docs/Architecture.md

@@ -221,6 +221,10 @@ again after a restart), permissions (L3), and work in progress as intents (L8).
   next tool boundary, unmounts elevated credentials, and asks what next.
 - **`abandon` ends a work item** from any waiting point, closing its record and
   any open PRs with a note and aborting its unresolved intents.
+- **A run going in circles ends** rather than running to its turn cap: turns that
+  repeat near-identically, or one correction (such as "reply with a tool call")
+  given again and again, end it in code, escalated with what it was doing. A loop
+  the model can't leave is the harness's to fix, not the model's to push through.
 - **Every action passes through the three layers** (P4).
 
 ### L3. Authority: scope and approvals
@@ -432,6 +436,8 @@ volume.
 - **It is never load-bearing:** nothing in the agent reads it, a failed write is
   logged and the call goes ahead, and it is deleted when the agent starts. Its
   layout never migrates; it carries its version for the page (X6).
+- **Agents are told:** while it records, each system prompt says in one sentence
+  that the agent's calls are recorded for the operator's study.
 - **On by default, off per agent** in its configuration: an agent that handles
   other people's lives (a household's presence, conversations, cameras) records
   nothing unless they know.
@@ -1175,6 +1181,8 @@ and memory work in practice), more than for daily use.
   reasoning, and the raw JSON. Memory appears as the log records it: the index
   when it was shown, each note read or written. Work from before the agent's last
   start has its steps but no requests.
+- **Loops are flagged:** near-identical turns, repeated apologies, one correction
+  given again and again, so they're seen and fixed (L2).
 - **It reads, never writes:** each agent's state store and call record through a
   read-only mount, opened read-only in short transactions, and the agent's memory
   folder read-only, as SilverBullet does (L10). Each agent stays the only writer

docs/Development-Plan.md

@@ -584,9 +584,10 @@ Slices a–c are built on this box before the agent host is ready, against
 bring-up, end-to-end and benchmark runs; only d waits for M6.1.
 - **a. The call record** (L7) in `nisse-core`: written by the shared model client
   and `Driver.run`, with each message's provenance from the per-role view and
-  fitting; wired in each agent's build; deleted at start.
+  fitting; wired in each agent's build; deleted at start. Each system prompt
+  says the calls are recorded, while they are.
 - **b. The walkthrough:** an item's steps, each run's turns, and each request read
-  against the log it was made from.
+  against the log it was made from; runs going in circles flagged.
 - **c. The overview:** each agent's active, queued, parked and blocked items.
 - **d. Deployment:** its image, the read-only mounts and a Caddy route behind
   Authelia (with #166).
@@ -796,6 +797,13 @@ publishes `gitea.dongar.net/dev/nisse-review` beside `nisse-dev`, and
 **M7.7 Deployment.** *Waits for the agent host (Phase 6).* Its container on the
 agent host, Gitea account and secrets (R5).
 
+**M7.8 Runs that go in circles end** (L2). *Pre-approved.* In `Driver.run`, for
+every agent. Seen 2026-10-24 on Flash-Next: invented tool names met with the
+prose reminder turn after turn, and a no-thinking run posting the same apology
+comment about 20 times until the turn cap. Repeated near-identical turns, or the
+same correction given too often, end the run as escalated, with what it was
+doing; the limits are tuning.
+
 ### Phase 8 — `nisse-ops`
 
 **M8.1 MCP servers** (#37). Settled so far: redaction scrubs each instance's own