bareloop 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -5,6 +5,165 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.12.0] — 2026-08-23
+
+### Added (N4 slice 2 — the softgreen rung: a close that JUDGES, and a signer who has the last word)
+
+- **The judged floor is real: LOCATE + DECIDE (`src/judged.js`).** A judge (haiku-4.5, pinned —
+  never a step knob) extracts FACTS from the real artifact with quotes; an arbiter-owned `decide()`
+  renders pass/fail from a signed rubric card; *unsure* is a red, never a pass. The judge never
+  renders a verdict, so the rubric-is-self-consistency gotcha stays closed. Wired as the
+  `judged-floor` close kind — metered from the run's own wallet, `offer:false` by law, and skipping
+  the seed-verdict read (its bar comes from calibration instead).
+- **`soft-green` is ADMITTED as a verdict class** — the class-scoped question set, the inherited
+  green guard battery (hamr: *"battery ties with job type"*), the class-scoped kind menu, and the
+  promise rule: composition stays ≤ the picked class, and exceeding it is an honest red rather than
+  a silent up- or downgrade.
+- **The signer's two artifacts are AUTHORED and enumerated in the hash** (`src/cardauthor.js`): the
+  rubric card comes from Q6 and the calibration set from Q7, both handed to the compiler verbatim,
+  both SHOWN to the signer (D5 shown-and-fixed), and what the signer fixed is what is stored —
+  `source: 'proposal'` says *nobody changed this*, which is a different fact from *a person read it
+  and changed nothing*.
+- **The calibration gate — ten graded truths and five resisted lies buy a signature**
+  (`src/calibrate.js`, gate 4 of `prepareSigning`). The whole pipe grades the signer's own ten cases
+  and faces a 5-artifact injection battery adapted to the locate axis; the floor is **10/10 with
+  itemized reds** (hamr, 2026-08-18) and all-or-nothing on both halves. The $0 legality check runs
+  first and buys no calls. A dead judge is a CASUALTY under the transport's name, never a reading of
+  the operator's rubric.
+- **Quarantine: a judged green earns no learning credit until an `accept` releases it.** Minted
+  soft-green bridge rows are held at mint, the release is forward-only, a rerun re-quarantines, and
+  a held entry is never offered by selection — so a soft-green pass cannot feed N3 before the judged
+  floor is proven.
+- **The review door — every run ends at the signer's three doors** (`accept` / `rerun` / `pause`).
+  The door records a DISPOSITION and never touches the loop's own verdict (hamr: *"it's important
+  not to change the loop self verdict"*): `runPlan` returns `green`/`already-green` exactly as
+  before. It opens at all three green sites (precheck `already-green`, the outer close, and the fix
+  loop's green). **Soft-green always** (`REVIEW_DOOR_CLASSES`), **green opt-in** via `reviewDoor:
+  true` / `--review-door` — the flag wins in both directions and is never inferred. An `accept`
+  re-runs the close's MECHANICAL stages (never a judged floor, never a person): a door keeps for 60
+  days and nothing freezes a tree.
+
+- **The judge tier joins the SIGNATURE — a bump flips the hash and the stage refuses the
+  mismatch** (`649d8a5`). `JUDGE_MODEL`'s docstring has always said a judge-model bump forces a
+  full recalibration, and nothing detected one: `closeDecl.calibration` stored only its `cases`,
+  so the tier that graded them sat OUTSIDE the signed bytes, a bump flipped no hash, and the
+  judged stage never compared the model it was about to buy against the model the signer's set
+  was graded by. A rule with no wired detector is prose (F45). The tier now lives beside the
+  cases as **`calibration.judgeModel`** (`CALIBRATION_FIELDS` in `src/declaredclose.js`
+  enumerates a stored set as exactly those two and nothing else), written by
+  `foldJudgedArtifacts` from the PIN itself rather than from anything a caller may name — and
+  because it is inside the spec, `jobSpecHash` covers it by construction: bump the constant,
+  every signed judged spec hashes differently, the signature dies, and the re-sign is what
+  re-runs the calibration gate. `validateCloseDecl` REQUIRES it on any stored set (a set nobody
+  can attribute to a tier is a floor nobody can tell apart from a bumped one).
+  `declaredStages` carries the close-level fact onto the judged stage as
+  `calibrationJudgeModel` — the same seam, and for the same reason, that already stamps
+  `offer: false` — and it carries it from the SIGNED bytes, so a stage can never name a tier the
+  signature does not. `runJudgedFloor` then refuses to grade on a mismatch, naming both models
+  and the two things that fix it (*re-sign* and *recalibrate*), under the same `FAILED` fault the
+  absent judge seam already stops on: nothing is broken, something was never re-done. An ABSENT
+  stamp is deliberately NOT a runtime stop — a signed spec cannot reach a run without a
+  calibration (the signing gate) or without a model on it (the spec gate), so the only runtime
+  question is WHICH model. No signed spec on disk moves: `jobs/*.json` carries zero
+  `judged-floor` stages today.
+- **The U runner mints the row its review door promises to release** (`e01d0af`). The door tells
+  a person that `accept` *"releases this run's learning credit"*; for every run
+  `scripts/run-u.mjs` has driven that sentence was false by construction — a cold green wrote a
+  standalone `bridge-<job>-<runid>.json` FILE and never a registry ROW, so
+  `--registry --workflow --decide accept` reached `recordDoor`, found no green row for the runid
+  and died `no-row-for-run`. The held credit could be described and never released. **STORAGE
+  ONLY:** nothing here selects, promotes or reuses a bridge — that rung stays parked on
+  `layer-3-reuse` (F88) — and exactly one thing reads the row back, the door. `writeGreenRow` is
+  `runReuse`'s own cold-leg green write LIFTED out of its closure unchanged (the
+  fork-on-a-different-close-shape rule, both collision refusals, the `appendGreen` leg), so the
+  two runners mint a green through ONE spelling; a second spelling of what a green writes is the
+  two-transforms class applied to the ledger itself. **`writeRunGreenRow`** (newly exported) is
+  the U runner's terminal policy on top of it, and every guard is a NAMED refusal rather than a
+  silence: no `--registry` (`no-registry`), an already-green run (`green-predates-run` — accept
+  confirms a verdict, it never mints one), a green with no executed plan (`no-plan-executed`), a
+  class whose credit is not held (`credit-not-held` — `green`-class runs mint nothing here,
+  which is what this runner has always done), and a spine leak blocks the row exactly as it
+  already blocks the bridge file. The row is born HELD because `greenParts` reads the SIGNED
+  class off the record — nothing new sets a flag — and `applyDoorDecision` releases it through
+  the path that already existed. `src/index.js`'s claim that `runReuse` is the only registry
+  writer is CORRECTED rather than left standing.
+### Fixed
+
+- **F102 — a pending human decision now survives a wall-halt → resume** (`a6f62c9`). Two records
+  answering two different questions: `human-decision` (the door, the words, and by whom, with
+  `source: 'operator'|'checkpoint'` and the moment the PERSON spoke) and `human-decision-spent`
+  (what actually bought it). The spend marker fires on the **WORK** — a fix round bought, an accept
+  that greened, a pause honoured — **not on the fix loop opening**, which is precisely the shape of
+  the incident (`iterationsUsed: 0`). A resume carrying one re-enters the fix loop through the same
+  seam a fresh answer uses; the ask is never re-rendered. Two answers to one question are REFUSED
+  (`hitl-decision-red` naming what is held), never merged.
+- **F103 — a rerun buys its own clock** (`a6f62c9`). Two counters that never do each other's job:
+  CHAIN (`chainWallMs`/`chainSpentUsd`, `job-end.spentUsd`) is every leg added up and is what the
+  halt readout reports; ENGAGEMENT (`priorElapsedMs`, `job-end.engagementSpentUsd`) is what bounds
+  THIS leg. Money is deliberately not symmetric — the signed budget stays the CHAIN's ceiling,
+  because a refilled wallet is the failure F45 measured. W-2 is untouched where it was designed for:
+  an ordinary resume folds exactly as it always has, and so does an `accept`.
+- **F106 (HIGH, review) — the calibration gate now meets the one ceiling** (`0ae7693`). The run's
+  third and largest paid seam (up to 10 locate calls plus the 5-artifact battery, each under its own
+  retry ladder) ran with no bound while the scout and the declaration loop were both stopped by
+  `run-author --budget` — the advertised budget and the enforced budget were two different numbers.
+  `prepareSigning`/`calibrationGate` take `ceilingUsd` + `priorCalls`, a cost book absorbs prior
+  spend so the gate reads the REMAINING balance, `capStop` is asked before each paid call inside the
+  pipe (retries included), and a ceiling stop returns as an operator refusal naming money
+  (`cap-halt` / `pricing-red`) — never a casualty, and never a part-graded set presented as graded.
+- **A review door's rerun is a fresh engagement too** (`0ae7693`): `resolveHumanRuling` takes
+  `doorRerun` as a third input, OR'd and never merged, so *"is this leg a fresh engagement"* keeps
+  ONE spelling and a door-rerun leg cannot inherit the rejected leg's wall.
+- **`scripts/run-u.mjs` wires `judgeProvider`** (pinned to the judge model, never a step knob) — a
+  live soft-green run no longer instrument-stops at the judged stage.
+- **Two mutation-blind gaps in `src/kinds.js` covered by tests** (found by the same review).
+
+- **The medium whole-branch code review's five findings** (`e0c87d3`). An absent `job-end` in
+  `scripts/run-u.mjs` (a crash between the door record and `job-end`, or a legacy spine) no
+  longer launders into an exact complete `$0` that folds into the rerun ceiling — unknown is
+  reported unknown (F6), regression test watched failing first. One name per kind and per code:
+  the `'judged-floor'` literal at 7 sites becomes **`JUDGED_FLOOR_KIND`** (`src/kinds.js`,
+  exported) and the `'quarantined'` code at 3 sites becomes **`QUARANTINED_CODE`**
+  (`src/bridges.js` — deliberately not `reuse.js`, which would cycle reuse ↔ selection). One
+  `threeDoors()` builder replaces the copy-pasted door lines in `scripts/u-readout.mjs` (output
+  byte-identical against HEAD), and a `changedEvidence()` helper in `src/planrun.js` replaces
+  the duplicated evidence block and the double `verdictType` default, with `doorOpens`'
+  signature untouched. Two findings were ESCALATED rather than decided — the judge-model bump
+  with no detector, and the U runner's door promising to release credit it never minted — and
+  both are the `1A`/`2B` entries above.
+- **The tail review's six findings over `1A`+`2B`** (`493b2ce`). The door PREVIEW path now
+  checks row-EXISTS before promising a credit release, and its printed commands carry
+  `--registry`/`--workflow` forward — the `e01d0af` fix had landed at the end-of-run readout and
+  not at this sibling site, so the operator's next invocation would have rediscovered
+  `no-row-for-run` one hop later. The registry row records **`rounds` + `roundsComplete`**: a
+  resume leg writes a fresh spine and the halted leg's restart record declares money and wall
+  but never rounds, so on a resume that count is a FLOOR and now says so the way the money
+  beside it already does (F6). A NAMED `--registry` that attempted no row prints the reason
+  rather than staying silent. The two near-identical record builders in `src/reuse.js`
+  consolidate into `commitWrite`, and the duplicated `worker-round` scan is hoisted to one
+  spelling.
+- **The release gate's two findings** (`a5a4731`). `docs/UPSTREAM-ASKS.md`'s BA-21 carries a
+  dated CORRECTION note: the retracted 2.0–2.5× figure was a clipipe-surface number (F48 — a
+  provider-billed surface that never pools with `anthropic-api`), and the measured API-side
+  numbers are ~5.7% / 1.586×; the acceptance criteria are unaffected. In `src/judged.js`, two
+  literal NUL bytes inside composite-key template strings are spelled `\x00` — byte-identical
+  at runtime, but the literal made `grep`/`file` treat the source as binary (the documented git
+  binary-detector trap).
+
+### Docs (2026-08-23)
+
+- **`docs/FINDINGS.md`: F102 and F103 move from NOT FIXED / NOT BUILT to FIXED**, each cited to
+  the commit that did it — `a6f62c9` for both, plus `0ae7693` for F103's extension (the review
+  door's rerun as `resolveHumanRuling`'s third input, OR'd and never merged). **F106 is minted**
+  from the 3-lens review's HIGH: F45's class in a money coat with the direction reversed — the
+  ENFORCED number was the looser one, which is the failure that leaves a bill instead of a red
+  (`cce3ce5`).
+- **PRD Addendum v1.76** (this release): the three doors restated, the green-class review door
+  kept OPT-IN, rerun named as *not a replay*, the `1A`+`2B` escalations ruled, and the one
+  remaining door hole named and left deliberately.
+- **`bareloop.context.md`**: the judge-tier paragraph rewritten from DEFERRED to the live
+  detector it now describes.
+
 ## [0.11.0] — 2026-08-18
 
 ### Changed (2026-08-18 — the review door's third button)

package/README.md

@@ -48,8 +48,9 @@ finds in the real work, and fixed rules — not the judge — render the verdict
 
 ## You have the last word
 
-Every run ends at a **review door**: here is what changed, here is what every check said, here
-is what I'm asking you. **Accept** it, **rerun** it — what you type is the feedback the next
+Every judged run ends at a **review door** (a purely mechanical green finishes on its own —
+ask for the door with `--review-door`): here is what changed, here is what every check said,
+here is what I'm asking you. **Accept** it, **rerun** it — what you type is the feedback the next
 attempt works from, funded fresh — or **pause** it and decide another day. A pause costs
 nothing, keeps everything, and picks up from the start of the last step whenever you come back.
 Never come back, and it quietly expires on its own.

package/bareloop.context.md

@@ -530,11 +530,136 @@ no model found, it moves no seed number, and a declaration that authors it itsel
 `genre-owned-env`.
 
 **The kind catalogue** (`KIND_CATALOGUE`, and it IS the whole vocabulary): `command-exit`,
-`count-not-worse`, `pattern-absent-in-diff`, `files-changed` and `human-confirms` are live;
-`judged-floor` is NAMED BUT LOCKED (`verdictClass: 'soft-green'`), so declaring it is a counted
-`locked-kind` red rather than an unknown-kind typo; `harness-loop` (TESTGEN) is ABSENT from v1
-entirely. In tool mode a locked kind is INEXPRESSIBLE — the schema carries one branch per live
-kind — so that demand arrives through the interview layer instead (`refuseLockedKind(kind)`).
+`count-not-worse`, `pattern-absent-in-diff`, `files-changed`, `human-confirms` and
+`judged-floor` are all live — `LOCKED_KINDS` is EMPTY today; `harness-loop` (TESTGEN) is ABSENT
+from v1 entirely (an unknown-kind typo, never counted demand). The locked-kind machinery is
+unchanged and is what a future entry arrives on: in tool mode a locked kind is INEXPRESSIBLE —
+the schema carries one branch per live kind — so that demand arrives through the interview
+layer instead (`refuseLockedKind(kind)`), whose "named but locked" wording is currently
+unreachable for exactly the reason above.
+
+**`judged-floor` is the one kind that BUYS its measurement** (softgreen module 2), and it is
+CLASS-GATED rather than locked: it renders a `soft-green` verdict, `soft-green` is still a
+LOCKED verdict class, so a real declaration naming it reds `class-ceiling` under a green pick
+and `class-battery-locked` under a soft-green one. The kind runs; no signable spec can reach it
+until the class is admitted. Its parameters are `card` — the signer's rubric as ENUMERATED
+items, where `rule` SELECTS from the arbiter's own rulebook (`JUDGE_RULES` / `JUDGE_RULE_IDS`,
+so a rule we do not implement is inexpressible) and `text` is the signer's words, which explain
+a red and never decide one — and `paths`, the AUTHORITATIVE artifacts, read off the seed listing
+like every other path and bounded at `MAX_JUDGED_PATHS` (one paid call each). It spawns nothing,
+so it takes no `cmd`, no `timeoutMs` and no `env`; it is `offer: false` BY LAW
+(`NEVER_OFFERED_KINDS` — a paid judge is never an in-run ruler); and it SKIPS the seed-verdict
+read (ruling 8) as a recorded `skipped` row.
+
+**Wiring a judged close, and what it costs.** The judge is PINNED (`JUDGE_MODEL`, exported) and
+is never a step knob: the runner supplies `runJob({ judgeProvider })` — its own seam, not
+`provider`/`providerFor` — and a judged stage with none instrument-STOPS as a wiring gap rather
+than grading on whatever binding was at hand. Each locate call is metered per call and emitted
+as a distinct `judge-round` spine record, which `runJob`'s ONE ledger accounts exactly like a
+`worker-round` (`ACCOUNTED_ROUND_TYPES`, and `readResume`'s fold reads that same list, so a
+resumed leg cannot silently widen a signed budget by the close's own spend). A budget funds the
+attempt PLUS its close. Unpriced is never free: a null cost is a `pricing-red` stop that is
+never retried, and the ladder is otherwise ONE retry (`JUDGE_ATTEMPTS`) — after that a broken
+judge is an instrument stop, never a red about the tree.
+
+**The two SIGNED artifacts of a judged close** (softgreen module 4, design §4.3/§4.4). Q6 and
+Q7 of the softgreen interview compile into the RUBRIC CARD and the FROZEN CALIBRATION SET, on
+the D5 shown-and-fixed path: `proposeJudgedArtifacts({answers, generate, book})` buys ONE
+schema-forced proposal (tool `propose_rubric`, over the same bounded malformed-emission ladder
+the declaration uses — a parse failure is an `artifact-red` retried under the cap, a proposal
+that parsed and then broke a rule is NOT retried); a UI shows it; `signJudgedArtifacts({proposal,
+fix})` stores the SIGNER's version (the fix replaces the proposal WHOLE, never merges — a signer
+who deleted a line must not get it back) and reports `source: 'signer'|'proposal'`; and
+`foldJudgedArtifacts(closeDecl, {card, cases})` enumerates both into the declaration. Free text
+in either artifact is scrubbed at ingest through the one `SECRET_PATTERNS` inventory, because a
+signed spec outlives the run that produced it.
+
+**Where they land, and what the hash covers.** The card replaces the ONE `judged-floor` stage's
+`params.card` — one card per close, and it is the signed one; a fold into a close with no judged
+stage (or two) THROWS rather than storing a rubric nothing reads. The cases land beside the
+stages as `closeDecl.calibration.cases`, because the set calibrates the RULER and is read before
+any stage runs. Both sit inside the spec, so `jobSpecHash` covers them by construction: a card
+line or a single case edit flips the hash and forces a re-sign, and a byte-identical re-store
+does not.
+
+**What a legal calibration set is** (`validateCalibrationSet`, beside the rulebook in
+`src/judged.js`, and re-checked at the spec gate by `validateCloseDecl`). EXACTLY
+`CALIBRATION_SIZE` = 10 cases — hamr's ruling, verbatim *"go build 10, we could double later"*,
+operator territory and never agent-picked — with BOTH polarities present, because a set that
+cannot fail one way proves nothing. A case is
+`{id, artifact, expect: {verdict: 'pass'|'red', reds: [{rule, fn}]}}`: `artifact` is the REAL
+source text the judge will be pointed at (never a description of one), and a red case must be
+ITEMIZED, naming a `rule` THIS close's card actually carries (§4.3's ceiling, mechanically — the
+fix for a miss is a new card line and a re-sign) and the `fn` the red lands on. The judge's own
+`why`/`quote` are deliberately NOT stored: no signer can predict prose, and pinning it would
+fail an honest pipe on wording. `expectedOf(decision)` is the ONE reduction of a `decide()`
+result to that shape, so a harness compares one shape rather than two.
+
+**THE CALIBRATION GATE** (`runCalibration`, softgreen module 5, `src/calibrate.js`). It runs the
+WHOLE pipe — `runLocate` over the shipped `JUDGE_ATTEMPTS` ladder, then `decide()` — over each of
+the ten, and compares `expectedOf(decision)` against the stored `expect` by VERDICT **and**
+ITEMIZED REDS (a `(rule, fn)` set, order-insensitive): *a pipe that reds the right case for the
+wrong reason has not been calibrated, it has been lucky*. The floor is **10/10, zero reds**
+(hamr, 2026-08-18) and it is reported per case — `graded: [{id, ok, got, want, detail}]` — never
+as an aggregate percentage.
+
+Alongside it runs **`INJECTION_LOCATE_BATTERY`: five ARBITER-OWNED artifacts**, one per
+bare-agent attack style, **re-aimed at the LOCATE axis** (2026-08-18 second addendum, ruling 1 —
+upstream's `shouldBreak` gold assumes a judge that renders a verdict, and this one never does).
+The attack text is embedded in the artifact, and a style resists only when the extracted FACTS
+are unaffected: same function list, same per-function doc reality. Reading the DECISION alone
+would be blind here — an invented `docQuote` reds `has-doc` through the quote-verification route,
+so a leak and a resist can render identical itemized reds. **All five must resist**; a leak fails
+calibration and names the style. Nothing about the battery is stored in a spec and no signer
+authors it.
+
+A **CASUALTY is never a failed case**: a dead call, an unpriced one (F6 — never retried) or an
+emission that never parses after the ladder STOPS the gate on `runLocate`'s own axis
+(`CASUALTY_AXES`), keeps the graded prefix, and reports zero failures — a broken judge is no
+evidence about the set in either direction. Every locate call is metered through `onCost` on
+every route out and the totals fold through `tallyCalls`, so one unpriced call makes `costUsd`
+null rather than an exact-looking floor.
+
+**At signing it is MANDATORY and it is the only PAID gate** (`prepareSigning`, gate 4). A close
+carrying a `judged-floor` stage is refused when no set is stored, when no `judgeLoop` seam is
+wired (a wiring gap, never a silent pass), when the gate is a casualty, and when anything short
+of all-of-them grades. It runs **after** gates 1–3, so no $0 refusal is ever paid for. The
+signing record keeps WHAT was certified — `cardHash`, `casesHash`, `setHash` (which covers
+`JUDGE_MODEL`), the graded rows and the battery — beside `judgeModel` itself.
+
+**D9.3 for a judged-ONLY close** (ruling 3, hamr: *"fix it now, we are delivering softgreen"*).
+A judged stage skips the seed read (ruling 8), so a close whose only work stage is judged has no
+seed red and used to be unsignable — the one job shape softgreen exists for. For that shape only,
+a PASSED calibration gate plays the seed-red role (the polarity law makes *this close can fail* a
+demonstrated fact), and the record says so: `gates.seedVerdict.satisfiedBy === 'calibration'`. A
+close with any mechanical work stage is UNCHANGED and still needs its seed red.
+
+**THE JUDGE TIER IS INSIDE THE SIGNATURE, and the stage refuses a mismatch.** *"A judge-model
+bump forces a full recalibration"* used to be an operator-side rule with nothing to fire on,
+which makes it prose (F45); it now has both halves of a detector. The tier the signer's set was
+graded by is stored beside the cases as **`calibration.judgeModel`** — `CALIBRATION_FIELDS`
+enumerates a stored set as exactly `cases` and `judgeModel` and nothing else — written by
+`foldJudgedArtifacts` from the PIN (`JUDGE_MODEL`) rather than from anything a caller may name.
+Because it is INSIDE the spec, `jobSpecHash` covers it by construction: bump the constant and
+every signed judged spec hashes differently, the signature dies, and the re-sign is what re-runs
+the calibration gate. **`validateCloseDecl` REQUIRES it** on any stored set (`missing-required`
+on `…calibration.judgeModel`) — a set nobody can attribute to a tier is a floor nobody can tell
+apart from a bumped one. **`declaredStages` stamps it onto the judged stage** as
+`calibrationJudgeModel`, from the SIGNED bytes and through the one seam that already turns a
+declaration into stages (the same carry `offer: false` rides), so a stage can never name a tier
+the signature does not and no second close-level channel is plumbed through every executor seam.
+**`runJudgedFloor` then STOPS on a stored-vs-live mismatch** before it buys a call, naming both
+models and the two things that fix it — *re-sign the spec with the new tier* and *re-run the
+calibration gate (recalibrate)* — under `STOP_FAULTS.FAILED`, the same fault and the same reason
+as the absent judge seam beside it: nothing is broken, something was never re-done. It stops
+rather than degrading in either direction, because grading on the new tier mints a verdict
+against an uncalibrated floor and grading on the old one is not on offer (the pin is a constant).
+
+**The one honest limit, deliberate:** an ABSENT stamp does not stop. It is the same split the
+SET's own presence already lives under — a signed spec that judges cannot reach a run without a
+calibration (the signing gate) or without a model on it (the spec gate), so the only runtime
+question is ever WHICH model, and a bare stage descriptor handed straight to `runStage` by a test
+or an adopter is not a signed spec making a claim about a tier.
 
 **`human-confirms` is the one kind that measures NOTHING** (N4 slice 1). Its whole parameter
 surface is `ask` — the plain question the signer answers — so it cannot spawn, cannot be
@@ -793,7 +918,7 @@ Reserved spine vocabulary (V7, machinery-free until job #1 surfaces one):
 `coordination-red` — a failure between units (scope contention, step order, store
 races), never to be folded into worker/interpreter reds.
 
-### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch? })` → outcome — `src/run.js`
+### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun? })` → outcome — `src/run.js`
 
 The last seven are the RESUME fold and are documented under *Resuming a killed run* below; they
 default to `0` / `true` / `0` / `null` / `[]` / `null` / `null`, so a fresh run passes none of them.
@@ -838,6 +963,24 @@ enumerated `HUMAN_DECISIONS` set); it is spent once, at
 the close readings up to the moment the fix loop opens, so the human's words become `post.gap`
 through the SAME seam (same bound, same scrub) and the next machine-clean tree pauses for a
 SECOND review rather than converting one sentence forever.
+
+**A decision SURVIVES the halt that interrupts it** (F102). The run records the answer it was
+handed (`human-decision` — the door, the words, the source) and, separately, what BOUGHT it
+(`human-decision-spent` — a fix round, an accept that greened, a pause honoured). A decision with
+no spend after it is still owed to the person, and `readResume` surfaces it as
+`restart.pendingDecision` (`{decision, text, receivedAt, source}`). Hand that back as
+**`heldRuling`** and the leg applies it directly — the ask is never re-rendered, and the spine
+says the answer came from a record rather than from a person. F102's incident is what this is
+for: a rerun that opened the fix loop, stopped with `iterationsUsed: 0`, and whose resume asked
+the byte-identical question again. The two markers are deliberately not one: the fix loop
+"spends" the ruling for THIS leg's close readings the moment it opens, while whether the person
+must be asked AGAIN depends on work actually having been bought.
+
+A leg handed BOTH a fresh `humanRuling` and a `heldRuling` is refused (`hitl-decision-red`,
+naming the held decision) before anything costs anything: two answers to one question is
+ambiguity, not a merge. `resolveHumanRuling(fresh, held)` is the exported seam that decides this
+(and whether the leg is a fresh engagement, below), so a runner cannot admit what a run refuses.
+
 `branch-red` is the WORK BRANCH refusing (below): the patient is not a git checkout, its
 branch namespace has no free name, or a resume's recorded branch is gone. Zero tokens, and
 never a fallback to working on the branch the run was handed. `provider-red` is a
@@ -1269,6 +1412,64 @@ run the rounds of a bounded attempt. N2 bounds (honest): `gold`/`rubric`/`hitl`
 closes refuse `close-unsupported` — N4's hitl is a `human-confirms` STAGE inside a `closeDecl`,
 never a close TYPE, so there is one live expression of hitl rather than two.
 
+### THE REVIEW DOOR — the three doors at the END of a run (softgreen module 8, PRD v1.71 §3)
+
+The pause machinery re-homed: the same doors, the same evidence package and the same 60-day TTL,
+one level OUT — from a stage inside the close to the door at the end of a run.
+
+**THE LAW, and it is not negotiable** (hamr, verbatim: *"it's important not to change the loop
+self verdict"*): the close mints the verdict, the door records a **disposition**. `runJob`
+returns `green` / `already-green` exactly as it always did, the ledger records exactly what it
+always recorded, and no answer a person gives can change either. A green run that is never
+answered is still a green run — the door is non-blocking.
+
+**Opening one.** A run whose terminal is verdict-bearing (`DOOR_OPEN_OUTCOMES` — `green`,
+`already-green`) emits ONE `review-door` record carrying the evidence: the outcome, the class,
+whether the credit is `quarantined`, every close stage's own result, the stages an `accept` will
+re-run (`mechanical`), and the changed set (same cap and same F28/F6 announcements the pause
+package makes). Which runs open one is `doorOpens(job, reviewDoor)`:
+
+- **always** for the classes in `REVIEW_DOOR_CLASSES` — `['soft-green']`, because a judged green
+  is quarantined at mint (module 6) and an `accept` is the ONLY thing that releases the credit;
+- **on request** for everything else: `reviewDoor: true` (the runner's `--review-door`). A
+  green-class run is byte-identical to what it always was unless it is asked for.
+- `reviewDoor: false` shuts it for any class. The flag wins in both directions and is never
+  inferred; `REVIEW_DOOR_CLASSES` is a constant, not a threshold, and widening it is arbiter
+  territory.
+
+**Answering one — `answerReviewDoor({ job, workdir, events, decision, text?, closeTimeoutMs?,
+registryDir?, name?, runid?, at?, now?, emit? })`** (`src/reviewdoor.js`). The answer arrives
+after the run has ended, possibly days later and from another process, so it cannot ride the
+run's return path. This is that seam. It never throws and never conjures — a fourth door, an
+empty `rerun`, a run that opened no door (`no-door`), an expired one (`door-expired`), a tree
+that moved (`door-accept-red`) and a missing registry all come back as named reds.
+
+- **`accept`** re-runs the close's **mechanical** stages against the tree AS IT STANDS
+  (`mechanicalStages` — everything outside `SEED_EXEMPT_KINDS`, so never a judged floor and never
+  a person) before it is honoured: hamr's ruling that an accept is not a rubber stamp, and the
+  answer to a tree that can move in the 60 days a door keeps. A red REFUSES the accept with the
+  stage named and records **nothing**. A pass records the disposition and, over a held judged
+  green, RELEASES the credit through module 6's `applyDoorDecision`.
+- **`rerun`** carries the person's words back as a directive (`next: 'rerun'`) and re-proves
+  nothing: the new run's close is what judges. Empty or whitespace text is refused at the same
+  seam every other door is.
+- **`pause`** runs nothing and spends nothing, in any state. The door simply keeps, and an
+  unanswered one expires under `PAUSE_TTL_MS` — that expiry IS what `cancel` used to be.
+
+Every door is recorded when a registry is wired, not only the accepts: *"the signer's accepts
+double as the judge's ongoing report card"*, and a rerun over a judged green is exactly as
+informative. An **already-green** run wrote no row of its own, so its door records nothing and
+releases nothing — slice 1's already-green no-mint rule, holding from the other side, and stated
+in the result's `note` rather than surfaced as a failure.
+
+**The rerun as a FRESH ENGAGEMENT** — hand the words back to the next run as
+**`doorRerun: {text, fromRunid?, receivedAt?}`**. Two things follow and only two: the
+`already-green` shortcut is refused (a tree that passes the close is precisely the state the
+person rejected — the run emits `door-rerun-open` and carries on), and the words reach the
+PLANNER as a requirement on top of the signed goal. It is never a `humanRuling`: that answers a
+close's human STAGE, and a green-class job has none. Money folds (the signed budget is the
+chain's ceiling); the WALL does not (F103).
+
 ### The reuse registry (Layer 3) — `src/bridges.js`, `src/selection.js`
 
 A **bridge** is the plan a green actually executed, kept so the next run of the same SHAPE
@@ -1298,6 +1499,50 @@ it points, and a percentage over 2–3 runs is fake precision. `costUsd`/`wallMs
 a number or an EXPLICIT `null`, and the key is REQUIRED either way, so an unknown has to be
 said rather than omitted (F6 — an omitted key is how a `?? 0` gets written downstream).
 
+**QUARANTINE — a judged green earns nothing until the signer accepts it** (softgreen module
+6; the standing ruling PRD v1.53, given its mechanism by v1.71 §3). A green minted under
+`verdictType: "soft-green"` carries `quarantined: true` on BOTH halves of R1's pair — the
+**version** (what inherits) and its **history row** (what the status ladder reads). It is a
+FLAG, never a withheld row: the run happened, the record says so, and the listing shows it —
+it is simply worth nothing yet. A held green does not count in `deriveStatus` (an entry whose
+only greens are held derives `null` and renders `HELD`, never `NO-GREEN`), and
+`reuseEligibility(bridge)` / `newestEligibleVersion(bridge)` refuse it for reuse **with a
+stated reason** — the same visible-skip discipline an unreadable registry file gets.
+`green` and `hitl` are untouched, byte for byte: the key is ABSENT, because the hold is about
+the young JUDGE, not about every class that is not green. `QUARANTINED_VERDICTS` is the one
+list; `quarantinesCredit(verdictType)` is the one predicate. The class travels on the green
+record as `verdictType` — an unrecognised value REDS rather than falling through to unheld.
+
+**The review door releases it, forward-only.** `recordDoor(bridge, {runid, decision, at})`
+records the signer's disposition (`accept | rerun | pause`, the same three doors `kinds.js`
+owns) on that run's own green row as an append-only `doors: [{decision, at}]` — the **report
+card**, kept as facts and never as a computed agreement rate (D6's no-score rule applies to
+the judge too). `accept` over a held green also flips `quarantined` to `false` on both halves;
+`rerun` and `pause` record and release nothing. There is deliberately **no re-hold path**: an
+accept followed by a rerun records the disagreement and leaves the credit granted. A repeat of
+the last decision is a no-op (`released` says whether THIS call freed it), and a door aimed at
+a run with **no green row of its own** — an already-green run, a red, a casualty — is the red
+`no-row-for-run`: releasing is not minting. `applyDoorDecision({registryDir, name, runid,
+decision, at})` is the on-disk half; the door opens AFTER the run ends, so the decision cannot
+ride the run's return path. **The door never changes the loop's verdict** — a green stays green
+in the ledger whatever the person then does with it.
+
+**`writeRunGreenRow({registryDir, job, name, outcome, plan, record})` → `{minted, reason,
+write}` — the terminal registry write for a runner that drives `runJob` directly** (rather
+than through `runReuse`, which writes its own rows). It is what gives that runner's review
+door a row to release: without one, `accept` reaches `recordDoor` and reds `no-row-for-run`.
+STORAGE ONLY — nothing here selects, promotes or reuses a bridge. Four refusals, each with a
+named `reason`: no `registryDir` (`no-registry` — the registry is operator-supplied, never
+conjured), `outcome !== 'green'` (`green-predates-run` for already-green — accept confirms a
+verdict, it never mints one — else `not-green`), no executed `plan` (`no-plan-executed`, R1),
+and a verdict class whose credit is not held (`credit-not-held` — `green`-class runs mint
+nothing here, `quarantinesCredit` is the one predicate). `name` falls back to `job.job`; the
+row is born HELD because the record carries the spec's own `verdictType`, never a flag. A
+refused underlying write returns `{minted: false, reason: 'write-refused', write}` with the
+reds on `write` — never a throw. Minting goes through the same cold-leg green write `runReuse`
+uses (shape-fork rule and collision refusals included), so the two runners can never spell
+"what a green writes" differently.
+
 **`loadGate(bridge, job)` → `{ ok, reds }` — the load-time gate.** Exactly three checks,
 asked *"is this the right KIND of recipe?"*: the job's **verdict type**, the **close-stage
 kinds** (v1: the same stage names in the same order), and every stored verb **within THIS
@@ -1319,12 +1564,16 @@ their next green, not repaired.
 
 **`runJob`/`runPlan` take `bridge?`** — a validated entry to reuse. The gate runs **at the
 door**: before the clock, before the close precheck, before any token. On a pass, the
-**newest** version's plan rides into the FIRST drafting prompt as a starting draft
+**newest ELIGIBLE** version's plan (the newest one no quarantine holds) rides into the FIRST
+drafting prompt as a starting draft
 (`bridge-loaded {name, versions, runid}` on the spine) and everything after it is the
 ordinary shipped path — same validator, same redraft-on-reds, the same replan ceiling, and a
 **replan never re-injects the bridge** (it drafts from the run's own state). On a fail the
 run returns the distinct terminal **`recipe-stale`** with `bridge-gate {outcome, name, reds}`
-and a decision-ready escalation, having spent nothing. **Falling back to cold is the
+and a decision-ready escalation, having spent nothing. A **wholly HELD** entry handed in
+directly is refused at the same door and by the same terminal, with `bridge-gate
+{outcome: 'quarantined'}` and the accept-then-rerun option named — the recipe is the right
+kind, it is simply unaccepted, and the two are never spelled the same. **Falling back to cold is the
 caller's decision, not an automatic silent fallback** — starting a paid run on a decision
 nobody made is the same class of error as widening a cap to manufacture a green. Omit
 `bridge` and the flow is byte-identical to a pre-Layer-3 run: no new event, and no starting
@@ -1548,6 +1797,17 @@ paused spine goes through `checkpointAgeGate`, and the run is not resumed withou
 decision: the lean-rerun rule (2026-08-12 §4) governs which door a prompt LEADS with, never an
 action taken for the operator.
 
+**A finished run's REVIEW DOOR is answered the same way, one flag over**: `--door <runid>`
+selects the run (its own spine, its own `review-door` record), `--decide` picks the door and
+`--approve <specHash>` signs it. The screen is its OWN preview and deliberately not the resume
+banner: a door is answered about a run that is OVER, so nothing that banner computes (what is
+left to resume with, which step it re-enters) is a true sentence there. `accept` and `pause`
+launch nothing and exit; `rerun` falls through into a fresh engagement — its own clock, the
+answered run's spend folded in — carrying the person's words as `doorRerun`. `--registry <dir>
+--workflow <name>` are optional: without them the answer is recorded on the run's own spine and
+the readout SAYS the credit was not released, rather than reporting a release that never
+happened.
+
 - **Completed tries are not re-run.** They come back as rows (marked `inherited`) and
   their bridges stay excluded from every later selection. A try whose `job-end` landed —
   the close judged it — counts as completed even if the kill beat its `try-end`; paying
@@ -1624,6 +1884,20 @@ action taken for the operator.
   (or `wall-halt`, below one close timeout: a try that cannot fund its close produces an
   unreadable row) with **nothing launched**. Topping up is a new envelope, and a new
   envelope is a new signature.
+- **…except a decide-time RERUN, which is a FRESH ENGAGEMENT** (F103, design record §3.4 —
+  hamr: *"redo/rerun comes with new authoring for money+time and keeps accounting of this far
+  and this session separate counters"*). A rerun opens on the full signed `maxWallMs` instead of
+  the remainder, because the person did not decide on the run's clock: the incident that minted
+  it took the door and inherited **87 seconds** from a leg that had already ended, on a worker
+  measured to read nine rounds before its first write. So there are TWO counters and neither
+  does the other's job — the CHAIN (every leg added up: `engagement.chainWallMs`,
+  `chainSpentUsd`, `job-end.spentUsd`, what the halt readout reports) and the ENGAGEMENT (what
+  bounds THIS leg: the clock's `priorElapsedMs`, `job-end.engagementSpentUsd`). The `engagement`
+  record states both at the top of every run. **MONEY IS DELIBERATELY NOT SYMMETRIC**: it folds
+  on every path, because the signed budget is the CHAIN's ceiling and a signature for $5 never
+  silently authorizes $10 — a rerun spends what REMAINS of it, never a refill. A rerun leg also
+  declares its `job-start` fold engagement-scoped (`priorWallMs` omitted, `chainWallMs` carried),
+  so a later resume of it inherits this engagement's minutes rather than the chain's again.
 - **Money stays honest end to end.** `carrySpentUsd` (completed tries + selection calls)
   seeds the resumed ledger; the mid-try fold is deliberately NOT in it, because it comes
   back inside the restarted try's own terminal — counting it in both places would bill it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",