@@ -89,6 +89,7 @@ pnpm --filter @objectstack/scenarios run-scenarios                       # every
 pnpm --filter @objectstack/scenarios run-scenarios --only service_desk --modes scratch
 pnpm --filter @objectstack/scenarios run-scenarios --record /tmp/rec.json  # also save every turn
 pnpm --filter @objectstack/scenarios run-scenarios --driver recorded:/tmp/rec.json  # replay, no model
+pnpm --filter @objectstack/scenarios run-scenarios --author-timeout 90       # minutes per authoring turn (default 60)
 ```
 
 Per card and mode the runner writes `docs/qa/platform-checklist/runs/<date>-scenario-<card>.json`
@@ -99,9 +100,24 @@ Per card and mode the runner writes `docs/qa/platform-checklist/runs/<date>-scen
 | `scratch` | `create-objectstack` → the agent builds from the card prompt and the runner's data contract (`prompts.ts`) → `objectstack validate` / `build` / `verify` (proofs chosen from the tags) → score → `objectstack dev --fresh` → seed, one user + permission-set grant + API key per persona → every question as every persona it names and every operation as its persona, over the app's MCP → the iterate change → rebuild, re-score, re-run |
 | `template` | a blank host project (`host<code>`) → boot → install the card's verified build **unmanaged** (`/api/v1/marketplace/install-local`, `installMode: 'unmanaged'`) → the agent applies the iterate change to the installed copy → score → seed → Run. A refused install is a finding in the record |
 
-- **Driver** (`driver.ts`): the local `claude` CLI on your own login (`claude -p --output-format stream-json`). It
-  refuses to start when `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` is set or the CLI is logged in with an API key
-  (the cost ruling on cloud#3600), and the record states the driver and login. `RecordedDriver` replays a recording.
+- **Driver** (`driver.ts`): the local `claude` CLI on your own login (`claude -p --output-format stream-json`, the
+  prompt written to its stdin: a build prompt carries the whole seed, and one argv string over 128 KiB makes `spawn`
+  fail with `E2BIG` on Linux). It refuses to start when `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN` is set or the CLI
+  is logged in with an API key (the cost ruling on cloud#3600), and the record states the driver, the login and the
+  authoring timeout. Every turn records its process: elapsed time, and for a turn that did not finish its exit code or
+  signal, whether the runner's timeout killed it, and the end of its stderr. `RecordedDriver` replays a recording.
+- **A build that did not finish is not measured** (`orchestrate.ts`): an authoring turn the timeout killed
+  (`--author-timeout`, build and iterate alike) leaves its Build half **not measured: author timed out after N min**;
+  one that ended with no result line or an error result (`error_max_turns`, `is_error`), or never ran, leaves it **not
+  measured: author turn failed: …**. Never a degraded score, and nothing runs on it: no score, seed, Run or iterate. The
+  scorecard's author rows show every authoring turn's `resultSubtype` and elapsed time.
+- **Seed** (`seed.ts`): rows go in as the admin, a lookup's target before its referrer. Where the card's declared
+  lookups lead back to where they start — `department.manager → employee` with `employee.department → department`, or a
+  self-lookup naming a later row — the seed loads in two passes: every row first with each lookup naming a row not in
+  yet left out, then one update per row sets those (`seed.secondPass` in the record). The side that waits is one the
+  build left optional; a build that makes every side of a cycle `required` cannot be seeded, which the data contract
+  states and the scorecard reports as a Build finding naming the cycle (the seed is still sent, so the record holds
+  the app's own refusals).
 - **Observation** (`observe.ts`): the write grader is fed what the runner reads itself: the agent's write calls and
   the door's answer (a coded refusal), the object's rows before and after the turn, and the audit trail's actor. A turn
   that wrote nothing because the object refused the read it needed first (a persona that may not read it) grades as
 
@@ -18,6 +18,10 @@
  *                      set reads `PERMISSION_DENIED` on every app object
  *   a seed row         POST /api/v1/data/:object with the card's own `id` (accepted
  *                      verbatim, so a lookup value in the seed names the real row)
+ *   a waiting lookup   PATCH /api/v1/data/:object/:id with the bare field patch (the
+ *                      seed's second pass, `seedApp` in `orchestrate.ts`; read from the
+ *                      route's source, `packages/rest/src/crud-routes.ts`, not yet
+ *                      measured live)
  *   rows               GET  /api/v1/data/:object?limit=…
  *   the audit actor    GET  /api/v1/data/sys_audit_log?record_id=… (`user_id`)
  *   unmanaged install  POST /api/v1/marketplace/install-local { packageId, manifest,
@@ -119,6 +123,8 @@ export interface AppHarness {
   /** An API key for the admin, for the questions no persona is named on. */
   adminApiKey(): Promise<string>;
   insertRow(object: string, row: Record<string, unknown>): Promise<HttpAnswer>;
+  /** Set fields on a row already in (the seed's second pass: the lookups that close a reference cycle). */
+  updateRow(object: string, id: string, patch: Record<string, unknown>): Promise<HttpAnswer>;
   listRows(object: string): Promise<HttpAnswer & { rows: Array<Record<string, unknown>> }>;
   /** The `user_id` the newest audit row for this record names; `null` when none names one. */
   auditActorUserId(object: string, recordId: string): Promise<string | null>;
@@ -262,6 +268,10 @@ export class HttpApp implements AppHarness {
     return this.call('POST', `/api/v1/data/${encodeURIComponent(object)}`, row, { session: this.admin });
   }
 
+  updateRow(object: string, id: string, patch: Record<string, unknown>): Promise<HttpAnswer> {
+    return this.call('PATCH', `/api/v1/data/${encodeURIComponent(object)}/${encodeURIComponent(id)}`, patch, { session: this.admin });
+  }
+
   async listRows(object: string): Promise<HttpAnswer & { rows: Array<Record<string, unknown>> }> {
     const r = await this.call('GET', `/api/v1/data/${encodeURIComponent(object)}?limit=1000`, undefined, { session: this.admin });
     const records = (r.body as { records?: unknown } | null)?.records;
 
@@ -10,6 +10,9 @@
  *   --driver claude      the local Claude Code CLI on your own login (default)
  *   --driver recorded:F  replay the recording F (no model, no network to a model)
  *   --record F           also save every live turn to F, for later replay
+ *   --author-timeout MIN the live driver's budget per authoring turn, build and
+ *                        iterate alike (default 60); a turn it kills leaves its
+ *                        Build half not measured
  *   --template F         a verified build (dist/objectstack.json) for template mode
  *   --no-iterate-run     skip the Run half after the iterate (scratch mode)
  *   --out DIR            where records go (default docs/qa/platform-checklist/runs, git-ignored)
@@ -29,7 +32,7 @@ import { fileURLToPath } from 'node:url';
 import { formatRefusal, loadScenarios, readCapabilityAreas } from '../loader.js';
 import { HttpApp } from './app.js';
 import { ClaudeCodeDriver, RecordedDriver, RecordingDriver, type AgentDriver } from './driver.js';
-import { runCard, type ProjectOps } from './orchestrate.js';
+import { minutesText, runCard, type ProjectOps } from './orchestrate.js';
 import { bootDev, os, readArtifact, readNamespace, scaffold } from './project.js';
 import { cardScorecard, renderScorecard, runRecord } from './scorecard.js';
 
@@ -54,6 +57,8 @@ export interface CliArgs {
   record?: string;
   template?: string;
   iterateRun: boolean;
+  /** Minutes per authoring turn (`--author-timeout`); the driver's default when absent. */
+  authorTimeoutMin?: number;
   out?: string;
   work?: string;
   createVersion?: string;
@@ -78,6 +83,12 @@ export function parseArgs(argv: readonly string[]): CliArgs {
     else if (flag === '--record') a.record = val();
     else if (flag === '--template') a.template = val();
     else if (flag === '--no-iterate-run') a.iterateRun = false;
+    else if (flag === '--author-timeout') {
+      const raw = val();
+      const min = Number(raw);
+      if (!Number.isFinite(min) || min <= 0) throw new Error(`--author-timeout takes a number of minutes above 0, not \`${raw}\``);
+      a.authorTimeoutMin = min;
+    }
     else if (flag === '--out') a.out = val();
     else if (flag === '--work') a.work = val();
     else if (flag === '--create-version') a.createVersion = val();
@@ -86,9 +97,12 @@ export function parseArgs(argv: readonly string[]): CliArgs {
   return a;
 }
 
-export function makeDriver(spec: string): AgentDriver {
-  if (spec === 'claude') return new ClaudeCodeDriver();
-  if (spec.startsWith('recorded:')) return RecordedDriver.fromFile(spec.slice('recorded:'.length));
+export function makeDriver(spec: string, opts: { authorTimeoutMin?: number } = {}): AgentDriver {
+  if (spec === 'claude') return new ClaudeCodeDriver(opts.authorTimeoutMin !== undefined ? { authorTimeoutMs: opts.authorTimeoutMin * 60_000 } : {});
+  if (spec.startsWith('recorded:')) {
+    if (opts.authorTimeoutMin !== undefined) throw new Error('--author-timeout applies to the live driver only: a replay re-reads each turn as it was recorded');
+    return RecordedDriver.fromFile(spec.slice('recorded:'.length));
+  }
   throw new Error(`unknown driver \`${spec}\` (claude, recorded:FILE)`);
 }
 
@@ -110,10 +124,13 @@ export async function main(argv: readonly string[]): Promise<number> {
     return 2;
   }
 
-  const live = makeDriver(args.driver);
+  const live = makeDriver(args.driver, args.authorTimeoutMin !== undefined ? { authorTimeoutMin: args.authorTimeoutMin } : {});
   const driver = args.record ? new RecordingDriver(live) : live;
   const info = driver.info();
-  console.log(`driver: ${info.driver} ${info.version ?? ''} · login: ${info.authMethod ?? 'n/a'} · API-billed: no`);
+  console.log(
+    `driver: ${info.driver} ${info.version ?? ''} · login: ${info.authMethod ?? 'n/a'} · API-billed: no` +
+      (info.authorTimeoutMs !== undefined ? ` · author timeout: ${minutesText(info.authorTimeoutMs)}` : ''),
+  );
 
   const ops: ProjectOps = {
     scaffold: (name, under) => {
 
@@ -9,10 +9,11 @@
  * exactly two drivers, and neither calls a model API itself:
  *
  *   - {@link ClaudeCodeDriver} spawns the `claude` CLI in headless mode
- *     (`claude -p … --output-format stream-json`). It REFUSES to start when the
- *     process would bill an API key — `ANTHROPIC_API_KEY` / `ANTHROPIC_AUTH_TOKEN`
- *     in the environment, or a CLI whose `auth status` reports an API-key login —
- *     and strips both variables from every child it spawns.
+ *     (`claude -p --output-format stream-json`, the prompt on stdin). It REFUSES
+ *     to start when the process would bill an API key — `ANTHROPIC_API_KEY` /
+ *     `ANTHROPIC_AUTH_TOKEN` in the environment, or a CLI whose `auth status`
+ *     reports an API-key login — and strips both variables from every child it
+ *     spawns.
  *   - {@link RecordedDriver} replays turns recorded earlier, so the runner's
  *     own tests (and a re-grade of an old run) need no model and no network.
  *
@@ -25,7 +26,7 @@ import { mkdtempSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSyn
 import { tmpdir } from 'node:os';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 
-import { parseStreamJson, type ParsedTurn } from './transcript.js';
+import { parseStreamJson, type ParsedTurn, type TurnProcess } from './transcript.js';
 
 /** Which run step a turn belongs to; the replay key is built from it. */
 export interface StepRef {
@@ -68,6 +69,8 @@ export interface DriverInfo {
   authMethod?: string;
   /** Always `false`: no driver here bills an API key; the record states it. */
   apiBilled: false;
+  /** The live driver's wall-clock budget per authoring turn (build and iterate), ms. */
+  authorTimeoutMs?: number;
 }
 
 export interface AgentDriver {
@@ -111,41 +114,104 @@ export function assertSubscriptionLogin(env: NodeJS.ProcessEnv, authStatus: unkn
   return method;
 }
 
+/**
+ * The authoring budget a run gets unless `--author-timeout` says otherwise:
+ * sized for a mid-tier (`starter`) card, whose 7–8-object builds ran well past
+ * a quarter of an hour.
+ */
+export const DEFAULT_AUTHOR_TIMEOUT_MIN = 60;
+
 export interface ClaudeCodeDriverOptions {
   /** The CLI binary; default `claude`. */
   bin?: string;
   /** Agentic turns allowed for one question or operation; default 12. */
   maxTurnsAsk?: number;
   /** Agentic turns allowed for one authoring task; default 80. */
   maxTurnsAuthor?: number;
-  /** Wall-clock budget per call, ms; default 15 min for authoring, 5 min for a question. */
+  /** Wall-clock budget per authoring turn (build and iterate), ms; default {@link DEFAULT_AUTHOR_TIMEOUT_MIN}. */
   authorTimeoutMs?: number;
+  /** Wall-clock budget per question or operation, ms; default 5 min. */
   askTimeoutMs?: number;
   /** Optional model alias passed as `--model` (the login's default otherwise). */
   model?: string;
 }
 
 interface CliRun {
   stdout: string;
-  stderr: string;
-  exit: number | null;
+  process: TurnProcess;
 }
 
-function runCli(bin: string, args: string[], cwd: string, timeoutMs: number): Promise<CliRun> {
+const STDERR_TAIL = 2000;
+
+/**
+ * One CLI process, the prompt written to its stdin. The prompt never travels
+ * on argv: a build prompt carries the card's whole seed, and on Linux one
+ * argument longer than 128 KiB (`MAX_ARG_STRLEN`) makes `spawn` throw `E2BIG`
+ * before the CLI starts — the two largest cards' build prompts are past it.
+ *
+ * Never rejects: a process that could not start, was killed by the timeout or
+ * exited without a result is answered with what was seen of it, so the turn
+ * it belongs to is recorded rather than lost.
+ */
+function runCli(bin: string, args: string[], cwd: string, input: string, timeoutMs: number): Promise<CliRun> {
   return new Promise((resolvePromise) => {
-    const child = spawn(bin, args, { cwd, env: subscriptionOnlyEnv(), stdio: ['ignore', 'pipe', 'pipe'] });
+    const started = Date.now();
     let stdout = '';
     let stderr = '';
-    child.stdout.on('data', (d: Buffer) => (stdout += d.toString()));
-    child.stderr.on('data', (d: Buffer) => (stderr += d.toString()));
-    const timer = setTimeout(() => child.kill('SIGTERM'), timeoutMs);
-    child.on('close', (exit) => {
-      clearTimeout(timer);
-      resolvePromise({ stdout, stderr, exit });
+    let timedOut = false;
+    let error: string | undefined;
+    let settled = false;
+    let timer: NodeJS.Timeout | undefined;
+    const settle = (exit: number | null, signal: NodeJS.Signals | null) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      const tail = stderr.trim().slice(-STDERR_TAIL);
+      resolvePromise({
+        stdout,
+        process: {
+          elapsedMs: Date.now() - started,
+          exit,
+          ...(signal ? { signal } : {}),
+          timedOut,
+          timeoutMs,
+          ...(tail ? { stderrTail: tail } : {}),
+          ...(error ? { error } : {}),
+        },
+      });
+    };
+    let child: ReturnType<typeof spawn>;
+    try {
+      child = spawn(bin, args, { cwd, env: subscriptionOnlyEnv(), stdio: ['pipe', 'pipe', 'pipe'] });
+    } catch (e) {
+      error = e instanceof Error ? e.message : String(e); // `spawn E2BIG` and its kin throw here
+      settle(null, null);
+      return;
+    }
+    child.stdout!.on('data', (d: Buffer) => (stdout += d.toString()));
+    child.stderr!.on('data', (d: Buffer) => (stderr += d.toString()));
+    child.on('error', (e) => {
+      error ??= e.message; // `spawn ENOENT`: no `close` may follow
+      if (child.pid === undefined) settle(null, null);
     });
+    child.stdin!.on('error', (e) => (error ??= e.message)); // EPIPE: the CLI exited before reading its prompt
+    child.stdin!.end(input);
+    timer = setTimeout(() => {
+      timedOut = true;
+      child.kill('SIGTERM');
+    }, timeoutMs);
+    child.on('close', (exit, signal) => settle(exit, signal));
   });
 }
 
+/**
+ * `no-result(exit 143)`, `no-result(signal SIGTERM)`, `no-result(spawn E2BIG)`:
+ * a turn that printed no result line, by how its process ended — or, when no
+ * process ever ran, why.
+ */
+const noResult = (p: TurnProcess): string =>
+  `no-result(${p.exit !== null ? `exit ${p.exit}` : p.signal ? `signal ${p.signal}` : (p.error ?? 'no exit code, no signal')})`;
+
 /** Every file under `dir` (skipping dependency and build trees) → content, for the author recording. */
 export function snapshotSources(dir: string): Record<string, string> {
   const out: Record<string, string> = {};
@@ -196,8 +262,12 @@ export class ClaudeCodeDriver implements AgentDriver {
     this.authMethod = assertSubscriptionLogin(process.env, parsed);
   }
 
+  private get authorTimeoutMs(): number {
+    return this.opts.authorTimeoutMs ?? DEFAULT_AUTHOR_TIMEOUT_MIN * 60_000;
+  }
+
   info(): DriverInfo {
-    return { driver: 'claude-code-cli', version: this.version, authMethod: this.authMethod, apiBilled: false };
+    return { driver: 'claude-code-cli', version: this.version, authMethod: this.authMethod, apiBilled: false, authorTimeoutMs: this.authorTimeoutMs };
   }
 
   private base(maxTurns: number): string[] {
@@ -211,15 +281,16 @@ export class ClaudeCodeDriver implements AgentDriver {
     writeFileSync(empty, JSON.stringify({ mcpServers: {} }));
     try {
       const args = [
-        '-p', task.prompt,
+        '-p',
         ...this.base(this.opts.maxTurnsAuthor ?? 80),
         '--mcp-config', empty, '--strict-mcp-config',
         '--permission-mode', 'acceptEdits',
         '--allowedTools', 'Bash', 'Read', 'Edit', 'Write', 'Glob', 'Grep', 'Skill',
       ];
-      const run = await runCli(this.bin, args, task.cwd, this.opts.authorTimeoutMs ?? 15 * 60_000);
+      const run = await runCli(this.bin, args, task.cwd, task.prompt, this.authorTimeoutMs);
       const turn = parseStreamJson(run.stdout);
-      if (turn.meta.resultSubtype === undefined) turn.meta.resultSubtype = `no-result(exit ${run.exit})`;
+      turn.meta.process = run.process;
+      if (turn.meta.resultSubtype === undefined) turn.meta.resultSubtype = noResult(run.process);
       return { turn, files: snapshotSources(task.cwd) };
     } finally {
       rmSync(dirname(empty), { recursive: true, force: true });
@@ -237,10 +308,11 @@ export class ClaudeCodeDriver implements AgentDriver {
       { mode: 0o600 },
     );
     try {
-      const args = ['-p', task.prompt, ...this.base(this.opts.maxTurnsAsk ?? 12), '--mcp-config', cfg, '--strict-mcp-config', '--allowedTools', 'mcp__app'];
-      const run = await runCli(this.bin, args, dir, this.opts.askTimeoutMs ?? 5 * 60_000);
+      const args = ['-p', ...this.base(this.opts.maxTurnsAsk ?? 12), '--mcp-config', cfg, '--strict-mcp-config', '--allowedTools', 'mcp__app'];
+      const run = await runCli(this.bin, args, dir, task.prompt, this.opts.askTimeoutMs ?? 5 * 60_000);
       const turn = parseStreamJson(run.stdout);
-      if (turn.meta.resultSubtype === undefined) turn.meta.resultSubtype = `no-result(exit ${run.exit})`;
+      turn.meta.process = run.process;
+      if (turn.meta.resultSubtype === undefined) turn.meta.resultSubtype = noResult(run.process);
       return turn;
     } finally {
       rmSync(dir, { recursive: true, force: true });
 
@@ -15,4 +15,5 @@ export * from './orchestrate.js';
 export * from './project.js';
 export * from './prompts.js';
 export * from './scorecard.js';
+export * from './seed.js';
 export * from './transcript.js';