bareloop 0.11.0 → 0.12.0

package/types/cardauthor.d.ts

@@ -0,0 +1,352 @@
+/**
+ * The proposal's shape, and therefore the whole shape the compiler can express.
+ *
+ * `rule` is an ENUM off the judge's own rulebook in BOTH places it appears — the
+ * card's lines and a case's expected reds — because wherever only a closed set
+ * can satisfy a field, the illegal value is made INEXPRESSIBLE rather than
+ * rejected after the fact (the `check-passes(name)` model). The SIZE is pinned by
+ * `minItems`/`maxItems` from the one constant, so nine and eleven are both
+ * unsayable rather than argued about afterwards.
+ *
+ * `artifact` and `text` are the only free strings, and neither decides anything:
+ * one is the code the judge will read, the other is the signer's own words.
+ */
+export function proposalSchema(): {
+    type: string;
+    properties: {
+        card: {
+            type: string;
+            description: string;
+            properties: {
+                items: {
+                    type: string;
+                    minItems: number;
+                    items: {
+                        type: string;
+                        properties: {
+                            rule: {
+                                enum: string[];
+                                description: string;
+                            };
+                            text: {
+                                type: string;
+                                minLength: number;
+                                description: string;
+                            };
+                        };
+                        required: string[];
+                        additionalProperties: boolean;
+                    };
+                };
+            };
+            required: string[];
+            additionalProperties: boolean;
+        };
+        cases: {
+            type: string;
+            minItems: number;
+            maxItems: number;
+            description: string;
+            items: {
+                type: string;
+                properties: {
+                    id: {
+                        type: string;
+                        minLength: number;
+                        description: string;
+                    };
+                    artifact: {
+                        type: string;
+                        minLength: number;
+                        description: string;
+                    };
+                    expect: {
+                        type: string;
+                        properties: {
+                            verdict: {
+                                enum: string[];
+                            };
+                            reds: {
+                                type: string;
+                                description: string;
+                                items: {
+                                    type: string;
+                                    properties: {
+                                        rule: {
+                                            enum: string[];
+                                            description: string;
+                                        };
+                                        fn: {
+                                            type: string;
+                                            minLength: number;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                    additionalProperties: boolean;
+                                };
+                            };
+                        };
+                        required: string[];
+                        additionalProperties: boolean;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+        };
+    };
+    required: string[];
+    additionalProperties: boolean;
+};
+/**
+ * The output channel. It records and acknowledges; it takes no action, which is
+ * why handing it to a toolless compile call does not reopen D3.
+ * @param {{calls: any[]}} box
+ */
+export function proposalTool(box: {
+    calls: any[];
+}): {
+    name: string;
+    description: string;
+    parameters: {
+        type: string;
+        properties: {
+            card: {
+                type: string;
+                description: string;
+                properties: {
+                    items: {
+                        type: string;
+                        minItems: number;
+                        items: {
+                            type: string;
+                            properties: {
+                                rule: {
+                                    enum: string[];
+                                    description: string;
+                                };
+                                text: {
+                                    type: string;
+                                    minLength: number;
+                                    description: string;
+                                };
+                            };
+                            required: string[];
+                            additionalProperties: boolean;
+                        };
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+            cases: {
+                type: string;
+                minItems: number;
+                maxItems: number;
+                description: string;
+                items: {
+                    type: string;
+                    properties: {
+                        id: {
+                            type: string;
+                            minLength: number;
+                            description: string;
+                        };
+                        artifact: {
+                            type: string;
+                            minLength: number;
+                            description: string;
+                        };
+                        expect: {
+                            type: string;
+                            properties: {
+                                verdict: {
+                                    enum: string[];
+                                };
+                                reds: {
+                                    type: string;
+                                    description: string;
+                                    items: {
+                                        type: string;
+                                        properties: {
+                                            rule: {
+                                                enum: string[];
+                                                description: string;
+                                            };
+                                            fn: {
+                                                type: string;
+                                                minLength: number;
+                                                description: string;
+                                            };
+                                        };
+                                        required: string[];
+                                        additionalProperties: boolean;
+                                    };
+                                };
+                            };
+                            required: string[];
+                            additionalProperties: boolean;
+                        };
+                    };
+                    required: string[];
+                    additionalProperties: boolean;
+                };
+            };
+        };
+        required: string[];
+        additionalProperties: boolean;
+    };
+    execute: (args: any) => Promise<string>;
+};
+/**
+ * The compile prompt. Q6's and Q7's answers travel VERBATIM — they are the whole
+ * input, and paraphrasing a lay answer is how a rubric stops being the person's.
+ *
+ * The rulebook is rendered from `JUDGE_RULES` itself rather than restated, for
+ * the reason the catalogue block is rendered from the catalogue: the prompt and
+ * the gate must describe one set of facts.
+ * @param {{answers: Record<string|number, any>, questions?: Record<string|number, string>}} o
+ */
+export function cardCasesPrompt({ answers, questions }: {
+    answers: Record<string | number, any>;
+    questions?: Record<string | number, string>;
+}): string;
+/**
+ * THE D5 MOMENT. The proposal is SHOWN; the signer's `fix` is what is STORED.
+ *
+ * The fix replaces the proposal WHOLE rather than merging into it. A merge would
+ * mean a signer who deleted a card line got it back, and "the signer signs the
+ * whole hash" is not a rule that survives a field-wise reconciliation. Handing
+ * back no fix is a legal answer — signing the proposal as proposed — and it says
+ * so (`source`), because *a person read this and changed nothing* and *nobody has
+ * looked* are two different facts.
+ *
+ * THE GATE RUNS OVER WHAT WILL BE STORED, never over the proposal: a signer can
+ * fix a legal proposal into an illegal one, and the artifact that reaches the
+ * hash is the one that must be legal.
+ *
+ * `scrubbed` is the INGEST SCRUB'S OWN ANNOUNCEMENT — the paths whose bytes the
+ * secret inventory masked on the way in. Empty on every honest artifact, and
+ * never silent when it is not: a signer signs a hash over the STORED bytes, so
+ * "what you typed is not what was stored" is a fact they are owed rather than one
+ * the redactor keeps.
+ * @param {{proposal: any, fix?: any}} o
+ * @returns {{ok: boolean, reds: Red[], card: any, cases: any[]|null, source: 'signer'|'proposal',
+ *   scrubbed: {path: string}[]}}
+ */
+export function signJudgedArtifacts({ proposal, fix }: {
+    proposal: any;
+    fix?: any;
+}): {
+    ok: boolean;
+    reds: Red[];
+    card: any;
+    cases: any[] | null;
+    source: "signer" | "proposal";
+    scrubbed: {
+        path: string;
+    }[];
+};
+/**
+ * Fold the two signed artifacts into the close declaration, ENUMERATED.
+ *
+ * WHERE EACH LANDS, and both are inside the spec so `jobSpecHash` covers them by
+ * construction (the hash is over the whole resolved spec):
+ *   - THE CARD replaces the judged stage's own `params.card`. ONE card, and it is
+ *     the SIGNED one: the composer's draft is a draft, and two cards in one close
+ *     is the drift a single storage site exists to prevent. The stage is where it
+ *     already lives, which is what `validateCard`, the M2 runner and the locate
+ *     prompt all read.
+ *   - THE CASES land beside the stages as `calibration.cases` — a close-level
+ *     artifact, because the set calibrates the RULER and not one stage's params,
+ *     and because module 5's gate reads it before any stage runs.
+ *   - THE JUDGE MODEL lands beside them as `calibration.judgeModel`, and it is the
+ *     PIN (`JUDGE_MODEL`) rather than anything a caller may name. A calibration set
+ *     is only worth the tier that graded it — §4.2's whole safety argument is worth
+ *     exactly as much as BA-20's injection evidence, which is haiku-4.5's alone — so
+ *     the set has to carry which tier certified it or nothing downstream can tell a
+ *     signed floor from a bumped one. Storing it HERE, inside the spec, is what makes
+ *     a bump flip `jobSpecHash`: the signature dies, the signer re-signs, and a
+ *     re-sign is a re-run of the calibration gate. That is the docstring on
+ *     `JUDGE_MODEL` finally given a detector instead of a promise (F45).
+ *
+ * A card with NOWHERE TO LAND THROWS. It is a caller's own broken input — a
+ * signed rubric folded into a close with no judged ruler — and there is no safe
+ * direction to degrade toward: storing it would sign a rubric nothing reads.
+ *
+ * The input is never mutated: a closeDecl is a signed artefact and rewriting a
+ * caller's copy in place is how two readers come to disagree about what was
+ * signed.
+ * @param {any} closeDecl @param {{card: any, cases: any[]}} o
+ * @returns {any} a new closeDecl
+ */
+export function foldJudgedArtifacts(closeDecl: any, { card, cases }: {
+    card: any;
+    cases: any[];
+}): any;
+/**
+ * ONE compile call: the person's Q6 and Q7 in, a proposal out.
+ *
+ * It buys ONE artifact through ONE channel, and the malformed-emission ladder is
+ * the SHARED one (`askStructured`) rather than a second copy — a second ladder is
+ * a second place for the cap, the reject block and the re-ask to drift.
+ *
+ * WHAT IS AND IS NOT RETRIED, and the split is the standing one: a reply that
+ * carries no proposal is a TRANSPORT fault and is retried under the bound; a
+ * proposal that PARSED and then broke the ruling is not — the model answered
+ * perfectly clearly and re-asking buys another call to be told the same thing.
+ * The proposal is returned as it was said, never repaired: no JSON repair, ever.
+ *
+ * The book is the CALLER's, so one ceiling governs the survey, the declaration
+ * ladder and this compile — the advertised ceiling and the enforced ceiling are
+ * the same ceiling.
+ * @param {{answers: Record<string|number, any>, questions?: Record<string|number, string>,
+ *   generate: Function, book?: ReturnType<typeof makeCostBook>,
+ *   structuredMode?: 'tool'|'text', structureRetries?: number}} o
+ * @returns {Promise<{ok: boolean, proposal: any, reds: Red[], stop: string|null,
+ *   attempts: number, raw: string, cost: any, raws: any[]}>}
+ */
+export function proposeJudgedArtifacts({ answers, questions, generate, book, structuredMode, structureRetries, }: {
+    answers: Record<string | number, any>;
+    questions?: Record<string | number, string>;
+    generate: Function;
+    book?: ReturnType<typeof makeCostBook>;
+    structuredMode?: "tool" | "text";
+    structureRetries?: number;
+}): Promise<{
+    ok: boolean;
+    proposal: any;
+    reds: Red[];
+    stop: string | null;
+    attempts: number;
+    raw: string;
+    cost: any;
+    raws: any[];
+}>;
+/** @typedef {{code: string, path: string, detail: string, [k: string]: any}} Red */
+/** the output channel for the compile. It takes no action; it carries the answer. */
+export const PROPOSAL_TOOL_NAME: "propose_rubric";
+/** what the tool returns. The loop stops on delivery, so the model never reads it. */
+export const PROPOSAL_ACK: "proposal received";
+/** the label the compile call is metered and persisted under — one spelling */
+export const PROPOSAL_LABEL: "judged-compile";
+/** a malformed EMISSION is a transport fault, bounded on its own axis — the same
+ * ceiling `authorClose` declares for the declaration channel */
+export const MAX_PROPOSAL_RETRIES: 2;
+/**
+ * The system prompt a caller BINDS ITS SEAM WITH — this module owns no provider
+ * and picks none, exactly as `authorClose` does not: the compile call arrives as
+ * `generate`, and a caller wires it with `makeLoopGenerate(provider, {system:
+ * COMPILE_SYSTEM})`, whose own `maxTokens` default (F30) is what holds ten
+ * artifacts. Exported rather than inlined so the one register this call is made
+ * in is not re-spelled at every integration.
+ */
+export const COMPILE_SYSTEM: string;
+export type Red = {
+    code: string;
+    path: string;
+    detail: string;
+    [k: string]: any;
+};
+import { makeCostBook } from './authorflow.js';

package/types/declaredclose.d.ts

@@ -6,6 +6,16 @@ export function isDeclaredClose(job: any): boolean;
  *
  * `offer` and `needs` pass through untouched when a declaration carries them
  * (v1's schema does not let one), so `checkMenu`'s derivation is unchanged.
+ *
+ * THE JUDGE TIER RIDES ALONG, and it rides as a STAMP for the same reason `offer`
+ * does. The tier that graded this close's calibration set is a CLOSE-level fact
+ * (`calibration.judgeModel`), and the stage that would buy a judge call is a STAGE;
+ * `runStage` is handed stages and never the declaration they came out of. Rather than
+ * plumb a second close-level channel down through every executor seam, the one place
+ * that already turns a declaration into stages carries it across — and it carries it
+ * from the SIGNED bytes, so a stage can never name a tier the signature does not.
+ * `runJudgedFloor` refuses a mismatch; the absence of a stamp is the SPEC gate's
+ * business (`validateCloseDecl` reds a set with no model), never a runtime fall-back.
  * @param {any} closeDecl
  * @returns {any[]|null} null when this is not a declaration
  */
@@ -98,7 +108,9 @@ export function guardNames(closeDecl: any, verdictType: string): string[];
  * @param {(s: string) => string} [redact] the scrub, applied at THIS boundary
  * @param {{timeoutMs?: number, cwd?: string, seedRef?: string,
  *   seedTrees?: any, gapCap?: number, maxBuffer?: number, baselineMode?: 'auto'|'worktree',
- *   humanRuling?: {decision: string, text?: string|null}|null}} [opts]
+ *   humanRuling?: {decision: string, text?: string|null}|null,
+ *   judgeLoop?: ((o: {system: string}) => any)|null,
+ *   onJudgeCost?: ((c: any) => void)|null}} [opts]
  * @returns {Promise<any>}
  */
 export function runDeclaredStages(stages: any[], redact?: (s: string) => string, opts?: {
@@ -113,6 +125,10 @@ export function runDeclaredStages(stages: any[], redact?: (s: string) => string,
         decision: string;
         text?: string | null;
     } | null;
+    judgeLoop?: ((o: {
+        system: string;
+    }) => any) | null;
+    onJudgeCost?: ((c: any) => void) | null;
 }): Promise<any>;
 /**
  * The trend reader's input for ONE close verdict, whichever executor produced
@@ -155,6 +171,12 @@ export const DECLARED_GENRES: readonly "TYPES"[];
  * channel of its own.
  */
 export const CLOSE_DECL_FIELDS: readonly string[];
+/** what a stored calibration set carries, ENUMERATED: the frozen cases and the judge
+ * tier that graded them. Both are inside the spec, so `jobSpecHash` covers both — which
+ * is the whole mechanism behind "a judge-model bump forces a full recalibration"
+ * (src/judged.js, `JUDGE_MODEL`): the field moves, the hash moves, the signature dies,
+ * and the re-sign re-runs the gate. Anything else in there is a field nobody reads. */
+export const CALIBRATION_FIELDS: readonly string[];
 /**
  * The prefix M1 puts on EVERY gap line of a declared stage (its `ctx.gapKeep`).
  * A literal, so the anchored pattern below is exact.
@@ -215,10 +237,17 @@ export const HUMAN_CHECKPOINTS: readonly string[];
  * validator reads one hierarchy table rather than hard-coding a class.
  *
  * `hard` is by CONSTRUCTION: every mechanical kind is a command whose measurement
- * is the truth. `hitl` joined it at N4 slice 1, and only because `human-confirms`
- * is genuinely LIVE — the widening and the kind go in one commit, or this table
- * admits a class the executor cannot render. The `soft` class is still absent:
- * `judged-floor` is locked, so no declaration can reach above hitl.
+ * is the truth. `hitl` joined it at N4 slice 1, and `soft` at softgreen module 3
+ * — each only because its kind is genuinely LIVE (`human-confirms`, then
+ * `judged-floor`): the widening and the kind go in one commit, or this table
+ * admits a class the executor cannot render.
+ *
+ * `hitl` STAYS despite the class's retirement (PRD v1.71: the human stage moved
+ * out of the close and became the review door at the end of every run). It is
+ * kept because `jobs/litectx-maintainer.json` is a SIGNED spec carrying a hitl
+ * declaration, and a signed spec is untouchable — dropping the spelling here
+ * would invalidate a signature the operator already gave, which is a re-sign
+ * nobody asked for. Retiring it is a separate, deliberate deletion.
  *
  * The direction that matters is unchanged. This says which class a declaration
  * MAY claim; `closeCeiling` says which class its stages actually NEED. A pick

package/types/index.d.ts

@@ -1,20 +1,24 @@
 export { makeSpine } from "./spine.js";
 export { runPlan } from "./planrun.js";
-export { runJob } from "./run.js";
 export { ralph, runClose, runStages, CLOSE_FAULTS } from "./ralph.js";
 export { globToPrefix, scanSecrets } from "./validate.js";
 export { validateJob, jobSpecHash, checkApproval, checkMenu, CLOSE_TYPES, CLASS_BY_CLOSE, GOLD_COMPARE, CADENCE_UNITS, PROVIDERS, CONDITION_KEYS, TOOL_MENU, LOCKED_TOOLS, STORE_VERBS, VERDICT_TYPES, LOCKED_VERDICTS } from "./job.js";
 export { validatePlan, stageClose, EXIT_TYPES, MAX_EXITS_PER_STEP, MAX_PLAN_STEPS, WRITE_VERBS, closeStagesOf } from "./plan.js";
 export { snapshotScope, evalExits } from "./exits.js";
-export { BRIDGE_SCHEMA, validateBridge, deriveStatus, listingRow, loadGate, mintBridge, appendGreen, appendRed, loadBridge, loadRegistry, saveBridge, makeRegistry, registryExists } from "./bridges.js";
+export { runJob, ACCOUNTED_ROUND_TYPES } from "./run.js";
+export { BRIDGE_SCHEMA, validateBridge, deriveStatus, listingRow, loadGate, mintBridge, appendGreen, appendRed, loadBridge, loadRegistry, saveBridge, makeRegistry, registryExists, QUARANTINED_VERDICTS, QUARANTINED_CODE, quarantinesCredit, newestEligibleVersion, reuseEligibility, recordDoor } from "./bridges.js";
 export { renderListing, selectionPrompt } from "./selection.js";
-export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate } from "./reuse.js";
+export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate, applyDoorDecision, writeRunGreenRow } from "./reuse.js";
 export { classifyIncidents, foldLedger, ledgerDeltas, updateLedger, LEDGER_CLASSES } from "./ledger.js";
 export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE } from "./workbranch.js";
-export { runDeclaredClose, runStage, seedRead, seedAtHead, seedListing, changedSet, makeSeedTrees, LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, EXIT_GREEN, EXIT_RED, EXIT_STOP, HUMAN_DECISIONS, SEED_EXEMPT_KINDS, normalizeHumanRuling } from "./kinds.js";
-export { validateDeclaration, normalizeDeclaration, KIND_CATALOGUE, CATALOGUE_KINDS, CATALOGUE_LIVE_KINDS, LOCKED_KINDS, TYPES_GENRE, TYPES_GENRE_TEMPLATE, GENRE_LANGUAGES, genreEnv, genreOwnedEnvNames, genreInstruments, DIRECTIONS, BASELINES, MAX_STAGES, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, CLASS_BATTERIES, classGuards, closeCeiling, NEVER_OFFERED_KINDS } from "./authoring.js";
+export { runDeclaredClose, runStage, seedRead, seedAtHead, seedListing, changedSet, makeSeedTrees, LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, EXIT_GREEN, EXIT_RED, EXIT_STOP, HUMAN_DECISIONS, SEED_EXEMPT_KINDS, JUDGED_FLOOR_KIND, normalizeHumanRuling, resolveHumanRuling, JUDGE_ATTEMPTS, MAX_JUDGED_PATHS, REVIEW_DOOR, DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages } from "./kinds.js";
+export { answerReviewDoor, doorRecordOf, doorAgeGate } from "./reviewdoor.js";
+export { JUDGE_MODEL, JUDGE_MAX_TOKENS, JUDGE_RULES, JUDGE_RULE_IDS, LOCATE_AXES, LOCATE_LABEL, validateCard, validateFacts, locatePrompt, runLocate, decide, defaultJudgeLoop, CALIBRATION_SIZE, CASE_VERDICTS, validateCalibrationSet, validateJudgedArtifacts, expectedOf } from "./judged.js";
+export { proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts, proposalSchema, proposalTool, cardCasesPrompt, PROPOSAL_TOOL_NAME, PROPOSAL_LABEL, MAX_PROPOSAL_RETRIES, COMPILE_SYSTEM } from "./cardauthor.js";
+export { runCalibration, compareExpectation, factsResist, artifactHash, INJECTION_LOCATE_BATTERY, INJECTION_CARD, CALIBRATION_LABEL, CASUALTY_AXES } from "./calibrate.js";
+export { validateDeclaration, normalizeDeclaration, KIND_CATALOGUE, CATALOGUE_KINDS, CATALOGUE_LIVE_KINDS, LOCKED_KINDS, TYPES_GENRE, TYPES_GENRE_TEMPLATE, GENRE_LANGUAGES, genreEnv, genreOwnedEnvNames, genreInstruments, DIRECTIONS, BASELINES, MAX_STAGES, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, CLASS_BATTERIES, classGuards, classMenu, closeCeiling, NEVER_OFFERED_KINDS } from "./authoring.js";
 export { runAuthorScout, buildSeedListing, seedFileList, classifySurvey, AUTHOR_SCOUT_VERBS, SCOUT_ATTEMPTS, SURVEY_CAUSES, SCOUT_RETRY_CAUSES } from "./authorscout.js";
 export { scrubRaw, RAW_PERSIST_MAX, RAW_TRIM_MARKER } from "./text.js";
-export { authorClose, authorPrompt, declarationSchema, makeLoopGenerate, MAX_REVISIONS, QUESTION_SETS, GREEN_QUESTIONS, CLASS_STATEMENTS, questionsFor, requiredAnswersFor } from "./authorflow.js";
+export { authorClose, authorPrompt, declarationSchema, makeLoopGenerate, MAX_REVISIONS, QUESTION_SETS, GREEN_QUESTIONS, SOFTGREEN_QUESTIONS, CLASS_STATEMENTS, questionsFor, requiredAnswersFor } from "./authorflow.js";
 export { validateCloseDecl, runDeclaredStages, declaredStages, isDeclaredClose, guardNames, closeGrade, DECLARED_GENRES, DECLARED_GAP_PREFIX, DECLARED_GAP_KEEP, DECLARED_CLOSE_CLASSES, CLOSE_DECL_FIELDS, HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED, HUMAN_CHECKPOINTS } from "./declaredclose.js";
 export { runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalEvents, refuseLockedKind, GENRE, REFUSAL_LIB, REFUSAL_CATEGORY, AUTHORED_SPEC_FIELDS } from "./authorjob.js";

package/types/job.d.ts

@@ -153,16 +153,29 @@ export const MIN_WALL_MS: 120000;
  * counts admission demand, and a generic invalid-value would bury it as a typo. */
 export const LOCKED_TOOLS: readonly string[];
 /** Layer 2 (design record 2026-07-21, decision 5): the verdict-type radio of
- * the four-field plan shape. v1 ADMITS only `green`; soft-green/hitl are
- * declared-but-locked — declaring one is a `request-red` (the tool-menu
- * pattern: disclosure ≠ admission), so the ledger counts the demand and the
- * non-code rung later fills a declared slot instead of reshaping the schema. */
+ * the four-field plan shape. All three are ADMITTED as of softgreen module 3;
+ * the declared-but-locked mechanism below (`LOCKED_VERDICTS`) is what carried
+ * them here one rung at a time — declaring a locked one is a `request-red` (the
+ * tool-menu pattern: disclosure ≠ admission), so the ledger counted the demand
+ * instead of the schema being reshaped when the rung finally landed. */
 export const VERDICT_TYPES: readonly string[];
-/** N4 slice 1: `hitl` is ADMITTED — the class whose *done* needs a person runs
- * through the same signed spec, the same agent-authored plan and the same
- * arbiter as a green job (the nine rulings, 2026-08-07; the three-button surface,
- * 2026-08-12). `soft-green` stays declared-but-locked until its judged floor is
- * built and proven (slice 2): a wobbly ruler must not mint anything. */
+/** N4 slice 1 admitted `hitl`; softgreen module 3 admits `soft-green`, and the
+ * menu is now EMPTY — every class the radio names is built.
+ *
+ * `soft-green`'s lock was never a policy, it was a missing floor: a judged
+ * verdict with no ruler mints nothing honestly. Modules 1 and 2 built the ruler
+ * (a pinned judge that only LOCATES, an arbiter-owned `decide()`, a calibration
+ * gate) and wired it as the `judged-floor` kind, so the lock has nothing left to
+ * protect (design record 2026-08-17 §4, and the 2026-08-18 thresholds addendum).
+ *
+ * EMPTY here means "nothing is locked", which is a TRUE statement about a closed
+ * menu — not F59's absent-read-as-empty, where a `{}` stood in for a fact nobody
+ * gathered. The mechanism below stays exactly as it is: it is read at call time
+ * from this constant, so re-locking a class (or admitting a fourth) is one edit
+ * and the counted `request-red` path comes back with it. `LOCKED_CLASSES` in
+ * src/authoring.js is the twin and moved in the same commit; the suite pins the
+ * two identical. */
+/** @type {readonly string[]} */
 export const LOCKED_VERDICTS: readonly string[];
 export const CADENCE_UNITS: readonly string[];
 /** SP-2: API-first; local deferred (PRD §5/§8). `clipipe-subscription` (F42,