bareloop 0.13.0 → 0.15.0

package/src/reuse.js

@@ -1,5 +1,5 @@
 // Layer 3 — the D7 ENVELOPE and the REUSE RUNNER (design record
-// docs/02-features/2026-08-01-layer-3-reuse-design.md, D3/D5/D6/D7 + R1).
+// docs/product/2026-08-01-layer-3-reuse-design.md, D3/D5/D6/D7 + R1).
 //
 // hamr's sentence is the whole specification of this file, verbatim:
 //
@@ -115,8 +115,30 @@ export const REUSE_GRADED_RED = Object.freeze(['escalated']);
  * how they would come to disagree about which member is which: the first three are
  * allowances the loop's remaining tries are meant to spend against, and the human
  * ones are the stop no further try can change (see `hardStop`).
+ *
+ * `provider-red` folded in 2026-08-25 (PRD v1.80 TODO #4, F115 "Ruled: one transport
+ * retry"; hamr's ruling verbatim: *"joins resume anyways and you decide but you are
+ * given an honest readout and with 1 retry"*). It is a MACHINE halt, not a human one
+ * — it does NOT go into `HUMAN_CHECKPOINTS` — but it is a checkpoint by the same
+ * test every other member here passes: the close never got the say it was asked
+ * for (no verdict was rendered, so it is not a graded red — see `REUSE_GRADED_RED`
+ * above), and the scout+draft and every finished step it bought stand on disk
+ * exactly like a cap-halt or a wall-halt. The one transport retry
+ * (`src/planrun.js`'s `withTransportRetry`) already covers the common case; when
+ * that retry ALSO fails, throwing the run away because the transport hiccuped
+ * twice is throwing away real work for no reason a machine can judge. Deliberately
+ * NO cost/step threshold gates this: a threshold is a number picked from a small
+ * observed sample (F115 logged exactly 7 rows), which is arbiter territory
+ * reserved for hamr — the operator decides case by case, every time, off the
+ * honest readout `scripts/run-u.mjs` prints.
+ *
+ * This entry was built 2026-08-24 as a LOCAL widening in `scripts/run-u.mjs`
+ * (`RESUMABLE_HALTS = [...CHECKPOINT_OUTCOMES, 'provider-red']`) because this file
+ * sat outside that pass's scope — the fold here is the follow-up, so this repo
+ * does not end up with two lists that can drift, which is the exact failure this
+ * constant exists to end (see the paragraph above).
  */
-export const CHECKPOINT_OUTCOMES = Object.freeze(['cap-halt', 'wall-halt', 'step-stalled', ...HUMAN_CHECKPOINTS]);
+export const CHECKPOINT_OUTCOMES = Object.freeze(['cap-halt', 'wall-halt', 'step-stalled', 'provider-red', ...HUMAN_CHECKPOINTS]);
 
 /**
  * v1's definition of "the same KIND of recipe" — and it is the LOAD GATE's own: the

package/src/root.js

@@ -1,5 +1,5 @@
 // Layer R — the root: the within-run ratchet (LAYERS.md item 2; design record
-// docs/02-features/2026-07-19-layer-r-design.md). One state that survives attempts
+// docs/product/2026-07-19-layer-r-design.md). One state that survives attempts
 // inside ONE run so a never-green run stops repeating itself (F21). Role is
 // CONTINUITY ONLY — F39 measured that hand-delivered state buys no conversion;
 // the semantic converter is Layer 2's job, not this module's.

package/src/run.js

@@ -3,7 +3,7 @@
 // smoke, the ONE budget ledger (cap-not-estimate; unpriced is never free, F6),
 // and the decision-ready stops. It composes the plan flow below it and
 // interprets nothing itself.
-// Design record: docs/02-features/2026-07-12-n2-headless-loop-design.md.
+// Design record: docs/product/2026-07-12-n2-headless-loop-design.md.
 //
 // The legacy operator-authored `steps[]` path was DELETED 2026-07-26 (PRD
 // v1.32): the drafting call, config-v1, the per-step interpret loops and the
@@ -17,6 +17,7 @@ import { validateJob, jobSpecHash, checkApproval } from './job.js';
 import { runPlan } from './planrun.js';
 import { SMOKE_STORE, resolveHumanRuling } from './kinds.js';
 import { readShimArm } from './readshim.js';
+import { codeVersion } from './codeversion.js';
 
 /** @typedef {{code: string, path: string, detail?: string}} Red */
 
@@ -254,6 +255,15 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   // outcome — keying on the outcome would floor the exact stop too, which is the same
   // dishonesty pointing the other way.
   let cutMidCall = false;
+  // F115 — did any worker call in this run absorb a transport-class retry
+  // (hamr's ruling: one retry, transport-only, planrun.js `withTransportRetry`)?
+  // The FIRST attempt of a retried call may already have been billed and threw
+  // before returning any usage figure — the same unknown a self-healed stall
+  // and a mid-call wall cut carry, so the same one-way floor applies even when
+  // the retry recovered and the run finishes green. Read off the `transport-retry`
+  // spine record's presence alone, never its `recovered` field: a recovered
+  // retry still hides the first attempt's possible spend.
+  let transportRetried = false;
   // The money on the terminal record, and whether the money is EXACT. `spentUsd`
   // is the accumulated sum of PRICED rounds ONLY — never an estimate derived
   // from tokens or averages (cap-not-estimate). When any round came back
@@ -263,7 +273,7 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   // branch on field presence.
   // ONE spelling of the four causes, so the terminal and the in-flight money readout can
   // never disagree about whether the same run's figure is exact.
-  const spendComplete = () => !unpriced && !stalled && !cutMidCall && !priorFloor;
+  const spendComplete = () => !unpriced && !stalled && !cutMidCall && !priorFloor && !transportRetried;
   const spend = () => ({
     spentUsd,
     spendComplete: spendComplete(),
@@ -294,6 +304,19 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   emit('job-start', {
     job: job.job, specHash: jobSpecHash(job), budgetUsd: job.budgetUsd,
     shape: 'plan', goal: job.goal,
+    // F117: replay reads these; report-only. `verdictType` is a REQUIRED spec
+    // field (src/job.js:552 reds `missing-required` before this line is ever
+    // reached), so it is always a real validated string here, never a
+    // fabricated default. `model` rides along only when the shell-owned
+    // provider binding actually carries one (bare-agent's Loop reads
+    // `baseProvider.model` directly — src/planrun.js:76's own comment); a
+    // native/clipipe call path with no such provider omits the field rather
+    // than guessing.
+    verdictType: job.verdictType,
+    ...(typeof provider?.model === 'string' ? { model: provider.model } : {}),
+    // F118: replay reads this; report-only. `dirty` is deliberately omitted —
+    // it can't be known without a shell, and null = unknown, never faked.
+    code: (() => { const { version, sha } = codeVersion(); return { version, sha }; })(),
     // RESUME (v1.46 §3) — the DECLARED fold, the `try-start` precedent one level
     // down. A reader reconstructing a chain of resumes must add only each attempt's
     // OWN new rounds; without this record the second resume of a halted run would
@@ -364,6 +387,10 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
     // One-way, and read by `spend()` — the run ends on this record either way, but the
     // between-rounds stop must keep its exact figure rather than inheriting a floor.
     if (type === 'wall-halt' && /** @type {any} */ (data)?.cutMidCall === true) cutMidCall = true;
+    // F115 — one-way, same lane as `stall`/`cutMidCall`: a transport retry's
+    // FIRST attempt threw before any usage figure came back, so the priced sum
+    // is a floor for the rest of the run regardless of `recovered`.
+    if (type === 'transport-retry') transportRetried = true;
     return emit(type, data);
   };
   const pricingRed = () => {

package/src/selection.js

@@ -1,5 +1,5 @@
 // Layer 3 — D3's DISPLAY half: the workflow LISTING, and the prompt that asks for a
-// pick (design record docs/02-features/2026-08-01-layer-3-reuse-design.md, D3).
+// pick (design record docs/product/2026-08-01-layer-3-reuse-design.md, D3).
 //
 // hamr's ruling, verbatim: *"i think there should be a listing for workflows names that
 // user can choose or auto-choose, or do we want llm to always decide (we still need to

package/src/transport.js

@@ -0,0 +1,71 @@
+// hamr's ruling, verbatim: "one retry for transport layer failure and
+// reporting with the rest end of gate." (F115, docs/logs/FINDINGS.md.)
+//
+// A transport failure is fetch THROWING — the request never produced an HTTP
+// response at all (a TLS fault mid-record, a reset socket, a DNS/network
+// failure). That is a DIFFERENT unknown from an HTTP response the provider
+// DID send (4xx/5xx/429): a response means the provider answered, so
+// bare-agent's own retry policy for those stays exactly what it is — this
+// module never widens that. Retrying only the no-response case is the whole
+// point: a call that dies mid-read may already have been billed (retry can
+// pay twice), so the retry budget stays as tight as hamr authorized it —
+// exactly one extra attempt, never configurable upward from a job spec or
+// argv (tighten-only doctrine).
+//
+// Scope: this module wires ONE seam — the worker Loop built in
+// src/planrun.js's `newLoop` (~line 2239), which is the ONE factory behind
+// every scout/drafter/step/fix-worker call. It deliberately does NOT reach
+// the judge loops (src/judged.js), the native/CLI loop (src/planrun.js
+// ~2089), or the authoring scout (src/authorscout.js) — none of those are in
+// scope of hamr's ruling and each has its own transport story.
+
+/** The fixed retry budget: ONE extra attempt after the first transport
+ * throw. Never read from a job spec or CLI flag — raising it is arbiter
+ * territory (only a code change hamr signs, never a run-time knob). */
+export const TRANSPORT_RETRIES = 1;
+
+/** bare-agent's `Retry.call` counts ATTEMPTS, not retries. */
+export const TRANSPORT_MAX_ATTEMPTS = TRANSPORT_RETRIES + 1;
+
+/**
+ * Is `err` a transport-class failure — the request never produced an HTTP
+ * response? True for: a TLS fault mid-record ("bad record mac" and kin), a
+ * reset/broken/timed-out socket (ECONNRESET, EPIPE, ETIMEDOUT, ECONNREFUSED,
+ * ENETUNREACH — by code on the error itself or on `err.cause`), and
+ * `fetch failed` wrapping a network `cause`. False for anything carrying an
+ * HTTP status (`err.status`/`err.statusCode`, 4xx/5xx/429) or an explicit
+ * `err.retryable === false` — those are provider RESPONSES, not transport
+ * casualties, and bare-agent's own policy governs them unchanged.
+ * @param {any} err
+ * @returns {boolean}
+ */
+export function isTransportFailure(err) {
+  if (err == null) return false;
+  // An explicit HTTP response is never a transport casualty, no matter what
+  // its message says — the provider answered.
+  const status = err.status ?? err.statusCode;
+  if (typeof status === 'number') return false;
+  if (err.retryable === false) return false;
+
+  const codeOf = (e) => (e && typeof e.code === 'string' ? e.code : null);
+  const TRANSPORT_CODES = new Set(['ECONNRESET', 'EPIPE', 'ETIMEDOUT', 'ECONNREFUSED', 'ENETUNREACH', 'EAI_AGAIN']);
+  const code = codeOf(err) ?? codeOf(err.cause);
+  if (code && TRANSPORT_CODES.has(code)) return true;
+
+  const message = String(err.message ?? err ?? '');
+  if (/bad record mac/i.test(message)) return true;
+  if (TRANSPORT_CODES.has(message.trim())) return true;
+  for (const c of TRANSPORT_CODES) if (message.includes(c)) return true;
+  if (/fetch failed/i.test(message)) {
+    // "fetch failed" alone is Node's generic wrapper — it is only a
+    // transport casualty when its cause names a network fault, never on
+    // message text alone (a fetch can also fail on a non-network throw
+    // upstream, and that must not silently qualify).
+    const causeCode = codeOf(err.cause);
+    if (causeCode) return true;
+    const causeMsg = String(err.cause?.message ?? '');
+    if (/bad record mac/i.test(causeMsg) || [...TRANSPORT_CODES].some((c) => causeMsg.includes(c))) return true;
+    return false;
+  }
+  return false;
+}

package/types/behaviour.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Summarize what a run DID with its tools, from its gate-audit records
+ * alone. Pure and read-only: no IO, no spine writes, no verdict.
+ *
+ * Counting rules:
+ *   - `llm` rows are provider rounds, never tool calls — always excluded.
+ *   - a tool call counts toward `totalCalls`/`byTool`/`uniquePaths`/repeats
+ *     only when `decision === 'allow'`; a `deny` is tallied separately in
+ *     `denied` and touches nothing else (denied ≠ done).
+ *   - `byTool` is keyed by `action.args.tool` when present, else
+ *     `action.type` (an edit or ctx_remember has no `args.tool`).
+ *   - exact repeats: see {@link repeatKey}. A first occurrence of an action
+ *     is not itself a "repeat" — only the 2nd, 3rd, ... occurrences count,
+ *     so `repeats` can never exceed `totalCalls - byTool-group-count`.
+ * @param {Array<{run_id?: string, action?: {type?: string, path?: string, args?: any}, decision?: string|null}>} events
+ * @param {{runId?: string}} [opts]
+ * @returns {{totalCalls: number, byTool: Record<string, number>, denied: number,
+ *   uniquePaths: number, repeats: number, repeatPct: number|null}}
+ */
+export function runBehaviour(events: Array<{
+    run_id?: string;
+    action?: {
+        type?: string;
+        path?: string;
+        args?: any;
+    };
+    decision?: string | null;
+}>, { runId }?: {
+    runId?: string;
+}): {
+    totalCalls: number;
+    byTool: Record<string, number>;
+    denied: number;
+    uniquePaths: number;
+    repeats: number;
+    repeatPct: number | null;
+};
+/**
+ * Render a {@link runBehaviour} summary as the agreed printable block
+ * (2–4 short lines). A zero-call run formats plainly ("0 tool calls") rather
+ * than a NaN-laced percentage — an empty run is a complete, reportable
+ * answer, not a division error.
+ * @param {ReturnType<typeof runBehaviour>} summary
+ * @returns {string}
+ */
+export function formatBehaviour(summary: ReturnType<typeof runBehaviour>): string;

package/types/codeversion.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Report-only stamp of the bareloop code this process is running as. Never
+ * throws — an unreadable package.json or absent `.git` reads as `null`,
+ * honestly, rather than crashing a caller over a report field.
+ * @returns {{ version: string|null, sha: string|null, dirty: null }}
+ */
+export function codeVersion(): {
+    version: string | null;
+    sha: string | null;
+    dirty: null;
+};
+/**
+ * First 8 characters of a sha, or null. Mirrors the short-sha convention
+ * `replay.js` already uses for `specHash` (`s.specHash.slice(0, 8)`).
+ * @param {string|null|undefined} sha
+ * @returns {string|null}
+ */
+export function shortSha(sha: string | null | undefined): string | null;

package/types/index.d.ts

@@ -22,4 +22,7 @@ export { runAuthorScout, buildSeedListing, seedFileList, classifySurvey, AUTHOR_
 export { scrubRaw, RAW_PERSIST_MAX, RAW_TRIM_MARKER } from "./text.js";
 export { authorClose, authorPrompt, declarationSchema, makeLoopGenerate, MAX_REVISIONS, QUESTION_SETS, GREEN_QUESTIONS, SOFTGREEN_QUESTIONS, CLASS_STATEMENTS, questionsFor, requiredAnswersFor } from "./authorflow.js";
 export { validateCloseDecl, runDeclaredStages, declaredStages, isDeclaredClose, guardNames, closeGrade, DECLARED_GENRES, DECLARED_GAP_PREFIX, DECLARED_GAP_KEEP, DECLARED_CLOSE_CLASSES, CLOSE_DECL_FIELDS, HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED, HUMAN_CHECKPOINTS } from "./declaredclose.js";
+export { runBehaviour, formatBehaviour } from "./behaviour.js";
+export { replayRun, formatReplay } from "./replay.js";
 export { runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalEvents, refuseLockedKind, GENRE, REFUSAL_LIB, REFUSAL_CATEGORY, AUTHORED_SPEC_FIELDS } from "./authorjob.js";
+export { PROMPT_REGISTERS, isPromptFile } from "./promptregisters.js";

package/types/ledger.d.ts

@@ -103,6 +103,20 @@ export const LEDGER_CLASSES: readonly string[];
  * reads as a GUESS rather than as vouched. The fail-safe direction, by construction.
  */
 export const VOUCHED_RATE_SOURCES: readonly string[];
+/** The spend records a run's money is read from. `worker-round` and `judge-round` are the
+ * ACCOUNTED types — exactly `ACCOUNTED_ROUND_TYPES` in src/run.js, which is the ledger that
+ * enforces the budget (F12). `judge-round` is the softgreen rung's judged floor: the first
+ * spend a CLOSE has ever had, and a provenance readout that skipped it would be blind to the
+ * one seam whose rate nobody has audited. `worker-turn` is the native surface's per-turn
+ * attribution — unpriced by design, included so the readout covers every metering row the
+ * plan flow writes rather than only the ones carrying money. The attempt-level totals
+ * (`worker-result`, `worker-plan`) are ECHOES of these same rounds and are excluded, for
+ * the same reason the ledger in run.js excludes them: counting them double-counts.
+ *
+ * Re-spelled rather than imported (src/run.js imports this module's siblings and a cycle
+ * buys nothing here) — `tests/ledger.test.js` asserts the two spellings agree, because a
+ * spend-slicing instrument that misses a writer is the F45 class this list exists to avoid. */
+export const SPEND_RECORD_TYPES: readonly string[];
 export type ProvenanceBucket = {
     rounds: number;
     usd: number;

package/types/promptregisters.d.ts

@@ -0,0 +1,31 @@
+/**
+ * True when `path` names one of the inventoried prompt-register files. Accepts
+ * either a repo-root-relative path (`src/tools.js`) or an absolute/relative
+ * path ending in one (`/home/x/bareloop/src/tools.js`, `./src/tools.js`) — git
+ * hands the check root-relative paths, but a caller working from an absolute
+ * path should not have to strip the prefix itself.
+ * @param {string} path
+ * @returns {boolean}
+ */
+export function isPromptFile(path: string): boolean;
+/**
+ * One entry in the prompt-register inventory: a file known to carry
+ * model-facing prompt/instruction text, and the name(s) that live there for a
+ * human reading this file. `name` may point at a named const OR at a function
+ * that builds a prompt inline (e.g. `scoutPrompt()`) — the check only ever
+ * keys on `file`.
+ * @typedef {{file: string, name: string}} PromptRegisterEntry
+ */
+/** @type {ReadonlyArray<PromptRegisterEntry>} */
+export const PROMPT_REGISTERS: ReadonlyArray<PromptRegisterEntry>;
+/**
+ * One entry in the prompt-register inventory: a file known to carry
+ * model-facing prompt/instruction text, and the name(s) that live there for a
+ * human reading this file. `name` may point at a named const OR at a function
+ * that builds a prompt inline (e.g. `scoutPrompt()`) — the check only ever
+ * keys on `file`.
+ */
+export type PromptRegisterEntry = {
+    file: string;
+    name: string;
+};

package/types/readshim.d.ts

@@ -36,15 +36,21 @@ export function readShimStrategy(arm: ReadShimArm): string;
  * reference to the ledger — see its own note. Both live in one object because
  * they are one worker's shim: the read seam and the retrieval seam the cap
  * steers a capped worker towards.
- * @param {{cap?: number, arm?: ReadShimArm}} [opts] `cap`: delivery bound in bytes (the
- *   shipped value is `READ_SHIM_CAP`; the option exists so the native path can pin the
- *   two bounds to one number rather than two constants drifting apart). `arm`: which
- *   levers are live (`readShimArm`). Defaults to ALL of them, so every caller written
- *   before the arms existed keeps the behaviour it was written against.
+ * @param {{cap?: number, arm?: ReadShimArm, onCount?: ((kind: 'pointered'|'capped', bytesWithheld: number) => void)|null}} [opts]
+ *   `cap`: delivery bound in bytes (the shipped value is `READ_SHIM_CAP`; the option
+ *   exists so the native path can pin the two bounds to one number rather than two
+ *   constants drifting apart). `arm`: which levers are live (`readShimArm`). Defaults to
+ *   ALL of them, so every caller written before the arms existed keeps the behaviour it
+ *   was written against. `onCount`: MEMORY-CACHE — fired once per pointer/capped-slice
+ *   response with exactly the bytes withheld on THAT response, for a caller (e.g.
+ *   `runPlan`) that sums several workers' shims into one run-level readout. Never called
+ *   for a diff response (L2 is its own lever, uncounted here) or a first read under the
+ *   cap (nothing was withheld).
  */
-export function createReadShim({ cap, arm }?: {
+export function createReadShim({ cap, arm, onCount }?: {
     cap?: number;
     arm?: ReadShimArm;
+    onCount?: ((kind: "pointered" | "capped", bytesWithheld: number) => void) | null;
 }): {
     arm: ReadShimArm;
     cap: number;
@@ -56,6 +62,11 @@ export function createReadShim({ cap, arm }?: {
         execute: (args: any) => Promise<any>;
     };
     serveStale: ({ file, path, startLine, endLine, detail }: StaleReq) => StaleServe | null;
+    summary: () => {
+        pointered: number;
+        capped: number;
+        bytesWithheld: number;
+    };
 };
 /**
  * The one-tool spelling, kept for every caller written before the shim became an

package/types/replay.d.ts

@@ -0,0 +1,195 @@
+/**
+ * Reconstruct one run's whole story from its spine + gate-audit. Pure: no
+ * IO, no spine writes, no verdict. Malformed/non-object entries in either
+ * array are skipped and counted, never thrown on.
+ *
+ * A step id can recur (a replan re-executes the same step): `steps[].occurrence`
+ * is 1 for that id's first step-start..step-end pair, 2 for its second, etc.
+ * Every field on an occurrence — rounds, toolCalls, checks, treeChanged, wallMs,
+ * spentUsd — is scoped to records strictly between ITS OWN start/end `seq`,
+ * never pooled across every occurrence sharing the id.
+ *
+ * A run whose spine carries no `step-start` at all (the plan's only step was
+ * already-green-skipped on a resumed leg, or a genuinely legacy loop-only
+ * shape) has no STEPS timeline to build — `timelineKind` reads `'iterations'`
+ * and `iterations[]` is populated from `iteration-start`/`close-verdict`/
+ * `run-end`/`escalation` instead. `steps`/`iterations` are never both
+ * populated: exactly one is non-empty, selected by `timelineKind`.
+ *
+ * @param {any[]} spineEvents parsed records from `u-<id>.jsonl`
+ * @param {any[]} [auditEvents] parsed records from the sibling `-gate-audit.jsonl`
+ * @param {{runId?: string|null}} [opts] `runId`: caller-supplied (the spine
+ *   carries no run-id field of its own — see the file header)
+ */
+export function replayRun(spineEvents: any[], auditEvents?: any[], { runId }?: {
+    runId?: string | null;
+}): {
+    runId: string | null;
+    job: any;
+    verdictType: any;
+    model: any;
+    code: {
+        version: any;
+        sha: any;
+    } | null;
+    goal: any;
+    lastEscalation: any;
+    budgetUsd: any;
+    specHash: any;
+    branch: any;
+    outcome: any;
+    stopReason: string | null;
+    spentUsd: any;
+    spendComplete: boolean;
+    floorReasons: string[];
+    transportRetryCount: number;
+    transportRetriesOutsideWindows: number;
+    wallMs: number | null;
+    chainClock: {
+        source: "wall-halt" | "wall-clock";
+        elapsedMs: number;
+        requestedMs: number | null;
+        enforcedMs: number | null;
+        bounded: boolean;
+    } | null;
+    resumed: boolean;
+    resumeSeed: {
+        phase: any;
+        completed: any;
+        skipping: any;
+        divergence: any;
+    } | null;
+    thisFileSpend: {
+        value: any;
+        source: "engagementSpentUsd" | "summed rounds";
+        totalRounds: number;
+        unpricedRounds: number;
+    };
+    spendMismatch: {
+        spentUsd: any;
+        thisFileUsd: any;
+        diffUsd: number;
+    } | null;
+    timelineKind: "steps" | "iterations";
+    steps: {
+        checks: {
+            passed: number;
+            failed: number;
+        };
+        treeChanged: boolean;
+        rounds: number;
+        toolCalls: number;
+        wallMs: number | null;
+        spentUsd: number | null;
+        unpricedRounds: number;
+        tripped: {
+            category: any;
+            detail: string | null;
+        } | null;
+        transportRetries: {
+            count: number;
+            label: string;
+            error: string | null;
+        } | null;
+        id: any;
+        occurrence: any;
+        outcome: any;
+    }[];
+    iterations: {
+        rounds: number;
+        toolCalls: number;
+        wallMs: number | null;
+        spentUsd: number | null;
+        unpricedRounds: number;
+        tripped: {
+            category: any;
+            detail: string | null;
+        } | null;
+        transportRetries: {
+            count: number;
+            label: string;
+            error: string | null;
+        } | null;
+        iteration: any;
+        verdict: any;
+        boundary: any;
+        closeStage: {
+            verdict: any;
+            stages: any;
+        } | null;
+    }[];
+    replans: any;
+    close: {
+        source: "close-verdict" | "outer-close";
+        iteration: number | null;
+        verdict: string | null;
+        stages: any[] | null;
+    } | null;
+    ending: {
+        record: any;
+        before: any[];
+        escalation: any;
+    };
+    behaviour: {
+        totalCalls: number;
+        byTool: Record<string, number>;
+        denied: number;
+        uniquePaths: number;
+        repeats: number;
+        repeatPct: number | null;
+    };
+    memoryCache: any;
+    skipped: number;
+};
+/**
+ * Render a {@link replayRun} summary as one printable page: a header block
+ * (goal/shape/signed/branch/outcome/spent), a timeline (steps or iterations,
+ * whichever the spine has), the CLOSE section (never omitted), the ending
+ * (last record + 3 before it, plus an out-of-window escalation), the
+ * behaviour block, and the MEMORY-CACHE line (always printed — `not armed on
+ * this run` when there is no record, never silently absent).
+ * @param {ReturnType<typeof replayRun>} summary
+ * @returns {string}
+ */
+export function formatReplay(summary: ReturnType<typeof replayRun>): string;
+/**
+ * One `--all` row's raw field strings for one real spine:
+ * `id  job  shape  outcome  spend  wall  steps  reason`. `reason` is
+ * `category — <first clause of detail, cut at 60 chars>` off the last
+ * escalation — never the generic `decision` prose. `-` on a green row;
+ * `no job-end (killed mid-run)` when the spine never reached a `job-end` at
+ * all (outcome itself is `null`) — a distinct, named case, not folded into
+ * the ordinary escalation reason.
+ * @param {ReturnType<typeof replayRun>} summary
+ * @returns {{id: string, resumed: boolean, job: string, shape: string, class: string, model: string, outcome: string, hadTransportRetries: boolean, spend: string, wall: string, steps: string, reason: string}}
+ */
+export function summarizeForAllLine(summary: ReturnType<typeof replayRun>): {
+    id: string;
+    resumed: boolean;
+    job: string;
+    shape: string;
+    class: string;
+    model: string;
+    outcome: string;
+    hadTransportRetries: boolean;
+    spend: string;
+    wall: string;
+    steps: string;
+    reason: string;
+};
+/**
+ * Render every row {@link summarizeForAllLine} built for one directory's
+ * spines as a fixed-column, aligned table WITH a header row (plus any
+ * `<name>  not-a-spine` lines interleaved at their original position — those
+ * are not part of the aligned columns, since a filename carries no outcome/
+ * spend/wall of its own). Never CSV: columns are padded, not delimited.
+ * @param {Array<{kind: 'spine', row: ReturnType<typeof summarizeForAllLine>}|{kind: 'not-a-spine', name: string}>} entries
+ * @returns {string}
+ */
+export function formatAllLines(entries: Array<{
+    kind: "spine";
+    row: ReturnType<typeof summarizeForAllLine>;
+} | {
+    kind: "not-a-spine";
+    name: string;
+}>): string;

package/types/reuse.d.ts

@@ -589,6 +589,28 @@ export const REUSE_GRADED_RED: readonly string[];
  * how they would come to disagree about which member is which: the first three are
  * allowances the loop's remaining tries are meant to spend against, and the human
  * ones are the stop no further try can change (see `hardStop`).
+ *
+ * `provider-red` folded in 2026-08-25 (PRD v1.80 TODO #4, F115 "Ruled: one transport
+ * retry"; hamr's ruling verbatim: *"joins resume anyways and you decide but you are
+ * given an honest readout and with 1 retry"*). It is a MACHINE halt, not a human one
+ * — it does NOT go into `HUMAN_CHECKPOINTS` — but it is a checkpoint by the same
+ * test every other member here passes: the close never got the say it was asked
+ * for (no verdict was rendered, so it is not a graded red — see `REUSE_GRADED_RED`
+ * above), and the scout+draft and every finished step it bought stand on disk
+ * exactly like a cap-halt or a wall-halt. The one transport retry
+ * (`src/planrun.js`'s `withTransportRetry`) already covers the common case; when
+ * that retry ALSO fails, throwing the run away because the transport hiccuped
+ * twice is throwing away real work for no reason a machine can judge. Deliberately
+ * NO cost/step threshold gates this: a threshold is a number picked from a small
+ * observed sample (F115 logged exactly 7 rows), which is arbiter territory
+ * reserved for hamr — the operator decides case by case, every time, off the
+ * honest readout `scripts/run-u.mjs` prints.
+ *
+ * This entry was built 2026-08-24 as a LOCAL widening in `scripts/run-u.mjs`
+ * (`RESUMABLE_HALTS = [...CHECKPOINT_OUTCOMES, 'provider-red']`) because this file
+ * sat outside that pass's scope — the fold here is the follow-up, so this repo
+ * does not end up with two lists that can drift, which is the exact failure this
+ * constant exists to end (see the paragraph above).
  */
 export const CHECKPOINT_OUTCOMES: readonly string[];
 /**

package/types/transport.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Is `err` a transport-class failure — the request never produced an HTTP
+ * response? True for: a TLS fault mid-record ("bad record mac" and kin), a
+ * reset/broken/timed-out socket (ECONNRESET, EPIPE, ETIMEDOUT, ECONNREFUSED,
+ * ENETUNREACH — by code on the error itself or on `err.cause`), and
+ * `fetch failed` wrapping a network `cause`. False for anything carrying an
+ * HTTP status (`err.status`/`err.statusCode`, 4xx/5xx/429) or an explicit
+ * `err.retryable === false` — those are provider RESPONSES, not transport
+ * casualties, and bare-agent's own policy governs them unchanged.
+ * @param {any} err
+ * @returns {boolean}
+ */
+export function isTransportFailure(err: any): boolean;
+/** The fixed retry budget: ONE extra attempt after the first transport
+ * throw. Never read from a job spec or CLI flag — raising it is arbiter
+ * territory (only a code change hamr signs, never a run-time knob). */
+export const TRANSPORT_RETRIES: 1;
+/** bare-agent's `Retry.call` counts ATTEMPTS, not retries. */
+export const TRANSPORT_MAX_ATTEMPTS: number;