Jeffy Loop 1.5.0

Every change in this release traces to a failure recorded in the public eval journals in evals/. Twelve projects were run to convergence and their append-only journals read in full; the patterns that cost the most iterations became this engine.

The engine (Stop hook)

• The hook does the budget arithmetic. Every re-feed now carries a RUN STATE line the engine counts itself: the iteration and how many remain, open tasks per section, unswept inventory rows, and, once only the convergence sequence remains, what that sequence still costs. Runs used to discover the arithmetic at the last iteration; the journals record one confessing "the budget arithmetic should have been done at iteration 7, not felt at iteration 9."
• A one-time +2 closing extension. When the budget expires with the ledger empty and the surface swept, the run gets exactly two more iterations to finish the ceremony instead of dying with the work done. Granted once, at exact exhaustion only, on both the plain and rejected-declaration paths.
• The verdict must be on the record. The hook refuses a convergence declaration whose closing journal entry carries no evaluator verdict, PASS or a stated unavailable. The ratchet is exempt; missing journals fail open.
• Machine-read lines stopped eating declarations. Six of twelve projects lost a first declaration to markdown on a machine-read line: backticks became command substitution (exit 127), a trailing annotation became a shell error (exit 2), a list-marker Converged line became invisible. The parsers now tolerate the marker and the backticks, check the command with bash -n before running anything, and name the exact fix instead of a mystery exit code. The fallback that executed section prose as shell is deleted.
• Rotation and archive counters anchor on real entry headings, with a one-shot migration for legacy baselines that counted the grammar template; an interrupt-desynced iteration counter now draws a hygiene note.

The method (templates)

• The adversarial evaluator fires the iteration the ledger first empties, given a clean audit on record and three or more iterations left, so a rejection lands while it can still be answered; up to three reviews when the first lands before the midpoint. The declaring iteration may close up to two gate-filed fixes, re-invoke, and declare as one transaction.
• Declining is priced: a non-runtime Low whose fix plus test exceeds one iteration is declined as cost: exceeds one iteration and named in the run report, never downgraded.
• Backlog lines carry a class (runtime, test, build-ci, docs, dev-tooling), runtime ordered first. Surface a host cannot reach is disclosed as - [~] with its reason instead of blocking convergence. Known-answer probe batteries are kept under .jeffy/probes/ and re-run instead of rebuilt. Working rules the corpus paid for are now binding, from "copy fixed files aside before a red-proof run" to "never pipe the verify through head or tail."

The launcher lints the plan's Verify command at /jeffy launch, so a malformed line costs one message at the start of a run instead of a rejected declaration at its end.

Validation. The behavioural suite grew from 75 to 116 checks. Three corpus failure scenarios were replayed against both engines: red on v1.4.1, green on v1.5.0. One limit stated plainly: the extension never fires over an occupied ledger, by design; a rejection that files tasks at the final iteration is answered by the earlier gate, not by more budget.

Upgrade: git pull and re-run the installer.