bareloop 0.33.0 → 0.35.0

package/src/monthly.js

@@ -14,19 +14,24 @@
 // run is counted at max(spend so far, capUsd) however quiet its spine; a run with a `job-end` counts
 // its real spend; a claim whose process is gone counts its floor and is settled — with an attributed
 // `settled` entry — by whichever later run finds it (the first note wins). An older row with no `pid` keeps the spine
-// mtime rule (a fresh spine, written to within DIED_MTIME_MS, is in flight). Only the refusal check
+// mtime rule (a fresh spine, written to within DIED_MTIME_MS, is in flight) — `runIsAlive`, src/runlist.js, the
+// one "is this run alive" rule the panel's glyph shares. Only the refusal check
 // reserves; the Money tab keeps showing real spend (`usd`).
 //
 // Honesty: a run whose spend is not fully known (a died/still-running spine, an unpriced
 // round, a missing spine file) makes the month total an "at least" figure — never a clean
-// number. The refusal text stays exactly `Max $X (monthly limit)`; `atLeast` travels beside it.
-import { existsSync, statSync } from 'node:fs';
+// number. The refusal text leads with `Max $X (monthly limit`; when runs hold money it adds
+// `, $Y held by a run in progress` before the closing paren (`monthlyRefusalText`). `atLeast` travels beside it.
+import { existsSync } from 'node:fs';
 import { readConfig, configPath, ConfigError } from './config.js';
-import { readRunList, appendRun, appendRunEvent, isLiveRunner, DIED_MTIME_MS } from './runlist.js';
-export { isLiveRunner };
+import { readRunList, appendRun, appendLegStart, appendRunEvent, isLiveRunner, runIsAlive, isSettled } from './runlist.js';
+import { legsOf } from './legs.js';
 import { parseJsonl } from './replayio.js';
-import { SPEND_RECORD_TYPES, spendProvenance, floorsFromRecords } from './ledger.js';
+import { SPEND_RECORD_TYPES, spendProvenance, floorsFromRecords, legSpend, runSpend, chainSpend } from './ledger.js';
 import { findRow } from './providerrows.js';
+import { readOrphanDraftSpends } from './draftspend.js';
+// the per-leg / per-run spend readers live with the ledger (one home, no import cycle through the replay reader)
+export { legSpend, runSpend, chainSpend };
 
 // The Money tab's per-provider breakdown groups a run by the endpoint it ran on and names
 // the groups it knows the vendor of. This is HISTORY labelling for spend already recorded
@@ -61,41 +66,35 @@ function rowIdFor(provider, baseUrl) {
 }
 
 /**
- * One run's own spend, off its spine records: this LEG's figure (never the chain fold),
- * plus the drafting spend the run was signed with (counted once — on the first leg only).
- * @param {any[]} records
- * @returns {{ usd: number, complete: boolean }}
+ * One run's wall time off its spine: job-start -> job-end when the run ended (exact), else the
+ * first -> last record floor (the SAME floor a died / still-running run's "at least" wall uses,
+ * `floorsFromRecords`). `ms` null = unknown — never 0.
+ * @param {any[]} records one spine's records (one leg or several)
+ * @returns {{ ms: number|null, complete: boolean }}
  */
-export function legSpend(records) {
-  const jobStart = records.find((r) => r && r.type === 'job-start') ?? null;
-  const jobEnd = records.findLast((r) => r && r.type === 'job-end') ?? null;
-  const rounds = records.filter((r) => r && SPEND_RECORD_TYPES.includes(r.type));
-  const pricedSum = rounds.reduce((a, r) => (typeof r.costUsd === 'number' && Number.isFinite(r.costUsd) ? a + r.costUsd : a), 0);
-  const unpriced = rounds.filter((r) => !(typeof r.costUsd === 'number' && Number.isFinite(r.costUsd))).length;
-  let usd = pricedSum;
-  let complete = false;
-  if (jobEnd) {
-    const eng = jobEnd.engagementSpentUsd;
-    usd = typeof eng === 'number' && Number.isFinite(eng) ? eng : pricedSum;
-    complete = jobEnd.spendComplete === true && unpriced === 0;
-  }
-  // drafting spend: a RESUMED / door-rerun leg carries the flag again but the first leg already counted it
-  const resumed = !!jobStart && 'priorSpentUsd' in jobStart;
-  if (jobStart && !resumed && typeof jobStart.draftSpentUsd === 'number' && Number.isFinite(jobStart.draftSpentUsd) && jobStart.draftSpentUsd > 0) {
-    usd += jobStart.draftSpentUsd;
-    if (jobStart.draftSpendComplete === false) complete = false;
+export function legWall(records) {
+  const legs = legsOf(records);
+  if (legs.length > 1) {
+    // P5-R: the sum of each leg's own working window, the gap between legs excluded (hamr 2026-10-02, 2A)
+    let ms = 0;
+    let complete = true;
+    for (const l of legs) {
+      const w = legWallOne(l.records);
+      if (w.ms === null) { complete = false; continue; }
+      ms += w.ms;
+      if (!w.complete) complete = false;
+    }
+    return { ms: legs.every((l) => legWallOne(l.records).ms === null) ? null : ms, complete };
   }
-  return { usd, complete };
+  return legWallOne(records);
 }
 
 /**
- * One run's wall time off its spine: job-start -> job-end when the run ended (exact), else the
- * first -> last record floor (the SAME floor a died / still-running run's "at least" wall uses,
- * `floorsFromRecords`). `ms` null = unknown — never 0.
+ * One LEG's wall (the single-leg rule {@link legWall} sums).
  * @param {any[]} records
  * @returns {{ ms: number|null, complete: boolean }}
  */
-export function legWall(records) {
+function legWallOne(records) {
   const jobStart = records.find((r) => r && r.type === 'job-start') ?? null;
   const jobEnd = records.findLast((r) => r && r.type === 'job-end') ?? null;
   const a = Date.parse(jobStart?.ts);
@@ -137,27 +136,26 @@ export function legTokens(records) {
  * @property {number} otherRounds every other round: a built-in guess, unpriced, or no provenance on record
  * @property {number} reservedUsd what the refusal check counts: `usd`, or the leg's cap when the run is in flight
  * @property {boolean} unreadable the spine was missing/unreadable or the listed date was bad (spend unknown)
+ * @property {boolean} [draft] drafting spend of a panel session that never became a run (src/draftspend.js) — not a run: no wall, not counted in `runs`
  */
 
 /**
  * What the refusal check counts for one run: its spend, unless it is IN FLIGHT (`job-start`, no
- * `job-end`, spine written to within DIED_MTIME_MS of `nowMs`), when it is the larger of that
+ * `job-end`, `runIsAlive` for a row with no pid — the pid-bearing rows are held by `readLegs`), when it is the larger of that
  * spend and the leg's own cap — the signed `budgetUsd` on the spine's `job-start` less the fold
  * a resumed leg inherited (`priorSpentUsd`), the same figure the run-start seam computes
  * (`legCapUsd`, src/userrun.js). A spine that records no `budgetUsd` reserves nothing extra.
- * @param {any[]} records
- * @param {string} spinePath
+ * @param {any[]} records the LATEST leg's records
+ * @param {import('./runlist.js').RunRow} row
  * @param {number} nowMs
  * @param {number} usd the leg's spend so far
  * @returns {number}
  */
-function inFlightCapUsd(records, spinePath, nowMs, usd) {
+function inFlightCapUsd(records, row, nowMs, usd) {
   if (records.some((r) => r && r.type === 'job-end')) return usd;
   const start = records.find((r) => r && r.type === 'job-start') ?? null;
   if (!start || !(typeof start.budgetUsd === 'number' && Number.isFinite(start.budgetUsd))) return usd;
-  let mtimeMs;
-  try { mtimeMs = statSync(spinePath).mtimeMs; } catch { return usd; }
-  if (nowMs - mtimeMs > DIED_MTIME_MS) return usd; // stale — died, counts its floor
+  if (!runIsAlive(row, nowMs)) return usd; // stale — died, counts its floor
   const fold = typeof start.priorSpentUsd === 'number' && Number.isFinite(start.priorSpentUsd) ? start.priorSpentUsd : 0;
   return Math.max(usd, Math.max(0, start.budgetUsd - fold));
 }
@@ -172,20 +170,22 @@ function inFlightCapUsd(records, spinePath, nowMs, usd) {
 function rowsAbove(rows, runid) {
   if (runid === undefined) return rows;
   const i = rows.findIndex((r) => r.runid === runid);
-  return i < 0 ? rows : rows.slice(0, i);
+  if (i < 0) return rows;
+  // a RESUMED run's earlier legs are already spent money in this month: its own row stays in (its spend
+  // counts, its claim does not — `readLegs`' `ownClaim`). A first-leg claim has no earlier legs to count.
+  return rows[i].leg !== undefined && rows[i].leg > 1 ? rows.slice(0, i + 1) : rows.slice(0, i);
 }
 
 /**
  * Every listed run as one {@link Leg}. The ONE reader the month total, the all-time total
  * and the per-provider figures share.
- * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below)
+ * @param {{ home?: string, sessionsRoot?: string, now?: () => number, aboveRunid?: string, thisMonthOnly?: boolean }} [opts] `sessionsRoot` = where the panel's sessions live (default `<home>/panel-sessions`); `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below); `thisMonthOnly` = do not parse the spine of a run listed in another local month (the refusal check drops it anyway) unless its claim is still held
  * @returns {Leg[]}
  */
 export function readLegs(opts = {}) {
   const nowMs = (opts.now ?? Date.now)();
   const { rows: allRows, events } = readRunList({ home: opts.home });
   const rows = rowsAbove(allRows, opts.aboveRunid);
-  const settled = new Set(events.filter((e) => e.type === 'settled').map((e) => e.runid));
   /** @type {Leg[]} */
   const legs = [];
   for (const row of rows) {
@@ -195,30 +195,60 @@ export function readLegs(opts = {}) {
     // pid is a live bareloop runner, however quiet its spine — killed = process gone, not silence.
     // An older row with no `pid` keeps the spine-mtime rule (`inFlightCapUsd`), never guessed alive.
     const hasPid = Number.isInteger(row.pid);
-    const heldCap = hasPid && !settled.has(row.runid) && typeof row.capUsd === 'number' && Number.isFinite(row.capUsd) && isLiveRunner(/** @type {number} */ (row.pid)) ? row.capUsd : null;
+    // a resume's OWN claim never holds against itself: its earlier legs' spend counts, its cap is what is being checked
+    const ownClaim = opts.aboveRunid !== undefined && row.runid === opts.aboveRunid;
+    const heldCap = !ownClaim && hasPid && !isSettled(events, row) && typeof row.capUsd === 'number' && Number.isFinite(row.capUsd) && runIsAlive(row, nowMs) ? row.capUsd : null;
+    // a RESUMED run (`row.leg`) may hold a leg of this month under a start date of another: read its spine
+    if (opts.thisMonthOnly && heldCap === null && row.leg === undefined && !Number.isNaN(at.getTime()) && !sameLocalMonth(at, new Date(nowMs))) continue;
     if (Number.isNaN(at.getTime()) || !existsSync(row.spine)) { legs.push({ ...base, reservedUsd: heldCap ?? 0 }); continue; }
     /** @type {any[]} */
     let records;
     try { records = parseJsonl(row.spine).records; } catch { legs.push({ ...base, reservedUsd: heldCap ?? 0 }); continue; }
-    const start = records.find((r) => r && r.type === 'job-start') ?? null;
-    const leg = legSpend(records);
-    const prov = spendProvenance(records);
-    const wall = legWall(records);
+    // P5-R: a resumed run is ONE spine of several legs and ONE listed row. The month and the Money tab still
+    // count each leg on its own date with its own spend (the figures they always read), so a leg resumed in a
+    // later month is that month's, never silently folded back into the month the run began in. The claim (the
+    // hold) belongs to the LATEST leg only.
+    const found = legsOf(records);
+    const spineLegs = found.length > 0 ? found : [{ leg: 1, records, start: null, jobStart: null }];
+    const lastLegNo = spineLegs.length;
+    const first = records.find((r) => r && r.type === 'job-start') ?? null;
+    for (const sl of spineLegs) {
+      const lstart = sl.jobStart ?? first;
+      const leg = legSpend(sl.records);
+      const prov = spendProvenance(sl.records);
+      const wall = legWall(sl.records);
+      const isLast = sl.leg === lastLegNo;
+      const legAt = sl.leg === 1 ? at : new Date(sl.start?.ts ?? sl.start?.at ?? row.at);
+      const ended = sl.records.some((r) => r && r.type === 'job-end');
+      legs.push({
+        at: Number.isNaN(legAt.getTime()) ? at : legAt,
+        model: typeof lstart?.model === 'string' ? lstart.model : null,
+        wallMs: wall.ms,
+        wallComplete: wall.complete,
+        provider: typeof lstart?.provider === 'string' ? lstart.provider : null,
+        baseUrl: typeof lstart?.baseUrl === 'string' ? lstart.baseUrl : null,
+        usd: leg.usd,
+        complete: leg.complete,
+        tokens: legTokens(sl.records),
+        vouchedRounds: prov.vouched.rounds,
+        otherRounds: prov.guessed.rounds + prov.unpriced.rounds + prov.unknown.rounds,
+        reservedUsd: !isLast || ownClaim ? leg.usd
+          : hasPid ? (ended || heldCap === null ? leg.usd : Math.max(leg.usd, heldCap))
+            : inFlightCapUsd(sl.records, row, nowMs, leg.usd),
+        unreadable: false,
+      });
+    }
+    // a leg that CLAIMED (its `leg-start` is on the list) but has not yet written its marker: its claim still
+    // holds, exactly as a first leg's row does before its spine exists
+    if (row.leg !== undefined && row.leg > lastLegNo && heldCap !== null) legs.push({ ...base, reservedUsd: heldCap });
+  }
+  // drafting spend of panel sessions that never became a run (abandoned / refused / panel restarted): money
+  // already spent, counted by the SAME readers as a run's leg (src/draftspend.js — a signed run carries its own)
+  for (const d of readOrphanDraftSpends({ home: opts.home, sessionsRoot: opts.sessionsRoot })) {
     legs.push({
-      at,
-      model: typeof start?.model === 'string' ? start.model : null,
-      wallMs: wall.ms,
-      wallComplete: wall.complete,
-      provider: typeof start?.provider === 'string' ? start.provider : null,
-      baseUrl: typeof start?.baseUrl === 'string' ? start.baseUrl : null,
-      usd: leg.usd,
-      complete: leg.complete,
-      tokens: legTokens(records),
-      vouchedRounds: prov.vouched.rounds,
-      otherRounds: prov.guessed.rounds + prov.unpriced.rounds + prov.unknown.rounds,
-      reservedUsd: hasPid ? (records.some((r) => r && r.type === 'job-end') || heldCap === null ? leg.usd : Math.max(leg.usd, heldCap))
-        : inFlightCapUsd(records, row.spine, nowMs, leg.usd),
-      unreadable: false,
+      at: new Date(d.startedAt), provider: d.provider, baseUrl: d.baseUrl, model: d.model, wallMs: null, wallComplete: false,
+      usd: d.spentUsd, complete: d.spendComplete, tokens: 0, vouchedRounds: 0, otherRounds: 0, reservedUsd: d.spentUsd,
+      unreadable: false, draft: true,
     });
   }
   return legs;
@@ -232,8 +262,8 @@ export function readLegs(opts = {}) {
 const sameLocalMonth = (at, now) => at.getFullYear() === now.getFullYear() && at.getMonth() === now.getMonth();
 
 /**
- * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `aboveRunid`: see {@link readLegs}
- * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's)
+ * @param {{ home?: string, sessionsRoot?: string, now?: () => number, aboveRunid?: string }} [opts] `aboveRunid`, `sessionsRoot`: see {@link readLegs}
+ * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number, heldUsd: number, heldRuns: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's); `heldUsd` = what in-progress runs set aside beyond what they have spent (`reservedUsd - usd`), over `heldRuns` runs
  */
 export function monthSpend(opts = {}) {
   const nowDate = new Date((opts.now ?? Date.now)());
@@ -241,17 +271,20 @@ export function monthSpend(opts = {}) {
   let reservedUsd = 0;
   let atLeast = false;
   let runs = 0;
-  for (const leg of readLegs({ home: opts.home, now: opts.now, aboveRunid: opts.aboveRunid })) {
+  let heldUsd = 0;
+  let heldRuns = 0;
+  for (const leg of readLegs({ home: opts.home, sessionsRoot: opts.sessionsRoot, now: opts.now, aboveRunid: opts.aboveRunid, thisMonthOnly: true })) {
     // an unreadable date could belong to this month — unknown, never dropped
     if (Number.isNaN(leg.at.getTime())) { atLeast = true; continue; }
     if (!sameLocalMonth(leg.at, nowDate)) continue;
-    runs += 1;
-    if (leg.unreadable) { atLeast = true; reservedUsd += leg.reservedUsd; continue; }
+    if (!leg.draft) runs += 1;
+    if (leg.unreadable) { atLeast = true; reservedUsd += leg.reservedUsd; if (leg.reservedUsd > 0) { heldUsd += leg.reservedUsd; heldRuns += 1; } continue; }
     usd += leg.usd;
     reservedUsd += leg.reservedUsd;
+    if (leg.reservedUsd > leg.usd) { heldUsd += leg.reservedUsd - leg.usd; heldRuns += 1; }
     if (!leg.complete) atLeast = true;
   }
-  return { usd, atLeast, runs, reservedUsd };
+  return { usd, atLeast, runs, reservedUsd, heldUsd, heldRuns };
 }
 
 /**
@@ -259,7 +292,7 @@ export function monthSpend(opts = {}) {
  * (rows from `rowIdFor`; a run on no known row lands under its own provider name, never
  * pooled into another row). Any leg with unknown spend makes the figure it belongs to
  * an "at least".
- * @param {{ home?: string, now?: () => number, rows?: readonly import('./providerrows.js').KeyRow[] }} [opts] `rows` = the Providers rows: when given, `tokensByRow` sums each row's tokens
+ * @param {{ home?: string, sessionsRoot?: string, now?: () => number, rows?: readonly import('./providerrows.js').KeyRow[] }} [opts] `rows` = the Providers rows: when given, `tokensByRow` sums each row's tokens
  * @returns {{ tokensByRow: Record<string, number>, total: {usd: number, atLeast: boolean, tokens: number}, month: {usd: number, atLeast: boolean, tokens: number},
  *   byProvider: Record<string, {label: string, monthUsd: number, monthAtLeast: boolean, totalUsd: number, totalAtLeast: boolean, tokens: number, vouchedRounds: number, otherRounds: number, monthWallMs: number|null, monthWallAtLeast: boolean, totalWallMs: number|null, totalWallAtLeast: boolean}> }}
  */
@@ -274,7 +307,7 @@ export function spendSummary(opts = {}) {
   const wallSeen = {};
   /** total tokens of the runs each Providers row served (matched by shape + endpoint + model) @type {Record<string, number>} */
   const tokensByRow = {};
-  for (const leg of readLegs({ home: opts.home })) {
+  for (const leg of readLegs({ home: opts.home, sessionsRoot: opts.sessionsRoot })) {
     let served = opts.rows ? findRow(opts.rows, { provider: leg.provider, baseUrl: leg.baseUrl, model: leg.model }) : null;
     // an older spine records a model but no provider: it counts toward the row whose Name EXACTLY
     // equals that model. Two rows sharing the Name make it ambiguous, so it counts toward neither.
@@ -293,9 +326,11 @@ export function spendSummary(opts = {}) {
       : (notRecorded ? (leg.model ? `not recorded (model ${leg.model})` : 'not recorded') : key.slice('other:'.length));
     const p = (byProvider[key] ??= { label, monthUsd: 0, monthAtLeast: false, totalUsd: 0, totalAtLeast: false, tokens: 0, vouchedRounds: 0, otherRounds: 0, monthWallMs: 0, monthWallAtLeast: false, totalWallMs: 0, totalWallAtLeast: false });
     const w = (wallSeen[key] ??= { monthRuns: 0, monthKnown: 0, totalKnown: 0 });
+    // drafting spend has no wall (it is not a run): it never turns a provider's wall into an "at least" or an unknown
+    const noWall = leg.draft === true;
     const unknown = leg.unreadable || !leg.complete;
     const wallKnown = !leg.unreadable && leg.wallMs !== null;
-    const wallAtLeast = !wallKnown || !leg.wallComplete;
+    const wallAtLeast = !noWall && (!wallKnown || !leg.wallComplete);
     total.usd += leg.usd; total.tokens += leg.tokens; if (unknown) total.atLeast = true;
     p.totalUsd += leg.usd; p.tokens += leg.tokens; p.vouchedRounds += leg.vouchedRounds; p.otherRounds += leg.otherRounds; if (unknown) p.totalAtLeast = true;
     if (wallKnown) { p.totalWallMs = /** @type {number} */ (p.totalWallMs) + /** @type {number} */ (leg.wallMs); w.totalKnown += 1; }
@@ -303,7 +338,7 @@ export function spendSummary(opts = {}) {
     if (inMonth) {
       month.usd += leg.usd; month.tokens += leg.tokens; if (unknown) month.atLeast = true;
       p.monthUsd += leg.usd; if (unknown) p.monthAtLeast = true;
-      w.monthRuns += 1;
+      if (!noWall) w.monthRuns += 1;
       if (wallKnown) { p.monthWallMs = /** @type {number} */ (p.monthWallMs) + /** @type {number} */ (leg.wallMs); w.monthKnown += 1; }
       if (wallAtLeast) p.monthWallAtLeast = true;
     }
@@ -323,6 +358,8 @@ export function spendSummary(opts = {}) {
  * @property {number|null} leftUsd what is left this month (null = no limit set)
  * @property {number|null} limitUsd the person's monthly limit (null = none)
  * @property {boolean} atLeast the month's spend is a floor, so `leftUsd` is a ceiling
+ * @property {number} [heldUsd] what run(s) in progress have set aside beyond their spend so far (present when a limit is set)
+ * @property {number} [heldRuns] how many runs hold it
  */
 
 /**
@@ -346,30 +383,33 @@ export function monthlyLimitOf(config, home) {
  * number above 0 throws `ConfigError`.
  * Compared in whole cents. Also throws `ConfigError` when config.json is unreadable — a gate
  * whose own instrument is broken refuses; it never silently runs with no limit.
- * @param {{ capUsd: number, home?: string, now?: () => number, aboveRunid?: string }} args `aboveRunid`: count only the claims listed above that run (a claim in progress)
+ * @param {{ capUsd: number, home?: string, sessionsRoot?: string, now?: () => number, aboveRunid?: string }} args `aboveRunid`: count only the claims listed above that run (a claim in progress)
  * @returns {MonthlyRoom}
  */
-export function checkMonthlyRoom({ capUsd, home, now, aboveRunid }) {
+export function checkMonthlyRoom({ capUsd, home, now, aboveRunid, sessionsRoot }) {
   const cfg = readConfig({ home });
   if (cfg.problem) throw new ConfigError(cfg.problem);
   const limit = monthlyLimitOf(cfg.config, home);
   if (limit === null) {
     return { ok: true, leftUsd: null, limitUsd: null, atLeast: false };
   }
-  const spent = monthSpend({ home, now, aboveRunid });
+  const spent = monthSpend({ home, sessionsRoot, now, aboveRunid });
   const leftCents = Math.max(0, Math.floor((limit - spent.reservedUsd) * 100 + 1e-6));
-  const capCents = Math.ceil((Number.isFinite(capUsd) ? capUsd : 0) * 100 - 1e-6);
-  return { ok: capCents <= leftCents, leftUsd: leftCents / 100, limitUsd: limit, atLeast: spent.atLeast };
+  const capCents = Math.ceil(capUsd * 100 - 1e-6); // a non-finite cap never fits (NaN/Infinity compare false) — never read as $0
+  return { ok: capCents <= leftCents, leftUsd: leftCents / 100, limitUsd: limit, atLeast: spent.atLeast, heldUsd: spent.heldUsd, heldRuns: spent.heldRuns };
 }
 
 /**
- * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal).
+ * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal). When run(s) in progress hold
+ * part of the limit, the same line says how much.
  * @param {MonthlyRoom} room
  * @returns {string|null} null when the run fits
  */
 export function monthlyRefusalText(room) {
   if (room.ok || room.leftUsd === null) return null;
-  return `Max $${room.leftUsd.toFixed(2)} (monthly limit)`;
+  const max = `Max $${room.leftUsd.toFixed(2)}`;
+  if (!room.heldRuns || !room.heldUsd || room.heldUsd <= 0) return `${max} (monthly limit)`;
+  return `${max} (monthly limit, $${room.heldUsd.toFixed(2)} held by ${room.heldRuns > 1 ? 'runs' : 'a run'} in progress)`;
 }
 
 /**
@@ -382,13 +422,14 @@ export function monthlyRefusalText(room) {
  */
 export function settleDeadClaims({ home, by, aboveRunid }) {
   const { rows, events } = readRunList({ home });
-  const settled = new Set(events.filter((e) => e.type === 'settled').map((e) => e.runid));
   let n = 0;
   for (const row of rowsAbove(rows, aboveRunid)) {
-    if (!Number.isInteger(row.pid) || settled.has(row.runid) || isLiveRunner(/** @type {number} */ (row.pid))) continue;
+    // the run's own claim is never closed by itself (a resume's own row stays in `rowsAbove` for its SPEND)
+    if (aboveRunid !== undefined && row.runid === aboveRunid) continue;
+    if (!Number.isInteger(row.pid) || isSettled(events, row) || isLiveRunner(/** @type {number} */ (row.pid))) continue;
     let spentUsd = 0;
-    try { spentUsd = legSpend(parseJsonl(row.spine).records).usd; } catch { /* no spine: nothing was recorded spent */ }
-    appendRunEvent({ runid: row.runid, type: 'settled', by, reason: 'process gone', spentUsd, spendComplete: false, at: new Date().toISOString() }, { home });
+    try { spentUsd = legSpend(legsOf(parseJsonl(row.spine).records).at(-1)?.records ?? []).usd; } catch { /* no spine: nothing was recorded spent */ }
+    appendRunEvent({ runid: row.runid, type: 'settled', by, reason: 'process gone', spentUsd, spendComplete: false, at: new Date().toISOString(), ...(row.leg === undefined ? {} : { leg: row.leg }) }, { home });
     n += 1;
   }
   return n;
@@ -402,20 +443,25 @@ export function settleDeadClaims({ home, by, aboveRunid }) {
  * it appends `{type:'released', reason:'refused'}` and reports the refusal, nothing spent. No limit set =
  * no claim (`claimed: false`; the caller lists the run as it always did). An unreadable config, or a row
  * that cannot be written, throws `ConfigError` — the gate refuses, never reads "no limit".
- * @param {{ row: import('./runlist.js').RunRow, capUsd: number, home?: string, now?: () => number }} args
+ * A RESUMED leg (`leg` 2+, P5-R) claims the same way but appends a `leg-start` beside the run's one row
+ * (the row itself is added only when the list has none), and a refusal gives back THAT leg's claim.
+ * @param {{ row: import('./runlist.js').RunRow, capUsd: number, home?: string, now?: () => number, leg?: number }} args
  * @returns {{ room: MonthlyRoom, claimed: boolean }}
  */
-export function claimRun({ row, capUsd, home, now }) {
+export function claimRun({ row, capUsd, home, now, leg = 1 }) {
   const cfg = readConfig({ home });
   if (cfg.problem) throw new ConfigError(cfg.problem);
   if (monthlyLimitOf(cfg.config, home) === null) return { room: { ok: true, leftUsd: null, limitUsd: null, atLeast: false }, claimed: false };
-  try { appendRun(row, { home }); } catch (/** @type {any} */ e) {
+  try {
+    appendRun(row, { home });
+    if (leg > 1) appendLegStart({ type: 'leg-start', runid: row.runid, leg, pid: row.pid, capUsd: row.capUsd, at: new Date().toISOString() }, { home });
+  } catch (/** @type {any} */ e) {
     throw new ConfigError(`cannot write this run's claim to the run list (${e.message})`);
   }
   settleDeadClaims({ home, by: row.runid, aboveRunid: row.runid });
   const room = checkMonthlyRoom({ capUsd, home, now, aboveRunid: row.runid });
   if (!room.ok) {
-    try { appendRunEvent({ runid: row.runid, type: 'released', by: row.runid, reason: 'refused', at: new Date().toISOString() }, { home }); } catch { /* the refusal stands; a stranded row of a dead process is closed by the next run */ }
+    try { appendRunEvent({ runid: row.runid, type: 'released', by: row.runid, reason: 'refused', at: new Date().toISOString(), ...(leg > 1 ? { leg } : {}) }, { home }); } catch { /* the refusal stands; a stranded row of a dead process is closed by the next run */ }
     return { room, claimed: false };
   }
   return { room, claimed: true };

package/src/panel/authorroutes.js

@@ -22,7 +22,8 @@ import { spawn as realSpawn } from 'node:child_process';
 import { openSync } from 'node:fs';
 import { join } from 'node:path';
 import { readFileSync } from 'node:fs';
-import { createSession, validateJobCard } from './authorsession.js';
+import { createSession, validateJobCard, validateReuseCard, lockedFieldChanged, buildReuseSpec, cardFields, STEP_LABELS } from './authorsession.js';
+import { validateJob } from '../job.js';
 import { checkMonthlyRoom, monthlyRefusalText } from '../monthly.js';
 import { ConfigError } from '../config.js';
 import { keysForDoor, keysHome } from '../keysfile.js';
@@ -34,6 +35,23 @@ export function mintToken() {
   return randomBytes(24).toString('hex');
 }
 
+/**
+ * The ONE spelling of this panel's own bind address (`host:port`), shared by the Host and Origin checks.
+ * @param {number} port
+ */
+const bindAddress = (port) => `127.0.0.1:${port}`;
+
+/**
+ * The ONE Host check: the request names this panel's own bind address. A page on another
+ * origin reaching the panel through a rebound DNS name sends that name as Host, so it fails here.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{port: number}} o
+ * @returns {{ok: true}|{ok: false, reason: string}}
+ */
+export function checkHostGuard(req, { port }) {
+  return req.headers.host === bindAddress(port) ? { ok: true } : { ok: false, reason: 'wrong Host' };
+}
+
 /**
  * `true` when a request may reach ANY route in this file — the token header
  * plus an Origin/Host that names this exact bind address. `req.headers`
@@ -46,12 +64,11 @@ export function mintToken() {
 export function checkHumanGuard(req, { token, port }) {
   const got = req.headers['x-bareloop-token'];
   if (got !== token) return { ok: false, reason: 'missing or wrong token' };
-  const want = `127.0.0.1:${port}`;
+  const want = bindAddress(port);
   const origin = req.headers.origin;
-  const host = req.headers.host;
   if (typeof origin === 'string' && origin.length > 0) {
     if (origin !== `http://${want}` && origin !== `https://${want}`) return { ok: false, reason: 'wrong Origin' };
-  } else if (host !== want) {
+  } else if (!checkHostGuard(req, { port }).ok) {
     return { ok: false, reason: 'wrong Host (and no Origin header)' };
   }
   return { ok: true };
@@ -73,7 +90,8 @@ const TERMINAL_PHASES = new Set(['refused', 'abandoned', 'error', 'signed', 'sig
  * deliberately has none of).
  * @param {{ port: number, token: string, env?: Record<string,string|undefined>,
  *   sessionsRoot?: string, spawnFn?: typeof realSpawn, bareloopBin?: string,
- *   jobsDir?: string, fetchImpl?: typeof fetch, home?: string }} opts
+ *   jobsDir?: string, fetchImpl?: typeof fetch, home?: string,
+ *   startFrom?: {get: (runid: string, o?: {model?: string}) => any, getImport: (id: string, o?: {model?: string}) => any} }} opts
  */
 export function createAuthorRoutes(opts) {
   // the RAW env with the keys file re-merged on every use, so an edited file takes effect
@@ -170,7 +188,7 @@ export function createAuthorRoutes(opts) {
       const cap = Number(q.get('cap'));
       if (!Number.isFinite(cap) || cap <= 0) { send(200, { ok: true, refusal: null }); return true; }
       try {
-        const room = checkMonthlyRoom({ capUsd: cap, home: opts.home });
+        const room = checkMonthlyRoom({ capUsd: cap, home: opts.home, sessionsRoot: opts.sessionsRoot });
         send(200, { ok: true, refusal: monthlyRefusalText(room), leftUsd: room.leftUsd, atLeast: room.atLeast });
       } catch (e) {
         if (!(e instanceof ConfigError)) throw e;
@@ -179,19 +197,74 @@ export function createAuthorRoutes(opts) {
       return true;
     }
 
+    // ── REUSE WORKFLOW (replaces P5 item 3's Start from this). `GET /api/author/start-from?runid=` (or `?import=`) —
+    // the prefill from the SIGNED job, which boxes are locked, the track record. $0, read-only. The route keeps its name.
+    if (pathname === '/api/author/start-from') {
+      if (!opts.startFrom) { send(404, { ok: false, error: 'not found' }); return true; }
+      if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
+      const sp = new URL(/** @type {string} */ (req.url), 'http://127.0.0.1').searchParams;
+      const runid = sp.get('runid') ?? '';
+      // `model` = the card's Model box right now: the estimate line counts only runs on that worker
+      const asModel = sp.has('model') ? { model: sp.get('model') ?? '' } : {};
+      const pre = sp.has('import') ? opts.startFrom.getImport(sp.get('import') ?? '', asModel) : opts.startFrom.get(runid, asModel);
+      if (pre === null) { send(404, { ok: false, error: 'no such run' }); return true; }
+      if (!pre.ok) { send(409, pre); return true; }
+      send(200, {
+        ok: true, origin: pre.origin, card: pre.card, from: pre.from, note: pre.note,
+        locked: pre.locked, open: pre.open, specHash: pre.specHash, workflowKey: pre.workflowKey, trackRecord: pre.trackRecord,
+        line: pre.line,
+      });
+      return true;
+    }
+
+    // A refreshed page re-attaches to the one live (non-terminal) session: its id and state (card, messages, steps),
+    // or `null`. The server's session map is the only truth; nothing is stored page-side.
+    if (pathname === '/api/author/live') {
+      if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
+      const live = [...sessions.values()].find((s) => !TERMINAL_PHASES.has(s.state.phase));
+      send(200, { ok: true, sessionId: live ? live.state.id : null, state: live ? live.state : null });
+      return true;
+    }
+
     if (pathname === '/api/author/start') {
       if (req.method !== 'POST') { send(405, { ok: false, error: 'POST only' }); return true; }
       if (hasLiveSession()) { send(409, { ok: false, error: 'an authoring session is already live — one at a time' }); return true; }
       const card = body ?? {};
-      const v = validateJobCard(card, { jobsDir: opts.jobsDir, rows: rowsForHome(keysHome(opts.home)) });
-      if (!v.ok) { send(400, { ok: false, error: v.error }); return true; }
-      const session = createSession(card, { env: envNow(), sessionsRoot: opts.sessionsRoot, ...(opts.home !== undefined ? { home: opts.home } : {}) });
+      const rows = rowsForHome(keysHome(opts.home));
+      // Reuse workflow — started from a green run or an imported job: only Source, Destination and the two caps may
+      // differ from the signed workflow. The SERVER refuses any other change (the page greys those boxes, but is
+      // never trusted); the spec it signs is a copy of the origin's with just those four set. Nothing is drafted.
+      /** @type {{spec: any, workflowKey: string}|null} */
+      let reuse = null;
+      const from = card.startFrom;
+      const fromRunid = typeof from === 'string' ? from : (typeof from?.runid === 'string' ? from.runid : null);
+      const fromImport = typeof from?.importId === 'string' ? from.importId : null;
+      if (fromRunid !== null || fromImport !== null) {
+        const pre = opts.startFrom ? (fromImport !== null ? opts.startFrom.getImport(fromImport) : opts.startFrom.get(fromRunid)) : null;
+        if (pre === null || pre === undefined) { send(404, { ok: false, error: 'no such run to reuse' }); return true; }
+        if (!pre.ok) { send(409, pre); return true; }
+        const locked = lockedFieldChanged(card, pre.card);
+        if (locked !== null) { send(400, { ok: false, error: `${locked} is locked on a reused workflow — Clear the card to change it` }); return true; }
+        const rv = validateReuseCard(card, { rows });
+        if (!rv.ok) { send(400, { ok: false, error: rv.error }); return true; }
+        const spec = buildReuseSpec(pre.spec, card, rows);
+        const jv = validateJob(spec, { shellCapUsd: spec.budgetUsd });
+        if (!jv.ok) { send(400, { ok: false, error: `the spec this reuse would sign is not valid (${jv.reds.map((r) => `${r.code} at ${r.path}`).join('; ')})` }); return true; }
+        reuse = { spec, workflowKey: pre.workflowKey };
+      }
+      if (reuse === null) {
+        const v = validateJobCard(card, { jobsDir: opts.jobsDir, rows });
+        if (!v.ok) { send(400, { ok: false, error: v.error }); return true; }
+      }
+      const session = createSession(cardFields(card), {
+        env: envNow(), sessionsRoot: opts.sessionsRoot, ...(opts.home !== undefined ? { home: opts.home } : {}), ...(reuse ? { reuse } : {}),
+      });
       sessions.set(session.id, session);
-      send(200, { ok: true, sessionId: session.id, state: session.state });
+      send(200, { ok: true, sessionId: session.id, reuse: reuse !== null, state: session.state });
       return true;
     }
 
-    const m = /^\/api\/author\/([A-Za-z0-9]+)(\/(send|revise|sign-prepare|sign|check-deps))?$/.exec(pathname);
+    const m = /^\/api\/author\/([A-Za-z0-9]+)(\/(send|revise|sign-prepare|sign|check-deps|abandon))?$/.exec(pathname);
     if (!m) { send(404, { ok: false, error: 'not found' }); return true; }
     const session = sessions.get(m[1]);
     if (!session) { send(404, { ok: false, error: 'no such session' }); return true; }
@@ -213,6 +286,11 @@ export function createAuthorRoutes(opts) {
       session.revise(String(body?.text ?? '')).then((r) => send(r.ok ? 200 : 400, { ...r, state: session.state }));
       return true;
     }
+    if (sub === 'abandon') {
+      const r = session.abandon();
+      send(r.ok ? 200 : 400, { ...r, state: session.state });
+      return true;
+    }
     if (sub === 'check-deps') {
       const r = session.checkDeps();
       send(r.ok ? 200 : 400, { ...r, state: session.state });
@@ -248,7 +326,7 @@ export function createAuthorRoutes(opts) {
  * @param {number} n a non-negative dollar amount
  * @returns {string}
  */
-function panelMoney2(n) {
+export function panelMoney2(n) {
   if (n > 0 && n < 0.01) return '<$0.01';
   // two-step rounding (matching index.html's own panelMoney): clean to
   // 6-decimal precision first (the same precision src/text.js's tallyCalls
@@ -280,7 +358,7 @@ export function signRun(session, claimedHash, o) {
   // lower nothing (the cap is signed in) but may raise the limit in Settings and sign again.
   try {
     const spec = JSON.parse(readFileSync(session.state.resolvedSpecPath, 'utf8'));
-    const refusal = monthlyRefusalText(checkMonthlyRoom({ capUsd: Number(spec.budgetUsd), home: o.home }));
+    const refusal = monthlyRefusalText(checkMonthlyRoom({ capUsd: Number(spec.budgetUsd), home: o.home, sessionsRoot: o.sessionsRoot }));
     if (refusal !== null) return { ok: false, error: refusal };
   } catch (e) {
     if (e instanceof ConfigError) return { ok: false, error: `${e.message} — refusing rather than guess the monthly limit` };
@@ -320,9 +398,11 @@ export function signRun(session, claimedHash, o) {
   });
   if (typeof child?.unref === 'function') child.unref();
   session.state.phase = 'signed';
+  // hamr 2026-10-05: the sign shows as the last step of the one progress list, never as a thread bubble
+  // hamr 2026-10-05 (option A): the drafting-spend line is that step's detail — nothing when there was no drafting spend (a Reuse)
   const draftLine = draftSpentUsd !== null
-    ? ` — drafting spent ${draftIncomplete ? 'at least ' : ''}${panelMoney2(draftSpentUsd)} (folds out of the run's own cap)`
+    ? `drafting spent ${draftIncomplete ? 'at least ' : ''}${panelMoney2(draftSpentUsd)} (folds out of the run's own cap)`
     : '';
-  session.state.messages.push({ role: 'system', text: `signed — spec hash ${session.state.specHash}${draftLine} — run starting detached, own log at ${logFile}` });
+  if (Array.isArray(session.state.steps)) session.state.steps.push({ id: 'signed', label: STEP_LABELS.signed, status: 'done', detail: draftLine });
   return { ok: true, job: session.state.resolvedSpecPath };
 }