bareloop 0.29.0 → 0.31.0

package/CHANGELOG.md

@@ -5,6 +5,138 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.31.0] — 2026-09-29
+
+### Added
+
+- **Panel Chat authoring (P3)** — the Chat tab now drafts a job from the page: a job card
+  (source, goal, Model, `Cap $` / Time cap), a chat thread, and Send / Revise / **Sign &
+  run** actions, backed by new `POST /api/author/*` routes. Every POST needs the
+  per-server-start token plus an Origin/Host check (the human-click guard); the sign route
+  additionally requires the exact spec hash from the session's own signing file and is the
+  only path that ever spawns `run-u` (argv array, ends in `--approve <hash>`). A single
+  progress indicator (amber cycling dots, green `[done]`, red `[stopped]` with the reason)
+  replaces per-phase chat bubbles; step lines carry no who-label; a pending ask always wins
+  the label ("waiting for your OK" / "install needed" / "waiting for your answer"). The
+  page opens on the Chat tab.
+- **Install-needed pause + Check again** — a repo copy with missing dependencies no longer
+  refuses outright: the session pauses, names the copy and the exact install command, and a
+  **Check again** button re-runs the same check on the same copy (bareloop still never
+  installs anything).
+- **Model check under Model** — one `[✓]`/`[✗]` line: key found/missing/bad-shape/rejected
+  (401/403 reads "key rejected", not "may be flaky") plus a $0 GET-only reachability probe
+  (`GET /api/author/model-check`, `checkProviderReachable` in `src/providers.js`). A missing
+  or bad key blocks Start; an unreachable endpoint shows red but never blocks.
+- **One cap covers drafting + run** — the separate Drafting cap field is gone. Drafting runs
+  under the same signed Cap `$`, and at sign the run's enforced ceiling is Cap minus what
+  drafting already spent. `runJob` takes `draftSpentUsd` and `draftSpendComplete` (carried on
+  `job-start` as their own fields, never `priorSpentUsd`, so a first run never reads as a
+  resume); `run-u` gains `--draft-spent-usd <n>` and `--draft-spend-incomplete` (validated
+  like `--read-shim`/`--scout`, carried in every resume/decide re-invocation tail);
+  `bareloop author` prints its drafting spend and the exact `run-u` command. Spend renders
+  as "$X ($Y drafting) of $Z", and an incomplete drafting fold reads "at least" on both
+  figures.
+- **Plain-question check lines** — the "checks N/M" headline is withdrawn. Run-tab part
+  cards and the Audit tab show "all N checks passed" or the first failing check in plain
+  words, e.g. "check #2 src/checks.js has 0 type errors? — 4 left, need 0"; an expanded
+  attempt row lists every declared check in order, including ones that never ran
+  ("not run"). One server-side owner maps each declared stage to its question ("did it
+  change any file?", "no casts or silencers added?", "does the test suite pass?", "no
+  failing tests?", …); numbers use three closed shapes ("N left, need T" / "N of total" /
+  "N, limit M").
+- Coloured `[✓]`/`[✗]` result glyphs on Run-tab part cards.
+- The fix worker's prompt now carries a facts-only close-grade history: "checks passed
+  N/M -> N/M -> …" (over the DECLARED stage count) and each stage's own number history
+  ("count-stage 12 -> 0"). Nothing generated, no advice.
+
+### Changed
+
+- **Panel money renders at 2 decimals everywhere** (`<$0.01` for a real sub-cent amount, a
+  floor rounds down). The CLI's 4-decimal `--all` output is unchanged.
+- **The "worse than before" confirm-turn question is retired** from both the panel and the
+  CLI — an empty answer always meant "nothing beyond Guardrails"; it now is never asked.
+- Chat tab cap row and labels follow the mockup (`Cap $`, `Token price $`, Time cap);
+  Audit tab Time cells show `HH:MM:SS` (full ISO on hover) instead of overflowing at
+  390px.
+
+### Fixed
+
+- **Live runs show a running floor, not "unknown"** — "$X so far (Y drafting) of $CAP ·
+  running Zm" on the Summary box and on a live run's own card; part-level tool counts on
+  a live run resolve through the same live audit-sidecar reader as the Audit tab.
+- **Job tab was permanently blank** — two elements shared `id="job-card"`; the read-only
+  card is now `job-card-readonly`, with a regression test banning duplicate ids.
+- **A failed or rejected chat POST no longer loses the typed answer** — the input clears only
+  on a proven success and errors persist in their own element instead of being wiped by
+  the 2-second poll.
+- **Fix-loop governor reads a declared close's numbers (F198)** — it fed on text-parsed
+  grades that read `null` for every declared count-not-worse gap; it now reads the close's
+  structured `{stage, value}`, so its progress/strike counting sees real convergence or
+  stalling. No limit or direction change.
+- **Escalated fix-loop exhaustion no longer advertises `--resume` (F197)** — `escalated` is
+  not resumable, so the option states that plainly instead of an unreachable "rerun with
+  --resume".
+- The plan part's wall time no longer reads ~0.0s for a real multi-second call (replay-side
+  fix; display only).
+- "Checks passed N/M" uses the declared stage count, not the count that ran under
+  first-red-wins — in the panel and in the fix worker's prompt (F203).
+
+### Docs
+
+- `bareloop.context.md` documents the `/api/author/*` routes, `draftSpentUsd`,
+  `draftSpendComplete`, `--draft-spent-usd`, `--draft-spend-incomplete` and
+  `moneyWithDraft`; PANEL-BUILD.md and the PRD carry the dated P3 / one-cap addenda.
+
+## [0.30.0] — 2026-09-27
+
+### Added
+
+- **Panel step map draws the retry loop** — a multi-attempt step (and the post-step fix loop)
+  now renders its "try N" curve and label on the map, alongside a pulsing amber dot on the
+  live-running box (same geometry as `design/panel-mockup.html`).
+- **Runs list and open run poll live** — a single poll owner refreshes the Runs list every
+  tick and the open run's own detail while it is still live (`▶`), stopping once it dies
+  (`?`) or gets a real `✓`/`✗` verdict; polling pauses on a hidden tab and catches up on
+  return. Re-renders are skipped when the fetched payload is unchanged, and scroll position
+  is preserved across poll-driven rebuilds.
+- `scripts/replay-live.mjs` (**dev-only, not shipped** — excluded from the published
+  package) paces an archived spine into a live-looking run for panel development and
+  screenshot proof, without touching the source spine or `~/.config/bareloop`.
+
+### Changed
+
+- **Job tab field order**: Check type, Model, `$` cap / Time cap, then the rest — moved per
+  hamr's ruling.
+- Job tab no longer shows a separate Job name field; the run's own card title already
+  carries it.
+
+### Fixed
+
+- The retry loop's "try N" curve and label now stay inside their own step box at every
+  width, including narrow/mobile widths (previously could render past the box's left edge
+  at widths like 350px).
+- An open (still-running) attempt on a live run now reads `▶` everywhere — map, part cards,
+  and Audit tab — never the died `?`, which is reserved for a genuinely died attempt.
+- The `[▶]` glyph now pulses for a live run everywhere it appears (runs list rows,
+  Workflows, the run header).
+- A running step's own in-progress attempt no longer leaks into a phantom fix-loop part on
+  the map.
+- A live fix-loop attempt whose window is still open now reports its outcome as unknown
+  rather than a fabricated red, so the map correctly shows it as running (with its pulsing
+  dot) instead of prematurely stopped.
+- A live run's Audit tab and tool-call/cache summary now fall back to the during-run
+  tree/worktree gate-audit path, so tool calls are visible while a run is still in progress,
+  not only after it finishes.
+
+### Notes
+
+- F195 (open): `/api/runs` re-replays every archived spine on every call (~457ms CPU at 250
+  rows, no per-row cache). Mitigated in this release by throttling the Runs list poll to
+  10s; the root cause is still open.
+- F196 (parked): a finished bundle run's tool log can be unreadable due to a sidecar naming
+  mismatch between `spine.jsonl` and its renamed gate-audit sidecar. Not fixed in this
+  release.
+
 ## [0.29.0] — 2026-09-26
 
 ### Added

package/bareloop.context.md

@@ -1160,7 +1160,37 @@ Reserved spine vocabulary (V7, machinery-free until job #1 surfaces one):
 `coordination-red` — a failure between units (scope contention, step order, store
 races), never to be folded into worker/interpreter reds.
 
-### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, closeDir?, layerRoot?, readShim?, scout?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun?, resumable? })` → outcome — `src/run.js`
+### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, closeDir?, layerRoot?, readShim?, scout?, bridge?, draftSpentUsd?, draftSpendComplete?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch?, humanRuling?, heldRuling?, reviewDoor?, doorRerun?, resumable? })` → outcome — `src/run.js`
+
+**`draftSpentUsd` (hamr's ruling 2026-09-28, "one cap covers drafting + run") — money the
+AUTHORING pipeline already spent on this job before it was signed.** Shrinks THIS run's own
+enforced ceiling (the one place the arithmetic lives: `remainingUsd() => Math.min(shellCapUsd,
+job.budgetUsd - draftFoldUsd - spentUsd)`), never the signed `budgetUsd` itself. Deliberately
+NOT `priorSpentUsd` — that key means "a previous attempt of this run died and folded its spend
+forward," read by `src/replay.js`'s `resumed` flag off the key's bare presence; a drafting fold
+must never make an ordinary first run read as a resume. Belted like `priorSpentUsd` (a
+non-finite or negative value reads as 0). Rides onto `job-start` as its own field,
+`draftSpentUsd`, only when > 0 — never inside `spentUsd`/`engagementSpentUsd`, which stay
+run-only. `bareloop run-u --draft-spent-usd <n>` is the CLI door (validated: finite, ≥ 0, else
+refused); `bareloop author` prints its own known drafting spend floor and the exact `run-u`
+command including the flag; the panel's sign route passes the session's own tracked drafting
+spend the same way. `src/replay.js`'s `moneyWithDraft(spendCore, draftSpentUsd, budgetUsd?, draftSpendComplete?)` is
+the one shared display formatter: `"$3.71 ($0.81 drafting) of $5.00"`, unchanged
+(`spendCore`/`spendCore of $cap`) when a run carries no drafting share. When
+`draftSpendComplete === false` it reads `"at least $3.71 (at least $0.81 drafting) of $5.00"`
+(the core is not double-prefixed if it is already a floor).
+
+**`draftSpendComplete` (default `true`; hamr's ruling 2026-09-28, 2nd addendum) — was the
+`draftSpentUsd` fold EXACT?** The authoring pipeline's metered-call list can go unpriced (F6)
+and the unknown does not heal by folding forward, so a drafting figure that is only a floor
+must say so. A NEW field beside `draftSpentUsd`, never a value inside `spendComplete` or
+`priorSpendComplete` (those answer "is THIS run's own ledger exact"; merging them would let a
+floor drafting spend read as an exact run). Read only when `draftSpentUsd` is emitted: rides
+onto `job-start` as `draftSpendComplete` beside `draftSpentUsd` (only when the fold is > 0);
+only an explicit `false` counts as incomplete — anything else, garbage included, reads `true`,
+so an unreadable flag never manufactures a false floor. `src/replay.js` surfaces it as
+`summary.draftSpendComplete` (`null` when no drafting fold; a job-start lacking the field reads
+`true`) and feeds it to `moneyWithDraft`.
 
 **`closeTimeoutMs` (PRD item 27/M3) is now OPTIONAL for every real caller.** Omit it (both
 `src/cli.js`'s bundle runner and `src/userrun.js` — lifted out of `scripts/run-u.mjs` by
@@ -1276,6 +1306,26 @@ knob, not a product default — the spec names no scout, so the signed hash is u
 `--read-shim`: an unrecognised value exits 2 at argv, and every re-invocation the runner prints
 carries `--scout off` when set, so a resume never silently drops the arm.
 
+**`bareloop run-u --draft-spend-incomplete`** is a boolean presence-flag (no value) that sets
+`runJob`'s `draftSpendComplete: false`, saying the `--draft-spent-usd` figure is a floor. It
+has no guard against being passed without `--draft-spent-usd` — alone it is inert (nothing is
+folded, so no `job-start` field is emitted). Every printed re-invocation tail carries it
+alongside `--draft-spent-usd` (only when drafting spend > 0), so a resumed leg never turns the
+floor back into an exact figure; `bareloop author` and the panel's sign route pass it when the
+session's drafting spend was incomplete.
+
+**`bareloop run-u --draft-spent-usd <n>`** (hamr's ruling 2026-09-28, "one cap covers drafting +
+run") is the same runner-territory class: a non-finite or negative value exits 2 at argv, before
+the approval gate — never coerced, since reading garbage as 0 would silently WIDEN the run's own
+enforced ceiling and reading it as `Infinity` would silently narrow it into "no cap". The spec
+names no drafting spend, so the signed `budgetUsd` is unaffected; this only shrinks THIS leg's
+own enforced remainder (`job.budgetUsd - draftSpentUsd - spentUsd`). Every printed
+resume/decide/door re-invocation carries `--draft-spent-usd` too, mirroring `--read-shim`'s own
+tail — a resumed leg that dropped it would silently widen its ceiling back up. `bareloop author`
+prints the exact `run-u` command including this flag, with its own known drafting spend (a floor,
+never $0 on an unpriced call — F6). The panel's sign route (`src/panel/authorroutes.js`)
+passes the same flag off the authoring session's own tracked spend.
+
 **The review door's two checkpoint terminals (N4 slice 1, doors re-cut 2026-08-18)** are the
 class's whole surface at this layer, and each is a CLEAN exit (`spendComplete` stays true —
 only the two casualties floor). The pause terminal is a
@@ -1554,7 +1604,10 @@ greens harmed — all three historical fix-loop greens converted in ≤ 2 verdic
 case caught, dead flat at 2 errors for 7 verdicts until the wall). It now stops on the same
 2-strike no-progress rule, read off a DIFFERENT signal: the close's own graded numbers, **per
 stage** (`src/trend.js`). A stage's series is the first number on the first red-marked line of
-its output, compared only against that stage's own BEST so far (never last-only, the same
+its output (for a DECLARED close the structured `{stage, value}` its verdict already carries —
+`closeGrade`, F198 — never a re-parse of the gap prose, which reads every declared grade as
+uncomparable; a command close, and a worker-crash's synthetic gap, still read the text),
+compared only against that stage's own BEST so far (never last-only, the same
 oscillator reason the ladder keeps a seen-set); reaching a LATER stage than ever before is
 progress too, since a staged close is first-red-wins. Two consecutive comparable readings with
 nothing improving ends the loop, under the unchanged `cap-halt` terminal and the unchanged
@@ -1578,6 +1631,10 @@ vs `the target files are clean but M error(s) exist outside them`) donates both
 series, and a run crossing that seam can read converging on work that only swapped which wall
 it is behind. Neither is sharpened by teaching the reader to tell prose shapes apart (the F49
 precedent); the second's root fix is a stage split in the close, which is the spec's to change.
+The fix worker's prompt also gains one facts-only line ("The close's own numbers so far, oldest
+first": checks-satisfied counts and each stage's number history, F198) — no advice, omitted when
+nothing was graded. This exhaustion terminal is `escalated`, a graded red that `--resume`
+refuses, so its options say plainly it cannot be resumed (revise the spec and rerun fresh, F197).
 The spine gains a per-iteration `ladder` record here too; every reading names its `governor`
 (`step-ladder` | `close-trend`) so two instruments under one event type can never be averaged
 into one number.
@@ -2553,7 +2610,7 @@ reimplements for the tool-call breakdown. It returns one plain object:
 
 ```
 { runId, job, goal, budgetUsd, specHash, branch, verdictType, model, code,
-  outcome, stopReason, spentUsd, spendComplete, wallMs, chainClock,
+  outcome, stopReason, spentUsd, spendComplete, draftSpentUsd, wallMs, chainClock,
   resumed, resumeSeed, thisFileSpend, spendMismatch,
   timelineKind: 'steps'|'iterations', replans, close,
   steps: [{ id, occurrence, outcome, rounds, toolCalls, checks: {passed, failed},
@@ -2583,6 +2640,13 @@ the model string, or `-`) — `model` is kept FULL, never truncated, unlike the
 column: a wrong or uncertain model reading is exactly the thing a directory-wide scan needs in
 full, not cut.
 
+**`draftSpentUsd`** (hamr's ruling 2026-09-28, "one cap covers drafting + run") reads
+`job-start.draftSpentUsd` — `null` on every run that never drafted through the panel/`bareloop
+author` (the common case, and every spine predating the field), the drafting spend FLOOR
+otherwise. Never `priorSpentUsd` (that key drives `resumed` below — see `runJob`'s own doc) and
+never folded into `spentUsd`. `summarizeForAllLine`'s `spend` column and every panel money
+display route this through `moneyWithDraft` (above).
+
 **`code`** (F118, the run→code direction — the commit→run direction is the prompt-commit
 check's `Failure:` run-reference rule; the two are companion halves of one loop, built the
 same day). `codeVersion()` (`src/codeversion.js`) is a pure, $0, no-shell reader: `version`
@@ -3230,7 +3294,14 @@ interviews of their own. All three are dispatched by name only: `bareloop run-u
   paged, for the Audit tab's Grouped view); `GET /api/runs/:runid/job` (the signed spec's
   own fields, ONLY when a bundle-layout run's `spec.json` is reachable — a run-u run has
   none on disk, and this reads `resolved:false` with every spec-only field honestly
-  `'unknown'`, never guessed from the spine's own narrower `job-start` record). Every
+  `'unknown'`, never guessed from the spine's own narrower `job-start` record). The run
+  detail also carries `draftSpentUsd`/`draftSpendComplete` (the drafting share of the one cap,
+  `null` when none), `spendFloorUsd`/`wallFloorMs` for a died OR still-running spine (a
+  floor, never `unknown`), and — when a spec resolves — per part attempt `declaredStagesTotal`
+  and `declaredStages[{name, question}]` in DECLARED order, plus per stage `kind`/`direction`/
+  `baselineKind`/`question`: the plain-English question is derived in `src/panel/server.js`
+  (`stageQuestionText`) from the signed stage's kind/params only, `null` when no honest
+  wording exists (the client then shows the stage's own name). Every
   endpoint is GET/HEAD only (anything else — including every write verb — is `405`); a URL
   never joins a path segment into a filesystem read — a runid is looked up in the run list
   first (`RUNID_RE`, `src/panel/server.js` — accepts a `~2`-style backfill-disambiguated
@@ -3243,6 +3314,69 @@ interviews of their own. All three are dispatched by name only: `bareloop run-u
   its own. Chat/Settings/authoring (P3/P4) are not built yet; the page says so rather than
   hiding the gap.
 
+- **Panel P2 (live run view, `docs/product/PANEL-BUILD.md` Addendum 2026-09-27)** → the page
+  polls, it does not push (no SSE/websocket). One `setInterval` (2s) drives two throttled
+  fetches: the OPEN run's own detail (`GET /api/runs/:runid`) refetches every 2s while its
+  glyph is live `▶`, and stops the instant it reaches a real `✓`/`✗` or dies `?`; the left
+  Runs list refetches on a separate 10s throttle inside the same tick (`RUNS_LIST_POLL_MS`,
+  lowered from the original 2s per F195 — `listRuns()` re-replays every archived spine on
+  every call, ~457ms CPU at 250 rows, open/escalated), except the tick right after the open
+  run stops being live, which forces one immediate list refresh so that row's glyph doesn't
+  wait up to 10s. Both fetches skip re-rendering when the payload's JSON is byte-identical to
+  the last one, restore each pane's scroll position across a poll-driven rebuild, and pause
+  while the tab is hidden (`document.hidden`), catching up immediately on
+  `visibilitychange`. The Audit tab does **not** join this loop — it refetches only when
+  opened/switched to. A live run's gate-audit sidecar (before `run-u`/`bareloop run`'s
+  end-of-run rename) is read from its DURING-RUN path (`<row.patient>/gate-audit.jsonl`) via
+  `resolveAuditPathForRow` (`src/panel/server.js`), the one shared owner the Run tab's tools
+  summary and the Audit tab both read through — tried only while the run's own spine has no
+  `job-end` yet, so a finished run never risks reading a stale leftover file at that path.
+  `scripts/replay-live.mjs <sourceSpine> <outDir> [--speed N]` is a dev-only, unshipped ($0,
+  no provider call) instrument that paces a real archived spine's records back out under a
+  new runid so the panel can be exercised against a "live" run without a paid run — it is not
+  a substitute for watching a real run start-to-end, which stays a separately authorized step.
+
+- **Panel P3 (chat/authoring, `docs/product/PANEL-BUILD.md` Addendum 2026-09-27)** → the ONE
+  family of write routes the panel serves, all under `/api/author/*` (`src/panel/
+  authorroutes.js`); every other route stays GET/HEAD-only per P1's own rule. Every route
+  requires the human-click guard: an `x-bareloop-token` header matching a fresh token minted
+  once per server start (templated into `index.html` like the port) AND an Origin/Host
+  naming this exact `127.0.0.1:<port>` — a request failing either gets `403`, before the
+  route body ever runs. `POST /api/author/start` (one job-card body; `409` while a prior
+  session is still non-terminal — one authoring session at a time) creates a session
+  (`src/panel/authorsession.js`) that runs `prepareSource`/`detectLanguage`/`validateJob`/
+  `authorCloseForJob`/`assembleSpec`/`prepareSigning` in-process, exactly the library calls
+  `bareloop interview`/`bareloop author` already make — never a script's own readline loop,
+  never a reimplementation of any gate. `GET /api/author/model-check?model=<id>` is the $0 readiness probe the job card runs
+  before Start (`checkProviderReachable`, `src/providers.js` — a models-list GET only, never a
+  completion; the page sees the key's NAME and a status word, never the value). `POST
+  /api/author/:id/check-deps` is the install-gap's "Check again" (`phase:'install-needed'`:
+  the session waits on the person's own install, then re-runs `missingDependencies` on the
+  same copy — bareloop never installs). `GET /api/author/:id` polls the session's state
+  (phase, chat messages, cost, `revisesLeft`, `specHash` once prepared). `POST /api/author/
+  :id/send {text}` answers whatever the confirm turn is currently asking (the `language` pick or a plan's
+  own follow-up question — the old `worseThanBefore` ask is retired, 2026-09-28) — refused outright when the pending ask is the
+  plan MENU itself (`{ok:false}`, no route from chat text to a plan decision, ever). `POST
+  /api/author/:id/revise {text}` is the menu's own `fix` pick, with the chat text as the
+  correction (D3: max 2 rounds, `revisesLeft` derived from the confirm turn's own round
+  number, never a second hardcoded cap). `POST /api/author/:id/sign-prepare` is the menu's
+  own `confirm` pick — it runs gates 1–4 and reaches `phase:'prepared'` with a `specHash`; it
+  NEVER signs. `POST /api/author/:id/sign {specHash}` is the ONLY route that spawns a run —
+  it refuses unless `phase==='prepared'` and the posted hash matches the session's own
+  `signing.json` `specHash` exactly, then spawns `setsid systemd-inhibit … node bin/
+  bareloop.mjs run-u --spec <resolved-spec.json> --approve <hash>` (plus `--draft-spent-usd <n>`
+  [`--draft-spend-incomplete`] when the session's drafting spend is > 0 — one cap covers
+  drafting + run) detached (array argv,
+  never a shell string), with its own log file inside the session's own dir, and the
+  server's own environment (a key is never read into or sent to the page — a missing one
+  refuses the session at $0, naming only the env var). `src/panel/authorsession.js` takes
+  test-only DI seams (`scout`/`generate`/`confirmGenerate`/`authorFn`/`prepareSigningFn`) so
+  a test can drive the real ask()-channel/revise/hash wiring without a live provider call;
+  none of them are reachable from `authorroutes.js`'s real construction path. Sessions live
+  under `~/.config/bareloop/panel-sessions/<id>/` (each one's own `resolved-spec.json` and
+  `signing.json`, the two files `bareloop author` itself already writes). Edit/re-sign, the
+  `~/.config/bareloop/.env` keys-file loader, and Settings are P4, not built here.
+
 - **`bareloop run-u <flags…>`** (PANEL-BUILD.md P0 task 2/4) → the person-path run flow
   (the JOBS-table/`--spec` runner, resume, the review door — `docs/logs/FINDINGS.md`'s
   U-mode). `src/cli.js`'s `run-u` dispatch hands `rest` straight to
@@ -3305,6 +3439,15 @@ interviews of their own. All three are dispatched by name only: `bareloop run-u
   returns a code / throws" rule `src/userrun.js` already keeps. Like `interview`, `src/cli.js`
   hands it raw `stdin`/`stdout`/`stderr` (its one interactive seam is the confirm turn).
 
+  **`--budget` and `--draft-spent-usd` (hamr's ruling 2026-09-28, "one cap covers drafting +
+  run"):** `--budget` still means the AUTHORING ceiling, unchanged — the panel sets it equal to
+  the job card's one `Cap $`. On a SIGNING PREPARED stop, `author` prints its own known
+  drafting spend (a floor, never $0 on an unpriced call — F6) and the exact `run-u` command to
+  run it, now including `--draft-spent-usd <known-floor>` when that floor is > 0 — the SAME
+  signed `budgetUsd` is the run's cap too, and `run-u` enforces the remainder
+  (`Cap $ − drafting spent`) as ITS own ceiling. Nothing here is left for a person to
+  hand-compute or re-type, the same rule F185 set for `--spec`.
+
 **Tighten-only budget/wall.** `--budget`/`--wall` on `bareloop run` may only lower the
 bundle's own signed `budgetUsd`/`maxWallMs` — `checkEnvelope`'s `envelope-widen` red refuses
 anything higher. Raising a ceiling is a re-export (a new signed bundle), never a runner flag.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",

package/src/authorflow.js

@@ -425,32 +425,18 @@ export function labelsFor(verdictType) { return questionSet(verdictType).labels;
 
 // ── CONFIRM TURN — person-facing wording (PRD item 33 M3 piece 4) ──────────
 //
-// These three are the $0, no-provider half of the confirm turn (D7): asked
-// before the scout ever runs, so a missing person at end of input stops at
-// $0 rather than after a paid call. FROZEN wording, exactly like SOURCE_FIELD
+// These are the $0, no-provider half of the confirm turn (D7): asked before
+// the scout ever runs, so a missing person at end of input stops at $0
+// rather than after a paid call. FROZEN wording, exactly like SOURCE_FIELD
 // and DESTINATION_FIELD_* above — a caller prints these verbatim, never
 // rewords or reorders them.
-
-/**
- * Asked ONLY for a repo source (ruling 2 addendum's D7) — a plain folder or a
- * URL has no "before" a repo's own history gives it to compare against. This
- * is the OLD Q5 wording, verbatim ("What would make you say this came back
- * worse than before?"), which M3 piece 3's reshape folded into Guardrails —
- * it survives here as its OWN field because the confirm turn (ruling 5's
- * 2026-09-13 addendum) includes it as a constraint only when the person
- * actually gave one, and folding it silently into the Guardrails free-text
- * slot would lose that "present or absent" distinction. An empty answer is
- * "nothing beyond what Guardrails already said" and is not required — see
- * the frozen-wording test below: this phrase appears NOWHERE in
- * {@link questionsFor}'s own sets, so a caller cannot double-ask it by
- * reading the wrong table.
- */
-export const WORSE_THAN_BEFORE_FIELD = Object.freeze({
-  id: 'worseThanBefore',
-  kind: 'mechanical',
-  label: 'Worse than before',
-  prompt: 'What would make you say this came back worse than before?',
-});
+//
+// RETIRED (hamr's ruling, 2026-09-28): the old Q5 "worse than before" field
+// and ask are gone — it was optional, and an EMPTY answer already meant
+// "nothing beyond Guardrails", so it never earned its own turn. `worseThanBefore`
+// downstream (confirmPrompt, `accepted.worseThanBefore`) is kept and always
+// resolves to `''` — the same value an empty answer always produced — so
+// nothing downstream needed to change shape, only the ask itself is gone.
 
 /**
  * Asked ONLY when `src/detectlang.js`'s `detectLanguage` reports its
@@ -1832,7 +1818,10 @@ async function askConfirmPlan({ convo, generate, mode, book, label }) {
  *   generate: Function, book: ReturnType<typeof makeCostBook>,
  *   ask: (step: {kind: string, [k: string]: any}) => Promise<string|null>,
  *   onPhase?: (phase: string, data?: any) => void, mode?: 'tool'|'text',
- *   worseThanBefore?: string}} o
+ *   worseThanBefore?: string}} o retired field (hamr's ruling 2026-09-28):
+ *   `worseThanBefore` is never asked any more and defaults to `''` — a
+ *   caller may still pass a string through (kept for a future, non-ask
+ *   source of the same constraint), it just never comes from an ask() step.
  * @returns {Promise<{ok: boolean,
  *   stop: null|'cap-halt'|'pricing-red'|'provider-red'|'artifact-red'|'confirm-abandoned'|'confirm-restart',
  *   rounds: number,
@@ -1843,13 +1832,12 @@ async function askConfirmPlan({ convo, generate, mode, book, label }) {
 export async function runConfirmTurn({
   verdictType, answers, questions, labels = {}, facts = null, listing = null, writeScope = null,
   isRepo, lang, generate, book, ask, onPhase = () => {}, mode = 'tool',
-  // `undefined` (the default) means "ask me" — every S2 caller (nothing
-  // pre-resolves this). A caller that already asked worseThanBefore itself
-  // (`authorCloseForJob`'s own $0 phase, run BEFORE the scout per D7) passes
-  // the resolved string straight through, and this turn asks nothing a
-  // second time. `''` is a legal resolved answer ("nothing beyond
-  // Guardrails") and is NOT the same as "ask me" — only `undefined` is.
-  worseThanBefore: presetWorseThanBefore = undefined,
+  // RETIRED ASK (hamr's ruling 2026-09-28): this turn never asks
+  // "worseThanBefore" any more — an absent value always resolves to `''`,
+  // byte-identical to what an empty answer always produced. A caller may
+  // still pass a resolved string through (kept as a plain pass-through, not
+  // an ask trigger).
+  worseThanBefore: presetWorseThanBefore = '',
 }) {
   /** @typedef {null|'cap-halt'|'pricing-red'|'provider-red'|'artifact-red'|'confirm-abandoned'|'confirm-restart'} ConfirmStop */
   /** @returns {{ok: boolean, stop: ConfirmStop, rounds: number, accepted: null, reds: Red[], cost: any}} */
@@ -1858,16 +1846,8 @@ export async function runConfirmTurn({
   const abandon = (rounds) => ({ ...base(), stop: /** @type {ConfirmStop} */ ('confirm-abandoned'), rounds, cost: book.report() });
 
   // ── the $0 half, entirely before any token spends (D7) ────────────────────
-  /** @type {string} */
-  let worseThanBefore = '';
-  if (presetWorseThanBefore !== undefined) {
-    worseThanBefore = presetWorseThanBefore;
-  } else if (isRepo) {
-    onPhase('confirm-worse-than-before');
-    const wtb = await ask({ kind: 'worseThanBefore', field: WORSE_THAN_BEFORE_FIELD });
-    if (wtb === null) return abandon(0);
-    worseThanBefore = redactSecrets(String(wtb).trim());
-  }
+  // no ask here any more — see the retirement note above.
+  const worseThanBefore = typeof presetWorseThanBefore === 'string' ? presetWorseThanBefore : '';
 
   /** @type {string} */
   let resolvedLang = typeof lang === 'string' ? lang : '';

package/src/authorjob.js

@@ -111,7 +111,7 @@ import {
 } from './authoring.js';
 import {
   QUESTION_SETS, questionsFor, requiredAnswersFor, authorClose, makeCostBook,
-  runConfirmTurn, WORSE_THAN_BEFORE_FIELD, LANGUAGE_PICK_FIELD,
+  runConfirmTurn, LANGUAGE_PICK_FIELD,
 } from './authorflow.js';
 import { runAuthorScout, buildSeedListing, SCOUT_ATTEMPTS } from './authorscout.js';
 import {
@@ -498,14 +498,11 @@ export async function authorCloseForJob({
   // paid survey. `ask` ABSENT is the whole confirm turn's off switch — every
   // caller that predates this piece (or a caller that never wires an
   // interactive seam) reaches the genre check below exactly as it always did.
-  let worseThanBefore = '';
+  // RETIRED (hamr's ruling 2026-09-28): the "worse than before" ask is gone —
+  // it was optional and an empty answer already meant "nothing beyond
+  // Guardrails", so `worseThanBefore` always resolves to `''` now, never asked.
+  const worseThanBefore = '';
   if (ask) {
-    if (isRepo) {
-      onPhase('confirm-worse-than-before', {});
-      const wtb = await ask({ kind: 'worseThanBefore', field: WORSE_THAN_BEFORE_FIELD });
-      if (wtb === null) return { ...base, interview, reds: [], stop: 'confirm-abandoned' };
-      worseThanBefore = redactSecrets(String(wtb).trim());
-    }
     if (langResult?.kind === 'ambiguous') {
       onPhase('confirm-language-pick', { candidates: langResult.candidates });
       const pick = await ask({ kind: 'language', field: LANGUAGE_PICK_FIELD, candidates: langResult.candidates });

package/src/authorrun.js

@@ -348,8 +348,9 @@ export async function main(argv, deps = {}) {
   // Only meaningful for a REPO source (PRD item 33 M3 piece 4, step S6): a
   // plain folder has no genre to detect and no code-shaped manifest to walk —
   // `LANG`/`langResult` stay at their "nothing to see" values and the confirm
-  // turn further down runs with `isRepo: false` (D5), which is what already
-  // skips the repo-only "worse than before" ask and the language pick alike.
+  // turn further down runs with `isRepo: false` (D5), which is what skips
+  // the language pick (the old repo-only "worse than before" ask is retired
+  // entirely as of 2026-09-28 — see src/authorflow.js's own retirement note).
   let langResult = /** @type {ReturnType<typeof detectLanguage>|null} */ (null);
   let LANG = 'none-detected';
   if (IS_REPO_SOURCE) {
@@ -702,9 +703,10 @@ export async function main(argv, deps = {}) {
     return String(value);
   };
   /** one free-text answer, possibly several lines; a blank line ends it.
-   * `allowBlank` lets the FIRST line be blank — `worseThanBefore`'s "nothing
-   * beyond Guardrails" is a legal, non-required answer, unlike every other
-   * free-text step below.
+   * `allowBlank` lets the FIRST line be blank — kept as a general option for
+   * a future optional free-text step; every current step below passes
+   * `false` (the old "worse than before" ask, retired 2026-09-28, was the
+   * only caller that ever passed `true`).
    * @param {boolean} allowBlank @returns {Promise<string|null>} */
   const readFreeText = async (allowBlank) => {
     /** @type {string[]} */
@@ -729,11 +731,6 @@ export async function main(argv, deps = {}) {
    * @param {{kind: string, [k: string]: any}} step @returns {Promise<string|null>} */
   const ask = async (step) => {
     out('');
-    if (step.kind === 'worseThanBefore') {
-      out(step.field.prompt);
-      out('  (press Enter on a blank line for "nothing beyond Guardrails")');
-      return readFreeText(true);
-    }
     if (step.kind === 'language') {
       out(step.field.prompt);
       for (const c of step.candidates ?? []) out(`  · ${c}`);
@@ -1201,7 +1198,15 @@ export async function main(argv, deps = {}) {
         // buys a real judge call per case, so a line saying "the gates spend no
         // tokens" would have been false the moment a judged close reached here.
         out(`authoring  ${costLine(authored.cost)}`);
-        out(`total cost ${costLine(costSoFar())}${judges ? '   (includes the calibration gate\'s judge calls)' : '   (gates 1-3 spend no tokens — they run commands)'}`);
+        const totalCost = costSoFar();
+        out(`total cost ${costLine(totalCost)}${judges ? '   (includes the calibration gate\'s judge calls)' : '   (gates 1-3 spend no tokens — they run commands)'}`);
+        // hamr's ruling 2026-09-28 ("one cap covers drafting + run") — this
+        // run's own known FLOOR (never $0 on an unpriced call, F6), handed to
+        // the run-u command below as `--draft-spent-usd` so the SIGNED run's
+        // own enforced ceiling becomes Cap $ minus what THIS pipeline already
+        // spent, computed in the one place (`src/run.js`'s `remainingUsd`)
+        // that arithmetic lives — never re-derived here.
+        const draftSpentUsd = typeof totalCost.costUsd === 'number' ? totalCost.costUsd : totalCost.knownUsd;
 
         if (!signing.ok) {
           out('\nSIGNING NOT PREPARED — the close did not clear D9\'s gates. Nothing was signed and nothing was run.');
@@ -1222,8 +1227,19 @@ export async function main(argv, deps = {}) {
           // person needs to run their own job, nothing left to hand off.
           // `providerEntry.envKey` (never a hardcoded ANTHROPIC_API_KEY) is the
           // same F187 rule scripts/run-u.mjs's own hint already follows.
+          // hamr's ruling 2026-09-28 (2nd addendum) — `totalCost.costUsd === null`
+          // means this pipeline's own metered list carried at least one unpriced
+          // call (`tallyCalls`'s `spendComplete: false`), so the drafting fold is
+          // a FLOOR, and the run-u command below must say so via its own
+          // presence-flag rather than let the next leg's job-start read it as
+          // exact.
+          const draftIncomplete = totalCost.costUsd === null;
+          if (draftSpentUsd > 0) {
+            out(`\n  drafting spent ${draftIncomplete ? `at least $${draftSpentUsd.toFixed(6)}` : `$${draftSpentUsd.toFixed(6)}`} — the run's own cap is the SAME signed $${spec.budgetUsd}, `
+              + 'and run-u will enforce the remainder (Cap $ minus this) as ITS ceiling — pass --draft-spent-usd exactly as shown below, never a rounded or re-typed figure.');
+          }
           out('\nTo run it (the same signature and gates as any other job — nothing here bypasses them):');
-          out(`  ${providerEntry.envKey}=... node scripts/run-u.mjs --spec ${specFile} --approve ${hash}`);
+          out(`  ${providerEntry.envKey}=... node scripts/run-u.mjs --spec ${specFile} --approve ${hash}${draftSpentUsd > 0 ? ` --draft-spent-usd ${draftSpentUsd}${draftIncomplete ? ' --draft-spend-incomplete' : ''}` : ''}`);
           emit('author-end', { outcome: 'prepared', specHash: hash });
         }
       }