bareloop 0.23.0 → 0.25.0

package/src/authorflow.js

@@ -80,7 +80,7 @@ import { JUDGE_RULE_IDS } from './judged.js';
 import {
   KIND_CATALOGUE, MAX_STAGES, DIRECTIONS, BASELINES,
   GENRE_LANGUAGES, TYPES_GENRE_TEMPLATE, classGuards, genreEnv, genreOwnedEnvNames, genreInstruments,
-  validateDeclaration, envCapableKind, classMenu, VERDICT_CLASSES, LIVE_CLASSES,
+  validateDeclaration, envCapableKind, classMenu, VERDICT_CLASSES, LIVE_CLASSES, MENU_CLASSES,
 } from './authoring.js';
 import { buildSeedListing, cleanEntry, SURVEY_CAUSES, AUTHOR_CALL_TIMEOUT_MS } from './authorscout.js';
 import { extractArtifact, priceOf, scrubRaw, tallyCalls, capStop } from './text.js';
@@ -1418,18 +1418,28 @@ export async function authorClose({
   // what D5 exists to make impossible. `verb` rides as a structured field so the
   // caller can carry this to the counted admission path rather than re-deriving
   // the demand from prose.
-  if (!LIVE_CLASSES.includes(String(verdictType))) {
+  // MENU_CLASSES, not LIVE_CLASSES (PRD item 31.1): this is the AUTHORING path,
+  // and the question it asks is "may a NEW close be drafted for this class",
+  // never "can this class run". `hitl` answers no to the first and yes to the
+  // second — it is unlisted, not locked, so `validateCloseDecl` still validates an
+  // existing hitl close against its real battery and the runtime still executes it.
+  if (!MENU_CLASSES.includes(String(verdictType))) {
     const known = VERDICT_CLASSES.includes(String(verdictType));
+    const unlisted = LIVE_CLASSES.includes(String(verdictType));
     return refuse([{
       code: 'class-unsupported',
       path: 'verdictType',
       verb: String(verdictType),
       lib: 'bareloop',
-      detail: known
-        ? `"${verdictType}" is a named but LOCKED verdict class — v1 admits ${LIVE_CLASSES.join(', ')} only, and a `
-          + 'class with no guard battery must refuse rather than author a close without the guards it cannot supply'
-        : `"${verdictType}" is not a verdict class — the menu is ${VERDICT_CLASSES.join(' | ')}, and nothing derives `
-          + 'a class from the answers',
+      detail: unlisted
+        ? `"${verdictType}" is built and still runs, but it is NOT ON THE AUTHORING MENU — this flow drafts `
+          + `${MENU_CLASSES.join(', ')} only. Its class moved to fwdloop; an existing close of this class still `
+          + 'validates and still executes, but no new one is drafted here'
+        : known
+          ? `"${verdictType}" is a named but LOCKED verdict class — v1 admits ${MENU_CLASSES.join(', ')} only, and a `
+            + 'class with no guard battery must refuse rather than author a close without the guards it cannot supply'
+          : `"${verdictType}" is not a verdict class — the menu is ${VERDICT_CLASSES.join(' | ')}, and nothing derives `
+            + 'a class from the answers',
     }], 'precheck');
   }
 

package/src/authoring.js

@@ -108,6 +108,38 @@ export const LOCKED_CLASSES = Object.freeze([]);
 /** the classes v1 actually builds */
 export const LIVE_CLASSES = Object.freeze(VERDICT_CLASSES.filter((c) => !LOCKED_CLASSES.includes(c)));
 
+/** OFF THE MENU, but still built — a THIRD state, distinct from both lists above
+ * (PRD item 31.1, hamr 2026-09-09: *"retire hitl from list, keep its code"*, and
+ * *"if it's not on menu, you can't reach it, from menu"*).
+ *
+ * `hitl` was retired by ruling at v1.71 and the class moved to fwdloop (PRD item
+ * 29), but no constant was ever updated, so `runInterview` still returned
+ * `ok:true` for a hitl pick — an authorable job for a class this product no
+ * longer closes.
+ *
+ * Why this is NOT `LOCKED_CLASSES`. Locked means INEXPRESSIBLE: no guard battery
+ * exists, so `validateCloseDecl` cannot check the close and must refuse
+ * (`src/declaredclose.js:306`). hitl's battery, question set, composition rule and
+ * runtime all exist and are tested — locking it would make every one of them
+ * unreachable, which is not "keeping the code", it is abandoning it in place with
+ * its tests deleted. So the split is:
+ *
+ *   LOCKED_CLASSES   — no battery. Cannot be validated, cannot run. (empty today)
+ *   UNLISTED_CLASSES — battery exists, validates and RUNS. Just never OFFERED.
+ *   LIVE_CLASSES     — everything the system can validate and run (locked removed).
+ *
+ * Read by the AUTHORING surface only (`runInterview`, `authorClose`'s precheck).
+ * The spec validator, the close validator and the runtime deliberately do NOT
+ * read it: a hitl spec that already exists still validates and still runs, which
+ * is what keeps the code alive and under test. Nothing can AUTHOR a new one.
+ * @type {readonly string[]} */
+export const UNLISTED_CLASSES = Object.freeze(['hitl']);
+
+/** what the authoring interview actually OFFERS: live, minus unlisted. This is
+ * "the menu" in hamr's sentence, and it is the only list an authoring refusal
+ * should ever name. */
+export const MENU_CLASSES = Object.freeze(LIVE_CLASSES.filter((c) => !UNLISTED_CLASSES.includes(c)));
+
 /** the hierarchy as a comparable number. `green` is the FLOOR: a mechanical
  * measurement is the cheapest honest verdict, a judge is above it, a person is
  * above that. Read by the ceiling rule and by nothing else. */

package/src/authorjob.js

@@ -35,11 +35,19 @@
 // same way `repoPath` does — a closed set handed over enumerated, never read out
 // of prose.
 //
-// v1 STILL ADMITS ONLY `green`. A soft-green or hitl pick returns the honest
-// counted refusal on the `request-red` admission path (D13's mechanism), now
-// carrying demand for a VERDICT CLASS rather than only for a genre. It refuses
-// at ADMISSION — before that class's questions are ever asked, because those two
-// question sets are named but locked (`QUESTION_SETS`, M3).
+// THE MENU IS TWO SHAPES: `green` (a command decides done) and `soft-green` (a
+// rubric decides it, through the judged floor). Both are LIVE and both author
+// here. `hitl` is named by the radio, still validates and still runs, and is NOT
+// OFFERED — the class moved to fwdloop (PRD items 29 and 31.1); picking it
+// returns the honest counted refusal on the `request-red` admission path (D13's
+// mechanism), carrying demand for a VERDICT CLASS rather than only for a genre.
+// It refuses at ADMISSION — before that class's questions are ever asked.
+//
+// This comment said the opposite until 2026-09-09 (*"v1 STILL ADMITS ONLY
+// `green`"*), which was false for a long time and sent one build in the wrong
+// direction: `LOCKED_CLASSES` was empty, so `runInterview` returned `ok:true` for
+// every class including the retired one. Check `MENU_CLASSES` at runtime rather
+// than trusting any sentence here, this one included.
 //
 // AND THE INTERVIEW KEYS ON THE CLASS. Three frozen question sets replace one
 // set per genre: genres are a fat tail that cannot be enumerated, classes are
@@ -91,14 +99,15 @@
 // in the stored declaration (forward-compat point 3), and the suite pins it.
 
 import { jobSpecHash, validateJob } from './job.js';
-import { seedAtHead, seedListing, seedRead as runSeedRead, makeSeedTrees, SEED_EXEMPT_KINDS, JUDGED_FLOOR_KIND } from './kinds.js';
+import { seedAtHead, seedListing, seedRead as runSeedRead, makeSeedTrees, SEED_EXEMPT_KINDS, judgedStages, closeJudges } from './kinds.js';
 // SOFTGREEN modules 4 and 5 — the compile the interview's Q6/Q7 answers land in,
 // and the gate that decides whether the ruler they describe is a ruler.
 import { proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts } from './cardauthor.js';
 import { runCalibration } from './calibrate.js';
-import { JUDGE_MODEL, CALIBRATION_SIZE } from './judged.js';
+import { CALIBRATION_SIZE } from './judged.js';
 import {
   GENRE_LANGUAGES, LOCKED_KINDS, TYPES_GENRE, VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES,
+  UNLISTED_CLASSES, MENU_CLASSES,
 } from './authoring.js';
 import { QUESTION_SETS, questionsFor, requiredAnswersFor, authorClose, makeCostBook } from './authorflow.js';
 import { runAuthorScout, buildSeedListing, SCOUT_ATTEMPTS } from './authorscout.js';
@@ -123,7 +132,7 @@ export { QUESTION_SETS, questionsFor, requiredAnswersFor };
  * rule about it: illegal becomes inexpressible instead of rejected after the
  * fact (the `check-passes(name)` model). A UI renders it as three buttons, and
  * two of them are marked locked. */
-export { VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES };
+export { VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, UNLISTED_CLASSES, MENU_CLASSES };
 
 /** The territory every refusal here lands against. bareloop's OWN catalogue —
  * the genre menu, the verdict menu, the kind menu — never a bare-suite package.
@@ -141,6 +150,15 @@ const LEVERS = ([
   'wait for the verdict-classes rung — this refusal is the evidence it waits on',
 ]);
 
+/** the levers for an UNLISTED class (PRD item 31.1): the class is BUILT, so
+ * "wait for the rung" is the wrong sentence — there is no rung left to wait on.
+ * The honest next step is the other product, or a class this one still offers. */
+/** @type {string[]} */
+const UNLISTED_LEVERS = ([
+  'restate the job for a class bareloop still offers: green (a command decides done) or soft-green (a rubric does)',
+  'take a job that needs a person\'s sign-off to fwdloop — that product is built for the human-in-the-loop shape',
+]);
+
 /**
  * One refusal, in the shape both the caller and the ledger need.
  * @param {{verb: string|null, path: string, detail: string, kind?: 'request-red'|'decision-ready', options?: string[]}} o
@@ -236,17 +254,33 @@ export function runInterview({ answers, verdictType = null, repoPath = null, que
     return out({});
   }
 
-  // A LOCKED class refuses HERE, before its questions are asked. Counted demand
-  // for the class itself — the verdict-classes rung is what this evidence is for.
-  if (LOCKED_CLASSES.includes(picked)) {
+  // A class that is not ON THE MENU refuses HERE, before its questions are asked.
+  // Counted demand for the class itself — the verdict-classes rung is what this
+  // evidence is for. TWO reasons a pick lands here, and they are different facts
+  // (PRD item 31.1):
+  //   * LOCKED   — no guard battery exists, so nothing could validate the close.
+  //   * UNLISTED — the class is built and still RUNS; this product just no longer
+  //                offers it. `hitl` moved to fwdloop (item 29); its code, tests
+  //                and runtime stay, and an existing hitl spec still validates.
+  // Either way the person cannot author one, and the refusal says which it is
+  // rather than pooling two different situations into one sentence.
+  if (LOCKED_CLASSES.includes(picked) || UNLISTED_CLASSES.includes(picked)) {
+    const unlisted = UNLISTED_CLASSES.includes(picked);
     return out({
       refusal: refuse({
         verb: picked,
         path: 'verdictType',
-        detail: `You picked "${picked}", and v1 cannot close that yet: it admits ${LIVE_CLASSES.join(', ')} only — a `
-          + 'job whose done a command can decide. A judged score and a person\'s sign-off are named in the menu and '
-          + 'locked, so picking one is recorded as demand rather than dropped, and this refusal is the evidence the '
-          + 'verdict-classes rung waits on.',
+        options: unlisted ? UNLISTED_LEVERS : LEVERS,
+        detail: unlisted
+          ? `You picked "${picked}", and this product no longer offers that class: the menu is `
+            + `${MENU_CLASSES.join(', ')} — a job whose done a command can decide, or one whose done needs `
+            + 'judgement against a rubric. A person\'s sign-off moved to fwdloop, which is built for it. The '
+            + 'class itself is not deleted — an existing spec still validates and still runs — so picking one is '
+            + 'recorded as demand rather than dropped.'
+          : `You picked "${picked}", and v1 cannot close that yet: it admits ${MENU_CLASSES.join(', ')} only — a `
+            + 'job whose done a command can decide. A class with no guard battery is named in the menu and locked, '
+            + 'so picking one is recorded as demand rather than dropped, and this refusal is the evidence the '
+            + 'verdict-classes rung waits on.',
       }),
     });
   }
@@ -277,21 +311,32 @@ export function runInterview({ answers, verdictType = null, repoPath = null, que
   }
   if (reds.length) return out({ answers: given });
 
-  // The green pick's own precondition: D1's "a repo is never a precondition"
-  // holds for the INTERVIEW and not for D9's validity gates, all three of which
-  // rest on a runnable patient with a git seed. A doc or a website job has no
-  // seed and no changed set, so nothing deterministic can be measured against it
-  // — that is softgreen/hitl territory, out of v1, refused on the same counted
+  // A GENRE precondition, not a class one — and the difference is why this text
+  // was wrong until 2026-09-09 (PRD item 31.2). It used to answer a missing repo
+  // with "that needs a judged (soft-green) or a human close", which told a person
+  // who had just PICKED soft-green that they needed soft-green. Both live classes
+  // land here identically: D1's "a repo is never a precondition" holds for the
+  // INTERVIEW and not for D9's validity gates, all three of which rest on a
+  // runnable patient with a git seed, and the close CATALOGUE is code-genre only
+  // (doc-genre kinds are not admitted — PRD item 26). So a doc or a website job
+  // refuses for want of a SEED, whichever class it picked, on the same counted
   // path. The class the user picked cannot be honoured, so it is not returned.
+  //
+  // The `verb` stays `non-green-verdict` deliberately. It is the ledger's key for
+  // this demand and renaming it would split one running count into two that look
+  // like different demands; the name is a poor description of a genre refusal,
+  // and that is a smaller cost than a discontinuous ledger.
   if (!isNonEmptyString(repoPath)) {
     return out({
       answers: given,
       refusal: refuse({
         verb: 'non-green-verdict',
         path: 'repoPath',
-        detail: 'This job has no code repository, so there is no seed to measure against and no changed set to read — '
-          + 'nothing deterministic can decide whether it came back done. That needs a judged (soft-green) or a '
-          + 'human close; this authoring flow drafts code-genre closes against a git seed only.',
+        detail: 'This job has no code repository, so there is no seed to measure against and no changed set to '
+          + 'read. This authoring flow drafts CODE-GENRE closes against a git seed only, and that is true of both '
+          + 'classes it offers: a green close runs commands over the tree, and a soft-green close judges the '
+          + 'artifacts the run changed in it. A job with no repository needs a doc-genre close, which is not built '
+          + 'here yet.',
       }),
     });
   }
@@ -370,7 +415,7 @@ function composerRefusal(reds) {
  * @param {{answers: Record<string|number, any>, repoPath?: string|null, lang: string,
  *   verdictType?: string|null,
  *   questions?: Record<string|number, string>|null, generate?: Function, provider?: any,
- *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null,
+ *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null, judgeModel?: string|null,
  *   onPhase?: (phase: string, data?: any) => void,
  *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   seedFn?: Function, scoutFn?: Function, listingFn?: Function,
@@ -384,6 +429,11 @@ export async function authorCloseForJob({
   answers, repoPath = null, lang, verdictType = null, questions = null,
   generate, provider = null, seedRef = null, scout = null, listing = null,
   ceilingUsd = null,
+  // THE JUDGE IDENTITY (PRD item 32.1), required only on the path that actually
+  // composes a judged stage — the stored calibration set carries the judge that
+  // certified it, and there is no library pin to fall back to. Absent on a purely
+  // mechanical close is correct and costs nothing: that close never judges.
+  judgeModel = null,
   // THE PROGRESS SEAMS. This composition is the pipeline's long silence — a real
   // survey, a real declaration ladder, and a real toolchain per close stage — and
   // it emitted nothing until it returned, so an operator watching a live run
@@ -573,7 +623,7 @@ export async function authorCloseForJob({
   // as the caller-error guard it is.
   /** @type {any} */
   let judged = null;
-  if ((closeDecl.stages ?? []).some((/** @type {any} */ s) => isObj(s) && s.kind === JUDGED_FLOOR_KIND)) {
+  if (closeJudges(closeDecl)) {
     // ONE CEILING, ALL THREE PAID SEAMS. The declaration loop's own calls are
     // ABSORBED before the compile is asked for, so the ceiling folds in prior
     // spend and re-invoking a seam cannot silently widen it. `absorb` deliberately
@@ -620,7 +670,14 @@ export async function authorCloseForJob({
     // non-array before anything can be `ok` — and the narrowing is stated rather
     // than defaulted: `?? []` here would fold an EMPTY signed set into a close,
     // which is the one direction that must never be reachable.
-    closeDecl = foldJudgedArtifacts(closeDecl, { card: signed.card, cases: /** @type {any[]} */ (signed.cases) });
+    if (typeof judgeModel !== 'string' || judgeModel.trim() === '') {
+      throw new Error('[authorjob] authorCloseForJob composed a JUDGED close and was given no judgeModel (PRD item '
+        + '32.1). The stored calibration set carries the judge that certified it, and a set stamped with a model '
+        + 'nobody named is exactly the unattributable floor that field exists to prevent.');
+    }
+    closeDecl = foldJudgedArtifacts(closeDecl, {
+      card: signed.card, cases: /** @type {any[]} */ (signed.cases), judgeModel,
+    });
     return {
       ok: true,
       refusal: null,
@@ -760,12 +817,15 @@ const scrubRed = (r) => /** @type {any} */ (Object.fromEntries(
  * The book is built HERE and PRIOR SPEND IS ABSORBED into it, so the ceiling folds in
  * what the earlier seams already spent and re-invoking a seam cannot silently widen
  * it; the gate reads it between calls and stops as a refusal that names money.
- * @param {{spec: any, judgedStages: any[], judgeLoop: Function|null,
+ * `judgeModel` is the RESOLVED judge identity (PRD item 32.1), required and with no
+ * default: it is stamped onto the graded set and onto the calibration-missing record
+ * alike, so both say which judge the close would have been certified by.
+ * @param {{spec: any, judgedStages: any[], judgeLoop: Function|null, judgeModel: string,
  *   onJudgeCost: ((c: any) => void)|null, calibrateFn: Function,
  *   ceilingUsd: number|null, priorCalls: any[]}} o
  * @returns {Promise<{ok: boolean, record: any, reds: Red[], refusal: Refusal|null}>}
  */
-async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, calibrateFn, ceilingUsd, priorCalls }) {
+async function calibrationGate({ spec, judgedStages, judgeLoop, judgeModel, onJudgeCost, calibrateFn, ceilingUsd, priorCalls }) {
   const cases = spec.closeDecl?.calibration?.cases ?? null;
   // ONE card, and it is the SIGNED one — the card the calibration is graded
   // against must be the card the close will RUN, or the gate certifies a ruler
@@ -779,7 +839,7 @@ async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, cal
       + 'ruler is unmeasured, and an unmeasured ruler cannot be signed.';
     return {
       ok: false,
-      record: { ok: false, stop: 'calibration-missing', judgeModel: JUDGE_MODEL, required: CALIBRATION_SIZE },
+      record: { ok: false, stop: 'calibration-missing', judgeModel, required: CALIBRATION_SIZE },
       reds: [{ code: 'calibration-missing', path: 'closeDecl.calibration.cases', detail }],
       refusal: refuse({
         kind: 'decision-ready',
@@ -805,6 +865,7 @@ async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, cal
     cases,
     card,
     judgeLoop,
+    judgeModel,
     // the gate's own calls join the same tally the ceiling is read against — a
     // ceiling that cannot see the spend it bounds is F45's blind detector in a
     // money coat. The caller's reporter fires with the call's whole record, after.
@@ -942,8 +1003,8 @@ async function calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, cal
  *
  * @param {{spec: any, workdir: string, seedRef?: string|null, shellCapUsd?: number,
  *   timeoutMs?: number, seedFn?: Function, listingFn?: Function, seedReadFn?: Function,
- *   judgeLoop?: Function|null, onJudgeCost?: ((c: any) => void)|null, calibrateFn?: Function,
- *   ceilingUsd?: number|null, priorCalls?: any[]}} o
+ *   judgeLoop?: Function|null, judgeModel?: string|null, onJudgeCost?: ((c: any) => void)|null,
+ *   calibrateFn?: Function, ceilingUsd?: number|null, priorCalls?: any[]}} o
  * @returns {Promise<{ok: boolean, specHash: string|null, seedRef: string|null,
  *   gates: any, work: any[], guards: any[], stops: any[], reds: Red[], refusal: Refusal|null}>}
  */
@@ -953,8 +1014,11 @@ export async function prepareSigning({
   // THE PAID SEAM, and it is the operator's to wire — this module owns no
   // provider and picks none (the same contract `authorCloseForJob` keeps for the
   // drafting model). Absent is never a fall-back: a judged close whose gate could
-  // not run is refused, not waved through.
-  judgeLoop = null, onJudgeCost = null, calibrateFn = runCalibration,
+  // not run is refused, not waved through. `judgeModel` is the seam's other half
+  // (PRD item 32.1) — WHICH model that loop drives, resolved by the caller
+  // (`resolveJudge`, src/judged.js). The two travel together: a gate that grades
+  // without recording its judge certifies a floor nobody can attribute.
+  judgeLoop = null, judgeModel = null, onJudgeCost = null, calibrateFn = runCalibration,
   // THE OPERATOR'S CEILING, and the spend it has already met. `null`/absent is
   // UNBOUNDED and is a stated choice, never a default invented here (the same
   // contract `authorCloseForJob` keeps). `priorCalls` is what the earlier paid
@@ -1109,9 +1173,17 @@ export async function prepareSigning({
   // validator checks a stored set for LEGALITY only and deliberately allows a
   // judged stage with no set at all, because making it mandatory is a signing
   // decision and this is the signing gate.
-  const judgedStages = (spec.closeDecl.stages ?? []).filter((/** @type {any} */ s) => isObj(s) && s.kind === JUDGED_FLOOR_KIND);
-  if (judgedStages.length) {
-    const cal = await calibrationGate({ spec, judgedStages, judgeLoop, onJudgeCost, calibrateFn, ceilingUsd, priorCalls });
+  const judged = judgedStages(spec.closeDecl);
+  if (judged.length) {
+    if (judgeLoop !== null && (typeof judgeModel !== 'string' || judgeModel.trim() === '')) {
+      throw new Error('[authorjob] prepareSigning was wired a judgeLoop with no judgeModel (PRD item 32.1). The two '
+        + 'halves of the judge seam travel together: the graded set is stamped with the judge that certified it, and '
+        + 'there is no library pin to fall back to.');
+    }
+    const cal = await calibrationGate({
+      spec, judgedStages: judged, judgeLoop, judgeModel: /** @type {string} */ (judgeModel),
+      onJudgeCost, calibrateFn, ceilingUsd, priorCalls,
+    });
     base.gates.calibration = cal.record;
     if (!cal.ok) return { ...base, work, guards, reds: cal.reds, refusal: cal.refusal };
   }

package/src/calibrate.js

@@ -46,7 +46,9 @@
 //     calibration becomes a refusal, exactly as D9's other three gates work.
 //   * IT PICKS NO NUMBER. The size is `CALIBRATION_SIZE` (hamr's), the floor is
 //     all-of-them (hamr's), the ladder is `JUDGE_ATTEMPTS` (operator-confirmed),
-//     and the model is `JUDGE_MODEL` (pinned). Nothing here invents a threshold.
+//     and the model is the run's RESOLVED judge identity, handed in (PRD item
+//     32.1) rather than pinned in this library. Nothing here invents a threshold
+//     and nothing here picks a judge.
 //   * IT OWNS NO PROVIDER. The judge seam arrives as `judgeLoop`; an absent one
 //     is a WIRING GAP that stops the gate, never a silent skip — a judged close
 //     signed off a calibration nobody ran is the exact state this gate exists to
@@ -58,7 +60,7 @@
 
 import { createHash } from 'node:crypto';
 import {
-  JUDGE_MODEL, LOCATE_LABEL, LOCATE_AXES, CALIBRATION_SIZE,
+  LOCATE_LABEL, LOCATE_AXES, CALIBRATION_SIZE,
   runLocate, decide, expectedOf, validateCard, validateCalibrationSet,
 } from './judged.js';
 import { JUDGE_ATTEMPTS } from './kinds.js';
@@ -309,11 +311,11 @@ export function factsResist(facts, gold, artifactText) {
  * when the model is malforming, which is the worst moment for a paid ladder to be
  * unbounded. A stop comes back as its own field rather than as a `red`: a ceiling
  * is the OPERATOR's governance, never the transport's casualty.
- * @param {{artifactText: string, card: any, judgeLoop: Function, attempts: number,
+ * @param {{artifactText: string, card: any, judgeLoop: Function, judgeModel: string, attempts: number,
  *   meter: (c: any) => void, id: string, kind: string,
  *   capStop: () => 'cap-halt'|'pricing-red'|null}} o
  */
-async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, kind, capStop }) {
+async function pipeOnce({ artifactText, card, judgeLoop, judgeModel, attempts, meter, id, kind, capStop }) {
   /** @type {any} */
   let last = null;
   /** @type {any[]} */
@@ -341,7 +343,7 @@ async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, ki
       // when ITS OWN wall is unbounded (`PROVIDER_TIMEOUT_MS`, src/clock.js).
       callBounds: { timeoutMs: PROVIDER_TIMEOUT_MS },
       onCost: (c) => meter({
-        id, kind, attempt, label: CALIBRATION_LABEL, model: JUDGE_MODEL,
+        id, kind, attempt, label: CALIBRATION_LABEL, model: judgeModel,
         costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
       }),
     });
@@ -381,7 +383,13 @@ async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, ki
  * graded one: `ok` is false, the cases nobody bought are absent rather than recorded
  * as failures, and `casualty` stays null — the transport was fine, the operator's own
  * governance stopped the gate.
- * @param {{cases: any, card: any, judgeLoop: Function|null,
+ * `judgeModel` is REQUIRED and has no default (PRD item 32.1). It is the identity
+ * the caller resolved (`resolveJudge`, src/judged.js) and it is what the graded set
+ * is STAMPED with — `setHash` folds it in, so a set certified by one judge cannot be
+ * mistaken for the same set certified by another. A default here would be the silent
+ * fall-back the whole judge-identity change exists to remove: a gate that grades
+ * under a model nobody named certifies a floor nobody can attribute.
+ * @param {{cases: any, card: any, judgeLoop: Function|null, judgeModel: string,
  *   onCost?: (c: any) => void, attempts?: number, battery?: any[], batteryCard?: any,
  *   capStop?: () => 'cap-halt'|'pricing-red'|null}} o
  * @returns {Promise<{ok: boolean, stop: string|null, casualty: any,
@@ -392,12 +400,25 @@ async function pipeOnce({ artifactText, card, judgeLoop, attempts, meter, id, ki
  *   costUsd: number|null, knownUsd: number, spendComplete: boolean, calls: any[]}>}
  */
 export async function runCalibration({
-  cases, card, judgeLoop, onCost = () => {},
+  cases, card, judgeLoop, judgeModel, onCost = () => {},
   attempts = JUDGE_ATTEMPTS,
   battery = /** @type {any[]} */ (/** @type {unknown} */ (INJECTION_LOCATE_BATTERY)),
   batteryCard = INJECTION_CARD,
   capStop = () => null,
 }) {
+  // The mandatory-identity throw guards a REAL judge seam graded under nobody's
+  // name — it does not apply when there is no seam at all. A caller wiring no
+  // `judgeLoop` (an adopter who has not connected a judge yet) legitimately hands
+  // in no `judgeModel` either, and that case is the WIRING-GAP `no-judge` stop
+  // below, returned as a red rather than thrown. Throwing here ahead of that
+  // check would make the wiring-gap stop unreachable through its own documented
+  // path — `prepareSigning` (src/authorjob.js) draws exactly this same line with
+  // its own `judgeLoop !== null` guard, and this function has to agree with it.
+  if (typeof judgeLoop === 'function' && (typeof judgeModel !== 'string' || judgeModel.trim() === '')) {
+    throw new Error('[calibrate] runCalibration needs the resolved judgeModel (PRD item 32.1): the graded set is '
+      + 'STAMPED with the judge that certified it, and a set nobody can attribute is a floor nobody can tell apart '
+      + 'from one graded by a different model. There is no library pin to fall back to.');
+  }
   /** @type {any[]} */
   const calls = [];
   /** @param {any} c */
@@ -413,7 +434,7 @@ export async function runCalibration({
     return /** @type {any} */ ({
       ok: false, stop: null, casualty: null, graded: [], failures: [],
       injection: { styles: [], allResisted: false, leaks: [] },
-      reds: [], judgeModel: JUDGE_MODEL,
+      reds: [], judgeModel,
       cardHash: null, casesHash: null, setHash: null,
       costUsd: t.costUsd, knownUsd: t.knownUsd, spendComplete: t.spendComplete, calls: calls.map((c) => ({ ...c })),
       ...extra,
@@ -464,7 +485,7 @@ export async function runCalibration({
         code: 'no-judge-seam',
         path: 'judgeLoop',
         detail: `the calibration gate runs ${CALIBRATION_SIZE} real locate calls plus ${battery.length} injection `
-          + `artifacts through ${JUDGE_MODEL}, and no judge seam was wired. An absent seam is an adopter wiring gap and `
+          + `artifacts through ${judgeModel}, and no judge seam was wired. An absent seam is an adopter wiring gap and `
           + 'never a fall-back: a gate that grades nothing would certify every close it was asked about',
       }],
     });
@@ -472,7 +493,7 @@ export async function runCalibration({
 
   const cardHash = artifactHash(card);
   const casesHash = artifactHash(cases);
-  const setHash = artifactHash({ card, cases, judgeModel: JUDGE_MODEL });
+  const setHash = artifactHash({ card, cases, judgeModel });
   const stamped = { cardHash, casesHash, setHash };
 
   // ── the signed ten ────────────────────────────────────────────────────────
@@ -480,7 +501,7 @@ export async function runCalibration({
   const graded = [];
   for (const c of cases) {
     const r = await pipeOnce({
-      artifactText: String(c.artifact), card, judgeLoop: /** @type {Function} */ (judgeLoop),
+      artifactText: String(c.artifact), card, judgeLoop: /** @type {Function} */ (judgeLoop), judgeModel,
       attempts, meter, id: String(c.id), kind: 'case', capStop,
     });
     // the ceiling, ahead of the casualty branch: a call nobody funded is not a call
@@ -527,7 +548,7 @@ export async function runCalibration({
   const styles = [];
   for (const b of battery) {
     const r = await pipeOnce({
-      artifactText: b.artifact, card: batteryCard, judgeLoop: /** @type {Function} */ (judgeLoop),
+      artifactText: b.artifact, card: batteryCard, judgeLoop: /** @type {Function} */ (judgeLoop), judgeModel,
       attempts, meter, id: b.id, kind: 'injection', capStop,
     });
     if (r.budget) {

package/src/cardauthor.js

@@ -60,10 +60,10 @@
 // pipe produces are one shape read twice (module 5 compares them mechanically).
 
 import {
-  JUDGE_RULE_IDS, JUDGE_RULES, CALIBRATION_SIZE, CASE_VERDICTS, validateJudgedArtifacts, JUDGE_MODEL,
+  JUDGE_RULE_IDS, JUDGE_RULES, CALIBRATION_SIZE, CASE_VERDICTS, validateJudgedArtifacts,
 } from './judged.js';
 import { askStructured, makeCostBook } from './authorflow.js';
-import { JUDGED_FLOOR_KIND } from './kinds.js';
+import { judgedStages } from './kinds.js';
 import { isObj, redactSecrets } from './validate.js';
 
 /** @typedef {{code: string, path: string, detail: string, [k: string]: any}} Red */
@@ -363,15 +363,16 @@ export function signJudgedArtifacts({ proposal, fix = null }) {
  *   - THE CASES land beside the stages as `calibration.cases` — a close-level
  *     artifact, because the set calibrates the RULER and not one stage's params,
  *     and because module 5's gate reads it before any stage runs.
- *   - THE JUDGE MODEL lands beside them as `calibration.judgeModel`, and it is the
- *     PIN (`JUDGE_MODEL`) rather than anything a caller may name. A calibration set
- *     is only worth the tier that graded it — §4.2's whole safety argument is worth
- *     exactly as much as BA-20's injection evidence, which is haiku-4.5's alone — so
- *     the set has to carry which tier certified it or nothing downstream can tell a
- *     signed floor from a bumped one. Storing it HERE, inside the spec, is what makes
- *     a bump flip `jobSpecHash`: the signature dies, the signer re-signs, and a
- *     re-sign is a re-run of the calibration gate. That is the docstring on
- *     `JUDGE_MODEL` finally given a detector instead of a promise (F45).
+ *   - THE JUDGE MODEL lands beside them as `calibration.judgeModel`. Since PRD item
+ *     32.1 that is the RESOLVED judge identity the caller hands in (`resolveJudge`,
+ *     src/judged.js — the spec's signed `judge` override, else the job's own worker
+ *     model), not a library pin. A calibration set is only worth the judge that
+ *     graded it, so the set has to carry which judge certified it or nothing
+ *     downstream can tell a signed floor from a moved one. Storing it HERE, inside
+ *     the spec, is what makes a judge change flip `jobSpecHash`: the signature dies,
+ *     the signer re-signs, and a re-sign is a re-run of the calibration gate. It is
+ *     REQUIRED, with no default — a set stamped with a model nobody named is exactly
+ *     the unattributable floor this field exists to prevent (F45).
  *
  * A card with NOWHERE TO LAND THROWS. It is a caller's own broken input — a
  * signed rubric folded into a close with no judged ruler — and there is no safe
@@ -380,20 +381,26 @@ export function signJudgedArtifacts({ proposal, fix = null }) {
  * The input is never mutated: a closeDecl is a signed artefact and rewriting a
  * caller's copy in place is how two readers come to disagree about what was
  * signed.
- * @param {any} closeDecl @param {{card: any, cases: any[]}} o
+ * @param {any} closeDecl @param {{card: any, cases: any[], judgeModel: string}} o
  * @returns {any} a new closeDecl
  */
-export function foldJudgedArtifacts(closeDecl, { card, cases }) {
+export function foldJudgedArtifacts(closeDecl, { card, cases, judgeModel }) {
+  if (typeof judgeModel !== 'string' || judgeModel.trim() === '') {
+    throw new Error('[cardauthor] foldJudgedArtifacts needs the resolved judgeModel (PRD item 32.1): the stored set '
+      + 'carries the judge that certified it, and there is no library pin to fall back to.');
+  }
   const out = structuredClone(closeDecl);
-  const stages = Array.isArray(out?.stages) ? out.stages : [];
-  const judged = stages.filter((/** @type {any} */ s) => isObj(s) && s.kind === JUDGED_FLOOR_KIND);
+  // `judgedStages` filters `out`'s OWN stage objects, so the card assignment
+  // below mutates the clone in place — the reason this reads `out`, not the
+  // caller's `closeDecl`.
+  const judged = judgedStages(out);
   if (judged.length !== 1) {
     throw new Error(`[cardauthor] the signed card folds into the close's ONE judged-floor stage, and this close has `
       + `${judged.length} — a rubric with nowhere to land is signed evidence nothing reads, and a second judged stage `
       + 'is a second bar for one verdict');
   }
   judged[0].params = { ...(isObj(judged[0].params) ? judged[0].params : {}), card: structuredClone(card) };
-  out.calibration = { cases: structuredClone(cases), judgeModel: JUDGE_MODEL };
+  out.calibration = { cases: structuredClone(cases), judgeModel };
   return out;
 }