bareloop 0.26.0 → 0.28.0

package/bareloop.context.md

@@ -72,8 +72,10 @@ inherited rule carries the green that minted it and the contrast that attributed
   (`sonnet` → `gemini-2.5-pro`, `haiku` → `gemini-2.5-flash`). It is
   **ADMITTED-PENDING-PROBE**: it has ZERO runs, and the probe rule is not waived for it —
   `PROBE_STATUS` (`src/providers.js`) is the machine-readable form of that debt, and
-  `probeWarningLines(provider)` renders the loud launch-time marker `scripts/run-u.mjs`
-  prints. That table is read to WARN, never to REFUSE. Each entry also declares its own
+  `probeWarningLines(provider)` renders the loud launch-time marker `src/userrun.js`
+  prints (also called from `src/interviewrun.js` at interview time — PANEL-BUILD.md P0
+  lifted both call sites out of the `scripts/run-u.mjs`/`scripts/run-interview.mjs` scripts
+  that used to hold them). That table is read to WARN, never to REFUSE. Each entry also declares its own
   `endpointKey` — the CONSTRUCTOR option name it reads an endpoint from — because
   bare-agent's providers do not agree on one spelling (`baseUrl` for anthropic/openai/
   gemini, `url` for Ollama) and none of them validate unknown option names, so a
@@ -94,7 +96,8 @@ inherited rule carries the green that minted it and the contrast that attributed
 - **Reuse — where a workflow comes from:** a plain `runJob` always drafts cold. Passing
   `bridge` starts from one standalone bridge file (`src/reuse.js`'s envelope, `## The reuse
   ENVELOPE and runReuse` below). The CLI's `--registry <dir>` / library-level `registryDir`
-  (`src/reuse.js`, `scripts/run-u.mjs`) instead reads/writes dated rows in an
+  (`src/reuse.js`, `src/userrun.js` — lifted out of `scripts/run-u.mjs` by PANEL-BUILD.md P0)
+  instead reads/writes dated rows in an
   operator-supplied directory of plain JSON files — no database, no default location; a
   named-but-missing registry is a red, never conjured (`## The reuse registry (Layer 3)`
   below).
@@ -234,7 +237,7 @@ contract the single close object has always used) plus:
 | `name` | unique kebab-case slug | the plan references it via `check-passes(name)`; duplicates red `duplicate-id` |
 | `offer` | optional boolean, default offered | `offer: false` hides the stage from the derived menu — it never reaches the agent. For a stage that cannot stand alone as a ruler: a PRECONDITION (e.g. "the seed commit exists" — passes instantly, teaches nothing) or the **final grading stage** — of the fourteen specs in `jobs/`, five hide a final `verdict` stage and seven hide a `changed-from-seed` precondition instead (the remaining two use an object-form close with no staged `offer` flags) (a per-spec convention, not a schema rule — nothing stops a stage named last from being offered except the spec author remembering to set the flag; preflight's `check-menu` event always names the full menu either way, so a forgotten flag is visible in the run's own record) |
 | `needs` | optional non-empty array of EARLIER stage names | a stage that reads what an earlier stage built (e.g. "the public API matches what an earlier stage emitted") names its prerequisite chain; picking it via `check-passes` runs the chain first, then the stage itself. Every name must be declared before this stage (`invalid-value` otherwise); `needs` + `offer: false` together is incoherent (`invalid-value`) — a stage with a chain to run must be reachable |
-| `direction` | optional `'up'` \| `'down'`, allow-list validated (anything else is `invalid-value`) | which way this stage's numeric series is READING as progress — `'down'` (fewer is better: typecheck errors, suppressions) or `'up'` (more is better: a fault-detection rate). **Absent means `'down'`** — every close built before this field existed is a count-shaped close, so the silent default is behaviour-identical for all of them (F120). Never inferred from the goal text and never LLM-judged — prose the agent writes must never influence its own halt rule, the same reasoning that keeps every close hand-authored or declared, never judged. Consulted by `isBetter(stage,a,b)` in `src/trend.js`, the one place the close-fix governor's `countImproved` and `best`-tracking read direction; `scripts/run-u.mjs` prints each stage's direction at the close-stage banner so a silent default is never invisible |
+| `direction` | optional `'up'` \| `'down'`, allow-list validated (anything else is `invalid-value`) | which way this stage's numeric series is READING as progress — `'down'` (fewer is better: typecheck errors, suppressions) or `'up'` (more is better: a fault-detection rate). **Absent means `'down'`** — every close built before this field existed is a count-shaped close, so the silent default is behaviour-identical for all of them (F120). Never inferred from the goal text and never LLM-judged — prose the agent writes must never influence its own halt rule, the same reasoning that keeps every close hand-authored or declared, never judged. Consulted by `isBetter(stage,a,b)` in `src/trend.js`, the one place the close-fix governor's `countImproved` and `best`-tracking read direction; `src/userrun.js` (lifted out of `scripts/run-u.mjs` by PANEL-BUILD.md P0) prints each stage's direction at the close-stage banner so a silent default is never invisible |
 
 The stages run in declared order as the close itself; the first red renders the verdict and
 later stages never run. `checkMenu(close)` returns only the offerable stages (each with its
@@ -538,6 +541,7 @@ contract); returns the parsed spec on ok, `null` on any red. A spec carrying the
 generic unknown-field. Menus exported: `CLOSE_TYPES`, `CLASS_BY_CLOSE`, `GOLD_COMPARE`,
 `CADENCE_UNITS`, `PROVIDERS`, `CONDITION_KEYS`, `TOOL_MENU`, `LOCKED_TOOLS`, `STORE_VERBS`,
 `VERDICT_TYPES`, `LOCKED_VERDICTS` — plus `checkMenu` itself.
+
 `globToPrefix(scope)` and `scanSecrets(text)` are exported too — the write-scope prefix
 mapping and the one secret-shape sweep `validateJob` itself is built from (`src/validate.js`).
 
@@ -615,9 +619,9 @@ a step, or test it without a provider.
 | interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. The interview ADMITS only what is on the menu (`MENU_CLASSES`): nothing is locked today (`LOCKED_CLASSES` is empty), and any pick off the menu returns a refusal rather than `ok:true` — ask `MENU_CLASSES` which classes can be authored, never this sentence. The interview asks NOTHING about a genre and NOTHING about the repository. **Ask the library for the set and its numbers — never hardcode a count or a slot number**: the green set has lost several slots since it was frozen (D13's genre confirm; the repo question, dropped 2026-08-15 because `repoPath` is mandatory structured input; and, at PRD item 33 M3 piece 3, the old "which files change/read" question, replaced by Source and Destination — MECHANICAL fields, proven against the machine, never a numbered answer), and it renumbers CONTIGUOUSLY from 1 each time rather than leaving a gap. Today the green set is THREE questions (Goal, Success, Guardrails); the `soft-green` set is those three plus one more — Judge Examples (one example to pass, one to fail, and why) — the judged floor's one required input, compiled into the signed rubric card and the frozen calibration set. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
 | survey | `runAuthorScout({ workdir, provider, attempts?, ceilingUsd? })` → `{ state, facts, reason, meta, raw, raws, calls, budgetStop }` | a bounded READ-ONLY LLM survey. Read-only by MENU CONSTRUCTION (`AUTHOR_SCOUT_VERBS` = the full menu minus write-class and store-class verbs), 8 rounds, F59's reserved toolless final round. **`state: 'ABSENT'` means the scout did not complete — never "no special facts are needed"**, and a parsed `{}` is one of its five ABSENT routes. Up to `SCOUT_ATTEMPTS` (**3**, hardcoded — PRD v1.58) attempts: `attempts` is TIGHTEN-ONLY and CLAMPS rather than throws (floor **1**, because a scout that never ran is an ABSENT nobody can act on), the direction every cap in this system runs in. **A retry fires on the typed MALFORMED class alone** (`SCOUT_RETRY_CAUSES` = `empty` \| `unparseable`); what is excluded is excluded for a reason — `call-failed` covers transport and `truncated:max_tokens`, both provider-red with NO redraft; `short` is F59's cut-off population and already has its own instrument INSIDE the attempt; `non-object` and `empty-object` are valid JSON with wrong or vacuous content, which is a SEMANTIC failure, and F38/F39 measured what re-asking one buys (the same distribution, sampled twice) — that is the self-healing line, and it is not crossed here. The re-ask is TOOLLESS over the conversation the survey already produced (the repository was already read; only the emission was unreadable) and names the mechanical parse error and nothing else. **There is no JSON repair behind it and there never will be** — a repairer decides what the model MEANT and writes it down as though the model had said it, in the one artefact whose whole job is to be honest about what a repository contains. `meta.attempts` / `meta.attemptsAllowed` record what was paid for; every attempt is metered under its own label (`author-scout`, `author-scout#2`, …) and leaves its raw behind. **`ceilingUsd` is the operator's money ceiling** (PRD v1.62) — checked BETWEEN attempts and before F59's reserved round, so no paid call escapes it; `null`/absent is UNBOUNDED, and a non-null non-finite value THROWS (the shared `capStop` seam — see `authorClose` below). When it ends the ladder, `budgetStop` names which stop (`cap-halt` \| `pricing-red`) and a survey that was never asked for carries the typed cause `not-funded` — deliberately OUTSIDE `SCOUT_RETRY_CAUSES`, because a retry is precisely what the cap forbade |
 | listing | `buildSeedListing({ workdir, seedRef, sourcePaths, testPaths })` | mechanical, `$0`, no model. `files` is the WHOLE tree (what the validator judges paths against); `block` is scoped to the survey's own paths and capped in ANNOUNCED tiers (what the prompt carries). Handing the validator the scoped half would make a job scoped to `src/` read as whole-tree and silently disarm the one-population law |
-| authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate, ceilingUsd? })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second. **`ceilingUsd` is the same operator ceiling the survey took** — the scout's spend is ABSORBED into this loop's cost book before its first call is weighed, so spend already incurred folds in and re-entering cannot silently widen it. It is checked immediately before EVERY paid call (the author call, each revise, and each malformed-emission retry). **A MALFORMED ceiling is an ERROR, not a silent unbounded run** (v1.64 §3): the seam every ceiling read goes through (`capStop`, `src/text.js`) THROWS on a non-null non-finite value — `'2.50'`, `NaN`, `Infinity`, `true`, `{}` — before the first paid call, and the throw propagates uncaught rather than being caught into an ABSENT survey, because a caught one would hand you the very silent-unbounded run it exists to prevent. `null`/omitted is the STATED operator choice for unbounded; `0` and negatives are finite, legal, and cap-halt immediately. The advertised ceiling and the enforced ceiling can therefore never be different numbers. A `cap-halt` here can arrive with `ok:true` — a close that was already validated and measured survives the money stop, exactly as a late provider casualty does |
+| authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate, ceilingUsd? })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second. **`ceilingUsd` is the same operator ceiling the survey took** — the scout's spend is ABSORBED into this loop's cost book before its first call is weighed, so spend already incurred folds in and re-entering cannot silently widen it. It is checked immediately before EVERY paid call (the author call, each revise, and each malformed-emission retry). **A MALFORMED ceiling is an ERROR, not a silent unbounded run** (v1.64 §3): the seam every ceiling read goes through (`capStop`, `src/text.js`) THROWS on a non-null non-finite value — `'2.50'`, `NaN`, `Infinity`, `true`, `{}` — before the first paid call, and the throw propagates uncaught rather than being caught into an ABSENT survey, because a caught one would hand you the very silent-unbounded run it exists to prevent. `null`/omitted is the STATED operator choice for unbounded; `0` and negatives are finite, legal, and cap-halt immediately. The advertised ceiling and the enforced ceiling can therefore never be different numbers. A `cap-halt` here can arrive with `ok:true` — a close that was already validated and measured survives the money stop, exactly as a late provider casualty does. **F176 (fixed):** "kept the last accepted revision" is not the same claim as "kept the best revision" — a later revise round can VALIDATE fine yet MEASURE worse (every stage instrument-stops rather than reading a real red/green verdict). `declaration`/`seedRead`/`finalFrom`/the returned `genreEnv.dropped` are therefore the NEWEST SOUND measured iteration, not simply the last one, when the last one instrument-stopped and an earlier one did not; `stop` itself never changes. The swap is never silent: the return also carries **`fellBack`** — `null` on every run where it never fired, else `{from, to, brokenStages}` naming which iteration was dropped, which now stands, and which of the dropped one's stages instrument-stopped — reported through `onPhase('author-fallback', …)` as it happens and printed at the terminal readout (`fellBackLines`, `src/authorreadout.js` — lifted out of `scripts/author-readout.mjs` by PANEL-BUILD.md P0; called from `src/authorrun.js`). **F179/F180 (history):** bare-agent 0.42.0's OpenAIProvider used to THROW mid-call on malformed tool-call JSON (a raw SyntaxError, after the billed round), crashing past this function; a 2026-09-15 stopgap caught it as a `provider-red`/`ask.providerError` casualty (booked `costUsd: null`) so a sound prior declaration was kept via the fallback above rather than discarded. **F179 (bare-agent 0.43.0, BA-27 — the real mechanism):** the throw is fixed upstream. `OpenAIProvider`/`OllamaProvider.generate` now return a malformed round PRICED (real `usage`, never `costUsd: null`) with `toolCalls: []` plus their own `malformedToolCall: {name, error}` marker, which `Loop.run` surfaces unchanged on its return. For the authoring declaration and confirm-turn calls, `askStructured` reads that marker and RETRIES through the existing malformed-emission retry ladder (`MAX_STRUCTURE_RETRIES`) instead of stopping the run — nothing is ever repaired, and a malformed FIRST call no longer needs an earlier sound declaration to fall back to. The generic provider-casualty fallback above (idle-timeout, etc.) still applies for every other admitted class. **F184 (fixed, worker path):** the scout and the worker path never joined that retry ladder (still true — retrying is arbiter-adjacent, out of scope), but the worker path's `ask()` (`src/planrun.js`) now at least READS the marker where it already sees it and emits a distinct spine record, `worker-malformed-tool-call` (`{phase, iteration, name, error}`), before returning `r` unexamined exactly as before — no retry, no change to strikes/ladder/attempt counting or verdict routing, purely the same visibility bar this section's authoring-path fix already set |
 | everything above, composed | `authorCloseForJob({ verdictType, answers, repoPath, lang, generate, ceilingUsd?, ... })` → `{ ok, closeDecl, verdictType, refusal, cost, ... }` | refuses at the cheapest gate that can refuse: an interview refusal costs **zero**. THE GENRE REFUSAL LIVES HERE (not in the interview): a language the catalogue owns no data for, and a LOCKED KIND the model reached for, both come back as counted `request-red` demand. **`ceilingUsd` is ONE number handed to BOTH paid seams** (the survey's and the declaration loop's) — the advertised ceiling and the enforced ceiling are the same ceiling. It travels as an EXPLICIT `null` when unset, because unbounded is a stated choice and an absent field read as falsy is that state reached by accident — and anything that is neither a finite number nor `null` throws at the seam rather than becoming that state by typo |
-| assembly | `assembleSpec(specDraft, { closeDecl, verdictType })` | folds the authored half into the OPERATOR's half. Budgets, the fence, cadence, escalation and the provider are never authored by anything here. The GOAL is passed through, not generated. **A draft that ALREADY carries the authored half is REFUSED — it THROWS, never merges and never overwrites.** `AUTHORED_SPEC_FIELDS` (`close`, `closeDecl`, `verdictType`) names the fields this fold WRITES, as data, so the refusal and the fold cannot disagree about which half of the spec is which; the rule is `job.js`'s one step earlier (two closes are two arbiters, and picking one silently is how a signed artefact stops meaning what the signer read). `scripts/run-author.mjs` asks the same question at **$0 BEFORE the scout**, so the answer never arrives after the model has been paid |
+| assembly | `assembleSpec(specDraft, { closeDecl, verdictType })` | folds the authored half into the OPERATOR's half. Budgets, the fence, cadence, escalation and the provider are never authored by anything here. The GOAL is passed through, not generated. **A draft that ALREADY carries the authored half is REFUSED — it THROWS, never merges and never overwrites.** `AUTHORED_SPEC_FIELDS` (`close`, `closeDecl`, `verdictType`) names the fields this fold WRITES, as data, so the refusal and the fold cannot disagree about which half of the spec is which; the rule is `job.js`'s one step earlier (two closes are two arbiters, and picking one silently is how a signed artefact stops meaning what the signer read). `src/authorrun.js` (lifted out of `scripts/run-author.mjs` by PANEL-BUILD.md P0) asks the same question at **$0 BEFORE the scout**, so the answer never arrives after the model has been paid |
 | the three gates | `prepareSigning({ spec, workdir, seedRef? })` → `{ ok, specHash, gates, work, guards, refusal }` | D9, and it NEVER signs |
 
 **D5 — the mandatory guards are SHOWN and FIXED, and the battery keys off the VERDICT
@@ -858,13 +862,17 @@ goal has to state everything the close will judge, and **nothing derives one fro
 or checks them against each other** — the only derivation runs close-stages → check menu, one
 hop, one direction. So the sole defence against an unstated stage is that the person signing
 reads both halves at once, and any surface you build around `prepareSigning` inherits that
-obligation. Both reference runners now do it: `scripts/run-u.mjs --approve` names every close
+obligation. Both reference runners now do it: `src/userrun.js --approve` (lifted out of
+`scripts/run-u.mjs` by PANEL-BUILD.md P0) names every close
 stage (name + kind) under the goal — for **BOTH spec forms**, through `closeStagesOf`, since
 gating that block on `closeDecl` reached exactly one of the eleven shipped specs and left the
 other ten (command `close[]`) showing the goal with no stages under it, which is the same
 half-reading in the guard against it (F100); a command stage prints `[command]` and NOT the
-catalogue kind name it does not carry — and `scripts/run-author.mjs` prints the goal above the
-declaration via `declarationLines(spec)` in `scripts/author-readout.mjs`, rendered from the
+catalogue kind name it does not carry — and `src/authorrun.js` (lifted out of
+`scripts/run-author.mjs`) prints the goal above the
+declaration via `declarationLines(spec)` in `src/authorreadout.js` (lifted out of
+`scripts/author-readout.mjs` — no adapter script remains for that one, it moved whole),
+rendered from the
 **RESOLVED** spec — the bytes that get hashed, never the draft and never the authored half
 alone. An absent goal renders as absent rather than as a bare label. This is a READING, not a
 validator: nothing compares the goal to the declaration, because deriving one from the other
@@ -875,14 +883,25 @@ is exactly what F87 forbids.
 `scripts/run-interview.mjs` existed the only way in was to hand-write an `answers.json` and a
 spec draft — precisely the SWE tax this product refuses. That script is the half that ASKS
 (`--verdict <class> --provider <anthropic-api|openai-api|gemini-api|clipipe-subscription>
---out <outdir> [--budget <usd>]`), and it is deliberately GLUE: **it
+--out <outdir> [--budget <usd>] [--base-url <url>]`), and it is deliberately GLUE: **it
 calls no provider at all**, so a whole interview costs $0 and no model ever sees it. `--provider`
 is REQUIRED with NO default — bareloop is LLM-agnostic, and defaulting it would silently re-lock
 every interview onto one vendor; missing or empty dies loud, at the door, naming the same menu
 `src/job.js`'s own validator admits. It is written into the draft's `provider` field, so
-`scripts/run-author.mjs` needs no flag of its own — it resolves whatever the interview wrote
+`src/authorrun.js` (lifted out of `scripts/run-author.mjs` by PANEL-BUILD.md P0) needs no flag of its own — it resolves whatever the interview wrote
 down.
 
+`--base-url` is OPTIONAL with NO default (PRD item 33 close-out — L17 named the provider but
+never admitted the endpoint): a provider name's table entry (`src/providers.js`) can be reached
+through an OpenAI-compatible gateway other than its own default host — DeepSeek, today's one
+secondary, is reached as `--provider openai-api --base-url https://api.deepseek.com/v1`. Absent,
+the draft carries NO `baseUrl` field at all (never `null`, never `''`) and every provider
+constructor defaults its own endpoint. When given, it lands in the draft's `baseUrl` field
+beside `provider` and passes through the SAME `validateJob` pass every other field takes below,
+at $0: `http://` to a public host, an embedded `user:pass@`, or an unparseable string reds there,
+before anything is written. The key still follows the PROVIDER, not the endpoint — a DeepSeek
+draft's key still loads from `OPENAI_API_KEY`, and the hand-off says so.
+
 **Source and Destination are the interview's own FIRST TWO QUESTIONS, and they REPLACE
 `--patient`** (PRD item 33 M3, ruling 2, `docs/product/ITEM33-BUILD.md`). Source — "a local
 folder, subfolder or file, or one URL the machine can reach" — is asked first and checked
@@ -910,8 +929,10 @@ piece 4 step S6 (D5 = A), the FORM CONTINUES — the class's own questions, job
 wall are all still asked, and the draft is still written, with no `writeScope` field
 (`PLAIN_FOLDER_DEFERRED_FIELDS`, `src/authorjob.js` — Destination there is an output directory,
 never a fence). The honest named stop (bareloop's check catalogue is code-genre only today,
-ruling 7 → M4) no longer lands HERE — it moves to `run-author.mjs`, AFTER a confirm turn over
-the $0 seed listing (no scout — D5's register is code-only). Everything load-bearing in it is
+ruling 7 → M4) no longer lands HERE — it moves to `run-author.mjs`, which now gives it
+IMMEDIATELY, at $0 (D5 amended 2026-09-21, F191: no scout and no confirm turn either — a plain
+folder has no code language, so the confirm turn's own code-derived protections cannot be
+computed for one; see the run-author.mjs section below). Everything load-bearing in it is
 borrowed rather than respelled —
 the QUESTIONS are the library's frozen sets (`questionsFor` / `requiredAnswersFor`), printed as
 handed over and never re-worded, re-ordered or re-numbered by the script; the REFUSALS are
@@ -946,7 +967,9 @@ spends it.
 DIFFERENT PROCESS under its own ceiling; the interview prints its exact command line (with
 `--budget` propagated only when one was given, and a note when the CHOSEN provider's own key —
 `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`, resolved through the same provider table
-`run-author.mjs` and `run-u.mjs` share — is unset in this shell)
+`run-author.mjs` and `run-u.mjs` share — is unset in this shell, OR set but MALFORMED: F181 — a
+value carrying a line break/control character/stray whitespace (a two-line secret-store entry,
+e.g.) reads a distinct reason via `apiKeyProblem` (`src/providers.js`), never the value)
 before asking `Run it now? [y/N]`, so declining still leaves a command to paste and two files
 already on disk. Only an explicit yes spends — the answer that costs nothing is the one you get
 by saying nothing, the same lean the pause's doors take. On a yes it releases stdin before
@@ -976,7 +999,10 @@ into a success one process up.
 - `run-author.mjs` — **1** a refusal or a failed gate (this now includes the confirm turn's own
   `confirm-abandoned`/`confirm-restart` stops — input ended, or the person chose to start over,
   both counted through the same generic "not-authored" branch every other authoring refusal
-  uses); **2** operator/config; **3** a leak; **4** a CRASH inside the paid span. **3
+  uses, and `source-deps-missing` — the prepared copy's `package.json` lists dependencies with
+  no `node_modules`, refused at $0 before the scout and before the provider/key are even
+  checked, naming the exact install command); **2** operator/config; **3** a leak; **4** a
+  CRASH inside the paid span. **3
   deliberately OVERRIDES a 4**: a secret sitting in a written file is the harder line of the
   two, and the crash keeps both of its own louder channels — the whole error on stderr and its
   own `author-crash` spine record. **This script is now interactive** (step S4): the confirm
@@ -984,12 +1010,15 @@ into a success one process up.
   who wrote what and lets the person confirm the plan, fix it (up to 2 rounds), type the goal
   themselves, or start over — everything else (the survey, the declaration loop, D9's gates)
   stays unattended. `rl.close()` runs in a `finally` around the whole paid span. **A plain-folder
-  Source (step S6, D5 = A) runs NO scout** — its own confirm turn runs over a $0, no-git
-  directory listing of the frozen tree instead, then the SAME honest "no checks yet" stop this
-  script always gave (`request-red`/`non-code-source`), now given AFTER that confirm turn rather
-  than before the API key is even read. If the confirm turn itself does not reach a signed plan
-  (abandoned, a cap/pricing stop, a provider/artifact red, or "start over"), THAT is the stop —
-  the non-code-source one only fires once a plan was actually confirmed.
+  Source (step S6, D5 amended 2026-09-21, F191) gets NO scout AND NO confirm turn.** D5
+  originally ran the confirm turn over a $0, no-git directory listing of the frozen tree first,
+  THEN gave the honest "no checks yet" stop (`request-red`/`non-code-source`) once a plan was
+  confirmed. Live run `mu4hc7sp` crashed inside that confirm turn instead: `confirmProtections`
+  calls `classGuards` (`src/authoring.js`), which is keyed by CODE LANGUAGE and throws on a
+  plain folder's `lang: 'none-detected'` — a plain folder has no language, so the confirm turn
+  cannot honestly show real, code-derived protections for one, and now never runs one. The stop
+  fires immediately after `author-start`, at $0, no scout, no confirm turn, no model call — the
+  spine is exactly `author-start` → `author-end{outcome:'not-authored', stop:'non-code-source'}`.
 
 **The protections a person is shown in the confirm turn come from CODE, never the model**
 (fix #1, live run mu0voeo4, 2026-09-14 — a run once showed a model-invented "behavior-
@@ -1001,10 +1030,33 @@ compose, each through a frozen plain-English line in `GUARD_DESCRIPTIONS` — be
 `CONFIRM_MENU` — plus the write fence when one is set; a guard with no line there throws
 rather than showing a blank description. The model instead returns `notChecked`: anything
 the person asked for that no listed check can verify, in the person's own words, never
-silently dropped. It is shown under its own heading in the menu (`scripts/run-author.mjs`)
+silently dropped. It is shown under its own heading in the menu (`src/authorrun.js`, lifted
+out of `scripts/run-author.mjs` by PANEL-BUILD.md P0)
 and threaded through to `accepted.notChecked` and `confirmedBlock`'s own "THE PERSON ASKED
 FOR THESE, BUT NOTHING CHECKS THEM" section for the composer.
 
+**The model drafting `notChecked` is now shown the SAME code-derived protections list before
+it drafts** (F183, ruling A, 2026-09-16 — live runs `mu2bjmed` and `mu2qmept` both had the
+model falsely claim an already-enforced guard or the write fence was missing, because it was
+never told what was actually enforced). `confirmProtections`'s output is computed once, before
+the paid round loop, and threaded into `confirmPrompt`'s model-facing prompt as an "ALREADY
+COVERED" block; `CONFIRM_SYSTEM` orders the model to check that list before naming anything in
+`notChecked`. The model still authors `notChecked` freely — this never makes the list
+deterministic, and it is still never a hand-typed second spelling of the guards. Not yet
+proven live.
+
+**`accepted.openQuestions` is the model's OWN honest `questions`, from the plan being
+ACCEPTED** (F175, fixed 2026-09-14) — never a prior, superseded round's, and never limited to
+a person's typed "fix" text as it used to be. On the round-2 "fix" terminal path (D3: there is
+no 3rd call) the model's own questions come first, then the person's still-pending fix text.
+Shown to the composer by `confirmedBlock` ("state these in your notes, never decide them
+silently") and at the terminal signing readout (`openQuestionLines`, `src/authorreadout.js` —
+lifted out of `scripts/author-readout.mjs` by PANEL-BUILD.md P0; no adapter script remains
+for that one, it moved whole).
+**Not fully closed:** the confirm menu still lets a person pick "Confirm" without being forced
+to resolve a raised question first — only the silent-drop-from-the-signed-record half of F175
+is fixed; the menu-bypass half stays open.
+
 **A crash inside the paid span leaves a BODY.** The fallible span — from just after
 `author-start` to the end of the main flow — sits in ONE try/catch that RETRIES NOTHING and
 SWALLOWS NOTHING. The operator's copy goes first and verbatim (it must not depend on the two
@@ -1111,7 +1163,8 @@ races), never to be folded into worker/interpreter reds.
 ### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, closeDir?, layerRoot?, readShim?, scout?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun?, resumable? })` → outcome — `src/run.js`
 
 **`closeTimeoutMs` (PRD item 27/M3) is now OPTIONAL for every real caller.** Omit it (both
-`src/cli.js`'s bundle runner and `scripts/run-u.mjs` do) and the run AUTOSETS the per-stage
+`src/cli.js`'s bundle runner and `src/userrun.js` — lifted out of `scripts/run-u.mjs` by
+PANEL-BUILD.md P0 — do) and the run AUTOSETS the per-stage
 close ceiling from a $0 seed timing pass, or reads the job spec's own signed override —
 "guesstimate + loud sign + customer override", the same shape rates-passthrough already
 uses (F113). Passing an explicit value here still wins outright over both (kept for
@@ -1120,7 +1173,8 @@ backward compatibility and test control) — see `resolveCloseTimeoutMs` further
 **`closeDir` (PRD item 27/M3 Part B, optional but effectively required for any
 hand-authored close that reads its own books)** — the close's own directory (pristine
 copies, calibration thresholds, logs), outside the patient tree. `src/cli.js` sets it to
-`<bundleDir>/runs/<runid>/close/`; `scripts/run-u.mjs` sets it to its existing `spineDir`. A
+`<bundleDir>/runs/<runid>/close/`; `src/userrun.js` (lifted out of `scripts/run-u.mjs` by
+PANEL-BUILD.md P0) sets it to its existing `spineDir`. A
 close script whose source mentions `BARELOOP_CLOSE_DIR` and gets none here refuses the run
 at $0 (`close-dir-required`, before any provider call) — see `checkCloseDirRequired` below.
 
@@ -1819,7 +1873,8 @@ that moved (`door-accept-red`) and a missing registry all come back as named red
   a person) before it is honoured: hamr's ruling that an accept is not a rubber stamp, and the
   answer to a tree that can move in the 60 days a door keeps. A red REFUSES the accept with the
   stage named and records **nothing**. A pass records the disposition and, over a held judged
-  green, RELEASES the credit through module 6's `applyDoorDecision`. `scripts/run-u.mjs` resolves
+  green, RELEASES the credit through module 6's `applyDoorDecision`. `src/userrun.js` (lifted
+  out of `scripts/run-u.mjs` by PANEL-BUILD.md P0) resolves
   the re-run's ceiling itself via `resolveCloseTimeoutMs` before calling this, and refuses outright
   (F137) as a named `close-timing-red` door stop — `answerReviewDoor` never called, nothing
   recorded — if that timing pass itself times out, rather than falling through to `runClose`'s
@@ -2185,7 +2240,8 @@ it came back for (the declared-fold precedent, `priorSpentUsd`'s exactly). Pass
 `resumeBranch`; `runReuse` does it for you. `null` — a leg killed before it ever branched — is
 the cold path, and correct, because a leg that never branched has no work to strand.
 
-`scripts/run-u.mjs --resume <runid|path>` is the operator-side consumer: it skips the patient
+`bareloop run-u --resume <runid|path>` (`src/userrun.js`, lifted out of `scripts/run-u.mjs`
+by PANEL-BUILD.md P0 — the script is now a thin adapter over it) is the operator-side consumer: it skips the patient
 reset (`resumeTreeGate` instead — a dirty tree is what a resume expects; only a moved HEAD
 stops it), folds the halted run's money and wall in, returns to the dead leg's own work branch,
 re-enters at the checkpoint, and arms the outside watchdog on the REMAINING wall. The top-up itself stays a spec edit the human signs.
@@ -2438,6 +2494,23 @@ objects will not be caught by this. `scripts/behaviour-readout.mjs <gate-audit.j
 prints the block for one run or every run_id found in the file, skipping malformed lines with
 a count rather than throwing.
 
+**F186 (2026-09-15) — the "run's own gate-audit JSONL" claim above was FALSE for a while, at the
+file-hygiene layer, never inside `runBehaviour` itself.** The authoring scout's gate audit
+(`src/authorscout.js`'s `defaultSurveyor`) writes directly into the patient tree at its root
+(`<workdir>/gate-audit.jsonl`), and the tree's own `.gitignore` denies `*.jsonl`, so
+`src/userrun.js`'s cold reset (`git clean -fd`, no `-x`, via `coldReset` — lifted with
+`moveStaleGateAudit` out of `scripts/u-patient.mjs` into `src/u-patient.js` by PANEL-BUILD.md
+P0) never removed it — the file
+accreted rows from every authoring scout AND every worker run that had ever touched the tree,
+and `run-u`'s end-of-run rename claimed the WHOLE accreted file as "this run's own audit"
+with no filtering. The fix is at the source, never a `run_id` filter bolted onto `runBehaviour`
+(a single run legitimately spans several run_ids): `src/authorrun.js` (lifted out of
+`scripts/run-author.mjs`) archives its own
+audit out of the tree the moment authoring ends; `src/userrun.js` moves any stale audit
+aside right after `coldReset`, before its own Gate ever opens (never on a resume, where the
+tree's audit is that same run's own prior leg). With both halves in place, the file this
+section describes really is scoped to the one run reading it, restoring the claim above.
+
 ```js
 import { runBehaviour, formatBehaviour } from 'bareloop';
 const events = fs.readFileSync(auditFile, 'utf8').trim().split('\n').map(JSON.parse);
@@ -2456,12 +2529,21 @@ is `Math.round(bytesWithheld / 4)`, a bytes→tokens ESTIMATE named accordingly
 it as measured. **Emitted only when the shim is armed** (any `readShim` arm but the off one) —
 an unarmed run emits no record at all, never a fabricated zero. It carries no cost fields, so it
 is not a spend record and no spend-slicing instrument needs to account for it.
-`scripts/run-u.mjs` prints it as a `MEMORY-CACHE` line right after `BEHAVIOUR` when armed
+`src/userrun.js` (lifted out of `scripts/run-u.mjs` by PANEL-BUILD.md P0) prints it as a `MEMORY-CACHE` line right after `BEHAVIOUR` when armed
 (`no record` if the run ended before the summary could fire); `scripts/behaviour-readout.mjs`
 prints the same line when handed the run's spine file as its optional third positional.
 
 
-### `replayRun(spineEvents, auditEvents?, { runId? })` / `formatReplay(summary)` — `src/replay.js`
+### `replayRun(spineEvents, auditEvents?, { runId? })` / `formatReplay(summary)` / `summarizeForAllLine(summary)` / `formatAllLines(entries)` — `src/replay.js`
+
+`summarizeForAllLine(summary)` reduces one `replayRun` summary to one `--all`/directory-
+listing row's raw field strings (`id`/`job`/`shape`/`class`/`model`/`outcome`/`spend`/
+`wall`/`steps`/`reason`); `formatAllLines(entries)` renders every row `listSpines` (below)
+built for one directory as a fixed-column aligned table, with `<name>  not-a-spine` lines
+interleaved at their original position for any file that didn't look like a spine. Both
+are PANEL-BUILD.md P0 additions to the package root: they already existed inside
+`src/replay.js` (built for `scripts/run-replay.mjs`'s own `--all` mode) but were not
+re-exported until this rung, alongside `src/replayio.js` below.
 
 PRD build-list item 6: today no failed run can be reconstructed in under five minutes — every
 byte is on disk (the spine JSONL + its gate-audit sidecar) but only hand-slicing JSONL reads it.
@@ -2711,6 +2793,45 @@ const audit = fs.readFileSync(auditFile, 'utf8').trim().split('\n').map(JSON.par
 console.log(formatReplay(replayRun(spine, audit, { runId: 'mszcthk1' })));
 ```
 
+### `replayOne(spinePath, opts?)` / `listSpines(dir)` / `readHistoryLog(file)` — `src/replayio.js`
+
+PANEL-BUILD.md P0, the rung's last task: the IO layer `replayRun`/`formatReplay` above
+never had — resolving a spine's gate-audit sibling on disk and reading it, and listing
+which `.jsonl` files in a directory are spines at all. This is the module `bareloop
+replay` and `bareloop history` are both thin callers of (previously duplicated ad hoc: a
+`readFileSync` inline in `src/cli.js`'s own `doHistory`, and a second copy of this exact
+IO logic living only in `scripts/run-replay.mjs` with no library form and no `bareloop`
+command over it — the gap PANEL-BUILD.md's own measured table named). Every function here
+is pure IO + content detection; the actual reconstruction is `replayRun`'s alone (above) —
+nothing here recomputes a field `replayRun`/`runBehaviour` already derive.
+
+`src/replayio.js` also holds lower-level plumbing (`parseJsonl`, `isSidecarByName`,
+`looksLikeSpine`, `resolveSiblings`) that the three functions below compose internally —
+a raw JSONL parser, a filename predicate, a content predicate, and a sibling-path
+resolver. These are deliberately **not** re-exported from the package root: they are
+implementation steps, not their own adopter-facing promise, and each is exercised (and
+importable) directly from `src/replayio.js` by this repo's own tests.
+
+- **`replayOne(spinePath, { preParsedSpine?, skipAudit? })`** → `ReturnType<replayRun>`.
+  Reads the spine (+ sidecar unless `skipAudit`) and hands both straight to `replayRun`.
+  `skipAudit` (carried over from the script this replaces, PR #23 review item 5): a
+  directory listing never opens a run's sidecar at all, since `summarizeForAllLine` reads
+  none of the audit-sourced fields — reading every run's sidecar in a `--all` listing was
+  pure unused I/O, multiplied by every spine found.
+- **`listSpines(dir)`** → `Array<{kind:'spine', row: ReturnType<summarizeForAllLine>} |
+  {kind:'not-a-spine', name}>`, one entry per `.jsonl` file found directly in `dir` (not
+  recursive) that is not a sidecar by name. Feeds `formatAllLines` directly.
+- **`readHistoryLog(file)`** → `{rows, skipped}`. The one reader for a bundle's
+  `history.jsonl` (`src/bundle.js`'s `appendHistory`); replaces `bareloop history`'s former
+  hand-rolled `readFileSync`/split.
+
+```js
+import { listSpines, replayOne } from 'bareloop';
+import { formatAllLines, formatReplay } from 'bareloop';
+console.log(formatAllLines(listSpines('/path/to/patient-repo')));
+console.log(formatReplay(replayOne('/path/to/patient-repo/u-mszcthk1.jsonl')));
+```
+
 ### `PROMPT_REGISTERS` / `isPromptFile(path)` — `src/promptregisters.js`, and the prompt-commit rule
 
 PRD build-list item 5 (TODO #8), Q9 answered (hamr, 2026-08-25): "a check". A commit that
@@ -2876,7 +2997,7 @@ defaulted knob. Arbiter constants, hamr 2026-09-07 verbatim: **floor = 120,000 m
 | `TIMING_PREFLIGHT_CEILING_MS` | `600_000` (library default × K) | the GENEROUS provisional ceiling every stage runs under DURING the timing pass itself — never the autoset/override ceiling the run then uses, which is only known after the pass completes |
 | `timeCloseStages(stages, {cwd, redact})` | → `{ perStage: {name,ms,exitCode,timedOut}[], slowestMs, slowestName, anyTimedOut }` | runs EVERY stage once, ignoring verdicts (first-red-wins stays for the real verdict precheck) — a declared/kind stage (no `.cmd`) is skipped, contributing no reading rather than a false zero. A stage that never finishes within `TIMING_PREFLIGHT_CEILING_MS` reads `timedOut: true` |
 | `computeCloseTimeoutCeiling({slowestMs, overrideMs?})` | → `{ ceilingMs, source: 'estimated'\|'override' }` | `max(FLOOR, K × slowestMs)`, unless `overrideMs` is given, in which case it wins outright (may sit above OR below the estimate — not tighten-only) |
-| `resolveCloseTimeoutMs({job, stages, cwd, redact})` | → `{ closeTimeoutMs, source, timing, timedOut }` | the ONE resolver `src/planrun.js` and `scripts/run-u.mjs` BOTH call (never two independent spellings of this precedence): a signed `job.closeTimeoutMs` wins with NO timing pass run at all; absent, the pass runs and the ceiling autosets. `timedOut: true` means a stage never finished the pass — the caller reds `close-timing-red` rather than trusting any number |
+| `resolveCloseTimeoutMs({job, stages, cwd, redact})` | → `{ closeTimeoutMs, source, timing, timedOut }` | the ONE resolver `src/planrun.js` and `src/userrun.js` (lifted out of `scripts/run-u.mjs` by PANEL-BUILD.md P0) BOTH call (never two independent spellings of this precedence): a signed `job.closeTimeoutMs` wins with NO timing pass run at all; absent, the pass runs and the ceiling autosets. `timedOut: true` means a stage never finished the pass — the caller reds `close-timing-red` rather than trusting any number |
 | `closeTimeoutBanner({ceilingMs, source, slowestMs?, slowestName?})` | → the printed line | ONE spelling for `estimated`/`override`/`explicit` (the last is the pre-M3 shell/test runtime-option escape hatch, never the signed field) — printed on every run so a silent default can never hide behind this feature the way the OLD 120s/900s defaults did |
 
 **`scripts/sign-close.mjs`** — `node scripts/sign-close.mjs <jobs/x.json> [--write]` or
@@ -2925,7 +3046,7 @@ hash and needs re-approval, exactly like any other semantic edit.
 | `close-sha-mismatch` | `exportBundle` (PRD item 27/M2) | a `close[].sha256` the spec carries does not match the bytes of the script actually being packed into the bundle — the two signatures (this one, and `bundleHash`'s manifest hash over the rewritten script) cover the same bytes by two different paths and must never drift apart silently (N4's own hazard, one layer up). Only fires when a value is PRESENT and wrong; a spec with no sha256 at all reds `missing-required` upstream, at `validateJob` |
 | `close-tampered` | `runPlan` (PRD item 27/M2) | a close script's bytes no longer match its signed `sha256` — checked at run start (alongside `close-absolute-path`, before the close-first precheck and before any provider call) AND before EVERY close run thereafter (`runCloseStages`'s wrapper in `src/planrun.js`, the one seam the precheck/preflight/check-passes/close-fix-loop all share). Distinct from `close-red` (a judged "no" from a working close) and from `close-crashed`/`close-timeout`/`close-killed` (the close ran and hit an instrument fault): this is decided BEFORE the close is even spawned, and it means the close that ran would not have been the one the operator approved. Registered in `CLOSE_FAULTS` (`src/ralph.js`) so it rides out through the same forbidden-zone machinery as every other close fault — never retried, never fed back as a gap |
 | `close-dir-required` | `runPlan` (PRD item 27/M3 Part B) | a close script's source mentions `BARELOOP_CLOSE_DIR` (it reads its own books directory) but the runner was given no `closeDir` at all — `checkCloseDirRequired` (`src/close-integrity.js`) reuses the same `readCloseScripts` reader the other two integrity checks share. $0, run start, before the close-first precheck and before any provider call |
-| `close-timing-red` | `runPlan` (PRD item 27/M3) | the $0 timing preflight (`resolveCloseTimeoutMs`/`timeCloseStages`, `src/closetimeout.js`) ran every close stage once, ignoring verdicts, and at least one never finished within the provisional ceiling (`TIMING_PREFLIGHT_CEILING_MS`, the library default × K = 600s) — the close cannot run on this machine in a boundable time. Only reachable when NEITHER a signed `job.closeTimeoutMs` NOR a caller-passed runtime override is present (both skip the pass entirely). `scripts/run-u.mjs`'s review door hits the SAME red on its own `accept` timing pass (F137) — it refuses the door outright rather than calling `answerReviewDoor` at all, so nothing is recorded |
+| `close-timing-red` | `runPlan` (PRD item 27/M3) | the $0 timing preflight (`resolveCloseTimeoutMs`/`timeCloseStages`, `src/closetimeout.js`) ran every close stage once, ignoring verdicts, and at least one never finished within the provisional ceiling (`TIMING_PREFLIGHT_CEILING_MS`, the library default × K = 600s) — the close cannot run on this machine in a boundable time. Only reachable when NEITHER a signed `job.closeTimeoutMs` NOR a caller-passed runtime override is present (both skip the pass entirely). `src/userrun.js`'s (lifted out of `scripts/run-u.mjs` by PANEL-BUILD.md P0) review door hits the SAME red on its own `accept` timing pass (F137) — it refuses the door outright rather than calling `answerReviewDoor` at all, so nothing is recorded |
 | `wall-under-close-timeout` | `runPlan` (PRD item 27/M3) | `job.maxWallMs` is set and is under the EFFECTIVE per-stage close timeout just resolved (autoset or signed) — a budget under one close cannot fund its own close. `validateJob`'s own `MIN_WALL_MS` floor only bounds the un-autoset library default; this run-start check is the honest shape once the real ceiling is known, rather than a silent clamp |
 | `bundle-missing` | `readBundle` | `dir` is not a directory at all |
 | `manifest-invalid` / `spec-invalid` | `readBundle` | `manifest.json`/`spec.json` could not be read or parsed |
@@ -2944,7 +3065,7 @@ between a swapped script and a fake green, so `bareloop run` calls it as literal
 before the envelope check, before the key check, before the worktree, before `runJob` is
 ever reached.
 
-#### The CLI — `bareloop export | run | history`, `bin/bareloop.mjs`
+#### The CLI — `bareloop export | run | history | replay | run-u | interview | author`, `bin/bareloop.mjs`
 
 `bin/bareloop.mjs` is a ~10-line adapter: it supplies the real `deps` (real `env`/`stdout`/
 `stderr`/`cwd`/`stdin`) and turns the returned number into `process.exitCode` — never
@@ -2959,7 +3080,12 @@ same seam `tests/planrun.test.js` uses. `deps` also accepts `env`, `stdout`, `st
 
 Bare `bareloop` (no sub-command) prints a numbered menu — `1 export  2 run  3 history  q
 quit` — and asks each sub-command's arguments one line at a time over the SAME code paths
-below.
+below. `run-u`, `interview` and `author` (below) are not on this menu (PANEL-BUILD.md P0
+tasks 2/4-4/4): each one's own flag grammar is too wide for a line-at-a-time wizard, and the
+menu's job is to ask the SAME questions the sub-command below already answers, never to
+invent a new interview — this is doubly true for `interview`/`author`, which already ARE
+interviews of their own. All three are dispatched by name only: `bareloop run-u <flags…>`,
+`bareloop interview <flags…>`, `bareloop author <flags…>`.
 
 - **`bareloop export <jobs/x.json> --registry <dir> --out <dir>`** → resolves the spec's
   close-script paths against the spec file's own directory (never the process cwd), calls
@@ -3001,7 +3127,7 @@ below.
      readShim: 'cap', scout: true })`, spine written to `<bundleDir>/runs/<runid>/spine.jsonl`.
      A thrown `runJob` crash is caught and reported, exit `1`.
   8. The worktree's `gate-audit.jsonl` is moved to `<bundleDir>/runs/<runid>/gate-audit.jsonl`
-     (same relocation `scripts/run-u.mjs` does for in-repo runs). `spentUsd`/`spendComplete`
+     (same relocation `src/userrun.js`, lifted out of `scripts/run-u.mjs`, does for in-repo runs). `spentUsd`/`spendComplete`
      are read off this run's own `job-end` spine event — never fabricated as `0` when unknown.
   9. `appendHistory` — one `history.jsonl` line: `{ runid, at, outcome, spentUsd,
      spendComplete, budgetUsd, maxWallMs, worktree, branch, bundleHash, approveHash }` (the
@@ -3035,9 +3161,92 @@ below.
   when none matches — which, cross-machine, is the common case, since the historic mint's
   real close-script path and the importer's own bundle path essentially never coincide.
 
-- **`bareloop history <bundleDir>`** → prints every `history.jsonl` line verbatim, then
-  every bridge's `listingRow(b)` from `<bundleDir>/bridges`. Always exit `0`; "(no runs
-  yet)" when `history.jsonl` doesn't exist.
+- **`bareloop history <bundleDir>`** → prints every `history.jsonl` row (via
+  `readHistoryLog` — `src/replayio.js`, PANEL-BUILD.md P0's last task; a malformed row is
+  counted and skipped, never reprinted corrupt), re-serialized with `JSON.stringify` (byte-
+  identical to the original line for every well-formed row, since `appendHistory` itself
+  writes `JSON.stringify(row)` — `src/bundle.js`), then every bridge's `listingRow(b)` from
+  `<bundleDir>/bridges`. Always exit `0`; "(no runs yet)" when `history.jsonl` doesn't exist.
+
+- **`bareloop replay <spine.jsonl>`** / **`bareloop replay --all <dir>`** (PANEL-BUILD.md
+  P0, last of the rung's four tasks) → the read side for the panel's History/Run/Audit/Job
+  tabs: point it at one run's spine (+ its `-gate-audit.jsonl` sidecar, resolved
+  automatically) and get `formatReplay`'s one-page report; point `--all` at a directory and
+  get every spine found directly in it as one aligned table row each
+  (`formatAllLines`/`summarizeForAllLine`). Read-only, $0, mints no verdict, writes nothing.
+  Lifted verbatim out of `scripts/run-replay.mjs` into `src/replayio.js` (see the Public API
+  entry below); that script is now this command's own thin adapter (`bareloop replay` is a
+  fresh sub-command name — `bareloop`'s own numbered menu is unchanged, same reasoning as
+  `run-u`/`interview`/`author` above). A `.jsonl` that carries no `job-start`/`run-start`
+  record — content-detected, never by filename pattern (the real archive uses `u-<id>`,
+  `battery-A1-<id>`, `reuse-<id>`, `job2-<id>`, and more, with no shared convention) — errs
+  `does not look like a spine`, exit `1`, rather than silently printing an empty report; a
+  directory of only such files under `--all` prints each as `<name>  not-a-spine` instead of
+  a blank table. Exit `0` on a normal report/listing (regardless of the RUN's own outcome —
+  this command reports, it never grades), `1` on a missing file/directory or a non-spine
+  file, `1` with a usage line on no args.
+
+- **`bareloop run-u <flags…>`** (PANEL-BUILD.md P0 task 2/4) → the person-path run flow
+  (the JOBS-table/`--spec` runner, resume, the review door — `docs/logs/FINDINGS.md`'s
+  U-mode). `src/cli.js`'s `run-u` dispatch hands `rest` straight to
+  **`src/userrun.js`'s own `main(argv, deps)`**, unparsed — that function is the flag
+  grammar's ONE owner, and `scripts/run-u.mjs` calls the exact same function directly, so
+  there is exactly one place this grammar is parsed, never two that can drift). Flags:
+  `--job <key>` (one of the JOBS table's rows) **or** `--spec <path>` (an authored
+  `resolved-spec.json`, F185) — exactly one, never both, never neither; `--resume
+  <runid|path>`; `--door <runid|path>` with `--decide <rerun|accept|pause>` and (`rerun`
+  only) `--text <…>`; `--review-door`; `--approve <specHash>`; `--registry <dir>` +
+  `--workflow <name>`; `--model <sonnet|haiku>`; `--read-shim <off|cap|diff|all>`; `--scout
+  <on|off>`. No key/no injected `deps.provider`: prints the preview (invocation hints, the
+  right key name for the job's own provider) and exits `0`, spending nothing — the same
+  preview `scripts/run-u.mjs --job <x>` prints with no `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`
+  set. `scripts/run-u.mjs` is unchanged in behaviour: it is the pre-existing thin adapter
+  over this same `src/userrun.js:main`, not rewired to go through `src/cli.js`.
+
+- **`bareloop interview <flags…>`** (PANEL-BUILD.md P0 task 3/4) → the close-authoring
+  interview, at the terminal, one question at a time (D10; `docs/logs/FINDINGS.md`'s
+  interview surface). `src/cli.js`'s `interview` dispatch hands `rest` straight to
+  **`src/interviewrun.js`'s own `main(argv, deps)`**, unparsed — the same one-owner shape
+  `run-u` uses, and `scripts/run-interview.mjs` calls the exact same function directly.
+  Flags: `--verdict <green|soft-green>`, `--provider <anthropic-api|openai-api|gemini-api>`,
+  `--out <outdir>` (all three required, no defaults — PRD item 34 L17: a defaulted provider
+  would silently re-lock every interview onto one vendor) plus optional `--budget <usd>` (the
+  AUTHORING ceiling, unbounded if omitted) and `--base-url <url>`. It never talks to a
+  provider itself: Source and Destination are its own first two questions (proven
+  mechanically, $0, via `prepareSource`/`proveDestination`), then the picked class's frozen
+  question set (`questionsFor`/`requiredAnswersFor`, `src/authorjob.js`), then the operator's
+  own job name/budget/wall. On success it writes `answers.json`/`specdraft.json` under `--out`
+  and either offers to spawn `scripts/run-author.mjs` (only when a clean key is present and no
+  install gap remains — default answer is no) or prints the exact command to run it later.
+  Because this module reads a real TTY/piped stdin, `src/cli.js` hands it `stdin`/`stdout`/
+  `stderr` (the raw streams, not the wrapped `out`/`err` line-functions every other command
+  here uses) rather than re-deriving them.
+
+- **`bareloop author <flags…>`** (PANEL-BUILD.md P0 task 4/4) → the authoring pipeline: a
+  real scout over a real repository, a real model filling the close declaration, D9's three
+  mechanical gates, stopping at `prepareSigning` (it never signs and never runs the job —
+  signing and running are `run-u`'s territory). `src/cli.js`'s `author` dispatch hands `rest`
+  straight to **`src/authorrun.js`'s own `main(argv, deps)`**, unparsed, the same one-owner
+  shape; `scripts/run-author.mjs` calls the exact same function directly. Flags: `--source
+  <tree>` (a PREPARED tree a source door already froze — an unprepared path dies loud, naming
+  the exact command to prepare one), `--answers <answers.json>`, `--draft <specdraft.json>`,
+  `--verdict <green|soft-green>`, `--out <outdir>` (all required) plus optional `--timeout
+  <ms>` (default 300000, per close stage) and `--budget <usd>` (the AUTHORING ceiling —
+  unbounded, and announced as such, if omitted). A REFUSAL IS A RESULT: every stop (an
+  interview refusal, an unauthorable close, a stage that cannot run, nothing red at the seed)
+  is written to `--out` and counted as admission demand on the module's own spine
+  (`author-<runid>.jsonl`), never swallowed. Exit vocabulary: `0` prepared/signable, `1` a
+  refusal or a failed gate, `2` operator/config (including a malformed or missing provider
+  key), `3` a secret-shaped leak in what this run wrote, `4` an unhandled crash (`author-crash`
+  + `author-end{outcome:'crashed'}` on the spine — a spine that stops mid-sentence is
+  indistinguishable from a run still in flight, F191). A real OS signal (SIGINT/SIGTERM/
+  SIGHUP) during the paid span still writes `author-killed` + `author-end{outcome:'killed'}`
+  and then RE-RAISES the signal itself (128+signo), never invents an exit code; SIGKILL is
+  named but, being uncatchable, cannot be covered. The library function itself never calls
+  `process.exit()` anywhere, on any path — every stop is a returned exit code (an internal
+  `throw new ExitSignal(n)`, caught at the bottom of `main`), the same "a library function
+  returns a code / throws" rule `src/userrun.js` already keeps. Like `interview`, `src/cli.js`
+  hands it raw `stdin`/`stdout`/`stderr` (its one interactive seam is the confirm turn).
 
 **Tighten-only budget/wall.** `--budget`/`--wall` on `bareloop run` may only lower the
 bundle's own signed `budgetUsd`/`maxWallMs` — `checkEnvelope`'s `envelope-widen` red refuses
@@ -3202,6 +3411,37 @@ freeze loop never trusts a buffer read a moment earlier), `into-exists`,
 refusal never throws, never overwrites a person's file, and never lands a destination inside
 the run's own scratch tree.
 
+**`prepareSource` copies ONLY git-tracked files** (hamr's ruling, unchanged) — a JS/TS repo's
+prepared copy therefore never carries `node_modules`, and every close stage that needs a tool
+(`tsc`, a test runner) would instrument-stop with nothing telling the person why. bareloop
+NEVER runs an install itself — it only ever touches gated primitives, never a shell-out to
+`npm`/`pnpm`/`yarn`/`bun` on the person's behalf. `missingDependencies` is exported ($0,
+JS/TS only for now — other languages return `null`, M3b's job): it takes `(treeDir,
+sourceSubdir?)` and walks from `sourceSubdir` up to `treeDir` (the same nearest-manifest rule
+`detectLanguage` uses, done independently to avoid a `source.js` ⇄ `detectlang.js` import
+cycle), and when the nearest `package.json` names a non-empty `dependencies`/`devDependencies`
+with no sibling `node_modules`, it returns `{manager, command, reason}` — the exact install
+line (`npm ci`/`pnpm install --frozen-lockfile`/`yarn install --frozen-lockfile`/`bun install
+--frozen-lockfile` by lockfile, else `npm install`), `cd`-prefixed for a subfolder job. An
+invalid `package.json`, no manifest found, or `node_modules` already present all return `null`
+— "cannot tell" is never a fabricated gap. `run-interview.mjs` prints the gap and the exact
+command right after `prepareSource` succeeds, and now PAUSES there (F182 fix, 2026-09-15):
+"Press Enter once it has finished to check again, or type skip to carry on without it" —
+Enter re-runs `missingDependencies` on the spot ("packages found — carrying on." or "still
+missing (…) — try again, or type skip to carry on without it.", looping), `skip` (or end of
+input, treated the same) carries on unresolved. It re-checks once more at the hand-off: a
+still-open gap suppresses the "Run it now?" offer entirely (the same shape the unkeyed-shell
+gate already uses) rather than spending on a run that would only instrument-stop — this is
+what the pause makes reachable: before the fix the interview fell straight through to the
+class questions and only ever re-checked once, too late for the offer to ever fire.
+`run-author.mjs` refuses
+`source-deps-missing` (a `request-red`, routed through the same `refusalEvents()` channel
+`language-unsupported` uses) at $0, before the scout and before the provider/key are even
+read. Once the person installs packages into the copy themselves, `prepareSource` has already
+hidden `node_modules` from `changedSet` via the copy's own PRIVATE `.git/info/exclude` (F177),
+so those installed files never read as the worker's own writes — the source repo's tracked
+`.gitignore` is never touched.
+
 **Destination is a DIRECTORY, never a filename** (D3 rework, hamr's ruling, 2026-09-12,
 condensed in `docs/product/ITEM33-BUILD.md`). It may already exist and need not be empty; it
 may sit inside the source itself (the same-dir case: "i can limit your actions to a certain
@@ -3229,7 +3469,8 @@ on a green then that would be the place agent allowed to do changes") — it nam
 FENCE inside the copied repo, the signed `writeScope` field's job (`src/job.js:363`), never a
 filesystem drop-off point. It is recorded as declared, never proven by `proveDestination` and
 never handed to `copyOut` (`frontDoorFromManifest` returns `null` for a repo manifest).
-Wiring it into `writeScope` landed at M3, ruling 2 — `scripts/run-interview.mjs` parses its own
+Wiring it into `writeScope` landed at M3, ruling 2 — `src/interviewrun.js` (lifted out of
+`scripts/run-interview.mjs` by PANEL-BUILD.md P0) parses its own
 Destination answer straight into `draft.writeScope` for a repo Source; this door itself still
 only records what it was told, unvalidated, exactly as before.
 
@@ -3252,7 +3493,7 @@ run — the same way `bareloop run <bundle> --repo <path>` varies the repo insta
 touching the bundle's own signature. So `job.js`/`jobSpecHash` carry nothing about it: the
 run's own instance lives entirely in the manifest `prepareSource` writes.
 
-`scripts/run-u.mjs` reads that manifest via `readSourceManifest(dirname(workdir))` (`workdir`
+`src/userrun.js` (lifted out of `scripts/run-u.mjs` by PANEL-BUILD.md P0) reads that manifest via `readSourceManifest(dirname(workdir))` (`workdir`
 IS `<into>/tree`, so its parent is `<into>`) and reduces it with `frontDoorFromManifest`. No
 manifest → no front-door behaviour at all — every existing repo-patient job is untouched. A
 manifest that exists but cannot be read or parsed is a named stop, never a silent skip. When
@@ -3269,6 +3510,23 @@ Not wired yet, named rather than silently absent: `bareloop run` (the exported b
 33/M5. The intake form that lets a person fill in Source/Destination through the authoring
 interview (rather than the CLI above) is item 33/M3, not yet built.
 
+**Running an authored spec needs no developer hand-step any more (F185, fixed 2026-09-16).**
+`scripts/run-u.mjs --spec <path to resolved-spec.json>` is an alternative to `--job <key>`
+(both, or neither, is a loud $0 refusal): it `validateJob`'s the spec on disk explicitly and
+early, then finds the ONE `source-*/` sibling directory beside it that carries a
+`source.json` (`run-interview.mjs` prepares the source door and invokes `run-author.mjs`
+against the same `--out`, so `resolved-spec.json` and `source-<runid>/{source.json,tree/}`
+are always siblings) and reads the workdir (`<that dir>/tree`) and seed off that SAME
+manifest `readSourceManifest` already serves elsewhere — never typed, guessed, or defaulted.
+No sibling, more than one, a missing seed, or a gone tree each refuse by name. Everything
+past that resolution — the `--approve <jobSpecHash>` signature, budget/wall ceilings,
+coldReset, the close-first precheck — is untouched: `--spec` only NAMES the job, exactly as
+a `--job` row does. `src/authorrun.js`'s (lifted out of `scripts/run-author.mjs` by
+PANEL-BUILD.md P0) "SIGNING PREPARED — NOT SIGNED" screen now
+prints the ready-to-paste `--spec` command (real path, real `--approve <hash>`, the
+provider's real env-key per F187) — a person finishing the interview alone can reach a
+running job with no `jobs/` edit and no JOBS-table row.
+
 ## Architecture
 
 Three layers. An **outer shell** (dumb, permanent): per-run budget cap via bareguard,
@@ -3337,6 +3595,18 @@ under it — this is a passthrough, not a jail.
   denies the gate audit path and every `ARBITER_BOOK_STORES` path under the workdir
   (`src/authorscout.js:295`); a plan step's read scope is the workdir alone
   (`src/planrun.js:1894`).
+- **A signed fence can never name `.git` or `node_modules` (F178/F177).** `scopeContained`
+  (`src/validate.js`, design law #1's own function — `validateJob`'s `writeScope` and
+  `validatePlan`'s step `scope`/exit `target`/`path` all go through it) refuses any fence/scope
+  whose normalized prefix has a whole path segment equal to `.git` or `node_modules` — not a
+  look-alike like `.github/**`, `my.git/**`, or `node_modules_util/**`. That alone cannot catch
+  a NESTED `node_modules` reachable through an otherwise-legal fence (a monorepo package scope,
+  or one a worker creates fresh during the run) — bareguard's `fs.deny` is exact
+  prefix-containment only, no glob, so it cannot express "at any depth" even if it were used
+  here. **`fs.deny` is deliberately NOT used for either book**: it blocks ALL fs actions,
+  reads included, and hamr's ruling blocks WRITING only — reading stays allowed. The runtime
+  belt is `tools.denyArgPatterns` (`FORBIDDEN_WRITE_SEGMENT_PATTERN`, `src/planrun.js`): keyed
+  to `write`/`edit` ONLY, matched against the serialized action's `path` field, whole-segment.
 
 **What it does not guarantee:** no network egress control and no container/VM isolation —
 this repo has neither built nor documented either. `CLOSE_ENV_DENY`'s deny rule matches