bareloop 0.34.0 → 0.36.0

package/src/replay.js

@@ -103,7 +103,8 @@
 
 import { runBehaviour, formatBehaviour } from './behaviour.js';
 import { shortSha } from './codeversion.js';
-import { SPEND_RECORD_TYPES } from './ledger.js';
+import { SPEND_RECORD_TYPES, chainSpend } from './ledger.js';
+import { legsOf } from './legs.js';
 
 /**
  * @param {unknown} e
@@ -167,6 +168,24 @@ export function auditWindow(jobStart, jobEnd) {
   };
 }
 
+/**
+ * One window PER LEG of a (possibly resumed) run (P5-R) — the ONE owner the panel and {@link replayRun} share. A
+ * run with no `leg-resume` marker is one leg and this is `[auditWindow(jobStart, jobEnd)]`, exactly as before. A
+ * resumed run's quiet time between two legs is nobody's, so a row another run wrote into a shared sidecar during it
+ * is outside every window; a leg that recorded no terminal (it died) ends where the next leg begins.
+ * @param {any[]} spineRecords
+ * @returns {{startTs: number, endTs: number}[]}
+ */
+export function auditWindowsOf(spineRecords) {
+  const legs = legsOf(spineRecords);
+  if (legs.length <= 1) {
+    const jobStart = spineRecords.find((e) => e && e.type === 'job-start') ?? null;
+    const jobEnd = legs.at(-1)?.jobEnd ?? null;
+    return [auditWindow(jobStart, jobEnd)];
+  }
+  return legs.map((l, i) => auditWindow(l.jobStart ?? l.start, l.jobEnd ?? (legs[i + 1]?.start ? { ts: legs[i + 1].start.ts } : null)));
+}
+
 /**
  * Trim a string to `max` chars with an explicit `…[+N chars]` marker —
  * NEVER a silent truncation, and never a trailing ellipsis alone
@@ -422,8 +441,14 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     else skipped += 1;
   }
 
+  // P5-R: a resumed run is ONE spine of several legs (src/legs.js `legsOf`, the one owner of the boundaries).
+  // `jobStart` is the run's FIRST (its start, its drafting fold); `latestStart` the latest leg's (the caps it ran
+  // under now); `jobEnd` the run's terminal — the LAST leg's, never an earlier leg's. A spine with no marker is
+  // one leg and every figure below reads exactly as it always did.
+  const legs = legsOf(spine);
   const jobStart = spine.find((e) => e.type === 'job-start') ?? null;
-  const jobEnd = spine.findLast((e) => e.type === 'job-end') ?? null;
+  const latestStart = legs.at(-1)?.jobStart ?? jobStart;
+  const jobEnd = legs.at(-1)?.jobEnd ?? null;
 
   // F195 fix: a gate-audit sidecar CAN be shared across several runs whose
   // spines happen to reuse the same filename (measured on a real archived
@@ -441,10 +466,10 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // (`src/panel/server.js`) calls this same {@link auditWindow} rather than
   // keeping its own copy.
   {
-    const { startTs, endTs } = auditWindow(jobStart, jobEnd);
+    const windows = auditWindowsOf(spine);
     audit = audit.filter((a) => {
       const t = parseTs(a.ts);
-      return t !== null && t >= startTs && t <= endTs;
+      return t !== null && windows.some((w) => t >= w.startTs && t <= w.endTs);
     });
   }
 
@@ -460,8 +485,12 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // and the wall-halt sites (src/planrun.js:2990,3208-3209).
   const stopReason = isGreen ? null : buildStopReason(lastEscalation, outcome);
 
-  const spentUsd = jobEnd && typeof jobEnd.spentUsd === 'number' && Number.isFinite(jobEnd.spentUsd) ? jobEnd.spentUsd : null;
-  const spendComplete = jobEnd ? jobEnd.spendComplete === true && spentUsd !== null : false;
+  // MONEY, one basis (P5-R): a one-leg spine reads its terminal's own total as it always did; a resumed run's
+  // legs are summed by each leg's own spend (`chainSpend`), never the last terminal's chain total on top of them
+  const chain = legs.length > 1 && jobEnd ? chainSpend(spine) : null;
+  const spentUsd = chain ? chain.usd
+    : (jobEnd && typeof jobEnd.spentUsd === 'number' && Number.isFinite(jobEnd.spentUsd) ? jobEnd.spentUsd : null);
+  const spendComplete = chain ? chain.complete : (jobEnd ? jobEnd.spendComplete === true && spentUsd !== null : false);
 
   // draftSpentUsd (hamr's ruling 2026-09-28, "one cap covers drafting +
   // run") — the AUTHORING pipeline's own spend on this job before it was
@@ -480,9 +509,28 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // exact then, the field simply didn't exist yet to say so.
   const draftSpendComplete = draftSpentUsd === null ? null
     : (jobStart.draftSpendComplete !== false);
-  const floorReasonList = floorReasons(spine, jobStart, spendComplete);
-
-  const wallMs = windowWallMs(parseTs(jobStart?.ts), parseTs(jobEnd?.ts));
+  const floorReasonList = floorReasons(spine, legs.map((l) => l.jobStart).find((j) => j?.priorSpendComplete === false) ?? jobStart, spendComplete);
+
+  // WALL: the sum of each leg's own working window, the gap between legs excluded (hamr 2026-10-02, 2A). A
+  // leg that died has no terminal, so its window ends at its last record (a floor); the LATEST leg without a
+  // terminal is unknown, as a one-leg run without one always was.
+  /** @param {import('./legs.js').Leg} l @param {boolean} isLast */
+  const legWallMs = (l, isLast) => {
+    const a = parseTs((l.jobStart ?? l.start)?.ts);
+    const b = l.jobEnd ? parseTs(l.jobEnd.ts) : (isLast ? null : parseTs(l.end?.ts));
+    return windowWallMs(a, b);
+  };
+  const wallMs = legs.length > 1
+    ? (() => {
+      let sum = 0;
+      for (let i = 0; i < legs.length; i += 1) {
+        const w = legWallMs(legs[i], i === legs.length - 1);
+        if (w === null) return null;
+        sum += w;
+      }
+      return sum;
+    })()
+    : windowWallMs(parseTs(jobStart?.ts), parseTs(jobEnd?.ts));
 
   // chainClock: the SIGNED wall, read off the run's own clock record —
   // src/planrun.js:1203 (`wall-clock`) or `emitWallHalt` (src/planrun.js:1269)
@@ -556,7 +604,7 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   // record at all (resumed before any plan reload was needed); keying
   // "resumed" on resume-seed alone would have printed `resumed: no` on
   // genuinely resumed runs and mis-explained their spend.
-  const resumed = !!jobStart && 'priorSpentUsd' in jobStart;
+  const resumed = legs.length > 1 || (!!jobStart && 'priorSpentUsd' in jobStart);
 
   // resumeSeed: the DETAIL fields (phase/completed/skipping/divergence) —
   // present only on the narrower resume-seed record; `resumed` above stays
@@ -582,7 +630,8 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
   const totalRoundsInFile = spendRecords.length;
   const unpricedRoundsInFile = spendRecords.filter((r) => !(typeof r.costUsd === 'number' && Number.isFinite(r.costUsd))).length;
   const summedRounds = spendRecords.reduce((acc, r) => (typeof r.costUsd === 'number' && Number.isFinite(r.costUsd) ? acc + r.costUsd : acc), 0);
-  const hasEngagementField = jobEnd && typeof jobEnd.engagementSpentUsd === 'number' && Number.isFinite(jobEnd.engagementSpentUsd);
+  // (a resumed run's terminal carries only its LATEST leg's engagement — its file's figure is the sum of the rounds)
+  const hasEngagementField = legs.length <= 1 && jobEnd && typeof jobEnd.engagementSpentUsd === 'number' && Number.isFinite(jobEnd.engagementSpentUsd);
   const thisFileSpend = {
     value: unpricedRoundsInFile > 0 ? null : (hasEngagementField ? jobEnd.engagementSpentUsd : summedRounds),
     source: /** @type {'engagementSpentUsd'|'summed rounds'} */ (hasEngagementField ? 'engagementSpentUsd' : 'summed rounds'),
@@ -664,18 +713,38 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
 
   const usedEndSeqs = new Set();
   const idOccurrence = new Map();
+  /** @type {Map<string, {stopReason: string|null, legIdx: number, tryNumber: number}>} */
+  const prevOccurrence = new Map();
 
   const steps = stepStarts.map((ss) => {
     const id = ss.step;
     const startSeq = typeof ss.seq === 'number' ? ss.seq : -Infinity;
     const startTs = parseTs(ss.ts);
 
+    // P5-R: a step belongs to ONE leg. Its `step-end` is the first one inside ITS OWN leg (never a later leg's
+    // `step-end` for the same id), and a step its leg's halt cut off ends where that leg ends — otherwise its
+    // window runs across the idle gap to the next leg and counts the gap as its time.
+    const myLegIdx = legs.length > 1 ? legs.reduce((acc, l, i) => (typeof l.start?.seq === 'number' && startSeq >= l.start.seq ? i : acc), 0) : 0;
+    const myLeg = legs.length > 1 ? legs[myLegIdx] : null;
+    const legEndSeq = legs.length > 1 && myLegIdx < legs.length - 1 && typeof legs[myLegIdx + 1].start?.seq === 'number' ? legs[myLegIdx + 1].start.seq : Infinity;
     const end = stepEnds
-      .filter((se) => se.step === id && typeof se.seq === 'number' && se.seq >= startSeq && !usedEndSeqs.has(se.seq))
+      .filter((se) => se.step === id && typeof se.seq === 'number' && se.seq >= startSeq && se.seq < legEndSeq && !usedEndSeqs.has(se.seq))
       .sort((a, b) => a.seq - b.seq)[0] ?? null;
     if (end) usedEndSeqs.add(end.seq);
-    const endSeq = end && typeof end.seq === 'number' ? end.seq : Infinity;
-    const endTs = end ? parseTs(end.ts) : null;
+    const cutByLeg = !end && myLeg !== null && Number.isFinite(legEndSeq);
+    const endSeq = end && typeof end.seq === 'number' ? end.seq : (cutByLeg ? legEndSeq : Infinity);
+    const endTs = end ? parseTs(end.ts) : (cutByLeg ? parseTs(myLeg?.end?.ts) : null);
+    // why this leg stopped the step (code-owned words); null for a step that ended itself or is still running
+    /** @type {string|null} */
+    let stopReason = null;
+    if (!end && myLeg !== null) {
+      const o = myLeg.outcome;
+      const isLastLeg = myLegIdx === legs.length - 1;
+      if (cutByLeg || (isLastLeg && o !== null && o !== 'green' && o !== 'already-green')) {
+        stopReason = o === 'cap-halt' ? 'money cap' : o === 'wall-halt' ? 'time cap' : o === 'provider-red' ? 'provider failed'
+          : o === 'step-stalled' ? 'step stalled' : o === 'stopped' ? 'you stopped it' : o === null ? 'died' : o;
+      }
+    }
 
     const phaseTag = `step:${id}`;
     // `judge-round` (a close's paid seam) carries no `.phase` at all
@@ -753,10 +822,17 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     }
 
     idOccurrence.set(id, (idOccurrence.get(id) ?? 0) + 1);
+    // the SAME step continuing across a leg boundary (the previous occurrence of this id was cut off by its leg's
+    // halt, and this one starts in a later leg) is "continued", never a retry; `tryNumber` counts real retries only
+    const prevOcc = prevOccurrence.get(id) ?? null;
+    const continued = myLeg !== null && prevOcc !== null && prevOcc.stopReason !== null && prevOcc.legIdx < myLegIdx;
+    const tryNumber = prevOcc === null ? 1 : (continued ? prevOcc.tryNumber : prevOcc.tryNumber + 1);
+    prevOccurrence.set(id, { stopReason, legIdx: myLegIdx, tryNumber });
 
     return {
       id,
       occurrence: idOccurrence.get(id),
+      ...(myLeg === null ? {} : { stopReason, continued, tryNumber }),
       outcome: end ? (end.outcome ?? null) : null,
       ...buildOccurrenceMetrics(startSeq, startTs, endSeq, endTs, roundsInWindow),
       checks: { passed, failed },
@@ -1241,7 +1317,10 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
         spentUsd: step.spentUsd,
         unpricedRounds: step.unpricedRounds,
         outcome: step.outcome,
-        attempts: stepAttempts,
+        // P5-R (resumed runs only): why its leg's halt cut this step off, whether it is the same step continuing
+        // from the leg before, and its retry count not counting continuations
+        ...(step.stopReason === undefined ? {} : { stopReason: step.stopReason, continued: step.continued, tryNumber: step.tryNumber }),
+        attempts: step.stopReason ? stepAttempts.map((a) => (a.outcome === null || a.outcome === undefined ? { ...a, outcome: 'stopped' } : a)) : stepAttempts,
       });
     }
 
@@ -1321,6 +1400,32 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     }
   }
 
+  // P5-R: which LEG each part belongs to, and where a resume picked up — only for a resumed run (a spine with
+  // no marker keeps its parts byte-for-byte). A step part is dated by its own step-start; a replan by its
+  // marker; every other part by the end of its last attempt (its own window's far edge), falling back to the
+  // near edge, then to leg 1. `resumedNext` marks the part a leg ENDED at: the next part is the leg after.
+  if (legs.length > 1) {
+    /** @param {number|null|undefined} seq */
+    const legOfSeq = (seq) => {
+      let n = 1;
+      if (typeof seq !== 'number' || !Number.isFinite(seq)) return n;
+      for (const l of legs) if (typeof l.start?.seq === 'number' && seq >= l.start.seq) n = l.leg;
+      return n;
+    };
+    for (const p of parts) {
+      const atts = Array.isArray(p.attempts) ? p.attempts : [];
+      const finiteEnds = atts.map((a) => a.endSeq).filter((v) => typeof v === 'number' && Number.isFinite(v));
+      const firstStart = atts.length ? atts[0].startSeq : null;
+      if (p.kind === 'step') p.leg = legOfSeq(firstStart);
+      else if (p.kind === 'replan' && typeof p.markerSeq === 'number') p.leg = legOfSeq(p.markerSeq);
+      else if (finiteEnds.length) p.leg = legOfSeq(Math.max(...finiteEnds));
+      else p.leg = legOfSeq(firstStart);
+    }
+    // legs never go backwards along the part list (a part is dated by file order)
+    for (let i = 1; i < parts.length; i += 1) if (parts[i].leg < parts[i - 1].leg) parts[i].leg = parts[i - 1].leg;
+    for (let i = 0; i < parts.length - 1; i += 1) if (parts[i + 1].leg > parts[i].leg) parts[i].resumedNext = true;
+  }
+
   return {
     runId,
     job: jobStart?.job ?? null,
@@ -1359,8 +1464,9 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     // escalation happen at all"). `summarizeForAllLine`'s `reason` column
     // needs the latter question answered unconditionally.
     lastEscalation,
-    budgetUsd: jobStart && typeof jobStart.budgetUsd === 'number' && Number.isFinite(jobStart.budgetUsd) ? jobStart.budgetUsd : null,
-    specHash: typeof jobStart?.specHash === 'string' ? jobStart.specHash : null,
+    // the caps and the spec the run's LATEST leg ran under (a resume may run under a re-signed hash)
+    budgetUsd: latestStart && typeof latestStart.budgetUsd === 'number' && Number.isFinite(latestStart.budgetUsd) ? latestStart.budgetUsd : null,
+    specHash: typeof latestStart?.specHash === 'string' ? latestStart.specHash : null,
     branch,
     outcome,
     stopReason,
@@ -1375,6 +1481,17 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     chainClock,
     resumed,
     resumeSeed,
+    // P5-R — the run's legs in order (always at least one for a spine with records): the panel's Audit divider and
+    // map connector read these, never re-derive a boundary. `startSeq`/`endSeq` bound the leg on the one `seq` series.
+    legs: legs.map((l) => ({
+      leg: l.leg,
+      after: l.after,
+      outcome: l.outcome,
+      startTs: typeof l.start?.ts === 'string' ? l.start.ts : null,
+      endTs: typeof l.end?.ts === 'string' ? l.end.ts : null,
+      startSeq: typeof l.start?.seq === 'number' ? l.start.seq : null,
+      endSeq: typeof l.end?.seq === 'number' ? l.end.seq : null,
+    })),
     thisFileSpend,
     // spendMismatch: a NON-resumed run's own `job-end.spentUsd` IS this
     // file's whole spend (no fold to explain a gap) — so on a cold run,
@@ -1684,7 +1801,10 @@ export function formatReplay(summary) {
     ? `this file unknown (${tf.unpricedRounds} of ${tf.totalRounds} rounds unpriced; ${tf.source})`
     : `this file ${money(tf.value)} (${tf.totalRounds} round${tf.totalRounds === 1 ? '' : 's'}, all priced; ${tf.source})`;
   let spentLine;
-  if (summary.resumed) {
+  if (summary.legs.length > 1) {
+    // one run, several legs on ONE file: one figure (each leg's own spend, summed), never two bases side by side
+    spentLine = `spent:   ${money(summary.spentUsd)}${summary.spentUsd !== null && !summary.spendComplete ? ' (floor, not exact)' : ''} over ${summary.legs.length} legs of one run · of ${money2(summary.budgetUsd)} signed`;
+  } else if (summary.resumed) {
     spentLine = `spent:   ${money(summary.spentUsd)} chain total (job-end; prior legs folded) · ${thisFileText} · of ${money2(summary.budgetUsd)} signed`;
   } else {
     spentLine = `spent:   ${money(summary.spentUsd)}${summary.spentUsd !== null && !summary.spendComplete ? ' (floor, not exact)' : ''} of ${money2(summary.budgetUsd)} signed`;
@@ -1705,7 +1825,7 @@ export function formatReplay(summary) {
       ? ` · floor because: ${summary.floorReasons.join(', ')}`
       : ' · floor (reason not in spine)';
   }
-  spentLine += ` · wall ${duration(summary.wallMs)} (this file)`;
+  spentLine += ` · wall ${duration(summary.wallMs)} (${summary.legs.length > 1 ? 'working time, gaps between legs excluded' : 'this file'})`;
   if (summary.chainClock) {
     const { elapsedMs, requestedMs, source } = summary.chainClock;
     const signed = typeof requestedMs === 'number' ? `${duration(requestedMs)} signed` : 'no wall signed';

package/src/replayio.js

@@ -87,7 +87,10 @@ export function resolveSiblings(spinePath) {
   const base = basename(spinePath);
   const stem = base.replace(/\.jsonl$/, '');
   const runId = stem.startsWith('u-') ? stem.slice(2) : stem;
-  const auditPath = join(dir, `${stem}-gate-audit.jsonl`);
+  let auditPath = join(dir, `${stem}-gate-audit.jsonl`);
+  // a bundle run (`<bundle>/runs/<runid>/spine.jsonl`) keeps its tool log beside the spine as plain `gate-audit.jsonl`
+  const bundleAudit = join(dir, 'gate-audit.jsonl');
+  if (base === 'spine.jsonl' && !existsSync(auditPath) && existsSync(bundleAudit)) auditPath = bundleAudit;
   return { runId, auditPath: existsSync(auditPath) ? auditPath : null };
 }
 
@@ -96,7 +99,7 @@ export function resolveSiblings(spinePath) {
  * hand both to {@link replayRun}. Read-only, $0, mints no verdict.
  * @param {string} spinePath absolute or cwd-relative path to a `.jsonl` spine
  * @param {{preParsedSpine?: {records: any[], skipped: number}, skipAudit?: boolean,
- *   auditPathOverride?: string|null}} [opts]
+ *   auditPathOverride?: string|string[]|null}} [opts]
  *   `preParsedSpine`: avoids a second parse of the same file when the caller
  *   ({@link listSpines}) already read it once to run {@link looksLikeSpine}.
  *   `skipAudit` (PR #23 review item 5, 2026-08-26, carried over): a
@@ -120,13 +123,17 @@ export function replayOne(spinePath, opts = {}) {
   const { runId, auditPath: resolvedAuditPath } = resolveSiblings(spinePath);
   const auditPath = auditPathOverride !== undefined ? auditPathOverride : resolvedAuditPath;
   const spine = preParsedSpine ?? parseJsonl(spinePath);
-  const audit = (!skipAudit && auditPath) ? parseJsonl(auditPath) : { records: [], skipped: 0 };
+  // P5-R: a RESUMED run still being written has TWO homes for its tool log — the finished legs' file and the
+  // live leg's file in the patient tree — so a caller may hand every path the run's log is in
+  const auditPaths = Array.isArray(auditPath) ? auditPath : (auditPath ? [auditPath] : []);
+  const audit = { records: /** @type {any[]} */ ([]), skipped: 0 };
+  if (!skipAudit) for (const ap of auditPaths) { const part = parseJsonl(ap); audit.records.push(...part.records); audit.skipped += part.skipped; }
   // `auditAvailable`: true only when a sidecar was actually FOUND AND READ.
   // `skipAudit` (a deliberate cheap directory listing) and "no sidecar on
   // disk" both mean this call never learned the real tool-call count, so
   // both report unknown, never a coincidental 0 (doctrine: unknown reported
   // as unknown, never rendered as zero — see `replayRun`'s own doc).
-  const auditAvailable = !skipAudit && auditPath !== null;
+  const auditAvailable = !skipAudit && auditPaths.length > 0;
   const summary = replayRun(spine.records, audit.records, { runId, auditAvailable });
   summary.skipped += spine.skipped + audit.skipped;
   return summary;

package/src/reuse.js

@@ -52,6 +52,7 @@ import { closeStagesOf } from './plan.js';
 import { MIN_WALL_MS, jobSpecHash } from './job.js';
 import { isObj, isNonEmptyString } from './validate.js';
 import { readGrade } from './trend.js';
+import { legsOf } from './legs.js';
 
 /** the paused-run TERMINAL and its spine record share one name (`runPlan` returns
  * it and `runJob` writes it onto `job-end`), spelled once in `declaredclose.js`
@@ -117,6 +118,11 @@ export const REUSE_GRADED_RED = Object.freeze(['escalated']);
  * allowances the loop's remaining tries are meant to spend against, and the human
  * ones are the stop no further try can change (see `hardStop`).
  *
+ * `stopped` (PANEL-BUILD.md P5 item 5, hamr 2026-10-02): the PERSON ended the leg at a round
+ * boundary (a `<spine>.stop` request). Nothing was judged and nothing failed — finished steps stand on
+ * disk, the allowance is unspent, so it is a checkpoint exactly like a cap-halt. Arbiter-adjacent (it
+ * widens what resume may re-enter); ruled by hamr, not chosen by a builder.
+ *
  * `provider-red` folded in 2026-08-25 (PRD v1.80 TODO #4, F115 "Ruled: one transport
  * retry"; hamr's ruling verbatim: *"joins resume anyways and you decide but you are
  * given an honest readout and with 1 retry"*). It is a MACHINE halt, not a human one
@@ -139,7 +145,7 @@ export const REUSE_GRADED_RED = Object.freeze(['escalated']);
  * does not end up with two lists that can drift, which is the exact failure this
  * constant exists to end (see the paragraph above).
  */
-export const CHECKPOINT_OUTCOMES = Object.freeze(['cap-halt', 'wall-halt', 'step-stalled', 'provider-red', ...HUMAN_CHECKPOINTS]);
+export const CHECKPOINT_OUTCOMES = Object.freeze(['cap-halt', 'wall-halt', 'step-stalled', 'provider-red', 'stopped', ...HUMAN_CHECKPOINTS]);
 
 /**
  * v1's definition of "the same KIND of recipe" — and it is the LOAD GATE's own: the
@@ -815,7 +821,16 @@ function readGradeSeed(seen) {
  *   spentUsd, spendComplete, carrySpentUsd, carrySpendComplete }`
  */
 export function readResume(events, { deathAt = null, direct = false, resumableOutcomes = [] } = {}) {
-  const list = Array.isArray(events) ? events.filter(isObj) : [];
+  let list = Array.isArray(events) ? events.filter(isObj) : [];
+  // P5-R: a DIRECT spine may be a resumed run's one file of several legs (src/legs.js). The checkpoint a resume
+  // continues from is the latest leg that reached a `job-start`, and that leg's own `job-start` DECLARES the fold
+  // it inherited (`priorSpentUsd`/`priorWallMs`/…) — so reading that one window and adding its rounds is the whole
+  // chain exactly once, never the earlier legs' rounds on top of a fold that already carries them. A spine with
+  // no marker is one leg and reads as it always did.
+  if (direct) {
+    const legs = legsOf(list);
+    if (legs.length > 1) list = (legs.findLast((l) => l.jobStart !== null) ?? legs[legs.length - 1]).records;
+  }
   /** which landed terminals are a CHECKPOINT rather than a graded row */
   const resumableHalt = new Set(Array.isArray(resumableOutcomes) ? resumableOutcomes : []);
   // the FIRST reuse-start is the envelope this spine was opened under. A resumed spine
@@ -1228,7 +1243,9 @@ export const PAUSE_TTL_MS = 60 * 24 * 60 * 60_000;
  * @returns {{ok: boolean, applies: boolean, ageMs: number|null, ttlMs: number, pausedAt: string|null, detail: string|null}}
  */
 export function checkpointAgeGate(events, { now = Date.now, ttlMs = PAUSE_TTL_MS } = {}) {
-  const list = Array.isArray(events) ? events.filter(isObj) : [];
+  const all = Array.isArray(events) ? events.filter(isObj) : [];
+  // P5-R: only the run's LATEST leg can be the one waiting — an earlier leg's pause was answered by the leg after it
+  const list = legsOf(all).at(-1)?.records ?? all;
   const end = list.filter((e) => e.type === 'job-end').at(-1) ?? null;
   const base = { applies: false, ageMs: null, ttlMs, pausedAt: null, detail: null };
   if (end?.outcome !== HITL_PAUSE) return { ...base, ok: true };

package/src/run.js

@@ -256,10 +256,13 @@ async function primitiveSmoke(workdir) {
  *   passes `false` so the escalation tail's option strings say "resume is
  *   `run-u`-only in v1" instead of naming a flag that would fail if typed. Forwarded
  *   verbatim to the plan flow, which owns the three `--resume`-naming readouts.
+ * @param {string|null} [opts.stopFile=null] P5 item 5 — the run's STOP REQUEST file
+ *   (`stopFilePath(spine)`, src/legs.js), forwarded verbatim to the plan flow, which reads it at the
+ *   round-boundary seam (where the money cap binds) and ends the leg `stopped`. `null` = no stop surface.
  * @returns {Promise<string>} outcome: 'green' | 'already-green' | 'escalated' |
  *   'unapproved-spec' | 'job-red' | 'smoke-red' | 'plan-red' | 'check-red' |
  *   'close-red' | 'close-unsupported' | 'recipe-stale' | 'branch-red' | 'pricing-red' | 'provider-red' |
- *   'interpreter-red' | 'cap-halt' | 'wall-halt' | 'step-stalled' |
+ *   'interpreter-red' | 'cap-halt' | 'wall-halt' | 'stopped' | 'step-stalled' |
  *   'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  *   NOTE: `job-end` can ALSO land with outcome 'runner-drained' (F140/PRD item
  *   28(c)) — the `beforeExit` backstop's own terminal, emitted from OUTSIDE this
@@ -270,7 +273,7 @@ async function primitiveSmoke(workdir) {
  *   deliberately NOT in the resumable/checkpoint set (`src/reuse.js`) — an
  *   unknown in-flight state is not a known-safe resume point.
  */
-export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, rates = null, judgeRates = null, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, closeDir = null, layerRoot = false, readShim = false, scout = true, bridge = null, draftSpentUsd = 0, draftSpendComplete = true, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, reviewDoor = null, doorRerun = null, resumable = true }) {
+export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, rates = null, judgeRates = null, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, closeDir = null, layerRoot = false, readShim = false, scout = true, bridge = null, draftSpentUsd = 0, draftSpendComplete = true, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, reviewDoor = null, doorRerun = null, resumable = true, stopFile = null }) {
   // THE READ SHIM's ARM, resolved at the door — the FIRST thing this entry does,
   // before the ledger, before the approval gate, before a byte of the spec is read.
   // An unrecognised spelling throws here at zero cost instead of being coerced by
@@ -537,7 +540,7 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   // accounts it natively (F12) and the job-end money contract is unchanged.
   {
     const outcome = await runPlan(job, {
-      workdir, provider, nativeProvider, providerFor, judgeProvider, judgeModel, rates, judgeRates, emit: meter, capRuns, ...(strikeLimit !== undefined ? { strikeLimit } : {}), closeTimeoutMs, closeDir, layerRoot, readShim, scout, bridge, priorWallMs: chainWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, reviewDoor, doorRerun, priorSpentUsd: chainFoldUsd, resumable,
+      workdir, provider, nativeProvider, providerFor, judgeProvider, judgeModel, rates, judgeRates, emit: meter, capRuns, ...(strikeLimit !== undefined ? { strikeLimit } : {}), closeTimeoutMs, closeDir, layerRoot, readShim, scout, bridge, priorWallMs: chainWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling, heldRuling, reviewDoor, doorRerun, priorSpentUsd: chainFoldUsd, resumable, stopFile,
       // hamr's ruling 2026-09-28 — ONE cap covers drafting + run: the run's
       // enforced ceiling is the signed `budgetUsd` (unchanged, still in the
       // spec hash) MINUS whatever drafting already spent on this job before

package/src/runlist.js

@@ -58,9 +58,12 @@ export function runlistPath(home) {
 }
 
 /**
- * @typedef {{ at: string, runid: string, job: string, spine: string, patient: string|null, via: 'run-u'|'bundle'|'backfill', pid?: number, capUsd?: number }} RunRow
+ * @typedef {{ at: string, runid: string, job: string, spine: string, patient: string|null, via: 'run-u'|'bundle'|'backfill', pid?: number, capUsd?: number, leg?: number }} RunRow
  * `pid`/`capUsd` (optional; older and backfilled rows carry neither): the runner's process id and the
  * leg's $ cap — what the monthly limit holds while that pid is a live bareloop runner (src/monthly.js).
+ * `leg` (P5-R; only on a row {@link readRunList} FOLDED from `leg-start` entries, i.e. a RESUMED run):
+ * the number of the run's latest leg — a resumed run is the same run, one row, and its `pid`/`capUsd`
+ * are that latest leg's.
  */
 
 /**
@@ -101,7 +104,10 @@ export function appendRun(row, opts = {}) {
 }
 
 /**
- * @typedef {{ runid: string, type: 'settled'|'released', by: string, at: string, reason?: string, spentUsd?: number, spendComplete?: boolean }} RunEvent
+ * @typedef {{ runid: string, type: 'settled'|'released', by: string, at: string, reason?: string, spentUsd?: number, spendComplete?: boolean, leg?: number }} RunEvent
+ * `leg` (P5-R): which leg of the run the write-back is about; absent = leg 1 (every entry written before P5-R).
+ * A resumed run is ONE row, so `settled`/`released` are per leg: a later leg's `released` gives back THAT leg's
+ * claim and never removes the run.
  * A claim's write-back, appended (never rewritten) beside the run rows. `settled` = the run's claim on the
  * monthly limit is over (`spentUsd`/`spendComplete` are its final figure, `by` is WHO wrote it: the run itself
  * at its `job-end`, or the next run that found its process gone, `reason: 'process gone'`). `released` = the
@@ -122,6 +128,43 @@ export function appendRunEvent(event, opts = {}) {
   try { chmodSync(path, 0o600); } catch { /* best-effort perms */ }
 }
 
+/**
+ * @typedef {{ type: 'leg-start', runid: string, leg: number, pid?: number, capUsd?: number, at: string }} LegStart
+ * A resumed run's NEW claim (P5-R, hamr 2026-10-02: one run, one id, one row): appended beside the run's row
+ * instead of a second row. {@link readRunList} folds it into the row.
+ */
+
+/**
+ * Append one {@link LegStart}: a resumed run's leg claim. Not locked: one short line, one append. THROWS on IO failure.
+ * @param {LegStart} entry
+ * @param {{ home?: string }} [opts]
+ * @returns {void}
+ */
+export function appendLegStart(entry, opts = {}) {
+  const path = runlistPath(opts.home);
+  mkdirSync(runlistHome(opts.home), { recursive: true, mode: 0o700 });
+  appendFileSync(path, `${JSON.stringify({ ...entry, type: 'leg-start' })}\n`);
+  try { chmodSync(path, 0o600); } catch { /* best-effort perms */ }
+}
+
+/**
+ * The leg a write-back names (absent = 1).
+ * @param {{ leg?: number }} e
+ * @returns {number}
+ */
+const legOf = (e) => (Number.isInteger(e.leg) && /** @type {number} */ (e.leg) >= 1 ? /** @type {number} */ (e.leg) : 1);
+
+/**
+ * Has this row's LATEST leg been settled? The ONE spelling (the monthly limit and the settle writer share it).
+ * @param {RunEvent[]} events {@link readRunList}'s `events`
+ * @param {{ runid: string, leg?: number }} row
+ * @returns {boolean}
+ */
+export function isSettled(events, row) {
+  const leg = legOf(row);
+  return events.some((e) => e.type === 'settled' && e.runid === row.runid && legOf(e) === leg);
+}
+
 /**
  * Tolerant reader — reuses {@link parseJsonl} (never a second hand-rolled
  * parser). An absent file reads as an empty list, not an error: a fresh
@@ -136,20 +179,45 @@ export function readRunList(opts = {}) {
   const path = runlistPath(opts.home);
   if (!existsSync(path)) return { rows: [], skipped: 0, events: [] };
   const { records, skipped } = parseJsonl(path);
-  // the FIRST settle for a runid is authoritative: two runs may both close the same dead claim, and the
+  // the FIRST settle for a (runid, leg) is authoritative: two runs may both close the same dead claim, and the
   // second note is a duplicate (a `released` line likewise); file order decides, later copies are ignored
   const seen = new Set();
   /** @type {RunEvent[]} */
   const events = records.filter((r) => {
     if (!r || (r.type !== 'settled' && r.type !== 'released')) return false;
-    const key = `${r.type}:${r.runid}`;
+    const key = `${r.type}:${r.runid}:${legOf(r)}`;
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
   });
-  const released = new Set(events.filter((e) => e.type === 'released').map((e) => e.runid));
-  const rows = records.filter((r) => r && !r.type && !released.has(r.runid));
-  return { rows, skipped, events };
+  // a leg-1 `released` = the run never started: not listed. A LATER leg's `released` only gives that leg's claim back.
+  const released = new Set(events.filter((e) => e.type === 'released' && legOf(e) === 1).map((e) => e.runid));
+  const voided = new Set(events.filter((e) => e.type === 'released' && legOf(e) > 1).map((e) => `${e.runid}:${legOf(e)}`));
+  /** @type {Map<string, RunRow & {claimAt: number}>} */
+  const byRunid = new Map();
+  /** @type {(RunRow & {claimAt: number})[]} */
+  const rows = [];
+  records.forEach((r, i) => {
+    if (!r) return;
+    if (!r.type) {
+      if (released.has(r.runid)) return;
+      const row = { ...r, claimAt: i };
+      rows.push(row);
+      if (!byRunid.has(r.runid)) byRunid.set(r.runid, row);
+    } else if (r.type === 'leg-start') {
+      const row = byRunid.get(r.runid);
+      if (!row || !Number.isInteger(r.leg) || r.leg < 2 || voided.has(`${r.runid}:${r.leg}`) || r.leg <= legOf(row)) return;
+      // the run's pid/cap are its LATEST leg's; the claim's place in the file (the monthly limit's "who is above
+      // whom") is that leg-start line's, since that is where the leg claimed
+      row.leg = r.leg;
+      row.pid = r.pid;
+      row.capUsd = r.capUsd;
+      row.claimAt = i;
+    }
+  });
+  // file order = claim order: a resumed run's latest claim sits where its latest leg-start line is
+  const ordered = rows.some((r) => r.leg !== undefined) ? [...rows].sort((a, b) => a.claimAt - b.claimAt) : rows;
+  return { rows: ordered.map(({ claimAt: _c, ...row }) => row), skipped, events };
 }
 
 /**

package/src/source.js

@@ -27,6 +27,7 @@ import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep, basename } from 'node:path';
 import { git } from './kinds.js';
+import { addWorktree, hideBareloopDir } from './worktree.js';
 import { MAX_BUFFER } from './kinds.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
 import { scanSecrets, SECRET_PATTERNS, SECRET_PATTERN_NAMES } from './validate.js';
@@ -440,16 +441,21 @@ async function fetchOnce(url, timeoutMs) {
  * as declared, unvalidated by `proveDestination`, and `frontDoorFromManifest`
  * never hands a repo source's destination to `copyOut` — wiring it into
  * `writeScope` is M3/M4's job, not this one.
- * @param {{source: string, into: string, destination?: string,
+ * `worktree` (P6 item 1, repo sources ONLY — ignored for every other kind): instead of COPYING the repo, make the
+ * run's tree a detached git worktree of the person's own repo at that directory (the shared
+ * `src/worktree.js`, the bundle door's own spelling), hide `.bareloop/` from their `git status`, and record the
+ * worktree and the repo root in the manifest. `into` then holds only `source.json`; the tree is `worktree`, at the
+ * repo's current commit (uncommitted edits are NOT in it). No seed commit is made — the seed IS the repo's HEAD.
+ * @param {{source: string, into: string, destination?: string, worktree?: string,
  *   fetchTimeoutMs?: number, afterScan?: () => (void|Promise<void>)}} args
  *   `fetchTimeoutMs` is test-only — production callers omit it and get
  *   `PROVIDER_TIMEOUT_MS`. `afterScan` is a test seam too: called exactly once,
  *   after the secret scan finished and before the freeze loop re-reads any
  *   file's bytes, so a test can swap a file inside that window
  *   deterministically. Production never sets it; absent, behaviour is unchanged.
- * @returns {Promise<{stop: null, into: string, tree: string, manifestPath: string, manifest: object}|SourceRefusal>}
+ * @returns {Promise<{stop: null, into: string, tree: string, manifestPath: string, manifest: Record<string, any>}|SourceRefusal>}
  */
-export async function prepareSource({ source, into, destination, fetchTimeoutMs = PROVIDER_TIMEOUT_MS, afterScan }) {
+export async function prepareSource({ source, into, destination, worktree, fetchTimeoutMs = PROVIDER_TIMEOUT_MS, afterScan }) {
   const intoAbs = resolve(into);
   if (existsSync(intoAbs)) {
     return refuse('into-exists', `${intoAbs} already exists — a source door writes a FRESH tree, never reuses one (the export worktree rule)`);
@@ -634,6 +640,9 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     const buf = f.buf ?? (f.symlinkTarget !== undefined ? Buffer.from(f.symlinkTarget, 'utf8') : await readFile(/** @type {string} */ (f.abs)));
     fileMeta.push({ path: f.rel, bytes: buf.length, sha256: sha256Hex(buf) });
     const isBinary = f.symlinkTarget === undefined && hasNulByte(buf.subarray(0, 8192));
+    // P6 item 2 (hamr 2026-10-05 Q2=A): a repo going onto a WORKTREE is the person's OWN repo, left in place — a secret
+    // already in it is MASKED wherever bareloop records it (`redactSecrets`), not a refusal. Every other kind keeps the scan.
+    if (worktree !== undefined && frozen.kind === 'repo') continue;
     const names = secretPatternNames(buf.toString(isBinary ? 'latin1' : 'utf8'));
     if (names.length) secretHits.push({ rel: f.rel, names });
   }
@@ -642,6 +651,34 @@ export async function prepareSource({ source, into, destination, fetchTimeoutMs
     return refuse('source-carries-secret', `${secretHits.length} file(s) carry a known secret shape — refused before anything was written (hard line #3, secrets never enter the tree): ${detail}`);
   }
 
+  if (worktree !== undefined && frozen.kind === 'repo') {
+    const repoRoot = /** @type {string} */ (frozen.root);
+    const wt = resolve(worktree);
+    try {
+      hideBareloopDir(repoRoot);
+      addWorktree(repoRoot, wt);
+    } catch (e) {
+      return refuse('source-worktree-failed', `could not make the job's worktree in ${repoRoot}: ${/** @type {Error} */ (e).message} (the repo needs at least one commit)`);
+    }
+    const headAt = await git(wt, ['rev-parse', 'HEAD']);
+    if (!headAt.ok) return refuse('source-git-failed', `git rev-parse HEAD failed in ${wt}: ${headAt.err}`);
+    const wtManifest = {
+      kind: 'repo',
+      source,
+      ...(frozen.sourceSubdir === undefined ? {} : { sourceSubdir: frozen.sourceSubdir }),
+      fetchedAt: new Date().toISOString(),
+      files: fileMeta,
+      seed: headAt.out.trim(),
+      destination: destination ?? null,
+      worktree: wt,
+      repo: repoRoot,
+    };
+    await mkdir(intoAbs, { recursive: true });
+    const wtManifestPath = join(intoAbs, 'source.json');
+    await writeFile(wtManifestPath, `${JSON.stringify(wtManifest, null, 2)}\n`);
+    return { stop: null, into: intoAbs, tree: wt, manifestPath: wtManifestPath, manifest: wtManifest };
+  }
+
   const treeDir = join(intoAbs, 'tree');
   const outputDir = join(treeDir, 'output');
   await mkdir(treeDir, { recursive: true });
@@ -809,7 +846,7 @@ const LOCKFILE_COMMANDS = Object.freeze([
  *   manifest)
  * @param {string} [sourceSubdir] the manifest's own `sourceSubdir` ('' or
  *   undefined when Source IS the repo root)
- * @returns {{manager: string, command: string, reason: string}|null} `null`
+ * @returns {{dir: string, lockFile: string|null, manager: string, command: string, reason: string}|null} `null`
  *   when there is nothing to report: no JS/TS manifest found walking up from
  *   `sourceSubdir` to `treeDir`, the nearest one found has no dependencies,
  *   `node_modules` is already there, or the manifest cannot even be read as
@@ -846,6 +883,8 @@ export function missingDependencies(treeDir, sourceSubdir = '') {
     const installCmd = lock ? lock.command : 'npm install';
     const rel = relative(root, d).split(sep).join('/');
     return {
+      dir: d,
+      lockFile: lock ? lock.file : null,
       manager: installCmd.split(' ')[0],
       command: rel === '' ? installCmd : `cd ${rel} && ${installCmd}`,
       reason: `${rel === '' ? 'package.json' : `${rel}/package.json`} lists dependencies but the copy has no node_modules`,