bareloop 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.35.0] - 2026-10-05
+
+### Added
+
+- **One run = one id (resume).** A resume now continues the SAME run: one runid, one spine file, a `leg-resume` marker opens each new leg (`legsOf` is the one owner of leg boundaries). Outcome is the last leg's, money is each leg's own spend summed once, wall is the sum of leg windows with the gap between legs excluded. The run list keeps one row; the panel shows one card (`resumed xN`), an Audit leg divider, and a dotted map connector. Resume readers (`readResume`, pause age gate, `deathAtOf`) read the latest leg.
+- **Panel Stop.** `POST /api/runs/:runid/stop` writes a stop request that is read at the round boundary where the money cap binds (not between steps), so a one-step run can be stopped. The leg ends as the resumable outcome `stopped` (`stopped` joins the checkpoint outcomes); resume re-enters the cut step. The page says "stopping after this turn...".
+- **Panel Resume.** `POST /api/runs/:runid/resume`, a Resume mode on the run's Job tab where only the money and time caps are inputs ("Money cap ($)", "Time cap (min)", Sign & resume). Changed caps write `resolved-spec-r<k>.json` beside the original. A cap at or below what is already spent or used is refused at $0.
+- **Ended block.** Every finished run carries one code-owned reason / next line (`ended` on the run detail, `endedLine` on the run list), shown on the Audit tab and under the job name on the card. Resume is listed only when the engine would accept it; a strike-governor cap-halt is no longer read as the money cap.
+- **Reuse workflow.** Green runs (and imported jobs) offer [Reuse workflow] in the Run tab's top action row: the origin's signed spec is copied and only five boxes are open (Source, Destination, money cap, time cap, Model; the server refuses any other change). `workflowKey(spec)` identifies "the same job" (signed spec without source, destination, budget, wall, provider/model; `jobSpecHash` untouched). The estimate line reads "Same job - G green - N not green - about $X and M min a run", with unknown said, never rendered as $0. Red rows say "Change the job: + New."
+- **Read-only Import.** A guarded folder browser (`GET /api/fs/list`, folders only, no symlinks, depth-3 search for job bundles, remembers the last folder), `POST /api/imports`, `GET /api/imports[/:id]`, rows in `<home>/imports.jsonl`, re-read on every view ("changed since import", "folder not found"). An imported job opens in the normal Run / Audit / Job tabs: an IMPORTED box, then the SUMMARY and MAP of its latest green run (from the bundle's spine, else its bridge, else "no green run in this bundle"). Reuse re-verifies the bundle and every close stage's signed bytes at the moment of reuse; the person signs it here. Re-importing a folder updates its one row.
+- **Runs list.** Runs/workflows first, imported jobs below; one code-owned status table (sign to word) read by run cards, expanded rows, the header, imported rows and MAP step cards; step names as written; Audit step rows wear the Run tab's sign and word.
+- **Monthly claims.** Settled per leg: a resumed run stays one listed row and only the leg's claim is released.
+- **Chat panel rework.** One chronological progress list (every pipeline step is one line that updates in place; a resumed step appends a new line; detail on its own line; one drafting line carrying model and cap), sitting under the thread above the ask box and auto-scrolling when it changes while live. One wide main button whose wording follows the moment (Start drafting / Sign & run / Check again / Send / Sign & run). The Chat tab always opens on an empty job card with Clear (or Abandon while a session is live and unsigned) on the card; `+ New` is gone. Ask box is a wrapping textarea (Enter sends, Shift+Enter is a newline) dimmed until there is something to reply to; job-card free-text boxes wrap and auto-grow; focused field gets the accent border. The card is fully locked while a drafting session is live.
+- **`POST /api/author/:id/abandon`** ends a live authoring session: terminal phase `abandoned`, releases the one-at-a-time lock, keeps booked drafting spend, books an in-flight call's usage, starts no new model call.
+- **`GET /api/author/live`**: a refreshed Chat page re-attaches to the one live authoring session (reuse included), card refilled from the session's own copy.
+- **Run summary** counts steps, not parts (a stopped-then-continued step is one step); a halted step's time stops at its leg's end.
+
+### Fixed
+
+- **F122 2A (b):** a step worker round cut at `max_tokens` (`truncated:max_tokens`) is now a failed attempt on the strike ladder, not provider-red; the same holds for the close-fix loop (the cut round is discarded, its spend stays booked, the next fix prompt carries a cut-off note). Scout, drafter and replan keep provider-red.
+- **F212:** a single-file `writeScope` is now seen by the tree snapshot, so `tree-changed` no longer reads 0 files changed when the worker edited that file.
+- **F213:** drafting spend of an authoring session that never became a run is booked (`draft-spend.json` written after every metered call, counted by the monthly and Money readers, attributed by start time).
+- Authoring refusals at $0: a repo source's absolute Destination is refused before any model call (one rule for the fresh and Reuse card; a repo Destination is the write fence); the non-repo refusal names what the door found (single file / plain folder / other); the reuse refusal names the provider in plain words.
+- A dead panel token (server restarted) shows one reload line and stops the Chat poll; a session's refusal is recorded once, in the progress line only.
+- Panel: a live run headline no longer reads `undefined` for wall time; a run with no spine yet reads "starting..."; live cards carry the same money/time floors as the right pane; Ended reasons are plain words with no raw engine detail; the IMPORTED box names the run behind each exported-history price; Providers keys-file path is never a hardcoded guess.
+
+### Changed
+
+- Tests that spawn a real runner take HOME and keys from a scratch dir (`cleanEnv()`), and pause/checkpoint fixtures are relative to today (the 60-day pause TTL expired a literal 2026-08-04 date). Test-only.
+- Small refactors: one spelling of the panel bind address in the Host and Origin guards; judge-round `rateSource` uses the one `rateSourceFields` helper; `monthly.js` header describes the held-money refusal form.
+
 ## [0.34.0] - 2026-10-01
 
 ### Fixed

package/bareloop.context.md

@@ -1112,7 +1112,9 @@ from ralph's shipped `runClose` because one runs a DECLARATION and the other an
 
 The shell's own fixed code for the closed exit menu — nothing here executes
 agent-authored text. `snapshotScope` hashes every file under a scope prefix (the
-"before" side of `tree-changed`; a missing dir snapshots empty). `evalExits` is AND-only
+"before" side of `tree-changed`; a missing dir snapshots empty; a scope whose prefix names a single
+regular FILE — a file-valued `writeScope` becomes `src/x.js/**` — snapshots that one file, keyed by the
+prefix, F212: a readdir on a file used to read as an empty tree forever). `evalExits` is AND-only
 and never short-circuits — the result names EVERY failing wall (`{ pass, results }`,
 each result `{ type, pass, detail?, fault? }`). `tree-changed` reads OUTCOME (bytes vs
 the snapshot): an identical re-write is NOT a change (F43) and git status is never
@@ -1229,7 +1231,7 @@ known-answer round-trip before tokens: `smoke-red` — a silent degradation thro
 
 Outcomes: `green | already-green | escalated | unapproved-spec | job-red | smoke-red |
 plan-red | check-red | close-red | close-unsupported | recipe-stale | branch-red | pricing-red |
-provider-red | interpreter-red | cap-halt | wall-halt | step-stalled |
+provider-red | interpreter-red | cap-halt | wall-halt | stopped | step-stalled |
 step-red:<id> | runner-drained`.
 
 **`runner-drained` (F140/PRD item 28(c))** is a distinct class from every outcome above: it is
@@ -1380,9 +1382,13 @@ ambiguity, not a merge. `resolveHumanRuling(fresh, held)` is the exported seam t
 `branch-red` is the WORK BRANCH refusing (below): the patient is not a git checkout, its
 branch namespace has no free name, or a resume's recorded branch is gone. Zero tokens, and
 never a fallback to working on the branch the run was handed. `provider-red` is a
-transport throw or a worker round the API cut off mid-generation (`truncated:max_tokens`,
-BA-6 — before which it laundered into a clean finish, F25): no verdict exists and the failed
-round's spend is only partly known (F6). `cap-halt` is the wallet; `wall-halt` is the clock
+transport throw, or a scout/drafter/replan round the API cut off mid-generation
+(`truncated:max_tokens`, BA-6 — before which it laundered into a clean finish, F25): no
+verdict exists and the failed round's spend is only partly known (F6). A STEP or FIX-loop
+worker round cut at `max_tokens` is NOT provider-red (F122 "2A" half b, hamr 2026-10-05, fix
+phase added by ruling A): it is a failed attempt — the round is booked, its output discarded,
+an `attempt-bounded` record carries the reason `output cut at the token limit (max_tokens)`,
+and the step's strike ladder (or the fix governor) applies as for any failed attempt. `cap-halt` is the wallet; `wall-halt` is the clock
 (F64 — a timeout derived from the run's own deadline is a governance stop, never a transport
 casualty). **`cap-halt` reaches you from the close-fix loop too, not only from a step:** the
 shell spells exhaustion (strikes on a step, and — since v1.46 — strikes in the fix loop as
@@ -2320,6 +2326,47 @@ watchdog `--wall-ms 0`, which it defaulted to `null` and armed no deadline at al
 still advertising one. The refusal names the lever: raise `maxWallMs`, which moves the spec hash
 and is re-signed.
 
+**A resume is the SAME run — one runid, one spine file, a `leg-resume` marker inside (P5-R, hamr
+2026-10-02: "one run, one id, one file").** `bareloop run-u --resume <runid|path>` and `bareloop run
+<bundle> --resume <runid>` never mint a new id and never open a second file: the new leg APPENDS to the
+halted run's own spine (`u-<runid>.jsonl`, or `<bundleDir>/runs/<runid>/spine.jsonl`).
+- **The leg's first record is `leg-resume {leg: N, after, at}`** — `after` is how the previous leg ended
+  (its `job-end` outcome, `'died'` when it recorded none) — written BEFORE the outside watchdog spawns (the
+  watchdog judges a run dead by its file going quiet). `seq` continues from the file's own highest
+  (`makeSpine(file, {startSeq})`). Then the leg's own `job-start`, which keeps the declared fold
+  (`priorSpentUsd`/`priorWallMs`/…): the budget ceiling still folds prior spend.
+- **A torn tail is never edited.** If the file does not end in `\n` (a kill mid-append), the resume writes
+  ONE `\n` and starts a fresh line: the torn bytes stay exactly as they were, alone on their own line
+  directly before the marker. The spine is append-only forever.
+- **`legsOf(events)` (`src/legs.js`, internal — not exported from the package root) is the ONE owner of where
+  a leg starts and ends**, returning `{leg, start, end, records, jobStart, jobEnd, outcome, after, startMs,
+  endMs}`; a spine with no marker (every run written before P5-R, and every run nobody resumed) is ONE leg.
+  `parseSpineText` tolerates exactly one torn line directly before a marker (and the file's own last two
+  lines); any other unparseable line is a corrupt log. Every reader goes through it: the resume reader
+  (`readResume` windows a direct spine at the latest leg that reached a `job-start`; `checkpointAgeGate` and
+  `deathAtOf` look only at the latest leg's terminal), `replayRun`, the monthly limit, the run list, the
+  panel, the end-of-run readout (this leg only), `bundlerun`'s history.
+- **Money has ONE basis per reader: the sum of each leg's own rounds** (`SPEND_RECORD_TYPES`, echoes
+  excluded; `legSpend`/`runSpend`/`chainSpend` in `src/ledger.js`) — never the rounds plus a declared prior,
+  so leg 1 is counted once. **Time is the sum of each leg's own window, the gap between legs excluded**
+  (only working time charges the wall). **The outcome is the LAST leg's.** A run is live iff its last leg has
+  no `job-end` and its runner is alive. An unknown figure reads as unknown / "at least", never as less.
+- **Side files are per leg.** The gate audit: leg 2+ APPENDS to `u-<runid>-gate-audit.jsonl` (never a
+  rename-overwrite). The watchdog's kill note: `<spine>.leg<N>.watchdog.json` for N ≥ 2 (`u-watchdog.mjs
+  --report <path>`; leg 1 keeps `<spine>.watchdog.json`). `.lag.jsonl` accumulates.
+- **The run list keeps ONE row per run.** A resume appends `{type:'leg-start', runid, leg, pid, capUsd, at}`;
+  `readRunList` folds it: the row's live `pid`/`capUsd` are the latest leg's, and it carries `leg`. `settled`
+  and `released` entries carry an optional `leg` (absent = leg 1): a later leg's `released` gives back THAT
+  leg's claim and never removes the run, and the monthly hold is taken per leg (`claimRun({leg})`; a
+  resumed leg's own earlier legs count as spent money, never as a hold).
+- **Refusals stay**: a run whose last leg is live (pid from the latest `leg-start`), a green run, or a
+  non-resumable terminal is refused. `bareloop run`'s `history.jsonl` writes one row per LEG
+  (`leg: N` from leg 2, no `resumedFrom`) and `run.json` is rewritten unchanged (same worktree, the run's
+  own start).
+- **Not covered by this ruling, and unchanged:** the review-door `rerun` (`--door <runid> --decide rerun`)
+  is a NEW run with a new runid (its door reader folds the answered run's chain spend); Reuse workflow in
+  the panel is a new run.
+
 **A pause checkpoint is answered on the same command line** (N4, 2026-08-12 §5.2 — the
 terminal is the v1 surface; the panel is N6's). The reference runner takes
 `--decide accept|rerun|pause` with `--text` for the rerun door, gated on the SAME
@@ -2997,8 +3044,8 @@ separate tarball step).
   README.md           the operator questions, in the order `bareloop run` asks them
   blessing.json        absent at export; written by the run that first greens it
   history.jsonl        absent at export; one line appended per `bareloop run` on this machine
-  runs/<runid>/        absent at export; one per run leg — spine.jsonl, gate-audit.jsonl, close/ (the
-                       close's books) and run.json ({runid, worktree, seed, repo, at, resumedFrom?})
+  runs/<runid>/        absent at export; one per RUN (a resume continues it) — spine.jsonl, gate-audit.jsonl,
+                       close/ (the close's books) and run.json ({runid, worktree, seed, repo, at})
 ```
 
 **`bundleHash`** = sha256 over the sorted `path:contentSha256` lines of exactly `spec.json`
@@ -3204,7 +3251,8 @@ key you want first (the panel picks the row by the Model menu).
      different from the recorded one is a stop, exit `1`, spending nothing; `--repo` is optional
      on a resume) and hands the engine `resumeRun` on that run's spine — the engine's own gates
      (checkpoint age, tree-at-seed, liveness) and spend fold apply, so `--budget` can never widen
-     a resume. The new leg gets its own `runs/<newid>/`. The resume command a halted leg prints carries that leg's own
+     a resume. The new leg appends to the SAME `runs/<runid>/spine.jsonl` behind a `leg-resume` marker
+     (P5-R): no new id, run dir or worktree. The resume command a halted leg prints carries that leg's own
      `--budget`/`--wall`, only if you passed them (a tightened ceiling never silently reverts to the signed
      one). After a MONEY halt the line does NOT repeat the exhausted `--budget` (chain spend is folded, so
      it would halt again at once); it prints `--budget <more than $<spent so far>, at most $<signed
@@ -3223,7 +3271,8 @@ key you want first (the panel picks the row by the Model menu).
      inputs); `--door`/`--decide`/`--review-door` are not exposed on `run`.
   8. `appendHistory` — one `history.jsonl` line off this leg's own `job-end`: `{ runid, at,
      outcome, spentUsd, spendComplete, budgetUsd, maxWallMs, worktree, branch, bundleHash,
-     approveHash, resumedFrom? }` (the `bundleHash` ↔ `approveHash` pairing, POC fact 2).
+     approveHash, leg? }` (the `bundleHash` ↔ `approveHash` pairing, POC fact 2; one row per LEG of the
+     one run — `leg: N` from the second leg, no `resumedFrom`).
      `spentUsd`/`spendComplete` are never fabricated as `0` when unknown. No `job-end` (a $0
      refusal, a crash) writes no row. A `green` outcome on a still-unblessed bundle also calls
      `bless(bundleDir, { bundleHash, runid, outcome, host })`.
@@ -3295,7 +3344,7 @@ key you want first (the panel picks the row by the Model menu).
   $0: no interview, no author, no run trigger, no key ever read. A row is `{ at, runid, job,
   spine, patient, via }` — `spine`/`patient` are always absolute paths (`patient: null` when
   not known, e.g. every `via:"backfill"` row: no spine record carries a run's workdir);
-  `via` is `'run-u'`, `'bundle'`, or `'backfill'`. `bareloop run-u` and `bareloop run` (the
+  `via` is `'run-u'`, `'bundle'`, or `'backfill'`. A RESUMED run is still one row: `readRunList` folds its `leg-start` entries into it (`leg`, and the latest leg's `pid`/`capUsd`; P5-R). `bareloop run-u` and `bareloop run` (the
   bundle path) each append their own row at run START, before the first paid call — a
   list-append failure is caught at both call sites and printed loudly to stderr
   (`WARNING: could not add this run to ~/.config/bareloop/runs.jsonl (…)`); the run itself
@@ -3385,9 +3434,17 @@ key you want first (the panel picks the row by the Model menu).
   never a reimplementation of any gate. `GET /api/author/model-check?model=<id>` is the $0 readiness probe the job card runs
   before Start (`checkProviderReachable`, `src/providers.js` — a models-list GET only, never a
   completion; the page sees the key's NAME and a status word, never the value). `POST
-  /api/author/:id/check-deps` is the install-gap's "Check again" (`phase:'install-needed'`:
+  /api/author/:id/check-deps` is the install-gap's "Check again" (the main button's wording while waiting on an install) (`phase:'install-needed'`:
   the session waits on the person's own install, then re-runs `missingDependencies` on the
-  same copy — bareloop never installs). `GET /api/author/:id` polls the session's state
+  same copy — bareloop never installs). `POST /api/author/:id/abandon` (the Chat card's **Abandon** button, 2026-10-05) ends a
+  LIVE, unsigned session: phase becomes the terminal `abandoned` (releasing the one-at-a-time lock), money already booked
+  stays booked (`draftSpentUsd` is never zeroed; a call in flight still books its usage), no NEW model call starts;
+  `400` on a session that is not live, `404` unknown id, same guard as the other author routes. After `signed` the card's
+  button reads **Clear** and only empties the card (a run is stopped from the Run tab). `GET /api/author/live` →
+  `{ok, sessionId, state}` of the ONE live (non-terminal) session, or `{sessionId:null, state:null}`: a refreshed page
+  re-attaches to it from the server's session map (nothing is stored page-side). A panel restart mints a new token and
+  loses the in-memory sessions: the page then shows one "reload this page" line and stops the Chat poll (no auto-reload;
+  drafting money already spent stays booked via `draft-spend.json`, below). `GET /api/author/:id` polls the session's state
   (phase, chat messages, cost, `revisesLeft`, `specHash` once prepared). `POST /api/author/
   :id/send {text}` answers whatever the confirm turn is currently asking (the `language` pick or a plan's
   own follow-up question — the old `worseThanBefore` ask is retired, 2026-09-28) — refused outright when the pending ask is the
@@ -3412,6 +3469,167 @@ key you want first (the panel picks the row by the Model menu).
   `signing.json`, the two files `bareloop author` itself already writes). Edit/re-sign, the
   `~/.config/bareloop/.env` keys-file loader, and Settings have landed (P4a/P4b — see "Settings" below).
 
+- **Panel P5 — the Ended block (`docs/product/PANEL-BUILD.md` Addendum 2026-10-02, item 1)** →
+  `GET /api/runs/:runid` carries `ended` = `{reason, next, line, actions:[{id,label}]}` for every
+  FINISHED run (green too; `null` while the run is live), and `GET /api/runs` carries `endedLine`
+  (the card's one short line under the job name, e.g. `money cap — resume`). Both come from ONE
+  code-owned function, `endedFor` (`src/panel/server.js`): fixed sentences keyed by the run's
+  outcome, with only
+  numbers and the engine's own recorded detail slotted in — never model text. The table:
+  green/already-green → "Goal met." (a `destination-refused` record turns it into "…the output
+  could not be delivered (detail)."); cap-halt → "Money cap reached ($X of $Y)." / "Raise the cap,
+  then Resume."; wall-halt → "Time cap reached."; provider-red → "The model provider failed
+  (detail)."; step-stalled → "A step stopped making progress."; plan-red/check-red/step-red/escalated
+  → "Goal not met — the checks said no (last gap)."; close-red → "The check itself broke
+  (instrument fault), not your goal."; `escalated` is a terminal and never resumable — its escalation of
+  category `cap-halt` with `spend.strikes` is the STRIKE governor, read "The fix loop stopped improving
+  (S of L tries, no check got better)." (card line `stopped improving`), and is the money cap ONLY when
+  the spine has a `money-halt` record or the job-end outcome is `cap-halt` itself; every other terminal → "Stopped before or outside the work
+  (code: <outcome>)." (never the raw engine detail — it can name retired surfaces; raw detail appears only as the quoted check gap on "goal not met" and the provider error, both capped at 120 characters; a destination-refused green reads "…could not be delivered." with no detail); a run with no `job-end` whose process is gone (glyph `?`, never `✗`) →
+  "Stopped with no ending recorded (last thing it did: …)." `actions` holds `resume` ONLY when
+  the engine would accept a resume (`resumePlanFor`: the same `readResume`/`CHECKPOINT_OUTCOMES`/
+  `checkpointAgeGate` readers the engine refuses with, plus a signed `resolved-spec.json` /
+  `resolved-spec-r<k>.json` beside the run whose hash is the one the run's `job-start` carries);
+  otherwise `next` says why Resume is not available. `resume` on the detail is
+  `{budgetUsd, maxWallMin, spentUsd, spendComplete}` (the confirm box's prefill) or `null`. The
+  result glyphs are unchanged. The reuse button is described under Reuse workflow, below.
+  **Status words (click-through 2026-10-04)** → every run row, run detail and imported row carries `status`
+  `{key, sign, word}` from ONE table (`src/panel/status.js`): `[▶] running · [·] waiting · [✓] passed · [✗] failed ·
+  [✗] capped · [✗] stopped · [?] died`; `glyph` is that sign. Mapping: green/already-green/satisfied → passed; no
+  job-end + runner alive → running, gone → died; cap-halt, wall-halt, and an escalation that is a money-halt or wall-halt
+  → capped; `stopped` → stopped; every other outcome (plan-red, check-red, step-red, close-red, provider-red,
+  step-stalled, other escalations, refusals) → failed. The detail also carries `startedAt` and `endedAt` (the last
+  `job-end` timestamp, null while live or died). `GET /api/imports` rows and `GET /api/imports/:id` carry `runStatus`
+  (passed, or null when the bundle shows no green) and `runReason` (`goal met`). The Ended block's lines for died and
+  stopped runs are `no ending recorded` and `you pressed Stop` (each `— resume` when Resume is offered).
+  **Resume (item 2)** → `POST /api/runs/:runid/resume` (`src/panel/runroutes.js`), behind
+  `checkHumanGuard` (token + own address, like `/api/author/*`); body `{budgetUsd?, maxWallMin?}`
+  (blank = the signed caps). `404` unknown run; `409` when `resumePlanFor` says the engine would
+  refuse (`Resume is not available for this run (why).`); `400` for a bad cap, a money cap at or below what is already spent (or a time cap at or below the time
+  used) — refused at $0 before any write or spawn — or the monthly $
+  limit (same library check and text as Sign & run). If a cap changed, the new spec is written as
+  `resolved-spec-r<k>.json` beside the original and its hash is approved; the signed spec the run
+  started under is never overwritten, and a run resumed under `r<k>` is resumed again under the
+  spec whose hash its `job-start` carries. The spawn is `setsid --wait systemd-inhibit node
+  bin/bareloop.mjs run-u --spec <spec> --resume <runid> --approve <hash>` (array argv, detached,
+  log `resume-<runid>-<ms>.log` beside the spec; `--draft-spent-usd`/`--draft-spend-incomplete`
+  ride along from the run's `job-start`, so the one cap still covers drafting). `--wait` hands back
+  the engine's own exit code: an exit inside the settle window (6s) is the engine's own refusal and
+  the log tail is returned as `error` verbatim; otherwise `{ok:true, runid, specHash, capsChanged,
+  log}`. The run keeps its runid and its one list row: the resumed leg appends to the same spine (P5-R,
+  `leg-start` in the run list), it never appears as a new run. The page's Resume button opens the
+  caps form (prefilled, "spent so far") and `Sign & resume` is the human click.
+  **Stop (item 5)** → `POST /api/runs/:runid/stop` (`src/panel/runroutes.js`, `checkHumanGuard`, no body).
+  It writes the run's STOP REQUEST, a file `<spine>.stop` (`stopFilePath(spine)`, `src/legs.js` — the one
+  spelling), and signals nothing. `404` unknown run; `409` when the run's LATEST leg is not live
+  (`runIsAlive`) or its spine does not exist yet (still starting). The ENGINE half is library code, so
+  CLI runs honour the file too (no new CLI command): `runJob`/`runPlan` take `stopFile`, and `run-u`/the
+  panel's spawn pass `<spine>.stop`. The seam is the ROUND BOUNDARY of a step worker — where the money cap binds
+  (`src/planrun.js`, the `metered` round callback): file present = delete it, emit `stop-requested
+  {phase, step, iteration, round}`, end the Loop after that round; `ask` then throws category `stopped`
+  and the step loop files it as job-end outcome `stopped` the way a mid-step cap-halt is filed
+  (`spendComplete` exact — nothing is in flight at a round boundary). One owner, one check: a one-step run
+  and a long step both stop within one turn. Resume re-enters that step. The request file is cleared three times: when honoured, when the
+  leg ends (`finally`), and at the start of the next leg (a click that raced a leg's end never stops a
+  resume). `stopped` is in `CHECKPOINT_OUTCOMES`: resumable like a `cap-halt`, the same run continues as a
+  new leg at the next step. `GET /api/runs/:runid` carries `live` and `stopping` (a stop request is on
+  disk and the leg is live); Ended row `stopped` = "You stopped it." / "Resume." / `[Resume]`, card line
+  `stopped — resume`, Audit divider `stopped: you stopped it · resumed <when>`. The page shows `[Stop]`
+  in the Run tab's action area while live, "stopping after this turn…" after the click, and the same
+  `[Resume]` there once the engine would accept one. The seam reads the file in STEP workers only
+  (`phase` `step:<id>`): the scout, plan and close-fix rounds never read it, so a Stop clicked while the run
+  is in one of those phases is not honoured until a step round runs again, and is otherwise cleared when
+  the leg ends — the money and time caps still bind throughout.
+  **Reuse workflow (replaces P5 item 3's Start from this, 2026-10-03)** — a button on GREEN runs only (the Run tab's
+  action row and the Ended block; `ended.actions` carries `{id:'reuse', label:'Reuse workflow'}` on green and
+  green-with-destination-refused rows, and on no other: a red row's next line is "Change the job: Clear the card and draft a new one.", and
+  stopped/capped/died rows offer `resume` only) and on every imported job. It opens the Chat tab's New job card
+  filled from the SIGNED job: a NEW run (new runid), never a rerun, nothing drafted ($0). **Only five boxes are
+  open — Source, Destination, Model, $ cap, Time cap**; every other box (check type, model, job name, goal, success,
+  guardrails, judge examples) is the signed workflow, greyed, and the SERVER refuses a start that changed one
+  (`400 "<Field> is locked on a reused workflow — Clear the card to change it"`; the page is never trusted).
+  Changing a locked box is Clear (the Chat card's top-right button), which drafts. Routes, behind `checkHumanGuard`:
+  `GET /api/author/start-from?runid=<id>` or `?import=<id>` → `{ok, origin, card, from:'signed job'|'imported job',
+  note, locked:[…], open:['source','destination','model','capUsd','maxWallMs'], specHash, workflowKey, trackRecord:{runs,
+  green, notGreen, live, finished, avgSpendUsd, avgWallMs}, line}` (`404` unknown, `409` with an `error` when
+  there is nothing to copy: no log, the run's signed job is not on disk, or an imported job that changed, lost its
+  dependency or no longer matches its signed bytes); `POST /api/author/start` accepts `startFrom: <runid>` or
+  `startFrom: {importId}` beside the card and answers `{ok, sessionId, reuse, state}`. The old
+  `POST /api/author/start-from-check` and the "Changed — new job" mode are gone. **Identity, two keys:** the
+  signature hash `jobSpecHash` is unchanged (it covers the caps and the write fence — what the person signs);
+  `workflowKey(spec)` (`src/job.js`, not exported from the package root) is a sha256 over the signed spec WITHOUT
+  `source`, `destination`, `writeScope`, `budgetUsd` and `maxWallMs` (`REUSE_OPEN_SPEC_FIELDS`) AND without `provider`,
+  `baseUrl` and `model` (`WORKFLOW_KEY_IDENTITY_FIELDS`; `jobSpecHash` still covers all of them). A reuse copies the
+  origin's signed spec, sets only `writeScope` (from Destination), `budgetUsd`, `maxWallMs` and the worker from the
+  chosen Model Name (`buildReuseSpec(origin, card, rows)`: `provider`; `baseUrl` when the row has one; `model` only
+  when the Name is not the provider's default tier — spelled as authoring spells it; a RUBRIC origin with no `judge`
+  first gets `judge` = its own resolved judge identity so the judge never follows the worker; an explicit judge is
+  kept; deterministic jobs get none), and signs under a
+  NEW `jobSpecHash` with the SAME `workflowKey` (the session refuses a spec whose key moved). Locked boxes carry the
+  signed values read by the Job tab's own readers. **Estimate line** above the card: "Same job — G green · N not
+  green · about $X and M min a run", from every LISTED run whose signed spec has the same `workflowKey` AND ran the same worker (provider + baseUrl + model) as the Model box now names — `GET /api/author/start-from?…&model=<Name>` recomputes it when the box changes; none = "Same job — no runs yet on this model" (one run =
+  one entry via `legsOf`; the averages read FINISHED runs with exact figures — spend from `chainSpend`, working time
+  from `legsWallMs`, resume gaps excluded); unknown is said ("no finished run yet to price or time", "cost not
+  recorded", "time not recorded"), never $0 or 0 min; no registry, no plan handover. **An imported job** (its provider is not forced: the chosen Settings row is the worker; a card with no matching row opens with no Name picked) is
+  re-verified at the moment of reuse — `readBundle` (the bundle hash covers every close script), `checkBundleDeps`,
+  and every close stage's signed sha256 against the bytes on disk over the spec with `$BARELOOP_BUNDLE` resolved to
+  the folder — then reused the same way; the close scripts stay in the verified folder (the engine re-verifies
+  their bytes at run start and before every close run). An operator-written command close has no declaration for
+  `prepareSigning` to ground (it refuses one by design), so that session's gate is the byte check, and the hash the
+  person signs at `[Sign & run]` is the spec's own. The ONE wide card button (below the message box; wording from `mainButtonFor`: Start drafting / Sign & run / Check again / Send / disabled) reads `Sign & run` on a Reuse card (one click: the page signs the
+  prepared hash as soon as the session reports `prepared`; the server re-checks it). `card.json` (the form text)
+  is still written beside `resolved-spec.json` when a session reaches `prepared`.
+  **The progress list (2026-10-04)** — `GET /api/author/:id` state carries `steps: [{id, label, status:
+  'running'|'done'|'failed', detail}]`, one entry per pipeline step in first-seen order, updated in place (ids/labels:
+  `STEP_LABELS`, `src/panel/authorsession.js`); `progressLabel` is the running step's label. A refusal sets
+  `state.error` and fails exactly one step with the same text as its `detail`; pipeline text is never a chat message
+  (`messages` holds person/model turns only). Two last steps, `hash` ("generating hash", detail `spec hash <full hash>`, done at sign-prepare) and `signed` ("signed hash", pushed by `signRun` when the sign is accepted); the old "SIGNING PREPARED" / "signed — … run starting detached" thread bubbles are gone. The page draws each step's `detail` on its own `> ` line under the step. Destination follows the Source: for a repo source it is the write
+  fence (relative `writeScope` globs, never proven as a directory); for a folder source an absolute directory. Both
+  are refused at $0, before any model call (the same rule on a fresh and a Reuse card): an ABSOLUTE
+  Destination on a repo source → `Destination must be a path inside the repo, like src/digest.js` (before the
+  copy); a source that is not a git repo → a plain refusal worded by the kind the source door recorded (a single
+  file: "Source must be the repo folder — put the file in Destination"; a plain folder or a URL: "not a code
+  project (no git repo found)").
+  **Import, read only (item 4)** — `src/panel/importroutes.js`. The Workflows toolbar's `[Import]` opens a folder
+  browser plus a paste box; an imported job is an exported bundle folder the person can LOOK at: nothing runs,
+  nothing is signed, the folder is never written. Routes, all behind `checkHumanGuard` (token + own address —
+  new disk exposure, so the strict guard, not the Host guard the plain GETs use): `GET /api/fs/list?path=`
+  → `{ok, requested, path, parent, bundle, entries:[{name, path, bundle:true}], truncated, stopped, visited, depth}`
+  (job BUNDLES only — a folder holding a regular file `manifest.json` — found by searching DOWN from `path` at most
+  `depth` = 3 folders; `name` is the path relative to `path`, `path` the absolute one; symlinks never followed,
+  `node_modules`/`.git`/dot-folders skipped, a bundle is never descended into, unreadable folders skipped silently;
+  capped at 5000 folders visited (`stopped`) and 200 bundles (`truncated`); starts at the home folder when `path` is blank);
+  `POST /api/imports {path}` → `{ok, id, job, dir}` (`readBundle` must come back clean — a plain or tampered
+  folder is `400` and records nothing); `GET /api/imports` (the list, every bundle RE-READ now) and
+  `GET /api/imports/:id` (one view). Imported list: `<home>/imports.jsonl`, one `{at, dir, job, bundleHash}` line
+  per FOLDER (a re-import replaces that folder's line; a file already holding duplicates lists once per real path, newest wins; mode 0600 in the 0700 config home); `id` = the first 12 hex of
+  sha256(real path). **Path safety:** the path is expanded (`~`, `~/…` only), refused if it holds a NUL byte, is
+  over 4096 bytes or is not absolute, then `resolve`d and `realpath`ed — the REAL folder is listed and recorded
+  and the response says which it chose (`path` beside `requested`); a non-directory is refused; a SYMLINK inside the
+  search is never listed and never followed; names only, never file contents. **Status, re-read on every list/view:** `ok`, `changed` ("changed since import",
+  red: a different/tampered/unreadable bundle) or `missing` ("folder not found"). The view carries goal,
+  `checkType`, `success` (the close stage names), `guardrails`, `budgetUsd`/`maxWallMs`, `model`, the history
+  the bundle shipped (`history:{greens,reds,total,recent}`, read from the bridges' history rows) and
+  `approved`/`approvedText` — approval on THIS machine is `verifyBlessing` (the first green run here writes
+  `blessing.json`): approved / not approved yet / stale. The row reads `imported · view only`; the view opens in
+  the same Run / Audit / Job tabs as any run (Audit: "no log — this job ran on another machine"), and its one
+  button, `[Reuse workflow]` in the Run tab's top action row, reuses the bundle's signed job as described above.
+  `GET /api/imports/:id` also carries `runsHere` (how many `runs/<runid>/` folders in the bundle hold a readable
+  `spine.jsonl`) and `run`, what the Run tab shows below the imported facts: `{kind:'spine', id, runid, at}` (the
+  newest run in the bundle's own `runs/` that ended green; `id` is `<importId>~<runid>`), else `{kind:'bridge', runid,
+  at, detail}` (the bridge's green version rendered as a run detail, fields the bridge does not carry left `null`),
+  else `{kind:'none'}`; never throws. **An imported bundle's run is served read only** through the ordinary run routes
+  under that composite id: `GET /api/runs/<importId>~<runid>` (detail), `…/audit` and `…/rounds` (and `…/job`) read
+  the spine inside the bundle (`importrun.js` `safeSpinePath`: a checked name, `lstat`ed, a link never followed); an
+  unknown import or run is `404`. Such a run is never in `GET /api/runs`, never live (`live`/`stopping` are false,
+  no pid), never resumable or stoppable from the panel.
+  **Run-card fixes (item 6)** → a listed run whose runner is alive but whose spine is not written
+  yet reads `starting: true` (list AND detail; glyph `▶`, every figure null, `fileMissing:false`) —
+  never `file missing`; a row whose runner is gone and whose spine is absent stays `fileMissing`.
+  `GET /api/runs` rows now carry `spendFloorUsd`/`wallFloorMs` for a LIVE spine too (previously died
+  only; both `null` once a `job-end` exists), the same `deriveDeath` floors the detail carries, so a
+  live card reads "$X so far · running Ym" exactly like the right pane.
+
 - **`bareloop run-u <flags…>`** (PANEL-BUILD.md P0 task 2/4) → the person-path run flow
   (the JOBS-table/`--spec` runner, resume, the review door — `docs/logs/FINDINGS.md`'s
   U-mode). `src/cli.js`'s `run-u` dispatch hands `rest` straight to
@@ -3509,7 +3727,8 @@ and leaves the worktree in place until the human removes it.
 
 **`history.jsonl` row shape** — one JSON object per line, one line per `bareloop run` on this
 machine: `{ runid, at, outcome, spentUsd, spendComplete, budgetUsd, maxWallMs, worktree,
-branch, bundleHash, approveHash }`. `bundleHash` is the bundle's own signed manifest hash
+branch, bundleHash, approveHash, leg? }` (`leg` only from a resumed run's second leg: the same `runid`,
+one row per leg). `bundleHash` is the bundle's own signed manifest hash
 (unchanged across tightened runs); `approveHash` is the hash of the actual, possibly-
 tightened, `$BARELOOP_BUNDLE`-resolved spec that run executed — the two are recorded side
 by side so a tightened run's real approval can never be confused with the bundle's headline
@@ -3585,6 +3804,15 @@ spends; the CLI prints it to stderr, exit 2) and at the panel's Sign & run (`sig
 same text under `#jf-cap-money` via `GET /api/author/monthly-check?cap=`. "This month" is the local
 calendar month; a died or incomplete-spend run makes the total an "at least" figure.
 
+*Drafting spend that never became a run* (2026-10-05, F213). A panel authoring session writes
+`<session dir>/draft-spend.json` (`{ sessionId, spentUsd, spendComplete, provider, baseUrl, model,
+startedAt, updatedAt }`, atomic) after every metered call, so an abandoned, refused or restarted session's
+drafting money is not lost. `readLegs` (hence `monthSpend`, `spendSummary`, `checkMonthlyRoom` and the Money
+tab) adds every `<home>/panel-sessions/<id>/` that has one and whose folder holds no listed run's `spine` or
+`patient` (a signed run already carries its drafting spend via `--draft-spent-usd`; no double count). It lands in
+the month of `startedAt` (the first call), under the provider row it was drafted on; `spendComplete: false` or an
+unreadable file makes the figure an "at least". It is not a run: no wall, not in the `runs` count.
+
 *Hold until done.* A run CLAIMS the limit when it starts and holds it until it is done — no lock file,
 records only. `claimRun` (`src/monthly.js`) writes the run's row FIRST (it carries its `pid` and
 `capUsd`), then reads `runs.jsonl`: earlier claims come first, and only the claims ABOVE its own row count

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",

package/src/bundlerun.js

@@ -23,6 +23,7 @@ import {
 } from './bundle.js';
 import { jobSpecHash } from './job.js';
 import { parseJsonl } from './replayio.js';
+import { legsOf } from './legs.js';
 import { startRun, resumeRun } from './userrun.js';
 
 /**
@@ -117,7 +118,9 @@ export async function bundleMain(args, {
   // after its own $0 refusals, so a refusal leaves no worktree behind. A RESUME is the one
   // exception: it re-enters the SAME worktree its halted run left (recorded in that run's
   // `run.json`), and a gone tree is a stop, never a silent fresh start.
-  const runid = now().toString(36);
+  // P5-R (hamr 2026-10-02: one run, one id, one file): a RESUME is the same run — same runid, same run dir, same
+  // spine; the engine appends the new leg to it. Only a fresh run mints an id.
+  const runid = resumeArg !== undefined ? resumeArg : now().toString(36);
   /** @type {string} */
   let repo;
   /** @type {string} */
@@ -126,6 +129,8 @@ export async function bundleMain(args, {
   let worktree;
   /** @type {string|null} */
   let deadSpine = null;
+  /** the run's own first-leg stamp, kept when a later leg rewrites `run.json` (it is the run's start, not the leg's) @type {string|null} */
+  let firstAt = null;
   if (resumeArg !== undefined) {
     if (!/^[a-z0-9]+$/.test(resumeArg)) { err(`--resume ${JSON.stringify(resumeArg)} is not a run id of this bundle`); return 1; }
     const deadRunJson = join(bundleDir, 'runs', resumeArg, 'run.json');
@@ -150,6 +155,7 @@ export async function bundleMain(args, {
     repo = rec.repo;
     seed = rec.seed;
     worktree = rec.worktree;
+    if (typeof rec.at === 'string') firstAt = rec.at;
     deadSpine = join(bundleDir, 'runs', resumeArg, 'spine.jsonl');
   } else {
     repo = resolve(cwd, /** @type {string} */ (repoArg));
@@ -189,7 +195,7 @@ export async function bundleMain(args, {
     }
     mkdirSync(runDir, { recursive: true });
     writeFileSync(join(runDir, 'run.json'), `${JSON.stringify({
-      runid, worktree, seed, repo, at: new Date(now()).toISOString(), ...(resumeArg === undefined ? {} : { resumedFrom: resumeArg }),
+      runid, worktree, seed, repo, at: firstAt ?? new Date(now()).toISOString(),
     }, null, 2)}\n`);
   };
 
@@ -227,7 +233,9 @@ export async function bundleMain(args, {
   // 7. history + (on a first green) the blessing — off THIS run's own spine, tolerant of
   // a torn line. No job-end (a $0 refusal, a crash) means no history row, as ever.
   const events = existsSync(spineFile) ? parseJsonl(spineFile).records : [];
-  const je = events.findLast((/** @type {any} */ e) => e.type === 'job-end');
+  // the LATEST leg's terminal: an earlier leg's job-end on the same file is a row already written for it
+  const legs = legsOf(events);
+  const je = legs.at(-1)?.jobEnd ?? null;
   if (!je) return engineCode;
   const outcome = je.outcome;
   const spentUsd = je.spentUsd ?? null;
@@ -246,7 +254,8 @@ export async function bundleMain(args, {
     branch,
     bundleHash: manifest.bundleHash,
     approveHash,
-    ...(resumeArg === undefined ? {} : { resumedFrom: resumeArg }),
+    // one row per LEG of the one run; the first leg's row keeps the shape it always had
+    ...(legs.length > 1 ? { leg: legs.length } : {}),
   });
   if (outcome === 'green' && !bundle.blessing) {
     bless(bundleDir, {

package/src/draftspend.js

@@ -0,0 +1,82 @@
+// Drafting spend that never became a run (self-review 2026-10-05, hamr's ruling A).
+//
+// A panel authoring session pays for model calls (survey, declaration, confirm turn) BEFORE any run exists.
+// That spend rode only in memory (`state.draftSpentUsd`) and reached disk when the session was signed and run
+// (`--draft-spent-usd` -> the run's spine). Abandon, a refusal, or a panel restart lost it, while the monthly
+// limit and the Money tab never counted it. So the session writes `<session dir>/draft-spend.json` after EVERY
+// metered call (one owner: the session's `onCall`, src/panel/authorsession.js), and the money readers
+// (`readLegs`, src/monthly.js) add every session folder that carries one and NEVER became a run.
+//
+// "Became a run" = some run-list row's `spine` or `patient` path sits inside that session's folder: a signed run
+// already carries its drafting spend through `--draft-spent-usd`, so counting the file too would double it.
+// Month attribution is the file's `startedAt` (the first metered call): fixed once written, so a session's
+// figure never moves between months as spend continues, the same start-date rule a run's leg uses.
+// `spendComplete: false` = "at least", never $0 (F6).
+import { existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join, resolve, sep } from 'node:path';
+import { readRunList, runlistHome } from './runlist.js';
+
+export const DRAFT_SPEND_FILE = 'draft-spend.json';
+
+/**
+ * @typedef {object} DraftSpend
+ * @property {string} sessionId
+ * @property {number} spentUsd the known floor of the session's drafting spend
+ * @property {boolean} spendComplete false = `spentUsd` is a floor ("at least")
+ * @property {string|null} provider the worker's provider shape (`anthropic-api` | `openai-api` | ...)
+ * @property {string|null} baseUrl
+ * @property {string|null} model
+ * @property {string} startedAt ISO, the first metered call
+ * @property {string} updatedAt ISO, the latest metered call
+ */
+
+/**
+ * (Re)write `<dir>/draft-spend.json` atomically (tmp + rename).
+ * @param {string} dir the session's folder
+ * @param {DraftSpend} rec
+ * @returns {void}
+ */
+export function writeDraftSpend(dir, rec) {
+  const file = join(dir, DRAFT_SPEND_FILE);
+  const tmp = `${file}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(rec, null, 2)}\n`);
+  renameSync(tmp, file);
+}
+
+/** @param {string} p @param {string} dir @returns {boolean} */
+const inside = (p, dir) => typeof p === 'string' && (resolve(p) === dir || resolve(p).startsWith(dir + sep));
+
+/**
+ * Every session folder's drafting spend that never became a run.
+ * @param {{ home?: string, sessionsRoot?: string }} [opts] `home` = the bareloop config dir (as everywhere in src/monthly.js); the sessions live in `<home>/panel-sessions` unless `sessionsRoot` names them
+ * @returns {DraftSpend[]}
+ */
+export function readOrphanDraftSpends(opts = {}) {
+  const root = resolve(opts.sessionsRoot ?? join(runlistHome(opts.home), 'panel-sessions'));
+  if (!existsSync(root)) return [];
+  /** @type {string[]} */
+  let names;
+  try { names = readdirSync(root); } catch { return []; }
+  const { rows } = readRunList({ home: opts.home });
+  /** @type {DraftSpend[]} */
+  const out = [];
+  for (const name of names) {
+    const dir = join(root, name);
+    const file = join(dir, DRAFT_SPEND_FILE);
+    if (!existsSync(file)) continue;
+    if (rows.some((r) => inside(r.spine, dir) || (r.patient && inside(r.patient, dir)))) continue;
+    try {
+      const j = JSON.parse(readFileSync(file, 'utf8'));
+      if (!j || typeof j !== 'object' || !Number.isFinite(j.spentUsd)) throw new Error('unreadable');
+      out.push({
+        sessionId: String(j.sessionId ?? name), spentUsd: j.spentUsd, spendComplete: j.spendComplete === true,
+        provider: typeof j.provider === 'string' ? j.provider : null, baseUrl: typeof j.baseUrl === 'string' ? j.baseUrl : null,
+        model: typeof j.model === 'string' ? j.model : null, startedAt: String(j.startedAt), updatedAt: String(j.updatedAt),
+      });
+    } catch {
+      // a file that names money but cannot be read is unknown spend: an "at least" of $0, dated unknown
+      out.push({ sessionId: name, spentUsd: 0, spendComplete: false, provider: null, baseUrl: null, model: null, startedAt: 'unreadable', updatedAt: 'unreadable' });
+    }
+  }
+  return out;
+}

package/src/exits.js

@@ -23,7 +23,7 @@
 //     unrunnable check is a stop, never a silent pass).
 
 import { createHash } from 'node:crypto';
-import { readFile, readdir } from 'node:fs/promises';
+import { readFile, readdir, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { globToPrefix } from './validate.js';
 
@@ -62,6 +62,15 @@ export async function snapshotScope(dir, scope) {
   const prefix = globToPrefix(scope);
   /** @type {Map<string, string>} */
   const snap = new Map();
+  // A scope whose prefix names a single regular FILE (a file-valued writeScope
+  // becomes `src/x.js/**`) snapshots that one file, keyed by the prefix itself —
+  // readdir on a file throws ENOTDIR, which read as an empty tree forever (F212).
+  try {
+    if ((await stat(join(dir, prefix))).isFile()) {
+      snap.set(prefix, createHash('sha256').update(await readFile(join(dir, prefix))).digest('hex'));
+      return snap;
+    }
+  } catch { /* missing or unreadable: fall through to the directory path */ }
   /** @type {string[]} */
   let entries;
   try {

package/src/interviewrun.js

@@ -743,7 +743,7 @@ export async function main(argv, deps = {}) {
     say(`It runs under the AUTHORING ceiling (${CEILING_USD === null ? 'UNBOUNDED — you gave no --budget' : `$${CEILING_USD}`}), which is not the job's $${draft.budgetUsd}.`);
     say('It stops at prepareSigning: it never signs, and it never runs the job.');
   } else {
-    say('NEXT — running run-author.mjs on this source stops right away, at $0: no scout, no confirm turn, no model call.');
+    say('NEXT — running bareloop author on this source stops right away, at $0: no scout, no confirm turn, no model call.');
     say('It never signs and never runs the job — bareloop has no checks for this kind of job yet.');
   }
   say('');
@@ -781,11 +781,11 @@ export async function main(argv, deps = {}) {
   if (!KEYED) {
     say('');
     if (providerEnvKey && keyProblem) {
-      say(`  (${providerEnvKey} is set but ${keyProblem} — run-author refuses without a clean key; secrets are never trimmed or repaired, only reported)`);
+      say(`  (${providerEnvKey} is set but ${keyProblem} — bareloop author refuses without a clean key; secrets are never trimmed or repaired, only reported)`);
     } else {
       say(providerEnvKey
-        ? `  (${providerEnvKey} is not set in this shell — run-author refuses without it; secrets load from the environment, never the tree)`
-        : `  (provider "${PROVIDER}" is not in the runnable table — run-author will refuse it loud; this is not a key problem)`);
+        ? `  (${providerEnvKey} is not set in this shell — bareloop author refuses without it; secrets load from the environment, never the tree)`
+        : `  (provider "${PROVIDER}" is not in the runnable table — bareloop author will refuse it loud; this is not a key problem)`);
     }
     // The repair, in plain words and WITHOUT a command: which secret store a person
     // keeps their key in is theirs, and printing one specific incantation would be
@@ -802,9 +802,9 @@ export async function main(argv, deps = {}) {
     : null;
   if (depsGapAtHandoff) {
     say('');
-    say(`  The copy still has no installed packages (${depsGapAtHandoff.reason}) — run-author would only instrument-stop on it.`);
+    say(`  The copy still has no installed packages (${depsGapAtHandoff.reason}) — bareloop author would only instrument-stop on it.`);
     say(`    cd ${prep.tree} && ${depsGapAtHandoff.command}`);
-    say('  then run run-author.mjs yourself with the command above.');
+    say('  then run bareloop author yourself with the command above.');
   }
   say('');
   // The default is NO, and it is the same lean the pause's doors take: the answer that
@@ -835,7 +835,7 @@ export async function main(argv, deps = {}) {
     say('');
     const child = spawnSyncFn(process.execPath, [BARELOOP_BIN, 'author', ...childArgs], { stdio: 'inherit' });
     if (child.error) {
-      say(`run-author could not be started (${child.error.message}) — the command above still stands.`);
+      say(`bareloop author could not be started (${child.error.message}) — the command above still stands.`);
       exitCode = 2;
     } else {
       // the child's own exit is the answer: a refusal there is a RESULT, and flattening