task-pipeline-skill 1.95.0 → 1.96.0

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -97,7 +97,8 @@ This spans the whole run, not one stage:
   finished.
 
 It stops for exactly four things: an unmet `manual` gate, a block it cannot resolve, a
-genuine ambiguity the brief does not answer, and completion.
+genuine ambiguity the brief does not answer, and completion — the iteration's finish line
+reached ([`finish-line.md`](finish-line.md)), never a search that ran dry.
 
 **A block or an ambiguity stops its node, not the run.** An ambiguity whose answer is
 internal and reversible is not a stop at all: the run takes the recommended answer, records
@@ -112,6 +113,11 @@ recorded reasons: external waits go on watchers, human decisions go into the que
 batch. Exit 4 does not prove a human gate or completion. A watcher keeps the recorded
 next action alive while no independent node is runnable. **When the board is empty, say so once**, and do not invent work to fill it.
 
+**Stop is not idle.** A finish line reached closes that iteration — stages 9–10, the
+hand-back, the retro — and on an armed loop the highest-priority board row starts a new
+iteration with its own contract. Re-opening the closed one to polish it is not continuing
+([`finish-line.md`](finish-line.md) → *Stop is not idle*).
+
 **This extends [`build.md`](build.md); it does not replace it.** That file's
 *Continuous execution* rule governs the inside of a stage-5 execution — do not
 check in between the tasks of a plan you were told to execute. It is unconditional

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -59,6 +59,7 @@ Custom profiles use their own declared stages and doctrine, with the kernel inta
 | **first run in a project** (new or existing) | `references/adoption.md` |
 | **first run · the entry audit** (offered once) | `references/setup.md` |
 | **what travels with the bundle vs stays in a project** | `references/portability.md` |
+| 0–10 · when an iteration stops — the contract fixed at intake, triage at discovery, the round budget | `references/finish-line.md` |
 | any repeating loop | `references/loop-guard.md` |
 | run-wide · what the run **leaves running and leaves behind** — every gate, and stage 10 | `references/residue.md` |
 | run-wide · what the run **prints about itself** — the rail, the iteration line | `references/progress.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/finish-line.md

@@ -0,0 +1,145 @@
+# The finish line — when an iteration stops
+
+An iteration stops when the work it promised is done **on the artefact the operator uses**.
+It does not stop when a search runs dry, because a search never does: every reading finds
+something, every fix is new surface for the next reading, and find → fix → find has no end of
+its own. This file is that end. The verdict is computed by `scripts/waves.py finish`.
+
+## Contents
+
+- The contract, fixed at intake
+- Triage at discovery
+- Rounds and the stop
+- Computing the verdict
+- Stop is not idle
+- The finish block
+- Rationalizations
+
+## The contract, fixed at intake
+
+The brief's `## Finish line` ([`../templates/brief.md`](../templates/brief.md)) carries five
+fields, written at stage 0 and confirmed with the brief:
+
+- **Objective** — one sentence: what is true when this iteration is done.
+- **Exit checks** — REQ ids, each with its command, run on the artefact the operator uses:
+  released, installed or deployed. A branch is not that artefact.
+- **Scope** — the modules, paths and REQ ids this iteration may change, as a list.
+- **Budget** — `run.finish.maxRounds` (default 3) and `run.finish.maxReleases` (default 2),
+  from `pipeline.json` ([`../pipeline.schema.json`](../pipeline.schema.json)).
+- **Base** — the commit the iteration started from.
+
+Widening the scope is a recorded revision of the brief, with the operator's go. A finding is
+not one.
+
+## Triage at discovery
+
+Every finding that reaches a round is classed when it is found, before anyone fixes it. First
+match wins. A defect in a node's own diff, caught before the node closes, follows
+[`review.md`](review.md) instead: Critical and Important block that node.
+
+**Blocking**, when:
+- **B1** — an exit check is red.
+- **B2** — it is, or once released would be, a hotfix-lane entry. The list's single home is [`iteration.md`](iteration.md)
+  → *No fix travels alone*; restated here, kept equal by the validator:
+  - production is down
+  - data is being lost or corrupted
+  - a credential has leaked
+  - a security hole is open to someone outside
+  - money or a legal obligation is failing
+- **B3** — the failing scenario passes at Base: this iteration broke it.
+- **B4** — a REQ marked `verified`, or a claim this iteration publishes, is false on the
+  artefact. A published claim beyond the REQs may instead be narrowed in the same change.
+
+**Deferred** — real, with a receipt, and no B test matches. It becomes a board row with its
+evidence, its priority inputs ([`prioritisation.md`](prioritisation.md)) and
+`found-in: <iteration>`. It is not fixed now.
+
+**Noise** — no reproducible receipt; a duplicate (append its evidence to the existing row); a
+Minor with no behavioural consequence; or an environment transient named by its cause. One
+ledger line, nothing else.
+
+Severity words, effort and "it is a one-line fix" never change the class. Each finding leaves
+one line in the run ledger ([`../templates/run.md`](../templates/run.md)):
+
+```
+finding: <id> — blocking:B<n> | deferred:B-NNN | noise — round <N> — base-repro yes|no|n/a
+```
+
+## Rounds and the stop
+
+A **round** is every exit check run once, plus one independent reading over the Scope: an
+audit axis, an observer, or the post-release readback. Rotating the axis
+([`audit.md`](audit.md)) never adds a round. Only new blocking findings count.
+
+- **Done** — every exit check green on the artefact, and two consecutive rounds with no new
+  blocking finding. The second of them may read only the last fix's diff.
+- **Diverging** — new blocking findings did not fall from one round to the next, or
+  self-inflicted ≥ new. Run [`loop-guard.md`](loop-guard.md)'s break protocol.
+- **Budget spent** — `maxRounds` or `maxReleases` reached before done: a blocker open, or the
+  second clean round still owed. Stop and hand the iteration back: each open blocker becomes a
+  top board row marked `needs-operator`. No round runs past the budget without the operator's
+  go, given with the numbers; a done reached past it without that go is still `budget`.
+
+The finish word is one of three: `done`; `budget`, the budget reached before done; `blocked`,
+the rounds diverging, handed to the loop guard. Deferred findings never extend an iteration.
+
+Each round leaves one ledger line, clean rounds included, because a clean round leaves no
+finding to count:
+
+```
+round: <N> — <reading> — new blocking <k>
+```
+
+## Computing the verdict
+
+```
+python3 scripts/waves.py finish --inventory <inventory.json> --ledger .task-pipeline/run.md \
+  --max-rounds 3 --max-releases 2 --releases <n> --checks <k>/<m> --artefact <name>@<sha>
+```
+
+`--rounds N` may stand in for `--ledger`; with neither the count is unknown and the script
+refuses. Exit codes:
+
+- `0` — done: the last two rounds found no new blocking item, none is open, and every exit
+  check is green on the artefact.
+- `3` — continue: a blocker open, a second clean round owed, or no `--checks` given.
+- `5` — budget: reached before done, or done past it without `--operator-go`.
+- `6` — blocked: diverging; run the loop guard's break protocol.
+- `1` — malformed: the inventory, the ledger or the arguments, each reason named.
+
+## Stop is not idle
+
+Reaching the finish line closes the iteration. It does not end the work.
+
+1. Close it: stages 9–10, the hand-back ([`progress.md`](progress.md) → *The hand-back*), the
+   retrospective.
+2. On an armed loop ([`continuity.md`](continuity.md)), take the highest-priority board row as a
+   **new** iteration with its own contract. Choose by priority, not recency: the row found last
+   is not next because it is fresh.
+3. Re-opening a closed iteration to polish it is the loop this rule ends.
+
+## The finish block
+
+Printed at stage 10, beside the verdict, and in the hand-back's `FINISH` field:
+
+```
+finish: done | budget | blocked — rounds <n>/<max> — releases <n>/<max>
+  exit checks: <k>/<m> green on <artefact>@<sha>
+  blocking: <n> open · <n> fixed
+  deferred: <n> → <ids, top priority first>
+  noise: <n>
+  known risks: <deferred rows at blast 3 or rung I4+, or none>
+  next: B-NNN (new iteration) | board empty
+```
+
+## Rationalizations
+
+| Excuse | Reality |
+|---|---|
+| "One more pass, it keeps finding things" | Every reading finds something. Only a new blocking finding argues for another round |
+| "It is a one-line fix, do it now" | Effort never changes the class. A deferred finding is a board row |
+| "This one is critical" | A severity word is not a B test. Name B1–B4, or defer it |
+| "Rotate the axis and keep going" | Rotation happens inside the round budget, never on top of it |
+| "The budget is nearly enough, one more round" | A round past the budget needs the operator's go, with the numbers |
+| "The deferred list is long, so we are not done" | Deferred findings never extend an iteration |
+| "Re-open the last iteration, it is nearly perfect" | That is the loop this rule ends. Take the top board row as a new iteration |

package/plugins/task-pipeline/skills/task-pipeline/references/iteration.md

@@ -36,7 +36,8 @@ A fix designed against today's state is the intermediate state that
 seam, and the fix is then paid for twice. The finding gets an id in its owning register
 and lands on a canvas node. Its wave decides when it is built.
 
-**The hotfix lane is the only exception, and it is closed.** It has five entries:
+**The hotfix lane is the only exception, and it is closed.** This list is its single home;
+[`finish-line.md`](finish-line.md)'s blocking test B2 cites it. It has five entries:
 - production is down;
 - data is being lost or corrupted;
 - a credential has leaked;
@@ -57,12 +58,12 @@ reason. "It is quick" is not one of the five entries.
 | 4 | Question round | answers from the sources, then one batch to the operator | every question is answered, assumed, or blocks a named node |
 | 5 | Plan | the work graph with waves and risk classes — `scripts/waves.py sync-graph` writes each node's `wave` and `risk` from the plan, so `graph.py close` enforces the rounds it owes — and one packet per node | every REQ lands on a node; [`planning.md`](planning.md)'s set comparison holds |
 | 6 | Build | parallel agents, each owning disjoint files | each node is committed on its branch, with its own checks green |
-| 7 | Verify | rounds per node, starting as each node lands | each node passes its risk class's rounds |
+| 7 | Verify | rounds per node, starting as each node lands; each finding triaged at discovery ([`finish-line.md`](finish-line.md)) | each node passes its risk class's rounds |
 | 8 | Seam check | cross-module checks per seam group | every seam the canvas names is exercised end to end |
 | 9 | Docs | stage 9 over everything the release iteration shipped | the doc gate passes and the docs match the code |
 | 10 | Release | versions, tags, pins, changelogs, in dependency order | the published artefacts resolve |
-| 11 | Post-release check | the stage-8 trio on what was released | every item the release claims closed is checked on the released artefact |
-| 12 | Next pool | the re-measured inventory and the proposal | the hand-back is sent |
+| 11 | Post-release check | the stage-8 trio on what was released, read as a finish-line round | every item the release claims closed is checked on the released artefact, and `finish:` is computed |
+| 12 | Next pool | the re-measured inventory and the proposal | the hand-back, with its `finish:` line, is sent |
 | 13 | Retrospective | the project retro, plus the shared lesson store where one exists | written last ([`retrospective.md`](retrospective.md)) |
 
 Steps 1–4 are stages 0–4 run once. Steps 6–8 are stages 5–8 per wave, and a wave's
@@ -218,7 +219,10 @@ actually published, installed or deployed — never on the branch. Each item the
 claims closed is re-checked against the released artefact. For installed packages and
 skills, follow [`deploy-targets.md`](deploy-targets.md) → *The verification trio*: update
 within the authorized rollout and read back each claimed installed channel. A failure goes to the hotfix
-lane if it is one of its five entries. Otherwise it goes to the next pool, with an id.
+lane if it is one of its five entries. Every post-release failure is triaged at the finish
+line ([`finish-line.md`](finish-line.md) → *Triage at discovery*): a blocking one is fixed in
+this release iteration, and the corrective release counts against `run.finish.maxReleases`; a
+deferred one goes to the next pool, with an id.
 
 ## The next pool
 

package/plugins/task-pipeline/skills/task-pipeline/references/loop-guard.md

@@ -101,6 +101,11 @@ review cap reached — 3 rounds — artifact: test/validate.py
 - **New > self-inflicted** — the reader is still paying. Continuing is then the
   operator's call, made with the numbers in hand rather than out of fatigue.
 
+At the level of a whole iteration only new **blocking** findings argue for continuing; a
+deferred or noise finding is paid for on the board, not with another round
+([`finish-line.md`](finish-line.md) → *Rounds and the stop*). The class is read from the
+run ledger's `finding:` lines and the rounds from its `round:` lines, never from memory.
+
 **The pair is the whole point.** A round count alone says how tired everyone is; the
 pair says whether the loop still produces anything. Measured on one file once, the
 guard's shapes and the run's own prose disagreed — one still paying, one exhausted —

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -64,6 +64,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | The entry audit and what it inspects | `references/setup.md` |
 | The ladder, seams, axis rotation, ratchets | `references/audit.md` |
 | Loop detection and its caps | `references/loop-guard.md` |
+| **The finish line** — when an iteration stops: the contract, triage at discovery, the round budget | `references/finish-line.md` |
 | **What the run prints about itself** — the header block, the rail, the iteration line | `references/progress.md` |
 | **What the run leaves running and leaves behind** — the eight classes, the `holds:` field, the teardown | `references/residue.md` |
 | **The run mode** — item-by-item pacing, default off, what it never collapses | `references/continuity.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/progress.md

@@ -169,6 +169,9 @@ SCOPE       what this claim covers: the commit, the environment, the REQ
 NOT VERIFIED what was built and NOT checked, or could not be. The literal
             `none within the stated scope` is a valid answer; an empty
             field is not
+FINISH      finish: done | budget | blocked — the finish block, as
+            finish-line.md prints it; mid-iteration, the round and
+            the open blocking count
 
 DECISIONS WAITING  <n>   each as a question with options, asked HERE
 AMBIGUITIES        <n>   computed, below
@@ -189,6 +192,11 @@ And `none within the stated scope` is a claim with a subject — it says *nothin
 what SCOPE names is unverified*. Leaving the field empty says nothing at all, which reads
 as the same thing and is not: canon 9a, one artifact over.
 
+**`FINISH` says why the iteration stopped** ([`finish-line.md`](finish-line.md) → *The
+finish block*): `done` with its exit checks green on the artefact, `budget` with each open
+blocker a `needs-operator` board row, or `blocked`. A hand-back that cannot fill it has not
+reached a finish line, and says which round it is in.
+
 **Where there is no brief** — `checkup`, `setup`, a short path — TASK quotes the
 operator's own sentence instead, marked as such. An unquotable TASK is a run that cannot
 say what it was asked, which is worth its own line.

package/plugins/task-pipeline/skills/task-pipeline/references/review.md

@@ -108,14 +108,19 @@ Review in this order; stop reading the diff only when you've covered all of it.
 **Severities:**
 
 - **Critical** — wrong behavior, data loss, security hole, a red or dishonest test
-  suite. Blocks.
+  suite. Blocks the node when the defect is in its diff or caused by it.
 - **Important** — a real defect or spec gap that will bite: missing requirement,
-  unhandled failure path, a magic value the constraints named. Blocks.
+  unhandled failure path, a magic value the constraints named. Blocks the node when the
+  defect is in its diff or caused by it.
 - **Minor** — style, naming, a nit with no behavioral consequence. Never blocks;
   goes to the ledger.
 - **⚠️ Cannot verify from diff** — the requirement lives in unchanged code or spans
   tasks. Not a blocker for the reviewer; the controller resolves it.
 
+**A pre-existing defect the reviewer notices** — one the diff neither contains nor
+causes — does not block the node, whatever its severity. It goes to finish-line triage
+([`finish-line.md`](finish-line.md) → *Triage at discovery*).
+
 Formatting nits that don't change meaning are not findings. Praise is not a
 finding either.
 

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -103,7 +103,9 @@ never that the work was skipped quietly.
   is now stale), no open contradictions, **every
   autonomy-sweep row is answered or explicitly marked "stop and ask here"**, **a
   user-facing task's brief names its `surface_class`**, the
-  **REQ table is written and every row names its check**, the carry-over ledger is
+  **REQ table is written and every row names its check**, **the brief's `## Finish line`
+  is filled — objective, exit checks on the artefact the operator uses, scope, budget and
+  base** ([`finish-line.md`](finish-line.md)), the carry-over ledger is
   seeded, **`.task-pipeline/run.md` exists and the header block has been printed**
   ([`progress.md`](progress.md)), the model decision is recorded, and the operator
   confirms the brief. Stop when a
@@ -379,7 +381,9 @@ never that the work was skipped quietly.
   surfaced that nobody asked for, every decision still waiting **asked here with
   options rather than listed**, and the ambiguity count computed from the four
   registers with its ids ([`progress.md`](progress.md) → *The hand-back*) — a run
-  that cannot say what happened has not finished, it has stopped; **the environment is
+  that cannot say what happened has not finished, it has stopped; **the `finish:` line is
+  printed beside this verdict — `done`, `budget` or `blocked`, with its block**
+  ([`finish-line.md`](finish-line.md) → *The finish block*); **the environment is
   given back** — all eight classes enumerated, everything this run started ended and
   verified by re-enumerating rather than by the teardown's reply, an earlier run of
   this project ended only when **provably spent**, an item this project does not own

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -211,11 +211,13 @@ In this order, inside the wave rather than after it:
 1. **Verify.** Every node the wave closes is certified ([`certification.md`](certification.md)),
    most of it already, as each node landed,
    and [`audit.md`](audit.md)'s exit is re-measured over what the wave touched.
-2. **Finish and fix — one fix round**, inside [`loop-guard.md`](loop-guard.md)'s caps.
-   Findings against this wave's nodes are fixed here or parked with a board row and reason.
-   Findings elsewhere join the inventory for a planned node; only the closed hotfix lane
-   bypasses that design ([`iteration.md`](iteration.md) → *No fix travels alone*). Nothing
-   is dropped silently.
+2. **Finish and fix — one fix round, for blocking findings only**, inside
+   [`loop-guard.md`](loop-guard.md)'s caps. Every finding is triaged when found
+   ([`finish-line.md`](finish-line.md) → *Triage at discovery*): blocking findings against
+   this wave's nodes are fixed here or parked with a board row and reason; deferred ones
+   become board rows; noise is one ledger line. Findings elsewhere join the inventory for a
+   planned node; only the closed hotfix lane bypasses that design
+   ([`iteration.md`](iteration.md) → *No fix travels alone*). Nothing is dropped silently.
 3. **Document** — the Doc Loop and the stage-9 propagation matrix
    ([`documentation.md`](documentation.md)), scoped to the wave: scenarios, decisions,
    docs and registers in the same change as the code.
@@ -224,7 +226,8 @@ In this order, inside the wave rather than after it:
    items, not only the board*). A re-plan is a committed `revisions` entry plus a canvas
    edit, never a quiet change.
 6. **Re-measure the inventory and re-cut the remaining waves** from the updated target —
-   never from the original guess. New findings join the inventory with ids.
+   never from the original guess. New findings join the inventory with ids and their
+   triage class; a deferred one never adds a wave to this release.
 
 ## A board bigger than one release
 

package/plugins/task-pipeline/skills/task-pipeline/scripts/graph.py

@@ -1580,7 +1580,7 @@ def cmd_producer(graph, args):
 def cmd_doctrine(graph, args):
     """Which doctrine this run actually read — B-061.
 
-    The bundle is 52 reference files. A run reads some subset and nothing recorded which,
+    The bundle is 53 reference files. A run reads some subset and nothing recorded which,
     so **a skipped file and a read one were indistinguishable** — the class every guard in
     this repository exists to catch, left standing over the doctrine itself.
 

package/plugins/task-pipeline/skills/task-pipeline/scripts/waves.py

@@ -30,6 +30,22 @@ reviewed; a table and a re-run can. This script is that re-run:
         refused halfway and a refused one writes nothing. Plan nodes the graph lacks are named
         and exit 1 before any write, unless --only-present
         (a plan that spans several repositories' graphs).
+    waves.py finish --inventory FILE --max-rounds N --max-releases M (--rounds K | --ledger RUN.md)
+                    --checks K/M --artefact NAME@SHA [--releases R] [--operator-go]
+        the finish-line verdict (`references/finish-line.md`) from the triaged items, and the
+        finish block printed. Only `triage: blocking` items count, less those closed as
+        duplicate, stale or not-reproduced; deferred and noise never change the verdict. The
+        round count is explicit: --rounds, or the ledger's `round: <N> — <reading> — new
+        blocking <k>` lines, whose counts must match the inventory. Exit 0 done (the last two
+        rounds found no new blocking item, none is open, --checks is all green, and the rounds
+        are within --max-rounds or --operator-go is passed); 5 the budget reached before done
+        (rounds at --max-rounds, releases at --max-releases with a blocker open, or done past
+        the round budget without --operator-go); 6 diverging (the blocking count did not fall
+        from one round that found some to the next, or it did not fall and the last round's
+        self-inflicted >= new, from round 2 on); 3 continue (including no --checks); 1
+        malformed (a schema error, a blocking item without `test` or `round`, B3 with
+        base_repro yes, a round past the rounds run, no round count, a ledger that disagrees,
+        --max-rounds below 2, an artefact that is not NAME@SHA).
 
 **The plan** is any JSON whose `nodes` list `{id, wave, closes}` — a work graph that carries
 `closes` on its nodes is one, and so is a short hand-written table. A node may carry
@@ -42,7 +58,7 @@ described in `templates/inventory.schema.json` (`$defs.modules`, `$defs.plan`).
 are listed in (wave, id) order, counts are sorted. A re-cut is a diff to a table and a
 re-run, which a reviewer can read.
 
-Exit codes: 0 done; 1 an item lands nowhere, or the tables and the inventory disagree, or a
+Exit codes (every verb but `finish`, whose own are above): 0 done; 1 an item lands nowhere, or the tables and the inventory disagree, or a
 graph move was refused; 2 a schema error, a table error (an id on two modules), usage, or an
 unreadable file. Stdlib only (`references/portability.md`).
 """
@@ -62,11 +78,18 @@ SCHEMA = HERE.parent / "templates" / "inventory.schema.json"
 GRAPH_PY = HERE / "graph.py"
 REQUIRED = ("id", "title", "area", "kind", "severity", "evidence", "proposed_fix")
 OPTIONAL = ("status", "source", "source_file", "repo", "module", "node", "wave", "release",
-            "register_id", "blocked_by", "closable_in_one_pass", "needs_operator", "notes")
+            "register_id", "blocked_by", "closable_in_one_pass", "needs_operator", "notes",
+            "triage", "test", "round", "base_repro", "blast", "rung")
 SEVERITY = ("critical", "high", "medium", "low", "info")
 STATUS = ("open", "changed", "closed", "fixed", "fixed-elsewhere", "duplicate", "moved", "stale",
           "not-reproduced", "carried")
 OPEN = ("open", "changed")
+# The finish line's vocabulary (references/finish-line.md → Triage at discovery). The
+# validator holds these to the doctrine, the run-ledger grammar and inventory/1's enums.
+TRIAGE = ("blocking", "deferred", "noise")
+TESTS = ("B1", "B2", "B3", "B4")
+BASE_REPRO = ("yes", "no", "n/a")
+RUNGS = ("I1", "I2", "I3", "I4", "I5")
 ID = re.compile(r"^[A-Za-z][A-Za-z0-9._-]{0,63}$")
 KIND = re.compile(r"^[a-z][a-z0-9-]*$")
 EXT = re.compile(r"^x-[a-z0-9-]+$")
@@ -115,9 +138,34 @@ def item_errors(x: object) -> list[str]:
     for k in ("closable_in_one_pass", "needs_operator"):
         if k in x and not isinstance(x[k], bool):
             errs.append(f"{iid}: `{k}` is not a boolean")
+    if "triage" in x and x["triage"] not in TRIAGE:
+        errs.append(f"{iid}: `triage` {x['triage']!r} is not one of {', '.join(TRIAGE)}")
+    if "test" in x and x["test"] not in TESTS:
+        errs.append(f"{iid}: `test` {x['test']!r} is not one of {', '.join(TESTS)}")
+    if "round" in x and not _posint(x["round"]):
+        errs.append(f"{iid}: `round` is not an integer from 1")
+    if "base_repro" in x and x["base_repro"] not in BASE_REPRO:
+        errs.append(f"{iid}: `base_repro` {x['base_repro']!r} is not one of {', '.join(BASE_REPRO)}")
+    if "blast" in x and not (_posint(x["blast"]) and x["blast"] <= 3):
+        errs.append(f"{iid}: `blast` is not 1, 2 or 3")
+    if "rung" in x and x["rung"] not in RUNGS:
+        errs.append(f"{iid}: `rung` {x['rung']!r} is not one of {', '.join(RUNGS)}")
+    if x.get("triage") == "blocking":
+        errs += [f"{iid}: blocking without `{k}` — a blocking finding names the B test that "
+                 "matched and the round that found it" for k in ("test", "round") if k not in x]
+        if x.get("test") == "B3" and x.get("base_repro") == "yes":
+            errs.append(f"{iid}: B3 says it passes at Base, and `base_repro: yes` says it fails "
+                        "there — one of the two is wrong")
+    elif "test" in x:
+        errs.append(f"{iid}: `test` on an item that is not blocking — a B test is what makes a "
+                    "finding blocking; without one it is deferred or noise")
     return errs
 
 
+def _posint(v) -> bool:
+    return isinstance(v, int) and not isinstance(v, bool) and v >= 1
+
+
 def schema_errors(items: list) -> list[str]:
     """inventory/1 itself, applied where `jsonschema` is installed. `item_errors` is the
     hand copy every install has; test/waves_test.py holds the two to one verdict."""
@@ -504,6 +552,163 @@ def cmd_sync_graph(a) -> int:
     return 0
 
 
+# ---------------------------------------------------------------------------- the finish line
+
+# A blocking item closed as one of these was never a blocker: it counts in no round.
+NOT_COUNTED = ("duplicate", "stale", "not-reproduced")
+ROUND_LINE = re.compile(r"^round:\s*(\d+)\s*[—-]\s*(.*?)\s*[—-]\s*new blocking\s*(\d+)\s*$")
+ARTEFACT = re.compile(r"^[^@\s]+@[0-9a-f]{7,40}$")
+
+
+def _priority(x: dict):
+    """Top priority first: the impact rung, then blast, then severity, then the id. Where an
+    item was found is not an input — a fresh finding is not next because it is fresh."""
+    rung = RUNGS.index(x["rung"]) + 1 if x.get("rung") in RUNGS else 0
+    return (-rung, -(x.get("blast") or 0), SEVERITY.index(x["severity"]), _natural(x["id"]))
+
+
+def _board_id(x: dict) -> str:
+    return x.get("register_id") or x["id"]
+
+
+def ledger_rounds(path: pathlib.Path) -> dict[int, int]:
+    """{round: new blocking} from the run ledger's `round:` lines (templates/run.md)."""
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeError) as exc:
+        raise Fail(1, [f"the run ledger {path} cannot be read ({type(exc).__name__})"])
+    out, errs = {}, []
+    for n, line in enumerate(text.splitlines(), 1):
+        if not line.startswith("round:"):
+            continue
+        m = ROUND_LINE.match(line.strip())
+        if not m:
+            errs.append(f"{path}:{n}: not `round: <N> — <reading> — new blocking <k>`")
+            continue
+        r = int(m[1])
+        if r < 1 or r in out:
+            errs.append(f"{path}:{n}: round {r} is below 1 or written twice")
+        out[r] = int(m[3])
+    if out and sorted(out) != list(range(1, max(out) + 1)):
+        errs.append(f"{path}: rounds {sorted(out)} are not 1..{max(out)} — a round line is missing")
+    if errs:
+        raise Fail(1, errs)
+    return out
+
+
+def finish_verdict(items: list[dict], rounds: int, max_rounds: int, max_releases: int,
+                   releases: int, checks: tuple[int, int] | None,
+                   operator_go: bool = False) -> tuple[int, str, dict]:
+    """(exit code, word, facts) — the finish line computed from the triaged items alone.
+    Deferred and noise items are counted for the block and never read for the verdict."""
+    triaged = [x for x in items if "triage" in x]
+    late = [f"{x['id']}: found in round {x['round']}, and only {rounds} round(s) ran"
+            for x in triaged if _posint(x.get("round")) and x["round"] > rounds]
+    if late:
+        raise Fail(1, late)
+    blocking = [x for x in triaged if x["triage"] == "blocking" and _status(x) not in NOT_COUNTED]
+    new = [sum(1 for x in blocking if x["round"] == r) for r in range(1, rounds + 1)]
+    selfinf = sum(1 for x in blocking if x["round"] == rounds and x.get("base_repro") == "no")
+    open_b = [x for x in blocking if _needs_node(x)]
+    facts = {"rounds": rounds, "new": new, "open": open_b, "fixed": len(blocking) - len(open_b),
+             "self_inflicted": selfinf}
+    clean = rounds >= 2 and new[-1] == 0 and new[-2] == 0 and not open_b
+    green = checks is not None and checks[0] == checks[1]
+    if clean and green:
+        if rounds <= max_rounds:
+            return 0, "done", facts
+        if operator_go:
+            return 0, "done", dict(facts, why=f"past budget — rounds {rounds}/{max_rounds} on the "
+                                              "operator's go")
+        return 5, "budget", dict(facts, why=f"past budget — operator's go required: done at round "
+                                            f"{rounds}/{max_rounds}")
+    if rounds >= max_rounds:
+        owed = (f"{len(open_b)} blocker(s) open" if open_b else
+                "exit checks not supplied" if checks is None else
+                "exit checks not all green" if not green else "the second clean round still owed")
+        return 5, "budget", dict(facts, why=f"rounds {rounds}/{max_rounds} reached before done — {owed}")
+    if open_b and releases >= max_releases:
+        return 5, "budget", dict(facts, why=f"releases {releases}/{max_releases} reached before "
+                                            f"done — {len(open_b)} blocker(s) open")
+    if rounds >= 2 and new[-1] >= new[-2] > 0:
+        return 6, "blocked", dict(facts, why=f"diverging — new blocking {new[-2]} → {new[-1]} "
+                                             "did not fall; run the loop guard's break protocol")
+    if rounds >= 2 and new[-1] >= new[-2] and selfinf and selfinf >= new[-1] - selfinf:
+        return 6, "blocked", dict(facts, why=f"diverging — round {rounds}: {selfinf} self-inflicted "
+                                             f"≥ {new[-1] - selfinf} new, and the count did not "
+                                             "fall; run the loop guard's break protocol")
+    why = (f"{len(open_b)} blocker(s) open" if open_b else
+           "exit checks not supplied — pass --checks K/M read on the artefact" if checks is None else
+           "exit checks not all green" if not green else
+           "a second round with no new blocking finding is owed")
+    return 3, "continue", dict(facts, why=why)
+
+
+def cmd_finish(a) -> int:
+    try:
+        _, items = load_inventory(pathlib.Path(a.inventory))
+    except Fail as exc:
+        raise Fail(1, exc.reasons)  # a malformed inventory is malformed here, never usage
+    for flag, v, least in (("--max-rounds", a.max_rounds, 2), ("--max-releases", a.max_releases, 1),
+                           ("--releases", a.releases, 0), ("--rounds", a.rounds, 0)):
+        if v is not None and v < least:
+            raise Fail(1, [f"{flag} {v} is below {least}" + (
+                " — done needs two clean rounds, so a budget of one can never be met"
+                if flag == "--max-rounds" else "")])
+    # THE ROUND COUNT IS EXPLICIT. A clean round leaves no item, so a count derived from the
+    # items can never see the two clean rounds `done` needs: the verdict would stay
+    # `continue` for ever. It comes from --rounds or from the ledger's `round:` lines.
+    led = ledger_rounds(pathlib.Path(a.ledger)) if a.ledger else None
+    if led is not None and not led and a.rounds is None:
+        raise Fail(1, [f"{a.ledger} carries no `round:` line and --rounds is absent — the round "
+                       "count cannot be read"])
+    if led is None and a.rounds is None:
+        raise Fail(1, ["the round count is not given — pass --rounds N, or --ledger with the run "
+                       "ledger's `round:` lines; clean rounds leave no item to count"])
+    rounds = a.rounds if a.rounds is not None else max(led)
+    if led and a.rounds is not None and a.rounds != max(led):
+        raise Fail(1, [f"--rounds {a.rounds} and the ledger's {max(led)} round(s) disagree"])
+    if led:
+        counted = {r: sum(1 for x in items if x.get("triage") == "blocking" and x.get("round") == r)
+                   for r in led}
+        bad = [f"round {r}: the ledger says new blocking {k}, the inventory holds {counted[r]}"
+               for r, k in sorted(led.items()) if counted[r] != k]
+        if bad:
+            raise Fail(1, bad)
+    checks = None
+    if a.checks:
+        m = re.fullmatch(r"(\d+)/(\d+)", a.checks.strip())
+        if not m or int(m[1]) > int(m[2]) or int(m[2]) == 0:
+            raise Fail(1, [f"--checks {a.checks!r} is not K/M green of M exit checks"])
+        checks = (int(m[1]), int(m[2]))
+    if a.artefact and not ARTEFACT.match(a.artefact):
+        raise Fail(1, [f"--artefact {a.artefact!r} is not NAME@SHA (a commit of 7-40 hex digits)"])
+    code, word, f = finish_verdict(items, rounds, a.max_rounds, a.max_releases, a.releases, checks,
+                                   a.operator_go)
+    deferred = sorted((x for x in items if x.get("triage") == "deferred"), key=_priority)
+    noise = [x for x in items if x.get("triage") == "noise"]
+    risks = [x for x in deferred if x.get("blast") == 3 or x.get("rung") in ("I4", "I5")]
+    pool = sorted((x for x in items if x.get("triage") != "blocking" and _needs_node(x)
+                   and x.get("triage") != "noise"), key=_priority)
+    budget = f"rounds {f['rounds']}/{a.max_rounds} — releases {a.releases}/{a.max_releases}"
+    if word == "continue":
+        print(f"next round: {f['rounds'] + 1}/{a.max_rounds} — {f['why']} — {budget}")
+    else:
+        print(f"finish: {word} — {budget}" + (f" — {f['why']}" if f.get("why") else ""))
+    print("  exit checks: " + (f"{checks[0]}/{checks[1]} green on {a.artefact or '<artefact not named>'}"
+                               if checks else "not supplied — read them on the artefact (--checks K/M)"))
+    print(f"  blocking: {len(f['open'])} open · {f['fixed']} fixed — new per round "
+          f"{' · '.join(str(n) for n in f['new']) or 'none'}"
+          + (f" — open: {', '.join(x['id'] for x in f['open'])}" if f["open"] else ""))
+    top = ", ".join(_board_id(x) for x in deferred[:5]) + (" …" if len(deferred) > 5 else "")
+    print(f"  deferred: {len(deferred)}" + (f" → {top}" if deferred else ""))
+    print(f"  noise: {len(noise)}")
+    print("  known risks: " + (", ".join(_board_id(x) for x in risks) or "none"))
+    print("  next: " + (f"{_board_id(pool[0])} (new iteration)" if pool
+                         else "highest-priority board row (read the board)"))
+    return code
+
+
 def main(argv: list[str]) -> int:
     p = argparse.ArgumentParser(prog="waves.py", description=__doc__.split("\n")[0])
     sub = p.add_subparsers(dest="cmd", required=True)
@@ -531,9 +736,20 @@ def main(argv: list[str]) -> int:
                                         "a lowering is refused")
     s.add_argument("--only-present", action="store_true",
                    help="ignore plan nodes this graph does not hold")
+    f = sub.add_parser("finish", help="the finish-line verdict from the triaged items, and the block")
+    f.add_argument("--inventory", required=True)
+    f.add_argument("--max-rounds", type=int, required=True, help="run.finish.maxRounds (default 3, at least 2)")
+    f.add_argument("--max-releases", type=int, required=True, help="run.finish.maxReleases (default 2)")
+    f.add_argument("--releases", type=int, default=0, help="releases this iteration made so far")
+    f.add_argument("--rounds", type=int, help="rounds run, clean ones included")
+    f.add_argument("--ledger", help="the run ledger; its `round:` lines are the round count")
+    f.add_argument("--operator-go", action="store_true",
+                   help="the operator's recorded go for rounds past --max-rounds")
+    f.add_argument("--checks", help="K/M — exit checks green on the artefact")
+    f.add_argument("--artefact", help="what they ran on, as NAME@SHA")
     a = p.parse_args(argv)
     verbs = {"merge": cmd_merge, "assign": cmd_assign, "count": cmd_count, "validate": cmd_validate,
-             "sync-graph": cmd_sync_graph}
+             "sync-graph": cmd_sync_graph, "finish": cmd_finish}
     try:
         return verbs[a.cmd](a)
     except Fail as exc: