Returns what the most recent run over this tenant's chains found, together with
how far it reached.

plane is optional. Omit it for the aggregate across all five planes;
supply it to address exactly one. Both forms answer the same shape: the same
verdict, the same coverage fields, and a byScope[] naming exactly the planes
the verdict speaks for. The single-plane form additionally carries that chain's
full run record in lastRun.

The aggregate is decided here, and it never upgrades a verdict. One BROKEN
plane makes the aggregate BROKEN, however many intact planes sit beside it — an
aggregate that could be outvoted gets quieter the more chains a deployment has.
A plane with no run record shows on the coverage axis and never on the
verdict axis: a tenant with no PQC rows has no PQC run, and reporting that as
"not yet verified" forever is a false alarm, not a finding.

Coverage is scopesTotal of chainsKnown. chainsKnown is how many chains
this tenant actually HAS — measured against the audit tables, not the number of
planes that could exist — so a tenant with no PQC handshake rows has four chains
and reads "4 of 4" when all four are walked, never a "4 of 5" it can never close.
"3 of 4" says one existing chain has never been walked, and byScope names the
three the verdict speaks for. There is no completeness flag: the one that used to
sit here compared the answered set with itself and was therefore affirmative
unconditionally. Unlike the platform surface, this denominator is exact and
current — it is measured by the read itself — so it carries no measurement
timestamp.

Coverage is reported, not folded away. retentionTruncated is true when ANY
addressed chain's prefix was lawfully aged out under a valid SIGNED watermark,
and coverageFrom is the earliest instant from which EVERY addressed chain is
actually covered — the latest of the per-chain watermarks, because any earlier
value would claim a window some chain no longer holds.

This is history, not a verdict about now. A chain that has never been
verified answers everVerified: false with no run attached — deliberately not
INTACT, because "nobody has looked" and "we looked and it was sound" are
different facts and only one of them is assurance.

The tenant plane is read-only by design: starting a run requires a verify
scope.