bareloop 0.34.0 → 0.36.0

package/src/text.js

@@ -308,3 +308,23 @@ export function stampRaw(raw, { cause = null, reason = null }) {
   raw.reason = reason === null || reason === undefined ? null : redactSecrets(reason);
   return raw;
 }
+
+/**
+ * BA-21 — the WRITE side of the pricing-provenance signal (read side: `rateProvenance` /
+ * `spendProvenance` in src/ledger.js). bare-agent >=0.37 rides `rateSource` beside
+ * `pricing` on every metering payload; both metering callbacks below forward it onto the
+ * spine through THIS one helper, because two sites spelling one rule are two instruments
+ * (the ripgrep fix that landed in ci.yml but not publish.yml).
+ *
+ * Forwarded VERBATIM — the write side reports what upstream said, and src/ledger.js is
+ * the one place that decides what counts as a guess. And an ABSENT provenance stays
+ * absent: a payload carrying no `rateSource` (bare-agent <0.37, and every round already
+ * in the archive) emits no field at all, so a reader sees UNKNOWN rather than a label we
+ * invented. Never defaulted to `null` here — `null` is upstream saying "nothing was
+ * priced", which is a different fact from "nobody told us".
+ * @param {any} arg an `onLlmResult` / `onTurn` payload
+ * @returns {{rateSource?: string|null}} the field to spread into the spine record
+ */
+export function rateSourceFields(arg) {
+  return arg && typeof arg === 'object' && 'rateSource' in arg ? { rateSource: arg.rateSource } : {};
+}

package/src/u-patient.js

@@ -16,9 +16,10 @@
 // mechanical preparation of a tree, and both callers print what it did.
 import { execFileSync } from 'node:child_process';
 import {
-  rmSync, existsSync, renameSync,
+  rmSync, existsSync,
 } from 'node:fs';
 import { join } from 'node:path';
+import { moveFile } from './movefile.js';
 
 /**
  * Reset a patient to its frozen seed and drop its `.litectx` store.
@@ -68,6 +69,6 @@ export function moveStaleGateAudit(wd, spineDir, runid) {
   const staleAudit = join(wd, 'gate-audit.jsonl');
   if (!existsSync(staleAudit)) return null;
   const preFile = join(spineDir, `pre-${runid}-gate-audit.jsonl`);
-  renameSync(staleAudit, preFile);
+  moveFile(staleAudit, preFile);
   return preFile;
 }

package/src/u-readout.js

@@ -16,6 +16,8 @@
 // leads; the leg is what this process actually bought, and dropping it would trade
 // one blindness for the other.
 
+import { legsOf } from './legs.js';
+
 /** minutes, at the precision the readout has ever claimed (~90%, hamr's ruling) */
 const min = (/** @type {number} */ ms) => (ms / 60_000).toFixed(1);
 
@@ -336,10 +338,16 @@ export function doorLines({ rerun, accept, pause }) {
  */
 export function deathAtOf({ watchdogAt, events } = {}) {
   const list = Array.isArray(events) ? events : [];
+  // P5-R: a resumed run is one spine of several legs. "Did this run end itself" is a question about its
+  // LATEST leg: an earlier leg's job-end says nothing about how the leg now being read stopped, and a
+  // watchdog note dated before this leg began is a different leg's note.
+  const last = legsOf(list).at(-1) ?? null;
+  const scope = last ? last.records : list;
   // a landed terminal is the run dating its own stop — nothing outside it is better
   // evidence about a run that was never killed
-  if (list.some((e) => e !== null && typeof e === 'object' && /** @type {any} */ (e).type === 'job-end')) return null;
+  if (scope.some((e) => e !== null && typeof e === 'object' && /** @type {any} */ (e).type === 'job-end')) return null;
   const at = typeof watchdogAt === 'string' ? Date.parse(watchdogAt) : NaN;
+  if (last && last.leg > 1 && last.startMs !== null && Number.isFinite(at) && at < last.startMs) return null;
   // an unreadable stamp is UNKNOWN, never a NaN handed to a fold (F6): the caller's
   // own default is the honest fallback
   return Number.isFinite(at) ? at : null;

package/src/u-watchdog.mjs

@@ -43,7 +43,7 @@
 //
 // Usage:
 //   node src/u-watchdog.mjs --spine <path> --pid <n>
-//        [--stale-ms N] [--wall-ms N] [--grace-ms N] [--dead-ms N] [--poll-ms N] [--term-grace-ms N]
+//        [--stale-ms N] [--wall-ms N] [--grace-ms N] [--dead-ms N] [--poll-ms N] [--term-grace-ms N] [--report <path>]
 import { statSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
 
 const arg = (/** @type {string} */ n, /** @type {string|null} */ dflt = null) => {
@@ -215,7 +215,9 @@ function stop(/** @type {string} */ reason, /** @type {string} */ judgement, /**
   // not a guard (F70: the instrument carrying the failure mode it exists to catch). The
   // kill below runs whether or not this succeeded; a failure is named on stderr so a
   // missing marker is never read as "the guard never fired".
-  const reportPath = `${spine}.watchdog.json`;
+  // a RESUMED leg writes its own note beside the run's one spine (P5-R: `<spine>.leg<N>.watchdog.json`), so a
+  // later leg never overwrites the earlier leg's evidence; the default is the file every run has always had
+  const reportPath = arg('report') ?? `${spine}.watchdog.json`;
   const tmpPath = `${reportPath}.tmp`;
   try {
     writeFileSync(tmpPath, `${JSON.stringify(record, null, 2)}\n`);

package/src/userrun.js

@@ -24,11 +24,13 @@
 // green ONE job end to end. That green GRADUATES the bridge: the plan the agent
 // authored is preserved from the spine as a reusable artifact, and the next run of
 // this shape reuses and fine-tunes it rather than starting cold.
-import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, renameSync, rmSync, readdirSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, rmSync, readdirSync, openSync, readSync, closeSync, fstatSync, unlinkSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { execFileSync, spawn } from 'node:child_process';
-import { join, resolve, dirname } from 'node:path';
+import { join, resolve, dirname, basename } from 'node:path';
+import { commitWork, removeWorktree } from './worktree.js';
+import { moveFile } from './movefile.js';
 import { runJob } from './run.js';
 import { moneyWithDraft } from './replay.js';
 import { jobSpecHash, resolveWorkerModel, validateJob } from './job.js';
@@ -72,10 +74,13 @@ import { answerReviewDoor, doorRecordOf, doorAgeGate } from './reviewdoor.js';
 // the cold reset, shared with the battery drivers so "cold" has one spelling
 import { coldReset, moveStaleGateAudit } from './u-patient.js';
 // PANEL-BUILD.md P1 — the one run list (`~/.config/bareloop/runs.jsonl`).
-import { appendRun, appendRunEvent, isLiveRunner, readRunList } from './runlist.js';
+import { appendRun, appendLegStart, appendRunEvent, isLiveRunner, readRunList } from './runlist.js';
+// P5-R — a resumed run is the SAME run: one id, one spine file, a `leg-resume` marker inside. `legsOf` is the
+// one owner of where a leg starts and ends; every reader below asks it.
+import { legsOf, parseSpineText, LEG_RESUME, watchdogNotePath, stopFilePath } from './legs.js';
 import { keysForDoor } from './keysfile.js';
 import { parseJsonl } from './replayio.js';
-import { claimRun, monthlyRefusalText, legSpend } from './monthly.js';
+import { claimRun, monthlyRefusalText, legSpend, chainSpend } from './monthly.js';
 import { ConfigError } from './config.js';
 import { commandFor } from './invoke.js';
 import { applyConfiguredKey, judgeRatesFor, keyNameFor, priceReadout, ratesFor, rowsForHome } from './providerrows.js';
@@ -265,6 +270,9 @@ class ExitSignal extends Error {
  * @property {string} [workdir] the patient's tree
  * @property {string} [seed] the patient's frozen seed commit
  * @property {string} [spineName] the spine directory name, beside `workdir`
+ * @property {string} [into] the source door's own directory (`source.json`, and the spine directory beside it).
+ *   Default `dirname(workdir)` — the copied-tree layout, where the tree is `<into>/tree`. A repo job on a WORKTREE
+ *   (P6 item 1) has its tree inside the person's repo, so its `into` is passed explicitly.
  * @property {string|null} [model] the raw `--model` tier name (`sonnet`/`haiku`), or null for the default
  * @property {string|null} [readShim] the raw `--read-shim` arm name, or null for the default
  * @property {string|null} [scout] the raw `--scout` value (`on`/`off`), or null for the default
@@ -296,6 +304,7 @@ class ExitSignal extends Error {
  * @property {string} workdir
  * @property {string} seed
  * @property {string} spineName
+ * @property {string} [into] see `RunOpts.into`
  * @property {string|null} model
  * @property {string|null} readShim
  * @property {string|null} scout
@@ -360,14 +369,17 @@ async function execute(ctx) {
   // owner of "a claimed run that never began" — every exit between the claim and the spine's first
   // record (a refused resume patient, a throwing prepareTree, a git/reset failure...) passes there.
   // Set on the no-limit path too, once the row is appended there (the same "listed, no spine yet" state).
-  /** @type {{ runid: string, spine: string, home: string|undefined }|null} */
+  /** @type {{ runid: string, spine: string, home: string|undefined, leg: number }|null} */
   let claimedRow = null;
+  // P5-R: has this leg written its first record (the `leg-resume` marker on a resume)? A resumed leg's spine
+  // file already exists, so "the file exists" no longer says the leg began.
+  let legBegun = false;
   // Release the claimed row (a `released` entry folds it out of the list, like a monthly refusal): the run
   // spent nothing and must not stay a ghost that keeps the month reading "at least". A failed release write
   // never masks the original exit.
   const releaseClaimedRow = () => {
     if (!claimedRow) return;
-    try { appendRunEvent({ runid: claimedRow.runid, type: 'released', by: claimedRow.runid, reason: 'not started', at: new Date().toISOString() }, { home: claimedRow.home }); } catch { /* the exit stands; a stranded row of a dead process is closed by the next run */ }
+    try { appendRunEvent({ runid: claimedRow.runid, type: 'released', by: claimedRow.runid, reason: 'not started', at: new Date().toISOString(), ...(claimedRow.leg > 1 ? { leg: claimedRow.leg } : {}) }, { home: claimedRow.home }); } catch { /* the exit stands; a stranded row of a dead process is closed by the next run */ }
   };
   try {
   const spec = ctx.spec;
@@ -654,7 +666,10 @@ async function execute(ctx) {
    * both the RESUME reader below and the live run further down need them. Two spellings of
    * one path is how `--resume` comes to read a different directory than the run writes. */
   const wd = resolve(WORKDIR);
-  const spineDir = ctx.bundle ? ctx.bundle.runDir : join(wd, '..', target.spine);
+  /** the source door's own directory: where `source.json` sits and the spine directory goes. The copied-tree layout
+   * has the tree at `<into>/tree`, so `dirname(wd)`; a worktree run passes it (its tree is inside the person's repo). */
+  const into = ctx.into !== undefined ? resolve(ctx.into) : dirname(wd);
+  const spineDir = ctx.bundle ? ctx.bundle.runDir : join(into, target.spine);
   /** `--resume` takes the runid (the conventional `<spine dir>/u-<runid>.jsonl`) or an
    * explicit path — the path form is what makes these gates testable without touching
    * an operator's real spine directory. */
@@ -662,6 +677,13 @@ async function execute(ctx) {
     : (RESUME.includes('/') || RESUME.endsWith('.jsonl') ? resolve(RESUME) : join(spineDir, `u-${RESUME}.jsonl`));
   /** @type {any} */
   let dead = null;
+  /** P5-R — the legs the halted run's file already holds, the leg a resume continues from, and how that leg ended @type {import('./legs.js').Leg[]} */
+  let deadLegs = [];
+  /** every record of the halted run's one file (all its legs) @type {any[]} */
+  let deadAllEvents = [];
+  let deadFromLegNo = 1;
+  /** @type {string} */
+  let deadAfter = 'died';
   /** F102 — the decision this checkpoint HOLDS: an answer the person already gave, on
    * a leg that stopped before a single round was bought for it. Null on every ordinary
    * resume. It is applied directly and the ask is never re-rendered — the whole of the
@@ -676,23 +698,34 @@ async function execute(ctx) {
     if (!existsSync(deadSpineFile)) die(`--resume: no spine at ${deadSpineFile} — a resume continues a run that happened, and this one left no log`);
     let raw = '';
     try { raw = readFileSync(deadSpineFile, 'utf8'); } catch (e) { die(`--resume: cannot read ${deadSpineFile}: ${e.message}`); }
-    /** @type {any[]} */
-    const deadEvents = [];
-    const lines = raw.split('\n');
-    lines.forEach((line, i) => {
-      if (!line.trim()) return;
-      try { deadEvents.push(JSON.parse(line)); } catch (e) {
-        // a kill can land mid-append, so a broken LAST line is the failure being modelled
-        // and is tolerated (named, never silently dropped). A broken line anywhere else is
-        // a corrupt log, and reconstructing from one would invent a history.
-        if (i >= lines.length - 2) err(`--resume: ignoring a truncated final line in ${deadSpineFile} (a kill mid-append — the expected shape)`);
-        else die(`--resume: ${deadSpineFile} is corrupt at line ${i + 1} (${e.message}) — a reconstruction from a damaged log would invent a history`);
-      }
-    });
+    // ONE parser for the spine's text (src/legs.js `parseSpineText`): a kill can land mid-append, so a broken
+    // LAST line is the failure being modelled; and a resumed run's own file carries exactly one torn line
+    // directly before each `leg-resume` marker (the resume never edits the torn bytes, it starts a fresh
+    // line). Both are tolerated and NAMED. A broken line anywhere else is a corrupt log, and reconstructing
+    // from one would invent a history.
+    const parsedDead = parseSpineText(raw);
+    for (const t of parsedDead.tolerated) {
+      err(t.why === 'tail'
+        ? `--resume: ignoring a truncated final line in ${deadSpineFile} (a kill mid-append — the expected shape)`
+        : `--resume: ignoring a truncated line ${t.line} in ${deadSpineFile} (a kill mid-append, left isolated by the next leg's marker)`);
+    }
+    if (parsedDead.corrupt) die(`--resume: ${deadSpineFile} is corrupt at line ${parsedDead.corrupt.line} (${parsedDead.corrupt.message}) — a reconstruction from a damaged log would invent a history`);
+    /** every record of the run's one file (all legs) */
+    deadAllEvents = parsedDead.records;
+    const allDeadEvents = deadAllEvents;
+    /** the legs already on the file, and the leg THIS resume will be (P5-R) */
+    deadLegs = legsOf(allDeadEvents);
+    // the leg a resume continues FROM is the latest leg that got as far as a `job-start`: a leg that died or
+    // was refused before runJob wrote one (a $0 stop) left no checkpoint, and the one behind it still stands
+    const fromLeg = deadLegs.findLast((l) => l.jobStart !== null) ?? deadLegs.at(-1);
+    /** the records `readResume` and every gate below read: that leg's own window, which carries its own declared fold */
+    const deadEvents = fromLeg ? fromLeg.records : allDeadEvents;
+    deadFromLegNo = fromLeg ? fromLeg.leg : 1;
     // is the dead run actually dead? Two processes on one patient is unrecoverable; a
     // false refusal costs one sentence. run-u's own pid is not on its spine, so the
     // watchdog's report or the run-list row is the pid there is — and its absence is not evidence of life.
-    const wdFile = `${deadSpineFile}.watchdog.json`;
+    // the watchdog's note for the leg being continued from (a resumed leg has its own note file)
+    const wdFile = watchdogNotePath(deadSpineFile, deadFromLegNo);
     /** @type {any} */
     let watchdog = null;
     if (existsSync(wdFile)) { try { watchdog = JSON.parse(readFileSync(wdFile, 'utf8')); } catch { /* an unreadable report is not evidence of life */ } }
@@ -704,6 +737,7 @@ async function execute(ctx) {
     /** @type {number|undefined} */
     let rowPid;
     if (cfgOn) { try { rowPid = readRunList({ home: cfgHome }).rows.findLast((r) => r.spine === deadSpineFile)?.pid; } catch { /* an unreadable list is not evidence of life */ } }
+    // a run's row carries its LATEST leg's pid (the run list folds `leg-start`); any earlier leg's note pid is checked too
     const alivePid = [watchdog?.pid, rowPid].find((p) => Number.isInteger(p) && isLiveRunner(p));
     if (alivePid !== undefined) {
       die(`--resume: pid ${alivePid} from ${deadSpineFile} is still alive (a bareloop runner). Two processes on one patient is unrecoverable — stop it first.`);
@@ -715,6 +749,8 @@ async function execute(ctx) {
     // closes was measured, not imagined (a report dated after a pause bills the human's
     // deciding time to the run's wall and can zero the remainder outright).
     const deathAt = deathAtOf({ watchdogAt: watchdog?.at, events: deadEvents });
+    // how the leg being continued from ended, for the marker the new leg opens with (`'died'`: no terminal recorded)
+    deadAfter = fromLeg?.outcome ?? 'died';
     dead = readResume(deadEvents, {
       direct: true,
       resumableOutcomes: RESUMABLE_HALTS,
@@ -792,13 +828,10 @@ async function execute(ctx) {
     if (!existsSync(doorSpineFile)) die(`--door: no spine at ${doorSpineFile} — a door belongs to a run that happened, and this one left no log`);
     let raw = '';
     try { raw = readFileSync(doorSpineFile, 'utf8'); } catch (e) { die(`--door: cannot read ${doorSpineFile}: ${e.message}`); }
-    doorEvents = [];
-    raw.split('\n').forEach((line, i) => {
-      if (!line.trim()) return;
-      try { /** @type {any[]} */ (doorEvents).push(JSON.parse(line)); } catch (e) {
-        die(`--door: ${doorSpineFile} is corrupt at line ${i + 1} (${e.message}) — a decision made on a damaged record is a decision about a run nobody can read`);
-      }
-    });
+    // the same parser as the resume reader: a resumed run's file carries one torn line before each marker
+    const parsedDoor = parseSpineText(raw);
+    if (parsedDoor.corrupt) die(`--door: ${doorSpineFile} is corrupt at line ${parsedDoor.corrupt.line} (${parsedDoor.corrupt.message}) — a decision made on a damaged record is a decision about a run nobody can read`);
+    doorEvents = parsedDoor.records;
     const start = doorEvents.find((/** @type {any} */ e) => e?.type === 'job-start');
     if (!start) die(`--door: ${doorSpineFile} carries no job-start — that is not a bareloop run's spine`);
     if (start.job !== spec.job) die(`--door: that spine is job "${start.job}", not "${spec.job}" — a door is answered against the spec that was signed for it`);
@@ -820,14 +853,11 @@ async function execute(ctx) {
       err(`  - or revise the goal/spec in ${SPEC_DESC} — a spec edit, so the hash changes and you sign the new one.`);
       throw new ExitSignal(2);
     }
-    const je = doorEvents.findLast((/** @type {any} */ e) => e?.type === 'job-end');
-    const spentKnown = typeof je?.spentUsd === 'number' && Number.isFinite(je.spentUsd);
-    doorPrior = {
-      spentUsd: spentKnown ? je.spentUsd : 0,
-      // a FLOOR stays a floor across the door (F6): an absent FIGURE is never "complete
-      // at $0" — completeness is only trusted when the number it completes is known
-      spendComplete: spentKnown && je?.spendComplete !== false,
-    };
+    // the chain's spend, on ONE basis per shape (`chainSpend`, src/monthly.js): a resumed run's several legs are
+    // summed by their own spend, never a later terminal's chain total on top of the earlier legs. A FLOOR stays a
+    // floor across the door (F6): an absent figure is never "complete at $0".
+    const chain = chainSpend(doorEvents);
+    doorPrior = { spentUsd: chain.usd, spendComplete: chain.complete };
   }
 
   /** is this resume the one a PERSON has to answer? Read off the recorded terminal,
@@ -1303,10 +1333,10 @@ async function execute(ctx) {
   // ── THE PAUSE DOOR (2026-08-17) — answered HERE, and it launches nothing.
   //
   // hamr's ruling replaced cancel with a pause that can resume, and the honest way to
-  // keep a checkpoint is to leave it alone. This runner writes one spine file per LEG,
+  // keep a checkpoint is to leave it alone. This runner appends one LEG per resume to the run's one spine file,
   // and a leg that returns before drafting emits no `plan-accepted` and no `step-end` —
   // which is exactly what `readStepCheckpoint` reads. So launching a run to say "not
-  // now" would mint a NEW runid whose own checkpoint is empty, and an operator who
+  // now" would add a LEG whose own checkpoint is empty, and an operator who
   // later resumed that runid would re-draft and re-pay for every step the paused leg
   // already finished. The checkpoint that matters is the one already on disk.
   //
@@ -1488,14 +1518,23 @@ async function execute(ctx) {
   // closed at its floor, with a note, once its process is gone). No limit set = no claim (the row is listed as
   // ever). An unreadable config.json, or a claim row that cannot be written, refuses too — a broken instrument
   // never silently reads "no limit".
-  const runid = ctx.bundle?.runid ?? Date.now().toString(36);
-  const spineFile = ctx.bundle ? join(spineDir, 'spine.jsonl') : join(spineDir, `u-${runid}.jsonl`);
+  // P5-R (hamr 2026-10-02: "one run, one id, one file"): a RESUME is the same run — the runid and the spine file
+  // are the halted run's own, and the new leg appends to it. Never a new id, never a second file.
+  const resuming = dead !== null && deadSpineFile !== null;
+  const runid = resuming
+    ? (ctx.bundle?.runid ?? basename(/** @type {string} */ (deadSpineFile)).replace(/\.jsonl$/, '').replace(/^u-/, ''))
+    : (ctx.bundle?.runid ?? Date.now().toString(36));
+  const spineFile = resuming ? /** @type {string} */ (deadSpineFile)
+    : (ctx.bundle ? join(spineDir, 'spine.jsonl') : join(spineDir, `u-${runid}.jsonl`));
+  /** which leg of the run this process is (1 = a fresh run) */
+  const LEG = resuming ? deadLegs.length + 1 : 1;
   const foldedUsd = dead ? dead.restart.priorSpentUsd : (doorPrior?.spentUsd ?? 0);
   const legCapUsd = Math.max(0, spec.budgetUsd - (typeof foldedUsd === 'number' && Number.isFinite(foldedUsd) ? foldedUsd : 0));
   // every row carries its runner's pid and the leg cap, limit set or not: a limit set LATER still holds it
   /** @type {import('./runlist.js').RunRow} */
   const runRow = {
-    at: new Date().toISOString(), runid, job: spec.job, spine: spineFile, patient: wd, via: ctx.bundle ? 'bundle' : 'run-u', pid: process.pid, capUsd: legCapUsd,
+    // a RESUMED run keeps its own start stamp (the row is listed only if the list has none; it is the run's, not the leg's)
+    at: resuming ? (deadLegs[0]?.start?.ts ?? new Date().toISOString()) : new Date().toISOString(), runid, job: spec.job, spine: spineFile, patient: wd, via: ctx.bundle ? 'bundle' : 'run-u', pid: process.pid, capUsd: legCapUsd,
   };
   let claimed = false;
   {
@@ -1503,9 +1542,9 @@ async function execute(ctx) {
     let refusal = null;
     try {
       if (cfgOn) {
-        const got = claimRun({ row: runRow, capUsd: legCapUsd, home: cfgHome });
+        const got = claimRun({ row: runRow, capUsd: legCapUsd, home: cfgHome, leg: LEG });
         claimed = got.claimed;
-        if (claimed) claimedRow = { runid, spine: spineFile, home: cfgHome };
+        if (claimed) claimedRow = { runid, spine: spineFile, home: cfgHome, leg: LEG };
         refusal = monthlyRefusalText(got.room);
       }
     } catch (e) {
@@ -1531,11 +1570,10 @@ async function execute(ctx) {
 
   // PANEL-BUILD.md P1 — one row in the run list, BEFORE any paid call (this
   // leg's own `runJob` further down, and BEFORE the provider-key checks that
-  // preceded this point already gated on). `runid` is fresh for THIS leg
-  // (cold start or resumed leg both mint one here), so `appendRun`'s own
-  // runid-dedup never fires on the ordinary path — it exists for a caller
-  // that legitimately re-enters with the same runid (e.g. a retried
-  // in-process test). A list-append failure must never block a real,
+  // preceded this point already gated on). `runid` is fresh on a cold start
+  // and the HALTED run's own on a resume (P5-R: a resume is the same run), so on a resume
+  // `appendRun`'s runid-dedup is what keeps it ONE row and the leg's claim is the
+  // `leg-start` beside it; on a cold start it never fires (a retried in-process test). A list-append failure must never block a real,
   // already-signed run: caught and named loudly, never rethrown.
   // `deps.runlistHome` — the same injectable test seam `ctx.deps` already
   // carries everything else through (env/out/err/provider/…): a caller that
@@ -1544,10 +1582,13 @@ async function execute(ctx) {
   // When the monthly claim above already appended this run's row, there is nothing to add.
   try {
     if (!claimed) {
+      // a RESUMED run is already listed: its row stays ONE row and this leg's claim is a `leg-start` beside it
+      // (the row is added only when the list has none)
       appendRun(runRow, { home: deps.runlistHome });
+      if (LEG > 1) appendLegStart({ type: 'leg-start', runid, leg: LEG, pid: process.pid, capUsd: legCapUsd, at: new Date().toISOString() }, { home: deps.runlistHome });
       // no limit set: the row is appended here, not by a claim — mark it so the execute catch releases it
       // the same way if the run exits before its spine has a first record (it lives in `deps.runlistHome`)
-      claimedRow = { runid, spine: spineFile, home: deps.runlistHome };
+      claimedRow = { runid, spine: spineFile, home: deps.runlistHome, leg: LEG };
     }
   } catch (/** @type {any} */ e) {
     err(`WARNING: could not add this run to ~/.config/bareloop/runs.jsonl (${e.message}) — the run continues; the panel's list will be missing this row.`);
@@ -1702,7 +1743,30 @@ async function execute(ctx) {
   // here (not inline at the `runJob` call below) so this pre-run reading lands
   // on the run's own spine in the SAME seq order everything else does, rather
   // than a second, disconnected spine writer.
-  const emit = makeSpine(spineFile);
+  // P5-R: a RESUME continues the halted run's own file. `seq` is monotonic per SPINE, so the emitter starts
+  // from the highest `seq` already in it; a kill can have left a torn line with no trailing newline, so ONE
+  // `\n` is written first and the torn bytes stay exactly as they are, alone on their own line (the spine is
+  // append-only forever: nothing here edits or truncates an existing byte).
+  let startSeq = 0;
+  if (resuming) {
+    for (const e of deadAllEvents) if (typeof e?.seq === 'number' && Number.isFinite(e.seq) && e.seq > startSeq) startSeq = e.seq;
+    const fd = openSync(spineFile, 'r');
+    try {
+      const size = fstatSync(fd).size;
+      if (size > 0) {
+        const last = Buffer.alloc(1);
+        readSync(fd, last, 0, 1, size - 1);
+        if (last[0] !== 0x0a) appendFileSync(spineFile, '\n');
+      }
+    } finally { closeSync(fd); }
+  }
+  const emit = makeSpine(spineFile, { startSeq });
+  // …and the leg's FIRST record is its marker, written BEFORE the outside watchdog is spawned: the watchdog
+  // judges a run dead by its spine file going quiet, and a file untouched since the last leg would read as stale.
+  if (resuming) {
+    emit(LEG_RESUME, { leg: LEG, after: deadAfter, at: new Date().toISOString() });
+    legBegun = true;
+  }
 
   // PRD item 33/M2, call site 3(a) — a source-door manifest, when this patient
   // was PREPARED through `prepareSource` (`scripts/prep-source.mjs`), sits
@@ -1712,7 +1776,7 @@ async function execute(ctx) {
   // manifest — that absence IS "repo jobs untouched", never an invented
   // destination for a job that declared none. A manifest that EXISTS but
   // cannot be read or parsed is a named $0 stop, never a silent skip.
-  const sourceManifest = await readSourceManifest(dirname(wd));
+  const sourceManifest = await readSourceManifest(into);
   if (sourceManifest.stop !== null) {
     emit('destination-refused', { code: sourceManifest.code, detail: sourceManifest.stop });
     emit('run-end', { outcome: 'escalated' });
@@ -1731,7 +1795,7 @@ async function execute(ctx) {
     // against `wd` alone let a destination at `<into>/profile.md` (inside the
     // run's own scratch area, outside the frozen tree, but still bareloop's
     // own scratch plumbing no destination should land in) slip through clean.
-    const dp = await proveDestination(frontDoor.destination, { into: dirname(wd) });
+    const dp = await proveDestination(frontDoor.destination, { into });
     if (dp.stop !== null) {
       emit('destination-refused', { code: dp.code, detail: dp.stop });
       emit('run-end', { outcome: 'escalated' });
@@ -1792,6 +1856,8 @@ async function execute(ctx) {
     // time on exactly the run it is watching (F70's shape).
     ...(RESUME_WALL_MS === null ? [] : ['--wall-ms', String(RESUME_WALL_MS)]),
     '--grace-ms', String(worstCloseSilenceMs),
+    // this leg's own note file (leg 1 keeps the name every run has always had)
+    '--report', watchdogNotePath(spineFile, LEG),
   ], { stdio: ['ignore', 'ignore', 'inherit'] });
   // A spawn failure arrives as an EVENT, and an unhandled 'error' on a ChildProcess is
   // an uncaught exception — i.e. a guard that could not start would END the paid run it
@@ -1828,9 +1894,16 @@ async function execute(ctx) {
     lagDue = now + LAG_POLL_MS;
   }, LAG_POLL_MS);
 
+  // P5 item 5 — the STOP request file (`<spine>.stop`, src/legs.js). A request belongs to ONE leg: one left on
+  // disk by an earlier leg (a click that raced that leg's end) is cleared HERE, before this leg's first step, so
+  // a resume is never stopped at once by a request it did not receive. The engine also consumes the file when it
+  // honours it, and the `finally` below clears whatever is left when the leg ends.
+  const stopFile = stopFilePath(spineFile);
+  try { rmSync(stopFile, { force: true }); } catch { /* best-effort — a stop surface must never kill the run */ }
   let outcome;
   try {
     outcome = await runJob(spec, {
+      stopFile,
       // PRD item 27/M3 — the SAME `emit` the pre-run close-timing reading above
       // used (never a second `makeSpine(spineFile)` here: two independent
       // emitters against one file would both start their seq counter at 0 and
@@ -1919,6 +1992,7 @@ async function execute(ctx) {
     // the guard outlives the run only by accident, never by design
     try { watchdog.kill('SIGKILL'); } catch { /* already gone */ }
     clearInterval(lagTimer);
+    try { rmSync(stopFile, { force: true }); } catch { /* best-effort */ }
   }
   const legMs = Date.now() - started;
 
@@ -1926,7 +2000,11 @@ async function execute(ctx) {
   // honest. No classification into pass/fail buckets — one run classifies nothing.
   const raw = readFileSync(spineFile, 'utf8');
   // tolerant: a torn/garbled line is skipped, not a crash (the shipped bundle-run fix, now the one engine read)
-  const events = parseJsonl(spineFile).records;
+  const allEvents = parseJsonl(spineFile).records;
+  // P5-R: the readout below is about THIS leg — its own rounds, its own halts, its own terminal. A resumed run's
+  // earlier legs are on the same file, and reading them here would count their rounds, tokens and halts again
+  // (the run's chain-wide figures are the folded ones the lines below already print).
+  const events = legsOf(allEvents).at(-1)?.records ?? allEvents;
   const je = events.findLast((e) => e.type === 'job-end');
   // The claim's WRITE-BACK (hamr 2026-09-30): when the run ends it settles its own claim on the monthly
   // limit — its final spend, attributed to itself. Best-effort: a run that dies before here is settled
@@ -1934,7 +2012,7 @@ async function execute(ctx) {
   if (je) {
     try {
       const fin = legSpend(events);
-      appendRunEvent({ runid, type: 'settled', by: runid, spentUsd: fin.usd, spendComplete: fin.complete, at: new Date().toISOString() }, { home: cfgHome });
+      appendRunEvent({ runid, type: 'settled', by: runid, spentUsd: fin.usd, spendComplete: fin.complete, at: new Date().toISOString(), ...(LEG > 1 ? { leg: LEG } : {}) }, { home: cfgHome });
     } catch (/** @type {any} */ e) { err(`WARNING: could not settle this run's claim in ~/.config/bareloop/runs.jsonl (${e.message}) — the next run settles it once this process is gone.`); }
   }
   // the ONE spelling of the text-side scan (src/validate.js) — a hand-rolled copy
@@ -1946,8 +2024,50 @@ async function execute(ctx) {
 
   const auditSrc = join(wd, 'gate-audit.jsonl');
   let auditFile = null;
-  if (existsSync(auditSrc)) { auditFile = ctx.bundle ? join(spineDir, 'gate-audit.jsonl') : join(spineDir, `u-${runid}-gate-audit.jsonl`); renameSync(auditSrc, auditFile); }
-  const audit = auditFile ? readFileSync(auditFile, 'utf8').trimEnd().split('\n').filter(Boolean).map((l) => JSON.parse(l)) : [];
+  // THIS leg's own audit rows — the readout's `writes` and BEHAVIOUR lines are about this leg, read from the
+  // leg's own tree file before it is filed
+  /** @type {any[]} */
+  let audit = [];
+  if (existsSync(auditSrc)) {
+    const legAuditText = readFileSync(auditSrc, 'utf8');
+    audit = legAuditText.trimEnd().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    auditFile = ctx.bundle ? join(spineDir, 'gate-audit.jsonl') : join(spineDir, `u-${runid}-gate-audit.jsonl`);
+    // P5-R: a resumed leg ADDS to the run's one audit file (a rename would overwrite the earlier legs' rows)
+    if (LEG > 1 && existsSync(auditFile)) {
+      const prior = readFileSync(auditFile, 'utf8');
+      appendFileSync(auditFile, `${prior.length > 0 && !prior.endsWith('\n') ? '\n' : ''}${legAuditText}`);
+      unlinkSync(auditSrc);
+    } else moveFile(auditSrc, auditFile);
+  }
+  // ── P6 item 1: a repo job on a WORKTREE in the person's own repo. GREEN: the run's work is committed on its work
+  // branch and the worktree folder removed (an already-green is a green: a cold one has nothing to commit, a resumed one may hold uncommitted work) — the branch stays, and the merge stays the person's. Anything else
+  // (stopped, capped, died, red): the folder stays so Resume works, and the Ended block names it. A green that opened a
+  // review door is committed too (the branch always holds the work) but keeps its folder: an accept at the door re-runs
+  // the mechanical stages against that tree.
+  // It runs HERE, right after the gate-audit move, so a later readout step that throws can never skip the commit.
+  const doorHere = events.findLast((e) => e.type === 'review-door') ?? null;
+  /** @type {string | null} */
+  let worktreeLine = null;
+  const wtManifest = sourceManifest.present ? sourceManifest.manifest : null;
+  if (typeof wtManifest?.worktree === 'string' && typeof wtManifest?.repo === 'string') {
+    if (outcome === 'green' || outcome === 'already-green') {
+      const wb = events.findLast((e) => e.type === 'work-branch' && typeof e.branch === 'string') ?? null;
+      try {
+        // the branch ALWAYS holds a green's work (the panel tells the person to merge it); only the FOLDER waits on a door
+        const fin = commitWork(wd, `bareloop: ${spec.job} (run ${runid})`);
+        // an already-green COLD run never made a work branch (the close passed before any work): nothing to name
+        const done = fin.committed ? `final commit ${fin.sha}` : (wb ? 'nothing left to commit' : 'nothing was changed (the close already passed)');
+        const onBranch = wb?.branch ?? 'the work branch';
+        if (doorHere) worktreeLine = `\nWORKTREE  ${done}${wb || fin.committed ? ` on ${onBranch}` : ''}; the worktree folder is KEPT for the review door — ${wd}`;
+        else {
+          const gone = removeWorktree(wtManifest.repo, wd);
+          worktreeLine = `\nWORKTREE  ${done}${wb || fin.committed ? ` on ${onBranch}` : ''}; ${gone ? 'the worktree folder is removed' : `the worktree folder could not be removed — ${wd}`}`;
+        }
+      } catch (e) {
+        worktreeLine = `\nWORKTREE  the final commit failed, so the folder is KEPT: ${wd} (${redactSecrets(String(/** @type {Error} */ (e).message).split('\n')[0])})`;
+      }
+    }
+  }
   const writes = audit.filter((e) => e.decision === 'allow' && (e.action?.type === 'write' || e.action?.type === 'edit'));
 
   out(`\noutcome   ${outcome}`);
@@ -2096,7 +2216,7 @@ async function execute(ctx) {
     // as "contained". D3 rework: `destination` is a DIRECTORY now, and a job
     // may produce more than one file — `copyOut` delivers every non-empty file
     // under `output/`, each under its own dated name, and returns the list.
-    const co = await copyOut({ tree: wd, into: dirname(wd), destination: frontDoor.destination });
+    const co = await copyOut({ tree: wd, into, destination: frontDoor.destination });
     if (co.stop === null) {
       // `f.path`, never `frontDoor.destination` — each file lands under its
       // OWN dated name (M2b fix 4: `profile-2026-09-12.md`, `-2` the same
@@ -2150,9 +2270,8 @@ async function execute(ctx) {
         // FOLDED across a resume, like every other money and time number this readout
         // prints: the row records what the RUN cost, never what this leg cost
         wallMs: legMs + (dead ? dead.restart.priorWallMs : 0),
-        // the ROUND count CANNOT fold — a resume leg writes a fresh spine and the halted
-        // leg's restart record declares money and wall but never rounds — so on a resume
-        // this is a FLOOR, and it says so the way the money above does (F6: a floor that
+        // the ROUND count is not part of the declared fold — a resumed leg's `job-start` declares
+        // money and wall but never rounds — so on a resume this is THIS LEG's count, a FLOOR, and it says so the way the money above does (F6: a floor that
         // reads as exact is dishonest; report the floor WITH its completeness)
         rounds: legRounds,
         roundsComplete: !dead,
@@ -2183,7 +2302,6 @@ async function execute(ctx) {
   // ENDED and its verdict is minted — this readout offers the three doors over it and
   // changes nothing about the outcome printed above. Read off the run's own record
   // (never off a flag), so a green that opened no door prints exactly what it always did.
-  const doorHere = events.findLast((e) => e.type === 'review-door') ?? null;
   if (doorHere) {
     out('');
     for (const l of reviewDoorPackage({
@@ -2283,6 +2401,7 @@ async function execute(ctx) {
       out('MEMORY-CACHE  no record (run ended before its summary)');
     }
   }
+  if (worktreeLine !== null) out(worktreeLine);
   out(`\nspine     ${spineFile}`);
   out(`patient   left AS THE RUN LEFT IT (read it before the next run resets to the seed)`);
 
@@ -2292,7 +2411,7 @@ async function execute(ctx) {
     // owns no spine, so its row is released (folded out of the list, like a monthly refusal) rather than
     // left as a ghost that keeps the month reading "at least". Once the spine exists the run is a real,
     // listed run and ends by its own job-end. A failed release write never masks the original exit.
-    if (claimedRow && !existsSync(claimedRow.spine)) releaseClaimedRow();
+    if (claimedRow && (claimedRow.leg > 1 ? !legBegun : !existsSync(claimedRow.spine))) releaseClaimedRow();
     if (e instanceof ExitSignal) return e.code;
     throw e;
   }
@@ -2312,6 +2431,7 @@ function buildCtx(mode, opts) {
     workdir: /** @type {string} */ (opts.workdir),
     seed: /** @type {string} */ (opts.seed),
     spineName: /** @type {string} */ (opts.spineName),
+    ...(opts.into === undefined ? {} : { into: opts.into }),
     model: opts.model ?? null,
     readShim: opts.readShim ?? null,
     scout: opts.scout ?? null,
@@ -2408,7 +2528,7 @@ export async function main(argv, deps = {}) {
       die(`give one of --job <key> (one of: ${Object.keys(JOBS).join(', ')}) or --spec <path to resolved-spec.json> `
         + '— a run has to name a job one of the two ways.');
     }
-    /** @type {{spec: string, workdir: string, spine: string, seed: string}} */
+    /** @type {{spec: string, workdir: string, spine: string, seed: string, into?: string}} */
     let target;
     /** the spec's own path, wherever it was found — a `jobs/` file for `--job`,
      * an arbitrary `resolved-spec.json` for `--spec`. */
@@ -2507,9 +2627,14 @@ export async function main(argv, deps = {}) {
       if (typeof seed !== 'string' || !seed) {
         die(`--spec ${specPath}: ${into}/source.json carries no seed commit — not a prepared copy this runner can trust`);
       }
-      const specWorkdir = join(into, 'tree');
+      // P6 item 1: a repo job's tree is a WORKTREE in the person's own repo, recorded in the manifest; every other prepared
+      // copy keeps its tree at `<into>/tree`
+      const worktreeRun = typeof manifestRead.manifest.worktree === 'string' && manifestRead.manifest.worktree !== '';
+      const specWorkdir = worktreeRun ? manifestRead.manifest.worktree : join(into, 'tree');
       if (!existsSync(specWorkdir) || !existsSync(join(specWorkdir, '.git'))) {
-        die(`--spec ${specPath}: the prepared copy's tree is gone (${specWorkdir} has no .git) — nothing to run against; re-prepare the source`);
+        die(worktreeRun
+          ? `--spec ${specPath}: the job's worktree is gone (${specWorkdir} has no .git) — nothing to run against; start the job again from the page`
+          : `--spec ${specPath}: the prepared copy's tree is gone (${specWorkdir} has no .git) — nothing to run against; re-prepare the source`);
       }
       target = {
         // display-only in --spec mode (SPEC_DESC below is what actually prints)
@@ -2520,6 +2645,7 @@ export async function main(argv, deps = {}) {
         // is, just computed instead of typed by a developer.
         spine: `${spec.job}-bareloop`,
         seed,
+        into,
       };
       SELECTOR = `--spec ${specPath}`;
       SPEC_DESC = specPath;
@@ -2533,6 +2659,7 @@ export async function main(argv, deps = {}) {
       workdir: target.workdir,
       seed: target.seed,
       spineName: target.spine,
+      ...(target.into === undefined ? {} : { into: target.into }),
       model: argFlag('model'),
       readShim: argFlag('read-shim'),
       scout: argFlag('scout'),