The refused run is refused everywhere

[felipesauer]

A MNEMA_RUN the record cannot vouch for is proven once, at the transport, and from
there the verb "only has to fail". That sentence is written at fourteen sites in nine
files and was asserted at one — memory, through three cli-e2e cases. The other
thirteen were the same four lines copied, with nothing observing that they ran.

The guard has two halves, and only one was protected

Measured on the trunk by writing the mutation and asking the compiler:

• "It does not write" is already total. Deleting the whole guard does not typecheck —
  the resolver answers string | undefined | typeof PIN_REFUSED, the spread then carries
  string | symbol, and the adapter takes run?: string. TS2379, at the call, in
  src. A fifteenth site written the naive way cannot be committed.
• "It fails" is protected by nothing. Deleting only the io.fail() typechecks
  clean. The write is still refused, and the shell is told the command SUCCEEDED — a
  script that stops on a non-zero exit walks straight past a write that never happened.

So this closes the second half, and does not unify the fourteen sites into one function:
that would trade a build-time guard for a test-time one.

The list is derived, not written

The command paths are walked off the program the entry builds, and each line is
synthesised from its own declaration (required positionals, mandatory options, and the
closed set a declaration names). A subcommand added tomorrow is exercised without an edit
anywhere. Which paths ask for a run is measured, by the refusal code only the resolver
produces — UNPROVEN_RUN. The obvious discriminant has an impostor: mnema run end reads
MNEMA_RUN on its own account and refuses an unknown id under UNKNOWN_RUN, so a scan
for that would have called a verb that stamps nothing a site of this rule.

Two passes, because one instrument cannot carry both halves: every path, outside a
project, must fail and print nothing; and every path found to ask runs twice in a
project of its own — refused (writes nothing) beside unpinned (writes something), so "it
wrote nothing" is read next to a line that could.

Fifteen paths from fourteen written sites — switch off and switch on are declared
by one function, and mutating that one site accuses both by name.

Two more holes closed by the same walk

• Outside a project, the surface says so in one sentence — read off the wording rather
  than retyped, with the three verbs that name their own way back asserted and the paths
  that legitimately answer declared, both directions reconciled. This is what reaches the
  four reportRefusal calls no test had ever run: three because nothing ran a read
  outside a project, and witness because its refusal is NO_TAIL and needed a record
  with nothing in it.
• processIo — the three lines that are the product at a terminal — is asked to talk
  to the real process: which stream, the newline it adds, and the exit code. Both streams
  are borrowed together and given back in a finally, and nothing is asserted until they
  are back, so the suite still exits 0.

Also in here

• The count of sites in two doc-comments said eleven: true the day it was first
  written (Every verb says whether it writes #476, when there were eleven), stale by the time it was copied into
  record-effect.ts (Both surfaces say if they write #591, when there were fourteen). Both rewritten, saying what
  falsified them, and now pointing at the guard that derives the figure.
• mergeAForeignTail moved out of every-verb-says-if-it-writes.test.ts into
  tests/support/, where the second caller can reach it.
• The ledger of files no test names loses two rows — wiring/io.ts and
  wiring/run-pin.ts — and the row that claimed "processIo never runs" is gone with it.

Numbers

packages/code/src/wiring: 51 uncovered lines → 11, 94.94% → 98.91%.
Workspace: 94.98/88.36/96.83/96.16 → 95.50/88.95/97.00/96.73. thresholds untouched.

No verb's behaviour changed. The only change under src/ is prose.

Ten mutations, none of them silent: dropping io.fail() at a site accuses that site by
name; dropping it at switch.ts accuses both paths it serves; the compiling escape
(typeof run === 'string') is caught with appended 1 with the run refused; a verb that
stops asking reddens the derived list naming it; the three port mutations each light the
one case that owns them, and nothing else in 4412.

build 0 · lint 0 · typecheck 0 · 4412 tests in 281 files (was 4401 in 278).