Function singleSubjectRequirementRefused

Evaluate a declared singleSubject requirement — resolves true when it REFUSES the start: an in-flight instance (no completedAt) of THIS definition already holds the prospective subject. The subject resolves from the $fields map's subject entry (a GDR envelope, .id the identity), falling back to scope.subject. No subject in hand means nothing to compare — the requirement passes; a pre-flight surface reports the unbound subject entry as provisional through unboundRequirementReads. The rule is count-shaped, so an absent scope.fetchDataset THROWS like a dataset-reading GROQ requirement — an empty * would pass vacuously. One evaluator serves every moment: the startInstance gate enforces it (StartNotAllowedError), the evaluateStart verb pre-flights it, and start surfaces evaluate it directly for their controls — every site gated by hasSingleSubjectRequirement, so only a rule this engine knows arrives here (an absent or unsupported rule is the caller's contract violation). Advisory under races like every engine-side check.