diff --git a/README.md b/README.md
index d327e48..e9aa0e9 100644
--- a/README.md
+++ b/README.md
@@ -32,8 +32,9 @@ measured.
 - `settings/`: setting-specific proving grounds for language projects.
 
 **Live versus planned.** Live: docs, fixtures, examples, ontology data and the
-packet crate `crates/weksa`, including the scoring library. Planned: lowering,
-the `weksa score` subcommand, and the golf loop that scores lowered English against an expressive corpus. No
+packet crate `crates/weksa`, including lowering, `weksa lower` and `weksa score`,
+and the golf loop's round and edit-accept cycle (`weksa loop open|round|cycle`).
+Planned: a model lowerer, Score documents and the other panel languages. No
 daemon runs; the earlier Node daemon is parked at tag `parked/weksa-node-body`.
 
 ## Ownership Model
diff --git a/crates/weksa/src/context.rs b/crates/weksa/src/context.rs
index 4dd5e30..eb1f6bc 100644
--- a/crates/weksa/src/context.rs
+++ b/crates/weksa/src/context.rs
@@ -3,8 +3,10 @@
 //! [`TrainItems`] or by encoding one item an [`EncoderOffer`] holds: Train-only
 //! minting and per-item encoding (leak-owned-by-flow-and-scorer-3,
 //! loop-context-builder-2). Instruction text is [`MINT_INSTRUCTIONS`] and
-//! [`ENCODE_INSTRUCTIONS`], consts in this module; an encode prompt also lists
-//! the inventory at the run's revision.
+//! [`ENCODE_INSTRUCTIONS`], consts in this module; both prompts also list the
+//! inventory at the run's revision. A mint prompt is the editor's: it reads
+//! [`TrainItems`], an [`Inventory`] and an [`EditFeedback`] and nothing else, so
+//! no held-out text, key or per-item score can reach it.
 //!
 //! Item blocks are data from the run's pinned corpus, reached only through
 //! `RunStores`, the one public producer of `TrainItems` and `EncoderOffer`
@@ -17,12 +19,21 @@ use std::marker::PhantomData;
 use crate::corpus::CorpusItem;
 use crate::inventory::{Inventory, InventoryEntry, OptionLabel, ValueKind};
 use crate::packet::EntityId;
+use crate::run::LADDER_STEP;
 use crate::split::{Checkpoint, Split, SplitScheme, fnv1a64, hex16};
 use crate::store::{CorpusStore, normalized};
 
-/// The instructions a mint prompt starts with. golf-loop-en edits the wording
-/// here.
-pub const MINT_INSTRUCTIONS: &str = "Mint glosses from the lines below.";
+/// The instructions a mint prompt starts with: the editor's whole brief. Fixed
+/// per run by `PROMPT_SOURCE_DIGEST`.
+pub const MINT_INSTRUCTIONS: &str = "\
+Propose one edit to the inventory below, so that the lines below can be encoded and lowered to English more faithfully.
+Answer with one JSON object and nothing else: no code fence, no commentary.
+Shape: {\"add\": [{\"family\", \"gloss\", \"value_kind\", \"applies_to\"}], \"retire\": [ids]}; 1 to 8 changes in all, adds and retires together.
+- family: one of Concept, Frame, Role, Relation, SpeechAct, Feature, ReferentKind, Extension.
+- gloss: 1 to 120 bytes naming a general meaning, never a quoted line.
+- value_kind and applies_to only on a Feature; value_kind only on an Extension. value_kind is \"Grade\", \"Flag\" or {\"Options\": [labels]}; applies_to is a list of slots.
+- ids and revision numbers are the store's: write an id only to retire a live entry, by the id the inventory lists.
+The line after this brief says whether your last edit was kept and the held-out composite score at the current inventory.";
 
 /// The instructions an encode prompt starts with: the encoder's whole brief.
 /// Fixed per run by `PROMPT_SOURCE_DIGEST`.
@@ -214,6 +225,64 @@ impl<'cp> EncoderOffer<'cp> {
     }
 }
 
+/// What the editor is told of how its last edit fared: whether it was kept, and
+/// the held-out composite at the current inventory, rounded to the nearest
+/// [`LADDER_STEP`]. The head composite changes only when an edit is accepted and
+/// an accept needs a gain above one step, so a run releases at most
+/// `1 / LADDER_STEP` distinct values (Blum and Hardt 2015, the Ladder). Nothing
+/// else about the held-out split is a field.
+///
+/// ```
+/// let f = weksa::context::EditFeedback::none();
+/// # let _ = f;
+/// ```
+///
+/// Its fields are private:
+///
+/// ```compile_fail,E0451
+/// let _ = weksa::context::EditFeedback { last: None, head: None };
+/// ```
+///
+/// and only the run builds one with a reading:
+///
+/// ```compile_fail,E0624
+/// let _ = weksa::context::EditFeedback::new(Some(true), Some(0.5));
+/// ```
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct EditFeedback {
+    last: Option<bool>,
+    head: Option<f64>,
+}
+
+impl EditFeedback {
+    /// No edit yet and no reading.
+    pub fn none() -> Self {
+        Self {
+            last: None,
+            head: None,
+        }
+    }
+
+    /// `last`: whether the previous edit was accepted; `head`: the composite at
+    /// the current inventory, rounded here to the nearest [`LADDER_STEP`].
+    pub(crate) fn new(last: Option<bool>, head: Option<f64>) -> Self {
+        Self {
+            last,
+            head: head.map(|x| (x / LADDER_STEP).round() * LADDER_STEP),
+        }
+    }
+
+    fn line(&self) -> String {
+        let last = match self.last {
+            Some(true) => "accepted",
+            Some(false) => "rejected",
+            None => "none",
+        };
+        let head = self.head.map_or("none".to_string(), |x| format!("{x:.3}"));
+        format!("last edit: {last}; validation composite at head: {head}")
+    }
+}
+
 /// Text for a model call, and the keys of the items it holds. The only
 /// constructors are [`Prompt::mint`] and [`Prompt::encode`].
 ///
@@ -224,23 +293,30 @@ impl<'cp> EncoderOffer<'cp> {
 /// # let paths = weksa::run::RunPaths { corpus: &p("c.cc"), inventory: &p("i.cc"), entities: &p("e.cc") };
 /// # let run = weksa::run::RunStores::create(&p("run"), "t", paths, "m", "e").unwrap();
 /// let t = run.train().unwrap();
-/// let p = weksa::context::Prompt::mint(&t);
-/// assert_eq!(p.text(), weksa::context::MINT_INSTRUCTIONS);
+/// let inv = run.inventory().inventory().unwrap();
+/// let feedback = weksa::context::EditFeedback::none();
+/// let p = weksa::context::Prompt::mint(&t, &inv, 0, &feedback);
+/// assert!(p.text().starts_with(weksa::context::MINT_INSTRUCTIONS));
+/// assert!(p.text().contains("last edit: none; validation composite at head: none"));
+/// assert!(p.text().contains("inventory rev:0"));
 /// ```
 ///
-/// Instructions are not a parameter:
+/// Instructions are not a parameter; the same call with a fifth argument fails
+/// on arity alone:
 ///
-/// ```compile_fail
+/// ```compile_fail,E0061
 /// # let dir = tempfile::tempdir().unwrap();
 /// # let p = |n: &str| dir.path().join(n);
 /// # for n in ["c.cc", "i.cc", "e.cc"] { std::fs::write(p(n), [0x90]).unwrap(); }
 /// # let paths = weksa::run::RunPaths { corpus: &p("c.cc"), inventory: &p("i.cc"), entities: &p("e.cc") };
 /// # let run = weksa::run::RunStores::create(&p("run"), "t", paths, "m", "e").unwrap();
 /// let t = run.train().unwrap();
-/// let p = weksa::context::Prompt::mint("x", &t);
+/// let inv = run.inventory().inventory().unwrap();
+/// let feedback = weksa::context::EditFeedback::none();
+/// let p = weksa::context::Prompt::mint(&t, &inv, 0, &feedback, "x");
 /// ```
 ///
-/// ```compile_fail
+/// ```compile_fail,E0277
 /// fn s<T: serde::Serialize>(_: &T) {}
 /// # let dir = tempfile::tempdir().unwrap();
 /// # let p = |n: &str| dir.path().join(n);
@@ -248,7 +324,9 @@ impl<'cp> EncoderOffer<'cp> {
 /// # let paths = weksa::run::RunPaths { corpus: &p("c.cc"), inventory: &p("i.cc"), entities: &p("e.cc") };
 /// # let run = weksa::run::RunStores::create(&p("run"), "t", paths, "m", "e").unwrap();
 /// let t = run.train().unwrap();
-/// let p = weksa::context::Prompt::mint(&t);
+/// let inv = run.inventory().inventory().unwrap();
+/// let feedback = weksa::context::EditFeedback::none();
+/// let p = weksa::context::Prompt::mint(&t, &inv, 0, &feedback);
 /// s(&p);
 /// ```
 pub struct Prompt {
@@ -303,13 +381,33 @@ fn entry_line(entry: &InventoryEntry) -> String {
     line
 }
 
+/// Each entry of `inventory` live at `rev`, one `\n` and one line apiece: the
+/// listing both prompts print under `inventory rev:<rev>`.
+fn inventory_lines(inventory: &Inventory, rev: u32) -> String {
+    inventory
+        .entries()
+        .filter(|e| e.live_at(rev))
+        .map(|e| format!("\n{}", entry_line(e)))
+        .collect()
+}
+
 /// Printed in place of a prior turn whose text no live Train item holds.
 const ELIDED: &str = "[elided]";
 
 impl Prompt {
-    /// [`MINT_INSTRUCTIONS`], then every Train item in key order.
-    pub fn mint(train: &TrainItems) -> Prompt {
-        let mut parts = vec![MINT_INSTRUCTIONS.to_string()];
+    /// [`MINT_INSTRUCTIONS`], the feedback line, the entries of `inventory` live
+    /// at `rev`, then every Train item in key order without prior turns.
+    pub fn mint(
+        train: &TrainItems,
+        inventory: &Inventory,
+        rev: u32,
+        feedback: &EditFeedback,
+    ) -> Prompt {
+        let mut parts = vec![
+            MINT_INSTRUCTIONS.to_string(),
+            feedback.line(),
+            format!("inventory rev:{rev}{}", inventory_lines(inventory, rev)),
+        ];
         parts.extend(train.items.iter().map(|item| block(item, None)));
         Prompt {
             text: parts.join("\n\n"),
@@ -327,15 +425,12 @@ impl Prompt {
         rev: u32,
     ) -> Prompt {
         let ids: Vec<&str> = offer.entities.iter().map(EntityId::as_str).collect();
-        let mut text = format!(
-            "{ENCODE_INSTRUCTIONS}\n\n{}\n\nentities: {}\n\ninventory rev:{rev}",
+        let text = format!(
+            "{ENCODE_INSTRUCTIONS}\n\n{}\n\nentities: {}\n\ninventory rev:{rev}{}",
             block(&offer.item, Some(train)),
-            ids.join(", ")
+            ids.join(", "),
+            inventory_lines(inventory, rev)
         );
-        for entry in inventory.entries().filter(|e| e.live_at(rev)) {
-            text.push('\n');
-            text.push_str(&entry_line(entry));
-        }
         Prompt {
             text,
             items: vec![offer.item.id.clone()],
@@ -363,6 +458,38 @@ mod tests {
     use super::*;
     use crate::split::fixture::{group_in, item};
 
+    #[test]
+    fn the_feedback_line_prints_exact_values() {
+        let line = |last, head| EditFeedback::new(last, head).line();
+        assert_eq!(
+            EditFeedback::none().line(),
+            "last edit: none; validation composite at head: none"
+        );
+        assert_eq!(
+            line(Some(true), Some(0.5)),
+            "last edit: accepted; validation composite at head: 0.500"
+        );
+        assert_eq!(
+            line(Some(false), Some(0.0)),
+            "last edit: rejected; validation composite at head: 0.000"
+        );
+        assert_eq!(line(None, None), EditFeedback::none().line());
+        // The head is rounded to the nearest step before it is printed.
+        assert_eq!(
+            line(None, Some(0.5012)),
+            "last edit: none; validation composite at head: 0.500"
+        );
+        assert_eq!(
+            line(None, Some(0.5026)),
+            "last edit: none; validation composite at head: 0.505"
+        );
+        assert_eq!(
+            line(None, Some(0.9999)),
+            "last edit: none; validation composite at head: 1.000"
+        );
+        assert_eq!(EditFeedback::new(None, Some(0.5026)).head, Some(0.505));
+    }
+
     #[test]
     fn checkpoint_offer_gate() {
         // A fresh checkpoint per call: this test is the gate, not the once rule.
diff --git a/crates/weksa/src/encode.rs b/crates/weksa/src/encode.rs
index 430f360..c8b37a2 100644
--- a/crates/weksa/src/encode.rs
+++ b/crates/weksa/src/encode.rs
@@ -1,15 +1,23 @@
-//! The encoder step: what a model's answer becomes. This is the one place JSON
-//! is read (the xenos boundary): a model answers in JSON, `PacketDraft::parse`
-//! reads it, and nothing is stored as JSON. The model writes meaning only;
-//! `into_packet` sets the id, schema version, inventory revision, kind,
+//! The encoder and editor steps: what a model's answer becomes. This is the one
+//! place JSON is read (the xenos boundary): a model answers in JSON,
+//! `PacketDraft::parse` or `EditDraft::parse` reads it (both through
+//! `from_json`), and nothing is stored as JSON. The encoder writes meaning
+//! only; `into_packet` sets the id, schema version, inventory revision, kind,
 //! provenance, constraints and extensions, and an empty trace, so a model that
-//! saw a Validation item cannot hand its words to whoever reads packets.
+//! saw a Validation item cannot hand its words to whoever reads packets. The
+//! editor writes family, gloss, value kind and slots only; `into_revision` sets
+//! every id and revision number.
 
 use std::fmt;
+use std::num::NonZeroU32;
 
+use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 
 use crate::corpus::CorpusItemId;
+use crate::inventory::{
+    Change, Family, InvId, Inventory, InventoryEntry, InventoryRevision, Slot, ValueKind,
+};
 use crate::packet::{
     Constraints, Context, Discourse, EncoderId, Grade, Packet, PacketId, PacketKind, Predication,
     Provenance, ProvenanceSource, Referent, Relation, SCHEMA_VERSION, Stance, Trace,
@@ -58,12 +66,17 @@ impl fmt::Debug for DraftError {
 
 impl std::error::Error for DraftError {}
 
+/// The one JSON read of a model's answer.
+fn from_json<T: DeserializeOwned>(answer: &str) -> Result<T, DraftError> {
+    serde_json::from_str(answer.trim()).map_err(|e| DraftError {
+        line: e.line(),
+        column: e.column(),
+    })
+}
+
 impl PacketDraft {
     pub fn parse(answer: &str) -> Result<Self, DraftError> {
-        serde_json::from_str(answer.trim()).map_err(|e| DraftError {
-            line: e.line(),
-            column: e.column(),
-        })
+        from_json(answer)
     }
 
     /// The draft that says what `packet` says.
@@ -105,6 +118,87 @@ impl PacketDraft {
     }
 }
 
+/// The most changes (adds and retires together) one edit may make.
+pub const MAX_EDIT_CHANGES: usize = 8;
+
+/// One entry an edit adds, as the editor writes it: no id and no revision.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EntryDraft {
+    pub family: Family,
+    pub gloss: String,
+    #[serde(default)]
+    pub value_kind: Option<ValueKind>,
+    #[serde(default)]
+    pub applies_to: Vec<Slot>,
+}
+
+/// An inventory edit as the editor writes it: entries to add and ids to retire.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EditDraft {
+    #[serde(default)]
+    pub add: Vec<EntryDraft>,
+    #[serde(default)]
+    pub retire: Vec<InvId>,
+}
+
+impl EditDraft {
+    pub fn parse(answer: &str) -> Result<Self, DraftError> {
+        from_json(answer)
+    }
+
+    /// The revision after `base` this edit asks for, and the entries it adds.
+    /// `None` when the edit makes no change or more than [`MAX_EDIT_CHANGES`].
+    /// Every id is the store's: an added entry takes the next number of its
+    /// family after the highest in `inventory`, retired entries included, in
+    /// draft order. Nothing else is judged here: the gloss, the entry's shape,
+    /// whether a retire target is live and a repeated id are
+    /// `InventoryStore::admit_revision`'s to refuse.
+    pub(crate) fn into_revision(
+        self,
+        inventory: &Inventory,
+        base: u32,
+    ) -> Option<(InventoryRevision, Vec<InventoryEntry>)> {
+        let count = self.add.len() + self.retire.len();
+        if count == 0 || count > MAX_EDIT_CHANGES {
+            return None;
+        }
+        let n = base.checked_add(1)?;
+        let mut entries: Vec<InventoryEntry> = Vec::new();
+        for draft in self.add {
+            let highest = inventory
+                .entries()
+                .map(|e| e.id)
+                .chain(entries.iter().map(|e| e.id))
+                .filter(|id| id.family() == draft.family)
+                .map(|id| id.n().get())
+                .max()
+                .unwrap_or(0);
+            entries.push(InventoryEntry {
+                id: draft.family.id(NonZeroU32::new(highest.checked_add(1)?)?),
+                gloss: draft.gloss,
+                value_kind: draft.value_kind,
+                applies_to: draft.applies_to,
+                introduced_rev: n,
+                retired_rev: None,
+            });
+        }
+        let changes = entries
+            .iter()
+            .map(|e| Change::Add(e.id))
+            .chain(self.retire.into_iter().map(Change::Retire))
+            .collect();
+        let revision = InventoryRevision {
+            n,
+            parent: Some(base),
+            changes,
+            frozen: false,
+        };
+        Some((revision, entries))
+    }
+}
+
 /// `encoder:<hex16>`, a digest of the model id and the prompt digest.
 pub fn encoder_id(model: &str, prompt_digest: &str) -> EncoderId {
     let digest = fnv1a64(format!("weksa-encoder-v1:{model}:{prompt_digest}").as_bytes());
@@ -228,4 +322,147 @@ mod tests {
             assert!(!text.contains("CANARY"), "{text}");
         }
     }
+
+    fn entry(id: &str, retired: Option<u32>) -> InventoryEntry {
+        let id = InvId::parse(id).unwrap();
+        InventoryEntry {
+            id,
+            gloss: "g".into(),
+            value_kind: (id.family() == Family::Extension).then_some(ValueKind::Flag),
+            applies_to: vec![],
+            introduced_rev: 1,
+            retired_rev: retired,
+        }
+    }
+
+    fn add(family: Family, gloss: &str) -> EntryDraft {
+        EntryDraft {
+            family,
+            gloss: gloss.into(),
+            value_kind: None,
+            applies_to: vec![],
+        }
+    }
+
+    #[test]
+    fn ids_are_the_stores() {
+        // concept:1 live, concept:3 retired (the highest), frame:2 live; no role.
+        let inv = Inventory::new(
+            vec![
+                entry("concept:1", None),
+                entry("concept:3", Some(2)),
+                entry("frame:2", None),
+            ],
+            vec![],
+        );
+        let draft = EditDraft {
+            add: vec![
+                add(Family::Concept, "first"),
+                add(Family::Role, "role"),
+                add(Family::Concept, "second"),
+                add(Family::Frame, "frame"),
+            ],
+            retire: vec![
+                InvId::parse("concept:1").unwrap(),
+                InvId::parse("frame:2").unwrap(),
+            ],
+        };
+        let (rev, entries) = draft.clone().into_revision(&inv, 6).unwrap();
+        let ids: Vec<String> = entries.iter().map(|e| e.id.to_string()).collect();
+        // After the highest of the family, retired ones included, in draft order.
+        assert_eq!(ids, ["concept:4", "role:1", "concept:5", "frame:3"]);
+        assert_eq!((rev.n, rev.parent, rev.frozen), (7, Some(6), false));
+        assert!(
+            entries
+                .iter()
+                .all(|e| e.introduced_rev == 7 && e.retired_rev.is_none())
+        );
+        let glosses: Vec<&str> = entries.iter().map(|e| e.gloss.as_str()).collect();
+        assert_eq!(glosses, ["first", "role", "second", "frame"]);
+        // Adds in draft order, then the retires in draft order.
+        let changes: Vec<String> = rev
+            .changes
+            .iter()
+            .map(|c| match c {
+                Change::Add(id) => format!("+{id}"),
+                Change::Retire(id) => format!("-{id}"),
+            })
+            .collect();
+        assert_eq!(
+            changes,
+            [
+                "+concept:4",
+                "+role:1",
+                "+concept:5",
+                "+frame:3",
+                "-concept:1",
+                "-frame:2"
+            ]
+        );
+    }
+
+    #[test]
+    fn the_change_count_is_one_to_eight() {
+        let inv = Inventory::new(vec![entry("concept:1", None)], vec![]);
+        let adds = |n: usize| EditDraft {
+            add: (0..n)
+                .map(|i| add(Family::Concept, &format!("g{i}")))
+                .collect(),
+            retire: vec![],
+        };
+        assert!(adds(0).into_revision(&inv, 1).is_none());
+        assert!(adds(1).into_revision(&inv, 1).is_some());
+        assert_eq!(adds(8).into_revision(&inv, 1).unwrap().1.len(), 8);
+        assert!(adds(9).into_revision(&inv, 1).is_none());
+        // Adds and retires count together.
+        let mixed = |a: usize, r: usize| EditDraft {
+            add: (0..a).map(|_| add(Family::Concept, "g")).collect(),
+            retire: vec![InvId::parse("concept:1").unwrap(); r],
+        };
+        assert!(mixed(4, 4).into_revision(&inv, 1).is_some());
+        assert!(mixed(4, 5).into_revision(&inv, 1).is_none());
+        assert!(mixed(0, 9).into_revision(&inv, 1).is_none());
+        // A repeated retire is the door's to refuse, not this fn's.
+        assert!(mixed(0, 2).into_revision(&inv, 1).is_some());
+    }
+
+    #[test]
+    fn an_edit_draft_reads_what_an_editor_may_write() {
+        let d = EditDraft::parse(
+            r#" {"add":[{"family":"Feature","gloss":"g","value_kind":{"Options":["a","b"]},"applies_to":["Referent"]}],"retire":["concept:2"]} "#,
+        )
+        .unwrap();
+        assert_eq!(d.add[0].family, Family::Feature);
+        assert_eq!(d.add[0].applies_to, [Slot::Referent]);
+        assert_eq!(d.retire, [InvId::parse("concept:2").unwrap()]);
+        // Both lists default; value_kind and applies_to default.
+        let d = EditDraft::parse(r#"{"add":[{"family":"Concept","gloss":"g"}]}"#).unwrap();
+        assert_eq!(d.add[0].value_kind, None);
+        assert!(d.add[0].applies_to.is_empty() && d.retire.is_empty());
+        assert_eq!(EditDraft::parse("{}").unwrap().add.len(), 0);
+    }
+
+    #[test]
+    fn an_edit_draft_refuses_what_the_store_writes() {
+        // An id, a revision number or a retired mark is the store's to write.
+        for field in ["id", "introduced_rev", "retired_rev", "n", "parent"] {
+            let json = format!(r#"{{"add":[{{"family":"Concept","gloss":"g","{field}":1}}]}}"#);
+            assert!(EditDraft::parse(&json).is_err(), "{field} in an entry");
+        }
+        for field in ["revision", "frozen", "changes"] {
+            let json = format!(r#"{{"add":[],"{field}":1}}"#);
+            assert!(EditDraft::parse(&json).is_err(), "{field} in an edit");
+        }
+        // A family or a retire id that is not one.
+        assert!(EditDraft::parse(r#"{"add":[{"family":"Nope","gloss":"g"}]}"#).is_err());
+        assert!(EditDraft::parse(r#"{"retire":["concept:0"]}"#).is_err());
+        assert!(EditDraft::parse(r#"{"retire":[1]}"#).is_err());
+        // Not JSON, not an object, an error that names no token.
+        let err = EditDraft::parse("{\n  \"add\": CANARYTOKEN").unwrap_err();
+        assert_eq!((err.line, err.column), (2, 10));
+        for text in [err.to_string(), format!("{err:?}")] {
+            assert!(!text.contains("CANARY"), "{text}");
+        }
+        assert!(EditDraft::parse("3").is_err() && EditDraft::parse("\"x\"").is_err());
+    }
 }
diff --git a/crates/weksa/src/inventory.rs b/crates/weksa/src/inventory.rs
index 6c8b984..ec59b13 100644
--- a/crates/weksa/src/inventory.rs
+++ b/crates/weksa/src/inventory.rs
@@ -85,6 +85,11 @@ impl InvId {
     pub fn family(self) -> Family {
         self.family
     }
+
+    /// The `n` of `<family prefix>:<n>`.
+    pub fn n(self) -> NonZeroU32 {
+        self.n
+    }
 }
 
 impl fmt::Display for InvId {
diff --git a/crates/weksa/src/lib.rs b/crates/weksa/src/lib.rs
index f61a9b6..c741c62 100644
--- a/crates/weksa/src/lib.rs
+++ b/crates/weksa/src/lib.rs
@@ -23,7 +23,7 @@ pub mod store;
 pub mod validate;
 
 pub use corpus::{CorpusItem, CorpusItemId, NameSpan, Source, Turn};
-pub use encode::PacketDraft;
+pub use encode::{EditDraft, PacketDraft};
 pub use entity::{Entity, EntityOrigin, LanguageForms, Pronunciation};
 pub use form::FormError;
 pub use inventory::{
@@ -36,7 +36,7 @@ pub use packet::{
     EncoderId, EntityId, Grade, NodeId, Packet, PacketId, PacketKind, SCHEMA_VERSION, Stance,
 };
 pub use phones::{Phone, PhoneInventory, SegmentError, Stress};
-pub use run::{RoundRecord, RunStores, round};
+pub use run::{Decision, RoundRecord, RunStores, cycle, round};
 pub use score::{Embedder, ItemScore, OllamaEmbedder, Scorer, chrf};
 pub use speaker::{Annotator, PairRelation, Party, Scene, Speaker};
 pub use split::{Split, SplitScheme};
diff --git a/crates/weksa/src/main.rs b/crates/weksa/src/main.rs
index 5e7eb28..7901ca5 100644
--- a/crates/weksa/src/main.rs
+++ b/crates/weksa/src/main.rs
@@ -11,7 +11,7 @@ use weksa::corpus::{CorpusItem, ModelFamily, NameSpan, Source, Turn};
 use weksa::entity::{Entity, EntityOrigin, LanguageForms, Pronunciation};
 use weksa::inventory::{proof_revision, seed};
 use weksa::packet::proof_packet;
-use weksa::run::{RoundOutcome, RunPaths, RunStores, round};
+use weksa::run::{CycleOutcome, RoundOutcome, RunPaths, RunStores, cycle, round};
 use weksa::score::ScoreInput;
 use weksa::{
     AnswerFiles, CorpusStore, EntityId, EntityStore, InventoryStore, OllamaEmbedder, PacketStore,
@@ -98,6 +98,15 @@ enum LoopCommand {
         #[arg(long, default_value = "http://127.0.0.1:11434")]
         ollama_url: String,
     },
+    /// Run one edit-accept cycle of the run at ROOT. The stores are read only
+    /// from the run's record. Prompts without answers are written to the
+    /// cycle's directory and the command exits 3; rerun after the `.answer`
+    /// files exist.
+    Cycle {
+        root: PathBuf,
+        #[arg(long, default_value = "http://127.0.0.1:11434")]
+        ollama_url: String,
+    },
 }
 
 #[derive(Subcommand)]
@@ -758,6 +767,25 @@ fn main() -> Result<()> {
                 RoundOutcome::Recorded(r) => println!("{}", r.summary_line()),
             }
         }
+        Command::Loop(LoopCommand::Cycle { root, ollama_url }) => {
+            let unreadable = |_| anyhow::anyhow!("a store would not read");
+            let mut run = RunStores::open(&root)?;
+            let mut files = AnswerFiles::new(
+                run.next_cycle_dir().map_err(unreadable)?,
+                run.record().model.clone(),
+            );
+            let scorer = Scorer::new(OllamaEmbedder::new(&ollama_url, &run.record().embedder));
+            match cycle(&mut run, &mut files, &scorer)? {
+                CycleOutcome::Unanswered { prompts } => {
+                    for digest in &prompts {
+                        println!("unanswered {digest}");
+                    }
+                    println!("unanswered {} prompts", prompts.len());
+                    std::process::exit(3);
+                }
+                CycleOutcome::Decided(decision) => println!("{}", decision.summary_line()),
+            }
+        }
         Command::Schema { out } => {
             std::fs::create_dir_all(&out)?;
             for (name, json) in weksa::schema::published() {
diff --git a/crates/weksa/src/run.rs b/crates/weksa/src/run.rs
index de6d846..1beb442 100644
--- a/crates/weksa/src/run.rs
+++ b/crates/weksa/src/run.rs
@@ -1,8 +1,15 @@
-//! One golf-loop run: the stores it pinned at open, the rounds it has recorded,
-//! and the one writer of both (`RunStores::create` and, for rounds, `round`).
+//! One golf-loop run: the stores it pinned at open, the rounds and decisions it
+//! has recorded, and the one writer of all of them (`RunStores::create`, `round`
+//! and `cycle`). A cycle asks an editor for one inventory edit, scores a
+//! candidate round under it and accepts or rejects on Validation (`decide`); the
+//! latest Accepted decision names the run's head inventory.
 //!
 //! A run pins its corpus and entity store files by canonical path and FNV-1a 64
-//! digest of their bytes. Every round reopens them only from that record and
+//! digest of their bytes. It works on its own copy of the inventory:
+//! `RunStores::create` copies the caller's inventory file to
+//! `<root>/inventory.cc` and pins the digest of the copy; the caller's path is
+//! kept as provenance and never opened again, and `open` refuses a head file
+//! whose digest differs. Every round reopens them only from that record and
 //! refuses on drift, and every round record carries the digests. Nothing inside
 //! a process whose writer controls the code can stop an item faked into a
 //! scratch store; what this makes true is that a run over a scratch store is a
@@ -19,9 +26,9 @@ use cultcache_rs::{CultCache, DatabaseEntry};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use crate::context::{EncoderOffer, Prompt, TrainItems};
+use crate::context::{EditFeedback, EncoderOffer, Prompt, TrainItems};
 use crate::corpus::{CorpusItem, CorpusItemId};
-use crate::encode::{PacketDraft, encoder_id};
+use crate::encode::{EditDraft, PacketDraft, encoder_id};
 use crate::form::{is_attestation, is_slug};
 use crate::lower::lower;
 use crate::model::{ModelPort, PortError};
@@ -37,6 +44,13 @@ pub const PROMPT_SOURCE_DIGEST: u64 = fnv1a64(include_bytes!("context.rs"));
 /// included, ends a run; code outside that file is not covered.
 pub const LOWERER_SOURCE_DIGEST: u64 = fnv1a64(include_bytes!("lower.rs"));
 
+/// The least composite gain an edit must show over item noise to be kept, and
+/// the grid the editor's one held-out number is rounded to. A run releases at
+/// most `1 / LADDER_STEP` = 200 distinct head composites (the Ladder, Blum and
+/// Hardt 2015), because the head changes only on an accept and an accept needs
+/// a gain above one step.
+pub const LADDER_STEP: f64 = 0.005;
+
 /// What a run pinned at open. Key `run:<label>`.
 #[derive(Clone, Debug, PartialEq, Eq, JsonSchema, DatabaseEntry)]
 #[cultcache(type = "weksa.loop_run")]
@@ -46,6 +60,9 @@ pub struct RunRecord {
     /// Canonical absolute path of the corpus store.
     #[cultcache(key = 1)]
     pub corpus: String,
+    /// Canonical absolute path of the inventory store the run was opened over:
+    /// provenance only. `create` copies that file to `<root>/inventory.cc` and
+    /// the run reads nothing at this path afterwards.
     #[cultcache(key = 2)]
     pub inventory: String,
     #[cultcache(key = 3)]
@@ -67,6 +84,9 @@ pub struct RunRecord {
     pub embedder: String,
     #[cultcache(key = 10)]
     pub chrf_version: String,
+    /// 16 hex of the bytes `create` copied to `<root>/inventory.cc`.
+    #[cultcache(key = 11)]
+    pub inventory_digest: String,
 }
 
 /// Where a round refused: the first stage that did.
@@ -137,6 +157,8 @@ pub struct RefusalCounts {
 ///         validation_mean: SplitMean::default(),
 ///         validation_scored: 0,
 ///         validation_refused: RefusalCounts::default(),
+///         inventory_digest: String::new(),
+///         cycle: None,
 ///     }
 /// }
 /// ```
@@ -180,6 +202,12 @@ pub struct RoundRecord {
     /// raise it.
     #[cultcache(key = 15)]
     validation_scored: u32,
+    /// 16 hex of the inventory file the round was scored under.
+    #[cultcache(key = 16)]
+    inventory_digest: String,
+    /// `Some(k)` for the candidate round of cycle `k`.
+    #[cultcache(key = 17)]
+    cycle: Option<u32>,
 }
 
 impl RoundRecord {
@@ -231,6 +259,12 @@ impl RoundRecord {
     pub fn validation_scored(&self) -> u32 {
         self.validation_scored
     }
+    pub fn inventory_digest(&self) -> &str {
+        &self.inventory_digest
+    }
+    pub fn cycle(&self) -> Option<u32> {
+        self.cycle
+    }
 
     /// The one line a recorded round prints. `n` is every item of the split,
     /// `scored` those that lowered; a mean counts a refused item as 0.
@@ -276,6 +310,8 @@ pub enum DriftOf {
     Lowerer,
     Model,
     Embedder,
+    /// The run's own head inventory file.
+    Inventory,
 }
 
 /// A run's failure. Display and Debug name a kind, never a path, key, label or
@@ -296,6 +332,10 @@ pub enum RunError {
     Store,
     /// The embedder failed.
     Embed,
+    /// Rounds 1 and 2 are not two plain replicates under the run's first inventory.
+    NoFloor,
+    /// A round has no Validation reading.
+    NoValidation,
 }
 
 impl fmt::Display for RunError {
@@ -309,6 +349,8 @@ impl fmt::Display for RunError {
             RunError::Io(kind) => write!(f, "io error {kind:?}"),
             RunError::Store => f.write_str("a store would not read or write"),
             RunError::Embed => f.write_str("the embedder failed"),
+            RunError::NoFloor => f.write_str("the run has no noise floor: record two rounds first"),
+            RunError::NoValidation => f.write_str("a reading has no validation item"),
         }
     }
 }
@@ -340,10 +382,17 @@ pub struct RunStores {
     entities: EntityStore,
 }
 
-fn file_digest(path: &str) -> Option<String> {
+/// The run's own copy of the inventory, made at `create`.
+const INVENTORY_FILE: &str = "inventory.cc";
+
+fn file_digest_at(path: &Path) -> Option<String> {
     std::fs::read(path).ok().map(|b| hex16(fnv1a64(&b)))
 }
 
+fn file_digest(path: &str) -> Option<String> {
+    file_digest_at(Path::new(path))
+}
+
 fn canonical(path: &Path) -> Result<String, RunError> {
     std::fs::canonicalize(path)
         .map_err(|e| RunError::Io(e.kind()))?
@@ -355,7 +404,8 @@ fn canonical(path: &Path) -> Result<String, RunError> {
 fn run_cache(root: &Path) -> Result<CultCache, RunError> {
     open_cache(&root.join("run.cc"), |c| {
         c.register_entry_type::<RunRecord>()?;
-        c.register_entry_type::<RoundRecord>()
+        c.register_entry_type::<RoundRecord>()?;
+        c.register_entry_type::<Decision>()
     })
     .map_err(|_| RunError::Store)
 }
@@ -368,6 +418,24 @@ fn one_run(cache: &CultCache) -> Result<Option<RunRecord>, RunError> {
         .next())
 }
 
+/// Copies `from` onto a `to` that must not exist: a root that already holds a
+/// file of that name (the source itself, say) refuses before anything is written.
+fn copy_new(from: &Path, to: &Path) -> Result<(), RunError> {
+    let io = |e: std::io::Error| RunError::Io(e.kind());
+    let mut source = std::fs::File::open(from).map_err(io)?;
+    let mut dest = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(to)
+        .map_err(io)?;
+    if let Err(e) = std::io::copy(&mut source, &mut dest) {
+        // The file is ours (create_new made it): a half copy must not block a retry.
+        let _ = std::fs::remove_file(to);
+        return Err(io(e));
+    }
+    Ok(())
+}
+
 impl RunStores {
     /// Pins the three stores at `root`, which must hold no run. A store file
     /// that does not exist is `Io(NotFound)`.
@@ -403,16 +471,29 @@ impl RunStores {
             model: model.to_string(),
             embedder: embedder.to_string(),
             chrf_version: CHRF_VERSION.to_string(),
+            inventory_digest: String::new(),
         };
-        let record = RunRecord {
-            corpus_digest: file_digest(&record.corpus).ok_or(RunError::Store)?,
-            entity_digest: file_digest(&record.entities).ok_or(RunError::Store)?,
-            ..record
-        };
-        cache
-            .put(format!("run:{label}"), &record)
-            .map_err(|_| RunError::Store)?;
-        Self::with(root, cache, record)
+        // The run works on its own copy; the caller's store is never opened again.
+        let head = root.join(INVENTORY_FILE);
+        copy_new(Path::new(&record.inventory), &head)?;
+        // The copy is ours from here: any later failure takes it away again, or
+        // it would refuse every retry.
+        let pinned = (|| {
+            let record = RunRecord {
+                corpus_digest: file_digest(&record.corpus).ok_or(RunError::Store)?,
+                entity_digest: file_digest(&record.entities).ok_or(RunError::Store)?,
+                inventory_digest: file_digest_at(&head).ok_or(RunError::Store)?,
+                ..record
+            };
+            cache
+                .put(format!("run:{label}"), &record)
+                .map_err(|_| RunError::Store)?;
+            Self::with(root, cache, record)
+        })();
+        if pinned.is_err() {
+            let _ = std::fs::remove_file(&head);
+        }
+        pinned
     }
 
     /// Reopens the run at `root` from its record, refusing when a pinned store
@@ -435,15 +516,20 @@ impl RunStores {
         if file_digest(&record.entities).as_ref() != Some(&record.entity_digest) {
             return Err(RunError::Drift(DriftOf::Entities));
         }
+        let (path, digest, _) = head_of(&cache, root, &record)?;
+        if file_digest_at(&path).as_ref() != Some(&digest) {
+            return Err(RunError::Drift(DriftOf::Inventory));
+        }
         Self::with(root, cache, record)
     }
 
     fn with(root: &Path, cache: CultCache, record: RunRecord) -> Result<Self, RunError> {
         let store = |_| RunError::Store;
+        let (head, _, _) = head_of(&cache, root, &record)?;
         Ok(Self {
             root: root.to_path_buf(),
             corpus: CorpusStore::open(Path::new(&record.corpus)).map_err(store)?,
-            inventory: InventoryStore::open(Path::new(&record.inventory)).map_err(store)?,
+            inventory: InventoryStore::open(&head).map_err(store)?,
             entities: EntityStore::open(Path::new(&record.entities)).map_err(store)?,
             cache,
             record,
@@ -499,6 +585,23 @@ impl RunStores {
         Ok(rounds)
     }
 
+    /// The recorded decisions, by cycle.
+    pub fn decisions(&self) -> anyhow::Result<Vec<Decision>> {
+        decisions_of(&self.cache)
+    }
+
+    /// The head inventory file, its digest and its establishing round.
+    fn head(&self) -> Result<(PathBuf, String, u32), RunError> {
+        head_of(&self.cache, &self.root, &self.record)
+    }
+
+    /// `<root>/cycle-<k>` for the next undecided cycle `k`.
+    pub fn next_cycle_dir(&self) -> anyhow::Result<PathBuf> {
+        Ok(self
+            .root
+            .join(format!("cycle-{}", self.decisions()?.len() + 1)))
+    }
+
     /// `<root>/round-<n>` for the next unrecorded round `n`.
     pub fn next_round_dir(&self) -> anyhow::Result<PathBuf> {
         Ok(self
@@ -507,8 +610,42 @@ impl RunStores {
     }
 }
 
-/// What a round came to.
+fn decisions_of(cache: &CultCache) -> anyhow::Result<Vec<Decision>> {
+    let mut decisions = cache.get_all::<Decision>()?;
+    decisions.sort_by_key(Decision::k);
+    Ok(decisions)
+}
+
+/// The head is derived, never stored: the latest Accepted decision names it
+/// (`<root>/cycle-<k>/inventory.cc`, its candidate digest, its candidate round);
+/// with none it is the copy `create` made and round 1.
+fn head_of(
+    cache: &CultCache,
+    root: &Path,
+    record: &RunRecord,
+) -> Result<(PathBuf, String, u32), RunError> {
+    let decisions = decisions_of(cache).map_err(|_| RunError::Store)?;
+    let accepted = decisions.iter().rfind(|d| d.verdict == Verdict::Accepted);
+    match accepted {
+        None => Ok((
+            root.join(INVENTORY_FILE),
+            record.inventory_digest.clone(),
+            1,
+        )),
+        Some(d) => Ok((
+            root.join(format!("cycle-{}", d.k)).join(INVENTORY_FILE),
+            d.candidate_inventory_digest
+                .clone()
+                .ok_or(RunError::Store)?,
+            d.candidate_round.ok_or(RunError::Store)?,
+        )),
+    }
+}
+
+/// What a round came to. One is built per call and matched at once, so the
+/// size of the record is not worth an indirection.
 #[derive(Debug)]
+#[allow(clippy::large_enum_variant)]
 pub enum RoundOutcome {
     /// Prompts nobody has answered; nothing was written to the run or admitted.
     Unanswered {
@@ -537,14 +674,53 @@ pub fn round<M: ModelPort, E: Embedder>(
     model: &mut M,
     scorer: &Scorer<E>,
 ) -> Result<RoundOutcome, RunError> {
+    check_drift(run, model, scorer)?;
     let store = |_| RunError::Store;
+    let dir = run.next_round_dir().map_err(store)?;
+    let (_, digest, _) = run.head()?;
+    match score_round(run, &run.inventory, &digest, &dir, None, model, scorer)? {
+        RoundOutcome::Recorded(record) => {
+            run.cache
+                .put(
+                    format!("run:{}:round:{}", run.record.label, record.n),
+                    &record,
+                )
+                .map_err(store)?;
+            Ok(RoundOutcome::Recorded(record))
+        }
+        unanswered => Ok(unanswered),
+    }
+}
+
+/// The model and embedder the run pinned are the ones answering.
+fn check_drift<M: ModelPort, E: Embedder>(
+    run: &RunStores,
+    model: &M,
+    scorer: &Scorer<E>,
+) -> Result<(), RunError> {
     if model.model() != run.record.model {
         return Err(RunError::Drift(DriftOf::Model));
     }
     if scorer.embedder().model() != run.record.embedder {
         return Err(RunError::Drift(DriftOf::Embedder));
     }
-    let inventory = run.inventory.inventory().map_err(store)?;
+    Ok(())
+}
+
+/// Encodes, admits, lowers and scores every offered item under `inventory`
+/// (whose file digests to `inventory_digest`), with packets in `dir`, and
+/// returns the record unput. `Recorded` here means built, not stored.
+fn score_round<M: ModelPort, E: Embedder>(
+    run: &RunStores,
+    inventory_store: &InventoryStore,
+    inventory_digest: &str,
+    dir: &Path,
+    cycle: Option<u32>,
+    model: &mut M,
+    scorer: &Scorer<E>,
+) -> Result<RoundOutcome, RunError> {
+    let store = |_| RunError::Store;
+    let inventory = inventory_store.inventory().map_err(store)?;
     let rev = inventory.latest().ok_or(RunError::NoInventory)?.n;
 
     let train = run.train().map_err(store)?;
@@ -554,7 +730,11 @@ pub fn round<M: ModelPort, E: Embedder>(
     for offer in run.offers().map_err(store)? {
         let prompt = Prompt::encode(&offer, &train, &inventory, rev);
         match model.answer(&prompt) {
-            Ok(answer) => answers.push((offer.key().to_string(), answer)),
+            Ok(answer) => answers.push((offer.key().to_string(), Some(answer))),
+            // An answer that is not UTF-8 is that item's parse refusal.
+            Err(PortError::Io(ErrorKind::InvalidData)) => {
+                answers.push((offer.key().to_string(), None))
+            }
             Err(PortError::Unanswered) => unanswered.push(prompt.digest()),
             Err(PortError::Io(kind)) => return Err(RunError::Io(kind)),
         }
@@ -569,10 +749,9 @@ pub fn round<M: ModelPort, E: Embedder>(
         });
     }
 
-    let dir = run.next_round_dir().map_err(store)?;
-    std::fs::create_dir_all(&dir).map_err(|e| RunError::Io(e.kind()))?;
+    std::fs::create_dir_all(dir).map_err(|e| RunError::Io(e.kind()))?;
     // The directory of an unrecorded round holds only a failed attempt's packets.
-    discard_packets(&dir);
+    discard_packets(dir);
     let mut packets = PacketStore::open(&dir.join("packets.cc")).map_err(store)?;
     let encoder = encoder_id(model.model(), &run.record.prompt_digest);
     let mut items: Vec<CorpusItem> = Vec::new();
@@ -580,12 +759,12 @@ pub fn round<M: ModelPort, E: Embedder>(
     for (key, answer) in &answers {
         let item = run.corpus.get(key).map_err(store)?.ok_or(RunError::Store)?;
         let id = CorpusItemId::parse(key).map_err(|_| RunError::Store)?;
-        let fate = match PacketDraft::parse(answer) {
-            Err(_) => Fate::Refused(Stage::Parse, None),
-            Ok(draft) => {
+        let fate = match answer.as_deref().map(PacketDraft::parse) {
+            None | Some(Err(_)) => Fate::Refused(Stage::Parse, None),
+            Some(Ok(draft)) => {
                 let packet = draft.into_packet(&id, rev, &encoder);
                 let packet_key = packet.id.to_string();
-                match packets.admit(packet, &run.inventory, &run.corpus, &run.entities) {
+                match packets.admit(packet, inventory_store, &run.corpus, &run.entities) {
                     Err(_) => Fate::Refused(Stage::Admit, None),
                     Ok(view) => match lower(&view, &inventory, &run.entities) {
                         Err(_) => Fate::Refused(Stage::Lower, Some(packet_key)),
@@ -620,7 +799,7 @@ pub fn round<M: ModelPort, E: Embedder>(
         match scorer.score(&inputs) {
             Ok(scores) => scores,
             Err(_) => {
-                discard_packets(&dir);
+                discard_packets(dir);
                 return Err(RunError::Embed);
             }
         }
@@ -693,13 +872,400 @@ pub fn round<M: ModelPort, E: Embedder>(
         validation_refused: refused,
         train_scored,
         validation_scored,
+        inventory_digest: inventory_digest.to_string(),
+        cycle,
     };
-    run.cache
-        .put(format!("run:{}:round:{n}", run.record.label), &record)
-        .map_err(store)?;
     Ok(RoundOutcome::Recorded(record))
 }
 
+/// One validation reading: chrF 0 to 100, meaning 0 to 1, and their composite.
+#[derive(Clone, Copy, Debug, PartialEq, Serialize, Deserialize, JsonSchema)]
+pub struct Reading {
+    pub chrf: f64,
+    pub meaning: f64,
+    pub composite: f64,
+}
+
+impl Reading {
+    /// `None` when the split has no items or no chrF; a missing meaning reads as
+    /// 0. The composite is the mean of chrF as a fraction and meaning.
+    pub fn of(mean: &SplitMean) -> Option<Self> {
+        if mean.count == 0 {
+            return None;
+        }
+        let chrf = mean.chrf?;
+        let meaning = mean.meaning.unwrap_or(0.0);
+        Some(Self {
+            chrf,
+            meaning,
+            composite: (chrf / 100.0 + meaning) / 2.0,
+        })
+    }
+}
+
+/// Which metric an edit regressed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum Metric {
+    Chrf,
+    Meaning,
+}
+
+/// Why an edit was rejected.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum Why {
+    /// The answer was not an edit draft.
+    EditParse,
+    /// The draft asked for no change or too many, or the inventory door refused it.
+    EditAdmit,
+    NoGain,
+    Regressed(Metric),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]
+pub enum Verdict {
+    Accepted,
+    Rejected(Why),
+}
+
+/// The smallest composite gain that accepts an edit: the measured floor, but
+/// never under one [`LADDER_STEP`], so a zero floor from identical replicates
+/// does not let a rounding-error gain through.
+pub fn threshold(floor: &Reading) -> f64 {
+    floor.composite.max(LADDER_STEP)
+}
+
+/// A reading difference in billionths. [`decide`] compares whole numbers, so a
+/// gain of exactly one [`LADDER_STEP`] is a tie on every baseline of the grid
+/// instead of a coin the last bits of `0.505 - 0.5` toss; differences under a
+/// billionth are not told apart.
+fn nano(x: f64) -> i64 {
+    (x * 1e9).round() as i64
+}
+
+/// The accept rule. A metric that falls by more than its tolerance (the floor,
+/// at least one step) rejects; otherwise the composite must gain strictly more
+/// than [`threshold`]. Means count a refused Validation item as 0, so refusing a
+/// weak item cannot raise a reading. Differences are compared in billionths.
+pub fn decide(base: &Reading, candidate: &Reading, floor: &Reading) -> Verdict {
+    if nano(candidate.chrf - base.chrf) < -nano(floor.chrf.max(100.0 * LADDER_STEP)) {
+        Verdict::Rejected(Why::Regressed(Metric::Chrf))
+    } else if nano(candidate.meaning - base.meaning) < -nano(floor.meaning.max(LADDER_STEP)) {
+        Verdict::Rejected(Why::Regressed(Metric::Meaning))
+    } else if nano(candidate.composite - base.composite) > nano(threshold(floor)) {
+        Verdict::Accepted
+    } else {
+        Verdict::Rejected(Why::NoGain)
+    }
+}
+
+/// One closed edit-accept cycle: digests and numbers, no text. Key
+/// `run:<label>:cycle:<k>`. Only [`cycle`] builds one.
+///
+/// ```
+/// fn f(d: &weksa::run::Decision) -> u32 { d.k() }
+/// ```
+///
+/// Every field is given, so the literal below fails only on privacy; its twin is
+/// the same literal in the unit test `a_decision_literal_compiles_in_the_lib`.
+///
+/// ```compile_fail,E0451
+/// use weksa::run::{Call, Decision, Reading, Verdict};
+/// fn f() -> Decision {
+///     let r = Reading { chrf: 0.0, meaning: 0.0, composite: 0.0 };
+///     Decision {
+///         k: 1,
+///         base_round: 1,
+///         base_rev: 1,
+///         base_inventory_digest: String::new(),
+///         edit: Call { prompt: String::new(), items: vec![] },
+///         edit_answer_digest: None,
+///         candidate_rev: None,
+///         candidate_inventory_digest: None,
+///         candidate_round: None,
+///         base: r,
+///         candidate: None,
+///         floor: r,
+///         threshold: 0.0,
+///         verdict: Verdict::Accepted,
+///     }
+/// }
+/// ```
+#[derive(Clone, Debug, PartialEq, JsonSchema, DatabaseEntry)]
+#[cultcache(type = "weksa.loop_decision")]
+pub struct Decision {
+    #[cultcache(key = 0)]
+    k: u32,
+    /// The head's establishing round: the base of this cycle.
+    #[cultcache(key = 1)]
+    base_round: u32,
+    #[cultcache(key = 2)]
+    base_rev: u32,
+    #[cultcache(key = 3)]
+    base_inventory_digest: String,
+    /// The edit prompt's digest and the Train keys it held.
+    #[cultcache(key = 4)]
+    edit: Call,
+    /// 16 hex of the editor's answer; `None` when it was unreadable.
+    #[cultcache(key = 5)]
+    edit_answer_digest: Option<String>,
+    #[cultcache(key = 6)]
+    candidate_rev: Option<u32>,
+    #[cultcache(key = 7)]
+    candidate_inventory_digest: Option<String>,
+    #[cultcache(key = 8)]
+    candidate_round: Option<u32>,
+    #[cultcache(key = 9)]
+    base: Reading,
+    #[cultcache(key = 10)]
+    candidate: Option<Reading>,
+    #[cultcache(key = 11)]
+    floor: Reading,
+    #[cultcache(key = 12)]
+    threshold: f64,
+    #[cultcache(key = 13)]
+    verdict: Verdict,
+}
+
+impl Decision {
+    pub fn k(&self) -> u32 {
+        self.k
+    }
+    pub fn base_round(&self) -> u32 {
+        self.base_round
+    }
+    pub fn base_rev(&self) -> u32 {
+        self.base_rev
+    }
+    pub fn base_inventory_digest(&self) -> &str {
+        &self.base_inventory_digest
+    }
+    pub fn edit(&self) -> &Call {
+        &self.edit
+    }
+    pub fn edit_answer_digest(&self) -> Option<&str> {
+        self.edit_answer_digest.as_deref()
+    }
+    pub fn candidate_rev(&self) -> Option<u32> {
+        self.candidate_rev
+    }
+    pub fn candidate_inventory_digest(&self) -> Option<&str> {
+        self.candidate_inventory_digest.as_deref()
+    }
+    pub fn candidate_round(&self) -> Option<u32> {
+        self.candidate_round
+    }
+    pub fn base(&self) -> &Reading {
+        &self.base
+    }
+    pub fn candidate(&self) -> Option<&Reading> {
+        self.candidate.as_ref()
+    }
+    pub fn floor(&self) -> &Reading {
+        &self.floor
+    }
+    pub fn threshold(&self) -> f64 {
+        self.threshold
+    }
+    pub fn verdict(&self) -> Verdict {
+        self.verdict
+    }
+
+    /// The one line a closed cycle prints.
+    pub fn summary_line(&self) -> String {
+        let candidate_rev = self
+            .candidate_rev
+            .map_or("none".to_string(), |n| n.to_string());
+        let candidate = self
+            .candidate
+            .map_or("none".to_string(), |c| format!("{:.4}", c.composite));
+        let verdict = match self.verdict {
+            Verdict::Accepted => "accepted".to_string(),
+            Verdict::Rejected(why) => format!(
+                "rejected {}",
+                match why {
+                    Why::EditParse => "edit-parse",
+                    Why::EditAdmit => "edit-admit",
+                    Why::NoGain => "no-gain",
+                    Why::Regressed(Metric::Chrf) => "regressed-chrf",
+                    Why::Regressed(Metric::Meaning) => "regressed-meaning",
+                }
+            ),
+        };
+        format!(
+            "cycle {} rev {}->{candidate_rev} base={:.4} candidate={candidate} floor={:.4} threshold={:.4} {verdict}",
+            self.k, self.base_rev, self.base.composite, self.floor.composite, self.threshold
+        )
+    }
+}
+
+/// What a cycle came to; built once per call, as [`RoundOutcome`] is.
+#[derive(Debug)]
+#[allow(clippy::large_enum_variant)]
+pub enum CycleOutcome {
+    /// Prompts nobody has answered; nothing was written to `run.cc`.
+    Unanswered {
+        prompts: Vec<String>,
+    },
+    Decided(Decision),
+}
+
+/// The spread of the Validation reading between rounds 1 and 2: two independent
+/// encodings under the run's first inventory and one spec, measured once per run.
+fn floor_of(rounds: &[RoundRecord], record: &RunRecord) -> Result<Reading, RunError> {
+    let replicate = |n: u32| {
+        let round = rounds
+            .iter()
+            .find(|r| {
+                r.n == n && r.cycle.is_none() && r.inventory_digest == record.inventory_digest
+            })
+            .ok_or(RunError::NoFloor)?;
+        Reading::of(&round.validation_mean).ok_or(RunError::NoValidation)
+    };
+    let (a, b) = (replicate(1)?, replicate(2)?);
+    Ok(Reading {
+        chrf: (a.chrf - b.chrf).abs(),
+        meaning: (a.meaning - b.meaning).abs(),
+        composite: (a.composite - b.composite).abs(),
+    })
+}
+
+/// One edit-accept cycle. The editor is asked for one inventory edit from a
+/// prompt built over Train items, the head inventory and an [`EditFeedback`];
+/// the edit is admitted as a candidate revision in `<root>/cycle-<k>/inventory.cc`;
+/// a candidate round scores it; [`decide`] accepts or rejects on Validation
+/// against the head's establishing round. Accepting is one write: the candidate
+/// round and the decision go into `run.cc` in one batch, and the decision names
+/// the new head. While any prompt is unanswered, or the candidate round fails,
+/// `run.cc` is untouched. An edit that fails is a rejected decision, not an error.
+pub fn cycle<M: ModelPort, E: Embedder>(
+    run: &mut RunStores,
+    model: &mut M,
+    scorer: &Scorer<E>,
+) -> Result<CycleOutcome, RunError> {
+    let store = |_| RunError::Store;
+    check_drift(run, model, scorer)?;
+    let rounds = run.rounds().map_err(store)?;
+    let floor = floor_of(&rounds, &run.record)?;
+    let (head_path, head_digest, base_round) = run.head()?;
+    let base = rounds
+        .iter()
+        .find(|r| r.n == base_round)
+        .ok_or(RunError::Store)?;
+    let base = Reading::of(&base.validation_mean).ok_or(RunError::NoValidation)?;
+    let decisions = run.decisions().map_err(store)?;
+    let k = decisions.len() as u32 + 1;
+    let dir = run.next_cycle_dir().map_err(store)?;
+    let inventory = run.inventory.inventory().map_err(store)?;
+    let base_rev = inventory.latest().ok_or(RunError::NoInventory)?.n;
+
+    let feedback = EditFeedback::new(
+        decisions.last().map(|d| d.verdict == Verdict::Accepted),
+        Some(base.composite),
+    );
+    let train = run.train().map_err(store)?;
+    let prompt = Prompt::mint(&train, &inventory, base_rev, &feedback);
+    let answer = match model.answer(&prompt) {
+        Ok(answer) => Some(answer),
+        Err(PortError::Io(ErrorKind::InvalidData)) => None,
+        Err(PortError::Unanswered) => {
+            return Ok(CycleOutcome::Unanswered {
+                prompts: vec![prompt.digest()],
+            });
+        }
+        Err(PortError::Io(kind)) => return Err(RunError::Io(kind)),
+    };
+
+    let blank = |verdict: Verdict| Decision {
+        k,
+        base_round,
+        base_rev,
+        base_inventory_digest: head_digest.clone(),
+        edit: Call {
+            prompt: prompt.digest(),
+            items: prompt.item_keys().to_vec(),
+        },
+        edit_answer_digest: answer.as_ref().map(|a| hex16(fnv1a64(a.as_bytes()))),
+        candidate_rev: None,
+        candidate_inventory_digest: None,
+        candidate_round: None,
+        base,
+        candidate: None,
+        floor,
+        threshold: threshold(&floor),
+        verdict,
+    };
+    let decision_key = format!("run:{}:cycle:{k}", run.record.label);
+    // A rejection leaves no candidate inventory behind, whichever attempt built it.
+    let reject = |run: &mut RunStores, why: Why| -> Result<CycleOutcome, RunError> {
+        discard_inventory(&dir);
+        let d = blank(Verdict::Rejected(why));
+        run.cache.put(decision_key.clone(), &d).map_err(store)?;
+        Ok(CycleOutcome::Decided(d))
+    };
+
+    let Some(draft) = answer.as_deref().and_then(|a| EditDraft::parse(a).ok()) else {
+        return reject(run, Why::EditParse);
+    };
+    let Some((revision, entries)) = draft.into_revision(&inventory, base_rev) else {
+        return reject(run, Why::EditAdmit);
+    };
+    let candidate_rev = revision.n;
+
+    // The cycle's directory holds prompts and answers; its inventory and packets
+    // are rebuilt from the head on every attempt.
+    let candidate_file = dir.join(INVENTORY_FILE);
+    std::fs::create_dir_all(&dir).map_err(|e| RunError::Io(e.kind()))?;
+    discard_inventory(&dir);
+    discard_packets(&dir);
+    std::fs::copy(&head_path, &candidate_file).map_err(|e| RunError::Io(e.kind()))?;
+    let mut candidate_store = InventoryStore::open(&candidate_file).map_err(store)?;
+    if candidate_store.admit_revision(revision, entries).is_err() {
+        drop(candidate_store);
+        return reject(run, Why::EditAdmit);
+    }
+    let candidate_digest = file_digest_at(&candidate_file).ok_or(RunError::Store)?;
+
+    let record = match score_round(
+        run,
+        &candidate_store,
+        &candidate_digest,
+        &dir,
+        Some(k),
+        model,
+        scorer,
+    )? {
+        RoundOutcome::Unanswered { prompts } => return Ok(CycleOutcome::Unanswered { prompts }),
+        RoundOutcome::Recorded(record) => record,
+    };
+    let candidate = Reading::of(&record.validation_mean).ok_or(RunError::NoValidation)?;
+    let verdict = decide(&base, &candidate, &floor);
+    let decided = Decision {
+        candidate_rev: Some(candidate_rev),
+        candidate_inventory_digest: Some(candidate_digest),
+        candidate_round: Some(record.n),
+        candidate: Some(candidate),
+        ..blank(verdict)
+    };
+    let staged = vec![
+        run.cache
+            .prepare_entry_named(
+                format!("run:{}:round:{}", run.record.label, record.n),
+                &record,
+            )
+            .map_err(store)?
+            .0,
+        run.cache
+            .prepare_entry_named(decision_key.clone(), &decided)
+            .map_err(store)?
+            .0,
+    ];
+    run.cache.put_prepared_batch(staged).map_err(store)?;
+    if verdict == Verdict::Accepted {
+        run.inventory = candidate_store;
+    }
+    Ok(CycleOutcome::Decided(decided))
+}
+
 /// Removes a round directory's packet store and its lock.
 fn discard_packets(dir: &Path) {
     for name in ["packets.cc", "packets.cc.lock"] {
@@ -707,6 +1273,13 @@ fn discard_packets(dir: &Path) {
     }
 }
 
+/// Removes a cycle directory's candidate inventory and its lock.
+fn discard_inventory(dir: &Path) {
+    for name in [INVENTORY_FILE, "inventory.cc.lock"] {
+        let _ = std::fs::remove_file(dir.join(name));
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -732,7 +1305,278 @@ mod tests {
             validation_mean: SplitMean::default(),
             validation_scored: 0,
             validation_refused: RefusalCounts::default(),
+            inventory_digest: String::new(),
+            cycle: None,
         };
         assert_eq!(r.n(), 1);
     }
+
+    /// The twin of the `Decision` literal in its compile_fail doctest.
+    #[test]
+    fn a_decision_literal_compiles_in_the_lib() {
+        let r = Reading {
+            chrf: 0.0,
+            meaning: 0.0,
+            composite: 0.0,
+        };
+        let d = Decision {
+            k: 1,
+            base_round: 1,
+            base_rev: 1,
+            base_inventory_digest: String::new(),
+            edit: Call {
+                prompt: String::new(),
+                items: vec![],
+            },
+            edit_answer_digest: None,
+            candidate_rev: None,
+            candidate_inventory_digest: None,
+            candidate_round: None,
+            base: r,
+            candidate: None,
+            floor: r,
+            threshold: 0.0,
+            verdict: Verdict::Accepted,
+        };
+        assert_eq!(d.k(), 1);
+    }
+
+    fn reading(chrf: f64, meaning: f64, composite: f64) -> Reading {
+        Reading {
+            chrf,
+            meaning,
+            composite,
+        }
+    }
+
+    #[test]
+    fn reading_of_a_mean() {
+        let mean = |count, chrf, meaning| SplitMean {
+            count,
+            chrf,
+            meaning,
+        };
+        assert_eq!(Reading::of(&mean(0, Some(50.0), Some(0.5))), None);
+        assert_eq!(Reading::of(&mean(2, None, Some(0.5))), None);
+        assert_eq!(
+            Reading::of(&mean(2, Some(50.0), Some(0.5))),
+            Some(reading(50.0, 0.5, 0.5))
+        );
+        // A missing meaning reads as 0.
+        assert_eq!(
+            Reading::of(&mean(2, Some(80.0), None)),
+            Some(reading(80.0, 0.0, 0.4))
+        );
+        assert_eq!(
+            Reading::of(&mean(1, Some(0.0), Some(1.0)))
+                .unwrap()
+                .composite,
+            0.5
+        );
+    }
+
+    #[test]
+    fn the_threshold_is_the_floor_but_never_under_a_step() {
+        assert_eq!(threshold(&reading(0.0, 0.0, 0.0)), LADDER_STEP);
+        assert_eq!(threshold(&reading(0.0, 0.0, 0.001)), LADDER_STEP);
+        assert_eq!(threshold(&reading(0.0, 0.0, LADDER_STEP)), LADDER_STEP);
+        assert_eq!(threshold(&reading(0.0, 0.0, 0.25)), 0.25);
+    }
+
+    #[test]
+    fn decide_pins_each_branch() {
+        let base = reading(50.0, 0.5, 0.5);
+        let zero = reading(0.0, 0.0, 0.0);
+        let rejected = Verdict::Rejected;
+
+        // Floor 0: a chrF drop beyond 100 * LADDER_STEP regresses, inside it does not.
+        let down = |chrf| reading(chrf, 0.5, 0.5);
+        assert_eq!(
+            decide(&base, &down(49.4), &zero),
+            rejected(Why::Regressed(Metric::Chrf))
+        );
+        assert_eq!(decide(&base, &down(49.6), &zero), rejected(Why::NoGain));
+        // The tolerance is the floor when that is larger: exactly at it stands.
+        let floor = reading(8.0, 0.0, 0.0);
+        assert_eq!(decide(&base, &down(42.0), &floor), rejected(Why::NoGain));
+        assert_eq!(
+            decide(&base, &down(41.99), &floor),
+            rejected(Why::Regressed(Metric::Chrf))
+        );
+        // A floor under a step does not narrow it.
+        let small = reading(0.1, 0.001, 0.0);
+        assert_eq!(decide(&base, &down(49.6), &small), rejected(Why::NoGain));
+        assert_eq!(
+            decide(&base, &reading(50.0, 0.498, 0.5), &small),
+            rejected(Why::NoGain)
+        );
+        // Meaning likewise: one step by default, the floor when larger.
+        let meaning = |m| reading(50.0, m, 0.5);
+        assert_eq!(
+            decide(&base, &meaning(0.49), &zero),
+            rejected(Why::Regressed(Metric::Meaning))
+        );
+        assert_eq!(decide(&base, &meaning(0.498), &zero), rejected(Why::NoGain));
+        let floor = reading(0.0, 0.25, 0.0);
+        assert_eq!(decide(&base, &meaning(0.25), &floor), rejected(Why::NoGain));
+        assert_eq!(
+            decide(&base, &meaning(0.2499), &floor),
+            rejected(Why::Regressed(Metric::Meaning))
+        );
+        // A regression rejects whatever the composite gained; chrF is judged first.
+        assert_eq!(
+            decide(&base, &reading(40.0, 0.9, 0.9), &zero),
+            rejected(Why::Regressed(Metric::Chrf))
+        );
+        assert_eq!(
+            decide(&base, &reading(50.0, 0.4, 0.9), &zero),
+            rejected(Why::Regressed(Metric::Meaning))
+        );
+        assert_eq!(
+            decide(&base, &reading(40.0, 0.4, 0.1), &zero),
+            rejected(Why::Regressed(Metric::Chrf))
+        );
+
+        // The gain must exceed the threshold strictly.
+        let gain = |c| reading(50.0, 0.5, c);
+        assert_eq!(decide(&base, &gain(0.504), &zero), rejected(Why::NoGain));
+        assert_eq!(decide(&base, &gain(0.506), &zero), Verdict::Accepted);
+        assert_eq!(decide(&base, &gain(0.5), &zero), rejected(Why::NoGain));
+        assert_eq!(decide(&base, &gain(0.4), &zero), rejected(Why::NoGain));
+        // A floor above the step sets the threshold: a gain equal to it is no gain.
+        let floor = reading(0.0, 0.0, 0.25);
+        assert_eq!(decide(&base, &gain(0.75), &floor), rejected(Why::NoGain));
+        assert_eq!(decide(&base, &gain(0.7501), &floor), Verdict::Accepted);
+        assert_eq!(decide(&base, &gain(0.506), &floor), rejected(Why::NoGain));
+    }
+
+    #[test]
+    fn a_gain_of_exactly_one_step_is_no_gain_on_every_baseline_of_the_grid() {
+        let zero = reading(0.0, 0.0, 0.0);
+        let at = |i: u32| reading(50.0, 0.5, f64::from(i) * LADDER_STEP);
+        for i in 0..400 {
+            assert_eq!(
+                decide(&at(i), &at(i + 1), &zero),
+                Verdict::Rejected(Why::NoGain),
+                "{i}"
+            );
+            // Two steps clears one; a step and a hair over clears it too.
+            assert_eq!(decide(&at(i), &at(i + 2), &zero), Verdict::Accepted, "{i}");
+            let hair = reading(50.0, 0.5, f64::from(i + 1) * LADDER_STEP + 1e-6);
+            assert_eq!(decide(&at(i), &hair, &zero), Verdict::Accepted, "{i}");
+        }
+        // The floor is a tie at its own value on the grid, as the step is.
+        let floor = reading(0.0, 0.0, 3.0 * LADDER_STEP);
+        for i in 0..400 {
+            assert_eq!(
+                decide(&at(i), &at(i + 3), &floor),
+                Verdict::Rejected(Why::NoGain),
+                "{i}"
+            );
+            assert_eq!(decide(&at(i), &at(i + 4), &floor), Verdict::Accepted, "{i}");
+        }
+        // The regression tolerance is a tie at its own value, on both metrics.
+        for i in 0..400 {
+            let chrf = 20.0 + f64::from(i) * 0.5;
+            let base = reading(chrf, 0.5, 0.5);
+            let drop = reading(chrf - 100.0 * LADDER_STEP, 0.5, 0.5);
+            assert_eq!(decide(&base, &drop, &zero), Verdict::Rejected(Why::NoGain));
+            let meaning = f64::from(i + 1) * LADDER_STEP;
+            let base = reading(50.0, meaning, 0.5);
+            let drop = reading(50.0, meaning - LADDER_STEP, 0.5);
+            assert_eq!(decide(&base, &drop, &zero), Verdict::Rejected(Why::NoGain));
+        }
+        // Two-decimal chrF readings are not binary-exact: in float, 84 of these
+        // pairs would read as a regression of more than 0.5.
+        for i in 60..10_000 {
+            let base = reading(f64::from(i) / 100.0, 0.5, 0.5);
+            let drop = reading(f64::from(i - 50) / 100.0, 0.5, 0.5);
+            assert_eq!(
+                decide(&base, &drop, &zero),
+                Verdict::Rejected(Why::NoGain),
+                "{i}"
+            );
+        }
+    }
+
+    fn replicate(n: u32, digest: &str, chrf: f64, meaning: f64) -> RoundRecord {
+        RoundRecord {
+            n,
+            inventory_rev: 1,
+            prompt_digest: String::new(),
+            lowerer_digest: String::new(),
+            corpus_digest: String::new(),
+            entity_digest: String::new(),
+            model: String::new(),
+            embedder: String::new(),
+            chrf_version: String::new(),
+            calls: vec![],
+            train: vec![],
+            train_mean: SplitMean::default(),
+            train_scored: 0,
+            validation_mean: SplitMean {
+                count: 2,
+                chrf: Some(chrf),
+                meaning: Some(meaning),
+            },
+            validation_scored: 2,
+            validation_refused: RefusalCounts::default(),
+            inventory_digest: digest.to_string(),
+            cycle: None,
+        }
+    }
+
+    fn record_of(digest: &str) -> RunRecord {
+        RunRecord {
+            label: "t".into(),
+            corpus: String::new(),
+            inventory: String::new(),
+            entities: String::new(),
+            corpus_digest: String::new(),
+            entity_digest: String::new(),
+            prompt_digest: String::new(),
+            lowerer_digest: String::new(),
+            model: String::new(),
+            embedder: String::new(),
+            chrf_version: String::new(),
+            inventory_digest: digest.to_string(),
+        }
+    }
+
+    /// The floor is the spread of each field of the two replicates, the composite
+    /// as the spread of the composites: with chrF up and meaning down it is not
+    /// a function of the other two spreads' magnitudes.
+    #[test]
+    fn the_floor_is_the_spread_of_each_field_of_the_two_replicates() {
+        let record = record_of("d1");
+        let rounds = [replicate(1, "d1", 60.0, 0.5), replicate(2, "d1", 50.0, 0.7)];
+        let floor = floor_of(&rounds, &record).unwrap();
+        // composites 0.55 and 0.6.
+        assert_eq!(floor.chrf, 10.0);
+        assert!((floor.meaning - 0.2).abs() < 1e-12);
+        assert!(
+            (floor.composite - 0.05).abs() < 1e-12,
+            "{}",
+            floor.composite
+        );
+
+        // The order of the replicates does not matter, and a third round, or a
+        // round under another inventory or from a cycle, is not a replicate.
+        let mut other = replicate(2, "d2", 0.0, 0.0);
+        let mut cycle = replicate(2, "d1", 0.0, 0.0);
+        cycle.cycle = Some(1);
+        other.n = 2;
+        let rounds = [
+            replicate(3, "d1", 0.0, 0.0),
+            other,
+            cycle,
+            replicate(2, "d1", 50.0, 0.7),
+            replicate(1, "d1", 60.0, 0.5),
+        ];
+        assert_eq!(floor_of(&rounds, &record).unwrap(), floor);
+        assert_eq!(
+            floor_of(&rounds[..3], &record).err(),
+            Some(RunError::NoFloor)
+        );
+    }
 }
diff --git a/crates/weksa/src/schema.rs b/crates/weksa/src/schema.rs
index 14a6953..21add8f 100644
--- a/crates/weksa/src/schema.rs
+++ b/crates/weksa/src/schema.rs
@@ -5,7 +5,7 @@ use crate::corpus::CorpusItem;
 use crate::entity::Entity;
 use crate::inventory::{InventoryEntry, InventoryRevision};
 use crate::packet::Packet;
-use crate::run::{RoundRecord, RunRecord};
+use crate::run::{Decision, RoundRecord, RunRecord};
 use crate::speaker::{Scene, Speaker};
 use cultcache_rs::DatabaseEntry;
 use schemars::{JsonSchema, schema_for};
@@ -27,5 +27,6 @@ pub fn published() -> Vec<(String, String)> {
         published_for::<Scene>(),
         published_for::<RunRecord>(),
         published_for::<RoundRecord>(),
+        published_for::<Decision>(),
     ]
 }
diff --git a/crates/weksa/tests/cli.rs b/crates/weksa/tests/cli.rs
index 8b0dd30..ebefd8e 100644
--- a/crates/weksa/tests/cli.rs
+++ b/crates/weksa/tests/cli.rs
@@ -309,6 +309,7 @@ fn schema_writes_the_published_files() {
             "weksa.interlingua_packet.schema.json",
             "weksa.inventory_entry.schema.json",
             "weksa.inventory_revision.schema.json",
+            "weksa.loop_decision.schema.json",
             "weksa.loop_round.schema.json",
             "weksa.loop_run.schema.json",
             "weksa.scene.schema.json",
@@ -1407,6 +1408,102 @@ fn loop_open_and_unanswered_round() {
     );
 }
 
+fn open_dao_run(d: &std::path::Path) {
+    dao_stores(d);
+    let o = weksa(
+        d,
+        &[
+            "loop",
+            "open",
+            "canaryroot",
+            "--label",
+            "smoke",
+            "--answerer",
+            "fake-model",
+        ],
+    );
+    assert!(o.status.success(), "{}", out(&o));
+}
+
+#[test]
+fn loop_cycle_needs_a_floor() {
+    let d = tempfile::tempdir().unwrap();
+    open_dao_run(d.path());
+    let o = weksa(d.path(), &["loop", "cycle", "canaryroot"]);
+    assert!(!o.status.success());
+    let text = out(&o);
+    assert!(
+        text.contains("the run has no noise floor: record two rounds first"),
+        "{text}"
+    );
+    for echoed in ["canaryroot", d.path().to_str().unwrap()] {
+        assert!(!text.contains(echoed), "{text}");
+    }
+    assert!(!d.path().join("canaryroot/cycle-1").exists());
+}
+
+#[test]
+fn loop_cycle_asks_then_decides() {
+    let d = tempfile::tempdir().unwrap();
+    open_dao_run(d.path());
+    // Two rounds of refusals: a floor of 0 and a base of 0.
+    for n in 1..=2 {
+        let first = weksa(d.path(), &["loop", "round", "canaryroot"]);
+        assert_eq!(first.status.code(), Some(3), "{}", out(&first));
+        for entry in std::fs::read_dir(d.path().join(format!("canaryroot/round-{n}"))).unwrap() {
+            let path = entry.unwrap().path();
+            std::fs::write(path.with_extension("answer"), "not json").unwrap();
+        }
+        let second = weksa(d.path(), &["loop", "round", "canaryroot"]);
+        assert!(second.status.success(), "{}", out(&second));
+    }
+
+    // The editor is asked first: one digest, a count, exit 3, the prompt on disk.
+    let ask = weksa(d.path(), &["loop", "cycle", "canaryroot"]);
+    assert_eq!(ask.status.code(), Some(3), "{}", out(&ask));
+    let text = out(&ask);
+    let lines: Vec<&str> = text.lines().collect();
+    assert_eq!(lines.len(), 2, "{text}");
+    let digest = lines[0].strip_prefix("unanswered ").unwrap();
+    assert_eq!(digest.len(), 16, "{text}");
+    assert_eq!(lines[1], "unanswered 1 prompts");
+    for echoed in ["canaryroot", d.path().to_str().unwrap()] {
+        assert!(!text.contains(echoed), "{text}");
+    }
+    let dir = d.path().join("canaryroot/cycle-1");
+    let prompt = std::fs::read_to_string(dir.join(format!("{digest}.prompt"))).unwrap();
+    assert!(prompt.starts_with(weksa::context::MINT_INSTRUCTIONS));
+
+    // An answer that is not an edit closes the cycle as a rejection, with no
+    // embed call and no echo of the answer.
+    std::fs::write(dir.join(format!("{digest}.answer")), "CANARYANSWER").unwrap();
+    let done = weksa(d.path(), &["loop", "cycle", "canaryroot"]);
+    assert!(done.status.success(), "{}", out(&done));
+    assert_eq!(
+        out(&done),
+        "cycle 1 rev 3->none base=0.0000 candidate=none floor=0.0000 threshold=0.0050 rejected edit-parse\n"
+    );
+
+    // The next cycle asks afresh in its own directory.
+    let next = weksa(d.path(), &["loop", "cycle", "canaryroot"]);
+    assert_eq!(next.status.code(), Some(3), "{}", out(&next));
+    let text = out(&next);
+    assert!(text.ends_with("unanswered 1 prompts\n"), "{text}");
+    assert!(!text.to_uppercase().contains("CANARY"), "{text}");
+    let asked = text
+        .lines()
+        .next()
+        .unwrap()
+        .strip_prefix("unanswered ")
+        .unwrap();
+    assert_ne!(asked, digest);
+    assert!(
+        d.path()
+            .join(format!("canaryroot/cycle-2/{asked}.prompt"))
+            .is_file()
+    );
+}
+
 #[test]
 fn loop_errors_echo_no_input() {
     let d = tempfile::tempdir().unwrap();
diff --git a/crates/weksa/tests/context.rs b/crates/weksa/tests/context.rs
index e38b2fa..c1784d8 100644
--- a/crates/weksa/tests/context.rs
+++ b/crates/weksa/tests/context.rs
@@ -2,7 +2,7 @@ mod common;
 
 use common::{cast, ent, entities_in, group_in_bucket, item_in, model, run_over, world};
 use weksa::context::{
-    ENCODE_INSTRUCTIONS as ENCODE, MINT_INSTRUCTIONS as MINT, OfferRefusal, Prompt,
+    ENCODE_INSTRUCTIONS as ENCODE, EditFeedback, MINT_INSTRUCTIONS as MINT, OfferRefusal, Prompt,
 };
 use weksa::run::RunStores;
 use weksa::{
@@ -111,17 +111,23 @@ fn train_items_are_in_key_order() {
     );
     assert_eq!((t.len(), t.is_empty()), (3, false));
     let dir = tempfile::tempdir().unwrap();
-    let none = run_over(dir.path()).train().unwrap();
+    let empty = run_over(dir.path());
+    let none = empty.train().unwrap();
     assert_eq!((none.len(), none.is_empty()), (0, true));
-    assert_eq!(Prompt::mint(&none).text(), MINT);
-    assert!(Prompt::mint(&none).item_keys().is_empty());
+    let (inv, fb) = (empty.inventory().inventory().unwrap(), EditFeedback::none());
+    assert_eq!(
+        Prompt::mint(&none, &inv, 0, &fb).text(),
+        format!("{MINT}\n\nlast edit: none; validation composite at head: none\n\ninventory rev:0")
+    );
+    assert!(Prompt::mint(&none, &inv, 0, &fb).item_keys().is_empty());
 }
 
 #[test]
 fn mint_prompt_holds_train_text_only() {
     let c = corpus();
     let t = c.run.train().unwrap();
-    let p = Prompt::mint(&t);
+    let inv = c.run.inventory().inventory().unwrap();
+    let p = Prompt::mint(&t, &inv, 4, &EditFeedback::none());
     assert!(p.text().starts_with(MINT));
     assert!(p.text().contains("alphamarker"));
     for other in ["betamarker", "gammamarker", "deltamarker", "epsilonmarker"] {
@@ -149,16 +155,20 @@ fn prompts_render_deterministically() {
         .unwrap();
     let run = run_over(dir.path());
     let t = run.train().unwrap();
+    let inv = run.inventory().inventory().unwrap();
+    let fb = EditFeedback::none();
     assert_eq!(
-        Prompt::mint(&t).text(),
+        Prompt::mint(&t, &inv, 0, &fb).text(),
         format!(
-            "{MINT}\n\n[item:a:1] entity:nibu: Hello there.\n\n[item:a:2] entity:nibu: Second line."
+            "{MINT}\n\nlast edit: none; validation composite at head: none\n\ninventory rev:0\n\n[item:a:1] entity:nibu: Hello there.\n\n[item:a:2] entity:nibu: Second line."
         )
     );
-    assert_eq!(Prompt::mint(&t).item_keys(), ["item:a:1", "item:a:2"]);
+    assert_eq!(
+        Prompt::mint(&t, &inv, 0, &fb).item_keys(),
+        ["item:a:1", "item:a:2"]
+    );
 
     let offer = run.offer("item:a:2").unwrap().unwrap();
-    let inv = run.inventory().inventory().unwrap();
     assert_eq!(
         Prompt::encode(&offer, &t, &inv, 0).text(),
         format!(
@@ -375,7 +385,8 @@ fn prior_turns_print_only_text_a_live_train_item_holds() {
 
     let run = run_over(dir.path());
     let t = run.train().unwrap();
-    let mint = Prompt::mint(&t);
+    let inv = run.inventory().inventory().unwrap();
+    let mint = Prompt::mint(&t, &inv, 0, &EditFeedback::none());
     for secret in ["withdrawnsecret", "testsecret", "validation reply"] {
         assert!(!mint.text().contains(secret), "mint printed {secret}");
     }
@@ -384,7 +395,6 @@ fn prior_turns_print_only_text_a_live_train_item_holds() {
         "mint prints no prior turns"
     );
 
-    let inv = run.inventory().inventory().unwrap();
     let encode = |key: &str| {
         Prompt::encode(&run.offer(key).unwrap().unwrap(), &t, &inv, 0)
             .text()
@@ -504,3 +514,28 @@ fn prior_turn_fold_matches_the_store() {
 }
 
 const ELIDED_MARK: &str = "[elided]";
+
+#[test]
+fn mint_and_encode_list_the_same_inventory() {
+    let w = world();
+    let run = run_over(w.dir.path());
+    let inv = run.inventory().inventory().unwrap();
+    let t = run.train().unwrap();
+    let offer = run.offer("item:nibu:1").unwrap().unwrap();
+    let fb = EditFeedback::none();
+    for rev in [2, 4] {
+        let header = format!("inventory rev:{rev}\n");
+        let mint = Prompt::mint(&t, &inv, rev, &fb);
+        let encode = Prompt::encode(&offer, &t, &inv, rev);
+        let from_mint = mint.text().split_once(&header).unwrap().1;
+        let from_mint = from_mint.split("\n\n").next().unwrap();
+        let from_encode = encode.text().split_once(&header).unwrap().1;
+        assert!(!from_mint.is_empty());
+        assert_eq!(from_mint, from_encode, "rev {rev}");
+    }
+    let at = |rev| {
+        let text = Prompt::mint(&t, &inv, rev, &fb).text().to_string();
+        text.split_once("inventory rev:").unwrap().1.to_string()
+    };
+    assert_ne!(at(2), at(4), "the revision selects the entries");
+}
diff --git a/crates/weksa/tests/golf_loop.rs b/crates/weksa/tests/golf_loop.rs
index 6631861..e2da558 100644
--- a/crates/weksa/tests/golf_loop.rs
+++ b/crates/weksa/tests/golf_loop.rs
@@ -120,6 +120,10 @@ fn open_checks_each_pin_by_name() {
         drift(&|r| r.entity_digest = "0".repeat(16)),
         Some(RunError::Drift(DriftOf::Entities))
     );
+    assert_eq!(
+        drift(&|r| r.inventory_digest = "0".repeat(16)),
+        Some(RunError::Drift(DriftOf::Inventory))
+    );
     assert_eq!(drift(&|_| {}), None, "the unchanged record opens");
 
     // An entity put after the pin is another entity store.
@@ -132,6 +136,219 @@ fn open_checks_each_pin_by_name() {
     );
 }
 
+#[test]
+fn a_run_works_on_its_own_copy_of_the_inventory() {
+    let w = world();
+    let dir = w.dir.path().to_path_buf();
+    let root = dir.join("run");
+    let (c, i, e) = paths(&dir);
+    let source_bytes = std::fs::read(&i).unwrap();
+    let mut run = RunStores::create(
+        &root,
+        "t",
+        RunPaths {
+            corpus: &c,
+            inventory: &i,
+            entities: &e,
+        },
+        "fake-model",
+        "bag",
+    )
+    .unwrap();
+
+    // The copy is byte for byte the source, and the record pins its digest.
+    let copy = root.join("inventory.cc");
+    assert_eq!(std::fs::read(&copy).unwrap(), source_bytes);
+    assert_eq!(run.record().inventory_digest, hex(&i));
+    assert_eq!(run.record().inventory_digest, hex(&copy));
+    assert_eq!(
+        run.record().inventory,
+        std::fs::canonicalize(&i).unwrap().to_str().unwrap(),
+        "the source path is provenance"
+    );
+    let rev = run.inventory().inventory().unwrap().latest().unwrap().n;
+
+    // A revision written to the source after open is a revision the run never
+    // reads, and it does not drift the run.
+    let mut source = weksa::InventoryStore::open(&i).unwrap();
+    source
+        .admit_revision(
+            weksa::InventoryRevision {
+                n: rev + 1,
+                parent: Some(rev),
+                changes: vec![],
+                frozen: false,
+            },
+            vec![],
+        )
+        .unwrap();
+    assert_ne!(hex(&i), run.record().inventory_digest);
+    run = RunStores::open(&root).unwrap();
+    assert_eq!(
+        run.inventory().inventory().unwrap().latest().unwrap().n,
+        rev,
+        "the run reads its copy"
+    );
+    assert_eq!(std::fs::read(&copy).unwrap(), source_bytes);
+
+    // Even with the source gone the run opens.
+    std::fs::remove_file(&i).unwrap();
+    assert!(RunStores::open(&root).is_ok());
+
+    // A revision appended to the copy is drift.
+    let mut head = weksa::InventoryStore::open(&copy).unwrap();
+    head.admit_revision(
+        weksa::InventoryRevision {
+            n: rev + 1,
+            parent: Some(rev),
+            changes: vec![],
+            frozen: false,
+        },
+        vec![],
+    )
+    .unwrap();
+    assert_eq!(
+        RunStores::open(&root).err(),
+        Some(RunError::Drift(DriftOf::Inventory))
+    );
+}
+
+#[test]
+fn create_refuses_a_root_that_holds_an_inventory_and_never_truncates_it() {
+    let dao = dao();
+    let bytes = std::fs::read(&dao.inventory).unwrap();
+    let create = |root: &Path, inventory: &Path| {
+        RunStores::create(
+            root,
+            "x",
+            RunPaths {
+                corpus: &dao.corpus,
+                inventory,
+                entities: &dao.entities,
+            },
+            "fake-model",
+            "bag",
+        )
+    };
+
+    // The source is the root's own inventory.cc: the copy would open it as its
+    // destination. It is refused and the source bytes survive.
+    let own = dao.root.join("own");
+    std::fs::create_dir_all(&own).unwrap();
+    std::fs::write(own.join("inventory.cc"), &bytes).unwrap();
+    assert_eq!(
+        create(&own, &own.join("inventory.cc")).err(),
+        Some(RunError::Io(std::io::ErrorKind::AlreadyExists))
+    );
+    assert_eq!(std::fs::read(own.join("inventory.cc")).unwrap(), bytes);
+
+    // Any other file of that name in the root is refused untouched, too.
+    let other = dao.root.join("other");
+    std::fs::create_dir_all(&other).unwrap();
+    std::fs::write(other.join("inventory.cc"), b"not yours").unwrap();
+    assert_eq!(
+        create(&other, &dao.inventory).err(),
+        Some(RunError::Io(std::io::ErrorKind::AlreadyExists))
+    );
+    assert_eq!(
+        std::fs::read(other.join("inventory.cc")).unwrap(),
+        b"not yours"
+    );
+    assert_eq!(std::fs::read(&dao.inventory).unwrap(), bytes);
+}
+
+#[test]
+fn a_create_that_fails_leaves_no_inventory_and_the_retry_succeeds() {
+    let dao = dao();
+    let root = dao.root.join("retry");
+    std::fs::create_dir_all(&root).unwrap();
+    let create = |inventory: &Path, entities: &Path| {
+        RunStores::create(
+            &root,
+            "x",
+            RunPaths {
+                corpus: &dao.corpus,
+                inventory,
+                entities,
+            },
+            "fake-model",
+            "bag",
+        )
+    };
+    // A directory opens for reading and fails mid-copy, after the destination exists.
+    let dir = dao.root.join("a-directory");
+    std::fs::create_dir_all(&dir).unwrap();
+    assert!(create(&dir, &dao.entities).is_err());
+    assert!(!root.join("inventory.cc").exists());
+    // A directory as the entities store fails after the inventory was copied.
+    assert!(create(&dao.inventory, &dir).is_err());
+    assert!(!root.join("inventory.cc").exists());
+    assert!(create(&dao.inventory, &dao.entities).is_ok());
+}
+
+/// `weksa.loop_run` as it was before the run kept its own inventory copy: keys
+/// 0 to 10.
+#[derive(Clone, cultcache_rs::DatabaseEntry)]
+#[cultcache(type = "weksa.loop_run")]
+struct LegacyRun {
+    #[cultcache(key = 0)]
+    label: String,
+    #[cultcache(key = 1)]
+    corpus: String,
+    #[cultcache(key = 2)]
+    inventory: String,
+    #[cultcache(key = 3)]
+    entities: String,
+    #[cultcache(key = 4)]
+    corpus_digest: String,
+    #[cultcache(key = 5)]
+    entity_digest: String,
+    #[cultcache(key = 6)]
+    prompt_digest: String,
+    #[cultcache(key = 7)]
+    lowerer_digest: String,
+    #[cultcache(key = 8)]
+    model: String,
+    #[cultcache(key = 9)]
+    embedder: String,
+    #[cultcache(key = 10)]
+    chrf_version: String,
+}
+
+#[test]
+fn a_run_from_before_the_copy_does_not_open() {
+    // A run.cc without key 11 is a scratch run off git: its open fails Store.
+    let w = world();
+    let dir = w.dir.path().to_path_buf();
+    let current = run_over(&dir).record().clone();
+    let root = dir.join("run");
+    std::fs::remove_file(root.join("run.cc")).unwrap();
+    let mut cache = CultCache::new();
+    cache.register_entry_type::<LegacyRun>().unwrap();
+    cache
+        .add_generic_backing_store(SingleFileMessagePackBackingStore::new(root.join("run.cc")))
+        .unwrap();
+    cache
+        .put(
+            "run:t",
+            &LegacyRun {
+                label: current.label,
+                corpus: current.corpus,
+                inventory: current.inventory,
+                entities: current.entities,
+                corpus_digest: current.corpus_digest,
+                entity_digest: current.entity_digest,
+                prompt_digest: current.prompt_digest,
+                lowerer_digest: current.lowerer_digest,
+                model: current.model,
+                embedder: current.embedder,
+                chrf_version: current.chrf_version,
+            },
+        )
+        .unwrap();
+    assert_eq!(RunStores::open(&root).err(), Some(RunError::Store));
+}
+
 #[test]
 fn source_digests_cover_their_files() {
     let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
@@ -328,18 +545,24 @@ fn answer_files_write_the_prompt_and_read_the_answer() {
 use std::collections::HashMap;
 
 use common::Bag;
-use weksa::context::{ENCODE_INSTRUCTIONS, Prompt};
+use weksa::context::{ENCODE_INSTRUCTIONS, MINT_INSTRUCTIONS, Prompt};
 use weksa::daodejing::packets;
 use weksa::model::{AnswerFiles, ModelPort, PortError};
 use weksa::run::{Outcome, RoundOutcome, RoundRecord, Stage, round};
 use weksa::{Embedder, PacketDraft, PacketStore, Scorer};
 
 /// Answers by the item the prompt holds; panics on an item it was not given,
-/// and records every prompt it was shown.
+/// and records every prompt it was shown. A prompt that starts with
+/// `MINT_INSTRUCTIONS` is the editor's and is answered from `edit` (a panic when
+/// none was given). With `candidate` set, an encode prompt that lists
+/// `inventory rev:<that revision>` is answered from the candidate answers.
 struct FakeModel {
     name: &'static str,
     answers: HashMap<String, String>,
+    candidate: Option<(u32, HashMap<String, String>)>,
+    edit: Option<Result<String, PortError>>,
     seen: Vec<(String, String)>,
+    mint_keys: Vec<Vec<String>>,
 }
 
 impl ModelPort for FakeModel {
@@ -347,9 +570,23 @@ impl ModelPort for FakeModel {
         self.name
     }
     fn answer(&mut self, prompt: &Prompt) -> Result<String, PortError> {
-        let key = prompt.item_keys()[0].clone();
         self.seen.push((prompt.digest(), prompt.text().to_string()));
-        match self.answers.get(&key) {
+        if prompt.text().starts_with(MINT_INSTRUCTIONS) {
+            self.mint_keys.push(prompt.item_keys().to_vec());
+            return self.edit.clone().expect("the model was asked for an edit");
+        }
+        let key = prompt.item_keys()[0].clone();
+        let answers = match &self.candidate {
+            Some((rev, candidate))
+                if prompt
+                    .text()
+                    .contains(&format!("\n\ninventory rev:{rev}\n")) =>
+            {
+                candidate
+            }
+            _ => &self.answers,
+        };
+        match answers.get(&key) {
             Some(answer) => Ok(answer.clone()),
             None => panic!("the model was asked about {key}"),
         }
@@ -364,15 +601,22 @@ fn json(draft: &PacketDraft) -> String {
     serde_json::to_string(draft).unwrap()
 }
 
+fn keyed(answers: &[(usize, String)]) -> HashMap<String, String> {
+    answers
+        .iter()
+        .map(|(n, a)| (format!("item:daodejing:{n}"), a.clone()))
+        .collect()
+}
+
 /// A fake that answers the Dao packets for the Train and Validation items.
 fn fake(answers: &[(usize, String)]) -> FakeModel {
     FakeModel {
         name: "fake-model",
-        answers: answers
-            .iter()
-            .map(|(n, a)| (format!("item:daodejing:{n}"), a.clone()))
-            .collect(),
+        answers: keyed(answers),
+        candidate: None,
+        edit: None,
         seen: vec![],
+        mint_keys: vec![],
     }
 }
 
@@ -384,11 +628,19 @@ struct Dao {
     _dir: tempfile::TempDir,
     root: PathBuf,
     corpus: PathBuf,
+    inventory: PathBuf,
+    entities: PathBuf,
     run: RunStores,
 }
 
 /// A run over copies of `data/daodejing/{corpus,inventory,entity}.cc`.
 fn dao() -> Dao {
+    dao_over(|_, _| {})
+}
+
+/// A Dao run whose stores `edit` (given the corpus and entity paths) changed
+/// before the run pinned them.
+fn dao_over(edit: impl FnOnce(&Path, &Path)) -> Dao {
     let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../data/daodejing");
     let dir = tempfile::tempdir().unwrap();
     let copy = |from: &str, to: &str| {
@@ -400,6 +652,7 @@ fn dao() -> Dao {
         copy("inventory.cc", "i.cc"),
         copy("entity.cc", "e.cc"),
     );
+    edit(&corpus, &entities);
     let root = dir.path().join("run");
     let run = RunStores::create(
         &root,
@@ -417,6 +670,8 @@ fn dao() -> Dao {
         _dir: dir,
         root,
         corpus,
+        inventory,
+        entities,
         run,
     }
 }
@@ -480,6 +735,8 @@ fn round_over_the_dao_stores_scores_train_and_validation() {
     assert_eq!(r.model(), "fake-model");
     assert_eq!(r.embedder(), "bag");
     assert_eq!(r.chrf_version(), weksa::score::CHRF_VERSION);
+    assert_eq!(r.inventory_digest(), pinned.inventory_digest);
+    assert_eq!(r.cycle(), None, "a plain round belongs to no cycle");
 
     // It is stored, and the packets are in the round's own store, made by the encoder step.
     assert_eq!(
@@ -802,6 +1059,34 @@ fn refusal_stages_are_counted() {
     assert_eq!(full.validation_scored(), 2);
 }
 
+#[test]
+fn non_utf8_encode_answer_is_a_parse_refusal() {
+    let mut dao = dao();
+    let expected = prompts(&dao.run);
+    let answers: HashMap<String, String> = good_answers()
+        .into_iter()
+        .map(|(n, a)| (format!("item:daodejing:{n}"), a))
+        .collect();
+    let round1 = dao.root.join("round-1");
+    std::fs::create_dir_all(&round1).unwrap();
+    for (key, p) in &expected {
+        let bytes = if key == "item:daodejing:3" {
+            vec![0xff, 0xfe, 0xfd]
+        } else {
+            answers[key].clone().into_bytes()
+        };
+        std::fs::write(round1.join(format!("{}.answer", p.digest())), bytes).unwrap();
+    }
+    let mut files = AnswerFiles::new(round1.clone(), "fake-model".into());
+    let r = recorded(round(&mut dao.run, &mut files, &Scorer::new(Bag)).unwrap());
+    // Item 3 is Validation: its refusal is a Parse refusal and the round stands.
+    let v = r.validation_refused();
+    assert_eq!((v.parse, v.admit, v.lower), (1, 0, 0));
+    assert_eq!((r.train_scored(), r.validation_scored()), (1, 1));
+    assert_eq!(r.validation_mean().count, 2);
+    assert_eq!(dao.run.rounds().unwrap(), [r]);
+}
+
 /// An embedder that is down.
 struct Down;
 
@@ -984,13 +1269,69 @@ fn errors_echo_no_input() {
     ]);
     let r = recorded(round(&mut dao.run, &mut model, &Scorer::new(Bag)).unwrap());
     all.push(format!("{r:?}"));
+    // Cycle errors, from a canary root, and a decision over a canary edit answer.
+    let canary_root = tmp.path().join("canaryrun");
+    let mut canary_run = RunStores::create(
+        &canary_root,
+        "ok",
+        RunPaths {
+            corpus: &dao.corpus,
+            inventory: &dao.inventory,
+            entities: &dao.entities,
+        },
+        "fake-model",
+        "bag",
+    )
+    .unwrap();
+    let mut model = cycle_fake(&format!("{{\"{canary}\":1}}"));
+    let e = cycle(&mut canary_run, &mut model, &Scorer::new(Bag))
+        .err()
+        .unwrap();
+    assert_eq!(e, RunError::NoFloor);
+    all.extend([format!("{e:?}"), e.to_string()]);
+    for _ in 0..2 {
+        let mut m = fake(&degraded_answers());
+        recorded(round(&mut canary_run, &mut m, &Scorer::new(Bag)).unwrap());
+    }
+    let d = decided(cycle(&mut canary_run, &mut model, &Scorer::new(Bag)).unwrap());
+    assert_eq!(d.verdict(), Verdict::Rejected(Why::EditParse));
+    all.extend([format!("{d:?}"), d.summary_line()]);
+    let mut non_utf8 = cycle_fake("");
+    non_utf8.edit = Some(Err(PortError::Io(std::io::ErrorKind::InvalidData)));
+    let d = decided(cycle(&mut canary_run, &mut non_utf8, &Scorer::new(Bag)).unwrap());
+    all.extend([format!("{d:?}"), d.summary_line()]);
+    weksa::InventoryStore::open(&canary_root.join("inventory.cc"))
+        .unwrap()
+        .admit_revision(
+            weksa::InventoryRevision {
+                n: 4,
+                parent: Some(3),
+                changes: vec![],
+                frozen: false,
+            },
+            vec![],
+        )
+        .unwrap();
+    let e = RunStores::open(&canary_root).err().unwrap();
+    assert_eq!(e, RunError::Drift(DriftOf::Inventory));
+    all.extend([format!("{e:?}"), e.to_string()]);
+    let e = RunError::NoValidation;
+    all.extend([format!("{e:?}"), e.to_string()]);
+    assert_eq!(
+        format!("{:?}", RunError::NoFloor),
+        RunError::NoFloor.to_string()
+    );
 
     for text in &all {
         assert!(!text.to_uppercase().contains("CANARY"), "{text}");
     }
-    assert!(all.len() >= 12);
+    assert!(all.len() >= 22);
     // Debug names the same kind Display does.
     assert_eq!(format!("{:?}", RunError::NoRun), "the root holds no run");
+    assert_eq!(
+        format!("{:?}", RunError::Drift(DriftOf::Inventory)),
+        "drift in Inventory"
+    );
     assert_eq!(
         format!("{:?}", RunError::Drift(DriftOf::Model)),
         "drift in Model"
@@ -1013,6 +1354,806 @@ fn prompts_come_only_from_context() {
     }
 }
 
+// ---- edit-accept cycles ----
+
+use weksa::run::{CycleOutcome, Decision, LADDER_STEP, Reading, Verdict, Why, cycle};
+
+const ONE_CONCEPT: &str =
+    r#"{"add":[{"family":"Concept","gloss":"a general meaning the Dao names"}]}"#;
+
+/// Item 2 refused at Admit (an unknown concept), items 1 and 3 good.
+fn degraded_answers() -> Vec<(usize, String)> {
+    vec![
+        (1, json(&draft_of(1))),
+        (2, edited(2, unknown_concept)),
+        (3, json(&draft_of(3))),
+    ]
+}
+
+/// Head answers degrade item 2; candidate answers (for `inventory rev:4`) are
+/// the good Dao drafts; the editor answers `edit`.
+fn cycle_fake(edit: &str) -> FakeModel {
+    let mut model = fake(&degraded_answers());
+    model.candidate = Some((4, keyed(&good_answers())));
+    model.edit = Some(Ok(edit.to_string()));
+    model
+}
+
+fn two_rounds(dao: &mut Dao) {
+    for _ in 0..2 {
+        let mut model = fake(&degraded_answers());
+        recorded(round(&mut dao.run, &mut model, &Scorer::new(Bag)).unwrap());
+    }
+}
+
+fn decided(outcome: CycleOutcome) -> Decision {
+    match outcome {
+        CycleOutcome::Decided(d) => d,
+        CycleOutcome::Unanswered { prompts } => panic!("unanswered: {prompts:?}"),
+    }
+}
+
+fn run_cycle(dao: &mut Dao, model: &mut FakeModel) -> Decision {
+    decided(cycle(&mut dao.run, model, &Scorer::new(Bag)).unwrap())
+}
+
+fn head_rev(root: &Path) -> u32 {
+    let run = RunStores::open(root).unwrap();
+    let inv = run.inventory().inventory().unwrap();
+    inv.latest().unwrap().n
+}
+
+fn validation(r: &RoundRecord) -> Reading {
+    Reading::of(r.validation_mean()).unwrap()
+}
+
+/// The feedback line the editor is shown for a head round, built from outside.
+fn feedback_line(last: &str, head: &RoundRecord) -> String {
+    let rounded = (validation(head).composite / LADDER_STEP).round() * LADDER_STEP;
+    format!("last edit: {last}; validation composite at head: {rounded:.3}")
+}
+
+fn mint_texts(model: &FakeModel) -> Vec<&str> {
+    model
+        .seen
+        .iter()
+        .map(|(_, t)| t.as_str())
+        .filter(|t| t.starts_with(MINT_INSTRUCTIONS))
+        .collect()
+}
+
+#[test]
+fn cycle_accepts_a_gain_past_the_floor() {
+    let mut dao = dao();
+    two_rounds(&mut dao);
+    let source = std::fs::read(&dao.inventory).unwrap();
+    let rounds = dao.run.rounds().unwrap();
+    assert_eq!(validation(&rounds[0]), validation(&rounds[1]), "floor 0");
+
+    let mut model = cycle_fake(ONE_CONCEPT);
+    let d = run_cycle(&mut dao, &mut model);
+    assert_eq!(
+        (d.k(), d.base_round(), d.candidate_round()),
+        (1, 1, Some(3))
+    );
+    assert_eq!((d.base_rev(), d.candidate_rev()), (3, Some(4)));
+    assert_eq!(d.verdict(), Verdict::Accepted);
+    assert_eq!(d.threshold(), LADDER_STEP);
+    assert_eq!(
+        *d.floor(),
+        Reading {
+            chrf: 0.0,
+            meaning: 0.0,
+            composite: 0.0
+        }
+    );
+    assert_eq!(*d.base(), validation(&rounds[0]));
+    let record = dao.run.rounds().unwrap().remove(2);
+    assert_eq!(d.candidate(), Some(&validation(&record)));
+    assert!(d.candidate().unwrap().composite - d.base().composite > LADDER_STEP);
+
+    // The candidate round was scored under the candidate file, as cycle 1's.
+    let file = dao.root.join("cycle-1/inventory.cc");
+    assert_eq!(
+        (record.n(), record.inventory_rev(), record.cycle()),
+        (3, 4, Some(1))
+    );
+    assert_eq!(record.inventory_digest(), hex(&file));
+    assert_eq!(d.candidate_inventory_digest(), Some(hex(&file).as_str()));
+    assert_eq!(
+        d.base_inventory_digest(),
+        hex(&dao.root.join("inventory.cc"))
+    );
+    assert_eq!(d.base_inventory_digest(), dao.run.record().inventory_digest);
+    assert!(dao.root.join("cycle-1/packets.cc").is_file());
+    assert_eq!(d.edit().items, ["item:daodejing:1"]);
+    assert_eq!(
+        d.edit_answer_digest(),
+        Some(format!("{:016x}", fnv1a64(ONE_CONCEPT.as_bytes())).as_str())
+    );
+    assert_eq!(d.edit().prompt, model.seen[0].0);
+
+    // The line, with the readings printed to four places.
+    let (b, c) = (d.base().composite, d.candidate().unwrap().composite);
+    assert_eq!(
+        d.summary_line(),
+        format!(
+            "cycle 1 rev 3->4 base={b:.4} candidate={c:.4} floor=0.0000 threshold=0.0050 accepted"
+        )
+    );
+
+    // The decision made it the head: a reopened run reads rev 4 from the cycle's
+    // file, and the caller's inventory file was never touched.
+    assert_eq!(head_rev(&dao.root), 4);
+    assert_eq!(std::fs::read(&dao.inventory).unwrap(), source);
+    assert_eq!(dao.run.decisions().unwrap(), std::slice::from_ref(&d));
+    assert_eq!(
+        RunStores::open(&dao.root).unwrap().decisions().unwrap(),
+        std::slice::from_ref(&d)
+    );
+    for (_, p) in prompts(&dao.run) {
+        assert!(p.text().contains("\n\ninventory rev:4\n"));
+    }
+
+    // `loop round` reads the head and never moves it; the next cycle's base is
+    // the establishing round 3, not the replicate recorded after it.
+    let mut again = fake(&good_answers());
+    let r = recorded(round(&mut dao.run, &mut again, &Scorer::new(Bag)).unwrap());
+    assert_eq!((r.n(), r.inventory_rev(), r.cycle()), (4, 4, None));
+    assert_eq!(r.inventory_digest(), hex(&file));
+    let mut second = fake(&good_answers());
+    second.candidate = Some((5, keyed(&good_answers())));
+    second.edit = Some(Ok(ONE_CONCEPT.to_string()));
+    let d2 = run_cycle(&mut dao, &mut second);
+    assert_eq!((d2.k(), d2.base_round(), d2.base_rev()), (2, 3, 4));
+    assert_eq!(d2.candidate_rev(), Some(5));
+    assert_eq!(d2.candidate_round(), Some(5));
+    assert_eq!(d2.verdict(), Verdict::Rejected(Why::NoGain));
+    assert_eq!(*d2.floor(), *d.floor(), "the floor is measured once");
+    assert_eq!(head_rev(&dao.root), 4, "a rejected edit moves nothing");
+    assert!(
+        mint_texts(&second)[0].contains(&feedback_line("accepted", &dao.run.rounds().unwrap()[2])),
+        "{}",
+        mint_texts(&second)[0]
+    );
+    assert!(dao.root.join("cycle-2/inventory.cc").is_file());
+    assert_eq!(
+        d2.base_inventory_digest(),
+        d.candidate_inventory_digest().unwrap()
+    );
+}
+
+#[test]
+fn cycle_rejects_no_gain_and_keeps_the_head() {
+    let mut dao = dao();
+    two_rounds(&mut dao);
+    let mut model = fake(&degraded_answers());
+    model.candidate = Some((4, keyed(&degraded_answers())));
+    model.edit = Some(Ok(ONE_CONCEPT.to_string()));
+    let d = run_cycle(&mut dao, &mut model);
+    assert_eq!(d.verdict(), Verdict::Rejected(Why::NoGain));
+    assert_eq!((d.candidate_rev(), d.candidate_round()), (Some(4), Some(3)));
+    assert_eq!(d.candidate(), Some(d.base()));
+    let c = d.base().composite;
+    assert_eq!(
+        d.summary_line(),
+        format!(
+            "cycle 1 rev 3->4 base={c:.4} candidate={c:.4} floor=0.0000 threshold=0.0050 rejected no-gain"
+        )
+    );
+    assert_eq!(head_rev(&dao.root), 3);
+    assert_eq!(
+        RunStores::open(&dao.root)
+            .unwrap()
+            .record()
+            .inventory_digest,
+        hex(&dao.root.join("inventory.cc"))
+    );
+    assert_eq!(
+        dao.run.rounds().unwrap().len(),
+        3,
+        "the candidate round is recorded"
+    );
+
+    // Cycle 2 goes to its own directory and is told the last edit was rejected,
+    // with the same head composite.
+    assert_eq!(dao.run.next_cycle_dir().unwrap(), dao.root.join("cycle-2"));
+    let d2 = run_cycle(&mut dao, &mut model);
+    assert_eq!((d2.k(), d2.base_round(), d2.base_rev()), (2, 1, 3));
+    assert!(dao.root.join("cycle-2/inventory.cc").is_file());
+    let mints = mint_texts(&model);
+    assert_eq!(mints.len(), 2);
+    let round1 = dao.run.rounds().unwrap().remove(0);
+    assert!(mints[0].contains(&feedback_line("none", &round1)));
+    assert!(mints[1].contains(&feedback_line("rejected", &round1)));
+}
+
+/// Item 2 and item 3 both refused at Admit: the weakest reading.
+fn worst_answers() -> Vec<(usize, String)> {
+    vec![
+        (1, json(&draft_of(1))),
+        (2, edited(2, unknown_concept)),
+        (3, edited(3, unknown_concept)),
+    ]
+}
+
+#[test]
+fn distinct_replicates_set_the_floor_and_a_gain_inside_it_is_no_gain() {
+    let mut dao = dao();
+    // Replicate 1 is degraded, replicate 2 is good: the two readings differ.
+    for answers in [degraded_answers(), good_answers()] {
+        let mut m = fake(&answers);
+        recorded(round(&mut dao.run, &mut m, &Scorer::new(Bag)).unwrap());
+    }
+    let rounds = dao.run.rounds().unwrap();
+    let (a, b) = (validation(&rounds[0]), validation(&rounds[1]));
+    let want = Reading {
+        chrf: (a.chrf - b.chrf).abs(),
+        meaning: (a.meaning - b.meaning).abs(),
+        composite: (a.composite - b.composite).abs(),
+    };
+    assert!(want.chrf > 0.0 && want.meaning > 0.0 && want.composite > LADDER_STEP);
+
+    // The candidate reads exactly as the good replicate: its gain over the head
+    // (round 1) is the floor, which is past a step and inside the noise.
+    let mut model = cycle_fake(ONE_CONCEPT);
+    let d = run_cycle(&mut dao, &mut model);
+    assert_eq!(*d.floor(), want);
+    assert_eq!(d.threshold(), want.composite);
+    assert_eq!(d.candidate(), Some(&b));
+    assert!(d.candidate().unwrap().composite - d.base().composite > LADDER_STEP);
+    assert_eq!(d.verdict(), Verdict::Rejected(Why::NoGain));
+    assert_eq!(head_rev(&dao.root), 3);
+}
+
+#[test]
+fn a_rejected_candidates_score_never_reaches_the_editor() {
+    let mut dao = dao();
+    two_rounds(&mut dao);
+    let mut model = fake(&degraded_answers());
+    model.candidate = Some((4, keyed(&worst_answers())));
+    model.edit = Some(Ok(ONE_CONCEPT.to_string()));
+    let d = run_cycle(&mut dao, &mut model);
+    assert!(matches!(d.verdict(), Verdict::Rejected(Why::Regressed(_))));
+    let rounds = dao.run.rounds().unwrap();
+    let (head, candidate) = (&rounds[0], &rounds[2]);
+    let ladder = |r: &RoundRecord| feedback_line("rejected", r);
+    assert_ne!(
+        ladder(head),
+        ladder(candidate),
+        "the candidate reads differently on the ladder"
+    );
+
+    let d2 = run_cycle(&mut dao, &mut model);
+    assert_eq!(d2.base_round(), 1);
+    let mints = mint_texts(&model);
+    assert!(mints[1].contains(&ladder(head)), "{}", mints[1]);
+    assert!(!mints[1].contains(&ladder(candidate)), "{}", mints[1]);
+    let rounds = dao.run.rounds().unwrap();
+    assert!(!mints[1].contains(&ladder(&rounds[3])), "{}", mints[1]);
+}
+
+#[test]
+fn two_accepts_make_the_latest_the_head_and_a_reject_after_them_is_told_so() {
+    let mut dao = dao();
+    // Level 0 twice: a floor of 0 and a base reading of the weakest.
+    for _ in 0..2 {
+        let mut m = fake(&worst_answers());
+        recorded(round(&mut dao.run, &mut m, &Scorer::new(Bag)).unwrap());
+    }
+    let mut model = fake(&worst_answers());
+    let mut step = |dao: &mut Dao, rev: u32, answers: &[(usize, String)]| {
+        model.candidate = Some((rev, keyed(answers)));
+        model.edit = Some(Ok(ONE_CONCEPT.to_string()));
+        run_cycle(dao, &mut model)
+    };
+    let d1 = step(&mut dao, 4, &degraded_answers());
+    let d2 = step(&mut dao, 5, &good_answers());
+    assert_eq!(d1.verdict(), Verdict::Accepted);
+    assert_eq!(d2.verdict(), Verdict::Accepted);
+    assert_eq!((d2.base_round(), d2.base_rev()), (3, 4));
+    assert_eq!(
+        (d2.candidate_round(), d2.candidate_rev()),
+        (Some(4), Some(5))
+    );
+
+    // The head is the second accept, live and reopened.
+    assert_eq!(head_rev(&dao.root), 5);
+    assert_eq!(
+        d2.candidate_inventory_digest(),
+        Some(hex(&dao.root.join("cycle-2/inventory.cc")).as_str())
+    );
+
+    // Cycle 3 builds on cycle 2's file and round, gains nothing, and is rejected.
+    let d3 = step(&mut dao, 6, &good_answers());
+    assert_eq!((d3.k(), d3.base_round(), d3.base_rev()), (3, 4, 5));
+    assert_eq!(
+        d3.base_inventory_digest(),
+        d2.candidate_inventory_digest().unwrap()
+    );
+    assert_eq!(d3.verdict(), Verdict::Rejected(Why::NoGain));
+    assert_eq!(head_rev(&dao.root), 5, "a reject moves nothing");
+
+    // Cycle 4 is told by the latest decision alone: cycle 3's reject, not cycle
+    // 2's accept, and the composite at the head, which the reject did not move.
+    let d4 = step(&mut dao, 6, &good_answers());
+    assert_eq!((d4.k(), d4.base_round(), d4.base_rev()), (4, 4, 5));
+    let rounds = dao.run.rounds().unwrap();
+    let mints = mint_texts(&model);
+    assert_eq!(mints.len(), 4);
+    assert!(mints[0].contains(&feedback_line("none", &rounds[0])));
+    assert!(mints[1].contains(&feedback_line("accepted", &rounds[2])));
+    assert!(mints[2].contains(&feedback_line("accepted", &rounds[3])));
+    assert!(
+        mints[3].contains(&feedback_line("rejected", &rounds[3])),
+        "{}",
+        mints[3]
+    );
+    assert!(mints[1].contains("\n\ninventory rev:4\n"));
+    assert!(mints[3].contains("\n\ninventory rev:5\n"));
+}
+
+#[test]
+fn a_rejection_leaves_no_candidate_inventory_from_an_earlier_attempt() {
+    for (name, rewrite, why) in [
+        ("zero changes", "{}", Why::EditAdmit),
+        ("not json", "not json", Why::EditParse),
+    ] {
+        let mut dao = dao();
+        two_rounds(&mut dao);
+        let scorer = Scorer::new(Bag);
+        let ask = |dao: &mut Dao| {
+            let mut files =
+                AnswerFiles::new(dao.run.next_cycle_dir().unwrap(), "fake-model".into());
+            cycle(&mut dao.run, &mut files, &scorer).unwrap()
+        };
+        let dir = dao.root.join("cycle-1");
+        let CycleOutcome::Unanswered { prompts } = ask(&mut dao) else {
+            panic!("{name}: answered from nothing")
+        };
+        let answer = dir.join(format!("{}.answer", prompts[0]));
+        std::fs::write(&answer, ONE_CONCEPT).unwrap();
+
+        // The candidate round is unanswered, which leaves the candidate inventory.
+        let CycleOutcome::Unanswered { .. } = ask(&mut dao) else {
+            panic!("{name}: answered the candidate round from nothing")
+        };
+        assert!(dir.join("inventory.cc").is_file(), "{name}");
+
+        // The editor's answer is replaced by one the door refuses.
+        std::fs::write(&answer, rewrite).unwrap();
+        let d = decided(ask(&mut dao));
+        assert_eq!(d.verdict(), Verdict::Rejected(why), "{name}");
+        assert!(!dir.join("inventory.cc").exists(), "{name}");
+        assert!(!dir.join("inventory.cc.lock").exists(), "{name}");
+        assert_eq!(head_rev(&dao.root), 3, "{name}");
+    }
+}
+
+#[cfg(unix)]
+#[test]
+fn a_failed_accept_write_leaves_neither_the_round_nor_the_decision() {
+    use std::os::unix::fs::PermissionsExt;
+    let mut dao = dao();
+    two_rounds(&mut dao);
+    let run_cc = std::fs::read(dao.root.join("run.cc")).unwrap();
+    let mut model = cycle_fake(ONE_CONCEPT);
+    // The cycle's directory exists, so everything but run.cc can still be
+    // written once the run's root takes no new files: the batch's staging file
+    // is refused, and it is the only write to run.cc a cycle makes.
+    std::fs::create_dir_all(dao.root.join("cycle-1")).unwrap();
+    let chmod = |mode| std::fs::set_permissions(&dao.root, std::fs::Permissions::from_mode(mode));
+    chmod(0o500).unwrap();
+    if std::fs::File::create(dao.root.join("probe")).is_ok() {
+        // Running as a user the mode does not bind: the fault cannot be injected.
+        std::fs::remove_file(dao.root.join("probe")).unwrap();
+        chmod(0o700).unwrap();
+        return;
+    }
+    let err = cycle(&mut dao.run, &mut model, &Scorer::new(Bag)).err();
+    chmod(0o700).unwrap();
+    assert_eq!(err, Some(RunError::Store));
+    assert_eq!(std::fs::read(dao.root.join("run.cc")).unwrap(), run_cc);
+    assert_eq!(dao.run.rounds().unwrap().len(), 2, "no orphan round");
+    assert!(dao.run.decisions().unwrap().is_empty(), "no decision");
+    let reopened = RunStores::open(&dao.root).unwrap();
+    assert_eq!(reopened.rounds().unwrap().len(), 2);
+    assert!(reopened.decisions().unwrap().is_empty());
+    assert_eq!(head_rev(&dao.root), 3);
+
+    // The rerun decides cycle 1 on round 3, as if the failure had not happened.
+    let d = run_cycle(&mut dao, &mut model);
+    assert_eq!((d.k(), d.candidate_round()), (1, Some(3)));
+    assert_eq!(d.verdict(), Verdict::Accepted);
+}
+
+#[test]
+fn unanswered_cycle_writes_nothing() {
+    let mut dao = dao();
+    two_rounds(&mut dao);
+    let run_cc = std::fs::read(dao.root.join("run.cc")).unwrap();
+    let scorer = Scorer::new(Bag);
+    let ask = |dao: &mut Dao| {
+        let mut files = AnswerFiles::new(dao.run.next_cycle_dir().unwrap(), "fake-model".into());
+        cycle(&mut dao.run, &mut files, &scorer).unwrap()
+    };
+    let dir = dao.root.join("cycle-1");
+
+    // The first call asks the editor and nothing else.
+    let CycleOutcome::Unanswered { prompts: asked } = ask(&mut dao) else {
+        panic!("answered from nothing")
+    };
+    assert_eq!(asked.len(), 1);
+    let mint_file = dir.join(format!("{}.prompt", asked[0]));
+    let mint = std::fs::read_to_string(&mint_file).unwrap();
+    assert_eq!(format!("{:016x}", fnv1a64(mint.as_bytes())), asked[0]);
+    assert!(mint.starts_with(MINT_INSTRUCTIONS));
+    assert!(mint.contains("\n\nlast edit: none; validation composite at head: 0.435\n\n"));
+    assert!(mint.contains("\n\ninventory rev:3\n"));
+    assert_eq!(mint.matches("[item:").count(), 1, "one Train block");
+    assert_eq!(std::fs::read_dir(&dir).unwrap().count(), 1);
+    assert_eq!(std::fs::read(dao.root.join("run.cc")).unwrap(), run_cc);
+
+    // With the edit answered, the candidate round asks three encode prompts at rev 4.
+    std::fs::write(dir.join(format!("{}.answer", asked[0])), ONE_CONCEPT).unwrap();
+    let CycleOutcome::Unanswered { prompts: encode } = ask(&mut dao) else {
+        panic!("answered the candidate round from nothing")
+    };
+    assert_eq!(encode.len(), 3);
+    let answers: HashMap<String, String> = keyed(&good_answers());
+    for digest in &encode {
+        let text = std::fs::read_to_string(dir.join(format!("{digest}.prompt"))).unwrap();
+        assert!(text.contains("\n\ninventory rev:4\n"), "{text}");
+        assert!(text.starts_with(ENCODE_INSTRUCTIONS));
+        let key = text
+            .split("[item:")
+            .nth(1)
+            .and_then(|t| t.split(']').next())
+            .map(|k| format!("item:{k}"))
+            .unwrap();
+        std::fs::write(dir.join(format!("{digest}.answer")), &answers[&key]).unwrap();
+    }
+    assert_eq!(
+        std::fs::read(dao.root.join("run.cc")).unwrap(),
+        run_cc,
+        "no round 3 and no decision"
+    );
+    assert_eq!(dao.run.rounds().unwrap().len(), 2);
+    assert!(dao.run.decisions().unwrap().is_empty());
+
+    // Answered, the cycle is decided; the next one uses cycle-2.
+    let d = decided(ask(&mut dao));
+    assert_eq!((d.k(), d.verdict()), (1, Verdict::Accepted));
+    assert_eq!(dao.run.next_cycle_dir().unwrap(), dao.root.join("cycle-2"));
+    let CycleOutcome::Unanswered { prompts: next } = ask(&mut dao) else {
+        panic!("cycle 2 answered from cycle 1's files")
+    };
+    assert_eq!(next.len(), 1);
+    assert!(
+        dao.root
+            .join(format!("cycle-2/{}.prompt", next[0]))
+            .is_file()
+    );
+    assert_ne!(next[0], asked[0]);
+}
+
+#[test]
+fn the_editor_sees_train_only() {
+    let canary_key = "item:canary:1";
+    let canary_text = "CANARYVALIDATIONTEXT";
+    let mut dao = dao_over(|corpus, entities| {
+        let entities = weksa::EntityStore::open(entities).unwrap();
+        let mut store = weksa::CorpusStore::open(corpus).unwrap();
+        let mut item = store.get("item:daodejing:2").unwrap().unwrap();
+        item.id = canary_key.into();
+        item.text = canary_text.into();
+        item.names = vec![];
+        item.prior_turns = vec![];
+        store.add(item, &entities).unwrap();
+    });
+    let with_canary = |mut m: FakeModel| {
+        m.answers.insert(canary_key.into(), json(&draft_of(2)));
+        if let Some((_, c)) = m.candidate.as_mut() {
+            c.insert(canary_key.into(), json(&draft_of(2)));
+        }
+        m
+    };
+    for _ in 0..2 {
+        let mut m = with_canary(fake(&degraded_answers()));
+        recorded(round(&mut dao.run, &mut m, &Scorer::new(Bag)).unwrap());
+    }
+    let mut model = fake(&degraded_answers());
+    model.candidate = Some((4, keyed(&degraded_answers())));
+    model.edit = Some(Ok(ONE_CONCEPT.to_string()));
+    let mut model = with_canary(model);
+    let d = run_cycle(&mut dao, &mut model);
+    assert_eq!(d.verdict(), Verdict::Rejected(Why::NoGain));
+
+    // A plain round with different answers changes the latest reading, not the
+    // head's: the line the next cycle shows is the head round's.
+    let mut other = with_canary(fake(&good_answers()));
+    let r4 = recorded(round(&mut dao.run, &mut other, &Scorer::new(Bag)).unwrap());
+    let rounds = dao.run.rounds().unwrap();
+    assert_ne!(validation(&r4), validation(&rounds[0]));
+    let d2 = run_cycle(&mut dao, &mut model);
+    assert_eq!(d2.base_round(), 1);
+
+    let corpus = weksa::CorpusStore::open(&dao.corpus).unwrap();
+    let mut held_out: Vec<String> = vec![canary_key.into(), canary_text.into(), "canary".into()];
+    for n in 2..=5 {
+        let item = corpus.get(&format!("item:daodejing:{n}")).unwrap().unwrap();
+        held_out.extend([item.id, item.text]);
+    }
+    let mints = mint_texts(&model);
+    assert_eq!(mints.len(), 2);
+    for text in &mints {
+        assert!(text.starts_with(MINT_INSTRUCTIONS));
+        for needle in &held_out {
+            assert!(
+                !text.to_lowercase().contains(&needle.to_lowercase()),
+                "{needle}"
+            );
+        }
+        assert_eq!(text.matches("[item:").count(), 1);
+        assert!(text.contains("[item:daodejing:1]"));
+    }
+    assert_eq!(
+        model.mint_keys,
+        [["item:daodejing:1"], ["item:daodejing:1"]]
+    );
+    // The one number from the held-out split is the head composite on the ladder.
+    let head = &rounds[0];
+    assert!(mints[0].contains(&format!("\n\n{}\n\n", feedback_line("none", head))));
+    assert!(mints[1].contains(&format!("\n\n{}\n\n", feedback_line("rejected", head))));
+    assert_eq!(
+        mints[0].replace("last edit: none;", "last edit: rejected;"),
+        mints[1],
+        "the two prompts differ by the last-edit word alone"
+    );
+
+    // Nothing the cycle writes or prints holds a held-out key or text.
+    for text in [
+        format!("{d:?}"),
+        d.summary_line(),
+        format!("{d2:?}"),
+        d2.summary_line(),
+    ] {
+        for needle in &held_out {
+            assert!(
+                !text.to_lowercase().contains(&needle.to_lowercase()),
+                "{needle}: {text}"
+            );
+        }
+    }
+    let run_cc = std::fs::read(dao.root.join("run.cc")).unwrap();
+    for needle in [canary_text, "item:daodejing:4", "item:daodejing:5"] {
+        assert!(
+            !run_cc.windows(needle.len()).any(|w| w == needle.as_bytes()),
+            "{needle}"
+        );
+    }
+}
+
+#[test]
+fn edit_refusals_are_decisions() {
+    use std::io::ErrorKind;
+    let nine = format!(
+        r#"{{"add":[{}]}}"#,
+        [r#"{"family":"Concept","gloss":"g"}"#; 9].join(",")
+    );
+    let long = format!(
+        r#"{{"add":[{{"family":"Concept","gloss":"{}"}}]}}"#,
+        "x".repeat(121)
+    );
+    let cases: Vec<(&str, Result<String, PortError>, Why)> = vec![
+        ("not json", Ok("not json at all".into()), Why::EditParse),
+        (
+            "non-utf8",
+            Err(PortError::Io(ErrorKind::InvalidData)),
+            Why::EditParse,
+        ),
+        (
+            "an id in an entry",
+            Ok(r#"{"add":[{"family":"Concept","gloss":"g","id":"concept:1"}]}"#.into()),
+            Why::EditParse,
+        ),
+        ("no changes", Ok("{}".into()), Why::EditAdmit),
+        ("nine changes", Ok(nine), Why::EditAdmit),
+        (
+            "retiring an absent id",
+            Ok(r#"{"retire":["concept:9999"]}"#.into()),
+            Why::EditAdmit,
+        ),
+        ("a 121-byte gloss", Ok(long), Why::EditAdmit),
+        (
+            "a control character in a gloss",
+            Ok("{\"add\":[{\"family\":\"Concept\",\"gloss\":\"a\\u0007b\"}]}".into()),
+            Why::EditAdmit,
+        ),
+    ];
+    for (name, edit, why) in cases {
+        let mut dao = dao();
+        two_rounds(&mut dao);
+        let mut model = cycle_fake("");
+        model.edit = Some(edit.clone());
+        let d = run_cycle(&mut dao, &mut model);
+        assert_eq!(d.verdict(), Verdict::Rejected(why), "{name}");
+        assert_eq!(
+            (d.candidate_rev(), d.candidate_round(), d.candidate()),
+            (None, None, None),
+            "{name}"
+        );
+        assert_eq!(d.candidate_inventory_digest(), None, "{name}");
+        let want = match &edit {
+            Ok(a) => Some(format!("{:016x}", fnv1a64(a.as_bytes()))),
+            Err(_) => None,
+        };
+        assert_eq!(d.edit_answer_digest(), want.as_deref(), "{name}");
+        assert_eq!(
+            dao.run.rounds().unwrap().len(),
+            2,
+            "{name}: no candidate round"
+        );
+        assert_eq!(model.seen.len(), 1, "{name}: no encode prompt was asked");
+        let dir = dao.root.join("cycle-1");
+        assert!(!dir.join("inventory.cc").exists(), "{name}");
+        assert!(!dir.join("inventory.cc.lock").exists(), "{name}");
+        assert_eq!(head_rev(&dao.root), 3, "{name}");
+        let tag = if why == Why::EditParse {
+            "edit-parse"
+        } else {
+            "edit-admit"
+        };
+        assert_eq!(
+            d.summary_line(),
+            format!(
+                "cycle 1 rev 3->none base={:.4} candidate=none floor=0.0000 threshold=0.0050 rejected {tag}",
+                d.base().composite
+            ),
+            "{name}"
+        );
+        assert_eq!(dao.run.decisions().unwrap(), [d], "{name}");
+
+        // The next cycle is told the last edit was rejected and asks afresh, in
+        // a directory of its own.
+        assert_eq!(dao.run.next_cycle_dir().unwrap(), dao.root.join("cycle-2"));
+        model.edit = Some(Ok(ONE_CONCEPT.into()));
+        let d2 = run_cycle(&mut dao, &mut model);
+        assert_eq!(d2.k(), 2, "{name}");
+        assert!(
+            mint_texts(&model)[1].contains("last edit: rejected;"),
+            "{name}"
+        );
+    }
+}
+
+#[test]
+fn cycle_needs_a_floor() {
+    let none = |dao: &mut Dao, model: &mut FakeModel| {
+        let before = std::fs::read(dao.root.join("run.cc")).unwrap();
+        let err = cycle(&mut dao.run, model, &Scorer::new(Bag)).err();
+        assert_eq!(std::fs::read(dao.root.join("run.cc")).unwrap(), before);
+        assert!(dao.run.decisions().unwrap().is_empty());
+        assert!(!dao.root.join("cycle-1").exists());
+        assert!(model.seen.is_empty(), "no prompt before the floor");
+        err
+    };
+    let mut dao = dao();
+    let mut model = cycle_fake(ONE_CONCEPT);
+    assert_eq!(none(&mut dao, &mut model), Some(RunError::NoFloor));
+    let mut one = fake(&degraded_answers());
+    recorded(round(&mut dao.run, &mut one, &Scorer::new(Bag)).unwrap());
+    assert_eq!(none(&mut dao, &mut model), Some(RunError::NoFloor));
+    assert_eq!(
+        RunError::NoFloor.to_string(),
+        "the run has no noise floor: record two rounds first"
+    );
+
+    // Rounds whose Validation items are all withdrawn have no reading.
+    let mut dao = dao_over(|corpus, _| {
+        let mut store = weksa::CorpusStore::open(corpus).unwrap();
+        for n in [2, 3] {
+            store.withdraw(&format!("item:daodejing:{n}")).unwrap();
+        }
+    });
+    for _ in 0..2 {
+        let mut m = fake(&[(1, json(&draft_of(1)))]);
+        let r = recorded(round(&mut dao.run, &mut m, &Scorer::new(Bag)).unwrap());
+        assert_eq!(r.validation_mean().count, 0);
+    }
+    let mut model = cycle_fake(ONE_CONCEPT);
+    assert_eq!(none(&mut dao, &mut model), Some(RunError::NoValidation));
+    assert_eq!(
+        RunError::NoValidation.to_string(),
+        "a reading has no validation item"
+    );
+}
+
+#[test]
+fn a_failed_candidate_round_writes_nothing() {
+    let mut dao = dao();
+    two_rounds(&mut dao);
+    let run_cc = std::fs::read(dao.root.join("run.cc")).unwrap();
+    let mut model = cycle_fake(ONE_CONCEPT);
+    assert_eq!(
+        cycle(&mut dao.run, &mut model, &Scorer::new(Down)).err(),
+        Some(RunError::Embed)
+    );
+    assert_eq!(std::fs::read(dao.root.join("run.cc")).unwrap(), run_cc);
+    assert_eq!(dao.run.rounds().unwrap().len(), 2);
+    assert!(dao.run.decisions().unwrap().is_empty());
+    assert!(!dao.root.join("cycle-1/packets.cc").exists());
+    assert_eq!(head_rev(&dao.root), 3);
+
+    // The rerun starts clean from the head and decides on round 3.
+    let d = run_cycle(&mut dao, &mut model);
+    assert_eq!((d.k(), d.candidate_round()), (1, Some(3)));
+    assert_eq!(d.verdict(), Verdict::Accepted);
+}
+
+#[test]
+fn a_changed_head_is_drift() {
+    let revision = |rev: u32| weksa::InventoryRevision {
+        n: rev + 1,
+        parent: Some(rev),
+        changes: vec![],
+        frozen: false,
+    };
+    let append = |file: &Path, rev: u32| {
+        weksa::InventoryStore::open(file)
+            .unwrap()
+            .admit_revision(revision(rev), vec![])
+            .unwrap();
+    };
+    // Before any accept the head is the run's copy.
+    let mut dao = dao();
+    append(&dao.root.join("inventory.cc"), 3);
+    assert_eq!(
+        RunStores::open(&dao.root).err(),
+        Some(RunError::Drift(DriftOf::Inventory))
+    );
+
+    // After an accept it is the cycle's file; the first copy is no longer read.
+    let mut dao2 = self::dao();
+    two_rounds(&mut dao2);
+    let mut model = cycle_fake(ONE_CONCEPT);
+    assert_eq!(
+        run_cycle(&mut dao2, &mut model).verdict(),
+        Verdict::Accepted
+    );
+    drop(dao2.run);
+    assert!(RunStores::open(&dao2.root).is_ok());
+    append(&dao2.root.join("inventory.cc"), 3);
+    assert!(
+        RunStores::open(&dao2.root).is_ok(),
+        "the superseded copy is not the head"
+    );
+    append(&dao2.root.join("cycle-1/inventory.cc"), 4);
+    assert_eq!(
+        RunStores::open(&dao2.root).err(),
+        Some(RunError::Drift(DriftOf::Inventory))
+    );
+    dao.run = RunStores::create(
+        &dao.root.join("again"),
+        "x",
+        RunPaths {
+            corpus: &dao.corpus,
+            inventory: &dao.inventory,
+            entities: &dao.entities,
+        },
+        "fake-model",
+        "bag",
+    )
+    .unwrap();
+    assert_eq!(
+        dao.run.record().inventory,
+        std::fs::canonicalize(&dao.inventory)
+            .unwrap()
+            .to_str()
+            .unwrap()
+    );
+}
+
 /// Tripwires over the source, with the limits stated: they read text, so they
 /// catch a spelling and not an alias.
 #[test]
@@ -1063,4 +2204,65 @@ fn source_tripwires() {
     }
     let context = read("context.rs");
     assert!(!context.contains("pub fn from_corpus") && !context.contains("pub fn for_round"));
+    // The editor's prompt reads Train items, an inventory and an EditFeedback:
+    // no round record, decision, held-out mean or refusal count is named there.
+    for banned in [
+        "RoundRecord",
+        "Decision",
+        "SplitMean",
+        "Aggregate",
+        "validation_mean",
+        "validation_refused",
+    ] {
+        assert!(!context.contains(banned), "context.rs names {banned}");
+    }
+    // `EditFeedback::none` is the one public constructor; Decision has none.
+    assert!(!context.contains("pub fn new"));
+    let run = read("run.rs");
+    let code: Vec<&str> = run
+        .lines()
+        .filter(|l| !l.trim_start().starts_with("//"))
+        .collect();
+    let count = |needle: &str| code.iter().filter(|l| l.contains(needle)).count();
+    assert!(!run.contains("pub fn new"));
+    assert_eq!(count("admit_revision("), 1, "one door call");
+    assert_eq!(
+        count("std::fs::copy"),
+        1,
+        "the cycle's copy; create's is copy_new"
+    );
+    assert_eq!(
+        count("Path::new(&record.inventory)"),
+        1,
+        "the source path is read once"
+    );
+    assert_eq!(
+        count("InventoryStore::open"),
+        2,
+        "the head and the cycle's file"
+    );
+    // Accepting is one write: from the decision literal on, the candidate round
+    // and the decision go through one `put_prepared_batch` and no `.put(`.
+    let tail = run
+        .split("let decided = Decision {")
+        .nth(1)
+        .and_then(|t| t.split("Ok(CycleOutcome::Decided(decided))").next())
+        .unwrap();
+    assert_eq!(tail.matches("put_prepared_batch(").count(), 1);
+    assert!(!tail.contains(".put("), "a second write after the batch");
+    // An entry draft carries no id or revision field.
+    let encode = read("encode.rs");
+    let entry = encode
+        .split("pub struct EntryDraft {")
+        .nth(1)
+        .and_then(|t| t.split('}').next())
+        .unwrap();
+    for banned in ["id", "introduced_rev", "retired_rev"] {
+        assert!(
+            !entry
+                .split_whitespace()
+                .any(|w| w.trim_end_matches(':') == banned),
+            "EntryDraft has a {banned} field"
+        );
+    }
 }
diff --git a/crates/weksa/tests/split_schema.rs b/crates/weksa/tests/split_schema.rs
index c2829d4..bb6bc78 100644
--- a/crates/weksa/tests/split_schema.rs
+++ b/crates/weksa/tests/split_schema.rs
@@ -134,6 +134,12 @@ fn published_schemas_match() {
     let published = weksa::schema::published();
     let mut names: Vec<String> = published.iter().map(|(n, _)| n.clone()).collect();
     names.sort();
+    for loop_type in ["run", "round", "decision"] {
+        assert!(
+            names.contains(&format!("weksa.loop_{loop_type}.schema.json")),
+            "{loop_type}"
+        );
+    }
     let mut on_disk: Vec<String> = std::fs::read_dir(&dir)
         .unwrap()
         .map(|e| e.unwrap().file_name().into_string().unwrap())
diff --git a/docs/targets/interlingua-lowering-map.md b/docs/targets/interlingua-lowering-map.md
index a0b3302..4f467e4 100644
--- a/docs/targets/interlingua-lowering-map.md
+++ b/docs/targets/interlingua-lowering-map.md
@@ -40,8 +40,9 @@ means no store holds it and nothing writes it.
 | Scene (cut `speaker-scene`) | Key `scene:<group>@<n>`, the item's split group; type `weksa.scene`: participants (speaker slugs) and, per ordered pair, relation features of slot `Scene` (relative status, intimacy, in-group, audience and whatever the loop adds), at an inventory revision, and an `Annotator` | As Speaker. Keyed by the group, so a scene never straddles the split | As Speaker |
 | Corpus item | Key `item:<source-slug>:<n>`, `n` canonical decimal >= 1 (no sign, no leading zero, from cut 2b); type `weksa.corpus_item` with text, language, speaker, split group, prior turns, source. Source `ModelWritten` carries a `ModelFamily` enum, the generator string as the fixture wrote it, and a prompt digest (cut 2b). The item carries no speaker state of its own: its speaker slug and group name the Speaker and Scene documents | Admitted once; the whole item is immutable (re-adding an identical item is a no-op, any difference is refused; a correction is a new item that `supersedes` the old); text already held under another key is refused unless the new item supersedes that key (cut 2b); withdrawn, never deleted, so old scores stay explainable | Importers and `weksa corpus add`, under `corpus-cast-plus-public-domain`; the source enum has no variant for Discord or any training-forbidden source (`corpus-clean`) |
 | Split assignment | Derived: `split(scheme, item.group)` | Fixed for a scheme; a new scheme is a new constant, never a reassignment. A model-written item whose group derives test is in no split; a superseding item keeps its predecessor's group | The hash function. Nobody assigns by hand, so there is no writer to forbid |
-| Loop round | Key `run:<label>:round:<n>`; type `weksa.loop_round` with spec version, profile revisions, model ids and prompt digests, sampled train items, proposed change, validation scores before and after, outcome | Opened, scored, closed accepted or rejected; immutable once closed. Lives in the run store on Yggdrasil | The loop driver's accept rule (validation composite improves past the measured noise floor and no metric regresses past tolerance) |
-| Score | Key `<lowering-key>:<metric>@<metric-version>`; type `weksa.score` | Immutable; a new metric version scores again under a new key | The scorer, deterministic given the metric version and the embedder's model id. Cut `scorer` computes scores as values; cut `golf-loop-en` stores them, because the lowering keys they hang from arrive with the loop |
+| Loop round | Key `run:<label>:round:<n>`; type `weksa.loop_round` with spec version, profile revisions, model ids and prompt digests, sampled train items, Validation means and refusal counts, the digest of the inventory file it was scored under and, for a cycle's candidate round, its cycle `k` | Scored and recorded whole; immutable. A candidate round is put in one batch with its Decision. Lives in the run store on Yggdrasil | `run::round` and `run::cycle` (both through `score_round`) |
+| Loop decision | Key `run:<label>:cycle:<k>`; type `weksa.loop_decision` with the base round and revision, the edit prompt's digest and Train keys, the editor's answer digest, the candidate revision, inventory digest and round, the base, candidate and floor readings (chrF, meaning, composite), the threshold and the verdict (Accepted, or Rejected for edit-parse, edit-admit, no-gain, regressed chrF or meaning); digests and numbers, no text | Immutable. The latest Accepted one names the run's head inventory (`<root>/cycle-<k>/inventory.cc`, its candidate digest, its candidate round); with none the head is the copy `create` made at `<root>/inventory.cc`. Lives in the run store on Yggdrasil | `run::cycle`'s accept rule, `run::decide`: the validation composite gains more than max(noise floor, `LADDER_STEP`) and no metric falls past max(its floor, one step), differences compared in billionths so a gain of exactly one step is a tie |
+| Score | Key `<lowering-key>:<metric>@<metric-version>`; type `weksa.score` | Immutable; a new metric version scores again under a new key | The scorer, deterministic given the metric version and the embedder's model id. Cut `scorer` computes scores as values; cut `golf-loop-en` stores them, because the lowering keys they hang from arrive with the loop. Lands with follow-up `golf-loop-score-docs`, in the round's directory; nothing in the cycle reads them |
 | Lowering trace | Key `lowering:<packet-key>:<profile>@<rev>:<lowerer-digest>:<sample>`; type `weksa.lowering` holding the surface text and its trace together | Immutable. A surface text cannot exist without its trace, because they are one record (`lowering-traced`) | The lowerer emits; the lowerer sees the packet without its `trace` (the input type has no such field), never the corpus item |
 | Conlang lexicon entry | Key `lex:<language>:<concept-id>`; root form, morphology class | Root placed at its concept's embedding when the concept first needs a form in that language; stable once accepted; diachrony derives later forms, it does not overwrite | The language project's owner: the operator for her settings' languages, the loop proposing roots for her review |
 | Conlang grammar and phonology data | `<language>/grammar`, `<language>/phonology` documents per language project | Revised by commit; every lowering names the revision | The language project's owner |
@@ -405,7 +406,8 @@ One line per cut; specs exist for the cuts about to run (2d and 4, siblings on `
 6. `pd-importer`: public-domain play and fiction dialogue into the corpus with speaker, scene group, edition provenance, and Speaker and Scene annotations by the ruled annotator. Waits on 4, follow-up `gutenberg-terms` and question `pd-speaker-annotation`.
 7a. `loop-context-builder`: `context.rs` (`TrainItems`, `EncoderOffer`, `Prompt`: corpus text reaches a model call only through `Prompt::mint` over live Train items or `Prompt::encode` over one offered item; instructions are the consts `MINT_INSTRUCTIONS` and `ENCODE_INSTRUCTIONS` in `context.rs`; `Checkpoint` has no public constructor, offers each item once, and its offers borrow it (the gate is typed `TestReadings` and Test offers on the round path; operator tools such as `weksa corpus dump` and `weksa score` still read corpus text of any split); prior turns print the held Train text), `SplitScheme::live`, `CorpusItem::cited_entities` (one owner of the id set `PacketStore::admit` and the offer share), and checkpoint-only Test readings (`Checkpoint`, `TestReadings`; `Aggregate` and `leak_diagnostic` carry no Test). Library only; since 7b `TrainItems::from_corpus` and `EncoderOffer::for_round` are crate-private and `RunStores` is their one public producer. Merges follow-ups `loop-context-builder-2` and `scorer-test-readings-type`. (spec r1)
 7b. `golf-loop-round` (spec r1; branch `weksa-lowering/golf-loop-round`): the smallest loop that scores one round. `run.rs`: `RunStores` pins the corpus and entity stores of a run by canonical path and FNV-1a 64 digest at `create`, reopens only from `<root>/run.cc` and refuses drift (corpus, entities, `PROMPT_SOURCE_DIGEST` of `context.rs`, `LOWERER_SOURCE_DIGEST` of `lower.rs`, model, embedder); `round` encodes every live Train and Validation item through a `ModelPort` (`model.rs`; the one adapter `AnswerFiles` writes `<digest>.prompt` and reads `<digest>.answer`, so the model is the Claude session), reads each answer into a `PacketDraft` (`encode.rs`, the one place a model's JSON is read), admits through `PacketStore::admit` into `<root>/round-<n>/packets.cc`, lowers, scores once, and keeps a `RoundRecord` (`weksa.loop_round`, no text, no Test; Train rows, Validation only as means and refusal counts). `weksa loop open|round`. Not here: the spec-edit step, accept rule and composite, noise floor, Score and lowering documents, a subprocess adapter, the checkpoint door, a model lowerer (follow-ups `golf-loop-spec-edit`, `golf-loop-accept-rule`, `golf-loop-score-documents`, `golf-loop-subprocess-adapter`, `golf-loop-checkpoint-door-bound`, `golf-loop-model-lowerer`). `packet-store-inventory-binding` is met for loop packets only (`RunStores` admits with the run's inventory); `validate`, `packet proof|dao` and `lower` still take caller stores. Waits on 7a, `checkpoint-gate`, 4b.
-7. `golf-loop-en` (7b landed its round, `ModelPort`, encoder prompt, template digest and round records; the rest remains): the loop driver, the packet store bound to one inventory store everywhere (`packet-store-inventory-binding`), a subprocess adapter, lowerer prompts, Score documents, the composite and accept rule, `weksa score`, the detached unit on Yggdrasil. Waits on 3, 5, 6 and follow-up `claude-on-yggdrasil`.
+7c. `golf-loop-edit-accept` (spec r1; branch `weksa-lowering/golf-loop-edit-accept`): one edit-accept cycle. The run works on its own copy of the inventory (`create` copies the caller's file to `<root>/inventory.cc`, refusing a root that already holds a file of that name, and pins its digest as `RunRecord` key 11; `RunRecord.inventory` is provenance; a `run.cc` from before has no key 11 and does not open); the head is derived from the latest Accepted `Decision`. `weksa loop cycle` asks the editor for one inventory edit from `Prompt::mint(train, inventory, rev, feedback)` (Train blocks, the inventory listing and an `EditFeedback` line: whether the last edit was kept and the head's Validation composite rounded to `LADDER_STEP`, the Ladder release of Blum and Hardt 2015), reads it as an `EditDraft` (`encode.rs`; ids and revisions are the store's, `into_revision`), admits it through `InventoryStore::admit_revision` into `<root>/cycle-<k>/inventory.cc`, runs a candidate round under it, and `decide`s on Validation against the head's establishing round past a floor measured as the spread between rounds 1 and 2 (never under one `LADDER_STEP`). An edit that fails is a rejected `Decision`, not an error. `RoundRecord` gains keys 16 (inventory digest) and 17 (cycle); an encode answer that is not UTF-8 is that item's parse refusal. Not here: Score and lowering documents (`golf-loop-score-docs`), Train rows in the edit prompt (`golf-loop-edit-train-feedback`), a paired floor (`golf-loop-paired-floor`), the checkpoint door and merging to `data/` (`golf-loop-checkpoint-door-bound`, `golf-loop-freeze-merge`), a model lowerer (`golf-loop-model-lowerer-next`; until it lands an entry an edit adds has no lowering row, so a cycle gains only by retiring entries or adding ones the encoder does not cite). Waits on 7b.
+7. `golf-loop-en` (7b and 7c landed the round, `ModelPort`, encoder prompt, template digest, round records and the edit-accept cycle; the rest remains): the packet store bound to one inventory store everywhere (`packet-store-inventory-binding`), a subprocess adapter, lowerer prompts, Score documents, `weksa score` in the loop, the detached unit on Yggdrasil. Waits on 3, 5, 6 and follow-up `claude-on-yggdrasil`.
 8. `style-axis`: a style-embedding score behind the scorer port. Waits on 3.
 9. `ja-panel`: ja-JP into the loop's panel. Waits on 7.
 10. `conlang-lexicon`: the first conlang's lexicon placed at concept embeddings, its morphology data, its ontology entries and the gloss reader. Waits on 3, 5 and question `first-conlang`.
diff --git a/schemas/cultnet/weksa.loop_decision.schema.json b/schemas/cultnet/weksa.loop_decision.schema.json
new file mode 100644
index 0000000..0966600
--- /dev/null
+++ b/schemas/cultnet/weksa.loop_decision.schema.json
@@ -0,0 +1,201 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Decision",
+  "description": "One closed edit-accept cycle: digests and numbers, no text. Key\n`run:<label>:cycle:<k>`. Only [`cycle`] builds one.\n\n```\nfn f(d: &weksa::run::Decision) -> u32 { d.k() }\n```\n\nEvery field is given, so the literal below fails only on privacy; its twin is\nthe same literal in the unit test `a_decision_literal_compiles_in_the_lib`.\n\n```compile_fail,E0451\nuse weksa::run::{Call, Decision, Reading, Verdict};\nfn f() -> Decision {\n    let r = Reading { chrf: 0.0, meaning: 0.0, composite: 0.0 };\n    Decision {\n        k: 1,\n        base_round: 1,\n        base_rev: 1,\n        base_inventory_digest: String::new(),\n        edit: Call { prompt: String::new(), items: vec![] },\n        edit_answer_digest: None,\n        candidate_rev: None,\n        candidate_inventory_digest: None,\n        candidate_round: None,\n        base: r,\n        candidate: None,\n        floor: r,\n        threshold: 0.0,\n        verdict: Verdict::Accepted,\n    }\n}\n```",
+  "type": "object",
+  "properties": {
+    "base": {
+      "$ref": "#/$defs/Reading"
+    },
+    "base_inventory_digest": {
+      "type": "string"
+    },
+    "base_rev": {
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0
+    },
+    "base_round": {
+      "description": "The head's establishing round: the base of this cycle.",
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0
+    },
+    "candidate": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/Reading"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "candidate_inventory_digest": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "candidate_rev": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "format": "uint32",
+      "minimum": 0
+    },
+    "candidate_round": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "format": "uint32",
+      "minimum": 0
+    },
+    "edit": {
+      "description": "The edit prompt's digest and the Train keys it held.",
+      "$ref": "#/$defs/Call"
+    },
+    "edit_answer_digest": {
+      "description": "16 hex of the editor's answer; `None` when it was unreadable.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "floor": {
+      "$ref": "#/$defs/Reading"
+    },
+    "k": {
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0
+    },
+    "threshold": {
+      "type": "number",
+      "format": "double"
+    },
+    "verdict": {
+      "$ref": "#/$defs/Verdict"
+    }
+  },
+  "required": [
+    "k",
+    "base_round",
+    "base_rev",
+    "base_inventory_digest",
+    "edit",
+    "base",
+    "floor",
+    "threshold",
+    "verdict"
+  ],
+  "$defs": {
+    "Call": {
+      "description": "One model call: the prompt's digest and the item keys it held.",
+      "type": "object",
+      "properties": {
+        "items": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "prompt": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "prompt",
+        "items"
+      ]
+    },
+    "Metric": {
+      "description": "Which metric an edit regressed.",
+      "type": "string",
+      "enum": [
+        "Chrf",
+        "Meaning"
+      ]
+    },
+    "Reading": {
+      "description": "One validation reading: chrF 0 to 100, meaning 0 to 1, and their composite.",
+      "type": "object",
+      "properties": {
+        "chrf": {
+          "type": "number",
+          "format": "double"
+        },
+        "composite": {
+          "type": "number",
+          "format": "double"
+        },
+        "meaning": {
+          "type": "number",
+          "format": "double"
+        }
+      },
+      "required": [
+        "chrf",
+        "meaning",
+        "composite"
+      ]
+    },
+    "Verdict": {
+      "oneOf": [
+        {
+          "type": "string",
+          "enum": [
+            "Accepted"
+          ]
+        },
+        {
+          "type": "object",
+          "properties": {
+            "Rejected": {
+              "$ref": "#/$defs/Why"
+            }
+          },
+          "additionalProperties": false,
+          "required": [
+            "Rejected"
+          ]
+        }
+      ]
+    },
+    "Why": {
+      "description": "Why an edit was rejected.",
+      "oneOf": [
+        {
+          "type": "string",
+          "enum": [
+            "NoGain"
+          ]
+        },
+        {
+          "description": "The answer was not an edit draft.",
+          "type": "string",
+          "const": "EditParse"
+        },
+        {
+          "description": "The draft asked for no change or too many, or the inventory door refused it.",
+          "type": "string",
+          "const": "EditAdmit"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "Regressed": {
+              "$ref": "#/$defs/Metric"
+            }
+          },
+          "additionalProperties": false,
+          "required": [
+            "Regressed"
+          ]
+        }
+      ]
+    }
+  }
+}
diff --git a/schemas/cultnet/weksa.loop_round.schema.json b/schemas/cultnet/weksa.loop_round.schema.json
index 7cde9c2..d846e12 100644
--- a/schemas/cultnet/weksa.loop_round.schema.json
+++ b/schemas/cultnet/weksa.loop_round.schema.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "RoundRecord",
-  "description": "One scored round. It holds no text and no Test reading: per-item rows for\nTrain only, Validation only as means and refusal counts by stage. Only\n`run::round` builds one.\n\n```\nfn f(r: &weksa::run::RoundRecord) -> u32 { r.n() }\n```\n\nEvery field is given, so the literal below fails only on privacy; its twin\nis the same literal in the unit test `a_round_record_literal_compiles_in_the_lib`.\n\n```compile_fail,E0451\nuse weksa::run::{RefusalCounts, RoundRecord};\nuse weksa::score::SplitMean;\nfn f() -> RoundRecord {\n    RoundRecord {\n        n: 1,\n        inventory_rev: 1,\n        prompt_digest: String::new(),\n        lowerer_digest: String::new(),\n        corpus_digest: String::new(),\n        entity_digest: String::new(),\n        model: String::new(),\n        embedder: String::new(),\n        chrf_version: String::new(),\n        calls: vec![],\n        train: vec![],\n        train_mean: SplitMean::default(),\n        train_scored: 0,\n        validation_mean: SplitMean::default(),\n        validation_scored: 0,\n        validation_refused: RefusalCounts::default(),\n    }\n}\n```",
+  "description": "One scored round. It holds no text and no Test reading: per-item rows for\nTrain only, Validation only as means and refusal counts by stage. Only\n`run::round` builds one.\n\n```\nfn f(r: &weksa::run::RoundRecord) -> u32 { r.n() }\n```\n\nEvery field is given, so the literal below fails only on privacy; its twin\nis the same literal in the unit test `a_round_record_literal_compiles_in_the_lib`.\n\n```compile_fail,E0451\nuse weksa::run::{RefusalCounts, RoundRecord};\nuse weksa::score::SplitMean;\nfn f() -> RoundRecord {\n    RoundRecord {\n        n: 1,\n        inventory_rev: 1,\n        prompt_digest: String::new(),\n        lowerer_digest: String::new(),\n        corpus_digest: String::new(),\n        entity_digest: String::new(),\n        model: String::new(),\n        embedder: String::new(),\n        chrf_version: String::new(),\n        calls: vec![],\n        train: vec![],\n        train_mean: SplitMean::default(),\n        train_scored: 0,\n        validation_mean: SplitMean::default(),\n        validation_scored: 0,\n        validation_refused: RefusalCounts::default(),\n        inventory_digest: String::new(),\n        cycle: None,\n    }\n}\n```",
   "type": "object",
   "properties": {
     "calls": {
@@ -16,12 +16,25 @@
     "corpus_digest": {
       "type": "string"
     },
+    "cycle": {
+      "description": "`Some(k)` for the candidate round of cycle `k`.",
+      "type": [
+        "integer",
+        "null"
+      ],
+      "format": "uint32",
+      "minimum": 0
+    },
     "embedder": {
       "type": "string"
     },
     "entity_digest": {
       "type": "string"
     },
+    "inventory_digest": {
+      "description": "16 hex of the inventory file the round was scored under.",
+      "type": "string"
+    },
     "inventory_rev": {
       "type": "integer",
       "format": "uint32",
@@ -85,7 +98,8 @@
     "validation_mean",
     "validation_refused",
     "train_scored",
-    "validation_scored"
+    "validation_scored",
+    "inventory_digest"
   ],
   "$defs": {
     "Call": {
diff --git a/schemas/cultnet/weksa.loop_run.schema.json b/schemas/cultnet/weksa.loop_run.schema.json
index b04b8b4..69bb0a4 100644
--- a/schemas/cultnet/weksa.loop_run.schema.json
+++ b/schemas/cultnet/weksa.loop_run.schema.json
@@ -26,6 +26,11 @@
       "type": "string"
     },
     "inventory": {
+      "description": "Canonical absolute path of the inventory store the run was opened over:\nprovenance only. `create` copies that file to `<root>/inventory.cc` and\nthe run reads nothing at this path afterwards.",
+      "type": "string"
+    },
+    "inventory_digest": {
+      "description": "16 hex of the bytes `create` copied to `<root>/inventory.cc`.",
       "type": "string"
     },
     "label": {
@@ -53,6 +58,7 @@
     "lowerer_digest",
     "model",
     "embedder",
-    "chrf_version"
+    "chrf_version",
+    "inventory_digest"
   ]
 }