feat(p19): the trace says HOW, and a run says what it spent and why it stopped

DEL C. P18 gave read_dir a window (filter/offset/limit) and then measured its
own paid round without being able to see it used: five of 31 documents read
lay outside the default window, so the window HAD been widened and the trace
could not say with which knob. ToolCall now carries the three arguments,
always present and empty/zero when not passed -- an absent key and "not
narrowed" must not read the same -- and the judge counts filter_calls and
paged_calls. _number_argument is a SIBLING of _string_argument, not a widening
of it: a model may send limit as 10 or as "10", and a reader that knew one
shape would report a paged call as unpaged.

DEL D. P18's finding 4 was WRONG AS WRITTEN. provenance.token_usage has been
stamped on every proposal artefact since S3.4 and stands in every one of round
2's; what was missing is a READER. The judge reads it now (round 2 measured:
289 054 tokens against round 1's 2 679 305, -89 %), and the P18 report gets a
dated correction UNDER its original paragraph rather than instead of it.

What was genuinely absent is {run_id}-coverage.json. settle prints the
coverage report and ApproachOutcome has carried not_evaluated since Trekk A3,
but neither ever reached a file, so a judge could see an approach had no
artefact and could not tell a budget stop from an approach nobody ordered.
Written from the finally IFF a mandate was given. stop_reason comes from a
CALLER-OWNED sink rather than from in_flight, and that is a measurement:
_evaluate_mandate SWALLOWS BudgetExceeded once something has been produced, so
run_project's own in_flight never sees it.

Load-bearing measured (10 arms), four mutations all red against the whole
suite, green control 1744/5 and the golden byte-unchanged. D-i stood GREEN
first -- the vacuous-gate class, 25th time: the arm called write_coverage
itself and therefore chose the reason it then asserted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/portfolio_optimiser/outbox.py

@@ -312,6 +312,43 @@ def write_proposal_reviews(
     return path
 
 
+def write_coverage(
+    outbox_dir: str,
+    run_id: str,
+    *,
+    rows: Sequence[Mapping[str, Any]],
+    stop_reason: str,
+) -> Path:
+    """Write ``{run_id}-coverage.json`` — WHY each commissioned approach ended as it did (P19 D2).
+
+    ``settle`` prints the coverage report and ``ApproachOutcome`` has carried ``not_evaluated``
+    since Trekk A3, but neither ever reached a FILE: measured 14.09, a judge reading an outbox could
+    see that an approach had no artefact and could not tell a budget stop from an approach nobody
+    ordered. That is the very silence ``ApproachOutcome`` exists to remove, one layer out.
+
+    ``stop_reason`` is ``BudgetExceeded.kind`` when a cap cut the run short (``tokens`` /
+    ``rounds`` / the portfolio's own kinds) and ``""`` when nothing did. A REQUIRED argument rather
+    than an inferred one, for ``cost_baseline_anchored``'s reason: "the run finished" and "we never
+    found out" must not be the same value.
+
+    Byte-deterministic and wall-clock-free, mirroring ``write_run_config``; plain data only, so the
+    RAW output layer stays MAF-free."""
+    directory = Path(outbox_dir)
+    directory.mkdir(parents=True, exist_ok=True)
+    path = directory / f"{run_id}-coverage.json"
+    path.write_text(
+        _dump(
+            {
+                "run_id": run_id,
+                "stop_reason": stop_reason,
+                "rows": [dict(row) for row in rows],
+            }
+        ),
+        encoding="utf-8",
+    )
+    return path
+
+
 def write_run_config(
     config_dir: str,
     run_id: str,