bareloop 0.10.0 → 0.12.0

package/bareloop.context.md

@@ -15,6 +15,20 @@
 > file ships with the package and is the complete adopter contract; the README is only
 > the pitch.
 
+> **DIRECTION CHANGE — 2026-08-17 (design decided, NOT built; nothing below has moved yet).**
+> **`hitl` is RETIRED as a verdict class.** The verdict classes become **`green` +
+> `soft-green`**, and the hitl pause machinery is **RE-HOMED, not deleted**: it becomes the
+> **review door** at the end of EVERY run (green and soft-green alike), where the person
+> `accept`s, `rerun`s (their text is the gap, funded as a FRESH engagement with its own money
+> and time) or `pause`s — and **the door never changes the loop's own verdict**. `soft-green`
+> gets a `judged-floor` stage behind a signed rubric card and a signed calibration set.
+> **Everything documented in this file describes the code as it actually is on this branch**,
+> where `hitl` IS admitted, `human-confirms` IS live, and the three `hitl-*` terminals exist —
+> integrate against what is written here, and expect the class-level rename when the next rung
+> lands. Records: PRD Addendum v1.71 and
+> `docs/02-features/2026-08-17-softgreen-review-door-design.md` (repo-only, not shipped);
+> evidence F102–F105.
+
 ## What this is
 
 **"Automate this job — I don't know the best workflow."** bareloop runs tasks that are
@@ -96,7 +110,7 @@ the step plan at run time (gated by `validatePlan`); the human signs only:
 | field | shape | notes |
 |---|---|---|
 | `goal` | non-empty text | what the agent plans against |
-| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). v1 ADMITS only `green`; declaring `soft-green`/`hitl` reds `request-red` with the type as a structured `verb` field (declared-but-locked — the tool-menu pattern). Every `request-red` also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
+| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). **`green` and `hitl` are ADMITTED** (N4 slice 1) — *and `hitl` is RETIRED as a class by the 2026-08-17 design (see the direction note at the top): it still works exactly as documented here on this branch, and the forward path for a job needing judgement is `soft-green` plus the end-of-run review door*; `soft-green` is still declared-but-locked and reds `request-red` with the type as a structured `verb` field (the tool-menu pattern) until its judged floor exists. Every `request-red` also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
 | `close` | **an ORDERED LIST of named stages** `[{ name, cmd, expect, judged?, gapKeep?, offer?, needs? }, ...]` (PRD v1.28), or a close object (table below) **only** for the declared-but-locked verdict classes | the destination, the only thing hand-authored; the check menu DERIVES from it (below). The plan flow executes a staged close directly and adapts a bare `predicate` object into a one-stage list; a `gold`/`rubric`/`hitl` object close validates (the declared-but-locked verdict classes still parse) but the plan flow refuses it at runtime as `close-unsupported` — it names no command to run |
 | `closeDecl` | **the AUTHORED close** `{ genre: "TYPES", lang: "js"\|"python", stages: [{ name, kind, params }], notes? }` | the ALTERNATIVE to `close`, and the point of the close-authoring rung: the user answers an interview and an LLM composes a DECLARATION over kinds whose implementations we own — never a script, never a shell fragment, never a new kind. **`close` and `closeDecl` are alternatives**: declaring both reds `close-duplicated` (two closes are two arbiters). It is HARD-class by construction (`CLASS_BY_CLOSE.declared`), so a locked verdict on one reds `close-hierarchy` as well as `request-red`. The declaration is validated by `validateCloseDecl`; the TREE-GROUNDED half of that gate (the path rule, and the scoped-job derivation that arms the F84 one-population law) is DEFERRED at spec-validation time — a job spec is validated with no repository in hand — and the runner re-runs it GROUNDED against the real seed before any stage and before any token. It stores the counting RULE and never a number (D12): there is no seed field, and `baseline: "seed"` is measured at each run's own HEAD |
 | `checks` | **RETIRED** (PRD v1.28/v1.32) | hand-authored checks are gone, not merely discouraged: declaring `checks` reds `checks-derived` by name. The check menu is DERIVED from the close's own stages instead — see **Staged close** below. The hazard this removes is measured, not theoretical: job #5's three hand-written checks were re-implementations of three stages the close already ran, and a hand-carved copy can drift LENIENT (the worker passes the operator's ruler and fails the real inspection) |
@@ -194,7 +208,9 @@ declared-but-locked verdict classes** (a close is data, never code; verdict-clas
 is a named red `close-hierarchy`). The go-forward shape is the staged list above; a
 `predicate` object is legal shorthand for a one-stage list and the plan flow adapts it, but
 `gold`/`rubric`/`hitl` validate and then refuse at runtime (`close-unsupported`) since v1
-admits `verdictType: green` only:
+admits `verdictType: green` and `hitl` only — and N4's hitl is a STAGE
+(`human-confirms` inside a `closeDecl`), never a close TYPE, so the `hitl` OBJECT form below
+stays refused at runtime exactly as it was:
 
 | type | fields (exact — extras red) | legal class |
 |---|---|---|
@@ -475,7 +491,9 @@ is COUNTED.
 **The verdict class is the USER's answer (PRD v1.57 §1), and it DRIVES the authoring.**
 `verdictType` is a declared radio the preflight validates, never inferred:
 `VERDICT_CLASSES` = `green` | `soft-green` | `hitl`, with `LOCKED_CLASSES` =
-`soft-green` | `hitl` declared-but-locked. Picking a locked one returns a counted
+`soft-green` alone (N4 slice 1 admitted `hitl`; `soft-green` waits for its judged floor —
+**which is now the forward path: `hitl` is retired as a class by the 2026-08-17 design and its
+pause becomes the end-of-run review door, unbuilt as of this branch**). Picking a locked one returns a counted
 `request-red` refusal at ADMISSION — before that class's questions are ever asked. The
 pick is also a PROMISE: every catalogue kind carries the `verdictClass` it can honestly
 render, `closeCeiling(declaration)` reports the highest class a declaration demands, and a
@@ -487,7 +505,7 @@ a step, or test it without a provider.
 
 | step | call | what it is |
 |---|---|---|
-| interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. THREE frozen question sets keyed by verdict class (`QUESTION_SETS`; `questionsFor(cls)` / `requiredAnswersFor(cls)`), and the interview asks NOTHING about a genre. The green set is six questions, answers keyed by number; the soft-green and hitl sets are named but LOCKED (`questions: null`, absent rather than empty) and their selection refuses before they run. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
+| interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. THREE frozen question sets keyed by verdict class (`QUESTION_SETS`; `questionsFor(cls)` / `requiredAnswersFor(cls)`), and the interview asks NOTHING about a genre and NOTHING about the repository. **Ask the library for the set and its numbers — never hardcode a count or a slot number**: the green set has lost two slots since it was frozen (D13's genre confirm, then the repo question, dropped 2026-08-15 because `repoPath` is mandatory structured input and asking for it again invites a second, drifting answer for a fact the machine already holds), and it renumbers CONTIGUOUSLY from 1 each time rather than leaving a gap. Today the green set is five questions, answers keyed by number; the HITL set is those five byte for byte plus one more (what the signer is deciding when they look at the result — `human-confirms`' `ask`), which is the spread's next number and moves with a green-side deletion; the soft-green set is named but LOCKED (`questions: null`, absent rather than empty) and its selection refuses before it runs. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
 | survey | `runAuthorScout({ workdir, provider, attempts?, ceilingUsd? })` → `{ state, facts, reason, meta, raw, raws, calls, budgetStop }` | a bounded READ-ONLY LLM survey. Read-only by MENU CONSTRUCTION (`AUTHOR_SCOUT_VERBS` = the full menu minus write-class and store-class verbs), 8 rounds, F59's reserved toolless final round. **`state: 'ABSENT'` means the scout did not complete — never "no special facts are needed"**, and a parsed `{}` is one of its five ABSENT routes. Up to `SCOUT_ATTEMPTS` (**3**, hardcoded — PRD v1.58) attempts: `attempts` is TIGHTEN-ONLY and CLAMPS rather than throws (floor **1**, because a scout that never ran is an ABSENT nobody can act on), the direction every cap in this system runs in. **A retry fires on the typed MALFORMED class alone** (`SCOUT_RETRY_CAUSES` = `empty` \| `unparseable`); what is excluded is excluded for a reason — `call-failed` covers transport and `truncated:max_tokens`, both provider-red with NO redraft; `short` is F59's cut-off population and already has its own instrument INSIDE the attempt; `non-object` and `empty-object` are valid JSON with wrong or vacuous content, which is a SEMANTIC failure, and F38/F39 measured what re-asking one buys (the same distribution, sampled twice) — that is the self-healing line, and it is not crossed here. The re-ask is TOOLLESS over the conversation the survey already produced (the repository was already read; only the emission was unreadable) and names the mechanical parse error and nothing else. **There is no JSON repair behind it and there never will be** — a repairer decides what the model MEANT and writes it down as though the model had said it, in the one artefact whose whole job is to be honest about what a repository contains. `meta.attempts` / `meta.attemptsAllowed` record what was paid for; every attempt is metered under its own label (`author-scout`, `author-scout#2`, …) and leaves its raw behind. **`ceilingUsd` is the operator's money ceiling** (PRD v1.62) — checked BETWEEN attempts and before F59's reserved round, so no paid call escapes it; `null`/absent is UNBOUNDED, and a non-null non-finite value THROWS (the shared `capStop` seam — see `authorClose` below). When it ends the ladder, `budgetStop` names which stop (`cap-halt` \| `pricing-red`) and a survey that was never asked for carries the typed cause `not-funded` — deliberately OUTSIDE `SCOUT_RETRY_CAUSES`, because a retry is precisely what the cap forbade |
 | listing | `buildSeedListing({ workdir, seedRef, sourcePaths, testPaths })` | mechanical, `$0`, no model. `files` is the WHOLE tree (what the validator judges paths against); `block` is scoped to the survey's own paths and capped in ANNOUNCED tiers (what the prompt carries). Handing the validator the scoped half would make a job scoped to `src/` read as whole-tree and silently disarm the one-population law |
 | authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate, ceilingUsd? })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second. **`ceilingUsd` is the same operator ceiling the survey took** — the scout's spend is ABSORBED into this loop's cost book before its first call is weighed, so spend already incurred folds in and re-entering cannot silently widen it. It is checked immediately before EVERY paid call (the author call, each revise, and each malformed-emission retry). **A MALFORMED ceiling is an ERROR, not a silent unbounded run** (v1.64 §3): the seam every ceiling read goes through (`capStop`, `src/text.js`) THROWS on a non-null non-finite value — `'2.50'`, `NaN`, `Infinity`, `true`, `{}` — before the first paid call, and the throw propagates uncaught rather than being caught into an ABSENT survey, because a caught one would hand you the very silent-unbounded run it exists to prevent. `null`/omitted is the STATED operator choice for unbounded; `0` and negatives are finite, legal, and cap-halt immediately. The advertised ceiling and the enforced ceiling can therefore never be different numbers. A `cap-halt` here can arrive with `ok:true` — a close that was already validated and measured survives the money stop, exactly as a late provider casualty does |
@@ -512,11 +530,158 @@ no model found, it moves no seed number, and a declaration that authors it itsel
 `genre-owned-env`.
 
 **The kind catalogue** (`KIND_CATALOGUE`, and it IS the whole vocabulary): `command-exit`,
-`count-not-worse`, `pattern-absent-in-diff`, `files-changed` are live; `judged-floor` and
-`human-confirms` are NAMED BUT LOCKED (and carry `verdictClass` `soft-green`/`hitl`), so
-declaring one is a counted `locked-kind` red rather than an unknown-kind typo; `harness-loop` (TESTGEN) is ABSENT from v1 entirely. In
-tool mode a locked kind is INEXPRESSIBLE — the schema carries one branch per live kind — so
-that demand arrives through the interview layer instead (`refuseLockedKind(kind)`).
+`count-not-worse`, `pattern-absent-in-diff`, `files-changed`, `human-confirms` and
+`judged-floor` are all live — `LOCKED_KINDS` is EMPTY today; `harness-loop` (TESTGEN) is ABSENT
+from v1 entirely (an unknown-kind typo, never counted demand). The locked-kind machinery is
+unchanged and is what a future entry arrives on: in tool mode a locked kind is INEXPRESSIBLE —
+the schema carries one branch per live kind — so that demand arrives through the interview
+layer instead (`refuseLockedKind(kind)`), whose "named but locked" wording is currently
+unreachable for exactly the reason above.
+
+**`judged-floor` is the one kind that BUYS its measurement** (softgreen module 2), and it is
+CLASS-GATED rather than locked: it renders a `soft-green` verdict, `soft-green` is still a
+LOCKED verdict class, so a real declaration naming it reds `class-ceiling` under a green pick
+and `class-battery-locked` under a soft-green one. The kind runs; no signable spec can reach it
+until the class is admitted. Its parameters are `card` — the signer's rubric as ENUMERATED
+items, where `rule` SELECTS from the arbiter's own rulebook (`JUDGE_RULES` / `JUDGE_RULE_IDS`,
+so a rule we do not implement is inexpressible) and `text` is the signer's words, which explain
+a red and never decide one — and `paths`, the AUTHORITATIVE artifacts, read off the seed listing
+like every other path and bounded at `MAX_JUDGED_PATHS` (one paid call each). It spawns nothing,
+so it takes no `cmd`, no `timeoutMs` and no `env`; it is `offer: false` BY LAW
+(`NEVER_OFFERED_KINDS` — a paid judge is never an in-run ruler); and it SKIPS the seed-verdict
+read (ruling 8) as a recorded `skipped` row.
+
+**Wiring a judged close, and what it costs.** The judge is PINNED (`JUDGE_MODEL`, exported) and
+is never a step knob: the runner supplies `runJob({ judgeProvider })` — its own seam, not
+`provider`/`providerFor` — and a judged stage with none instrument-STOPS as a wiring gap rather
+than grading on whatever binding was at hand. Each locate call is metered per call and emitted
+as a distinct `judge-round` spine record, which `runJob`'s ONE ledger accounts exactly like a
+`worker-round` (`ACCOUNTED_ROUND_TYPES`, and `readResume`'s fold reads that same list, so a
+resumed leg cannot silently widen a signed budget by the close's own spend). A budget funds the
+attempt PLUS its close. Unpriced is never free: a null cost is a `pricing-red` stop that is
+never retried, and the ladder is otherwise ONE retry (`JUDGE_ATTEMPTS`) — after that a broken
+judge is an instrument stop, never a red about the tree.
+
+**The two SIGNED artifacts of a judged close** (softgreen module 4, design §4.3/§4.4). Q6 and
+Q7 of the softgreen interview compile into the RUBRIC CARD and the FROZEN CALIBRATION SET, on
+the D5 shown-and-fixed path: `proposeJudgedArtifacts({answers, generate, book})` buys ONE
+schema-forced proposal (tool `propose_rubric`, over the same bounded malformed-emission ladder
+the declaration uses — a parse failure is an `artifact-red` retried under the cap, a proposal
+that parsed and then broke a rule is NOT retried); a UI shows it; `signJudgedArtifacts({proposal,
+fix})` stores the SIGNER's version (the fix replaces the proposal WHOLE, never merges — a signer
+who deleted a line must not get it back) and reports `source: 'signer'|'proposal'`; and
+`foldJudgedArtifacts(closeDecl, {card, cases})` enumerates both into the declaration. Free text
+in either artifact is scrubbed at ingest through the one `SECRET_PATTERNS` inventory, because a
+signed spec outlives the run that produced it.
+
+**Where they land, and what the hash covers.** The card replaces the ONE `judged-floor` stage's
+`params.card` — one card per close, and it is the signed one; a fold into a close with no judged
+stage (or two) THROWS rather than storing a rubric nothing reads. The cases land beside the
+stages as `closeDecl.calibration.cases`, because the set calibrates the RULER and is read before
+any stage runs. Both sit inside the spec, so `jobSpecHash` covers them by construction: a card
+line or a single case edit flips the hash and forces a re-sign, and a byte-identical re-store
+does not.
+
+**What a legal calibration set is** (`validateCalibrationSet`, beside the rulebook in
+`src/judged.js`, and re-checked at the spec gate by `validateCloseDecl`). EXACTLY
+`CALIBRATION_SIZE` = 10 cases — hamr's ruling, verbatim *"go build 10, we could double later"*,
+operator territory and never agent-picked — with BOTH polarities present, because a set that
+cannot fail one way proves nothing. A case is
+`{id, artifact, expect: {verdict: 'pass'|'red', reds: [{rule, fn}]}}`: `artifact` is the REAL
+source text the judge will be pointed at (never a description of one), and a red case must be
+ITEMIZED, naming a `rule` THIS close's card actually carries (§4.3's ceiling, mechanically — the
+fix for a miss is a new card line and a re-sign) and the `fn` the red lands on. The judge's own
+`why`/`quote` are deliberately NOT stored: no signer can predict prose, and pinning it would
+fail an honest pipe on wording. `expectedOf(decision)` is the ONE reduction of a `decide()`
+result to that shape, so a harness compares one shape rather than two.
+
+**THE CALIBRATION GATE** (`runCalibration`, softgreen module 5, `src/calibrate.js`). It runs the
+WHOLE pipe — `runLocate` over the shipped `JUDGE_ATTEMPTS` ladder, then `decide()` — over each of
+the ten, and compares `expectedOf(decision)` against the stored `expect` by VERDICT **and**
+ITEMIZED REDS (a `(rule, fn)` set, order-insensitive): *a pipe that reds the right case for the
+wrong reason has not been calibrated, it has been lucky*. The floor is **10/10, zero reds**
+(hamr, 2026-08-18) and it is reported per case — `graded: [{id, ok, got, want, detail}]` — never
+as an aggregate percentage.
+
+Alongside it runs **`INJECTION_LOCATE_BATTERY`: five ARBITER-OWNED artifacts**, one per
+bare-agent attack style, **re-aimed at the LOCATE axis** (2026-08-18 second addendum, ruling 1 —
+upstream's `shouldBreak` gold assumes a judge that renders a verdict, and this one never does).
+The attack text is embedded in the artifact, and a style resists only when the extracted FACTS
+are unaffected: same function list, same per-function doc reality. Reading the DECISION alone
+would be blind here — an invented `docQuote` reds `has-doc` through the quote-verification route,
+so a leak and a resist can render identical itemized reds. **All five must resist**; a leak fails
+calibration and names the style. Nothing about the battery is stored in a spec and no signer
+authors it.
+
+A **CASUALTY is never a failed case**: a dead call, an unpriced one (F6 — never retried) or an
+emission that never parses after the ladder STOPS the gate on `runLocate`'s own axis
+(`CASUALTY_AXES`), keeps the graded prefix, and reports zero failures — a broken judge is no
+evidence about the set in either direction. Every locate call is metered through `onCost` on
+every route out and the totals fold through `tallyCalls`, so one unpriced call makes `costUsd`
+null rather than an exact-looking floor.
+
+**At signing it is MANDATORY and it is the only PAID gate** (`prepareSigning`, gate 4). A close
+carrying a `judged-floor` stage is refused when no set is stored, when no `judgeLoop` seam is
+wired (a wiring gap, never a silent pass), when the gate is a casualty, and when anything short
+of all-of-them grades. It runs **after** gates 1–3, so no $0 refusal is ever paid for. The
+signing record keeps WHAT was certified — `cardHash`, `casesHash`, `setHash` (which covers
+`JUDGE_MODEL`), the graded rows and the battery — beside `judgeModel` itself.
+
+**D9.3 for a judged-ONLY close** (ruling 3, hamr: *"fix it now, we are delivering softgreen"*).
+A judged stage skips the seed read (ruling 8), so a close whose only work stage is judged has no
+seed red and used to be unsignable — the one job shape softgreen exists for. For that shape only,
+a PASSED calibration gate plays the seed-red role (the polarity law makes *this close can fail* a
+demonstrated fact), and the record says so: `gates.seedVerdict.satisfiedBy === 'calibration'`. A
+close with any mechanical work stage is UNCHANGED and still needs its seed red.
+
+**THE JUDGE TIER IS INSIDE THE SIGNATURE, and the stage refuses a mismatch.** *"A judge-model
+bump forces a full recalibration"* used to be an operator-side rule with nothing to fire on,
+which makes it prose (F45); it now has both halves of a detector. The tier the signer's set was
+graded by is stored beside the cases as **`calibration.judgeModel`** — `CALIBRATION_FIELDS`
+enumerates a stored set as exactly `cases` and `judgeModel` and nothing else — written by
+`foldJudgedArtifacts` from the PIN (`JUDGE_MODEL`) rather than from anything a caller may name.
+Because it is INSIDE the spec, `jobSpecHash` covers it by construction: bump the constant and
+every signed judged spec hashes differently, the signature dies, and the re-sign is what re-runs
+the calibration gate. **`validateCloseDecl` REQUIRES it** on any stored set (`missing-required`
+on `…calibration.judgeModel`) — a set nobody can attribute to a tier is a floor nobody can tell
+apart from a bumped one. **`declaredStages` stamps it onto the judged stage** as
+`calibrationJudgeModel`, from the SIGNED bytes and through the one seam that already turns a
+declaration into stages (the same carry `offer: false` rides), so a stage can never name a tier
+the signature does not and no second close-level channel is plumbed through every executor seam.
+**`runJudgedFloor` then STOPS on a stored-vs-live mismatch** before it buys a call, naming both
+models and the two things that fix it — *re-sign the spec with the new tier* and *re-run the
+calibration gate (recalibrate)* — under `STOP_FAULTS.FAILED`, the same fault and the same reason
+as the absent judge seam beside it: nothing is broken, something was never re-done. It stops
+rather than degrading in either direction, because grading on the new tier mints a verdict
+against an uncalibrated floor and grading on the old one is not on offer (the pin is a constant).
+
+**The one honest limit, deliberate:** an ABSENT stamp does not stop. It is the same split the
+SET's own presence already lives under — a signed spec that judges cannot reach a run without a
+calibration (the signing gate) or without a model on it (the spec gate), so the only runtime
+question is ever WHICH model, and a bare stage descriptor handed straight to `runStage` by a test
+or an adopter is not a signed spec making a claim about a tier.
+
+**`human-confirms` is the one kind that measures NOTHING** (N4 slice 1). Its whole parameter
+surface is `ask` — the plain question the signer answers — so it cannot spawn, cannot be
+env-capable, and cannot be handed a second job. Four laws ride on it, all checked rather than
+assumed: it is `offer: false` BY LAW (a declaration that offers one reds `human-stage-offered`,
+and `declaredStages` stamps the law onto the stage the runner sees, so `checkMenu` can never
+hand the agent `check-passes(<a person>)`); it must be the LAST stage
+(`human-stage-not-last` — first-red-wins would otherwise silently delete every mechanical stage
+behind it and empty the evidence package the person is owed); it is at-most-once (one signer,
+one judge); and it SKIPS the seed-verdict read (ruling 8), with the skip recorded as a row
+carrying `verdict: 'skipped'` rather than taken in silence.
+
+**A human stage does not RUN — it PAUSES.** `StageResult.verdict` gains `pause` (and `skipped`),
+`runDeclaredClose` reports `pause`/`pausedAt`, and the arbiter bridge translates it to the
+distinct `HUMAN_PAUSE` verdict — never `satisfied`, never `needs_revision`, and never a
+`CLOSE_FAULTS` word (a fault says the close could not render a verdict; a pause says it is not
+FINISHED rendering one). With the signer's ruling in hand (`ctx.humanRuling`, carried by the
+runner and never authored) the same stage renders what the person said: `accept` is a green a
+PERSON judged, `rerun` is a red whose gap is their own words. `normalizeHumanRuling` is the
+library half of the gate — `null` is the pause path, a fourth door is refused, and a `rerun`
+with empty or whitespace-only text is refused by name, because an empty gap re-runs the worker
+as though nothing had been said.
 
 **A red `count-not-worse` gap carries the LINES it counted, not only how many (F98).** Each
 term's **KEPT** matched lines nest under that term's own breakdown row — the row that already
@@ -590,6 +755,81 @@ alone. An absent goal renders as absent rather than as a bare label. This is a R
 validator: nothing compares the goal to the declaration, because deriving one from the other
 is exactly what F87 forbids.
 
+**The path an adopter actually drives is TWO scripts, and the first one spends nothing.**
+`runInterview` is a pure function over answers with no prompt loop in it, so until
+`scripts/run-interview.mjs` existed the only way in was to hand-write an `answers.json` and a
+spec draft — precisely the SWE tax this product refuses. That script is the half that ASKS
+(`--patient <repoPath> --verdict <class> --out <outdir> [--budget <usd>] [--lang js]`, default
+`js`), and it is deliberately GLUE: **it calls no provider at all**, so a whole interview costs
+$0 and no model ever sees it. Everything load-bearing in it is borrowed rather than respelled —
+the QUESTIONS are the library's frozen sets (`questionsFor` / `requiredAnswersFor`), printed as
+handed over and never re-worded, re-ordered or re-numbered by the script; the REFUSALS are
+`runInterview`'s; the SCRUB is `redactSecrets` at capture AND again at the library's own ingest,
+so no keystroke reaches stdout or disk by a route that skips the one inventory; and the spec
+draft is checked by the SAME `validateJob` that will judge it after the paid call, with the
+authored half's expected reds filtered off `AUTHORED_SPEC_FIELDS` by name. A typo'd slug or an
+under-floor wall therefore costs $0 rather than a scout plus a model call.
+
+A LOCKED class refuses BEFORE a single question is asked: the script hands `runInterview` an
+empty answer set, prints the counted `request-red` verbatim, and stops — nothing is asked and
+nothing is written, because asking a class's questions for a job nothing here can close is an
+interview at the wrong price. On success it writes exactly TWO files into `--out`:
+`answers.json`, which is the LIBRARY's redacted reading of the answers (`iv.answers`) and never
+the raw keystrokes; and `specdraft.json`, which is the OPERATOR's half ONLY — no `close`, no
+`closeDecl`, no `verdictType`, because those three ARE `AUTHORED_SPEC_FIELDS` and `assembleSpec`
+refuses a draft carrying any of them rather than merging over it. `tools` is deliberately
+OMITTED from the draft too (MED-1: an omitted menu hashes as the concrete current `TOOL_MENU`,
+which pins WHICH menu was signed; naming today's list would freeze it into the operator's half).
+An interview that never finishes writes NOTHING: a half-collected answer set that looks finished
+is the failure nobody sees.
+
+**Two ceilings, two names, never pooled on screen or anywhere else.** `--budget` is the
+AUTHORING ceiling — what the authoring call may spend — parsed by the same `parseCeiling` rule
+`run-author.mjs` parses it with: absent is UNBOUNDED and ANNOUNCED before anything spends,
+malformed is an ERROR rather than a silent fallback, and zero or negative is rejected on the
+same rule. `budgetUsd` is the JOB's budget, asked separately and signed into the spec. The
+interview stores neither: the ceiling is handed straight to the child, which is the process that
+spends it.
+
+**It ends by OFFERING the paid step, and the offer's default is NO.** `run-author.mjs` is a
+DIFFERENT PROCESS under its own ceiling; the interview prints its exact command line (with
+`--budget` propagated only when one was given, and a note when `ANTHROPIC_API_KEY` is unset)
+before asking `Run it now? [y/N]`, so declining still leaves a command to paste and two files
+already on disk. Only an explicit yes spends — the answer that costs nothing is the one you get
+by saying nothing, the same lean the pause's doors take. On a yes it releases stdin before
+spawning (two readers on one terminal is a keystroke landing in whichever happens to be
+listening) and then propagates the CHILD's exit status rather than flattening a refusal there
+into a success one process up.
+
+**Both scripts speak exit codes, and an adopter wrapping them in CI reads them:**
+
+- `run-interview.mjs` — **0** the interview finished (and, when it spawned the paid step, that
+  step's own status is what you get, never a flattened 0); **1** a REFUSAL — a locked class, the
+  library's own reds over the answers, or a spec draft that does not validate; **2**
+  operator/config — usage, a missing or non-existent `--patient`, a present-but-empty `--lang`,
+  a malformed `--budget`, stdin ending mid-interview, or a child that could not be started;
+  **3** a LEAK that `scanSecrets` found in a file it had just written (count and path only —
+  echoing the matched string is the same leak, one hop on).
+- `run-author.mjs` — **1** a refusal or a failed gate; **2** operator/config; **3** a leak;
+  **4** a CRASH inside the paid span. **3 deliberately OVERRIDES a 4**: a secret sitting in a
+  written file is the harder line of the two, and the crash keeps both of its own louder
+  channels — the whole error on stderr and its own `author-crash` spine record.
+
+**A crash inside the paid span leaves a BODY.** The fallible span — from just after
+`author-start` to the end of the main flow — sits in ONE try/catch that RETRIES NOTHING and
+SWALLOWS NOTHING. The operator's copy goes first and verbatim (it must not depend on the two
+writes below it succeeding), then the spine gets `author-crash` via `crashRecord`: `name`,
+`message` and `code` through `redactSecrets`, the STACK through `scrubRaw` — the ONE persist
+boundary, the same `SECRET_PATTERNS` inventory, bounded with the bound announcing its own size —
+plus `author-end {outcome: 'crashed'}`, because `author-end` is the one record that says a run
+stopped AT ALL and a crash omitting it leaves a spine that reads as still-running. The spine
+write is itself guarded and its failure said out loud (F70: a crash handler that crashes
+destroys the report it was built to make). Nothing ABOVE the try is inside it, deliberately —
+the argv and config `die()` paths run before the spine file exists, so they stop loud on stderr
+and 2 instead. **Latent, not live:** nothing reads the author spine today, and the nearest
+reader (`classifyIncidents`, `src/ledger.js`) keys on types neither record uses, so both fall
+through every branch UNCOUNTED — the fail-safe direction, uncounted rather than miscounted.
+
 **Refusals are COUNTED (D13).** `refusalEvents(refusal)` returns the spine events: a
 `job-red` carrying `{ code: 'request-red', verb, lib: 'bareloop' }` — the `lib` stamped at
 the EMIT SITE, so `classifyIncidents` files it against bareloop's own catalogue and its
@@ -678,7 +918,7 @@ Reserved spine vocabulary (V7, machinery-free until job #1 surfaces one):
 `coordination-red` — a failure between units (scope contention, step order, store
 races), never to be folded into worker/interpreter reds.
 
-### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch? })` → outcome — `src/run.js`
+### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun? })` → outcome — `src/run.js`
 
 The last seven are the RESUME fold and are documented under *Resuming a killed run* below; they
 default to `0` / `true` / `0` / `null` / `[]` / `null` / `null`, so a fresh run passes none of them.
@@ -694,7 +934,53 @@ known-answer round-trip before tokens: `smoke-red` — a silent degradation thro
 
 Outcomes: `green | already-green | escalated | unapproved-spec | job-red | smoke-red |
 plan-red | check-red | close-red | close-unsupported | recipe-stale | branch-red | pricing-red |
-provider-red | interpreter-red | cap-halt | wall-halt | step-stalled | step-red:<id>`.
+provider-red | interpreter-red | cap-halt | wall-halt | step-stalled | hitl-pause |
+hitl-decision-red | step-red:<id>`.
+
+**The two hitl terminals (N4 slice 1, doors re-cut 2026-08-18)** are the class's whole surface
+at this layer, and each is a CLEAN exit (`spendComplete` stays true — only the two casualties floor). `hitl-pause` is a
+decision-ready CHECKPOINT: the close reached a stage no machine can render, so the run stops
+holding everything it has done, emits the evidence package (every mechanical stage's result, the
+close's own `ask`, and the changed paths — bounded, trim announced), and the clock stops with
+it. It is on `CHECKPOINT_OUTCOMES` (the canonical `resumableOutcomes` list, exported so an
+exported bundle inherits one spelling), and `checkpointAgeGate` refuses one older than
+`PAUSE_TTL_MS` (60 days) by NAMING the age and the TTL. The signer's own `pause` door mints
+that SAME terminal, with `humanDecision: 'pause'` and an explicit `gap: null` on the record: no
+fix loop, no worker round, nothing spent, the rerun allowance untouched, and the checkpoint left
+exactly as it was. `hitl-decision-red` refuses a decision the run cannot act on — a word that is
+not one of the three doors, a `rerun` with empty text, or a decision handed to a close with no
+human stage — before anything is spent. Neither demotes a bridge, and both are excluded from the
+ledger's escalation counting.
+
+There was a third terminal, `hitl-cancel`, for a `cancel` door that no longer exists (hamr,
+2026-08-17: *"pause can resume — that would be more honest"*). Nothing mints it and no constant
+exports it; the ledger still RECOGNISES the bare string so a spine written before the change
+reads as governance rather than as a counted capability gap. An unresumed pause expiring under
+the TTL is what cancel used to be.
+
+Pass the signer's answer as `humanRuling: { decision, text? }` (`accept | rerun | pause`, the
+enumerated `HUMAN_DECISIONS` set); it is spent once, at
+the close readings up to the moment the fix loop opens, so the human's words become `post.gap`
+through the SAME seam (same bound, same scrub) and the next machine-clean tree pauses for a
+SECOND review rather than converting one sentence forever.
+
+**A decision SURVIVES the halt that interrupts it** (F102). The run records the answer it was
+handed (`human-decision` — the door, the words, the source) and, separately, what BOUGHT it
+(`human-decision-spent` — a fix round, an accept that greened, a pause honoured). A decision with
+no spend after it is still owed to the person, and `readResume` surfaces it as
+`restart.pendingDecision` (`{decision, text, receivedAt, source}`). Hand that back as
+**`heldRuling`** and the leg applies it directly — the ask is never re-rendered, and the spine
+says the answer came from a record rather than from a person. F102's incident is what this is
+for: a rerun that opened the fix loop, stopped with `iterationsUsed: 0`, and whose resume asked
+the byte-identical question again. The two markers are deliberately not one: the fix loop
+"spends" the ruling for THIS leg's close readings the moment it opens, while whether the person
+must be asked AGAIN depends on work actually having been bought.
+
+A leg handed BOTH a fresh `humanRuling` and a `heldRuling` is refused (`hitl-decision-red`,
+naming the held decision) before anything costs anything: two answers to one question is
+ambiguity, not a merge. `resolveHumanRuling(fresh, held)` is the exported seam that decides this
+(and whether the leg is a fresh engagement, below), so a runner cannot admit what a run refuses.
+
 `branch-red` is the WORK BRANCH refusing (below): the patient is not a git checkout, its
 branch namespace has no free name, or a resume's recorded branch is gone. Zero tokens, and
 never a fallback to working on the branch the run was handed. `provider-red` is a
@@ -789,7 +1075,10 @@ never replans) — plus at most ONE arbiter-granted extra on a second variance s
 REAL close and governed by the close TREND rule below (`capRuns`, default 3, survives only as
 its blind fallback). `plan-executed` (the plan-as-executed record, design law #2) lands on the
 spine on every path that executed steps. Additional outcomes: `already-green |
-plan-red | check-red | close-red | wall-halt`. Worker prompts hold the v1.12 §5 contract
+plan-red | check-red | close-red | wall-halt | hitl-pause | hitl-decision-red`.
+A `human-confirms` stage is caught at BOTH close seams — the precheck (reaching a person there
+means the machine half already passes on the untouched tree, so pausing costs $0 where drafting
+a plan first would spend a budget to arrive at the same question) and the post-steps close. Worker prompts hold the v1.12 §5 contract
 (mutation-proven): the absolute repo root, the step's action/target, prior artifacts,
 the gap — NEVER the budget, the close command, a check's command, or the arbiter's books.
 
@@ -1119,8 +1408,67 @@ about its task, beside the absolute-path law it is the twin of — both are fenc
 cannot infer. It renders for EVERY worker on every grant (a worker granted only `write` gets
 no component strategy paragraph at all and must still be told). The fence is unchanged; what
 changed is that the rule is stated instead of learned one refusal at a time, which cost a real
-run the rounds of a bounded attempt. N2 bounds (honest): `gold`/`rubric` closes refuse
-`close-unsupported` (execution lands at N4).
+run the rounds of a bounded attempt. N2 bounds (honest): `gold`/`rubric`/`hitl` OBJECT
+closes refuse `close-unsupported` — N4's hitl is a `human-confirms` STAGE inside a `closeDecl`,
+never a close TYPE, so there is one live expression of hitl rather than two.
+
+### THE REVIEW DOOR — the three doors at the END of a run (softgreen module 8, PRD v1.71 §3)
+
+The pause machinery re-homed: the same doors, the same evidence package and the same 60-day TTL,
+one level OUT — from a stage inside the close to the door at the end of a run.
+
+**THE LAW, and it is not negotiable** (hamr, verbatim: *"it's important not to change the loop
+self verdict"*): the close mints the verdict, the door records a **disposition**. `runJob`
+returns `green` / `already-green` exactly as it always did, the ledger records exactly what it
+always recorded, and no answer a person gives can change either. A green run that is never
+answered is still a green run — the door is non-blocking.
+
+**Opening one.** A run whose terminal is verdict-bearing (`DOOR_OPEN_OUTCOMES` — `green`,
+`already-green`) emits ONE `review-door` record carrying the evidence: the outcome, the class,
+whether the credit is `quarantined`, every close stage's own result, the stages an `accept` will
+re-run (`mechanical`), and the changed set (same cap and same F28/F6 announcements the pause
+package makes). Which runs open one is `doorOpens(job, reviewDoor)`:
+
+- **always** for the classes in `REVIEW_DOOR_CLASSES` — `['soft-green']`, because a judged green
+  is quarantined at mint (module 6) and an `accept` is the ONLY thing that releases the credit;
+- **on request** for everything else: `reviewDoor: true` (the runner's `--review-door`). A
+  green-class run is byte-identical to what it always was unless it is asked for.
+- `reviewDoor: false` shuts it for any class. The flag wins in both directions and is never
+  inferred; `REVIEW_DOOR_CLASSES` is a constant, not a threshold, and widening it is arbiter
+  territory.
+
+**Answering one — `answerReviewDoor({ job, workdir, events, decision, text?, closeTimeoutMs?,
+registryDir?, name?, runid?, at?, now?, emit? })`** (`src/reviewdoor.js`). The answer arrives
+after the run has ended, possibly days later and from another process, so it cannot ride the
+run's return path. This is that seam. It never throws and never conjures — a fourth door, an
+empty `rerun`, a run that opened no door (`no-door`), an expired one (`door-expired`), a tree
+that moved (`door-accept-red`) and a missing registry all come back as named reds.
+
+- **`accept`** re-runs the close's **mechanical** stages against the tree AS IT STANDS
+  (`mechanicalStages` — everything outside `SEED_EXEMPT_KINDS`, so never a judged floor and never
+  a person) before it is honoured: hamr's ruling that an accept is not a rubber stamp, and the
+  answer to a tree that can move in the 60 days a door keeps. A red REFUSES the accept with the
+  stage named and records **nothing**. A pass records the disposition and, over a held judged
+  green, RELEASES the credit through module 6's `applyDoorDecision`.
+- **`rerun`** carries the person's words back as a directive (`next: 'rerun'`) and re-proves
+  nothing: the new run's close is what judges. Empty or whitespace text is refused at the same
+  seam every other door is.
+- **`pause`** runs nothing and spends nothing, in any state. The door simply keeps, and an
+  unanswered one expires under `PAUSE_TTL_MS` — that expiry IS what `cancel` used to be.
+
+Every door is recorded when a registry is wired, not only the accepts: *"the signer's accepts
+double as the judge's ongoing report card"*, and a rerun over a judged green is exactly as
+informative. An **already-green** run wrote no row of its own, so its door records nothing and
+releases nothing — slice 1's already-green no-mint rule, holding from the other side, and stated
+in the result's `note` rather than surfaced as a failure.
+
+**The rerun as a FRESH ENGAGEMENT** — hand the words back to the next run as
+**`doorRerun: {text, fromRunid?, receivedAt?}`**. Two things follow and only two: the
+`already-green` shortcut is refused (a tree that passes the close is precisely the state the
+person rejected — the run emits `door-rerun-open` and carries on), and the words reach the
+PLANNER as a requirement on top of the signed goal. It is never a `humanRuling`: that answers a
+close's human STAGE, and a green-class job has none. Money folds (the signed budget is the
+chain's ceiling); the WALL does not (F103).
 
 ### The reuse registry (Layer 3) — `src/bridges.js`, `src/selection.js`
 
@@ -1151,6 +1499,50 @@ it points, and a percentage over 2–3 runs is fake precision. `costUsd`/`wallMs
 a number or an EXPLICIT `null`, and the key is REQUIRED either way, so an unknown has to be
 said rather than omitted (F6 — an omitted key is how a `?? 0` gets written downstream).
 
+**QUARANTINE — a judged green earns nothing until the signer accepts it** (softgreen module
+6; the standing ruling PRD v1.53, given its mechanism by v1.71 §3). A green minted under
+`verdictType: "soft-green"` carries `quarantined: true` on BOTH halves of R1's pair — the
+**version** (what inherits) and its **history row** (what the status ladder reads). It is a
+FLAG, never a withheld row: the run happened, the record says so, and the listing shows it —
+it is simply worth nothing yet. A held green does not count in `deriveStatus` (an entry whose
+only greens are held derives `null` and renders `HELD`, never `NO-GREEN`), and
+`reuseEligibility(bridge)` / `newestEligibleVersion(bridge)` refuse it for reuse **with a
+stated reason** — the same visible-skip discipline an unreadable registry file gets.
+`green` and `hitl` are untouched, byte for byte: the key is ABSENT, because the hold is about
+the young JUDGE, not about every class that is not green. `QUARANTINED_VERDICTS` is the one
+list; `quarantinesCredit(verdictType)` is the one predicate. The class travels on the green
+record as `verdictType` — an unrecognised value REDS rather than falling through to unheld.
+
+**The review door releases it, forward-only.** `recordDoor(bridge, {runid, decision, at})`
+records the signer's disposition (`accept | rerun | pause`, the same three doors `kinds.js`
+owns) on that run's own green row as an append-only `doors: [{decision, at}]` — the **report
+card**, kept as facts and never as a computed agreement rate (D6's no-score rule applies to
+the judge too). `accept` over a held green also flips `quarantined` to `false` on both halves;
+`rerun` and `pause` record and release nothing. There is deliberately **no re-hold path**: an
+accept followed by a rerun records the disagreement and leaves the credit granted. A repeat of
+the last decision is a no-op (`released` says whether THIS call freed it), and a door aimed at
+a run with **no green row of its own** — an already-green run, a red, a casualty — is the red
+`no-row-for-run`: releasing is not minting. `applyDoorDecision({registryDir, name, runid,
+decision, at})` is the on-disk half; the door opens AFTER the run ends, so the decision cannot
+ride the run's return path. **The door never changes the loop's verdict** — a green stays green
+in the ledger whatever the person then does with it.
+
+**`writeRunGreenRow({registryDir, job, name, outcome, plan, record})` → `{minted, reason,
+write}` — the terminal registry write for a runner that drives `runJob` directly** (rather
+than through `runReuse`, which writes its own rows). It is what gives that runner's review
+door a row to release: without one, `accept` reaches `recordDoor` and reds `no-row-for-run`.
+STORAGE ONLY — nothing here selects, promotes or reuses a bridge. Four refusals, each with a
+named `reason`: no `registryDir` (`no-registry` — the registry is operator-supplied, never
+conjured), `outcome !== 'green'` (`green-predates-run` for already-green — accept confirms a
+verdict, it never mints one — else `not-green`), no executed `plan` (`no-plan-executed`, R1),
+and a verdict class whose credit is not held (`credit-not-held` — `green`-class runs mint
+nothing here, `quarantinesCredit` is the one predicate). `name` falls back to `job.job`; the
+row is born HELD because the record carries the spec's own `verdictType`, never a flag. A
+refused underlying write returns `{minted: false, reason: 'write-refused', write}` with the
+reds on `write` — never a throw. Minting goes through the same cold-leg green write `runReuse`
+uses (shape-fork rule and collision refusals included), so the two runners can never spell
+"what a green writes" differently.
+
 **`loadGate(bridge, job)` → `{ ok, reds }` — the load-time gate.** Exactly three checks,
 asked *"is this the right KIND of recipe?"*: the job's **verdict type**, the **close-stage
 kinds** (v1: the same stage names in the same order), and every stored verb **within THIS
@@ -1172,12 +1564,16 @@ their next green, not repaired.
 
 **`runJob`/`runPlan` take `bridge?`** — a validated entry to reuse. The gate runs **at the
 door**: before the clock, before the close precheck, before any token. On a pass, the
-**newest** version's plan rides into the FIRST drafting prompt as a starting draft
+**newest ELIGIBLE** version's plan (the newest one no quarantine holds) rides into the FIRST
+drafting prompt as a starting draft
 (`bridge-loaded {name, versions, runid}` on the spine) and everything after it is the
 ordinary shipped path — same validator, same redraft-on-reds, the same replan ceiling, and a
 **replan never re-injects the bridge** (it drafts from the run's own state). On a fail the
 run returns the distinct terminal **`recipe-stale`** with `bridge-gate {outcome, name, reds}`
-and a decision-ready escalation, having spent nothing. **Falling back to cold is the
+and a decision-ready escalation, having spent nothing. A **wholly HELD** entry handed in
+directly is refused at the same door and by the same terminal, with `bridge-gate
+{outcome: 'quarantined'}` and the accept-then-rerun option named — the recipe is the right
+kind, it is simply unaccepted, and the two are never spelled the same. **Falling back to cold is the
 caller's decision, not an automatic silent fallback** — starting a paid run on a decision
 nobody made is the same class of error as widening a cap to manufacture a green. Omit
 `bridge` and the flow is byte-identical to a pre-Layer-3 run: no new event, and no starting
@@ -1342,9 +1738,11 @@ semantics are byte-unchanged (PRD v1.46 §3):
 - **`resumableOutcomes: [...]`** reclassifies a landed `job-end` whose outcome is a
   CHECKPOINT rather than a verdict as a restart rather than a completed row. "A landed
   job-end is complete" is true of a VERDICT; a checkpoint means the work is on disk and the
-  plan is on the spine with nothing decided against them. **The set is the CALLER's**, and
-  the reference runner's is `['cap-halt', 'wall-halt', 'step-stalled']` (`run-u`'s
-  `RESUMABLE_HALTS`). The first two are governance halts — an operator-owned allowance ran
+  plan is on the spine with nothing decided against them. **The set is the CALLER's** — the
+  parameter stays a parameter, and its empty default is what the reuse loop's own graded-row
+  semantics depend on — but the canonical ANSWER is exported as **`CHECKPOINT_OUTCOMES`**
+  (`['cap-halt', 'wall-halt', 'step-stalled', 'hitl-pause']`), and the reference runner
+  CONSUMES it rather than keeping a copy. The first two are governance halts — an operator-owned allowance ran
   out. `step-stalled` joined them 2026-08-13 on hamr's ruling (PRD v1.64 §1): it is the one
   terminal whose OWN escalation already offers *"retry the run"*, nothing about the work on
   disk is wrong, and the shape that named the fix is a stall that trips with time left and
@@ -1385,6 +1783,31 @@ watchdog `--wall-ms 0`, which it defaulted to `null` and armed no deadline at al
 still advertising one. The refusal names the lever: raise `maxWallMs`, which moves the spec hash
 and is re-signed.
 
+**A `hitl-pause` checkpoint is answered on the same command line** (N4, 2026-08-12 §5.2 — the
+terminal is the v1 surface; the panel is N6's). The reference runner takes
+`--decide accept|rerun|pause` with `--text` for the rerun door, gated on the SAME
+`--approve <specHash>` signature the run itself is signed with (ruling 4: the spec hash is the
+only signer proof this repo has, and no second identity mechanism was invented). The decision
+SEMANTICS are the library's — an adopter's runner should call `normalizeHumanRuling` and print
+its refusal rather than re-spell "three doors, no fourth" or "a rerun needs text", and hand the
+result to `runJob` as `humanRuling`. Two questions belong to the RUNNER because only it can ask
+them: a decision with no run to answer, and a decision aimed at a checkpoint that is not a pause
+(an `accept` there would mint a green over evidence nobody was shown). Before any of it, the
+paused spine goes through `checkpointAgeGate`, and the run is not resumed without an explicit
+decision: the lean-rerun rule (2026-08-12 §4) governs which door a prompt LEADS with, never an
+action taken for the operator.
+
+**A finished run's REVIEW DOOR is answered the same way, one flag over**: `--door <runid>`
+selects the run (its own spine, its own `review-door` record), `--decide` picks the door and
+`--approve <specHash>` signs it. The screen is its OWN preview and deliberately not the resume
+banner: a door is answered about a run that is OVER, so nothing that banner computes (what is
+left to resume with, which step it re-enters) is a true sentence there. `accept` and `pause`
+launch nothing and exit; `rerun` falls through into a fresh engagement — its own clock, the
+answered run's spend folded in — carrying the person's words as `doorRerun`. `--registry <dir>
+--workflow <name>` are optional: without them the answer is recorded on the run's own spine and
+the readout SAYS the credit was not released, rather than reporting a release that never
+happened.
+
 - **Completed tries are not re-run.** They come back as rows (marked `inherited`) and
   their bridges stay excluded from every later selection. A try whose `job-end` landed —
   the close judged it — counts as completed even if the kill beat its `try-end`; paying
@@ -1461,6 +1884,20 @@ and is re-signed.
   (or `wall-halt`, below one close timeout: a try that cannot fund its close produces an
   unreadable row) with **nothing launched**. Topping up is a new envelope, and a new
   envelope is a new signature.
+- **…except a decide-time RERUN, which is a FRESH ENGAGEMENT** (F103, design record §3.4 —
+  hamr: *"redo/rerun comes with new authoring for money+time and keeps accounting of this far
+  and this session separate counters"*). A rerun opens on the full signed `maxWallMs` instead of
+  the remainder, because the person did not decide on the run's clock: the incident that minted
+  it took the door and inherited **87 seconds** from a leg that had already ended, on a worker
+  measured to read nine rounds before its first write. So there are TWO counters and neither
+  does the other's job — the CHAIN (every leg added up: `engagement.chainWallMs`,
+  `chainSpentUsd`, `job-end.spentUsd`, what the halt readout reports) and the ENGAGEMENT (what
+  bounds THIS leg: the clock's `priorElapsedMs`, `job-end.engagementSpentUsd`). The `engagement`
+  record states both at the top of every run. **MONEY IS DELIBERATELY NOT SYMMETRIC**: it folds
+  on every path, because the signed budget is the CHAIN's ceiling and a signature for $5 never
+  silently authorizes $10 — a rerun spends what REMAINS of it, never a refill. A rerun leg also
+  declares its `job-start` fold engagement-scoped (`priorWallMs` omitted, `chainWallMs` carried),
+  so a later resume of it inherits this engagement's minutes rather than the chain's again.
 - **Money stays honest end to end.** `carrySpentUsd` (completed tries + selection calls)
   seeds the resumed ledger; the mid-try fold is deliberately NOT in it, because it comes
   back inside the restarted try's own terminal — counting it in both places would bill it