Budget grounding reconciliation by agent actions

notes/fresh-workspace-handoff.md

@@ -1083,18 +1083,30 @@ gives the second action an explicit refreshed `finding_catalog`; it never reruns
 the editor. Gates pass 15/15 newspaper tests, 469/469 library tests, 13/13
 strategic-smoke binary tests, and `git diff --check`.
 
+Exact-source run 45 at
+`1d898489daeb34fc9f53e6c6bddf00738fc66364` resumed revision 27 without
+world or successful-publication replay. Issues 13 and 14 remained preserved.
+Action one was rejected locally before the copy desk. Action two was admitted
+and rechecked, and the copy desk returned four fresh findings, but the
+two-action ceiling left no action to answer them. Issues 15 through 18 and the
+final digest remain absent. The bounded protocol needs three total actions: the
+initial action, at most one local-admission correction, and at most one fresh
+copy-desk correction. A rejection after action three is terminal; the same
+workbench state and receipts persist, and the editor never reruns. The exact
+mixed-path regression and full gates pass: 16/16 newspaper tests, 470/470
+library tests, 13/13 strategic-smoke binary tests, and `git diff --check`.
+
 Pushed `af749de` routes a provider timeout through the shared model transport's
 existing one same-request retry and records attempt telemetry. Run 36 crossed
 that boundary; timeout retry is not its active blocker.
 
-1. Commit and push the verified two-action reconciliation and refreshed-
-   `finding_catalog` cut.
-2. Resume from run 44's preserved Issue 13 and Issue 14 boundary at revision 27
+1. Commit and push the verified three-action reconciliation cut.
+2. Launch exact-source run 46 from immutable run 45's preserved Issue 13 and Issue 14 boundary at revision 27
    to compose Issues 15 through 18 plus the final digest. Preserve every
    completed wave checkpoint and canonical world state; do not replay mechanics
    or successful publications. Require the resulting unedited publications and
    final digest to pass fresh independent editorial and provenance review before
-   claiming acceptance. Preserve runs 38/39/40/42, the run-41 root and committed
+   claiming acceptance. Preserve runs 38/39/40/42/43/44/45, the run-41 root and committed
    world lineage, stopped run 23, exact acceptance conditions, and unchanged
    live daemons.
 3. Have the game-side adapter lower its authored hierarchy into the published

notes/ghostlight-current-system-map.md

@@ -1315,24 +1315,30 @@ surviving article selection and order, sections, bylines, and all unaffected
 text remain frozen. If the lead is deleted, owner code promotes the next article
 to the front page. The agent cannot request a new simulation or source packet,
 submit a replacement `EditorialPageDraft`, or act as a second editor. The same
-copy desk rechecks the complete repaired page. The worker permits at most two
-actions in one agent run: an initial repair and exactly one corrective action
-after a rejected tool observation. On the first rejection, the same workbench
-retains the repaired draft and current verdict, republishes the dynamic action
-schema, and exposes a freshly numbered finding catalog derived by the same
-helper used for the initial catalog. The harness includes the first action and
-copy-desk receipts in the second action's causal source chain. Acceptance ends
-the run immediately; an inadmissible repair, an empty surviving page, or a page
-rejected after the second action returns no edition. Thus the editor owns
+copy desk rechecks the complete repaired page. The worker permits at most three
+actions in one agent run: the initial repair and two bounded corrections. The
+intended full path can spend one correction on deterministic admission and one
+on a fresh copy-desk verdict; every rejected action consumes the same total
+budget rather than opening a separate retry owner for either boundary. After
+the first or second rejection, the same workbench retains the current private
+draft and verdict, republishes the dynamic action schema, and exposes a freshly
+numbered finding catalog derived by the same helper used for the initial
+catalog. The harness includes every prior action receipt and any copy-desk tool
+receipts in the next action's causal source chain; a local admission rejection
+correctly contributes no nonexistent tool receipt. Acceptance ends the run
+immediately. An inadmissible repair, an empty surviving page, or a page rejected
+after the third action returns no edition. Thus the editor owns
 initial copy, the reconciler owns only this bounded repair session, the copy
 desk owns grounding judgment, and none owns source facts or world state.
 Focused tests cover order-independent same-target phrase repair, exact same-desk
-repair with source identity preserved, bounded article deletion with survivor recheck, and
-one corrective response to the copy desk's current finding catalog. A terminal
-regression proves that a second rejection exhausts the two-action budget and
-retains all six editor, copy-desk, and action receipts, including both rejected
-action dispositions. The library and strategic-binary test suites pass. The typed
-issue retains exact event IDs, channels,
+repair with source identity preserved, bounded article deletion with survivor
+recheck, and one corrective response to the copy desk's current finding catalog.
+A mixed-path regression proves local empty-repair rejection, admitted repair and
+copy-desk rejection, then third-action acceptance with seven receipts and final
+copy-desk ancestry over every prior completed receipt. A terminal regression
+proves that three admitted but rejected repairs exhaust the three-action budget
+and retain all eight editor, copy-desk, and action receipts, including all three
+rejected action dispositions. The typed issue retains exact event IDs, channels,
 reliability, source revision, and model receipts as audit data. Its internal
 issue time is derived from the latest cited publication record without exposing
 that clock to editorial inference. Terminally rejected attempts semantically