bareloop 0.25.1 → 0.27.0

package/CHANGELOG.md

@@ -5,6 +5,531 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.27.0] — 2026-09-21
+
+### Changed
+
+- **`bare-agent` bumped `^0.42.0` → `^0.43.0`.** Ships BA-27 (bareloop's own corroborating
+  upstream ask, `docs/product/UPSTREAM-ASKS.md`): `OpenAIProvider`/`OllamaProvider.generate` no
+  longer throw a raw `SyntaxError` when a model's tool-call `arguments` string is malformed JSON —
+  the shared `parseToolCalls` helper returns the round priced (real `usage`) with `toolCalls: []`
+  plus its own `malformedToolCall: {name, error}` marker instead, and `Loop.run` surfaces that
+  marker unchanged on its return. No other package changed (`package-lock.json` diff is
+  `bare-agent` only).
+
+### Removed
+
+- **`withMalformedToolCallShim`, bareloop's local F179 stopgap (`src/authorflow.js`, added
+  2026-09-15 commit `96866d5`).** Deleted now that bare-agent 0.43.0 fixes BA-27 upstream —
+  `makeLoopGenerate` calls `loop.run()` directly again, no delegate provider. `askStructured`'s
+  `r?.malformedToolCall` check (`e9e2839`) is unchanged and now reads bare-agent's own field.
+- **`callCasualty`'s SyntaxError admission (`src/text.js`)**, dead code once no provider bareloop
+  constructs (`AnthropicProvider`, `OpenAIProvider`, `GeminiProvider` — `src/providers.js`) can
+  still throw a JSON `SyntaxError` out of `generate()` after a billed round: verified against
+  0.43.0's installed source that Anthropic and Gemini read tool-call arguments as already-parsed
+  objects (nothing to `JSON.parse` in their response paths), and every provider's raw-HTTP-body
+  parse is already try/catch-wrapped inside `_request`. The idle-timeout (ETIMEDOUT/TimeoutError)
+  admission is unchanged.
+
+### Fixed
+
+- **The publish workflow now fails when `package-lock.json`'s version drifts from `package.json`.** npm writes that field on install, so a release that bumps `package.json` without running one leaves it behind — and nothing caught it: `npm ci` fails when the lockfile's *dependency* entries disagree, but never checks the lockfile's copy of the project's own version. `scripts/check-lockfile.mjs` (`npm run check:lockfile`) compares both places npm writes it and runs in the publish workflow. No lockfile is not a failure.
+
+- **F191 — a plain-folder source's confirm turn crashed live (run `mu4hc7sp`), leaving a
+  two-record spine (`author-start`, `author-phase confirm`) with no ending at all.**
+  `confirmProtections` computes protections via `classGuards` (`src/authoring.js`), which is
+  keyed by CODE LANGUAGE and throws on a plain folder's `lang: 'none-detected'` — a plain
+  folder has no language, so a confirm turn cannot honestly show real, code-derived protections
+  for one. `scripts/run-author.mjs` no longer runs a confirm turn over a plain folder at all:
+  the honest "no checks yet" stop now fires immediately after `author-start`, at $0 — no scout,
+  no confirm turn, no model call. The now-unreachable confirm-turn branch (~70 lines) is
+  deleted. Alongside it, the try/catch crash net (which used to start ~300 lines after
+  `author-start`, leaving exactly the gap this crash fell into) now opens immediately after the
+  spine exists, and its crash message reads the run's own metered-call list rather than
+  unconditionally claiming "died inside the paid span". Customer-facing text in
+  `scripts/run-interview.mjs`/`bareloop.context.md` that promised a plain-folder confirm turn
+  is corrected to match. Fail-first proven in tests (each of the three code changes shown red
+  against the prior commit, green after); a new live end-to-end test proves zero provider calls.
+  Three follow-up fixes landed in the same pass: the stop's own text claimed "Nothing was spent
+  and nothing was written," while the same branch writes `authored.json` into `--out` — both this
+  message and `scripts/run-interview.mjs`'s matching install-gap line now read "Nothing was spent.
+  Your source was not changed." (true on both counts: no provider call happens on this path, and
+  the source tree itself is never touched); an F71 regression (`process.exit(1)` right after a
+  `console.log`, which can discard already-queued stdout under a slow reader) was fixed back to
+  `process.exitCode = 1`; and a duplicate `spine <path>` print this exitCode fix's fall-through
+  briefly introduced was removed (the shared tail print already covers this exit path). Not yet
+  re-run against the original crashing patient (`docs/logs/FINDINGS.md` F191).
+- **F190 — fixed properly this pass.** The prior fix (commit 56bbee8) hand-copied
+  `scripts/run-u.mjs`'s same-provider `baseUrl` conditional a second time. Both the author and
+  judge provider constructions in `scripts/run-author.mjs` now go through `buildRunnerProviders`
+  (`src/providers.js`), the one seam `src/cli.js` already used — this file was the one call
+  site that had not adopted it. Not yet re-proven live (`docs/logs/FINDINGS.md` F190).
+- **F185 — an interview-authored repo job had no code path INTO `scripts/run-u.mjs`: a person
+  finishing the authoring interview was left holding a signed, hash-stable `resolved-spec.json`
+  with no way to run it, only a developer hand-step (`cp` the spec into `jobs/` + hand-add a
+  `JOBS` row).** hamr's ruling (2026-09-16, option A): `scripts/run-u.mjs` now accepts `--spec
+  <path to resolved-spec.json>` as an alternative to `--job <key>` (giving both, or neither, is a
+  loud $0 refusal). It `validateJob`'s the spec explicitly and early, then reads the workdir and
+  seed off the prepared copy's OWN source manifest (`readSourceManifest`, `src/source.js` — the
+  same reader `run-author.mjs` already uses) — the one `source-*/` sibling directory beside the
+  spec that carries a `source.json`; never typed, guessed, or defaulted, and a missing/ambiguous
+  manifest or a gone tree each refuse by name. `scripts/run-author.mjs`'s "SIGNING PREPARED — NOT
+  SIGNED" end screen now prints the exact ready-to-paste run command (real spec path, real
+  `--approve <hash>`, the provider's real env-key name per F187). Every existing arbiter gate —
+  the `--approve` signature, the budget/wall ceilings, coldReset, the close-first precheck —
+  applies unchanged; `--spec` only NAMES the job. Not yet proven live (`docs/logs/FINDINGS.md`
+  F185).
+- **F183 — the confirm turn's model-facing prompt never showed the model the real, code-derived
+  guards or write fence, so `notChecked` could (and twice live did, runs `mu2bjmed` and
+  `mu2qmept`) falsely claim an already-enforced protection was missing** (e.g. "no ts-ignore
+  comments" and "do not edit or delete tests", while `no-suppressions` and the write fence
+  already covered both). hamr's ruling A (2026-09-16): feed the real protections in as facts,
+  never drop the model's list. `confirmProtections`'s existing code-derived list (the same one
+  already shown to the person, `src/authorflow.js`) is now computed once, before the model
+  drafts, and threaded into `confirmPrompt`'s model-facing prompt as an "ALREADY COVERED" block;
+  `CONFIRM_SYSTEM` now orders the model to check that list before naming anything in
+  `notChecked`. The model still authors `notChecked` freely — nothing made deterministic, no
+  second hand-typed guard list. Not yet proven live (`docs/logs/FINDINGS.md` F183).
+- **Item 6 — `src/authoring.js`'s `TYPES_GENRE_TEMPLATE` (model-facing prompt text,
+  interpolated verbatim into the authoring prompt) was missing from `src/
+  promptregisters.js`'s `PROMPT_REGISTERS` inventory entirely.** Added; no other prompt content
+  found in that file. `docs/product/PRD.md`'s item 33 close-out box ticked.
+- **F182 — the interview never waited for the install, so "Run it now?" was unreachable for a
+  repo that needs packages.** `scripts/run-interview.mjs` printed the install-gap message right
+  after `prepareSource` and fell straight through to the class questions, only re-checking
+  `missingDependencies` once, at hand-off — too late for the offer to ever fire. It now pauses
+  right there and loops on the same check (`"Press Enter once it has finished to check again, or
+  type skip to carry on without it: "`), printing `"packages found — carrying on."` on a
+  resolved recheck; `skip` or end of input carries on unresolved, same as before. Also drops the
+  misleading "then rerun this command" wording, which pointed at restarting the whole interview
+  when only the install is needed. Not yet proven live.
+- **F181 — a key with an embedded newline (or other control character, or stray whitespace)
+  read as "set" by every presence-only key check and then crashed Node's own header-encode
+  (`ERR_INVALID_CHAR`) inside the paid span, rather than refusing at $0.** One exported pure
+  helper, `apiKeyProblem(value)` (`src/providers.js`, beside the provider table), reports a
+  plain-English reason (or `null`) for a value carrying CR, LF, TAB, another C0/DEL control
+  character, or leading/trailing whitespace — it never trims or repairs. Wired at every door
+  that already presence-checks a key: `scripts/run-author.mjs` (worker and judge keys),
+  `scripts/run-u.mjs` (worker and judge keys), `src/cli.js`'s `bareloop run`
+  (`ANTHROPIC_API_KEY`), and `scripts/run-interview.mjs`'s `KEYED` offer gate (a malformed key
+  no longer counts as keyed). Every refusal names the env var and the reason class, never the
+  value. Not yet proven live.
+- **F187 — `scripts/run-u.mjs`'s printed invocation hints (the "approve and run" line and the
+  sleep-inhibitor wrapper line, both built through the shared `invoke()` helper) always named
+  `ANTHROPIC_API_KEY`, regardless of the job's actual provider.** A job on `openai-api`
+  (DeepSeek) printed the wrong variable name to set. `invoke()` now reads `providerEntry.envKey`
+  — the same resolved name the real key check at launch already uses. Not yet proven live.
+- **F186 — the printed BEHAVIOUR line (and any replay) counted tool calls from EVERY run that
+  ever touched the patient tree, not just the run being read, because the authoring scout's gate
+  audit is written directly into the patient tree and the tree's `.gitignore` denies `*.jsonl`,
+  so a cold reset never removes it.** Fixed at the source, never by filtering `runBehaviour` on
+  `run_id` (a single run legitimately spans several). `scripts/run-author.mjs` now archives its
+  own gate audit out of the patient tree the moment authoring ends (`archiveGateAudit()`, called
+  from `finally` and once more before the one `process.exit()` path that skips it).
+  `scripts/run-u.mjs` now moves any stale audit aside right after `coldReset`, before its own
+  Gate ever opens (`moveStaleGateAudit`, new export from `scripts/u-patient.mjs`) — never on the
+  resume branch, where the tree's audit is that same run's own prior leg. Not yet proven live.
+- **F184 — a malformed tool-call round on the WORKER path (`src/planrun.js`'s Loop-path `ask()`)
+  ended an attempt with nothing on the spine naming it — indistinguishable from the model
+  genuinely producing no useful work.** `ask()` now reads bare-agent 0.43.0's own
+  `r.malformedToolCall` marker (present since BA-27) and emits a distinct `worker-malformed-tool-
+  call` record (`{phase, iteration, name, error}`, scrubbed and length-capped) — visibility only:
+  no retry, no change to strikes/ladder/attempt counting/verdict routing, all arbiter-adjacent and
+  out of scope. Not yet proven live.
+- **F179 — a malformed tool-call JSON on the FIRST authoring call had no earlier sound
+  declaration to fall back to, so 318e066's provider-red stopped the run outright.** hamr's
+  2026-09-15 ruling: retry, never repair. `withMalformedToolCallShim` (`src/authorflow.js`,
+  wired into `makeLoopGenerate`) is a delegate provider (`Object.create`, never a mutation of
+  the shared instance) whose `_request` strips a malformed tool call out of the raw response
+  BEFORE `generate()`'s own `JSON.parse` can throw on it, so the round comes back PRICED on
+  bare-agent's own real usage instead of crashing. `askStructured` reads the resulting round
+  through its EXISTING malformed-emission retry ladder (`MAX_STRUCTURE_RETRIES`, no new cap),
+  tagged with a new `malformed-tool-call-arguments` axis — checked BEFORE the accept path and
+  regardless of how many calls survived the strip, so a reply carrying a malformed call
+  alongside a valid one is never accepted either (follow-up fix, same day, review-caught).
+  Scoped to `makeLoopGenerate` only — the authoring declaration calls and the confirm turn; the
+  scout and the worker path build their own provider wiring and still only get 318e066's stop
+  (an open gap). Not yet proven live.
+- **F179/F180 — bare-agent 0.42.0's OpenAIProvider could throw a raw SyntaxError mid-call (a
+  malformed tool-call `arguments` string, `JSON.parse` with no try/catch), crashing past
+  `askStructured` and discarding an already-sound, already-measured declaration while the
+  billed call went unbooked.** `askStructured` (`src/authorflow.js`) now wraps its `generate`
+  call in try/catch, tested against a new shared predicate, `callCasualty` (`src/text.js`,
+  beside `priceOf`): a `HaltError` still re-raises (a governance exit, never laundered); an
+  ETIMEDOUT/TimeoutError-shaped throw or a JSON-mentioning SyntaxError lands as the same typed
+  `providerError` the resolved-`{error}` path already produced, booked at `costUsd: null`
+  (honest-unknown, never a complete-looking floor); anything else still crashes.
+  `authorscout.js`'s `settled` seam, which already hand-caught its own narrower idle-timeout
+  class, now delegates to the same predicate. No JSON repair, no new retry. Not yet proven live
+  (run `mu2bjmed` is the live crash this fixes; the corroborating upstream ask is BA-27 in
+  `docs/product/UPSTREAM-ASKS.md`).
+- **F178/F177 — a signed fence could name `.git` or `node_modules` directly (or reach a nested
+  `node_modules` through an otherwise-legal fence), letting writes there go invisibly to
+  `changedSet`.** `scopeContained` (`src/validate.js`, the one containment law `validateJob`
+  and `validatePlan` both go through) now refuses any fence/scope whose normalized prefix has a
+  whole path segment equal to `.git` or `node_modules` (hamr's ruling, 2026-09-14, option B) —
+  a look-alike like `.github`/`my.git`/`node_modules_util` stays admitted. The runtime belt for
+  a NESTED `node_modules` a legal fence can still reach uses `tools.denyArgPatterns`
+  (`FORBIDDEN_WRITE_SEGMENT_PATTERN`, `src/planrun.js`), scoped to `write`/`edit` only —
+  bareguard's `fs.deny` was tried first for `.git` and reverted: it blocks ALL fs actions,
+  reads included, which silently over-blocked (caught by the full gate's own drift test,
+  `tests/tools.test.js`); `fs.deny` is never used for either book now. Not yet proven live.
+- **F177 — a repo source whose tracked `.gitignore` did not mention `node_modules` let
+  installed packages read as the worker's own writes.** `changedSet` (`src/kinds.js`) unions
+  the tracked diff with `git ls-files --others --exclude-standard`, so an unignored
+  `node_modules` installed into the copy (live-verified: 247 files on a real copy of pulselog)
+  read as changes the worker made. `prepareSource` now hides `node_modules` in the copy's own
+  PRIVATE `.git/info/exclude` (hamr's ruling, 2026-09-14, option A) — the source repo's tracked
+  files, `.gitignore` included, are never touched. Not yet proven live.
+- **PRD item 33 close-out — `prepareSource` freezes tracked files only, so a JS/TS repo's
+  prepared copy never carried `node_modules`, and every close stage needing a tool (`tsc`, a
+  test runner) instrument-stopped with nothing telling the person why.** bareloop never runs an
+  install itself (hamr's ruling, 2026-09-14, option A): `missingDependencies` (`src/source.js`,
+  exported) is a pure, $0, JS/TS-only detector that names the exact install command.
+  `scripts/run-interview.mjs` prints it right after `prepareSource` succeeds and again at the
+  hand-off, where a still-open gap suppresses the "Run it now?" offer entirely.
+  `scripts/run-author.mjs` refuses `source-deps-missing` at $0, before the scout and before the
+  provider/key are even read. Not yet proven live end to end (the detector and the refusal
+  paths are each proven directly; a real `npm ci` against a real prepared copy of a real repo
+  confirmed the hidden git's seed stays clean when the source's `.gitignore` ignores
+  `node_modules` — see the build report for the gap this does NOT cover, a repo whose
+  `.gitignore` does not ignore `node_modules`).
+- **PRD item 33 close-out (L17) — the authoring interview never admitted an endpoint, so a
+  DeepSeek draft (`--provider openai-api`) authored against api.openai.com instead.**
+  `scripts/run-interview.mjs` now takes an optional `--base-url <url>` flag (no default; absent
+  leaves the draft's `baseUrl` field out entirely, never `null`/`''`) and validates it through
+  the existing `validateJob` `baseUrl` rule at $0 before writing anything. The interview's
+  header, the hand-off command, and `scripts/run-author.mjs`'s own start banner/`author-start`
+  event now name the endpoint when one is set; the key hint still points at the provider's own
+  env var (`OPENAI_API_KEY` for a DeepSeek endpoint) since there is no separate
+  endpoint-specific key. Not yet proven live.
+- **F176 — the revise ladder kept a later revision even when it measured worse than an earlier
+  one.** `authorClose` (`src/authorflow.js`) now tracks every MEASURED (validated + seed-read)
+  iteration and falls back to the NEWEST SOUND one — a real red/green verdict, never an
+  instrument-stop — when the last measured iteration is unsound and an earlier one is not.
+  `stop` is never changed; the swap is reported via a new `fellBack` return field, an
+  `onPhase('author-fallback', …)` event, and the terminal signing readout. Not yet proven live.
+- **F175 — the confirm turn's own honestly-raised `questions` never reached
+  `accepted.openQuestions`.** `runConfirmTurn` now carries the model's own `questions` from the
+  plan being accepted into `accepted.openQuestions` on every accepting path (confirm, type-goal,
+  the round-2 "fix" terminal), and fixes a related ledger bug where round 1's "fix" text (the
+  answer to round 2's redraft) was carried forward even after round 2 was accepted outright. Not
+  yet proven live.
+- **F175's open half — "Confirm" and "Type the goal yourself" could still accept a plan whose own
+  raised question was never answered, silently confirming a genuinely-missing answer away** (run
+  `mu0voeo4`; only the silent-drop half above was covered by the first F175 fix). hamr's
+  2026-09-16 ruling (option a): `runConfirmTurn`'s `confirm`/`type-goal` paths now force each
+  raised question through a new `kind: 'answer'` step before returning — no extra model call, a
+  blank answer re-asks the same question, `null` abandons like every other `ask`. Answers land in
+  a new `accepted.answeredQuestions` (Q:/A: pairs), kept separate from `openQuestions` (which
+  keeps its "could not resolve" meaning and is honestly empty on these two paths now).
+  `confirmedBlock` renders the answers as binding, and the SIGNING PREPARED readout
+  (`scripts/author-readout.mjs`'s new `answeredQuestionLines`) prints them when non-empty. The
+  `fix` path is unchanged. Not yet proven live.
+
+## [0.26.0] — 2026-09-14
+
+### Added
+
+- **Source and Destination replace `--patient` (PRD item 33 M3, ruling 2):**
+  `scripts/run-interview.mjs` now asks Source and Destination as its own first two interactive
+  questions, before the picked verdict class's frozen set — never a `--patient` flag. Each is
+  proven mechanically, $0, the moment it is answered: Source is checked against the machine and
+  (for a local directory) language-detected immediately; Destination's SHAPE depends on what
+  Source turned out to be (the same `looksLikeRepoSource` rule `prepareSource` itself uses to
+  route this, now exported from `src/source.js` rather than duplicated) — for a repo Source, the
+  answer IS the write fence and fills `draft.writeScope` directly (the separate "FENCE" question
+  is gone); for every other kind, it is re-asked in a loop until it names an absolute, writable
+  directory (`proveDestination`). The moment both are answered, the interview calls
+  `prepareSource` itself to freeze Source into a hidden scratch copy under a fresh `into` nested
+  inside `--out`, and everything downstream — the class's own questions, the job spec's
+  `description`, and the `--source` handed to `scripts/run-author.mjs` — reads that PREPARED
+  COPY, never the original again. A non-repo Source gets Source and Destination proven and
+  frozen and then an honest named stop: bareloop's check catalogue is code-genre only today
+  (ruling 7 → M4); the prepared copy stays on disk regardless. `scripts/run-author.mjs` gains
+  `--source <tree>`, replacing `--patient <repoPath>`: it must be a tree a source door already
+  prepared (`readSourceManifest(dirname(source))` finds a manifest of kind `'repo'` beside it) —
+  an unprepared path dies loud naming the exact `scripts/prep-source.mjs` command to run first,
+  and a prepared non-repo source gets the same honest M4 stop, now recorded to the spine as
+  counted demand. `scripts/prep-source.mjs`'s printed next-step command follows suit.
+
+- **A Source inside a repo (e.g. a monorepo package) is now a repo job (hamr's ruling A, PRD
+  item 34 loose end):** `looksLikeRepoSource`/`prepareSource` (`src/source.js`) used to treat a
+  folder as a repo source only when `.git` sat directly inside it, so a Source like
+  `myrepo/packages/api` fell to the plain-folder path (no checks yet, M4) and could hit an
+  untracked `node_modules` symlink as a refusal. A new `nearestGitAncestor(startDir)` walks up
+  from a directory to the nearest ancestor carrying a `.git` entry (a real repo directory, or a
+  linked-worktree/submodule file) — the one walk now shared by `looksLikeRepoSource`,
+  `prepareSource`'s own routing, and `src/detectlang.js`'s boundary walk, replacing three
+  separate copies. `prepareSource`'s directory branch freezes the WHOLE found repo's tracked
+  files when Source is a subfolder, exactly as it already did for a repo-root Source; the
+  manifest gains a `sourceSubdir` field (Source's path relative to the repo root, `''` at the
+  root) for a later piece to wire into scope — nothing reads it yet. Edge case, reported not
+  solved: a Source pointed at a deep folder under a large repo (e.g. one's whole home directory)
+  now freezes that WHOLE repo's tracked files, with no size or depth limit to catch it.
+
+- **Language auto-detection (PRD item 33 M3, ruling 3):** `src/detectlang.js`'s `detectLanguage`
+  reads a code job's language off its own repository — `package.json` → js (TypeScript
+  included), `pyproject.toml`/`setup.py` → python — walking up from the Source folder to the
+  nearest ancestor manifest, never past the repository root (the nearest `.git`). A known
+  manifest this catalogue has no genre data for yet (`go.mod`, `Cargo.toml`, `pom.xml`,
+  `build.gradle(.kts)`, `*.csproj`/`*.sln`, `composer.json`) is a named `language-unsupported`
+  stop — never a silent fallback to js — carrying a `Refusal` shaped exactly like
+  `src/authorjob.js`'s own (`REFUSAL_LIB`/`REFUSAL_CATEGORY`, `request-red`). Two manifests at
+  the same nearest level is a named `ambiguous` result listing both; no manifest anywhere is
+  `no-code-job`, which is NOT an error (a plain-folder job still gets the form; M4 gives it
+  checks). The whole known-language table is one data list, keyed against `GENRE_LANGUAGES`
+  (`src/authoring.js`) — a later language landing there (M3b) needs no new code path here.
+
+- **The question sets become the unified intake form (PRD item 33 M3 piece 3, signed ruling
+  "The intake form (RULED)").** `src/authorflow.js` reshapes the green/soft-green/hitl question
+  sets to the ruled 6-field form: Source and Destination (already asked as mechanical fields
+  since M3 piece 2) plus a free-text trio, numbered contiguously 1-3, whose text is now the
+  signed table's own "Holds" column, VERBATIM: Goal ("what you want to achieve"), What success
+  looks like ("checks a machine can count"), and Guardrails ("what must not happen or change" —
+  the old "must not change" and "worse than before" questions JOINED into one field; "worse than
+  before" is gone from the form entirely, moving to the confirm turn, piece 4, repo-only — now
+  built, see below). Soft-green adds a fourth field, Judge Examples ("one pass, one fail, and why" — the
+  old Q6 is retired as its own question, since the "why" half of a real pass/fail pair is what
+  `cardauthor.js`'s rubric compile already read it for). Each field's LABEL (Goal / What success
+  looks like / Guardrails / Judge examples) is shown for the first time too — a new `labelsFor`
+  reader alongside `questionsFor`/`requiredAnswersFor`, and the composer's own interview block
+  now shows the label with each answer. hitl (never shown, kept in code) renumbers the same way,
+  with no signed-table label for its own fourth question. Source and Destination's own wording
+  now also lives in `src/authorflow.js` (`SOURCE_FIELD`, `DESTINATION_FIELD_REPO`,
+  `DESTINATION_FIELD_PLAIN`, `destinationFieldFor`), so `scripts/run-interview.mjs` prints
+  library text for all six fields, none of its own. What the old Q2 used to tell the composer
+  (which files change, which are read-only) now reaches `authorPrompt` through a new optional
+  `writeScope` parameter (`writeScopeBlock`), fed from Destination's own proven write-scope
+  fence end to end (`authorClose` → `authorCloseForJob` → `scripts/run-author.mjs`'s
+  `draft.writeScope`) rather than silently vanishing.
+
+- **The confirm turn (PRD item 33 M3 piece 4).** After the survey, `scripts/run-author.mjs`
+  now runs a paid, interactive confirm turn (`runConfirmTurn`, `src/authorjob.js` →
+  `src/authorflow.js`) before authoring: a $0 half (repo-only "worse than before", an
+  ambiguous-language pick, both asked BEFORE the scout) followed by up to 2 paid rounds where
+  the model drafts a plan — every check it will compose, the always-on guards as PROTECTIONS
+  (never named in the goal), and one signed goal sentence — and the person confirms it, fixes
+  it, types the goal themselves, or starts over. No hand-authored matcher ever compares the
+  goal against the checks (ruling 6) — the model states its own plan and the person is the one
+  judgement that accepts it. `scripts/run-interview.mjs` asks no separate goal question any
+  more (ruling 5's addendum, D2 = option B) and no longer dies on an ambiguous-language Source
+  (it defers the pick to the confirm turn, D7); `run-author.mjs`'s own ambiguous-language die()
+  is likewise gone. The confirm turn's own cost book absorbs the scout's prior spend (and its
+  own `costUsd: null` calls) before its first `capStop()` check, so a scout that already spent
+  most of the ceiling is visible to it immediately — only the confirm turn's OWN new calls
+  travel onward to `authorClose` as `priorCalls`/`priorRaws`, never the scout's a second time.
+  `run-author.mjs` is now interactive: a readline `ask` seam (same idiom as
+  `run-interview.mjs`'s own), closed in a `finally` around the whole paid span. The confirm
+  turn's open questions (a round-2 "fix" passed to the composer verbatim) print at the SIGNING
+  PREPARED readout (`openQuestionLines`, `scripts/author-readout.mjs`) — the signed spec format
+  itself is unchanged. `authorClose` gains a `confirmed` plan fed into `authorPrompt`'s new
+  `confirmedBlock` ("compose these checks and no other"). Every existing caller of
+  `authorCloseForJob`/`authorClose`/`authorPrompt` that passes no `ask` runs byte-identical to
+  before this piece existed. **`TYPES_GENRE_TEMPLATE` now composes its WORK stages only for a
+  confirmed check (D6 = A, "replace it", item 33 step S7):** the frozen TYPES genre template's
+  old unconditional work-stage skeleton (`typecheck`, `typecheck-outside`, `tests-kept`,
+  `suite-green`) and unconditional STRICT-checker mandate conflicted with ruling 6 ("a genre
+  never adds a check the goal did not ask for") for exactly the case run mtv8jihy surfaced (an
+  unasked `tsc --strict` stage). The STRICT form of the checker, and the WORK stages themselves,
+  are now composed only when a confirmed check — or, absent a confirm turn, the goal and
+  interview answers — asks for them; the GUARDS (`changed-from-seed`, `no-suppressions`) stay
+  always on, unaffected, since they are enforced structurally (`classGuards` +
+  `validateDeclaration`'s guards-absent red), never by this prompt text. The template is prompt
+  text handed to the authoring model only — never hashed into a signed spec, `closeDecl`, bundle
+  manifest, or bench row signature — so this edit changes nothing about an already-signed close.
+  `tests/authoring.test.js`'s byte-identity test is re-pinned to the new frozen block.
+  `scripts/run-interview.mjs` asks no separate GOAL question any more (ruling 5's
+  addendum, D2 = option B) and no longer dies on an ambiguous-language Source (D7 defers the
+  pick to the confirm turn); its own $0 validator pass filters both `goal`
+  (`CONFIRM_AUTHORED_FIELDS`) and, for a plain-folder job, `writeScope`
+  (`PLAIN_FOLDER_DEFERRED_FIELDS`, both `src/authorjob.js`) reds the same way it already filters
+  `AUTHORED_SPEC_FIELDS`'s. **A plain-folder Source no longer stops the interview at all (PRD
+  item 33 M3 piece 4, step S6, D5 = A ruling):** the form continues — class questions, job name,
+  budget, wall, and the offer — and the draft is written with no `writeScope` (Destination there
+  is an output directory, never a fence). The honest "no checks yet" stop (ruling 7 → M4) moves
+  to `run-author.mjs`, which now runs a plain-folder job's confirm turn too — over a $0, no-git
+  listing of the frozen tree rather than a scout (D5: the scout's register is code-only) — before
+  giving that same stop. If the confirm turn itself does not reach a signed plan, that stop
+  stands instead; the non-code-source stop only fires once a person actually confirmed one.
+
+### Removed
+
+- **BREAKING: soft-green's rubric-card/calibration answer keys change shape (PRD item 33 M3
+  piece 3).** The old two-question pair (`answers[6]`, `answers[7]`) is now ONE answer at key
+  `4` (`SOFTGREEN_JUDGE_EXAMPLES_KEY`) — `src/cardauthor.js`'s `cardCasesPrompt` reads that one
+  key instead. Any hand-authored `answers.json` from before this change needs its keys
+  reshaped: green's old five (1-5) become three (1-3, Guardrails absorbing the old 3 and 5);
+  soft-green's old seven (1-7) become four (1-4).
+- **BREAKING: `--patient` is gone from `scripts/run-interview.mjs` and `scripts/run-author.mjs`
+  (PRD item 33 M3, ruling 2).** `run-interview.mjs` asks Source (and Destination) as its own
+  first questions instead; `run-author.mjs` takes `--source <tree>`, which must be a prepared
+  copy (see "Added", above). Passing `--patient` to either script now is a loud, explicit
+  refusal naming its replacement, rather than a silently-ignored or misrouted flag.
+- **BREAKING: `--lang` is gone from `scripts/run-interview.mjs` and `scripts/run-author.mjs`.**
+  Language is now auto-detected from Source's own repository (see "Added", above) — it is
+  a fact of the repo, never a flag a person sets. Passing `--lang` now is a loud, explicit
+  refusal naming the flag and why, rather than a silently-ignored no-op.
+
+### Fixed
+
+- **The confirm turn's "protections" now come from code, never the model (item 34 loose-end
+  fix, finding #1 from live run mu0voeo4):** the confirm turn used to display whatever prose the
+  model invented for `protections`, and one live run invented a "behavior-preservation guard"
+  this build has no way to check (no kind in the catalogue can verify runtime behaviour). The
+  model is no longer asked for `protections` at all — the schema dropped the field — and what a
+  person sees and what gets recorded as `accepted.protections` is now rendered from the SAME
+  guards `classGuards` will actually compose (`src/authoring.js`'s `MECHANICAL_GUARDS`), through
+  a frozen plain-English line per guard (`GUARD_DESCRIPTIONS`, `src/authorflow.js`), plus the
+  write fence when one is set. The model instead returns `notChecked` — anything the person asked
+  for that no listed check can verify — shown under its own heading in the menu and in the
+  composer's confirmed-plan block, never silently dropped.
+- **`run-interview.mjs`'s paid-step hand-off no longer describes a scout a plain folder
+  never gets (item 34 loose-end fix):** since 21561cf (D5=A), a non-repo Source gets no
+  scout — the confirm turn reads the file list and `run-author.mjs` stops at the M4 wall
+  ("no checks for this kind of job yet") before signing is ever reached. The hand-off text
+  printed the repo-only wording ("a real scout over that repository", "It stops at
+  prepareSigning") for every source regardless. A plain-folder session now prints its own
+  line naming the confirm turn and the M4 stop; a repo session's wording is unchanged.
+- **`run-author.mjs`'s `language-unsupported` stop is now counted admission demand (item 34
+  loose-end fix on M3):** the check used to print the refusal and `process.exit(1)` before the
+  run's spine even existed, so nothing recorded it. The spine is now bootstrapped first (before
+  any provider is resolved, before the API key is read, before any spend) and the stop is
+  emitted through the same `refusalEvents()` channel every other refusal in the script uses,
+  so it folds into `src/ledger.js`'s `classifyIncidents` admission count instead of vanishing.
+  `run-interview.mjs`'s own printed line for the same stop no longer claims "the refusal IS the
+  record" — that script keeps no spine of its own, so it now says plainly that nothing here
+  recorded it, and points at `run-author.mjs` for the one that does.
+- **Scan-then-freeze TOCTOU closed in the source front door (PRD item 34 L1):**
+  `prepareSource`'s folder/repo path used to hash+secret-scan each file's bytes once, then
+  re-read the same file a SECOND time off disk (`copyFile`) to freeze it into the hidden
+  tree — a window where a file changed on disk between the two reads would have its secret
+  scan run against different bytes than the ones actually frozen. The freeze step now
+  re-hashes its own (second) read and refuses (`source-changed-after-scan`) on any mismatch
+  against the scan-time hash, rather than caching every file's buffer (which would hold a
+  whole repo in memory at once — the streaming scan design exists to avoid exactly that).
+  `copyFile`'s mode-bit preservation is kept explicitly (`stat` + `chmod` on the frozen
+  file), verified not to regress.
+- **A gitignored/untracked subfolder inside a repo no longer freezes into an empty
+  claim (hamr's ruling A, PRD item 34 loose end, 2026-09-13):** the ruling-2 addendum's
+  "a Source subfolder is a repo job" rework froze the WHOLE repo's tracked files, but
+  `listRepoFiles` only ever returns tracked paths — when Source itself is a subfolder git
+  tracks nothing under (`.gitignore`'d, or simply never committed), the freeze used to
+  succeed anyway with a `kind: 'repo'` tree holding none of Source's own files, silently
+  vanishing the person's input. `prepareSource` now refuses `source-untracked-in-repo`
+  before `into` is created — a repo-root Source, and a subfolder with at least one tracked
+  file underneath it, are unaffected.
+- **The documented-exports guard now reads the doc instead of a hand-typed array (F167,
+  PRD item 34 L4):** `tests/index.test.js`'s "documented public surface" test used to check
+  a list of names copied out of `bareloop.context.md` by hand — the same class of bug that
+  let `datedDestination`/`pickDelivery` ship `undefined` in v0.25.0 while the guard stayed
+  green. `documentedExportNames` now parses the doc live (import-block examples, Public API
+  section headings, `Menus exported:` lists, and tight "X is/are exported" proximity) and
+  found two more real gaps the hand list missed: `cliMain` and (already fixed) the two
+  source-front-door helpers. Covers the doc's explicit export-marker idioms, not every
+  function mentioned in flowing prose — a broader sweep was tried and produced 21 false
+  positives out of 97 candidates on this doc, noise a regex cannot safely resolve.
+- **The export list now equals the documented contract exactly, guarded both ways (PRD
+  item 34 L20):** the 91 undocumented names that were genuinely discussed in
+  `bareloop.context.md` prose (the "Close authoring", "Bundles", "THE REVIEW DOOR", "The
+  reuse ENVELOPE" and ledger sections — none of which used per-function `###` headings, so
+  the extractor's marker idioms could not credit any name in them) now carry an explicit
+  `import { ... } from 'bareloop'` marker next to their existing prose, including
+  `JUDGED_MARKER` (previously undocumented anywhere despite being required by every close
+  script this repo ships and by `exportBundle`'s `close-import-unexported` legality check).
+  `tests/index.test.js`'s guard is now a full two-way check — every export must be
+  documented and every documented name must be exported — replacing the one-directional
+  guard and the item-34-L4-scoped "37 restored" test, both now fully subsumed. Two
+  exclusions carry forward unchanged: `main` (the doc's pre-rename local name for the real
+  export `cliMain`) and `resumableOutcomes` (its own "exported" sentence describes "bundle",
+  not this name — the real export is `CHECKPOINT_OUTCOMES`).
+- **The doc-reading extractor's own coverage gap closed (PRD item 34 L4 follow-up):** the
+  switch to reading `bareloop.context.md` live covered fewer names than the hand-typed array
+  it replaced — 37 exported names (`mintBridge`, `appendGreen`, `BRIDGE_SCHEMA`, the rest of
+  the reuse registry, plus `runStages`/`globToPrefix`/`scanSecrets`/three ledger helpers) sat
+  in flowing prose with no marker idiom the extractor reads, so the guard silently stopped
+  covering them. `bareloop.context.md` now carries an explicit marker (an `import { ... }
+  from 'bareloop'` example, or a tight "X is/are exported" sentence) for each of the 37, and
+  `tests/index.test.js` pins that they stay derived. A live count found 169 of
+  `src/index.js`'s 255 exports still undocumented by any marker idiom — reported, not fixed
+  here; a full reverse guard (every real export documented) was considered and rejected as
+  out of this fix's scope.
+- **`SCOUT_LABEL` gains a third state in `scripts/run-u.mjs` (PRD item 34 L2):** an explicit
+  `--scout on` used to print the identical "scout ON (default)" text as no flag at all,
+  indistinguishable in printed logs/re-invocation lines — which matters for the
+  SCOUT-CONTRAST bench row's provenance. It now prints `scout ON (--scout on — operator
+  explicit)`, distinct from the true default and from `--scout off`'s unchanged label.
+- **Job authoring is LLM-agnostic (PRD item 34 L17):** `scripts/run-author.mjs` no longer
+  forces `PROVIDER_NAME = 'anthropic-api'` for its scout and drafter — the identity is now
+  resolved from the operator's own draft (`resolveProvider(draft.provider)`), the same
+  no-flag/no-default rule `scripts/run-u.mjs` applies to the worker; a missing or
+  unrecognized draft provider dies loud, at $0, before any paid call, naming the known
+  table. `scripts/run-interview.mjs` gains a REQUIRED `--provider` flag with no default (a
+  default would silently re-lock every interview onto one vendor) and writes it into the
+  draft; the paid-step offer's key line and unset-key notice now name whichever provider's
+  own env var applies, never a hardcoded `ANTHROPIC_API_KEY`. Non-Anthropic drafting is
+  legal as of this change but not yet proven live — that is M3's DeepSeek proof run, not
+  this one.
+
+### Docs
+
+- **`npx @scope/pkg`-shaped close commands documented as a KNOWN, KEPT limit (PRD item 34
+  L3):** `closeScriptCandidateToken`'s path-shaped test (`src/validate.js`) reads a scoped
+  package name as a script path because it contains `/`, so such a close can never be
+  signed — `bareloop.context.md` now says so next to the scope note it belongs beside. Not
+  fixed: it fails safe and no shipped job uses the shape.
+
+### Changed
+
+- **DeepSeek secondary model swap (F171, PRD item 34 L16):** `deepseek-chat` is no longer
+  served by DeepSeek's API (a live `/models` call returned only `deepseek-flash` and
+  `deepseek-v4-pro`). The `openai-api` tier table (`src/providers.js`) and its per-model
+  `legacyMaxTokens` request-key gating now name `deepseek-flash`. F149's gating measurement
+  was taken on `deepseek-chat` and is carried forward UNVERIFIED on `deepseek-flash`;
+  pricing stays the estimated default (F113 unchanged).
+- **`hitl` removed from every customer-facing surface (PRD item 34 L19):** `bareloop.context.md`,
+  and the usage/help text of `scripts/run-author.mjs` and `scripts/run-interview.mjs`, no
+  longer name `hitl` anywhere. The class, its terminals (`hitl-pause`, `hitl-decision-red`,
+  the legacy human-close terminal) and its `human-confirms` stage kind are untouched in code —
+  kept admitted for reuse, never revived, never shown to a customer again. The counted-demand
+  refusal a person sees when they pick an off-menu verdict class is unchanged (it names the
+  class and fwdloop by design). `tests/hitl-hidden.test.js` pins the doc and both scripts
+  case-insensitively hitl-free.
+
+### Removed
+
+- **BREAKING: 78 undocumented names dropped from the `src/index.js` root export list (PRD
+  item 34 L20, owner's option A):** a live audit found 169 of 255 root exports had zero real
+  citation in `bareloop.context.md`; 91 of those were genuinely discussed in the doc's
+  prose and gained an explicit marker (see Fixed, above) instead of being dropped, but the
+  remaining 78 had no adopter-facing mention anywhere and no in-repo consumer reaching them
+  through the package root — a name imported directly from `import { x } from 'bareloop'`
+  and nothing else. Every dropped name's own module is untouched; only the root re-export
+  is gone, and each still exists inside its own module for the library's own internal use —
+  but `package.json`'s `exports` map only `"."` to `src/index.js`, so a package user can no
+  longer reach any of them, including via a submodule path such as `src/text.js`. Dropped:
+  `artifactHash`, `authorPrompt`,
+  `BASELINES`, `CALIBRATION_LABEL`, `cardCasesPrompt`, `CASE_VERDICTS`, `CATALOGUE_KINDS`,
+  `CATALOGUE_LIVE_KINDS`, `changedSet`, `classifySurvey`, `classMenu`, `CLASS_STATEMENTS`,
+  `CLOSE_DECL_FIELDS`, `closeGrade`, `compareExpectation`, `COMPILE_SYSTEM`,
+  `createReadShim`, `declarationSchema`, `DECLARED_CLOSE_CLASSES`, `DECLARED_GAP_KEEP`,
+  `DECLARED_GAP_PREFIX`, `DECLARED_GENRES`, `defaultJudgeLoop`, `DIRECTIONS`, `doorAgeGate`,
+  `doorRecordOf`, `EXIT_GREEN`, `EXIT_RED`, `EXIT_STOP`, `factsResist`, `GENRE`,
+  `GENRE_LANGUAGES`, `genreOwnedEnvNames`, `GREEN_QUESTIONS`, `guardNames`,
+  `HITL_DECISION_RED`, `HITL_PAUSE`, `HUMAN_CHECKPOINTS`, `INJECTION_CARD`,
+  `isDeclaredClose`, `JUDGED_FLOOR_KIND`, `JUDGE_MAX_TOKENS`, `LIVE_CLASSES`,
+  `LOCATE_AXES`, `LOCATE_LABEL`, `locatePrompt`, `makeLoopGenerate`, `makeSeedTrees`,
+  `MAX_PROPOSAL_RETRIES`, `MAX_STAGES`, `normalizeDeclaration`, `prepareWorkBranch`,
+  `PROPOSAL_LABEL`, `proposalSchema`, `proposalTool`, `PROPOSAL_TOOL_NAME`,
+  `QUARANTINED_CODE`, `QUESTION_SETS`, `RAW_TRIM_MARKER`, `READ_SHIM_ARMS`,
+  `readShimStrategy`, `REFUSAL_CATEGORY`, `REFUSAL_LIB`, `REVIEW_DOOR`, `seedFileList`,
+  `seedListing`, `shapeForkName`, `SOFTGREEN_QUESTIONS`, `SURVEY_CAUSES`, `TYPES_GENRE`,
+  `TYPES_GENRE_TEMPLATE`, `validateCard`, `validateFacts`, `validateJudgedArtifacts`,
+  `VERDICT_CLASSES`, `WORK_BRANCH_PREFIX`, `WORK_BRANCH_RE`, `wrapReadTool`. No in-repo
+  importer reached any of these through the package root (verified against every
+  `from '../src/index.js'` / `from './index.js'` / `from 'bareloop'` site in the tree), so
+  nothing else in this repo needed a path change.
+
 ## [0.25.1] — 2026-09-13
 
 ### Fixed