bare-agent 0.23.0 → 0.25.0

package/README.md

@@ -94,7 +94,7 @@ Every piece works alone — take what you need, ignore the rest. Two axes: **Act
 
 ### Recurse — break a hard task into a tree *(the RLM primitive)*
 
-`recurse(task, ctx, opts)` does **decompose → fan-out → verify → synthesize** in one call — Recursive Language Models as a single import, composed *around* the Loop (never a new engine). The default is **model-driven**: the worker is handed a `spawn_child` tool and decides whether to split, bounded by depth + bareguard (no second guard layer). Forced fan-out (`count` / `mode:'fanout'`) and data-driven width (`mode:'partition'`, measured from a corpus) are opt-in. Give workers a stance with `opts.persona` (prepended to every worker, carries down the tree, deliberately kept out of the isolated verifier), and tell them *where they are* with `opts.context` (a read-only paths/cwd blob threaded to every worker so a sliced child can locate its artifact — facts, not a stance). For a leaf that should self-correct, pass `opts.refineLeaf` (opt-in): a definite leaf becomes a bounded generate→sense→regenerate loop driven by *your* deterministic sensor (test/compile/lint), feeding the gap back with escalating temperature. The headline guarantee: **aggregation is code, never a model-stated number**, and a dead worker or exhausted guard returns an honest `{ incomplete, missingSlices }` — never a faked pass.
+`recurse(task, ctx, opts)` does **decompose → fan-out → verify → synthesize** in one call — Recursive Language Models as a single import, composed *around* the Loop (never a new engine). The default is **model-driven**: the worker is handed a `spawn_child` tool and decides whether to split, bounded by depth + bareguard (no second guard layer). Forced fan-out (`count` / `mode:'fanout'`) and data-driven width (`mode:'partition'`, measured from a corpus) are opt-in. Give workers a stance with `opts.persona` (prepended to every worker, carries down the tree, deliberately kept out of the isolated verifier), and tell them *where they are* with `opts.context` (a read-only paths/cwd blob threaded to every worker so a sliced child can locate its artifact — facts, not a stance). For a leaf that should self-correct, pass `opts.refineLeaf` (opt-in): a definite leaf becomes a bounded generate→sense→regenerate loop driven by *your* deterministic sensor (test/compile/lint), feeding the gap back (with escalating temperature on models that accept it; on a temperature-fixed model like `claude-sonnet-5` the gap critique carries recovery, and the receipt records the effective temps). The headline guarantee: **aggregation is code, never a model-stated number**, and a dead worker or exhausted guard returns an honest `{ incomplete, missingSlices }` — never a faked pass.
 
 Over a corpus, context reaches a worker as a **handle routed by question shape** (`opts.retrieval`):
 
@@ -119,9 +119,9 @@ console.log(result.count, result.matchedIds);   // a code-derived count + the id
 
 > **⚠️ Cost is open by design — wire a cap.** `recurse()` adds no intrinsic total-work limit. On the model-driven default a node can spawn up to ~100 children per level, each recursing to `maxDepth` (default 3), so **token / $ spend compounds and is bounded only by your gate** — not by recurse. Run it **with bareguard** (`ctx.policy`, which enforces depth/budget/call caps) **or with some token/USD cap** for any non-trivial or untrusted task; ungoverned, a weak model that over-decomposes *will* burn tokens. For a hard local brake without a gate, set `maxDepth: 1` (flat, no nesting). The forced modes (`mode:'fanout'` / `'partition'`) are bounded by a deterministic count + concurrency cap; the open path is the model-driven default.
 
-**Govern — one gate over both axes.** `wireGate(gate)` routes every LLM + tool call through one bareguard policy + audit + budget. Denied tools never reach the model; halts (turn / budget / content caps) exit cleanly. `require('bare-agent/bareguard')`
+**Govern — one gate over both axes.** `wireGate(gate)` routes every LLM + tool call through one bareguard policy + audit + budget. Denied tools never reach the model; halts (turn / budget / content caps) exit cleanly. A plain deny stays advisory (the model can pivot to an allowed tool), but the Loop short-circuits a *spin* — `maxConsecutiveDenials` consecutive denials of the same action (default 3) stop the run with `error:'denied:<tool>'` instead of burning the budget to the cap; under `recurse` that surfaces as `{ incomplete, blocker:'governance-deny' }`. `require('bare-agent/bareguard')`
 
-**Providers:** OpenAI-compatible (OpenAI, OpenRouter, Groq, vLLM, LM Studio), Anthropic, Gemini (native), Ollama, CLIPipe, Fallback — or bring your own (one `generate` method). All return the same shape; swap freely. Usage including prompt-cache tiers is normalized, so `result.metrics` reports honest cumulative tokens + cost — and `null`, never a silent `0`, for a model it couldn't price.
+**Providers:** OpenAI-compatible (OpenAI, OpenRouter, Groq, vLLM, LM Studio), Anthropic, Gemini (native), Ollama, CLIPipe, Fallback — or bring your own (one `generate` method). All return the same shape; swap freely. Usage including prompt-cache tiers is normalized, so `result.metrics` reports honest cumulative tokens + cost — and `null`, never a silent `0`, for a model it couldn't price. A model that rejects a non-default `temperature` (e.g. `claude-sonnet-5`, OpenAI o1/gpt-5-class return a `400`) is handled gracefully — the provider drops the param and retries once rather than failing the call, surfacing `temperatureDropped` so a caller can report the effective value.
 
 **Tools:** Any function is a tool — REST, MCP, CLI, shell. Built-in web + mobile (optional).
 

package/bareagent.context.md

@@ -1,7 +1,7 @@
 # bareagent — Integration Guide
 
 > For AI assistants and developers wiring bareagent into a project.
-> v0.23.0 | Node.js >= 18 | zero required deps (`bareguard ^0.9.0` optional peer for governance) | Apache 2.0
+> v0.25.0 | Node.js >= 18 | zero required deps (`bareguard ^0.9.0` optional peer for governance) | Apache 2.0
 >
 > Full human guide with composition examples, design philosophy, and recipes: [Usage Guide](docs/02-features/usage-guide.md)
 
@@ -379,6 +379,8 @@ if (result.error?.startsWith('halt:')) {
 
 Halt-severity decisions exit the loop cleanly via a typed `HaltError` — full mechanics (sealed `msgs`, `halt:<rule>` error token, `loop:done{halted:true}` event, `throwOnError:true` interaction, `halt:unknown` coalesce) are in the **Halt decisions throw `HaltError`** paragraph below. Short version: check `result.error?.startsWith('halt:')` after the run.
 
+**Deny-spin short-circuit (`maxConsecutiveDenials`, default 3, v0.25+).** A *non-halt* deny (a `policy` verdict that isn't `true` — e.g. a `humanChannel: deny`, an allowlist miss, a `content`/`fs.writeScope` block) is **advisory**: it's fed back to the model as a tool result so the model can pivot to a different allowed tool. But a model that keeps retrying the *same* denied action would otherwise spin every round until your `budget.maxCostUsd` finally halts it — burning the whole cap with no progress (this bit a coding agent whose write kept tripping `content.askPatterns`). The Loop now counts **consecutive** denials (any allowed call resets the streak, preserving the pivot) and short-circuits at `maxConsecutiveDenials` with `result.error === 'denied:<tool>'` (a clean return, transcript sealed — never a throw). Check `result.error?.startsWith('denied:')` to distinguish a governance block from a completed run; set `maxConsecutiveDenials: 0` (or `Infinity`) on `new Loop({...})` to restore the pure-advisory behavior. Under `recurse`, a short-circuited worker returns a **labeled** `{ incomplete: true, blocker: 'governance-deny' }` (and `receipts.blocker`) so you can widen scope / re-gate / escalate rather than read it as a model failure.
+
 Legacy `wrapTool` / `wrapTools` are retained as deprecation shims (one-shot console warning, removal in 1.0). Migration: replace `wrapTools(tools)` at `loop.run()` with `filterTools(tools)` once upfront + `onLlmResult` / `onToolResult` on `new Loop({...})` to pick up LLM-cost recording and `_ctx` threading.
 
 **`actionTranslator` for bash/fs primitive activation (v0.10.1+).** Bareguard's `bashCheck` / `fsCheck` / `netCheck` only fire when `action.type === 'bash'` / `'read'` / `'write'` / `'fetch'`. The default action shape is `{type: toolName, args, _ctx}` which matches `tools.denylist` / `tools.allowlist` but does NOT activate those primitives. Adopters who want both pass `wireGate(gate, { actionTranslator })`. Since bareguard 0.4.1+, the primitives read fields from either flat (`action.cmd`) or nested (`action.args.cmd` / `.command`) shapes, so you can pass args through verbatim:
@@ -673,7 +675,7 @@ const out = await recurse('Audit auth.js, billing.js, gateway.js for authz bugs'
 
 **Worker context (`opts.context`, v0.23.0):** a read-only working-context string (paths/cwd) PREPENDED to every worker's TASK message as a `Working context:` block — so a sliced child can **locate its artifact** (the Planner paraphrases the goal into subtasks and drops absolute paths; without this, workers guess `.`/`~`/`/tmp` and get denied). Forwarded to the Planner as `info` (path-aware slices) and shown to the verifier too (neutral FACTS, not a stance — distinct from `persona`, which is a privileged SYSTEM-prompt stance). Carries down the tree. **Security:** it still becomes part of the prompt, so pass caller-trusted run-state only, never untrusted/end-user text (lower-privilege than `persona` — user message, not system — but still an injection surface). Absent ⇒ the task message is unchanged.
 
-**Leaf self-correction (`opts.refineLeaf`, v0.23.0, opt-in):** turn a **definite leaf** (a node offered no `spawn_child` — `simple` tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass: `{ sensor, maxIterations?, temperatures? }`. `sensor(result, { task, context, contract }) → Verdict` is YOUR **deterministic** close (test/compile/lint — not a model judge); on a non-pass its `critique` (the gap, not the transcript) is fed FRESH into the next attempt and the **retry temperature ESCALATES** (default `[0.2, 0.7, 1.0]` — load-bearing: a weak model at a flat temperature regenerates identical wrong code and ignores even crisp feedback). Each attempt is gate-checked + metered; a HaltError mid-loop → clean `{ incomplete }`; honest non-recovery → `receipts.refineLeaf.passed === false` (never a faked pass); `receipts.tokens` sums all attempts. The error-keyed `recall` stays YOUR tool (`opts.tools`), keyed off the fed-back critique — bareagent stays litectx-agnostic. Carries down (engages at the leaves). Absent ⇒ a leaf is a single pass.
+**Leaf self-correction (`opts.refineLeaf`, v0.23.0, opt-in):** turn a **definite leaf** (a node offered no `spawn_child` — `simple` tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass: `{ sensor, maxIterations?, temperatures? }`. `sensor(result, { task, context, contract }) → Verdict` is YOUR **deterministic** close (test/compile/lint — not a model judge); on a non-pass its `critique` (the gap, not the transcript) is fed FRESH into the next attempt and — **on models that accept `temperature`** — the **retry temperature ESCALATES** (default `[0.2, 0.7, 1.0]` — load-bearing there: a weak model at a flat temperature regenerates identical wrong code and ignores even crisp feedback). On a **temperature-fixed model** (e.g. `claude-sonnet-5`, which 400s any non-default temperature) the provider silently drops the param (see below), the escalation lever is inert, and the fed-back gap critique carries recovery alone; `receipts.refineLeaf.temperatures` then records the EFFECTIVE temps — a `null` marks an attempt that ran at the model's default (never the ignored requested value). Each attempt is gate-checked + metered; a HaltError mid-loop → clean `{ incomplete }`; honest non-recovery → `receipts.refineLeaf.passed === false` (never a faked pass); `receipts.tokens` sums all attempts. The error-keyed `recall` stays YOUR tool (`opts.tools`), keyed off the fed-back critique — bareagent stays litectx-agnostic. Carries down (engages at the leaves). Absent ⇒ a leaf is a single pass.
 
 ```javascript
 const out = await recurse('Fix the failing function in calc.js', ctx, {
@@ -741,6 +743,8 @@ new CLIPipe({ command: 'ollama', args: ['run', 'llama3.2'] })
 
 All return `{ text, toolCalls, usage: { inputTokens, outputTokens }, model? }`. The optional `model` (v0.16.1+) is the id the response was produced by — Loop prefers it over `provider.model` for cost accounting. CLIPipe always returns `toolCalls: []` and zero usage (CLI tools don't report tokens), and omits `model`.
 
+**Temperature graceful degradation (BA-10).** Newer models reject ANY non-default `temperature` with a `400` (`claude-sonnet-5`: `` `temperature` is deprecated for this model. ``; OpenAI o1/gpt-5-class: `Unsupported value: 'temperature' … Only the default (1) …`). All four providers detect that specific 400 (message names `temperature` as unsupported/deprecated AND a temperature was sent), **drop the param, warn once per instance, and retry once** — so a call that would otherwise throw succeeds at the model's default temperature. Keyed off the API error text, not a model list. A genuine out-of-range 400 is NOT degraded (it re-throws — dropping it would mask a caller bug). When a drop happens the result carries `temperatureDropped: true` (an optional `GenerateResult`/`Loop.run` field) so a caller can report the effective temperature — `recurse`'s `refineLeaf` uses it for an honest receipt. Dormant on models that accept temperature (byte-identical to before).
+
 **Error body (v0.11.0):** on an HTTP error the OpenAI/Anthropic/Ollama providers throw a `ProviderError` whose `message` carries the upstream error string. The full parsed response is **not** attached to `err.body` by default (so an unexpected field can't leak through logs that dump the error object). Pass `{ exposeErrorBody: true }` to attach it for debugging.
 
 **Plaintext-key warning (Unreleased):** the OpenAI provider's `baseUrl` accepts `http://` (for local/OpenAI-compatible endpoints), but a `Bearer` key sent over plaintext http to a **non-loopback** host is exposed on the wire. The provider now warns once when that happens. Loopback hosts (`localhost`/`127.0.0.0/8`/`::1` — local proxies, Ollama-style endpoints) stay silent, since that's the legitimate keyless-local case. The header is **not** stripped (some local proxies want a key), so use `https` for any remote endpoint, or drop `apiKey` when the local endpoint needs none.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-agent",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "files": [
     "index.js",
     "index.d.ts",

package/src/loop.d.ts

@@ -52,6 +52,16 @@ export type LoopOptions = {
      */
     onLlmResult?: Function | undefined;
     onToolResult?: Function | undefined;
+    /**
+     * - BA-11 safety net (default 3). Short-circuit the run when
+     * `policy` denies this many tool calls IN A ROW with no allowed call in between — a governance deny is
+     * not a recoverable tool error, so a model that keeps retrying variants of a denied action would
+     * otherwise burn the budget to the cap without progress (probe-16: 16 calls, sensor never reached). Any
+     * tool call that PASSES policy resets the streak, preserving allowlist-safe pivoting (deny X → allow Y).
+     * The run returns cleanly with `error: 'denied:<tool>'` (mirrors the halt return; never throws even under
+     * throwOnError). Set `0` or `Infinity` to disable (restores pre-BA-11 advisory-deny behavior).
+     */
+    maxConsecutiveDenials?: number | undefined;
     /**
      * - Removed in v0.8; presence throws a migration error.
      */
@@ -79,6 +89,7 @@ export class Loop {
     throwOnError: boolean;
     store: import("../types").Store | null;
     policy: Function | null;
+    maxConsecutiveDenials: number;
     assemble: Function | null;
     trim: Function | null;
     onLlmResult: Function | null;
@@ -111,7 +122,7 @@ export class Loop {
      *   thunk is re-evaluated each round (D4/eval-assist F2) so a tool set that grows mid-run — e.g. a skill
      *   unlocking its tools — is offered on the next round; a static array is resolved once at wire time.
      * @param {Record<string, any>} [options={}] - Per-run overrides (system, temperature, ctx, etc.).
-     * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics}>}
+     * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics, temperatureDropped?: boolean}>}
      *   On halt the returned `error` is `halt:<rule>` (or `halt:unknown` if the
      *   thrown HaltError carried no `rule`), and `msgs` is sanitized so any
      *   dangling assistant `tool_calls` from the halted round are paired with
@@ -129,6 +140,7 @@ export class Loop {
         error: string | null;
         msgs: Message[];
         metrics: RunMetrics;
+        temperatureDropped?: boolean;
     }>;
     /**
      * Health check — validates provider, store, and tools without throwing.
@@ -156,7 +168,7 @@ export class Loop {
      * @param {string} text - User message.
      * @param {ToolDef[]} [tools=[]] - Tool definitions.
      * @param {Record<string, any>} [options={}] - Per-run overrides.
-     * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics}>}
+     * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics, temperatureDropped?: boolean}>}
      */
     chat(text: string, tools?: ToolDef[], options?: Record<string, any>): Promise<{
         text: string;
@@ -166,6 +178,7 @@ export class Loop {
         error: string | null;
         msgs: Message[];
         metrics: RunMetrics;
+        temperatureDropped?: boolean;
     }>;
     stop(): void;
 }
@@ -226,6 +239,13 @@ export function estimateCost(model: string | null, usage: Usage | null): number
  *   gate.record (via wireGate). `event.kind` discriminates the source: `'turn'` for a main-loop round,
  *   `'summarize'` for an out-of-band `ctx.summarize` call (R-C6). Both count against the budget.
  * @property {Function} [onToolResult]
+ * @property {number} [maxConsecutiveDenials] - BA-11 safety net (default 3). Short-circuit the run when
+ *   `policy` denies this many tool calls IN A ROW with no allowed call in between — a governance deny is
+ *   not a recoverable tool error, so a model that keeps retrying variants of a denied action would
+ *   otherwise burn the budget to the cap without progress (probe-16: 16 calls, sensor never reached). Any
+ *   tool call that PASSES policy resets the streak, preserving allowlist-safe pivoting (deny X → allow Y).
+ *   The run returns cleanly with `error: 'denied:<tool>'` (mirrors the halt return; never throws even under
+ *   throwOnError). Set `0` or `Infinity` to disable (restores pre-BA-11 advisory-deny behavior).
  * @property {number} [maxRounds] - Removed in v0.8; presence throws a migration error.
  */
 /** @type {Record<string, {in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}>} */

package/src/loop.js

@@ -49,6 +49,13 @@ const { ToolError, HaltError } = require('./errors');
  *   gate.record (via wireGate). `event.kind` discriminates the source: `'turn'` for a main-loop round,
  *   `'summarize'` for an out-of-band `ctx.summarize` call (R-C6). Both count against the budget.
  * @property {Function} [onToolResult]
+ * @property {number} [maxConsecutiveDenials] - BA-11 safety net (default 3). Short-circuit the run when
+ *   `policy` denies this many tool calls IN A ROW with no allowed call in between — a governance deny is
+ *   not a recoverable tool error, so a model that keeps retrying variants of a denied action would
+ *   otherwise burn the budget to the cap without progress (probe-16: 16 calls, sensor never reached). Any
+ *   tool call that PASSES policy resets the streak, preserving allowlist-safe pivoting (deny X → allow Y).
+ *   The run returns cleanly with `error: 'denied:<tool>'` (mirrors the halt return; never throws even under
+ *   throwOnError). Set `0` or `Infinity` to disable (restores pre-BA-11 advisory-deny behavior).
  * @property {number} [maxRounds] - Removed in v0.8; presence throws a migration error.
  */
 
@@ -212,6 +219,13 @@ class Loop {
       throw new Error('[Loop] options.policy must be a function (toolName, args, ctx) => true | string');
     }
     this.policy = options.policy || null;
+    // BA-11 deny-spin guard. Default 3; 0/Infinity/non-finite disables (restores advisory-deny behavior).
+    // Validated only if provided so an explicit 0 is honored as "off" (Infinity also disables).
+    if (options.maxConsecutiveDenials != null
+        && (typeof options.maxConsecutiveDenials !== 'number' || options.maxConsecutiveDenials < 0 || Number.isNaN(options.maxConsecutiveDenials))) {
+      throw new Error('[Loop] options.maxConsecutiveDenials must be a non-negative number (0 or Infinity disables)');
+    }
+    this.maxConsecutiveDenials = options.maxConsecutiveDenials != null ? options.maxConsecutiveDenials : 3;
     if (options.assemble != null && typeof options.assemble !== 'function') {
       throw new Error('[Loop] options.assemble must be a function (msgs, info) => msgs');
     }
@@ -294,7 +308,7 @@ class Loop {
    *   thunk is re-evaluated each round (D4/eval-assist F2) so a tool set that grows mid-run — e.g. a skill
    *   unlocking its tools — is offered on the next round; a static array is resolved once at wire time.
    * @param {Record<string, any>} [options={}] - Per-run overrides (system, temperature, ctx, etc.).
-   * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics}>}
+   * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics, temperatureDropped?: boolean}>}
    *   On halt the returned `error` is `halt:<rule>` (or `halt:unknown` if the
    *   thrown HaltError carried no `rule`), and `msgs` is sanitized so any
    *   dangling assistant `tool_calls` from the halted round are paired with
@@ -356,6 +370,13 @@ class Loop {
 
     let lastUsage = { inputTokens: 0, outputTokens: 0 };
     let totalCost = 0;
+    // BA-10: sticky across rounds — true if ANY round's `temperature` was dropped by the model (400,
+    // unsupported/deprecated) and retried without it. Surfaced on the result so an upstream receipt
+    // (recurse's refineLeaf) can report the EFFECTIVE temperature rather than the ignored request.
+    let temperatureDropped = false;
+    // BA-11: consecutive policy-deny counter (reset by any tool call that PASSES policy). When it reaches
+    // this.maxConsecutiveDenials the run short-circuits cleanly — see the deny block below.
+    let consecutiveDenials = 0;
 
     // The meter (Feature 3): bareagent is the canonical run counter. Accumulates across rounds and is
     // returned as `result.metrics`. `tokens` is CUMULATIVE over all four tiers (fixes the last-round-only
@@ -583,6 +604,7 @@ class Loop {
       }
 
       lastUsage = result.usage || lastUsage;
+      if (result.temperatureDropped) temperatureDropped = true;
       // Publish the latest measured usage to ctx (non-enumerable, fail-open) so a transcript-bound seam —
       // e.g. F2 stash auto-compaction — can read EXACT provider-counted `inputTokens` to gauge context
       // pressure on the NEXT round's trim. Symmetric with lending ctx.summarize; the Loop stays unaware of
@@ -642,7 +664,7 @@ class Loop {
           try { await flush(msgs, ctx); }
           catch (err) { if (err instanceof HaltError) throw err; this._reportError('trim-flush', err, { round }); }
         }
-        return { text: result.text, toolCalls: [], usage: lastUsage, cost: totalCost, error: null, msgs, metrics: finalizeMetrics() };
+        return { text: result.text, toolCalls: [], usage: lastUsage, cost: totalCost, error: null, msgs, metrics: finalizeMetrics(), ...(temperatureDropped && { temperatureDropped: true }) };
       }
 
       // Execute tool calls
@@ -726,10 +748,30 @@ class Loop {
               : `[Loop] Tool "${tc.name}" denied by policy`;
             msgs.push({ role: 'tool', tool_call_id: tc.id, content: reason });
             this._safeEmit({ type: 'loop:tool_result', data: { tool: tc.name, denied: true, reason } });
+            // BA-11: a governance deny is not a recoverable tool error. Count consecutive denials; when the
+            // model keeps retrying denied actions (proven live: 8 in a row before giving up) short-circuit the
+            // run rather than let it burn the budget to the cap. The streak resets on any ALLOWED tool call
+            // (below), so a legit deny-then-pivot (deny X → allow Y) never trips this. 0/Infinity disables.
+            consecutiveDenials += 1;
+            if (this.maxConsecutiveDenials > 0 && Number.isFinite(this.maxConsecutiveDenials)
+                && consecutiveDenials >= this.maxConsecutiveDenials) {
+              const denyTag = `denied:${tc.name}`;
+              // Pair any still-dangling tool_calls from this round so the returned transcript stays
+              // provider-valid (same seal the halt path uses), then exit cleanly — no throw even under
+              // throwOnError, mirroring the governance-halt contract.
+              sealDanglingToolCalls(msgs, denyTag);
+              this._reportError('denied', new Error(`policy denied ${consecutiveDenials} consecutive tool calls (${tc.name})`), { rule: denyTag, denials: consecutiveDenials });
+              this._safeEmit({ type: 'loop:done', data: { text: '', denied: true, rule: denyTag, cost: totalCost } });
+              return { text: '', toolCalls: [], usage: lastUsage, cost: totalCost, error: denyTag, msgs, metrics: finalizeMetrics() };
+            }
             continue;
           }
         }
 
+        // BA-11: reaching here means this tool call PASSED policy (or there is no policy) — progress, so the
+        // consecutive-deny streak resets. A single deny followed by an allowed call never trips the guard.
+        consecutiveDenials = 0;
+
         const toolStartedAt = Date.now();
         let toolResult;
         let toolError;
@@ -863,7 +905,7 @@ class Loop {
    * @param {string} text - User message.
    * @param {ToolDef[]} [tools=[]] - Tool definitions.
    * @param {Record<string, any>} [options={}] - Per-run overrides.
-   * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics}>}
+   * @returns {Promise<{text: string, toolCalls: ToolCall[], usage: Usage, cost: number, error: string|null, msgs: Message[], metrics: RunMetrics, temperatureDropped?: boolean}>}
    */
   async chat(text, tools = [], options = {}) {
     this._history.push({ role: 'user', content: text });

package/src/provider-anthropic.d.ts

@@ -54,6 +54,9 @@ export class AnthropicProvider {
      * @throws {Error} `[AnthropicProvider] ...` — on HTTP errors (4xx/5xx) or invalid JSON response.
      */
     generate(messages: Message[], tools?: ToolDef[], options?: Record<string, any>): Promise<GenerateResult>;
+    /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+    _warnTemperatureDropped(): void;
+    _warnedTempDropped: boolean | undefined;
     /**
      * @param {Message} msg
      * @returns {any}

package/src/provider-anthropic.js

@@ -3,6 +3,7 @@
 const https = require('https');
 const http = require('http');
 const { ProviderError } = require('./errors');
+const { requestWithTemperatureFallback } = require('./provider-temperature');
 
 /** @param {string} hostname @returns {boolean} */
 function isLoopbackHost(hostname) {
@@ -91,7 +92,15 @@ class AnthropicProvider {
       }));
     }
 
-    const data = await this._request(body);
+    // BA-10: some models (e.g. claude-sonnet-5) reject a non-default `temperature` with a 400 — drop it
+    // and retry once rather than let the whole call fail. `temperatureDropped` flows back so an upstream
+    // receipt (recurse's refineLeaf) can report the effective temperature, not the one the model ignored.
+    const { data, temperatureDropped } = await requestWithTemperatureFallback({
+      request: () => this._request(body),
+      hadTemperature: () => body.temperature != null,
+      stripTemperature: () => { delete body.temperature; },
+      warnOnce: () => this._warnTemperatureDropped(),
+    });
 
     let text = '';
     /** @type {import('../types').ToolCall[]} */
@@ -115,9 +124,17 @@ class AnthropicProvider {
         cacheReadTokens: data.usage?.cache_read_input_tokens || 0,
         cacheCreationTokens: data.usage?.cache_creation_input_tokens || 0,
       },
+      ...(temperatureDropped && { temperatureDropped: true }),
     };
   }
 
+  /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+  _warnTemperatureDropped() {
+    if (this._warnedTempDropped) return;
+    this._warnedTempDropped = true;
+    console.warn(`[AnthropicProvider] '${this.model}' rejected a non-default 'temperature' (unsupported/deprecated) — retrying without it. Further drops from this provider instance are silent.`);
+  }
+
   /**
    * @param {Message} msg
    * @returns {any}

package/src/provider-gemini.d.ts

@@ -50,6 +50,9 @@ export class GeminiProvider {
      * @throws {Error} `[GeminiProvider] ...` — on HTTP errors (4xx/5xx) or invalid JSON response.
      */
     generate(messages: Message[], tools?: ToolDef[], options?: Record<string, any>): Promise<GenerateResult>;
+    /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+    _warnTemperatureDropped(): void;
+    _warnedTempDropped: boolean | undefined;
     /**
      * Normalize Gemini `usageMetadata` to the neutral {@link Usage} shape. Like OpenAI, `promptTokenCount`
      * INCLUDES the cached tokens (`cachedContentTokenCount`), so subtract for the uncached remainder

package/src/provider-gemini.js

@@ -3,6 +3,7 @@
 const https = require('https');
 const http = require('http');
 const { ProviderError } = require('./errors');
+const { requestWithTemperatureFallback } = require('./provider-temperature');
 
 /** @typedef {import('../types').Message} Message */
 /** @typedef {import('../types').ToolDef} ToolDef */
@@ -103,7 +104,14 @@ class GeminiProvider {
     if (options.temperature != null) genConfig.temperature = options.temperature;
     if (Object.keys(genConfig).length) body.generationConfig = genConfig;
 
-    const data = await this._request(`/models/${this.model}:generateContent`, body);
+    // BA-10: graceful degrade if a model rejects a non-default `temperature` (Gemini nests it under
+    // generationConfig). Keyed off the API error text, so dormant on models that accept temperature.
+    const { data, temperatureDropped } = await requestWithTemperatureFallback({
+      request: () => this._request(`/models/${this.model}:generateContent`, body),
+      hadTemperature: () => body.generationConfig?.temperature != null,
+      stripTemperature: () => { if (body.generationConfig) delete body.generationConfig.temperature; },
+      warnOnce: () => this._warnTemperatureDropped(),
+    });
 
     let text = '';
     /** @type {ToolCall[]} */
@@ -123,9 +131,17 @@ class GeminiProvider {
       toolCalls,
       model: data.modelVersion || this.model,
       usage: this._normalizeUsage(data.usageMetadata),
+      ...(temperatureDropped && { temperatureDropped: true }),
     };
   }
 
+  /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+  _warnTemperatureDropped() {
+    if (this._warnedTempDropped) return;
+    this._warnedTempDropped = true;
+    console.warn(`[GeminiProvider] '${this.model}' rejected a non-default 'temperature' (unsupported/deprecated) — retrying without it. Further drops from this provider instance are silent.`);
+  }
+
   /**
    * Normalize Gemini `usageMetadata` to the neutral {@link Usage} shape. Like OpenAI, `promptTokenCount`
    * INCLUDES the cached tokens (`cachedContentTokenCount`), so subtract for the uncached remainder

package/src/provider-ollama.d.ts

@@ -32,6 +32,9 @@ export class OllamaProvider {
      * @throws {Error} `[OllamaProvider] ...` — on HTTP errors or invalid JSON response.
      */
     generate(messages: Message[], tools?: ToolDef[], options?: Record<string, any>): Promise<GenerateResult>;
+    /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+    _warnTemperatureDropped(): void;
+    _warnedTempDropped: boolean | undefined;
     /**
      * @param {string} path
      * @param {Record<string, any>} body

package/src/provider-ollama.js

@@ -2,6 +2,7 @@
 
 const http = require('http');
 const { ProviderError } = require('./errors');
+const { requestWithTemperatureFallback } = require('./provider-temperature');
 
 /** @typedef {import('../types').Message} Message */
 /** @typedef {import('../types').ToolDef} ToolDef */
@@ -48,7 +49,14 @@ class OllamaProvider {
       }));
     }
 
-    const data = await this._request('/api/chat', body);
+    // BA-10: graceful degrade if a model rejects a non-default `temperature` (Ollama nests it under
+    // `options`). Keyed off the API error text, so dormant on models that accept temperature.
+    const { data, temperatureDropped } = await requestWithTemperatureFallback({
+      request: () => this._request('/api/chat', body),
+      hadTemperature: () => body.options?.temperature != null,
+      stripTemperature: () => { if (body.options) delete body.options.temperature; },
+      warnOnce: () => this._warnTemperatureDropped(),
+    });
     const msg = data.message || {};
 
     return {
@@ -65,9 +73,17 @@ class OllamaProvider {
         inputTokens: data.prompt_eval_count || 0,
         outputTokens: data.eval_count || 0,
       },
+      ...(temperatureDropped && { temperatureDropped: true }),
     };
   }
 
+  /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+  _warnTemperatureDropped() {
+    if (this._warnedTempDropped) return;
+    this._warnedTempDropped = true;
+    console.warn(`[OllamaProvider] '${this.model}' rejected a non-default 'temperature' (unsupported/deprecated) — retrying without it. Further drops from this provider instance are silent.`);
+  }
+
   /**
    * @param {string} path
    * @param {Record<string, any>} body

package/src/provider-openai.d.ts

@@ -44,6 +44,9 @@ export class OpenAIProvider {
      * @throws {Error} `[OpenAIProvider] ...` — on HTTP errors (4xx/5xx) or invalid JSON response.
      */
     generate(messages: Message[], tools?: ToolDef[], options?: Record<string, any>): Promise<GenerateResult>;
+    /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+    _warnTemperatureDropped(): void;
+    _warnedTempDropped: boolean | undefined;
     /**
      * Normalize OpenAI usage to the neutral {@link Usage} shape. OpenAI auto-caches prompt prefixes
      * (>=1024 tokens) and reports the cached portion in `prompt_tokens_details.cached_tokens` —

package/src/provider-openai.js

@@ -3,6 +3,7 @@
 const https = require('https');
 const http = require('http');
 const { ProviderError } = require('./errors');
+const { requestWithTemperatureFallback } = require('./provider-temperature');
 
 /** @typedef {import('../types').Message} Message */
 /** @typedef {import('../types').ToolDef} ToolDef */
@@ -61,7 +62,14 @@ class OpenAIProvider {
       }));
     }
 
-    const data = await this._request('/chat/completions', body);
+    // BA-10: newer models (o1/gpt-5-class) reject a non-default `temperature` with a 400 — drop it and
+    // retry once. `temperatureDropped` flows back so an upstream receipt can report the effective value.
+    const { data, temperatureDropped } = await requestWithTemperatureFallback({
+      request: () => this._request('/chat/completions', body),
+      hadTemperature: () => body.temperature != null,
+      stripTemperature: () => { delete body.temperature; },
+      warnOnce: () => this._warnTemperatureDropped(),
+    });
     const choice = data.choices[0];
     const msg = choice.message;
 
@@ -74,9 +82,17 @@ class OpenAIProvider {
       })),
       model: data.model || this.model,
       usage: this._normalizeUsage(data.usage),
+      ...(temperatureDropped && { temperatureDropped: true }),
     };
   }
 
+  /** One-time warning that this model rejected `temperature` and the request was retried without it (BA-10). */
+  _warnTemperatureDropped() {
+    if (this._warnedTempDropped) return;
+    this._warnedTempDropped = true;
+    console.warn(`[OpenAIProvider] '${this.model}' rejected a non-default 'temperature' (unsupported/deprecated) — retrying without it. Further drops from this provider instance are silent.`);
+  }
+
   /**
    * Normalize OpenAI usage to the neutral {@link Usage} shape. OpenAI auto-caches prompt prefixes
    * (>=1024 tokens) and reports the cached portion in `prompt_tokens_details.cached_tokens` —

package/src/provider-temperature.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Does this error mean the model rejected `temperature` as unsupported/deprecated?
+ * @param {any} err - the rejection from a provider `_request` (a {@link ProviderError} carries `.status`).
+ * @returns {boolean}
+ */
+export function isTemperatureUnsupported(err: any): boolean;
+/**
+ * Issue a provider request; if it 400s because `temperature` is unsupported AND a temperature was
+ * actually sent, strip it and retry ONCE. Returns whether the temperature was dropped so the caller
+ * can report the EFFECTIVE temperature (the receipt must not claim a value the model ignored).
+ *
+ * @param {object} opts
+ * @param {() => Promise<any>} opts.request - issues the API call (rejects `ProviderError` on 4xx).
+ * @param {() => boolean} opts.hadTemperature - was a temperature actually in the request body?
+ * @param {() => void} opts.stripTemperature - mutate the request body to remove the temperature.
+ * @param {() => void} [opts.warnOnce] - emit the one-time degrade warning (caller dedupes per instance).
+ * @returns {Promise<{ data: any, temperatureDropped: boolean }>}
+ */
+export function requestWithTemperatureFallback({ request, hadTemperature, stripTemperature, warnOnce }: {
+    request: () => Promise<any>;
+    hadTemperature: () => boolean;
+    stripTemperature: () => void;
+    warnOnce?: (() => void) | undefined;
+}): Promise<{
+    data: any;
+    temperatureDropped: boolean;
+}>;

package/src/provider-temperature.js

@@ -0,0 +1,60 @@
+'use strict';
+
+// Graceful degradation for models that reject a non-default `temperature` (BA-10 / relayfact F34).
+//
+// Newer models — claude-sonnet-5 ("`temperature` is deprecated for this model."), OpenAI o1/gpt-5-class
+// ("Unsupported value: 'temperature' … Only the default (1) …") — return a 400 for ANY non-default
+// temperature. Left unhandled, the whole `generate` throws; upstream (e.g. recurse's `refineLeaf`) then
+// collapses to `incomplete` with the executable close never run — a failure that LOOKS like "the model
+// couldn't do it" when in fact no attempt was ever made.
+//
+// The fix keys off the API's own error TEXT, never a hardcoded model list, so it survives future models
+// that drop the param and stays dormant on every model that accepts it. It retries ONCE without the
+// temperature, and ONLY for the unsupported/deprecated class — a genuine out-of-range 400 re-throws
+// (dropping it would mask a caller bug).
+
+/** The error names `temperature` … */
+const TEMP_NAMED = /temperature/i;
+// … AND indicates it's unsupported/deprecated (NOT merely out of range — that stays a hard error).
+// The `only…default` alternative uses a BOUNDED gap (`[^.]{0,40}`, not `.*`): an unbounded `.*` here is a
+// quadratic-blowup footgun on a long provider/proxy-supplied error message that repeats "only" with no
+// "default" (O(n) start positions × O(n) backtrack). The bound keeps it linear and still matches
+// "Only the default (1) value is supported."
+const TEMP_UNSUPPORTED = /(deprecat|unsupported|not support|does not support|no longer support|only\b[^.]{0,40}\bdefault|must be omitted|isn't supported|is not allowed)/i;
+
+/**
+ * Does this error mean the model rejected `temperature` as unsupported/deprecated?
+ * @param {any} err - the rejection from a provider `_request` (a {@link ProviderError} carries `.status`).
+ * @returns {boolean}
+ */
+function isTemperatureUnsupported(err) {
+  const msg = err && typeof err.message === 'string' ? err.message : '';
+  return !!err && err.status === 400 && TEMP_NAMED.test(msg) && TEMP_UNSUPPORTED.test(msg);
+}
+
+/**
+ * Issue a provider request; if it 400s because `temperature` is unsupported AND a temperature was
+ * actually sent, strip it and retry ONCE. Returns whether the temperature was dropped so the caller
+ * can report the EFFECTIVE temperature (the receipt must not claim a value the model ignored).
+ *
+ * @param {object} opts
+ * @param {() => Promise<any>} opts.request - issues the API call (rejects `ProviderError` on 4xx).
+ * @param {() => boolean} opts.hadTemperature - was a temperature actually in the request body?
+ * @param {() => void} opts.stripTemperature - mutate the request body to remove the temperature.
+ * @param {() => void} [opts.warnOnce] - emit the one-time degrade warning (caller dedupes per instance).
+ * @returns {Promise<{ data: any, temperatureDropped: boolean }>}
+ */
+async function requestWithTemperatureFallback({ request, hadTemperature, stripTemperature, warnOnce }) {
+  try {
+    return { data: await request(), temperatureDropped: false };
+  } catch (err) {
+    if (isTemperatureUnsupported(err) && hadTemperature()) {
+      stripTemperature();
+      if (warnOnce) warnOnce();
+      return { data: await request(), temperatureDropped: true };
+    }
+    throw err;
+  }
+}
+
+module.exports = { isTemperatureUnsupported, requestWithTemperatureFallback };

package/src/recurse.d.ts

@@ -90,9 +90,11 @@ export type RecurseOptions = {
      * tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass, so a failed
      * slice can self-correct. `sensor` is a DETERMINISTIC close (test/compile/lint — NOT a model judge, R-S8) that
      * returns a `Verdict`; on a non-pass its `critique` (the GAP, not the transcript) is fed FRESH into the next
-     * attempt (D6/A1 anti-anchoring) and the **retry temperature ESCALATES** (`temperatures`, default
-     * `[0.2,0.7,1.0]`) — the live-validated requirement that lets a weak model escape a repeat-the-same-mistake rut
-     * (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). `maxIterations` defaults to
+     * attempt (D6/A1 anti-anchoring) and, on models that ACCEPT `temperature`, the **retry temperature ESCALATES**
+     * (`temperatures`, default `[0.2,0.7,1.0]`) — the live-validated lever that lets a weak model escape a
+     * repeat-the-same-mistake rut (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). On a
+     * temperature-fixed model (BA-10) the provider drops the param, `receipts.refineLeaf.temperatures` records
+     * `null`, and the fed-back gap critique carries recovery alone. `maxIterations` defaults to
      * `temperatures.length`; the REAL bound is bareguard (each attempt is gate-checked + metered). CARRIES DOWN the
      * tree (preserved by `forChild`), so it engages at the leaves of a Family-A decomposition. Recovery is PARTIAL
      * (a stubborn blind spot may persist) — `receipts.refineLeaf.passed` reports honestly. Does NOT apply to a node
@@ -213,19 +215,25 @@ export type RecurseNode = {
     verdict: Verdict | null;
     incomplete: boolean;
     halted: boolean;
+    /**
+     * - (BA-11) set to `'governance-deny'` when this node stopped because its Loop
+     * short-circuited a consecutive-policy-deny spin (not a model failure). Mirrors `RecurseResult.blocker`.
+     */
+    blocker?: string | undefined;
     /**
      * - The worker Loop's `metrics.tokens`.
      */
     tokens: object | null;
     /**
-     * - (BA-8) when this leaf
-     * ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally passed
-     * (false = honest non-recovery, not a faked success).
+     * - (BA-8) when this
+     * leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
+     * passed (false = honest non-recovery, not a faked success). `temperatures` are the EFFECTIVE per-attempt temps
+     * (BA-10): a `null` marks an attempt the model ran at its DEFAULT because it rejected the requested temperature.
      */
     refineLeaf?: {
         iterations: number;
         passed: boolean;
-        temperatures: number[];
+        temperatures: (number | null)[];
     } | undefined;
     model: string | null;
     /**
@@ -284,6 +292,12 @@ export type RecurseResult = {
      * back incomplete (§9 scenario 1) — the anti-survivor-sum signal, not a quiet undercount.
      */
     missingSlices?: string[] | undefined;
+    /**
+     * - Present when `incomplete` for a specific, actionable reason. `'governance-deny'`
+     * (BA-11): the worker's Loop short-circuited after N consecutive policy denials rather than burn to the
+     * budget cap — the caller can widen scope / re-gate / escalate instead of reading it as a model failure.
+     */
+    blocker?: string | undefined;
     /**
      * - The audit node for this call (RC-10).
      */
@@ -353,9 +367,11 @@ export type Slice = {
  *   tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass, so a failed
  *   slice can self-correct. `sensor` is a DETERMINISTIC close (test/compile/lint — NOT a model judge, R-S8) that
  *   returns a `Verdict`; on a non-pass its `critique` (the GAP, not the transcript) is fed FRESH into the next
- *   attempt (D6/A1 anti-anchoring) and the **retry temperature ESCALATES** (`temperatures`, default
- *   `[0.2,0.7,1.0]`) — the live-validated requirement that lets a weak model escape a repeat-the-same-mistake rut
- *   (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). `maxIterations` defaults to
+ *   attempt (D6/A1 anti-anchoring) and, on models that ACCEPT `temperature`, the **retry temperature ESCALATES**
+ *   (`temperatures`, default `[0.2,0.7,1.0]`) — the live-validated lever that lets a weak model escape a
+ *   repeat-the-same-mistake rut (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). On a
+ *   temperature-fixed model (BA-10) the provider drops the param, `receipts.refineLeaf.temperatures` records
+ *   `null`, and the fed-back gap critique carries recovery alone. `maxIterations` defaults to
  *   `temperatures.length`; the REAL bound is bareguard (each attempt is gate-checked + metered). CARRIES DOWN the
  *   tree (preserved by `forChild`), so it engages at the leaves of a Family-A decomposition. Recovery is PARTIAL
  *   (a stubborn blind spot may persist) — `receipts.refineLeaf.passed` reports honestly. Does NOT apply to a node
@@ -419,10 +435,13 @@ export type Slice = {
  * @property {Verdict|null} verdict
  * @property {boolean} incomplete
  * @property {boolean} halted
+ * @property {string} [blocker] - (BA-11) set to `'governance-deny'` when this node stopped because its Loop
+ *   short-circuited a consecutive-policy-deny spin (not a model failure). Mirrors `RecurseResult.blocker`.
  * @property {object|null} tokens - The worker Loop's `metrics.tokens`.
- * @property {{iterations: number, passed: boolean, temperatures: number[]}} [refineLeaf] - (BA-8) when this leaf
- *   ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally passed
- *   (false = honest non-recovery, not a faked success).
+ * @property {{iterations: number, passed: boolean, temperatures: (number|null)[]}} [refineLeaf] - (BA-8) when this
+ *   leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
+ *   passed (false = honest non-recovery, not a faked success). `temperatures` are the EFFECTIVE per-attempt temps
+ *   (BA-10): a `null` marks an attempt the model ran at its DEFAULT because it rejected the requested temperature.
  * @property {string|null} model
  * @property {string|null} [retrieval] - (§10 step 7) the retrieval mode this node ran (`scan`/`search`/`exact`),
  *   or null/absent for a plain reasoning node.
@@ -443,6 +462,9 @@ export type Slice = {
  * @property {any} [best] - The best partial answer when `incomplete` (RC-9).
  * @property {string[]} [missingSlices] - When `incomplete` because a child failed: the sub-task(s) that came
  *   back incomplete (§9 scenario 1) — the anti-survivor-sum signal, not a quiet undercount.
+ * @property {string} [blocker] - Present when `incomplete` for a specific, actionable reason. `'governance-deny'`
+ *   (BA-11): the worker's Loop short-circuited after N consecutive policy denials rather than burn to the
+ *   budget cap — the caller can widen scope / re-gate / escalate instead of reading it as a model failure.
  * @property {RecurseNode} receipts - The audit node for this call (RC-10).
  */
 /**

package/src/recurse.js

@@ -56,6 +56,10 @@ const DEFAULT_WORKER_BUDGET = 100;
 // low temperature a weak model regenerates byte-identical wrong code and IGNORES even crisp deterministic
 // feedback (0/5 recovery); recovery only appears once retries are given room to vary (0/5 → 2-3/5). So escalation
 // is a DESIGN REQUIREMENT of the seam, not a tuning nicety. Overridable via `opts.refineLeaf.temperatures`.
+// SCOPE (BA-10): this holds for models that ACCEPT `temperature`. On a temperature-fixed model (e.g.
+// claude-sonnet-5 — the provider drops the param, `receipts.refineLeaf.temperatures` records `null`), the
+// escalation lever is inert and the fed-back gap `critique` carries recovery alone (an empirical question the
+// live run answers). The critique is the primary correction lever; temperature is a secondary diversity lever.
 const DEFAULT_REFINE_TEMPS = [0.2, 0.7, 1.0];
 
 /**
@@ -217,9 +221,11 @@ function auditSafeCtx(ctx, overrides = {}) {
  *   tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass, so a failed
  *   slice can self-correct. `sensor` is a DETERMINISTIC close (test/compile/lint — NOT a model judge, R-S8) that
  *   returns a `Verdict`; on a non-pass its `critique` (the GAP, not the transcript) is fed FRESH into the next
- *   attempt (D6/A1 anti-anchoring) and the **retry temperature ESCALATES** (`temperatures`, default
- *   `[0.2,0.7,1.0]`) — the live-validated requirement that lets a weak model escape a repeat-the-same-mistake rut
- *   (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). `maxIterations` defaults to
+ *   attempt (D6/A1 anti-anchoring) and, on models that ACCEPT `temperature`, the **retry temperature ESCALATES**
+ *   (`temperatures`, default `[0.2,0.7,1.0]`) — the live-validated lever that lets a weak model escape a
+ *   repeat-the-same-mistake rut (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). On a
+ *   temperature-fixed model (BA-10) the provider drops the param, `receipts.refineLeaf.temperatures` records
+ *   `null`, and the fed-back gap critique carries recovery alone. `maxIterations` defaults to
  *   `temperatures.length`; the REAL bound is bareguard (each attempt is gate-checked + metered). CARRIES DOWN the
  *   tree (preserved by `forChild`), so it engages at the leaves of a Family-A decomposition. Recovery is PARTIAL
  *   (a stubborn blind spot may persist) — `receipts.refineLeaf.passed` reports honestly. Does NOT apply to a node
@@ -284,10 +290,13 @@ function auditSafeCtx(ctx, overrides = {}) {
  * @property {Verdict|null} verdict
  * @property {boolean} incomplete
  * @property {boolean} halted
+ * @property {string} [blocker] - (BA-11) set to `'governance-deny'` when this node stopped because its Loop
+ *   short-circuited a consecutive-policy-deny spin (not a model failure). Mirrors `RecurseResult.blocker`.
  * @property {object|null} tokens - The worker Loop's `metrics.tokens`.
- * @property {{iterations: number, passed: boolean, temperatures: number[]}} [refineLeaf] - (BA-8) when this leaf
- *   ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally passed
- *   (false = honest non-recovery, not a faked success).
+ * @property {{iterations: number, passed: boolean, temperatures: (number|null)[]}} [refineLeaf] - (BA-8) when this
+ *   leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
+ *   passed (false = honest non-recovery, not a faked success). `temperatures` are the EFFECTIVE per-attempt temps
+ *   (BA-10): a `null` marks an attempt the model ran at its DEFAULT because it rejected the requested temperature.
  * @property {string|null} model
  * @property {string|null} [retrieval] - (§10 step 7) the retrieval mode this node ran (`scan`/`search`/`exact`),
  *   or null/absent for a plain reasoning node.
@@ -309,6 +318,9 @@ function auditSafeCtx(ctx, overrides = {}) {
  * @property {any} [best] - The best partial answer when `incomplete` (RC-9).
  * @property {string[]} [missingSlices] - When `incomplete` because a child failed: the sub-task(s) that came
  *   back incomplete (§9 scenario 1) — the anti-survivor-sum signal, not a quiet undercount.
+ * @property {string} [blocker] - Present when `incomplete` for a specific, actionable reason. `'governance-deny'`
+ *   (BA-11): the worker's Loop short-circuited after N consecutive policy denials rather than burn to the
+ *   budget cap — the caller can widen scope / re-gate / escalate instead of reading it as a model failure.
  * @property {RecurseNode} receipts - The audit node for this call (RC-10).
  */
 
@@ -503,6 +515,15 @@ async function recurse(task, ctx = {}, opts = {}) {
     node.incomplete = true;
     return { incomplete: true, best: out.text || null, receipts: node };
   }
+  // BA-11: a deny-spin short-circuit. The Loop stopped the worker after N consecutive governance denials
+  // (a governance deny is not a recoverable tool error — retrying variants would burn to the budget cap;
+  // probe-16: 16 calls, sensor never reached → incomplete). Surface it as a clean, LABELED incomplete so a
+  // caller can tell a governance block apart from a model failure and act (widen scope, re-gate, escalate).
+  if (typeof out.error === 'string' && out.error.startsWith('denied:')) {
+    node.incomplete = true;
+    node.blocker = 'governance-deny';
+    return { incomplete: true, best: out.text || null, blocker: 'governance-deny', receipts: node };
+  }
   if (out.error) {
     node.incomplete = true;
     return { incomplete: true, best: out.text || null, receipts: node };
@@ -603,6 +624,12 @@ async function recurseRefineLeaf(task, ctx, opts, state) {
     tokensSum = tokensSum || {};
     for (const [k, v] of Object.entries(t)) if (typeof v === 'number') tokensSum[k] = (tokensSum[k] || 0) + v;
   };
+  // BA-10 honest receipt: the EFFECTIVE temperature per attempt. A model that rejects a non-default
+  // `temperature` (400, unsupported/deprecated) runs at its DEFAULT — the provider drops it and the Loop
+  // surfaces `temperatureDropped`. Recording the requested temp would claim a value the model ignored, so
+  // a dropped attempt is stored as `null` ("provider default"). Indexed by iteration (refine calls once each).
+  /** @type {(number|null)[]} */
+  const effectiveTemps = [];
   // One attempt = a fresh leaf Loop (no spawn tool: a retry is a direct correction, not a re-decomposition) at the
   // iteration's temperature, with the GAP fed forward as fresh feedback. A governance halt → throw so refine stops.
   const attempt = async ({ iteration, critique }) => {
@@ -619,6 +646,10 @@ async function recurseRefineLeaf(task, ctx, opts, state) {
       ? `${base}\n\nYour previous attempt FAILED these checks:\n${critique}\n\nReturn a corrected result that passes ALL of them.`
       : base;
     const out = await loop.run([{ role: 'user', content: userText }], handleTools, { ctx: auditSafeCtx(ctx, { depth }), temperature });
+    // `temperatureDropped` is set on the Loop result only when the model rejected the requested temperature
+    // (BA-10); it's absent on the error/halt return shapes, so read it through a narrow cast.
+    const dropped = /** @type {{temperatureDropped?: boolean}} */ (out).temperatureDropped;
+    effectiveTemps[iteration] = dropped ? null : temperature;
     accrueTokens(out.metrics ? out.metrics.tokens : null);
     if (typeof out.error === 'string' && out.error.startsWith('halt:')) throw new HaltError('refine-leaf attempt halted', { rule: out.error.slice('halt:'.length) });
     if (out.error) throw new Error(out.error); // a non-halt worker fault → honest incomplete
@@ -633,7 +664,10 @@ async function recurseRefineLeaf(task, ctx, opts, state) {
       maxIterations,
     });
     node.tokens = tokensSum;
-    node.refineLeaf = { iterations: outcome.iterations, passed: !!(outcome.verdict && outcome.verdict.pass), temperatures: temps.slice(0, outcome.iterations) };
+    // `temperatures` = the EFFECTIVE temps (BA-10): a `null` marks an attempt whose requested temperature the
+    // model rejected and ran at its default — so the receipt never claims a value the model ignored. On a
+    // temperature-accepting model this equals the requested `temps.slice(0, iterations)` (byte-identical receipt).
+    node.refineLeaf = { iterations: outcome.iterations, passed: !!(outcome.verdict && outcome.verdict.pass), temperatures: effectiveTemps.slice(0, outcome.iterations) };
     const result = outcome.result;
 
     // Optional rubric layer on top of the deterministic sensor (RC-7): forced for critical, or a contract/override.
@@ -653,6 +687,13 @@ async function recurseRefineLeaf(task, ctx, opts, state) {
       node.incomplete = true;
       return { incomplete: true, best: null, receipts: node };
     }
+    // BA-11: a deny-spin inside a refine attempt (the Loop short-circuited after N consecutive governance
+    // denials, rethrown at recurse.js as `denied:<tool>`) is a LABELED governance block, not a model fault.
+    if (typeof err?.message === 'string' && err.message.startsWith('denied:')) {
+      node.incomplete = true;
+      node.blocker = 'governance-deny';
+      return { incomplete: true, best: null, blocker: 'governance-deny', receipts: node };
+    }
     node.incomplete = true;
     return { incomplete: true, best: null, receipts: node };
   }

package/types/index.d.ts

@@ -80,6 +80,12 @@ export interface GenerateResult {
   usage: Usage;
   /** Model id the response was produced by; preferred over Provider.model for cost accounting. */
   model?: string | null;
+  /**
+   * True when the requested `temperature` was rejected by the model (400, unsupported/deprecated) and
+   * the request was retried without it (BA-10). The response was produced at the model's DEFAULT
+   * temperature, not the one requested — callers reporting an effective temperature must honor this.
+   */
+  temperatureDropped?: boolean;
 }
 
 /** A conversation message in OpenAI chat format. */