bareloop 0.27.0 → 0.29.0

package/src/userrun.js

@@ -0,0 +1,2299 @@
+// The person-path run — the WHOLE flow (`--job`/`--spec`, `--resume`, `--door`)
+// lifted out of `scripts/run-u.mjs` into one library module (PRD PANEL-BUILD.md
+// P0; hamr: "i think run-u one libary is better to prevent drift", then
+// "agreed, one module three thin doors"). One internal engine (`execute`,
+// below) and three thin named doors onto it — `startRun`, `resumeRun`,
+// `answerDoor` — replacing the flag-driven entry `scripts/run-u.mjs` used to
+// be. `scripts/run-u.mjs` is now a thin adapter over `main(argv, deps)` here,
+// the same ~10-line shape `bin/bareloop.mjs` already is over `src/cli.js`.
+//
+// This is a LIFT, not a rewrite: the orchestration below is
+// `scripts/run-u.mjs`'s own body, unchanged in its logic — every
+// `console.log`/`console.error` became `out`/`err`, and every
+// `process.exit(n)` became `throw new ExitSignal(n)` (a library function may
+// never call `process.exit` itself). The semantics it calls (`runJob`,
+// `answerReviewDoor`, `readResume`, `replayRun`) were already library before
+// this move and are untouched; `src/replay.js` stays exactly where it is and
+// is not a door.
+//
+// U — the user-mode e2e. ONE run: one sentence of problem, a budget, a clock, one
+// close. No arms, no operator-authored checks, no hand-solving, no retry logic —
+// a run that dies comes back to hamr with the cause (standing rule, 2026-07-26).
+//
+// Acceptance (hamr, LAYERS §4): the workflow need not green everything — it must
+// green ONE job end to end. That green GRADUATES the bridge: the plan the agent
+// authored is preserved from the spine as a reusable artifact, and the next run of
+// this shape reuses and fine-tunes it rather than starting cold.
+import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, renameSync, rmSync, readdirSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { execFileSync, spawn } from 'node:child_process';
+import { join, resolve, dirname } from 'node:path';
+import { runJob } from './run.js';
+import { jobSpecHash, resolveWorkerModel, validateJob } from './job.js';
+import { readShimArm } from './readshim.js';
+import { closeStagesOf } from './plan.js';
+import { resolveCloseTimeoutMs } from './closetimeout.js';
+import { makeSpine } from './spine.js';
+// PRD item 33/M2 — the source front door. `readSourceManifest` finds the
+// per-run instance a `prepareSource` patient carries beside its tree (never
+// signed into the job spec — a job is a repeatable SHAPE, the source/
+// destination a per-run value, exactly like `bareloop run <bundle> --repo
+// <path>` varies the repo without touching the bundle's signature).
+import { readSourceManifest, frontDoorFromManifest, proveDestination, copyOut } from './source.js';
+import { scanSecrets, redactSecrets } from './validate.js';
+import { runBehaviour, formatBehaviour } from './behaviour.js';
+// the three doors' SEMANTICS live in the library; this script surfaces them
+import { normalizeHumanRuling, resolveHumanRuling, closeJudges, judgedStages } from './kinds.js';
+// SOFTGREEN — the judged stage's PINNED tier. The constant is the library's; a
+// spelling here would be a second pin that can drift from the one the gate calibrated.
+import { resolveJudge } from './judged.js';
+// --resume reads the halted run's own spine back through the SAME reader the reuse
+// path uses (never a second one) and keeps its patient the way it left it.
+import { readResume, resumeTreeGate, checkpointAgeGate, writeRunGreenRow, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS } from './reuse.js';
+// PRD item 28's provider factory (src/providers.js): the WORKER provider's
+// ctor/envKey/tier-table/param-gating come from here now — one seam instead
+// of an `if (provider === …)` scattered across this script. PRD item 32.2
+// moved the JUDGE onto this SAME factory: it used to be separately pinned
+// below to a hardcoded Anthropic constructor at the judged tier because the
+// judge could only ever be Claude — now that its identity is RESOLVED
+// (`resolveJudge`, imported above) rather than pinned, building it through a
+// second bespoke constructor would be a second seam for the same job the
+// worker's already goes through. `tests/reviewdoor-u.test.js` greps this
+// file's own source to prove THIS runner actually wires the resolved judge
+// through `makeProvider` into `runJob` (not just that the library can).
+import { resolveProvider, makeProvider, probeWarningLines, apiKeyProblem } from './providers.js';
+import { loadRegistry, quarantinesCredit } from './bridges.js';
+import { HITL_PAUSE } from './declaredclose.js';
+// the REVIEW DOOR (module 8): the library opens it on the run's own spine, and this
+// is the seam that answers one. Same rulebook, one level out.
+import { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
+// the cold reset, shared with the battery drivers so "cold" has one spelling
+import { coldReset, moveStaleGateAudit } from './u-patient.js';
+// PANEL-BUILD.md P1 — the one run list (`~/.config/bareloop/runs.jsonl`).
+import { appendRun } from './runlist.js';
+// the banner's wall arithmetic, extracted so it is reachable by a test (F83): the
+// end-of-run readout sits past the approval gate, so nothing could ever drive it here
+import { wallLine, doomedResume, deathAtOf, evidencePackage, doorLines, resumeAtLines, reviewDoorPackage, runDoorLines, tokensLine, doorTimingRedLines } from './u-readout.js';
+
+const require = createRequire(import.meta.url);
+const { AnthropicProvider } = require('bare-agent/providers');
+
+const JOBS = {
+  'aurora-spawner': {
+    spec: 'aurora-u-spawner-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/aurora-u',
+    spine: 'aurora-u-bareloop',
+    seed: 'd661e507c5cd0981368d90ed3e3abf6e2bb9ed18',
+  },
+  'litectx-types': {
+    spec: 'litectx-u-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/litectx-u',
+    spine: 'litectx-u-bareloop',
+    seed: '96813a43bbcbac6a808ff610c6751a8736e2903e',
+  },
+  'pulselog-types': {
+    spec: 'pulselog-u-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/pulselog-u',
+    spine: 'pulselog-u-bareloop',
+    seed: '92d71a7c1253f8f2430e2d308ecfef01c826b5c2',
+  },
+  // Bench row G3 (the NEGATIVE row) — the planted contract contradiction
+  // (docs/product/G3-SCOPING.md). A copy of the pulselog-u patient (patients are
+  // always copies) with one extra commit: two test/** files that pin
+  // assembleEmail's subject to two different strings, unsatisfiable together
+  // inside writeScope: src/**. Not frozen, not signed, no run — BUILT ON BRANCH
+  // per hamr's 2026-09-01 order; he reviews the diff before this row ever fires.
+  'pulselog-g3': {
+    spec: 'pulselog-g3-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/pulselog-g3',
+    spine: 'pulselog-g3-bareloop',
+    seed: '54d18935dd310ec1986bdc2b37cebbc6999efc10',
+  },
+  // the first AUTHORED close (closeDecl, not a hand-written close script) — the
+  // sign-and-run e2e: same patient/seed as 'pulselog-types', close declared by the
+  // authoring interview (run msmsy579) instead of by hand.
+  'pulselog-author-types': {
+    spec: 'pulselog-author-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/pulselog-author-live',
+    spine: 'pulselog-author-live-bareloop',
+    seed: '92d71a7c1253f8f2430e2d308ecfef01c826b5c2',
+  },
+  // the first spec authored through the PERSON path (run-interview.mjs →
+  // run-author.mjs, DeepSeek deepseek-flash, run mu2js0c0) rather than the
+  // AUTHOR path above — hash fc3d5a1b… (resolved-spec.json copied verbatim into
+  // jobs/, re-verified before and after the copy). workdir is the M2 source
+  // front door's own prepareSource copy (source-mu2bglzc/tree), not the patient's
+  // top level, so the spine dir lands nested one level deeper than its neighbours'
+  // — noted, not a defect in this row.
+  'pulselog-person-strict': {
+    spec: 'pulselog-person-strict-checks.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/pulselog-person-live-2/out/source-mu2bglzc/tree',
+    spine: 'pulselog-person-live-2-bareloop',
+    seed: 'b57e692c000570e7586787f2d2e3b027a5fa6011',
+  },
+  'baremobile-types': {
+    spec: 'baremobile-u-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/baremobile-u',
+    spine: 'baremobile-u-bareloop',
+    seed: 'd9b318fac78036bd3db35f68c4b1eb5ee634244d',
+  },
+  // Bench row G2 (the NEGATIVE row) — TESTGEN cold start in plan-v1. The legacy
+  // steps[] config went 0-of-43 (F38); this config's rate is UNKNOWN until its
+  // establishing run. Same patient/seed/grader as the l2accept battery
+  // (TESTGEN-PREREG); the spec is the cold goal. See docs/product/G2-SCOPING.md.
+  'aurora-testgen-cold': {
+    spec: 'aurora-testgen-cold.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/aurora-soar',
+    spine: 'aurora-soar-bareloop',
+    seed: 'd661e507c5cd0981368d90ed3e3abf6e2bb9ed18',
+  },
+  'bareagent-types': {
+    spec: 'bareagent-u-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/bareagent-u',
+    spine: 'bareagent-u-bareloop',
+    seed: '0037182a5a369d380e1635e0e4ab13e3557cfab9',
+  },
+  'bareguard-types': {
+    spec: 'bareguard-u-types.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/bareguard-u',
+    spine: 'bareguard-u-bareloop',
+    seed: '2ae8fcd37041c186524a6eb5e953b9752cd602fa',
+  },
+  // PRD item 28 / 30.9 — the openai-api probe through THIS runner (the shipped
+  // one), not poc-run-param.mjs. Same job shape, same seed, its own patient copy.
+  'bareguard-types-deepseek': {
+    spec: 'bareguard-u-types-deepseek.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/bareguard-u-deepseek',
+    spine: 'bareguard-u-deepseek-bareloop',
+    seed: '2ae8fcd37041c186524a6eb5e953b9752cd602fa',
+  },
+  // N4's hitl PROVING job (build plan §Proving; hamr's ruling, 2026-08-13). The job
+  // has been dark since 507adbb deleted the legacy `steps[]` path its old spec was
+  // written against, and it comes back as a plan-flow job with an AUTHORED close.
+  //
+  // `jobs/litectx-maintainer.json` DOES NOT EXIST, and this row does not create it:
+  // the spec is authored live through scripts/run-interview.mjs → run-author.mjs and
+  // signed by hamr, goal and answers included. Until it lands the runner refuses by
+  // name (see the spec read below) — a row is the runner's half of a job, never the
+  // signer's. The patient is a COPY at the convention this table already uses, and
+  // the seed is that copy's own HEAD (litectx v0.32.0, 115213d).
+  'litectx-maintainer': {
+    spec: 'litectx-maintainer.json',
+    workdir: '/home/hamr/PycharmProjects/bareloop-patients/litectx-maintainer',
+    spine: 'litectx-maintainer-bareloop',
+    seed: '115213dcb4c9f468c1045a212e6802456ed9119e',
+  },
+};
+
+// CLOSE_TIMEOUT_MS retired (PRD item 27/M3, 2026-09-07): a hardcoded 900s cap
+// was a defaulted second ceiling with no operator-set floor, exactly the shape
+// `maxWallMs`'s own no-default rule already forbids. The per-stage ceiling is
+// now resolved once, below, before the watchdog is even spawned (F67 needs
+// the real number to size its stale/grace windows) — `resolveCloseTimeoutMs`
+// (src/closetimeout.js) is the ONE place this precedence is spelled out, and
+// `src/planrun.js`'s own in-run resolution goes through the identical function.
+// The close-fix loop's RETIRED iteration cap (PRD v1.46 §4). It no longer governs:
+// that loop now stops on the same 2-strike no-progress rule the step ladder uses,
+// read off the close's own per-stage numbers. This number survives as the bound for
+// the one case that rule cannot read — a close whose output carries no number at all
+// — because a governor that cannot see the variable must not be the governor.
+const CAP_RUNS = 4;
+// The step ladder's strike ceiling (src/ladder.js). Shell-owned, exactly where the
+// step's fixed count used to be: a step ends when it stops making progress, not
+// after N tries, and this is the number of no-progress iterations it is allowed.
+const STRIKE_LIMIT = 2;
+/** Thrown to unwind the engine to an exit code without ever calling
+ * `process.exit()` (constraint: a library function returns a code / throws,
+ * it never calls `process.exit` itself). Caught at the bottom of `execute`
+ * and of `main` — never expected to escape either. */
+class ExitSignal extends Error {
+  /** @param {number} code */
+  constructor(code) {
+    super(`exit ${code}`);
+    this.code = code;
+  }
+}
+
+/**
+ * @typedef {object} Deps
+ * @property {Record<string,string|undefined>} [env]
+ * @property {(s: string) => void} [out]
+ * @property {(s: string) => void} [err]
+ * @property {any} [provider] the TEST SEAM: supplying this skips the real-key
+ *   check entirely, the same shape `src/cli.js`'s `main(argv, deps)` uses.
+ * @property {(tier: string) => any} [providerFor]
+ * @property {any} [judgeProvider]
+ * @property {string} [runlistHome] F196 — a test seam for `appendRun`'s
+ *   (src/runlist.js) `home` override, the same shape `deps.provider` already
+ *   is. Production never sets it; `appendRun` falls through to its own
+ *   `os.homedir()`-based default.
+ */
+
+/**
+ * @typedef {object} RunOpts
+ * @property {any} [spec] the parsed, not-yet-validated job spec — read by
+ *   `resumeRun`/`answerDoor`, whose positional argument is the runid rather
+ *   than the spec (unlike `startRun`, which takes `spec` positionally and
+ *   never reads this).
+ * @property {string} [workdir] the patient's tree
+ * @property {string} [seed] the patient's frozen seed commit
+ * @property {string} [spineName] the spine directory name, beside `workdir`
+ * @property {string|null} [model] the raw `--model` tier name (`sonnet`/`haiku`), or null for the default
+ * @property {string|null} [readShim] the raw `--read-shim` arm name, or null for the default
+ * @property {string|null} [scout] the raw `--scout` value (`on`/`off`), or null for the default
+ * @property {string|null} [registry] a bridge registry directory
+ * @property {string|null} [workflow] the registry's workflow name (defaults to `spec.job`)
+ * @property {string|null} [approve] the spec hash being signed; omitted previews only
+ * @property {boolean} [reviewDoor] opt in to a green-class run opening a review door
+ * @property {string} [selector] how the re-invocation commands this prints should name the job (`--job x` / `--spec <path>`)
+ * @property {string} [specDesc] how a "go edit the spec" hint should read
+ * @property {Deps} [deps]
+ */
+
+/**
+ * @typedef {object} RunCtx
+ * @property {any} spec
+ * @property {string} specPath
+ * @property {string} selector
+ * @property {string} specDesc
+ * @property {string} workdir
+ * @property {string} seed
+ * @property {string} spineName
+ * @property {string|null} model
+ * @property {string|null} readShim
+ * @property {string|null} scout
+ * @property {string|null} registry
+ * @property {string|null} workflow
+ * @property {string|null} approve
+ * @property {boolean} reviewDoor
+ * @property {string|null} resume
+ * @property {string|null} door
+ * @property {string|null} decide
+ * @property {string|null} text
+ * @property {Deps} deps
+ */
+
+/**
+ * The one internal engine (PANEL-BUILD.md P0, hamr: "one library to prevent
+ * drift", then "agreed, one module three thin doors"). This is
+ * `scripts/run-u.mjs`'s own body, byte-for-byte in its ORCHESTRATION (the
+ * semantics it calls — `runJob`, `answerReviewDoor`, `readResume` — are
+ * already library and untouched): every `console.log`/`console.error`
+ * became `out`/`err`, and every `process.exit(n)` became `throw new
+ * ExitSignal(n)` (caught at the bottom of this function) so the library
+ * never calls `process.exit` itself — the same shape `src/cli.js`'s
+ * `main(argv, deps)` already uses.
+ *
+ * `startRun`/`resumeRun`/`answerDoor` (below) are the three thin doors: each
+ * builds this same shaped `ctx` and hands off to this one function — the
+ * engine is written once, and the doors differ only in how they arrive at
+ * `ctx.resume`/`ctx.door`/`ctx.decide`/`ctx.text`.
+ * @param {RunCtx} ctx
+ * @returns {Promise<number>} an exit code — never calls process.exit
+ */
+async function execute(ctx) {
+  const deps = ctx.deps ?? {};
+  const env = deps.env ?? process.env;
+  const out = deps.out ?? ((/** @type {string} */ s) => { console.log(s); });
+  const err = deps.err ?? ((/** @type {string} */ s) => { console.error(s); });
+  /** every operator/config stop this engine makes, in one exit code — thrown,
+   * never `process.exit()`'d, so this stays a library function (constraint:
+   * "never process.exit() inside the library — return an exit code").
+   * `@returns {never}` is load-bearing, not decorative: it is what lets tsc
+   * narrow every `let x; try { x = ... } catch { die(...) }` site below to a
+   * defined `x` afterward, honestly, because `die` truly never returns.
+   * @param {string} m
+   * @returns {never} */
+  const die = (m) => { err(m); throw new ExitSignal(2); };
+  let exitCode = 0;
+  try {
+  const spec = ctx.spec;
+  const specPath = ctx.specPath;
+  const SELECTOR = ctx.selector;
+  const SPEC_DESC = ctx.specDesc;
+  /** @type {{workdir: string, seed: string, spine: string}} */
+  const target = { workdir: ctx.workdir, seed: ctx.seed, spine: ctx.spineName };
+
+  // --model picks the DEFAULT worker tier (runner territory — the spec names no model, so
+  // the signed hash is unaffected). Tier names, not model ids. This map is the OPERATOR's
+  // and is deliberately WIDER than the planner's menu: since 2026-08-06 `STEP_MODELS` is
+  // sonnet-only (the haiku attribution probe — see src/plan.js), so a PLAN can no longer
+  // say haiku while `--model haiku` still can. haiku takes no output_config.effort
+  // (provider-gated, battery rule) — nothing to gate yet since neither tier sets effort.
+  // PRD v1.36 floor: the drafter/default tier is sonnet MINIMUM — measured, a haiku
+  // drafter died plan-red twice on the same rejection (ms7gne7s). `--model haiku` runs
+  // BELOW the floor: an explicit operator probe whose rows are probes, never battery
+  // evidence.
+  const DEFAULT_TIER_MODELS = { sonnet: 'claude-sonnet-5', haiku: 'claude-haiku-4-5-20251001' };
+  // `modelFlagArg` is null when --model was never passed at all — distinct from a
+  // flag that happens to resolve to the default tier's own id, because the SPEC
+  // (below, once loaded) needs to know whether a flag was actually given, not just
+  // what it resolved to (build-list #3: spec wins, a mismatched flag is refused).
+  const modelFlagArg = ctx.model ?? null;
+  const tierArg = modelFlagArg ?? 'sonnet';
+  const FLAG_TIER_MODEL = DEFAULT_TIER_MODELS[/** @type {keyof typeof DEFAULT_TIER_MODELS} */ (tierArg)];
+  if (!FLAG_TIER_MODEL) { err(`unknown --model "${tierArg}" — one of: ${Object.keys(DEFAULT_TIER_MODELS).join(', ')}`); throw new ExitSignal(2); }
+  // --read-shim picks the READ SHIM's ARM (src/readshim.js, Phase 2 A0/A1/A2/A3). Runner
+  // territory exactly like --model: the spec names no shim, so the signed hash is
+  // unaffected. Phase 2 itself never flipped this default — its own "what this
+  // experiment does NOT claim" — leaving the flip as a decision only hamr could make.
+  // hamr made it explicitly on 2026-08-31: default becomes A1 cap for everyday runs;
+  // `--read-shim off` restores A0 (bench rows pin `off` explicitly, handled separately).
+  // This is the operator's flip, not the experiment's — the Phase 2 no-self-flip promise
+  // was honored.
+  //
+  // The arm NAMES are the operator's spelling; `readShimArm` is the one resolver, and it
+  // THROWS on anything it does not recognise (BA-4 param-guard class) before a token is
+  // spent — a row that silently ran the wrong arm is worse than a row that refused.
+  const READ_SHIM_ARM_NAMES = /** @type {Record<string, boolean|'cap'|'diff'>} */ ({
+    A0: false, off: false, false: false,
+    A1: 'cap', cap: 'cap',
+    A2: 'diff', diff: 'diff',
+    A3: true, all: true, true: true,
+  });
+  const shimArg = ctx.readShim ?? null;
+  if (shimArg !== null && !Object.prototype.hasOwnProperty.call(READ_SHIM_ARM_NAMES, shimArg)) {
+    err(`unknown --read-shim "${shimArg}" — one of: ${Object.keys(READ_SHIM_ARM_NAMES).join(', ')}`);
+    throw new ExitSignal(2);
+  }
+  const READ_SHIM = shimArg === null ? 'cap' : READ_SHIM_ARM_NAMES[shimArg];
+  // resolve it HERE, at argv, not at runJob: the throw must land before the approval
+  // gate, the patient reset and the provider, not three hundred lines and one API key later.
+  const READ_SHIM_LEVERS = readShimArm(READ_SHIM);
+  const READ_SHIM_LABEL = shimArg === null
+    ? 'read shim CAP (A1 — default per hamr 2026-08-31; pass --read-shim off for A0, as bench rows do)'
+    : `read shim ${shimArg} -> ${JSON.stringify(READ_SHIM)} (cap ${READ_SHIM_LEVERS.cap} · pointer ${READ_SHIM_LEVERS.pointer} · diff ${READ_SHIM_LEVERS.diff} · G1 ${READ_SHIM_LEVERS.g1})`;
+  /** every re-invocation this script PRINTS carries the arm. A resume that drops it runs
+   * the default (A1 cap since 2026-08-31) while being filed under the arm it was launched
+   * with — a silently mislabelled row
+   * is the one failure the arm resolver's throw cannot catch. */
+  const SHIM_TAIL = shimArg === null ? '' : ` --read-shim ${shimArg}`;
+
+  // --scout picks whether the plan flow pays for the read-only survey at all
+  // (docs/product/SCOUT-CONTRAST.md). Runner territory exactly like --read-shim
+  // and --model: the spec names no scout, so the signed hash is unaffected. An
+  // unrecognised value throws at argv, before the approval gate — the same
+  // param-guard class as --read-shim above, for the same reason: a silently
+  // coerced knob would mislabel a bench row.
+  const SCOUT_NAMES = /** @type {Record<string, boolean>} */ ({ on: true, true: true, off: false, false: false });
+  const scoutArg = ctx.scout ?? null;
+  if (scoutArg !== null && !Object.prototype.hasOwnProperty.call(SCOUT_NAMES, scoutArg)) {
+    err(`unknown --scout "${scoutArg}" — one of: ${Object.keys(SCOUT_NAMES).join(', ')}`);
+    throw new ExitSignal(2);
+  }
+  const SCOUT = scoutArg === null ? true : SCOUT_NAMES[scoutArg];
+  // item 34 L2: three real states, three labels — an explicit `--scout on` used
+  // to print the exact same "(default)" text as no flag at all, so a bench-log
+  // auditor reading stdout could never tell "operator explicitly chose on" from
+  // "no flag given" for that row (fix-ledger, 2026-09-05 @ c9f100d).
+  const SCOUT_LABEL = scoutArg === null
+    ? 'scout ON (default)'
+    : (SCOUT ? 'scout ON (--scout on — operator explicit)' : 'scout OFF (--scout off — operator probe; planner drafts blind)');
+  /** every re-invocation this script PRINTS carries the arm — the SHIM_TAIL rule,
+   * so a resume never silently drops it and runs the default under the arm's label. */
+  const SCOUT_TAIL = scoutArg !== null && !SCOUT ? ' --scout off' : '';
+
+  const WORKDIR = target.workdir;
+  const SEED = target.seed;
+  const specHash = jobSpecHash(spec);
+  // MODEL (build-list #3, hamr's GO 2026-08-30): the signed spec's `model`, if
+  // present, wins outright; a --model flag naming a DIFFERENT id is refused
+  // (never silently overridden) — resolveWorkerModel is the one decision, pure
+  // and tested apart from this script. The JUDGE's model is resolved separately
+  // (`resolveJudge`, below the key block): it defaults to this same resolved
+  // worker model and a signed `judge` override wins over it.
+  // The provider's OWN tier table (src/providers.js) supplies the default —
+  // not the anthropic-only DEFAULT_TIER_MODELS above (that map is the
+  // `--model` FLAG's vocabulary only, sonnet/haiku, unrelated to which
+  // provider the spec names). `spec.provider` is not validateJob'd until
+  // runJob below, so an unrecognized value dies here with the same operator-
+  // facing message resolveWorkerModel's own errors use, rather than an
+  // unhandled throw.
+  let providerEntry;
+  try {
+    providerEntry = resolveProvider(spec.provider);
+  } catch (e) {
+    die(/** @type {Error} */ (e).message);
+  }
+  // PRD item 31.3 — an ADMITTED-PENDING-PROBE provider says so, LOUDLY, on every
+  // launch. The probe rule (item 28 ruling (d)) is that no endpoint enters the
+  // menu without its own clean paid probe; hamr admitted `gemini-api` to the menu
+  // before that fire, so the honest state is "runnable, unproven" and it must be
+  // visible at the moment money is about to be spent — not buried in a doc. This
+  // NEVER refuses: refusing would be a second ruling nobody made.
+  for (const line of probeWarningLines(/** @type {string} */ (spec.provider)) ?? []) err(line);
+
+  let modelResolution;
+  try {
+    modelResolution = resolveWorkerModel({
+      specModel: spec.model,
+      flagModel: modelFlagArg === null ? undefined : FLAG_TIER_MODEL,
+      defaultModel: /** @type {NonNullable<typeof providerEntry>} */ (providerEntry).tiers.sonnet,
+    });
+  } catch (e) {
+    die(/** @type {Error} */ (e).message);
+  }
+  const MODEL = modelResolution.model;
+  const MODEL_LABEL = modelResolution.source === 'spec' ? `${MODEL} (spec)` : MODEL;
+  // `maxWallMs` is OPTIONAL in job-v1 and has NO DEFAULT — a spec without one is
+  // time-unbounded by explicit operator choice, and the whole point of the missing
+  // default is that an unbounded run must be a VISIBLE choice rather than a silent
+  // second ceiling (src/clock.js, F45). So the runner does two things and neither is
+  // "invent a number": it NAMES the unbounded state in every readout instead of
+  // printing `NaN min` (`undefined / 60000`), and it OMITS `--wall-ms` rather than
+  // handing the watchdog the literal string "undefined" — u-watchdog's num() would
+  // fall back to its null default and disarm the deadline trigger silently while the
+  // header still claimed a wall. That is the same NaN-disarms-a-guard class as the
+  // closeStages fix below, one flag over.
+  const WALL_MS = typeof spec.maxWallMs === 'number' && Number.isFinite(spec.maxWallMs) ? spec.maxWallMs : null;
+  const WALL_LABEL = WALL_MS === null ? 'UNBOUNDED (spec sets no maxWallMs — deliberate operator choice; no outside deadline)' : `${WALL_MS / 60000}min`;
+
+  // ── --resume: continue a run its own MONEY (or TIME) cap — a STALL, or a transport
+  // casualty that outlived its one retry — stopped ──
+  // PRD v1.46 §3, and it closes the third leg of hamr's resume rulings: kill-resume
+  // existed on the reuse path and W-2 pauses the wall decision-ready, but the case the
+  // original ruling was actually about — "why would i want to waste more money on
+  // something i already started" — had no machinery on the U path at all. This runner
+  // hard-reset the patient on every launch and the resume reader classed any landed
+  // job-end as complete.
+  //
+  // The TOP-UP ITSELF IS NOT HERE and never will be: raising `budgetUsd` is a spec edit,
+  // so it changes the hash and hamr signs the new one with `--approve`. This flag only
+  // declines to throw away what the dead run already bought — the tree, the plan, the
+  // steps that finished, and the money, which is folded IN so the ceiling cannot widen.
+  const RESUME = ctx.resume ?? null;
+  /** the terminals that are a checkpoint rather than a verdict — THE LIBRARY's set
+   * (`CHECKPOINT_OUTCOMES`, src/reuse.js), not this script's own.
+   *
+   * It used to be a literal here, and N4 is what made that untenable: a fourth
+   * checkpoint (`hitl-pause`) had to be added in two places at once, and the
+   * exported bundle (PRD v1.44 §2 — a thin runner with bareloop as a dependency)
+   * would have needed a third copy. `readResume` still takes the list as a
+   * PARAMETER and still defaults to empty — that default is what the reuse loop's
+   * graded-row semantics depend on — so what moved is the canonical ANSWER, not
+   * the seam. Same reasoning that put the pause TTL in the library (OPEN-2, hamr,
+   * 2026-08-13).
+   *
+   * `provider-red` folded INTO the canonical constant 2026-08-25 (PRD v1.80 TODO
+   * #4, F115) — it lived here as a local widening for one pass because `src/reuse.js`
+   * sat outside that change's file scope; the reasoning for why it belongs on this
+   * list at all now lives beside the constant itself, not here, so there is exactly
+   * one place that reasoning can drift.
+   *
+   * Nothing else is resumable — a green is done, and a red is an answer. */
+  const RESUMABLE_HALTS = CHECKPOINT_OUTCOMES;
+
+  // ── THE THREE DOORS (N4, 2026-08-12 §1) — the hitl surface, at the terminal ──
+  //
+  // There is no interactive surface anywhere in this repo and there is not going to
+  // be one here: paid runs launch setsid-detached under `systemd-inhibit`, so a
+  // process blocking on stdin would block on a terminal nobody is watching. "Three
+  // buttons" is therefore a PAUSE plus a re-invocation — the run stops
+  // decision-ready, the person reads the evidence package, and their answer comes
+  // back as a flag on the resume that continues it.
+  //
+  // SIGNER-ONLY (ruling 4): the only signer proof this repo has is the spec-hash
+  // approval, so the decision rides that same gate rather than inventing a second
+  // identity mechanism. A decision without the matching hash never reaches `runJob`.
+  //
+  // The SEMANTICS are the library's (`normalizeHumanRuling`, src/kinds.js): three
+  // doors and no fourth, and a `rerun` whose text is the whole of what the fix
+  // worker will be given. This script asks that function and prints its refusal —
+  // a second rulebook here is how a runner comes to admit what the run refuses.
+  const DECIDE = ctx.decide ?? null;
+  const TEXT = ctx.text ?? null;
+
+  // ── THE REVIEW DOOR (softgreen module 8, PRD v1.71 §3) — the same three doors,
+  // one level out: at the END of a run rather than at a stage inside the close.
+  //
+  // `--door <runid>` answers a FINISHED run's door; `--resume` continues a HALTED
+  // one. They are different runs in different states and are refused together
+  // rather than merged, because a merge would have to pick which question the
+  // operator meant.
+  //
+  // `--review-door` is the OPT-IN half, and it is the one operator-facing default
+  // this module has: a soft-green run opens its door unasked (its credit is held
+  // until a person accepts, and nothing else releases it), and a green-class run
+  // behaves exactly as it always has unless this flag is passed. PRD v1.71 §3 says
+  // "the end of EVERY run" and also that a green door is NON-BLOCKING; the reading
+  // that changes an existing job's spine without being asked is hamr's to pick, and
+  // flipping it is one line in `REVIEW_DOOR_CLASSES` (src/kinds.js).
+  const DOOR = ctx.door ?? null;
+  const REVIEW_DOOR_ON = ctx.reviewDoor === true;
+  if (DOOR !== null && RESUME !== null) {
+    die('--door answers the review door of a run that FINISHED; --resume continues one that HALTED. Those are two '
+      + 'different runs in two different states — give one.');
+  }
+  if (DECIDE !== null && RESUME === null && DOOR === null) {
+    die('--decide answers a PAUSED run (--resume) or a finished run\'s REVIEW DOOR (--door), and there is neither here. '
+      + 'A decision is an answer to something that already exists — there is nothing for it to rule on at the start of a fresh run.');
+  }
+  // A door that carries no text REFUSES the flag rather than dropping it. Silently
+  // discarding words a person typed is worse than refusing them: they would believe
+  // they had said something, and nothing downstream would ever carry it.
+  if (TEXT !== null && DECIDE !== 'rerun') {
+    die(`--text is for the rerun door: only a "rerun" carries text (the human's words ARE the gap the worker converts from). `
+      + `${DECIDE === null ? 'No --decide was given at all.' : `This run was handed --decide ${DECIDE}, which takes none.`}`);
+  }
+  /** the signer's answer, normalised at the LIBRARY's seam, or null for every
+   * ordinary run and for the leg that pauses. Never authored here, never defaulted,
+   * never inferred. */
+  const RULING = (() => {
+    if (DECIDE === null) return null;
+    const norm = normalizeHumanRuling({ decision: DECIDE, ...(TEXT === null ? {} : { text: TEXT }) });
+    if (!norm.ok) die(`--decide ${JSON.stringify(DECIDE)} is not a ruling this run can act on: ${norm.why}`);
+    return norm.ruling;
+  })();
+  /** the patient's tree, and the spine directory beside it — derived ONCE, here, because
+   * both the RESUME reader below and the live run further down need them. Two spellings of
+   * one path is how `--resume` comes to read a different directory than the run writes. */
+  const wd = resolve(WORKDIR);
+  const spineDir = join(wd, '..', target.spine);
+  /** `--resume` takes the runid (the conventional `<spine dir>/u-<runid>.jsonl`) or an
+   * explicit path — the path form is what makes these gates testable without touching
+   * an operator's real spine directory. */
+  const deadSpineFile = RESUME == null ? null
+    : (RESUME.includes('/') || RESUME.endsWith('.jsonl') ? resolve(RESUME) : join(spineDir, `u-${RESUME}.jsonl`));
+  /** @type {any} */
+  let dead = null;
+  /** F102 — the decision this checkpoint HOLDS: an answer the person already gave, on
+   * a leg that stopped before a single round was bought for it. Null on every ordinary
+   * resume. It is applied directly and the ask is never re-rendered — the whole of the
+   * finding is that the person paid for that decision once and must not pay again. */
+  let HELD = null;
+  /** the paused run's own `hitl-pause` record — the evidence package the LIBRARY
+   * assembled (the ask, every mechanical stage's result, the changed set). Hoisted
+   * out of the reader block because the preview below renders it, and re-deriving
+   * the run's facts at the surface is how a screen comes to disagree with a spine. */
+  let pauseRecord = null;
+  if (deadSpineFile !== null) {
+    if (!existsSync(deadSpineFile)) die(`--resume: no spine at ${deadSpineFile} — a resume continues a run that happened, and this one left no log`);
+    let raw = '';
+    try { raw = readFileSync(deadSpineFile, 'utf8'); } catch (e) { die(`--resume: cannot read ${deadSpineFile}: ${e.message}`); }
+    /** @type {any[]} */
+    const deadEvents = [];
+    const lines = raw.split('\n');
+    lines.forEach((line, i) => {
+      if (!line.trim()) return;
+      try { deadEvents.push(JSON.parse(line)); } catch (e) {
+        // a kill can land mid-append, so a broken LAST line is the failure being modelled
+        // and is tolerated (named, never silently dropped). A broken line anywhere else is
+        // a corrupt log, and reconstructing from one would invent a history.
+        if (i >= lines.length - 2) err(`--resume: ignoring a truncated final line in ${deadSpineFile} (a kill mid-append — the expected shape)`);
+        else die(`--resume: ${deadSpineFile} is corrupt at line ${i + 1} (${e.message}) — a reconstruction from a damaged log would invent a history`);
+      }
+    });
+    // is the dead run actually dead? Two processes on one patient is unrecoverable; a
+    // false refusal costs one sentence. run-u's own pid is not on its spine, so the
+    // watchdog's report is the pid there is — and its absence is not evidence of life.
+    const wdFile = `${deadSpineFile}.watchdog.json`;
+    /** @type {any} */
+    let watchdog = null;
+    if (existsSync(wdFile)) { try { watchdog = JSON.parse(readFileSync(wdFile, 'utf8')); } catch { /* an unreadable report is not evidence of life */ } }
+    if (Number.isInteger(watchdog?.pid)) {
+      let alive = true;
+      try { process.kill(watchdog.pid, 0); } catch { alive = false; }
+      if (alive) {
+        let cmdline = null;
+        try { cmdline = readFileSync(`/proc/${watchdog.pid}/cmdline`, 'utf8').replace(/\0/g, ' ').trim(); } catch { /* no /proc, or not ours */ }
+        if (cmdline === null || cmdline.includes('run-u.mjs') || cmdline.includes('u-watchdog.mjs')) {
+          die(`--resume: pid ${watchdog.pid} from ${deadSpineFile} is still alive${cmdline ? ` (${cmdline.slice(0, 120)})` : ' and this process cannot read its command line'}. Two processes on one patient is unrecoverable — stop it first.`);
+        }
+        err(`--resume: pid ${watchdog.pid} is alive but is NOT this runner (${cmdline.slice(0, 80)}) — the pid was recycled; continuing.`);
+      }
+    }
+    // WHEN did the dead leg stop? The watchdog's kill record is later, better evidence
+    // than the last spine event for a run that was KILLED — and worse evidence for one
+    // that ended itself, which is what N4's pause is. The preference order lives in
+    // `deathAtOf` (src/u-readout.js) so it is reachable by a test; the hazard it
+    // closes was measured, not imagined (a report dated after a pause bills the human's
+    // deciding time to the run's wall and can zero the remainder outright).
+    const deathAt = deathAtOf({ watchdogAt: watchdog?.at, events: deadEvents });
+    dead = readResume(deadEvents, {
+      direct: true,
+      resumableOutcomes: RESUMABLE_HALTS,
+      ...(deathAt === null ? {} : { deathAt }),
+    });
+    if (!dead.started) die(`--resume: ${deadSpineFile} carries no job-start — that is not a bareloop run's spine`);
+    if (dead.job !== spec.job) die(`--resume: that spine is job "${dead.job}", not "${spec.job}" — a resume continues ONE job, and running another job's plan as this one's is a substitution nothing here is allowed to make`);
+    if (dead.greened) die('--resume: that run already GREENED — there is nothing to resume.');
+    if (dead.ended) die(`--resume: that run reached its own terminal (${dead.endOutcome}) — only a governance halt (${RESUMABLE_HALTS.join(' / ')}) leaves work to continue. Start a fresh run.`);
+    if (!dead.restart) die(`--resume: ${deadSpineFile} has no attempt to continue — it never opened one.`);
+    // ── THE PAUSE TTL (2026-08-12 §2): a hitl checkpoint is kept for 60 days.
+    //
+    // The rule and the number are the LIBRARY's (`checkpointAgeGate` / `PAUSE_TTL_MS`,
+    // OPEN-2 as hamr ruled it) so the exported bundle inherits them; this reads its
+    // answer and refuses. It sits HERE, with the spine gates, rather than beside
+    // `resumeTreeGate` further down, for two reasons: an expired checkpoint must refuse
+    // BEFORE the operator signs a hash for it, and the age gate needs no git — the
+    // tree gate does, and that is why the tree gate is where it is.
+    //
+    // `applies:false` on every other terminal is the gate's own doing: ageing out a
+    // cap-halt would be a governance change nobody ruled. An UNREADABLE stamp refuses
+    // too (unknown is not young — F6), which is why this branches on `ok` and not on
+    // an age comparison of its own.
+    const age = checkpointAgeGate(deadEvents);
+    if (!age.ok) {
+      err(`CHECKPOINT EXPIRED — ${age.detail}`);
+      err('The work is still on the run\'s own branch; what has expired is the DECISION, not the tree. The levers are yours:');
+      err('  - start a fresh run against the current tree (the same hash, nothing to re-sign);');
+      err(`  - or revise the goal/spec in ${SPEC_DESC} — a spec edit, so the hash changes and you sign the new one;`);
+      err('  - or abandon it and keep the verdict the paused run already minted.');
+      throw new ExitSignal(2);
+    }
+    // F102 — DOES THIS CHECKPOINT ALREADY HOLD AN ANSWER? A leg that received a
+    // decision and stopped before a single round was bought for it left the person's
+    // words on its own spine, and the reader carries them. Read BEFORE the two gates
+    // below, because a held decision is precisely the case where the terminal is NOT a
+    // pause and a decision is nonetheless outstanding — the state F102's resume could
+    // not tell apart from "nobody has looked yet".
+    HELD = dead.restart.pendingDecision ?? null;
+    // and TWO ANSWERS TO ONE QUESTION is refused by the library's own resolver, so the
+    // runner cannot admit what the run refuses (a second rulebook here is how those two
+    // come apart). The message names the held decision: the operator has to know what
+    // they would be overriding. An unreadable HELD record refuses through the same seam
+    // rather than being repaired — a decision nobody can read is not one to act on.
+    const resolved = resolveHumanRuling(RULING, HELD);
+    if (!resolved.ok) {
+      die(`${RULING === null ? `--resume: the held decision on ${deadSpineFile}` : `--decide ${RULING.decision}`}: ${resolved.why}`);
+    }
+    // A decision answers a PAUSE. Every other checkpoint here stopped on an allowance,
+    // and nothing about it is waiting on a person — handing one a ruling would let an
+    // `accept` mint a green over evidence nobody was ever shown. The library refuses a
+    // ruling for a close with no human stage; this is the other half of the same
+    // question, and only the runner can ask it (it is about WHICH checkpoint is being
+    // answered, not about the close's shape). A HELD decision is deliberately exempt:
+    // it was answered against a pause, on a leg that then died carrying it.
+    if (RULING !== null && dead.endOutcome !== HITL_PAUSE) {
+      die(`--decide ${RULING.decision}: that run stopped on ${dead.endOutcome ?? 'an unrecorded terminal'}, not at a human stage. `
+        + 'A decision answers a pause — the run has to have asked you something before you can answer it. Resume it without a decision.');
+    }
+    pauseRecord = deadEvents.filter((/** @type {any} */ e) => e?.type === HITL_PAUSE).at(-1) ?? null;
+  }
+  // ── THE DOOR's own reader. A finished run's spine, its door record, and what it
+  // spent — the last of those because the signed budget is the CHAIN's ceiling and a
+  // rerun spends what REMAINS of it (F103's money half: time is fresh, money folds).
+  /** @type {string|null} */
+  const doorSpineFile = DOOR == null ? null
+    : (DOOR.includes('/') || DOOR.endsWith('.jsonl') ? resolve(DOOR) : join(spineDir, `u-${DOOR}.jsonl`));
+  /** @type {any[]|null} */
+  let doorEvents = null;
+  /** @type {any} */
+  let doorRecord = null;
+  /** @type {{spentUsd: number, spendComplete: boolean}|null} */
+  let doorPrior = null;
+  if (doorSpineFile !== null) {
+    if (!existsSync(doorSpineFile)) die(`--door: no spine at ${doorSpineFile} — a door belongs to a run that happened, and this one left no log`);
+    let raw = '';
+    try { raw = readFileSync(doorSpineFile, 'utf8'); } catch (e) { die(`--door: cannot read ${doorSpineFile}: ${e.message}`); }
+    doorEvents = [];
+    raw.split('\n').forEach((line, i) => {
+      if (!line.trim()) return;
+      try { /** @type {any[]} */ (doorEvents).push(JSON.parse(line)); } catch (e) {
+        die(`--door: ${doorSpineFile} is corrupt at line ${i + 1} (${e.message}) — a decision made on a damaged record is a decision about a run nobody can read`);
+      }
+    });
+    const start = doorEvents.find((/** @type {any} */ e) => e?.type === 'job-start');
+    if (!start) die(`--door: ${doorSpineFile} carries no job-start — that is not a bareloop run's spine`);
+    if (start.job !== spec.job) die(`--door: that spine is job "${start.job}", not "${spec.job}" — a door is answered against the spec that was signed for it`);
+    // THE DOOR ITSELF. Its absence is a refusal and never an invented one: a run that
+    // opened no door has a verdict standing on its own, and answering a door nobody
+    // was shown the evidence for is the rubber stamp this whole class exists to stop.
+    doorRecord = doorRecordOf(doorEvents);
+    if (!doorRecord) {
+      die(`--door ${DOOR}: that run opened no review door — its verdict (${doorEvents.findLast((/** @type {any} */ e) => e?.type === 'job-end')?.outcome ?? 'unrecorded'}) stands on its own and there is nothing here to dispose of.\n`
+        + '  A soft-green run opens one always; a green-class run opens one only when the run was launched with --review-door.');
+    }
+    // …and the 60-day TTL, read HERE for the same reason the pause TTL is read with
+    // the spine gates: an expired door must refuse BEFORE a hash is signed for it.
+    const dage = doorAgeGate(doorRecord);
+    if (!dage.ok) {
+      err(`DOOR EXPIRED — ${dage.detail}`);
+      err('That expiry IS what "cancel" used to be: the verdict the run minted stands, nothing graduated, and nobody had to decide.');
+      err('  - start a fresh run against the current tree (the same hash, nothing to re-sign);');
+      err(`  - or revise the goal/spec in ${SPEC_DESC} — a spec edit, so the hash changes and you sign the new one.`);
+      throw new ExitSignal(2);
+    }
+    const je = doorEvents.findLast((/** @type {any} */ e) => e?.type === 'job-end');
+    const spentKnown = typeof je?.spentUsd === 'number' && Number.isFinite(je.spentUsd);
+    doorPrior = {
+      spentUsd: spentKnown ? je.spentUsd : 0,
+      // a FLOOR stays a floor across the door (F6): an absent FIGURE is never "complete
+      // at $0" — completeness is only trusted when the number it completes is known
+      spendComplete: spentKnown && je?.spendComplete !== false,
+    };
+  }
+
+  /** is this resume the one a PERSON has to answer? Read off the recorded terminal,
+   * never off the presence of a `--decide` — the whole point is that the flag is
+   * absent on the first visit. */
+  const PAUSED = !!dead && dead.endOutcome === HITL_PAUSE;
+
+  /**
+   * The LINE-level half of the evidence package (ruling 2). The library carries WHICH
+   * files moved — the granularity it can state honestly from where it sits — and this
+   * reads the lines themselves out of the patient.
+   *
+   * READ-ONLY and BEST-EFFORT, in that order. It runs in the preview, above the
+   * approval gate, so it may never mutate a patient (no `add -N`, no index touch) and
+   * it may never throw: a diff nobody can read is a missing SECTION of a readout, not
+   * a failed resume. Its absence is NAMED rather than rendered as an empty diff, which
+   * would read as "nothing changed" — the F6 direction that matters most here, since a
+   * person is about to mint a green off what this shows them.
+   *
+   * The patient is read AS IT STANDS NOW, not as it stood at the pause: a checkpoint
+   * lives 60 days and nothing freezes a tree. That is exactly why `accept` re-runs the
+   * mechanical stages (OPEN-3) instead of trusting what the human read.
+   * @param {string[]} paths the pause record's own changed set, used as a pathspec
+   */
+  const DIFF_LINE_CAP = 200;
+  /** One renderer for the review screen's evidence, shared by the resume preview
+   * and the fresh-pause terminal so the fallback rule cannot drift between them:
+   * with a `hitl-pause` record, the package is the close's own ask + the diff of
+   * what changed; without one, say so plainly (per-site wording) rather than
+   * rendering the bare "approve?" ruling 2 forbids.
+   * @param {any} pause @param {string[]} fallbackLines */
+  const printPauseEvidence = (pause, fallbackLines) => {
+    if (!pause) {
+      for (const l of fallbackLines) out(l);
+    } else {
+      const paths = Array.isArray(pause.changed?.paths) ? pause.changed.paths : [];
+      for (const l of evidencePackage({ pause, diff: readDiff(paths) })) out(l);
+    }
+  };
+
+  const readDiff = (paths) => {
+    const run = (/** @type {string[]} */ a) => execFileSync('git', ['-C', wd, ...a], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+    try {
+      // after `--`, so a path that starts with a dash is a PATH and never a flag
+      const pathspec = paths.length ? ['--', ...paths] : [];
+      // secrets are scrubbed through the ONE inventory (src/validate.js), never a
+      // second spelling: a token sitting in a patient's diff must not be echoed onto
+      // a terminal or into whatever log is capturing it.
+      const raw = redactSecrets(run(['diff', '--unified=1', SEED, ...pathspec]));
+      const all = raw.split('\n').filter((l, i, a) => !(l === '' && i === a.length - 1));
+      const lines = all.slice(0, DIFF_LINE_CAP);
+      const others = run(['ls-files', '--others', '--exclude-standard']).split('\n').map((s) => s.trim()).filter(Boolean);
+      const untracked = paths.length ? others.filter((f) => paths.includes(f)) : others;
+      return { lines, truncated: Math.max(0, all.length - lines.length), untracked, unavailable: null };
+    } catch (e) {
+      return {
+        lines: [],
+        truncated: 0,
+        untracked: [],
+        unavailable: `${wd} could not be read against the seed ${SEED.slice(0, 12)} (${redactSecrets(String(e?.message ?? e)).split('\n')[0]})`,
+      };
+    }
+  };
+  /** F103 — is THIS leg a fresh engagement? A rerun is: the person commissioned new
+   * work at the moment they took the door, and they did not decide on the run's clock.
+   * The reading comes from the library's one resolver, never a second spelling here.
+   *
+   * BOTH DOORS are handed to it. A `--decide rerun` on a `--door` reaches the library
+   * as `doorRerun` rather than as a ruling (one flag, two questions), so it is passed
+   * in that slot here too — the `DOOR_RERUN` record itself is only built further down,
+   * after the library has answered the door, and a runner whose watchdog wall folded
+   * while the run's own clock did not would be the two counters disagreeing again. */
+  const FRESH_ENGAGEMENT = resolveHumanRuling(
+    RULING, HELD, DOOR !== null && RULING?.decision === 'rerun' ? RULING : null,
+  ).fresh;
+  /** the restart runs on the REMAINDER of the signed wall, never a fresh allotment —
+   * "a budget ceiling folds in prior spend so re-invoking cannot silently widen it",
+   * in a time coat. Both the run's own clock and the outside watchdog read this one.
+   *
+   * F103 narrows where that is true. A RESUME of the same engagement folds, exactly as
+   * it always has (W-2: a kill may never buy a second wall). A RERUN does not: `msx7a3rj`
+   * took the door and inherited 87 seconds from a leg that had already ended, on a worker
+   * measured to read nine rounds before its first write — not a short engagement, a
+   * structurally impossible one, and it paid real money to find that out. MONEY still
+   * folds on every path (the `left` line below): the signed budget is the chain's
+   * ceiling, and a raise is a spec edit somebody signs. */
+  const RESUME_WALL_MS = WALL_MS === null || !dead ? WALL_MS
+    : (FRESH_ENGAGEMENT ? WALL_MS : Math.max(0, WALL_MS - dead.restart.priorWallMs));
+
+  /** does the named registry HOLD a quarantined green row for this runid under this
+   * workflow name? The door-preview's half of 2B: `quarantined` on the door record says
+   * the credit is held, and THIS says whether there is a row to release — the same two
+   * facts the run's own readout ANDs (`doorHere.quarantined && REGISTRY_ROW.minted`),
+   * recovered here by lookup because a preview is a separate invocation. Read-only, $0,
+   * fail-safe: no registry, an unreadable one, or no matching row all read as "nothing
+   * to release", never as a promise.
+   * @param {string|null} registryDir @param {string} name @param {string} runid */
+  function heldRowFor(registryDir, name, runid) {
+    if (registryDir === null || registryDir === '') return false;
+    return loadRegistry(registryDir).bridges.some((b) => b.name === name
+      && (Array.isArray(b.history) ? b.history : []).some((h) => h.runid === runid && h.outcome === 'green' && h.quarantined === true));
+  }
+
+  // ── THE REVIEW DOOR's screen (module 8). Its OWN preview, deliberately not folded
+  // into the resume banner below: a door is answered about a run that is OVER, so
+  // none of that banner's arithmetic (what is left to resume with, which step it
+  // re-enters, whether the plan is doomed) is a true sentence here. What a person
+  // needs is the evidence, the three doors, and what each one costs.
+  if (doorSpineFile !== null && (ctx.approve ?? null) !== specHash) {
+    // doorSpineFile is computed FROM DOOR (`DOOR == null ? null : ...` above) and is
+    // non-null here, so DOOR itself cannot be null — this is a real invariant, stated
+    // for tsc rather than asserted away, and it can never actually throw.
+    if (DOOR === null) throw new Error('unreachable: doorSpineFile is only non-null when DOOR is non-null');
+    out('U — REVIEW DOOR, answering a run that has already ended');
+    out(`  spec     ${SPEC_DESC}  $${spec.budgetUsd}  wall ${WALL_LABEL}`);
+    out(`  run      ${DOOR}  ${doorPrior?.spendComplete === false ? '≥' : ''}$${(doorPrior?.spentUsd ?? 0).toFixed(4)} spent  ·  ${doorSpineFile}`);
+    out(`  patient  ${WORKDIR} @ ${SEED.slice(0, 12)}`);
+    out('');
+    for (const l of reviewDoorPackage({
+      door: doorRecord,
+      diff: readDiff(Array.isArray(doorRecord?.changed?.paths) ? doorRecord.changed.paths : []),
+    })) out(l);
+    out(`\n  hash     ${specHash}`);
+    if ((ctx.approve ?? null) !== null) err(`\nREFUSED: --approve ${(ctx.approve ?? null)} does not match this spec version.`);
+    // THE PREVIEW MAKES THE SAME PROMISE THE RUN'S OWN READOUT DOES (2B), read the
+    // same way: `quarantined` says the credit is HELD; whether there is anything to
+    // RELEASE is answered by the registry, not the class. The run's readout answers
+    // it off the row it just wrote; a preview is a separate invocation, so it asks
+    // the named registry whether a held green row for this runid actually exists —
+    // and the printed commands carry the registry forward, because an accept aimed
+    // at no registry is the `no-row-for-run` refusal one hop later.
+    const previewHeld = doorRecord?.quarantined === true && heldRowFor((ctx.registry ?? null), (ctx.workflow ?? null) ?? spec.job, DOOR);
+    const previewRegistry = (ctx.registry ?? null) !== null ? ` --registry ${(ctx.registry ?? null)} --workflow ${(ctx.workflow ?? null) ?? spec.job}` : '';
+    const doorInvoke = (/** @type {string} */ tail) => `  node scripts/run-u.mjs ${SELECTOR} --door ${DOOR}${tail}${previewRegistry} --approve ${specHash}`;
+    out('');
+    if (RULING === null) {
+      for (const l of runDoorLines({
+        rerun: doorInvoke(' --decide rerun --text "<what you want done differently>"').trim(),
+        accept: doorInvoke(' --decide accept').trim(),
+        pause: doorInvoke(' --decide pause').trim(),
+        ttlDays: PAUSE_TTL_MS / 86_400_000,
+        held: previewHeld,
+      })) out(l);
+      if (doorRecord?.quarantined === true && !previewHeld) {
+        out('  (this run\'s credit is HELD and the named registry holds no green row for it'
+          + `${(ctx.registry ?? null) === null ? ' — no --registry was named' : ''}, so an accept records a disposition and releases nothing)`);
+      }
+    } else {
+      out(`  decision ${RULING.decision}${RULING.decision === 'rerun' ? ' — and these words become the requirement the fresh engagement plans against:' : ''}`);
+      if (RULING.text !== null) for (const l of String(RULING.text).split('\n')) out(`           ${l}`);
+      out(`\nTo approve and answer:\n${doorInvoke(` --decide ${RULING.decision}${RULING.text === null ? '' : ` --text ${JSON.stringify(RULING.text)}`}`)}`);
+      if (RULING.decision === 'rerun') {
+        out('\nA rerun COMMISSIONS WORK — launch it under a sleep inhibitor (a suspend freezes every guard, F72):');
+        out('  systemd-inhibit --what=idle:sleep --why="bareloop u run" env <the command above>');
+      }
+    }
+    throw new ExitSignal((ctx.approve ?? null) === null ? 0 : 1);
+  }
+
+  if ((ctx.approve ?? null) !== specHash) {
+    out(dead ? 'U — RESUME, continuing a halted run, REAL dollars' : 'U — user-mode e2e, ONE run, REAL dollars');
+    out(`  spec     ${SPEC_DESC}  $${spec.budgetUsd}  wall ${WALL_LABEL}  strikeLimit=${STRIKE_LIMIT} (step ladder + close-fix progress rule)`);
+    out(`  patient  ${WORKDIR} @ ${SEED.slice(0, 12)}`);
+    out(`  shim     ${READ_SHIM_LABEL}`);
+    out(`  scout    ${SCOUT_LABEL}`);
+    out(`  goal     "${spec.goal}"`);
+    // F87 — the goal must state everything the close will judge, and nothing derives
+    // one from the other or checks them against each other. So the only defence is
+    // that the person signing reads both halves AT ONCE: this gate printed the goal
+    // and never the stages, and run-author printed the stages and never the goal.
+    // Names and kinds only; the params and notes are the authoring surface's reading
+    // (`scripts/author-readout.mjs`), and this one is about what the dollars below buy.
+    // Through `closeStagesOf` — THE ONE STAGING (src/plan.js), the same derivation the
+    // watchdog's stage count below already reads for the same reason. Gated on
+    // `spec.closeDecl` this printed the stages for exactly ONE of the eleven shipped
+    // specs: the other ten declare a command `close[]`, so the signer read the goal,
+    // then the hash, and never the stages that judge it — the F87 half-reading this
+    // block exists to end, reproduced by the block itself.
+    // A command stage carries no `kind` (that is the DECLARATION's vocabulary), and it
+    // is not a `command-exit` either — these stages gate on an exit code AND a judged
+    // floor — so it renders as `command` rather than borrowing a kind name it has not
+    // got. The spec here is read raw off disk and is not validateJob'd until runJob,
+    // so a stage is rendered defensively: a malformed entry must not throw the gate.
+    const stages = closeStagesOf(spec) ?? [];
+    if (stages.length) {
+      out(`  judged   ${stages.length} close stage(s) — this run is green only when EVERY one of them is, so the goal above has to name what they measure:`);
+      // direction is a deliberate visibility guard (2026-08-31 ruling) against the
+      // silent 'down' default: printed for every stage, never inferred, so the
+      // person signing sees which stages the close-fix governor reads as a rate
+      // (higher is better) rather than assuming every number is a count going down.
+      for (const s of stages) {
+        const dir = s?.direction === 'up' ? 'up (higher is better)' : 'down (lower is better, default)';
+        out(`           ${s?.name ?? '(unnamed)'}  [${s?.kind ?? 'command'}]  direction ${dir}`);
+      }
+    }
+    if (dead) {
+      const rs = dead.restart;
+      out(`  spine    ${deadSpineFile}  → stopped on ${dead.endOutcome ?? 'a halt'}`);
+      // D4a — SAY when the gate opened on a derivation rather than on the recorded name.
+      // The operator is looking at a spine that says `step-red`; without this line the
+      // resume reads as the gate having quietly stopped refusing.
+      if (dead.wallDerivedHalt) {
+        out('           recorded step-red RE-READ as wall-halt off this run\'s own wall-bounded record — the wall was crossed before it ended');
+      }
+      // the fold line says which of the two counters folds, per case: on an ordinary
+      // resume BOTH do (unchanged), and on a decide-time rerun the money still does
+      // while the wall does not (F103, spelled out in the `clock` line below).
+      out(`  spent    ${dead.spendComplete ? '' : '≥'}$${rs.priorSpentUsd.toFixed(4)} and ${(rs.priorWallMs / 60000).toFixed(1)}min before the halt — ${FRESH_ENGAGEMENT ? 'the MONEY is FOLDED IN, so this spends the REMAINDER; the wall is not (below)' : 'FOLDED IN, so this restarts on the REMAINDER'}`);
+      // F102 — SAY THAT THE ANSWER SURVIVED. Without this line the operator cannot
+      // tell a resume that will act on their words from one that will ask again, and
+      // that is the difference this whole rung exists for.
+      if (HELD) {
+        out(`  held     "${HELD.decision}"${HELD.text === null ? '' : ' — your own words, still the gap:'} answered ${HELD.receivedAt ?? 'at an unrecorded time'} and never paid for`);
+        if (HELD.text !== null) for (const l of String(HELD.text).split('\n')) out(`           ${l}`);
+        out('           this resume APPLIES it — you are not asked again (F102)');
+      }
+      // F103 — and say which clock this leg gets, because a rerun's is not the
+      // remainder. The two counters are both printed rather than one number meaning
+      // both: chain so far, and what this engagement may spend.
+      if (FRESH_ENGAGEMENT && WALL_MS !== null) {
+        out(`  clock    FRESH ENGAGEMENT — a rerun is new work you commissioned, so it opens on the full signed ${WALL_MS / 60000}min rather than on what the corrected leg left (F103)`);
+        out(`           chain so far ${(rs.priorWallMs / 60000).toFixed(1)}min — reported, never a bound on work you have just asked for`);
+      }
+      out(`  left     $${(spec.budgetUsd - rs.priorSpentUsd).toFixed(4)} of $${spec.budgetUsd}${WALL_MS === null ? '' : ` and ${(/** @type {number} */ (RESUME_WALL_MS) / 60000).toFixed(1)}min of ${WALL_MS / 60000}min`}`);
+      // WHERE it picks up. Without this line "resume" covers two runs that cost very
+      // different amounts — one that re-scouts and re-drafts from nothing, and one that
+      // re-enters at the close — and the hash being signed authorizes the dollars either way.
+      // …through `resumeAtLines` (src/u-readout.js), because a PAUSE is a phase this
+      // line did not have: it stops after the plan's steps, at the close's human stage, and
+      // the step arithmetic used to walk off the end of the plan (`at step 2 of 1
+      // "(unknown)"`). The rule the helper holds is that a step count may never exceed the
+      // plan, and that the phase is said in words.
+      for (const l of resumeAtLines({ seed: rs.seed, paused: dead.endOutcome === HITL_PAUSE })) out(l);
+      // WHAT IT INHERITS as a trend baseline. Without this line the resumed run's
+      // halt readout can name a direction the leg itself never measured, and a reader
+      // has no way to tell that the number came from the leg before it.
+      const gs = dead.restart.grades ?? [];
+      // grouped PER STAGE and rendered `stage a → b`, the same spelling src/trend.js's
+      // own readout uses — a second way of writing one series is a second way of reading
+      // it, and the accuracy law is that a series belongs to one stage
+      const byStage = new Map();
+      for (const g of gs) {
+        const k = g.stage ?? '(unstaged)';
+        if (!byStage.has(k)) byStage.set(k, []);
+        byStage.get(k).push(g.value);
+      }
+      if (gs.length) out(`  trend    ${gs.length} close grade(s) inherited as baselines (${[...byStage].map(([k, vs]) => `${k} ${vs.join(' → ')}`).join('; ')}) — the halt readout spans BOTH legs`);
+      else out('  trend    no close grade to inherit — this leg\'s readout is judged on its own evidence');
+      // WHAT IT INHERITS AS A BOUND. The line above is a readout the leg carries; this is
+      // an allowance it does NOT get. A resumed leg that opens with both replans spent
+      // can only exhaust the plan it reloads — it cannot redraw it — and that changes
+      // what the dollars being signed here can buy. Stated only when there is something
+      // to state: a "0 replans spent" line on every cold-ish resume is noise that trains
+      // the eye to skip the line that matters.
+      if (rs.replans > 0) {
+        out(`  replans  ${rs.replans} already spent by this run — the ceiling is the RUN's (PRD v1.12), so this leg inherits it rather than a fresh one`
+          + (rs.replanGrantUsed ? '; the arbiter\'s one extra is spent too' : '; the arbiter\'s one extra is still unearned'));
+      }
+      out('  patient  continued AS THE RUN LEFT IT — NOT reset to the seed');
+      // The commonest resume there will ever be is the one straight after a money cut,
+      // and on THAT spine the remainder is zero or negative by definition — the run
+      // halted because the allowance was gone. Signing this hash unchanged buys an
+      // immediate re-halt. A minus sign three lines up is not a warning; this is.
+      const moneyLeft = spec.budgetUsd - rs.priorSpentUsd;
+      const timeLeft = RESUME_WALL_MS;
+      if (moneyLeft <= 0 || (timeLeft !== null && timeLeft <= 0)) {
+        out('  ⚠ NOTHING LEFT — this run halted because its allowance ran out, and nothing here refills it:');
+        if (moneyLeft <= 0) out(`            budgetUsd $${spec.budgetUsd} is already spent (${moneyLeft < 0 ? `over by $${(-moneyLeft).toFixed(4)}` : 'exactly'})`);
+        if (timeLeft !== null && timeLeft <= 0) out(`            maxWallMs ${/** @type {number} */ (WALL_MS) / 60000}min is already burnt`);
+        out(`            RAISE the number(s) in ${SPEC_DESC} first — that is a spec edit, so the hash below changes and you sign the new one. Resuming as-is re-halts immediately for a close precheck's worth of nothing.`);
+      }
+      // F97 — the DOOMED SHAPE, which is the warning the line above cannot give. That
+      // one fires when the ALLOWANCE is gone; this one fires when the allowance is fine
+      // and the leg still cannot get anywhere: `u-msn0uccv` re-entered the exact plan
+      // whose action was the diagnosed defect, with the replan ledger already spent, and
+      // step-redded for $0.82 with $0.60 and 9.8 minutes still on the clock. WARNING
+      // ONLY — a mechanical gap (a named wall, a count) converts on re-entry every time,
+      // and only the operator can tell which kind of gap this is.
+      if (doomedResume(rs)) {
+        out('  ⚠ SAME PLAN, NO REPLANS — this resume re-enters the plan that already failed, and cannot redraw it:');
+        out('            a resume does not re-draft (the spine says scout-skipped {reason:"resumed"}); the plan reloads byte-for-byte,');
+        out('            and the replan ceiling shown above is spent, so the one channel that could replace it is gone.');
+        out('            Fine if the gap is MECHANICAL (a named wall, a count) — doomed by construction if the PLAN is the defect: F97 paid $0.82 to find that out.');
+      }
+      if (dead.specHash && dead.specHash !== specHash) {
+        out(`  NOTE     the halted run was signed under ${dead.specHash.slice(0, 12)}… and this spec hashes to ${specHash.slice(0, 12)}…`);
+        out('           that is what a TOP-UP looks like: budgetUsd is in the hash, so raising it is a spec edit you sign below. The reloaded plan is re-validated against THIS spec and refused by name if it no longer fits.');
+      }
+    }
+    // ── THE REVIEW (N4, ruling 2 + 2026-08-12 §5.2). This is the screen the whole
+    // class exists for: the person is deciding, and they decide HERE, before any
+    // signature. Never a bare "approve?" — the package is the close's own ask, every
+    // mechanical stage's result, what the run changed and the lines it changed.
+    if (PAUSED) {
+      out('');
+      // if the record that says WHAT a person was asked is gone: refusing would
+      // strand real work, so say it, and let the operator decide with the spine
+      // in front of them.
+      printPauseEvidence(pauseRecord, [
+        'HUMAN REVIEW — this run paused for a person, but its `hitl-pause` record is not on the spine, so there is',
+        'no evidence package to show. Read the spine and the patient yourself before answering; nothing here can',
+        `stand in for it: ${deadSpineFile}`,
+      ]);
+    }
+    out(`  hash     ${specHash}`);
+    if ((ctx.approve ?? null) !== null) err(`\nREFUSED: --approve ${(ctx.approve ?? null)} does not match this spec version.`);
+    // WHICH DOOR. A pause with no ruling yet is offered all three, rerun first
+    // (2026-08-12 §4 — the ~40% rubber-stamp datum: the lean is toward the answer that
+    // costs a cycle, never toward the one that mints a green nobody read). A pause WITH
+    // a ruling is shown the ruling back — including the words that will BE the gap —
+    // and one invocation to sign.
+    // F187 — this hint used to hardcode ANTHROPIC_API_KEY, so a job on a
+    // different provider (e.g. openai-api/DeepSeek) printed the WRONG variable
+    // name to set: a person pasting it verbatim hit a $0 refusal naming the
+    // right key only by accident of the runner's own generic error message,
+    // never from this hint. `providerEntry.envKey` is the same resolved name
+    // the real key check at launch (`:1157-1158` below) reads.
+    const invoke = (/** @type {string} */ tail) => `  ${providerEntry.envKey}=... node scripts/run-u.mjs ${SELECTOR}${dead ? ` --resume ${RESUME}` : ''}${SHIM_TAIL}${SCOUT_TAIL}${tail} --approve ${specHash}`;
+    /** the door the operator has already picked, as flags — hoisted out of the else
+     * below so the inhibitor line at the bottom can print the WHOLE command rather
+     * than a shape the operator has to assemble. Empty on an ordinary run and on the
+     * pause that has not been ruled on yet (there the three doors are the answer). */
+    const decisionTail = RULING === null ? ''
+      : ` --decide ${RULING.decision}${RULING.text === null ? '' : ` --text ${JSON.stringify(RULING.text)}`}`;
+    if (PAUSED && RULING === null) {
+      out('');
+      for (const l of doorLines({
+        rerun: invoke(' --decide rerun --text "<what you want done differently>"').trim(),
+        accept: invoke(' --decide accept').trim(),
+        pause: invoke(' --decide pause').trim(),
+      })) out(l);
+    } else {
+      if (RULING !== null) {
+        out(`\n  decision ${RULING.decision}${RULING.decision === 'rerun' ? ' — and these words become the gap the fix worker converts from:' : ''}`);
+        if (RULING.text !== null) for (const l of String(RULING.text).split('\n')) out(`           ${l}`);
+      }
+      out(`\nTo approve and run:\n${invoke(decisionTail)}`);
+    }
+    // THE INHIBITOR, printed rather than remembered (F72). A suspend freezes
+    // EVERYTHING: the outside watchdog is a poller, so it cannot observe — let alone
+    // kill — a run whose machine is asleep, and since hamr's 2026-08-15 ruling the
+    // run's own wall does not count those minutes either (src/clock.js is monotonic
+    // now). So a suspended run is simply unwatched for as long as it sleeps. This is
+    // the moment the operator can still do something about it, and run-reuse.mjs has
+    // printed the same line here since F72 was minted; the U runner carried it only as
+    // a comment, which is a rule nobody reads at the moment they launch.
+    out('\nLaunch under a sleep inhibitor — a suspend freezes every guard, including the outside watchdog (F72):');
+    out(PAUSED && RULING === null
+      // a pause with no ruling is choosing between three doors above; prefixing one of
+      // them would quietly recommend it, and the lean this surface was built with runs
+      // the other way (rerun first, never the rubber stamp)
+      ? '  systemd-inhibit --what=idle:sleep --why="bareloop u run" env <the door you picked, above>'
+      // `env` before the assignment on purpose: systemd-inhibit execs a COMMAND, and a
+      // bare `VAR=value` prefix is shell syntax it would try to run as one. The key
+      // still rides an env assignment and never argv (it must never reach a cmdline).
+      : `  systemd-inhibit --what=idle:sleep --why="bareloop u run" env \\\n  ${invoke(decisionTail).trim()}`);
+    throw new ExitSignal((ctx.approve ?? null) === null ? 0 : 1);
+  }
+
+  // ── THE REVIEW DOOR, ANSWERED (module 8). Past the approval gate, so the signer
+  // proof is the same one every other decision rides: the spec hash they approved.
+  //
+  // The rulebook is the LIBRARY's (`answerReviewDoor`) and nothing is re-decided
+  // here: it validates the door, re-proves the tree for an `accept`, records the
+  // disposition and releases a held judged green. This prints what it did.
+  //
+  // `accept` and `pause` LAUNCH NOTHING and exit. `rerun` falls through into the run
+  // below as a FRESH ENGAGEMENT (§3.4): its own clock, and what REMAINS of the signed
+  // budget — money folds on every path, time does not.
+  /** @type {{text: string, fromRunid: string, receivedAt: string}|null} */
+  let DOOR_RERUN = null;
+  if (doorSpineFile !== null) {
+    if (RULING === null) {
+      err('NO DECISION — this run is standing at its review door and no decision was given.');
+      err('Answer it with one of: --decide rerun --text "<your words>" · --decide accept · --decide pause');
+      err('(the same command without --approve prints the evidence package — that is the screen this decision is made on)');
+      throw new ExitSignal(2);
+    }
+    const answeredAt = new Date().toISOString();
+    // PRD item 27/M3 — the door's mechanical re-run needs the same effective
+    // ceiling the run itself would use; resolved through the identical
+    // function (`resolveCloseTimeoutMs`), never a second guess. Paid only on
+    // an `accept` decision's re-proof (`proveMechanically`, src/reviewdoor.js);
+    // a `rerun`/`pause` decision spends nothing here either way.
+    const doorCloseTiming = await resolveCloseTimeoutMs({ job: spec, stages: closeStagesOf(spec) ?? [], cwd: wd, redact: redactSecrets });
+    // hamr's ruling 2026-09-07 (docs/product/CLOSE-INTEGRITY-BUILD.md, "Ruled
+    // 2026-09-07") — a door whose own timing pass times out must REFUSE the
+    // accept outright as a named `close-timing-red` door stop, mirroring the
+    // in-run escalation below (~line 1173): falling through to the library's
+    // 120s default (the pre-fix shape: `closeTimeoutMs: undefined`) silently
+    // substituted an unauthorized ceiling for a door decision. `answerReviewDoor`
+    // is never called on this path — nothing is recorded (no door record on
+    // `doorSpineFile`), nothing is released, and nothing is spent.
+    if (doorCloseTiming.timedOut) {
+      // `resolveCloseTimeoutMs` only returns `timing: null` on the signed-override
+      // path, which returns `timedOut: false` — so `timedOut: true` always carries a
+      // real `timing`. Stated for tsc, not asserted away.
+      if (doorCloseTiming.timing === null) throw new Error('unreachable: resolveCloseTimeoutMs sets timing whenever timedOut is true');
+      const names = doorCloseTiming.timing.perStage.filter((s) => s.timedOut).map((s) => s.name).join(', ');
+      for (const l of doorTimingRedLines({ names })) err(l);
+      throw new ExitSignal(1);
+    }
+    // Symmetric invariant: every non-timedOut return of `resolveCloseTimeoutMs` sets a
+    // real `closeTimeoutMs` (override or estimated) — `null` only pairs with
+    // `timedOut: true`, already handled above.
+    if (doorCloseTiming.closeTimeoutMs === null) throw new Error('unreachable: resolveCloseTimeoutMs sets closeTimeoutMs whenever timedOut is false');
+    const ans = await answerReviewDoor({
+      job: spec,
+      workdir: wd,
+      events: doorEvents ?? [],
+      decision: RULING.decision,
+      text: RULING.text,
+      closeTimeoutMs: doorCloseTiming.closeTimeoutMs,
+      closeDir: spineDir,
+      at: answeredAt,
+      // THE REGISTRY IS OPTIONAL AND NEVER CONJURED. This runner keeps standalone
+      // bridge FILES, not a registry, so a release has nothing to write unless the
+      // operator names one. Absent, the answer is recorded on the run's own spine and
+      // the readout SAYS the credit was not released — never a silent no-op.
+      registryDir: (ctx.registry ?? null),
+      name: (ctx.workflow ?? null) ?? spec.job,
+      runid: DOOR,
+      // the decision goes onto the answered run's OWN append-only log: the record of
+      // what a person decided about a run belongs beside the record of the run
+      emit: makeSpine(doorSpineFile, { startSeq: doorEvents?.at(-1)?.seq ?? 0 }),
+    });
+    if (!ans.ok) {
+      err(`\nDOOR REFUSED (${RULING.decision}) — nothing was recorded and nothing was released.`);
+      for (const r of ans.reds) err(`  ${r.code}:${r.path} — ${r.detail}`);
+      if (ans.mechanical?.stages?.length) {
+        err('  the mechanical re-run, stage by stage:');
+        for (const s of ans.mechanical.stages) err(`    ${s.name}  ${s.verdict}`);
+      }
+      throw new ExitSignal(2);
+    }
+    if (RULING.decision !== 'rerun') {
+      out(`\n${RULING.decision === 'accept' ? 'ACCEPTED' : 'PAUSED'} — the verdict this run minted (${doorRecord.outcome}) is UNTOUCHED; what you answered is what happens to the work.`);
+      if (RULING.decision === 'accept') {
+        out(`  proved   ${ans.mechanical?.ran ?? 0} mechanical stage(s) re-ran on the tree as it stands, and passed — an accept is not a rubber stamp`);
+        out(`  credit   ${ans.released ? 'RELEASED — this workflow is now eligible for reuse' : ((ctx.registry ?? null) === null ? 'not released: no --registry was named, so there is no entry to release (the answer is on the spine)' : (quarantinesCredit(spec.verdictType) ? 'nothing left to release — this row was already released by an earlier accept (a repeat answer records nothing new)' : 'nothing was held to release — a green-class row is minted born RELEASED (hamr, 2026-08-30): a machine proved it, so there was never a credit to quarantine'))}`);
+        if (ans.note) out(`  note     ${ans.note}`);
+      } else {
+        out(`  costs    nothing, in any state — no work, no money, no allowance moved`);
+        out(`  keeps    ${PAUSE_TTL_MS / 86_400_000} days from the door on the record; after that it expires on its own, which is all "cancel" ever meant`);
+        out(`  reopen   node scripts/run-u.mjs ${SELECTOR} --door ${DOOR} --approve ${specHash}`);
+      }
+      throw new ExitSignal(0);
+    }
+    DOOR_RERUN = { text: /** @type {string} */ (RULING.text), fromRunid: /** @type {string} */ (DOOR), receivedAt: answeredAt };
+    out(`\nRERUN — a FRESH ENGAGEMENT against the same signed spec. The previous run's verdict (${doorRecord.outcome}) is untouched.`);
+    out(`  clock    its own: the full signed wall (${WALL_LABEL}) — a person does not decide on the run's clock (F103)`);
+    out(`  money    what REMAINS of the signed $${spec.budgetUsd}: ${doorPrior?.spendComplete === false ? '≥' : ''}$${(doorPrior?.spentUsd ?? 0).toFixed(4)} is already spent and folds in (a signature for $${spec.budgetUsd} never authorises more)`);
+    out('  gap      your words, carried to the PLANNER as a requirement on top of the goal');
+  }
+
+  // ── THE PAUSE DOOR (2026-08-17) — answered HERE, and it launches nothing.
+  //
+  // hamr's ruling replaced cancel with a pause that can resume, and the honest way to
+  // keep a checkpoint is to leave it alone. This runner writes one spine file per LEG,
+  // and a leg that returns before drafting emits no `plan-accepted` and no `step-end` —
+  // which is exactly what `readStepCheckpoint` reads. So launching a run to say "not
+  // now" would mint a NEW runid whose own checkpoint is empty, and an operator who
+  // later resumed that runid would re-draft and re-pay for every step the paused leg
+  // already finished. The checkpoint that matters is the one already on disk.
+  //
+  // So the decision is recorded to the operator, in words, against the runid they
+  // resume — and nothing is spent, nothing is signed away, and no allowance moves. The
+  // library keeps its own half (`runPlan` mints a `hitl-pause` with `humanDecision`
+  // when an adopter drives the door directly); this is the runner's, and the two agree
+  // on the one fact that matters: the run stays paused and stays resumable.
+  //
+  // IT SITS ABOVE THE WALL GATE, and that placement is a ruling (v1.73 addendum 2,
+  // ruling 5): *the pause door is ALLOWANCE-FREE in every state, including below the
+  // wall-exhausted gate*. Pause does no work and spends no money, so there is nothing
+  // for an allowance to pay for, and charging one would be the door billing a person
+  // for declining to decide. A raise-and-re-sign is what changes what a RERUN can buy;
+  // it was never what a pause costs. `accept` and `rerun` still meet the wall below —
+  // they commission work, and work meets the clock.
+  if (PAUSED && RULING?.decision === 'pause') {
+    out(`\nPAUSED BY YOU — nothing was run and nothing was spent. The checkpoint stands exactly as it was: the work is on the run's own branch, the plan and the money are where the paused leg left them.`);
+    out(`  keeps    ${PAUSE_TTL_MS / 86_400_000} days from the pause on the record — after that the checkpoint expires on its own, and nothing has to be decided today to let that happen`);
+    out('  resume   the SAME runid, whenever you want, with the door you pick then:');
+    out(`           node scripts/run-u.mjs ${SELECTOR} --resume ${RESUME}${SHIM_TAIL}${SCOUT_TAIL} --decide accept --approve ${specHash}`);
+    out(`           node scripts/run-u.mjs ${SELECTOR} --resume ${RESUME}${SHIM_TAIL}${SCOUT_TAIL} --decide rerun --text "<what you want done differently>" --approve ${specHash}`);
+    out(`  read     the same command with no --decide re-prints the evidence package you just looked at`);
+    throw new ExitSignal(0);
+  }
+
+  // W-2, on the launch side: "when time is up, keep the grade we already have and stop".
+  // A resume whose wall remainder is zero or negative has no time to start anything in,
+  // and launching it buys a scout and a precheck's worth of nothing before the clock
+  // halts it. The preview above already warns; this REFUSES, because the warning is
+  // advisory and this is the wall itself. It also closes the guard's half of the same
+  // hole: `--wall-ms 0` used to reach u-watchdog, which defaulted it to null and armed
+  // no deadline at all while this banner still claimed a wall.
+  if (dead && RESUME_WALL_MS !== null && RESUME_WALL_MS <= 0) {
+    err(`WALL ALREADY EXHAUSTED — the halted run burned ${(dead.restart.priorWallMs / 60000).toFixed(1)}min of the signed ${/** @type {number} */ (WALL_MS) / 60000}min, so this resume starts with no time at all.`);
+    err('Nothing here refills it (a run may never widen its own cap). The lever is yours:');
+    err(`  - RAISE maxWallMs in ${SPEC_DESC} — that is a spec edit, so the hash changes and you sign the new one with --approve;`);
+    err('  - or revise the goal/spec, or abandon the run and keep the verdict it already minted.');
+    // NAMED, because it is a real and non-obvious consequence rather than an oversight:
+    // a PAUSED run whose wall is gone cannot be ACCEPTED — an accept re-runs every
+    // mechanical stage against the tree as it stands (OPEN-3), which is work, and work
+    // meets the clock. The wall is governance and this runner does not get to decide
+    // that some decisions are free of it.
+    //
+    // The one door that IS free of it is `pause`, answered above and never reaching
+    // here (v1.73 ruling 5). That is not this script relaxing a governance gate: a pause
+    // runs nothing and spends nothing, so there is no allowance for it to be charged
+    // against, and the checkpoint it keeps is the one already on disk.
+    if (PAUSED) {
+      err('  NOTE: this run is waiting on a DECISION and its wall is gone, so accept and rerun cannot be applied until the wall is.');
+      err(`        --decide pause is still open and always is: it costs nothing in any state, and the checkpoint keeps for ${PAUSE_TTL_MS / 86_400_000} days.`);
+    }
+    throw new ExitSignal(2);
+  }
+
+  // A PAUSE is answered, or it is not resumed. The lean-rerun rule (2026-08-12 §4) is
+  // about which door a prompt LEADS with — it is never an action taken for the
+  // operator, so there is no default here to fall through to. Resuming a pause with no
+  // ruling would re-run the close and pause again at the same stage, buying a precheck
+  // to ask the same question twice.
+  if (PAUSED && RULING === null) {
+    err('NO DECISION — this resume continues a run that is waiting on a person, and no decision was given.');
+    err('Answer it with one of: --decide rerun --text "<your words>" · --decide accept · --decide pause');
+    err('(run the same command without --approve to read the evidence package first — that is the screen this decision is made on)');
+    throw new ExitSignal(2);
+  }
+
+
+  // TWO KEYS, TWO ROLES, AND ONLY THE ONES THIS JOB WILL USE (PRD item 31.4).
+  //
+  // Before this, `ANTHROPIC_API_KEY` was demanded UNCONDITIONALLY — so a green
+  // job whose worker is DeepSeek or Gemini, and whose close is pure mechanical
+  // commands, still hard-exited without an Anthropic key it would never spend a
+  // token against. That made "provider-agnostic" half-true: you could run on
+  // another provider only if you also held an Anthropic account.
+  //
+  // The WORKER's key comes from the provider's own `envKey` (the factory's, so
+  // there is one table saying which provider reads which variable) and is
+  // ALWAYS required — the worker always runs.
+  //
+  // The JUDGE's key is required only when the close actually judges
+  // (`closeJudges`, src/kinds.js — the ONE reading of that question), and since
+  // PRD item 32 the judge is no longer pinned to Anthropic: its identity is
+  // RESOLVED below, and its key follows that resolved provider's own env var with
+  // `JUDGE_API_KEY` as a role-named override in front. One variable used to do two
+  // jobs (worker key for an anthropic-api job AND judge key for every job), which
+  // was confusing while the judge was pinned and would be a plain lie now that it
+  // is not.
+  //
+  // A green anthropic-api job's behaviour is byte-identical to before: its
+  // worker key IS `ANTHROPIC_API_KEY`, demanded as ever.
+  const JUDGES = closeJudges(spec.closeDecl);
+  // WHICH MODEL GRADES THIS JOB (PRD item 32.1). Resolved, never pinned: the
+  // spec's signed `judge: {provider, model}` if it names one, else this job's own
+  // worker provider and model — so a DeepSeek or Gemini job judges on its own
+  // provider and needs no second account. `resolveJudge` throws on a malformed
+  // override rather than quietly falling back to the worker's; the spec validator
+  // has already redded that shape, so reaching the throw means a caller skipped
+  // validation. Resolved UNCONDITIONALLY (needs no key) — `judge.model` rides
+  // into runJob below whether this leg constructs a real judge provider or not.
+  const judge = resolveJudge({ specJudge: spec.judge, workerProvider: spec.provider, workerModel: MODEL });
+  const judgeEntry = resolveProvider(judge.provider);
+  // undefined, not null: both come straight off `env[...]` lookups below, which
+  // (like process.env) never produce null for a missing key.
+  /** @type {string|undefined} */
+  let workerApiKey;
+  /** @type {string|undefined} */
+  let judgeApiKey;
+  // TEST SEAM (constraint: `deps.provider` skips the real-key check entirely,
+  // the same shape src/cli.js's `doRun` already uses) — a caller that hands in
+  // its own provider IS the run, so nothing here needs a real secret.
+  if (!deps.provider) {
+    // A green anthropic-api job's behaviour is byte-identical to before: its
+    // worker key IS `ANTHROPIC_API_KEY`, demanded as ever.
+    workerApiKey = env[providerEntry.envKey];
+    if (!workerApiKey) { err(`${providerEntry.envKey} not set (secrets load from the environment — never the tree)`); throw new ExitSignal(2); }
+    // F181 — a key that reads as "set" above can still carry a line break/
+    // control char/stray whitespace (a two-line secret-store entry, e.g.) and
+    // crash Node's own header-encode inside the paid span. Refuse at the SAME
+    // door, before any provider is constructed; never echo the value.
+    const workerKeyProblem = apiKeyProblem(workerApiKey);
+    if (workerKeyProblem) { err(`${providerEntry.envKey} ${workerKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`); throw new ExitSignal(2); }
+    // The judge's KEY follows the RESOLVED judge provider's own env var, with
+    // `JUDGE_API_KEY` as a role-named override in front of it (PRD item 32.3). The
+    // override matters most in the case this item exists for: a job whose worker and
+    // judge are the SAME provider but different accounts, and the anthropic case
+    // where one variable used to do two jobs.
+    judgeApiKey = env.JUDGE_API_KEY ?? env[judgeEntry.envKey];
+    if (JUDGES && !judgeApiKey) {
+      err(`This job's close JUDGES (${judgedStages(spec.closeDecl).length} judged stage(s)) and its judge is ${judge.model} on ${judge.provider}${spec.judge ? ' (signed override)' : " (this job's own worker model — no `judge` override signed)"}.`);
+      err(`Neither JUDGE_API_KEY nor ${judgeEntry.envKey} is set — secrets load from the environment, never the tree.`);
+      err('Refused at $0, BEFORE the worker spends anything: a judged run that discovers this at the close has paid for a verdict it cannot render.');
+      throw new ExitSignal(2);
+    }
+    // F181 — same door, second shape: a judge key that IS present can still be
+    // malformed (line break/control char/stray whitespace). Checked only when
+    // JUDGES (the key is only required then); never echoes the value.
+    if (JUDGES) {
+      const judgeKeyProblem = apiKeyProblem(/** @type {string} */ (judgeApiKey));
+      if (judgeKeyProblem) {
+        const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : judgeEntry.envKey;
+        err(`${judgeEnvName} ${judgeKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`);
+        throw new ExitSignal(2);
+      }
+    }
+  }
+
+  // `wd`/`spineDir` are derived once, above the resume reader that needs them; only the
+  // directory's CREATION belongs here, after the preview/approval gates have exited.
+  mkdirSync(spineDir, { recursive: true });
+  const runid = Date.now().toString(36);
+  const spineFile = join(spineDir, `u-${runid}.jsonl`);
+
+  // PANEL-BUILD.md P1 — one row in the run list, BEFORE any paid call (this
+  // leg's own `runJob` further down, and BEFORE the provider-key checks that
+  // preceded this point already gated on). `runid` is fresh for THIS leg
+  // (cold start or resumed leg both mint one here), so `appendRun`'s own
+  // runid-dedup never fires on the ordinary path — it exists for a caller
+  // that legitimately re-enters with the same runid (e.g. a retried
+  // in-process test). A list-append failure must never block a real,
+  // already-signed run: caught and named loudly, never rethrown.
+  // `deps.runlistHome` — the same injectable test seam `ctx.deps` already
+  // carries everything else through (env/out/err/provider/…): a caller that
+  // injects it writes this leg's row under a temp home instead of the real
+  // `~/.config/bareloop`; production never sets it.
+  try {
+    appendRun({
+      at: new Date().toISOString(), runid, job: spec.job, spine: spineFile, patient: wd, via: 'run-u',
+    }, { home: deps.runlistHome });
+  } catch (/** @type {any} */ e) {
+    err(`WARNING: could not add this run to ~/.config/bareloop/runs.jsonl (${e.message}) — the run continues; the panel's list will be missing this row.`);
+  }
+
+  const git = (/** @type {string[]} */ a) => execFileSync('git', ['-C', wd, ...a], { encoding: 'utf8' }).trim();
+  if (dead) {
+    // A RESUME is the OPPOSITE case from a cold launch: the halted run's edits are work
+    // this budget already paid for, and resetting them would throw away exactly what
+    // resume exists to keep. A dirty tree is what a resume expects to find. Only a MOVED
+    // HEAD stops it — nothing in a run commits, so that means a human did, and the
+    // reconstruction's premise (this tree is where the run left it) no longer holds.
+    // The `.litectx` store is kept for the same reason: it is paid indexing, and the
+    // COLD-MEANS-COLD reset below is about a fresh baseline, which this is not.
+    const gate = resumeTreeGate({ head: git(['rev-parse', 'HEAD']), seed: SEED, dirty: git(['status', '--porcelain']) });
+    if (!gate.ok) {
+      err(`PATIENT REFUSED — ${gate.detail}`);
+      err('This is a decision for you, not the harness: reset and start fresh, or put HEAD back where the halted run left it and resume again.');
+      throw new ExitSignal(2);
+    }
+    out(`patient   ${gate.detail ?? 'clean — the halted run left no uncommitted work'} (store kept: it is indexing this run already paid for)`);
+  } else {
+    // the patient starts at the seed, every time — a run that inherits the previous
+    // run's edits is measuring the wrong thing. COLD MEANS COLD (P design record): the
+    // isolate verbs (stash/remember) persist in .litectx across runs, so an uncleaned
+    // store would leak run N's memory into run N+1's "cold" baseline and quietly poison
+    // every contrast (the reuse rung's OFF arm above all). The store is a derived,
+    // self-healing cache by litectx's own contract; the re-index it costs is ~65s under
+    // yield. When the reuse rung lands, KEEPING the store becomes an explicit
+    // ledger-attributed choice — never a leak.
+    //
+    // The mechanism lives in `src/u-patient.js` so a battery driver rehearsing a
+    // cold row runs THIS reset rather than a second spelling of it.
+    const cold = coldReset(wd, SEED);
+    out(`patient reset — clean at ${cold.head}, store ${cold.storeRemoved ? 'removed (cold)' : 'was already absent (cold)'}`);
+    // F186 — AFTER coldReset and BEFORE this run's own Gate ever opens (which
+    // writes to this same path), any gate-audit.jsonl still sitting in the
+    // tree is provably not this run's (see moveStaleGateAudit's own doc) —
+    // move it aside now, so the end-of-run rename below (`gate-audit.jsonl`
+    // -> `u-<runid>-gate-audit.jsonl`) only ever carries THIS run's rows. Not
+    // called on the RESUME (`dead`) branch above — a halted run's own gate
+    // audit already in the tree it resumes into is that SAME run's prior leg.
+    const preFile = moveStaleGateAudit(wd, spineDir, runid);
+    if (preFile) out(`gate audit — a stale file was already sitting in the patient tree (not this run's); moved aside to ${preFile}`);
+  }
+
+  const approvals = [{ specHash, signer: env.USER ?? 'human', ts: new Date().toISOString() }];
+  // spec.baseUrl (PRD item 28, ruling (d), 2026-09-09: admitted in v1) — an
+  // OpenAI-compatible gateway/endpoint. Undefined for anthropic-api jobs and
+  // for an openai-api job that names none (bare-agent's OpenAIProvider then
+  // defaults to api.openai.com/v1 on its own).
+  const baseUrl = typeof spec.baseUrl === 'string' ? spec.baseUrl : undefined;
+  // TEST SEAM — same shape as src/cli.js's `doRun`: a caller that supplies
+  // `deps.provider` skips the real-key check above entirely and this
+  // construction never runs (a scripted provider IS the run).
+  let provider = deps.provider;
+  let providerFor = deps.providerFor;
+  let judgeProvider = deps.judgeProvider ?? null;
+  if (!provider) {
+    provider = makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: MODEL, baseUrl });
+    // P: the per-step model-tier factory. The TIER menu a PLAN may name is signed in the
+    // plan schema (STEP_MODELS — sonnet-only since the 2026-08-06 haiku attribution probe);
+    // the tier->model mapping is the RUNNER's territory, here, and keeps haiku for the
+    // operator's own --model knob. haiku takes no output_config.effort (provider-gated,
+    // battery rule) - nothing to gate yet since neither tier sets effort params.
+    // `sonnet` maps to the RESOLVED worker model (MODEL — spec/flag/default), not the
+    // bare provider-table id, so a spec-named model reaches every plan step's own
+    // provider (STEP_MODELS is sonnet-only), not just the top-level `provider` above.
+    // ONLY when the SPEC named it: a `--model haiku` probe keeps its old reach (the
+    // top-level provider), never silently widening into every step's tier. The tier
+    // table itself comes from `providerEntry` (src/providers.js) — for openai-api
+    // today that means BOTH tiers resolve to the same `deepseek-flash` id (hamr's
+    // ruling, PRD 30.7: one secondary provider, not a menu; swapped from the
+    // retired `deepseek-chat`, F171), so a `--model haiku` probe against an
+    // openai-api job harmlessly re-resolves to the same model.
+    const TIER_MODELS = modelResolution.source === 'spec' ? { ...providerEntry.tiers, sonnet: MODEL } : providerEntry.tiers;
+    /** @type {Record<string, any>} */
+    const tierCache = {};
+    providerFor = (/** @type {string} */ tier) => (tierCache[tier] ??= TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)] === MODEL ? provider : makeProvider(spec.provider, { apiKey: /** @type {string} */ (workerApiKey), model: TIER_MODELS[/** @type {keyof typeof TIER_MODELS} */ (tier)], baseUrl }));
+    // SOFTGREEN — the JUDGED stage's own provider. Since PRD item 32.1 its identity is
+    // RESOLVED (`judge` above), not pinned: the spec's signed `judge` override, else this
+    // job's own worker model. It is still never a step knob and never agent-selectable —
+    // naming your own examiner is arbiter territory, and `judge` is a field the HUMAN
+    // signs into the hash. The `baseUrl` rides along only when the judge is the same
+    // provider as the worker: a spec's `baseUrl` is the WORKER's endpoint, and pointing a
+    // different vendor's client at it would be the silent-misconfiguration class
+    // `endpointKey` exists to prevent. Built only when `judgeApiKey` is present (PRD item
+    // 31.4 — the judge's key is demanded only when a judge is CALLED, so this construction
+    // is conditional on purpose, not unconditional): `runPlan` reads it only when a stage
+    // is `judged-floor`, and the alternative (deriving "does this close judge?" here) is a
+    // second reading of the declaration that can drift from the one the runner actually
+    // executes. Absent, a judged stage instrument-STOPS as a wiring gap, which is what
+    // every live softgreen run would have done: run-author wired this seam and this
+    // runner never did.
+    judgeProvider = judgeApiKey
+      ? makeProvider(judge.provider, { apiKey: /** @type {string} */ (judgeApiKey), model: judge.model, baseUrl: judge.provider === spec.provider ? baseUrl : undefined })
+      : null;
+  }
+
+  const started = Date.now();
+  out(`\n== U run ${runid} ==  $${spec.budgetUsd} · ${WALL_LABEL} · ${MODEL_LABEL}`);
+  // the arm is named on the run's own stdout: a battery row whose arm is only in the
+  // driver's plan is a row nobody can audit from its own log.
+  out(`   ${READ_SHIM_LABEL}`);
+  out(`   ${SCOUT_LABEL}`);
+
+  // F67 — the OUTSIDE watchdog, started before the run and sharing nothing with it.
+  // Every guard bareloop had lived inside this process, and ms3197n8/ms3jh76q proved
+  // that is exactly where they cannot help: 274min and 81.5min of total silence, the
+  // in-process fuse never running because whatever froze the run froze its timers
+  // too. This one is a separate process holding one file's mtime and a pid.
+  // `unref()` so it can never keep a finished run alive.
+  // The STALE window is sized above the worst LEGAL spine silence, which is the
+  // CLOSE, not the worker: runStages emits nothing between stages (the close
+  // runner is async since the F68 fix, but its spine silence is unchanged), so a
+  // legal close can be
+  // silent for up to closeTimeoutMs × stages. The default 600s window against a
+  // 900s-per-stage cap would kill a live verdict mid-close — the exact damage the
+  // wall grace exists to prevent, on the trigger the grace never covered.
+  // The WALL's grace is the SAME arithmetic, and it must be passed: the watchdog's
+  // own default is one stage (900s), so a 4-stage close left on the default put the
+  // outside deadline at wall+15min while a legal close can still be mid-verdict at
+  // wall+60min — the guard could destroy a live verdict. This is the one number that
+  // keeps the outside deadline equal to the deadline the run's own clock enforces
+  // (src/clock.js: maxWallMs + closeStages × closeTimeoutMs).
+  // THE COUNT COMES FROM `closeStagesOf`, the runner's own derivation (src/plan.js),
+  // because the guard and the thing it guards must read the SAME number. Reading
+  // `spec.close` alone counted an AUTHORED close (`closeDecl`) as one stage — a
+  // six-stage declaration would have armed both windows at a sixth of the silence a
+  // legal close may take, and the outside guard would SIGKILL a live verdict
+  // mid-close. That is F70's shape exactly: the instrument built to guard a failure
+  // mode carrying that failure mode. A legacy object-form close (the locked verdict
+  // classes, job.js) is still ONE stage — `stageClose` wraps it — and the floor
+  // below is live rather than decorative: this spec is read raw off disk and is not
+  // validateJob'd until runJob, so `closeStagesOf` can return null (a spec naming no
+  // close at all) or an empty list, and a 0 or NaN here would disarm both windows
+  // silently.
+  const closeStages = closeStagesOf(spec)?.length || 1;
+  // PRD item 27/M3 — the watchdog needs the REAL per-stage ceiling before it can
+  // size its own windows, and this run's own clock/close calls need the exact
+  // same number, so it is resolved ONCE, here, through the same function
+  // `src/planrun.js` uses in-run (`resolveCloseTimeoutMs`), before the watchdog
+  // spawn or the run itself sees a single provider token. `emit` is created
+  // here (not inline at the `runJob` call below) so this pre-run reading lands
+  // on the run's own spine in the SAME seq order everything else does, rather
+  // than a second, disconnected spine writer.
+  const emit = makeSpine(spineFile);
+
+  // PRD item 33/M2, call site 3(a) — a source-door manifest, when this patient
+  // was PREPARED through `prepareSource` (`scripts/prep-source.mjs`), sits
+  // beside its tree at `<into>/source.json`; `wd` IS `<into>/tree`, so its own
+  // parent is `<into>`. A patient the JOBS table above points at directly
+  // (every row today) never went through the front door and carries no
+  // manifest — that absence IS "repo jobs untouched", never an invented
+  // destination for a job that declared none. A manifest that EXISTS but
+  // cannot be read or parsed is a named $0 stop, never a silent skip.
+  const sourceManifest = await readSourceManifest(dirname(wd));
+  if (sourceManifest.stop !== null) {
+    emit('destination-refused', { code: sourceManifest.code, detail: sourceManifest.stop });
+    emit('run-end', { outcome: 'escalated' });
+    err(`SOURCE-MANIFEST-RED — ${sourceManifest.stop}. See ${spineFile}`);
+    throw new ExitSignal(1);
+  }
+  /** the front door's per-run instance, or null when there is none (no
+   * manifest, or a manifest that never declared a destination) — read ONCE,
+   * here, and reused at the copy-out call site below rather than re-read. */
+  const frontDoor = frontDoorFromManifest(sourceManifest);
+  if (frontDoor) {
+    // BEFORE ANY TOKEN (hamr's ruling, PRD item 33): a job that cannot land its
+    // output should never buy a worker turn first. `into: dirname(wd)` — review
+    // finding #3 — NOT `wd`: `wd` IS `<into>/tree`, so proving containment
+    // against `wd` alone let a destination at `<into>/profile.md` (inside the
+    // run's own scratch area, outside the frozen tree, but still bareloop's
+    // own scratch plumbing no destination should land in) slip through clean.
+    const dp = await proveDestination(frontDoor.destination, { into: dirname(wd) });
+    if (dp.stop !== null) {
+      emit('destination-refused', { code: dp.code, detail: dp.stop });
+      emit('run-end', { outcome: 'escalated' });
+      err(`DESTINATION-RED — ${dp.stop}. See ${spineFile}`);
+      throw new ExitSignal(1);
+    }
+  }
+
+  const closeTimingResolved = await resolveCloseTimeoutMs({ job: spec, stages: closeStagesOf(spec) ?? [], cwd: wd, redact: redactSecrets });
+  if (closeTimingResolved.timedOut) {
+    // Same invariant as the door's own timing check above: `resolveCloseTimeoutMs`
+    // only omits `timing` on the signed-override path, which is never `timedOut`.
+    if (closeTimingResolved.timing === null) throw new Error('unreachable: resolveCloseTimeoutMs sets timing whenever timedOut is true');
+    const names = closeTimingResolved.timing.perStage.filter((s) => s.timedOut).map((s) => s.name).join(', ');
+    emit('close-timing', { perStage: closeTimingResolved.timing.perStage, slowestMs: closeTimingResolved.timing.slowestMs, slowestName: closeTimingResolved.timing.slowestName, ceilingMs: null, source: 'estimated' });
+    emit('escalation', {
+      category: 'close-timing-red', decisionReady: true,
+      decision: `A close stage did not finish within the timing preflight's own ceiling — the close cannot run on this machine in a boundable time, so nothing was run and nothing was spent. Stage(s): ${names}`,
+      options: ['investigate why the stage hangs (infra/network/resource issue)', 'sign an explicit closeTimeoutMs override once the real duration is known', 'abandon the task'],
+    });
+    emit('run-end', { outcome: 'escalated' });
+    err(`CLOSE-TIMING-RED — stage(s) never finished the timing preflight: ${names}. See ${spineFile}`);
+    throw new ExitSignal(1);
+  }
+  const RESOLVED_CLOSE_TIMEOUT_MS = /** @type {number} */ (closeTimingResolved.closeTimeoutMs);
+  // F133 (run mtqwmb9l) — this reading is used ONLY to size the outside
+  // watchdog below (`worstCloseSilenceMs`); it is NEVER announced (no
+  // `emit('close-timing', …)`, no banner print) and NEVER passed into `runJob`
+  // (see the F133 comment at that call site). The pre-fix shape printed AND
+  // emitted this exact reading here, then fed it into `runJob` as a bare
+  // `closeTimeoutMs`, which printed/emitted it a SECOND time under the wrong
+  // word ("explicit runner override") — two banner lines for one number, the
+  // second one lying about its own source. `runJob` now runs its own timing
+  // pass (autoset, or the spec's own signed field) and is the ONE place that
+  // announces the ceiling for this run — a small, deliberate, $0 re-measure
+  // (never two AI-worker rounds, only close scripts) traded for one honest,
+  // correctly-labelled line instead of two.
+  const worstCloseSilenceMs = RESOLVED_CLOSE_TIMEOUT_MS * closeStages;
+  // `fileURLToPath`, not `.pathname`: a URL keeps its path percent-ENCODED, so a repo
+  // checked out under a directory with a space (or any of `#?%`) hands spawn a path
+  // containing `%20` that does not exist, and the guard dies at startup on the one run
+  // it was meant to protect. Same spelling the sibling scripts use.
+  const watchdog = spawn(process.execPath, [
+    // PANEL-BUILD.md P0 — this engine now lives in src/, one directory over
+    // from scripts/u-watchdog.mjs (it used to be a same-directory sibling).
+    fileURLToPath(new URL('../scripts/u-watchdog.mjs', import.meta.url)),
+    '--spine', spineFile,
+    '--pid', String(process.pid),
+    '--stale-ms', String(worstCloseSilenceMs + 600_000),
+    // omitted entirely on an unbounded spec (see WALL_MS above): the watchdog's own
+    // startup line then says "no wall", so the choice is loud on BOTH sides of the
+    // process boundary and the STALE trigger — which needs no wall — stays armed.
+    // On a RESUME this is the REMAINDER, not the signed total: the run's own clock
+    // starts at `priorWallMs`, so arming the outside guard for the whole wall again
+    // would put the two deadlines minutes apart and leave the guard unable to fire in
+    // time on exactly the run it is watching (F70's shape).
+    ...(RESUME_WALL_MS === null ? [] : ['--wall-ms', String(RESUME_WALL_MS)]),
+    '--grace-ms', String(worstCloseSilenceMs),
+  ], { stdio: ['ignore', 'ignore', 'inherit'] });
+  // A spawn failure arrives as an EVENT, and an unhandled 'error' on a ChildProcess is
+  // an uncaught exception — i.e. a guard that could not start would END the paid run it
+  // exists to protect, at second zero. The run must continue UNGUARDED and say so:
+  // losing the outside guard is a degraded run (the in-process fuses and the money cap
+  // still bound it), losing the run is a wasted budget. Loud, because a reader must
+  // never later mistake a missing watchdog marker for "the guard was watching and never
+  // fired".
+  watchdog.on('error', (e) => {
+    err(`\nWATCHDOG FAILED TO START (${e.message}) — this run is UNGUARDED from outside: a frozen event loop will NOT be reaped (F67). The run continues under its own fuses, wall clock and money cap.`);
+  });
+  watchdog.unref();
+
+  // WHERE-was-the-freeze sampler. ms3jh76q froze its event loop for 81.5min and the
+  // spine could not say where — a frozen loop emits nothing, by construction. This
+  // timer is delayed exactly as long as any block; when it finally fires it records
+  // how late it ran, which brackets the freeze in time. Diagnostic sidecar only:
+  // nothing in the run reads it, and it decides nothing (the arbiter is untouched).
+  // Coverage split with the watchdog: blocks that END show up here; a block long
+  // enough for the watchdog's stale kill dies mid-freeze and is localized by the
+  // marker + the last spine event instead. Both windows are covered, by different
+  // instruments.
+  const LAG_POLL_MS = 1_000;
+  const LAG_RECORD_MS = 3_000; // healthy gaps measured in ms; litectx's sync index blocked ~18s
+  const lagFile = `${spineFile}.lag.jsonl`;
+  let lagDue = Date.now() + LAG_POLL_MS;
+  const lagTimer = setInterval(() => {
+    const now = Date.now();
+    const blockedMs = now - lagDue;
+    if (blockedMs >= LAG_RECORD_MS) {
+      const rec = { blockedMs, from: new Date(now - blockedMs).toISOString(), until: new Date(now).toISOString() };
+      try { appendFileSync(lagFile, `${JSON.stringify(rec)}\n`); } catch { /* best-effort — a diagnostic must never kill the run */ }
+    }
+    lagDue = now + LAG_POLL_MS;
+  }, LAG_POLL_MS);
+
+  let outcome;
+  try {
+    outcome = await runJob(spec, {
+      // PRD item 27/M3 — the SAME `emit` the pre-run close-timing reading above
+      // used (never a second `makeSpine(spineFile)` here: two independent
+      // emitters against one file would both start their seq counter at 0 and
+      // collide the moment either one had already written a record).
+      approvals, workdir: wd, provider, providerFor, judgeProvider, judgeModel: judge.model, emit,
+      // F133 (run mtqwmb9l) — `closeTimeoutMs` is deliberately NOT passed here.
+      // `RESOLVED_CLOSE_TIMEOUT_MS` above exists only to size the outside
+      // watchdog before it spawns; feeding it back into `runJob` used to make
+      // this call print a SECOND, mislabelled "explicit runner override" line
+      // on top of run-u's own already-printed banner (removed above, same
+      // reason). `runJob` resolves (autoset, or the spec's own signed field)
+      // and announces the ceiling itself now — the ONE banner/spine record
+      // for this run.
+      shellCapUsd: spec.budgetUsd, capRuns: CAP_RUNS, strikeLimit: STRIKE_LIMIT,
+      closeDir: spineDir,
+      readShim: READ_SHIM,
+      scout: SCOUT,
+      // RESUME: the money and the wall the halted run already burned are FOLDED IN (so
+      // the signed ceiling cannot widen by being re-invoked), and the checkpoint it
+      // reached is handed over so the plan is reloaded rather than re-drafted and the
+      // finished steps are skipped rather than re-paid.
+      ...(dead ? {
+        priorSpentUsd: dead.restart.priorSpentUsd,
+        // and whether that fold was EXACT — a floor stays a floor across the resume (F6)
+        priorSpendComplete: dead.restart.priorSpendComplete,
+        priorWallMs: dead.restart.priorWallMs,
+        ...(dead.restart.seed ? { resumeSeed: dead.restart.seed } : {}),
+        // and the dead leg's own close GRADES, so this leg's halt readouts judge the
+        // whole chain rather than the leg. A leg that re-grades an unchanged tree is
+        // flat on its own evidence; the RUN — which is what the top-up decision is
+        // about — may have been converging when the allowance ran out.
+        ...(dead.restart.grades?.length ? { resumeGrades: dead.restart.grades } : {}),
+        // and the REPLAN ledger the chain has spent. The line above feeds a readout; this
+        // one feeds a BOUND — `replanned`/`varianceGrantUsed` are locals in `runPlan`, so
+        // an unforwarded ledger hands this leg a fresh allowance of one PRD v1.12 makes the
+        // RUN's, once per kill. It rides onto this leg's `job-start` as `priorReplans` too,
+        // which is what lets a resume OF a resume fold once instead of restarting the
+        // ceiling at whichever window it happens to read.
+        ...(dead.restart.replans > 0
+          ? { resumeReplans: { count: dead.restart.replans, grantUsed: dead.restart.replanGrantUsed } }
+          : {}),
+        // and WHERE the dead leg's work is sitting (PRD v1.57 §3). The branch name is
+        // derived from the SIGNED spec, so it is identical on every leg: without this the
+        // restart collides with its own predecessor's branch and the collision walk hands
+        // it a fresh `-2` standing beside the work it came back to continue.
+        ...(dead.restart.branch ? { resumeBranch: dead.restart.branch } : {}),
+      } : {}),
+      // N4 — the SIGNER's answer, normalised at the library's own seam above and
+      // carried in on the leg that resumes the pause. It is spent ONCE, on this leg's
+      // close readings: `accept` greens the human stage after the mechanical stages
+      // re-run on the tree as it stands (OPEN-3), `rerun` reds it with these words as
+      // the gap, and `pause` never gets this far (it is answered above, launching nothing).
+      // Absent on every ordinary run — refused-but-unwired would pause forever.
+      // …and NOT on the review-door path (module 8), where the same `--decide rerun`
+      // means something else entirely: a `humanRuling` answers a close's human STAGE
+      // and is refused for a close that has none, which is every green-class job. The
+      // door's rerun travels as `doorRerun` below instead. One flag, two questions —
+      // the runner picks by which run is being answered, never by the flag's spelling.
+      ...(RULING === null || DOOR !== null ? {} : { humanRuling: RULING }),
+      // F102 — and the answer the CHECKPOINT holds, when the leg before this one died
+      // holding it. Same seam, same semantics, one difference the spine records: the
+      // decision came from a record rather than from a person on this invocation. The
+      // two are never both set (the resolver refused above), so this can never be a
+      // silent override of words somebody just typed.
+      ...(HELD === null ? {} : { heldRuling: HELD }),
+      // MODULE 8 — does this run END at a review door? Soft-green opens one unasked
+      // (the library's class default); `--review-door` is the green-class opt-in; and a
+      // leg that IS a rerun taken at a door opens the next one by construction — the
+      // person is working through the door, and a rerun that ended silently would be
+      // the one leg in the chain they could not answer.
+      ...(REVIEW_DOOR_ON || DOOR_RERUN ? { reviewDoor: true } : {}),
+      // …and the signer's words, when this leg is that rerun. The money the answered
+      // run spent folds in (the signed budget is the chain's ceiling); the WALL does
+      // not (F103 — a rerun that inherits a dead leg's clock is structurally doomed).
+      ...(DOOR_RERUN === null ? {} : {
+        doorRerun: DOOR_RERUN,
+        priorSpentUsd: doorPrior?.spentUsd ?? 0,
+        priorSpendComplete: doorPrior?.spendComplete !== false,
+      }),
+    });
+  } finally {
+    // the guard outlives the run only by accident, never by design
+    try { watchdog.kill('SIGKILL'); } catch { /* already gone */ }
+    clearInterval(lagTimer);
+  }
+  const legMs = Date.now() - started;
+
+  // ── the read. Facts only: what happened, what it cost, and whether the record is
+  // honest. No classification into pass/fail buckets — one run classifies nothing.
+  const raw = readFileSync(spineFile, 'utf8');
+  const events = raw.trimEnd().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const je = events.findLast((e) => e.type === 'job-end');
+  // the ONE spelling of the text-side scan (src/validate.js) — a hand-rolled copy
+  // here would be the ninth, and one that misses a shape leaks on the very output
+  // it guards. Only the COUNT is ever read out; the matches themselves stay here.
+  const leaks = scanSecrets(raw);
+  // the ACCEPTED plan (a replan emits its own) — plan-validate carries verdicts, not the plan
+  const plan = events.findLast((e) => e.type === 'plan-accepted')?.plan ?? null;
+
+  const auditSrc = join(wd, 'gate-audit.jsonl');
+  let auditFile = null;
+  if (existsSync(auditSrc)) { auditFile = join(spineDir, `u-${runid}-gate-audit.jsonl`); renameSync(auditSrc, auditFile); }
+  const audit = auditFile ? readFileSync(auditFile, 'utf8').trimEnd().split('\n').filter(Boolean).map((l) => JSON.parse(l)) : [];
+  const writes = audit.filter((e) => e.decision === 'allow' && (e.action?.type === 'write' || e.action?.type === 'edit'));
+
+  out(`\noutcome   ${outcome}`);
+  out(`spent     ${je?.spentUsd == null ? 'UNKNOWN' : `${je.spendComplete === false ? '≥' : ''}$${je.spentUsd.toFixed(4)}`} of $${spec.budgetUsd}`);
+  // FOLDED, exactly like the money line above it: on a resume the cap governs both legs
+  // together, and a leg-only wall next to a folded spend is two framings on one cap with
+  // no label to tell them apart (F83). The leg stays on the line beside it.
+  out(`wall      ${wallLine({ legMs, priorWallMs: dead ? dead.restart.priorWallMs : 0, wallLabel: WALL_LABEL })}`);
+  const legRounds = events.filter((e) => e.type === 'worker-round' && e.kind === 'turn').length;
+  out(`rounds    ${legRounds}`);
+  // THIS LEG's own tokens, off THIS LEG's own spine — same scope as `rounds` above it,
+  // never the folded chain (see `tokensLine`'s doc for why worker-result is excluded).
+  out(`tokens    ${tokensLine({ events })}`);
+  out(`writes    ${writes.length} allowed (${new Set(writes.map((e) => e.action?.path)).size} distinct files)`);
+  out(`plan      ${plan ? `${plan.steps?.length ?? '?'} ${plan.steps?.length === 1 ? 'step' : 'steps'}` : 'none validated'}`);
+  out(`checks    ${events.filter((e) => e.type === 'check-run').length} runs · menu [${events.find((e) => e.type === 'check-menu')?.offered?.join(', ') ?? '-'}]`);
+  // the close as JUDGED FIRST, then whether the fix loop had to run. Printing only
+  // the last outer-close reads as "close red" next to "outcome green" — the record
+  // must not make the reader reconcile two numbers that mean different things.
+  const oc = events.findLast((e) => e.type === 'outer-close');
+  const fixed = events.some((e) => e.type === 'fix-loop');
+  out(`close     first judgment ${oc?.verdict ?? '-'}${oc?.stage ? ` (stage ${oc.stage})` : ''}${fixed ? ` → fix loop ran → ${outcome}` : ''}`);
+  out(`replan    ${events.some((e) => e.type === 'replan') ? 'YES' : 'no'}`);
+  // F115 — absence, never a fabricated 0: printed ONLY when a transport retry
+  // actually happened, so a run with none says nothing about retries at all.
+  const transportRetries = events.filter((e) => e.type === 'transport-retry');
+  if (transportRetries.length > 0) {
+    const recovered = transportRetries.some((e) => e.recovered === true);
+    out(`retries   ${transportRetries.length} transport retr${transportRetries.length === 1 ? 'y' : 'ies'} · ${recovered ? 'recovered' : 'not recovered'} (spend is a floor)`);
+  }
+  for (const e of events.filter((x) => x.type === 'escalation')) out(`ESCALATION ${e.category}: ${(e.decision ?? '').slice(0, 160)}`);
+  // v1.46 §2 — the MONEY halt reads out like the wall's: the verdict that STANDS, the
+  // per-stage trend that says which lever fits, and the three levers themselves. The
+  // run pauses decision-ready; nothing here adjusts a budget, and nothing here relaunches.
+  const mh = events.findLast((e) => e.type === 'money-halt');
+  if (mh) {
+    out(`\nMONEY HALT — the cap cut the run at $${mh.remainingUsd?.toFixed?.(4) ?? '?'} left of $${mh.budgetUsd}. The verdict already minted STANDS: ${mh.verdict ?? 'unknown'}${mh.stage ? ` at stage "${mh.stage}"` : ''}.`);
+    out(`  trend   ${mh.trend} — ${mh.reading}`);
+    out(`  lever   ${mh.lever}`);
+    for (const o of mh.options ?? []) out(`          · ${o}`);
+    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL} --approve <the NEW hash after you edit budgetUsd>`);
+    out('          (the top-up is yours to sign — nothing in the run may widen its own budget)');
+  }
+  // A STALL is a checkpoint too (hamr's go, 2026-08-13). Its own escalation prints one
+  // line above and says *"retry the run"*, and until this line the only retry on offer
+  // was a COLD one that re-drafts the plan and re-pays for every step already finished.
+  // Unlike the money halt above, nothing here needs re-signing: no allowance moved, so
+  // the hash already approved is the hash that resumes.
+  if (outcome === 'step-stalled') {
+    out('\nSTALL HALT — the model stopped producing rounds and reissuing the call did not recover it. The tree, the plan and the steps already finished STAND.');
+    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL} --approve ${specHash}`);
+    out('          (no spec edit, so the hash is unchanged — this re-enters at the stalled step and re-pays for none of the ones before it)');
+    out('          (if the allowance is what actually ran out underneath the stall, that preview says so and refuses — it is read there, not asserted here)');
+  }
+  // PRD v1.80 TODO #4 / F115 — provider-red JOINS the resumable set. The one
+  // transport retry (src/planrun.js's `withTransportRetry`) already ran and
+  // still failed, so `spent` above is already a FLOOR (`je.spendComplete ===
+  // false` from src/run.js's F44 branch) — never rounded up to exact. What is
+  // added here is WHERE the death landed, read back off this run's own spine
+  // through the SAME reader `--resume` uses (never a second one), and the
+  // exact, copy-pasteable command. No cost/step threshold decides anything
+  // here — that decision is hamr's, case by case, off this readout.
+  if (outcome === 'provider-red') {
+    const pr = readResume(events, { direct: true, resumableOutcomes: RESUMABLE_HALTS });
+    const seed = pr.restart?.seed ?? null;
+    const total = Array.isArray(seed?.plan?.steps) ? seed.plan.steps.length : null;
+    const done = Array.isArray(seed?.completedSteps) ? seed.completedSteps.length : 0;
+    out('\nPROVIDER-RED — the transport retry above also failed; no close ever rendered a verdict. The tree, the plan and the steps already finished STAND.');
+    out(`  died    ${total === null ? 'before a plan was accepted — nothing paid is re-payable'
+      : done >= total ? `at the close — all ${total} step(s) finished`
+        : `in step ${done + 1} of ${total}`}`);
+    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL} --approve ${specHash}`);
+    out('          (no spec edit, so the hash is unchanged — this re-enters at the recorded step and re-pays for none of the ones before it)');
+    out('          (if the allowance is what actually ran out underneath the transport fault, that preview says so and refuses — it is read there, not asserted here)');
+  }
+  // ── N4 §1.4/§5.2 — THE PAUSE, at the terminal the person is actually standing at.
+  // The run stopped decision-ready with the clock stopped (ruling 1) and everything
+  // it did stands until an answer comes back. This renders the SAME evidence package
+  // the resume preview renders, from the SAME record and the SAME function: one
+  // assembly of one run's facts, two screens.
+  //
+  // A decision moves no allowance, so nothing here needs re-signing — the hash that
+  // bought this run is the hash that answers it, exactly like the stall readout above.
+  if (outcome === HITL_PAUSE) {
+    const pause = events.filter((e) => e.type === HITL_PAUSE).at(-1) ?? null;
+    out('');
+    printPauseEvidence(pause, [
+      'HUMAN REVIEW — the run paused for a person but wrote no `hitl-pause` record; read the spine and the patient',
+      'yourself before answering. Nothing here can stand in for the evidence it did not write.',
+    ]);
+    out('  clock    STOPPED — the wall does not run while a person is reading (W-2), and this leg\'s elapsed is what folds into the resume');
+    out('');
+    const answer = (/** @type {string} */ tail) => `node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${tail} --approve ${specHash}`;
+    for (const l of doorLines({
+      rerun: answer(' --decide rerun --text "<what you want done differently>"'),
+      accept: answer(' --decide accept'),
+      pause: answer(' --decide pause'),
+    })) out(l);
+    out(`  (the same command without --approve re-prints this package — the checkpoint keeps for ${PAUSE_TTL_MS / 86_400_000} days)`);
+  }
+
+  // PRD item 33/M2, call site 3(b) — on a MINTED green only. `outcome` never
+  // carries a distinct 'soft-green' string (src/run.js's own outcome union has
+  // none): a judged close mints the same 'green' as a hard one, and the CLASS
+  // lives on `spec.verdictType`/`REVIEW_DOOR_CLASSES` — so `outcome === 'green'`
+  // already covers both, exactly as the spec's "green/soft-green" phrasing asks
+  // for. A refused copy-out is reported beside the green it could not deliver
+  // and NEVER changes `outcome` — the verdict is the close's, never this
+  // module's to touch.
+  if (outcome === 'green' && frontDoor) {
+    // `into: dirname(wd)` — same review finding #3 fix as the preflight above,
+    // so the two proofs of the same destination never disagree on what counts
+    // as "contained". D3 rework: `destination` is a DIRECTORY now, and a job
+    // may produce more than one file — `copyOut` delivers every non-empty file
+    // under `output/`, each under its own dated name, and returns the list.
+    const co = await copyOut({ tree: wd, into: dirname(wd), destination: frontDoor.destination });
+    if (co.stop === null) {
+      // `f.path`, never `frontDoor.destination` — each file lands under its
+      // OWN dated name (M2b fix 4: `profile-2026-09-12.md`, `-2` the same
+      // day), so the declared directory is not the path anything actually
+      // wrote. The spine records what happened, not what was asked for.
+      for (const f of co.files) {
+        emit('destination-written', { path: f.path, declared: frontDoor.destination, bytes: f.bytes, sha256: f.sha256 });
+        out(`\nDESTINATION  written — ${f.path} (${f.bytes}B, sha256 ${f.sha256.slice(0, 12)}…)`);
+      }
+    } else {
+      emit('destination-refused', { code: co.code, detail: co.stop });
+      out(`\nDESTINATION  NOT written — ${co.code}: ${co.stop}`);
+    }
+  }
+
+  // ── THE REGISTRY ROW (2B), minted BEFORE the door is rendered because the door's own
+  // text reads off it. A bridge FILE is not a registry ROW, and the review door answers
+  // rows: with none, `--door --decide accept` reached `recordDoor`, found no green row for
+  // this runid and refused `no-row-for-run` — so the door could describe a held learning
+  // credit it had no way to release.
+  //
+  // STORAGE ONLY. Nothing here selects, promotes or reuses a bridge (that rung is parked);
+  // the row is written, and exactly one thing reads it back — the door. Every rule lives in
+  // the library seam, which is where the reuse runner's greens go too, so there is ONE
+  // spelling of what a green writes: no `--registry` is no row, an already-green run mints
+  // nothing (accept confirms a verdict, it never mints one), and a green with no executed
+  // plan mints nothing. hamr's ruling 2026-08-30 (PRD open item #16): a green-class run now
+  // mints its row too, born RELEASED — a machine proved it, so there is no credit to
+  // quarantine. Whether the minted row IS held is decided one level down: `greenParts`
+  // reads the SIGNED class off the record, never because a line here set a flag.
+  //
+  // A SPINE LEAK BLOCKS IT, exactly as it blocks the bridge file below and for the same
+  // reason: a spine carrying a secret must never graduate into an artifact that outlives
+  // the run, and a registry row outlives it harder than a file does.
+  const REGISTRY_ROW = leaks.length
+    ? { minted: false, reason: 'spine-leak', write: null }
+    : writeRunGreenRow({
+      registryDir: (ctx.registry ?? null),
+      job: spec,
+      name: (ctx.workflow ?? null),
+      outcome,
+      plan,
+      record: {
+        runid,
+        patient: wd,
+        at: new Date().toISOString(),
+        costUsd: je?.spentUsd ?? null,
+        // F44/F6 — completeness travels WITH the spend, and an absent job-end is
+        // unknown-and-incomplete rather than a floor that reads as exact
+        spendComplete: je?.spentUsd != null && je.spendComplete !== false,
+        // FOLDED across a resume, like every other money and time number this readout
+        // prints: the row records what the RUN cost, never what this leg cost
+        wallMs: legMs + (dead ? dead.restart.priorWallMs : 0),
+        // the ROUND count CANNOT fold — a resume leg writes a fresh spine and the halted
+        // leg's restart record declares money and wall but never rounds — so on a resume
+        // this is a FLOOR, and it says so the way the money above does (F6: a floor that
+        // reads as exact is dishonest; report the floor WITH its completeness)
+        rounds: legRounds,
+        roundsComplete: !dead,
+        specHash,
+      },
+    });
+  if (REGISTRY_ROW.minted) {
+    out(`\nREGISTRY   ${REGISTRY_ROW.write.name} — ${REGISTRY_ROW.write.action} (${REGISTRY_ROW.write.file})`);
+    // hamr's ruling 2026-08-30: a minted row is HELD only for a class `quarantinesCredit`
+    // still names (soft-green today) — a green-class row is born RELEASED, because a
+    // machine proved it and there was never a credit to quarantine
+    out(quarantinesCredit(spec.verdictType)
+      ? '  HELD: this green\'s learning credit is quarantined until you release it at the door below'
+      : '  RELEASED: a machine proved this green, so its row carries no credit to quarantine');
+  } else if (REGISTRY_ROW.write !== null) {
+    // a REFUSED write is said out loud rather than swallowed — the door below is about to
+    // offer a disposition this run has no row to record
+    out(`\nREGISTRY   NOT written — ${REGISTRY_ROW.write.reds.map((r) => `${r.code}:${r.path}`).join(', ')}`);
+  } else if ((ctx.registry ?? null) !== null) {
+    // the operator NAMED a registry and no row was even attempted — silence here would
+    // leave them guessing whether the flag was read at all. One line, the reason as-is
+    // (green-predates-run / not-green / no-plan-executed / spine-leak);
+    // no --registry stays silent, because nothing was asked for.
+    out(`\nREGISTRY   no row — ${REGISTRY_ROW.reason}`);
+  }
+
+  // ── THE REVIEW DOOR, where the person is actually standing (module 8). The run
+  // ENDED and its verdict is minted — this readout offers the three doors over it and
+  // changes nothing about the outcome printed above. Read off the run's own record
+  // (never off a flag), so a green that opened no door prints exactly what it always did.
+  const doorHere = events.findLast((e) => e.type === 'review-door') ?? null;
+  if (doorHere) {
+    out('');
+    for (const l of reviewDoorPackage({
+      door: doorHere,
+      diff: readDiff(Array.isArray(doorHere.changed?.paths) ? doorHere.changed.paths : []),
+    })) out(l);
+    out('');
+    // the door is answered in a SEPARATE invocation, so the registry this run wrote its row
+    // against has to travel in the printed command — an accept aimed at no registry (or at
+    // a different one) is the `no-row-for-run` refusal all over again, one hop later.
+    const doorRegistry = REGISTRY_ROW.minted ? ` --registry ${(ctx.registry ?? null)} --workflow ${REGISTRY_ROW.write.name}` : '';
+    const answerDoor = (/** @type {string} */ tail) => `node scripts/run-u.mjs ${SELECTOR} --door ${runid}${tail}${doorRegistry} --approve ${specHash}`;
+    // THE PROMISE READS OFF THE ROW, not off the class. `quarantined` on the door record
+    // says this run's credit is HELD; whether there is anything to RELEASE is a second
+    // question, and the honest answer is "only if a row was minted". Without `--registry`
+    // there is none, and a door that promised a release it cannot perform is the defect
+    // 2B closed — so the two are ANDed rather than the class alone being trusted.
+    for (const l of runDoorLines({
+      rerun: answerDoor(' --decide rerun --text "<what you want done differently>"'),
+      accept: answerDoor(' --decide accept'),
+      pause: answerDoor(' --decide pause'),
+      ttlDays: PAUSE_TTL_MS / 86_400_000,
+      held: doorHere.quarantined === true && REGISTRY_ROW.minted,
+    })) out(l);
+    if (doorHere.quarantined === true && !REGISTRY_ROW.minted) {
+      out('  (this run\'s credit is HELD and no registry row was written, so an accept records a disposition '
+        + 'and releases nothing — name --registry/--workflow on the RUN to give the door something to release)');
+    }
+    out(`  (the same command with no --decide re-prints this package — the door keeps for ${PAUSE_TTL_MS / 86_400_000} days)`);
+  }
+  // A leak is the HARD LINE broken, not a note in the margin: an advisory that
+  // prints a count and then exits 0 while still writing the bridge is a guard in
+  // name only. On any hit the run fails LOUD (non-zero) and the bridge is NOT
+  // written — a spine carrying a secret must never graduate into a reusable
+  // artifact that outlives the run. Count and PATH only, never the matched
+  // content: echoing the secret to stdout/CI logs is the same leak, one hop on.
+  if (leaks.length) {
+    out(`\nSPINE LEAK: ${leaks.length} secret-shaped strings in ${spineFile} — the hard line is broken; BRIDGE NOT WRITTEN`);
+    exitCode = 3; // distinct from 2 (operator/config) and 1 (stale --approve)
+  }
+
+  // the BRIDGE: on a green the agent's own plan is kept as the reusable artifact
+  if (outcome === 'green' && plan && !leaks.length) {
+    // one file PER GREEN, never one file per job: two cold runs of this job produced
+    // two DIFFERENT plans that both green (run 1: 3 steps, run 3: 2 steps), so a
+    // single `bridge-<job>.json` silently destroys the earlier bridge. WHICH bridge
+    // gets offered for reuse is a selection question the reuse rung answers
+    // (PRD v1.34 item 3) — the runner must not answer it by clobbering.
+    // `spec.job` is operator-authored JSON reaching a filesystem path here, so it is
+    // checked AT THE USE SITE rather than trusted from a distance. Same spelling as
+    // the shipped validator's SLUG_RE (src/job.js) — deliberately not a second,
+    // looser alphabet: `.` would admit `..` and walk out of spineDir. In practice
+    // validateJob reds a non-slug job before any green exists, so this is a boundary
+    // assertion, not the primary defence; it REJECTS rather than rewrites because a
+    // malformed job name is an operator mistake to surface, not to silently mask.
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(spec.job)) throw new Error(`spec.job ${JSON.stringify(spec.job)} is not a kebab-case slug — refusing to build a bridge filename from it (${SPEC_DESC})`);
+    const bridgeFile = join(spineDir, `bridge-${spec.job}-${runid}.json`);
+    writeFileSync(bridgeFile, `${JSON.stringify({ job: spec.job, specHash, runid, greenAt: new Date().toISOString(), plan }, null, 2)}\n`);
+    out(`\nBRIDGE saved — ${bridgeFile}`);
+    out('  the next run of this shape reuses this plan instead of starting cold');
+  }
+  // F67: if the outside guard fired, say so HERE rather than leaving the reader to
+  // reconcile a truncated run against a file they don't know exists. (A kill it
+  // completed leaves no readout at all — the marker beside the spine IS the record.)
+  if (existsSync(`${spineFile}.watchdog.json`)) {
+    const m = JSON.parse(readFileSync(`${spineFile}.watchdog.json`, 'utf8'));
+    out(`\nWATCHDOG   fired: ${m.reason} — the run was stopped from OUTSIDE, not by its own governance`);
+  }
+  // event-loop freezes the run survived — the sampler's record of WHERE the loop was blocked
+  if (existsSync(lagFile)) {
+    const lags = readFileSync(lagFile, 'utf8').trimEnd().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const worst = lags.reduce((a, b) => (b.blockedMs > a.blockedMs ? b : a));
+    out(`\nLOOP FROZE ${lags.length}x — worst ${(worst.blockedMs / 1000).toFixed(1)}s, ${worst.from} → ${worst.until} (${lagFile})`);
+  }
+  // ── BEHAVIOUR (PRD build-list §2, agreed 2026-08-23): what the run DID with its
+  // tools, read purely from this run's own gate audit — children included, since
+  // `audit` is already scoped to this runid's file, never re-filtered here. Gates
+  // nothing, mints no verdict; absence is reported as absence, never as a fabricated 0.
+  if (audit.length) {
+    out(`\nBEHAVIOUR  ${formatBehaviour(runBehaviour(audit)).split('\n').join('\n           ')}`);
+  } else {
+    out('\nBEHAVIOUR  no gate audit recorded');
+  }
+  // ── MEMORY-CACHE (src/readshim.js, src/planrun.js): what the read shim saved
+  // this run, read from the run's own `memory-cache` spine record. Report-only,
+  // no cost fields — never folds into any spend line above. Armed-only: an
+  // unarmed run (READ_SHIM_LEVERS.on false) prints nothing at all, and an armed
+  // run whose spine has no record (a crash before the run-level `finally` fired)
+  // says so rather than fabricating a zero line.
+  if (READ_SHIM_LEVERS.on) {
+    const mc = events.findLast((e) => e.type === 'memory-cache');
+    if (mc) {
+      const kb = (mc.bytesWithheld / 1024).toFixed(1);
+      const kTokens = (mc.approxTokens / 1000).toFixed(1);
+      out(`MEMORY-CACHE  ${mc.pointered} re-reads answered from memory · ${mc.capped} reads capped · ${kb} KB withheld (~${kTokens}k tokens not re-sent)`);
+    } else {
+      out('MEMORY-CACHE  no record (run ended before its summary)');
+    }
+  }
+  out(`\nspine     ${spineFile}`);
+  out(`patient   left AS THE RUN LEFT IT (read it before the next run resets to the seed)`);
+
+    return exitCode;
+  } catch (/** @type {any} */ e) {
+    if (e instanceof ExitSignal) return e.code;
+    throw e;
+  }
+}
+/**
+ * Builds the shared `RunCtx` all three doors hand to `execute`.
+ * @param {{spec: any, resume: string|null, door: string|null, decide: string|null, text: string|null}} mode
+ * @param {RunOpts} opts
+ * @returns {RunCtx}
+ */
+function buildCtx(mode, opts) {
+  return {
+    spec: mode.spec,
+    specPath: opts.specDesc ?? (mode.spec && mode.spec.job) ?? '(spec)',
+    selector: opts.selector ?? '--spec <spec>',
+    specDesc: opts.specDesc ?? (mode.spec && mode.spec.job) ?? '(spec)',
+    workdir: /** @type {string} */ (opts.workdir),
+    seed: /** @type {string} */ (opts.seed),
+    spineName: /** @type {string} */ (opts.spineName),
+    model: opts.model ?? null,
+    readShim: opts.readShim ?? null,
+    scout: opts.scout ?? null,
+    registry: opts.registry ?? null,
+    workflow: opts.workflow ?? null,
+    approve: opts.approve ?? null,
+    reviewDoor: opts.reviewDoor === true,
+    resume: mode.resume,
+    door: mode.door,
+    decide: mode.decide,
+    text: mode.text,
+    deps: opts.deps ?? {},
+  };
+}
+
+/**
+ * A fresh run — today's `--job` / `--spec` path. `opts.workdir`/`opts.seed`/
+ * `opts.spineName` name the patient (the JOBS-table row, or the `--spec`
+ * manifest's own reading of it, when called through `main`/`scripts/run-u.mjs`).
+ * @param {any} spec the parsed, not-yet-validated job spec
+ * @param {RunOpts} [opts]
+ * @returns {Promise<number>} an exit code — never calls process.exit
+ */
+export async function startRun(spec, opts = {}) {
+  return execute(buildCtx({ spec, resume: null, door: null, decide: null, text: null }, opts));
+}
+
+/**
+ * A halted run — today's `--resume` path.
+ * @param {string} runId the runid (or an explicit spine path, for tests)
+ * @param {RunOpts & {decide?: string|null, text?: string|null}} [opts]
+ * @returns {Promise<number>} an exit code — never calls process.exit
+ */
+export async function resumeRun(runId, opts = {}) {
+  return execute(buildCtx({ spec: opts.spec, resume: runId, door: null, decide: opts.decide ?? null, text: opts.text ?? null }, opts));
+}
+
+/**
+ * A finished run's review door — today's `--door` path.
+ * @param {string} runId the runid (or an explicit spine path, for tests)
+ * @param {{decide: string|null, text?: string|null}} decision
+ * @param {RunOpts} [opts]
+ * @returns {Promise<number>} an exit code — never calls process.exit
+ */
+export async function answerDoor(runId, decision, opts = {}) {
+  return execute(buildCtx({ spec: opts.spec, resume: null, door: runId, decide: decision?.decide ?? null, text: decision?.text ?? null }, opts));
+}
+
+/**
+ * Parses this runner's own argv shape — the JOBS table's `--job <key>` /
+ * `--spec <path>`, plus `--resume`/`--door`/`--decide`/`--text`/
+ * `--review-door`/`--approve`/`--registry`/`--workflow`/`--model`/
+ * `--read-shim`/`--scout` — and dispatches to whichever of the three doors
+ * above the flags name. `scripts/run-u.mjs` is the thin adapter over this,
+ * the same shape `bin/bareloop.mjs` already is over `src/cli.js`'s own
+ * `main(argv, deps)`.
+ * @param {string[]} argv
+ * @param {Deps} [deps]
+ * @returns {Promise<number>}
+ */
+export async function main(argv, deps = {}) {
+  const env = deps.env ?? process.env;
+  const out = deps.out ?? ((/** @type {string} */ s) => { console.log(s); });
+  const err = deps.err ?? ((/** @type {string} */ s) => { console.error(s); });
+  /** @param {string} m @returns {never} */
+  const die = (m) => { err(m); throw new ExitSignal(2); };
+  const argFlag = (/** @type {string} */ n) => { const i = argv.indexOf(`--${n}`); return i === -1 ? null : (argv[i + 1] ?? ''); };
+
+  try {
+    // F185 — a repo job authored through the PERSON path (run-interview.mjs →
+    // run-author.mjs) used to have NO way to reach this runner: `--job` only ever
+    // resolved a row from the hard-coded JOBS table below, and nothing wrote that
+    // row or copied the authored spec into `jobs/` — a developer did both by hand.
+    // hamr's ruling (2026-09-16, option A): `--spec <path to resolved-spec.json>`
+    // is the other way to NAME a job, reading the prepared copy's OWN source
+    // manifest (`readSourceManifest`, src/source.js) for the workdir and the seed
+    // — never typed, never guessed, never defaulted — so there is no table row to
+    // add and nothing to copy into `jobs/`. It is an alternative to `--job`, never
+    // a second way to widen what either one already does: every gate below this
+    // point (the `--approve` signature, the budget/wall ceilings, coldReset, the
+    // close-first precheck) reads `spec`/`specHash`/`target` exactly as it always
+    // has, whichever selector named them.
+    const jobArg = argFlag('job');
+    const specArg = argFlag('spec');
+    if (jobArg !== null && specArg !== null) {
+      die(`--job ${jobArg} and --spec ${specArg} name a job two different ways — give one. `
+        + '--job picks a row from this script\'s own table; --spec points at an authored resolved-spec.json '
+        + 'and reads its prepared copy\'s own source manifest for the workdir and seed (F185).');
+    }
+    if (jobArg === null && specArg === null) {
+      die(`give one of --job <key> (one of: ${Object.keys(JOBS).join(', ')}) or --spec <path to resolved-spec.json> `
+        + '— a run has to name a job one of the two ways.');
+    }
+    /** @type {{spec: string, workdir: string, spine: string, seed: string}} */
+    let target;
+    /** the spec's own path, wherever it was found — a `jobs/` file for `--job`,
+     * an arbitrary `resolved-spec.json` for `--spec`. */
+    let specPath;
+    /** every re-invocation command this script prints (resume/door/reopen) reuses
+     * this so a `--spec` run's own commands stay `--spec`, never silently fall
+     * back to `--job` (the same class of mislabel F186 named for the read shim). */
+    let SELECTOR;
+    /** how a "go edit the spec" hint renders — `jobs/<file>` for `--job`, the
+     * spec's own path for `--spec` (it has no `jobs/` home to point at). */
+    let SPEC_DESC;
+    let spec;
+
+    if (jobArg !== null) {
+      target = JOBS[/** @type {keyof typeof JOBS} */ (jobArg)];
+      if (!target) { err(`unknown --job "${jobArg}" — one of: ${Object.keys(JOBS).join(', ')}`); throw new ExitSignal(2); }
+      // THE SPEC IS THE OTHER HALF, AND IT MAY NOT BE THERE YET. A row in the table above
+      // is the RUNNER's half of a job — the patient, its seed, where the spine goes. The
+      // spec is the SIGNER's half: it is authored (scripts/run-interview.mjs →
+      // scripts/run-author.mjs) and signed, and nothing here may invent one. A row whose
+      // spec has not been authored yet used to die on `readFileSync`'s ENOENT stack, which
+      // reads as the runner being broken rather than as the job being unauthored.
+      specPath = fileURLToPath(new URL(`../jobs/${target.spec}`, import.meta.url));
+      if (!existsSync(specPath)) {
+        die(`--job ${jobArg}: there is no spec at ${specPath}.\n`
+          + '  The table row is the runner\'s half of a job (patient, seed, spine); the SPEC is yours — authored through\n'
+          + `  scripts/run-interview.mjs and scripts/run-author.mjs, then signed. Nothing here can stand in for it: a job\n`
+          + '  with no spec has no goal, no close, no budget and no hash to approve.');
+      }
+      try { spec = JSON.parse(readFileSync(specPath, 'utf8')); } catch (e) {
+        die(`--job ${jobArg}: ${specPath} is not readable JSON (${e.message}) — a spec nobody can parse is a spec nobody signed`);
+      }
+      SELECTOR = `--job ${jobArg}`;
+      SPEC_DESC = `jobs/${target.spec}`;
+    } else {
+      specPath = resolve(/** @type {string} */ (specArg));
+      if (!existsSync(specPath)) {
+        die(`--spec ${specPath} does not exist — a run needs the resolved-spec.json an authoring session actually wrote `
+          + '(scripts/run-author.mjs\'s own `out/resolved-spec.json`), never a path nobody authored');
+      }
+      let raw;
+      try { raw = readFileSync(specPath, 'utf8'); } catch (e) {
+        die(`--spec ${specPath}: cannot read (${/** @type {Error} */ (e).message})`);
+      }
+      try { spec = JSON.parse(/** @type {string} */ (raw)); } catch (e) {
+        die(`--spec ${specPath} is not readable JSON (${e.message}) — a spec nobody can parse is a spec nobody signed`);
+      }
+      // validateJob'd HERE, at $0, before a single filesystem lookup for the
+      // source manifest or a single line of the preview prints — a `--job` row's
+      // spec is developer-authored and reaches this same check inside `runJob`
+      // itself, further down; a `--spec` run gets it explicitly and early because
+      // there is no developer standing between the person and this launch to have
+      // caught a malformed spec first. `shellCapUsd: spec.budgetUsd` is the same
+      // self-coupling `prepareSigning`'s own gate 1a and `runJob` below both use
+      // (the budget bound this check enforces IS the spec's own advertised
+      // number) — a bare `validateJob(spec)` would red every real spec here, since
+      // the function's own default cap ($2) sits under every shipped job's budget.
+      const jv = validateJob(spec, { shellCapUsd: typeof spec?.budgetUsd === 'number' ? spec.budgetUsd : undefined });
+      if (!jv.ok) {
+        die(`--spec ${specPath} fails validateJob — ${jv.reds.length} red(s):\n`
+          + jv.reds.map((r) => `  ${r.code} at ${r.path}${r.detail ? ` — ${r.detail}` : ''}`).join('\n'));
+      }
+      // THE PREPARED COPY'S OWN SOURCE MANIFEST — never typed, never guessed. A
+      // `resolved-spec.json` written by run-author.mjs sits in the SAME `--out`
+      // directory a source door's own `source-<runid>/` (source.json + tree/) was
+      // prepared into (run-interview.mjs passes both the same OUT); so the one
+      // directory beside the spec that carries a `source.json` IS the copy this
+      // spec was authored against.
+      let entries;
+      try { entries = readdirSync(dirname(specPath), { withFileTypes: true }); } catch (e) {
+        die(`--spec ${specPath}: ${dirname(specPath)} could not be listed (${/** @type {Error} */ (e).message}) — cannot find the prepared copy beside it`);
+      }
+      const candidates = entries
+        .filter((e) => e.isDirectory() && e.name.startsWith('source-') && existsSync(join(dirname(specPath), e.name, 'source.json')))
+        .map((e) => join(dirname(specPath), e.name));
+      if (candidates.length === 0) {
+        die(`--spec ${specPath}: no prepared copy beside it — looked for a source-*/ directory carrying source.json in `
+          + `${dirname(specPath)} and found none. A --spec run reads its workdir and seed off the copy the authoring `
+          + 'session prepared; it is never typed or guessed. Prepare one first: node scripts/run-interview.mjs (or '
+          + 'run-author.mjs directly against a --source) before running this spec.');
+      }
+      if (candidates.length > 1) {
+        die(`--spec ${specPath}: ${candidates.length} prepared copies sit beside it (${candidates.join(', ')}) — `
+          + 'a --spec run cannot guess which one this spec was authored against; point --spec at a resolved-spec.json '
+          + 'with exactly one source-*/ sibling.');
+      }
+      const into = candidates[0];
+      const manifestRead = await readSourceManifest(into);
+      if (manifestRead.stop !== null) {
+        die(`--spec ${specPath}: ${manifestRead.code} — ${manifestRead.stop}`);
+      }
+      if (!manifestRead.present || !manifestRead.manifest) {
+        die(`--spec ${specPath}: ${into} carries no source.json — not a prepared copy this runner can trust`);
+      }
+      const seed = manifestRead.manifest.seed;
+      if (typeof seed !== 'string' || !seed) {
+        die(`--spec ${specPath}: ${into}/source.json carries no seed commit — not a prepared copy this runner can trust`);
+      }
+      const specWorkdir = join(into, 'tree');
+      if (!existsSync(specWorkdir) || !existsSync(join(specWorkdir, '.git'))) {
+        die(`--spec ${specPath}: the prepared copy's tree is gone (${specWorkdir} has no .git) — nothing to run against; re-prepare the source`);
+      }
+      target = {
+        // display-only in --spec mode (SPEC_DESC below is what actually prints)
+        spec: specPath,
+        workdir: specWorkdir,
+        // spine name derived from the spec's OWN signed job name — never hand-picked,
+        // exactly the shape a JOBS row's own `<patient>-bareloop` convention already
+        // is, just computed instead of typed by a developer.
+        spine: `${spec.job}-bareloop`,
+        seed,
+      };
+      SELECTOR = `--spec ${specPath}`;
+      SPEC_DESC = specPath;
+    }
+
+    const ctx = {
+      spec,
+      specPath,
+      selector: SELECTOR,
+      specDesc: SPEC_DESC,
+      workdir: target.workdir,
+      seed: target.seed,
+      spineName: target.spine,
+      model: argFlag('model'),
+      readShim: argFlag('read-shim'),
+      scout: argFlag('scout'),
+      registry: argFlag('registry'),
+      workflow: argFlag('workflow'),
+      approve: argFlag('approve'),
+      reviewDoor: argv.includes('--review-door'),
+      resume: argFlag('resume'),
+      door: argFlag('door'),
+      decide: argFlag('decide'),
+      text: argFlag('text'),
+      deps,
+    };
+    // straight to the ONE shared engine, not through a door function: `ctx`
+    // here already carries `resume` AND `door` exactly as argv gave them
+    // (both, if the operator passed both), and it is `execute` itself that
+    // must see both to raise the "two different runs in two different
+    // states" refusal — picking a door here first would silently drop
+    // whichever flag lost, and that refusal would never fire.
+    return await execute(ctx);
+  } catch (/** @type {any} */ e) {
+    if (e instanceof ExitSignal) return e.code;
+    throw e;
+  }
+}