bare-agent 0.29.0 → 0.31.0

package/README.md

@@ -94,7 +94,7 @@ Every piece works alone — take what you need, ignore the rest. Two axes: **Act
 
 ### Recurse — break a hard task into a tree *(the RLM primitive)*
 
-`recurse(task, ctx, opts)` does **decompose → fan-out → verify → synthesize** in one call — Recursive Language Models as a single import, composed *around* the Loop (never a new engine). The default is **model-driven**: the worker is handed a `spawn_child` tool and decides whether to split, bounded by depth + bareguard (no second guard layer). Forced fan-out (`count` / `mode:'fanout'`) and data-driven width (`mode:'partition'`, measured from a corpus) are opt-in. Give workers a stance with `opts.persona` (prepended to every worker, carries down the tree, deliberately kept out of the isolated verifier), and tell them *where they are* with `opts.context` (a read-only paths/cwd blob threaded to every worker so a sliced child can locate its artifact — facts, not a stance). For a leaf that should self-correct, pass `opts.refineLeaf` (opt-in): a definite leaf becomes a bounded generate→sense→regenerate loop driven by *your* deterministic sensor (test/compile/lint), feeding the gap back (with escalating temperature on models that accept it; on a temperature-fixed model like `claude-sonnet-5` the gap critique carries recovery, and the receipt records the effective temps). The headline guarantee: **aggregation is code, never a model-stated number**, and a dead worker or exhausted guard returns an honest `{ incomplete, missingSlices }` — never a faked pass.
+`recurse(task, ctx, opts)` does **decompose → fan-out → verify → synthesize** in one call — Recursive Language Models as a single import, composed *around* the Loop (never a new engine). The default is **model-driven**: the worker is handed a `spawn_child` tool and decides whether to split, bounded by depth + bareguard (no second guard layer). Forced fan-out (`count` / `mode:'fanout'`) and data-driven width (`mode:'partition'`, measured from a corpus) are opt-in. Give workers a stance with `opts.persona` (prepended to every worker, carries down the tree, deliberately kept out of the isolated verifier), and tell them *where they are* with `opts.context` (a read-only paths/cwd blob threaded to every worker so a sliced child can locate its artifact — facts, not a stance). For a leaf that should self-correct, pass `opts.refineLeaf` (opt-in): a definite leaf becomes a bounded generate→sense→regenerate loop driven by *your* deterministic sensor (test/compile/lint — one that judges the *returned* result, never a worker side-effect it could game), feeding the gap back (with escalating temperature on models that accept it; on a temperature-fixed model like `claude-sonnet-5` the gap critique carries recovery, and the receipt records the effective temps). On a temperature-fixed model, `refineLeaf.rejectedBuffer` adds a second lever — it feeds the model's own prior *failed attempts* back verbatim ("write something structurally different"), the directed-diversity complement to temperature's random diversity (adaptive by default; the two are antagonistic, so it holds temperature flat when it engages). A *broken* arbiter — a sensor or a caller `evaluate` that throws or returns a malformed verdict — is named, never blamed on the model: the node stops at the first broken close and returns `{ incomplete, blocker: 'broken-sensor' | 'broken-verifier' }` with the model's last output preserved. The headline guarantee: **aggregation is code, never a model-stated number**, and a dead worker or exhausted guard returns an honest `{ incomplete, missingSlices }` — never a faked pass.
 
 Over a corpus, context reaches a worker as a **handle routed by question shape** (`opts.retrieval`):
 

package/bareagent.context.md

@@ -1,7 +1,7 @@
 # bareagent — Integration Guide
 
 > For AI assistants and developers wiring bareagent into a project.
-> v0.29.0 | Node.js >= 18 | zero required deps (`bareguard >=0.9.0 <0.13.0` optional peer for governance) | Apache 2.0
+> v0.31.0 | Node.js >= 18 | zero required deps (`bareguard >=0.9.0 <0.13.0` optional peer for governance) | Apache 2.0
 >
 > Full human guide with composition examples, design philosophy, and recipes: [Usage Guide](docs/02-features/usage-guide.md)
 
@@ -38,7 +38,7 @@ Eight entry points:
 | Count / answer "how many / all" over a corpus, honestly | recurse(task, ctx, `{ corpus, retrieval: 'scan' }`) — scans every slice, CODE-counts |
 | Give recurse workers a persona/role (senior-dev stance) | recurse(task, ctx, `{ persona }`) — prepended to every worker, carries down the tree; not applied to the verifier |
 | Tell recurse workers WHERE they are (paths/cwd) so a slice can find its file | recurse(task, ctx, `{ context }`) — read-only blob on every worker's task message + the Planner + verifier; carries down (facts, not a stance) |
-| Let a recurse LEAF retry its own failure with a deterministic check | recurse(task, ctx, `{ refineLeaf: { sensor } }`) — leaf becomes a bounded generate→sense→regenerate loop; your sensor (test/compile/lint), gap fed back, escalating temperature |
+| Let a recurse LEAF retry its own failure with a deterministic check | recurse(task, ctx, `{ refineLeaf: { sensor } }`) — leaf becomes a bounded generate→sense→regenerate loop; your sensor (test/compile/lint) judges the RETURNED result, gap fed back, escalating temperature; `rejectedBuffer` feeds prior failed attempts back on a temp-fixed model |
 | Track task state (pending/running/done/failed) | StateMachine |
 | Run agent turns on a schedule (cron, timers) | Scheduler |
 | Require human approval before dangerous actions | Checkpoint |
@@ -708,7 +708,13 @@ const out = await recurse('Audit auth.js, billing.js, gateway.js for authz bugs'
 
 **Worker context (`opts.context`, v0.23.0):** a read-only working-context string (paths/cwd) PREPENDED to every worker's TASK message as a `Working context:` block — so a sliced child can **locate its artifact** (the Planner paraphrases the goal into subtasks and drops absolute paths; without this, workers guess `.`/`~`/`/tmp` and get denied). Forwarded to the Planner as `info` (path-aware slices) and shown to the verifier too (neutral FACTS, not a stance — distinct from `persona`, which is a privileged SYSTEM-prompt stance). Carries down the tree. **Security:** it still becomes part of the prompt, so pass caller-trusted run-state only, never untrusted/end-user text (lower-privilege than `persona` — user message, not system — but still an injection surface). Absent ⇒ the task message is unchanged.
 
-**Leaf self-correction (`opts.refineLeaf`, v0.23.0, opt-in):** turn a **definite leaf** (a node offered no `spawn_child` — `simple` tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass: `{ sensor, maxIterations?, temperatures? }`. `sensor(result, { task, context, contract }) → Verdict` is YOUR **deterministic** close (test/compile/lint — not a model judge); on a non-pass its `critique` (the gap, not the transcript) is fed FRESH into the next attempt and — **on models that accept `temperature`** — the **retry temperature ESCALATES** (default `[0.2, 0.7, 1.0]` — load-bearing there: a weak model at a flat temperature regenerates identical wrong code and ignores even crisp feedback). On a **temperature-fixed model** (e.g. `claude-sonnet-5`, which 400s any non-default temperature) the provider silently drops the param (see below), the escalation lever is inert, and the fed-back gap critique carries recovery alone; `receipts.refineLeaf.temperatures` then records the EFFECTIVE temps — a `null` marks an attempt that ran at the model's default (never the ignored requested value). Each attempt is gate-checked + metered; a HaltError mid-loop → clean `{ incomplete }`; honest non-recovery → `receipts.refineLeaf.passed === false` (never a faked pass); `receipts.tokens` sums all attempts. The error-keyed `recall` stays YOUR tool (`opts.tools`), keyed off the fed-back critique — bareagent stays litectx-agnostic. Carries down (engages at the leaves). Absent ⇒ a leaf is a single pass.
+**Leaf self-correction (`opts.refineLeaf`, v0.23.0, opt-in):** turn a **definite leaf** (a node offered no `spawn_child` — `simple` tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass: `{ sensor, maxIterations?, temperatures?, rejectedBuffer? }`. `sensor(result, { task, context, contract }) → Verdict` is YOUR **deterministic** close (test/compile/lint — not a model judge); on a non-pass its `critique` (the gap, not the transcript) is fed FRESH into the next attempt and — **on models that accept `temperature`** — the **retry temperature ESCALATES** (default `[0.2, 0.7, 1.0]` — load-bearing there: a weak model at a flat temperature regenerates identical wrong code and ignores even crisp feedback). On a **temperature-fixed model** (e.g. `claude-sonnet-5`, which 400s any non-default temperature) the provider silently drops the param (see below), the escalation lever is inert, and the fed-back gap critique carries recovery alone; `receipts.refineLeaf.temperatures` then records the EFFECTIVE temps — a `null` marks an attempt that ran at the model's default (never the ignored requested value). Each attempt is gate-checked + metered; a HaltError mid-loop → clean `{ incomplete }`; honest non-recovery → `receipts.refineLeaf.passed === false` (never a faked pass); `receipts.tokens` sums all attempts. The error-keyed `recall` stays YOUR tool (`opts.tools`), keyed off the fed-back critique — bareagent stays litectx-agnostic. Carries down (engages at the leaves). Absent ⇒ a leaf is a single pass.
+
+> **Sensor integrity (`refineLeaf.sensor`):** the sensor must judge the **returned result** (tamper-proof — build/run the returned string in isolation), never a worker **side-effect** a worker with edit tools could game (writing a passing file then returning junk, or editing the failing test itself). The loop optimizes against whatever the sensor reads — keep the close outside what the worker can write. (RSI field lesson: reward-hacking appeared in every optimization loop with a gameable close. **Demonstrated in-repo** — `poc/sensor-gaming-blocked.mjs`: the moment the honest path was blocked, `claude-sonnet-5` faked a pass on an unsatisfiable on-disk check **5/5** — both by editing the test and by making the returned function non-pure — while a tamper-proof close that runs the returned artifact in isolation was not gameable.)
+
+> **Broken arbiter ≠ failing model (BA-15):** a `refineLeaf.sensor` — or a caller `opts.evaluate` verifier — that **throws** (your test runner crashed — ENOENT, a harness syntax error) or returns a **malformed verdict** (anything with neither a usable `pass` nor a valid tri-state `status`) is a faulty **arbiter**, not a model failure. The loop stops at the **first** broken close (it never retries against a broken judge — each retry would carry zero feedback) and returns a labeled `{ incomplete, blocker: 'broken-sensor' | 'broken-verifier', blockerDetail }` (what the arbiter did; mirrored on `receipts`), with `best` preserving the model's last non-empty output (BA-5) — best-effort work the arbiter never graded, not a pass. The label names WHICH knob to fix. Check `out.blocker` before debugging the model: `'broken-sensor'` / `'broken-verifier'` mean fix your sensor / your `evaluate` and re-run; `'governance-deny'` means widen scope / re-gate. **`pass` may be any truthy/falsy value** (`true`, `1`, `0`) — only a verdict carrying *no* usable signal is malformed — and a verdict backed by a class/getters keeps its fields. **In a nested run** the label travels: `out.blocker` reports a descendant's fault with `out.blockerTask` naming which sub-task broke, while each ancestor's receipts record it as `blockerFrom` — an ancestor's own `blocker` always means *that* node broke, so it never accuses a node whose sensor never ran. The **default Evaluator rubric verifier is never labeled** (its failures are provider-class faults), and a `HaltError` thrown by either arbiter stays a clean governance halt. One thing stays YOURS: an arbiter that **hangs** hangs the node (no gate checkpoint fires inside your callback) — run untrusted or model-generated checks in an isolated child process **with a timeout**.
+
+> **`rejectedBuffer` (BA-14, v0.30.0):** a second lever for a **temperature-fixed** model, where escalation is inert. Instead of only the latest critique, it surfaces the model's OWN prior failed attempts VERBATIM — *"you wrote these, they failed X — write something STRUCTURALLY DIFFERENT."* This is **directed** diversity (attack the specific repeated mistake); escalation is **random** diversity, and the two are **antagonistic** — temperature monotonically degrades the buffer (`poc/ba14b`: flat-0.2 100% → 0.7 70% → 1.0 50%), so when the buffer engages the retry temperature is **held flat** at `temperatures[0]`, never escalated. Trigger: `true` = force on (also on temperature-accepting models); `false` = force off (pure BA-8 escalation); **unset = adaptive** — engage only once a prior attempt's temperature was dropped (i.e. a temp-fixed model where escalation is inert and the buffer is the sole lever). On a temperature-accepting model the default leaves behavior byte-identical. `receipts.refineLeaf.rejectedBuffer` reports whether it engaged. Efficacy is a **weak-model / fixation** phenomenon (live on `claude-sonnet-5` it engaged 6/6 but recovered no better than critique-only — cost-neutral, hence adaptive-not-always-on).
 
 ```javascript
 const out = await recurse('Fix the failing function in calc.js', ctx, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-agent",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "files": [
     "index.js",
     "index.d.ts",

package/src/loop.js

@@ -701,6 +701,11 @@ class Loop {
         const generate = () => this.provider.generate(toSend, activeTools, options);
         result = this.retry ? await this.retry.call(generate) : await generate();
       } catch (err) {
+        // A HaltError is a governance exit, not a provider failure — re-throw it (like every other seam) so it
+        // reaches the outer handler, which seals dangling tool_calls and returns error:`halt:<rule>`. Without
+        // this, throwOnError:false laundered a provider-surfaced HaltError into a generic `error:<message>`,
+        // indistinguishable from a real fault (the retry never retries it — DEFAULT_RETRY_ON is false for it).
+        if (err instanceof HaltError) throw err;
         this._reportError('provider', err, { round });
         if (this.throwOnError) throw err;
         // BA-5: a mid-run provider failure must not erase the work of the rounds that succeeded.

package/src/recurse.d.ts

@@ -94,13 +94,36 @@ export type RecurseOptions = {
      * (`temperatures`, default `[0.2,0.7,1.0]`) — the live-validated lever that lets a weak model escape a
      * repeat-the-same-mistake rut (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). On a
      * temperature-fixed model (BA-10) the provider drops the param, `receipts.refineLeaf.temperatures` records
-     * `null`, and the fed-back gap critique carries recovery alone. `maxIterations` defaults to
+     * `null`, and the fed-back gap critique carries recovery alone — UNLESS the rejected-attempt buffer engages
+     * (below). `maxIterations` defaults to
      * `temperatures.length`; the REAL bound is bareguard (each attempt is gate-checked + metered). CARRIES DOWN the
      * tree (preserved by `forChild`), so it engages at the leaves of a Family-A decomposition. Recovery is PARTIAL
      * (a stubborn blind spot may persist) — `receipts.refineLeaf.passed` reports honestly. Does NOT apply to a node
      * that delegates (its children + the tree verify own quality), nor to the scan/fanout/partition dispatch paths.
      * Absent ⇒ a leaf is a single pass (byte-identical to pre-BA-8). An error-keyed `recall` is the CALLER's tool
      * (`opts.tools`) keyed off the fed-back critique — bareagent stays litectx-agnostic.
+     * **Sensor integrity (RSI-learnings #1/#5, "audit the close"):** the `sensor` MUST judge the RETURNED result
+     * (tamper-proof — e.g. build/run the returned string in an isolated context, as `poc/ba8-leaf-refine.mjs` does),
+     * NEVER a worker side-effect a worker with edit tools could GAME (writing a passing file then returning junk, or
+     * editing the failing test itself). A gameable close is the reward-hacking surface every RSI system in the field
+     * got bitten by; the loop optimizes against WHATEVER the sensor reads, so keep it outside what the worker can write.
+     * **Broken sensor ≠ failing model (BA-15):** a sensor that THROWS (non-Halt) or returns a MALFORMED verdict
+     * (anything but `{pass: boolean}` or a valid tri-state `status`) is a faulty ARBITER — the loop stops at the
+     * FIRST broken close (never retries against it) and returns a labeled `{incomplete, blocker:'broken-sensor'}`
+     * (+ `receipts.blockerDetail`), with `best` preserving the model's last attempt. A `HaltError` thrown by the
+     * sensor stays a clean governance halt. The sensor's EXECUTION environment is the caller's: run untrusted /
+     * model-generated checks in an isolated child process WITH A TIMEOUT — a sensor that hangs forever hangs the
+     * leaf (no bareguard checkpoint fires between sensor start and return).
+     * **`rejectedBuffer` (BA-14):** a SkillOpt-shaped rejected-attempt buffer — instead of only the LATEST critique,
+     * surface the model's OWN prior failed attempts verbatim ("you wrote these, they failed X — write something
+     * STRUCTURALLY DIFFERENT"). This is DIRECTED diversity (attack the specific repeated mistake), where escalation
+     * is RANDOM diversity; the two are ANTAGONISTIC (`poc/ba14b-temp-with-buffer.mjs`: temperature monotonically
+     * degrades the buffer, 100%→70%→50% across 0.2/0.7/1.0), so when the buffer engages the retry temperature is
+     * HELD at `temperatures[0]` (flat-low), never escalated. `true` = force on (also on temperature-accepting
+     * models); `false` = force off (pure BA-8 escalation); UNSET = ADAPTIVE — engage only once a prior attempt's
+     * temperature was dropped (a temperature-fixed model, BA-10, where escalation is inert and the buffer is the
+     * sole lever — `poc/ba14-rejected-buffer.mjs`: flat-temp 50%→100%). `receipts.refineLeaf.rejectedBuffer`
+     * reports whether any iteration injected it. Bounded by `maxIterations` (the buffer never outgrows it).
      */
     refineLeaf?: {
         sensor: (result: any, ctx: {
@@ -110,6 +133,7 @@ export type RecurseOptions = {
         }) => (Verdict | Promise<Verdict>);
         maxIterations?: number;
         temperatures?: number[];
+        rejectedBuffer?: boolean;
     } | undefined;
     /**
      * - Definition of done (A3). When present, the verifier grades against THIS,
@@ -216,24 +240,48 @@ export type RecurseNode = {
     incomplete: boolean;
     halted: boolean;
     /**
-     * - (BA-11) set to `'governance-deny'` when this node stopped because its Loop
-     * short-circuited a consecutive-policy-deny spin (not a model failure). Mirrors `RecurseResult.blocker`.
+     * - Set when this node stopped for a specific non-model reason (mirrors
+     * `RecurseResult.blocker`): `'governance-deny'` (BA-11) — its Loop short-circuited a consecutive-policy-deny
+     * spin; `'broken-sensor'` (BA-15) — the caller's `refineLeaf.sensor` threw or returned a malformed verdict;
+     * `'broken-verifier'` (BA-15) — the caller's `opts.evaluate` did (the default Evaluator path is never labeled).
      */
     blocker?: string | undefined;
+    /**
+     * - (BA-15) with a `broken-*` blocker: what the arbiter did (threw with
+     * which message, or which malformed shape it returned) — the actionable half of the label.
+     */
+    blockerDetail?: string | undefined;
+    /**
+     * - (BA-15) a
+     * DESCENDANT's blocker, surfaced here so an aggregating node still reports the fault upward. Deliberately
+     * SEPARATE from this node's own `blocker` (which means "THIS node's arbiter/Loop broke"): stamping a
+     * descendant's label onto every ancestor made the receipts tree accuse nodes whose sensor never ran, and
+     * re-labelled a parent `governance-deny` when only one child was denied. `blockerTask` names the culprit.
+     */
+    blockerFrom?: {
+        blocker: string;
+        blockerDetail?: string;
+        blockerTask?: string;
+    } | undefined;
     /**
      * - The worker Loop's `metrics.tokens`.
      */
     tokens: object | null;
     /**
-     * - (BA-8) when this
-     * leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
+     * - (BA-8) when
+     * this leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
      * passed (false = honest non-recovery, not a faked success). `temperatures` are the EFFECTIVE per-attempt temps
      * (BA-10): a `null` marks an attempt the model ran at its DEFAULT because it rejected the requested temperature.
+     * `rejectedBuffer` (BA-14): whether any iteration injected the rejected-attempt buffer (prior failed attempts
+     * surfaced verbatim); when it engages the REQUESTED retry temperature is held flat at `temperatures[0]`, never
+     * escalated (ba14b antagonism) — but a temperature-fixed model still drops it, so the EFFECTIVE temp recorded
+     * above is `null`, not `temperatures[0]`.
      */
     refineLeaf?: {
         iterations: number;
         passed: boolean;
         temperatures: (number | null)[];
+        rejectedBuffer: boolean;
     } | undefined;
     model: string | null;
     /**
@@ -296,8 +344,26 @@ export type RecurseResult = {
      * - Present when `incomplete` for a specific, actionable reason. `'governance-deny'`
      * (BA-11): the worker's Loop short-circuited after N consecutive policy denials rather than burn to the
      * budget cap — the caller can widen scope / re-gate / escalate instead of reading it as a model failure.
+     * `'broken-sensor'` (BA-15): the caller's `refineLeaf.sensor` threw or returned a malformed verdict — the
+     * ARBITER is faulty, not the model; fix the sensor and re-run (`receipts.blockerDetail` says what it did).
+     * `'broken-verifier'` (BA-15): same fault class at the verify slot — the caller's `opts.evaluate` threw
+     * (non-Halt) or returned a malformed verdict; the default Evaluator path is never labeled (its failures are
+     * provider-class faults). For both `broken-*` blockers `best` preserves the model's last non-empty output
+     * (BA-5) — the arbiter broke, so treat it as best-effort work rather than a graded pass.
      */
     blocker?: string | undefined;
+    /**
+     * - (BA-15) with a `broken-*` blocker: what the arbiter did — the
+     * ACTIONABLE half of the label, surfaced on the result (not only in `receipts`) so a caller branching on
+     * `blocker` can report the cause without walking the receipts tree.
+     */
+    blockerDetail?: string | undefined;
+    /**
+     * - (BA-15) when the blocker was INHERITED from a descendant in a nested run:
+     * which sub-task actually broke. Without it a nested failure reports "a sensor broke" with no way to find
+     * which one.
+     */
+    blockerTask?: string | undefined;
     /**
      * - The audit node for this call (RC-10).
      */
@@ -362,7 +428,7 @@ export type Slice = {
  *   TRUSTED run-state (paths/cwd); do NOT pass untrusted / end-user-controlled text here.
  * @property {ToolDef[]} [tools] - Handle tools offered to EVERY worker (RC-5 pull-default: litectx
  *   `recall`/`get`, wired at build step 7). Workers query on demand; never the whole corpus.
- * @property {{sensor: (result: any, ctx: {task: string, context: string|undefined, contract: string|null}) => (Verdict|Promise<Verdict>), maxIterations?: number, temperatures?: number[]}} [refineLeaf]
+ * @property {{sensor: (result: any, ctx: {task: string, context: string|undefined, contract: string|null}) => (Verdict|Promise<Verdict>), maxIterations?: number, temperatures?: number[], rejectedBuffer?: boolean}} [refineLeaf]
  *   (Opt-in, BA-8 / relayfact F17) Turn a DEFINITE LEAF (a node that is offered no `spawn_child` — `simple`
  *   tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass, so a failed
  *   slice can self-correct. `sensor` is a DETERMINISTIC close (test/compile/lint — NOT a model judge, R-S8) that
@@ -371,13 +437,36 @@ export type Slice = {
  *   (`temperatures`, default `[0.2,0.7,1.0]`) — the live-validated lever that lets a weak model escape a
  *   repeat-the-same-mistake rut (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). On a
  *   temperature-fixed model (BA-10) the provider drops the param, `receipts.refineLeaf.temperatures` records
- *   `null`, and the fed-back gap critique carries recovery alone. `maxIterations` defaults to
+ *   `null`, and the fed-back gap critique carries recovery alone — UNLESS the rejected-attempt buffer engages
+ *   (below). `maxIterations` defaults to
  *   `temperatures.length`; the REAL bound is bareguard (each attempt is gate-checked + metered). CARRIES DOWN the
  *   tree (preserved by `forChild`), so it engages at the leaves of a Family-A decomposition. Recovery is PARTIAL
  *   (a stubborn blind spot may persist) — `receipts.refineLeaf.passed` reports honestly. Does NOT apply to a node
  *   that delegates (its children + the tree verify own quality), nor to the scan/fanout/partition dispatch paths.
  *   Absent ⇒ a leaf is a single pass (byte-identical to pre-BA-8). An error-keyed `recall` is the CALLER's tool
  *   (`opts.tools`) keyed off the fed-back critique — bareagent stays litectx-agnostic.
+ *   **Sensor integrity (RSI-learnings #1/#5, "audit the close"):** the `sensor` MUST judge the RETURNED result
+ *   (tamper-proof — e.g. build/run the returned string in an isolated context, as `poc/ba8-leaf-refine.mjs` does),
+ *   NEVER a worker side-effect a worker with edit tools could GAME (writing a passing file then returning junk, or
+ *   editing the failing test itself). A gameable close is the reward-hacking surface every RSI system in the field
+ *   got bitten by; the loop optimizes against WHATEVER the sensor reads, so keep it outside what the worker can write.
+ *   **Broken sensor ≠ failing model (BA-15):** a sensor that THROWS (non-Halt) or returns a MALFORMED verdict
+ *   (anything but `{pass: boolean}` or a valid tri-state `status`) is a faulty ARBITER — the loop stops at the
+ *   FIRST broken close (never retries against it) and returns a labeled `{incomplete, blocker:'broken-sensor'}`
+ *   (+ `receipts.blockerDetail`), with `best` preserving the model's last attempt. A `HaltError` thrown by the
+ *   sensor stays a clean governance halt. The sensor's EXECUTION environment is the caller's: run untrusted /
+ *   model-generated checks in an isolated child process WITH A TIMEOUT — a sensor that hangs forever hangs the
+ *   leaf (no bareguard checkpoint fires between sensor start and return).
+ *   **`rejectedBuffer` (BA-14):** a SkillOpt-shaped rejected-attempt buffer — instead of only the LATEST critique,
+ *   surface the model's OWN prior failed attempts verbatim ("you wrote these, they failed X — write something
+ *   STRUCTURALLY DIFFERENT"). This is DIRECTED diversity (attack the specific repeated mistake), where escalation
+ *   is RANDOM diversity; the two are ANTAGONISTIC (`poc/ba14b-temp-with-buffer.mjs`: temperature monotonically
+ *   degrades the buffer, 100%→70%→50% across 0.2/0.7/1.0), so when the buffer engages the retry temperature is
+ *   HELD at `temperatures[0]` (flat-low), never escalated. `true` = force on (also on temperature-accepting
+ *   models); `false` = force off (pure BA-8 escalation); UNSET = ADAPTIVE — engage only once a prior attempt's
+ *   temperature was dropped (a temperature-fixed model, BA-10, where escalation is inert and the buffer is the
+ *   sole lever — `poc/ba14-rejected-buffer.mjs`: flat-temp 50%→100%). `receipts.refineLeaf.rejectedBuffer`
+ *   reports whether any iteration injected it. Bounded by `maxIterations` (the buffer never outgrows it).
  * @property {string} [contract] - Definition of done (A3). When present, the verifier grades against THIS,
  *   not the loose task, and verification always runs.
  * @property {(result: any, ctx: {contract: string|null, task: string}) => (Verdict|Promise<Verdict>)} [evaluate]
@@ -435,13 +524,26 @@ export type Slice = {
  * @property {Verdict|null} verdict
  * @property {boolean} incomplete
  * @property {boolean} halted
- * @property {string} [blocker] - (BA-11) set to `'governance-deny'` when this node stopped because its Loop
- *   short-circuited a consecutive-policy-deny spin (not a model failure). Mirrors `RecurseResult.blocker`.
+ * @property {string} [blocker] - Set when this node stopped for a specific non-model reason (mirrors
+ *   `RecurseResult.blocker`): `'governance-deny'` (BA-11) — its Loop short-circuited a consecutive-policy-deny
+ *   spin; `'broken-sensor'` (BA-15) — the caller's `refineLeaf.sensor` threw or returned a malformed verdict;
+ *   `'broken-verifier'` (BA-15) — the caller's `opts.evaluate` did (the default Evaluator path is never labeled).
+ * @property {string} [blockerDetail] - (BA-15) with a `broken-*` blocker: what the arbiter did (threw with
+ *   which message, or which malformed shape it returned) — the actionable half of the label.
+ * @property {{blocker: string, blockerDetail?: string, blockerTask?: string}} [blockerFrom] - (BA-15) a
+ *   DESCENDANT's blocker, surfaced here so an aggregating node still reports the fault upward. Deliberately
+ *   SEPARATE from this node's own `blocker` (which means "THIS node's arbiter/Loop broke"): stamping a
+ *   descendant's label onto every ancestor made the receipts tree accuse nodes whose sensor never ran, and
+ *   re-labelled a parent `governance-deny` when only one child was denied. `blockerTask` names the culprit.
  * @property {object|null} tokens - The worker Loop's `metrics.tokens`.
- * @property {{iterations: number, passed: boolean, temperatures: (number|null)[]}} [refineLeaf] - (BA-8) when this
- *   leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
+ * @property {{iterations: number, passed: boolean, temperatures: (number|null)[], rejectedBuffer: boolean}} [refineLeaf] - (BA-8) when
+ *   this leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
  *   passed (false = honest non-recovery, not a faked success). `temperatures` are the EFFECTIVE per-attempt temps
  *   (BA-10): a `null` marks an attempt the model ran at its DEFAULT because it rejected the requested temperature.
+ *   `rejectedBuffer` (BA-14): whether any iteration injected the rejected-attempt buffer (prior failed attempts
+ *   surfaced verbatim); when it engages the REQUESTED retry temperature is held flat at `temperatures[0]`, never
+ *   escalated (ba14b antagonism) — but a temperature-fixed model still drops it, so the EFFECTIVE temp recorded
+ *   above is `null`, not `temperatures[0]`.
  * @property {string|null} model
  * @property {string|null} [retrieval] - (§10 step 7) the retrieval mode this node ran (`scan`/`search`/`exact`),
  *   or null/absent for a plain reasoning node.
@@ -465,6 +567,18 @@ export type Slice = {
  * @property {string} [blocker] - Present when `incomplete` for a specific, actionable reason. `'governance-deny'`
  *   (BA-11): the worker's Loop short-circuited after N consecutive policy denials rather than burn to the
  *   budget cap — the caller can widen scope / re-gate / escalate instead of reading it as a model failure.
+ *   `'broken-sensor'` (BA-15): the caller's `refineLeaf.sensor` threw or returned a malformed verdict — the
+ *   ARBITER is faulty, not the model; fix the sensor and re-run (`receipts.blockerDetail` says what it did).
+ *   `'broken-verifier'` (BA-15): same fault class at the verify slot — the caller's `opts.evaluate` threw
+ *   (non-Halt) or returned a malformed verdict; the default Evaluator path is never labeled (its failures are
+ *   provider-class faults). For both `broken-*` blockers `best` preserves the model's last non-empty output
+ *   (BA-5) — the arbiter broke, so treat it as best-effort work rather than a graded pass.
+ * @property {string} [blockerDetail] - (BA-15) with a `broken-*` blocker: what the arbiter did — the
+ *   ACTIONABLE half of the label, surfaced on the result (not only in `receipts`) so a caller branching on
+ *   `blocker` can report the cause without walking the receipts tree.
+ * @property {string} [blockerTask] - (BA-15) when the blocker was INHERITED from a descendant in a nested run:
+ *   which sub-task actually broke. Without it a nested failure reports "a sensor broke" with no way to find
+ *   which one.
  * @property {RecurseNode} receipts - The audit node for this call (RC-10).
  */
 /**

package/src/recurse.js

@@ -216,7 +216,7 @@ function auditSafeCtx(ctx, overrides = {}) {
  *   TRUSTED run-state (paths/cwd); do NOT pass untrusted / end-user-controlled text here.
  * @property {ToolDef[]} [tools] - Handle tools offered to EVERY worker (RC-5 pull-default: litectx
  *   `recall`/`get`, wired at build step 7). Workers query on demand; never the whole corpus.
- * @property {{sensor: (result: any, ctx: {task: string, context: string|undefined, contract: string|null}) => (Verdict|Promise<Verdict>), maxIterations?: number, temperatures?: number[]}} [refineLeaf]
+ * @property {{sensor: (result: any, ctx: {task: string, context: string|undefined, contract: string|null}) => (Verdict|Promise<Verdict>), maxIterations?: number, temperatures?: number[], rejectedBuffer?: boolean}} [refineLeaf]
  *   (Opt-in, BA-8 / relayfact F17) Turn a DEFINITE LEAF (a node that is offered no `spawn_child` — `simple`
  *   tier or at `maxDepth`) into a bounded generate→sense→regenerate loop instead of a single pass, so a failed
  *   slice can self-correct. `sensor` is a DETERMINISTIC close (test/compile/lint — NOT a model judge, R-S8) that
@@ -225,13 +225,36 @@ function auditSafeCtx(ctx, overrides = {}) {
  *   (`temperatures`, default `[0.2,0.7,1.0]`) — the live-validated lever that lets a weak model escape a
  *   repeat-the-same-mistake rut (`poc/ba8-leaf-refine.mjs`: 0/5 → 2-3/5; flat temp recovers 0/5). On a
  *   temperature-fixed model (BA-10) the provider drops the param, `receipts.refineLeaf.temperatures` records
- *   `null`, and the fed-back gap critique carries recovery alone. `maxIterations` defaults to
+ *   `null`, and the fed-back gap critique carries recovery alone — UNLESS the rejected-attempt buffer engages
+ *   (below). `maxIterations` defaults to
  *   `temperatures.length`; the REAL bound is bareguard (each attempt is gate-checked + metered). CARRIES DOWN the
  *   tree (preserved by `forChild`), so it engages at the leaves of a Family-A decomposition. Recovery is PARTIAL
  *   (a stubborn blind spot may persist) — `receipts.refineLeaf.passed` reports honestly. Does NOT apply to a node
  *   that delegates (its children + the tree verify own quality), nor to the scan/fanout/partition dispatch paths.
  *   Absent ⇒ a leaf is a single pass (byte-identical to pre-BA-8). An error-keyed `recall` is the CALLER's tool
  *   (`opts.tools`) keyed off the fed-back critique — bareagent stays litectx-agnostic.
+ *   **Sensor integrity (RSI-learnings #1/#5, "audit the close"):** the `sensor` MUST judge the RETURNED result
+ *   (tamper-proof — e.g. build/run the returned string in an isolated context, as `poc/ba8-leaf-refine.mjs` does),
+ *   NEVER a worker side-effect a worker with edit tools could GAME (writing a passing file then returning junk, or
+ *   editing the failing test itself). A gameable close is the reward-hacking surface every RSI system in the field
+ *   got bitten by; the loop optimizes against WHATEVER the sensor reads, so keep it outside what the worker can write.
+ *   **Broken sensor ≠ failing model (BA-15):** a sensor that THROWS (non-Halt) or returns a MALFORMED verdict
+ *   (anything but `{pass: boolean}` or a valid tri-state `status`) is a faulty ARBITER — the loop stops at the
+ *   FIRST broken close (never retries against it) and returns a labeled `{incomplete, blocker:'broken-sensor'}`
+ *   (+ `receipts.blockerDetail`), with `best` preserving the model's last attempt. A `HaltError` thrown by the
+ *   sensor stays a clean governance halt. The sensor's EXECUTION environment is the caller's: run untrusted /
+ *   model-generated checks in an isolated child process WITH A TIMEOUT — a sensor that hangs forever hangs the
+ *   leaf (no bareguard checkpoint fires between sensor start and return).
+ *   **`rejectedBuffer` (BA-14):** a SkillOpt-shaped rejected-attempt buffer — instead of only the LATEST critique,
+ *   surface the model's OWN prior failed attempts verbatim ("you wrote these, they failed X — write something
+ *   STRUCTURALLY DIFFERENT"). This is DIRECTED diversity (attack the specific repeated mistake), where escalation
+ *   is RANDOM diversity; the two are ANTAGONISTIC (`poc/ba14b-temp-with-buffer.mjs`: temperature monotonically
+ *   degrades the buffer, 100%→70%→50% across 0.2/0.7/1.0), so when the buffer engages the retry temperature is
+ *   HELD at `temperatures[0]` (flat-low), never escalated. `true` = force on (also on temperature-accepting
+ *   models); `false` = force off (pure BA-8 escalation); UNSET = ADAPTIVE — engage only once a prior attempt's
+ *   temperature was dropped (a temperature-fixed model, BA-10, where escalation is inert and the buffer is the
+ *   sole lever — `poc/ba14-rejected-buffer.mjs`: flat-temp 50%→100%). `receipts.refineLeaf.rejectedBuffer`
+ *   reports whether any iteration injected it. Bounded by `maxIterations` (the buffer never outgrows it).
  * @property {string} [contract] - Definition of done (A3). When present, the verifier grades against THIS,
  *   not the loose task, and verification always runs.
  * @property {(result: any, ctx: {contract: string|null, task: string}) => (Verdict|Promise<Verdict>)} [evaluate]
@@ -290,13 +313,26 @@ function auditSafeCtx(ctx, overrides = {}) {
  * @property {Verdict|null} verdict
  * @property {boolean} incomplete
  * @property {boolean} halted
- * @property {string} [blocker] - (BA-11) set to `'governance-deny'` when this node stopped because its Loop
- *   short-circuited a consecutive-policy-deny spin (not a model failure). Mirrors `RecurseResult.blocker`.
+ * @property {string} [blocker] - Set when this node stopped for a specific non-model reason (mirrors
+ *   `RecurseResult.blocker`): `'governance-deny'` (BA-11) — its Loop short-circuited a consecutive-policy-deny
+ *   spin; `'broken-sensor'` (BA-15) — the caller's `refineLeaf.sensor` threw or returned a malformed verdict;
+ *   `'broken-verifier'` (BA-15) — the caller's `opts.evaluate` did (the default Evaluator path is never labeled).
+ * @property {string} [blockerDetail] - (BA-15) with a `broken-*` blocker: what the arbiter did (threw with
+ *   which message, or which malformed shape it returned) — the actionable half of the label.
+ * @property {{blocker: string, blockerDetail?: string, blockerTask?: string}} [blockerFrom] - (BA-15) a
+ *   DESCENDANT's blocker, surfaced here so an aggregating node still reports the fault upward. Deliberately
+ *   SEPARATE from this node's own `blocker` (which means "THIS node's arbiter/Loop broke"): stamping a
+ *   descendant's label onto every ancestor made the receipts tree accuse nodes whose sensor never ran, and
+ *   re-labelled a parent `governance-deny` when only one child was denied. `blockerTask` names the culprit.
  * @property {object|null} tokens - The worker Loop's `metrics.tokens`.
- * @property {{iterations: number, passed: boolean, temperatures: (number|null)[]}} [refineLeaf] - (BA-8) when this
- *   leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
+ * @property {{iterations: number, passed: boolean, temperatures: (number|null)[], rejectedBuffer: boolean}} [refineLeaf] - (BA-8) when
+ *   this leaf ran as a bounded refine loop: how many attempts it took and whether the deterministic sensor finally
  *   passed (false = honest non-recovery, not a faked success). `temperatures` are the EFFECTIVE per-attempt temps
  *   (BA-10): a `null` marks an attempt the model ran at its DEFAULT because it rejected the requested temperature.
+ *   `rejectedBuffer` (BA-14): whether any iteration injected the rejected-attempt buffer (prior failed attempts
+ *   surfaced verbatim); when it engages the REQUESTED retry temperature is held flat at `temperatures[0]`, never
+ *   escalated (ba14b antagonism) — but a temperature-fixed model still drops it, so the EFFECTIVE temp recorded
+ *   above is `null`, not `temperatures[0]`.
  * @property {string|null} model
  * @property {string|null} [retrieval] - (§10 step 7) the retrieval mode this node ran (`scan`/`search`/`exact`),
  *   or null/absent for a plain reasoning node.
@@ -321,6 +357,18 @@ function auditSafeCtx(ctx, overrides = {}) {
  * @property {string} [blocker] - Present when `incomplete` for a specific, actionable reason. `'governance-deny'`
  *   (BA-11): the worker's Loop short-circuited after N consecutive policy denials rather than burn to the
  *   budget cap — the caller can widen scope / re-gate / escalate instead of reading it as a model failure.
+ *   `'broken-sensor'` (BA-15): the caller's `refineLeaf.sensor` threw or returned a malformed verdict — the
+ *   ARBITER is faulty, not the model; fix the sensor and re-run (`receipts.blockerDetail` says what it did).
+ *   `'broken-verifier'` (BA-15): same fault class at the verify slot — the caller's `opts.evaluate` threw
+ *   (non-Halt) or returned a malformed verdict; the default Evaluator path is never labeled (its failures are
+ *   provider-class faults). For both `broken-*` blockers `best` preserves the model's last non-empty output
+ *   (BA-5) — the arbiter broke, so treat it as best-effort work rather than a graded pass.
+ * @property {string} [blockerDetail] - (BA-15) with a `broken-*` blocker: what the arbiter did — the
+ *   ACTIONABLE half of the label, surfaced on the result (not only in `receipts`) so a caller branching on
+ *   `blocker` can report the cause without walking the receipts tree.
+ * @property {string} [blockerTask] - (BA-15) when the blocker was INHERITED from a descendant in a nested run:
+ *   which sub-task actually broke. Without it a nested failure reports "a sensor broke" with no way to find
+ *   which one.
  * @property {RecurseNode} receipts - The audit node for this call (RC-10).
  */
 
@@ -566,16 +614,16 @@ async function recurse(task, ctx = {}, opts = {}) {
     const missingSlices = node.spawned.filter(c => c.incomplete).map(c => c.task);
     if (missingSlices.length > 0) {
       node.incomplete = true;
-      return { incomplete: true, best: result, missingSlices, receipts: node };
+      // BA-15: carry a child's blocker up, so a nested broken sensor still names itself at the top.
+      return incompleteWithBlocker(node, result, { missingSlices });
     }
 
     // Verify: a SEPARATE-context judge, never the generator grading itself. Runs when a contract is given, the
     // caller supplied a verifier, OR the task is critical (the forced-verify safety rail).
     const wantVerify = critical || typeof opts.contract === 'string' || typeof opts.evaluate === 'function';
     if (wantVerify) {
-      const verdict = await verify(task, result, ctx, opts);
-      node.verdict = verdict;
-      return { result, verdict, receipts: node };
+      // `return await` (not a bare `return`) is load-bearing here — see verifyOrBlock's JSDoc.
+      return await verifyOrBlock(task, result, ctx, opts, node);
     }
 
     return { result, verdict: null, receipts: node };
@@ -583,12 +631,221 @@ async function recurse(task, ctx = {}, opts = {}) {
     if (err instanceof HaltError) {
       node.halted = true;
       node.incomplete = true;
-      return { incomplete: true, best: result, receipts: node };
+      // BA-15: a halt AFTER the children ran (e.g. mid-synthesize) must still name a child's broken sensor —
+      // otherwise the caller reads a governance problem where their own arbiter crashed.
+      return incompleteWithBlocker(node, result);
     }
     throw err;
   }
 }
 
+/** Valid tri-state `Verdict.status` values a caller arbiter (sensor/verifier) may return in lieu of a boolean `pass`. */
+const SENSOR_STATUS = new Set(['satisfied', 'needs_revision', 'failed']);
+
+/**
+ * BA-15 — a TYPED signal that a caller arbiter (the `refineLeaf.sensor` or the `opts.evaluate` verifier)
+ * broke (threw non-Halt, or returned a malformed verdict). Classified by `instanceof` + `.tag`, NOT by
+ * re-parsing an `Error.message` prefix — so an intermediate layer that rewords the message (the exact class
+ * of the prior loop.js HaltError-wrapping bug) or a Loop/provider error whose text happens to begin
+ * `broken-sensor: ` can never be mis-labeled. Module-local: it is always thrown AND caught inside recurse.js
+ * (never propagates to a caller), so it needs no `errors.js` entry or public export.
+ */
+class BrokenArbiterError extends Error {
+  /**
+   * @param {'broken-sensor'|'broken-verifier'} tag - which seam broke.
+   * @param {string} detail - what the arbiter did (surfaced as `receipts.blockerDetail`).
+   * @param {{cause?: any}} [options] - `cause` preserves the original error (stack/type) for debugging.
+   */
+  constructor(tag, detail, options = {}) {
+    super(`${tag}: ${detail}`, options.cause !== undefined ? { cause: options.cause } : undefined);
+    this.name = 'BrokenArbiterError';
+    this.tag = tag;
+    this.detail = detail;
+  }
+}
+
+/**
+ * BA-15 — validate a caller arbiter's return at a close seam (the `refineLeaf.sensor` AND the caller
+ * `opts.evaluate` verifier). A verdict is well-formed iff it is an object carrying a boolean `pass` OR a
+ * valid tri-state `status` (the two shapes `refine`/callers branch on). Returns `null` when well-formed,
+ * else a short description of the malformation ("named, never coerced" — a garbage verdict otherwise reads
+ * as pass:false with critique:null at the sensor seam, or rides a converged-shaped return at the verify slot).
+ * @param {any} v
+ * @returns {string|null}
+ */
+function verdictShapeFault(v) {
+  if (v === null || typeof v !== 'object' || Array.isArray(v)) {
+    return `returned ${v === null ? 'null' : Array.isArray(v) ? 'an array' : `a ${typeof v}`}`;
+  }
+  // A PRESENT `pass` counts whatever its type (`1`/`0`/`'yes'` are a long-standing yes-no convention, and
+  // `refine` has always branched on its TRUTHINESS). BA-15 exists to catch a verdict carrying NO usable
+  // signal — not to reject one that answers clearly in a different dialect: demanding a strict boolean
+  // silently flipped previously-CONVERGING adopter sensors to a permanent first-attempt block.
+  if (v.pass != null || SENSOR_STATUS.has(v.status)) return null;
+  const keys = Object.keys(v).slice(0, 5).join(', ');
+  return `returned an object with neither a usable \`pass\` nor a valid \`status\` (keys: ${keys || 'none'})`;
+}
+
+/** Upper bound on a `blockerDetail` fragment — it rides into receipts and, via a wired gate, onto disk. */
+const DETAIL_MAX = 200;
+
+/**
+ * BA-15 — a readable one-liner for ANYTHING thrown by a caller arbiter. `String(err)` on a non-Error throw
+ * (a test harness rejecting with a raw `{code:'ENOENT', path}` result is the common case) yields the useless
+ * `[object Object]`, defeating `blockerDetail`'s entire purpose: naming what broke so the operator can fix it.
+ * @param {any} err
+ * @returns {string}
+ */
+function describeThrown(err) {
+  const clamp = (s) => (s.length > DETAIL_MAX ? `${s.slice(0, DETAIL_MAX)}… (truncated)` : s);
+  if (err instanceof Error && typeof err.message === 'string' && err.message) return clamp(err.message);
+  if (err === null || typeof err !== 'object') return clamp(String(err));
+  // Deliberately NOT a whole-object dump. A thrown non-Error is typically a spawn/exec RESULT, which routinely
+  // carries a full stdout buffer and an env snapshot — and `blockerDetail` rides into `receipts`, which a wired
+  // gate serializes VERBATIM into a plaintext audit log (the F16/BA-1 lesson: never let caller data of unknown
+  // shape reach the audit unfiltered). Take only the conventional diagnostic fields, clamped.
+  try {
+    const picked = ['name', 'code', 'errno', 'syscall', 'path', 'status', 'signal', 'message']
+      .filter(k => typeof err[k] === 'string' || typeof err[k] === 'number')
+      .map(k => `${k}=${String(err[k])}`)
+      .join(' ');
+    if (picked) return clamp(picked);
+  } catch { /* a throwing accessor / Proxy trap — fall through to the type tag */ }
+  return Object.prototype.toString.call(err);
+}
+
+/**
+ * BA-15 — run a caller arbiter (the `refineLeaf.sensor` or the `opts.evaluate` verifier) and NAME a broken one
+ * rather than let it launder. A non-`HaltError` throw or a malformed return (per {@link verdictShapeFault}) is
+ * re-thrown as a typed {@link BrokenArbiterError} the call sites classify by `instanceof` + `.tag` (NEVER by
+ * re-parsing the message text); a `HaltError` passes straight through (clean
+ * governance exit, BA-2). One helper so the sensor and verifier seams stay byte-identical (same guidance
+ * string, same fault taxonomy) — a divergence between them was the copy-paste risk this replaces.
+ * A verdict that carries a valid `status` but no boolean `pass` is NORMALIZED to add `pass = status ===
+ * 'satisfied'` (the same derivation as `evaluator.js`): the advertised `{status}` contract must actually
+ * WORK — `refine.js` stops the leaf on `verdict.pass`, so a bare `{status:'satisfied'}` would otherwise never
+ * satisfy, burn every iteration, and report `passed:false` (a satisfied close mislabeled as non-recovery).
+ * @template {{pass?: boolean, status?: string}} T
+ * @param {'broken-sensor'|'broken-verifier'} tag - the fault channel, carried on the thrown error's `.tag`.
+ * @param {() => (T | Promise<T>)} call - invokes the arbiter (already bound to its result/ctx args).
+ * @returns {Promise<T>} the arbiter's well-formed verdict (with `pass` derived from `status` when absent).
+ */
+async function runArbiter(tag, call) {
+  const who = tag === 'broken-sensor' ? 'sensor' : 'evaluate';
+  const shape = `a ${who === 'sensor' ? 'sensor' : 'verifier'} must return {pass} or {status: 'satisfied'|'needs_revision'|'failed'}`;
+  /** A throw from the arbiter's own body (sync or async rejection) — "the sensor threw". */
+  const threw = (err) => {
+    if (err instanceof HaltError || err instanceof BrokenArbiterError) return err;
+    // `cause` keeps the original error (stack + type) reachable for debugging; `detail` stays the short label.
+    return new BrokenArbiterError(tag, `${who} threw: ${describeThrown(err)}`, { cause: err });
+  };
+  /** A throw from READING the value the arbiter returned — "the verdict is unreadable", a different fault. */
+  const unreadable = (err) => {
+    if (err instanceof HaltError || err instanceof BrokenArbiterError) return err;
+    return new BrokenArbiterError(tag, `${who} returned a verdict whose properties could not be read: ${describeThrown(err)} — ${shape}`, { cause: err });
+  };
+
+  // Typed `any` deliberately: this block probes an UNTRUSTED caller return (it may be a promise, a plain
+  // verdict, or a hostile Proxy), so the generic `T | Promise<T>` narrowing does not apply until it is settled.
+  /** @type {any} */
+  let raw;
+  try {
+    raw = call();
+  } catch (err) { throw threw(err); }
+
+  // `await`ing directly would conflate two different faults: the await PROBES `.then` on the returned value,
+  // so an accessor-backed/Proxy verdict throws during the await and gets reported as "the sensor threw" —
+  // sending the operator hunting a `throw` in a sensor that returned perfectly normally. Probe the thenable
+  // separately (a throw HERE is the returned value being unreadable) and only then await (a rejection THERE
+  // is genuinely the arbiter's body failing).
+  let thenable;
+  try {
+    thenable = raw !== null && (typeof raw === 'object' || typeof raw === 'function') && typeof raw.then === 'function';
+  } catch (err) { throw unreadable(err); }
+
+  /** @type {any} */
+  let v = raw;
+  if (thenable) {
+    try {
+      v = await raw;
+    } catch (err) { throw threw(err); }
+  }
+  // The SHAPE INSPECTION is guarded SEPARATELY: reading `.status`/`.pass`/`Object.keys` on a returned Proxy or
+  // accessor-backed object can itself throw. Unguarded that escapes untyped (the very uncaught crash this seam
+  // prevents, one step later) — but folding it into the call's own catch is also wrong: it reports "the sensor
+  // threw" for a sensor that RETURNED NORMALLY, sending the operator hunting a `throw` that does not exist.
+  // The fault is in the returned VALUE, so it is named as such.
+  try {
+    const fault = verdictShapeFault(v);
+    if (fault) throw new BrokenArbiterError(tag, `${who} ${fault} — ${shape}`);
+    // Derive `pass` from a status-only verdict so the advertised `{status}` shape actually gates `refine`, which
+    // branches on `verdict.pass`. NEVER mutate the caller's object — and never flatten it either: an object
+    // spread copies OWN enumerable properties only, so a class-instance verdict whose `status`/`critique` are
+    // PROTOTYPE getters passes the shape check above and then comes out the other side with those fields
+    // ERASED (critique lost ⇒ every retry re-sends the plain task with zero feedback — the exact burn BA-15
+    // exists to prevent). Copy descriptors onto the SAME prototype so accessor-backed fields survive.
+    if (v.pass == null && typeof v.status === 'string') {
+      const copy = Object.create(Object.getPrototypeOf(v), Object.getOwnPropertyDescriptors(v));
+      Object.defineProperty(copy, 'pass', {
+        value: v.status === 'satisfied', writable: true, enumerable: true, configurable: true,
+      });
+      return /** @type {T} */ (copy);
+    }
+    return v;
+  } catch (err) { throw unreadable(err); }
+}
+
+/**
+ * BA-15 — surface a CHILD's blocker at the PARENT. A nested tree aggregates a dead child into
+ * `{incomplete, missingSlices}`; without this the child's `broken-sensor` (or `governance-deny`) label is
+ * dropped at the first parent, so a top-level caller branching on `result.blocker` sees nothing and debugs
+ * the model instead of its own sensor — the exact laundering BA-15 exists to close, reintroduced one level up.
+ * `broken-sensor` wins over `governance-deny`: it names a fault in the CALLER's own code, which is both more
+ * actionable and cheaper to fix than a gate decision.
+ *
+ * `blockerTask` names WHICH descendant broke. Without it a nested run reports "a sensor broke" with no way to
+ * find which one — half a fix. (It is also why the label is NOT stamped onto the parent's own `blocker`; see
+ * {@link incompleteWithBlocker}.)
+ *
+ * `'broken-verifier'` is deliberately NOT matched here: `forChild` strips `evaluate`, so a child never runs a
+ * caller verifier and no child node can carry that label. Matching it would be unreachable code asserting a
+ * capability that does not exist.
+ * @param {RecurseNode[]} spawned - this node's child receipts.
+ * @returns {{blocker: string, blockerDetail?: string, blockerTask?: string}|null}
+ */
+function inheritedBlocker(spawned) {
+  const pick = spawned.find(c => c.incomplete && c.blocker === 'broken-sensor')
+    || spawned.find(c => c.incomplete && c.blocker);
+  if (!pick || !pick.blocker) return null;
+  return {
+    blocker: pick.blocker,
+    ...(pick.blockerDetail && { blockerDetail: pick.blockerDetail }),
+    ...(pick.task && { blockerTask: pick.task }),
+  };
+}
+
+/**
+ * BA-15 — the ONE shared "this node is incomplete because a descendant was" return. Used by every aggregating
+ * path (worker / partition / fanout) on BOTH its `missingSlices` branch AND its `HaltError` catch: the halt
+ * branches originally skipped the inherit entirely, so a gate tripping AFTER a broken-sensor child (e.g. mid-
+ * synthesize) dropped the label and the caller read a governance problem where their own sensor had crashed.
+ *
+ * The inherited label rides the RETURNED result (the caller-facing API — that surfacing is the whole point)
+ * but is recorded on the node as `blockerFrom`, NOT by overwriting `node.blocker`. `node.blocker` means "THIS
+ * node's own arbiter/Loop broke"; stamping a descendant's label onto every ancestor made the receipts tree
+ * accuse nodes whose sensor never ran, and re-labelled a parent `governance-deny` when only one child was
+ * denied — pointing the operator at the wrong node to re-gate.
+ * @param {RecurseNode} node
+ * @param {any} best
+ * @param {{missingSlices?: string[]}} [extra] - extra fields for the non-halt aggregation branch.
+ * @returns {RecurseResult}
+ */
+function incompleteWithBlocker(node, best, extra = {}) {
+  const inherited = inheritedBlocker(node.spawned);
+  if (inherited) node.blockerFrom = inherited;
+  return /** @type {RecurseResult} */ ({ incomplete: true, best, ...extra, ...(inherited || {}), receipts: node });
+}
+
 /**
  * BA-8 leaf-refine — run a DEFINITE leaf as a bounded generate→sense→regenerate loop (relayfact F17). Reuses the
  * existing `refine.js` primitive (the Outcomes iterate→grade→revise port): each attempt is a FRESH leaf Loop
@@ -608,10 +865,25 @@ async function recurse(task, ctx = {}, opts = {}) {
 async function recurseRefineLeaf(task, ctx, opts, state) {
   const { provider, system, handleTools, depth, critical, node, sensor } = state;
   node.model = provider.model || null;
-  const cfg = /** @type {{maxIterations?: number, temperatures?: number[]}} */ (opts.refineLeaf || {});
+  const cfg = /** @type {{maxIterations?: number, temperatures?: number[], rejectedBuffer?: boolean}} */ (opts.refineLeaf || {});
   const temps = Array.isArray(cfg.temperatures) && cfg.temperatures.length ? cfg.temperatures : DEFAULT_REFINE_TEMPS;
   const maxIterations = Number.isInteger(cfg.maxIterations) && /** @type {number} */ (cfg.maxIterations) > 0
     ? /** @type {number} */ (cfg.maxIterations) : temps.length;
+  // BA-14 rejected-attempt buffer: surface the model's OWN prior failed attempts verbatim ("you wrote these,
+  // they failed X — write something DIFFERENT") — a SkillOpt-shaped directed-diversity lever. `rejectedBuffer`:
+  // `true` = force on (also on temperature-accepting models); `false` = force off; unset = ADAPTIVE (engage only
+  // once a prior attempt's temperature was DROPPED, i.e. a temperature-fixed model where BA-8 escalation is inert
+  // and the buffer is the only lever — ba14 D>C). Escalation and the buffer are ANTAGONISTIC (ba14b: temp
+  // monotonically degrades the buffer 100→70→50% across 0.2/0.7/1.0), so when the buffer engages we HOLD temps[0].
+  const bufferForced = cfg.rejectedBuffer === true;
+  const bufferDisabled = cfg.rejectedBuffer === false;
+  let bufferUsed = false; // receipt: did any iteration actually inject the ledger?
+  const LEDGER_ENTRY_CAP = 600, LEDGER_WHY_CAP = 400;
+  const formatLedger = (/** @type {Array<{result: any, verdict: any}>} */ history) => history.map((h, i) => {
+    const code = String(h.result == null ? '' : h.result).replace(/```[a-zA-Z]*\n?/g, '').trim().slice(0, LEDGER_ENTRY_CAP);
+    const why = h.verdict && typeof h.verdict.critique === 'string' ? h.verdict.critique.slice(0, LEDGER_WHY_CAP) : '';
+    return `--- Rejected attempt ${i + 1} (already failed — do NOT reproduce) ---\n${code}${why ? `\nFailed: ${why}` : ''}`;
+  }).join('\n\n');
 
   // A refine leaf runs N Loops, so its receipts.tokens SUMS every attempt's spend (not just the last) — the
   // honest cost of the node. The 4-tier tokens object (`{input,output,cacheCreation,cacheRead}`, loop.js) is flat
@@ -630,10 +902,23 @@ async function recurseRefineLeaf(task, ctx, opts, state) {
   // a dropped attempt is stored as `null` ("provider default"). Indexed by iteration (refine calls once each).
   /** @type {(number|null)[]} */
   const effectiveTemps = [];
+  // BA-15/BA-5: the last attempt's text, kept OUTSIDE refine so a broken-sensor stop can still preserve the
+  // model's work — when the ARBITER breaks, the work was never judged; destroying it would punish the model
+  // for the caller's fault (refine's own history is lost on the throw).
+  /** @type {string|null} */
+  let lastAttemptText = null;
   // One attempt = a fresh leaf Loop (no spawn tool: a retry is a direct correction, not a re-decomposition) at the
   // iteration's temperature, with the GAP fed forward as fresh feedback. A governance halt → throw so refine stops.
-  const attempt = async ({ iteration, critique }) => {
-    const temperature = temps[Math.min(iteration, temps.length - 1)];
+  const attempt = async ({ iteration, critique, history }) => {
+    const hist = Array.isArray(history) ? history : [];
+    // ADAPTIVE trigger: a prior attempt whose temperature the model rejected (BA-10) records `null` in
+    // effectiveTemps → escalation is inert on this (temperature-fixed) model, so engage the buffer. Forced-on
+    // engages regardless (incl. temperature-accepting models). Needs ≥1 prior attempt to have something to buffer.
+    const tempDropped = effectiveTemps.some((t) => t === null);
+    const useBuffer = hist.length > 0 && !bufferDisabled && (bufferForced || tempDropped);
+    // ba14b: temperature is antagonistic to the buffer's directed diversity — HOLD temps[0] when it engages;
+    // otherwise escalate (BA-8, the no-memory lever). On a temperature-fixed model both collapse to the default.
+    const temperature = useBuffer ? temps[0] : temps[Math.min(iteration, temps.length - 1)];
     const loop = new Loop({
       provider, system,
       policy: ctx.policy || undefined,
@@ -642,24 +927,44 @@ async function recurseRefineLeaf(task, ctx, opts, state) {
       throwOnError: false,
     });
     const base = withContext(task, opts.context);
-    const userText = critique
-      ? `${base}\n\nYour previous attempt FAILED these checks:\n${critique}\n\nReturn a corrected result that passes ALL of them.`
-      : base;
+    let userText;
+    if (useBuffer) {
+      bufferUsed = true;
+      userText = `${base}\n\nYou have already tried the following and each FAILED. Do NOT reproduce them — write a STRUCTURALLY DIFFERENT result that passes ALL checks:\n\n${formatLedger(hist)}`;
+    } else if (critique) {
+      userText = `${base}\n\nYour previous attempt FAILED these checks:\n${critique}\n\nReturn a corrected result that passes ALL of them.`;
+    } else {
+      userText = base;
+    }
     const out = await loop.run([{ role: 'user', content: userText }], handleTools, { ctx: auditSafeCtx(ctx, { depth }), temperature });
     // `temperatureDropped` is set on the Loop result only when the model rejected the requested temperature
     // (BA-10); it's absent on the error/halt return shapes, so read it through a narrow cast.
     const dropped = /** @type {{temperatureDropped?: boolean}} */ (out).temperatureDropped;
     effectiveTemps[iteration] = dropped ? null : temperature;
     accrueTokens(out.metrics ? out.metrics.tokens : null);
+    // BA-5: capture BEFORE the throws. The Loop returns its last non-empty text on EVERY terminating path
+    // (halt/deny/truncation/refusal), so a throw placed above this line would discard the text of the very
+    // attempt that terminated — leaving `best:null` on a FIRST-attempt halt, the exact loss the catch-branch
+    // preservation exists to prevent. (Caught by review: the earlier tests only halted on attempt 2, where a
+    // prior clean attempt had already populated this.)
+    lastAttemptText = out.text || lastAttemptText;
     if (typeof out.error === 'string' && out.error.startsWith('halt:')) throw new HaltError('refine-leaf attempt halted', { rule: out.error.slice('halt:'.length) });
     if (out.error) throw new Error(out.error); // a non-halt worker fault → honest incomplete
     return out.text;
   };
 
+  // BA-15: the sensor call is WRAPPED (via runArbiter) so a broken arbiter is NAMED, never coerced. A non-Halt
+  // throw (the caller's test runner crashed — ENOENT, syntax error in the harness) and a malformed return are
+  // the same fault class: "didn't judge", which must never collapse into "judged-and-failed" (the model's
+  // fault) or a bare {incomplete} (indistinguishable from a provider death). The throw stops refine at the
+  // FIRST broken close — retrying against a broken arbiter burns every remaining attempt for nothing (each
+  // retry would carry critique:null, i.e. the plain task again). HaltError passes through (governance, BA-2).
+  const evaluate = (result, c) => runArbiter('broken-sensor', () => sensor(result, { task, context: opts.context, contract: c.contract }));
+
   try {
     const outcome = await refine({
       attempt,
-      evaluate: (result, c) => sensor(result, { task, context: opts.context, contract: c.contract }),
+      evaluate,
       contract: typeof opts.contract === 'string' ? opts.contract : undefined,
       maxIterations,
     });
@@ -667,35 +972,59 @@ async function recurseRefineLeaf(task, ctx, opts, state) {
     // `temperatures` = the EFFECTIVE temps (BA-10): a `null` marks an attempt whose requested temperature the
     // model rejected and ran at its default — so the receipt never claims a value the model ignored. On a
     // temperature-accepting model this equals the requested `temps.slice(0, iterations)` (byte-identical receipt).
-    node.refineLeaf = { iterations: outcome.iterations, passed: !!(outcome.verdict && outcome.verdict.pass), temperatures: effectiveTemps.slice(0, outcome.iterations) };
+    node.refineLeaf = { iterations: outcome.iterations, passed: !!(outcome.verdict && outcome.verdict.pass), temperatures: effectiveTemps.slice(0, outcome.iterations), rejectedBuffer: bufferUsed };
     const result = outcome.result;
 
     // Optional rubric layer on top of the deterministic sensor (RC-7): forced for critical, or a contract/override.
     const wantVerify = critical || typeof opts.contract === 'string' || typeof opts.evaluate === 'function';
     if (wantVerify) {
-      const verdict = await verify(task, result, ctx, opts);
-      node.verdict = verdict;
-      return { result, verdict, receipts: node };
+      // `return await` (not a bare `return`) is load-bearing here — see verifyOrBlock's JSDoc.
+      return await verifyOrBlock(task, result, ctx, opts, node);
     }
     // No rubric layer ⇒ the sensor's final verdict IS the node verdict (a non-pass is surfaced, not hidden).
     node.verdict = outcome.verdict || null;
     return { result, verdict: outcome.verdict || null, receipts: node };
   } catch (err) {
     node.tokens = tokensSum; // record whatever attempts DID spend, on both the halt and fault paths
+    // The refineLeaf receipt must ride EVERY terminating path, not just the clean one (same invariant as BA-10's
+    // `temperatureDropped`): a leaf that ran attempts then halted/faulted still spent tokens and may have engaged
+    // the buffer. `effectiveTemps[iteration]` is set BEFORE each attempt's throw, so it reflects every attempt made.
+    // NOT unconditional: the refine loop may have COMPLETED (receipt already written, possibly `passed:true`) and
+    // the throw come from the verify layer below it — clobbering that to `passed:false` would report a sensor that
+    // never closed when it did, misattributing a verify-slot halt to a non-converging leaf.
+    if (!node.refineLeaf) {
+      node.refineLeaf = { iterations: effectiveTemps.length, passed: false, temperatures: effectiveTemps.slice(), rejectedBuffer: bufferUsed };
+    }
+    // BA-5: EVERY terminating branch preserves the model's last non-empty attempt (`lastAttemptText`), never
+    // `null` — matching the plain-worker path (`best: out.text || null`) and the "bounds PRESERVE work"
+    // invariant. A refine leaf is the sole cross-attempt text channel in a ralph-style retry; dropping it on a
+    // halt/deny/fault (as this path did pre-BA-15) loses attempt N's only bridge to attempt N+1.
     if (err instanceof HaltError) {
       node.halted = true;
       node.incomplete = true;
-      return { incomplete: true, best: null, receipts: node };
+      return { incomplete: true, best: lastAttemptText, receipts: node };
     }
     // BA-11: a deny-spin inside a refine attempt (the Loop short-circuited after N consecutive governance
     // denials, rethrown at recurse.js as `denied:<tool>`) is a LABELED governance block, not a model fault.
     if (typeof err?.message === 'string' && err.message.startsWith('denied:')) {
       node.incomplete = true;
       node.blocker = 'governance-deny';
-      return { incomplete: true, best: null, blocker: 'governance-deny', receipts: node };
+      return { incomplete: true, best: lastAttemptText, blocker: 'governance-deny', receipts: node };
+    }
+    // BA-15: the caller's SENSOR broke — a faulty arbiter, not a model failure. Named (like BA-11's
+    // governance-deny) so the caller fixes the sensor instead of debugging the model; `best` preserves the
+    // model's last non-empty attempt (BA-5) — the arbiter, not the model, is at fault.
+    if (err instanceof BrokenArbiterError && err.tag === 'broken-sensor') {
+      node.incomplete = true;
+      node.blocker = 'broken-sensor';
+      node.blockerDetail = err.detail;
+      // `blockerDetail` rides the RESULT too, not just receipts: it is the actionable half of the label (WHAT
+      // the sensor did), and a parent reading a child's return — or a caller branching on the documented
+      // `{blocker}` shape — should not have to walk the receipts tree to get it.
+      return { incomplete: true, best: lastAttemptText, blocker: 'broken-sensor', blockerDetail: err.detail, receipts: node };
     }
     node.incomplete = true;
-    return { incomplete: true, best: null, receipts: node };
+    return { incomplete: true, best: lastAttemptText, receipts: node };
   }
 }
 
@@ -746,6 +1075,10 @@ async function recurseScan(task, ctx, opts, state) {
     };
   }
 
+  // BA-5: hoisted so a halt thrown BELOW the scan (e.g. from the verify slot) still returns the finished,
+  // code-counted result as `best` instead of destroying it — re-running a scan re-pays every window judge call.
+  /** @type {{count: number, matchedIds: string[]}|null} */
+  let scanResult = null;
   try {
     const scan = await scanCount(task, corpus, {
       provider,
@@ -758,6 +1091,7 @@ async function recurseScan(task, ctx, opts, state) {
     node.scan = { window: scan.window, passes: scan.passes, scanned: scan.scanned, matched: scan.count };
     // Structured, CODE-counted result — the count is authoritative; matchedIds carry the evidence (RC-10).
     const result = { count: scan.count, matchedIds: scan.matchedIds };
+    scanResult = result;
 
     // RC-9: a dead window means we did NOT see every slice → the count is a floor, not the answer. Report it
     // incomplete with the partial as `best`, never a clean pass over a hole.
@@ -770,16 +1104,21 @@ async function recurseScan(task, ctx, opts, state) {
     // structured count against the goal/contract (an isolated grader, never the scanner itself).
     const wantVerify = critical || typeof opts.contract === 'string' || typeof opts.evaluate === 'function';
     if (wantVerify) {
-      const verdict = await verify(task, result, ctx, opts);
-      node.verdict = verdict;
-      return { result, verdict, receipts: node };
+      // `return await` (not a bare `return`) is load-bearing here — see verifyOrBlock's JSDoc.
+      return await verifyOrBlock(task, result, ctx, opts, node);
     }
     return { result, verdict: null, receipts: node };
   } catch (err) {
     if (err instanceof HaltError) {
       node.halted = true;
       node.incomplete = true;
-      return { incomplete: true, best: null, receipts: node };
+      // BA-5, PARTIAL by construction: a halt from the VERIFY slot lands here with the scan already finished,
+      // so the counted result is returned instead of null (it previously survived only in receipts, forcing a
+      // full re-scan). A halt DURING `scanCount` — the likelier case, since a token cap trips after many window
+      // judge calls — still yields `null`: `scanCount` throws without surfacing the windows it did judge, so
+      // there is nothing here to preserve. Fixing that needs `scanCount` to return its partial union on halt
+      // (a retrieval-side change, not this seam's); tracked as a known limit rather than papered over here.
+      return { incomplete: true, best: scanResult, receipts: node };
     }
     throw err;
   }
@@ -837,6 +1176,8 @@ async function recursePartition(task, ctx, opts, state) {
   // (never `undefined`) across every dispatch path.
 
   const childResults = [];
+  /** @type {{count: number, matchedIds: string[]}|null} */
+  let partitionResult = null;
   try {
     // 2b) Pre-wave checkpoint — width (the cost) is now known. A governance HaltError halts BEFORE any worker
     //     spends (bounds the burst to zero); a plain deny is advisory (allowlist-safe), same contract as fanout.
@@ -881,25 +1222,30 @@ async function recursePartition(task, ctx, opts, state) {
       if (child.incomplete) missingSlices.push(label);
     }
     const result = { count: matched.size, matchedIds: [...matched] };
+    partitionResult = result; // BA-5: a halt below this (e.g. verify) returns the full result, not a count-only rebuild
     node.partition.matched = matched.size;
 
     if (missingSlices.length > 0) {
       node.incomplete = true;
-      return { incomplete: true, best: result, missingSlices, receipts: node };
+      // BA-15: carry a child's blocker up (see inheritedBlocker).
+      return incompleteWithBlocker(node, result, { missingSlices });
     }
     const wantVerify = critical || typeof opts.contract === 'string' || typeof opts.evaluate === 'function';
     if (wantVerify) {
-      const verdict = await verify(task, result, ctx, opts);
-      node.verdict = verdict;
-      return { result, verdict, receipts: node };
+      // `return await` (not a bare `return`) is load-bearing here — see verifyOrBlock's JSDoc.
+      return await verifyOrBlock(task, result, ctx, opts, node);
     }
     return { result, verdict: null, receipts: node };
   } catch (err) {
     if (err instanceof HaltError) {
       node.halted = true;
       node.incomplete = true;
-      const best = childResults.length ? { count: new Set(childResults.flatMap((v) => (v && Array.isArray(v.matchedIds) ? v.matchedIds : []))).size } : null;
-      return { incomplete: true, best, receipts: node };
+      // Prefer the finished result (a halt from the verify slot lands here with it already computed); else
+      // rebuild a best-effort count from whatever slices did return (BA-5, never a bare null).
+      const best = partitionResult
+        || (childResults.length ? { count: new Set(childResults.flatMap((v) => (v && Array.isArray(v.matchedIds) ? v.matchedIds : []))).size } : null);
+      // BA-15: a halt must not swallow a child's broken-sensor label (see incompleteWithBlocker).
+      return incompleteWithBlocker(node, best);
     }
     throw err;
   }
@@ -933,6 +1279,11 @@ async function recurseFanout(task, ctx, opts, state) {
 
   const childResults = [];
   const contract = typeof opts.contract === 'string' ? opts.contract : null;
+  // BA-5: declared OUTSIDE the try so a halt from the verify slot (which lands in the catch below, with the
+  // reduce already computed and PAID FOR) returns the finished reduce instead of a lossy re-join of the raw
+  // child strings — a different TYPE from the documented reduce output, and an 'merge' strategy's LLM call
+  // thrown away. Mirrors `scanResult`/`partitionResult` on the sibling paths.
+  let result;
 
   try {
     // 1) Decompose into exactly `count` independent parallel steps (the NB-2 Planner seam). A non-Halt planner
@@ -1003,7 +1354,6 @@ async function recurseFanout(task, ctx, opts, state) {
     // 4) NB-3 reduce over the slice results. Unlike Family A there is no parent closing turn, so we ALWAYS
     //    reduce: a `synthesize` FUNCTION is the deterministic code-reduce (§9.1); a string runs the built-in
     //    reducer; unset defaults to lossless `'concat'`. (`childResults` always has `count` entries.)
-    let result;
     if (typeof opts.synthesize === 'function') {
       result = await opts.synthesize({ task, text: null, results: childResults, children: node.spawned, ctx });
     } else {
@@ -1023,24 +1373,27 @@ async function recurseFanout(task, ctx, opts, state) {
     // 5) Honest completeness (RC-9): any missing slice → incomplete, with the partial reduce as `best`.
     if (missingSlices.length > 0) {
       node.incomplete = true;
-      return { incomplete: true, best: result, missingSlices, receipts: node };
+      // BA-15: carry a child's blocker up (see inheritedBlocker).
+      return incompleteWithBlocker(node, result, { missingSlices });
     }
 
     // 6) Verify (RC-7): forced for critical, or when a contract/override is supplied.
     const wantVerify = critical || contract != null || typeof opts.evaluate === 'function';
     if (wantVerify) {
-      const verdict = await verify(task, result, ctx, opts);
-      node.verdict = verdict;
-      return { result, verdict, receipts: node };
+      // `return await` (not a bare `return`) is load-bearing here — see verifyOrBlock's JSDoc.
+      return await verifyOrBlock(task, result, ctx, opts, node);
     }
     return { result, verdict: null, receipts: node };
   } catch (err) {
     if (err instanceof HaltError) {
       node.halted = true;
       node.incomplete = true;
-      // best-effort partial: whatever slices we did collect, losslessly joined (no LLM — the gate already tripped)
-      const best = childResults.length ? childResults.filter(v => v !== '').join('\n\n') : null;
-      return { incomplete: true, best: best || null, receipts: node };
+      // BA-5: prefer the FINISHED reduce when the halt landed after it (the verify slot); only fall back to a
+      // lossless join of the raw slices when the halt tripped before/during the reduce itself. Never a bare null.
+      const rejoined = childResults.length ? childResults.filter(v => v !== '').join('\n\n') : null;
+      const best = result !== undefined ? result : (rejoined || null);
+      // BA-15: a halt must not swallow a child's broken-sensor label (see incompleteWithBlocker).
+      return incompleteWithBlocker(node, best);
     }
     throw err;
   }
@@ -1107,6 +1460,16 @@ function buildSpawnTool(ctx, opts, depth, maxDepth, node, childResults) {
       // silently dropped or faked. The same declared value is collected for the NB-3 reducer.
       const value = child.incomplete ? (child.best == null ? '' : child.best) : (child.result == null ? '' : child.result);
       childResults.push(value);
+      // BA-15: a child blocked by a BROKEN ARBITER must not read to the parent model as a generic failure.
+      // Collapsed into a bare `[incomplete]`, the parent cannot tell "the model failed" from "the judge is
+      // broken", so it re-spawns the identical subtask against the identical broken sensor — re-running a
+      // full leaf attempt each time, up to the Loop's round limit. That is BA-15's own spend-burn ("retrying
+      // against a broken arbiter carries zero feedback") reintroduced one level up, so the tool result says
+      // so explicitly and tells the model not to retry.
+      if (child.incomplete && child.blocker === 'broken-sensor') {
+        const where = child.blockerTask ? ` (in sub-task: ${child.blockerTask})` : '';
+        return `[blocked: broken-sensor] The CHECK that judges this subtask is itself broken${where} — ${child.blockerDetail || 'no detail available'}. Retrying will hit the same broken check: do NOT re-delegate this subtask; report it as blocked. Partial output: ${String(value)}`.trim();
+      }
       if (child.incomplete) return `[incomplete] ${String(value)}`.trim();
       return String(value);
     },
@@ -1130,7 +1493,19 @@ function verify(task, result, ctx, opts) {
   // and an agentic critic needs the path to exercise the artifact. A caller `evaluate` gets the RAW task (it owns
   // its own context); only the default isolated grader is contextualized.
   if (typeof opts.evaluate === 'function') {
-    return Promise.resolve(opts.evaluate(result, { contract, task }));
+    // BA-15 (verifier seam): the CALLER-supplied verifier is wrapped exactly like the refineLeaf sensor — a
+    // non-Halt throw or a malformed return is a faulty ARBITER, tagged so the call sites label it (pre-fix a
+    // throw crashed the whole run on the plain-worker path / laundered to a bare {incomplete} under refineLeaf,
+    // and a garbage verdict rode a CONVERGED-shaped {result, verdict} out). The default Evaluator path below is
+    // NOT wrapped: it constructs well-formed Verdicts by design, and its failures are provider-class faults.
+    // Capture the narrowed reference in a const: `typeof opts.evaluate === 'function'` does NOT survive into the
+    // nested async closure (TS re-widens `opts.evaluate` to possibly-undefined there → TS2722/TS18048).
+    // BOUND to `opts`, because a bare `const evaluate = opts.evaluate` DETACHES the method: the call used to be
+    // `opts.evaluate(...)` (receiver `opts`), and a caller passing a class method (`evaluate: grader.check`)
+    // would suddenly get `this === undefined` and throw on its first `this.x` read — a working (if degraded)
+    // integration flipped to a hard `broken-verifier` by an unrelated typecheck fix.
+    const evaluate = opts.evaluate.bind(opts);
+    return runArbiter('broken-verifier', () => evaluate(result, { contract, task }));
   }
   const provider = ctx.provider || opts.provider;
   const evaluator = new Evaluator({ provider });
@@ -1145,4 +1520,39 @@ function verify(task, result, ctx, opts) {
   );
 }
 
+/**
+ * BA-15 (verifier seam) — run the verify slot, converting a `BrokenArbiterError` into a LABELED
+ * `{ incomplete, blocker:'broken-verifier' }` return with `best` preserving the result the arbiter failed to
+ * judge (BA-5: the work exists — best-effort, not a graded pass). One helper so all five dispatch paths (worker /
+ * refineLeaf / scan / partition / fanout) get identical semantics. Anything else (HaltError, a default-
+ * Evaluator provider fault) rethrows to the caller's own catch, exactly as before.
+ *
+ * MUST be called as `return await verifyOrBlock(...)` from inside each caller's `try` — a bare
+ * `return verifyOrBlock(...)` returns the promise and exits the `try` before it settles, so a verifier
+ * `HaltError` would escape the caller's own catch instead of landing as a clean `{ incomplete, halted }`
+ * (proven by `poc/ba15-broken-sensor.mjs` [E4]).
+ * @param {string} task
+ * @param {any} result
+ * @param {RecurseCtx} ctx
+ * @param {RecurseOptions} opts
+ * @param {RecurseNode} node
+ * @returns {Promise<RecurseResult>}
+ */
+async function verifyOrBlock(task, result, ctx, opts, node) {
+  try {
+    const verdict = await verify(task, result, ctx, opts);
+    node.verdict = verdict;
+    return { result, verdict, receipts: node };
+  } catch (err) {
+    // Only a typed BrokenArbiterError is a caller-verifier fault; everything else (HaltError, a default-
+    // Evaluator provider fault) rethrows to the caller's own catch. Classified by type, never by message text.
+    if (!(err instanceof BrokenArbiterError)) throw err;
+    node.incomplete = true;
+    node.blocker = 'broken-verifier';
+    node.blockerDetail = err.detail;
+    // `blockerDetail` rides the RESULT too (see the sensor-side sibling) — the actionable half of the label.
+    return { incomplete: true, best: result, blocker: 'broken-verifier', blockerDetail: err.detail, receipts: node };
+  }
+}
+
 module.exports = { recurse };

package/src/refine.d.ts

@@ -1,15 +1,25 @@
 export type Verdict = import("./evaluator").Verdict;
 export type RefineOptions = {
     /**
-     *   Build one generation. On iteration 0, `lastResult`/`critique` are null. Fresh-feedback (D6/A1) is the
-     *   consumer's to realize here: seed a NEW Loop with `{goal + critique}` rather than continuing the failed
-     *   transcript — anchoring on a wrong answer defeats the independent verifier.
+     *   Build one generation. On iteration 0, `lastResult`/`critique` are null and `history` is empty. Fresh-feedback
+     *   (D6/A1) is the consumer's to realize here: seed a NEW Loop with `{goal + critique}` rather than continuing the
+     *   failed transcript — anchoring on a wrong answer defeats the independent verifier. `history` is a fresh
+     *   shallow COPY of every prior `{result, verdict}` in order (a SkillOpt rejected-attempt buffer, BA-14): a
+     *   consumer MAY surface the failed attempts verbatim ("you already wrote these, they failed X — write something
+     *   different"), the lever that recovers a temperature-fixed model's fixation rut where escalation is inert
+     *   (`poc/ba14-rejected-buffer.mjs`: flat-temp 50%→100%). *Structurally* mutating the copy (push/splice/reorder)
+     *   is safe; the `{result, verdict}` entries are SHARED references into refine's internal history (and the returned
+     *   `outcome.history`), so treat them as READ-ONLY — deep-mutating an entry corrupts the outcome.
      */
     attempt: (args: {
         iteration: number;
         lastResult: any;
         critique: string | null;
         contract: string | null;
+        history: Array<{
+            result: any;
+            verdict: Verdict;
+        }>;
     }) => any;
     /**
      *   Judge a result — typically `evaluator.evaluate(goal, result, { rubric, contract })`.
@@ -56,10 +66,16 @@ export type RefineOutcome = {
 /** @typedef {import('./evaluator').Verdict} Verdict */
 /**
  * @typedef {object} RefineOptions
- * @property {(args: {iteration: number, lastResult: any, critique: string|null, contract: string|null}) => any} attempt
- *   Build one generation. On iteration 0, `lastResult`/`critique` are null. Fresh-feedback (D6/A1) is the
- *   consumer's to realize here: seed a NEW Loop with `{goal + critique}` rather than continuing the failed
- *   transcript — anchoring on a wrong answer defeats the independent verifier.
+ * @property {(args: {iteration: number, lastResult: any, critique: string|null, contract: string|null, history: Array<{result: any, verdict: Verdict}>}) => any} attempt
+ *   Build one generation. On iteration 0, `lastResult`/`critique` are null and `history` is empty. Fresh-feedback
+ *   (D6/A1) is the consumer's to realize here: seed a NEW Loop with `{goal + critique}` rather than continuing the
+ *   failed transcript — anchoring on a wrong answer defeats the independent verifier. `history` is a fresh
+ *   shallow COPY of every prior `{result, verdict}` in order (a SkillOpt rejected-attempt buffer, BA-14): a
+ *   consumer MAY surface the failed attempts verbatim ("you already wrote these, they failed X — write something
+ *   different"), the lever that recovers a temperature-fixed model's fixation rut where escalation is inert
+ *   (`poc/ba14-rejected-buffer.mjs`: flat-temp 50%→100%). *Structurally* mutating the copy (push/splice/reorder)
+ *   is safe; the `{result, verdict}` entries are SHARED references into refine's internal history (and the returned
+ *   `outcome.history`), so treat them as READ-ONLY — deep-mutating an entry corrupts the outcome.
  * @property {(result: any, ctx: {iteration: number, contract: string|null}) => (Verdict | Promise<Verdict>)} evaluate
  *   Judge a result — typically `evaluator.evaluate(goal, result, { rubric, contract })`.
  * @property {string} [contract] - The shared definition of done (A3/D10), forwarded to BOTH `attempt` and

package/src/refine.js

@@ -4,10 +4,16 @@
 
 /**
  * @typedef {object} RefineOptions
- * @property {(args: {iteration: number, lastResult: any, critique: string|null, contract: string|null}) => any} attempt
- *   Build one generation. On iteration 0, `lastResult`/`critique` are null. Fresh-feedback (D6/A1) is the
- *   consumer's to realize here: seed a NEW Loop with `{goal + critique}` rather than continuing the failed
- *   transcript — anchoring on a wrong answer defeats the independent verifier.
+ * @property {(args: {iteration: number, lastResult: any, critique: string|null, contract: string|null, history: Array<{result: any, verdict: Verdict}>}) => any} attempt
+ *   Build one generation. On iteration 0, `lastResult`/`critique` are null and `history` is empty. Fresh-feedback
+ *   (D6/A1) is the consumer's to realize here: seed a NEW Loop with `{goal + critique}` rather than continuing the
+ *   failed transcript — anchoring on a wrong answer defeats the independent verifier. `history` is a fresh
+ *   shallow COPY of every prior `{result, verdict}` in order (a SkillOpt rejected-attempt buffer, BA-14): a
+ *   consumer MAY surface the failed attempts verbatim ("you already wrote these, they failed X — write something
+ *   different"), the lever that recovers a temperature-fixed model's fixation rut where escalation is inert
+ *   (`poc/ba14-rejected-buffer.mjs`: flat-temp 50%→100%). *Structurally* mutating the copy (push/splice/reorder)
+ *   is safe; the `{result, verdict}` entries are SHARED references into refine's internal history (and the returned
+ *   `outcome.history`), so treat them as READ-ONLY — deep-mutating an entry corrupts the outcome.
  * @property {(result: any, ctx: {iteration: number, contract: string|null}) => (Verdict | Promise<Verdict>)} evaluate
  *   Judge a result — typically `evaluator.evaluate(goal, result, { rubric, contract })`.
  * @property {string} [contract] - The shared definition of done (A3/D10), forwarded to BOTH `attempt` and
@@ -49,7 +55,7 @@ async function refine(options) {
   let lastVerdict = null;
 
   for (let iteration = 0; iteration < maxIterations; iteration++) {
-    const result = await attempt({ iteration, lastResult, critique: lastVerdict ? lastVerdict.critique : null, contract });
+    const result = await attempt({ iteration, lastResult, critique: lastVerdict ? lastVerdict.critique : null, contract, history: history.slice() });
     const verdict = await evaluate(result, { iteration, contract });
     history.push({ result, verdict });
     lastResult = result;