bareloop 0.30.0 → 0.32.0

package/src/replay.js

@@ -462,6 +462,24 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
 
   const spentUsd = jobEnd && typeof jobEnd.spentUsd === 'number' && Number.isFinite(jobEnd.spentUsd) ? jobEnd.spentUsd : null;
   const spendComplete = jobEnd ? jobEnd.spendComplete === true && spentUsd !== null : false;
+
+  // draftSpentUsd (hamr's ruling 2026-09-28, "one cap covers drafting +
+  // run") — the AUTHORING pipeline's own spend on this job before it was
+  // signed, off `job-start`'s dedicated field (never `priorSpentUsd`, which
+  // is the RESUME fold `resumed` above keys on). `null` when the run never
+  // carried one (the common case, and every run predating this field) —
+  // never a decorative 0 a reader could mistake for "drafting spent
+  // nothing".
+  const draftSpentUsd = jobStart && typeof jobStart.draftSpentUsd === 'number' && Number.isFinite(jobStart.draftSpentUsd) && jobStart.draftSpentUsd > 0
+    ? jobStart.draftSpentUsd : null;
+  // draftSpendComplete (hamr's ruling 2026-09-28) — was the drafting fold above
+  // EXACT? `null` when there is no drafting fold at all (the common case, and
+  // every run predating both fields) — never paired with a `draftSpentUsd` of
+  // `null`. An archive whose `job-start` carries `draftSpentUsd` but predates
+  // this companion field (src/run.js's own belt) defaults to `true` — it was
+  // exact then, the field simply didn't exist yet to say so.
+  const draftSpendComplete = draftSpentUsd === null ? null
+    : (jobStart.draftSpendComplete !== false);
   const floorReasonList = floorReasons(spine, jobStart, spendComplete);
 
   const wallMs = windowWallMs(parseTs(jobStart?.ts), parseTs(jobEnd?.ts));
@@ -1112,6 +1130,26 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     if (planRoundsInitialArr.length > 0) {
       const { spentUsd, unpricedRounds } = windowSpend(planRoundsInitialArr);
       const b = partBehaviour(scoutTsHi, firstTs);
+      // F: the plan part's own wall time (build item 8, 2026-09-28, run
+      // mul5fofw: a $0.28/20623-token paid call read as "0.0s"). Root cause:
+      // `scoutTsHi` is literally `planRoundsInitialArr[0].ts` — the plan
+      // round's OWN completion timestamp (every round record is stamped
+      // AFTER the call returns, never before) — so using it as plan's own
+      // START boundary measures the call against ITSELF, leaving only the
+      // few-ms gap to the next logged record (`firstTs`, the following
+      // step-start) as the "duration". Measured on mul5fofw's real spine:
+      // scout's own last round ts 11:15:00.335Z -> the plan round's ts
+      // 11:16:22.667Z is 82.3s, the plan call's real wall time; the old
+      // window (11:16:22.667Z -> 11:16:22.679Z, the step-start 12ms later)
+      // could never show anything but ~0. Fixed HERE ONLY (the reader/
+      // display side, never the seq-scoped `b`/`attempts` windows above,
+      // which were already correctly bounded and are left untouched): the
+      // wall window now runs from scout's own true end (its last round's
+      // ts, or job-start when there was no scout) to plan's own true end
+      // (its last round's ts) — never the NEXT phase's timestamps on either
+      // side, which is what made this unmeasurable by construction.
+      const scoutEndTs = scoutRoundsArr.length ? parseTs(scoutRoundsArr[scoutRoundsArr.length - 1].ts) : jobStartTs;
+      const planEndTs = parseTs(planRoundsInitialArr[planRoundsInitialArr.length - 1].ts);
       parts.push({
         id: 'plan',
         kind: 'plan',
@@ -1122,7 +1160,7 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
         toolCalls: b ? b.totalCalls : null,
         byTool: b ? b.byTool : null,
         blocked: b ? b.denied : null,
-        wallMs: windowWallMs(scoutTsHi, firstTs),
+        wallMs: windowWallMs(scoutEndTs, planEndTs),
         spentUsd,
         unpricedRounds,
         outcome: null,
@@ -1328,6 +1366,8 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     stopReason,
     spentUsd,
     spendComplete,
+    draftSpentUsd,
+    draftSpendComplete,
     floorReasons: floorReasonList,
     transportRetryCount: transportRetries.length,
     transportRetriesOutsideWindows,
@@ -1384,6 +1424,44 @@ function money2(n) {
   return n === null ? 'unknown' : `$${n.toFixed(2)}`;
 }
 
+/**
+ * hamr's ruling 2026-09-28 ("one cap covers drafting + run") — the ONE
+ * spend display for a run that may carry a drafting share, so every surface
+ * that shows a run's money (the CLI's own `spent` line, the panel's Run tab
+ * summary/counters, the Runs list row, the Audit header, the Job tab) reads
+ * the same string rather than each hand-composing its own. `spendCore` is
+ * already-formatted text (`money(...)`, or a `died`/floor line's "at least
+ * $X") — this only decides whether to append the `(<draft> drafting)`
+ * clause and the `of $<cap>` tail, never re-derives the money itself.
+ * Unchanged (`spendCore` alone, or `spendCore of $cap`) when there is no
+ * drafting share — a run without one prints exactly what it always did.
+ *
+ * hamr's ruling 2026-09-28 (2nd addendum) — an INCOMPLETE drafting fold
+ * (`draftSpendComplete === false`) is a floor, not a total, and F6's rule
+ * ("unpriced is never free, a floor never dresses as exact") applies here
+ * exactly as it does to `spendCore` itself: the drafting clause reads `at
+ * least $X drafting`, and because a reader summing the two figures would
+ * otherwise take the LEADING number as exact too, `spendCore` itself also
+ * gains the `at least ` prefix — unless it already carries one (a `died`
+ * floor, or an already-prefixed caller), never doubled.
+ * @param {string} spendCore already-formatted spend text (e.g. `$3.71` or `at least $2.00`)
+ * @param {number|null} draftSpentUsd the drafting share, or null when there isn't one
+ * @param {number|null} [budgetUsd] the signed cap, appended as `of $X.XX` when given
+ * @param {boolean|null} [draftSpendComplete] whether the drafting fold above was EXACT;
+ *   `null`/`undefined`/`true` all read as exact (never a new enum value elsewhere) —
+ *   only an explicit `false` triggers the floor wording.
+ * @returns {string}
+ */
+export function moneyWithDraft(spendCore, draftSpentUsd, budgetUsd, draftSpendComplete) {
+  const hasDraft = draftSpentUsd !== null && draftSpentUsd !== undefined;
+  const draftFloor = hasDraft && draftSpendComplete === false;
+  const coreAlreadyFloor = /^(at least |≥)/.test(spendCore);
+  const core = draftFloor && !coreAlreadyFloor ? `at least ${spendCore}` : spendCore;
+  const draftPart = hasDraft ? ` (${draftFloor ? 'at least ' : ''}${money(draftSpentUsd)} drafting)` : '';
+  const capPart = budgetUsd === undefined ? '' : ` of ${money2(budgetUsd)}`;
+  return `${core}${draftPart}${capPart}`;
+}
+
 /**
  * The `$`/`spend` column for one occurrence/iteration row: `unpricedRounds >
  * 0` reads `unknown (N unpriced rounds)` — never `$0`, never a partial sum
@@ -1827,7 +1905,7 @@ export function summarizeForAllLine(summary) {
     // shown on a run with zero retries.
     outcome: `${summary.outcome ?? 'unknown'}${summary.transportRetryCount > 0 ? ` ⟲${summary.transportRetryCount}` : ''}`,
     hadTransportRetries: summary.transportRetryCount > 0,
-    spend: money(summary.spentUsd),
+    spend: moneyWithDraft(money(summary.spentUsd), summary.draftSpentUsd, undefined, summary.draftSpendComplete),
     wall: duration(summary.wallMs),
     steps: stepsCol,
     reason,

package/src/replayio.js

@@ -95,7 +95,8 @@ export function resolveSiblings(spinePath) {
  * Read one run's spine (+ its gate-audit sidecar, when present) off disk and
  * hand both to {@link replayRun}. Read-only, $0, mints no verdict.
  * @param {string} spinePath absolute or cwd-relative path to a `.jsonl` spine
- * @param {{preParsedSpine?: {records: any[], skipped: number}, skipAudit?: boolean}} [opts]
+ * @param {{preParsedSpine?: {records: any[], skipped: number}, skipAudit?: boolean,
+ *   auditPathOverride?: string|null}} [opts]
  *   `preParsedSpine`: avoids a second parse of the same file when the caller
  *   ({@link listSpines}) already read it once to run {@link looksLikeSpine}.
  *   `skipAudit` (PR #23 review item 5, 2026-08-26, carried over): a
@@ -103,11 +104,21 @@ export function resolveSiblings(spinePath) {
  *   `summarizeForAllLine` reads none of the fields that sidecar feeds inside
  *   `replayRun`, so reading every run's sidecar in a directory listing was
  *   pure unused I/O, multiplied by every spine found.
+ *   `auditPathOverride` (build item 7, 2026-09-28): when a caller has ALREADY
+ *   resolved the real audit path through the one shared resolver
+ *   (`src/panel/server.js`'s `resolveAuditPathForRow`, which also covers a
+ *   still-LIVE run's during-run sidecar location — this function's own
+ *   `resolveSiblings` call only ever finds the FINISHED-run convention), it
+ *   passes that path here (`null` included) instead of letting this
+ *   function re-derive a finished-only path on its own. `undefined` (the
+ *   default) keeps the original resolveSiblings-only behaviour — every
+ *   existing caller is unaffected.
  * @returns {ReturnType<typeof replayRun>}
  */
 export function replayOne(spinePath, opts = {}) {
-  const { preParsedSpine, skipAudit = false } = opts;
-  const { runId, auditPath } = resolveSiblings(spinePath);
+  const { preParsedSpine, skipAudit = false, auditPathOverride } = opts;
+  const { runId, auditPath: resolvedAuditPath } = resolveSiblings(spinePath);
+  const auditPath = auditPathOverride !== undefined ? auditPathOverride : resolvedAuditPath;
   const spine = preParsedSpine ?? parseJsonl(spinePath);
   const audit = (!skipAudit && auditPath) ? parseJsonl(auditPath) : { records: [], skipped: 0 };
   // `auditAvailable`: true only when a sidecar was actually FOUND AND READ.

package/src/run.js

@@ -134,6 +134,29 @@ async function primitiveSmoke(workdir) {
  *   load gate refuses one: a refusal returns the distinct `recipe-stale` outcome with zero
  *   spend rather than silently drafting cold, because starting a paid run on a decision
  *   nobody made is the same class of error as widening a cap to manufacture a green.
+ * @param {number} [opts.draftSpentUsd=0] hamr's ruling 2026-09-28 ("one cap covers
+ *   drafting + run") — money the AUTHORING pipeline (`authorCloseForJob`/
+ *   `prepareSigning`, run under the SAME signed `budgetUsd` as its ceiling) already
+ *   spent on THIS job before it was ever signed. The signed `budgetUsd` stays the
+ *   one number in the spec hash; this shrinks the RUN's own enforced ceiling by
+ *   what drafting already took, so the two phases never spend more than the one
+ *   cap together. Deliberately NOT `priorSpentUsd` — that key means "a previous
+ *   ATTEMPT of this same run died and folded its spend forward" and is read by
+ *   `readResume`/`replay.js`'s `resumed` flag; a drafting spend is not a resume and
+ *   must never make an ordinary first run of a job read as one. It is also never
+ *   folded into `spentUsd` (the run's own ledger, cumulative-so-far and what a
+ *   resume's `priorSpentUsd` seeds) or into `engagementSpentUsd` — drafting is a
+ *   DIFFERENT phase's spend, reported beside the run's, never inside it. A garbage
+ *   value (non-finite, negative) is read as 0, belted exactly like `priorSpentUsd`.
+ * @param {boolean} [opts.draftSpendComplete=true] hamr's ruling 2026-09-28 — was the
+ *   `draftSpentUsd` fold above EXACT? The authoring pipeline's own metered-call list can
+ *   go unpriced (F6) exactly like a resumed attempt's can, and the unknown does not heal
+ *   by folding forward. A NEW field beside `draftSpentUsd`, never a new state inside
+ *   `spendComplete`/`priorSpendComplete` — those answer "is THIS run's own ledger exact,"
+ *   this answers "was the OTHER phase's ledger exact," and the two must never merge into
+ *   one flag or a floor drafting spend could read as an exact run. Read only when
+ *   `draftSpentUsd` itself is emitted; a garbage value is read as `true` (the same belt
+ *   `priorSpendComplete` gets — an unreadable flag never manufactures a false floor).
  * @param {number} [opts.priorSpentUsd=0] RESUME (module C) — money a PREVIOUS, killed
  *   attempt of this same try already spent. It seeds the ledger, so the restarted
  *   attempt runs under the REMAINDER of the signed `budgetUsd` and the terminal
@@ -242,7 +265,7 @@ async function primitiveSmoke(workdir) {
  *   deliberately NOT in the resumable/checkpoint set (`src/reuse.js`) — an
  *   unknown in-flight state is not a known-safe resume point.
  */
-export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, closeDir = null, layerRoot = false, readShim = false, scout = true, bridge = null, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, reviewDoor = null, doorRerun = null, resumable = true }) {
+export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, closeDir = null, layerRoot = false, readShim = false, scout = true, bridge = null, draftSpentUsd = 0, draftSpendComplete = true, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, reviewDoor = null, doorRerun = null, resumable = true }) {
   // THE READ SHIM's ARM, resolved at the door — the FIRST thing this entry does,
   // before the ledger, before the approval gate, before a byte of the spec is read.
   // An unrecognised spelling throws here at zero cost instead of being coerced by
@@ -270,6 +293,18 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
    * ENGAGEMENT's spend can be stated side by side on every terminal. Two things
    * counted by one number will eventually be asked to disagree. */
   const chainFoldUsd = spentUsd;
+  // hamr's ruling 2026-09-28 — the DRAFTING fold, kept apart from the RESUME
+  // fold above on purpose (see the param's own doc): it shrinks the run's
+  // enforced ceiling below but never seeds `spentUsd`/`chainFoldUsd`, so it
+  // can never be read as "a previous attempt of THIS run died" by `readResume`
+  // or by `replay.js`'s `resumed` flag (which keys on `priorSpentUsd`'s
+  // presence alone). Belted exactly like `priorSpentUsd`: a garbage value
+  // (non-finite, negative) reads as 0 rather than poisoning the ceiling
+  // arithmetic into "no cap" or "already over".
+  const draftFoldUsd = typeof draftSpentUsd === 'number' && Number.isFinite(draftSpentUsd) && draftSpentUsd > 0 ? draftSpentUsd : 0;
+  // Belted exactly like `priorSpendComplete`'s own read below: a garbage value
+  // (non-boolean) reads as `true` rather than manufacturing a false floor.
+  const draftFoldComplete = draftSpendComplete !== false;
   let unpriced = false;
   // RESUME (v1.46 §3): was the FOLD itself exact? `readResume` marks it false when any
   // round inside the dead attempt came back unpriced, and that unknown does not heal by
@@ -379,6 +414,11 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
     // A fold of $0 that is NOT exact is still a fold — the unknown is the whole of what
     // it inherited, and it is the only field that can carry it forward.
     ...(spentUsd > 0 || priorFloor ? { priorSpentUsd: spentUsd, priorSpendComplete: !priorFloor } : {}),
+    // …and the DRAFTING fold, on its own dedicated field — never `priorSpentUsd`
+    // (see the param's own doc above: that key means "resumed", and this run
+    // was not). Emitted only when there is one, same "a decorative 0 is
+    // indistinguishable from none" rule every other fold field here follows.
+    ...(draftFoldUsd > 0 ? { draftSpentUsd: draftFoldUsd, draftSpendComplete: draftFoldComplete } : {}),
     // …and the TIME fold, which F103 splits in two. `priorWallMs` is what the next
     // reader ADDS to (the bound), and it is engagement-scoped: a rerun opens a fresh
     // engagement, so the minutes the person did not commission are not a bound on
@@ -493,7 +533,13 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   {
     const outcome = await runPlan(job, {
       workdir, provider, nativeProvider, providerFor, judgeProvider, judgeModel, emit: meter, capRuns, ...(strikeLimit !== undefined ? { strikeLimit } : {}), closeTimeoutMs, closeDir, layerRoot, readShim, scout, bridge, priorWallMs: chainWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, reviewDoor, doorRerun, priorSpentUsd: chainFoldUsd, resumable,
-      remainingUsd: () => Math.min(shellCapUsd, job.budgetUsd - spentUsd),
+      // hamr's ruling 2026-09-28 — ONE cap covers drafting + run: the run's
+      // enforced ceiling is the signed `budgetUsd` (unchanged, still in the
+      // spec hash) MINUS whatever drafting already spent on this job before
+      // signing. Advertised = enforced: this is the ONE place the ceiling
+      // arithmetic lives, so every readout of "what's left" is this same
+      // subtraction, never a second one computed elsewhere.
+      remainingUsd: () => Math.min(shellCapUsd, job.budgetUsd - draftFoldUsd - spentUsd),
       isUnpriced: () => unpriced, // F6: let the plan flow bail in-flight, not just after it returns
       spendComplete, // …and let its money-halt readout say whether the remaining it quotes is exact
     });

package/src/runlist.js

@@ -128,6 +128,19 @@ function runidForSpine(spinePath) {
   return resolveSiblings(spinePath).runId;
 }
 
+// DIED (hamr's ruling B, 2026-09-25): a run with no `job-end` never shares
+// the failed glyph — [✗] stays reserved for a run whose close/arbiter
+// actually rendered a "no" (a real result). A spine that just stops, with
+// no ending ever recorded, is a DIFFERENT fact (killed, crashed, or the
+// machine slept) and gets its own [?] glyph. The distinguishing signal is
+// the spine FILE's own mtime, never wall-clock "now minus job-start" (a
+// resumed/paused run can legitimately sit quiet for a long time without
+// having died): still fresh (written to within this window) reads as the
+// existing `running` [▶] state; older than this reads as died. Tighten-only,
+// named so a future change is a deliberate, visible edit. Lives here (not in
+// the panel) because the monthly limit reads the same rule (src/monthly.js).
+export const DIED_MTIME_MS = 10 * 60 * 1000;
+
 // A backfill scan of a real patients directory can be arbitrarily deep
 // (person-path runs archive several levels down: `<dir>/<proj>/out/
 // source-<x>/<proj>-bareloop/u-<id>.jsonl`, 4 levels under the dir a person

package/src/userrun.js

@@ -30,6 +30,7 @@ import { fileURLToPath } from 'node:url';
 import { execFileSync, spawn } from 'node:child_process';
 import { join, resolve, dirname } from 'node:path';
 import { runJob } from './run.js';
+import { moneyWithDraft } from './replay.js';
 import { jobSpecHash, resolveWorkerModel, validateJob } from './job.js';
 import { readShimArm } from './readshim.js';
 import { closeStagesOf } from './plan.js';
@@ -72,6 +73,10 @@ import { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
 import { coldReset, moveStaleGateAudit } from './u-patient.js';
 // PANEL-BUILD.md P1 — the one run list (`~/.config/bareloop/runs.jsonl`).
 import { appendRun } from './runlist.js';
+import { keysForDoor } from './keysfile.js';
+import { checkMonthlyRoom, monthlyRefusalText } from './monthly.js';
+import { ConfigError } from './config.js';
+import { applyConfiguredKey, keyNameFor, rowsForHome } from './providerrows.js';
 // the banner's wall arithmetic, extracted so it is reachable by a test (F83): the
 // end-of-run readout sits past the approval gate, so nothing could ever drive it here
 import { wallLine, doomedResume, deathAtOf, evidencePackage, doorLines, resumeAtLines, reviewDoorPackage, runDoorLines, tokensLine, doorTimingRedLines } from './u-readout.js';
@@ -218,6 +223,8 @@ class ExitSignal extends Error {
 /**
  * @typedef {object} Deps
  * @property {Record<string,string|undefined>} [env]
+ * @property {string} [keysHome] P4a — a test seam naming the home whose `.env` keys file is loaded
+ *   even when `env` is injected; production never sets it.
  * @property {(s: string) => void} [out]
  * @property {(s: string) => void} [err]
  * @property {any} [provider] the TEST SEAM: supplying this skips the real-key
@@ -242,6 +249,15 @@ class ExitSignal extends Error {
  * @property {string|null} [model] the raw `--model` tier name (`sonnet`/`haiku`), or null for the default
  * @property {string|null} [readShim] the raw `--read-shim` arm name, or null for the default
  * @property {string|null} [scout] the raw `--scout` value (`on`/`off`), or null for the default
+ * @property {string|null} [draftSpentUsd] the raw `--draft-spent-usd` value (hamr's
+ *   ruling 2026-09-28, "one cap covers drafting + run"), or null when the job never
+ *   drafted through the panel/`bareloop author`. Parsed and validated in `execute`
+ *   (finite, >= 0, else refused) — never coerced silently, the same param-guard
+ *   class `--read-shim`/`--scout` already are.
+ * @property {boolean} [draftSpendIncomplete] the raw `--draft-spend-incomplete` presence-
+ *   flag (hamr's ruling 2026-09-28, 2nd addendum) — whether the drafting fold above was a
+ *   FLOOR, never an exact figure. A new field beside `draftSpentUsd`, same param-guard
+ *   class, no value to misread.
  * @property {string|null} [registry] a bridge registry directory
  * @property {string|null} [workflow] the registry's workflow name (defaults to `spec.job`)
  * @property {string|null} [approve] the spec hash being signed; omitted previews only
@@ -263,6 +279,8 @@ class ExitSignal extends Error {
  * @property {string|null} model
  * @property {string|null} readShim
  * @property {string|null} scout
+ * @property {string|null} draftSpentUsd
+ * @property {boolean} draftSpendIncomplete
  * @property {string|null} registry
  * @property {string|null} workflow
  * @property {string|null} approve
@@ -294,9 +312,19 @@ class ExitSignal extends Error {
  */
 async function execute(ctx) {
   const deps = ctx.deps ?? {};
-  const env = deps.env ?? process.env;
   const out = deps.out ?? ((/** @type {string} */ s) => { console.log(s); });
   const err = deps.err ?? ((/** @type {string} */ s) => { console.error(s); });
+  // P4a item 1 — the keys file (`~/.config/bareloop/.env`) fills what the shell leaves
+  // unset; the shell wins. An injected `deps.env` skips the file unless `deps.keysHome`
+  // names a home (a test never reads the real one). Values go only to provider
+  // construction below.
+  const keys = keysForDoor(deps);
+  const env = keys.env;
+  if (keys.warning && deps.env === undefined) err(`WARNING: ${keys.warning}`);
+  // config.json (monthly limit, chosen key variables) lives beside the run list. An injected
+  // `env` with no injected home means a test — the real ~/.config/bareloop is never read then.
+  const cfgHome = keys.home ?? deps.runlistHome;
+  const cfgOn = cfgHome !== undefined;
   /** every operator/config stop this engine makes, in one exit code — thrown,
    * never `process.exit()`'d, so this stays a library function (constraint:
    * "never process.exit() inside the library — return an exit code").
@@ -394,6 +422,39 @@ async function execute(ctx) {
    * so a resume never silently drops it and runs the default under the arm's label. */
   const SCOUT_TAIL = scoutArg !== null && !SCOUT ? ' --scout off' : '';
 
+  // --draft-spent-usd (hamr's ruling 2026-09-28, "one cap covers drafting +
+  // run") — runner territory exactly like --read-shim/--scout above: the
+  // spec's signed budgetUsd is unaffected, this only shrinks THIS leg's own
+  // enforced ceiling. Same param-guard class and the same reason: an
+  // unreadable value here would either silently widen the ceiling (garbage
+  // read as 0) or silently narrow it (garbage read as Infinity) — neither is
+  // acceptable, so this refuses at argv, before the approval gate, rather
+  // than coercing.
+  const draftSpentArg = ctx.draftSpentUsd ?? null;
+  let DRAFT_SPENT_USD = 0;
+  if (draftSpentArg !== null) {
+    const v = Number(draftSpentArg);
+    if (draftSpentArg.trim() === '' || !Number.isFinite(v) || v < 0) {
+      err(`--draft-spent-usd "${draftSpentArg}" is not a finite number >= 0 — refusing rather than coercing it into $0 (which would widen the ceiling) or letting a NaN poison the ceiling arithmetic`);
+      throw new ExitSignal(2);
+    }
+    DRAFT_SPENT_USD = v;
+  }
+  // --draft-spend-incomplete (hamr's ruling 2026-09-28, 2nd addendum) — a NEW
+  // field beside --draft-spent-usd, never a value inside it: whether the
+  // drafting fold above was EXACT. Boolean presence-flag, same class as
+  // --review-door above (no argument, no value to misread as 0/Infinity).
+  // Meaningless alone (no drafting fold to qualify) but never refused for
+  // being passed without --draft-spent-usd — a re-invocation tail that always
+  // pairs the two never needs a second guard to prove it did.
+  const DRAFT_SPEND_INCOMPLETE = ctx.draftSpendIncomplete === true;
+  /** every re-invocation this script PRINTS carries the drafting fold, the
+   * same SHIM_TAIL/SCOUT_TAIL rule: a resume that dropped it would silently
+   * WIDEN the ceiling back up by the drafting spend on its next leg (and
+   * dropping the incomplete flag would silently turn a floor into an exact
+   * figure on the next leg's own job-start). */
+  const DRAFT_TAIL = DRAFT_SPENT_USD > 0 ? ` --draft-spent-usd ${DRAFT_SPENT_USD}${DRAFT_SPEND_INCOMPLETE ? ' --draft-spend-incomplete' : ''}` : '';
+
   const WORKDIR = target.workdir;
   const SEED = target.seed;
   const specHash = jobSpecHash(spec);
@@ -1040,7 +1101,7 @@ async function execute(ctx) {
     // right key only by accident of the runner's own generic error message,
     // never from this hint. `providerEntry.envKey` is the same resolved name
     // the real key check at launch (`:1157-1158` below) reads.
-    const invoke = (/** @type {string} */ tail) => `  ${providerEntry.envKey}=... node scripts/run-u.mjs ${SELECTOR}${dead ? ` --resume ${RESUME}` : ''}${SHIM_TAIL}${SCOUT_TAIL}${tail} --approve ${specHash}`;
+    const invoke = (/** @type {string} */ tail) => `  ${providerEntry.envKey}=... node scripts/run-u.mjs ${SELECTOR}${dead ? ` --resume ${RESUME}` : ''}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${tail} --approve ${specHash}`;
     /** the door the operator has already picked, as flags — hoisted out of the else
      * below so the inhibitor line at the bottom can print the WHOLE command rather
      * than a shape the operator has to assemble. Empty on an ordinary run and on the
@@ -1205,8 +1266,8 @@ async function execute(ctx) {
     out(`\nPAUSED BY YOU — nothing was run and nothing was spent. The checkpoint stands exactly as it was: the work is on the run's own branch, the plan and the money are where the paused leg left them.`);
     out(`  keeps    ${PAUSE_TTL_MS / 86_400_000} days from the pause on the record — after that the checkpoint expires on its own, and nothing has to be decided today to let that happen`);
     out('  resume   the SAME runid, whenever you want, with the door you pick then:');
-    out(`           node scripts/run-u.mjs ${SELECTOR} --resume ${RESUME}${SHIM_TAIL}${SCOUT_TAIL} --decide accept --approve ${specHash}`);
-    out(`           node scripts/run-u.mjs ${SELECTOR} --resume ${RESUME}${SHIM_TAIL}${SCOUT_TAIL} --decide rerun --text "<what you want done differently>" --approve ${specHash}`);
+    out(`           node scripts/run-u.mjs ${SELECTOR} --resume ${RESUME}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL} --decide accept --approve ${specHash}`);
+    out(`           node scripts/run-u.mjs ${SELECTOR} --resume ${RESUME}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL} --decide rerun --text "<what you want done differently>" --approve ${specHash}`);
     out(`  read     the same command with no --decide re-prints the evidence package you just looked at`);
     throw new ExitSignal(0);
   }
@@ -1297,22 +1358,32 @@ async function execute(ctx) {
   // the same shape src/cli.js's `doRun` already uses) — a caller that hands in
   // its own provider IS the run, so nothing here needs a real secret.
   if (!deps.provider) {
+    // P4b — the Settings row (keys file line) whose API shape + Base URL match this spec
+    // supplies the key VARIABLE, standing in for the provider's built-in one; no matching
+    // row = the built-in. Names only — values come from the
+    // env / keys file. The judge follows the worker's choice when it is the same provider
+    // (the same rule that gives it the worker's baseUrl below).
+    const keyCfg = cfgOn ? rowsForHome(cfgHome) : [];
+    const workerEnv = applyConfiguredKey(env, spec.provider, spec.baseUrl, keyCfg, spec.model);
+    const judgeEnv = judge.provider === spec.provider ? workerEnv : applyConfiguredKey(env, judge.provider, undefined, keyCfg, judge.model);
+    /** the variable NAME this worker's key is read from (the person's pick, else built-in) — for messages only */
+    const workerKeyName = keyNameFor(spec.provider, spec.baseUrl, keyCfg, spec.model).name;
     // A green anthropic-api job's behaviour is byte-identical to before: its
     // worker key IS `ANTHROPIC_API_KEY`, demanded as ever.
-    workerApiKey = env[providerEntry.envKey];
-    if (!workerApiKey) { err(`${providerEntry.envKey} not set (secrets load from the environment — never the tree)`); throw new ExitSignal(2); }
+    workerApiKey = workerEnv[providerEntry.envKey];
+    if (!workerApiKey) { err(`${workerKeyName} not set (secrets load from the environment — never the tree)`); throw new ExitSignal(2); }
     // F181 — a key that reads as "set" above can still carry a line break/
     // control char/stray whitespace (a two-line secret-store entry, e.g.) and
     // crash Node's own header-encode inside the paid span. Refuse at the SAME
     // door, before any provider is constructed; never echo the value.
     const workerKeyProblem = apiKeyProblem(workerApiKey);
-    if (workerKeyProblem) { err(`${providerEntry.envKey} ${workerKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`); throw new ExitSignal(2); }
+    if (workerKeyProblem) { err(`${workerKeyName} ${workerKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`); throw new ExitSignal(2); }
     // The judge's KEY follows the RESOLVED judge provider's own env var, with
     // `JUDGE_API_KEY` as a role-named override in front of it (PRD item 32.3). The
     // override matters most in the case this item exists for: a job whose worker and
     // judge are the SAME provider but different accounts, and the anthropic case
     // where one variable used to do two jobs.
-    judgeApiKey = env.JUDGE_API_KEY ?? env[judgeEntry.envKey];
+    judgeApiKey = env.JUDGE_API_KEY ?? judgeEnv[judgeEntry.envKey];
     if (JUDGES && !judgeApiKey) {
       err(`This job's close JUDGES (${judgedStages(spec.closeDecl).length} judged stage(s)) and its judge is ${judge.model} on ${judge.provider}${spec.judge ? ' (signed override)' : " (this job's own worker model — no `judge` override signed)"}.`);
       err(`Neither JUDGE_API_KEY nor ${judgeEntry.envKey} is set — secrets load from the environment, never the tree.`);
@@ -1332,6 +1403,34 @@ async function execute(ctx) {
     }
   }
 
+  // THE MONTHLY $ LIMIT (PANEL-BUILD.md P4a, hamr 2026-09-29: "drop time keep money") — the
+  // ONE run-start seam. Every run this door starts (the CLI's `bareloop run-u` and the panel,
+  // which spawns it) passes here after the signature and the key gates and BEFORE the run
+  // list row, the patient reset or any token: a cap larger than what is left this month does
+  // not start, and nothing is spent. This leg's exposure is the whole signed cap on a cold
+  // start (it covers drafting + run) and only the REMAINDER on a resume/door-rerun, whose
+  // earlier spend is already in the month's total (a resume's killed leg counts its real spend only,
+  // never its unspent cap — `resumingSpine` — since the remainder asked for here covers that). No limit set = no check. An unreadable
+  // config.json refuses too — a broken instrument never silently reads "no limit".
+  {
+    const foldedUsd = dead ? dead.restart.priorSpentUsd : (doorPrior?.spentUsd ?? 0);
+    const legCapUsd = Math.max(0, spec.budgetUsd - (typeof foldedUsd === 'number' && Number.isFinite(foldedUsd) ? foldedUsd : 0));
+    /** @type {string|null} */
+    let refusal = null;
+    try {
+      if (cfgOn) refusal = monthlyRefusalText(checkMonthlyRoom({ capUsd: legCapUsd, home: cfgHome, resumingSpine: deadSpineFile }));
+    } catch (e) {
+      if (!(e instanceof ConfigError)) throw e;
+      err(`${e.message} — refusing to start rather than guess the monthly limit. Nothing spent.`);
+      throw new ExitSignal(2);
+    }
+    if (refusal !== null) {
+      err(refusal);
+      err('Nothing spent. Lower the cap, or raise the monthly limit in Settings.');
+      throw new ExitSignal(2);
+    }
+  }
+
   // `wd`/`spineDir` are derived once, above the resume reader that needs them; only the
   // directory's CREATION belongs here, after the preview/approval gates have exited.
   mkdirSync(spineDir, { recursive: true });
@@ -1458,6 +1557,14 @@ async function execute(ctx) {
   // driver's plan is a row nobody can audit from its own log.
   out(`   ${READ_SHIM_LABEL}`);
   out(`   ${SCOUT_LABEL}`);
+  // hamr's ruling 2026-09-28 — advertised = enforced: the banner states the
+  // SIGNED cap above unconditionally (it never changes, same spec hash), and
+  // this line states the drafting fold whenever there is one, so the number
+  // this run actually enforces (Cap $ − drafting spent) is never a second,
+  // silent figure a reader has to compute themselves.
+  if (DRAFT_SPENT_USD > 0) {
+    out(`   drafting spent $${DRAFT_SPENT_USD.toFixed(4)} — this run's own enforced ceiling is $${(spec.budgetUsd - DRAFT_SPENT_USD).toFixed(4)} of the signed $${spec.budgetUsd}`);
+  }
 
   // F67 — the OUTSIDE watchdog, started before the run and sharing nothing with it.
   // Every guard bareloop had lived inside this process, and ms3197n8/ms3jh76q proved
@@ -1642,6 +1749,8 @@ async function execute(ctx) {
       closeDir: spineDir,
       readShim: READ_SHIM,
       scout: SCOUT,
+      draftSpentUsd: DRAFT_SPENT_USD,
+      draftSpendComplete: !DRAFT_SPEND_INCOMPLETE,
       // RESUME: the money and the wall the halted run already burned are FOLDED IN (so
       // the signed ceiling cannot widen by being re-invoked), and the checkpoint it
       // reached is handed over so the plan is reloaded rather than re-drafted and the
@@ -1731,7 +1840,15 @@ async function execute(ctx) {
   const writes = audit.filter((e) => e.decision === 'allow' && (e.action?.type === 'write' || e.action?.type === 'edit'));
 
   out(`\noutcome   ${outcome}`);
-  out(`spent     ${je?.spentUsd == null ? 'UNKNOWN' : `${je.spendComplete === false ? '≥' : ''}$${je.spentUsd.toFixed(4)}`} of $${spec.budgetUsd}`);
+  // hamr's ruling 2026-09-28 — the drafting share (this leg's own job-start
+  // record) rides beside the run's own spend via the ONE shared formatter,
+  // so this line never disagrees with the panel's Run tab/Runs list about
+  // what "$X of $Y" means for a job that drafted through the panel/author.
+  const jobStartRec = events.find((e) => e.type === 'job-start');
+  const legDraftSpentUsd = typeof jobStartRec?.draftSpentUsd === 'number' && jobStartRec.draftSpentUsd > 0 ? jobStartRec.draftSpentUsd : null;
+  const legDraftSpendComplete = legDraftSpentUsd === null ? null : jobStartRec.draftSpendComplete !== false;
+  const spendCore = je?.spentUsd == null ? 'UNKNOWN' : `${je.spendComplete === false ? '≥' : ''}$${je.spentUsd.toFixed(4)}`;
+  out(`spent     ${moneyWithDraft(spendCore, legDraftSpentUsd, spec.budgetUsd, legDraftSpendComplete)}`);
   // FOLDED, exactly like the money line above it: on a resume the cap governs both legs
   // together, and a leg-only wall next to a folded spend is two framings on one cap with
   // no label to tell them apart (F83). The leg stays on the line beside it.
@@ -1768,7 +1885,7 @@ async function execute(ctx) {
     out(`  trend   ${mh.trend} — ${mh.reading}`);
     out(`  lever   ${mh.lever}`);
     for (const o of mh.options ?? []) out(`          · ${o}`);
-    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL} --approve <the NEW hash after you edit budgetUsd>`);
+    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL} --approve <the NEW hash after you edit budgetUsd>`);
     out('          (the top-up is yours to sign — nothing in the run may widen its own budget)');
   }
   // A STALL is a checkpoint too (hamr's go, 2026-08-13). Its own escalation prints one
@@ -1778,7 +1895,7 @@ async function execute(ctx) {
   // the hash already approved is the hash that resumes.
   if (outcome === 'step-stalled') {
     out('\nSTALL HALT — the model stopped producing rounds and reissuing the call did not recover it. The tree, the plan and the steps already finished STAND.');
-    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL} --approve ${specHash}`);
+    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL} --approve ${specHash}`);
     out('          (no spec edit, so the hash is unchanged — this re-enters at the stalled step and re-pays for none of the ones before it)');
     out('          (if the allowance is what actually ran out underneath the stall, that preview says so and refuses — it is read there, not asserted here)');
   }
@@ -1799,7 +1916,7 @@ async function execute(ctx) {
     out(`  died    ${total === null ? 'before a plan was accepted — nothing paid is re-payable'
       : done >= total ? `at the close — all ${total} step(s) finished`
         : `in step ${done + 1} of ${total}`}`);
-    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL} --approve ${specHash}`);
+    out(`  resume  node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL} --approve ${specHash}`);
     out('          (no spec edit, so the hash is unchanged — this re-enters at the recorded step and re-pays for none of the ones before it)');
     out('          (if the allowance is what actually ran out underneath the transport fault, that preview says so and refuses — it is read there, not asserted here)');
   }
@@ -1820,7 +1937,7 @@ async function execute(ctx) {
     ]);
     out('  clock    STOPPED — the wall does not run while a person is reading (W-2), and this leg\'s elapsed is what folds into the resume');
     out('');
-    const answer = (/** @type {string} */ tail) => `node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${tail} --approve ${specHash}`;
+    const answer = (/** @type {string} */ tail) => `node scripts/run-u.mjs ${SELECTOR} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${tail} --approve ${specHash}`;
     for (const l of doorLines({
       rerun: answer(' --decide rerun --text "<what you want done differently>"'),
       accept: answer(' --decide accept'),
@@ -2057,6 +2174,8 @@ function buildCtx(mode, opts) {
     model: opts.model ?? null,
     readShim: opts.readShim ?? null,
     scout: opts.scout ?? null,
+    draftSpentUsd: opts.draftSpentUsd ?? null,
+    draftSpendIncomplete: opts.draftSpendIncomplete === true,
     registry: opts.registry ?? null,
     workflow: opts.workflow ?? null,
     approve: opts.approve ?? null,
@@ -2275,6 +2394,8 @@ export async function main(argv, deps = {}) {
       model: argFlag('model'),
       readShim: argFlag('read-shim'),
       scout: argFlag('scout'),
+      draftSpentUsd: argFlag('draft-spent-usd'),
+      draftSpendIncomplete: argv.includes('--draft-spend-incomplete'),
       registry: argFlag('registry'),
       workflow: argFlag('workflow'),
       approve: argFlag('approve'),

package/types/authorflow.d.ts

@@ -649,7 +649,10 @@ export function confirmPrompt({ answers, questions, labels, facts, listing, writ
  *   generate: Function, book: ReturnType<typeof makeCostBook>,
  *   ask: (step: {kind: string, [k: string]: any}) => Promise<string|null>,
  *   onPhase?: (phase: string, data?: any) => void, mode?: 'tool'|'text',
- *   worseThanBefore?: string}} o
+ *   worseThanBefore?: string}} o retired field (hamr's ruling 2026-09-28):
+ *   `worseThanBefore` is never asked any more and defaults to `''` — a
+ *   caller may still pass a string through (kept for a future, non-ask
+ *   source of the same constraint), it just never comes from an ask() step.
  * @returns {Promise<{ok: boolean,
  *   stop: null|'cap-halt'|'pricing-red'|'provider-red'|'artifact-red'|'confirm-abandoned'|'confirm-restart',
  *   rounds: number,
@@ -1013,26 +1016,6 @@ export const QUESTION_SETS: Record<string, {
  * @type {Record<string, string|null>}
  */
 export const CLASS_STATEMENTS: Record<string, string | null>;
-/**
- * Asked ONLY for a repo source (ruling 2 addendum's D7) — a plain folder or a
- * URL has no "before" a repo's own history gives it to compare against. This
- * is the OLD Q5 wording, verbatim ("What would make you say this came back
- * worse than before?"), which M3 piece 3's reshape folded into Guardrails —
- * it survives here as its OWN field because the confirm turn (ruling 5's
- * 2026-09-13 addendum) includes it as a constraint only when the person
- * actually gave one, and folding it silently into the Guardrails free-text
- * slot would lose that "present or absent" distinction. An empty answer is
- * "nothing beyond what Guardrails already said" and is not required — see
- * the frozen-wording test below: this phrase appears NOWHERE in
- * {@link questionsFor}'s own sets, so a caller cannot double-ask it by
- * reading the wrong table.
- */
-export const WORSE_THAN_BEFORE_FIELD: Readonly<{
-    id: "worseThanBefore";
-    kind: "mechanical";
-    label: "Worse than before";
-    prompt: "What would make you say this came back worse than before?";
-}>;
 /**
  * Asked ONLY when `src/detectlang.js`'s `detectLanguage` reports its
  * `ambiguous` outcome — two supported languages' manifests at the same

package/types/authorrun.d.ts

@@ -1,6 +1,7 @@
 /**
  * @typedef {object} Deps
  * @property {Record<string,string|undefined>} [env]
+ * @property {string} [keysHome] P4a — test seam: load this home's `.env` keys file even when `env` is injected.
  * @property {NodeJS.ReadStream} [stdin]
  * @property {NodeJS.WritableStream} [stdout]
  * @property {NodeJS.WritableStream} [stderr]
@@ -23,6 +24,10 @@
 export function main(argv: string[], deps?: Deps): Promise<number>;
 export type Deps = {
     env?: Record<string, string | undefined> | undefined;
+    /**
+     * P4a — test seam: load this home's `.env` keys file even when `env` is injected.
+     */
+    keysHome?: string | undefined;
     stdin?: NodeJS.ReadStream | undefined;
     stdout?: NodeJS.WritableStream | undefined;
     stderr?: NodeJS.WritableStream | undefined;

package/types/cli.d.ts

@@ -3,7 +3,7 @@
  * code, so `bin/bareloop.mjs` can set `process.exitCode` and let node flush
  * queued stdout on its own (F-something: `process.exit()` can discard it).
  * @param {string[]} argv
- * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any, runlistHome?: string }} deps
+ * @param {{ env?: Record<string,string|undefined>, stdout?: any, stderr?: any, cwd?: string, provider?: any, providerFor?: any, judgeProvider?: any, judgeModel?: string|null, now?: () => number, stdin?: any, runlistHome?: string, keysHome?: string }} deps
  * @returns {Promise<number>}
  */
 export function main(argv: string[], deps?: {
@@ -18,4 +18,5 @@ export function main(argv: string[], deps?: {
     now?: () => number;
     stdin?: any;
     runlistHome?: string;
+    keysHome?: string;
 }): Promise<number>;