bareloop 0.22.0 → 0.24.0

package/src/judged.js

@@ -65,32 +65,150 @@
 
 import { createRequire } from 'node:module';
 import { extractArtifact, priceOf, scrubRaw } from './text.js';
+import { resolveProvider } from './providers.js';
 
 const require = createRequire(import.meta.url);
 
 /**
- * THE JUDGE MODEL, PINNED. Never agent-selectable and never a step knob: it is
- * the only tier with established injection resistance upstream (BA-20's
- * INJECTION_BATTERY is haiku-4.5 only), and §4.2's whole safety argument is
- * worth exactly as much as that evidence. A judge-model bump forces a full
- * recalibration — mandatory, per the model-bump dead-weight replay rule.
+ * THE JUDGE'S HISTORICAL PIN. Until PRD item 32 (2026-09-10) this constant WAS
+ * the judge: every grading path imported it, so bareloop could run a worker on
+ * any provider and still judge only on Claude.
  *
- * THAT IS ENFORCED, not asked for, and it is enforced in three places because a
- * rule with no wired detector is prose (F45):
- *   1. the value here is STORED with the set it graded — `foldJudgedArtifacts`
+ * It is no longer read by any grading path. The judge identity is now RESOLVED
+ * per job (`resolveJudge` below) and travels as data — `ctx.judgeModel` into
+ * `runJudgedFloor`, an explicit argument into the calibration gate, and
+ * `closeDecl.calibration.judgeModel` into the signed spec, exactly as before.
+ * Keeping the export is deliberate: it is part of the public API
+ * (`src/index.js`) and an adopter importing it should not break on a minor.
+ * What it means now is "the judge bareloop pinned before item 32", which is
+ * still the right DEFAULT for an anthropic-api job and still the only tier with
+ * established injection resistance upstream (BA-20's `INJECTION_BATTERY` is
+ * haiku-4.5 only).
+ *
+ * THE ENFORCEMENT IS UNCHANGED, and still lives in three wired places because a
+ * rule with no detector is prose (F45) — only the value being compared moved
+ * from this constant to the resolved identity:
+ *   1. the identity is STORED with the set it graded — `foldJudgedArtifacts`
  *      writes it as `closeDecl.calibration.judgeModel`, inside the spec, so
- *      `jobSpecHash` covers it by construction. Bump this constant and every
+ *      `jobSpecHash` covers it by construction. Change the judge and every
  *      signed judged spec hashes differently: the signature dies, and re-signing
  *      is what re-runs the calibration gate.
  *   2. `validateCloseDecl` REQUIRES it on any stored set — a set nobody can
- *      attribute to a tier is a floor nobody can tell apart from a bumped one.
- *   3. `runJudgedFloor` refuses to grade when the stored tier is not this one,
- *      naming both models. It does not degrade in either direction: grading on
- *      the new tier judges against a floor nobody calibrated, and the old tier is
- *      not on offer.
+ *      attribute to a judge is a floor nobody can tell apart from a moved one.
+ *   3. `runJudgedFloor` refuses to grade when the stored identity is not the one
+ *      about to grade, naming both. It does not degrade in either direction:
+ *      grading on the new judge judges against a floor nobody calibrated, and
+ *      the old judge is not on offer.
  */
 export const JUDGE_MODEL = 'claude-haiku-4-5';
 
+/**
+ * RESOLVE WHICH MODEL GRADES THIS JOB (PRD item 32.1).
+ *
+ * hamr, 2026-09-10: *"what i care about is that judge becomes llm agnostic and
+ * not set to one model or provider"* — and the shape he named: *"defaults to
+ * whatever llm is used and can be overriden"*.
+ *
+ * So, in precedence order:
+ *   1. `spec.judge` — an explicit, SIGNED `{provider, model}`. This is how a run
+ *      pins a judge deliberately different from its worker (an independent
+ *      reader, or a judge whose calibration a job wants to keep while the worker
+ *      moves). It is a spec field the HUMAN signs, part of `jobSpecHash` like
+ *      every other; the drafting agent cannot express it, because naming your
+ *      own examiner is arbiter territory.
+ *   2. otherwise the job's OWN worker provider and model. A DeepSeek job judges
+ *      on DeepSeek and needs no second account — which is the whole point: after
+ *      item 31.4 a green job runs on its own key alone, and this is what lets a
+ *      JUDGED one do the same.
+ *
+ * There is deliberately NO third fallback to `JUDGE_MODEL`. A caller that cannot
+ * say which model will grade has not wired a judge, and the grading path stops
+ * as a wiring gap rather than grading under an identity nobody chose — the same
+ * answer an absent `judgeLoop` already gets. A silent default here would be the
+ * exact silent-ignore class that `endpointKey` and F149 exist to prevent, except
+ * pointed at the arbiter.
+ *
+ * SELF-GRADING is licensed by measurement, not by this function: the judge
+ * renders no verdict (it locates facts; `decide()` is deterministic), and the
+ * calibration gate — 10 cases, a 10-of-10 floor, no partial credit, cases that
+ * MUST fail — is exactly the instrument that catches a judge which cannot see
+ * failures. If a worker-family judge cannot pass its own calibration, that is
+ * the finding, and the gate refuses to sign.
+ *
+ * @param {{specJudge?: any, workerProvider?: string, workerModel?: string}} o
+ * @returns {{provider: string, model: string}}
+ */
+export function resolveJudge({ specJudge, workerProvider, workerModel } = {}) {
+  const nonEmpty = (/** @type {any} */ v) => typeof v === 'string' && v.trim() !== '';
+  if (specJudge !== null && typeof specJudge === 'object'
+    && nonEmpty(specJudge.provider) && nonEmpty(specJudge.model)) {
+    return { provider: specJudge.provider, model: specJudge.model };
+  }
+  if (specJudge !== undefined && specJudge !== null) {
+    // A malformed `judge` is never quietly ignored into the worker default: the
+    // spec VALIDATOR reds it (src/job.js), and reaching here with one means a
+    // caller skipped validation. Throwing beats grading under an identity the
+    // signer did not write.
+    throw new Error('[judged] spec.judge, when present, is {provider, model} with both non-empty — '
+      + `got ${JSON.stringify(specJudge)}. A malformed judge is not a request to use the worker's.`);
+  }
+  if (!nonEmpty(workerProvider) || !nonEmpty(workerModel)) {
+    throw new Error('[judged] resolveJudge needs the job\'s worker provider and model to default the judge to them '
+      + '(PRD item 32.1) — a caller that can name neither a judge nor a worker has not wired a judge, and there is '
+      + 'no library-pinned fall-back any more.');
+  }
+  return { provider: /** @type {string} */ (workerProvider), model: /** @type {string} */ (workerModel) };
+}
+
+/**
+ * `resolveJudge` needs a worker MODEL already resolved, and an authoring
+ * pipeline has to compute one identity at TWO different moments — once at
+ * compose time, to STAMP `closeDecl.calibration.judgeModel` into the spec it
+ * is about to sign, and again at the calibration gate that grades against
+ * that stamp — from a value that is not yet a validated spec (the operator's
+ * draft) the first time and is one (the assembled spec) the second. Two
+ * hand-spelled compositions of `resolveWorkerModel` + `resolveJudge` is
+ * exactly the kind of pair that drifts (PRD F45's "a rule with no detector is
+ * prose" applies to a rule spelled TWICE just as much as to one spelled
+ * nowhere) — this is the one spelling both calls make, and it mirrors the
+ * SAME composition `scripts/run-u.mjs` applies at launch time: the named
+ * provider's own `tiers.sonnet` defaults an absent model, and a signed
+ * `judge` override wins over the worker default.
+ *
+ * `source` is read for `provider`/`model`/`judge` only, so a draft and the
+ * spec `assembleSpec` folds it into resolve identically — `assembleSpec`
+ * spreads the draft into the spec untouched on those three fields — and any
+ * draft that goes on to validate and sign therefore stamps and grades under
+ * the exact same identity `scripts/run-u.mjs` will resolve at run time.
+ *
+ * `source.provider` absent, or unresolvable, or `source.judge` malformed all
+ * THROW here exactly as `resolveProvider`/`resolveJudge` already do on their
+ * own — a caller composing this from a pre-validation draft is expected to
+ * catch that and use a placeholder, because a draft that cannot resolve here
+ * is a draft `validateJob` reds a few lines later regardless, before anything
+ * gets signed under the placeholder.
+ *
+ * `resolveWorkerModelFn` is taken as a PARAMETER rather than imported — this
+ * module cannot import `./job.js` directly: `job.js` imports
+ * `./declaredclose.js`, which imports `resolveJudge` from THIS module, and a
+ * `judged.js` → `job.js` edge would close that into a cycle. `resolveProvider`
+ * has no such conflict (`./providers.js` imports nothing local) and is
+ * imported directly.
+ *
+ * @param {{provider?: string, model?: string, judge?: any}} source draft or spec
+ * @param {string} fallbackProviderName used only when `source.provider` is absent
+ * @param {(o: {specModel?: string, flagModel?: string, defaultModel: string}) => {model: string, source: string}} resolveWorkerModelFn `resolveWorkerModel` from `./job.js`
+ * @returns {{provider: string, model: string}}
+ */
+export function resolveJobJudge(source, fallbackProviderName, resolveWorkerModelFn) {
+  const providerName = source?.provider ?? fallbackProviderName;
+  const providerEntry = resolveProvider(providerName);
+  const { model } = resolveWorkerModelFn({
+    specModel: source?.model, flagModel: undefined, defaultModel: providerEntry.tiers.sonnet,
+  });
+  return resolveJudge({ specJudge: source?.judge, workerProvider: providerName, workerModel: model });
+}
+
 /**
  * The locate call's token ceiling. The POC's two real artifacts came back well
  * inside 2000; this doubles that for headroom on a longer artifact, and the
@@ -565,6 +683,43 @@ export function validateFacts(facts) {
 
 // ── THE LOCATE PROMPT ───────────────────────────────────────────────────────
 
+/**
+ * THE ONE SHAPE INVENTORY (PRD 30.8), stated ONCE and never twice. It drives
+ * BOTH the LOCATE prompt's prose ("declared with ...") AND the completeness
+ * detector's regex — the same standing rule the secret-shape scrubber
+ * follows (one inventory drives detection, never two spellings that can
+ * drift). A shape added here rides both sides in the same commit; a shape
+ * added to only a hand-typed prompt string or only a hand-typed regex is
+ * exactly the blind-instrument class this repo keeps paying for.
+ *
+ * Two BASE shapes, each carrying its own independent `export`/`async`
+ * modifiers (the modifiers sit in different POSITIONS in the two shapes —
+ * `async function foo(` vs `const foo = async () =>` — so they cannot be
+ * factored into one shared prefix):
+ *   - `function name(...)`      — optionally `export`, optionally `async`,
+ *     in either order before `function`.
+ *   - `const name = (...) =>`   — optionally `export` before `const`,
+ *     optionally `async` after `=`.
+ *
+ * Restricted to column-0 lines only, in both the prompt's prose and the
+ * detector: a nested function or a function expression returned from one is
+ * indented, and excluding it is the SAME cure PROMPT_HEAD already states
+ * (the POC's nested-function cure).
+ * @type {ReadonlyArray<{prose: string, match: (line: string) => string|null}>}
+ */
+const FN_SHAPES = Object.freeze([
+  {
+    prose: '`function name(...)` (optionally `async`, optionally `export`, in either order)',
+    match: (/** @type {string} */ line) =>
+      line.match(/^(?:(?:export|async)\s+){0,2}function\s+([A-Za-z_$][\w$]*)\s*\(/)?.[1] ?? null,
+  },
+  {
+    prose: '`const name = (...) =>` (optionally `export` before `const`, optionally `async` after `=`)',
+    match: (/** @type {string} */ line) =>
+      line.match(/^(?:export\s+)?const\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>/)?.[1] ?? null,
+  },
+]);
+
 /** The spine every card shares. Both POC cures live here rather than on a rule,
  * because both are properties of ENUMERATING functions and not of any one
  * question about them: the nested-function clause (the POC counted a returned
@@ -573,8 +728,7 @@ export function validateFacts(facts) {
 const PROMPT_HEAD =
   'You LOCATE FACTS in a source file. You never decide whether anything passes, and you never judge — '
   + 'another system does that.\n'
-  + 'For EVERY top-level function in the FILE (declared with `function name(...)`, `const name = (...) =>`, '
-  + 'or `export function name(...)`), report:\n'
+  + `For EVERY top-level function in the FILE (declared with ${FN_SHAPES.map((s) => s.prose).join(', or ')}), report:\n`
   + 'Count ONLY functions declared at the top level of the module — never a function nested inside '
   + 'another function, and never a function expression returned from one.\n'
   + '  "name": the function name\n'
@@ -596,6 +750,43 @@ export function locatePrompt(card) {
   return `${PROMPT_HEAD}${asks}\n${PROMPT_TAIL}`;
 }
 
+/**
+ * THE COMPLETENESS MIRROR of `PROMPT_HEAD`'s own contract (PRD 30.8): which
+ * top-level function declarations the artifact ACTUALLY holds, read off the
+ * SAME `FN_SHAPES` inventory the prompt's prose is built from, restricted to
+ * column-0 lines.
+ *
+ * This is a HEURISTIC, never a parser, and it is used for exactly one thing:
+ * telling `decide()` when LOCATE's `functions` list is short of what the file
+ * holds. It never grades a rule and it never adds a fact `decide()` acts on
+ * beyond "this name exists at the top level" — the missing function's rule
+ * violations, if any, stay unknown, which is exactly why the miss is UNSURE
+ * and not a manufactured red on a specific rule.
+ *
+ * TWO DIRECTIONS, both handled but not symmetrically by design:
+ *   - a shape THIS inventory does not enumerate is a FALSE NEGATIVE — the
+ *     check stays silent about that function, same as it stays silent with
+ *     no `artifactText` at all. Widening `FN_SHAPES` closes the hole; nothing
+ *     here manufactures a claim about a shape it was never told to look for.
+ *   - a column-0 line that only LOOKS like a declaration (e.g. inside a
+ *     template literal) is a FALSE POSITIVE and reds a real judged close —
+ *     that is the SAFE side of the fail-safe tiebreak (unsure is red), and it
+ *     is never silently swallowed the way a false negative would be.
+ * @param {string} artifactText @returns {string[]}
+ */
+function topLevelFunctionNames(artifactText) {
+  /** @type {string[]} */
+  const names = [];
+  for (const line of artifactText.split('\n')) {
+    if (/^\s/.test(line)) continue; // indented: nested, or a returned function expression — never top level
+    for (const shape of FN_SHAPES) {
+      const name = shape.match(line);
+      if (name) { names.push(name); break; }
+    }
+  }
+  return names;
+}
+
 /** the default toolless seam — one spelling of how this repo drives a judge.
  * A `Loop`, NOT `provider.generate()`: the POC measured that a bare provider
  * result carries no `costUsd` at all, and under F6 an unpriced call is a red,
@@ -628,12 +819,23 @@ export const defaultJudgeLoop = ({ provider, system }) => {
  * On every route out, red or clean, `onCost` fires exactly once with the honest
  * read: a paid call that leaves no meter record is F12 wearing a judge's coat.
  * @param {{artifactText: string, card: any, loopFactory: (o: {provider?: any, system: string}) => any,
- *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number}) => void}} o
+ *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number}) => void,
+ *   callBounds?: {timeoutMs?: number, deadlineMs?: number}}} o
  * @returns {Promise<{ok: boolean, facts: any|null, red: {axis: string, detail: string}|null,
  *   costUsd: number|null, unpricedRounds: number, truncated: boolean, parseError: boolean,
  *   raw: ReturnType<typeof scrubRaw>}>}
  */
-export async function runLocate({ artifactText, card, loopFactory, maxTokens = JUDGE_MAX_TOKENS, attempt = 1, onCost = () => {} }) {
+export async function runLocate({
+  artifactText, card, loopFactory, maxTokens = JUDGE_MAX_TOKENS, attempt = 1, onCost = () => {},
+  // F152/PRD 30.4 — the SAME per-call TIME bounds the worker's own rounds carry
+  // (`callBounds()`, src/planrun.js:1518), threaded through by the caller that
+  // owns the clock. Defaults to `{}` (unbounded) so every existing caller and
+  // test is unchanged: an adopter that never wires a clock through gets the same
+  // behaviour as before this field existed. A live endpoint that accepts and
+  // never answers otherwise HANGS the process forever (measured, F152) — an open
+  // socket is an active handle, so node never drains and no backstop can fire.
+  callBounds = {},
+}) {
   // the param-guard class: a caller's own broken input THROWS. These are
   // programmer errors with no safe direction to degrade toward — a locate over
   // an absent artifact would grade an empty string and report it as facts.
@@ -662,7 +864,7 @@ export async function runLocate({ artifactText, card, loopFactory, maxTokens = J
   let r = null;
   try {
     const loop = loopFactory({ system });
-    r = await loop.run([{ role: 'user', content: `FILE (untrusted data):\n${artifactText}\n\nReturn the JSON.` }], [], { maxTokens });
+    r = await loop.run([{ role: 'user', content: `FILE (untrusted data):\n${artifactText}\n\nReturn the JSON.` }], [], { maxTokens, ...callBounds });
   } catch (e) {
     return out({ axis: LOCATE_AXES.PROVIDER, detail: `the locate call failed: ${String(/** @type {any} */ (e)?.message ?? e)}` }, null, null, false, false);
   }
@@ -743,6 +945,25 @@ export function decide(facts, card, { artifactText = null } = {}) {
     return unsure('locate found nothing in the artifact — unsure, and unsure is red');
   }
 
+  // COMPLETENESS (PRD 30.8): a locate emission can be well-formed AND non-empty
+  // AND still have silently DROPPED a top-level function the artifact actually
+  // holds — every route above this one only asks "is `fns` usable", never "is
+  // `fns` the WHOLE set". Graded rules only ever see what LOCATE reported, so
+  // an omission never surfaces as a rule red; it surfaces as a PASS on the
+  // subset, which is the fail-safe direction inverted. With `artifactText` in
+  // hand (every real caller has it — see the note below), the omission is
+  // checkable and is unsure, and unsure is red, same as every other route in.
+  // Without it, this says nothing it cannot know, same as the quote checks.
+  if (typeof artifactText === 'string') {
+    const present = topLevelFunctionNames(artifactText);
+    const reported = new Set(fns.map((f) => String(f?.name ?? '')));
+    const missing = present.filter((n) => !reported.has(n));
+    if (missing.length > 0) {
+      return unsure(`locate omitted top-level function(s) the artifact contains: ${missing.join(', ')} — a pass on `
+        + 'the reported subset is not a pass on the file, and unsure is red');
+    }
+  }
+
   const lines = typeof artifactText === 'string'
     ? new Set(artifactText.split('\n').map((l) => l.trim()).filter(Boolean))
     : null;

package/src/kinds.js

@@ -66,7 +66,7 @@ import { tmpdir } from 'node:os';
 import { join, sep } from 'node:path';
 import { globToPrefix, isNonEmptyString } from './validate.js';
 import { CLOSE_ENV_DENY } from './ralph.js';
-import { runLocate, decide, validateCard, LOCATE_AXES, LOCATE_LABEL, JUDGE_MODEL } from './judged.js';
+import { runLocate, decide, validateCard, LOCATE_AXES, LOCATE_LABEL } from './judged.js';
 
 /** the close's two judgment exits — a stage's verdict, in the shape the
  * hand-written closes already spoke (exit code is truth) */
@@ -173,6 +173,46 @@ export const MAX_JUDGED_PATHS = 8;
  * decision on it, and five literals is how they come to disagree. */
 export const JUDGED_FLOOR_KIND = 'judged-floor';
 export const SEED_EXEMPT_KINDS = Object.freeze([JUDGED_FLOOR_KIND, 'human-confirms']);
+
+/**
+ * The judged stages of a close declaration, and whether it has any — the ONE
+ * spelling of "does this close ask a model to render anything?".
+ *
+ * The comment above `JUDGED_FLOOR_KIND` says five literals is how the readers
+ * come to disagree, and by PRD item 31.4 there were SIX open-coded
+ * `stages.filter(s => s.kind === JUDGED_FLOOR_KIND)` across the tree
+ * (`src/authorjob.js` twice, `src/cardauthor.js`, `src/declaredclose.js`,
+ * `scripts/run-author.mjs`, `scripts/author-readout.mjs`). 31.4 needed a
+ * seventh, in the runner, to decide whether a judge KEY is demanded — and a
+ * seventh spelling deciding a REFUSAL is the drift `scripts/run-u.mjs`'s own
+ * judge-provider comment warns about ("a second reading of the declaration
+ * that can drift from the one the runner actually executes"). So there is one
+ * reading now, and every caller shares it.
+ *
+ * Defensive on shape ON PURPOSE: callers pass raw specs read off disk and
+ * half-built drafts, not validated declarations. An absent/!object `closeDecl`
+ * or `stages` is "no judged stages", never a throw — the close VALIDATOR is
+ * what rejects a malformed declaration, and this predicate answering a
+ * question about one is not the place to re-litigate it.
+ * @param {any} closeDecl a close declaration (or anything, including undefined)
+ * @returns {any[]} the judged-floor stages, in declaration order
+ */
+export function judgedStages(closeDecl) {
+  const stages = closeDecl && typeof closeDecl === 'object' ? closeDecl.stages : undefined;
+  if (!Array.isArray(stages)) return [];
+  return stages.filter((s) => s !== null && typeof s === 'object' && s.kind === JUDGED_FLOOR_KIND);
+}
+
+/**
+ * Does this close declaration judge — i.e. will a judge model be CALLED?
+ * The question `scripts/run-u.mjs` asks before demanding a judge key (PRD item
+ * 31.4): a job that never judges must run on its own provider's key alone.
+ * @param {any} closeDecl
+ * @returns {boolean}
+ */
+export function closeJudges(closeDecl) {
+  return judgedStages(closeDecl).length > 0;
+}
 /** the one kind a PERSON renders — named once, because the runner keys three
  * decisions on it (is there a door to answer, which stage paused, whose ruling
  * this is) and three literals is how they come to disagree */
@@ -258,8 +298,10 @@ export function mechanicalStages(stages) {
  *   gapCap?: number, maxBuffer?: number, seedTrees?: SeedTrees,
  *   humanRuling?: {decision: string, text?: string|null}|null,
  *   judgeLoop?: (o: {system: string}) => any,
+ *   judgeModel?: string,
  *   onJudgeCost?: (c: {stage: string|null, kind: string|null, path: string, attempt: number,
  *     label: string, model: string, costUsd: number|null, unpricedRounds: number}) => void,
+ *   callBounds?: () => {timeoutMs?: number, deadlineMs?: number},
  *   onStage?: (row: {stage: string|null, kind: string|null, verdict: string, durationMs: number}) => void}} Ctx
  *   The arbiter's half of a stage run. Every field here is operator/runner
  *   territory: a declaration parameterises kinds, never the contracts.
@@ -267,14 +309,25 @@ export function mechanicalStages(stages) {
  *   runner — never authored, never defaulted, and absent on every ordinary run.
  *   `judgeLoop` is the PAID seam the judged stage runs its locate call through, and
  *   it is operator territory for the same reason the worker's provider is: this
- *   module owns no provider and never picks one, and the judge tier is PINNED
- *   (`JUDGE_MODEL`) rather than chosen. Absent is not a fall-back to some other
- *   model — the stage stops as a wiring gap, the same answer `runPlan` gives a
+ *   module owns no provider and never picks one. Absent is not a fall-back to some
+ *   other model — the stage stops as a wiring gap, the same answer `runPlan` gives a
  *   native job with no native factory.
+ *   `judgeModel` is the seam's other half (PRD item 32.1): WHICH model that loop
+ *   drives, resolved by the runner (`resolveJudge`, src/judged.js — the spec's signed
+ *   `judge` override, else the job's own worker model) rather than pinned in this
+ *   library. It is required whenever `judgeLoop` is, and for the same reason: a
+ *   verdict whose grader cannot be named is a floor nobody can attribute, and the
+ *   signed calibration record has nothing to compare against. The two travel
+ *   together or the stage stops.
  *   `onJudgeCost` is the METER, and it is the only reason a judged stage can be
  *   funded honestly: this executor cannot reach the run's ledger, so every locate
  *   call's cost is reported OUT through it, once per call, on every route including
  *   the red ones — a paid call that leaves no meter record is F12 in a judge's coat.
+ *   `callBounds` is F152/PRD 30.4's per-call TIME bound, read fresh before every
+ *   locate attempt — the same derivation the run's own worker rounds carry
+ *   (`callBounds()`, src/planrun.js). Absent is the honest unbounded default:
+ *   an adopter or test that wires no clock through behaves exactly as before
+ *   this field existed.
  *   `onStage` is a REPORTING seam and nothing else: the seed read spawns a real
  *   toolchain per stage (a suite is the slow one) and a whole read is one opaque
  *   await, so the shell gets told as each stage lands. It decides nothing, it is
@@ -1730,16 +1783,34 @@ async function runJudgedFloor(stage, ctx) {
   //     model on it (`validateCloseDecl`), so the runtime question is only ever WHICH
   //     model — and a stage descriptor handed straight to `runStage` by an adopter or a
   //     test is not a signed spec making a claim about a tier.
-  if (isNonEmptyString(stage.calibrationJudgeModel) && stage.calibrationJudgeModel !== JUDGE_MODEL) {
-    return stopped(stage, ctx, `INSTRUMENT: stage "${stage.name}" would grade with ${JUDGE_MODEL}, and the calibration `
-      + `set signed with this close was graded by ${stage.calibrationJudgeModel} — the judge tier moved under the `
+  //
+  // PRD item 32.1: WHICH model grades is no longer this module's constant — it is
+  // `ctx.judgeModel`, the identity the run resolved and wired (`resolveJudge`,
+  // src/judged.js: the spec's signed `judge` override, else the job's own worker
+  // model). The IDENTITY is checked before the seam and before the stamp, because
+  // an unwired identity makes both of the messages below unwritable: neither
+  // "would grade with X" nor "the judge is X" can be said by a stage that cannot
+  // name X. There is deliberately NO fall-back to `JUDGE_MODEL` here — a run that
+  // cannot say which model grades has not wired a judge, and grading under an
+  // identity nobody chose is exactly the silent-ignore class this repo refuses
+  // everywhere else.
+  if (!isNonEmptyString(ctx.judgeModel)) {
+    return stopped(stage, ctx, `INSTRUMENT: stage "${stage.name}" is a judged stage and this run wired no judge IDENTITY `
+      + '(ctx.judgeModel) — an adopter wiring gap, never a silent fall-back to a library pin. A verdict whose grader '
+      + 'cannot be named is a floor nobody can attribute, and the calibration record has nothing to compare against',
+    {}, STOP_FAULTS.FAILED);
+  }
+  const judgeModel = /** @type {string} */ (ctx.judgeModel);
+  if (isNonEmptyString(stage.calibrationJudgeModel) && stage.calibrationJudgeModel !== judgeModel) {
+    return stopped(stage, ctx, `INSTRUMENT: stage "${stage.name}" would grade with ${judgeModel}, and the calibration `
+      + `set signed with this close was graded by ${stage.calibrationJudgeModel} — the judge moved under the `
       + 'signature. A floor is worth exactly the judge that certified it, so this stops rather than grading against a '
-      + 'floor nobody calibrated: re-sign the spec with the new tier and re-run the calibration gate (recalibrate)',
-    { signedJudgeModel: stage.calibrationJudgeModel, judgeModel: JUDGE_MODEL }, STOP_FAULTS.FAILED);
+      + 'floor nobody calibrated: re-sign the spec with the new judge and re-run the calibration gate (recalibrate)',
+    { signedJudgeModel: stage.calibrationJudgeModel, judgeModel }, STOP_FAULTS.FAILED);
   }
   if (typeof ctx.judgeLoop !== 'function') {
     return stopped(stage, ctx, `INSTRUMENT: stage "${stage.name}" is a judged stage and this run wired no judge seam `
-      + `(ctx.judgeLoop) — an adopter wiring gap, never a silent fall-back: the judge is ${JUDGE_MODEL}, pinned, and a `
+      + `(ctx.judgeLoop) — an adopter wiring gap, never a silent fall-back: the judge is ${judgeModel} and a `
       + 'stage that quietly graded on whatever model was lying around would be a floor nobody calibrated',
     {}, STOP_FAULTS.FAILED);
   }
@@ -1781,11 +1852,17 @@ async function runJudgedFloor(stage, ctx) {
         card: p.card,
         loopFactory,
         attempt,
+        // F152/PRD 30.4 — read fresh per attempt, the same way `planrun.js`'s own
+        // worker rounds re-read `callBounds()` at every call site rather than
+        // once: the remaining time shrinks between attempts. Absent (no clock
+        // wired through) is `{}`, the honest unbounded default `runLocate` itself
+        // already carries.
+        callBounds: typeof ctx.callBounds === 'function' ? ctx.callBounds() : {},
         onCost: (c) => {
           if (typeof ctx.onJudgeCost !== 'function') return;
           ctx.onJudgeCost({
             stage: stage?.name ?? null, kind: stage?.kind ?? null, path: rel, attempt,
-            label: LOCATE_LABEL, model: JUDGE_MODEL, costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
+            label: LOCATE_LABEL, model: judgeModel, costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
           });
         },
       });
@@ -1836,7 +1913,7 @@ async function runJudgedFloor(stage, ctx) {
     exitCode: red ? EXIT_RED : EXIT_GREEN,
     gapLines: gap.render(),
     detail: {
-      model: JUDGE_MODEL,
+      model: judgeModel,
       card: p.card.items.map((/** @type {any} */ it) => it.rule),
       paths,
       perPath,