looply-cli 0.0.0-stage → 0.3.0

package/dist/bin.js

@@ -0,0 +1,2727 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = main;
+const source_cmd_1 = require("./source-cmd");
+const fs_1 = require("fs");
+const tool_bridge_1 = require("./tool-bridge");
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const path_1 = require("path");
+const config_1 = require("./config");
+const self_repo_id_1 = require("./self-repo-id");
+const programme_mode_1 = require("./programme-mode");
+const trusted_git_1 = require("./trusted-git");
+const doctor_1 = require("./doctor");
+const integration_runtime_1 = require("./integration-runtime");
+const publication_recorder_1 = require("./publication-recorder");
+const observation_inventory_1 = require("./observation-inventory");
+const evidence_facts_1 = require("./evidence-facts");
+const integration_deps_1 = require("./integration-deps");
+const lane_claims_1 = require("./lane-claims");
+const integration_runtime_2 = require("./integration-runtime");
+const agent_contained_1 = require("./agent-contained");
+const exec_domains_1 = require("./exec-domains");
+const model_transport_1 = require("./model-transport");
+const provider_state_1 = require("./provider-state");
+const providers_1 = require("./providers");
+const provider_preflight_1 = require("./provider-preflight");
+const init_detect_1 = require("./init-detect");
+const report_cmd_1 = require("./report-cmd");
+const tool_call_record_1 = require("./tool-call-record");
+const token_window_1 = require("./token-window");
+const status_cmd_1 = require("./status-cmd");
+const goal_view_1 = require("./goal-view");
+const run_cmd_1 = require("./run-cmd");
+const start_attempts_1 = require("./start-attempts");
+const node_os_1 = require("node:os");
+const autonomy_authority_1 = require("./autonomy-authority");
+const scan_cmd_1 = require("./scan-cmd");
+const verify_cmd_1 = require("./verify-cmd");
+const queue_write_lease_1 = require("./queue-write-lease");
+const workspace_quarantine_1 = require("./workspace-quarantine");
+const queue_view_1 = require("./queue-view");
+const queue_store_1 = require("./queue-store");
+const ledger_store_1 = require("./ledger-store");
+const git_driver_1 = require("./git-driver");
+const repos_cmd_1 = require("./repos-cmd");
+const serve_cmd_1 = require("./serve-cmd");
+const core_1 = require("@looply/core");
+const sessions_cmd_1 = require("./sessions-cmd");
+const session_observe_runtime_1 = require("./session-observe-runtime");
+const evidence_cmd_1 = require("./evidence-cmd");
+const retention_apply_runtime_1 = require("./retention-apply-runtime");
+const session_store_1 = require("./session-store");
+const compatible_sets_1 = require("./compatible-sets");
+const workspace_1 = require("./workspace");
+const run_refusal_marks_1 = require("./run-refusal-marks");
+const daemon_cmd_1 = require("./daemon-cmd");
+const machine_store_1 = require("./machine-store");
+const server_client_1 = require("./server-client");
+const session_adapter_runtime_1 = require("./session-adapter-runtime");
+const session_control_transport_1 = require("./session-control-transport");
+const session_checkpoint_runtime_1 = require("./session-checkpoint-runtime");
+const session_observation_store_1 = require("./session-observation-store");
+const welcome_1 = require("./welcome");
+const agent_cmd_1 = require("./agent-cmd");
+const ui_1 = require("./ui");
+const setup_1 = require("./setup");
+const setup_prompt_1 = require("./setup-prompt");
+const integration_1 = require("./integration");
+/**
+ * `looply` entry point.
+ *
+ * Only the commands that are implemented are listed. A command that prints
+ * "not implemented yet" is worse than one that does not exist, because it looks
+ * like a broken feature rather than an unbuilt one.
+ */
+const USAGE = `looply — an autonomous build loop you drive from your phone
+
+usage:
+  looply pair [--server <url>]        pair this machine with your phone
+  looply daemon [--once] [--yes]      stay connected: presence, and ship the ledger
+  looply serve add [path]            serve this repository (or <path>) from one machine-wide supervisor
+  looply serve remove <path>         stop serving a repository
+  looply serve list                  the served repositories, and whether each still has .looply/config.yaml
+  looply serve                       run the supervisor: one daemon per served repository, restarted if it stops
+  looply serve install | uninstall   start the supervisor at login (Windows); prints a service template elsewhere
+  looply init                        profile the repo and draft .looply/config.yaml
+  looply doctor [--config <path>] [--provider]
+                                     validate the config and run one full gate pass; --provider also asks the model to answer once
+  looply scan [--lens a,b] [--dry-run] read the code through several lenses and fill the queue
+  looply verify [--max N]            check unverified items against the code, so a run can pick them
+  looply queue [--all]               everything waiting, and why
+  looply integrate --init <ref>      create looply/integration from a base you name
+  looply integrate --branch <name> [--goal <id>]
+                                     offer one finished branch to the integration queue:
+                                     fast-forward or nothing, checked at the commit that
+                                     would actually be published (needs run.integration)
+  looply runs [--reap]               what this project is running; --reap retires proven-dead leftovers
+  looply runs --release <runId|slot-N|claim-lock>
+                                     clear a leftover a recycled pid makes look alive
+  looply source add <file> [--name <n>]
+                                     hand a Markdown (.md) or plain-text (.txt) document to
+                                     this project, verbatim, from the machine that holds it
+  looply source list                 what this project has been given
+  looply source show <id>            one source: its statements, what each IS, where each came from,
+                                     and where each requirement stands against this repository
+  looply source reconcile <id>       measure where each requirement stands against this repository
+                                     (HEAD's tree, by name — a place to look, never "implemented"), and record it
+  looply source coverage <id>        which requirements no goal serves, which are served, and which a person
+                                     evidenced — a finished queue is not coverage
+  looply stop                        finish the round in flight, then stop
+  looply pause | looply resume       hold between rounds, and let it go again
+  looply run [--hours N] [--dry-run] [--in <workspace> | --new-workspace]
+                                     start a run: pick, implement, gate, prove, keep or discard
+                                     --in runs it in another checkout of this repository, so two
+                                     runs can work at once without sharing a tree
+                                     --try-once-more spends a stopped goal's ONE retry (never
+                                     turns the brake off; the next failure stops it again)
+  looply status                     one-screen snapshot from .looply/state/status.json
+  looply report                     run report from the local ledger, alerts first
+  looply goal <id>                  one goal from this machine's records: the grant and the lane's answer,
+                                     compiles, proposals, the lane's attempts, each run's rounds — read-only
+  looply goals                      every mirrored goal, one line each, with its grant's standing
+  looply repos [--accept] [--published <repo>]
+                                    the other repositories this programme spans: where each one is,
+                                    and whether the revisions somebody accepted together still hold
+  looply evidence                   what this project has accumulated, and what the retention
+                                    policy would do with it. It deletes nothing.
+  looply sessions [--offer <file>] [--ack <id>]
+                                    sessions this machine did not start, asking to be managed;
+                                    observe-only — authorizing control is the server's to give
+  looply version
+
+not built yet: item
+`;
+function loadConfig(path) {
+    const full = (0, path_1.resolve)(path);
+    let text;
+    try {
+        text = (0, fs_1.readFileSync)(full, 'utf8');
+    }
+    catch {
+        throw new config_1.ConfigError('<file>', `cannot read ${full}`);
+    }
+    return (0, config_1.parseConfig)(text);
+}
+/* istanbul ignore next — real fs and env; the logic lives in doctor.ts */
+function nodeDoctorDeps() {
+    // Lifted to integration-deps.ts (M5-1) so doctor, the integrate command and the daemon ask the same questions.
+    return (0, integration_deps_1.nodeDoctorDepsFor)(process.cwd());
+}
+/* istanbul ignore next — real fs, tty and cwd; the logic lives in setup.ts */
+async function init(argv) {
+    const target = (0, path_1.resolve)('.looply/config.yaml');
+    // Never overwrite: by the time init is re-run the file is the user's, full of
+    // hand-tuned rails and gates a fresh draft would silently throw away.
+    if ((0, fs_1.existsSync)(target)) {
+        process.stderr.write(`init: ${target} already exists — move it aside first for a fresh draft\n`);
+        return 1;
+    }
+    const profile = (0, init_detect_1.detectRepo)({
+        readFile: (p) => {
+            try {
+                return (0, fs_1.readFileSync)((0, path_1.resolve)(p), 'utf8');
+            }
+            catch {
+                return null;
+            }
+        },
+    }, (0, path_1.basename)(process.cwd()));
+    // What detection found, before anything is asked — so the questions arrive
+    // with context rather than out of nowhere.
+    process.stdout.write((0, ui_1.box)((0, ui_1.fields)([
+        ['project', profile.name],
+        ['manager', `${profile.packageManager} ${(0, ui_1.dim)(`(${profile.packageManagerEvidence})`)}`],
+        ...(profile.workspaces.length
+            ? [['spaces', profile.workspaces.join(', ')]]
+            : []),
+        [
+            'checks',
+            [profile.typecheck?.name, profile.testRunner?.name].filter(Boolean).join(', ') ||
+                (0, ui_1.dim)('none detected'),
+        ],
+    ]), { title: 'what this project looks like' }) + '\n');
+    // --yes for CI and for anyone who would rather edit the file than answer
+    // questions. Non-interactive stdin takes the same path: prompting a pipe
+    // hangs forever, which is the worst possible failure for a setup command.
+    const useDefaults = argv.includes('--yes') || argv.includes('-y') || !process.stdin.isTTY;
+    const asker = (0, setup_prompt_1.nodeAsker)();
+    let answers;
+    try {
+        answers = await (0, setup_prompt_1.runSetup)({
+            profile,
+            asker,
+            write: (s) => process.stdout.write(s),
+            useDefaults,
+        });
+    }
+    finally {
+        asker.close();
+    }
+    (0, fs_1.mkdirSync)((0, path_1.resolve)('.looply'), { recursive: true });
+    (0, fs_1.writeFileSync)(target, (0, setup_1.renderConfig)(profile, answers));
+    const paired = (() => {
+        try {
+            return new machine_store_1.MachineStore((0, machine_store_1.machineFilePath)()).load() !== null;
+        }
+        catch {
+            return false;
+        }
+    })();
+    process.stdout.write((0, setup_prompt_1.renderSetupDone)((0, setup_1.summarise)(answers, profile), target, paired));
+    if (useDefaults && !answers.rails.length) {
+        process.stdout.write(`  ${(0, ui_1.warn)('no rails were set — nothing in this repo is off limits. Edit forbidden_paths before a long run.')}\n\n`);
+    }
+    return 0;
+}
+async function doctor(argv) {
+    const at = argv.indexOf('--config');
+    const path = at >= 0 ? argv[at + 1] : '.looply/config.yaml';
+    if (!path) {
+        process.stderr.write('doctor: --config needs a path\n');
+        return 1;
+    }
+    const cfg = loadConfig(path);
+    process.stdout.write(`project : ${cfg.project.name}\n`);
+    process.stdout.write(`budget  : ${cfg.run.minHours}h, up to ${cfg.run.maxRounds} rounds\n`);
+    process.stdout.write(`proof   : ${cfg.proof.enabled ? 'on' : 'OFF'}\n`);
+    process.stdout.write(`notify  : ${cfg.notify.channel} every ${cfg.notify.everyMin}min\n`);
+    process.stdout.write('gates   :\n');
+    for (const g of cfg.gates) {
+        const bits = [g.required ? 'required' : null, g.when ? `when ${g.when}` : null].filter(Boolean);
+        process.stdout.write(`  - ${g.name}${bits.length ? ` (${bits.join(', ')})` : ''}: ${g.run}\n`);
+    }
+    process.stdout.write(`rails   : ${cfg.rails.forbiddenPaths.join(', ') || '(none)'}\n`);
+    process.stdout.write(`mode    : ${(0, programme_mode_1.describeProgramme)(cfg)}\n`);
+    /**
+     * WHAT THE LAST WINDOW COST IN TOKENS, WHICH NOTHING HAS EVER SHOWN.
+     *
+     * These figures have been on every spend row since they were first parsed,
+     * and the only reader of that ledger sums dollars — the capability audit's
+     * E-05. This is the one command that already reports what this machine is and
+     * what it is about to do, so it is where they go. The filesystem read is here
+     * because the filesystem is; what may be said, and what may not, is decided
+     * in `token-window.ts`.
+     *
+     * The machine's own money window when it declares one, so the two figures a
+     * person compares are over the same hours; otherwise the stated default.
+     */
+    const tokenWindowMs = cfg.machine?.envelope?.windowMs ?? token_window_1.DEFAULT_TOKEN_WINDOW_MS;
+    process.stdout.write((0, token_window_1.tokenLine)((0, token_window_1.tokensInWindow)(Date.now(), tokenWindowMs), tokenWindowMs) + String.fromCharCode(10));
+    const warnings = (0, config_1.configWarnings)(cfg);
+    for (const w of warnings)
+        process.stdout.write(`warning : ${w}\n`);
+    // The integration ref, asked here rather than at round 1 of a run (M6-12).
+    const refWarning = await (0, doctor_1.integrationRefWarning)(cfg, new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(process.cwd())));
+    if (refWarning !== null)
+        process.stdout.write(`warning : ${refWarning}\n`);
+    process.stdout.write('doctor  : running interlocks and one full gate pass (no agent call)\n');
+    const report = await (0, doctor_1.runDoctorGate)(cfg, nodeDoctorDeps());
+    /**
+     * 🔴 THIS SAID "UNTRUSTED EXECUTION IS CONTAINED" AND MEANT ONLY THE GATE.
+     *
+     * MEASURED on a machine printing exactly that line: a provider executable
+     * appended to and TRUNCATED the machine spend ledger, and wrote a path
+     * outside every declared `agent.runtime` grant. Both are true at once,
+     * because the AppContainer is applied to GATE STEPS — the project's own
+     * commands — and the contained-provider path was deliberately removed from
+     * the transport after two phases established the provider cannot run inside
+     * one.
+     *
+     * A single PASS line covering all subprocesses is therefore a claim nobody
+     * can honour. Four separate facts, four separate lines, and the one that is
+     * an ASSUMPTION says so in the word `assumed`.
+     */
+    if (report.containment) {
+        const c = report.containment;
+        process.stdout.write(c.available
+            ? `doctor  : gate steps are contained (${c.backend})` + String.fromCharCode(10)
+            : `doctor  : gate steps are NOT contained (${c.backend}) — ${c.because ?? 'unavailable'}` +
+                String.fromCharCode(10));
+    }
+    // The provider is not confined by anything, on any machine, in this build.
+    // Stated unconditionally because it does not vary: see `model-transport`.
+    process.stdout.write('doctor  : the provider process is NOT confined — it runs as you, and is TRUSTED by' +
+        String.fromCharCode(10) +
+        '          assumption. Run only provider binaries you trust with this machine.' +
+        String.fromCharCode(10));
+    process.stdout.write(`doctor  : model tool access is mediated (${tool_bridge_1.TOOL_POLICIES.implementer.tools.join(', ')} for the` +
+        String.fromCharCode(10) +
+        `          implementer; ${tool_bridge_1.TOOL_POLICIES.verifier.tools.join(', ')} for the verifier), and` +
+        String.fromCharCode(10) +
+        '          off-project paths are refused at the bridge.' +
+        String.fromCharCode(10));
+    if (report.abort) {
+        process.stderr.write(`ABORT   : ${report.abort.reason} (code ${report.abort.code})\n`);
+        return 1;
+    }
+    for (const s of report.steps) {
+        const label = s.ok ? 'ok  ' : 'FAIL';
+        const why = s.timedOut ? ' — timed out' : '';
+        process.stdout.write(`  ${label} ${s.step} (${s.ms}ms)${why}\n`);
+        if (!s.ok && s.output)
+            process.stdout.write(`${s.output.replace(/\s+$/, '')}\n`);
+    }
+    process.stdout.write(report.ok ? 'doctor  : all gate steps pass\n' : 'doctor  : gate steps failed\n');
+    /**
+     * 🔴 THE AGENT CHECK IS OPT-IN, AND ITS ABSENCE WAS A REAL HOLE.
+     *
+     * `doctor` deliberately makes NO agent call — it exists to find a wrong `tsc`
+     * in ninety seconds, and that was the right decision. But it left the other
+     * half unchecked: a wrong AGENT command was found at round 1 of an overnight
+     * run, by which point a person is asleep.
+     *
+     * ⚠️ OPT-IN BECAUSE IT SPENDS A MODEL CALL. Making it part of every `doctor`
+     * would put a cost on the check people run most often, and they would stop
+     * running it.
+     */
+    if (argv.includes('--provider')) {
+        const resolved = (0, providers_1.resolveProvider)({
+            ...(cfg.provider === undefined ? {} : { provider: cfg.provider }),
+            spec: cfg.agent,
+        });
+        if (!('spec' in resolved)) {
+            process.stderr.write(`provider: ${resolved.message}\n`);
+            return 1;
+        }
+        if (resolved.warning !== null)
+            process.stdout.write(`warning : ${resolved.warning}\n`);
+        /**
+         * 🔴 READINESS FIRST, AND IT COSTS NOTHING. `auth status` is local and prints
+         * the profile’s own state; asking the model whether it is logged in spends a
+         * turn to learn something a file already knows. More importantly it answers
+         * the RIGHT question: this is the profile and environment the run uses.
+         *
+         * ⚠️ AND IT REPORTS THE REASON IT WAS GIVEN, NOT A GUESS. Five states are kept
+         * apart in `provider-state.ts` precisely because only ONE of them means "log
+         * in"; flattening them sends somebody to re-authenticate an account that was
+         * never the trouble. Measured before this existed: an unauthenticated profile
+         * was reported as `refused`, advising a comparison of command-line flags.
+         */
+        const profile = (0, provider_state_1.providerProfileDir)();
+        const exe = resolved.spec.executable ?? (0, provider_state_1.providerExecutableFor)((0, agent_contained_1.claudePackageDir)());
+        if (exe === null) {
+            process.stdout.write('provider: no provider runtime was found — Claude Code is not installed beside node,\n');
+            process.stdout.write('          and agent.executable names none.\n');
+            return 1;
+        }
+        const sessionDir = (0, model_transport_1.providerSessionDir)(process.cwd(), 'implementer');
+        const ready = (0, provider_state_1.checkProviderAuth)(exe, { ...(0, exec_domains_1.buildProviderEnv)(sessionDir), CLAUDE_CONFIG_DIR: profile });
+        if (!ready.ok) {
+            process.stdout.write(`provider: not ready — ${ready.reason}\n`);
+            process.stdout.write(`          ${ready.because}\n`);
+            process.stdout.write(`          profile: ${ready.profile}\n`);
+            process.stdout.write('          no model call was spent finding this out.\n');
+            return 1;
+        }
+        process.stdout.write(`provider: logged in (${ready.method}) for ${ready.profile}\n`);
+        process.stdout.write('provider: asking it to answer once (this spends a model call)\n');
+        // `exe` above is the path `checkProviderAuth` just used successfully, and
+        // the one the run would spawn. Handing it over keeps the check from
+        // refusing a provider the run starts perfectly well.
+        const pre = await (0, provider_preflight_1.preflightProvider)(resolved.spec, (0, provider_preflight_1.nodePreflightDeps)(resolved.spec.runtime ?? [], profile, exe));
+        process.stdout.write(`provider: ${pre.verdict} (${pre.ms}ms)\n`);
+        if (pre.detail)
+            process.stdout.write(`          ${pre.detail}\n`);
+        if (pre.advice)
+            process.stdout.write(`          ${pre.advice}\n`);
+        if (!(0, provider_preflight_1.preflightPasses)(pre))
+            return 1;
+    }
+    return report.ok ? 0 : 1;
+}
+/* istanbul ignore next — real fs and clock; the logic lives in status-cmd.ts */
+function status() {
+    let text;
+    try {
+        text = (0, fs_1.readFileSync)((0, path_1.resolve)('.looply/state/status.json'), 'utf8');
+    }
+    catch (e) {
+        // Only "not there yet" maps to the friendly message; a permission error
+        // reported as "no run yet" would hide a real problem behind a calm screen.
+        if (e.code !== 'ENOENT')
+            throw e;
+        text = null;
+    }
+    const { out, code } = (0, status_cmd_1.renderStatus)(text, Date.now());
+    (code === 0 ? process.stdout : process.stderr).write(out);
+    return code;
+}
+/* istanbul ignore next — real fs; the logic lives in report-cmd.ts */
+function report() {
+    let text;
+    try {
+        text = (0, fs_1.readFileSync)((0, path_1.resolve)('.looply/state/events.jsonl'), 'utf8');
+    }
+    catch (e) {
+        // Same rule as status: only "not there yet" is friendly; a permission
+        // error reported as "no run yet" would hide a real problem.
+        if (e.code !== 'ENOENT')
+            throw e;
+        text = null;
+    }
+    // The record of what the bridge served, when there is one. Read here for the
+    // same reason the ledger is: the filesystem stays out of report-cmd.ts. Its
+    // absence is the ordinary case — a scan, a verify, or a run before this
+    // existed — and renders nothing at all.
+    let toolText;
+    try {
+        toolText = (0, fs_1.readFileSync)((0, path_1.resolve)(`.looply/state/${tool_call_record_1.TOOL_CALL_FILE}`), 'utf8');
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+        toolText = null;
+    }
+    const { out, code } = (0, report_cmd_1.renderReport)(text, toolText);
+    (code === 0 ? process.stdout : process.stderr).write(out);
+    return code;
+}
+/* istanbul ignore next — real fs; the logic lives in goal-view.ts */
+async function goal(argv) {
+    const id = argv[0];
+    if (id === undefined || id.startsWith('--')) {
+        process.stderr.write('goal: which one? usage: looply goal <id>\n');
+        return 64;
+    }
+    const read = await (0, goal_view_1.readGoalFacts)(process.cwd(), id, { now: () => Date.now() });
+    if (!read.ok) {
+        process.stderr.write(`goal    : ${read.because}\n`);
+        return read.code;
+    }
+    process.stdout.write((0, goal_view_1.renderGoalView)(read.facts, Date.now()));
+    return 0;
+}
+/* istanbul ignore next — real fs; the logic lives in goal-view.ts */
+/**
+ * `looply repos` deps, against this checkout.
+ *
+ * 🔴 THE REVISION IS THE INTEGRATION REF WHERE THERE IS ONE, and HEAD otherwise
+ * — and it SAYS which. A compatible set is about what would be published, and
+ * for a project whose runs converge on `looply/integration` that is the
+ * integration ref, not whatever branch somebody left themselves on.
+ *
+ * ⚠️ NULL ON ANY FAILURE, never a guess. An unreadable repository must reach
+ * `combinedAcceptance` as absent so it answers `unmeasurable`; a fabricated sha
+ * would turn "I could not look" into "it has drifted".
+ */
+/**
+ * Adapters THIS BUILD speaks. A constant, not configuration: what a build can
+ * talk to is a property of the build, and letting a config name an adapter the
+ * code does not implement is how a session gets a label nothing backs.
+ */
+/** The same digest `daemon-cmd.ts` and `run-cmd.ts` key a project on. */
+const sha256 = (text) => (0, node_crypto_1.createHash)('sha256').update(text, 'utf8').digest('hex');
+/**
+ * ⚠️ HOW LONG ONE `--direct` WAITS, AND HOW OFTEN IT LOOKS.
+ *
+ * An unbounded wait on a directory a SESSION writes is this process hanging on
+ * the cooperation of the thing it is directing. Ten seconds is long enough for
+ * an adapter that is listening and short enough that one that is not does not
+ * hold a terminal.
+ */
+const DIRECT_WAIT_MS = 10_000;
+const DIRECT_POLL_MS = 250;
+const SUPPORTED_SESSION_ADAPTERS = ['looply-session-v1'];
+/**
+ * `looply sessions` deps, against this checkout.
+ *
+ * 🔴 EVERY MEASUREMENT IS TAKEN HERE, AND NOTHING IS TAKEN FROM THE CLAIM. The
+ * claim supplies only the QUESTION — which workspace, which pid, which sha —
+ * and each answer comes from the machine. A field that could not be established
+ * is `null`, which `sessionAdoptionVerdict` turns into `unmeasurable`.
+ */
+/**
+ * `looply evidence` deps: the evidence stores of THIS project, on disk.
+ *
+ * 🔴 TWO STORES, NAMED, AND THE REST DELIBERATELY ABSENT. The policy's docblock
+ * names three places evidence accumulates. These are the two whose class is
+ * unambiguous from what they are:
+ *
+ *   rejected/<runId>/  a candidate a round threw away — bounded raw diagnostics
+ *                      from a FAILED attempt, which is `failure-diagnostic`
+ *                      almost word for word.
+ *   retired/<runId>/   the record a reaped run left behind. DURABLE: the reaper
+ *                      keeps these on purpose — they are "the evidence `--reap`
+ *                      needs" — so an age window must never touch them.
+ *
+ * ⚠️ The evidence CACHE and the compile transcript are NOT inventoried here.
+ * They are single files holding many entries, and the policy's unit is an
+ * artifact; splitting them needs a per-entry decision about what each one is,
+ * and guessing that in order to report a bigger number would be the opposite of
+ * the point. Recorded as unfinished rather than approximated.
+ *
+ * 🔴 `owned: true` IS ASSERTED ONLY FOR DIRECTORIES LOOPLY ITSELF WRITES.
+ * Both of these live under `.looply/state/` and are created by the round runner
+ * and the reaper. Nothing outside those paths is claimed, because the policy
+ * treats an unowned artifact as untouchable and the whole value of that rule is
+ * that it is not handed out loosely.
+ */
+function nodeEvidenceDeps() {
+    const stateDir = (0, git_driver_1.projectStateDir)(process.cwd());
+    return {
+        artifacts: async () => {
+            const out = [];
+            const walk = (store, cls) => {
+                const root = (0, path_1.join)(stateDir, store);
+                if (!(0, fs_1.existsSync)(root))
+                    return;
+                for (const entry of (0, fs_1.readdirSync)(root, { withFileTypes: true })) {
+                    const path = (0, path_1.join)(root, entry.name);
+                    let bytes = 0;
+                    let createdAtMs = 0;
+                    try {
+                        // A directory's size is the sum of what it holds; a stat on the
+                        // directory itself reports the entry, not the contents.
+                        const stack = [path];
+                        while (stack.length > 0) {
+                            const at = stack.pop();
+                            const st = (0, fs_1.statSync)(at);
+                            createdAtMs = createdAtMs === 0 ? st.mtimeMs : Math.min(createdAtMs, st.mtimeMs);
+                            if (st.isDirectory()) {
+                                for (const child of (0, fs_1.readdirSync)(at))
+                                    stack.push((0, path_1.join)(at, child));
+                            }
+                            else {
+                                bytes += st.size;
+                            }
+                        }
+                    }
+                    catch {
+                        // Unreadable is not evidence about size. Left out rather than
+                        // reported as zero, which would understate a store on purpose.
+                        continue;
+                    }
+                    out.push({ id: entry.name, store, bytes, createdAtMs, class: cls, owned: true });
+                }
+            };
+            walk('rejected', 'failure-diagnostic');
+            walk('retired', 'durable');
+            /**
+             * 🔴 THE THIRD STORE, AND THE ONE THIS PRODUCT PROMISED ITSELF.
+             * `session-observation-store.ts` says observations get "a root a
+             * retention policy can be pointed at". Nothing pointed it until now, so
+             * every watch ever taken was still on disk and `looply evidence` could
+             * only list the directory under *uninventoried*. §5 D5: *"do not claim
+             * complete retention from an inventory of only two folders."*
+             *
+             * ⚠️ ITS CLASSIFICATION IS PER FILE AND COMES FROM THE RECORD, not from
+             * the directory it sits in — a session holds watches of different ages
+             * that ended in different ways. `inventoryObservations` reads each one;
+             * anything it cannot read is named under `uninventoried` instead of
+             * being planned over.
+             */
+            out.push(...(0, observation_inventory_1.inventoryObservations)(stateDir).artifacts);
+            return out;
+        },
+        /**
+         * Everything under the state dir that the two classified stores do not
+         * cover. Reported, never planned over — see `reportUninventoried`.
+         */
+        uninventoried: async () => {
+            const out = [];
+            if (!(0, fs_1.existsSync)(stateDir))
+                return out;
+            /** `null` when it could not be sized — never 0, which would be a claim. */
+            const sizeOf = (path) => {
+                let bytes = 0;
+                try {
+                    const stack = [path];
+                    while (stack.length > 0) {
+                        const at = stack.pop();
+                        const st = (0, fs_1.statSync)(at);
+                        if (st.isDirectory())
+                            for (const child of (0, fs_1.readdirSync)(at))
+                                stack.push((0, path_1.join)(at, child));
+                        else
+                            bytes += st.size;
+                    }
+                }
+                catch {
+                    return null;
+                }
+                return bytes;
+            };
+            for (const entry of (0, fs_1.readdirSync)(stateDir, { withFileTypes: true })) {
+                /**
+                 * 🔴 THE CLASSIFIED STORES ARE SKIPPED HERE — `artifacts()` counts them
+                 * — BUT ONLY FOR WHAT IT CAN READ. Its walk drops an entry it cannot
+                 * `stat`, and this scan used to skip the whole directory, so such an
+                 * entry was counted by NEITHER and named by neither. It is picked up
+                 * here instead, under its store, so nothing falls between the two.
+                 *
+                 * ⚠️ Asked independently rather than by sharing state with
+                 * `artifacts()`, which would make this answer depend on the order the
+                 * two happen to be called in.
+                 */
+                /**
+                 * 🔴 CLASSIFIED NOW, SO IT IS NOT COUNTED TWICE — but what could not
+                 * be READ is still named, with the reason, because that is the whole
+                 * job of this list. A record that does not parse is exactly the entry
+                 * a person needs to see; it is the one the policy refused to touch.
+                 */
+                if (entry.name === observation_inventory_1.OBSERVATIONS_STORE) {
+                    for (const why of (0, observation_inventory_1.inventoryObservations)(stateDir).unreadable) {
+                        out.push({ name: `${observation_inventory_1.OBSERVATIONS_STORE}/${why}`, bytes: null });
+                    }
+                    continue;
+                }
+                if (entry.name === 'rejected' || entry.name === 'retired') {
+                    const root = (0, path_1.join)(stateDir, entry.name);
+                    let children;
+                    try {
+                        children = (0, fs_1.readdirSync)(root);
+                    }
+                    catch {
+                        out.push({ name: entry.name, bytes: null });
+                        continue;
+                    }
+                    for (const child of children) {
+                        if (sizeOf((0, path_1.join)(root, child)) === null) {
+                            out.push({ name: `${entry.name}/${child}`, bytes: null });
+                        }
+                    }
+                    continue;
+                }
+                out.push({ name: entry.name, bytes: sizeOf((0, path_1.join)(stateDir, entry.name)) });
+            }
+            return out;
+        },
+        policy: evidence_cmd_1.evidencePolicy,
+        nowMs: () => Date.now(),
+        out: (l) => process.stdout.write(l + '\n'),
+        err: (l) => process.stderr.write(l + '\n'),
+        /* ── what `--apply` needs, and nothing else uses ────────────────────── */
+        pathOf: (a) => (0, path_1.join)(stateDir, a.store, a.id),
+        stateDir: () => stateDir,
+        apply: (intent) => (0, retention_apply_runtime_1.applyRetention)(intent, {
+            nowMs: () => Date.now(),
+            policy: (0, evidence_cmd_1.evidencePolicy)(),
+            facts: (id) => (0, evidence_facts_1.artifactFacts)(stateDir, id),
+            journalPath: (0, path_1.join)(stateDir, 'retention-apply.jsonl'),
+            lockPath: (0, path_1.join)(stateDir, 'retention-apply.lock'),
+        }),
+    };
+}
+function nodeSessionsDeps() {
+    const cwd = process.cwd();
+    const cfg = loadConfig((0, path_1.join)(cwd, git_driver_1.STATE_DIR, 'config.yaml'));
+    const stateDir = (0, git_driver_1.projectStateDir)(cwd);
+    const store = new session_store_1.SessionStore(stateDir, ledger_store_1.nodeLedgerFs);
+    let opened = false;
+    const open = async () => {
+        if (!opened) {
+            await store.open();
+            opened = true;
+        }
+    };
+    /**
+     * 🔴 ONE TRANSPORT, TWO READERS. `serverControl` and `directionContext` are
+     * the same read narrowed two ways, and building them from one object is what
+     * keeps that true: two separately-constructed transports would be two
+     * separate reads of the grant list, and the verb a caller checks could be
+     * checked against a scope the other read never saw.
+     */
+    const transportDeps = {
+        machine: () => {
+            const identity = new machine_store_1.MachineStore((0, machine_store_1.machineFilePath)()).load();
+            if (identity === null)
+                return null;
+            const projectId = new machine_store_1.MachineStore((0, machine_store_1.machineFilePath)()).projectFor((0, machine_store_1.repoPathHash)(cwd, sha256));
+            if (projectId === null)
+                return null;
+            return { machineId: identity.machineId, projectId };
+        },
+        grants: async (projectId) => {
+            const identity = new machine_store_1.MachineStore((0, machine_store_1.machineFilePath)()).load();
+            if (identity === null)
+                throw new Error('this machine is not paired');
+            const client = new server_client_1.ServerClient({ baseUrl: identity.serverUrl, token: identity.token });
+            return (await client.sessionGrants(projectId)).grants;
+        },
+        recordAck: async (projectId, grantId, ack) => {
+            const identity = new machine_store_1.MachineStore((0, machine_store_1.machineFilePath)()).load();
+            if (identity === null)
+                throw new Error('this machine is not paired');
+            const client = new server_client_1.ServerClient({ baseUrl: identity.serverUrl, token: identity.token });
+            await client.acknowledgeSessionGrant(projectId, grantId, ack);
+        },
+        paths: (sessionId) => (0, session_adapter_runtime_1.adapterPaths)(stateDir, sessionId),
+        supportedAdapters: () => SUPPORTED_SESSION_ADAPTERS,
+        now: () => new Date().toISOString(),
+        note: (line) => process.stdout.write(`  ${line}\n`),
+    };
+    /** What the last measurement left out, so the report can name it. */
+    let lastExcluded = [];
+    return {
+        readClaim: async (path) => {
+            try {
+                const parsed = JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+                return isSessionClaimShape(parsed) ? parsed : null;
+            }
+            catch {
+                return null;
+            }
+        },
+        measure: async (claim, consent) => {
+            /**
+             * ⚠️ THE CHECKOUT IS READ, NOT TRUSTED. `null` on any failure, the same
+             * rule `nodeReposDeps` follows: an unreadable tree must reach the fold as
+             * absent so it answers `unmeasurable`.
+             */
+            let workspaceAt = null;
+            try {
+                workspaceAt = await new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(claim.workspace)).headSha();
+            }
+            catch {
+                workspaceAt = null;
+            }
+            /** A run this machine already has in that checkout. Exclusive control. */
+            let heldBy = null;
+            try {
+                const holder = new workspace_1.RunRegistry((0, workspace_1.workspacesRoot)(cwd), workspace_1.nodeProbe)
+                    .active()
+                    .find((r) => (0, path_1.resolve)(r.workspace) === (0, path_1.resolve)(claim.workspace));
+                heldBy = holder === undefined ? null : holder.runId;
+            }
+            catch {
+                heldBy = null;
+            }
+            /** The product's own liveness probe, with its third answer intact. */
+            let liveness;
+            try {
+                const probed = (0, workspace_1.nodeProbe)(claim.pid);
+                liveness = probed === 'alive' ? 'alive' : probed === 'dead' ? 'gone' : 'unknown';
+            }
+            catch {
+                liveness = 'unknown';
+            }
+            return {
+                supportedAdapters: SUPPORTED_SESSION_ADAPTERS,
+                repoDeclared: cfg.sessions?.repo !== undefined && cfg.sessions.repo === claim.repo,
+                hostIsThisMachine: (0, node_os_1.hostname)() === claim.host,
+                liveness,
+                workspaceAt,
+                workspaceHeldBy: heldBy,
+                // Absent config is `null`, NOT an empty allow-list: "nothing is
+                // permitted" and "nobody said" are different answers and only one of
+                // them is safe to act on.
+                scopeAllowed: cfg.sessions?.scope ?? null,
+                budgetOwnedHere: cfg.sessions?.budgetOwner === undefined ? null : cfg.sessions.budgetOwner === claim.budgetOwner,
+                controlAuthorized: consent.authorized,
+                sessionCooperating: consent.acked,
+            };
+        },
+        records: async () => {
+            await open();
+            return store.all();
+        },
+        /**
+         * 🔴 WHAT THE SERVER AND THE SESSION'S OWN CHANNEL, TOGETHER, SAY.
+         *
+         * Until this existed, `server.url` and `server.machine_token_file` were
+         * parsed by `config.ts` and read by NOBODY, and `sessions --offer` printed
+         * "this machine could not ask the server" because nothing in the CLI had
+         * ever asked it anything about a grant — a configuration block with no
+         * consumer, which is this codebase's most-named defect wearing different
+         * clothes.
+         *
+         * ⚠️ EVERY FAILURE HERE IS `null`, WHICH IS NOT A REFUSAL. Unpaired,
+         * unregistered, unreachable: none of them is a decision anybody made about
+         * this session, and the command prints them as "nothing was established"
+         * rather than as an answer.
+         */
+        serverControl: (0, session_control_transport_1.serverControlFor)(transportDeps),
+        directionContext: (0, session_control_transport_1.directionContextFor)(transportDeps),
+        /**
+         * 🔴 WRITE THE INSTRUCTION, THEN WAIT — AND BOUND THE WAIT.
+         *
+         * An unbounded wait on a directory a SESSION writes is this process hanging
+         * on the cooperation of the thing it is directing. The bound is short, and
+         * running out of it is reported as "no answer yet" rather than as a failure:
+         * the instruction was delivered, and what happened next is unknown.
+         *
+         * ⚠️ THE RESULT FILE IS ARCHIVED, NOT DELETED. It is the only record that
+         * the session answered at all.
+         */
+        direct: async (sessionId, instruction, waitMs) => {
+            const paths = (0, session_adapter_runtime_1.adapterPaths)(stateDir, sessionId);
+            (0, session_adapter_runtime_1.deliver)(paths, {
+                kind: 'instruction',
+                instructionId: instruction.id,
+                grantId: instruction.grantId,
+                verb: instruction.verb,
+                args: instruction.args,
+                at: instruction.at,
+            });
+            // F41: `--wait` asks for longer, bounded by `MAX_DIRECT_WAIT_S` where it is parsed.
+            const deadline = Date.now() + (waitMs ?? DIRECT_WAIT_MS);
+            for (;;) {
+                const found = (0, session_adapter_runtime_1.collectResults)(paths, [instruction], new Date().toISOString());
+                for (const r of found.results) {
+                    if (r.ruling.kind === 'accept' && r.ruling.result.instructionId === instruction.id) {
+                        (0, session_adapter_runtime_1.archiveResult)(paths, r.file);
+                        return r.ruling.result;
+                    }
+                    if (r.ruling.kind === 'refused') {
+                        process.stdout.write(`  ${r.file}: not accepted — ${r.ruling.because}\n`);
+                        (0, session_adapter_runtime_1.archiveResult)(paths, r.file);
+                    }
+                }
+                for (const blind of found.unreadable)
+                    process.stdout.write(`  blind: ${blind}\n`);
+                if (Date.now() >= deadline)
+                    return null;
+                await new Promise((resolve) => setTimeout(resolve, DIRECT_POLL_MS));
+            }
+        },
+        append: async (record) => {
+            await open();
+            await store.append(record);
+        },
+        now: () => new Date().toISOString(),
+        /**
+         * The real watcher.
+         *
+         * ⚠️ `stillAuthorized` IS A CONSTANT FOR AN OBSERVE-ONLY WATCH, AND THE
+         * REASON IS WORTH READING RATHER THAN ASSUMING. An observe-only watch has
+         * no grant to withdraw — observation was never the half that needed
+         * permission — so there is no server answer to ask for and nothing that
+         * could come back false. Its bounds are the window's `until`, the session's
+         * liveness, the event cap and the stop flag, all of which are real and all
+         * of which this runtime honours.
+         *
+         * 🔴 A CONTROLLED WATCH ASKS FOR REAL (F42). A controlled session's watch
+         * outliving its grant is precisely the thing `stopFor` puts revocation
+         * first for, and LIVE-3 found this constant doing exactly that: the grant
+         * was revoked and the watch recorded on for its whole window. `sessions-cmd`
+         * now hands a watch attached under control the server's question as
+         * `subject.stillAuthorized`; the constant is only the observe-only default.
+         */
+        watch: async (window, subject) => {
+            const { workspace, pid, stillAuthorized } = subject;
+            let stopped = false;
+            const onSignal = () => {
+                stopped = true;
+            };
+            process.once('SIGINT', onSignal);
+            process.once('SIGTERM', onSignal);
+            try {
+                return await (0, session_observe_runtime_1.watchSession)(window, { ...session_observe_runtime_1.DEFAULT_WATCH_OPTIONS, root: workspace }, {
+                    now: () => new Date().toISOString(),
+                    liveness: () => {
+                        // The product's own probe, with its third answer intact: an
+                        // unanswerable pid is `unknown`, and `stopFor` does not end a
+                        // watch on it.
+                        try {
+                            const probed = (0, workspace_1.nodeProbe)(pid);
+                            return probed === 'alive' ? 'alive' : probed === 'dead' ? 'gone' : 'unknown';
+                        }
+                        catch {
+                            return 'unknown';
+                        }
+                    },
+                    // F42: a controlled watch re-asks the server (`sessions-cmd` hands the
+                    // question over); an observe-only one has no grant to withdraw.
+                    stillAuthorized: stillAuthorized ?? (async () => true),
+                    /**
+                     * 🔴 AN ABSOLUTE PATH, NEVER THE BARE NAME, AND A GUARD IN THIS
+                     * REPOSITORY CAUGHT THE FIRST DRAFT DOING IT WRONG. On Windows the
+                     * cwd is searched before PATH, and the cwd HERE is the workspace of
+                     * a session being watched — which is to say a directory whose
+                     * contents are exactly what this code has no reason to trust. A
+                     * bare `git` would have let the watched tree choose the program
+                     * that reads it, in the one place where being watched is supposed
+                     * to be safe.
+                     *
+                     * `trustedGitArgs` and `trustedGitEnv` come along for the same
+                     * reason they do everywhere else: hooks off, signing off, and the
+                     * whole `GIT_` namespace built rather than inherited.
+                     */
+                    revision: () => {
+                        const bin = (0, trusted_git_1.gitBinary)();
+                        if (bin === null)
+                            return null;
+                        try {
+                            return (0, node_child_process_1.execFileSync)(bin, [...(0, trusted_git_1.trustedGitArgs)(), 'rev-parse', 'HEAD'], {
+                                cwd: workspace,
+                                env: (0, trusted_git_1.trustedGitEnv)(process.env, workspace),
+                                encoding: 'utf8',
+                                stdio: ['ignore', 'pipe', 'ignore'],
+                            }).trim();
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+                    askedToStop: () => stopped,
+                });
+            }
+            finally {
+                process.removeListener('SIGINT', onSignal);
+                process.removeListener('SIGTERM', onSignal);
+            }
+        },
+        /**
+         * 🔴 WHAT THIS MACHINE CAN ESTABLISH ABOUT A WORKSPACE IT DOES NOT CONTROL.
+         *
+         * ⚠️ THE LIVENESS PROBE KEEPS ITS THIRD ANSWER. `unknown` becomes a
+         * checkpoint labelled `unknown` rather than one labelled `still`, because a
+         * capture whose quality nobody established must not read as the reassuring
+         * one.
+         */
+        recordObservation: async (record) => {
+            (0, session_observation_store_1.writeObservation)((0, session_observation_store_1.observationPaths)(stateDir, record.sessionId), record);
+        },
+        observations: async (sessionId) => {
+            const lines = [];
+            (0, session_observation_store_1.reportObservations)(sessionId, (0, session_observation_store_1.readObservations)((0, session_observation_store_1.observationPaths)(stateDir, sessionId)), (l) => lines.push(l));
+            return lines;
+        },
+        measureWorkspace: async (workspace, _sessionId, pid) => {
+            let liveness;
+            try {
+                const probed = (0, workspace_1.nodeProbe)(pid);
+                liveness = probed === 'alive' ? 'alive' : probed === 'dead' ? 'gone' : 'unknown';
+            }
+            catch {
+                liveness = 'unknown';
+            }
+            /** A managed run already writing there. A checkpoint of that is a capture of two authors. */
+            let heldBy = null;
+            try {
+                const holder = new workspace_1.RunRegistry((0, workspace_1.workspacesRoot)(cwd), workspace_1.nodeProbe)
+                    .active()
+                    .find((r) => (0, path_1.resolve)(r.workspace) === (0, path_1.resolve)(workspace));
+                heldBy = holder === undefined ? null : holder.runId;
+            }
+            catch {
+                heldBy = null;
+            }
+            const reading = (0, session_checkpoint_runtime_1.measureWorkspace)(workspace, liveness, heldBy);
+            // Carried to the report, which is the only place a person sees it.
+            lastExcluded = reading.excluded;
+            return reading;
+        },
+        writeCheckpoint: async (checkpoint) => {
+            const written = (0, session_checkpoint_runtime_1.writeCheckpoint)(stateDir, checkpoint);
+            const lines = [];
+            (0, session_checkpoint_runtime_1.reportCheckpoint)(written, checkpoint, (l) => lines.push(l), lastExcluded);
+            return lines;
+        },
+        newHandshakeId: () => `hs_${(0, node_crypto_1.randomUUID)().replace(/-/g, '').slice(0, 12)}`,
+        out: (l) => process.stdout.write(l + '\n'),
+        err: (l) => process.stderr.write(l + '\n'),
+    };
+}
+/** The adapter contract, checked before anything reads the claim as a claim. */
+function isSessionClaimShape(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    const o = v;
+    const strings = ['sessionId', 'adapter', 'adapterVersion', 'repo', 'workspace', 'host', 'sourceSha', 'budgetOwner'];
+    if (!strings.every((k) => typeof o[k] === 'string'))
+        return false;
+    if (typeof o['pid'] !== 'number' || !Number.isInteger(o['pid']))
+        return false;
+    return Array.isArray(o['scope']) && o['scope'].every((x) => typeof x === 'string');
+}
+/**
+ * WHICH DECLARED REPOSITORY IS THIS ONE — by path, never by name.
+ *
+ * ⚠️ `path` is the only thing that says "this is me". The id is an identity a
+ * compatible set names and carries no location, and `name` in `project:` is a
+ * different namespace again — matching on either would make a project that
+ * happened to share a word with a sibling declare itself circular.
+ *
+ * Returns null when nothing declared resolves to here, which the fold reads as
+ * "not established" rather than "no need is circular".
+ */
+/**
+ * Why this run may not start yet, when this project declares cross-repo needs.
+ *
+ * 🔴 THE CHEAP HALF OF ENFORCEMENT, ASKED WHERE THE DIRTY-TREE CHECK IS ASKED.
+ * A need is about publication in ANOTHER repository, so answering it costs a
+ * `git rev-parse` per declared repo and a read of the local set records — no
+ * server, no model. Asking it here means a project whose dependency has not
+ * published does not spend a compile and a verify finding that out, which is
+ * exactly the waste `fe9f746` removed for a dirty tree.
+ *
+ * ⚠️ IT IS PROJECT-LEVEL, LIKE THE NEEDS THEMSELVES. It answers "may this
+ * project start work at all", never "may this item" — item-level needs are
+ * UNFINISHED and this does not pretend otherwise.
+ *
+ * ⚠️ AN UNREADABLE SIBLING BLOCKS, and that is the safe direction: the fold
+ * answers `unmeasured`, and starting dependent work on the strength of "I could
+ * not look" is the mistake every other fold in this package refuses.
+ *
+ * Returns null when the project declares no needs, or when every need is met.
+ */
+/**
+ * Where every declared repository stands, and what was accepted together.
+ *
+ * 🔴 ONE BUILDER, TWO READERS. The project-level gate below asks it whether this
+ * project may start at all; `pickableItems` asks it, through the run, whether
+ * one ITEM's needs are met. Two copies of "what has published" would eventually
+ * answer differently about the same moment, and the one that mattered would be
+ * whichever the reader happened to call.
+ *
+ * ⚠️ IT DOES NOT SHORT-CIRCUIT ON "no project-level needs". That early return
+ * belongs to the gate, not here: a project declaring none of its own can still
+ * hold items that declare theirs, and a builder that gave up early would hand
+ * the run an undefined context and block every one of them as `undeclared`.
+ */
+async function crossRepoContext(cwd, cfg) {
+    const declared = cfg.repos ?? [];
+    if (declared.length === 0)
+        return undefined;
+    const current = new Map();
+    for (const repo of declared) {
+        try {
+            const git = new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(repo.path));
+            const branches = await git.listBranches(integration_1.INTEGRATION_BRANCH);
+            const integration = branches.find((b) => b.name === integration_1.INTEGRATION_BRANCH);
+            current.set(repo.id, integration === undefined ? await git.headSha() : integration.sha);
+        }
+        catch {
+            // Left out of the map on purpose: absent is what the folds read as
+            // "could not be read", and a fabricated sha would answer a different
+            // question than the one asked.
+        }
+    }
+    const store = new compatible_sets_1.CompatibleSetStore((0, git_driver_1.projectStateDir)(cwd), ledger_store_1.nodeLedgerFs);
+    await store.open();
+    const records = store.all();
+    const setId = (0, compatible_sets_1.newestSetId)(records);
+    return {
+        declared: declared.map((d) => d.id),
+        self: (0, self_repo_id_1.selfRepoId)(declared, cwd),
+        set: setId === null ? null : (0, compatible_sets_1.setFrom)(records, setId),
+        current,
+    };
+}
+async function crossRepoNeedsTrouble(configPath) {
+    let cfg;
+    try {
+        cfg = loadConfig(configPath);
+    }
+    catch {
+        // Not this check's business. The run loads the same file a moment later and
+        // reports a bad config far better than a guess from here could.
+        return null;
+    }
+    const needs = cfg.crossRepoNeeds ?? [];
+    if (needs.length === 0)
+        return null;
+    const cwd = process.cwd();
+    const declared = cfg.repos ?? [];
+    const current = new Map();
+    for (const repo of declared) {
+        try {
+            const git = new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(repo.path));
+            const branches = await git.listBranches(integration_1.INTEGRATION_BRANCH);
+            const integration = branches.find((b) => b.name === integration_1.INTEGRATION_BRANCH);
+            current.set(repo.id, integration === undefined ? await git.headSha() : integration.sha);
+        }
+        catch {
+            // Left out of the map on purpose: absent is what the fold reads as
+            // "could not be read", and a fabricated sha would answer a different
+            // question than the one asked.
+        }
+    }
+    const store = new compatible_sets_1.CompatibleSetStore((0, git_driver_1.projectStateDir)(cwd), ledger_store_1.nodeLedgerFs);
+    await store.open();
+    const records = store.all();
+    const setId = (0, compatible_sets_1.newestSetId)(records);
+    const blockers = (0, core_1.crossRepoBlockedBy)({
+        needs,
+        declared: declared.map((d) => d.id),
+        self: (0, self_repo_id_1.selfRepoId)(declared, cwd),
+        set: setId === null ? null : (0, compatible_sets_1.setFrom)(records, setId),
+        current,
+    });
+    return (0, core_1.describeCrossRepoBlockers)(blockers);
+}
+function nodeReposDeps() {
+    const cwd = process.cwd();
+    const cfg = loadConfig((0, path_1.join)(cwd, git_driver_1.STATE_DIR, 'config.yaml'));
+    const stateDir = (0, git_driver_1.projectStateDir)(cwd);
+    const store = new compatible_sets_1.CompatibleSetStore(stateDir, ledger_store_1.nodeLedgerFs);
+    let opened = false;
+    const open = async () => {
+        if (!opened) {
+            await store.open();
+            opened = true;
+        }
+    };
+    return {
+        declared: () => cfg.repos ?? [],
+        self: () => (0, self_repo_id_1.selfRepoId)(cfg.repos ?? [], cwd),
+        needs: () => cfg.crossRepoNeeds ?? [],
+        // ⚠️ SHARED WITH THE DAEMON'S INTEGRATOR rather than written twice. Two
+        // copies of "where is this repository" are two copies that can disagree,
+        // and the one that disagrees is the one deciding whether a set drifted.
+        revisionOf: publication_recorder_1.nodeRevisionOf,
+        records: async () => {
+            await open();
+            return store.all();
+        },
+        append: async (record) => {
+            await open();
+            await store.append(record);
+        },
+        now: () => new Date().toISOString(),
+        // `newId`'s prefixes are a closed vocabulary of DB entities; a compatible
+        // set is not one of those, so it is generated here rather than widening it.
+        newId: () => `set_${(0, node_crypto_1.randomUUID)().replace(/-/g, '').slice(0, 12)}`,
+        out: (l) => process.stdout.write(l + '\n'),
+        err: (l) => process.stderr.write(l + '\n'),
+    };
+}
+async function goals() {
+    const read = await (0, goal_view_1.readGoalsList)(process.cwd(), { now: () => Date.now() });
+    if (!read.ok) {
+        process.stderr.write(`goals   : ${read.because}\n`);
+        return read.code;
+    }
+    process.stdout.write((0, goal_view_1.renderGoalsList)(read.entries));
+    return 0;
+}
+const DEFAULT_SERVER = 'https://looply-api-607184ed6acc.herokuapp.com';
+/** Pair this machine with a phone, so runs can be watched and driven remotely. */
+async function pair(argv) {
+    const at = argv.indexOf('--server');
+    const serverUrl = at >= 0 && argv[at + 1] ? argv[at + 1] : DEFAULT_SERVER;
+    const nameAt = argv.indexOf('--name');
+    const machineName = nameAt >= 0 ? argv[nameAt + 1] : undefined;
+    return (0, daemon_cmd_1.pairCommand)({
+        cwd: process.cwd(),
+        serverUrl,
+        ...(machineName ? { machineName } : {}),
+        log: (line) => process.stdout.write(`${line}\n`),
+    });
+}
+/** Keep this machine connected: presence, and shipping the ledger. */
+async function daemon(argv) {
+    const at = argv.indexOf('--config');
+    const configPath = at >= 0 ? argv[at + 1] : '.looply/config.yaml';
+    if (!configPath) {
+        process.stderr.write('daemon: --config needs a path\n');
+        return 1;
+    }
+    // Registering is irreversible, so an unknown directory is asked about. The
+    // asker is only wired up when there is a terminal to answer on: with stdin
+    // piped — a service unit, a CI job — a prompt is an indefinite hang, and the
+    // gate refuses instead, telling you about --yes.
+    const interactive = Boolean(process.stdin.isTTY);
+    return (0, daemon_cmd_1.daemonCommand)({
+        cwd: process.cwd(),
+        config: loadConfig(configPath),
+        once: argv.includes('--once'),
+        log: (line) => process.stdout.write(`${line}\n`),
+        gate: {
+            assumeYes: argv.includes('--yes') || argv.includes('-y'),
+            ...(interactive ? { ask: (0, daemon_cmd_1.nodeRegisterAsk)((s) => process.stdout.write(s)) } : {}),
+        },
+    });
+}
+/** Seed or top up the queue by reading the code through several narrow lenses. */
+async function scan(argv) {
+    const at = argv.indexOf('--config');
+    const configPath = at >= 0 ? argv[at + 1] : '.looply/config.yaml';
+    if (!configPath) {
+        process.stderr.write('scan: --config needs a path\n');
+        return 1;
+    }
+    const onlyAt = argv.indexOf('--lens');
+    const only = onlyAt >= 0 && argv[onlyAt + 1] ? argv[onlyAt + 1].split(',') : undefined;
+    const perAt = argv.indexOf('--per-lens');
+    let perLens;
+    if (perAt >= 0) {
+        const n = Number(argv[perAt + 1]);
+        if (!Number.isInteger(n) || n < 1) {
+            process.stderr.write('scan: --per-lens needs a positive whole number\n');
+            return 1;
+        }
+        perLens = n;
+    }
+    const cfg = loadConfig(configPath);
+    try {
+        await (0, scan_cmd_1.scanProject)({
+            cwd: process.cwd(),
+            config: cfg,
+            ...(only ? { only } : {}),
+            ...(perLens !== undefined ? { perLens } : {}),
+            dryRun: argv.includes('--dry-run'),
+            log: (line) => process.stdout.write(`${line}\n`),
+        });
+    }
+    catch (e) {
+        /**
+         * ⚠️ A REFUSAL, NOT A CRASH. Writing the queue while a run holds it loses
+         * the items silently; this says so and exits 2, the way every other
+         * "somebody else is here" answer in this file does.
+         */
+        if (e instanceof queue_write_lease_1.QueueBusy) {
+            process.stderr.write(`\n  scan: ${e.message}\n\n`);
+            return 2;
+        }
+        throw e;
+    }
+    return 0;
+}
+/**
+ * Check the drafts a scan produced.
+ *
+ * A run does this by itself when it has nothing pickable, so this command is
+ * for doing it deliberately: it is the cheapest agent work looply does, and
+ * seeing what survives contact with the code is worth knowing before spending
+ * a round on anything.
+ */
+/**
+ * THE INTEGRATION QUEUE'S PRODUCTION ENTRY POINT.
+ *
+ * ⚠️ NOT A SECOND SCHEDULER. It decides nothing about which goal runs; it
+ * offers ONE finished branch, once, and answers whether it went in. The
+ * coordinator still schedules, and this is the seam it — or a person — calls
+ * when a run has finished and its work is ready to converge.
+ *
+ * ⚠️ GATED ON `run.integration`, like everything else in this phase. With the
+ * flag off it says so and changes nothing.
+ */
+async function integrate(argv) {
+    const cwd = process.cwd();
+    const at = argv.indexOf('--config');
+    const configPath = at >= 0 ? argv[at + 1] : '.looply/config.yaml';
+    if (configPath === undefined) {
+        process.stderr.write('integrate: --config needs a path\n');
+        return 1;
+    }
+    const cfg = loadConfig(configPath);
+    const enabled = cfg.run.integration === true;
+    const git = new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(cwd));
+    const initAt = argv.indexOf('--init');
+    if (initAt >= 0) {
+        const from = argv[initAt + 1];
+        if (from === undefined || from.startsWith('--')) {
+            process.stderr.write('integrate: --init needs the ref to start integration from, and it is not guessed — ' +
+                'that is where every future run will begin\n');
+            return 1;
+        }
+        const out = await (0, integration_runtime_1.initialiseIntegration)(cwd, from, git);
+        if (!out.ok) {
+            process.stderr.write(`integrate: ${out.because}\n`);
+            return 1;
+        }
+        process.stdout.write(out.already
+            ? `integrate: ${out.ref} already exists at ${out.sha.slice(0, 7)}\n`
+            : `integrate: created ${out.ref} at ${out.sha.slice(0, 7)} (from ${from})\n`);
+        return 0;
+    }
+    const branchAt = argv.indexOf('--branch');
+    const branch = branchAt >= 0 ? argv[branchAt + 1] : undefined;
+    if (branch === undefined || branch.startsWith('--')) {
+        process.stderr.write('integrate: --branch needs the branch to offer\n');
+        return 1;
+    }
+    const goalAt = argv.indexOf('--goal');
+    const goalId = goalAt >= 0 ? argv[goalAt + 1] : undefined;
+    /**
+     * THE REQUIRED CHECKS, RUN AGAINST THE CANDIDATE IN ITS OWN CHECKOUT.
+     *
+     * 🔴 A CLEAN FAST-FORWARD IS NOT ACCEPTANCE. These are the project's own
+     * gates — the same ones a round must pass — executed at the commit that would
+     * actually be published, in a checkout cut for the purpose.
+     */
+    // The lane's deps, built once for this command and the daemon (M5-1): the project's own gate in the candidate's checkout.
+    /**
+     * WHAT THIS BRANCH'S DELIVERY CLAIMED, AT ITS TIP — resolved exactly as the daemon's offer resolves
+     * it (`integrateOnce`), so a person's `integrate` is held to the same proof: under programme
+     * admission a candidate with no claim gets the strict lane, and one with a claim must pass what it
+     * cites.
+     */
+    const tip = (await git.refExists(branch)) ? await git.mergeBase(branch, branch) : null;
+    // F33: the same containment the daemon's offer applies.
+    const claim = tip === null
+        ? null
+        : (0, lane_claims_1.deliveredClaimFor)(cwd, { branch, commitSha: tip }, await (0, lane_claims_1.deliveriesInHistory)(cwd, tip, (a, b) => git.isAncestor(a, b), (0, integration_runtime_2.readAttempts)(cwd)));
+    const out = await (0, integration_runtime_1.integrationTick)(cwd, { branch, ...(goalId === undefined ? {} : { goalId }), ...(claim === null ? {} : { claim }) }, enabled, (0, integration_deps_1.nodeIntegrationDeps)(cwd, cfg, (line) => process.stdout.write(`${line}\n`), git));
+    switch (out.kind) {
+        case 'off':
+            process.stdout.write('integrate: run.integration is off — nothing to do\n');
+            return 0;
+        case 'uninitialised':
+            process.stderr.write(`integrate: ${out.because}\n`);
+            return 2;
+        case 'idle':
+            process.stdout.write(`integrate: ${out.because}\n`);
+            return 0;
+        case 'published':
+            process.stdout.write(`integrate: published ${branch} → ${out.attempt.published?.ref} ` +
+                `(${String(out.attempt.published?.from).slice(0, 7)}..${out.attempt.published?.to.slice(0, 7)})\n`);
+            return 0;
+        case 'refused':
+            process.stderr.write(`integrate: not published — ${out.attempt.because ?? 'no reason recorded'}\n`);
+            return 2;
+    }
+}
+async function verify(argv) {
+    const at = argv.indexOf('--config');
+    const configPath = at >= 0 ? argv[at + 1] : '.looply/config.yaml';
+    if (!configPath) {
+        process.stderr.write('verify: --config needs a path\n');
+        return 1;
+    }
+    const maxAt = argv.indexOf('--max');
+    let max;
+    if (maxAt >= 0) {
+        const n = Number(argv[maxAt + 1]);
+        if (!Number.isInteger(n) || n < 1) {
+            process.stderr.write('verify: --max needs a positive whole number\n');
+            return 1;
+        }
+        max = n;
+    }
+    const log = (line) => { process.stdout.write(`${line}\n`); };
+    let report;
+    try {
+        report = await (0, verify_cmd_1.verifyCommand)({
+            cwd: process.cwd(),
+            config: loadConfig(configPath),
+            ...(max === undefined ? {} : { max }),
+            log,
+        });
+    }
+    catch (e) {
+        // See the note in `scan`. A verify pass writes verdicts into queue.json,
+        // and a live run would write its own snapshot back over every one of them.
+        if (e instanceof queue_write_lease_1.QueueBusy) {
+            process.stderr.write(`\n  verify: ${e.message}\n\n`);
+            return 2;
+        }
+        throw e;
+    }
+    if (report.checked === 0) {
+        log('verify  : nothing to check — no items are waiting to be confirmed.');
+        return 0;
+    }
+    const verdicts = Object.entries(report.byVerdict)
+        .map(([k, n]) => `${n} ${k}`)
+        .join(' · ');
+    log('');
+    log(`verify  : ${report.checked} checked — ${verdicts}`);
+    log(`verify  : ${report.ready} ready to work on`);
+    if (report.failed)
+        log(`verify  : ${report.failed} could not be written back — run it again`);
+    return 0;
+}
+/**
+ * Is a run going right now?
+ *
+ * Read from the projection rather than from a process list: the run may be
+ * on another terminal, and status.json is the thing both of them agree on.
+ * A missing or unreadable file means no, which is the safe reading — the
+ * request is written either way and the next run consumes it.
+ */
+function isRunLive() {
+    try {
+        const parsed = JSON.parse((0, fs_1.readFileSync)((0, path_1.resolve)('.looply/state/status.json'), 'utf8'));
+        // `live` is top level. It was read as `parsed.run.live` — the shape
+        // `looply agent --json` produces, not the shape LedgerStore writes — so
+        // the answer was always undefined, `looply stop` always said no run was
+        // going, and it never wrote the request. welcome() and agent() both read
+        // the flat field correctly, which is what let the odd one out survive.
+        return parsed?.live === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The queue, in the terminal.
+ *
+ * The screen exists for the *why*: a queue of fifteen where twelve are stale,
+ * blocked or duplicates is a queue of three, and a count alone hides that.
+ */
+async function queue(argv) {
+    const store = new queue_store_1.QueueStore((0, path_1.resolve)('.looply/state'), ledger_store_1.nodeLedgerFs);
+    await store.open();
+    for (const line of (0, queue_view_1.renderQueue)(store.list(), { all: argv.includes('--all') })) {
+        process.stdout.write(line + '\n');
+    }
+    return 0;
+}
+/**
+ * What this project is running, and what it left behind.
+ *
+ * 🔴 THE REAPER HAD NO WAY IN. Phase 1 shipped `createWorkspace`, `reapVerdict`
+ * and `reapWorkspace` with NO production caller — so workspaces and registry
+ * entries accumulated with nothing able to retire them, and the orphan lifecycle
+ * the phase claimed to have was unreachable code. This is its home.
+ *
+ * Read-only without `--reap`, deliberately: a person should be able to see what
+ * is going on without authorising a deletion in the same breath.
+ */
+async function runs(argv) {
+    const projectState = (0, git_driver_1.projectStateDir)(process.cwd());
+    const registry = new workspace_1.RunRegistry(projectState);
+    const entries = registry.list();
+    /**
+     * 🔴 THE SLOTS ARE SHOWN, AND THEY USED NOT TO BE.
+     *
+     * The concurrency bound lives in `slot-<n>.json`, and `list()` filters those
+     * out on purpose — counting them would report every run twice. But nothing
+     * else showed them either, so a slot held by a record that had already gone
+     * was invisible: `looply runs` printed "nothing running, and nothing left
+     * behind" while every start refused with "this project already has 1
+     * execution(s) holding a slot". Nothing in the CLI could see it, name it, or
+     * clear it, and the project was wedged with no way out but deleting files by
+     * hand.
+     */
+    const slots = registry.slots();
+    /**
+     * 🔴 AND THE CHECKOUTS NOTHING ACCOUNTS FOR. `--new-workspace` cuts the
+     * worktree BEFORE the run registers, so anything that ends the run in between
+     * — a config error, a dirty tree, `--dry-run`, a crash — left a real checkout
+     * this command could not see and `--reap` could not reach. One per failed
+     * start, accumulating silently. Found by using the command.
+     */
+    const { abandoned, busy } = (0, workspace_1.abandonedWorkspaces)(process.cwd(), registry);
+    /**
+     * 🔴 AND THE CLAIM LOCK, WHICH WAS INVISIBLE TO EVERY COMMAND. It is only
+     * breakable when its owner is PROVEN dead, so one left by a process that is
+     * alive but hung — or whose pid cannot be judged — denied every start of the
+     * project with a message about "another start deciding" and nothing to look at.
+     * That is the same wedge the slot files had before this listed them.
+     */
+    const lock = registry.claimLock();
+    /**
+     * 🔴 A REAL REPOSITORY MAKES THESE ROWS UNREADABLE. Measured against a clone of
+     * looply itself: a workspace path is
+     * `C:\Users\…\.looply\workspaces\399072e3c9a57ef8\ws-20260904070437-dra9`,
+     * and a box row carrying one came out at 170 characters — which wraps twice on
+     * an 80-column terminal and turns a three-row table into nine lines of noise.
+     * Every fixture used until now had a path short enough to hide it.
+     *
+     * The root is the same for every one of them, so it is said ONCE and the rows
+     * carry the part that differs. A `--in` checkout is somewhere else entirely and
+     * keeps its full path, because that is the only place it appears.
+     */
+    const wsRootShown = (0, path_1.resolve)((0, workspace_1.workspacesRoot)(process.cwd()));
+    const shortWs = (w) => {
+        const r = (0, path_1.resolve)(w);
+        return r.toLowerCase().startsWith(`${wsRootShown.toLowerCase()}${path_1.sep}`)
+            ? `…${path_1.sep}${r.slice(wsRootShown.length + 1)}`
+            : r;
+    };
+    if (entries.length === 0 &&
+        slots.length === 0 &&
+        abandoned.length === 0 &&
+        busy.length === 0 &&
+        lock === null) {
+        /**
+         * ⚠️ AND `--release` STILL HAS TO ANSWER. This returned 0 with "nothing
+         * running, and nothing left behind" BEFORE the flag was parsed, so
+         * `looply runs --release anything-at-all` reported success on a clean
+         * project — a command that did nothing, said nothing about it, and exited 0.
+         */
+        if (argv.includes('--release')) {
+            process.stderr.write(`\n  nothing is registered for this project, so there is nothing to release\n\n`);
+            return 2;
+        }
+        process.stdout.write(`\n  ${(0, ui_1.dim)('nothing running, and nothing left behind')}\n\n`);
+        return 0;
+    }
+    if (entries.length > 0) {
+        const rows = entries.map((e) => e.kind === 'unreadable'
+            ? [
+                'unreadable',
+                // 🔴 AND HOW TO CLEAR IT. This printed the path and the reason and
+                // stopped, and `--release` then refused the name it had just shown
+                // — the one row a person most wants gone was the one nothing could
+                // remove. It holds no slot, so this is clutter rather than a wedge,
+                // but a listing that offers no way out stops being believed.
+                `${e.path} — ${e.because}; \`looply runs --release ${(0, path_1.basename)(e.path).replace(/\.json$/, '')}\` clears it`,
+            ]
+            : [
+                e.kind === 'active' ? 'running' : e.kind === 'orphaned' ? 'orphaned' : 'unjudgeable',
+                `${e.record.runId}  ${e.record.branch}  pid ${e.record.pid}  ${shortWs(e.record.workspace)}`,
+            ]);
+        process.stdout.write(`${(0, ui_1.box)((0, ui_1.fields)(rows), { title: 'executions' })}\n`);
+    }
+    if (lock !== null) {
+        const who = lock.pid === null
+            ? 'nothing this can identify'
+            : `pid ${lock.pid}, which is ${lock.liveness === 'alive' ? 'running' : lock.liveness === 'dead' ? 'gone' : 'not answering'}`;
+        process.stdout.write(`${(0, ui_1.box)((0, ui_1.fields)([
+            [
+                'claim lock',
+                `held by ${who}  ${(0, ui_1.dim)(lock.liveness === 'dead' ? 'the next start will break it' : '`looply runs --release claim-lock` clears it')}`,
+            ],
+        ]), { title: 'starting' })}
+`);
+    }
+    if (slots.length > 0) {
+        const rows = slots.map((s) => [
+            `slot-${s.slot}`,
+            s.record === null
+                ? `${(0, ui_1.warn)('unreadable')} — nothing can say whose it is; \`looply runs --release slot-${s.slot}\` clears it`
+                : `${s.record.runId}  pid ${s.record.pid}`,
+        ]);
+        process.stdout.write(`${(0, ui_1.box)((0, ui_1.fields)(rows), { title: 'concurrency slots' })}\n`);
+    }
+    /**
+     * 🔴 AND THE FILES THAT LOOK LIKE SLOTS AND ARE NOT.
+     *
+     * `slot-abc.json` and `slot-01.json` are deliberately not slots: neither
+     * name round-trips, so `--release slot-<n>` could not clear them and a row
+     * offering that would be a lie. They were then in no listing at all — a file
+     * plainly on disk, mentioned nowhere, which is precisely the state this
+     * command exists to make impossible. They are inert; they are also printed.
+     */
+    const strays = registry.strayFiles();
+    if (strays.length > 0) {
+        process.stdout.write(`  ${(0, ui_1.warn)('note')} — ${strays.length} file(s) in the slots directory nothing can name. ` +
+            `Inert: nothing counts them and nothing reads them. Delete them if you like:\n`);
+        for (const s of strays)
+            process.stdout.write(`         ${(0, ui_1.dim)(s)}\n`);
+        process.stdout.write('\n');
+    }
+    if (abandoned.length > 0 || busy.length > 0) {
+        /**
+         * ⚠️ BUSY CHECKOUTS ARE SHOWN TOO. They used to be skipped in silence, so a
+         * real directory on disk existed nowhere: no row, no count, no reason, and
+         * this command printing "nothing running, and nothing left behind". They
+         * are not offered for reaping — something is using them — but a person
+         * looking at a directory that is plainly there deserves to see it.
+         */
+        const rows = [
+            ...busy.map((w) => [
+                'in use',
+                `${shortWs(w)}  ${(0, ui_1.dim)(`in use — \`looply runs --release ${(0, path_1.basename)(w)}\` clears its start marker`)}`,
+            ]),
+            ...abandoned.map((w) => {
+                /**
+                 * 🔴 "ABANDONED" AND "KEPT ON PURPOSE" ARE DIFFERENT THINGS, and this
+                 * said the first about both. A checkout the reaper has already refused —
+                 * because it holds a person's uncommitted files, or because its git
+                 * config cannot be read — was listed as "no execution accounts for this
+                 * checkout", which is true and reads as "nothing is using this, remove
+                 * it". The quarantine record is what lets the row say which it is.
+                 */
+                const held = (0, workspace_quarantine_1.quarantineOf)(process.cwd(), w);
+                return held === null
+                    ? ['abandoned', `${shortWs(w)}  ${(0, ui_1.dim)('no execution accounts for this checkout')}`]
+                    : [
+                        'quarantined',
+                        `${shortWs(w)}  ${(0, ui_1.warn)(held.because)}  ${(0, ui_1.dim)(`— \`looply runs --release ${(0, path_1.basename)(w)}\` when you have looked`)}`,
+                    ];
+            }),
+        ];
+        process.stdout.write(`${(0, ui_1.box)((0, ui_1.fields)(rows), { title: 'workspaces' })}
+`);
+        process.stdout.write(`  ${(0, ui_1.dim)(`…  =  ${wsRootShown}`)}
+`);
+    }
+    /**
+     * THE LAST RESORT, AND THE ONLY THING THAT CAN CLEAR A HOLD THAT LOOKS ALIVE.
+     *
+     * Liveness here is a pid, and pids are recycled. A run killed hard leaves both
+     * its registry entry and its lease behind, so every automatic witness agrees
+     * the run is going — and if a later process inherits that pid, they agree for
+     * ever. The slot is never reclaimed and the project's concurrency is one
+     * lower than it says, permanently, with nothing to point at.
+     *
+     * ⚠️ SO A PERSON SAYS SO, BY NAME. Not a flag on `--reap`, not a heuristic
+     * about how old a record is, and nothing automatic: the name has to be typed.
+     * It is the same shape as the one-time explicit release the owner accepted
+     * for F7 — narrow, deliberate, and impossible to reach by accident.
+     *
+     * ⚠️ `slot-<n>` IS ACCEPTED AS WELL AS A runId, because the case this exists
+     * for includes a slot file nothing can read — and a corrupt slot has no runId
+     * to type.
+     *
+     * ⚠️ IT DOES NOT TOUCH THE WORKSPACE. Forgetting a hold is a statement about
+     * bookkeeping; the checkout and everything in it stays exactly where it is,
+     * and `--reap` — which proves death first — is still the only thing that
+     * removes one.
+     */
+    const releaseAt = argv.indexOf('--release');
+    if (releaseAt !== -1) {
+        const name = argv[releaseAt + 1];
+        if (name === undefined || name.startsWith('--')) {
+            process.stderr.write(`\n  --release needs the runId or slot-<n> to clear, exactly as listed above\n\n`);
+            return 2;
+        }
+        if (name === 'claim-lock') {
+            /**
+             * ⚠️ WARN WHEN ITS OWNER IS RUNNING. The box a few lines above may have
+             * just said "held by pid N, which is running", and clearing it anyway lets
+             * a second start into a decision another process is in the middle of.
+             */
+            if (lock !== null && lock.liveness !== 'dead') {
+                const how = lock.liveness === 'alive' ? 'answers' : 'cannot be judged';
+                process.stdout.write(`  ${(0, ui_1.warn)('note')} — pid ${lock.pid ?? '?'} ${how}. If that is a start still deciding, ` +
+                    `clearing this lets another one decide alongside it.
+`);
+            }
+            const cleared = registry.forgetClaimLock();
+            process.stdout.write(cleared
+                ? `  claim-lock: cleared — the next start decides for itself
+
+`
+                : `  claim-lock: nothing to clear
+
+`);
+            return cleared ? 0 : 2;
+        }
+        const asSlot = /^slot-(\d+)$/.exec(name);
+        if (asSlot !== null) {
+            const n = Number.parseInt(asSlot[1] ?? '', 10);
+            /**
+             * 🔴 THE SAME WARNING ITS SIBLING GIVES. This branch cleared a slot with
+             * no read and no probe, while the runId branch a few lines below probes
+             * and says "pid N answers, so this may be a real run". The justification
+             * for accepting `slot-<n>` at all is a slot nothing can read — and that
+             * covers only the unreadable case, not one that reads perfectly and names
+             * a process that is running right now.
+             */
+            const holder = slots.find((sl) => sl.slot === n)?.record ?? null;
+            if (holder !== null && (0, workspace_1.nodeProbe)(holder.pid) !== 'dead') {
+                process.stdout.write(`  ${(0, ui_1.warn)('note')} — slot-${n} names ${holder.runId}, pid ${holder.pid}, which answers. ` +
+                    `Clearing it lets another execution start alongside it.
+`);
+            }
+            const cleared = registry.forgetSlot(n);
+            process.stdout.write(cleared
+                ? `  slot-${n}: cleared — the run's own record, if it has one, was left alone\n\n`
+                : `  slot-${n}: nothing to clear\n\n`);
+            return cleared ? 0 : 2;
+        }
+        /**
+         * ⚠️ IT MUST BE ONE THIS PROJECT ACTUALLY LISTS. `forget` builds a path from
+         * the name, so a typed `../../something` would otherwise reach outside the
+         * registry. `RunRegistry` refuses that shape itself; this refuses it earlier,
+         * with a sentence about the project rather than about path syntax.
+         */
+        const known = entries.find((e) => e.kind !== 'unreadable' && e.record.runId === name);
+        const holdsSlot = slots.some((s) => s.record?.runId === name);
+        /**
+         * 🔴 AND AN UNREADABLE RECORD IS CLEARABLE BY THE NAME IT IS PRINTED UNDER.
+         *
+         * `known` deliberately skips `unreadable` entries — there is no trustworthy
+         * runId inside a file that will not parse, and `--release` must never act
+         * on one. But the FILENAME is not inside the file: it is `<name>.json` in
+         * a directory this owns, and it is what `looply runs` prints. So the one
+         * entry a person is most likely to want gone was the one entry nothing
+         * could remove: `--release` said "no execution called X is registered" and
+         * `--reap` skipped it, for ever, with the path on screen the whole time.
+         *
+         * It holds no slot and blocks nothing, so this is clutter rather than a
+         * wedge — but a listing that shows a thing and offers no way to clear it is
+         * how a person learns to stop believing the listing.
+         */
+        const unreadableHere = entries.find((e) => e.kind === 'unreadable' && (0, path_1.basename)(e.path) === `${name}.json`);
+        /**
+         * A workspace listed as `in use` whose start marker names a pid nothing can
+         * distinguish from the run that wrote it.
+         *
+         * ⚠️ AFTER THE RECORD LOOKUP, DELIBERATELY. A name that is BOTH a known
+         * runId and a workspace directory clears the RECORD — the more specific
+         * thing, and what somebody reading the executions table means. This branch
+         * used to come first and would silently have done the other one.
+         *
+         * 🔴 AND IT WARNS, BECAUSE THIS MARKER MAY BE THE CHECKOUT'S ONLY
+         * PROTECTION. Between `worktree add` and the run taking its lease there is
+         * no record and no lease — just this file. Clearing it with no probe and no
+         * word let the very next `--reap` remove a live starting run's checkout.
+         */
+        if (known === undefined && unreadableHere === undefined && !holdsSlot && busy.some((w) => (0, path_1.basename)(w) === name)) {
+            const holder = (0, workspace_1.creationMarkerHolder)(process.cwd(), name);
+            if (holder !== null && holder.liveness !== 'dead') {
+                const how = holder.liveness === 'alive' ? 'answers' : 'cannot be judged';
+                process.stdout.write(`  ${(0, ui_1.warn)('note')} — pid ${holder.pid} ${how}. If that is a run still starting up, ` +
+                    `clearing this lets the next \`--reap\` remove its checkout.\n`);
+            }
+            const cleared = (0, workspace_1.forgetCreationMarker)(process.cwd(), name);
+            process.stdout.write(cleared
+                ? `  ${name}: its start marker was cleared — the checkout was left alone\n\n`
+                : `  ${name}: nothing to clear\n\n`);
+            return cleared ? 0 : 2;
+        }
+        /**
+         * 🔴 THE ONLY THING THAT CLEARS A QUARANTINE, and it must be a person.
+         *
+         * A quarantine never expires and nothing re-derives it away: not a clean
+         * tree, not a later run, not a reap. This is the sentence in
+         * `recovery.ts` — "looply cannot tell whose changes those are" — turned into
+         * a command. It removes the RECORD and never the directory, so whatever
+         * made looply refuse is still exactly where the person left it.
+         *
+         * ⚠️ BEFORE THE RECORD BRANCH, AND THAT ORDER IS THE FIX FOR A MEASURED
+         * DATA-LOSS CHAIN. A workspace directory is NAMED for its runId, so
+         * `--release <name>` matches BOTH this and the run-record branch. With the
+         * record first, the person who read a quarantine refusal and typed the
+         * command it printed cleared the RECORD instead — was told "cleared — the
+         * workspace was left alone", which reads as confirmation — and thereby made
+         * the checkout record-less, i.e. abandoned. The next `--reap` then removed
+         * it. Looply's own advice was the shortest route to losing the checkout it
+         * had just refused to touch.
+         *
+         * A person who has typed the name of a QUARANTINED workspace means the
+         * quarantine. The record is left alone, and the message says so.
+         */
+        const quarantinedAt = (0, path_1.join)((0, workspace_1.workspacesRoot)(process.cwd()), name);
+        const held = (0, workspace_quarantine_1.quarantineOf)(process.cwd(), quarantinedAt);
+        if (held !== null) {
+            const gone = (0, workspace_quarantine_1.clearQuarantine)(process.cwd(), quarantinedAt);
+            process.stdout.write(gone
+                ? `  ${name}: quarantine cleared — the checkout was left exactly as it is.\n` +
+                    `  ${(0, ui_1.dim)(`it was held because: ${held.because}`)}\n` +
+                    (known === undefined
+                        ? '\n'
+                        : `  ${(0, ui_1.dim)(`its execution record is untouched; \`looply runs --release ${name}\` again clears that`)}\n\n`)
+                : `  ${name}: its quarantine record could not be removed\n\n`);
+            return gone ? 0 : 2;
+        }
+        if (known === undefined && unreadableHere === undefined && !holdsSlot) {
+            process.stderr.write(`\n  no execution called ${name} is registered for this project\n\n`);
+            return 2;
+        }
+        if (unreadableHere !== undefined && known === undefined) {
+            process.stdout.write(`  ${(0, ui_1.warn)('note')} — nothing can read this record, so nothing can say whose it was. ` +
+                `It holds no slot.\n`);
+        }
+        if (known?.kind === 'active') {
+            process.stdout.write(`  ${(0, ui_1.warn)('note')} — pid ${known.record.pid} answers, so this may be a real run. ` +
+                `Clearing it lets another execution start alongside it.\n`);
+        }
+        const out = registry.forget(name);
+        process.stdout.write(out.forgot || out.slot !== null
+            ? `  ${name}: cleared${out.slot === null ? '' : ` (slot ${out.slot} freed)`} — the workspace was left alone\n\n`
+            : `  ${name}: nothing to clear\n\n`);
+        return 0;
+    }
+    if (!argv.includes('--reap')) {
+        /**
+         * 🔴 AND IT SAYS WHICH ONES `--reap` CAN ACTUALLY TAKE. This printed
+         * "N orphaned — looply runs --reap retires the ones it can prove are dead"
+         * for every orphan, including the ones it refuses permanently and
+         * correctly: a crash in the main checkout, or in a `--in` checkout a
+         * person chose. Following that advice does nothing, once a day, for ever.
+         */
+        const orphans = entries.filter((e) => e.kind === 'orphaned');
+        /**
+         * 🔴 AND IT COUNTS THEM THE WAY THE REAPER REFUSES THEM.
+         *
+         * This asked `record.worktree`, which is true for ANY linked worktree —
+         * including one a person made and ran `--in`. A crash there was announced
+         * as "in a checkout looply made", and `--reap` then refused it, for ever.
+         * `reapableCheckout` is the reaper's own permanent test, so the sentence
+         * and the command behind it now agree by construction.
+         */
+        const reapable = orphans.filter((e) => e.kind === 'orphaned' && (0, workspace_1.reapableCheckout)(e.record, process.cwd()).ok).length;
+        if (orphans.length > 0) {
+            process.stdout.write(reapable > 0
+                ? `  ${(0, ui_1.dim)(`${orphans.length} orphaned, ${reapable} in a checkout looply made — looply runs --reap`)}\n`
+                : `  ${(0, ui_1.dim)(`${orphans.length} orphaned, none in a checkout looply made — looply runs --release <runId>`)}\n`);
+        }
+        if (abandoned.length > 0) {
+            process.stdout.write(`  ${(0, ui_1.dim)(`${abandoned.length} checkout(s) nothing accounts for — \`looply runs --reap\` retires those it can`)}
+`);
+        }
+        /**
+         * ⚠️ PROVEN DEAD OR UNREADABLE — NOT MERELY "not active". `active()`
+         * deliberately over-counts an unjudgeable pid as running, so counting
+         * anything that is not `active` here made the same screen print
+         * `unjudgeable · run_x  pid 4` AND `1 slot(s) held by nothing that is
+         * running`, and then recommend clearing it. A slot nobody can judge is
+         * exactly the one a person should not be nudged into freeing.
+         */
+        const stuck = slots.filter((s) => s.record === null ||
+            entries.some((e) => e.kind === 'orphaned' && e.record.runId === s.record?.runId) ||
+            !entries.some((e) => e.kind !== 'unreadable' && e.record.runId === s.record?.runId)).length;
+        if (stuck > 0) {
+            process.stdout.write(`  ${(0, ui_1.dim)(`${stuck} slot(s) held by nothing that is running — \`looply runs --release <runId|slot-N>\` clears one`)}\n`);
+        }
+        process.stdout.write('\n');
+        return 0;
+    }
+    const git = new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(process.cwd()));
+    /**
+     * What looply itself put in those checkouts, so the reaper does not read its
+     * own copy as the person's file and refuse for ever. See `workspaceResidue`.
+     *
+     * Best-effort: a project with no readable config is reaped exactly as before.
+     */
+    let carried = [];
+    try {
+        carried = loadConfig((0, path_1.join)(process.cwd(), git_driver_1.STATE_DIR, 'config.yaml')).run.carryIntoCheckouts ?? [];
+    }
+    catch {
+        /* no config, or an unreadable one: nothing is excused, which is the old behaviour */
+    }
+    for (const w of abandoned) {
+        const out = await (0, workspace_1.reapAbandoned)(git, process.cwd(), w, undefined, undefined, undefined, carried);
+        process.stdout.write(out.reaped
+            ? `  ${(0, path_1.basename)(w)}: retired — no execution accounted for it
+`
+            : `  ${(0, path_1.basename)(w)}: ${(0, ui_1.warn)('kept')} — ${out.because ?? 'unknown'}
+`);
+    }
+    for (const e of entries) {
+        if (e.kind !== 'orphaned')
+            continue;
+        const out = await (0, workspace_1.reapWorkspace)(git, registry, e.record, process.cwd(), undefined, undefined, undefined, carried);
+        process.stdout.write(out.reaped
+            ? `  ${e.record.runId}: retired${out.evidenceAt === undefined ? '' : ` — its records kept at ${out.evidenceAt}`}\n`
+            : `  ${e.record.runId}: ${(0, ui_1.warn)('kept')} — ${out.because ?? 'unknown'}` +
+                /**
+                 * ⚠️ AND SAY WHAT TO DO ABOUT THE ONE KIND `--reap` CAN NEVER CLEAR.
+                 * A run that crashed in the MAIN checkout leaves a record whose
+                 * workspace no execution created, so this refuses it every time,
+                 * correctly and for ever. Without this a person is told 'kept' once a
+                 * day with no way forward.
+                 */
+                /**
+                 * ⚠️ EVERY REFUSAL `--reap` CANNOT RESOLVE BY RETRYING, not only the
+                 * main-checkout one. A `--in` checkout a person chose is refused for
+                 * exactly the same reason and just as permanently — looply did not
+                 * make it, so looply may not remove it — and without this the person
+                 * is nagged about it once a day with no way forward.
+                 *
+                 * A refusal about FILES is deliberately excluded: that one resolves
+                 * itself when the person moves or deletes them, and pointing them at
+                 * `--release` instead would be telling them to hide it.
+                 */
+                (out.because?.includes('workspaces root') === true ||
+                    out.because?.includes('main checkout') === true
+                    ? ` — looply runs --release ${e.record.runId} clears the record`
+                    : '') +
+                '\n');
+    }
+    process.stdout.write('\n');
+    return 0;
+}
+/**
+ * Ask a running loop to stop.
+ *
+ * The request goes to control.json and the run reads it between rounds, which
+ * is also why --now kills nothing: a round interrupted halfway leaves a
+ * half-written tree, and the next run refuses to start on one. The round in
+ * flight always finishes.
+ */
+/**
+ * 🔴 `pause` AND `resume`: TWO VERBS THE DAEMON HAS ALWAYS WRITTEN AND THE
+ * TERMINAL COULD NEVER SAY.
+ *
+ * `ControlKind` has had all three since it was written, the run reads all
+ * three, and the phone can send all three — but the CLI only ever wrote `stop`.
+ * So a person at the machine had exactly one brake with one setting: end the
+ * run. Wanting it to hold for ten minutes while they looked at something meant
+ * stopping it and starting again, which spends a Start and loses the queue's
+ * position.
+ *
+ * ⚠️ THE SAME FANNING WRITER AS `stop`, deliberately. A pause that reached the
+ * first execution to look and no others would be exactly the defect Phase 1
+ * measured and fixed for `stop` — and it would be silent, because a paused run
+ * and a running one look identical from outside.
+ */
+/**
+ * ⚠️ AND IT PASSES ARGV THROUGH. It used to hand `stop` an empty array, so
+ * `looply pause --now` silently dropped the flag that `stop` exists to refuse
+ * loudly — the one case where a person believes they did something drastic.
+ */
+async function pauseOrResume(kind, argv) {
+    return stop(argv, kind);
+}
+async function stop(argv, kind = 'stop') {
+    /**
+     * 🔴 THE BRAKE HAS TO ADDRESS THE PROJECT, NOT A DIRECTORY.
+     *
+     * Phase 1 moved the run's `ControlStore` to the PROJECT state directory — so
+     * that one stop would reach every workspace — and left this writer at the cwd.
+     * The two then pointed at different files whenever a run was executing
+     * anywhere but the main checkout: from the main checkout `isRunLive` found no
+     * `status.json` and this wrote NOTHING while the run carried on, and from
+     * inside a workspace it wrote a control file the run does not read. A human
+     * brake that silently does nothing is worse than no brake at all.
+     *
+     * Liveness comes from the registry for the same reason. `status.json` is
+     * execution-scoped by design, so asking one directory whether "a run" is going
+     * cannot answer a question about N of them — and the registry probes the pid
+     * rather than trusting a file.
+     *
+     * ⚠️ SIMPLE MODE IS UNCHANGED: in an ordinary checkout the project and
+     * execution directories are the same path, and `isRunLive` still answers.
+     */
+    const projectState = (0, git_driver_1.projectStateDir)(process.cwd());
+    const running = new workspace_1.RunRegistry(projectState).active();
+    const live = running.length > 0 || isRunLive();
+    /**
+     * ⚠️ ONE WRITER, SHARED WITH THE DAEMON. The shared `control.json` plus one
+     * addressed request per live execution — see `requestControlEverywhere`. The
+     * daemon had the same hole and a different code path; now it has neither.
+     */
+    let addressed = [];
+    let unreachable = [];
+    /**
+     * 🔴 A STANDING HOLD OUTLIVES THE RUN, SO `resume` MUST WRITE WITH NOTHING
+     * RUNNING — AND IT DID NOT. THIS WAS A DEADLOCK WITH NO KEY.
+     *
+     * MEASURED: `looply pause` during a run, run ends, `control.json` still reads
+     * `pause`. The daemon's autonomy tick reads that same project file to answer
+     * "has a person asked this machine to hold" — its own docblock says so — so
+     * the machine holds. `looply resume` then printed "no run is going — nothing
+     * to resume", wrote NOTHING, exited 0, and left the hold exactly where it
+     * was. The one documented way out of a hold could not clear one.
+     *
+     * ⚠️ `pause` IS THE SAME FACT FROM THE OTHER SIDE. Asking the machine to hold
+     * BEFORE it starts anything is a coherent thing to want, and the daemon reads
+     * the file that expresses it. Refusing to write it because nothing is running
+     * yet is refusing the request at exactly the moment it is cheapest to honour.
+     *
+     * ⚠️ `stop` IS DIFFERENT AND STAYS DIFFERENT. It addresses a RUN. There is no
+     * such thing as stopping a run that does not exist, and writing a standing
+     * `stop` would leave an order that the next run consumes on its way past —
+     * which is the "last night's stop wedges tonight's run" hazard the old
+     * comment here was rightly worried about.
+     */
+    const standing = kind !== 'stop';
+    /** Whether a control file was actually written. Every message below reads this. */
+    const wrote = live || standing;
+    if (wrote) {
+        const out = await (0, workspace_1.requestControlEverywhere)(projectState, running, kind, 'human:cli', ledger_store_1.nodeLedgerFs, process.cwd());
+        addressed = out.reached;
+        unreachable = out.unreachable;
+    }
+    if (running.length > 1) {
+        /**
+         * ⚠️ THE VERB IS THE ONE THE PERSON TYPED. This line was written for `stop`
+         * and then reused by `pause` and `resume` without being read again, so
+         * `looply resume` on three executions reported that three executions "were
+         * told to stop" — the exact opposite of what had just been asked for, in
+         * the one place a person looks to check the brake reached everything.
+         */
+        const told = kind === 'resume' ? 'were told to carry on' : `were told to ${kind}`;
+        process.stdout.write(`
+  ${(0, ui_1.dim)(`${addressed.length} of ${running.length} running executions ${told}.`)}
+`);
+    }
+    if (unreachable.length > 0) {
+        process.stdout.write(`  ${(0, ui_1.warn)('could not reach')} ${unreachable.join(', ')} — their state directories could not be written
+`);
+    }
+    process.stdout.write('\n  ' + (0, queue_view_1.stopMessage)(live, kind) + '\n');
+    /**
+     * 🔴 `--now` IS REMOVED RATHER THAN IMPLEMENTED, AND THAT IS THE HONEST END
+     * OF A FLAG THAT NEVER DID ANYTHING.
+     *
+     * It was parsed, it printed a sentence, and it changed nothing — while
+     * `DESIGN.md` advertised "graceful … or immediate". A flag that is accepted
+     * and ignored is worse than one that does not exist: a person who types it in
+     * an emergency believes they have done something.
+     *
+     * And it cannot be implemented, deliberately. Phase 3 refused to add a hard
+     * cancel because "a round in flight always finishes" is the invariant
+     * RECOVERY rests on — cut one off and a dirty tree becomes looply's own
+     * mid-round state, which the next run cannot tell from a person's edits. The
+     * flag was advertising a capability the architecture is built to refuse.
+     *
+     * ⚠️ IT IS REFUSED LOUDLY, NOT IGNORED QUIETLY. Somebody's script may pass it.
+     */
+    if (argv.includes('--now')) {
+        process.stdout.write('\n  ' +
+            (0, ui_1.warn)('--now was removed') +
+            ' — it never did anything. A round in flight always finishes, because\n' +
+            '  cutting one off leaves a half-written tree the next run cannot tell from your edits.\n' +
+            /**
+             * 🔴 IT REPORTS WHAT WAS WRITTEN, FROM THE VARIABLE THAT DECIDED IT —
+             * AND THE FIRST TWO VERSIONS OF THIS LINE BOTH LIED, IN OPPOSITE
+             * DIRECTIONS.
+             *
+             * The original said "The stop above is in effect" unconditionally, so
+             * `looply stop --now` with nothing running printed "no run is going"
+             * and then, two lines later, the loudest possible reassurance
+             * contradicting it. The repair replaced that with "nothing was
+             * written" keyed on `live` — and by then `pause` and `resume` DID
+             * write with nothing running, so `looply pause --now` announced that
+             * nothing had been written over a control file it had just written.
+             *
+             * One false sentence about a write replaced by another is not a
+             * repair; it is the same defect with a new value. So the sentence is
+             * derived from `wrote`, which is the variable the write itself is
+             * conditioned on, and the two cannot disagree without the compiler
+             * noticing.
+             */
+            (wrote
+                ? `  The ${kind} above is in effect.\n`
+                : '  There was nothing running to stop, so nothing was written.\n'));
+    }
+    process.stdout.write('\n');
+    return 0;
+}
+/**
+ * Start a run.
+ *
+ * `--dry-run` prints the plan and calls no agent, which is how you find out the
+ * queue is empty or proof is switched off in a second rather than at round one
+ * of an overnight run.
+ */
+async function run(argv) {
+    /**
+     * WHERE THIS EXECUTION RUNS. Absent means here, which is Simple Mode.
+     *
+     * `--in` is the whole of Phase 1's parallel interface, and that is deliberate:
+     * a second isolated execution is a second `looply run` in a second workspace,
+     * and looply already knows how to be one run in one checkout. Nothing about
+     * the no-flag path changes — same cwd, same state directory, same lease.
+     */
+    const inAt = argv.indexOf('--in');
+    let workspace;
+    if (inAt >= 0) {
+        const raw = argv[inAt + 1];
+        if (raw === undefined || raw.startsWith('--')) {
+            process.stderr.write('run: --in needs a path\n');
+            return 1;
+        }
+        workspace = (0, path_1.resolve)(raw);
+        if (!(0, fs_1.existsSync)(workspace)) {
+            process.stderr.write(`run: no such directory: ${workspace}\n`);
+            return 1;
+        }
+        /**
+         * The same refusal every other verb gets, at the earliest point a person
+         * can be told. A workspace that is not a repository root is one where
+         * `reset --hard` would reach further than the person named.
+         */
+        const misplaced = (0, trusted_git_1.repoRootTroubleAt)(workspace);
+        if (misplaced !== null) {
+            process.stderr.write(`run: ${misplaced}\n`);
+            return 1;
+        }
+    }
+    /**
+     * MAKE ONE, RATHER THAN BE HANDED ONE.
+     *
+     * 🔴 THE OTHER HALF OF THE LIFECYCLE WAS ALSO UNREACHABLE. `looply runs
+     * --reap` only ever removes a checkout under this project's workspaces root —
+     * that containment gate is what stops a reaper deleting a directory a person
+     * made — and nothing in production ever put a checkout there.
+     * `createWorkspace` had no caller, so `--reap` refused every orphan it was
+     * ever shown, and the phase's own DEMO J passed by never reaching the code it
+     * named.
+     *
+     * `--new-workspace` is the way in. Looply cuts the checkout, so looply may
+     * later remove it; a `--in` path a person chose stays theirs, and `--reap`
+     * still refuses it. That asymmetry is the point, not an oversight.
+     *
+     * ⚠️ MUTUALLY EXCLUSIVE WITH `--in`, because they answer the same question and
+     * somebody who typed both meant one of them.
+     */
+    if (argv.includes('--new-workspace')) {
+        if (workspace !== undefined) {
+            process.stderr.write('run: --in and --new-workspace both say where to run; pick one\n');
+            return 1;
+        }
+        const here = process.cwd();
+        const notARoot = (0, trusted_git_1.repoRootTroubleAt)(here);
+        if (notARoot !== null) {
+            process.stderr.write(`run: ${notARoot}\n`);
+            return 1;
+        }
+        try {
+            const git = new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(here));
+            const base = await git.headSha();
+            const stamp = new Date().toISOString().replace(/[-:T]/g, '').slice(0, 14);
+            const tag = `ws-${stamp}-${Math.floor(Math.random() * 1e6).toString(36)}`;
+            // Its own branch from the outset: a worktree cannot share a checked-out
+            // branch with another, and the round runner cuts its run branch inside.
+            //
+            /**
+             * 🔴 AND IT IS PROVISIONED BEFORE ANYTHING RUNS IN IT. A worktree holds
+             * only what git tracks, the contained gate has no network by design, and
+             * so a second worker's gate could not pass for any project with a
+             * dependency — measured as four rounds red on the same missing toolchain.
+             * `run.carry_into_checkouts` names what must travel; empty means nothing
+             * is copied and this is byte-identical to what it was.
+             *
+             * Read from the config the run itself will read, so the two cannot
+             * disagree about what this checkout needs.
+             */
+            const carry = loadConfig((0, path_1.join)(here, git_driver_1.STATE_DIR, 'config.yaml')).run.carryIntoCheckouts ?? [];
+            workspace = await (0, workspace_1.createWorkspace)(git, here, tag, `looply/${tag}`, base, (0, node_os_1.homedir)(), carry);
+            process.stdout.write(`  workspace: ${workspace}\n`);
+            /**
+             * ⚠️ AND IT SAYS WHAT IT CANNOT DO. The queue is EXECUTION-scoped — one
+             * whole-file rewrite per checkout, which is what makes it safe without a
+             * lock — so a freshly cut workspace starts with an empty one, and a run
+             * there has nothing to pick.
+             *
+             * That is not an oversight: getting work INTO a second execution is a
+             * coordinator's job, and Phase 1 is deliberately not one. What WOULD be an
+             * oversight is a command that cuts a checkout, says nothing, and leaves a
+             * person watching a run end with "nothing to do" and no idea why.
+             */
+            process.stdout.write(`  ${(0, ui_1.dim)('note: a new workspace starts with an empty queue — nothing assigns work to it yet.')}\n`);
+            process.stdout.write(`  ${(0, ui_1.dim)('`looply run --in <path>` runs in a checkout that already has one.')}\n`);
+        }
+        catch (e) {
+            process.stderr.write(`run: could not make a workspace — ${e.message}\n`);
+            return 1;
+        }
+    }
+    /**
+     * 🔴 THE CHEAPEST REFUSAL, ASKED BEFORE THE TWO MOST EXPENSIVE STEPS.
+     *
+     * The runner refuses a dirty tree as `run()`'s first statement — §12 case 1,
+     * because uncommitted work would be folded into round 1's diff and the first
+     * discard would destroy it. That refusal is right and stays where it is.
+     *
+     * ⚠️ BUT `run()` IS CALLED AFTER COMPILE AND VERIFY, WHICH ARE MODEL CALLS.
+     * Measured: a run against a tree with ONE changed path compiled the goal,
+     * verified both items, and only then refused — **five provider calls across
+     * two runs that bought nothing**. The question costs a `git status`.
+     *
+     * ⚠️ IT ASKS ABOUT THE TREE THE RUN WILL ACTUALLY USE, which is the property
+     * that makes it safe: the runner asks the same question of the same checkout,
+     * so this can only ever change WHEN the refusal happens, never WHETHER.
+     *
+     * 🔴 AND IT SKIPS `--dry-run`, WHICH NEVER REACHES THE RUNNER. A dry run
+     * returns before any round begins and is precisely when somebody wants to ask
+     * "what would happen" without committing their edits first; refusing it here
+     * would be a new refusal, not an earlier one.
+     *
+     * ⚠️ An unreadable checkout is NOT refused here. That is the runner's own
+     * question to answer with its own driver, and guessing at it from outside
+     * would refuse runs this has no business judging.
+     */
+    if (!argv.includes('--dry-run')) {
+        const where = workspace ?? process.cwd();
+        let dirty = null;
+        try {
+            dirty = await new git_driver_1.GitDriver((0, git_driver_1.nodeGitExec)(where)).changedPaths();
+        }
+        catch {
+            dirty = null;
+        }
+        if (dirty !== null && dirty.length > 0) {
+            process.stderr.write(`run: working tree has ${dirty.length} changed path(s) — refusing to start (commit or stash first)\n`);
+            return 1;
+        }
+    }
+    const at = argv.indexOf('--config');
+    const configPath = at >= 0 ? argv[at + 1] : '.looply/config.yaml';
+    if (!configPath) {
+        process.stderr.write('run: --config needs a path\n');
+        return 1;
+    }
+    /**
+     * 🔴 A DECLARED CROSS-REPO NEED GATES THE RUN, and it is asked before the
+     * compile for the same reason the dirty tree is: the answer is local and free,
+     * and finding it out after two model calls is money for nothing.
+     *
+     * ⚠️ A DRY RUN IS TOLD, NOT REFUSED. It exists to answer "what would happen",
+     * and what would happen is precisely that this need blocks — so saying so is
+     * the useful answer and refusing would withhold it.
+     */
+    const needsTrouble = await crossRepoNeedsTrouble(configPath);
+    if (needsTrouble !== null) {
+        if (argv.includes('--dry-run')) {
+            process.stdout.write(`dry run: this project would not start — ${needsTrouble}\n`);
+        }
+        else {
+            process.stderr.write(`run: not starting — ${needsTrouble}\n`);
+            process.stderr.write('  `looply repos` shows where each declared repository stands.\n');
+            return 1;
+        }
+    }
+    const hoursAt = argv.indexOf('--hours');
+    let hours;
+    if (hoursAt >= 0) {
+        const raw = Number(argv[hoursAt + 1]);
+        if (!Number.isFinite(raw) || raw <= 0) {
+            process.stderr.write('run: --hours needs a positive number\n');
+            return 1;
+        }
+        hours = raw;
+    }
+    // Passed by whatever asked for this run, so the lease can record which
+    // request it is carrying out. Absent for a hand-typed run, and REFUSED when
+    // present but empty.
+    //
+    // The flag keeps the name it has always had while the value generalises: a
+    // command id when a person tapped Start, `autonomyStartId(C, N)` when a
+    // controller spent an ordinal. Nothing below this line parses it.
+    //
+    // Empty is refused rather than dropped because dropping it produces a run
+    // that is attributed to NOTHING — no lease field, no start mark, no refusal
+    // mark — which is invisible to whatever asked for it, for ever. That is a
+    // worse outcome than not running, and it is a shape only a caller composing
+    // its own identity can reach.
+    const cmdAt = argv.indexOf('--command-id');
+    const commandId = cmdAt >= 0 ? argv[cmdAt + 1] : undefined;
+    if (cmdAt >= 0 && (commandId === undefined || commandId === '')) {
+        process.stderr.write('run: --command-id needs a request identity\n');
+        return 1;
+    }
+    // WHICH TRY THIS IS, when something is counting them.
+    //
+    // Present only for an autonomous Start. A human Start is bounded by the
+    // server's redelivery window and needs no attempt of its own; giving it one
+    // would put a second, smaller cap on a path that has worked for phases and
+    // change behaviour nobody asked to change.
+    const attemptAt = argv.indexOf('--request-attempt');
+    let requestAttempt;
+    if (attemptAt >= 0) {
+        const raw = Number(argv[attemptAt + 1]);
+        if (!Number.isInteger(raw) || raw < 1 || raw > start_attempts_1.MAX_START_REQUEST_ATTEMPTS) {
+            process.stderr.write(`run: --request-attempt needs a whole number from 1 to ${start_attempts_1.MAX_START_REQUEST_ATTEMPTS}\n`);
+            return 1;
+        }
+        if (commandId === undefined) {
+            // An attempt number counts tries at a REQUEST. Without one there is
+            // nothing to count, and nothing to file the claim under.
+            process.stderr.write('run: --request-attempt needs a --command-id\n');
+            return 1;
+        }
+        requestAttempt = raw;
+    }
+    // ───────────────────────────────────────────────────────────────────────────
+    // `--autonomous` IS TRANSPORT, NOT PERMISSION.
+    //
+    // Its only effect is that beginning this run does not consume a person's
+    // pending pause or stop. That is a real power — it lets a run proceed past an
+    // instruction a person left — so a flag on a command line must not be enough
+    // to claim it. Anyone who can type `looply run` could otherwise type
+    // `--autonomous` and walk through somebody's Stop.
+    //
+    // So the flag only ANNOUNCES what the child must independently establish: an
+    // attempt number in range, a request to file it under, and — below, at the
+    // admission seam — an exclusive claim that actually succeeded. The claim is
+    // the proof, because only the autonomy path produces one and the filesystem
+    // decides who gets it.
+    //
+    // Announced without the rest, this is a misuse rather than a lesser request,
+    // and it is refused outright instead of being quietly downgraded. Nothing
+    // legitimate sends one without the other: the launcher emits both together.
+    const announcedAutonomous = argv.includes('--autonomous');
+    if (announcedAutonomous && requestAttempt === undefined) {
+        process.stderr.write('run: --autonomous needs the --request-attempt it belongs to\n');
+        return 1;
+    }
+    // The goal binding, carried across from the daemon. All three or none: a
+    // goal with no version cannot be checked for freshness, and item ids with no
+    // goal name work for nobody. Parsed strictly here rather than half-applied
+    // later, because a run that starts UNBOUND when a goal was asked for works
+    // the whole queue while the phone waits for a goal that never binds.
+    const goalAt = argv.indexOf('--goal-id');
+    const goalId = goalAt >= 0 ? argv[goalAt + 1] : undefined;
+    const versionAt = argv.indexOf('--goal-version');
+    const rawVersion = versionAt >= 0 ? argv[versionAt + 1] : undefined;
+    const itemsAt = argv.indexOf('--item-ids');
+    const rawItems = itemsAt >= 0 ? argv[itemsAt + 1] : undefined;
+    let goalVersion;
+    if (goalId !== undefined) {
+        if (rawVersion === undefined) {
+            process.stderr.write('run: --goal-id needs a --goal-version\n');
+            return 1;
+        }
+        goalVersion = Number(rawVersion);
+        if (!Number.isInteger(goalVersion) || goalVersion < 0) {
+            process.stderr.write('run: --goal-version needs a whole number\n');
+            return 1;
+        }
+    }
+    else if (rawVersion !== undefined || rawItems !== undefined) {
+        process.stderr.write('run: --goal-version and --item-ids need a --goal-id\n');
+        return 1;
+    }
+    // The answer this run is picking up, if a person started again after one.
+    // Carried as an id, resolved against the server inside the run — the daemon
+    // does not tell a run what a decision said, only which decision to go and
+    // read. It needs a goal for the same reason the version does: the resolution
+    // is checked against the pursuit this run is actually bound to.
+    const resumeAt = argv.indexOf('--resumed-from-approval');
+    const resumedFromApprovalId = resumeAt >= 0 ? argv[resumeAt + 1] : undefined;
+    if (resumedFromApprovalId !== undefined) {
+        if (resumedFromApprovalId.length === 0 || resumedFromApprovalId.startsWith('--')) {
+            process.stderr.write('run: --resumed-from-approval needs an approval id\n');
+            return 1;
+        }
+        if (goalId === undefined) {
+            process.stderr.write('run: --resumed-from-approval needs a --goal-id\n');
+            return 1;
+        }
+    }
+    /**
+     * The approved action this Start was accepted to carry out.
+     *
+     * PARSED HERE AND PROVEN NOWHERE HERE. An id on a command line is something
+     * anybody can type, and this flag buys exactly nothing on its own: the run
+     * refuses it unless a durable reservation, written by the Start gate before
+     * this process existed, names this run's own `--command-id`. That check lives
+     * in `governed-run`, where the rest of the governed vocabulary lives.
+     *
+     * The goal requirement is the same one the resume flag has, for the same
+     * reason: an approval belongs to a pursuit at a version, and a run that names
+     * none has nothing to check it against.
+     */
+    const governedAt = argv.indexOf('--governed-approval');
+    const governedApprovalId = governedAt >= 0 ? argv[governedAt + 1] : undefined;
+    if (governedApprovalId !== undefined) {
+        if (governedApprovalId.length === 0 || governedApprovalId.startsWith('--')) {
+            process.stderr.write('run: --governed-approval needs an approval id\n');
+            return 1;
+        }
+        if (goalId === undefined) {
+            process.stderr.write('run: --governed-approval needs a --goal-id\n');
+            return 1;
+        }
+        if (resumedFromApprovalId !== undefined) {
+            // A run picks up an answer or carries one out. Both at once would be a
+            // run acting on a refusal and an approval in the same breath.
+            process.stderr.write('run: a run cannot both resume a decision and carry one out\n');
+            return 1;
+        }
+    }
+    // An empty value is not an empty id: `--item-ids ''` means "adopt nothing
+    // new", which is what a second run of the same goal asks for. Splitting it
+    // naively would produce one item whose id is the empty string.
+    const itemIds = rawItems === undefined ? undefined : rawItems === '' ? [] : rawItems.split(',');
+    if (itemIds?.some((i) => i.length === 0)) {
+        process.stderr.write('run: --item-ids has an empty id\n');
+        return 1;
+    }
+    // ─────────────────────────────────────────────────────────────────────────
+    // THE ADMISSION SEAM.
+    //
+    // Before the config is read, before the goal is resolved, before the lease is
+    // taken, before a single agent call — this process states that it is the one
+    // executing this attempt, and the filesystem decides whether it is.
+    //
+    // It is HERE, in the child, rather than in the daemon that spawned it,
+    // because children are detached and outlive their parents. A claim written by
+    // the daemon would record the identity of a process whose death proves
+    // nothing about whether the run is still going; a claim written here records
+    // the identity of the only process that can go on to do the work.
+    //
+    // The loser exits by its own door. It has decided nothing about the goal, so
+    // it writes no refusal mark and no start mark — there is nothing to say.
+    let autonomous = false;
+    if (requestAttempt !== undefined && commandId !== undefined) {
+        /**
+         * 🔴 THE AUTHORITY TRAIL IS THE DAEMON'S AND THE PROJECT'S, NOT THIS
+         * CHECKOUT'S — AND READING IT FROM THE WORKSPACE REFUSED EVERY PLACED RUN.
+         *
+         * This was `join(workspace ?? process.cwd(), STATE_DIR, 'state')`, which is
+         * EXECUTION-scoped. Every file it looks for is written by the DAEMON: the
+         * adopted controller, the validated ordinal reservation under it, and the
+         * launch receipt for this attempt. The daemon writes them in its own
+         * checkout; a run the coordinator placed in a workspace looked in the
+         * workspace, found an empty directory, and exited with
+         *
+         *     run: no grant on this machine reserved a Start by that name
+         *
+         * MEASURED end to end, and reachable no other way: every unit test on this
+         * path runs in a single checkout, where the project and execution state
+         * directories are THE SAME PATH, so the distinction is invisible. It only
+         * appears the moment a run is placed somewhere else — which is the entire
+         * point of a coordinator.
+         *
+         * `projectStateDir` resolves the repository's identity, so it answers the
+         * same path from the main checkout and from any linked worktree of it. In
+         * an ordinary single-checkout project that path is exactly what this line
+         * produced before, so nothing about Simple Mode changes.
+         */
+        const stateDir = (0, git_driver_1.projectStateDir)(workspace ?? process.cwd());
+        // ─────────────────────────────────────────────────────────────────────
+        // AUTHORITY BEFORE EXCLUSIVITY.
+        //
+        // The exclusive claim below proves UNIQUENESS: one process owns this
+        // attempt. It was being read as permission, and it is not. A certification
+        // pass showed the gap in one line — invent a request id, claim attempt 1
+        // of it uncontested, and the autonomous policy was granted, with no grant,
+        // no controller and no ordinal anywhere in existence.
+        //
+        // So this asks first, and asks about durable facts the DAEMON wrote: an
+        // adopted controller, a validated ordinal reservation under it, a request
+        // id that pair derives, a launch receipt for this attempt, and a spawn
+        // record that — if it has been written yet — describes this process.
+        //
+        // The child asks the server nothing. It does not need to: the daemon
+        // reconciled with the server before it reserved anything, and every step
+        // after that left a file. This is that trail, read back.
+        const authority = await (0, autonomy_authority_1.checkAutonomyAuthority)({ stateDir, fs: start_attempts_1.nodeAttemptFs, pid: process.pid, host: (0, node_os_1.hostname)() }, commandId, requestAttempt);
+        if (!authority.ok) {
+            // NOT a refusal about the goal. Nothing here has looked at a goal, a
+            // queue or a repository — this process simply was not asked for. It
+            // leaves by the non-semantic door, so nothing downstream may conclude
+            // anything about the work.
+            process.stderr.write(`run: ${authority.because}\n`);
+            return run_cmd_1.EXIT_ATTEMPT_CLAIMED;
+        }
+        const attempts = new start_attempts_1.StartAttempts(stateDir, start_attempts_1.nodeAttemptFs);
+        const claimed = await attempts.claim(commandId, requestAttempt);
+        if (!claimed.ok) {
+            process.stderr.write(`run: ${claimed.because}\n`);
+            return run_cmd_1.EXIT_ATTEMPT_CLAIMED;
+        }
+        // EARNED TWICE OVER. The daemon authorized this exact execution, and this
+        // process is the one that got in.
+        autonomous = announcedAutonomous;
+    }
+    /**
+     * RESOLVED INSIDE THE WORKSPACE when there is one. The default
+     * `.looply/config.yaml` is relative, and a run in another checkout must read
+     * THAT checkout's config — otherwise two workspaces would run whichever gates
+     * belonged to the directory the operator happened to be standing in. An
+     * explicit absolute `--config` still wins, because `resolve` leaves it alone.
+     */
+    const cfg = loadConfig(workspace === undefined ? configPath : (0, path_1.resolve)(workspace, configPath));
+    for (const w of (0, config_1.configWarnings)(cfg))
+        process.stdout.write(`warning : ${w}\n`);
+    const log = (line) => {
+        process.stdout.write(`${line}\n`);
+    };
+    let summary;
+    try {
+        summary = await (0, run_cmd_1.runLoop)({
+            cwd: workspace ?? process.cwd(),
+            config: cfg,
+            /**
+             * ⚠️ ASKED PER PICK, NOT ONCE. A sibling publishes while this run is
+             * working, and an item blocked at round 3 should be pickable at round 9 —
+             * a context captured at startup would keep it waiting all night.
+             */
+            crossRepo: () => crossRepoContext(workspace ?? process.cwd(), cfg),
+            ...(hours !== undefined ? { hours } : {}),
+            // `!== undefined`, like every field beside it. Under a truthiness test an
+            // EMPTY `--command-id` was silently dropped, and a run with no request
+            // identity writes no lease field, no start mark and no refusal mark — it
+            // is invisible to whatever asked for it, for ever. Unreachable for a
+            // server command, which always has an id; reachable the moment a
+            // controller composes one.
+            ...(commandId !== undefined ? { commandId } : {}),
+            ...(autonomous ? { autonomous: true } : {}),
+            ...(goalId === undefined ? {} : { goalId }),
+            ...(goalVersion === undefined ? {} : { goalVersion }),
+            ...(itemIds === undefined ? {} : { itemIds }),
+            ...(resumedFromApprovalId === undefined ? {} : { resumedFromApprovalId }),
+            ...(governedApprovalId === undefined ? {} : { governedApprovalId }),
+            dryRun: argv.includes('--dry-run'),
+            /**
+             * 🔴 THE ONLY WAY A PERSON AT A TERMINAL CAN CLEAR A SAFETY HOLD, and
+             * until now there was none. A hold has no expiry by design; the one
+             * retry it carries was spendable only by a paired phone's Start. A
+             * `looply run --goal-id G --goal-version 1` that hit a hold was told to
+             * "start it again", and starting it again hit the same fence for ever.
+             *
+             * ⚠️ IT SPENDS, IT DOES NOT DISABLE. Same exclusive create the daemon
+             * uses, so the second invocation is refused rather than granted.
+             */
+            tryOnceMore: argv.includes('--try-once-more'),
+            log,
+        });
+    }
+    catch (e) {
+        // A refusal retrying cannot fix leaves by its own door. The daemon that
+        // spawned this reads the exit code and stops offering the command, rather
+        // than handing it back every few seconds for the rest of the redelivery
+        // window — which is noise, not resilience. Everything else keeps exiting 1
+        // and stays retryable.
+        if (!(e instanceof run_cmd_1.RunRefused))
+            throw e;
+        // Two audiences, one decision. A person watching a terminal reads this;
+        // the daemon that spawned this cannot, because it spawns with
+        // `stdio: 'ignore'` on a detached child, so the words go nowhere. Both are
+        // told, by the channel each can actually hear.
+        process.stderr.write(`${e.message}
+`);
+        // Only when something asked. A hand-typed `looply run` has no request to
+        // answer, and writing a mark nobody will ever look up would make this file
+        // a log of every refusal rather than an index of the outstanding one.
+        //
+        // `!== undefined`, matching the forwarding guard above: the two must agree
+        // about what counts as a request, or a run could be attributed on the lease
+        // and unattributed in its refusal. An empty id never reaches here anyway —
+        // it is refused at the parse — and this says so rather than relying on it.
+        //
+        // ONLY the RunRefused message. Not the stack, not anything else this
+        // process printed — `Command.reason` is read by a client, and a refusal is
+        // a decision the machine chose to report, not whatever happened to be on
+        // its way out.
+        if (commandId !== undefined) {
+            try {
+                // The SAME expression the run process uses, not a relative one that
+                // happens to agree: a mark written anywhere else is a mark nobody reads.
+                //
+                // 🔴 IT SAID `process.cwd()` AND MEANT IT, and `--in` made that false.
+                // `runLoop` is given `cwd: workspace ?? process.cwd()` and the admission
+                // seam claims its attempt under the same expression, so a run executing
+                // in a workspace wrote its StartAttempts claim in one directory and its
+                // refusal in another. The phone would then wait out the full retry
+                // window for a reason that was already on disk, one directory over.
+                //
+                // ⚠️ RESIDUAL, STATED RATHER THAN PAPERED OVER: the DAEMON reads marks
+                // from its own state directory. That still meets this one, because
+                // nothing passes `--in` to a daemon-launched run — `--command-id` and
+                // `--in` never appear together today. A later phase that launches into
+                // workspaces must move this channel to project scope AND make it
+                // append-only first: it is a whole-document rewrite, so sharing it
+                // between concurrent runs without that is the lost-update class.
+                /**
+                 * 🔴 PROJECT-SCOPED, AS THE COMMENT ABOVE PREDICTED IT WOULD HAVE TO
+                 * BE. "A later phase that launches into workspaces must move this
+                 * channel to project scope AND make it append-only first" — this is
+                 * that phase, and `RunRefusalMarks` now appends beside its index for
+                 * exactly the lost-update reason named there.
+                 *
+                 * The daemon reads this from the PROJECT's state, so a placed run
+                 * writing it beside its workspace left every refusal unreadable: the
+                 * launcher fell back to "the run exited — exit 3" with no code, and
+                 * nothing downstream could conclude anything about the goal.
+                 */
+                const marks = new run_refusal_marks_1.RunRefusalMarks((0, git_driver_1.projectStateDir)(workspace ?? process.cwd()), ledger_store_1.nodeLedgerFs);
+                await marks.load();
+                // The CODE as well as the words. `e` is a `RunRefused` — the line above
+                // rethrows anything else — so its code is in scope and typed here, and
+                // until 6D2A it was simply dropped on the floor at this one line.
+                await marks.record({
+                    commandId,
+                    reason: e.message,
+                    code: e.code,
+                    // M5-2: and the branch, when the run had one — the lane's key to the grant.
+                    ...(e.branch === undefined ? {} : { branch: e.branch }),
+                    // L4b: and what key 2 confirmed, on a met goal -- the facts the settle carries.
+                    ...(e.delivery === undefined ? {} : { delivery: e.delivery }),
+                    at: new Date().toISOString(),
+                });
+            }
+            catch {
+                // Never fatal, and never changes the answer. Failing to write the
+                // reason costs the phone a sentence; failing to exit 3 would cost it
+                // the refusal itself, and be retried every three seconds for an hour.
+            }
+        }
+        return run_cmd_1.EXIT_REFUSED;
+    }
+    const { rounds, committed, discarded, abandoned } = summary.totals;
+    log('');
+    log(`stopped : ${summary.stopReason}`);
+    log(`rounds  : ${rounds} — ${committed} kept, ${discarded} discarded, ${abandoned} abandoned`);
+    // A run that never discarded anything is not a triumph, it is a signal: the
+    // prover is the only thing that can fail a round on quality, and one that
+    // never fires is one that is not working.
+    if (rounds >= 10 && discarded === 0 && cfg.proof.enabled) {
+        log('');
+        log('note    : nothing was discarded across the whole run. A prover that never');
+        log('          rejects is usually misconfigured rather than lucky — check it.');
+    }
+    return 0;
+}
+/**
+ * Read enough of the world to render the welcome or the agent snapshot.
+ *
+ * Every read is optional. A folder with no looply in it must still get a useful
+ * screen, so a missing file is a fact about the state rather than an error.
+ */
+function readWorld() {
+    let config = null;
+    try {
+        config = (0, config_1.parseConfig)((0, fs_1.readFileSync)((0, path_1.resolve)('.looply/config.yaml'), 'utf8'));
+    }
+    catch {
+        config = null;
+    }
+    let status = null;
+    try {
+        const parsed = JSON.parse((0, fs_1.readFileSync)((0, path_1.resolve)('.looply/state/status.json'), 'utf8'));
+        status = parsed;
+    }
+    catch {
+        status = null;
+    }
+    let items = [];
+    try {
+        const parsed = JSON.parse((0, fs_1.readFileSync)((0, path_1.resolve)('.looply/state/queue.json'), 'utf8'));
+        if (Array.isArray(parsed))
+            items = parsed;
+        else if (parsed && typeof parsed === 'object' && Array.isArray(parsed.items)) {
+            items = parsed.items;
+        }
+    }
+    catch {
+        items = [];
+    }
+    let machine = { paired: false, id: null, serverUrl: null };
+    try {
+        const identity = new machine_store_1.MachineStore((0, machine_store_1.machineFilePath)()).load();
+        if (identity)
+            machine = { paired: true, id: identity.machineId, serverUrl: identity.serverUrl };
+    }
+    catch {
+        // A corrupt identity file is reported by `pair` and `daemon`, which can act
+        // on it. Here it just means "not paired" for display purposes.
+    }
+    return { config, status, items, machine };
+}
+/** The bare `looply` screen: where you are, what you can do, what to do next. */
+function welcome() {
+    const world = readWorld();
+    const status = world.status;
+    process.stdout.write((0, welcome_1.renderWelcome)({
+        paired: world.machine.paired,
+        ...(world.machine.id ? { machineName: world.machine.id } : {}),
+        ...(world.machine.serverUrl ? { serverUrl: world.machine.serverUrl } : {}),
+        configured: world.config !== null,
+        ...(world.config ? { projectName: world.config.project.name } : {}),
+        readyItems: world.items.filter((i) => i.state === 'ready').length,
+        draftItems: world.items.filter((i) => i.state === 'draft' || i.state === 'verifying').length,
+        runLive: status?.live === true,
+        currentItem: status?.round?.title ?? null,
+    }, daemon_cmd_1.CLI_VERSION));
+    return 0;
+}
+/**
+ * `looply agent` — state for another program.
+ *
+ * Exits 0 whenever it could answer, including "nothing is running". A non-zero
+ * exit means the question could not be answered, never that the answer was dull.
+ */
+function agent(argv) {
+    const world = readWorld();
+    const snapshot = (0, agent_cmd_1.buildSnapshot)({
+        cliVersion: daemon_cmd_1.CLI_VERSION,
+        config: world.config,
+        status: world.status,
+        items: world.items,
+        machine: world.machine,
+        now: Date.now(),
+    });
+    const json = argv.includes('--json') || !argv.includes('--text');
+    process.stdout.write(json ? (0, agent_cmd_1.renderAgentJson)(snapshot) : (0, agent_cmd_1.renderAgentText)(snapshot));
+    return 0;
+}
+async function main(argv) {
+    // Honoured before anything prints, so a piped or redirected run is clean.
+    if (argv.includes('--no-color'))
+        (0, ui_1.setColor)(false);
+    const [cmd, ...rest] = argv.filter((a) => a !== '--no-color');
+    switch (cmd) {
+        case 'init':
+            return init(rest);
+        case 'doctor':
+            return doctor(rest);
+        case 'pair':
+            return pair(rest);
+        case 'daemon':
+            return daemon(rest);
+        case 'serve':
+            return (0, serve_cmd_1.serveCommand)(rest, (0, serve_cmd_1.nodeServeDeps)());
+        case 'scan':
+            return scan(rest);
+        case 'verify':
+            return verify(rest);
+        case 'queue':
+            return queue(rest);
+        case 'integrate':
+            return integrate(rest);
+        case 'runs':
+            return runs(rest);
+        case 'source':
+            return (0, source_cmd_1.sourceCommand)(rest, (0, source_cmd_1.nodeSourceDeps)());
+        case 'stop':
+            return stop(rest);
+        case 'pause':
+            return pauseOrResume('pause', rest);
+        case 'resume':
+            return pauseOrResume('resume', rest);
+        case 'run':
+            return run(rest);
+        case 'status':
+            return status();
+        case 'report':
+            return report();
+        case 'goal':
+            return goal(rest);
+        case 'goals':
+            return goals();
+        case 'repos':
+            return (0, repos_cmd_1.reposCommand)(rest, nodeReposDeps());
+        case 'sessions':
+            return (0, sessions_cmd_1.sessionsCommand)(rest, nodeSessionsDeps());
+        case 'evidence':
+            return (0, evidence_cmd_1.evidenceCommand)(rest, nodeEvidenceDeps());
+        case 'version':
+        case '--version':
+        case '-v':
+            process.stdout.write('0.1.0\n');
+            return 0;
+        case undefined:
+            return welcome();
+        case 'agent':
+            return agent(rest);
+        case 'help':
+        case '--help':
+        case '-h':
+            process.stdout.write(USAGE);
+            return 0;
+        default:
+            process.stderr.write(`looply: unknown command ${JSON.stringify(cmd)}\n\n${USAGE}`);
+            return 64;
+    }
+}
+/* istanbul ignore next — process wiring, exercised by running the binary */
+if (require.main === module) {
+    main(process.argv.slice(2)).then((code) => {
+        process.exitCode = code;
+    }, (e) => {
+        process.stderr.write(`${e.message}\n`);
+        process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=bin.js.map