bareloop 0.33.0 → 0.34.0

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.34.0] - 2026-10-01
+
+### Fixed
+
+- Judge rounds now carry `rateSource` (`'caller'` under your price, else the guess label the worker rounds carry), so a customer-priced judge round counts as vouched, not other, in the provenance readout and the monthly counts. Dollar totals are unchanged. Evidence: live run `mup3h70u` (136 worker rounds `caller`, 14 judge rounds without it).
+- The monthly-limit refusal now names the money a run in progress holds: `Max $4.00 (monthly limit, $5.95 held by a run in progress)` (`runs` when several); with nothing held the text is unchanged. `monthSpend` / `checkMonthlyRoom` also return `heldUsd` and `heldRuns`.
+- The interview's "Run it now?" now starts the packaged door (`bin/bareloop.mjs author`, same flags) instead of `scripts/run-author.mjs`, which the published package does not ship.
+- One "is this run alive" rule (`runIsAlive`, `src/runlist.js`) now drives both the panel's [▶] / [?] glyph and the monthly limit's hold: the run row's pid first (`isLiveRunner`), the spine-mtime rule only for a row with no pid. A run whose pid is alive but whose spine is quiet for 10+ minutes now reads running, not died; a dead pid with a fresh spine reads died. A `job-end` on the spine still wins.
+- `--resume` now also refuses when the predecessor run's own run-list row carries the pid of a live bareloop runner, not only when a watchdog kill record names it (same refusal text).
+- Every panel GET/HEAD route now refuses (`403`) a request whose `Host` is not the panel's own `127.0.0.1:<port>` (one shared `checkHostGuard`, also used by the write routes' guard), so a page on another origin cannot read the run list through a rebound DNS name. No token is needed to read.
+- The monthly-limit check (and so every run start) no longer parses the spine of every run ever listed: it reads only runs listed in the current local month, plus any claim still held by a live runner. The Money tab's all-time figures still read everything.
+- A key row priced 0 / 0 is still accepted, but the `price    yours:` readout (run preview and run tail) now ends with a warning that the price is $0 so spend and limits read $0.
+- A run that stops at $0 on a SOURCE-MANIFEST-RED, DESTINATION-RED or CLOSE-TIMING-RED now releases its monthly claim (the same `released` entry as a run that never started), so it leaves no ghost row and the month no longer reads "at least".
+- A spec whose `budgetUsd` is not a finite number (e.g. `1e999`) is refused by `validateJob` at $0, and the monthly-limit check (`checkMonthlyRoom` / `claimRun`) no longer reads a non-finite cap as $0 — it never fits.
+- A bundle money halt that used the whole signed ceiling now says no room is left under the signed ceiling (and prints no resume line) instead of a `--budget <more than X, at most X>` placeholder nothing can satisfy.
+
 ## [0.33.0] — 2026-09-30
 
 ### Added

package/bareloop.context.md

@@ -158,7 +158,7 @@ minting claim, or the shell-owned retry cap — all unknown-field reds.
 | `provider` | `anthropic-api` \| `openai-api` \| `gemini-api` \| `clipipe-subscription` | menu (`PROVIDERS`); part of the lineage key by definition. Only `anthropic-api` is guaranteed (F48); `openai-api` (PRD item 28) goes through the provider factory (`src/providers.js`), reads `OPENAI_API_KEY`, and admits only `deepseek-flash` today (F171: swapped from the retired `deepseek-chat`) — see "Worker surface" above for its `baseUrl` field and per-model gating; `gemini-api` (PRD item 31.3) reads `GEMINI_API_KEY` and is ADMITTED-PENDING-PROBE — zero runs, and every launch says so (`PROBE_STATUS`/`probeWarningLines`); `clipipe-subscription` drives the worker natively and needs `opts.nativeProvider` |
 | `conditions` | `{ providerPath?, closeVerbosity?, taskFraming?, scaffold? }` | declared keys only, string values — the environment label (consumed by the N3 lineage key; recorded on spines from run one) |
 | `cadence` | `{ unit: hour\|day\|week, every: 1..30 }` | validated now, consumed at N5 (Scheduler) |
-| `budgetUsd` | `0 < n <= shell cap` | ceiling chain: workflow ≤ job ≤ shell — each layer may tighten, never exceed |
+| `budgetUsd` | finite `0 < n <= shell cap` | ceiling chain: workflow ≤ job ≤ shell — each layer may tighten, never exceed |
 | `maxWallMs` | optional integer ms `>= MIN_WALL_MS` (one close timeout) | the run's wall clock. **NO DEFAULT, by ruling** — absent means time-unbounded *by explicit operator choice*, never by fallback (F45: a defaulted cap is a silent second ceiling). Enforcement is a BETWEEN-ROUND deadline, so the honest worst case is `maxWallMs + closeStages × closeTimeoutMs` — every stage of a staged close gets the FULL timeout — and all three numbers are reported (`loop.stop()` cannot cut an in-flight call — F61 measured 500ms→4,018ms). The `MIN_WALL_MS` floor is a ONE-stage, un-autoset-default number, so a spec with many stages OR a raised/autoset `closeTimeoutMs` can validate while its overshoot dwarfs its cap: `runPlan` adds a RUN-START check (PRD item 27/M3) that refuses `wall-under-close-timeout` at $0 once the EFFECTIVE per-stage ceiling is known (autoset or signed), rather than a silent clamp. Operator-only, tighten-only; adding or changing it changes the spec hash |
 | `closeTimeoutMs` | optional integer ms `>= CLOSE_TIMEOUT_FLOOR_MS` (120,000 — hamr's arbiter floor, 2026-09-07) | PRD item 27/M3's SIGNED override for the close's own per-stage wall-clock cap. Absent (the normal case): the run autosets it from a $0 seed timing pass — `max(FLOOR, K × slowest measured stage)`, `K = 5` (hamr, 2026-09-07: "2 and 5 are fine"). Present: the operator's own number wins outright and may legally sit ABOVE *or below* the autoset estimate (the rates-passthrough shape, F113 — never tighten-only). Arbiter territory exactly like `budgetUsd`/`maxWallMs`/`close[].sha256`: the authoring pipeline's `assembleSpec` refuses a draft carrying it |
 | `model` | optional non-empty string, exact provider model id (e.g. `"claude-sonnet-5"`) | the WORKER's model, build-list #3. Absent means today's runner default; present it wins over a `--model` flag outright, and a flag naming a different id is refused (`resolveWorkerModel`, `src/job.js`) rather than silently overridden. Part of the signed hash like every other field. Worker only — the JUDGE's model comes from the `judge` row below, which DEFAULTS to this same worker model |
@@ -1860,10 +1860,10 @@ before. bareloop keeps no price list of its own, ever.
 carries it on every metering payload, and bareloop forwards it VERBATIM (`rateSourceFields`,
 `src/planrun.js`): every API `worker-round` (worker, scout, planner, fix loop) carries it beside
 `pricing` today — `'caller'` when a customer price is on the key's row, else `'tier'`/`'default'`
-(the guess). The exceptions read UNKNOWN provenance, correctly, and by the same rule that governs
-the archive: `judge-round` records carry no `rateSource` (the judge cost payload,
-`src/kinds.js` `onJudgeCost`, does not forward it, so a judge round is never counted as vouched,
-priced by you or not), and so does every round archived before the signal existed. The native
+(the guess). `judge-round` records carry it too (the judge Loop's per-call label, forwarded by
+`src/kinds.js` `onJudgeCost`): `'caller'` under your price on the judge's row, else the guess label. The
+exceptions read UNKNOWN provenance, correctly, and by the same rule that governs the archive: every
+round archived before the signal existed (judge rounds before this change included). The native
 per-turn `worker-turn` carries `null`, bareloop's OWN statement rather than a forwarded one: that
 surface prices the SESSION, so a turn had no rate to guess. A `worker-round`/`worker-turn`
 carries bare-agent's own label beside `pricing`:
@@ -3165,6 +3165,9 @@ monthly limit, your price and the key-row choice apply exactly as on the sub-com
 got none, and a run started from the menu skipped the limit). All three are dispatched by name only: `bareloop run-u <flags…>`,
 `bareloop interview <flags…>`, `bareloop author <flags…>`.
 
+When two key rows share one provider and endpoint, a CLI run uses the FIRST row in the keys list, so put the
+key you want first (the panel picks the row by the Model menu).
+
 - **`bareloop export <jobs/x.json> --registry <dir> --out <dir>`** → resolves the spec's
   close-script paths against the spec file's own directory (never the process cwd), calls
   `exportBundle`. On success prints `bundleHash:`, the sorted file list, and "this bundle is
@@ -3205,7 +3208,8 @@ got none, and a run started from the menu skipped the limit). All three are disp
      `--budget`/`--wall`, only if you passed them (a tightened ceiling never silently reverts to the signed
      one). After a MONEY halt the line does NOT repeat the exhausted `--budget` (chain spend is folded, so
      it would halt again at once); it prints `--budget <more than $<spent so far>, at most $<signed
-     budgetUsd>>` for you to fill in, and is not runnable until you do. A bundle's spec is
+     budgetUsd>>` for you to fill in, and is not runnable until you do. When the run spent the WHOLE signed
+     ceiling, that range is empty, so no resume line is printed: the block says no room is left under the signed ceiling. A bundle's spec is
      manifest-hashed, so its halt hint never asks you to edit `budgetUsd`.
   6. `resolveBundleSpec` (the `$BARELOOP_BUNDLE` substitution) → tighten `budgetUsd`/`maxWallMs`
      in memory if `--budget`/`--wall` were given → `approveHash = jobSpecHash(that tightened+
@@ -3325,6 +3329,8 @@ got none, and a run started from the menu skipped the limit). All three are disp
   `baselineKind`/`question`: the plain-English question is derived in `src/panel/server.js`
   (`stageQuestionText`) from the signed stage's kind/params only, `null` when no honest
   wording exists (the client then shows the stage's own name). Every
+  GET/HEAD answers only when its `Host` header is the panel's own `127.0.0.1:<port>` (`checkHostGuard`,
+  `src/panel/authorroutes.js`; any other Host is `403`, no token needed to read). Every
   P1 endpoint is GET/HEAD only (anything else — including every write verb — is `405`, outside the
   two human-click-guarded write families `/api/author/*` and `/api/settings/*` below); a URL
   never joins a path segment into a filesystem read — a runid is looked up in the run list
@@ -3370,7 +3376,8 @@ got none, and a run started from the menu skipped the limit). All three are disp
   requires the human-click guard: an `x-bareloop-token` header matching a fresh token minted
   once per server start (templated into `index.html` like the port) AND an Origin/Host
   naming this exact `127.0.0.1:<port>` — a request failing either gets `403`, before the
-  route body ever runs. `POST /api/author/start` (one job-card body; `409` while a prior
+  route body ever runs. The token protects against other browser origins, not against other local users or
+  processes on the same machine (local-trust model). `POST /api/author/start` (one job-card body; `409` while a prior
   session is still non-terminal — one authoring session at a time) creates a session
   (`src/panel/authorsession.js`) that runs `prepareSource`/`detectLanguage`/`validateJob`/
   `authorCloseForJob`/`assembleSpec`/`prepareSigning` in-process, exactly the library calls
@@ -3440,7 +3447,7 @@ got none, and a run started from the menu skipped the limit). All three are disp
   mechanically, $0, via `prepareSource`/`proveDestination`), then the picked class's frozen
   question set (`questionsFor`/`requiredAnswersFor`, `src/authorjob.js`), then the operator's
   own job name/budget/wall. On success it writes `answers.json`/`specdraft.json` under `--out`
-  and either offers to spawn `scripts/run-author.mjs` (only when a clean key is present and no
+  and either offers to spawn the packaged `bin/bareloop.mjs author` (same flags as `scripts/run-author.mjs`, which the package does not ship; only when a clean key is present and no
   install gap remains — default answer is no) or prints the exact command to run it later.
   Because this module reads a real TTY/piped stdin, `src/cli.js` hands it `stdin`/`stdout`/
   `stderr` (the raw streams, not the wrapped `out`/`err` line-functions every other command
@@ -3559,7 +3566,7 @@ provider its own row, for the worker's provider the row on the worker's endpoint
 (The judge's KEY still follows the worker's row, so with two rows on one endpoint key and price can differ.) A priced round is stamped `rateSource:'caller'` (VOUCHED, see `spendProvenance`); with
 no price it stays the built-in guess, as before. The run preview and the run tail print
 `price    yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)` when a price is set, and
-nothing when none is. **The price is yours, and it sets what the cap means:** the cap and the halts run
+nothing when none is; a 0 / 0 price is accepted but the line then ends `— WARNING: this price is $0, so spend and limits read $0`. **The price is yours, and it sets what the cap means:** the cap and the halts run
 on the dollars your price produces, so a price set too low weakens the cap (a run can do far more
 than you meant before it halts). When a vendor lists two prices (for example a cache-hit and a
 cache-miss input rate) enter the higher one. bare-agent applies its own cache multipliers (read 0.1×,
@@ -3570,8 +3577,9 @@ re-priced** (a spine and the run list keep the dollars they booked). Not covered
 resolves no key row.
 
 **Monthly $ limit.** `checkMonthlyRoom({ capUsd, home, now })` → `{ ok, leftUsd, limitUsd,
-atLeast }`; `monthlyRefusalText(room)` is the ONE spelling: `Max $<left, 2 decimals> (monthly
-limit)`. It is called at the run-start seam in `src/userrun.js` `execute` (before any token
+atLeast, heldUsd, heldRuns }`; `monthlyRefusalText(room)` is the ONE spelling: `Max $<left, 2 decimals>
+(monthly limit)`, and when run(s) in progress hold money beyond what they have spent, the same line
+reads `Max $4.00 (monthly limit, $5.95 held by a run in progress)` (`runs` when more than one). It is called at the run-start seam in `src/userrun.js` `execute` (before any token
 spends; the CLI prints it to stderr, exit 2) and at the panel's Sign & run (`signRun` in
 `src/panel/authorroutes.js`, refused server-side whatever the page shows). The page only echoes the
 same text under `#jf-cap-money` via `GET /api/author/monthly-check?cap=`. "This month" is the local
@@ -3584,17 +3592,17 @@ records only. `claimRun` (`src/monthly.js`) writes the run's row FIRST (it carri
 its pid is a live bareloop runner (`isLiveRunner`, `src/runlist.js`, also what `--resume` uses to refuse a
 resume against a live run: the process is a node executable with a `bareloop`/`bareloop.mjs`/`run-u.mjs`/
 `u-watchdog.mjs` argument, or is itself named so — a recycled pid running some other program never holds a
-cap, though a recycled node program with such an argument still would), however quiet its spine; a claim whose process is gone is closed by whoever
+cap, though a recycled node program with such an argument still would), however quiet its spine (`runIsAlive`, `src/runlist.js`, is the one "is this run alive" rule: the panel's [▶] / [?] glyph reads it too; `--resume` also refuses on the pid in the predecessor's own run-list row, not only the watchdog's record); a claim whose process is gone is closed by whoever
 finds it, with a note (`{runid, type:'settled', by:<finder>, reason:'process gone', spentUsd:<floor>}`) and
 counts its real spend. If the sum fits, the run goes; if not, it appends `{type:'released',
 reason:'refused'}` and refuses with the exact text, nothing spent. A run whose row is listed (claimed, or with no limit set) that then exits at $0 before its spine has a first record (a refused
-`--resume` patient, a failing tree setup) appends `{type:'released', reason:'not started'}` too, so it leaves no row. A row that cannot be written, or an
+`--resume` patient, a failing tree setup) appends `{type:'released', reason:'not started'}` too, so it leaves no row; so does a $0 refusal after the spine exists (`SOURCE-MANIFEST-RED`, `DESTINATION-RED`, `CLOSE-TIMING-RED`). A row that cannot be written, or an
 unreadable config, refuses too — never "no limit". When a run ends it appends its own
 `{runid, type:'settled', by:<runid>, spentUsd, spendComplete, at}`. Two runs may close the same dead claim;
 the FIRST note for a runid is authoritative. `readRunList` folds these entries out of the run rows
 (`events`; a `released` claim's row is not listed). Month totals still read real spend off the spines. An
 older row with no `pid` keeps the spine-mtime rule (`DIED_MTIME_MS`: a spine written to within it is in
-flight, at its leg cap). A run refused because an earlier claim was itself later refused is the accepted
+flight, at its leg cap). The refusal check parses only the spines of runs listed in the current local month (plus any claim still held by a live runner); the all-time readers still read every run. A run refused because an earlier claim was itself later refused is the accepted
 safe-side cost of doing without a lock.
 Only the refusal reserves the cap (`monthSpend().reservedUsd`); the Money tab's month figure is
 real spend.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",

package/src/interviewrun.js

@@ -722,7 +722,8 @@ export async function main(argv, deps = {}) {
   }
 
   // ── 6. the paid step, which is a DIFFERENT process under a DIFFERENT ceiling ─
-  const RUN_AUTHOR = fileURLToPath(new URL('../scripts/run-author.mjs', import.meta.url));
+  // the PACKAGED door (`bin/` ships; `scripts/` does not): `bareloop author` takes the same flags as run-author
+  const BARELOOP_BIN = fileURLToPath(new URL('../bin/bareloop.mjs', import.meta.url));
   const childArgs = [
     '--source', TREE, '--answers', answersFile, '--draft', draftFile,
     '--verdict', VERDICT, '--out', OUT,
@@ -832,7 +833,7 @@ export async function main(argv, deps = {}) {
     exitCode = 0;
   } else {
     say('');
-    const child = spawnSyncFn(process.execPath, [RUN_AUTHOR, ...childArgs], { stdio: 'inherit' });
+    const child = spawnSyncFn(process.execPath, [BARELOOP_BIN, 'author', ...childArgs], { stdio: 'inherit' });
     if (child.error) {
       say(`run-author could not be started (${child.error.message}) — the command above still stands.`);
       exitCode = 2;

package/src/job.js

@@ -289,8 +289,8 @@ export function validateJob(input, { shellCapUsd = 2 } = {}) {
   }
 
   if (spec.budgetUsd === undefined) red('missing-required', 'budgetUsd');
-  else if (!(typeof spec.budgetUsd === 'number' && spec.budgetUsd > 0 && spec.budgetUsd <= shellCapUsd)) {
-    red('bounds', 'budgetUsd', `0 < budget <= shell cap ${shellCapUsd} (cap-not-estimate; no self-adjusted budgets, ever)`);
+  else if (!(typeof spec.budgetUsd === 'number' && Number.isFinite(spec.budgetUsd) && spec.budgetUsd > 0 && spec.budgetUsd <= shellCapUsd)) {
+    red('bounds', 'budgetUsd', `a finite 0 < budget <= shell cap ${shellCapUsd} (cap-not-estimate; no self-adjusted budgets, ever)`);
   }
 
   // T (PRD v1.27/v1.29) — TIME, with exactly budgetUsd's status: operator input,

package/src/judged.js

@@ -793,10 +793,28 @@ function topLevelFunctionNames(artifactText) {
  * so the priced seam is the only legal one.
  * `rates` is the customer's own price for the judge's row (USD per 1K, `ratesFor`'s
  * `rates`); null/absent = bare-agent's built-in guess, exactly as before.
- * @param {{provider: any, system: string, rates?: {in: number, out: number}|null}} o */
+ * @param {{provider: any, system: string, rates?: {in: number, out: number}|null}} o
+ * @returns {{run: (msgs: any[], tools: any[], opts?: any) => Promise<any>}} */
 export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
   const { Loop } = require('bare-agent');
-  return new Loop({ provider, system, ...(rates ? { rates } : {}) });
+  // BA-21: the Loop's run RESULT carries no `rateSource` — only the per-call metering event
+  // does (`onLlmResult`). Capture it there and ride it on the result, so `runLocate` can
+  // forward it to the judge-round record beside `costUsd`. Absent (no round metered) = no key.
+  /** @type {{rateSource: string|null}|null} */
+  let seen = null;
+  const loop = new Loop({
+    provider, system, ...(rates ? { rates } : {}),
+    onLlmResult: (/** @type {{rateSource?: string|null}} */ m) => {
+      if (m && typeof m === 'object' && 'rateSource' in m) seen = { rateSource: m.rateSource ?? null };
+    },
+  });
+  return {
+    run: async (/** @type {any[]} */ msgs, /** @type {any[]} */ tools, /** @type {any} */ opts) => {
+      seen = null;
+      const res = await loop.run(msgs, tools, opts);
+      return res && typeof res === 'object' && seen ? { ...res, rateSource: /** @type {any} */ (seen).rateSource } : res;
+    },
+  };
 };
 
 // ── LOCATE: one attempt ─────────────────────────────────────────────────────
@@ -821,7 +839,7 @@ export const defaultJudgeLoop = ({ provider, system, rates = null }) => {
  * On every route out, red or clean, `onCost` fires exactly once with the honest
  * read: a paid call that leaves no meter record is F12 wearing a judge's coat.
  * @param {{artifactText: string, card: any, loopFactory: (o: {provider?: any, system: string}) => any,
- *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number}) => void,
+ *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number, rateSource?: string|null}) => void,
  *   callBounds?: {timeoutMs?: number, deadlineMs?: number}}} o
  * @returns {Promise<{ok: boolean, facts: any|null, red: {axis: string, detail: string}|null,
  *   costUsd: number|null, unpricedRounds: number, truncated: boolean, parseError: boolean,
@@ -852,7 +870,9 @@ export async function runLocate({
   /** @param {{axis: string, detail: string}|null} red @param {any} facts @param {any} r @param {boolean} truncated @param {boolean} parseError */
   const out = (red, facts, r, truncated, parseError) => {
     const { costUsd, unpricedRounds } = r === null ? { costUsd: null, unpricedRounds: 0 } : priceOf(r);
-    onCost({ costUsd, unpricedRounds });
+    // BA-21: the round's provenance rides beside the cost when the loop carried it (see
+    // `defaultJudgeLoop`); a loop that never metered a rate adds no key.
+    onCost({ costUsd, unpricedRounds, ...(r && typeof r === 'object' && 'rateSource' in r ? { rateSource: r.rateSource } : {}) });
     return {
       ok: red === null, facts, red, costUsd, unpricedRounds, truncated, parseError,
       raw: scrubRaw({

package/src/kinds.js

@@ -1871,6 +1871,7 @@ async function runJudgedFloor(stage, ctx) {
           ctx.onJudgeCost({
             stage: stage?.name ?? null, kind: stage?.kind ?? null, path: rel, attempt,
             label: LOCATE_LABEL, model: judgeModel, costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
+            ...('rateSource' in c ? { rateSource: c.rateSource } : {}),
           });
         },
       });

package/src/ledger.js

@@ -410,10 +410,9 @@ export function updateLedger({ ledgerFile, spineFiles }) {
 // and the plan flow forwards it verbatim onto `worker-round`/`judge-round`/`worker-turn`
 // (`rateSourceFields`, src/planrun.js — the write side).
 //
-// NAMED rather than papered over: `judge-round`'s own payload (src/kinds.js's
-// `onJudgeCost({...})`) does not carry `rateSource` yet, so every judge round reads
-// UNKNOWN provenance today — correctly, by the same rule that governs the archive, and
-// the day that payload forwards the field the emit site already spreads it.
+// `judge-round`'s payload (src/kinds.js's `onJudgeCost({...})`) forwards `rateSource` from the
+// judge Loop's per-call metering (`defaultJudgeLoop`, src/judged.js); a judge round whose loop
+// carried none — and every judge round archived before this — reads UNKNOWN, by the archive rule.
 //
 // `pricing` is UNCHANGED and still strictly two-valued ('priced'|'unpriced'). Nothing
 // below reads it, nothing below decides anything, and no new escalation category exists:

package/src/monthly.js

@@ -14,16 +14,16 @@
 // run is counted at max(spend so far, capUsd) however quiet its spine; a run with a `job-end` counts
 // its real spend; a claim whose process is gone counts its floor and is settled — with an attributed
 // `settled` entry — by whichever later run finds it (the first note wins). An older row with no `pid` keeps the spine
-// mtime rule (a fresh spine, written to within DIED_MTIME_MS, is in flight). Only the refusal check
+// mtime rule (a fresh spine, written to within DIED_MTIME_MS, is in flight) — `runIsAlive`, src/runlist.js, the
+// one "is this run alive" rule the panel's glyph shares. Only the refusal check
 // reserves; the Money tab keeps showing real spend (`usd`).
 //
 // Honesty: a run whose spend is not fully known (a died/still-running spine, an unpriced
 // round, a missing spine file) makes the month total an "at least" figure — never a clean
 // number. The refusal text stays exactly `Max $X (monthly limit)`; `atLeast` travels beside it.
-import { existsSync, statSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { readConfig, configPath, ConfigError } from './config.js';
-import { readRunList, appendRun, appendRunEvent, isLiveRunner, DIED_MTIME_MS } from './runlist.js';
-export { isLiveRunner };
+import { readRunList, appendRun, appendRunEvent, isLiveRunner, runIsAlive } from './runlist.js';
 import { parseJsonl } from './replayio.js';
 import { SPEND_RECORD_TYPES, spendProvenance, floorsFromRecords } from './ledger.js';
 import { findRow } from './providerrows.js';
@@ -141,23 +141,21 @@ export function legTokens(records) {
 
 /**
  * What the refusal check counts for one run: its spend, unless it is IN FLIGHT (`job-start`, no
- * `job-end`, spine written to within DIED_MTIME_MS of `nowMs`), when it is the larger of that
+ * `job-end`, `runIsAlive` for a row with no pid — the pid-bearing rows are held by `readLegs`), when it is the larger of that
  * spend and the leg's own cap — the signed `budgetUsd` on the spine's `job-start` less the fold
  * a resumed leg inherited (`priorSpentUsd`), the same figure the run-start seam computes
  * (`legCapUsd`, src/userrun.js). A spine that records no `budgetUsd` reserves nothing extra.
  * @param {any[]} records
- * @param {string} spinePath
+ * @param {import('./runlist.js').RunRow} row
  * @param {number} nowMs
  * @param {number} usd the leg's spend so far
  * @returns {number}
  */
-function inFlightCapUsd(records, spinePath, nowMs, usd) {
+function inFlightCapUsd(records, row, nowMs, usd) {
   if (records.some((r) => r && r.type === 'job-end')) return usd;
   const start = records.find((r) => r && r.type === 'job-start') ?? null;
   if (!start || !(typeof start.budgetUsd === 'number' && Number.isFinite(start.budgetUsd))) return usd;
-  let mtimeMs;
-  try { mtimeMs = statSync(spinePath).mtimeMs; } catch { return usd; }
-  if (nowMs - mtimeMs > DIED_MTIME_MS) return usd; // stale — died, counts its floor
+  if (!runIsAlive(row, nowMs)) return usd; // stale — died, counts its floor
   const fold = typeof start.priorSpentUsd === 'number' && Number.isFinite(start.priorSpentUsd) ? start.priorSpentUsd : 0;
   return Math.max(usd, Math.max(0, start.budgetUsd - fold));
 }
@@ -178,7 +176,7 @@ function rowsAbove(rows, runid) {
 /**
  * Every listed run as one {@link Leg}. The ONE reader the month total, the all-time total
  * and the per-provider figures share.
- * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below)
+ * @param {{ home?: string, now?: () => number, aboveRunid?: string, thisMonthOnly?: boolean }} [opts] `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below); `thisMonthOnly` = do not parse the spine of a run listed in another local month (the refusal check drops it anyway) unless its claim is still held
  * @returns {Leg[]}
  */
 export function readLegs(opts = {}) {
@@ -195,7 +193,8 @@ export function readLegs(opts = {}) {
     // pid is a live bareloop runner, however quiet its spine — killed = process gone, not silence.
     // An older row with no `pid` keeps the spine-mtime rule (`inFlightCapUsd`), never guessed alive.
     const hasPid = Number.isInteger(row.pid);
-    const heldCap = hasPid && !settled.has(row.runid) && typeof row.capUsd === 'number' && Number.isFinite(row.capUsd) && isLiveRunner(/** @type {number} */ (row.pid)) ? row.capUsd : null;
+    const heldCap = hasPid && !settled.has(row.runid) && typeof row.capUsd === 'number' && Number.isFinite(row.capUsd) && runIsAlive(row, nowMs) ? row.capUsd : null;
+    if (opts.thisMonthOnly && heldCap === null && !Number.isNaN(at.getTime()) && !sameLocalMonth(at, new Date(nowMs))) continue;
     if (Number.isNaN(at.getTime()) || !existsSync(row.spine)) { legs.push({ ...base, reservedUsd: heldCap ?? 0 }); continue; }
     /** @type {any[]} */
     let records;
@@ -217,7 +216,7 @@ export function readLegs(opts = {}) {
       vouchedRounds: prov.vouched.rounds,
       otherRounds: prov.guessed.rounds + prov.unpriced.rounds + prov.unknown.rounds,
       reservedUsd: hasPid ? (records.some((r) => r && r.type === 'job-end') || heldCap === null ? leg.usd : Math.max(leg.usd, heldCap))
-        : inFlightCapUsd(records, row.spine, nowMs, leg.usd),
+        : inFlightCapUsd(records, row, nowMs, leg.usd),
       unreadable: false,
     });
   }
@@ -233,7 +232,7 @@ const sameLocalMonth = (at, now) => at.getFullYear() === now.getFullYear() && at
 
 /**
  * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `aboveRunid`: see {@link readLegs}
- * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's)
+ * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number, heldUsd: number, heldRuns: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's); `heldUsd` = what in-progress runs set aside beyond what they have spent (`reservedUsd - usd`), over `heldRuns` runs
  */
 export function monthSpend(opts = {}) {
   const nowDate = new Date((opts.now ?? Date.now)());
@@ -241,17 +240,20 @@ export function monthSpend(opts = {}) {
   let reservedUsd = 0;
   let atLeast = false;
   let runs = 0;
-  for (const leg of readLegs({ home: opts.home, now: opts.now, aboveRunid: opts.aboveRunid })) {
+  let heldUsd = 0;
+  let heldRuns = 0;
+  for (const leg of readLegs({ home: opts.home, now: opts.now, aboveRunid: opts.aboveRunid, thisMonthOnly: true })) {
     // an unreadable date could belong to this month — unknown, never dropped
     if (Number.isNaN(leg.at.getTime())) { atLeast = true; continue; }
     if (!sameLocalMonth(leg.at, nowDate)) continue;
     runs += 1;
-    if (leg.unreadable) { atLeast = true; reservedUsd += leg.reservedUsd; continue; }
+    if (leg.unreadable) { atLeast = true; reservedUsd += leg.reservedUsd; if (leg.reservedUsd > 0) { heldUsd += leg.reservedUsd; heldRuns += 1; } continue; }
     usd += leg.usd;
     reservedUsd += leg.reservedUsd;
+    if (leg.reservedUsd > leg.usd) { heldUsd += leg.reservedUsd - leg.usd; heldRuns += 1; }
     if (!leg.complete) atLeast = true;
   }
-  return { usd, atLeast, runs, reservedUsd };
+  return { usd, atLeast, runs, reservedUsd, heldUsd, heldRuns };
 }
 
 /**
@@ -323,6 +325,8 @@ export function spendSummary(opts = {}) {
  * @property {number|null} leftUsd what is left this month (null = no limit set)
  * @property {number|null} limitUsd the person's monthly limit (null = none)
  * @property {boolean} atLeast the month's spend is a floor, so `leftUsd` is a ceiling
+ * @property {number} [heldUsd] what run(s) in progress have set aside beyond their spend so far (present when a limit is set)
+ * @property {number} [heldRuns] how many runs hold it
  */
 
 /**
@@ -358,18 +362,21 @@ export function checkMonthlyRoom({ capUsd, home, now, aboveRunid }) {
   }
   const spent = monthSpend({ home, now, aboveRunid });
   const leftCents = Math.max(0, Math.floor((limit - spent.reservedUsd) * 100 + 1e-6));
-  const capCents = Math.ceil((Number.isFinite(capUsd) ? capUsd : 0) * 100 - 1e-6);
-  return { ok: capCents <= leftCents, leftUsd: leftCents / 100, limitUsd: limit, atLeast: spent.atLeast };
+  const capCents = Math.ceil(capUsd * 100 - 1e-6); // a non-finite cap never fits (NaN/Infinity compare false) — never read as $0
+  return { ok: capCents <= leftCents, leftUsd: leftCents / 100, limitUsd: limit, atLeast: spent.atLeast, heldUsd: spent.heldUsd, heldRuns: spent.heldRuns };
 }
 
 /**
- * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal).
+ * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal). When run(s) in progress hold
+ * part of the limit, the same line says how much.
  * @param {MonthlyRoom} room
  * @returns {string|null} null when the run fits
  */
 export function monthlyRefusalText(room) {
   if (room.ok || room.leftUsd === null) return null;
-  return `Max $${room.leftUsd.toFixed(2)} (monthly limit)`;
+  const max = `Max $${room.leftUsd.toFixed(2)}`;
+  if (!room.heldRuns || !room.heldUsd || room.heldUsd <= 0) return `${max} (monthly limit)`;
+  return `${max} (monthly limit, $${room.heldUsd.toFixed(2)} held by ${room.heldRuns > 1 ? 'runs' : 'a run'} in progress)`;
 }
 
 /**

package/src/panel/authorroutes.js

@@ -34,6 +34,17 @@ export function mintToken() {
   return randomBytes(24).toString('hex');
 }
 
+/**
+ * The ONE Host check: the request names this panel's own bind address. A page on another
+ * origin reaching the panel through a rebound DNS name sends that name as Host, so it fails here.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{port: number}} o
+ * @returns {{ok: true}|{ok: false, reason: string}}
+ */
+export function checkHostGuard(req, { port }) {
+  return req.headers.host === `127.0.0.1:${port}` ? { ok: true } : { ok: false, reason: 'wrong Host' };
+}
+
 /**
  * `true` when a request may reach ANY route in this file — the token header
  * plus an Origin/Host that names this exact bind address. `req.headers`
@@ -48,10 +59,9 @@ export function checkHumanGuard(req, { token, port }) {
   if (got !== token) return { ok: false, reason: 'missing or wrong token' };
   const want = `127.0.0.1:${port}`;
   const origin = req.headers.origin;
-  const host = req.headers.host;
   if (typeof origin === 'string' && origin.length > 0) {
     if (origin !== `http://${want}` && origin !== `https://${want}`) return { ok: false, reason: 'wrong Origin' };
-  } else if (host !== want) {
+  } else if (!checkHostGuard(req, { port }).ok) {
     return { ok: false, reason: 'wrong Host (and no Origin header)' };
   }
   return { ok: true };

package/src/panel/server.js

@@ -25,12 +25,12 @@
 // for every cap/threshold: a shell never widens what it was asked to do).
 
 import { createServer } from 'node:http';
-import { readFileSync, existsSync, statSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import {
   dirname, join, basename, relative, isAbsolute, sep,
 } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readRunList, DIED_MTIME_MS } from '../runlist.js';
+import { readRunList, DIED_MTIME_MS, runIsAlive } from '../runlist.js';
 import {
   replayOne, parseJsonl, resolveSiblings, isSidecarByName,
 } from '../replayio.js';
@@ -39,7 +39,7 @@ import { runBehaviour } from '../behaviour.js';
 import { SPEND_RECORD_TYPES, floorsFromRecords } from '../ledger.js';
 import { jobSpecHash } from '../job.js';
 import { confirmProtections } from '../authorflow.js';
-import { createAuthorRoutes, mintToken } from './authorroutes.js';
+import { createAuthorRoutes, mintToken, checkHostGuard } from './authorroutes.js';
 import { createSettingsRoutes } from './settingsroutes.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -137,9 +137,9 @@ export function checkTypeTitle(verdictType, atIso) {
   return null;
 }
 
-// DIED (hamr's ruling B, 2026-09-25): a run with no `job-end` is `died` [?], never [✗], once its
-// spine file's mtime is older than DIED_MTIME_MS — the constant and its full comment live in
-// src/runlist.js (the monthly limit reads the same rule); re-exported here for the panel's callers.
+// DIED (hamr's ruling B, 2026-09-25): a run with no `job-end` is `died` [?], never [✗], once nothing is
+// running it — `runIsAlive` (src/runlist.js: the row's pid first, the spine-mtime rule DIED_MTIME_MS only
+// for a row with no pid; the monthly limit reads the same rule); the constant is re-exported here for the panel's callers.
 export { DIED_MTIME_MS };
 
 /**
@@ -231,12 +231,12 @@ export function formatTimestamp(ts) {
  * fields, which assume a `job-end` exists) — the ONE owner of this
  * derivation, used by every caller below (`/api/runs`, `/api/runs/:id`) so
  * the two never drift apart.
- * @param {string} spinePath
+ * @param {import('../runlist.js').RunRow} row the run's listed row (its pid, else its spine's mtime, says whether it is still running)
  * @param {any[]} records raw parsed spine records (already read once by the caller)
  * @param {string|null} outcome `replayRun`'s own `summary.outcome`
  * @returns {{died: boolean, why: string|null, spendFloorUsd: number|null, wallFloorMs: number|null}}
  */
-function deriveDeath(spinePath, records, outcome) {
+function deriveDeath(row, records, outcome) {
   const notDied = {
     died: false, why: null, spendFloorUsd: null, wallFloorMs: null,
   };
@@ -245,9 +245,7 @@ function deriveDeath(spinePath, records, outcome) {
   // out to be a died run or one that is genuinely still running (build item
   // 6): computed here, once, before the died/still-running branch below.
   const floors = floorsFromRecords(records);
-  let mtimeMs;
-  try { mtimeMs = statSync(spinePath).mtimeMs; } catch { return { ...notDied, ...floors }; }
-  if (Date.now() - mtimeMs <= DIED_MTIME_MS) return { ...notDied, ...floors }; // still fresh — genuinely `running`, not died
+  if (runIsAlive(row)) return { ...notDied, ...floors }; // something is still running it — genuinely `running`, not died
 
   const withTs = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string');
   const last = withTs.length ? withTs[withTs.length - 1] : null;
@@ -300,7 +298,7 @@ function summarizeRow(row) {
     };
   }
   const line = summarizeForAllLine(summary);
-  const death = deriveDeath(row.spine, rawRecords, summary.outcome);
+  const death = deriveDeath(row, rawRecords, summary.outcome);
   return {
     runid: row.runid,
     job: row.job,
@@ -395,7 +393,7 @@ export function getRunDetail(runid, opts = {}) {
   const auditPath = resolveAuditPathForRow(row, rawSpineRecords);
   const summary = replayOne(row.spine, { auditPathOverride: auditPath });
   const timelineKind = summary.timelineKind;
-  const death = deriveDeath(row.spine, rawSpineRecords, summary.outcome);
+  const death = deriveDeath(row, rawSpineRecords, summary.outcome);
   // judgeModel (Summary box "judge:" line): the FIRST `judge-round`'s own
   // `model` field (src/planrun.js:1704's `onJudgeCost` emit) — a soft-green
   // close's own paid judge seam, distinct from the worker `model` above.
@@ -1746,6 +1744,13 @@ export function handleRequest(req, res, opts) {
   }
   const { pathname } = url;
 
+  // every read names the panel's own address as Host — no token needed to read, but another origin's
+  // page (a rebound DNS name) must not be able to fetch the run list
+  if ((method === 'GET' || method === 'HEAD') && !checkHostGuard(req, { port: opts.port }).ok) {
+    sendText(res, 403, 'wrong Host — this panel answers only at its own 127.0.0.1 address');
+    return;
+  }
+
   if (method !== 'GET' && method !== 'HEAD') {
     const routes = routesFor(opts, pathname);
     if (routes) {

package/src/planrun.js

@@ -1708,11 +1708,9 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         stage: c.stage, path: c.path, attempt: c.attempt, label: c.label, model: c.model,
         costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
         // BA-21 provenance, through the SAME helper the worker rounds use — this record
-        // is on `spendProvenance`'s read list (src/ledger.js), so a judge-round that
-        // never carried the field would read UNKNOWN forever inside the readout built to
-        // expose exactly this seam. NAMED, not papered over: the judge cost payload
-        // (src/kinds.js `onJudgeCost({...})`) does not carry `rateSource` today, so it
-        // still reads UNKNOWN — correctly — until that payload forwards it too.
+        // is on `spendProvenance`'s read list (src/ledger.js). The judge cost payload
+        // (src/kinds.js `onJudgeCost`) forwards the field when the judge Loop carried it
+        // (`defaultJudgeLoop`); a loop that metered no rate leaves the key absent (UNKNOWN).
         ...rateSourceFields(c),
       }),
     })

package/src/providerrows.js

@@ -236,12 +236,14 @@ function perMoney(n) {
 
 /**
  * The one readout line for a resolved customer price, preview and run tail alike:
- * `yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)`.
+ * `yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)`. A 0 / 0 price is accepted (the price
+ * is the customer's) but the line says so: every round then books $0, so spend and limits read $0.
  * @param {{ inPerM: number, outPerM: number, envName: string }} price a {@link ratesFor} result
  * @returns {string}
  */
 export function priceReadout(price) {
-  return `yours: in ${perMoney(price.inPerM)} / out ${perMoney(price.outPerM)} per 1M tokens (${price.envName} row)`;
+  const zero = price.inPerM === 0 && price.outPerM === 0 ? ' — WARNING: this price is $0, so spend and limits read $0' : '';
+  return `yours: in ${perMoney(price.inPerM)} / out ${perMoney(price.outPerM)} per 1M tokens (${price.envName} row)${zero}`;
 }
 
 /**

package/src/providers.js

@@ -2,8 +2,9 @@
 // `provider` name to the bare-agent constructor it drives, the env var
 // carrying its key, and the per-tier model table — including any
 // provider-specific request-key gating. Before this module existed, both
-// runners constructed `AnthropicProvider` BY NAME (`src/cli.js`'s
-// `buildProviders`, `scripts/run-u.mjs`'s top-level wiring) and any second
+// runners constructed `AnthropicProvider` BY NAME (the old `buildProviders` in
+// `src/cli.js` and `scripts/run-u.mjs`'s top-level wiring, both since replaced
+// by `buildRunnerProviders` below) and any second
 // provider would have meant scattering `if (provider === …)` across both.
 //
 // hamr's ruling (PRD 30.7, 2026-09-09): `deepseek-chat` is THE secondary
@@ -265,8 +266,7 @@ export function makeProvider(providerName, { apiKey, model, baseUrl } = {}) {
 
 /**
  * Build the `{provider, providerFor, judgeProvider}` triple both runners
- * need (`src/cli.js`'s `buildProviders`, `scripts/run-u.mjs`'s top-level
- * wiring) — ONE seam instead of two copies of the same construction and
+ * need (`src/authorrun.js` and `src/panel/authorsession.js` call it) — ONE seam instead of two copies of the same construction and
  * tier-memoization logic. `model`/`tierModels` are already-RESOLVED inputs
  * (the caller runs `resolveWorkerModel` itself, exactly as both runners did
  * before this factory existed — that decision stays where each runner's own

package/src/runlist.js

@@ -213,6 +213,21 @@ function runidForSpine(spinePath) {
 // the panel) because the monthly limit reads the same rule (src/monthly.js).
 export const DIED_MTIME_MS = 10 * 60 * 1000;
 
+/**
+ * The ONE "is this run alive" rule, for the panel's glyph ([▶] vs [?]) and the monthly limit's hold. A
+ * row that carries its runner's `pid` is alive exactly while that pid is a live bareloop runner
+ * ({@link isLiveRunner}) however quiet its spine; only a row with NO pid (an older row) falls back to
+ * the spine-mtime rule above. A run that has ENDED (a `job-end` on its spine) is a different fact the
+ * callers read off the spine itself — this answers "is a process still running it", nothing more.
+ * @param {{ pid?: number, spine: string }} row
+ * @param {number} [nowMs] the clock for the mtime fallback
+ * @returns {boolean}
+ */
+export function runIsAlive(row, nowMs = Date.now()) {
+  if (Number.isInteger(row.pid)) return isLiveRunner(/** @type {number} */ (row.pid));
+  try { return nowMs - statSync(row.spine).mtimeMs <= DIED_MTIME_MS; } catch { return false; }
+}
+
 // A backfill scan of a real patients directory can be arbitrarily deep
 // (person-path runs archive several levels down: `<dir>/<proj>/out/
 // source-<x>/<proj>-bareloop/u-<id>.jsonl`, 4 levels under the dir a person

package/src/userrun.js

@@ -72,7 +72,7 @@ import { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
 // the cold reset, shared with the battery drivers so "cold" has one spelling
 import { coldReset, moveStaleGateAudit } from './u-patient.js';
 // PANEL-BUILD.md P1 — the one run list (`~/.config/bareloop/runs.jsonl`).
-import { appendRun, appendRunEvent, isLiveRunner } from './runlist.js';
+import { appendRun, appendRunEvent, isLiveRunner, readRunList } from './runlist.js';
 import { keysForDoor } from './keysfile.js';
 import { parseJsonl } from './replayio.js';
 import { claimRun, monthlyRefusalText, legSpend } from './monthly.js';
@@ -362,6 +362,13 @@ async function execute(ctx) {
   // Set on the no-limit path too, once the row is appended there (the same "listed, no spine yet" state).
   /** @type {{ runid: string, spine: string, home: string|undefined }|null} */
   let claimedRow = null;
+  // Release the claimed row (a `released` entry folds it out of the list, like a monthly refusal): the run
+  // spent nothing and must not stay a ghost that keeps the month reading "at least". A failed release write
+  // never masks the original exit.
+  const releaseClaimedRow = () => {
+    if (!claimedRow) return;
+    try { appendRunEvent({ runid: claimedRow.runid, type: 'released', by: claimedRow.runid, reason: 'not started', at: new Date().toISOString() }, { home: claimedRow.home }); } catch { /* the exit stands; a stranded row of a dead process is closed by the next run */ }
+  };
   try {
   const spec = ctx.spec;
   const specPath = ctx.specPath;
@@ -684,7 +691,7 @@ async function execute(ctx) {
     });
     // is the dead run actually dead? Two processes on one patient is unrecoverable; a
     // false refusal costs one sentence. run-u's own pid is not on its spine, so the
-    // watchdog's report is the pid there is — and its absence is not evidence of life.
+    // watchdog's report or the run-list row is the pid there is — and its absence is not evidence of life.
     const wdFile = `${deadSpineFile}.watchdog.json`;
     /** @type {any} */
     let watchdog = null;
@@ -692,8 +699,14 @@ async function execute(ctx) {
     // ONE owner of "is that pid a live bareloop runner" (src/runlist.js `isLiveRunner`, shared with the
     // monthly limit's holds): alive AND a bareloop runner refuses; a recycled pid that now runs some
     // other program does not. Where /proc is unreadable an existing pid is assumed to be ours.
-    if (Number.isInteger(watchdog?.pid) && isLiveRunner(watchdog.pid)) {
-      die(`--resume: pid ${watchdog.pid} from ${deadSpineFile} is still alive (a bareloop runner). Two processes on one patient is unrecoverable — stop it first.`);
+    // The pid is the watchdog's kill record's, or the predecessor's OWN run-list row's (every row carries
+    // its runner's pid): a run never killed by the watchdog has no record but still has its row.
+    /** @type {number|undefined} */
+    let rowPid;
+    if (cfgOn) { try { rowPid = readRunList({ home: cfgHome }).rows.findLast((r) => r.spine === deadSpineFile)?.pid; } catch { /* an unreadable list is not evidence of life */ } }
+    const alivePid = [watchdog?.pid, rowPid].find((p) => Number.isInteger(p) && isLiveRunner(p));
+    if (alivePid !== undefined) {
+      die(`--resume: pid ${alivePid} from ${deadSpineFile} is still alive (a bareloop runner). Two processes on one patient is unrecoverable — stop it first.`);
     }
     // WHEN did the dead leg stop? The watchdog's kill record is later, better evidence
     // than the last spine event for a run that was KILLED — and worse evidence for one
@@ -1704,6 +1717,7 @@ async function execute(ctx) {
     emit('destination-refused', { code: sourceManifest.code, detail: sourceManifest.stop });
     emit('run-end', { outcome: 'escalated' });
     err(`SOURCE-MANIFEST-RED — ${sourceManifest.stop}. See ${spineFile}`);
+    releaseClaimedRow(); // a $0 refusal after the spine exists: no ghost row, no "at least" month
     throw new ExitSignal(1);
   }
   /** the front door's per-run instance, or null when there is none (no
@@ -1722,6 +1736,7 @@ async function execute(ctx) {
       emit('destination-refused', { code: dp.code, detail: dp.stop });
       emit('run-end', { outcome: 'escalated' });
       err(`DESTINATION-RED — ${dp.stop}. See ${spineFile}`);
+      releaseClaimedRow(); // a $0 refusal after the spine exists: no ghost row, no "at least" month
       throw new ExitSignal(1);
     }
   }
@@ -1740,6 +1755,7 @@ async function execute(ctx) {
     });
     emit('run-end', { outcome: 'escalated' });
     err(`CLOSE-TIMING-RED — stage(s) never finished the timing preflight: ${names}. See ${spineFile}`);
+    releaseClaimedRow(); // a $0 refusal after the spine exists: no ghost row, no "at least" month
     throw new ExitSignal(1);
   }
   const RESOLVED_CLOSE_TIMEOUT_MS = /** @type {number} */ (closeTimingResolved.closeTimeoutMs);
@@ -1991,10 +2007,16 @@ async function execute(ctx) {
         : mh.trend === 'flat' ? 'more money is unlikely to help; this bundle\'s goal is signed and cannot be revised here'
           : 'read the last close output before deciding whether more money is worth it';
       out(`  lever   ${lever}`);
-      out(`          · choose a larger --budget on the resume line below (the room left is the signed $${signed}; it cannot be raised past that)`);
-      out('          · abandon the task');
-      out(`  resume  ${ctx.bundle.invoke}${WALL_FLAG} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${REGISTRY_TAIL} --budget <more than ${spentTxt}, at most $${signed}> --approve ${PRINT_APPROVE}`);
-      out('          (type the --budget number yourself — nothing here fills it in, so this line does not run as printed; nothing in the run may widen its own budget)');
+      if (spentUsd !== null && spentUsd >= signed) {
+        // the whole signed ceiling is spent: "more than spent, at most signed" is unsatisfiable, so no resume line is printed
+        out(`          · no room left under the signed ceiling: this run spent all of the signed $${signed}, and a bundle's ceiling cannot be raised`);
+        out('          · abandon the task');
+      } else {
+        out(`          · choose a larger --budget on the resume line below (the room left is the signed $${signed}; it cannot be raised past that)`);
+        out('          · abandon the task');
+        out(`  resume  ${ctx.bundle.invoke}${WALL_FLAG} --resume ${runid}${SHIM_TAIL}${SCOUT_TAIL}${DRAFT_TAIL}${REGISTRY_TAIL} --budget <more than ${spentTxt}, at most $${signed}> --approve ${PRINT_APPROVE}`);
+        out('          (type the --budget number yourself — nothing here fills it in, so this line does not run as printed; nothing in the run may widen its own budget)');
+      }
     } else {
       out(`  lever   ${mh.lever}`);
       for (const o of mh.options ?? []) out(`          · ${o}`);
@@ -2270,9 +2292,7 @@ async function execute(ctx) {
     // owns no spine, so its row is released (folded out of the list, like a monthly refusal) rather than
     // left as a ghost that keeps the month reading "at least". Once the spine exists the run is a real,
     // listed run and ends by its own job-end. A failed release write never masks the original exit.
-    if (claimedRow && !existsSync(claimedRow.spine)) {
-      try { appendRunEvent({ runid: claimedRow.runid, type: 'released', by: claimedRow.runid, reason: 'not started', at: new Date().toISOString() }, { home: claimedRow.home }); } catch { /* the exit stands; a stranded row of a dead process is closed by the next run */ }
-    }
+    if (claimedRow && !existsSync(claimedRow.spine)) releaseClaimedRow();
     if (e instanceof ExitSignal) return e.code;
     throw e;
   }

package/types/judged.d.ts

@@ -229,7 +229,7 @@ export function locatePrompt(card: any): string;
  * On every route out, red or clean, `onCost` fires exactly once with the honest
  * read: a paid call that leaves no meter record is F12 wearing a judge's coat.
  * @param {{artifactText: string, card: any, loopFactory: (o: {provider?: any, system: string}) => any,
- *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number}) => void,
+ *   maxTokens?: number, attempt?: number, onCost?: (c: {costUsd: number|null, unpricedRounds: number, rateSource?: string|null}) => void,
  *   callBounds?: {timeoutMs?: number, deadlineMs?: number}}} o
  * @returns {Promise<{ok: boolean, facts: any|null, red: {axis: string, detail: string}|null,
  *   costUsd: number|null, unpricedRounds: number, truncated: boolean, parseError: boolean,
@@ -247,6 +247,7 @@ export function runLocate({ artifactText, card, loopFactory, maxTokens, attempt,
     onCost?: (c: {
         costUsd: number | null;
         unpricedRounds: number;
+        rateSource?: string | null;
     }) => void;
     callBounds?: {
         timeoutMs?: number;
@@ -389,7 +390,9 @@ export function defaultJudgeLoop({ provider, system, rates }: {
         in: number;
         out: number;
     } | null;
-}): import("bare-agent").Loop;
+}): {
+    run: (msgs: any[], tools: any[], opts?: any) => Promise<any>;
+};
 export type RuleRed = {
     fn: string;
     why: string;

package/types/monthly.d.ts

@@ -29,17 +29,18 @@ export function legTokens(records: any[]): number;
 /**
  * Every listed run as one {@link Leg}. The ONE reader the month total, the all-time total
  * and the per-provider figures share.
- * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below)
+ * @param {{ home?: string, now?: () => number, aboveRunid?: string, thisMonthOnly?: boolean }} [opts] `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below); `thisMonthOnly` = do not parse the spine of a run listed in another local month (the refusal check drops it anyway) unless its claim is still held
  * @returns {Leg[]}
  */
 export function readLegs(opts?: {
     home?: string;
     now?: () => number;
     aboveRunid?: string;
+    thisMonthOnly?: boolean;
 }): Leg[];
 /**
  * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `aboveRunid`: see {@link readLegs}
- * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's)
+ * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number, heldUsd: number, heldRuns: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's); `heldUsd` = what in-progress runs set aside beyond what they have spent (`reservedUsd - usd`), over `heldRuns` runs
  */
 export function monthSpend(opts?: {
     home?: string;
@@ -50,6 +51,8 @@ export function monthSpend(opts?: {
     atLeast: boolean;
     runs: number;
     reservedUsd: number;
+    heldUsd: number;
+    heldRuns: number;
 };
 /**
  * The Money tab's figures: all-time and this-month spend, and per-provider breakdown
@@ -97,6 +100,8 @@ export function spendSummary(opts?: {
  * @property {number|null} leftUsd what is left this month (null = no limit set)
  * @property {number|null} limitUsd the person's monthly limit (null = none)
  * @property {boolean} atLeast the month's spend is a floor, so `leftUsd` is a ceiling
+ * @property {number} [heldUsd] what run(s) in progress have set aside beyond their spend so far (present when a limit is set)
+ * @property {number} [heldRuns] how many runs hold it
  */
 /**
  * The person's monthly limit off a parsed config.json: key absent (or null) = no limit (null);
@@ -122,7 +127,8 @@ export function checkMonthlyRoom({ capUsd, home, now, aboveRunid }: {
     aboveRunid?: string;
 }): MonthlyRoom;
 /**
- * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal).
+ * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal). When run(s) in progress hold
+ * part of the limit, the same line says how much.
  * @param {MonthlyRoom} room
  * @returns {string|null} null when the run fits
  */
@@ -160,7 +166,6 @@ export function claimRun({ row, capUsd, home, now }: {
     room: MonthlyRoom;
     claimed: boolean;
 };
-export { isLiveRunner };
 export type Leg = {
     /**
      * when the run was listed
@@ -223,5 +228,12 @@ export type MonthlyRoom = {
      * the month's spend is a floor, so `leftUsd` is a ceiling
      */
     atLeast: boolean;
+    /**
+     * what run(s) in progress have set aside beyond their spend so far (present when a limit is set)
+     */
+    heldUsd?: number | undefined;
+    /**
+     * how many runs hold it
+     */
+    heldRuns?: number | undefined;
 };
-import { isLiveRunner } from './runlist.js';

package/types/panel/authorroutes.d.ts

@@ -1,5 +1,20 @@
 /** @returns {string} a fresh per-process token — never persisted, never logged */
 export function mintToken(): string;
+/**
+ * The ONE Host check: the request names this panel's own bind address. A page on another
+ * origin reaching the panel through a rebound DNS name sends that name as Host, so it fails here.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{port: number}} o
+ * @returns {{ok: true}|{ok: false, reason: string}}
+ */
+export function checkHostGuard(req: import("node:http").IncomingMessage, { port }: {
+    port: number;
+}): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
 /**
  * `true` when a request may reach ANY route in this file — the token header
  * plus an Origin/Host that names this exact bind address. `req.headers`

package/types/providerrows.d.ts

@@ -127,7 +127,8 @@ export function keyNameFor(provider: string | null | undefined, baseUrl: string
 export function applyConfiguredKey(env: Record<string, string | undefined>, provider: string | null | undefined, baseUrl: string | null | undefined, rows: readonly KeyRow[], model?: string | null | undefined): Record<string, string | undefined>;
 /**
  * The one readout line for a resolved customer price, preview and run tail alike:
- * `yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)`.
+ * `yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)`. A 0 / 0 price is accepted (the price
+ * is the customer's) but the line says so: every round then books $0, so spend and limits read $0.
  * @param {{ inPerM: number, outPerM: number, envName: string }} price a {@link ratesFor} result
  * @returns {string}
  */

package/types/providers.d.ts

@@ -52,8 +52,7 @@ export function makeProvider(providerName: string, { apiKey, model, baseUrl }?:
 }): any;
 /**
  * Build the `{provider, providerFor, judgeProvider}` triple both runners
- * need (`src/cli.js`'s `buildProviders`, `scripts/run-u.mjs`'s top-level
- * wiring) — ONE seam instead of two copies of the same construction and
+ * need (`src/authorrun.js` and `src/panel/authorsession.js` call it) — ONE seam instead of two copies of the same construction and
  * tier-memoization logic. `model`/`tierModels` are already-RESOLVED inputs
  * (the caller runs `resolveWorkerModel` itself, exactly as both runners did
  * before this factory existed — that decision stays where each runner's own

package/types/runlist.d.ts

@@ -95,6 +95,20 @@ export function readRunList(opts?: {
  * @returns {boolean}
  */
 export function isLiveRunner(pid: number): boolean;
+/**
+ * The ONE "is this run alive" rule, for the panel's glyph ([▶] vs [?]) and the monthly limit's hold. A
+ * row that carries its runner's `pid` is alive exactly while that pid is a live bareloop runner
+ * ({@link isLiveRunner}) however quiet its spine; only a row with NO pid (an older row) falls back to
+ * the spine-mtime rule above. A run that has ENDED (a `job-end` on its spine) is a different fact the
+ * callers read off the spine itself — this answers "is a process still running it", nothing more.
+ * @param {{ pid?: number, spine: string }} row
+ * @param {number} [nowMs] the clock for the mtime fallback
+ * @returns {boolean}
+ */
+export function runIsAlive(row: {
+    pid?: number;
+    spine: string;
+}, nowMs?: number): boolean;
 /**
  * `bareloop runs backfill <dir>` — recursively scan `dir` (bounded to
  * {@link MAX_BACKFILL_DEPTH} levels, never into `node_modules`/`.git`,