Docs: runs going in circles end; agents are told they're recorded

A run that repeats itself, or keeps getting the same correction, ends in
code as escalated instead of running to its turn cap (L2, M7.8), and the
page flags such runs (X6). While the call record is on, each system
prompt says so.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Architecture.md

@@ -221,6 +221,10 @@ again after a restart), permissions (L3), and work in progress as intents (L8).
   next tool boundary, unmounts elevated credentials, and asks what next.
 - **`abandon` ends a work item** from any waiting point, closing its record and
   any open PRs with a note and aborting its unresolved intents.
+- **A run going in circles ends** rather than running to its turn cap: turns that
+  repeat near-identically, or one correction (such as "reply with a tool call")
+  given again and again, end it in code, escalated with what it was doing. A loop
+  the model can't leave is the harness's to fix, not the model's to push through.
 - **Every action passes through the three layers** (P4).
 
 ### L3. Authority: scope and approvals
@@ -432,6 +436,8 @@ volume.
 - **It is never load-bearing:** nothing in the agent reads it, a failed write is
   logged and the call goes ahead, and it is deleted when the agent starts. Its
   layout never migrates; it carries its version for the page (X6).
+- **Agents are told:** while it records, each system prompt says in one sentence
+  that the agent's calls are recorded for the operator's study.
 - **On by default, off per agent** in its configuration: an agent that handles
   other people's lives (a household's presence, conversations, cameras) records
   nothing unless they know.
@@ -1175,6 +1181,8 @@ and memory work in practice), more than for daily use.
   reasoning, and the raw JSON. Memory appears as the log records it: the index
   when it was shown, each note read or written. Work from before the agent's last
   start has its steps but no requests.
+- **Loops are flagged:** near-identical turns, repeated apologies, one correction
+  given again and again, so they're seen and fixed (L2).
 - **It reads, never writes:** each agent's state store and call record through a
   read-only mount, opened read-only in short transactions, and the agent's memory
   folder read-only, as SilverBullet does (L10). Each agent stays the only writer

docs/Development-Plan.md

@@ -584,9 +584,10 @@ Slices a–c are built on this box before the agent host is ready, against
 bring-up, end-to-end and benchmark runs; only d waits for M6.1.
 - **a. The call record** (L7) in `nisse-core`: written by the shared model client
   and `Driver.run`, with each message's provenance from the per-role view and
-  fitting; wired in each agent's build; deleted at start.
+  fitting; wired in each agent's build; deleted at start. Each system prompt
+  says the calls are recorded, while they are.
 - **b. The walkthrough:** an item's steps, each run's turns, and each request read
-  against the log it was made from.
+  against the log it was made from; runs going in circles flagged.
 - **c. The overview:** each agent's active, queued, parked and blocked items.
 - **d. Deployment:** its image, the read-only mounts and a Caddy route behind
   Authelia (with #166).
@@ -796,6 +797,13 @@ publishes `gitea.dongar.net/dev/nisse-review` beside `nisse-dev`, and
 **M7.7 Deployment.** *Waits for the agent host (Phase 6).* Its container on the
 agent host, Gitea account and secrets (R5).
 
+**M7.8 Runs that go in circles end** (L2). *Pre-approved.* In `Driver.run`, for
+every agent. Seen 2026-10-24 on Flash-Next: invented tool names met with the
+prose reminder turn after turn, and a no-thinking run posting the same apology
+comment about 20 times until the turn cap. Repeated near-identical turns, or the
+same correction given too often, end the run as escalated, with what it was
+doing; the limits are tuning.
+
 ### Phase 8 — `nisse-ops`
 
 **M8.1 MCP servers** (#37). Settled so far: redaction scrubs each instance's own