bareloop 0.10.0 → 0.12.0

package/src/ledger.js

@@ -1,5 +1,5 @@
 // The upstream ledger (module 4) — reactive lib/primitive incident monitoring.
-// Design record: docs/plans/2026-07-11-upstream-ledger-design.md (adaptlearn
+// Design record: docs/02-features/2026-07-11-upstream-ledger-design.md (adaptlearn
 // POC'd spec) + its 2026-07-13 addendum: the bareloop event mapping. One
 // append-only JSONL both the consumer (the panel, N6) and the maintainer read;
 // the A1/A2/A3 upstream-ask flow, mechanized — evidence in, human judgment out.
@@ -22,6 +22,7 @@
 import { readFileSync, appendFileSync, existsSync } from 'node:fs';
 import { basename } from 'node:path';
 import { createHash } from 'node:crypto';
+import { HITL_PAUSE, HITL_DECISION_RED } from './declaredclose.js';
 
 /** severity order, worst-first (the fold's display order; frequency ranks within) */
 export const LEDGER_CLASSES = Object.freeze([
@@ -82,6 +83,28 @@ const EXCLUDED_ESCALATIONS = new Set([
   'gate-red',
   'smoke-red',          // already counted via primitive-smoke
   'hitl-close',         // by design: a human is the close
+  // N4 slice 1 — the hitl class's own terminals, and each is here for its own
+  // reason rather than by family resemblance. `hitl-pause` is a CHECKPOINT (the
+  // cap-halt story with a person instead of a budget: the run stopped because it
+  // reached the one stage a machine cannot render). `hitl-decision-red` is an
+  // honest refusal of the OPERATOR's own input, exactly like `close-unsupported`
+  // below, and the one direction that would be wrong is filing either of them as
+  // a capability gap against a library that did nothing.
+  //
+  // MINTED, never borrowed: the legacy `hitl-close` above is the deleted path's
+  // close TYPE and keeps its own meaning. Reusing that name would have made two
+  // different facts one number (the `step-stalled` lesson).
+  HITL_PAUSE,
+  HITL_DECISION_RED,
+  // LEGACY, read-only, and a bare STRING on purpose (the `gate-red` precedent
+  // above): `hitl-cancel` was the third door's terminal until 2026-08-17, when
+  // cancel was deleted in favour of a pause that can resume. Nothing in this tree
+  // mints it any more — there is no constant left to import — but this set is the
+  // EXECUTABLE excluded-set, and dropping a name does not delete the category: it
+  // re-files any spine that still CARRIES one as a counted capability gap against
+  // a library that did nothing. A reader must keep recognising what a writer can
+  // no longer write.
+  'hitl-cancel',
   'close-unsupported',  // honest refusal, by design
   // Close authoring (M4, D13) — the interview refusing a job we cannot close: a
   // genre we do not run, a job with no seed to measure against, a locked kind.