M2.8: switch over to the new loop

nisse-dev now runs only the conversational loop. The gated state machine
it was built alongside is gone:

- Removed control.py, planner.py, executor.py, approvals.py, gates.py
  (command_form moves to loop/reader.py), publish.py and poller.py, the
  old assembly in agent.py (its shared helpers move to loop/build.py),
  the store's state-machine view (get_state, transition), their tests,
  the old end-to-end and live planning/milestone/gate tests, and
  specs/orchestrator.qnt with its scenarios.
- Roles are driver, helper, expert and classifier; driver is required.
  loop:, roles.planner, roles.executor and tuning.executor are refused
  with what to use instead; tuning.driver takes the turn cap and failure
  limit.
- The benchmark and the capability matrix measure the driver: the
  loop's own system prompt and tools, the task's plan as the agreed
  restatement. Task plans end with finish_milestone, so earlier runs
  show as (old); stored runs' executor tuning reads as the driver's.
- A delegation on the loop records what its helper's alias resolved to
  (L9), as the old path's did.
- The dump shows a work item's revision and what it waits for.
- Behaviour the old tests covered and the loop shares stays covered:
  driver runs that fail on a model call, stop mid-turn, reset the
  failure count; go-aheads ignoring case and punctuation; a request too
  big to fit is never sent; the assembly tests, now on build_loop_agent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

docs/Development-Plan.md

@@ -24,8 +24,8 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
 | Section | Status | Notes |
 |---|---|---|
 | **L1** Work model | mostly done | Work items with an active pointer (M1.1); issue intake (M2.1); queue, parking and blocked items (M2.2) on the new loop; no grace period yet |
-| **L2** Agent loop | partial | `control.py`, a fixed state machine with no-stranding, `stop`, `abandon`. Replaced by the new loop (Phase 2) |
-| **L3** Authority | partial | Revision binding and arrival stamping (`gates.py`); scope is still plan approval, not the issue and its conversation |
+| **L2** Agent loop | mostly done | The loop (Phase 2), the only one since the switch-over (M2.8): driver runs, waits, `stop`, `abandon`, question runs |
+| **L3** Authority | partial | Go-aheads bound to the restatement's revision, on the issue and its conversation (M2.1); no action classes yet (M3.1) |
 | **L4** Classifier | none | |
 | **L5** Conversation | partial | Matrix transport, mentions, lenient commands; on the new loop, a thread per item, named and ambiguous commands, plain-language go-aheads (M2.3); little explanation |
 | **L6** Context | partial | Context fitting, per-role views and orchestrator facts (M1.2); no scope or agent memory |
@@ -41,7 +41,7 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
 | **D5** Review | partial | PR conversation comments only (#69), watch stall (#70) |
 | **D7–D8** Deployment, projects | partial | Runs from a venv as a systemd unit on this box; project entries in config (M1.4); egress not enforced |
 | **O**, **X** | none | No container image yet |
-| `specs/` | done for now | `orchestrator.qnt` (current loop), `loop.qnt` (the architecture, #91) |
+| `specs/` | done for now | `loop.qnt` (the architecture, #91); `orchestrator.qnt` went with `control.py` (M2.8) |
 
 ---
 
@@ -51,8 +51,9 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
   Authelia. The infrastructure repository exists in Gitea.
 - **Local inference:** llama-swap on an RTX 4090 host (320 W cap). The benchmark
   (PR #55) chose `qwen3.8-27b` for local work.
-- **Models by role today:** executor `qwen3.8-27b`, planner and helper
-  `claude-opus-5-5`, expert `claude-haiku-4-5`. Phase 2 moves to driver and helpers.
+- **Models by role today:** driver and helper `claude-opus-5-5`, expert
+  `claude-haiku-4-5`. `qwen3.8-27b` has had no role since the executor's went
+  (M2.8); the driver benchmark measures where it fits.
 - **Bring-up** runs on this development VM (`scripts/bringup.sh`), against test
   resources: a test repository, the test Matrix room, a budget-capped LiteLLM key;
   configuration in `/root/nisse-e2e/`.
@@ -85,11 +86,9 @@ Only `nisse-dev` has real code; `nisse-core` and `nisse-ops` are placeholders.
   (`-k`) or diagnosed (`--lf`); `scripts/e2e.sh` reports what a run spent. Manual
   live runs are for the new loop's first runs and phase ends. Findings are filed as
   issues and either fixed before moving on or deliberately deferred.
-- **The Quint models move with the loop:** `orchestrator.qnt` while `control.py`
-  runs, `loop.qnt` for the new loop, whose properties become tests as each piece
-  lands (Phase 2).
-- **`control.py` gets fixes only,** and only for what blocks a live run. New
-  behaviour goes into the new loop.
+- **The Quint model moves with the loop:** `loop.qnt` models the architecture,
+  and its properties are tests (the property walk), changed in the same PR as a
+  rule they cover.
 - **Bring-up runs on this box as root,** against test resources only, with today's
   gates on until the classifier and trust dial are proven (Phase 3).
 - **This plan is revised as we go,** in the same PR as the work that changes it.
@@ -230,8 +229,8 @@ deletes afterwards.
 **M2.6 Roles and capability profiles.** *Pre-approved.* **Done** (this PR).
 `driver`, `helper`, `expert`, `classifier` (L9); escalation triggers; delegation and
 `ask_expert` on the new loop.
-- `roles.driver` (unset: the planner's model) and `roles.classifier` (unset: the
-  expert's), pinned per item; the driver and the go-ahead reader run on the item's.
+- `roles.driver` (required since M2.8; until then, unset meant the planner's
+  model) and `roles.classifier` (unset: the expert's), pinned per item; the driver and the go-ahead reader run on the item's.
 - `profiles:` in configuration (tools, strengths, weaknesses), used in briefings:
   the driver is told what its helper and expert are good at, the helper who will
   read its handback; never a model's name.
@@ -264,9 +263,8 @@ in prose, asking mid-work (L5, #42, #77).
   defaults, secrets by name with their visibility, egress additions.
 - Acceptance: the bring-up configuration is one project entry; a second project
   needs only a second entry.
-- `projects: {name: entry}`. The old loop runs exactly one project and refuses
-  more. On the new loop each project has its own clone, workspace, push credential
-  and milestones. Issues are named `project#14` when two projects could both have
+- `projects: {name: entry}`. Each project has its own clone, workspace, push
+  credential and milestones. Issues are named `project#14` when two projects could both have
   `#14`, and a bare `#14` that matches two is asked about. Switching projects parks
   the one worked on last.
 - Secrets are by `${VAR}` reference only, `commands` or `harness`. `commands`
@@ -295,8 +293,20 @@ the release's own tests over it).
 - The live bring-up's switch to the image waits for the next live test (it needs
   its own test repository too); `bringup.sh plan` shows what it will run.
 
-**M2.8 Switch over.** *Pre-approved, after acceptance.* `nisse-dev` runs the new
-loop; `control.py`, its tests and `orchestrator.qnt` are removed.
+**M2.8 Switch over.** *Pre-approved, after acceptance.* **Done** (this PR, after
+the live session's fixes in #119 and #122). `nisse-dev` runs only the loop.
+- Removed: `control.py`, `planner.py`, `executor.py`, `approvals.py`, `gates.py`,
+  `publish.py`, `poller.py`, the old assembly (`agent.py`, folded into
+  `loop/build.py`), the state store's state-machine view, their tests, the old
+  end-to-end and live planning tests, and `orchestrator.qnt` with its scenarios.
+- Configuration: `loop:`, `roles.planner`, `roles.executor` and
+  `tuning.executor` are refused with what to use instead; `roles.driver` is
+  required, and `tuning.driver` takes the driver's turn cap and failure limit.
+- The benchmark and the capability matrix measure the driver: the loop's own
+  system prompt and tools, the task's plan as the agreed restatement. Task plans
+  end with `finish_milestone`, so earlier runs show as `(old)`.
+- A delegation on the loop records what its helper's alias resolved to (L9), as
+  the old path's did.
 
 ### Phase 3 — Authority
 
@@ -392,7 +402,7 @@ if the implementation differs.
   lines, then drop the oldest events with a note saying so; never the system
   prompt, the current plan or the most recent turns. View labels:
   `[orchestrator]`, `[operator, Matrix]`, `[operator, comment on PR #N]`,
-  `[helper report]`, `[executor]` narration.
+  `[helper report]`, `[driver]` narration.
 - **L7 rendering:** content is stored as bytes or local paths and uploaded or
   inlined at render time, never as provider handles. Token budgeting and
   prompt-cache breakpoints are render-time concerns, never stored. Compaction