resident

type Bank struct {
	// Partial is whatever text the attempt had produced when it stopped. Empty
	// is the ordinary case for a death on the clock, which is exactly why the
	// other two fields exist.
	Partial string
	// Shared is the progress the attempt posted as it went, oldest first.
	Shared []string
	// Artifacts are absolute paths to files that are still on disk.
	Artifacts []string
	// State is the dead leaf's structured findings: files it touched, edits it
	// made, checks it ran and what they found, and the last calls it made.
	// Derived from the leaf's own outcome by LeafState, general for any task.
	// Empty when the leaf left no structured record, which is the ordinary
	// case for a generalist that produced only prose — and an empty state is
	// simply left out of the composition.
	State string
	// Transcript is the dead attempt's OWN TURNS, read back from the record it
	// wrote as it worked (internal/store/transcript.go): the assistant text, the
	// tool calls and the results they returned, in the order they happened.
	//
	// THIS IS THE FIELD THAT MAKES A RESTART A RESUMPTION. The three above are
	// what the attempt CHOSE to announce — a partial result, some progress rows,
	// a structured summary — and a leaf abandoned mid-turn announced almost
	// nothing, because announcing is what a leaf does when it is finishing. Its
	// work is nonetheless all there: seventy-one runs of one test file, on the
	// happy-dom run of 2026-08-28, every one recorded under the node and every
	// one discarded when the claim reaper started the leaf over.
	//
	// It is expected to be PARTIAL. The recorder flushes on a full batch and on
	// every way out of a leaf, a fault included, so what survives is everything
	// up to the last flush — which is exactly what "resume from where it got to"
	// means, and is why nothing here tries to invent the result of a tool call
	// whose answer never arrived. See [BankedRun] for how one is rendered: an
	// outline of every turn the run took, and then its end verbatim.
	Transcript string
}

type BriefActivity struct {
	Since         time.Time    `json:"since"`
	Events        []BriefEvent `json:"events"`
	Done          int          `json:"done"`
	Failed        int          `json:"failed"`
	Cancelled     int          `json:"cancelled"`
	Questions     int          `json:"questions"`
	CharterFired  int          `json:"charter_fired"`
	FactsLearned  int          `json:"facts_learned"`
	SkillsLearned int          `json:"skills_learned"`
	CraftsForged  int          `json:"crafts_forged"`
	CostUSD       float64      `json:"cost_usd"`
	// Waiting counts the standing rows: what is stopped on the user right now,
	// as opposed to what happened while they were gone.
	Waiting int `json:"waiting"`
}

type BriefComposeFunc func(ctx context.Context, activity BriefActivity) (BriefDraft, error)

type BriefDraft struct {
	Headline string           `json:"headline"`
	Items    []BriefDraftItem `json:"items"`
}

type BriefDraftItem struct {
	Seq  int64  `json:"seq"`
	Body string `json:"body"`
}

type BriefEvent struct {
	Seq  int64               `json:"seq"`
	Time time.Time           `json:"time"`
	Kind store.BriefItemKind `json:"kind"`
	Text string              `json:"text"`
	Ref  string              `json:"ref,omitempty"`
}

type CancelRethinkFunc func(ctx context.Context, node store.Node, reason string)

type CompileFunc func(ctx context.Context, instruction string, graphContext string) (Compiled, error)

type Compiled struct {
	Goal        string
	Assumptions []string
	Scale       string

	// Title is the job's rail-sized display name, produced by the compile
	// call itself. Empty falls back to the separate naming pass, which is
	// what every caller without a compiler still gets.
	Title string
	// Contract is the task-scale working method, produced by the same compile
	// call. Empty falls back to the separate contract pass.
	Contract string
	// Parts is the compile call's reading of the ask: the separate requests it
	// contains, in the person's own words. It is evidence handed to the
	// planner, never a layout — see plan.Options.Asked.
	Parts []string
	// Accept is the acceptance checklist: the behaviours the person's REQUEST
	// states, read from the request's own words before any work existed.
	//
	// It rides the compile because the compile is the one pass in the system
	// holding the request VERBATIM. Everything downstream of it holds the
	// compiled goal, which is this program's reading of the ask rather than the
	// ask — and a checklist derived from our own reading is a checklist we wrote
	// for ourselves, which is precisely what the gate may not hold anybody to.
	// See plan.Acceptance and docs/design/gate/ACCEPTANCE.md.
	Accept []plan.Point
	// Constraints are the rules the person's REQUEST states about what the run
	// may or may not DO, in their own words, kept only where the compiler could
	// quote them out of the instruction (head.keepStatedConstraints).
	//
	// It rides beside Accept because the two are read off the same verbatim ask
	// and neither can be recovered downstream — everything past the compile
	// holds the compiled goal, which is this program's reading. They differ in
	// where they land: the checklist goes on the node that DELIVERS, and a
	// constraint goes on every node of the job, because the person said it about
	// the run. See plan.Graph.SetConstraints.
	Constraints []plan.Constraint
	// TrialOf is the retrieved unsettled fact this goal deliberately tests.
	// Zero means the compiled job is ordinary work.
	TrialOf int64

	// BuildsOn names earlier top-level jobs this one continues. Each becomes
	// a feeds_into edge onto the new subtree's entry nodes, so the prior
	// result arrives as an input digest — continuity through the graph, not
	// through a shared workspace.
	BuildsOn []string

	// Question, when set, means the compiler judged one gap too consequential
	// to guess. Nothing is spliced; the question is asked in the thread and
	// the user's reply arrives as an ordinary next message.
	Question string

	// QuestionOptions makes any compiler askback selectable without removing
	// free text. Charter is an inert standing draft until the reconciler records
	// a separate ratification command.
	QuestionOptions []store.QuestionOption
	Charter         *store.CharterSpec
	ServiceIntent   bool

	// WorkModel is the model the user named for this job in their own words.
	// It rides the splice as provenance, so the leaves that run it are pinned
	// to what was asked for rather than to whatever the slot holds later.
	WorkModel string

	// ModelNote is the one calm receipt line about that choice.
	ModelNote string

	// Note is the one calm receipt line the compiler adds about its own
	// answer — that it supplied no reading and the person's words stand as
	// the goal. Empty is the ordinary case.
	Note string
}

type ConsolidateFunc func(ctx context.Context, scope string, facts []store.Fact, candidate *ScopePair) (Consolidation, error)

type Consolidation struct {
	Facts      []Learned
	ScopeAlias *ScopeAliasJudgment
}

type CraftAdvance struct {
	Unrolled int
	Round    int
	Spliced  int
	Receipt  string
	Stopped  string
}

type CraftCandidate struct {
	Name string
	YAML string
}

type CraftMind struct {
	// contains filtered or unexported fields
}

type CraftParamFiller func(ctx context.Context, instruction string, workflow *craft.Workflow) (map[string]string, error)

type CraftRepairFunc func(ctx context.Context, candidate CraftCandidate, problem string) (CraftCandidate, error)

type CraftRun struct {
	// Prefix is the run's job root id and id namespace.
	Prefix string
	Nodes  int
	Steps  int
	// Receipt names the craft and its version in the user's own thread.
	Receipt string
}

type CraftRunner struct {
	// contains filtered or unexported fields
}

type CraftShelf interface {
	Match(request string, k int) []craft.Scored
	Load(name string) (*craft.Workflow, error)
	List() ([]craft.Summary, error)
	History(name string, limit int) ([]craft.Version, error)
	Save(workflow *craft.Workflow, message string) (string, error)
}

type CraftSource interface {
	Load(name string) (*craft.Workflow, error)
}

type CraftSurvival struct {
	For     int `json:"for"`
	Against int `json:"against"`
	// LastCost is what the most recent clean run of this workflow actually
	// spent, whole-subtree. It rides here rather than in a new query because
	// the outcome write is already standing over the node that just landed and
	// the store already totals a subtree's spend; a receipt that wants to say
	// "last time $0.38" would otherwise be one join away and has never been
	// made. Absent on records written before this field existed, which reads as
	// zero and simply leaves the clause off.
	LastCost float64 `json:"last_cost,omitempty"`
	// Retired is why the person stopped this way of working being reached for,
	// in their own words, and its presence IS the retirement — the recognizer
	// skips any craft whose record carries one.
	//
	// It lives in the survival record rather than in a marker of its own for the
	// reason the record exists at all: this is the one thing the system already
	// knows about a craft by name, it is already read on the recognition path
	// before anything is compiled, and a second key would be a second thing to
	// keep true. Nothing is deleted by a retirement — the workflow file, its
	// versions and its evidence stay exactly where they are, which is what makes
	// this reversible by hand and auditable at all.
	Retired string `json:"retired,omitempty"`
	// RetiredWhen is when that happened, so a page can say how long ago.
	RetiredWhen time.Time `json:"retired_when,omitempty"`
}

type DistillFunc func(ctx context.Context, goal, outcome string, failed bool) ([]Learned, error)

type ExecResult struct {
	Summary          string
	PromptTokens     int
	CompletionTokens int
	// CachedTokens is the share of PromptTokens the provider billed at the
	// cached rate. The executor has always measured it and the journal now has
	// somewhere to put it; carrying it here is what joins the two, and without
	// it every cache discipline the harness practises stays unfalsifiable from
	// the outside.
	CachedTokens int
	Cost         float64
	// Turns is the same spend with its shape kept: one row per model call,
	// summing to the three totals above. It rides here for the same reason
	// CachedTokens does — the executor has always known it and the journal now
	// has somewhere to put it — and an executor that does not meter turns leaves
	// it empty, which journals nothing rather than journalling a zero.
	Turns []executor.TurnUsage
	// Promote asks the runner to settle this reflex partial and enqueue the
	// same verbatim instruction on the ordinary compiled path atomically.
	Promote         bool
	ServiceRequests []executor.ServiceRequest
	// Model is who actually served the work — the rung a panel picked or an
	// escalation moved to, which is not the model anyone asked for. It rides
	// the spend row because that is the row a receipt already reads.
	Model string
	// SpendBanked says this run banked its own calls as they were billed — one
	// usage row per response, written at the moment the provider answered
	// (cmd/codeaf's leafBanker, provider.WithBilling) — so the three totals
	// above are the REMAINDER and not the whole. On an ordinary banked run they
	// are zero and nothing more is written; they are non-zero when part of the
	// leaf ran on a worker whose calls the adapter never saw, and that part is
	// journaled exactly as it always was.
	//
	// The per-turn shape below is NOT a duplicate and is written either way —
	// it is a different kind of record, one row per turn rather than one per
	// call, and nothing else in the journal carries it. Which is why the zero
	// check above asks this field as well: a fully banked run has nothing left
	// to sum and its turn ledger still has to reach the journal.
	SpendBanked bool

	// HOW THE WORK ENDED, WHICH IS A DIFFERENT FACT FROM WHAT IT PRODUCED.
	//
	// A leaf that ran out of its tokens mid-edit and a leaf that finished
	// reached this seam wearing the same three fields — a summary, some money,
	// some turns — so the scheduler saw err == nil and settled the node done.
	// A judge's "nothing is left" then stood as the whole account of a worker
	// that had been cut off with a red build: measured on 2026-09-01, a leaf
	// stopped at `⏳ ran out of tokens — 33 turns` and was ✓ two seconds later,
	// its summary its own last sentence, and its siblings briefed on truncated
	// work. Nothing that runs after that ✓ can recover the cut work.
	//
	// THE ENDING WORD IS THE WHOLE OF THE ANSWER, and it is one field rather
	// than two. A StopReason is a string whose zero value is the empty string,
	// and [executor.StopReason.OutOfRoom] reads that empty string as false — so
	// a result nobody filled in already settles as an ordinary finish, exactly
	// as it did before any of this existed. Absence is still said out loud.
	//
	// It was once guarded by a second `Stopped` flag asked before this one, and
	// the flag could only ever subtract: one writer set it in the same breath as
	// this field and one reader consulted it, and what it gated was whether a
	// worker's real work is thrown away. A result that arrives carrying an
	// unambiguous "it ran out" and a flag somebody forgot is a node quietly
	// retired over work that was still going — the very defect this seam exists
	// to refuse — so the ending word decides alone.
	//
	// Stop is the executor's own word for the ending — "budget", "turn-cap",
	// "deadline", "done".
	Stop executor.StopReason
	// Meter is what ran out and how far the leaf got, read at land time. It is
	// carried for the record rather than for the decision: the decision is
	// RanOut, and this is what a person and an autopsy are owed about it.
	Meter executor.Meter
	// Continued says something else is already carrying this leaf's remaining
	// work — a spliced continuation, a repair journaled against the daily rail.
	// A leaf that ran out and HAS a successor is finished with; one that ran out
	// with nothing behind it has no account, and the scheduler must not write
	// one for it. See Runner.runOne.
	Continued bool

	// RefusedGrowth is the growth governor's own [GrowVerdict.Cause] — the word
	// "standstill" or "fixed-point" — when the round that would have carried
	// this leaf's remainder was refused because NOTHING IS CHANGING, and it is
	// the empty string when growth was not refused on that ground, which
	// includes every ordinary leaf, every cap, and the daily rail.
	//
	// EMPTY MEANS NO SUCH REFUSAL AND THE VALUE IS THE CAUSE WORD, never a
	// sentence and never a flag: the sentence a person reads is derived from it
	// exactly once, by GrowthStopped, so the stream, the record and the node's
	// ending cannot describe one event three ways.
	//
	// It rides here because the governor's finding was already true and already
	// printed by the time the leaf landed, and the scheduler — the one thing
	// that can stop paying for the job — was the only reader never told. It
	// carried "it ran out" and "nothing is continuing it", both of which were
	// also true of the very first fruitless round, so the queue could not tell
	// the two apart and put a job that had concluded nothing was changing back
	// on it for a third attempt. Stop still answers what stopped the leaf; this
	// answers what the job concluded about carrying on.
	RefusedGrowth string
}

type ExecuteFunc func(ctx context.Context, node store.Node) (ExecResult, error)

type ExpandFunc func(ctx context.Context, node store.Node) (spliced int, expanded bool)

type Failed struct {
	// Ask is what was being attempted, in the words the person used. It is
	// never a node id and never a step brief written by the machine.
	Ask string
	// Cause is one plain clause about why it stopped — the innermost thing that
	// actually refused, in its own words. Empty when nothing said.
	Cause string
	// Next is what happens now: a fallback that is already running, or that
	// nothing is and how to ask again.
	Next string
	// Detail is the transport underneath, kept whole and unedited. It rides
	// below the headline so the room folds it.
	Detail string
}

type Finding struct {
	Kind  string
	Names []string
}

type GrowRequest struct {
	// JobRoot is the id namespace the job's nodes are minted under: both the
	// ceiling's corpus and the journal's key.
	JobRoot string
	// Node is where a refusal is recorded — the work whose reader needs to know
	// that a governor, and not the work finishing, is why nothing more happens.
	Node store.Node
	// Lineage is the namespace rounds are counted under: a leaf's own split
	// lineage for a replan, the job root for growth that belongs to the job as
	// a whole. Two siblings that each split once are two lineages with one
	// round each, not one lineage with two.
	Lineage string
	Reason  string
	// Adding is the node count about to be spliced. Zero means the caller does
	// not know yet — it has not planned the growth — and the ceiling is then
	// read as "is there room for anything at all".
	Adding int
	// Round is the round this growth would be, when the caller already knows it
	// from its own id arithmetic. Zero derives it from the journal.
	Round int
	// Criterion overrides what the job is judged against. Empty reads it off
	// the job root's own spec, which is where W1 put it.
	Criterion      plan.Done
	DailyBudgetUSD float64
	// Ungated keeps the caps and skips the paid question — Growth.Ungated,
	// carried to the one helper that acts on it.
	Ungated bool
	// Grounded says this round is bought by a REVIEW FINDING THAT NAMES A FILE
	// OF THE RECORD: the delivery gate read the tree it is handing over and
	// said, of a file that is on disk, that it does not do something the
	// request asked for.
	//
	// It is here because two readings of one job may not refuse each other in
	// silence. ofetch s12 is the measured case: the gate refused the delivery
	// over src/circuit-breaker.ts, the first repair round asked to be planned,
	// and the coverage question answered "everything this job is judged on is
	// already covered" — so nothing ran, the run ended partial after 145 calls,
	// and the two answers were never reconciled. The FIRST round after such a
	// finding is not the coverage question's to refuse: the finding IS the
	// evidence that something is not covered, taken from the same world, and it
	// is more specific than a judgement about the job as a whole.
	Grounded bool
	// Quiet keeps the refusal out of the work's record while keeping it in the
	// journal. It is for the one caller whose refusal is not a handover: a
	// claim-time expansion that is refused runs the node whole, immediately, on
	// the worker that is already holding it — so the words every other path
	// needs ("handing over what's done") would describe something that is not
	// happening, on a node the reader is about to watch finish.
	Quiet bool
	// Workspace is where the work this growth reacts to happened, when the
	// caller knows it. Empty reads the seam instead (JobWorkspace), which is
	// where every caller that cannot say gets its answer.
	Workspace string
	// Artifacts is the workspace's own before-and-after reading of the tree:
	// every path the round left behind, relevant or not. Handing the raw list
	// rather than a count is what lets the governor decide what "produced"
	// MEANS instead of taking a caller's word for it — see MeasureRound, and
	// see the ink s10 wall for what a caller's count is worth.
	Artifacts []string
	// Measured says this caller read the world and Produced is its answer.
	//
	// It is a separate field and not a zero test on Produced, because "nobody
	// looked" and "somebody looked and the answer was nothing" are opposite
	// facts that a bare zero spells the same way — and a rule that read them as
	// one would refuse a caller that never measured anything, which is a
	// fail-safe pointing the wrong way. A growth path with no reading of the
	// tree keeps exactly the governors it had.
	Measured bool
	// Produced is how many of those files the JOB IS ABOUT. It is derived here
	// rather than passed in wherever Artifacts are given; a caller that has
	// already narrowed its own reading may set it directly. Meaningless unless
	// Measured.
	Produced int

	// Remainder is the work this round is being bought to finish, as the
	// reviewer named it. It is compared against the last round's for equality
	// and for nothing else.
	Remainder string
	// Finding is the review finding this round is being bought to close, as the
	// record holds it rather than as the review spelled it: a kind and every
	// name it stands on. Empty is every round nobody bought for a finding, and
	// it is never refused on this ground. See [Finding] and [spentNames].
	Finding Finding

	// Rechecking marks a second look at a decision already taken this round —
	// the exact ceiling, once a plan exists and its node count is known. The
	// free checks are re-read; the paid question is not, because it was already
	// asked on the way in and its answer has not changed.
	Rechecking bool
	// contains filtered or unexported fields
}

type GrowVerdict struct {
	Allow bool
	Round int
	// Refused is the sentence a person reads, empty when allowed and when the
	// pause is the daily rail — a rail is not a refusal, it is a question
	// already asked in its own words elsewhere.
	Refused string
	Cause   string
	// CoveredDespite is the standing evidence that stopped the coverage
	// question from refusing this round, when it would have. It travels on the
	// verdict so the ADMISSION can journal it: the row that records a round is
	// written after the splice, by a caller holding the request it was decided
	// from, and this is the one fact about the decision that request never had.
	CoveredDespite []string
	// Spent is the names of this round's finding that had already had their two
	// rounds, and it travels for the same reason. The names it was bought for
	// are derived from the finding itself and need no carrying.
	Spent []string
}

type Growth struct {
	Reason string
	Ask    Satisfier
	// Ungated skips the satisfaction question and keeps the caps. It is for the
	// one caller whose growth is not a machine's second thought: a person who
	// has just said what they want more of is not answerable by "the goal is
	// already covered", because they have just redefined the goal.
	Ungated bool
	// Grounded says this growth is bought by a review finding that names a file
	// of the record — GrowRequest.Grounded, carried through the one seam every
	// growing job passes through.
	Grounded bool
	// After is the landed node this growth is a reaction to — the result that
	// convened the revision sentinel, exhausted or failed or merely surprising.
	// The zero node is growth with no such result behind it (a person changing
	// the goal), and it wires no evidence.
	//
	// It travels with the reason because it answers the same kind of question:
	// the reason says why the job grew, and this says what it grew from, which
	// is what an added node has to be able to read. The overrun splice has
	// always had it in hand — it is that path's whole subject — and the
	// revision path used to have nowhere to put it, so its additions were
	// admitted with no edge to the work they were replacing.
	After store.Node

	// Records are files the finished work left behind that the remainder must
	// READ rather than reuse: the text of a change, a measurement, a transcript.
	//
	// They are separate from the artifact list because the two are separate
	// invitations and collapsing them was measured producing a false statement.
	// An artifact is "this exists, do not make it again". A record is "this is
	// what happened, and it is where your account of it has to come from" — and
	// a repair that was handed only artifact NAMES had no way to learn what the
	// work it is finishing actually did, so the pass that wrote its method
	// offered an illustrative root cause instead and the leaf shipped that
	// example verbatim as the real one.
	//
	// Empty is every caller that has one kind of file and not the other, which
	// renders exactly the bytes this path has always rendered.
	Records []string
	// State is the dead leaf's structured findings — files it touched, checks
	// it ran, and its last tool calls — derived from the leaf's own outcome
	// by LeafState. It travels with Records for the same reason: the remainder
	// needs to know what the finished work actually did, not just what files
	// it left. A continuation that knows what the dead leaf already found
	// resumes from there instead of re-reading everything it already diagnosed.
	// Empty is every caller that has no structured outcome, which renders
	// exactly the bytes this path has always rendered.
	State string

	// Goal overrides the brief the splice is planned from. Empty — every caller
	// that existed before the cooperative path — keeps OverrunGoal, which is
	// the only phrasing the splice has ever used.
	//
	// It exists because that phrasing is a claim and not a template: "it stopped
	// when its resources ran out, so parts of the assignment may already be
	// complete" is the first thing the planner reads, and it is false of a leaf
	// that handed its budget back on purpose. A planner told the work ran out
	// plans a remainder; the cooperative path needs it to plan a division, and
	// those are different questions asked of the same call.
	Goal string
}

type Handover struct {
	// Seq and At are the journal's own coordinates for the request. At is what
	// makes the request answerable: a resident only owes an answer to a request
	// made while it was already serving.
	Seq int64
	At  time.Time
	// Reason is the requester's own words, verbatim.
	Reason    string
	SessionID string
}

type HandoverFunc func(request Handover) (accepted bool, reason string)

type JITExpander struct {
	Graph          *store.Store
	DailyBudgetUSD float64
	// FreeSlots reports the pool's idle dispatch slots right now. Nil means
	// "no signal" — the starvation gate is skipped and the gate is exactly
	// as permissive as it was before the field existed.
	FreeSlots func() int
	// ContextTokens is the window of the planning model this expander divides
	// through — the same model the build asked, and not the leaf's. Zero is
	// unknown and falls back to jitDigestBytes, which is what every expansion
	// took before the window was threaded here.
	ContextTokens int
	// Resolve finds the job a claimed node belongs to. Not ok means "this node
	// has no plan" — a one-leaf job, a craft node, a rehydration miss — and is
	// the ordinary answer for most of what a resident claims.
	Resolve func(node store.Node) (JITTarget, bool)
	// Ask overrides the process-wide satisfaction gate. Nil uses it.
	Ask Satisfier
}

type JITTarget struct {
	// Plan is the job's live plan document.
	Plan *plan.Graph
	// Lock guards it. Nil is legal and means the caller has no concurrency to
	// protect against, which is every test and no production surface.
	Lock sync.Locker
	// Prefix is the id namespace the job's store nodes are minted under, so a
	// child of plan node N is "<prefix>-nN" — the same arithmetic the reconciler
	// used at admission, which is what lets the child be looked up and judged
	// again when it is itself claimed.
	Prefix string
	// PlanNode is the claimed node's id inside Plan.
	PlanNode int
	// Client plans the expansion. Nil refuses it — a job whose planning client
	// did not survive a restart runs its nodes whole, which is what it did
	// before this file existed.
	Client plan.Completer
	// Options carries the ceilings the job was planned under.
	Options plan.Options
	// Journal persists the document after it has grown. Nil skips it, at the
	// cost of a restart not seeing the deeper shape.
	Journal func()
}

type JobSketch struct {
	Origin           store.Origin
	Title            string
	Ask              string
	Outcome          string
	Age              string
	NodeCount        int
	PromptTokens     int
	CompletionTokens int
	Cost             float64
	SurpriseTokens   int
	ExpectedTokens   int
	Surprise         *float64
}

type Learned struct {
	Scope string
	Kind  store.FactKind
	Body  string
	// Unsettled is the structured pair required by FactUnsettled. Body is a
	// searchable projection and is regenerated from this payload on write.
	Unsettled *store.UnsettledPair
	Replaces  int64
	// Sources names the existing facts a consolidated line derives from,
	// strongest evidence first. It is empty outside consolidation.
	Sources []int64
	// Skill is set only when this memory names a reusable artifact produced by
	// the job. Its fact enters the notebook as a non-retrievable candidate.
	Skill *SkillCandidate
	// Craft is set only when the job's SHAPE looked reusable. It is not a
	// memory at all — it rides here because one distiller call judges both,
	// and it is split off before the notebook ever sees it.
	Craft *CraftCandidate
	// Quarantines names source facts rejected by a repeated bad-outcome pattern.
	// It is honored only by consolidation.
	Quarantines []int64
}

type ModelResolveFunc func(names []string, boost bool) (string, bool)

type NarrateFunc func(ctx context.Context, narration Narration) (string, error)

type Narration struct {
	// Goal is the user's verbatim intent for this subtree.
	Goal string
	// Finished are labels of parts landed since the last update, each with a
	// one-line result.
	Finished []string
	// Running are labels of parts in flight, each with elapsed time.
	Running []string
	// Queued is how many parts are admitted but not yet started.
	Queued int
	// Previous are the narrator's own recent lines for this job.
	Previous []string
}

type OpenFindings struct {
	// Unexercised are the behaviours the request stated that no check in the
	// tree exercises, in the words the request used. store.DeliveryGate.
	Unexercised []string
	// Unasserted are the behaviours a check in the tree NAMES and no assertion
	// WEIGHS, each carrying the observables nothing asserted. store.DeliveryGate.
	Unasserted []string
	// Failing are the named checks the last reading of the project's own tests
	// found red. store.VerificationReading.Sample.
	Failing []string
	// Gap is the last finding the delivery gate recorded against this lineage.
	Gap string
	// Unclosed says a gap the gate raised was never closed — the repair was
	// refused or could not be bought — which is a different fact from a gap
	// that a later round answered.
	Unclosed bool
	// Declined is the sentence a gate wrote INSTEAD OF a judgement: the harness
	// stopped spending on the job before the delivery was ever judged, so the
	// row carries a refusal and no gap. store.DeliveryGate.Refused, on a row
	// whose Unclosed is set.
	//
	// It is a field beside Gap and not a value in it because the two are
	// different news and a brief that ran them together would lie either way: a
	// gap is what a review found missing, this is that nobody looked, and the
	// last gap a review DID find still stands underneath it. Reading the row as
	// silence was the other half of the same lie — a job that produced nothing
	// and was judged by nothing read as a job with nothing outstanding.
	Declined string
	// Unreadable says the last gate passed over a tree whose checks nobody
	// could read, which is not a pass over a checked delivery.
	Unreadable bool
	// Consumers is the changed-definition finding: one line per definition this
	// run reshaped that the rest of the project still uses the old way. It is a
	// reading of the world like Failing and unlike Gap — no suite and no name
	// comparison can make it, because the name is still there.
	// store.DeliveryGate.Consumers.
	Consumers []string
	// Unbound is the unbound-reference finding: one line per name this run's own
	// sources READ that nothing in the tree binds, each carrying the file and
	// line it is read at. It is a reading of the world like Failing and unlike
	// Gap, and it is the one a repair round can act on without running anything.
	// store.DeliveryGate.Unbound.
	Unbound []string
	// Mechanical says the standing gap is the MECHANICAL half's: a file the
	// plan promised and the disk does not hold. It is beside Gap rather than
	// inside it because the two are answered by different evidence — one is a
	// judge's sentence about a delivery, the other is a stat of the filesystem —
	// and nothing that reads a claim about the plan may overrule the second.
	Mechanical bool
}

type OverrunPlanFunc func(ctx context.Context, goal, prefix string) (store.Subtree, error)

type PlanAnchor struct {
	NodeID     string
	SessionID  string
	CommandSeq int64
}

type PlanFunc func(ctx context.Context, compiled Compiled) (store.Subtree, error)

type Reconciler struct {
	// contains filtered or unexported fields
}

type RedirectFunc func(ctx context.Context, job store.Node, message string, flavor RevisionFlavor) (Redirection, error)

type Redirection struct {
	Added   int
	Dropped int
	Amended int
	Notes   []string
	// RunningRemovals names store nodes the revision wanted removed while a
	// worker is inside them. Started work is frozen, so removal degrades to a
	// cancel request, gated by what it would throw away.
	RunningRemovals []string
}

type ReflectFunc func(ctx context.Context, jobs []JobSketch) ([]Learned, error)

type RevisionFlavor string

type RoundChange struct {
	// Relevant is what the round changed that the job is about: check files,
	// and sources inside the focus.
	Relevant []string
	// Scratch is the rest — files the round wrote that are outside everything
	// the request named. They are journaled rather than dropped: "this round
	// wrote fourteen files and moved none of them" is a recognisable failure
	// and the names are what make it recognisable.
	Scratch []string
	// Measured says somebody could look. It is false where there is no
	// workspace to read the round against, which reads as "nobody counted" and
	// leaves every governor exactly as it was.
	Measured bool
}

type Runner struct {
	// contains filtered or unexported fields
}

type Satisfier interface {
	Satisfied(ctx context.Context, criterion plan.Done, landed []plan.Landed, inflight []plan.Spec) (plan.Satisfaction, error)
}

type SatisfierFunc func(ctx context.Context, criterion plan.Done, landed []plan.Landed, inflight []plan.Spec) (plan.Satisfaction, error)

type ScopeAliasJudgment struct {
	Merge     bool   `json:"merge"`
	Canonical string `json:"canonical"`
}

type ScopePair struct {
	First  string
	Second string
}

type SentinelFunc func(ctx context.Context, prompt SentinelPrompt) (SentinelVerdict, error)

type SentinelPrompt struct {
	CharterID    string
	Invariant    string
	SentinelHint string
	Watch        store.WatchSpec
	Evidence     string
	// Previous is what this sentinel decided at its last few wakes and what
	// became of each decision, newest first. For a poll charter the evidence is
	// the constant condition string, so without this the call is byte-identical
	// every wake — a firing the user has already declined is judged the same
	// way again an hour later, and again, forever.
	Previous []string
	// Voice is the learned speech contract, assembled here rather than at the
	// surface because the notebook belongs to the resident. The sentinel's line
	// is read by the user, so it is subject to the same learned preferences as
	// anything else that speaks; an empty notebook leaves it empty and the
	// prompt byte-identical.
	Voice string
}

type SentinelVerdict struct {
	Yes  bool
	Line string
}

type ServiceRuntime interface {
	IdentityMatches(pid int, startedAt time.Time) (bool, error)
	Healthy(context.Context, store.Service) error
	Start(store.Service) (pid int, startedAt time.Time, err error)
	Stop(pid int, startedAt time.Time) error
}

type ServiceSupervisor struct {
	// contains filtered or unexported fields
}

type Shortfall struct {
	Unexercised int
	Red         int
	// Lost is how many public names the newest symbol-level reading says the
	// finished tree no longer spells. It is the check roster's sibling and it
	// belongs here for the same reason: a round that put back eight deleted
	// public attributes moved the work whatever the check-level row said, and
	// on igel s11 the check-level row said the tree had got BETTER on the run
	// that deleted them. store.SurfaceReading is the reading; nothing here
	// re-derives it.
	Lost int
	// Standing is the review finding that is still open, as a digest. Empty is
	// a job with nothing standing against it.
	Standing string
}

type SkillCandidate struct {
	Artifact string
}

type StandingWatch interface {
	Install(ctx context.Context) error
	// Uninstall is the reverse gear. A consent the product accepts and cannot
	// give back is not consent, and the timer repairs itself against a manual
	// `launchctl unload` every five minutes, so the only honest off-switch is
	// one the resident itself performs after journalling the decision.
	Uninstall(ctx context.Context) error
	Status() (watchdog.Status, error)
}

type TasteStanding struct {
	Scope string
	// For counts the corrections behind the rule plus every "this is what I
	// meant"; Against counts every "keep it this way".
	For     int
	Against int
	// KeepsSince counts only the refusals that landed after the rule's current
	// standing was recorded, which is what a demotion may act on.
	KeepsSince int
	// Confidence is For/(For+Against) shrunk toward the neutral prior by the
	// same n/(n+8) rule every other sensor in the store is judged by.
	Confidence float64
}

type TerritoryDigestFunc func(ctx context.Context, title string, jobs []TerritoryDigestJob, voice string) (string, error)

type TerritoryDigestJob struct {
	ID       string
	Title    string
	Ask      string
	Outcome  string
	Pointers []string
}

type TitleFunc func(ctx context.Context, goal string) (string, error)

type WatchPass struct {
	Examined  int
	Woken     int
	Checked   int
	Fired     int
	Proposed  int
	No        int
	Errors    int
	Quota     int
	Expired   int
	RailWaits int
}