feat(p19): the trace says HOW, and a run says what it spent and why it stopped

DEL C. P18 gave read_dir a window (filter/offset/limit) and then measured its
own paid round without being able to see it used: five of 31 documents read
lay outside the default window, so the window HAD been widened and the trace
could not say with which knob. ToolCall now carries the three arguments,
always present and empty/zero when not passed -- an absent key and "not
narrowed" must not read the same -- and the judge counts filter_calls and
paged_calls. _number_argument is a SIBLING of _string_argument, not a widening
of it: a model may send limit as 10 or as "10", and a reader that knew one
shape would report a paged call as unpaged.

DEL D. P18's finding 4 was WRONG AS WRITTEN. provenance.token_usage has been
stamped on every proposal artefact since S3.4 and stands in every one of round
2's; what was missing is a READER. The judge reads it now (round 2 measured:
289 054 tokens against round 1's 2 679 305, -89 %), and the P18 report gets a
dated correction UNDER its original paragraph rather than instead of it.

What was genuinely absent is {run_id}-coverage.json. settle prints the
coverage report and ApproachOutcome has carried not_evaluated since Trekk A3,
but neither ever reached a file, so a judge could see an approach had no
artefact and could not tell a budget stop from an approach nobody ordered.
Written from the finally IFF a mandate was given. stop_reason comes from a
CALLER-OWNED sink rather than from in_flight, and that is a measurement:
_evaluate_mandate SWALLOWS BudgetExceeded once something has been produced, so
run_project's own in_flight never sees it.

Load-bearing measured (10 arms), four mutations all red against the whole
suite, green control 1744/5 and the golden byte-unchanged. D-i stood GREEN
first -- the vacuous-gate class, 25th time: the arm called write_coverage
itself and therefore chose the reason it then asserted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -718,6 +718,16 @@ when the seam is detached, so the loop cannot silently degrade into theater.
   run also writes `{run_id}-exploration.json`: the per-round ledger, the plan reviews and the
   in-loop advisory verdicts, written even when a cap cut the exploration short.
 
+  Every tool call recorded in `{run_id}-exploration.json` and `{run_id}-debate.json` says HOW the
+  level was asked for — `filter`, `offset` and `limit` beside the tool name, the base and the path
+  — so "did the model narrow the level, or page through it" is readable from the artefact rather
+  than inferred from which documents happened to fall outside a default window.
+
+  A run given a mandate also writes `{run_id}-coverage.json`: one row per commissioned approach
+  with its status and detail, including the ones the run never reached, plus the `stop_reason`
+  (`tokens` / `rounds`) when a cap cut the commission short. A run without a mandate writes no
+  such file — coverage is the mandate's report.
+
   The hosted surface takes the same door as `explore_prompt` + `explore_contract` on
   `POST /invocations`.