bareloop 0.25.0 → 0.26.0

package/src/index.js

@@ -52,7 +52,7 @@ export {
   BRIDGE_SCHEMA, validateBridge, deriveStatus, listingRow, loadGate,
   mintBridge, appendGreen, appendRed,
   loadBridge, loadRegistry, saveBridge, makeRegistry, registryExists,
-  QUARANTINED_VERDICTS, QUARANTINED_CODE, quarantinesCredit, newestEligibleVersion, reuseEligibility, recordDoor,
+  QUARANTINED_VERDICTS, quarantinesCredit, newestEligibleVersion, reuseEligibility, recordDoor,
 } from './bridges.js';
 export { renderListing, selectionPrompt } from './selection.js';
 // Layer 3 modules 4+5 — the D7 envelope and the reuse runner. `runReuse` composes
@@ -81,7 +81,7 @@ export { renderListing, selectionPrompt } from './selection.js';
 // at a review door, and a door with no row to act on can only describe a held learning
 // credit it has no way to release. STORAGE ONLY — nothing here selects, promotes or reuses
 // a bridge; those stay parked on `layer-3-reuse`.
-export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate, applyDoorDecision, writeRunGreenRow, shapeForkName } from './reuse.js';
+export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate, applyDoorDecision, writeRunGreenRow } from './reuse.js';
 // BA-21 pricing provenance rides out with the ledger because it is the same job: reading
 // a run's own spend record honestly. `rateProvenance`/`spendProvenance` answer "how much of
 // this was priced by a rate nobody vouched for" — REPORTING ONLY, no halt, no refusal.
@@ -95,7 +95,7 @@ export { classifyIncidents, foldLedger, ledgerDeltas, updateLedger, LEDGER_CLASS
 // runner that resumes reads the branch off the dead spine and may want to verify it is
 // still there before spending anything. The runner applies the rule itself either way —
 // neither export is a way to opt out of it.
-export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE } from './workbranch.js';
+export { workBranchName } from './workbranch.js';
 // THE READ SHIM (arm-gated, OFF by default via `runJob`'s `readShim`). The cap is exported
 // because bareloop.context.md names it, and documented-but-unexported is a false contract;
 // the wrapper goes with it so a caller building its own worker seam wraps the SAME ledger
@@ -105,7 +105,7 @@ export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE }
 // `readShimArm` is exported for the same reason the cap is: a battery driver has to be able
 // to name and check the arm it is about to run BEFORE it launches, and the legal set living
 // only inside a runner would leave the driver guessing at spellings the guard will reject.
-export { createReadShim, wrapReadTool, readShimArm, readShimStrategy, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY, READ_SHIM_ARMS } from './readshim.js';
+export { readShimArm, READ_SHIM_CAP, READ_SHIM_STRATEGY, READ_SHIM_DIFF_STRATEGY } from './readshim.js';
 // ── CLOSE AUTHORING v1 (gate 4) — the user declares what done means ──────────
 // The public surface is settled ONCE, here, at M4 (M2's header flagged the
 // naming collision and deferred it rather than exporting piecemeal).
@@ -123,12 +123,12 @@ export { createReadShim, wrapReadTool, readShimArm, readShimStrategy, READ_SHIM_
 // gate (that is what `prepareSigning` does with them), and `seedAtHead` because
 // D8's seed is READ at run start rather than typed into a spec.
 export {
-  runDeclaredClose, runStage, seedRead, seedAtHead, seedListing, changedSet, makeSeedTrees,
-  LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, EXIT_GREEN, EXIT_RED, EXIT_STOP,
+  runDeclaredClose, runStage, seedRead, seedAtHead,
+  LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER,
   // N4 slice 1 — the hitl surface an adopting runner needs: the three doors, the
   // gate that reads a signer's answer (and refuses an empty one), and the seed
   // exemption ruling 8 states.
-  HUMAN_DECISIONS, SEED_EXEMPT_KINDS, JUDGED_FLOOR_KIND, normalizeHumanRuling, resolveHumanRuling,
+  HUMAN_DECISIONS, SEED_EXEMPT_KINDS, normalizeHumanRuling, resolveHumanRuling,
   // SOFTGREEN module 2 — the judged stage's own arbiter-owned bounds. An adopter
   // wiring `judgeProvider` needs both numbers to reason about what a judged close
   // can cost: one paid call per artifact, at most one retry each.
@@ -136,7 +136,7 @@ export {
   // SOFTGREEN module 8 — the REVIEW DOOR's vocabulary: the record type a run
   // writes when it ends at the door, which terminals open one, which classes open
   // one unasked, and the mechanical-only rule an `accept` re-proves against.
-  REVIEW_DOOR, DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages,
+  DOOR_OPEN_OUTCOMES, REVIEW_DOOR_CLASSES, doorOpens, mechanicalStages,
 } from './kinds.js';
 // SOFTGREEN module 8 — the door's ANSWERING half. A run OPENS the door on its own
 // spine and ends; a person answers minutes or days later, from another process, so
@@ -144,7 +144,7 @@ export {
 // it re-proves the tree for an `accept`, releases a held judged green through
 // module 6's registry half, and refuses an expired door under the same 60-day TTL a
 // hitl checkpoint keeps. It never returns, writes or implies a verdict.
-export { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
+export { answerReviewDoor } from './reviewdoor.js';
 // SOFTGREEN module 1 — the judged floor's core. The pieces an adopter (and an
 // integrating UI) genuinely needs: `resolveJudge` (PRD item 32.1 — WHICH model
 // grades a job: the spec's signed `judge` override, else the job's own worker
@@ -157,13 +157,13 @@ export { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
 // runner reaches it through `runPlan`'s `judgeProvider`, and it is exported so a
 // caller building its own harness does not spell a second one.
 export {
-  JUDGE_MODEL, resolveJudge, JUDGE_MAX_TOKENS, JUDGE_RULES, JUDGE_RULE_IDS, LOCATE_AXES, LOCATE_LABEL,
-  validateCard, validateFacts, locatePrompt, runLocate, decide, defaultJudgeLoop,
+  JUDGE_MODEL, resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS,
+  runLocate, decide,
   // SOFTGREEN module 4 — what a legal SIGNED calibration set is. The SIZE is
   // hamr's own ruling and a size change is a spec-level threshold change;
   // `expectedOf` is the ONE reduction of a `decide()` result to the shape a case
   // stores, so a calibration harness compares one shape rather than two.
-  CALIBRATION_SIZE, CASE_VERDICTS, validateCalibrationSet, validateJudgedArtifacts, expectedOf,
+  CALIBRATION_SIZE, validateCalibrationSet, expectedOf,
 } from './judged.js';
 // SOFTGREEN module 4 — the COMPILE. Q6 becomes the rubric card and Q7 becomes the
 // frozen calibration set, both on the D5 shown-and-fixed path: the LLM proposes
@@ -173,8 +173,6 @@ export {
 // line or a case is a re-sign like every other spec edit.
 export {
   proposeJudgedArtifacts, signJudgedArtifacts, foldJudgedArtifacts,
-  proposalSchema, proposalTool, cardCasesPrompt,
-  PROPOSAL_TOOL_NAME, PROPOSAL_LABEL, MAX_PROPOSAL_RETRIES, COMPILE_SYSTEM,
 } from './cardauthor.js';
 // SOFTGREEN module 5 — THE CALIBRATION GATE. `runCalibration` grades the whole
 // pipe (locate + decide) over the signed ten and the five arbiter-owned injection
@@ -185,22 +183,21 @@ export {
 // on trust. `INJECTION_LOCATE_BATTERY` and `INJECTION_CARD` are ARBITER-OWNED
 // constants: no signer authors them and nothing stores them in a spec.
 export {
-  runCalibration, compareExpectation, factsResist, artifactHash,
-  INJECTION_LOCATE_BATTERY, INJECTION_CARD, CALIBRATION_LABEL, CASUALTY_AXES,
+  runCalibration,
+  INJECTION_LOCATE_BATTERY, CASUALTY_AXES,
 } from './calibrate.js';
 // M2 — what a declaration may SAY, and whether one said it legally. The
 // catalogue and the genre are DATA an integrating UI renders (the kind menu, the
 // guard batteries it must show the user under D5 and cannot let them remove).
 export {
-  validateDeclaration, normalizeDeclaration, KIND_CATALOGUE, CATALOGUE_KINDS, CATALOGUE_LIVE_KINDS,
-  LOCKED_KINDS, TYPES_GENRE, TYPES_GENRE_TEMPLATE, GENRE_LANGUAGES, genreEnv, genreOwnedEnvNames,
+  validateDeclaration, KIND_CATALOGUE,
+  LOCKED_KINDS, genreEnv,
   // how the genre's own tools PRINT — genre property for the same reason the
   // suppression battery is (2026-08-09, run msmbpjk6)
   genreInstruments,
-  DIRECTIONS, BASELINES, MAX_STAGES,
   // the verdict-class surface (PRD v1.57 §1–§2): the radio's own menu, the guard
   // battery keyed off it, and the ceiling that makes the pick a promise
-  VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, CLASS_BATTERIES, classGuards, classMenu, closeCeiling,
+  LOCKED_CLASSES, CLASS_BATTERIES, classGuards, closeCeiling,
   // ruling 5 as data: the kinds no agent may ever be offered as an in-run ruler
   NEVER_OFFERED_KINDS,
 } from './authoring.js';
@@ -208,27 +205,26 @@ export {
 // loop; `runAuthorScout`/`buildSeedListing` are exported because a caller that
 // already paid for a survey passes it back in rather than buying a second one.
 export {
-  runAuthorScout, buildSeedListing, seedFileList, classifySurvey, AUTHOR_SCOUT_VERBS,
+  runAuthorScout, buildSeedListing, AUTHOR_SCOUT_VERBS,
   // the malformed-class retry ladder: the hardcoded ceiling, the typed causes it
   // reads, and the closed set of causes that may fire it (2026-08-09, PRD v1.58)
-  SCOUT_ATTEMPTS, SURVEY_CAUSES, SCOUT_RETRY_CAUSES,
+  SCOUT_ATTEMPTS, SCOUT_RETRY_CAUSES,
 } from './authorscout.js';
 /** the ONE scrubbed-persist boundary for a model's raw output, and its announced
  * bound — exported because every future writer of a raw must reach for this one
  * rather than spell a second scrub (PRD v1.58) */
-export { scrubRaw, RAW_PERSIST_MAX, RAW_TRIM_MARKER } from './text.js';
+export { scrubRaw, RAW_PERSIST_MAX } from './text.js';
 export {
-  authorClose, authorPrompt, declarationSchema, makeLoopGenerate, MAX_REVISIONS,
-  QUESTION_SETS, GREEN_QUESTIONS, SOFTGREEN_QUESTIONS, CLASS_STATEMENTS, questionsFor, requiredAnswersFor,
+  authorClose, MAX_REVISIONS,
+  questionsFor, requiredAnswersFor,
 } from './authorflow.js';
 // M4a — the runtime bridge. `validateCloseDecl` is the spec-level gate (the job
 // validator's own branch calls it); `runDeclaredStages` is the executor seam a
 // runner other than `runPlan` would need; `closeStagesOf` is the ONE staging
 // every close consumer reads, widened to both fields.
 export {
-  validateCloseDecl, runDeclaredStages, declaredStages, isDeclaredClose, guardNames, closeGrade,
-  DECLARED_GENRES, DECLARED_GAP_PREFIX, DECLARED_GAP_KEEP, DECLARED_CLOSE_CLASSES, CLOSE_DECL_FIELDS,
-  HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED, HUMAN_CHECKPOINTS,
+  validateCloseDecl, runDeclaredStages, declaredStages,
+  HUMAN_PAUSE,
 } from './declaredclose.js';
 export { closeStagesOf } from './plan.js';
 // Build-list item 2 (2026-08-23) — the run behaviour summary: a report-only
@@ -247,7 +243,7 @@ export { replayRun, formatReplay } from './replay.js';
 // never signs — the approvals array and the human's word are unchanged.
 export {
   runInterview, authorCloseForJob, assembleSpec, prepareSigning, refusalEvents, refuseLockedKind,
-  GENRE, REFUSAL_LIB, REFUSAL_CATEGORY, AUTHORED_SPEC_FIELDS,
+  AUTHORED_SPEC_FIELDS,
 } from './authorjob.js';
 // PRD build-list item 5 (TODO #8) — the prompt-register inventory: every file
 // known to carry model-facing prompt/instruction text, and the predicate a
@@ -293,4 +289,7 @@ export { main as cliMain } from './cli.js';
 // source.mjs` and `scripts/run-u.mjs` are two separate call sites reaching
 // for the SAME functions — an adopter building a third has to reach the same
 // module, not a re-derivation of it.
-export { prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest } from './source.js';
+export {
+  prepareSource, proveDestination, copyOut, readSourceManifest, frontDoorFromManifest,
+  datedDestination, pickDelivery,
+} from './source.js';

package/src/job.js

@@ -135,8 +135,9 @@ export const CADENCE_UNITS = Object.freeze(['hour', 'day', 'week']);
  * rows on the cost axis, and budgets sized for one do not transfer. */
 /** PRD item 28 (2026-09-06/09-09): `openai-api` — an OpenAI-shaped provider,
  * constructed via `src/providers.js`'s factory. hamr's ruling (PRD 30.7):
- * `deepseek-chat` is THE secondary provider (one, not a menu of half-tested
- * models); the factory's tier table is where that lives, not this menu.
+ * `deepseek-flash` is THE secondary provider (one, not a menu of half-tested
+ * models; F171, item 34 L16: swapped from the retired `deepseek-chat`); the
+ * factory's tier table is where that lives, not this menu.
  *
  * PRD item 31.3 (hamr, 2026-09-09: *"anthropic, openai, gemini drop ollama for
  * now"*): `gemini-api` joins. That is bareloop matching bare-agent's own

package/src/kinds.js

@@ -483,12 +483,14 @@ async function sh(cmd, args, { cwd, env: declared = {}, timeoutMs = DEFAULT_TIME
 }
 
 /**
- * git, read-only, in a repository. Faults come back as `ok:false` with the
- * stderr — a caller decides whether that is a stop.
+ * git, in a repository (reads by every caller in this file; `src/source.js`
+ * also uses it for the hidden-git seed's `init`/`add`/`commit`). Faults come
+ * back as `ok:false` with the stderr — a caller decides whether that is a
+ * stop.
  *
  * Exported (PRD item 33/M2, `src/source.js`) so the hidden-git seed a plain
  * folder/file/URL job runs against goes through the SAME spawn primitive as
- * every other git read in this file — a second `spawn('git', …)` for the
+ * every other git call in this file — a second `spawn('git', …)` for the
  * source front door would be a second instrument with its own timeout and
  * buffer ceiling to keep in sync with this one.
  * @param {string} cwd @param {string[]} args

package/src/promptregisters.js

@@ -45,6 +45,12 @@ export const PROMPT_REGISTERS = Object.freeze([
   Object.freeze({ file: 'src/authorflow.js', name: 'STRUCTURE_INSTRUCTION_TOOL' }),
   Object.freeze({ file: 'src/authorflow.js', name: 'STRUCTURE_INSTRUCTION_TEXT' }),
 
+  // src/authorflow.js — the confirm turn (PRD item 33 M3 piece 4)
+  Object.freeze({ file: 'src/authorflow.js', name: 'CONFIRM_SYSTEM' }),
+  Object.freeze({ file: 'src/authorflow.js', name: 'confirmPrompt() (inline template, not a const)' }),
+  Object.freeze({ file: 'src/authorflow.js', name: 'CONFIRM_STRUCTURE_INSTRUCTION' }),
+  Object.freeze({ file: 'src/authorflow.js', name: 'confirmedBlock() (inline template, not a const — feeds authorPrompt)' }),
+
   // src/judged.js — the softgreen judge's locate prompt (spine + per-rule asks)
   Object.freeze({ file: 'src/judged.js', name: 'PROMPT_HEAD' }),
   Object.freeze({ file: 'src/judged.js', name: 'PROMPT_TAIL' }),

package/src/providers.js

@@ -45,10 +45,17 @@ export const ANTHROPIC_TIER_MODELS = Object.freeze({
  * of a single-model provider, not a second model masquerading as `haiku`.
  * If DeepSeek (or a future openai-api entrant) ever ships a genuinely
  * cheaper tier model, this is where it would earn its own `haiku` id.
+ *
+ * MODEL SWAP (F171, item 34 L16, hamr 2026-09-13): `deepseek-chat` is no
+ * longer served — a live `/models` call returned only `deepseek-flash` and
+ * `deepseek-v4-pro`. Switched to `deepseek-flash` (DeepSeek V4.1). F149's
+ * `legacyMaxTokens` measurement (asked 64 output tokens, got 665/608) was
+ * taken on `deepseek-chat` and is UNVERIFIED on `deepseek-flash` — kept on
+ * below as the fail-safe (over-capping direction is safe; see F171).
  */
 export const OPENAI_TIER_MODELS = Object.freeze({
-  sonnet: 'deepseek-chat',
-  haiku: 'deepseek-chat',
+  sonnet: 'deepseek-flash',
+  haiku: 'deepseek-flash',
 });
 
 /**
@@ -97,9 +104,14 @@ export const PROBE_STATUS = Object.freeze({
  *
  * A model with no entry here gets `{}` — bare-agent's own default
  * (`max_completion_tokens`, GPT-5-safe) applies, unmodified.
+ *
+ * F171 (2026-09-13): `deepseek-chat` was retired and swapped for
+ * `deepseek-flash` (item 34 L16). This gating was measured on
+ * `deepseek-chat` only and carried forward onto `deepseek-flash`
+ * UNVERIFIED — re-verify before any paid DeepSeek run relies on it.
  */
 const OPENAI_MODEL_OPTIONS = Object.freeze({
-  'deepseek-chat': Object.freeze({ legacyMaxTokens: true }),
+  'deepseek-flash': Object.freeze({ legacyMaxTokens: true }),
 });
 
 /**

package/src/source.js

@@ -23,9 +23,9 @@
 // on rather than catch.
 
 import { createHash } from 'node:crypto';
-import { existsSync } from 'node:fs';
-import { mkdir, readdir, readFile, writeFile, lstat, stat, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
-import { dirname, join, resolve, sep, basename } from 'node:path';
+import { existsSync, lstatSync } from 'node:fs';
+import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
+import { dirname, join, relative, resolve, sep, basename } from 'node:path';
 import { git } from './kinds.js';
 import { MAX_BUFFER } from './kinds.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
@@ -76,6 +76,69 @@ const MAX_SAME_DAY = 99;
 /** @param {string} code @param {string} stop @returns {SourceRefusal} */
 const refuse = (code, stop) => ({ stop, code });
 
+/**
+ * Walk from `startDir` upward — inclusive — to the NEAREST ancestor whose own
+ * directory carries a `.git` entry, whether that entry is a real repo
+ * directory or a linked-worktree/submodule FILE (the caller decides what a
+ * file means for it). `null` when no ancestor up to the filesystem root has
+ * one. ONE helper for "find the repo boundary walking up", shared by
+ * {@link looksLikeRepoSource} and `prepareSource`'s own authoritative routing
+ * below (PRD item 33 M3 ruling 2 addendum, 2026-09-13: a Source that is a
+ * SUBFOLDER inside a git repo is a repo job, not a plain-folder one — the
+ * boundary is the nearest ancestor's `.git`, never only a `.git` sitting
+ * directly inside Source itself) and reused by `src/detectlang.js`'s own
+ * upward walk (`walkChain`), which only needs the boundary directory, not
+ * which kind of `.git` it is — never three copies of this rule.
+ * @param {string} startDir an absolute directory to start the walk FROM
+ * @returns {{dir: string, isFile: boolean}|null}
+ */
+export function nearestGitAncestor(startDir) {
+  let dir = resolve(startDir);
+  for (;;) {
+    const dotGit = join(dir, '.git');
+    if (existsSync(dotGit)) {
+      let isFile = false;
+      try { isFile = !lstatSync(dotGit).isDirectory(); } catch { /* raced away between exists and lstat — treated as a directory below, the pre-existing walk's own behaviour */ }
+      return { dir, isFile };
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null; // reached the filesystem root
+    dir = parent;
+  }
+}
+
+/**
+ * A CHEAP peek (a stat, never a read) at whether `source` is going to turn
+ * out to be a REPO source — the ONE rule for that question, shared by
+ * `prepareSource` (which routes the destination check below before the real
+ * walk further down decides authoritatively) and `scripts/run-interview.mjs`
+ * (PRD item 33 M3 ruling 2), which has to know BEFORE Source is even frozen
+ * whether Destination fills the write fence or a delivery directory. Never a
+ * second, hand-typed copy of this test: a URL is never a repo; a local path
+ * is a repo source only when it is a DIRECTORY, and the NEAREST ancestor
+ * (Source itself, or an ancestor above it — ruling 2's 2026-09-13 addendum)
+ * carries a `.git` DIRECTORY. A nearest `.git` that is a FILE (a linked
+ * worktree or a submodule) is NOT repo-like here — the real walk below
+ * refuses `source-is-linked-worktree` for that case, and this peek must
+ * agree closely enough to route the destination question correctly rather
+ * than offer the write-fence wording for a source that is about to be
+ * refused. An unreadable path is reported properly by the real walk; this
+ * peek only has to agree with that walk closely enough to route correctly,
+ * never to replace it.
+ * @param {string} source
+ * @returns {boolean}
+ */
+export function looksLikeRepoSource(source) {
+  if (/^https?:\/\//i.test(source)) return false;
+  try {
+    const abs = resolve(source);
+    const st = lstatSync(abs);
+    if (!st.isDirectory()) return false;
+    const found = nearestGitAncestor(abs);
+    return found !== null && !found.isFile;
+  } catch { return false; }
+}
+
 /** @param {Buffer} buf @returns {boolean} */
 function hasNulByte(buf) {
   // "first 8 KB" (PRD/M2 text) — a NUL anywhere further in a huge log-shaped
@@ -351,22 +414,14 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     return refuse('into-exists', `${intoAbs} already exists — a source door writes a FRESH tree, never reuses one (the export worktree rule)`);
   }
   const isUrl = /^https?:\/\//i.test(source);
-  // a CHEAP peek (a stat, never a read) at whether this source is going to
-  // turn out to be a repo — needed here, before the source is actually
-  // walked below, because a repo source's destination takes a DIFFERENT path
-  // (the write-fence recording above) than every other kind's (the directory
-  // proof). The real walk below makes the authoritative kind determination
-  // (and refuses source-is-linked-worktree when `.git` is a file); this peek
+  // needed here, before the source is actually walked below, because a repo
+  // source's destination takes a DIFFERENT path (the write-fence recording
+  // above) than every other kind's (the directory proof). The real walk
+  // below makes the authoritative kind determination (and refuses
+  // source-is-linked-worktree when `.git` is a file); `looksLikeRepoSource`
   // only has to agree with it closely enough to route the destination check
   // correctly, and it does — both read the same `.git` existence test.
-  let looksLikeRepoSource = false;
-  if (!isUrl) {
-    try {
-      const peekAbs = resolve(source);
-      const peekStat = await lstat(peekAbs);
-      looksLikeRepoSource = peekStat.isDirectory() && existsSync(join(peekAbs, '.git'));
-    } catch { /* an unreadable source is reported properly by the real walk below */ }
-  }
+  const isRepoLike = looksLikeRepoSource(source);
   // hamr's ruling (PRD item 33): source AND destination are proven at job
   // start, $0 — and review finding #2 sharpens WHEN: before `into` is
   // created, never after, so a refused destination leaves nothing on disk
@@ -374,7 +429,7 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
   // its result). Order matters here: this runs before any source is read,
   // fetched, or walked.
   if (destination !== undefined) {
-    if (looksLikeRepoSource) {
+    if (isRepoLike) {
       if (typeof destination !== 'string' || destination.length === 0) {
         return refuse('destination-invalid', 'destination must be a non-empty value — a repo source records it as the declared write fence, wired into writeScope in a later milestone');
       }
@@ -384,7 +439,7 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     }
   }
 
-  /** @type {{kind: 'url'|'file'|'folder'|'repo', files: {rel: string, abs?: string, buf?: Buffer, symlinkTarget?: string}[], root?: string, finalUrl?: string}} */
+  /** @type {{kind: 'url'|'file'|'folder'|'repo', files: {rel: string, abs?: string, buf?: Buffer, symlinkTarget?: string}[], root?: string, finalUrl?: string, sourceSubdir?: string}} */
   let frozen;
 
   if (isUrl) {
@@ -429,22 +484,54 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
       // patients-are-copies rule), and gets the same `output/`, manifest,
       // destination and copy-out every other source gets. Its own guards
       // (the input stays untouched) arrive with M4.
-      const dotGit = join(sourceAbs, '.git');
-      let isRepo = false;
-      if (existsSync(dotGit)) {
+      //
+      // RULING 2 ADDENDUM (hamr, 2026-09-13, option A): a Source that is a
+      // SUBFOLDER inside a git repo IS a repo job — the boundary is the
+      // NEAREST ancestor's `.git`, found by walking UP from Source, never
+      // only a `.git` sitting directly inside Source itself (a monorepo
+      // package like `myrepo/packages/api` used to fall to the plain-folder
+      // path below, which has no checks yet and would hit untracked
+      // `node_modules` symlinks as a refusal, F164's class). The WHOLE
+      // repo's tracked files are frozen — `listRepoFiles(repoRoot)`, not just
+      // the subfolder — exactly as for a repo-ROOT source today.
+      const found = nearestGitAncestor(sourceAbs);
+      if (found !== null && found.isFile) {
         // a `.git` FILE (a linked worktree or a submodule) points its gitdir
         // somewhere else entirely — copying it would aim every git command,
         // the seed commit included, at the ORIGINAL repo. Refused, never
-        // followed, for the same reason a symlink is.
-        if (!(await lstat(dotGit)).isDirectory()) {
-          return refuse('source-is-linked-worktree', `${source}/.git is a file, not a directory — this is a linked worktree or a submodule, whose real git directory lives elsewhere; point the door at the repo itself (a copy would silently commit into the original)`);
-        }
-        isRepo = true;
+        // followed, for the same reason a symlink is. `found.dir` is the
+        // ancestor that actually carries the file — Source itself when
+        // Source IS that ancestor, an ancestor ABOVE Source otherwise.
+        return refuse('source-is-linked-worktree', `${found.dir}/.git is a file, not a directory — this is a linked worktree or a submodule, whose real git directory lives elsewhere; point the door at the repo itself (a copy would silently commit into the original)`);
       }
+      const isRepo = found !== null;
       if (isRepo) {
-        const walked = await listRepoFiles(sourceAbs);
+        const repoRoot = /** @type {{dir: string}} */ (found).dir;
+        const walked = await listRepoFiles(repoRoot);
         if (walked.stop !== null) return walked;
-        frozen = { kind: 'repo', root: sourceAbs, files: walked.files };
+        // Source's own path relative to the repo root — '' when Source IS
+        // the repo root, a real subpath (e.g. "packages/api") when it is a
+        // subfolder. Recorded in the manifest (below) for later use; nothing
+        // downstream reads it yet — the fence/scope wiring is a later piece.
+        const sourceSubdir = relative(repoRoot, sourceAbs).split(sep).join('/');
+        // hamr's ruling A (PRD item 34 loose end, 2026-09-13, live-proven at
+        // $0): the ruling-2 addendum above freezes the WHOLE repo whenever
+        // Source is a subfolder, but `listRepoFiles` only ever returns
+        // TRACKED paths — when the subfolder itself is gitignored or simply
+        // untracked, NONE of its own files are among them, and the freeze
+        // silently succeeds with a `kind: 'repo'` tree that holds nothing the
+        // person actually pointed Source at. Refused here, before `into` is
+        // created and before a single byte is scanned or written — a repo
+        // ROOT source (`sourceSubdir === ''`) is exempt (it always has the
+        // whole tracked tree by definition), and a subfolder with AT LEAST
+        // ONE tracked file underneath it is unaffected (that is the existing,
+        // unchanged "partially-ignored files inside a tracked folder" case).
+        if (sourceSubdir !== '' && !walked.files.some((f) => f.rel === sourceSubdir || f.rel.startsWith(`${sourceSubdir}/`))) {
+          return refuse('source-untracked-in-repo', `${sourceAbs} is inside the git repo at ${repoRoot}, but git does not track anything in it, so a repo job would not see its files — commit the files, or point Source at a folder outside the repo`);
+        }
+        frozen = {
+          kind: 'repo', root: repoRoot, files: walked.files, sourceSubdir,
+        };
       } else {
         const walked = await walkFolder(sourceAbs);
         if (walked.stop !== null) return walked;
@@ -529,12 +616,38 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
   // git tracks no empty directories — a `.gitkeep` is what makes `output/`
   // actually exist in the seed commit the close measures changes against
   await writeFile(join(outputDir, '.gitkeep'), '');
-  for (const f of frozen.files) {
+  // TOCTOU close (item 34 L1, fix-ledger `src/source.js:506,537`): a folder/
+  // repo file's bytes were hashed and secret-scanned ABOVE, from one read —
+  // then re-read a SECOND time here via `copyFile`, off disk, to freeze into
+  // the tree. A file swapped on disk between the two reads would have its
+  // secret scan run against bytes different from the ones actually frozen —
+  // exactly the gap the hard line (secrets never enter the tree) exists to
+  // close. Fixed by re-verifying, not by caching every buffer: caching would
+  // hold a whole repo's bytes in memory at once (the streaming design above
+  // this loop exists precisely to avoid that for a repo source "far larger
+  // than memory"). Instead, this second read is hashed again and compared
+  // against `fileMeta`'s scan-time `sha256` (same index, same file order as
+  // the scan loop above) — a match means the bytes frozen ARE the bytes
+  // scanned; a mismatch refuses rather than silently freezing content the
+  // scan never saw. `copyFile` also preserved the source file's mode bits
+  // (verified: 0o755 in, 0o755 out; a plain `writeFile` defaults to 0o644),
+  // so the replacement chmod's the destination from a fresh `stat` to keep
+  // that behaviour unchanged.
+  for (let i = 0; i < frozen.files.length; i += 1) {
+    const f = frozen.files[i];
     const dest = join(treeDir, treeRel(f.rel));
     await mkdir(dirname(dest), { recursive: true });
-    if (f.buf) await writeFile(dest, f.buf);
-    else if (f.symlinkTarget !== undefined) await symlink(f.symlinkTarget, dest);
-    else await copyFile(/** @type {string} */ (f.abs), dest);
+    if (f.buf) { await writeFile(dest, f.buf); continue; }
+    if (f.symlinkTarget !== undefined) { await symlink(f.symlinkTarget, dest); continue; }
+    const [freshBuf, srcStat] = await Promise.all([
+      readFile(/** @type {string} */ (f.abs)),
+      stat(/** @type {string} */ (f.abs)),
+    ]);
+    if (sha256Hex(freshBuf) !== fileMeta[i].sha256) {
+      return refuse('source-changed-after-scan', `${f.rel} changed on disk after its secret scan — refused rather than freezing bytes the scan never saw (hard line #3)`);
+    }
+    await writeFile(dest, freshBuf);
+    await chmod(dest, srcStat.mode & 0o777);
   }
 
   if (frozen.kind !== 'repo') {
@@ -580,6 +693,13 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
   const manifest = {
     kind: frozen.kind,
     source,
+    // Source's own path relative to the repo root (ruling 2 addendum,
+    // 2026-09-13) — '' when Source IS the repo root, a real subpath (e.g.
+    // "packages/api") when it is a subfolder frozen as part of the WHOLE
+    // repo. A NEW field beside the existing ones: `source` above keeps its
+    // existing meaning (the original Source path, untouched), and nothing
+    // downstream reads `sourceSubdir` yet — recorded here, wired later.
+    ...(frozen.sourceSubdir === undefined ? {} : { sourceSubdir: frozen.sourceSubdir }),
     ...(frozen.finalUrl === undefined ? {} : { finalUrl: frozen.finalUrl }),
     fetchedAt: new Date().toISOString(),
     files: fileMeta,