.
+     * Absent in every production caller, so this is a no-op everywhere but a test.
+     */
+    const faulting = (site) => {
+        if (opts.faultAt === site) {
+            throw new Error(`injected fault at ${site} (test-only; see RunFaultSite)`);
+        }
+    };
+    const holding = async (fn) => {
+        try {
+            return await fn();
+        }
+        catch (e) {
+            await releaseHold();
+            throw e;
+        }
+    };
+    /**
+     * The readable record of what holds the slot — what `looply runs` and the
+     * reaper work from.
+     *
+     * 🔴 DEFINED AFTER `releaseHold`, AND GUARDED, because it can throw. It was
+     * three lines ABOVE the definition, so an EEXIST on a repeated runId, a
+     * filesystem refusal, or a runId this cannot address left the lease AND the
+     * slot held with nothing able to give them back — and the source pin below
+     * could not see it, because the pin looks for `throw` STATEMENTS and this is
+     * an exception out of a call.
+     */
+    /**
+     * 🔴 PROJECT-SCOPED, BECAUSE THESE ARE THE DAEMON↔RUN WIRE — AND EXECUTION
+     * SCOPING THEM ESCALATED EVERY COORDINATED GOAL TO A HUMAN.
+     *
+     * A LEASE is about a CHECKOUT: one run per working tree, so it belongs beside
+     * the tree. A START MARK is about a REQUEST — durable proof that the Start the
+     * daemon asked for produced a Run — and the daemon is its only reader.
+     *
+     * MEASURED end to end: a coordinator-placed run wrote `run-starts.json` into
+     * its WORKSPACE, and the daemon read it from its own checkout. `provenStart`
+     * therefore answered null for every placed run, the launcher never reported
+     * `started`, and `autonomy-controller` concluded
+     *
+     *     Start 1 was attempted 3 times and never began
+     *
+     * and escalated a perfectly healthy goal to `human_required` — three cadences
+     * into every night, for every goal the coordinator placed.
+     *
+     * ⚠️ INVISIBLE IN A SINGLE CHECKOUT, which is why nothing caught it: there the
+     * project and execution state directories ARE the same path, so writer and
+     * reader agree by accident. It only appears once a run is placed somewhere
+     * else, which is the entire point of a coordinator.
+     */
+    const startMarks = new run_start_marks_1.RunStartMarks(projectStateDirPath, ledger_store_1.nodeLedgerFs, log);
+    // READ BEFORE WRITING. Without this the store holds an empty list, and
+    // recording this run rewrites the whole file with one entry — so the fifty
+    // the cap allows for have never actually accumulated, and any question about
+    // an earlier request answers "no run". Harmless while the only reader asked
+    // about the newest request; not harmless once anything asks retrospectively.
+    if (opts.commandId !== undefined)
+        await holding(() => {
+            faulting('startMarks.load');
+            return startMarks.load();
+        });
+    try {
+        registry.register(runRecord);
+    }
+    catch (e) {
+        await releaseHold();
+        throw e;
+    }
+    registered = true;
+    /**
+     * 🔴 THE START RECEIPT IS WRITTEN HERE, BECAUSE HERE IS WHERE IT BECOMES
+     * TRUE — AND WRITING IT AT `run.started` ESCALATED PAID RUNS TO A HUMAN.
+     *
+     * `markingStartsOn` recorded the receipt when the ledger first appended
+     * `run.started`, which `RoundRunner` emits after the compile pass, both
+     * verify passes and the adaptive evaluation. So a Start could hold the lease,
+     * take a capacity slot, reserve budget, spend a compile and two verify passes
+     * — tens of minutes and real money — leave by any of the six refusals between
+     * here and there, and leave NO EVIDENCE THAT IT EVER RAN. The launcher then
+     * answers `failed` for that request for ever after, and three such Starts
+     * produce
+     *
+     *     Start 1 was attempted 3 times and never began
+     *
+     * on a goal that had begun three times and been charged for it.
+     *
+     * MEASURED on the real command, single checkout, idle machine, trivial queue:
+     * the run appeared in the registry at 524 ms and the receipt appeared at
+     * 769 ms. Anything that ends a run inside that window — a kill, a crash, a
+     * machine going to sleep — produces the escalation above. With a real queue
+     * the window is the whole compile-and-verify pass, which is minutes.
+     *
+     * Registration is the honest instant: the record is on disk, the lease and
+     * the slot are held, and `registry.active()` already counts this run. Nothing
+     * downstream can make it untrue that a Run existed.
+     *
+     * ⚠️ IT DOES NOT MEAN THE START SUCCEEDED, and the launcher no longer reads
+     * it that way: a refusal mark for the same request outranks this receipt, so
+     * the six terminal refusals downstream still speak for the goal.
+     *
+     * ⚠️ NEVER FATAL, and never for a hand-typed run. A run genuinely under way
+     * must not be killed because the daemon's evidence file would not write; the
+     * cost is an unacked command, which the redelivery window already bounds.
+     */
+    if (opts.commandId !== undefined) {
+        try {
+            await startMarks.record({
+                commandId: opts.commandId,
+                runId,
+                at: new Date().toISOString(),
+                // The checkout this run is executing in. The daemon reads THIS to find
+                // the run's ledger after it ends — the registry record is given back
+                // on the way out, this is not.
+                workspace: cwd,
+            });
+        }
+        catch (e) {
+            log(`start   : could not record that this run began (${e.message}) — the phone may ask again`);
+        }
+    }
+    /**
+     * ⚠️ THE CREATION MARKER IS NOT CLEARED HERE — it is cleared as the LAST thing
+     * this run does, at the very end of the teardown below.
+     *
+     * 🔴 THIS DOCBLOCK USED TO SAY IT WAS NEVER CLEARED AT ALL, twenty lines from
+     * the call that clears it. Both extremes were shipped in turn — cleared here,
+     * which reopened the window it exists to close; then never cleared, which made
+     * a finished checkout permanently unreapable once its pid was recycled — and
+     * the comment was left describing the middle one.
+     *
+     * The marker names THIS PROCESS, so it covers the checkout for the process's
+     * whole life, including the teardown window where `releaseHold` has already
+     * given back the lease and the record.
+     */
+    /**
+     * READ THE QUEUE AGAIN, now that nothing else may write it.
+     *
+     * `queue.open()` ran a long way above this — before three git subprocesses
+     * and before the wait for the lease — and the store answers `list()` from the
+     * map it filled then. It never goes back to disk. So without this line every
+     * decision below is taken against a snapshot of how things were BEFORE this
+     * run had exclusive use of the tree: whether this goal version already has a
+     * plan, what recovery should put back, what a round may pick.
+     *
+     * A stale snapshot here is not merely a stale opinion, which is what makes it
+     * worth a second read rather than a comment. `insertAll` commits
+     * `[...this.items.values(), ...inserted]` — the whole map, not a delta — so
+     * whatever this process failed to see is not just missed, it is written back
+     * over. A `release-goal-items` that took the lease first and let a goal's work
+     * go would be silently undone by the next thing this run wrote.
+     *
+     * The lease is the only mutual exclusion in the system. Reading outside it and
+     * writing inside it is the one arrangement that cannot work.
+     */
+    await holding(() => {
+        faulting('queue.open');
+        return queue.open();
+    });
+    /**
+     * BEFORE anything is written, refuse a queue that holds a LATER plan.
+     *
+     * This check used to stand further down, next to the compile decision — and
+     * two things that write the queue stood in front of it: adopting the items a
+     * Start named, and putting stranded work back. So the one case that is
+     * supposed to touch nothing touched two things first, and a Start naming
+     * items would take ownership of them on behalf of an authority it was about
+     * to declare stale.
+     *
+     * Versions only go up, so a plan compiled for a later version is durable
+     * evidence that this run's authority is out of date. The honest response to
+     * "your instructions have been overtaken" is to do nothing at all, and doing
+     * nothing has to include the repairs: recovery is skipped too, deliberately,
+     * because a queue that has been rewritten underneath this process is not one
+     * to tidy on the strength of a Start that should never have arrived. The next
+     * run, under an authority that agrees with the queue, recovers it.
+     */
+    if (scope !== null) {
+        const contradicting = (0, goal_ownership_1.splitGoalWork)(queue.list(), scope).newerPlans;
+        if (contradicting.length) {
+            const versions = [...new Set(contradicting.map((i) => i.compiledForGoalVersion))].join(', ');
+            const superseded = `this machine holds work compiled for a LATER version of this goal (${versions}, and this Start says ` +
+                `${binding.kind === 'bound' ? binding.goal.version : '?'}) — refusing to run against evidence that ` +
+                'the goal has already moved on';
+            leaving(superseded);
+            await releaseHold();
+            throw new RunRefused(superseded, 
+            // Durable evidence that the goal is ahead of this Start. Not a guess:
+            // a plan compiled for a later version cannot exist under a correct
+            // history, so the goal has moved and this Start is behind it.
+            'goal_superseded');
+        }
+    }
+    // Under the lease, because it writes the queue. One durable write for the
+    // whole set: a crash partway through would otherwise leave the goal owning
+    // some of what the phone named and nothing recording which.
+    if (scope !== null && opts.itemIds?.length) {
+        const goalId = scope.goalId;
+        const itemIds = opts.itemIds;
+        const adopted = await holding(() => {
+            faulting('adoptGoalItems');
+            return (0, goal_ownership_1.adoptGoalItems)(queue, goalId, itemIds);
+        });
+        if (!adopted.ok) {
+            leaving(`cannot start this goal — ${adopted.problem}`);
+            await releaseHold();
+            // Terminal: the named items will not become adoptable by being asked for
+            // again in three seconds.
+            throw new RunRefused(`cannot start this goal — ${adopted.problem}`, 'run_refused');
+        }
+        log(`goal    : ${adopted.adopted} item(s) taken on` +
+            (adopted.alreadyOwned ? `, ${adopted.alreadyOwned} already this goal's` : ''));
+    }
+    const dispatcher = new notify_channel_1.ChannelDispatcher({
+        exec: notify_channel_1.nodeNotifyExec,
+        fileExists: (p) => (0, node_fs_1.existsSync)(p),
+        log,
+        homeDir: (0, node_os_1.homedir)(),
+    }, config.notify.channel);
+    dispatcher.preflight();
+    // Two audiences, two rules. The cadence notifier decides whether to
+    // interrupt somebody who is not here, and obeys notify.every_min. The
+    // terminal one narrates to somebody who is, and has no rate limit: a run
+    // that printed three header lines and then nothing for hours is
+    // indistinguishable from a hung one, which is the failure mode this whole
+    // product is written against.
+    const terminal = new progress_view_1.TerminalNotifier(log);
+    // implement() runs exactly once per round, so this is the round number.
+    let roundNo = 0;
+    const cadence = new notify_cadence_1.CadenceNotifier(config.notify.everyMin, { send: (text) => dispatcher.send(text, config.notify.to) }, () => Date.now());
+    const notifier = (0, progress_view_1.fanOut)(terminal, cadence);
+    // Every agent this run starts is registered here, so the run can stop them
+    // on the way out rather than leaving one editing the repository with no
+    // parent. Covers an ordinary exit, a throw, a Ctrl-C and a `looply stop`;
+    // a SIGKILL of this process cannot be covered from inside it.
+    const children = new owned_children_1.OwnedChildren();
+    const signals = new signals_1.SignalWatcher({
+        proc: (0, signals_1.nodeSignalSource)(),
+        // First Ctrl-C: the runner finishes the round in flight, so the tree is
+        // never left half-written. Said out loud because otherwise a run that
+        // appears to ignore Ctrl-C invites a second, harder one.
+        onGraceful: () => {
+            log('');
+            log('run     : stopping after this round. Press Ctrl-C again to stop now.');
+        },
+        // Second: the round will not be finished, so kill what this run started
+        // rather than leaving an agent editing the tree with no parent. Both of
+        // these callbacks existed and neither was ever wired.
+        onForce: () => {
+            const killed = children.killAll();
+            log(`run     : stopping now — ${killed} agent process(es) stopped.`);
+        },
+    });
+    signals.install();
+    // If this machine is paired, every event the run writes also goes to the
+    // server. Without it a run was correct, complete and invisible — the phone
+    // showed a project that never moved. Unpaired is a normal state, not an
+    // error: looply works on its own and the app is an addition.
+    const sync = await (0, sync_1.attachSync)(cwd, config, log);
+    stopSync = sync === null ? null : () => sync.stop();
+    const synced = sync ? new syncing_ledger_1.SyncingLedger(ledger, sync.daemon, (0, syncing_ledger_1.logSinkErrorOnce)(log)) : ledger;
+    endingSink = synced;
+    /**
+     * Say, durably, that the command which asked for this run got one.
+     *
+     * Wrapped around the ledger rather than hooked into RoundRunner, because the
+     * moment that matters is precisely when `run.started` is appended — and the
+     * runner already does that, for its own reasons, knowing nothing about
+     * commands. This notices; the runner is unchanged.
+     *
+     * Only for a run the daemon asked for. A hand-typed `looply run` has no
+     * command to prove anything to.
+     */
+    /**
+     * ⚠️ STILL HERE, AND NOW ALMOST ALWAYS A NO-OP. The receipt is written at
+     * registration above; `RunStartMarks.record` returns early when the command
+     * already has one, so this writes nothing on any path that registered.
+     *
+     * It is kept because it costs nothing and it is the only writer that would
+     * still fire if a future path reached `run.started` without registering —
+     * which is exactly the kind of silent gap this whole receipt exists to close.
+     */
+    const onMarkError = (e) => log(`start   : could not record that this run began (${e.message}) — the phone may ask again`);
+    // `cwd` is carried so a mark written here names the checkout, exactly as the
+    // one written at registration does.
+    const ledgerForRun = opts.commandId === undefined ? synced : (0, run_start_marks_1.markingStartsOn)(synced, startMarks, opts.commandId, onMarkError, cwd);
+    /**
+     * What you set on your phone, laid over the file.
+     *
+     * Only settings somebody actually chose are applied — the server answers with
+     * the whole registry, and its defaults are not this project's. Failure is not
+     * fatal: a run that cannot reach the server still runs, on the file alone,
+     * which is the same rule every other server call here follows.
+     */
+    if (sync) {
+        try {
+            const { settings } = await sync.client.projectSettings(sync.projectId);
+            const overlay = (0, settings_overlay_1.applySettings)(config, settings);
+            config = overlay.config;
+            for (const line of (0, settings_overlay_1.describeOverrides)(overlay))
+                log(line);
+        }
+        catch (e) {
+            log(`settings: could not read your phone's settings (${e.message}) — using ${'.looply/config.yaml'} alone`);
+            /**
+             * ...EXCEPT FOR PUBLISHING, WHICH NARROWS INSTEAD.
+             *
+             * Falling back to the file is right for every other setting: a run that
+             * cannot reach the server should still run, and `max_rounds` from a file
+             * somebody committed is a perfectly good answer.
+             *
+             * It is the wrong answer for exactly one key. The phone is where
+             * publishing gets turned OFF, and "I could not ask" and "nobody has
+             * turned it off" are the same silence and opposite facts — the argument
+             * `approval-gate-read` already makes for `unknown`. A file saying
+             * `on-approval` and a person who set `never` from the sofa an hour ago
+             * would otherwise resolve, here, in favour of the file.
+             *
+             * A TOTAL OUTAGE COULD NOT REACH A PUSH ANYWAY: the governed path asks the
+             * server to read the approval, to claim it and to mint an execution, and
+             * refuses if any of them cannot be reached. What this closes is the
+             * PARTIAL case — settings failing while the approval routes answer — which
+             * is narrow, real, and the kind of gap only found by checking a shipped
+             * thing against what was promised for it.
+             */
+            if ((0, config_1.mayPublish)(config.publish.policy)) {
+                log('settings: publishing is off for this run — your phone could not be asked');
+                config = { ...config, publish: { policy: 'never' } };
+            }
+        }
+    }
+    // Now that the phone has had its say. `--hours` still wins: it is the most
+    // deliberate thing in the chain, typed on the machine that is about to run.
+    const minHours = opts.hours ?? config.run.minHours;
+    /**
+     * Built here, AFTER the sync, because only the sync knows the project id.
+     *
+     * This was constructed before `attachSync` ran and read `config.project.id`,
+     * which no config carries — `looply init` writes `project.name` and nothing
+     * else — so every event a run wrote was stamped `projectId: 'local'`. The
+     * upload then worked perfectly: the daemon shipped the batch, the server
+     * accepted the request, and ingest dropped every event on
+     * `.filter(e => e.projectId === projectId)` because the id in the envelope
+     * was not the id in the URL. Nothing failed, nothing was logged, and the
+     * phone showed a project that never moved — the precise failure SyncingLedger
+     * exists to prevent, reintroduced one line above it.
+     *
+     * `verifyDrafts` and the scan already resolved it this way. This was the odd
+     * one out, which is what let it survive.
+     *
+     * Bound separately from the identity because recovery below is announced as
+     * events too, and an event needs the same id.
+     */
+    const projectId = sync?.projectId ?? config.project.id ?? 'local';
+    endingProjectId = projectId;
+    const identity = { runId, projectId, lane: 'feature', branch };
+    // Applied here rather than where it was decided, because the repair is
+    // announced as events and an event needs the project id the server
+    // registered — the same reason the run identity is built here.
+    //
+    // Event-first on purpose: the machine does not reach into the server's tables
+    // to fix them. It says what happened on the ledger it already owns, and every
+    // projection converges from that. One execution history, many mirrors.
+    if (recovery.kind === 'repairable' && (recovery.items.length || recovery.closeRun)) {
+        await holding(() => {
+            faulting('applyRecovery');
+            return (0, recovery_io_1.applyRecovery)(recovery, {
+                queue,
+                ledger: ledgerForRun,
+                // M5-5: the daemon's sweep may have closed this same dead run a moment
+                // ago — measured: one second before, and the ending was written twice.
+                // The ledger is read at write time; a second ending is never written.
+                alreadyEnded: async (id) => {
+                    const ended = await (0, run_ended_1.readRunEnded)(stateDir, ledger_store_1.nodeLedgerFs, id);
+                    return ended.ok ? ended.ended : null;
+                },
+                projectId,
+                now: () => Date.now(),
+                log,
+            });
+        });
+    }
+    /**
+     * WHAT A PERSON ALREADY DECIDED, WHEN THIS RUN IS PICKING IT UP.
+     *
+     * The daemon carried one id here. Everything the model will be told is read
+     * now, from the row that person's decision was written to — the same place,
+     * and the same wording, they saw before they answered.
+     *
+     * READ BEFORE THE FIRST ROUND, AND FATAL IF IT CANNOT BE. A run resumed on a
+     * refusal it could not read is a run that plans as though nothing was
+     * refused, and the likeliest thing it plans is asking for the same action
+     * again — which stops it at the same boundary, having spent a Start.
+     *
+     * A PLAIN ERROR, DELIBERATELY NOT A REFUSAL. Every `RunRefusalCode` is
+     * terminal: throwing one here would end a person's whole grant because a
+     * single HTTP read failed. This exits retryable, and the next Start reads it
+     * again.
+     */
+    let resolution;
+    if (opts.resumedFromApprovalId !== undefined) {
+        if (binding.kind !== 'bound' || goalServer === null) {
+            leaving('a run cannot pick up a decision without the goal it was made for');
+            await releaseHold();
+            throw new Error('a run cannot pick up a decision without the goal it was made for');
+        }
+        const got = await (0, approval_resolution_1.readApprovalResolution)(goalServer.resolution, opts.resumedFromApprovalId, {
+            projectId,
+            goalId: binding.goal.id,
+            goalVersion: binding.goal.version,
+            now: Date.now(),
+        });
+        if (!got.ok) {
+            leaving(`could not pick up that decision — ${got.because}`);
+            await releaseHold();
+            throw new Error(`could not pick up that decision — ${got.because}`);
+        }
+        resolution = got.resolution;
+        log(`action  : picking up where you said ${resolution.outcome} — ${resolution.display}`);
+    }
+    /**
+     * THE ONE THING A PERSON ALREADY SAID YES TO, DONE BEFORE ANYTHING IS ASKED.
+     *
+     * Before the agent exists, before a queue is compiled, before a single round.
+     * If somebody approved publishing an artifact, opening this run by asking a
+     * model what it would like to do would be the wrong first act — and worse, it
+     * would let a model's next idea arrive before the thing already authorised.
+     *
+     * NOTHING HERE DECIDES ANYTHING. The whole step is one call into
+     * `governed-run`, which owns every word about claims and execution ids
+     * precisely so this file does not — a guard written at 7B4-B asserts that,
+     * and it is still passing.
+     *
+     * A REFUSAL IS A PLAIN ERROR, not a `RunRefusalCode`. Every refusal code is
+     * terminal, and ending a person's grant because a governed step could not
+     * begin would answer a temporary problem with a permanent one.
+     */
+    /**
+     * WHY THIS LOOP WILL STOP, ARMED ONCE AND READ BY A RUNNER THAT CANNOT TELL WHY.
+     *
+     * Declared HERE rather than beside the approval machinery it used to sit
+     * with, because the governed prehook below can arm it before a single round
+     * exists. `RoundRunner` reads this at the top of its loop — before the pick,
+     * not only after a model turn — and a comment there says that nothing arms it
+     * that way today and the fence is for the day something does. This is that
+     * day: an ambiguous governed result ends the run having invoked no model at
+     * all, which is exactly what the fence was written for.
+     */
+    let halt = null;
+    let governed;
+    if (opts.governedApprovalId !== undefined) {
+        if (binding.kind !== 'bound' || goalServer === null) {
+            leaving('a run cannot carry out an approved action without the goal it was for');
+            await releaseHold();
+            throw new Error('a run cannot carry out an approved action without the goal it was for');
+        }
+        const outcome = await (0, governed_run_1.runGovernedAction)({
+            server: goalServer.governed,
+            /**
+             * EVERY EXECUTOR LOOPLY HAS, and the policy decides which of them can
+             * ever be reached rather than which are registered here.
+             *
+             * Registering the push executor unconditionally is deliberate: a broker
+             * assembled differently per policy would be a second place the policy
+             * lives, and the two would eventually disagree. The gate is in one
+             * place — before the claim — and this list is simply what Looply can
+             * do.
+             */
+            broker: (0, governed_broker_1.createGovernedBroker)([
+                (0, governed_broker_1.fixturePublishExecutor)({ fs: start_attempts_1.nodeAttemptFs }),
+                (0, git_push_executor_1.gitPushExecutor)(new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(cwd))),
+                /**
+                 * 🔴 ONE APPROVED ORDERING CONSTRAINT, CARRIED OUT. Registered
+                 * unconditionally beside the others, for the reason given above: a
+                 * broker assembled differently per policy would be a second place the
+                 * policy lives.
+                 *
+                 * ⚠️ THE CAPABILITY IS `goalServer.edges`, NOT THE CLIENT, and the
+                 * first draft of this reached for the client and would not compile
+                 * — `openGoalServer` keeps it inside itself on purpose, because
+                 * handing one out puts deciding, listing and claiming within reach of
+                 * the same call site.
+                 */
+                (0, goal_depends_executor_1.goalDependsExecutor)(projectId, goalServer.edges),
+            ]),
+            // 🔴 PROJECT-SCOPED: the daemon RESERVES under `projectStateDir` at the
+            // Start boundary, and this is the reader that re-derives the claim key
+            // from that reservation. Read from the execution state, a placed run
+            // found no reservation for the approval it was started to carry out.
+            reservations: new governed_approvals_1.GovernedApprovals(projectStateDirPath, start_attempts_1.nodeAttemptFs),
+            log: (line) => log(`action  : ${line}`),
+        }, {
+            projectId,
+            goalId: binding.goal.id,
+            goalVersion: binding.goal.version,
+            runId,
+            // From the trusted daemon-to-child wire, never from anything a model
+            // or a person typed alongside the approval id.
+            ...(opts.commandId === undefined ? { commandId: undefined } : { commandId: opts.commandId }),
+            approvalId: opts.governedApprovalId,
+            publishPolicy: config.publish.policy,
+        });
+        if (outcome.kind === 'refused') {
+            leaving(`that action was not carried out — ${outcome.because}`);
+            await releaseHold();
+            throw new Error(`that action was not carried out — ${outcome.because}`);
+        }
+        if (outcome.kind === 'stop') {
+            // The attempt was made and its result is not something to plan around.
+            // The pursuit stays alive and held; a person decides what happens next.
+            halt = { stopReason: 'governed-action-ambiguous', because: outcome.because };
+            log(`action  : ${outcome.because}`);
+        }
+        else if (outcome.kind === 'done') {
+            governed = outcome.result;
+            /**
+             * F34 (group B walk #5): AN APPLIED EDGE MOVED THE GOAL TO A NEW VERSION, and everything this
+             * run resolved — its binding, its plan, its grant — is about the old one. Working on meant a
+             * wasted compile at best, and at worst work published under a claim the lane then calls stale.
+             * Retryable, not terminal: the goal's next Start works the new version.
+             */
+            if (governed.actionType === 'goal.depends' && governed.outcome === 'succeeded') {
+                leaving(`the goal gained a dependency (${governed.display}) — its next Start works the new version`);
+                await releaseHold();
+                throw new Error(`the goal gained a dependency — ${governed.display}; its next Start works the new version`);
+            }
+        }
+    }
+    /**
+     * A RUN THAT IS NOT THE ANSWER TO THE QUESTION DOES NOT GET TO REASON.
+     *
+     * The completion fence at the end of this file already refuses to call a goal
+     * done while somebody is owed an answer, and that was enough while the worst
+     * a run could do was waste itself. It is not enough now.
+     *
+     * Reached only when this run carries NEITHER a decision to pick up nor an
+     * action to carry out. In that case any outstanding approval work belongs to
+     * some other Start, and there is nothing this run can usefully do with a
+     * model: it would reason for hours against a pursuit that is waiting on a
+     * person, and the likeliest thing it proposes is the action already waiting.
+     *
+     * BEFORE THE AGENT EXISTS, which is the whole point of its position. Meeting
+     * this at the fence instead would mean the model calls were already paid for.
+     *
+     * A PLAIN ERROR, like the fence: every `RunRefusalCode` is terminal, and
+     * ending a person's grant because they have not answered yet would answer a
+     * question they are still thinking about.
+     */
+    if (opts.resumedFromApprovalId === undefined &&
+        opts.governedApprovalId === undefined &&
+        binding.kind === 'bound' &&
+        goalServer !== null) {
+        const outstanding = await (0, approval_gate_read_1.readApprovalGate)(goalServer.gate, {
+            projectId,
+            goalId: binding.goal.id,
+            goalVersion: binding.goal.version,
+            now: Date.now(),
+            consumed: (ids) => resumes.consumed(ids),
+        });
+        const waiting = (0, core_1.approvalHold)(outstanding);
+        if (waiting !== null) {
+            log(`action  : not starting work — ${waiting}`);
+            leaving(`this goal is waiting on you — ${waiting}`);
+            await releaseHold();
+            throw new Error(`this goal is waiting on you — ${waiting}`);
+        }
+    }
+    /**
+     * ⛔ AND HAS THIS MACHINE ALREADY DECIDED THAT REPEATING IS USELESS?
+     *
+     * ───────────────────────────────────────────────────────────────────────────
+     * THE BYPASS THIS CLOSES
+     *
+     * A hand-typed `looply run` never touches the autonomy controller. With no
+     * `--command-id` and no `--request-attempt` the whole admission block in
+     * `bin.ts` is skipped, so nothing consults a grant, a budget or a safety
+     * hold — the daemon's brake is simply not on this path. Without this fence a
+     * person could be told "I have stopped, nothing is working" and then re-enter
+     * the identical feedback loop by typing eight characters.
+     *
+     * ───────────────────────────────────────────────────────────────────────────
+     * WHY AN OVERRIDE NEEDS NOTHING SPECIAL HERE
+     *
+     * A person's explicit Start is the escape hatch, and it arrives through the
+     * daemon: the Start gate spends the incident's one retry BEFORE spawning the
+     * run, so by the time this reads the store the incident is no longer ACTIVE
+     * and the authorised run walks through. A hand-typed run has spent nothing,
+     * so it meets the hold — which is the whole distinction, and it needs no flag
+     * on the command line to express. ARGV PROVES NOTHING HERE EITHER.
+     *
+     * ⚠️ IT IS A PLAIN ERROR, LIKE THE APPROVAL FENCE ABOVE, not a RunRefused:
+     * every refusal code is terminal, and ending a person's grant because their
+     * machine is stuck would answer a question nobody asked.
+     *
+     * ⚠️ HONEST LIMIT: this binds the BOUND path. An unbound hand-typed run has no
+     * pursuit to be held for, and nothing on that path can clear or spend an
+     * incident — asserted in the spec rather than assumed here.
+     */
+    /**
+     * THE RESOURCE SURFACES THIS RUN DECLARED, TAKEN IN A TOTAL ORDER.
+     *
+     * 🔴 ALL OR NOTHING, BEFORE ANY WORK. Holding two of three surfaces while
+     * waiting for the third is precisely the state a total acquisition order
+     * exists to make impossible — which is why deadlock here is unrepresentable
+     * rather than detectable, and why there is no wait-for graph to write.
+     *
+     * ⚠️ AND `run.surfaces` OFF MEANS NO LEASE IS EVER TAKEN. Not "taken and
+     * ignored": the acquire is not called at all, so a project that never asked
+     * for surfaces has no new file, no new failure mode and no new refusal.
+     */
+    const declaredSurfaces = (0, declared_surfaces_1.declaredSurfacesFor)(config, binding);
+    let heldSurfaces = [];
+    if (declaredSurfaces.length > 0) {
+        const got = await holding(() => {
+            faulting('acquireSurfaces');
+            return (0, surface_lease_1.acquireSurfaces)(cwd, declaredSurfaces, { runId, ttlMs: SURFACE_TTL_MS });
+        });
+        /**
+         * ⚠️ A PLAIN THROW, NOT A `RunRefused`. Every refusal code is TERMINAL — a
+         * controller seeing one would stop offering this pursuit — and "somebody
+         * else is holding a directory" is the most retryable condition there is.
+         *
+         * ⚠️ AND THE RELEASE IS ON THE LINE ABOVE THE THROW, not separated from it
+         * by prose. A source pin reads a window around every `throw` in this
+         * function looking for `releaseHold()`, because a throw that skips it leaks
+         * the lease, the registry entry and the slot — and a comment between the
+         * two is enough to make the pin miss it.
+         */
+        if (!got.ok) {
+            leaving(`cannot start: ${got.because}`);
+            await releaseHold();
+            throw new Error(`cannot start: ${got.because}`);
+        }
+        heldSurfaces = got.held;
+        // Visible to `releaseHold`, which every refusal path already calls and
+        // which is defined above this line. See its surface branch.
+        heldSurfacesRef.current = got.held;
+        log(`surface : holding ${declaredSurfaces.join(', ')}`);
+    }
+    /** The hold whose one retry this run has been told to spend, once work starts. */
+    let retryToSpend = null;
+    if (binding.kind === 'bound' && safety !== null) {
+        const incident = safety.activeIncident(binding.goal.id, binding.goal.version);
+        if (incident !== null) {
+            /**
+             * ⚠️ THE SPEND IS ASKED FOR, NEVER ASSUMED. Without the flag this is the
+             * refusal it has always been — the brake does not release itself because
+             * somebody ran the command again.
+             */
+            if (opts.tryOnceMore !== true) {
+                log(`action  : not starting work — ${incident.because}`);
+                leaving(`this machine has stopped working on that goal — ${incident.because}`);
+                await releaseHold();
+                throw new Error(`this machine has stopped working on that goal — ${incident.because}. ` +
+                    'Run it again with --try-once-more to spend this incident’s one retry.');
+            }
+            /**
+             * 🔴 THE FENCE IS HERE; THE SPEND IS NOT. IT HAPPENS JUST BEFORE THE
+             * FIRST ROUND, AND THE DISTANCE BETWEEN THE TWO IS WHY.
+             *
+             * Spending here burnt the retry about a thousand lines before any work
+             * could begin, and several ordinary things refuse a run in between — a
+             * dirty working tree ("commit or stash first", thrown as the first thing
+             * `runner.run()` does), an empty work set, a superseded goal. So a person
+             * with three uncommitted edits — which is how people at terminals live —
+             * typed the command looply told them to, watched it print "one retry,
+             * spent", and then watched it die without buying a single model turn. The
+             * retry was gone and the hold was permanently discharged.
+             *
+             * The refusal has to be early, because the point is not to start. The
+             * SPEND has to be late, because the point is to buy an attempt.
+             */
+            retryToSpend = incident;
+            log(`action  : held by ${incident.kind} (${incident.id}) — its one retry will be spent when work starts`);
+        }
+    }
+    // One agent runner for all three roles. The prompt travels on stdin, so a
+    // multi-line prompt, a diff full of quotes, and a prompt past cmd.exe's 8191
+    // character ceiling all stop being the runner's problem (agent-exec.ts).
+    // MEDIATED. The model runs outside the container — the packaged provider
+    // cannot start inside one — and gets no host tools at all. Every capability
+    // it can call is a Looply MCP tool, and each of those executes contained.
+    /**
+     * WHICH PROVIDER BINARY IS ABOUT TO ANSWER.
+     *
+     * 🔴 Until now the only test applied to it was `existsSync`, and nothing
+     * recorded what a run had used — so an update, a tamper, or a different Node
+     * install shifting the derived path all looked identical to nothing having
+     * happened. This says so once, and only when it CHANGED.
+     *
+     * Best-effort by construction: a diagnostic that could stop a run would be a
+     * worse thing than the gap it reports.
+     */
+    await (async () => {
+        try {
+            /**
+             * 🔴 `resolved.spec.command`, NOT `config.agent.command` — AND THE
+             * DIFFERENCE MADE THIS RECORD LIE.
+             *
+             * The transport launches `resolved.spec.command`; this asked the CONFIG.
+             * A preset resolves one to the other, so a project configured for a
+             * different provider could be recorded as the default — `provider: codex`
+             * hashing `claude.exe` — which is precisely the "never silently swap
+             * model or provider" invariant, broken in the one record kept to detect
+             * it.
+             *
+             * The rule is that identity is a fact about what WILL RUN, so it is read
+             * from the thing that will run it.
+             */
+            const isDefault = resolved.spec.command === agent_exec_1.DEFAULT_AGENT.command;
+            const pkg = isDefault ? (0, agent_contained_1.claudePackageDir)() : null;
+            const note = await (0, provider_identity_store_1.noteProviderIdentity)(new provider_identity_store_1.ProviderIdentityStore(stateDir, ledger_store_1.nodeLedgerFs), isDefault
+                ? { kind: 'default', ...(pkg === null ? {} : { executable: (0, node_path_1.join)(pkg, 'bin', 'claude.exe') }) }
+                : { kind: 'configured', command: resolved.spec.command });
+            if (note !== null)
+                log(`provider: ${note}`);
+        }
+        catch {
+            /* a diagnostic must never be the reason a run does not start */
+        }
+    })();
+    /**
+     * ═══════════════════════════════════════════════════════════════════════
+     * THE CANONICAL EXECUTION ADMISSION. EVERY CHARGEABLE RUN PASSES HERE.
+     * ═══════════════════════════════════════════════════════════════════════
+     *
+     * 🔴 IT IS HERE, AND NOWHERE ELSE, BECAUSE `runLoop` IS THE ONE THING EVERY
+     * RUN IS.
+     *
+     * A person typing `looply run`, a Start the daemon spawned, a goal the
+     * coordinator placed in a workspace, and anything Autopilot decides all
+     * converge on this function. Checking a budget in the Brain, the coordinator,
+     * the CLI and the provider adapter would be four policies that agree until
+     * the day one of them is edited — and the one that spends the money is
+     * whichever runs last. So there is one gate, at the lowest point, and every
+     * caller above it is an optimisation rather than an authority.
+     *
+     * ⚠️ BEFORE THE AGENT EXISTS. The line below constructs the transport; the
+     * first model call follows within the round loop. Refusing here means no
+     * provider process is started, no turn is spent, and — crucially — no
+     * implementation ATTEMPT is charged against the item, because the round loop
+     * has not begun.
+     *
+     * ⚠️ AND IT IS NOT A STATEMENT ABOUT THE GOAL. A full budget is the most
+     * retryable condition there is: it becomes false as the window rolls. So it
+     * leaves by the same door a held surface does — a plain Error, never a
+     * `RunRefused`, whose every code is terminal and would send a controller's
+     * pursuit to `human_required` for a wallet that refills in an hour.
+     *
+     * ⚠️ NO ENVELOPE, NO GATE. Absent is what every existing project has, and
+     * Simple Mode gains no new refusal by upgrading.
+     */
+    const envelope = config.machine?.envelope;
+    let admission = null;
+    if (envelope !== undefined) {
+        const inFlight = (() => {
+            try {
+                /**
+                 * 🔴 THE CANDIDATE MUST NOT COUNT ITSELF, AND THIS COMMENT USED
+                 * TO ARGUE THAT IT SHOULD.
+                 *
+                 * `withinEnvelope` refuses when `runsInFlight >= maxConcurrentRuns`,
+                 * so what it is being asked is "may one MORE start" — the candidate
+                 * is the "more". This run registers before it asks, so passing the
+                 * registry's count included itself.
+                 *
+                 * MEASURED: `max_concurrent_runs` defaults to 1, so 1 >= 1 refused,
+                 * and ANY project that wrote a `machine.envelope:` block could no
+                 * longer run a single goal. A budget that bricks Simple Mode is not a
+                 * budget.
+                 */
+                return Math.max(0, registry.active().length - 1);
+            }
+            catch {
+                return 0;
+            }
+        })();
+        const admitted = (0, spend_ledger_1.admitSpend)(envelope, binding.kind === 'bound' ? `run:${binding.goal.id}` : 'run', envelope.estimateUsdPerStart, inFlight, () => Date.now(), undefined, 
+        // So the settlement below REPLACES this run's rows instead of being
+        // added to the very rows it is computed from.
+        runId);
+        if (!admitted.ok) {
+            log(`budget  : ${admitted.because}`);
+            leaving(`cannot start: ${admitted.because}`);
+            await releaseHold();
+            throw new Error(`cannot start: ${admitted.because}`);
+        }
+        admission = admitted.admission;
+        settleAdmission = () => {
+            /**
+             * 🔴 SETTLED FROM THIS RUN'S OWN ROWS, EXACTLY ONCE. The reservation held
+             * an ESTIMATE; the transport wrote what each invocation actually cost,
+             * tagged with this runId. Settling with the sum turns the promise into a
+             * receipt, and `Admission.settle` is idempotent so a teardown that runs
+             * twice charges once.
+             *
+             * ⚠️ AN UNMEASURED RUN SETTLES AT `undefined`, not at zero. The round
+             * path reports no cost at all, so a run that did rounds has spent an
+             * amount nobody can state — and the window must stay unmeasurable rather
+             * than record a night of work as free.
+             */
+            const actual = (0, spend_ledger_1.spentByRun)(runId);
+            admission?.settle(actual === null ? undefined : actual, Date.now() - startedAtMs);
+        };
+        log(`budget  : admitted — the machine is inside its envelope` +
+            (envelope.maxUsd === undefined ? '' : ` (ceiling $${envelope.maxUsd.toFixed(2)})`));
+    }
+    // `children` is this run's registry; the transport is the longest-lived
+    // child it starts and was the one thing never adopted into it.
+    //
+    // ⚠️ `runId` TRAVELS WITH IT, so every invocation's cost is attributed to
+    // this run and the admission above can be settled at what it really cost.
+    /**
+     * 🔴 THE JSON ENVELOPE, UNWRAPPED — SO THE ROUND'S COST IS RECORDED.
+     *
+     * The round asked for `--output-format text` and so recorded every
+     * invocation with `usd` absent: honest, and useless — the most expensive
+     * path in the system could never say what it spent, and a trial's report had
+     * to write "no actual usage captured". The scanner already ran on the JSON
+     * path; the round, the verifier and the planner now do too. The transport
+     * records the provider's `total_cost_usd`, `num_turns`, `usage` and
+     * `session_id` at the invocation, and `unwrapping` hands the round the same
+     * final message it always read. Missing usage stays absent — never zero.
+     */
+    /**
+     * ⚠️ THE BUILT-IN PROVIDER ONLY. A configured provider's stdout is the
+     * model's own stream: there is no CLI between the model and this process to
+     * write an envelope the model cannot forge, so asking it for "json" and
+     * unwrapping the answer would let a model-typed `total_cost_usd` become a
+     * ledger row — the closure acceptance check proves exactly that, end to
+     * end. A configured provider is driven exactly as before: text, unwrapped
+     * by nothing, recorded with `usd` absent.
+     */
+    const builtIn = (0, model_transport_1.isBuiltInProvider)(resolved.spec);
+    const wireFormat = builtIn ? { format: 'json' } : {};
+    /**
+     * F35: and a usage-limit refusal is waited out inside this Start rather than returned as the
+     * answer — measured live, it was read as "the compiler failed" and three Starts were bought in
+     * ninety seconds. Inside `unwrapping`, because the refusal is read off the envelope it strips.
+     * A Stop, a Pause or a signal ends the wait (see `provider-limit.ts`).
+     */
+    const limitWait = {
+        now: () => Date.now(),
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+        interrupted: async () => {
+            if (signals.requested() || halt !== null)
+                return true;
+            try {
+                const req = await control.read();
+                return req !== null && (req.kind === 'stop' || req.kind === 'pause');
+            }
+            catch {
+                // A control file that cannot be read now says nothing; the next slice reads it again.
+                return false;
+            }
+        },
+        log,
+        // A detached run's output is discarded: the ledger is what `looply goal` and the phone read.
+        announce: async (text) => {
+            try {
+                await ledgerForRun.append({
+                    ts: new Date().toISOString(),
+                    runId,
+                    projectId,
+                    lane: 'feature',
+                    kind: 'alert',
+                    actor: 'system',
+                    data: { code: 'provider-limit', severity: 'warn', text },
+                });
+            }
+            catch (e) {
+                log(`provider: the wait could not be recorded (${e.message})`);
+            }
+        },
+    };
+    const withFinalMessage = (invoke) => builtIn ? (0, agent_envelope_1.unwrapping)((0, provider_limit_1.waitingOutProviderLimits)(invoke, limitWait)) : invoke;
+    const agent = withFinalMessage((0, model_transport_1.makeMediatedAgentRunner)(cwd, 'implementer', resolved.spec, { runId, ...wireFormat }, children));
+    /**
+     * 🔴 THE VERIFIER GETS THE VERIFIER'S TOOLS — AND A RUN USED TO LEND IT
+     * THE IMPLEMENTER'S.
+     *
+     * One transport was built here and handed to three passes: the round, the
+     * compile step, and the VERIFY pass. `TOOL_POLICIES` distinguishes them —
+     * implementer gets `read, glob, grep, edit, write`, verifier gets
+     * `read, glob, grep` — and `verify-cmd` builds a verifier-roled transport for
+     * the standalone command. Inside a run, that narrowing was simply not applied.
+     *
+     * MEASURED at the bridge: a verifier-roled bridge answers "the verifier may
+     * not call write"; an implementer-roled one accepts the call. So a model asked
+     * to CHECK an item against the code could change the code first, and its
+     * verdict would then be about a tree it had just written — in one of the two
+     * keys the whole design rests on.
+     *
+     * ⚠️ `runId` TRAVELS WITH IT TOO, so verify-pass invocations are still
+     * attributed to this run and settled with everything else it spent.
+     */
+    const verifyAgent = withFinalMessage((0, model_transport_1.makeMediatedAgentRunner)(cwd, 'verifier', resolved.spec, { runId, ...wireFormat }, children));
+    /**
+     * 🔴 PLANNING GETS THE PLANNER'S TOOLS. Compiling a goal and evaluating a
+     * goal gap both READ the codebase and produce a plan; neither edits anything.
+     * Both were lent the implementer's transport — `[read, glob, grep, edit,
+     * write]` — for no reason beyond it being the one already in scope, which is
+     * exactly how the verify pass came to carry write until it was narrowed.
+     *
+     * `brain` is `[read, glob, grep]`. A capability nothing uses is a capability
+     * that only ever gets used by accident, and the narrowing costs nothing
+     * because a compile that edits files is not a compile.
+     *
+     * `runId` travels with it, so planning invocations stay attributed to this
+     * run and are settled with everything else it spent.
+     */
+    const planAgent = withFinalMessage((0, model_transport_1.makeMediatedAgentRunner)(cwd, 'brain', resolved.spec, { runId, ...wireFormat }, children));
+    /**
+     * 🔴 THE PROVER GETS THE PROVER'S TOOLS — THE SAME NARROWING AS THE TWO
+     * ABOVE, AND THE ONE THAT WAS MISSED.
+     *
+     * `prove` was handed `agent`, the implementer's transport, so the second
+     * key ran with `edit` and `write` in the window between a GREEN gate and
+     * the commit, where nothing re-gates what it changes. Measured live on
+     * 2026-09-24: the bridge was launched as `implementer` for the proving turn,
+     * and its spend was booked as implementer spend. See `TOOL_POLICIES.prover`.
+     */
+    const proveAgent = withFinalMessage((0, model_transport_1.makeMediatedAgentRunner)(cwd, 'prover', resolved.spec, { runId, ...wireFormat }, children));
+    /**
+     * A goal with nothing to work on compiles itself some work.
+     *
+     * Here, and not in RoundRunner, because this is the composition root: the
+     * goal is already resolved, the lease is already held, and the agent already
+     * exists. The runner receives a queue and cannot tell why anything is in it,
+     * which is the property the whole scoped-queue design exists to preserve.
+     *
+     * ONLY when the goal owns nothing. That is the whole idempotency story at
+     * this level: derived ids make a materialisation retry converge, but they
+     * cannot make two separate reasoning calls agree, so the second call must not
+     * happen. A goal that already owns work — because a previous run compiled it,
+     * or because this Start named items to adopt — is left alone. Re-planning a
+     * goal whose work is under way is a later phase's decision, not a side effect
+     * of starting it again.
+     *
+     * A failed compilation is not a failed run: the run carries on and reports
+     * "nothing to do" if that is the truth, which leaves the start-run to be
+     * offered again rather than terminally consumed.
+     */
+    // Compile when there is no plan for THIS version, and nothing eligible that
+    // could still move. Those are two different conditions and both matter:
+    //
+    //  - no current plan, because a previous version's plan must not stop this
+    //    version ever getting one. That count was the whole defect.
+    //  - nothing eligible still working, because work a person adopted by hand
+    //    should be got on with rather than planned around.
+    //
+    // A finished current plan therefore does NOT trigger a second one. Deciding
+    // whether a finished plan should be replaced is recompilation, and it is a
+    // separate question with its own answer.
+    const owned = queue.list();
+    const eligible = runQueue.list();
+    const split = (0, goal_ownership_1.splitGoalWork)(owned, scope);
+    // The decision reads as the question it is asking. `split` below is for
+    // saying what is being held back, which is a different job.
+    const verdict = (0, goal_ownership_1.decideCompile)(split, eligible, scope);
+    if (scope !== null && split.olderPlans.length) {
+        // Said out loud rather than left to be inferred from a queue that looks
+        // shorter than it is. These are durable and still owned; they are simply
+        // not this version's work.
+        log(`goal    : ${split.olderPlans.length} item(s) from an earlier plan for this goal, kept but not worked`);
+    }
+    if (scope !== null && split.unknownPlans.length) {
+        // Compiler output from before provenance was recorded. Durable, inert, and
+        // NOT treated as hand-adopted work: it was compiled for some particular
+        // version and nobody knows which, so it cannot be version-independent.
+        log(`goal    : ${split.unknownPlans.length} compiled item(s) here predate version tracking — ` +
+            'kept, but not worked by any version');
+    }
+    if (scope !== null && split.forged.length) {
+        log(`goal    : ${split.forged.length} item(s) here carry a compiler version but did not come from the ` +
+            'compiler — ignoring them');
+    }
+    if (scope !== null && split.newerPlans.length) {
+        /**
+         * REFUSE, rather than work around it.
+         *
+         * Goal versions only ever go up, so a plan compiled for a LATER version is
+         * durable evidence against the authority this run is acting under — a
+         * rolled-back mirror, a Start that should have been refused, a hand-edited
+         * queue. It should be unreachable: a Start behind the mirror is terminally
+         * refused long before selection.
+         *
+         * Merely hiding it and working something else is the unsafe part. The
+         * machine would be executing under an authority it has proof is stale,
+         * which is exactly what the version rules exist to prevent — so this stops,
+         * terminally, and touches nothing. The offending items are left exactly as
+         * they are: not deleted, not un-owned, not rewritten.
+         */
+        if (sync)
+            await sync.stop();
+        signals.uninstall();
+        const versions = [...new Set(split.newerPlans.map((i) => i.compiledForGoalVersion))].join(', ');
+        const superseded = `this machine holds work compiled for a LATER version of this goal (${versions}, and this Start says ` +
+            `${binding.kind === 'bound' ? binding.goal.version : '?'}) — refusing to run against evidence that ` +
+            'the goal has already moved on';
+        leaving(superseded);
+        await releaseHold();
+        throw new RunRefused(superseded, 'goal_superseded');
+    }
+    /**
+     * Whether this Start has already paid for a compilation.
+     *
+     * The adaptive decision below is only for a Start that arrived with an
+     * EXISTING exhausted plan. A Start that compiled its first plan has already
+     * spent ten minutes of compiler and up to thirty of verify against a
+     * sixty-minute window, and adding an evaluation and a second compilation to
+     * that would run past it — the command would be marked expired while the run
+     * carried on unacked, which is the failure Phase 4.1 exists to prevent.
+     */
+    let compiledThisRun = false;
+    /**
+     * Verification is budgeted for the WHOLE process, not per pass.
+     *
+     * There are now two passes on the adaptive path — the one below, and one over
+     * the plan the adaptive decision may produce. `VERIFY_MAX_PER_RUN` was
+     * written when there could only be one, so two passes each taking six drafts
+     * would put sixty minutes of verifier inside a sixty-minute window. They draw
+     * from one budget instead.
+     */
+    let verifyBudget = verify_cmd_2.VERIFY_MAX_PER_RUN;
+    /**
+     * EVERYTHING A START DOES BEFORE THE RUN, under one guard.
+     *
+     * The compile, the verify passes and the adaptive decision all happen above
+     * the try/finally that protects the run itself, so anything thrown by any of
+     * them — a rejected agent invocation being the likely one — would leave this
+     * process holding the lease and skip the teardown entirely. Recoverable,
+     * because the next process finds the pid dead, but it makes an ordinary agent
+     * failure look like a crash and wedges the tree until something notices.
+     *
+     * The guard was first put around the adaptive seam alone, which left its two
+     * older neighbours exposed for exactly the same reason.
+     *
+     * Nothing here throws. What it would have thrown is carried to the teardown,
+     * which releases the lease and reports it as retryable.
+     */
+    /** Hoisted: both are read by the teardown, which sits outside the guard. */
+    /**
+     * M3-2 — THE COMPILER'S ANSWER IS CHECKED, AND THE COMPILE IS A RECORD.
+     *
+     * The prompt defines a step's evidence as a claim about code that already
+     * exists, so every entry is re-read at the committed tree before the step
+     * becomes an item: a refused step is logged with the claim beside the fact
+     * and never queued. Admitted or refused, the compile is appended to
+     * `compiles.jsonl` — who was asked (the provider's identity, read from the
+     * thing that runs, as the identity note above does), with what (a digest,
+     * never the prompt or the transcript), at which tree, what came back and
+     * what was refused — BEFORE any item is minted. A record that cannot be
+     * written is a log line, never a refused run.
+     */
+    const compileReaders = (0, citation_readers_1.nodeCitationReaders)(cwd, stateDir);
+    const compileProvider = (0, provider_identity_1.providerRecordFor)(resolved.spec, resolved.spec.command === agent_exec_1.DEFAULT_AGENT.command ? (0, agent_contained_1.claudePackageDir)() : null);
+    const compiles = new compile_store_1.CompileStore(stateDir, ledger_store_1.nodeLedgerFs);
+    const recordCompile = async (forGoalId, forGoalVersion, treeSha, outcome, checked) => {
+        try {
+            if (!compiles.isOpen())
+                await compiles.open();
+            await compiles.append((0, core_2.compileRecordFrom)({
+                goalId: forGoalId,
+                goalVersion: forGoalVersion,
+                treeSha,
+                requestDigest: outcome.requestDigest,
+                provider: compileProvider,
+                askedAt: new Date().toISOString(),
+                answer: outcome.ok ? 'plan' : outcome.failure === 'unreadable' ? 'malformed' : 'no-answer',
+                ...(outcome.ok ? {} : { because: outcome.reason }),
+                admitted: checked?.admitted.length ?? 0,
+                refused: (checked?.refused ?? []).map((r) => ({ title: r.step.title, because: r.verdict.ok ? 'admitted' : r.verdict.because })),
+                malformed: outcome.ok ? outcome.malformed : 0,
+                dropped: outcome.ok ? outcome.dropped : 0,
+            }));
+        }
+        catch (e) {
+            log(`compile : the record could not be written — ${e.message}`);
+        }
+    };
+    let pickable = 0;
+    let adaptive = null;
+    /**
+     * D3's answer, computed ONCE when a `satisfied` decision lands.
+     *
+     * Held rather than recomputed because one of the two endings that render it
+     * (`nothingPickableBecause`) is synchronous, and because asking the server
+     * twice could give two answers to a question whose whole purpose is to be
+     * decided once. Undefined until a `satisfied` decision exists, and undefined
+     * for ever if this run never reaches one.
+     */
+    let coverage;
+    /**
+     * What KEY 2 actually observed, kept from the call that established it.
+     *
+     * Null until KEY 2 turns, and null for ever if it never does — in which case
+     * the fourth key is never asked either, so there is nothing to be missing.
+     */
+    let key2Saw = null;
+    /** The run whose round KEY 2 confirmed — an EARLIER Start's, not this one's (see `deliveringBranch`). */
+    let deliveringRunId = null;
+    // L4b: the commit key 2 confirmed HEAD on, beside the run that delivered it.
+    let deliveringSha = null;
+    /** F27: the tree this Start's evaluator judged, when a programme moved HEAD to the tree the lane holds. */
+    let judged = { kind: 'as-is', because: 'no goal-met check ran' };
+    /** The first compile's authority answer, kept so its reason is the acted-on one. */
+    let stillOurs = { ok: true };
+    let seamFailure = null;
+    try {
+        if (verdict.compile && scope !== null && binding.kind === 'bound') {
+            compiledThisRun = true;
+            log(`compile : ${binding.goal.text}`);
+            const compiled = await (0, goal_compile_1.compileGoal)({
+                goalId: binding.goal.id,
+                goalVersion: binding.goal.version,
+                goalText: binding.goal.text,
+                projectId,
+                projectName: config.project.name,
+                /**
+                 * 🔴 THE POINT OF THE WHOLE PHASE, AT THE ONE LINE THAT MAKES IT REAL.
+                 * Before this, the compiler received five fields and none of them was
+                 * history, so a plan was recompiled from the goal text every time and
+                 * could propose an approach that had already failed three times.
+                 *
+                 * Read at the COMMITTED tree, so a content fact observed at a tree
+                 * that has since moved is not offered as current — the reader decides
+                 * currency, and this is where it is given what it needs to.
+                 */
+                memory: await memoryFor(memoryStore, git, { goalId: binding.goal.id }, await currentGraph()),
+                // The task packet (M2-3), after memory: the requirements a person linked
+                // this goal to, quoted as data with their standing, one server read per
+                // linked source; an unanswerable source is a `missing` line, not a refusal.
+                ...(goalServer === null
+                    ? {}
+                    : {
+                        packet: (await (0, packet_for_goal_1.packetForGoal)(binding.goal, (id) => goalServer.sources.sourceDetail(projectId, id), 
+                        // F19: in a programme, what the OTHER goals own is named so this plan does none of it.
+                        (0, programme_mode_1.programmeIsOn)(config) ? goals.all() : [])).packet,
+                        // The checks a claim may cite: the gate's step names ARE the
+                        // acceptance map `produceClaims` holds `provenBy` against.
+                        checks: config.gates.map((g) => g.name),
+                    }),
+            }, { invoke: planAgent });
+            // M3-2: checked at the committed tree before any step becomes an item; the compile recorded either way.
+            const compiledAt = await git.headTreeSha().catch(() => null);
+            const checked = compiled.ok ? await (0, compile_check_1.checkCompiledPlan)(compiled.steps, compileReaders, compiledAt) : null;
+            for (const r of checked?.refused ?? [])
+                log(`compile : ${(0, compile_check_1.describeRefusal)(r)}`);
+            await recordCompile(binding.goal.id, binding.goal.version, compiledAt, compiled, checked);
+            if (!compiled.ok) {
+                // Retryable, and nothing durable: a compiler that failed did not produce
+                // a plan, so this version still has none and the next Start tries again.
+                log(`compile : ${compiled.reason} — this run has nothing to work on.`);
+                compileNote = `compile: ${compiled.reason} — this run has nothing to work on`;
+            }
+            else if (!compiled.steps.length && compiled.malformed > 0) {
+                /**
+                 * NOT an empty plan: an UNREADABLE one.
+                 *
+                 * `extractPlan` drops steps it cannot read and carries on, so a
+                 * transcript of malformed objects arrives here as `ok: true` with no
+                 * steps and a non-zero `dropped`. That is indistinguishable from a
+                 * legitimate empty plan by the step count alone — and the difference
+                 * matters, because a receipt would durably spend revision 1 on an answer
+                 * nobody could read.
+                 *
+                 * Nothing is written, so the next Start compiles the same revision again,
+                 * which is what a retryable failure should do.
+                 */
+                log(`compile : the plan could not be read — ${compiled.malformed} step(s) were malformed. ` +
+                    'Nothing queued, and this goal still has no plan.');
+                compileNote = `compile: the plan could not be read — ${compiled.malformed} step(s) were malformed`;
+            }
+            else if (checked !== null && !checked.admitted.length && checked.refused.length > 0) {
+                // Every step made a claim about the repository that does not hold. Like a
+                // plan that could not be read: nothing queued, no plan for this version,
+                // and the next Start tries again.
+                log(`compile : every step was refused — ${checked.refused.length} step(s) cited evidence that does not hold at the tree. ` +
+                    'Nothing queued, and this goal still has no plan.');
+                compileNote = `compile: every step was refused — ${checked.refused.length} step(s) cited evidence that does not hold at the tree`;
+            }
+            else if (!(stillOurs = await freshAuthority(binding.goal.id, binding.goal.version, binding.goal.text)).ok) {
+                /**
+                 * The goal moved while its FIRST plan was being compiled.
+                 *
+                 * The same ten-minute window the adaptive path guards, on the path that
+                 * had no guard at all. `binding` is resolved once, before the lease is
+                 * even taken, and the daemon rewrites goals.json on its own cadence
+                 * holding no lease — so a person who amends or abandons the goal three
+                 * minutes into a compile is invisible to a run that only remembers.
+                 *
+                 * Nothing is written. The version stamped on those steps would be one
+                 * nobody is pursuing, and a run that materialised them would then work
+                 * them for hours: `scope` still says the old version, so they classify
+                 * as current-plan, the verify pass promotes them, and the release
+                 * command for an abandoned goal cannot even land — it needs the lease
+                 * this run is holding.
+                 *
+                 * Asked ONCE and its answer kept: two reads could disagree, and the
+                 * reason a person is given must be the reason the run acted on.
+                 */
+                log(`compile : this goal moved while its plan was being made — ${stillOurs.reason}`);
+                compileNote = `compile: this goal moved while its plan was being made — ${stillOurs.reason}`;
+            }
+            else {
+                const now = Date.now();
+                /**
+                 * The receipt goes in whatever the plan contained, INCLUDING nothing.
+                 *
+                 * An empty plan is a legitimate answer — the compiler read the goal and
+                 * had no steps to propose — and it used to leave no trace at all. So the
+                 * next Start found a version that owned nothing, `decideCompile` said
+                 * "compile", and it asked the same question again. For ever, once per
+                 * explicit Start, at ten minutes a time.
+                 *
+                 * The receipt is what makes "revision 1 happened" true independently of
+                 * what revision 1 contained. It applies to the FIRST plan for the same
+                 * reason it applies to the adaptive ones; leaving R1 out was the only
+                 * thing that made an empty first plan different from an empty second one.
+                 */
+                const firstSteps = checked?.admitted ?? [];
+                /**
+                 * HOISTED so the claims can be attributed to the items these steps
+                 * became. `planToItems` maps one step to one item IN ORDER, and
+                 * `produceClaims` relies on that alignment; computing it inline would
+                 * have left nothing to align against.
+                 */
+                const firstItems = (0, goal_compile_1.planToItems)(firstSteps, {
+                    goalId: scope.goalId,
+                    goalVersion: binding.goal.version,
+                    projectId,
+                    orderKeyAt: (i) => (0, core_1.newId)('item', now + i + 1),
+                });
+                const written = await (0, goal_ownership_1.materialiseGoalPlan)(queue, scope.goalId, [
+                    (0, goal_compile_1.planMarker)({
+                        goalId: scope.goalId,
+                        goalVersion: binding.goal.version,
+                        revision: core_1.FIRST_PLAN_REVISION,
+                        projectId,
+                        orderKey: (0, core_1.newId)('item', now),
+                    }),
+                    // Time-ordered keys, unlike the ids: the loop works top-down, so order
+                    // is priority, and a derived id sorts arbitrarily.
+                    //
+                    // NOTE the ids here are unchanged. `planToItems` at revision 1 writes
+                    // no `compiledForPlanRevision` and derives through `compiledItemId`, so
+                    // a plan compiled before revisions existed and one compiled now are
+                    // byte-identical. Only the marker is new.
+                    ...firstItems,
+                ]);
+                /**
+                 * 🔴 NAME THE BRANCH'S GOAL WHERE THE LANE CAN READ IT.
+                 *
+                 * Written at materialisation, before any work, and written even when
+                 * this plan claims nothing: `coordinator-state.ts:341-347` needs a
+                 * `goalId` on the published attempt, and until this record existed the
+                 * only writer was a person typing `looply integrate --goal`. See
+                 * `goalOfBranch` for the deadlock that caused.
+                 */
+                (0, lane_claims_1.recordLaneClaim)(cwd, {
+                    schema: lane_claims_1.LANE_CLAIMS_SCHEMA,
+                    kind: 'claims',
+                    at: new Date(now).toISOString(),
+                    branch,
+                    runId,
+                    goalId: scope.goalId,
+                    goalVersion: binding.goal.version,
+                    planRevision: core_1.FIRST_PLAN_REVISION,
+                    servings: await claimsFor(firstSteps, firstItems, binding.goal.requirements ?? []),
+                    // F28: the plan lives here, so the goal's later Starts are placed here.
+                    workspace: cwd,
+                });
+                if (!written.ok) {
+                    log(`compile : ${written.problem}`);
+                    compileNote = `compile: ${written.problem}`;
+                }
+                else if (!compiled.steps.length) {
+                    log('compile : the plan came back empty — nothing to do for this goal.');
+                    compileNote = 'compile: the plan came back empty';
+                }
+                else {
+                    log(
+                    // Less one for the receipt, which is not a step and must not be
+                    // counted to a person as though it were work queued for them.
+                    `compile : ${Math.max(0, written.created - 1)} step(s) queued` +
+                        (written.alreadyThere ? `, ${written.alreadyThere} already here` : '') +
+                        (compiled.dropped ? `, ${compiled.dropped} trimmed` : '') +
+                        (checked?.refused.length ? `, ${checked.refused.length} refused` : ''));
+                }
+            }
+        }
+        // Drafts are checked here rather than refused. A scan writes items in
+        // `draft` because a finding is a claim; a run picks only `ready`. Nothing
+        // joined the two, so a freshly scanned project could not be run at all — the
+        // refusal pointed at the phone, which is no help unpaired and wrong paired,
+        // since marking an item ready by hand skips the very check that makes it
+        // pickable. Verification is the cheapest agent work looply does, so a run
+        // does it rather than sending the user away.
+        // Read fresh rather than from the snapshot taken before recovery: an item
+        // this run just put back is pickable, and counting the stale figure made a
+        // recovered run report "nothing to do" about a queue it had just repaired.
+        // The SCOPED queue, not the raw one. A goal-bound run counting every ready
+        // item in the project would decide it had work when none of it was its own —
+        // skipping the verify pass over its own drafts, and then handing the runner a
+        // scoped queue with nothing pickable in it.
+        pickable = runQueue.list().filter((i) => i.state === 'ready').length;
+        if (!pickable) {
+            // Read fresh: `all` was taken before recovery and before compilation, so it
+            // does not contain the plan this run may have just written.
+            const drafts = runQueue.list().filter((i) => i.state === 'draft');
+            if (drafts.length) {
+                log(`verify  : ${drafts.length} unchecked item(s) — confirming each against the code before picking`);
+                const pass = await (0, verify_pass_1.verifyDrafts)({
+                    queue: runQueue,
+                    ledger: ledgerForRun,
+                    verify: (0, verify_cmd_1.makeItemVerifier)(verifyAgent, queue),
+                    cachePut: (id, head, ev) => evidence.put(id, head, ev),
+                    headSha: () => git.headSha(),
+                    projectId,
+                    now: () => Date.now(),
+                    onVerdict: (item, outcome) => {
+                        const mark = outcome.verdict === 'confirmed' || outcome.verdict === 'amended' ? 'ready' : outcome.verdict;
+                        log(`verify  : ${mark.padEnd(9)} ${item.title.slice(0, 68)}`);
+                    },
+                }, 
+                // Bounded, because the whole pass happens BEFORE `run.started` — which
+                // is the only thing that acks the start-run that asked for this run,
+                // and that command expires an hour after it was issued. Sequential at
+                // up to five minutes a draft, an uncapped pass over enough of them
+                // spends the entire window and the command is marked expired while the
+                // run carries on unacked. Drafts past the cap are not lost; the next
+                // run checks them.
+                { max: verifyBudget });
+                verifyBudget -= pass.checked;
+                log(`verify  : ${pass.ready} of ${pass.checked} are ready to work on`);
+                pickable = pass.ready;
+            }
+        }
+        /**
+         * THE ADAPTIVE DECISION, and the only place it can live.
+         *
+         * Below this, the block that reports "nothing to do" has already stopped the
+         * sync, uninstalled the signal handlers and RELEASED THE LEASE — it is
+         * teardown, not a decision point. Anything that evaluates a goal or writes a
+         * plan has to happen while the tree is still held, which is here: after the
+         * verify pass has had its say about the drafts, and before any of that is
+         * given back.
+         *
+         * `pickable` is re-tested rather than assumed. Line above closes the verify
+         * block, and a pass that promoted a draft leaves work to do — this must not
+         * fire on a run that has something to get on with.
+         *
+         * ONE START, AT MOST ONE RUN: this may produce one more plan for THIS run to
+         * work, and it is never reached again afterwards. `runner.run()` returns to a
+         * `finally` that does nothing but clean up.
+         */
+        if (!pickable && scope !== null && binding.kind === 'bound' && !compiledThisRun) {
+            const bound = binding.goal;
+            // Captured, because `scope` moves when a new plan is materialised below and
+            // the callbacks here must go on describing the goal they were built for.
+            const goalId = scope.goalId;
+            const owned = queue.list();
+            const revision = (0, goal_ownership_1.currentPlanRevision)(owned, scope.goalId, bound.version);
+            // Only for a version that already HAS a plan. With none, `decideCompile`
+            // would have compiled one above, and there is nothing to have been
+            // insufficient.
+            if (revision > 0) {
+                log(`goal    : plan ${revision} has nothing left to work on — checking whether the goal is met`);
+                /**
+                 * The scope KEY 2 is asked about, built HERE and used below.
+                 *
+                 * `scope` at this point still has no `planRevision` — it is only assigned
+                 * when a new plan is materialised, sixty lines down. Passing it to the
+                 * completion check made that check revision-BLIND: `classifyForScope`
+                 * treats a scope without a revision as "every plan for this version is
+                 * current", so revision 1's delivery could answer for revision 2. The
+                 * unit tests could not see it, because they supplied the revision the
+                 * composition root did not.
+                 */
+                const askedScope = { ...scope, planRevision: revision };
+                /**
+                 * F27: IN A PROGRAMME WHOSE LANE INTEGRATES, JUDGE THE TREE THE LANE HOLDS for this
+                 * goal's delivered work — the delivered round, the lane's replay of it, or the moved
+                 * base it could not be carried onto (`goal-met-target.ts`). Only in a checkout looply
+                 * made: moving HEAD in a person's own checkout is not this run's to do.
+                 */
+                judged = { kind: 'as-is', because: 'not a programme workspace' };
+                // F33: a checkout LOOPLY MADE (its provisioning marker), not merely any linked worktree — a person's
+                // own `git worktree add` checkout inherits the tracked config and must never have its HEAD moved.
+                if ((0, programme_mode_1.programmeIsOn)(config) && config.run.integration === true && (0, reaper_1.hasProvisionedMarker)(cwd)) {
+                    judged = await (0, goal_met_target_1.goalMetTarget)({ cwd, git, stateDir, scope: askedScope, items: owned });
+                    if (judged.kind !== 'as-is' && judged.sha !== (await git.headSha())) {
+                        if ((await git.changedPaths()).length > 0) {
+                            judged = { kind: 'as-is', because: 'the working tree has uncommitted changes' };
+                        }
+                        else {
+                            (0, goal_met_target_1.writeJudgingMarker)(stateDir, { runId, sha: judged.sha });
+                            await git.switchDetached(judged.sha);
+                        }
+                    }
+                    log(`goal    : judging ${(0, goal_met_target_1.describeTarget)(judged)}`);
+                }
+                adaptive = await (0, goal_adaptive_1.decideAdaptive)({
+                    goalId: scope.goalId,
+                    goalVersion: bound.version,
+                    goalText: bound.text,
+                    projectId,
+                    projectName: config.project.name,
+                    currentRevision: revision,
+                    // The same packet and checks the first compile was given, so a
+                    // revision can claim what it delivers (see `AdaptiveInput.packet`).
+                    ...(goalServer === null
+                        ? {}
+                        : {
+                            packet: (await (0, packet_for_goal_1.packetForGoal)(bound, (id) => goalServer.sources.sourceDetail(projectId, id), (0, programme_mode_1.programmeIsOn)(config) ? goals.all() : [])).packet,
+                            checks: config.gates.map((g) => g.name),
+                        }),
+                    /**
+                     * Receipts filtered out — by DERIVED ID, not by tag.
+                     *
+                     * They are metadata about a plan having happened, not steps anybody
+                     * attempted, and listing "[closed] plan 2 for this goal" among the
+                     * work invites the model to reason about a row that means nothing.
+                     *
+                     * This was written as `tag !== 'goal' || state !== 'closed'` and
+                     * that was a real defect, the second of its kind: `'goal'` is the
+                     * compiler's default tag for an untagged step, and a step that
+                     * spends its last attempt becomes `closed`. So an untagged step
+                     * that FAILED three times was hidden from the evaluator, which then
+                     * had no reason not to say the goal was met — and seeing what the
+                     * plan actually did is the evaluator's whole job.
+                     */
+                    planItems: (0, goal_ownership_1.scopedQueue)(queue, askedScope)
+                        .list()
+                        .filter((i) => !(0, goal_compile_1.isPlanMarker)(i)),
+                }, {
+                    evaluate: (i) => (0, goal_gap_1.evaluateGoalGap)(i, { invoke: planAgent }),
+                    compile: (i, maxSteps) => (0, goal_compile_1.compileGoal)(i, { invoke: planAgent, maxSteps }),
+                    changedPaths: () => git.changedPaths(),
+                    headSha: () => git.headSha(),
+                    /**
+                     * KEY 2, against the CURRENT revision and the FINAL commit.
+                     *
+                     * The rounds are read from the ledger at the moment the question is
+                     * asked, not carried from earlier in the run: an answer about
+                     * "was this delivered" must be about what is durably written down.
+                     */
+                    confirmSatisfied: async (head) => {
+                        const read = await (0, round_records_1.readRoundRecords)(stateDir, ledger_store_1.nodeLedgerFs);
+                        // A ledger that could not be read proves nothing EITHER WAY, and
+                        // since a KEY 2 refusal is terminal it must not be reported as
+                        // "no round delivered any of this plan". `unknown` keeps it
+                        // retryable and says what actually happened.
+                        if (!read.ok)
+                            return { ok: false, reason: read.because, unknown: true };
+                        const confirmed = (0, goal_execution_evidence_1.confirmGoalExecutionEvidence)({
+                            scope: askedScope,
+                            items: owned,
+                            rounds: read.rounds,
+                            // F27: a carried commit is confirmed as the round the lane carried.
+                            currentHead: judged.kind === 'carried' ? judged.of : head,
+                            requiredSteps: (0, gate_1.requiredSteps)(config.gates),
+                        });
+                        /**
+                         * 🔴 WHAT KEY 2 SAW, KEPT FOR THE FOURTH KEY.
+                         *
+                         * Per-requirement coverage asks two further questions — was the
+                         * item claiming a requirement in this delivery, and did the gate
+                         * step it names pass at this tree. Both are things this call has
+                         * already established, and re-deriving them below would be a
+                         * second answer that can disagree with the one the completion
+                         * claim rests on.
+                         */
+                        if (confirmed.ok) {
+                            deliveringRunId = confirmed.round.runId;
+                            deliveringSha = confirmed.round.sha ?? null;
+                            key2Saw = {
+                                delivered: new Set(confirmed.delivered),
+                                checks: new Map((confirmed.round.gate?.steps ?? []).map((st) => [
+                                    st.step,
+                                    // A `when:` filter that matched nothing is SKIPPED, which
+                                    // is a different answer from passing — and the whole
+                                    // reason exit 0 cannot be taken for coverage.
+                                    st.skipped === true ? 'skipped' : st.ok ? 'passed' : 'failed',
+                                ])),
+                            };
+                        }
+                        return confirmed.ok ? { ok: true } : { ok: false, reason: confirmed.because };
+                    },
+                    stillAuthoritative: () => freshAuthority(goalId, bound.version, bound.text),
+                });
+                // M3-2: the adaptive plan's answer is checked and recorded the same way; a plan
+                // with every step refused is no decision, not an empty revision.
+                let adaptiveChecked = null;
+                if (adaptive.kind === 'planned') {
+                    const adaptiveAt = await git.headTreeSha().catch(() => null);
+                    adaptiveChecked = adaptive.steps.ok ? await (0, compile_check_1.checkCompiledPlan)(adaptive.steps.steps, compileReaders, adaptiveAt) : null;
+                    for (const r of adaptiveChecked?.refused ?? [])
+                        log(`goal    : ${(0, compile_check_1.describeRefusal)(r)}`);
+                    await recordCompile(scope.goalId, bound.version, adaptiveAt, adaptive.steps, adaptiveChecked);
+                    if (adaptiveChecked !== null && !adaptiveChecked.admitted.length && adaptiveChecked.refused.length > 0) {
+                        log(`goal    : every step of plan ${adaptive.revision} was refused — ${adaptiveChecked.refused.length} step(s) cited evidence ` +
+                            'that does not hold at the tree; nothing queued');
+                        adaptive = { kind: 'no-decision', reason: 'every step of the adaptive plan was refused' };
+                    }
+                }
+                /**
+                 * D3 — asked HERE, where the decision is, and only for `satisfied`.
+                 *
+                 * Every other kind already refuses for its own reason, and asking the
+                 * server about coverage for a goal that is not claiming to be done
+                 * would be a round-trip nobody reads.
+                 */
+                if (adaptive.kind === 'satisfied') {
+                    /**
+                     * ⚠️ DEFERRED TO THE LANE WHEN THE LANE WILL JUDGE (F25). In programme mode with
+                     * integration, the daemon's third key judges strict coverage on the integrated tree,
+                     * from the lane's receipts — the acceptance authority. Judging it here, on this
+                     * checkout, read a receipt table nothing writes and blocked every goal. Anywhere
+                     * the lane does not judge, the worker still does.
+                     */
+                    coverage =
+                        (0, programme_mode_1.programmeIsOn)(config) && config.run.integration === true && config.machine?.integrate === true
+                            ? undefined
+                            : await coverageNow();
+                    /**
+                     * 🔴 WHAT THIS DELIVERY FINISHED, FOR THE LANE TO JUDGE LATER.
+                     *
+                     * The claims say what each item was FOR; this says which of them the
+                     * delivery actually finished, and at which tip. The lane cannot
+                     * re-derive either: no commit trailer records an item id, and the run
+                     * registry is released on a clean exit. It is written here because
+                     * this is where KEY 2 has already answered both, and a second
+                     * derivation could disagree with the one the completion claim rests on.
+                     *
+                     * ⚠️ IT IS PROVENANCE, NOT ACCEPTANCE. `coverage` above is this
+                     * worker's own verdict about its own checkout; the lane throws that
+                     * away and recomputes from its own gate. What travels is the claim.
+                     */
+                    await recordDelivery(scope, bound.version);
+                }
+                if (adaptive.kind === 'planned') {
+                    const at = Date.now();
+                    const next = adaptive.revision;
+                    const nextSteps = adaptiveChecked?.admitted ?? [];
+                    // Hoisted for the same reason as the first plan's: the claims are
+                    // attributed by index to the items these steps became.
+                    const nextItems = (0, goal_compile_1.planToItems)(nextSteps, {
+                        goalId: scope.goalId,
+                        goalVersion: bound.version,
+                        projectId,
+                        orderKeyAt: (i) => (0, core_1.newId)('item', at + i + 1),
+                        planRevision: next,
+                    });
+                    const written = await (0, goal_ownership_1.materialiseGoalPlan)(queue, scope.goalId, [
+                        // The receipt first, so a revision that produced no steps is still
+                        // durable and still spends its place in the budget.
+                        (0, goal_compile_1.planMarker)({
+                            goalId: scope.goalId,
+                            goalVersion: bound.version,
+                            revision: next,
+                            projectId,
+                            orderKey: (0, core_1.newId)('item', at),
+                        }),
+                        ...nextItems,
+                    ]);
+                    // One record per plan revision, for the reason the first one is
+                    // written: the branch's goal must be nameable from the ledger
+                    // whatever this revision turns out to contain.
+                    (0, lane_claims_1.recordLaneClaim)(cwd, {
+                        schema: lane_claims_1.LANE_CLAIMS_SCHEMA,
+                        kind: 'claims',
+                        at: new Date(at).toISOString(),
+                        branch,
+                        runId,
+                        goalId: scope.goalId,
+                        goalVersion: bound.version,
+                        planRevision: next,
+                        servings: await claimsFor(nextSteps, nextItems, bound.requirements ?? []),
+                        workspace: cwd,
+                    });
+                    if (!written.ok) {
+                        log(`goal    : ${written.problem}`);
+                    }
+                    else {
+                        log(`goal    : plan ${next} — ${written.created - 1} step(s) queued`);
+                        // The run now works the NEW plan, so its scope moves with it;
+                        // otherwise its own fresh rows would read as a revision it has never
+                        // heard of, which is a contradiction it would refuse on.
+                        scope = { ...scope, planRevision: next };
+                        runQueue = (0, goal_ownership_1.scopedQueue)(queue, scope);
+                        const drafts = runQueue.list().filter((i) => i.state === 'draft');
+                        if (drafts.length && verifyBudget > 0) {
+                            const pass = await (0, verify_pass_1.verifyDrafts)({
+                                queue: runQueue,
+                                ledger: ledgerForRun,
+                                verify: (0, verify_cmd_1.makeItemVerifier)(verifyAgent, queue),
+                                cachePut: (id, head, ev) => evidence.put(id, head, ev),
+                                headSha: () => git.headSha(),
+                                projectId,
+                                now: () => Date.now(),
+                                onVerdict: (item, outcome) => {
+                                    const mark = outcome.verdict === 'confirmed' || outcome.verdict === 'amended' ? 'ready' : outcome.verdict;
+                                    log(`verify  : ${mark.padEnd(9)} ${item.title.slice(0, 68)}`);
+                                },
+                            }, { max: verifyBudget });
+                            verifyBudget -= pass.checked;
+                            log(`verify  : ${pass.ready} of ${pass.checked} are ready to work on`);
+                            pickable = pass.ready;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        seamFailure = err instanceof Error ? err.message : String(err);
+        log(`goal    : the goal check could not be completed — ${seamFailure}`);
+    }
+    /**
+     * M6-16: WHY A RUN WITH NOTHING PICKABLE IS LEAVING — composed from what is
+     * already decided (the seam, the adaptive verdict, the work set) in the same
+     * order the exits below render it, because the hold is released at the top
+     * of that block and the ending is written there, before any of them.
+     */
+    const nothingPickableBecause = () => {
+        if (seamFailure !== null)
+            return `could not check this goal — ${seamFailure}`;
+        const said = adaptive === null ? null : (0, goal_adaptive_1.describeAdaptive)(adaptive, attestedNow(), coverage);
+        if (said !== null)
+            return said.message;
+        const left = scope === null ? null : (0, core_1.workLeft)(runQueue.list());
+        if (left === 'finished')
+            return `this goal's work is done — ${(0, queue_summary_1.describeNoReady)(runQueue.list())}`;
+        if (left === 'stalled')
+            return `nothing here can move without you — ${(0, queue_summary_1.describeNoReady)(runQueue.list())}`;
+        return `nothing to do — ${(0, queue_summary_1.describeNoReady)(runQueue.list())}`;
+    };
+    if (!pickable) {
+        if (sync)
+            await sync.stop();
+        signals.uninstall();
+        // This path returns before the try/finally below, so the lease has to be
+        // given back here too. Forgetting it would wedge the tree until the next
+        // process noticed the pid was dead — recoverable, but for no reason.
+        leaving(nothingPickableBecause());
+        // F31 (corr-12): named BEFORE the slot is given back — the lookup's fallback reads this checkout's
+        // branch, and once it is released another run may already be cutting its own here.
+        const deliveredOn = await deliveringBranch();
+        await releaseHold();
+        /**
+         * THE COMPLETION FENCE.
+         *
+         * Every terminal conclusion this pursuit can reach is below: the goal was
+         * met, its work is finished, or nothing here can move without a person.
+         * All three end the pursuit, and none of them may be reached while somebody
+         * still owes an answer.
+         *
+         * WHY EVEN A DENIAL FENCES IT. A refusal that no run has been told about
+         * yet is a fact the goal has not had a chance to plan around. Concluding
+         * "met" or "finished" on the strength of work done BEFORE that answer
+         * existed would close a pursuit on a question it never heard — and the
+         * whole point of resuming is that the answer changes what is worth doing.
+         * Once a resumed run has picked it up, it stops fencing anything.
+         *
+         * READ FRESH, HERE, and not carried from the top of the run. A run lasts
+         * hours; the person may have answered during it, and a conclusion drawn
+         * from a reading taken before the first round would be about a world that
+         * has moved.
+         *
+         * A PLAIN ERROR, AND THAT IS THE LOAD-BEARING PART. Every `RunRefusalCode`
+         * is terminal — `isContinuableRefusal` returns false for all seven — so
+         * refusing here would settle the person's grant because they had not yet
+         * answered a question. Retryable is the truth: the next Start, once they
+         * have, may conclude anything it likes.
+         */
+        if (binding.kind === 'bound' && goalServer !== null) {
+            const fence = await (0, approval_gate_read_1.readApprovalGate)(goalServer.gate, {
+                projectId,
+                goalId: binding.goal.id,
+                goalVersion: binding.goal.version,
+                now: Date.now(),
+                consumed: (ids) => resumes.consumed(ids),
+            });
+            const waiting = (0, core_1.approvalHold)(fence);
+            if (waiting !== null) {
+                log(`action  : not calling this goal done — ${waiting}`);
+                await releaseHold();
+                throw new Error(`this goal is waiting on you — ${waiting}`);
+            }
+        }
+        /**
+         * "Nothing to do" was one message and one retryable failure, and it was
+         * hiding three different situations.
+         *
+         * For a goal-bound run it now says which. A goal whose work is FINISHED, or
+         * whose work can no longer move on this machine, will answer the same way
+         * for ever — so a retryable failure buys a start-run offered again every
+         * three seconds until it silently expires an hour later, and the person who
+         * tapped Start is told nothing at all. Terminal is the truthful answer, and
+         * it reaches the phone as a refusal with a reason rather than as silence.
+         *
+         * `working` and `none` stay retryable, because for those the next attempt
+         * really might find something: a draft still to be verified, or a plan not
+         * yet compiled.
+         *
+         * Deliberately NOT a goal state. Nothing is written anywhere — this is
+         * derived from the goal's own slice of the queue, every time it is asked,
+         * so it cannot go stale and there is no new column to keep true.
+         */
+        /**
+         * What the adaptive decision concluded, said in a way that reaches a person.
+         *
+         * These are TERMINAL and produce no run, which is the whole point: the
+         * command is refused with a reason rather than acked `done`, because `done`
+         * on a start-run means a run began and nothing else. The reason travels to
+         * the phone through the transport Phase 6A3 built.
+         */
+        // Retryable, and reported rather than swallowed.
+        //
+        // "Nothing durable was written" would be the tidy thing to say and is not
+        // always true: a throw AFTER `materialiseGoalPlan` leaves the revision on
+        // disk. That is safe — the write is one whole-file rename and the next
+        // Start converges on the same rows — but the message should not claim more
+        // than it knows, so it says what happened rather than what it hopes.
+        if (seamFailure !== null) {
+            await releaseHold();
+            throw new Error(`could not check this goal — ${seamFailure}`);
+        }
+        if (adaptive !== null) {
+            const said = (0, goal_adaptive_1.describeAdaptive)(adaptive, attestedNow(), coverage);
+            // `null` is the compiled-a-plan case, which is not an outcome: the run
+            // went on to work it, and only got here because the plan produced nothing
+            // pickable. The work-set facts below say which nothing that is.
+            if (said !== null) {
+                // The decision's own code travels with it. Nothing here re-derives it.
+                //
+                // 🔴 AND IT RELEASED NOTHING. This exit was invisible to the source pin
+                // that guards the other eleven, because that pin looked for `throw new`
+                // and this is `throw <ternary>`. Widening the pin found it immediately —
+                // which is the argument for structural rules over enumerated ones.
+                // L4b: what key 2 saw, when this is the met-goal refusal and key 2 answered.
+                // Computed BEFORE the release, so the throw stays beside `releaseHold()`.
+                // An ARROW, for the reason `coverageNow` gives: these three are filled
+                // inside a callback, so the straight-line body would narrow them to null.
+                const deliveryNow = () => deliveringRunId !== null && deliveringSha !== null && key2Saw !== null
+                    ? { runId: deliveringRunId, sha: deliveringSha, checks: Object.fromEntries(key2Saw.checks) }
+                    : undefined;
+                const delivery = said.terminal && said.code === 'goal_satisfied' ? deliveryNow() : undefined;
+                await releaseHold();
+                // The branch the controller will ask the lane about: the one that delivered (F20).
+                const refusedOn = deliveredOn;
+                throw said.terminal ? new RunRefused(said.message, said.code, refusedOn, delivery) : new Error(said.message);
+            }
+        }
+        const left = scope === null ? null : (0, core_1.workLeft)(runQueue.list());
+        if (left === 'finished') {
+            // A WORK-SET fact, not a goal verdict: every row reached a terminal state.
+            // Deliberately NOT `goal_satisfied` — that requires both keys, and this
+            // path never asked the second one.
+            await releaseHold();
+            throw new RunRefused(`this goal's work is done — ${(0, queue_summary_1.describeNoReady)(runQueue.list())}`, 'run_refused');
+        }
+        if (left === 'stalled') {
+            await releaseHold();
+            throw new RunRefused(`nothing here can move without you — ${(0, queue_summary_1.describeNoReady)(runQueue.list())}`, 'human_required');
+        }
+        await releaseHold();
+        throw new Error(`nothing to do — ${(0, queue_summary_1.describeNoReady)(runQueue.list())}`);
+    }
+    /**
+     * THE APPROVAL BOUNDARY, AND THE ONLY PLACE IT COULD LIVE.
+     *
+     * Everything a request for human authority needs is known here and nowhere
+     * else: which project the server registered, which goal this run is for, at
+     * which version, which run is asking, and — inside the round — which item it
+     * was working. The runner has none of it, the tool bridge has none of it, and
+     * the model must never have any of it.
+     *
+     * `halt` is the one bit of state the run keeps about this. It is armed once,
+     * before the model turn returns to the round protocol, and read by the runner
+     * through a dep that cannot tell an approval from any other reason to stop.
+     *
+     * ─────────────────────────────────────────────────────────────────────────
+     * THE CONTROL PLANE THIS RUN MAY FILE A QUESTION WITH, OR NOTHING.
+     *
+     * Both halves are required and the second is the subtle one. `goalServer` is
+     * built from the machine's own credentials and knows the server's id for this
+     * repository; `projectId` is what this run STAMPS ON ITS EVENTS, and it comes
+     * from the sync. When the sync could not be opened that falls back to
+     * `'local'`, every event this run writes is dropped by ingest on exactly that
+     * mismatch, and the server therefore never learns the run exists — so an
+     * approval naming it could not be validated even though a perfectly good
+     * client is sitting right there. Requiring the two to agree turns a confusing
+     * 400 about an unknown run into a sentence about what is actually wrong.
+     */
+    const approvalServer = goalServer !== null && goalServer.projectId === projectId ? goalServer.approvals : null;
+    const blocking = new run_approval_1.BlockingApproval({
+        server: approvalServer ?? {
+            createApproval: () => Promise.reject(new Error('unreachable: guarded before use')),
+        },
+        // The house rule is that the next cadence is the retry and a tight catch
+        // loop turns an outage into a spin. This is the one place that cannot wait
+        // for a cadence — the run is holding a working tree and is about to end —
+        // so it asks a bounded number of times and pauses between, rather than
+        // firing three refused connections in the same millisecond.
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    });
+    /**
+     * Set when the approval could NOT be filed. Thrown after the run has settled,
+     * never instead of settling it: the ledger is the only account of what
+     * happened, and a process that threw before writing one would leave a run
+     * that looks live for ever.
+     */
+    let approvalFailure = null;
+    /**
+     * A model turn asked for something only a person may authorise.
+     *
+     * ORDERING IS THE WHOLE CONTRACT, and it runs downwards: validate what the
+     * model said, build the exact request from trusted context, file it with the
+     * server, and only then arm the halt that ends the run. Every failure above
+     * the last step leaves `halt` unarmed, so a run can never come to rest saying
+     * it is waiting for an approval that does not exist.
+     */
+    const askForApproval = async (declaration, itemId) => {
+        const said = (line) => log(`action  : ${line}`);
+        /** Nothing was filed, and the run stops saying so rather than carrying on. */
+        const cannot = (why) => {
+            approvalFailure = why;
+            halt = { stopReason: 'aborted', because: why };
+            said(why);
+        };
+        if (binding.kind !== 'bound') {
+            // Nothing to hang the request on. The server requires a pursuit alongside
+            // a run, and a later controller decides holds by reading approvals for a
+            // goal — one filed without either would be invisible to the thing meant
+            // to act on it, which is worse than not filing it.
+            return cannot('a run with no goal cannot ask for approval');
+        }
+        if (approvalServer === null) {
+            return cannot(goalServer === null
+                ? 'this machine is not paired, so there is nobody to ask'
+                : 'this run is not being mirrored to the server, so nobody could be asked about it');
+        }
+        /**
+         * The model chose the action and its fields. It chose nothing else.
+         *
+         * `runner` is the actor for the same reason every round event carries it:
+         * this happened inside a round, at the machine's own initiative. It is
+         * deliberately not a `human:` actor — a run that could sign as a person
+         * would be a run that could authorise itself — and deliberately not derived
+         * from `opts.autonomous`, because who asked and who said go are different
+         * questions and only the first belongs on the request.
+         */
+        // The project's publish policy travels WITH the request build, so an
+        // action that may not leave this machine is refused before a person is
+        // ever asked about it.
+        const built = (0, pending_action_1.buildPendingActionSignal)(declaration, { projectId, requestedBy: 'runner' }, config.publish.policy);
+        if (!built.ok)
+            return cannot(`that action cannot be requested — ${built.because}`);
+        /**
+         * THE SERVER HAS TO HAVE HEARD OF THIS RUN FIRST.
+         *
+         * Creating the approval names the run it came from, and the server checks
+         * that against a `Run` row it only has because this run's own `run.started`
+         * was ingested. That event is written to the ledger the instant the runner
+         * starts and shipped by the sync on its own cadence — which, for a first
+         * round that finished quickly, may not have come round yet.
+         *
+         * Best-effort on purpose. A flush that fails changes nothing about what
+         * happens next: the create is attempted anyway, and a server that still has
+         * not heard of the run refuses it, which is the honest outcome rather than a
+         * reason not to try.
+         */
+        try {
+            await sync?.daemon.flush();
+        }
+        catch {
+            /* the create below is the real test of whether the server can be reached */
+        }
+        const outcome = await blocking.raise(built.signal, {
+            projectId,
+            goalId: binding.goal.id,
+            goalVersion: binding.goal.version,
+            originRunId: runId,
+            // A REAL identity or none. The round is working this item, so there is
+            // one; nothing here would invent a value to fill the field if there were
+            // not.
+            originItemId: itemId,
+        });
+        if (!outcome.ok)
+            return cannot(`the approval could not be filed — ${outcome.because}`);
+        // DURABLE FIRST, SETTLED SECOND. Past this line the server holds the
+        // question, so a crash before the run finishes ending is recoverable from
+        // the server's own row rather than from anything written here.
+        said(`waiting for you to approve ${built.signal.request.type} — nothing has been done`);
+        halt = {
+            stopReason: 'approval-required',
+            because: 'stopped to ask you to approve something',
+            // Attribution, spread onto `run.ended` by a runner that does not read it.
+            // The id and nothing else: what the approval SAYS is the server's answer
+            // to give, every time it is asked.
+            endedContext: { approvalId: outcome.approvalId },
+        };
+    };
+    const deps = {
+        ledger: ledgerForRun,
+        queue: runQueue,
+        git,
+        // Passed straight through: an item's cross-repo needs are decided by
+        // `pickableItems`, and the only thing this file contributes is the wire.
+        ...(opts.crossRepo === undefined ? {} : { crossRepo: opts.crossRepo }),
+        // CONTAINED. A gate step is the project's own tests over code the agent
+        // just wrote, so it runs inside the boundary with Looply's own runtime
+        // rather than as the daemon with the machine's.
+        gateRunner: (0, untrusted_gate_1.makeUntrustedGateRunner)(cwd),
+        // ASKED EVERY ROUND, NEVER CACHED. ~0.6 s against a 45-minute agent
+        // ceiling, and asking each time is what makes the three-round bound mean
+        // anything — and what lets a machine that recovers mid-run carry on.
+        environmentReady: (0, untrusted_gate_1.makeContainmentPreflight)(cwd),
+        implement: async (item, attempt, repair) => {
+            roundNo += 1;
+            terminal.phase(roundNo, 'implementing', item.title);
+            /**
+             * 🔴 ONE SNAPSHOT FOR THIS ROUND, TAKEN HERE.
+             *
+             * Asked per round rather than once per run, because a previous round
+             * may have committed — and asked ONCE per round rather than twice,
+             * because the memory ranking and the structural block must describe the
+             * same world. Two calls either side of a commit would rank memories
+             * against one tree and print a neighbourhood from another, and nothing
+             * downstream could tell.
+             */
+            const graphNow = await currentGraph();
+            const goalNow = binding.kind === 'bound' ? binding.goal.id : undefined;
+            const turn = await (0, agent_driver_1.runImplementer)(agent, {
+                itemId: item.id,
+                // The decision travels to the model here and nowhere else. It is not on
+                // the item, not in the queue, and not a runner dep — the round protocol
+                // has no vocabulary for it and must not acquire one.
+                prompt: buildImplementerPrompt(item, attempt, config, resolution, governed, 
+                // Scoped to the item's own subject as well as the pursuit: what failed
+                // on THIS piece of work is what a round most needs not to repeat.
+                await memoryFor(memoryStore, git, { goalId: goalNow }, graphNow), 
+                /**
+                 * 🔴 THE GRAPH REACHING A PROMPT. Same snapshot as the line above, so
+                 * the structure a model is shown and the memories it is ranked by
+                 * describe ONE world — two calls could straddle a commit and disagree.
+                 */
+                structureFor(graphNow, goalNow), 
+                // What the last attempt did and why it was refused, when this run
+                // saw it refused. The runner built it from the retained evidence.
+                repair, 
+                /**
+                 * 🔴 AND THE GOAL ITSELF, WHICH WAS ALWAYS ONE PROPERTY AWAY. The
+                 * line that computes `goalNow` reads `binding.goal.id` off this same
+                 * object; `binding.goal.text` is the person's own wording, preserved
+                 * verbatim, and it was being left behind on every round of every
+                 * pursuit (the audit's E-01). Read from the binding rather than
+                 * fetched, so the text a round is shown is the text the round is
+                 * bound to — a second read could straddle an amendment and show a
+                 * goal this work was never authorised against.
+                 */
+                binding.kind === 'bound' ? binding.goal.text : undefined),
+                timeoutMs: AGENT_TIMEOUT_MS,
+            });
+            if (turn.kind !== 'pending-action')
+                return turn;
+            // NARROWED HERE, ONCE. A request for authority is not something a round
+            // can be told about, so it never reaches the runner as one: the boundary
+            // is dealt with, the halt is armed, and what goes back is a turn that
+            // produced no implementable result — which is exactly what happened.
+            await askForApproval(turn.declaration, item.id);
+            const { transcript, ms, exitOk, timedOut } = turn;
+            return {
+                kind: 'abandoned',
+                reason: halt?.because ?? 'the turn asked for an action instead of implementing',
+                transcript,
+                ms,
+                exitOk,
+                timedOut,
+            };
+        },
+        ...(config.proof.enabled
+            ? {
+                prove: async ({ item }) => {
+                    terminal.phase(roundNo, 'proving', item.title);
+                    const diff = await git.diff();
+                    const run = await (0, prover_1.runProver)(proveAgent, {
+                        item: { title: item.title, evidence: item.evidence },
+                        diff,
+                        // Held only so the exclusion is enforced where it is testable;
+                        // the prompt builder never reads it. The prover grades the
+                        // code, not the implementer's account of it.
+                        implementer: {
+                            itemId: item.id,
+                            outcome: 'implemented',
+                            filesTouched: [],
+                            testsAdded: 0,
+                            note: '',
+                            blocked: null,
+                        },
+                    }, PROVER_TIMEOUT_MS);
+                    return (0, prover_1.toProofOutcome)(run);
+                },
+                /**
+                 * 🔴 §6.C, AND THE LINE `config.ts` HAS BEEN WARNING ABOUT SINCE
+                 * M6-20. `on_partial: ask` is the DEFAULT and nothing could ask, so a
+                 * partial proof was discarded with a log line while the server held
+                 * the whole mechanism and the phone rendered it.
+                 *
+                 * ⚠️ AN UNPAIRED MACHINE IS UNCHANGED. `goalServer` is null without a
+                 * paired machine and a registered project, and the asker says the
+                 * same two lines and discards, exactly as this did.
+                 */
+                resolvePartial: (0, partial_asker_1.makePartialAsker)({
+                    /**
+                     * 🔴 ONE FIELD, SO THERE IS NOTHING TO THROW ABOUT. Unpaired is the
+                     * ABSENCE of a server, not a null id beside calls that need one —
+                     * and a bare `throw` in this file is how a run leaks its lease and
+                     * its slot, which `run-hold-release.spec.ts` says out loud.
+                     */
+                    server: goalServer === null
+                        ? null
+                        : {
+                            projectId: goalServer.projectId,
+                            ask: (body) => goalServer.questions.ask(body),
+                            read: (p, id) => goalServer.questions.read(p, id),
+                        },
+                    runId,
+                    now: () => Date.now(),
+                    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+                    windowMs: config.proof.askWindowMin * 60_000,
+                    graceMs: partial_asker_1.PARTIAL_ASK_GRACE_MS,
+                    pollMs: partial_asker_1.PARTIAL_ASK_POLL_MS,
+                    log,
+                }),
+            }
+            : {}),
+        evidence: { invalidate: (itemId) => evidence.invalidate(itemId) },
+        // Where a rejected candidate goes before `git reset --hard` takes the tree:
+        // under the state directory, which `discard()` spares by name.
+        rejectedEvidence: (0, rejected_evidence_1.makeRejectedEvidenceStore)(cwd),
+        reverify: {
+            cache: {
+                lookup: (itemId, head) => evidence.lookup(itemId, head),
+                put: (itemId, head, ev) => evidence.put(itemId, head, ev),
+            },
+            countCommitsTouching: (from, to, paths) => git.countCommitsTouching(from, to, paths),
+            // Same verifier the pre-run pass uses, so an item's verdict never
+            // depends on which route asked for it.
+            verify: (0, verify_cmd_1.makeItemVerifier)(verifyAgent, queue),
+        },
+        notifier,
+        readEnvFile: (p) => {
+            try {
+                return (0, node_fs_1.readFileSync)((0, node_path_1.join)(cwd, p), 'utf8');
+            }
+            catch {
+                return null;
+            }
+        },
+        env: process.env,
+        now: () => Date.now(),
+        sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+        stopRequested: () => signals.requested(),
+        // The generic half of the boundary above. The runner asks whether the rest
+        // of this run is still possible and is handed a reason; it never learns
+        // that the reason is a person.
+        haltRequested: () => halt,
+        /**
+         * ⚠️ ONLY WHEN THE PROJECT ASKED, and only for a run that has a base to be
+         * stale. With `run.integration` off there is no `looply/integration` ref,
+         * so this is not wired at all rather than wired and answering "current".
+         */
+        ...(config.run.integration === true
+            ? {
+                /**
+                 * 🔴 `.catch(() => ({ kind: 'current' }))` WAS THE THIRD FAIL-OPEN IN
+                 * ONE CHECK, AND THE MOST DIRECT.
+                 *
+                 * `current` is this function's word for "the ground has not moved,
+                 * carry on". So a broken git, a missing base commit, a repository
+                 * mid-`rebase` with an index lock — every one of them told the run
+                 * that its base was fresh, which is the single answer this check
+                 * exists to be sure about. Combined with the two inside git-driver, a
+                 * staleness check failed open in three independent ways.
+                 *
+                 * A staleness check that cannot check has to HALT. That is the same
+                 * rule the loop-safety history follows ("an unreadable history must
+                 * hold, not pass") and the same one `withinEnvelope` follows for an
+                 * unmeasurable ceiling. Stopping costs a run; carrying on builds an
+                 * hour of work on ground that moved.
+                 */
+                /**
+                 * WHERE THIS RUN'S BRANCH IS CUT FROM — the other half of the phase.
+                 *
+                 * ⚠️ `cutFrom` ANSWERS null UNTIL INTEGRATION EXISTS, and the runner
+                 * then cuts from HEAD exactly as it always has. Once it exists, every
+                 * run starts from the same base instead of stacking on the last one.
+                 */
+                integrationBase: async () => {
+                    try {
+                        const at = await (0, integration_1.cutFrom)(git, true);
+                        return at === null ? null : at.ref;
+                    }
+                    catch {
+                        // A start point that cannot be read is not a reason to refuse the
+                        // run; it is a reason to start where runs have always started.
+                        return null;
+                    }
+                },
+                baseStale: async (cutAt) => {
+                    try {
+                        // F29: the commit the runner CUT from — never this checkout's HEAD before the cut, which in
+                        // a reused checkout is the LAST run's tip and read every moved lane as a stale base (corr-7).
+                        const out = await (0, integration_1.baseFreshness)(git, cutAt, true);
+                        /**
+                         * ⚠️ UNINITIALISED STOPS THE RUN TOO, and does not read as fresh.
+                         * `run.integration` is on, so this project asked for its runs to
+                         * converge; with no integration ref there is nothing to converge
+                         * on and nothing to compare against. Carrying on while reporting
+                         * freshness is the one answer this check exists to prevent.
+                         */
+                        return out.kind === 'current' ? null : out.because;
+                    }
+                    catch (e) {
+                        return (`this run cannot tell whether its base is still current (${e.message}). ` +
+                            'Refusing to build on ground it cannot check');
+                    }
+                },
+            }
+            : {}),
+        // Attribution for this run's header event, passed as opaque values. The
+        // runner spreads them and knows nothing about what they mean — that is the
+        // whole point of the carrier, and why RoundRunner still contains no
+        // occurrence of the word.
+        ...(binding.kind === 'bound'
+            ? {
+                runContext: {
+                    goalId: binding.goal.id,
+                    goalVersion: binding.goal.version,
+                    // Which answer this run was started to pick up. Lineage, carried on
+                    // the same opaque channel the goal binding uses — the runner spreads
+                    // it onto the header and knows nothing about what it means.
+                    ...(resolution === undefined ? {} : { resumedFromApprovalId: resolution.approvalId }),
+                },
+            }
+            : {}),
+        // The phone's pause and stop. The daemon writes this file from another
+        // process; the runner reads it between rounds.
+        control,
+    };
+    /**
+     * THE GRANTS A PERSON HAS OPENED, AND THE RECORD OF WHAT THIS MACHINE SPENT.
+     *
+     * 🔴 THIS LINK DID NOT EXIST, AND EVERYTHING EITHER SIDE OF IT DID. The gate's
+     * validity check, the core model, the server's grant and list routes and the
+     * commit trailer line were all built and tested around a door nothing could
+     * open: `looply run` wired neither a source of grants nor a sink for spent
+     * ones, so no grant reached a gate from a run and a railed path stayed shut
+     * whatever a person granted.
+     *
+     * ⚠️ BOTH OR NEITHER, AND THE RUNNER ENFORCES THAT. Its constructor refuses a
+     * grant source with no spend sink — "one grant reopening the same rail every
+     * round until it expires" — so this cannot be half-wired into a door that
+     * never closes.
+     *
+     * ⚠️ NO SERVER, NO GRANTS. Without `sync` there is no trusted source, and the
+     * runner then keeps every rail shut. That is the same deny-by-default the
+     * whole design rests on, and it is why a failure to fetch below yields an
+     * EMPTY list rather than an exception that would strand the run.
+     */
+    // MACHINE-SCOPED. "Single use" held once only because there was one
+    // exemptions ledger per checkout; one per worktree let the same granted row
+    // pass every filter in each of them, and a single-use grant over a railed
+    // path became spendable once per workspace. Phase 1 closed that by sharing
+    // the project's ledger. Phase 2 moved it out of the repository, because a
+    // ledger a person can delete by re-cloning is a ledger that forgets what the
+    // machine has spent. See rails-home.ts.
+    const exemptionStore = (0, rails_stores_1.railsExemptionStore)(cwd);
+    let grants = [];
+    if (sync) {
+        await holding(() => {
+            faulting('exemptionStore.open');
+            return exemptionStore.open();
+        });
+        try {
+            const { exemptions: rows } = await sync.client.projectExemptions(sync.projectId);
+            // The three filters live in `grantsFromServer`, where they can be tested
+            // and mutated one at a time: granted-not-refused, a real expiry, and not
+            // already spent on this machine.
+            grants = (0, exemption_store_1.grantsFromServer)(rows, (e) => exemptionStore.isSpent(e), (g) => (0, core_1.exemptionFromGrant)({ ...g, actor: g.actor }));
+            if (grants.length > 0)
+                log(`rails   : ${grants.length} granted exemption(s) available`);
+        }
+        catch {
+            // A grant source that cannot be reached is no grant source. Rails shut.
+            grants = [];
+        }
+    }
+    const runner = new round_runner_1.RoundRunner({ ...config, run: { ...config.run, minHours } }, {
+        ...deps,
+        // ORIGIN TRANSLATED ONCE, HERE, into a policy the runner can act on
+        // without knowing what a controller is. A person's tap consumes their
+        // own control request; a Start this machine chose to make does not get
+        // to overrule a person's pause with an act they never performed.
+        consumeControlOnStart: opts.autonomous !== true,
+        /**
+         * ⚠️ ONLY WHEN A PURSUIT COULD BE OBSERVED AT ALL. Collecting per-round
+         * facts for an unbound run costs a `headTreeSha` per round and produces
+         * records nothing will ever read: the producer below is guarded on
+         * `binding.kind === 'bound'`.
+         */
+        perRoundSafety: config.run.perRoundSafety === true && binding.kind === 'bound',
+        /**
+         * ⚠️ ONLY WHEN THE PROJECT ASKED. With `run.surfaces` off this is empty,
+         * and an empty declaration constrains nothing — which is the whole
+         * compatibility guarantee, made by the same line that would enforce it.
+         */
+        ...(heldSurfaces.length === 0 ? {} : { declaredSurfaces: declaredSurfaces }),
+        /**
+         * 🔴 THE FENCE, WIRED. `checkFence` shipped with no production caller at
+         * all — called only by its own unit test — so `surface-lease.ts`'s claim
+         * that "EXPIRY EXISTS ONLY HERE, AND ONLY BECAUSE OF THE FENCE" was half
+         * true: the expiry shipped and the comparison that makes expiry safe did
+         * not. The runner asks this immediately before every commit.
+         *
+         * ⚠️ EVERY HELD SURFACE, AND THE FIRST REFUSAL WINS. A run holding three
+         * surfaces that has been taken over on one of them is not the current
+         * holder, and committing any part of that round would be the very
+         * two-writer state the lease exists to prevent.
+         */
+        ...(heldSurfaces.length === 0
+            ? {}
+            : {
+                checkFence: () => {
+                    for (const fence of heldSurfaces) {
+                        const verdict = (0, surface_lease_1.checkFence)(cwd, fence);
+                        if (!verdict.ok)
+                            return verdict;
+                    }
+                    return { ok: true };
+                },
+            }),
+        /**
+         * 🔴 THE ONE RETRY IS SPENT WHEN A ROUND IS CERTAIN, NOT BEFORE.
+         *
+         * MEASURED, twice, on the version that spent it at the statement before
+         * `runner.run()`: the dirty-tree check is `run()`'s FIRST statement, so a
+         * person with uncommitted edits saw "one retry, spent" and "working tree
+         * has 1 changed path(s) — refusing to start" in the same second, with no
+         * ledger written and no round begun. The hold was discharged for ever and
+         * the next unflagged `looply run` walked straight past the fence. The
+         * clean-tree variant reached the same end through `queue-empty`.
+         *
+         * The runner calls this after its own preconditions and after an item is
+         * picked, which is the first moment a round is certain.
+         */
+        ...(retryToSpend === null || safety === null
+            ? {}
+            : {
+                beforeFirstRound: async () => {
+                    const spent = await safety.override(retryToSpend.id, runId);
+                    if (!spent.ok) {
+                        return { ok: false, because: `${retryToSpend.because}; ${spent.because}. That retry is already gone.` };
+                    }
+                    log(`action  : trying once more after ${retryToSpend.kind} (${retryToSpend.id}) — one retry, spent`);
+                    return { ok: true };
+                },
+            }),
+        // Wired as a PAIR, because the runner refuses one without the other.
+        // Without a server there is nothing to wire and every rail stays shut.
+        ...(sync
+            ? {
+                // Item-scoped here; path, expiry and unused-ness are judged at the
+                // interlock by `isExemptionValid`, which is the only place that
+                // sees the path being opened.
+                // 🔴 ASKS THE STORE EVERY ROUND, not just at fetch time. Filtering
+                // the captured array alone kept offering a grant that an earlier
+                // round of THIS run had already spent — "one grant reopening the
+                // same rail every round until it expires", which is the exact
+                // failure the constructor below refuses a half-wiring to prevent.
+                // Wiring both halves satisfied that check and did it anyway.
+                exemptionsFor: (itemId) => (0, exemption_store_1.offerableFor)(grants, itemId, (e) => exemptionStore.isSpent(e)),
+                // Spent on COMMIT, not on check: a discarded round leaves the door
+                // open for the retry. The runner calls this after the commit exists.
+                spendExemption: async (spent) => {
+                    await exemptionStore.record(spent);
+                },
+            }
+            : {}),
+    }, identity);
+    // The branch is NOT created here. RoundRunner.run() creates it, and
+    // GitDriver.createBranch refuses a name that already exists (DESIGN section
+    // 12 case 2 — reusing a branch would land this run's commits on top of
+    // whatever an aborted run left there). Creating it in both places made that
+    // refusal fire against the run's own branch, so every run exited 1 after
+    // printing these three lines and no round was ever reached. The runner owns
+    // git; this file only reports what the runner is about to do.
+    log(`branch  : ${branch}`);
+    log(`base    : ${baseSha.slice(0, 7)}`);
+    log(`budget  : ${minHours}h, up to ${config.run.maxRounds} rounds`);
+    /**
+     * THE RUN-END DELIVERY (F20), ON EVERY WAY OUT THAT COMMITTED (F31, corr-12). A run that
+     * committed and then threw out of the runner left its branch with no claim, and the lane holds an
+     * unclaimed branch to the strict rule — refused while any capability step is red, and not offered
+     * again until the base moves. On a throw the summary is lost, so `onlyIfCommitted` asks this
+     * run's own rounds instead.
+     */
+    const writeRunEndDelivery = async (onlyIfCommitted) => {
+        const at = scope;
+        if (at === null)
+            return;
+        try {
+            const read = await (0, round_records_1.readRoundRecords)(stateDir, ledger_store_1.nodeLedgerFs);
+            if (onlyIfCommitted && (!read.ok || !read.rounds.some((r) => r.runId === runId && r.outcome === 'committed')))
+                return;
+            const head = await git.headSha();
+            const mineIds = new Set(queue.list().filter((i) => i.goalId === at.goalId).map((i) => i.id));
+            const ours = read.ok ? read.rounds.filter((r) => mineIds.has(r.itemId)) : [];
+            const end = read.ok
+                ? (0, run_delivery_1.deliveryAtRunEnd)({
+                    scope: at,
+                    items: queue.list(),
+                    rounds: read.rounds,
+                    head,
+                    requiredSteps: (0, gate_1.requiredSteps)(config.gates),
+                    branch,
+                    runId,
+                    acceptanceDigest: (0, core_3.acceptanceMapDigest)(config.gates),
+                    at: new Date().toISOString(),
+                    // F31 (soun-4): only work this branch's history contains.
+                    reachable: await (0, run_delivery_1.reachableFrom)(git, head, ours),
+                })
+                : { kind: 'none', because: read.because };
+            if (end.kind === 'record') {
+                if (!(0, lane_claims_1.recordLaneClaim)(cwd, end.record))
+                    log('delivery: could not be written — the lane will hold this branch to the strict rule');
+            }
+            else {
+                log(`delivery: none recorded for the lane — ${end.because}`);
+            }
+        }
+        catch (e) {
+            log(`delivery: none recorded for the lane — ${e.message}`);
+        }
+    };
+    try {
+        const summary = await runner.run().catch(async (e) => {
+            await writeRunEndDelivery(true);
+            throw e;
+        });
+        /**
+         * 🔴 THE RUN DID NOTHING, AND SAYS SO RATHER THAN LOOKING LIKE A RUN.
+         *
+         * `beforeFirstRound` refuses when the one retry could not be taken. The
+         * summary carries the reason so the ending is honest — this is not a run
+         * that finished, it is a run that never started.
+         */
+        /**
+         * 🔴 A ROUND THAT WROTE OUTSIDE ITS LEASE FLAGS THE GOAL AND IS NOT RETRIED.
+         *
+         * The round was already discarded where the trespass was seen — before the
+         * gate, before any commit. What is left is to say so, with the exact paths,
+         * because the person's DECLARATION is what needs changing and they cannot
+         * change it from "something went wrong".
+         */
+        if (summary.surfaceViolation !== undefined) {
+            const v = summary.surfaceViolation;
+            log(`surface : wrote outside ${v.declared.join(', ')} — ${v.paths.slice(0, 5).join(', ')}`);
+            log('surface : the round was discarded and this goal is flagged; the declaration is what is wrong');
+        }
+        if (summary.refusedBeforeFirstRound !== undefined) {
+            log(`action  : not starting work — ${summary.refusedBeforeFirstRound}`);
+            await releaseHold();
+            throw new Error(`this machine has stopped working on that goal — ${summary.refusedBeforeFirstRound}`);
+        }
+        /**
+         * 🔴 THE DELIVERY IS WRITTEN BY THE RUN THAT DELIVERED IT, ON THE BRANCH IT CUT,
+         * BEFORE ITS SLOT IS GIVEN BACK (F20). The daemon offers a finished branch to the
+         * lane as soon as the slot is free, and under programme admission a branch the
+         * lane finds no claim for gets the strict rule and is not offered again at that
+         * tip. It used to be written only by a LATER Start, under that Start's own
+         * never-created branch — so the lane never found it at all.
+         *
+         * ⚠️ KEY 2's OWN ANSWER (`deliveryAtRunEnd`), and best-effort: a delivery that
+         * could not be written leaves the branch to the strict lane, never to a crash.
+         */
+        if (scope !== null && summary.totals.committed > 0)
+            await writeRunEndDelivery(false);
+        /**
+         * WHAT THIS RUN ACHIEVED, WRITTEN DOWN BEFORE ANYTHING ELSE CAN THROW.
+         *
+         * Recorded here rather than at the very end because the paths below throw,
+         * and an attempt that is not written down is an attempt the detectors
+         * cannot see — a run that keeps failing the same way would be invisible to
+         * the one mechanism built to notice.
+         *
+         * ⚠️ THE EXCLUSION IS DERIVED FROM THE STOP REASON, NOT GUESSED. A run that
+         * stopped because a person was asked something has not failed to progress;
+         * it stopped ON PURPOSE, and counting it would turn somebody's ten minutes
+         * over an approval into a safety incident. `approval-required` and the
+         * ambiguous-action reason are the two the runner can end on that mean
+         * "waiting for a person", and both are excluded.
+         *
+         * Bound pursuits only: an unbound run has no pursuit whose progress could
+         * be measured, and inventing one would be inventing the very number this
+         * phase refuses to invent.
+         */
+        if (binding.kind === 'bound' && safety !== null && scope !== null) {
+            /**
+             * ⚠️ NOT DERIVABLE FROM `stopReason`, which is why the runner carries it
+             * out separately: an environment-blocked run ends as `aborted`, and so
+             * does an ordinary crash-out. Without this the run is recorded as
+             * `gate_failed` — the outcome list's words for "a deterministic gate
+             * refused it", which is exactly what did not happen — and its unchanged
+             * tree fingerprint feeds `noProgress`, which needs no failure signature
+             * and so survived the whole point of the `blocked` verdict.
+             *
+             * ⚠️ AND PAIRED WITH `committed === 0`, deliberately. Meeting a broken
+             * container is not by itself a reason to record nothing: a run that hit
+             * one, recovered and landed work made real progress, and hiding that
+             * would be the opposite error — a pursuit that IS stuck looking healthy.
+             */
+            const excluded = summary.stopReason === 'approval-required'
+                ? 'awaiting_approval'
+                : summary.stopReason === 'governed-action-ambiguous'
+                    ? 'awaiting_human_resolution'
+                    : summary.metUnavailableEnvironment === true && summary.totals.committed === 0
+                        ? 'environment_unavailable'
+                        : null;
+            /**
+             * ONE OBSERVATION PER ROUND, OR — STILL, BY DEFAULT — ONE PER RUN.
+             *
+             * 🔴 THE DENOMINATOR WAS THE DEFECT. A four-hour run that discarded forty
+             * rounds on the identical failure was ONE observation, so
+             * `MAX_SAME_FAILURE_REPEATS = 3` needed three such RUNS — half a day —
+             * before it said anything, while `MAX_ITEM_EXECUTION_ATTEMPTS = 3` was
+             * being spent per round. The two constants read as if they agreed and
+             * were measuring different things by a factor of the round count.
+             *
+             * ⚠️ THE OBSERVATIONS STILL ARRIVE AT THE END OF THE RUN, and that is a
+             * deliberate narrowing of what the plan sketched. Recording them AS each
+             * round ends would make a hold reachable inside a single Mode-1 run —
+             * three consecutive rounds failing on one flaky test is an ordinary
+             * evening, not a pathology — and a hold has no expiry. What this fixes is
+             * what the NEXT run's brake is told, which is the defect that was
+             * actually costing people money.
+             *
+             * ⚠️ AND `excluded` IS RE-DERIVED PER ROUND for the environment case,
+             * because `metUnavailableEnvironment` latches true for the rest of the
+             * run: reading it directly would exclude every round after the first bad
+             * container, including the ones that worked.
+             */
+            const perRound = summary.rounds ?? null;
+            const records = perRound === null
+                ? [
+                    {
+                        worked: summary.totals.committed > 0,
+                        /**
+                         * 🔴 IT USED TO SAY `null` HERE, AND null MAPS TO `gate_failed`.
+                         *
+                         * The old comment argued that a run summarising many rounds
+                         * cannot say where it failed — which is true, and is not an
+                         * argument for naming the GATE. A prover refusal recorded as a
+                         * gate failure is a specific false claim, and it was the
+                         * claim made in the DEFAULT configuration: per-round facts
+                         * exist only when `run.per_round_safety` is on, and it is off
+                         * by default.
+                         *
+                         * The runner maintains `failedAtThisRound` on every round
+                         * whatever that flag says — only the facts ARRAY is gated — so
+                         * the last unsuccessful round's site is knowable here for free.
+                         * It is the LAST one, not a claim about all of them.
+                         *
+                         * ⚠️ AND UNDEFINED STILL MEANS `gate_failed`, unchanged: a run
+                         * that never set it never failed a round in a way the runner
+                         * classified.
+                         */
+                        failedAt: summary.lastFailedAt ?? null,
+                        // See `failedAt` above: a run summarises many rounds and cannot
+                        // say which gates passed in which of them.
+                        passingGates: undefined,
+                        tree: await git.headTreeSha().catch(() => null),
+                        failure: summary.lastFailure ?? null,
+                        work: runQueue.list(),
+                        excludedFor: excluded,
+                    },
+                ]
+                : perRound.map((r) => ({
+                    worked: r.worked,
+                    failedAt: r.failedAt,
+                    passingGates: r.passingGates,
+                    tree: r.treeFingerprint,
+                    failure: r.failure,
+                    /**
+                     * 🔴 THE ROUND'S OWN WORK LIST, NOT THE RUN'S FINAL ONE.
+                     *
+                     * Every record used to be built from ONE snapshot taken after the
+                     * run ended, so all N carried the same progress fingerprint — and
+                     * `noProgress` compares those for equality and never looks at the
+                     * outcome. Three rounds was therefore enough, unconditionally: a
+                     * run that picked three items, gated them green and committed all
+                     * three recorded that it had achieved nothing three times, and
+                     * held its own goal. Measured.
+                     */
+                    work: r.work,
+                    excludedFor: r.metUnavailableEnvironment && !r.worked ? 'environment_unavailable' : excluded,
+                }));
+            /**
+             * 🔴 THE HIGH-WATER MARK OF GATES THAT HAVE PASSED, ACROSS THIS RUN.
+             *
+             * `passingGates` feeds the progress fingerprint, and `noProgress` fires
+             * only on three IDENTICAL fingerprints in a row. Fed the raw per-round
+             * set, one flaky step — a timeout, a port in use, a slow container —
+             * changes the set every round, so three identical fingerprints never
+             * happen and ALL FOUR detectors are off for a pursuit that is stuck.
+             *
+             * A union only ever grows: a step passing for the first time is progress,
+             * a step flapping is not. Seeded empty per run, which is the honest bound
+             * — the observations are durable but their vectors are not, so this is a
+             * within-run high-water mark and is described as one.
+             */
+            const gatesEverPassed = new Set();
+            for (const rec of records) {
+                /**
+                 * ⚠️ AN EXCLUDED ATTEMPT MINTS NOTHING. `observationFor` returns null for
+                 * one, and the mint used to happen as an argument to it — so the claim
+                 * file was written and the observation thrown away. Those claims
+                 * accumulate above the last observation and are never reclaimed, which is
+                 * how the mint's candidate window came to be burnt through. Asking the
+                 * question first costs a comparison.
+                 */
+                if (!(0, core_4.countsTowardSafety)(rec.excludedFor))
+                    continue;
+                const observation = (0, loop_safety_observer_1.observationFor)({
+                    goalId: binding.goal.id,
+                    goalVersion: binding.goal.version,
+                    // Not parsed out of a request id — this repository refuses to derive
+                    // anything from one. It counts on from the last attempt rather than
+                    // counting the history, which saturates once the history is trimmed.
+                    ordinal: await safety.mintOrdinal(binding.goal.id),
+                    runId,
+                    /**
+                     * 🔴 FOUR OUTCOMES, NOT TWO. This was
+                     * `committed > 0 ? 'worked' : 'gate_failed'`, so `verifier_failed` and
+                     * `action_rejected` had no production producer at all — a four-value
+                     * enum with two unreachable values, making every observation coarser
+                     * than it looked. A round the PROVER refused was recorded as "a
+                     * deterministic gate refused it", which is a different fact about a
+                     * different mechanism.
+                     *
+                     * ⚠️ AND AN UNCLASSIFIED FAILURE IS STILL `gate_failed`, which is what
+                     * the run-level path has always produced — so the default behaviour is
+                     * unchanged and only the newly-distinguishable cases move.
+                     */
+                    outcome: rec.worked
+                        ? 'worked'
+                        : rec.failedAt === 'verifier'
+                            ? 'verifier_failed'
+                            : rec.failedAt === 'action'
+                                ? 'action_rejected'
+                                : 'gate_failed',
+                    pursuit: {
+                        items: rec.work,
+                        planRevision: (0, goal_ownership_1.currentPlanRevision)(rec.work, binding.goal.id, binding.goal.version),
+                    },
+                    ...(rec.passingGates === undefined ? {} : { passingGates: rec.passingGates }),
+                    // Everything that had already passed before this round. See the set's
+                    // declaration above: the union is what makes the contribution monotone.
+                    gatesEverPassed: [...gatesEverPassed],
+                    treeFingerprint: rec.tree,
+                    /**
+                     * 🔴 THIS WAS A LITERAL `null` AND SO `repeated_failure` COULD NEVER
+                     * FIRE — a whole detector, fully tested against hand-built inputs,
+                     * unreachable because the one producer never fed it. Found by an
+                     * adversarial review, not by any gate.
+                     *
+                     * Signed only when the run actually hit a deterministic failure.
+                     * Absent means "none", which is different from "one nobody could
+                     * identify" — the latter arrives as a real signature with a null digest.
+                     */
+                    failureSignature: rec.failure === null ? null : (0, core_1.failureSignature)(rec.failure),
+                    actionFingerprint: null,
+                    excluded: rec.excludedFor,
+                    at: new Date().toISOString(),
+                });
+                if (observation !== null) {
+                    const verdict = await safety.observe(observation);
+                    if (verdict.kind === 'hold') {
+                        // Recorded, not enforced here: this run has already done its work.
+                        // The hold is what the NEXT tick and the next Start will meet.
+                        await safety.raise({
+                            goalId: binding.goal.id,
+                            goalVersion: binding.goal.version,
+                            kind: verdict.hold,
+                            because: verdict.because,
+                            evidence: verdict.evidence,
+                        });
+                        log(`safety  : ${verdict.because}`);
+                    }
+                }
+                // AFTER the observation, so this round is measured against what had
+                // already passed BEFORE it. Updating first would fold this round's own
+                // gates into its own baseline and make every round look like no progress.
+                for (const step of rec.passingGates ?? [])
+                    gatesEverPassed.add(step);
+            }
+        }
+        /**
+         * And what a person could read about it later.
+         *
+         * The safety brake above stops the machine; this is what stops the NEXT
+         * plan proposing the same thing. They are deliberately separate: safety is
+         * authority over whether to spend, memory is only evidence — and P11.22 is
+         * explicit that memory must never become loop-safety truth.
+         */
+        if (summary.lastFailure !== undefined && binding.kind === 'bound') {
+            await rememberFailedAttempt(memoryStore, memoryKey, {
+                runId,
+                goalId: binding.goal.id,
+                // The pursuit, not the item: an approach outlives the item that carried
+                // it, and the next plan is written against the goal.
+                subject: binding.goal.text,
+                failureStep: summary.lastFailure.step,
+            });
+        }
+        /**
+         * SETTLED FIRST, THROWN SECOND, and never the other way round.
+         *
+         * The run has met a consequential action it could not file a question
+         * about. That is a failure and must be reported as one — but the ledger is
+         * the only account of what happened, and throwing before `run.ended` was
+         * written would leave a run that looks live for ever to every reader on
+         * both sides. So the ending is durable by the time this line runs, and it
+         * says `aborted`: a failure this process could not continue past, which is
+         * precisely what it is. What it must never say is that somebody is being
+         * asked, because nobody is.
+         *
+         * A PLAIN ERROR, deliberately not a refusal. The likeliest cause is that
+         * the server has not yet been told about this run, or could not be reached
+         * at all — both of which the next attempt may well get past. A terminal
+         * refusal would spend the pursuit permanently on a problem that fixes
+         * itself.
+         */
+        if (approvalFailure !== null) {
+            await ledgerForRun.append({
+                ts: new Date().toISOString(),
+                runId,
+                projectId,
+                lane: 'feature',
+                kind: 'alert',
+                actor: 'system',
+                // Critical for the same reason a dead prover is: nothing else reaches a
+                // phone from a detached run, and a run that keeps meeting an action it
+                // cannot ask about will do it again tonight and every night after.
+                data: { code: 'approval-unfiled', severity: 'critical', text: approvalFailure },
+            });
+            throw new Error(approvalFailure);
+        }
+        return summary;
+    }
+    finally {
+        // Before the lease is released, so nothing can start a new run while an
+        // agent from this one is still writing to the tree.
+        const killed = children.killAll();
+        if (killed > 0)
+            log(`run     : stopped ${killed} agent process(es) this run had started.`);
+        // Released whatever happened, including on the way out of a throw: a lease
+        // left behind is recoverable (the next process finds the pid dead) but it
+        // makes an ordinary failure look like a crash.
+        await releaseHold();
+        signals.uninstall();
+        // Stopping the sync flushes what the last round produced. Without this the
+        // final rounds of a run — including run.ended — could be lost on exit, and
+        // the phone would show a run that appears to still be going forever.
+        if (sync) {
+            await sync.stop();
+            // A stream that died an hour ago said so an hour ago, and that line has
+            // scrolled away. The end of the run is where someone looks to find out
+            // whether their phone saw any of it.
+            const { buffered, dropped, unacked } = sync.daemon.status();
+            if (!sync.alive()) {
+                log(`sync    : ${buffered} events never reached your phone. \`looply report\` still has the run.`);
+            }
+            // The cap sheds the *oldest* events, so an overflowed mirror reads as a
+            // run that started late rather than one that is missing anything — the
+            // only place that reads honestly is a line saying how many went.
+            if (dropped > 0) {
+                log(`sync    : ${dropped} events were dropped while the server was away — your phone's copy has a gap.`);
+            }
+            // A different failure from the two above, and the quietest one: the
+            // server answered every request successfully and kept fewer events than
+            // it was handed. Nothing about the run looks wrong from here, so if this
+            // is not said, the only symptom is a phone showing a project at rest
+            // while a run is plainly happening in this terminal.
+            if (unacked > 0) {
+                log(`sync    : ${unacked} events reached the server but were not stored. Your phone's copy is incomplete;`);
+                log('          `looply report` still has the whole run.');
+            }
+        }
+        /**
+         * THE LAST THING THIS RUN DOES, and it has to be last.
+         *
+         * The creation marker names THIS PROCESS, and it is the checkout's only
+         * cover once `releaseHold` has given back the lease and the registry
+         * record — which happens at the TOP of this block, while there is still
+         * work below it. Clearing the marker any earlier reopened a window where a
+         * concurrent `--reap` saw no lease, no record and no marker.
+         *
+         * ⚠️ BUT IT MUST BE CLEARED. Left behind, it is a permanent pid-shaped
+         * claim on a finished checkout: once that pid is recycled the workspace
+         * reads as busy for ever, invisible to `looply runs --reap` with nothing a
+         * person could point at. The lease has the same weakness and is cleared for
+         * the same reason.
+         */
+        /**
+         * ⚠️ SURFACES GO BACK BEFORE THE START MARKER, and before anything else in
+         * this teardown can throw. A surface held by a finished run blocks every
+         * later run that declares it until the TTL lapses — six hours of a project
+         * refusing to schedule itself, for a directory nobody is in.
+         *
+         * `releaseSurface` marks rather than deletes, so the ordinal still stands
+         * and no later holder can be handed the same fence.
+         */
+        for (const fence of heldSurfaces)
+            (0, surface_lease_1.releaseSurface)(cwd, fence, runId);
+        (0, workspace_1.clearCreationMarker)(stateDir);
+    }
+}
+//# sourceMappingURL=run-cmd.js.map