bareloop 0.33.0 → 0.35.0

package/src/panel/status.js

@@ -0,0 +1,51 @@
+// PANEL status words — ONE code-owned table (sign -> word) and ONE writer of "which word does this run wear".
+// hamr's ruling 2026-10-04 (option A): every surface (run cards, expanded run rows, the right-side header, imported
+// rows) reads `status` from the server; the page never maps an outcome to a word itself.
+//
+//   [▶] running · [·] waiting · [✓] passed · [✗] failed · [✗] capped · [✗] stopped · [?] died
+//
+// Outcome -> word (every outcome the panel knows; anything not listed is `failed`):
+//   green, already-green, satisfied                      -> passed
+//   no job-end, runner alive (or starting)               -> running
+//   no job-end, runner gone (died)                       -> died
+//   cap-halt, wall-halt                                  -> capped   (money cap / time cap)
+//   escalated + money-halt record, escalated + wall-halt -> capped
+//   stopped (the person pressed Stop)                    -> stopped
+//   plan-red, check-red, step-red, escalated (strikes / provider / other), close-red, provider-red, step-stalled,
+//   and every other outcome (refusals, instrument stops)  -> failed
+// `waiting` is the step-level sign for a step that has not started; no run outcome maps to it.
+
+/** the sentence a passed run carries as its reason (the Ended block's `line`) */
+export const GOAL_MET_LINE = 'goal met';
+
+/** @typedef {'running'|'waiting'|'passed'|'failed'|'capped'|'stopped'|'died'} StatusKey */
+
+/** the table: key -> sign + word */
+export const STATUS = Object.freeze({
+  running: Object.freeze({ sign: '▶', word: 'running' }),
+  waiting: Object.freeze({ sign: '·', word: 'waiting' }),
+  passed: Object.freeze({ sign: '✓', word: 'passed' }),
+  failed: Object.freeze({ sign: '✗', word: 'failed' }),
+  capped: Object.freeze({ sign: '✗', word: 'capped' }),
+  stopped: Object.freeze({ sign: '✗', word: 'stopped' }),
+  died: Object.freeze({ sign: '?', word: 'died' }),
+});
+
+/**
+ * The status of one run.
+ * @param {{outcome: string|null|undefined, died?: boolean, category?: string|null, moneyHalt?: boolean}} o
+ *   `category` is the last escalation's category; `moneyHalt` is whether the spine carries a `money-halt` record
+ * @returns {{key: StatusKey, sign: string, word: string}}
+ */
+export function statusFor(o) {
+  /** @type {StatusKey} */
+  let key = 'failed';
+  const out = o.outcome;
+  if (o.died) key = 'died';
+  else if (out === null || out === undefined) key = 'running';
+  else if (out === 'green' || out === 'already-green' || out === 'satisfied') key = 'passed';
+  else if (out === 'cap-halt' || out === 'wall-halt') key = 'capped';
+  else if (out === 'stopped') key = 'stopped';
+  else if (out === 'escalated' && ((o.category === 'cap-halt' && o.moneyHalt) || o.category === 'wall-halt')) key = 'capped';
+  return { key, ...STATUS[key] };
+}

package/src/planrun.js

@@ -21,7 +21,7 @@
 // which putting either in fs.deny would silently contradict.
 
 import { createRequire } from 'node:module';
-import { readFileSync, readdirSync } from 'node:fs';
+import { readFileSync, readdirSync, existsSync, unlinkSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { join, resolve, relative } from 'node:path';
 import { Gate } from 'bareguard';
@@ -39,8 +39,9 @@ import { TOOL_BY_VERB, CTX_TOOLS, createCtxTools, toolAction, PERSONA_TOOLS, str
 import { createReadShim, readShimArm, readShimStrategy } from './readshim.js';
 import { globToPrefix, redactSecrets, SECRET_PATTERNS } from './validate.js';
 import { validateBridge, loadGate, newestEligibleVersion, reuseEligibility, quarantinesCredit, QUARANTINED_CODE } from './bridges.js';
-import { extractArtifact } from './text.js';
+import { extractArtifact, rateSourceFields } from './text.js';
 import { defaultJudgeLoop } from './judged.js';
+export { rateSourceFields };
 import { createClock, isWallTimeout } from './clock.js';
 import { isDeclaredClose, runDeclaredStages, validateCloseDecl, closeGrade, HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED } from './declaredclose.js';
 import {
@@ -536,25 +537,8 @@ export const FORBIDDEN_WRITE_SEGMENT_PATTERN = /"path":"(?:(?:[^"\\]|\\.)*\/)?(?
  */
 export const BOUND_REASON_MAX = 200;
 
-/**
- * BA-21 — the WRITE side of the pricing-provenance signal (read side: `rateProvenance` /
- * `spendProvenance` in src/ledger.js). bare-agent >=0.37 rides `rateSource` beside
- * `pricing` on every metering payload; both metering callbacks below forward it onto the
- * spine through THIS one helper, because two sites spelling one rule are two instruments
- * (the ripgrep fix that landed in ci.yml but not publish.yml).
- *
- * Forwarded VERBATIM — the write side reports what upstream said, and src/ledger.js is
- * the one place that decides what counts as a guess. And an ABSENT provenance stays
- * absent: a payload carrying no `rateSource` (bare-agent <0.37, and every round already
- * in the archive) emits no field at all, so a reader sees UNKNOWN rather than a label we
- * invented. Never defaulted to `null` here — `null` is upstream saying "nothing was
- * priced", which is a different fact from "nobody told us".
- * @param {any} arg an `onLlmResult` / `onTurn` payload
- * @returns {{rateSource?: string|null}} the field to spread into the spine record
- */
-export function rateSourceFields(arg) {
-  return arg && typeof arg === 'object' && 'rateSource' in arg ? { rateSource: arg.rateSource } : {};
-}
+/** the recorded reason for a step attempt whose round was cut at the output cap (F122 2A b) */
+export const TRUNCATED_REASON = 'output cut at the token limit (max_tokens)';
 
 /**
  * What the NEXT attempt is told about the bound that cut the previous one.
@@ -589,6 +573,9 @@ export function rateSourceFields(arg) {
  */
 export function boundedNote(bounded, rounds) {
   if (!bounded) return null;
+  if (bounded.cause === 'truncated') {
+    return `Your previous attempt was CUT OFF: ${TRUNCATED_REASON}. That response was discarded.`;
+  }
   if (bounded.cause !== 'denied') {
     return `Your previous attempt was CUT OFF after ${rounds} tool rounds. `
       + 'Reading is bounded; writing is not. Form a hypothesis EARLY and make the change.';
@@ -982,12 +969,18 @@ ${scoutBlob || '(no scout notes)'}`;
  *   passes `false` so the three `--resume`-naming readouts below (`MONEY_OPTIONS`,
  *   the resume-plan-red option, the fix-loop terminal) say "resume is `run-u`-only
  *   in v1" instead of naming a flag that would fail if typed.
+ * @param {string|null} [opts.stopFile=null] P5 item 5 — the run's STOP REQUEST file
+ *   (`stopFilePath(spine)`, src/legs.js). Read at ONE seam, the round boundary of a step worker
+ *   (the `metered` callback, where the money cap binds): present = emit `stop-requested`, consume
+ *   the file, end the Loop after that round, and end the leg `stopped` (a checkpoint outcome, filed
+ *   the way a mid-step cap-halt is; resume re-enters that step). Nothing is in flight at that
+ *   point, so the spend is exact. `null` = no stop surface (the default).
  * @returns {Promise<string>} 'green' | 'already-green' | 'escalated' | 'plan-red' |
  *   'check-red' | 'close-red' | 'close-unsupported' | 'recipe-stale' | 'pricing-red' |
- *   'branch-red' | 'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' |
+ *   'branch-red' | 'cap-halt' | 'wall-halt' | 'stopped' | 'provider-red' | 'interpreter-red' |
  *   'step-stalled' | 'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  */
-export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, rates = null, judgeRates = null, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, closeDir = null, maxStepRounds = 40, layerRoot = false, readShim = false, scout = true, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, priorSpentUsd = 0, reviewDoor = null, doorRerun = null, resumable = true }) {
+export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, rates = null, judgeRates = null, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, closeDir = null, maxStepRounds = 40, layerRoot = false, readShim = false, scout = true, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, priorSpentUsd = 0, reviewDoor = null, doorRerun = null, resumable = true, stopFile = null }) {
   // MEMORY-CACHE: what the read shim (src/readshim.js) saved THIS run, summed across
   // every mkWorker's own shim instance (scout, drafter, each step's worker, the fix
   // worker) — one accumulator closed over by all of them, because the shim's ledger
@@ -1708,11 +1701,9 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         stage: c.stage, path: c.path, attempt: c.attempt, label: c.label, model: c.model,
         costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
         // BA-21 provenance, through the SAME helper the worker rounds use — this record
-        // is on `spendProvenance`'s read list (src/ledger.js), so a judge-round that
-        // never carried the field would read UNKNOWN forever inside the readout built to
-        // expose exactly this seam. NAMED, not papered over: the judge cost payload
-        // (src/kinds.js `onJudgeCost({...})`) does not carry `rateSource` today, so it
-        // still reads UNKNOWN — correctly — until that payload forwards it too.
+        // is on `spendProvenance`'s read list (src/ledger.js). The judge cost payload
+        // (src/kinds.js `onJudgeCost`) forwards the field when the judge Loop carried it
+        // (`defaultJudgeLoop`); a loop that metered no rate leaves the key absent (UNKNOWN).
         ...rateSourceFields(c),
       }),
     })
@@ -2436,7 +2427,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
      * `iteration` mirrors `roundIteration` exactly, undefined included: the bound
      * cannot know a label the run never set, and inventing one here would be the
      * only place in this file that claims to.
-     * @type {{iteration: number|string|undefined, cause: 'rounds'|'wall'|'denied', reason: string|null}|undefined}
+     * @type {{iteration: number|string|undefined, cause: 'rounds'|'wall'|'denied'|'truncated', reason: string|null}|undefined}
      */
     let attemptBounded;
     /**
@@ -2660,6 +2651,14 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     // completes no round and returns from no step, which are the only two places
     // `clock.expired()` is otherwise consulted). Same clock object as every other
     // reader — never a second time source.
+    /** P5 item 5 — set by the round seam when the person's stop request was honoured on this worker */
+    let stopHit = false;
+    const throwIfStopped = () => {
+      if (!stopHit) return;
+      const err = /** @type {CategorizedError} */ (new Error('stopped at the person\'s request (a stop request was honoured at a round boundary)'));
+      err.category = 'stopped';
+      throw err;
+    };
     const stallWatch = createStallWatch({
       onStall: (n) => emit('stall', { phase, iteration: roundIteration, stall: n, stallMs: STALL_MS, maxStalls: MAX_STALLS }),
       expired: () => clock.expired(),
@@ -2742,7 +2741,17 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
           // step loop after a step returns (between steps), the head of a step's attempt
           // (a step that would BEGIN past the deadline is never funded), and the head of
           // a close-fix iteration (W-2 — the run stops on the verdict already minted).
-          if (clock.expired()) {
+          // P5 item 5 — the person's STOP, read at THIS seam: the round boundary, where the money cap binds
+          // (nothing in flight, the round just metered). It is the ONE owner of the stop request. The file is
+          // consumed here; `self.stop()` ends the Loop after this round exactly as a bound does; `ask`/`askFrom`
+          // then throw category `stopped`, which the step loop files as the checkpoint outcome `stopped` the way a
+          // mid-step cap-halt is filed. Step workers only (scout/plan/fix never read it).
+          if (stopFile !== null && !stopHit && phase.startsWith('step:') && existsSync(stopFile)) {
+            try { unlinkSync(stopFile); } catch { /* already consumed */ }
+            stopHit = true;
+            emit('stop-requested', { phase, step: phase.slice('step:'.length), iteration: roundIteration, round: roundsThisAttempt, meaning: 'the person asked to stop; the leg ends after this round and a resume re-enters this step' });
+            self.stop();
+          } else if (clock.expired()) {
             attemptBounded = { iteration: roundIteration, cause: 'wall', reason: null };
             emit('wall-bounded', { phase, iteration: roundIteration, ...clock.report(closeTimeoutForReport) });
             self.stop();
@@ -2779,7 +2788,9 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         // bare-agent's own Loop.chat() (loop.js ~1321) strips a leading system
         // message before re-running for exactly this reason; do the same here.
         const rest = msgs[0]?.role === 'system' ? msgs.slice(1) : msgs;
-        return await stallWatch.watch((gen) => newLoop(gen).run([...rest, { role: 'user', content: prompt }], [], { cacheMessages: true, maxTokens: 32000, ...callBounds() }));
+        const r = await stallWatch.watch((gen) => newLoop(gen).run([...rest, { role: 'user', content: prompt }], [], { cacheMessages: true, maxTokens: 32000, ...callBounds() }));
+        throwIfStopped();
+        return r;
       } catch (e) {
         throw categorize(e).err;
       }
@@ -2788,6 +2799,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       let r;
       try {
         r = await stallWatch.watch((gen) => newLoop(gen).run([{ role: 'user', content: prompt }], defs, { cacheMessages: true, maxTokens: 32000, ...callBounds() }));
+        throwIfStopped();
       } catch (e) {
         throw categorize(e).err;
       }
@@ -2805,6 +2817,17 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         emit('attempt-bounded', { phase, iteration: roundIteration, rounds: roundsThisAttempt, cap: attemptRounds, reason });
         return r;
       }
+      // F122 "2A" half (b), hamr 2026-10-05: a STEP or FIX worker round cut at max_tokens
+      // is a FAILED WORKER ATTEMPT, not transport. Same lane as the deny streak above: the
+      // cut round's output is discarded (bare-agent already dropped it), its spend is booked
+      // by the per-round meter, the tree is judged as it stands, and the step's strike
+      // ladder (or the fix governor) applies unchanged (hamr ruling A extended it to `fix`
+      // after run muux1x96). Scout, drafter, replan keep the transport route below.
+      if (r.error && r.error.startsWith('truncated:') && (phase.startsWith('step:') || phase === 'fix')) {
+        attemptBounded = { iteration: roundIteration, cause: 'truncated', reason: TRUNCATED_REASON };
+        emit('attempt-bounded', { phase, iteration: roundIteration, rounds: roundsThisAttempt, cap: attemptRounds, reason: TRUNCATED_REASON, stopReason: r.stopReason ?? null });
+        return r;
+      }
       // the remaining error-return taxonomy (one map, same doctrine as native's):
       // halt → cap-halt, API truncation → provider-red, anything else is wiring
       if (r.error) {
@@ -3692,6 +3715,11 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     // (attempts used, steps done); its absence means the deadline landed inside a call
     // instead, which is F64's cutMidCall stop — and run.js keys the job-end money floor
     // on exactly that field, so conflating the two would report an unknown as exact.
+    // P5 item 5 — the person stopped the leg at a round boundary inside this step: a checkpoint, not a verdict
+    if (cat === 'stopped') {
+      planExecuted();
+      return 'stopped';
+    }
     if (cat === 'wall-halt') {
       emitWallHalt(stepWallStop ?? { cutMidCall: true, phase: `step:${step.id}`, stepsDone: idx, stepsPlanned: plan.steps.length });
       planExecuted();
@@ -4055,6 +4083,9 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         .filter((s) => s.values.length > 0)
         .map((s) => `${s.stage} ${s.values.join(' → ')}`);
       const factsLine = [checksFact, ...stageFacts].filter(Boolean).join(' · ');
+      // same iteration numbering as the step loop: `w.setIteration(iteration)` above
+      // stamps the bound, so "the attempt just before this one" is `iteration - 1`
+      const bound = w.wasBounded();
       await w.ask([
         'The job\'s final verification is failing. Fix the repository so it passes.',
         `Repository root (absolute): ${workdir}\nEvery path you pass to a tool MUST be absolute and inside this root.`,
@@ -4062,6 +4093,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         !gap && post.gap && `The verification's output on the tree as it stands (not an attempt of yours):\n${post.gap}`,
         gap && `Previous attempt failed the verification:\n${gap}`,
         factsLine && `The close's own numbers so far, oldest first (facts only — no advice):\n${factsLine}`,
+        bound?.iteration === iteration - 1 && boundedNote(bound, maxStepRounds),
         rootInj && rootInj.note,
       ].filter(Boolean).join('\n\n'));
     };

package/src/providerrows.js

@@ -134,6 +134,23 @@ export function endpointOf(provider, baseUrl) {
   } catch { return raw.replace(/\/+$/, ''); }
 }
 
+/**
+ * A job's provider in plain words for a refusal line: the host its Base URL points at (else the
+ * shape's own default host, else the shape's label), plus the model when the spec names one.
+ * Never a key, a path or a status code.
+ * @param {{provider?: string, baseUrl?: string|null, model?: string|null}} spec
+ * @returns {string}
+ */
+export function providerInWords(spec) {
+  const provider = String(spec?.provider ?? '');
+  const url = endpointOf(provider, spec?.baseUrl ?? null);
+  let host = '';
+  try { host = new URL(url).host; } catch { host = ''; }
+  if (host === '') host = SHAPES.find((s) => s.id === provider)?.label ?? provider;
+  const model = typeof spec?.model === 'string' ? spec.model.trim() : '';
+  return model !== '' ? `${host}, ${model}` : host;
+}
+
 /**
  * The URL a row talks to, for display ('' = the vendor's own host, which has no URL to show).
  * @param {KeyRow} row
@@ -236,12 +253,14 @@ function perMoney(n) {
 
 /**
  * The one readout line for a resolved customer price, preview and run tail alike:
- * `yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)`.
+ * `yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)`. A 0 / 0 price is accepted (the price
+ * is the customer's) but the line says so: every round then books $0, so spend and limits read $0.
  * @param {{ inPerM: number, outPerM: number, envName: string }} price a {@link ratesFor} result
  * @returns {string}
  */
 export function priceReadout(price) {
-  return `yours: in ${perMoney(price.inPerM)} / out ${perMoney(price.outPerM)} per 1M tokens (${price.envName} row)`;
+  const zero = price.inPerM === 0 && price.outPerM === 0 ? ' — WARNING: this price is $0, so spend and limits read $0' : '';
+  return `yours: in ${perMoney(price.inPerM)} / out ${perMoney(price.outPerM)} per 1M tokens (${price.envName} row)${zero}`;
 }
 
 /**

package/src/providers.js

@@ -2,8 +2,9 @@
 // `provider` name to the bare-agent constructor it drives, the env var
 // carrying its key, and the per-tier model table — including any
 // provider-specific request-key gating. Before this module existed, both
-// runners constructed `AnthropicProvider` BY NAME (`src/cli.js`'s
-// `buildProviders`, `scripts/run-u.mjs`'s top-level wiring) and any second
+// runners constructed `AnthropicProvider` BY NAME (the old `buildProviders` in
+// `src/cli.js` and `scripts/run-u.mjs`'s top-level wiring, both since replaced
+// by `buildRunnerProviders` below) and any second
 // provider would have meant scattering `if (provider === …)` across both.
 //
 // hamr's ruling (PRD 30.7, 2026-09-09): `deepseek-chat` is THE secondary
@@ -265,8 +266,7 @@ export function makeProvider(providerName, { apiKey, model, baseUrl } = {}) {
 
 /**
  * Build the `{provider, providerFor, judgeProvider}` triple both runners
- * need (`src/cli.js`'s `buildProviders`, `scripts/run-u.mjs`'s top-level
- * wiring) — ONE seam instead of two copies of the same construction and
+ * need (`src/authorrun.js` and `src/panel/authorsession.js` call it) — ONE seam instead of two copies of the same construction and
  * tier-memoization logic. `model`/`tierModels` are already-RESOLVED inputs
  * (the caller runs `resolveWorkerModel` itself, exactly as both runners did
  * before this factory existed — that decision stays where each runner's own

package/src/ralph.js

@@ -653,6 +653,9 @@ export async function ralph({ middle, close, judge, capRuns, ladder, emit, redac
           ['raise maxWallMs and rerun (resume-to-cap; a spec edit, so the new hash needs re-approval)',
             'revise the goal/spec so the work fits the time (same re-approval)',
             'abandon the task']],
+        // P5 item 5 — the PERSON asked to stop at a round boundary: nothing failed, nothing is discarded.
+        'stopped': ['You stopped the run. Nothing is discarded: the work on disk stands, and a resume re-enters this step.',
+          ['resume (the same run continues)', 'abandon the task']],
         // F66 — the STALL WATCHDOG gave up: no round completed for the stall window,
         // three times over, and reissuing the call did not recover it. It borrows both
         // siblings' rules. Like `step-variance`, the caller reads this category and

package/src/replay.js

@@ -103,7 +103,8 @@
 
 import { runBehaviour, formatBehaviour } from './behaviour.js';
 import { shortSha } from './codeversion.js';
-import { SPEND_RECORD_TYPES } from './ledger.js';
+import { SPEND_RECORD_TYPES, chainSpend } from './ledger.js';
+import { legsOf } from './legs.js';
 
 /**
  * @param {unknown} e
@@ -167,6 +168,24 @@ export function auditWindow(jobStart, jobEnd) {
   };
 }
 
+/**
+ * One window PER LEG of a (possibly resumed) run (P5-R) — the ONE owner the panel and {@link replayRun} share. A
+ * run with no `leg-resume` marker is one leg and this is `[auditWindow(jobStart, jobEnd)]`, exactly as before. A
+ * resumed run's quiet time between two legs is nobody's, so a row another run wrote into a shared sidecar during it
+ * is outside every window; a leg that recorded no terminal (it died) ends where the next leg begins.
+ * @param {any[]} spineRecords
+ * @returns {{startTs: number, endTs: number}[]}
+ */
+export function auditWindowsOf(spineRecords) {
+  const legs = legsOf(spineRecords);
+  if (legs.length <= 1) {
+    const jobStart = spineRecords.find((e) => e && e.type === 'job-start') ?? null;
+    const jobEnd = legs.at(-1)?.jobEnd ?? null;
+    return [auditWindow(jobStart, jobEnd)];
+  }
+  return legs.map((l, i) => auditWindow(l.jobStart ?? l.start, l.jobEnd ?? (legs[i + 1]?.start ? { ts: legs[i + 1].start.ts } : null)));
+}
+
 /**
  * Trim a string to `max` chars with an explicit `…[+N chars]` marker —
  * NEVER a silent truncation, and never a trailing ellipsis alone
@@ -422,8 +441,14 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     else skipped += 1;
   }
 
+  // P5-R: a resumed run is ONE spine of several legs (src/legs.js `legsOf`, the one owner of the boundaries).
+  // `jobStart` is the run's FIRST (its start, its drafting fold); `latestStart` the latest leg's (the caps it ran
+  // under now); `jobEnd` the run's terminal — the LAST leg's, never an earlier leg's. A spine with no marker is
+  // one leg and every figure below reads exactly as it always did.
+  const legs = legsOf(spine);
   const jobStart = spine.find((e) => e.type === 'job-start') ?? null;
-  const jobEnd = spine.findLast((e) => e.type === 'job-end') ?? null;
+  const latestStart = legs.at(-1)?.jobStart ?? jobStart;
+  const jobEnd = legs.at(-1)?.jobEnd ?? null;
 
   // F195 fix: a gate-audit sidecar CAN be shared across several runs whose
   // spines happen to reuse the same filename (measured on a real archived
@@ -441,10 +466,10 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // (`src/panel/server.js`) calls this same {@link auditWindow} rather than
   // keeping its own copy.
   {
-    const { startTs, endTs } = auditWindow(jobStart, jobEnd);
+    const windows = auditWindowsOf(spine);
     audit = audit.filter((a) => {
       const t = parseTs(a.ts);
-      return t !== null && t >= startTs && t <= endTs;
+      return t !== null && windows.some((w) => t >= w.startTs && t <= w.endTs);
     });
   }
 
@@ -460,8 +485,12 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // and the wall-halt sites (src/planrun.js:2990,3208-3209).
   const stopReason = isGreen ? null : buildStopReason(lastEscalation, outcome);
 
-  const spentUsd = jobEnd && typeof jobEnd.spentUsd === 'number' && Number.isFinite(jobEnd.spentUsd) ? jobEnd.spentUsd : null;
-  const spendComplete = jobEnd ? jobEnd.spendComplete === true && spentUsd !== null : false;
+  // MONEY, one basis (P5-R): a one-leg spine reads its terminal's own total as it always did; a resumed run's
+  // legs are summed by each leg's own spend (`chainSpend`), never the last terminal's chain total on top of them
+  const chain = legs.length > 1 && jobEnd ? chainSpend(spine) : null;
+  const spentUsd = chain ? chain.usd
+    : (jobEnd && typeof jobEnd.spentUsd === 'number' && Number.isFinite(jobEnd.spentUsd) ? jobEnd.spentUsd : null);
+  const spendComplete = chain ? chain.complete : (jobEnd ? jobEnd.spendComplete === true && spentUsd !== null : false);
 
   // draftSpentUsd (hamr's ruling 2026-09-28, "one cap covers drafting +
   // run") — the AUTHORING pipeline's own spend on this job before it was
@@ -480,9 +509,28 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // exact then, the field simply didn't exist yet to say so.
   const draftSpendComplete = draftSpentUsd === null ? null
     : (jobStart.draftSpendComplete !== false);
-  const floorReasonList = floorReasons(spine, jobStart, spendComplete);
-
-  const wallMs = windowWallMs(parseTs(jobStart?.ts), parseTs(jobEnd?.ts));
+  const floorReasonList = floorReasons(spine, legs.map((l) => l.jobStart).find((j) => j?.priorSpendComplete === false) ?? jobStart, spendComplete);
+
+  // WALL: the sum of each leg's own working window, the gap between legs excluded (hamr 2026-10-02, 2A). A
+  // leg that died has no terminal, so its window ends at its last record (a floor); the LATEST leg without a
+  // terminal is unknown, as a one-leg run without one always was.
+  /** @param {import('./legs.js').Leg} l @param {boolean} isLast */
+  const legWallMs = (l, isLast) => {
+    const a = parseTs((l.jobStart ?? l.start)?.ts);
+    const b = l.jobEnd ? parseTs(l.jobEnd.ts) : (isLast ? null : parseTs(l.end?.ts));
+    return windowWallMs(a, b);
+  };
+  const wallMs = legs.length > 1
+    ? (() => {
+      let sum = 0;
+      for (let i = 0; i < legs.length; i += 1) {
+        const w = legWallMs(legs[i], i === legs.length - 1);
+        if (w === null) return null;
+        sum += w;
+      }
+      return sum;
+    })()
+    : windowWallMs(parseTs(jobStart?.ts), parseTs(jobEnd?.ts));
 
   // chainClock: the SIGNED wall, read off the run's own clock record —
   // src/planrun.js:1203 (`wall-clock`) or `emitWallHalt` (src/planrun.js:1269)
@@ -556,7 +604,7 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // record at all (resumed before any plan reload was needed); keying
   // "resumed" on resume-seed alone would have printed `resumed: no` on
   // genuinely resumed runs and mis-explained their spend.
-  const resumed = !!jobStart && 'priorSpentUsd' in jobStart;
+  const resumed = legs.length > 1 || (!!jobStart && 'priorSpentUsd' in jobStart);
 
   // resumeSeed: the DETAIL fields (phase/completed/skipping/divergence) —
   // present only on the narrower resume-seed record; `resumed` above stays
@@ -582,7 +630,8 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   const totalRoundsInFile = spendRecords.length;
   const unpricedRoundsInFile = spendRecords.filter((r) => !(typeof r.costUsd === 'number' && Number.isFinite(r.costUsd))).length;
   const summedRounds = spendRecords.reduce((acc, r) => (typeof r.costUsd === 'number' && Number.isFinite(r.costUsd) ? acc + r.costUsd : acc), 0);
-  const hasEngagementField = jobEnd && typeof jobEnd.engagementSpentUsd === 'number' && Number.isFinite(jobEnd.engagementSpentUsd);
+  // (a resumed run's terminal carries only its LATEST leg's engagement — its file's figure is the sum of the rounds)
+  const hasEngagementField = legs.length <= 1 && jobEnd && typeof jobEnd.engagementSpentUsd === 'number' && Number.isFinite(jobEnd.engagementSpentUsd);
   const thisFileSpend = {
     value: unpricedRoundsInFile > 0 ? null : (hasEngagementField ? jobEnd.engagementSpentUsd : summedRounds),
     source: /** @type {'engagementSpentUsd'|'summed rounds'} */ (hasEngagementField ? 'engagementSpentUsd' : 'summed rounds'),
@@ -664,18 +713,38 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
 
   const usedEndSeqs = new Set();
   const idOccurrence = new Map();
+  /** @type {Map<string, {stopReason: string|null, legIdx: number, tryNumber: number}>} */
+  const prevOccurrence = new Map();
 
   const steps = stepStarts.map((ss) => {
     const id = ss.step;
     const startSeq = typeof ss.seq === 'number' ? ss.seq : -Infinity;
     const startTs = parseTs(ss.ts);
 
+    // P5-R: a step belongs to ONE leg. Its `step-end` is the first one inside ITS OWN leg (never a later leg's
+    // `step-end` for the same id), and a step its leg's halt cut off ends where that leg ends — otherwise its
+    // window runs across the idle gap to the next leg and counts the gap as its time.
+    const myLegIdx = legs.length > 1 ? legs.reduce((acc, l, i) => (typeof l.start?.seq === 'number' && startSeq >= l.start.seq ? i : acc), 0) : 0;
+    const myLeg = legs.length > 1 ? legs[myLegIdx] : null;
+    const legEndSeq = legs.length > 1 && myLegIdx < legs.length - 1 && typeof legs[myLegIdx + 1].start?.seq === 'number' ? legs[myLegIdx + 1].start.seq : Infinity;
     const end = stepEnds
-      .filter((se) => se.step === id && typeof se.seq === 'number' && se.seq >= startSeq && !usedEndSeqs.has(se.seq))
+      .filter((se) => se.step === id && typeof se.seq === 'number' && se.seq >= startSeq && se.seq < legEndSeq && !usedEndSeqs.has(se.seq))
       .sort((a, b) => a.seq - b.seq)[0] ?? null;
     if (end) usedEndSeqs.add(end.seq);
-    const endSeq = end && typeof end.seq === 'number' ? end.seq : Infinity;
-    const endTs = end ? parseTs(end.ts) : null;
+    const cutByLeg = !end && myLeg !== null && Number.isFinite(legEndSeq);
+    const endSeq = end && typeof end.seq === 'number' ? end.seq : (cutByLeg ? legEndSeq : Infinity);
+    const endTs = end ? parseTs(end.ts) : (cutByLeg ? parseTs(myLeg?.end?.ts) : null);
+    // why this leg stopped the step (code-owned words); null for a step that ended itself or is still running
+    /** @type {string|null} */
+    let stopReason = null;
+    if (!end && myLeg !== null) {
+      const o = myLeg.outcome;
+      const isLastLeg = myLegIdx === legs.length - 1;
+      if (cutByLeg || (isLastLeg && o !== null && o !== 'green' && o !== 'already-green')) {
+        stopReason = o === 'cap-halt' ? 'money cap' : o === 'wall-halt' ? 'time cap' : o === 'provider-red' ? 'provider failed'
+          : o === 'step-stalled' ? 'step stalled' : o === 'stopped' ? 'you stopped it' : o === null ? 'died' : o;
+      }
+    }
 
     const phaseTag = `step:${id}`;
     // `judge-round` (a close's paid seam) carries no `.phase` at all
@@ -753,10 +822,17 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     }
 
     idOccurrence.set(id, (idOccurrence.get(id) ?? 0) + 1);
+    // the SAME step continuing across a leg boundary (the previous occurrence of this id was cut off by its leg's
+    // halt, and this one starts in a later leg) is "continued", never a retry; `tryNumber` counts real retries only
+    const prevOcc = prevOccurrence.get(id) ?? null;
+    const continued = myLeg !== null && prevOcc !== null && prevOcc.stopReason !== null && prevOcc.legIdx < myLegIdx;
+    const tryNumber = prevOcc === null ? 1 : (continued ? prevOcc.tryNumber : prevOcc.tryNumber + 1);
+    prevOccurrence.set(id, { stopReason, legIdx: myLegIdx, tryNumber });
 
     return {
       id,
       occurrence: idOccurrence.get(id),
+      ...(myLeg === null ? {} : { stopReason, continued, tryNumber }),
       outcome: end ? (end.outcome ?? null) : null,
       ...buildOccurrenceMetrics(startSeq, startTs, endSeq, endTs, roundsInWindow),
       checks: { passed, failed },
@@ -1241,7 +1317,10 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
         spentUsd: step.spentUsd,
         unpricedRounds: step.unpricedRounds,
         outcome: step.outcome,
-        attempts: stepAttempts,
+        // P5-R (resumed runs only): why its leg's halt cut this step off, whether it is the same step continuing
+        // from the leg before, and its retry count not counting continuations
+        ...(step.stopReason === undefined ? {} : { stopReason: step.stopReason, continued: step.continued, tryNumber: step.tryNumber }),
+        attempts: step.stopReason ? stepAttempts.map((a) => (a.outcome === null || a.outcome === undefined ? { ...a, outcome: 'stopped' } : a)) : stepAttempts,
       });
     }
 
@@ -1321,6 +1400,32 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     }
   }
 
+  // P5-R: which LEG each part belongs to, and where a resume picked up — only for a resumed run (a spine with
+  // no marker keeps its parts byte-for-byte). A step part is dated by its own step-start; a replan by its
+  // marker; every other part by the end of its last attempt (its own window's far edge), falling back to the
+  // near edge, then to leg 1. `resumedNext` marks the part a leg ENDED at: the next part is the leg after.
+  if (legs.length > 1) {
+    /** @param {number|null|undefined} seq */
+    const legOfSeq = (seq) => {
+      let n = 1;
+      if (typeof seq !== 'number' || !Number.isFinite(seq)) return n;
+      for (const l of legs) if (typeof l.start?.seq === 'number' && seq >= l.start.seq) n = l.leg;
+      return n;
+    };
+    for (const p of parts) {
+      const atts = Array.isArray(p.attempts) ? p.attempts : [];
+      const finiteEnds = atts.map((a) => a.endSeq).filter((v) => typeof v === 'number' && Number.isFinite(v));
+      const firstStart = atts.length ? atts[0].startSeq : null;
+      if (p.kind === 'step') p.leg = legOfSeq(firstStart);
+      else if (p.kind === 'replan' && typeof p.markerSeq === 'number') p.leg = legOfSeq(p.markerSeq);
+      else if (finiteEnds.length) p.leg = legOfSeq(Math.max(...finiteEnds));
+      else p.leg = legOfSeq(firstStart);
+    }
+    // legs never go backwards along the part list (a part is dated by file order)
+    for (let i = 1; i < parts.length; i += 1) if (parts[i].leg < parts[i - 1].leg) parts[i].leg = parts[i - 1].leg;
+    for (let i = 0; i < parts.length - 1; i += 1) if (parts[i + 1].leg > parts[i].leg) parts[i].resumedNext = true;
+  }
+
   return {
     runId,
     job: jobStart?.job ?? null,
@@ -1359,8 +1464,9 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     // escalation happen at all"). `summarizeForAllLine`'s `reason` column
     // needs the latter question answered unconditionally.
     lastEscalation,
-    budgetUsd: jobStart && typeof jobStart.budgetUsd === 'number' && Number.isFinite(jobStart.budgetUsd) ? jobStart.budgetUsd : null,
-    specHash: typeof jobStart?.specHash === 'string' ? jobStart.specHash : null,
+    // the caps and the spec the run's LATEST leg ran under (a resume may run under a re-signed hash)
+    budgetUsd: latestStart && typeof latestStart.budgetUsd === 'number' && Number.isFinite(latestStart.budgetUsd) ? latestStart.budgetUsd : null,
+    specHash: typeof latestStart?.specHash === 'string' ? latestStart.specHash : null,
     branch,
     outcome,
     stopReason,
@@ -1375,6 +1481,17 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     chainClock,
     resumed,
     resumeSeed,
+    // P5-R — the run's legs in order (always at least one for a spine with records): the panel's Audit divider and
+    // map connector read these, never re-derive a boundary. `startSeq`/`endSeq` bound the leg on the one `seq` series.
+    legs: legs.map((l) => ({
+      leg: l.leg,
+      after: l.after,
+      outcome: l.outcome,
+      startTs: typeof l.start?.ts === 'string' ? l.start.ts : null,
+      endTs: typeof l.end?.ts === 'string' ? l.end.ts : null,
+      startSeq: typeof l.start?.seq === 'number' ? l.start.seq : null,
+      endSeq: typeof l.end?.seq === 'number' ? l.end.seq : null,
+    })),
     thisFileSpend,
     // spendMismatch: a NON-resumed run's own `job-end.spentUsd` IS this
     // file's whole spend (no fold to explain a gap) — so on a cold run,
@@ -1684,7 +1801,10 @@ export function formatReplay(summary) {
     ? `this file unknown (${tf.unpricedRounds} of ${tf.totalRounds} rounds unpriced; ${tf.source})`
     : `this file ${money(tf.value)} (${tf.totalRounds} round${tf.totalRounds === 1 ? '' : 's'}, all priced; ${tf.source})`;
   let spentLine;
-  if (summary.resumed) {
+  if (summary.legs.length > 1) {
+    // one run, several legs on ONE file: one figure (each leg's own spend, summed), never two bases side by side
+    spentLine = `spent:   ${money(summary.spentUsd)}${summary.spentUsd !== null && !summary.spendComplete ? ' (floor, not exact)' : ''} over ${summary.legs.length} legs of one run · of ${money2(summary.budgetUsd)} signed`;
+  } else if (summary.resumed) {
     spentLine = `spent:   ${money(summary.spentUsd)} chain total (job-end; prior legs folded) · ${thisFileText} · of ${money2(summary.budgetUsd)} signed`;
   } else {
     spentLine = `spent:   ${money(summary.spentUsd)}${summary.spentUsd !== null && !summary.spendComplete ? ' (floor, not exact)' : ''} of ${money2(summary.budgetUsd)} signed`;
@@ -1705,7 +1825,7 @@ export function formatReplay(summary) {
       ? ` · floor because: ${summary.floorReasons.join(', ')}`
       : ' · floor (reason not in spine)';
   }
-  spentLine += ` · wall ${duration(summary.wallMs)} (this file)`;
+  spentLine += ` · wall ${duration(summary.wallMs)} (${summary.legs.length > 1 ? 'working time, gaps between legs excluded' : 'this file'})`;
   if (summary.chainClock) {
     const { elapsedMs, requestedMs, source } = summary.chainClock;
     const signed = typeof requestedMs === 'number' ? `${duration(requestedMs)} signed` : 'no wall signed';