bareloop 0.29.0 → 0.31.0

package/src/planrun.js

@@ -3864,7 +3864,41 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       blindCap: capRuns,
       directions: stageDirections,
     });
-    fixTrend.record({ gap: post.gap ?? '' });
+    // F198: feed the STRUCTURED {stage, value} a declared close already produced
+    // (`closeGrade`, src/declaredclose.js) rather than re-parsing `post.gap` through
+    // `readGrade`'s `\bred\b` scan — a declared close's own gap prose never carries
+    // that word, so the text path read every declared grade as an uncomparable
+    // null. `post` IS `lastCloseVerdict` here (this is the opening grade, straight
+    // off `judgeClose()`, before any crash-message substitution can occur), so
+    // `closeGrade(post)` is exact. `readGrade` stays the fallback INSIDE
+    // `trend.record` for a command close, where `closeGrade` returns `{gap}` only.
+    fixTrend.record(closeGrade(post));
+    // F198 item 2 — TRACE: before this, `middle` (below) handed the fix worker
+    // ONLY the current gap (this iteration's raw close output, or the previous
+    // attempt's — planrun.js's `await w.ask([...])` at the end of `middle`) and
+    // never any history of prior grades. Nothing else about the close's own
+    // numbers travelled between tries.
+    //
+    // The fix: a FACTS-ONLY number history, one entry per grade fixTrend has
+    // already read (never advice, never model-generated text — a prompt
+    // register change, `src/promptregisters.js`'s inventory, `src/planrun.js`
+    // already listed there). `checksHistory` is the "N passed of M declared"
+    // count per grade: N counts the satisfied stages on each declared verdict's
+    // own `stages` list (first-red-wins, so that list holds only the stages that
+    // RAN), and M is the DECLARED stage count (`stagedClose.length`, the same
+    // one source `createTrend`'s stageOrder reads) — never the ran count, or a
+    // 7-stage close red at stage 2 would read "1/2" instead of "1/7". Nothing a
+    // command close's verdict carries, so it stays empty there and the line is
+    // simply omitted. The per-stage number history rides on `fixTrend.report()`
+    // already, so nothing new is stored for that half.
+    /** @type {string[]} */
+    const checksHistory = [];
+    const pushChecks = (/** @type {any} */ v) => {
+      if (Array.isArray(v?.stages)) {
+        checksHistory.push(`${v.stages.filter((/** @type {any} */ s) => s.verdict === 'satisfied').length}/${stagedClose.length}`);
+      }
+    };
+    pushChecks(post);
     /** ralph's `ladder` seam, filled by the trend reader instead of the step
      * ladder's repeat/write pair. ONE exhaustion terminal, two triggers (ralph's own
      * rule): the category stays `cap-halt` and the outcome stays `escalated`, so the
@@ -3883,7 +3917,15 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         if (lastCloseVerdict?.verdict === HUMAN_PAUSE) {
           return { governor: 'close-trend', trend: 'unknown', reading: 'the close is waiting on a person — not a grade', iteration: o.iteration, paused: true };
         }
-        return { governor: 'close-trend', ...fixTrend.record({ gap: o.gap }), iteration: o.iteration };
+        // Same structured-first read as the seed above. `lastCloseVerdict` is THIS
+        // iteration's verdict (judge() ran immediately before ralph calls this
+        // record) UNLESS a worker-crash overwrote `gap` with a synthetic message
+        // (src/ralph.js) that no longer matches `lastCloseVerdict.gap` — guarded by
+        // the equality check so a crash still reads through the text fallback on
+        // its own synthetic gap, exactly as before.
+        const graded = lastCloseVerdict && lastCloseVerdict.gap === o.gap ? closeGrade(lastCloseVerdict) : { gap: o.gap };
+        if (lastCloseVerdict && lastCloseVerdict.gap === o.gap) pushChecks(lastCloseVerdict);
+        return { governor: 'close-trend', ...fixTrend.record(graded), iteration: o.iteration };
       },
       struckOut: fixTrend.struckOut,
       report: fixTrend.report,
@@ -3897,9 +3939,12 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
             : `${rep.strikes}/${rep.limit} strikes — the fix loop stopped making progress against the close's own numbers (${t.reading}). Continue, change approach, or stop?`,
           options: [
             'revise the goal/spec so the work is reachable (a spec edit, so the new hash needs re-approval)',
-            resumable
-              ? 'top up budgetUsd and rerun with --resume, if the trend above says it was still converging'
-              : 'resume is `run-u`-only in v1 — top up budgetUsd and re-fire the bundle from the start, if the trend above says it was still converging',
+            // F197/mul5fofw — this terminal is ONE exhaustion terminal, and ralph.js
+            // hardcodes its outcome as `escalated` (a GRADED RED, src/reuse.js's
+            // `REUSE_GRADED_RED`: the close rendered a verdict and it was red).
+            // `escalated` is a graded red, never a checkpoint (F197) — `--resume`
+            // refuses it, so the sentence states that plainly.
+            'this cannot be resumed — the close already rendered its verdict against the tree; revise the goal/spec and rerun fresh (a new hash needs re-approval)',
             'abandon the task',
           ],
         };
@@ -3996,12 +4041,23 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         })
         : null;
       if (rootInj) emit('root-injected', { phase: 'fix', ...rootInj.event });
+      // F198 item 2 — the facts-only history: JOINED numbers only, no prose the
+      // model didn't already earn by writing the close's own output. `values`
+      // joins with `→` (fixTrend's own vocabulary), stages join with `·`; a
+      // stage this leg has read only once still shows its one number (no arrow),
+      // which is still a fact the worker did not otherwise have.
+      const checksFact = checksHistory.length > 0 ? `checks passed ${checksHistory.join(' → ')}` : null;
+      const stageFacts = fixTrend.report().stages
+        .filter((s) => s.values.length > 0)
+        .map((s) => `${s.stage} ${s.values.join(' → ')}`);
+      const factsLine = [checksFact, ...stageFacts].filter(Boolean).join(' · ');
       await w.ask([
         'The job\'s final verification is failing. Fix the repository so it passes.',
         `Repository root (absolute): ${workdir}\nEvery path you pass to a tool MUST be absolute and inside this root.`,
         artifacts.length > 0 && `Working context (read-only) — the plan's steps produced:\n${artifacts.map((a) => `[${a.id}] ${a.text}`).join('\n\n')}`,
         !gap && post.gap && `The verification's output on the tree as it stands (not an attempt of yours):\n${post.gap}`,
         gap && `Previous attempt failed the verification:\n${gap}`,
+        factsLine && `The close's own numbers so far, oldest first (facts only — no advice):\n${factsLine}`,
         rootInj && rootInj.note,
       ].filter(Boolean).join('\n\n'));
     };

package/src/promptregisters.js

@@ -76,6 +76,9 @@ export const PROMPT_REGISTERS = Object.freeze([
 
   // src/planrun.js — the native-surface read-truncation strategy line
   Object.freeze({ file: 'src/planrun.js', name: 'NATIVE_READ_STRATEGY' }),
+  // src/planrun.js — the fix loop's facts-only close-grade history line
+  // (F198 item 2), built inline inside `middle` and appended to `w.ask([...])`
+  Object.freeze({ file: 'src/planrun.js', name: 'middle()\'s facts-only "The close\'s own numbers so far" block (inline template, not a const)' }),
 
   // src/authoring.js — the types-genre close template, interpolated verbatim
   // into the authoring prompt (src/authorflow.js's assembled system message,

package/src/providers.js

@@ -320,6 +320,88 @@ export function buildRunnerProviders({
   return { provider, providerFor, judgeProvider };
 }
 
+/**
+ * A `providerName`'s own models-list GET endpoint — the shape this
+ * function's ONE caller (`checkProviderReachable`, below) needs and nothing
+ * else reads: `anthropic-api` and `openai-api` (the panel's Model select,
+ * PANEL-BUILD.md P3 build item 7) are the only two shapes this build knows
+ * how to ask, both a plain unauthenticated-body GET with the key in a
+ * header — never a completion/chat endpoint, so this never spends a token.
+ * @param {string} providerName
+ * @param {string} [baseUrl]
+ * @returns {{url: string, headers: Record<string,string>}|null} `null` when
+ *   this provider's models-list shape is not known (never guessed at)
+ */
+function modelsListRequest(providerName, baseUrl) {
+  if (providerName === 'anthropic-api') {
+    return {
+      url: `${baseUrl || 'https://api.anthropic.com/v1'}/models`,
+      headers: { 'x-api-key': '', 'anthropic-version': '2023-06-01' },
+    };
+  }
+  if (providerName === 'openai-api') {
+    return { url: `${baseUrl || 'https://api.openai.com/v1'}/models`, headers: {} };
+  }
+  return null;
+}
+
+/**
+ * $0 reachability check: a GET against `providerName`'s own models-list
+ * endpoint, server-side, with the key in a header — NEVER a completion
+ * request, so it never spends a token (PANEL-BUILD.md P3 build item 7: "the
+ * person must get feedback BEFORE drafting if the chosen model can't
+ * work"). Reused, unmodified, by the panel's model-readiness route today
+ * (`src/panel/authorroutes.js`) and by the future Settings providers
+ * table's own "test" column (PANEL-BUILD.md P4) — ONE function, not two
+ * hand-typed copies of the same probe.
+ *
+ * NEVER returns the key, never logs it — the key only ever appears in a
+ * request header sent straight to the provider's own host.
+ * @param {object} o
+ * @param {string} o.providerName
+ * @param {string} o.apiKey
+ * @param {string} [o.model] when given, the response is also checked for this model id
+ * @param {string} [o.baseUrl]
+ * @param {typeof fetch} [o.fetchImpl] TEST SEAM — defaults to the real global `fetch`
+ * @param {number} [o.timeoutMs] defaults to 4000 — a flaky endpoint must never hang the caller
+ * @returns {Promise<{reachable: boolean, modelListed: boolean|null, status: string, note: string|null}>}
+ */
+export async function checkProviderReachable({
+  providerName, apiKey, model, baseUrl, fetchImpl = fetch, timeoutMs = 4000,
+}) {
+  const req = modelsListRequest(providerName, baseUrl);
+  if (!req) {
+    return {
+      reachable: false, modelListed: null, status: 'unsupported-provider',
+      note: `no models-list check known for "${providerName}"`,
+    };
+  }
+  const headers = { ...req.headers };
+  if (providerName === 'anthropic-api') headers['x-api-key'] = apiKey;
+  else headers.Authorization = `Bearer ${apiKey}`;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    // GET ONLY — no body, no completion/chat call, no tokens spent.
+    const res = await fetchImpl(req.url, { method: 'GET', headers, signal: controller.signal });
+    if (!res.ok) {
+      return { reachable: false, modelListed: null, status: `HTTP ${res.status}`, note: `models list returned HTTP ${res.status}` };
+    }
+    /** @type {any} */
+    let body = null;
+    try { body = await res.json(); } catch { body = null; }
+    const ids = Array.isArray(body?.data) ? body.data.map((/** @type {any} */ m) => m?.id).filter(Boolean) : [];
+    const modelListed = model ? ids.includes(model) : null;
+    return { reachable: true, modelListed, status: 'ok', note: null };
+  } catch (/** @type {any} */ e) {
+    const cls = e?.name === 'AbortError' ? 'timeout' : (e?.code || e?.name || 'network-error');
+    return { reachable: false, modelListed: null, status: String(cls), note: `request failed: ${cls}` };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * The launch-time warning lines for an ADMITTED-PENDING-PROBE provider, or
  * `null` when the provider has paid for its own end-to-end probe (and for an

package/src/replay.js

@@ -462,6 +462,24 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
 
   const spentUsd = jobEnd && typeof jobEnd.spentUsd === 'number' && Number.isFinite(jobEnd.spentUsd) ? jobEnd.spentUsd : null;
   const spendComplete = jobEnd ? jobEnd.spendComplete === true && spentUsd !== null : false;
+
+  // draftSpentUsd (hamr's ruling 2026-09-28, "one cap covers drafting +
+  // run") — the AUTHORING pipeline's own spend on this job before it was
+  // signed, off `job-start`'s dedicated field (never `priorSpentUsd`, which
+  // is the RESUME fold `resumed` above keys on). `null` when the run never
+  // carried one (the common case, and every run predating this field) —
+  // never a decorative 0 a reader could mistake for "drafting spent
+  // nothing".
+  const draftSpentUsd = jobStart && typeof jobStart.draftSpentUsd === 'number' && Number.isFinite(jobStart.draftSpentUsd) && jobStart.draftSpentUsd > 0
+    ? jobStart.draftSpentUsd : null;
+  // draftSpendComplete (hamr's ruling 2026-09-28) — was the drafting fold above
+  // EXACT? `null` when there is no drafting fold at all (the common case, and
+  // every run predating both fields) — never paired with a `draftSpentUsd` of
+  // `null`. An archive whose `job-start` carries `draftSpentUsd` but predates
+  // this companion field (src/run.js's own belt) defaults to `true` — it was
+  // exact then, the field simply didn't exist yet to say so.
+  const draftSpendComplete = draftSpentUsd === null ? null
+    : (jobStart.draftSpendComplete !== false);
   const floorReasonList = floorReasons(spine, jobStart, spendComplete);
 
   const wallMs = windowWallMs(parseTs(jobStart?.ts), parseTs(jobEnd?.ts));
@@ -799,8 +817,40 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // plan run whose close was satisfied on the first outer-close precheck
   // never enters a fix loop, and this field must read exactly as it did
   // before this addition for that run).
+  // F196 (2026-09-27, live-observed on mujjtrvd): a step still RUNNING (no
+  // `step-end` on the spine yet) has its own in-flight micro-loop
+  // (`ralph({judge,...})`, src/planrun.js) that emits its OWN
+  // `iteration-start` — e.g. step 2's attempt 1 on mujjtrvd (seq 71,
+  // `strict-clean-whole-src`'s own step-start at seq 69, no step-end). The
+  // old `lastStepEndSeq` (the LAST *ended* step's own boundary — seq 68,
+  // step 1 `type-checks-jsdoc`'s step-end) left that still-running step's
+  // seq range wide open, so its iteration-start leaked in below as a fake
+  // fix-loop attempt: the Run tab showed step 2 as `[done]` with 0
+  // calls/`?` (`end` never found for it in the `steps` map) plus a phantom
+  // `FIX [running]` box after it. An un-ended step is its own right
+  // boundary: the fix loop can only start once the run's LAST-STARTED step
+  // (`steps[steps.length-1]` — `steps` preserves spine order, so this is
+  // the step with the highest `stepStartSeq` across the whole file,
+  // including every concatenated leg of a resumed chain) has reached its
+  // own step-end.
+  //
+  // Deliberately checks only the LAST step, never "every step" (measured
+  // and rejected: a first pass checking `steps.some(s => s.stepEndSeq ===
+  // Infinity)` broke a genuinely FINISHED resumed-chain archive,
+  // litectx-u-bareloop/reuse-msc6w93z.jsonl — its first leg's
+  // `fix-index-js-strict` attempt (step-start seq 34) crashed with no
+  // step-end before the chain resumed and re-ran that same step from seq
+  // 77 onward to a real step-end at seq 115; the file's LAST step
+  // (`achieve-strict-typecheck`, step-end seq 611) did end, and this run's
+  // real fixLoop must still be read). Checking only the last-started step
+  // preserves that file's output unchanged while still nulling fixLoop on
+  // mujjtrvd (last step `strict-clean-whole-src` never step-ends in the
+  // mid-run slice) and on every other archived spine this fix was diffed
+  // against that turned out to be a truncated/killed file with no
+  // `job-end` at all (its last step-start likewise never step-ended) —
+  // see the F196 commit's report for the full before/after list.
   let fixLoop = null;
-  if (timelineKind === 'steps' && stepStarts.length > 0) {
+  if (timelineKind === 'steps' && stepStarts.length > 0 && steps[steps.length - 1].stepEndSeq !== Infinity) {
     const lastStepEndSeq = stepEnds.reduce((max, se) => (typeof se.seq === 'number' && se.seq > max ? se.seq : max), -Infinity);
     const outerClosesAfter = spine
       .filter((e) => e.type === 'outer-close' && typeof e.seq === 'number' && e.seq > lastStepEndSeq)
@@ -869,7 +919,21 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
           iteration: typeof is.iteration === 'number' ? is.iteration : null,
           verdict,
           stages: end && end.type === 'close-verdict' && Array.isArray(end.stages) ? end.stages : null,
-          outcome: /** @type {'green'|'red'} */ (verdict === 'satisfied' || verdict === 'green' || verdict === 'already-green' ? 'green' : 'red'),
+          // `end === null` means this iteration's own window hasn't closed
+          // yet (no close-verdict/run-end/escalation boundary has landed on
+          // the spine after its iteration-start) — a LIVE run reading this
+          // mid-iteration, never a finished one (a finished spine's last
+          // iteration always has a boundary). Fabricating 'red' here (as
+          // `verdict === null` used to fall through to) reads a still-running
+          // fix-loop attempt as an already-failed one; `null` (the same
+          // "unresolved" value every other in-progress outcome in this file
+          // uses) is the honest read. Fixed here, the one place this outcome
+          // is minted, rather than in the panel's `partBoxState` (which reads
+          // this field but has no ordering info to tell "genuinely red" from
+          // "still open" apart if this field itself already lies).
+          outcome: end
+            ? /** @type {'green'|'red'} */ (verdict === 'satisfied' || verdict === 'green' || verdict === 'already-green' ? 'green' : 'red')
+            : /** @type {null} */ (null),
           ...buildOccurrenceMetrics(startSeq, startTs, endSeq, endTs, roundsInWindow),
           windowStartSeq: startSeq,
           windowEndSeq: endSeq,
@@ -1066,6 +1130,26 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     if (planRoundsInitialArr.length > 0) {
       const { spentUsd, unpricedRounds } = windowSpend(planRoundsInitialArr);
       const b = partBehaviour(scoutTsHi, firstTs);
+      // F: the plan part's own wall time (build item 8, 2026-09-28, run
+      // mul5fofw: a $0.28/20623-token paid call read as "0.0s"). Root cause:
+      // `scoutTsHi` is literally `planRoundsInitialArr[0].ts` — the plan
+      // round's OWN completion timestamp (every round record is stamped
+      // AFTER the call returns, never before) — so using it as plan's own
+      // START boundary measures the call against ITSELF, leaving only the
+      // few-ms gap to the next logged record (`firstTs`, the following
+      // step-start) as the "duration". Measured on mul5fofw's real spine:
+      // scout's own last round ts 11:15:00.335Z -> the plan round's ts
+      // 11:16:22.667Z is 82.3s, the plan call's real wall time; the old
+      // window (11:16:22.667Z -> 11:16:22.679Z, the step-start 12ms later)
+      // could never show anything but ~0. Fixed HERE ONLY (the reader/
+      // display side, never the seq-scoped `b`/`attempts` windows above,
+      // which were already correctly bounded and are left untouched): the
+      // wall window now runs from scout's own true end (its last round's
+      // ts, or job-start when there was no scout) to plan's own true end
+      // (its last round's ts) — never the NEXT phase's timestamps on either
+      // side, which is what made this unmeasurable by construction.
+      const scoutEndTs = scoutRoundsArr.length ? parseTs(scoutRoundsArr[scoutRoundsArr.length - 1].ts) : jobStartTs;
+      const planEndTs = parseTs(planRoundsInitialArr[planRoundsInitialArr.length - 1].ts);
       parts.push({
         id: 'plan',
         kind: 'plan',
@@ -1076,7 +1160,7 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
         toolCalls: b ? b.totalCalls : null,
         byTool: b ? b.byTool : null,
         blocked: b ? b.denied : null,
-        wallMs: windowWallMs(scoutTsHi, firstTs),
+        wallMs: windowWallMs(scoutEndTs, planEndTs),
         spentUsd,
         unpricedRounds,
         outcome: null,
@@ -1282,6 +1366,8 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     stopReason,
     spentUsd,
     spendComplete,
+    draftSpentUsd,
+    draftSpendComplete,
     floorReasons: floorReasonList,
     transportRetryCount: transportRetries.length,
     transportRetriesOutsideWindows,
@@ -1338,6 +1424,44 @@ function money2(n) {
   return n === null ? 'unknown' : `$${n.toFixed(2)}`;
 }
 
+/**
+ * hamr's ruling 2026-09-28 ("one cap covers drafting + run") — the ONE
+ * spend display for a run that may carry a drafting share, so every surface
+ * that shows a run's money (the CLI's own `spent` line, the panel's Run tab
+ * summary/counters, the Runs list row, the Audit header, the Job tab) reads
+ * the same string rather than each hand-composing its own. `spendCore` is
+ * already-formatted text (`money(...)`, or a `died`/floor line's "at least
+ * $X") — this only decides whether to append the `(<draft> drafting)`
+ * clause and the `of $<cap>` tail, never re-derives the money itself.
+ * Unchanged (`spendCore` alone, or `spendCore of $cap`) when there is no
+ * drafting share — a run without one prints exactly what it always did.
+ *
+ * hamr's ruling 2026-09-28 (2nd addendum) — an INCOMPLETE drafting fold
+ * (`draftSpendComplete === false`) is a floor, not a total, and F6's rule
+ * ("unpriced is never free, a floor never dresses as exact") applies here
+ * exactly as it does to `spendCore` itself: the drafting clause reads `at
+ * least $X drafting`, and because a reader summing the two figures would
+ * otherwise take the LEADING number as exact too, `spendCore` itself also
+ * gains the `at least ` prefix — unless it already carries one (a `died`
+ * floor, or an already-prefixed caller), never doubled.
+ * @param {string} spendCore already-formatted spend text (e.g. `$3.71` or `at least $2.00`)
+ * @param {number|null} draftSpentUsd the drafting share, or null when there isn't one
+ * @param {number|null} [budgetUsd] the signed cap, appended as `of $X.XX` when given
+ * @param {boolean|null} [draftSpendComplete] whether the drafting fold above was EXACT;
+ *   `null`/`undefined`/`true` all read as exact (never a new enum value elsewhere) —
+ *   only an explicit `false` triggers the floor wording.
+ * @returns {string}
+ */
+export function moneyWithDraft(spendCore, draftSpentUsd, budgetUsd, draftSpendComplete) {
+  const hasDraft = draftSpentUsd !== null && draftSpentUsd !== undefined;
+  const draftFloor = hasDraft && draftSpendComplete === false;
+  const coreAlreadyFloor = /^(at least |≥)/.test(spendCore);
+  const core = draftFloor && !coreAlreadyFloor ? `at least ${spendCore}` : spendCore;
+  const draftPart = hasDraft ? ` (${draftFloor ? 'at least ' : ''}${money(draftSpentUsd)} drafting)` : '';
+  const capPart = budgetUsd === undefined ? '' : ` of ${money2(budgetUsd)}`;
+  return `${core}${draftPart}${capPart}`;
+}
+
 /**
  * The `$`/`spend` column for one occurrence/iteration row: `unpricedRounds >
  * 0` reads `unknown (N unpriced rounds)` — never `$0`, never a partial sum
@@ -1781,7 +1905,7 @@ export function summarizeForAllLine(summary) {
     // shown on a run with zero retries.
     outcome: `${summary.outcome ?? 'unknown'}${summary.transportRetryCount > 0 ? ` ⟲${summary.transportRetryCount}` : ''}`,
     hadTransportRetries: summary.transportRetryCount > 0,
-    spend: money(summary.spentUsd),
+    spend: moneyWithDraft(money(summary.spentUsd), summary.draftSpentUsd, undefined, summary.draftSpendComplete),
     wall: duration(summary.wallMs),
     steps: stepsCol,
     reason,

package/src/replayio.js

@@ -95,7 +95,8 @@ export function resolveSiblings(spinePath) {
  * Read one run's spine (+ its gate-audit sidecar, when present) off disk and
  * hand both to {@link replayRun}. Read-only, $0, mints no verdict.
  * @param {string} spinePath absolute or cwd-relative path to a `.jsonl` spine
- * @param {{preParsedSpine?: {records: any[], skipped: number}, skipAudit?: boolean}} [opts]
+ * @param {{preParsedSpine?: {records: any[], skipped: number}, skipAudit?: boolean,
+ *   auditPathOverride?: string|null}} [opts]
  *   `preParsedSpine`: avoids a second parse of the same file when the caller
  *   ({@link listSpines}) already read it once to run {@link looksLikeSpine}.
  *   `skipAudit` (PR #23 review item 5, 2026-08-26, carried over): a
@@ -103,11 +104,21 @@ export function resolveSiblings(spinePath) {
  *   `summarizeForAllLine` reads none of the fields that sidecar feeds inside
  *   `replayRun`, so reading every run's sidecar in a directory listing was
  *   pure unused I/O, multiplied by every spine found.
+ *   `auditPathOverride` (build item 7, 2026-09-28): when a caller has ALREADY
+ *   resolved the real audit path through the one shared resolver
+ *   (`src/panel/server.js`'s `resolveAuditPathForRow`, which also covers a
+ *   still-LIVE run's during-run sidecar location — this function's own
+ *   `resolveSiblings` call only ever finds the FINISHED-run convention), it
+ *   passes that path here (`null` included) instead of letting this
+ *   function re-derive a finished-only path on its own. `undefined` (the
+ *   default) keeps the original resolveSiblings-only behaviour — every
+ *   existing caller is unaffected.
  * @returns {ReturnType<typeof replayRun>}
  */
 export function replayOne(spinePath, opts = {}) {
-  const { preParsedSpine, skipAudit = false } = opts;
-  const { runId, auditPath } = resolveSiblings(spinePath);
+  const { preParsedSpine, skipAudit = false, auditPathOverride } = opts;
+  const { runId, auditPath: resolvedAuditPath } = resolveSiblings(spinePath);
+  const auditPath = auditPathOverride !== undefined ? auditPathOverride : resolvedAuditPath;
   const spine = preParsedSpine ?? parseJsonl(spinePath);
   const audit = (!skipAudit && auditPath) ? parseJsonl(auditPath) : { records: [], skipped: 0 };
   // `auditAvailable`: true only when a sidecar was actually FOUND AND READ.

package/src/run.js

@@ -134,6 +134,29 @@ async function primitiveSmoke(workdir) {
  *   load gate refuses one: a refusal returns the distinct `recipe-stale` outcome with zero
  *   spend rather than silently drafting cold, because starting a paid run on a decision
  *   nobody made is the same class of error as widening a cap to manufacture a green.
+ * @param {number} [opts.draftSpentUsd=0] hamr's ruling 2026-09-28 ("one cap covers
+ *   drafting + run") — money the AUTHORING pipeline (`authorCloseForJob`/
+ *   `prepareSigning`, run under the SAME signed `budgetUsd` as its ceiling) already
+ *   spent on THIS job before it was ever signed. The signed `budgetUsd` stays the
+ *   one number in the spec hash; this shrinks the RUN's own enforced ceiling by
+ *   what drafting already took, so the two phases never spend more than the one
+ *   cap together. Deliberately NOT `priorSpentUsd` — that key means "a previous
+ *   ATTEMPT of this same run died and folded its spend forward" and is read by
+ *   `readResume`/`replay.js`'s `resumed` flag; a drafting spend is not a resume and
+ *   must never make an ordinary first run of a job read as one. It is also never
+ *   folded into `spentUsd` (the run's own ledger, cumulative-so-far and what a
+ *   resume's `priorSpentUsd` seeds) or into `engagementSpentUsd` — drafting is a
+ *   DIFFERENT phase's spend, reported beside the run's, never inside it. A garbage
+ *   value (non-finite, negative) is read as 0, belted exactly like `priorSpentUsd`.
+ * @param {boolean} [opts.draftSpendComplete=true] hamr's ruling 2026-09-28 — was the
+ *   `draftSpentUsd` fold above EXACT? The authoring pipeline's own metered-call list can
+ *   go unpriced (F6) exactly like a resumed attempt's can, and the unknown does not heal
+ *   by folding forward. A NEW field beside `draftSpentUsd`, never a new state inside
+ *   `spendComplete`/`priorSpendComplete` — those answer "is THIS run's own ledger exact,"
+ *   this answers "was the OTHER phase's ledger exact," and the two must never merge into
+ *   one flag or a floor drafting spend could read as an exact run. Read only when
+ *   `draftSpentUsd` itself is emitted; a garbage value is read as `true` (the same belt
+ *   `priorSpendComplete` gets — an unreadable flag never manufactures a false floor).
  * @param {number} [opts.priorSpentUsd=0] RESUME (module C) — money a PREVIOUS, killed
  *   attempt of this same try already spent. It seeds the ledger, so the restarted
  *   attempt runs under the REMAINDER of the signed `budgetUsd` and the terminal
@@ -242,7 +265,7 @@ async function primitiveSmoke(workdir) {
  *   deliberately NOT in the resumable/checkpoint set (`src/reuse.js`) — an
  *   unknown in-flight state is not a known-safe resume point.
  */
-export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, closeDir = null, layerRoot = false, readShim = false, scout = true, bridge = null, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, reviewDoor = null, doorRerun = null, resumable = true }) {
+export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, closeDir = null, layerRoot = false, readShim = false, scout = true, bridge = null, draftSpentUsd = 0, draftSpendComplete = true, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, reviewDoor = null, doorRerun = null, resumable = true }) {
   // THE READ SHIM's ARM, resolved at the door — the FIRST thing this entry does,
   // before the ledger, before the approval gate, before a byte of the spec is read.
   // An unrecognised spelling throws here at zero cost instead of being coerced by
@@ -270,6 +293,18 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
    * ENGAGEMENT's spend can be stated side by side on every terminal. Two things
    * counted by one number will eventually be asked to disagree. */
   const chainFoldUsd = spentUsd;
+  // hamr's ruling 2026-09-28 — the DRAFTING fold, kept apart from the RESUME
+  // fold above on purpose (see the param's own doc): it shrinks the run's
+  // enforced ceiling below but never seeds `spentUsd`/`chainFoldUsd`, so it
+  // can never be read as "a previous attempt of THIS run died" by `readResume`
+  // or by `replay.js`'s `resumed` flag (which keys on `priorSpentUsd`'s
+  // presence alone). Belted exactly like `priorSpentUsd`: a garbage value
+  // (non-finite, negative) reads as 0 rather than poisoning the ceiling
+  // arithmetic into "no cap" or "already over".
+  const draftFoldUsd = typeof draftSpentUsd === 'number' && Number.isFinite(draftSpentUsd) && draftSpentUsd > 0 ? draftSpentUsd : 0;
+  // Belted exactly like `priorSpendComplete`'s own read below: a garbage value
+  // (non-boolean) reads as `true` rather than manufacturing a false floor.
+  const draftFoldComplete = draftSpendComplete !== false;
   let unpriced = false;
   // RESUME (v1.46 §3): was the FOLD itself exact? `readResume` marks it false when any
   // round inside the dead attempt came back unpriced, and that unknown does not heal by
@@ -379,6 +414,11 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
     // A fold of $0 that is NOT exact is still a fold — the unknown is the whole of what
     // it inherited, and it is the only field that can carry it forward.
     ...(spentUsd > 0 || priorFloor ? { priorSpentUsd: spentUsd, priorSpendComplete: !priorFloor } : {}),
+    // …and the DRAFTING fold, on its own dedicated field — never `priorSpentUsd`
+    // (see the param's own doc above: that key means "resumed", and this run
+    // was not). Emitted only when there is one, same "a decorative 0 is
+    // indistinguishable from none" rule every other fold field here follows.
+    ...(draftFoldUsd > 0 ? { draftSpentUsd: draftFoldUsd, draftSpendComplete: draftFoldComplete } : {}),
     // …and the TIME fold, which F103 splits in two. `priorWallMs` is what the next
     // reader ADDS to (the bound), and it is engagement-scoped: a rerun opens a fresh
     // engagement, so the minutes the person did not commission are not a bound on
@@ -493,7 +533,13 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   {
     const outcome = await runPlan(job, {
       workdir, provider, nativeProvider, providerFor, judgeProvider, judgeModel, emit: meter, capRuns, ...(strikeLimit !== undefined ? { strikeLimit } : {}), closeTimeoutMs, closeDir, layerRoot, readShim, scout, bridge, priorWallMs: chainWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, reviewDoor, doorRerun, priorSpentUsd: chainFoldUsd, resumable,
-      remainingUsd: () => Math.min(shellCapUsd, job.budgetUsd - spentUsd),
+      // hamr's ruling 2026-09-28 — ONE cap covers drafting + run: the run's
+      // enforced ceiling is the signed `budgetUsd` (unchanged, still in the
+      // spec hash) MINUS whatever drafting already spent on this job before
+      // signing. Advertised = enforced: this is the ONE place the ceiling
+      // arithmetic lives, so every readout of "what's left" is this same
+      // subtraction, never a second one computed elsewhere.
+      remainingUsd: () => Math.min(shellCapUsd, job.budgetUsd - draftFoldUsd - spentUsd),
       isUnpriced: () => unpriced, // F6: let the plan flow bail in-flight, not just after it returns
       spendComplete, // …and let its money-halt readout say whether the remaining it quotes is exact
     });