bareloop 0.34.0 → 0.36.0

package/src/bundlerun.js

@@ -16,13 +16,15 @@
 import { hostname } from 'node:os';
 import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { join, resolve } from 'node:path';
 
 import {
   readBundle, resolveBundleSpec, checkEnvelope, bless, verifyBlessing, appendHistory, checkBundleDeps,
 } from './bundle.js';
 import { jobSpecHash } from './job.js';
+import { addWorktree, worktreePath } from './worktree.js';
 import { parseJsonl } from './replayio.js';
+import { legsOf } from './legs.js';
 import { startRun, resumeRun } from './userrun.js';
 
 /**
@@ -117,7 +119,9 @@ export async function bundleMain(args, {
   // after its own $0 refusals, so a refusal leaves no worktree behind. A RESUME is the one
   // exception: it re-enters the SAME worktree its halted run left (recorded in that run's
   // `run.json`), and a gone tree is a stop, never a silent fresh start.
-  const runid = now().toString(36);
+  // P5-R (hamr 2026-10-02: one run, one id, one file): a RESUME is the same run — same runid, same run dir, same
+  // spine; the engine appends the new leg to it. Only a fresh run mints an id.
+  const runid = resumeArg !== undefined ? resumeArg : now().toString(36);
   /** @type {string} */
   let repo;
   /** @type {string} */
@@ -126,6 +130,8 @@ export async function bundleMain(args, {
   let worktree;
   /** @type {string|null} */
   let deadSpine = null;
+  /** the run's own first-leg stamp, kept when a later leg rewrites `run.json` (it is the run's start, not the leg's) @type {string|null} */
+  let firstAt = null;
   if (resumeArg !== undefined) {
     if (!/^[a-z0-9]+$/.test(resumeArg)) { err(`--resume ${JSON.stringify(resumeArg)} is not a run id of this bundle`); return 1; }
     const deadRunJson = join(bundleDir, 'runs', resumeArg, 'run.json');
@@ -150,6 +156,7 @@ export async function bundleMain(args, {
     repo = rec.repo;
     seed = rec.seed;
     worktree = rec.worktree;
+    if (typeof rec.at === 'string') firstAt = rec.at;
     deadSpine = join(bundleDir, 'runs', resumeArg, 'spine.jsonl');
   } else {
     repo = resolve(cwd, /** @type {string} */ (repoArg));
@@ -159,7 +166,7 @@ export async function bundleMain(args, {
       err(`--repo ${repoArg} must be a git repository with at least one commit: ${/** @type {Error} */ (e).message}`);
       return 1;
     }
-    worktree = join(repo, '.bareloop', 'wt', runid);
+    worktree = worktreePath(repo, runid);
     if (existsSync(worktree)) { err(`worktree already exists: ${worktree}`); return 1; }
   }
 
@@ -180,16 +187,11 @@ export async function bundleMain(args, {
   // at job-end (a killed run has none) and the run list is machine-global.
   const prepareTree = () => {
     if (deadSpine === null) {
-      mkdirSync(dirname(worktree), { recursive: true });
-      try {
-        execFileSync('git', ['-C', repo, 'worktree', 'add', '--detach', worktree, 'HEAD'], { encoding: 'utf8' });
-      } catch (e) {
-        throw new Error(`git worktree add failed: ${/** @type {Error} */ (e).message}`);
-      }
+      addWorktree(repo, worktree);
     }
     mkdirSync(runDir, { recursive: true });
     writeFileSync(join(runDir, 'run.json'), `${JSON.stringify({
-      runid, worktree, seed, repo, at: new Date(now()).toISOString(), ...(resumeArg === undefined ? {} : { resumedFrom: resumeArg }),
+      runid, worktree, seed, repo, at: firstAt ?? new Date(now()).toISOString(),
     }, null, 2)}\n`);
   };
 
@@ -227,7 +229,9 @@ export async function bundleMain(args, {
   // 7. history + (on a first green) the blessing — off THIS run's own spine, tolerant of
   // a torn line. No job-end (a $0 refusal, a crash) means no history row, as ever.
   const events = existsSync(spineFile) ? parseJsonl(spineFile).records : [];
-  const je = events.findLast((/** @type {any} */ e) => e.type === 'job-end');
+  // the LATEST leg's terminal: an earlier leg's job-end on the same file is a row already written for it
+  const legs = legsOf(events);
+  const je = legs.at(-1)?.jobEnd ?? null;
   if (!je) return engineCode;
   const outcome = je.outcome;
   const spentUsd = je.spentUsd ?? null;
@@ -246,7 +250,8 @@ export async function bundleMain(args, {
     branch,
     bundleHash: manifest.bundleHash,
     approveHash,
-    ...(resumeArg === undefined ? {} : { resumedFrom: resumeArg }),
+    // one row per LEG of the one run; the first leg's row keeps the shape it always had
+    ...(legs.length > 1 ? { leg: legs.length } : {}),
   });
   if (outcome === 'green' && !bundle.blessing) {
     bless(bundleDir, {

package/src/draftspend.js

@@ -0,0 +1,197 @@
+// Drafting spend that never became a run (self-review 2026-10-05, hamr's ruling A).
+//
+// A panel authoring session pays for model calls (survey, declaration, confirm turn) BEFORE any run exists.
+// That spend rode only in memory (`state.draftSpentUsd`) and reached disk when the session was signed and run
+// (`--draft-spent-usd` -> the run's spine). Abandon, a refusal, or a panel restart lost it, while the monthly
+// limit and the Money tab never counted it. So the session writes `<session dir>/draft-spend.json` after EVERY
+// metered call (one owner: the session's `onCall`, src/panel/authorsession.js), and the money readers
+// (`readLegs`, src/monthly.js) add every session folder that carries one and NEVER became a run.
+//
+// "Became a run" = some run-list row's `spine` or `patient` path sits inside that session's folder: a signed run
+// already carries its drafting spend through `--draft-spent-usd`, so counting the file too would double it.
+// Month attribution is the file's `startedAt` (the first metered call): fixed once written, so a session's
+// figure never moves between months as spend continues, the same start-date rule a run's leg uses.
+// `spendComplete: false` = "at least", never $0 (F6).
+import { appendFileSync, existsSync, readdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { join, resolve, sep } from 'node:path';
+import { readRunList, runlistHome } from './runlist.js';
+
+export const DRAFT_SPEND_FILE = 'draft-spend.json';
+/** the session's drafting LOG: an append-only JSONL beside draft-spend.json (one owner: the session, src/panel/authorsession.js). Three event kinds, see {@link DraftEvent}. */
+export const DRAFT_LOG_FILE = 'draft-log.jsonl';
+
+/**
+ * One line of the drafting log. `no` = the step's position in the session's progress list (a step id can repeat).
+ *  - `step-start`  {no, id, label, at}
+ *  - `step-end`    {no, status: 'done'|'failed', label, at}   (a re-opened step writes `step-reopen` {no, at} first)
+ *  - `call`        {no, step, label, model, costUsd (null stays null), unpricedRounds, at}: one METERED model call
+ *    (no token counts: the call path does not carry them without reworking the library, so none are recorded)
+ * @typedef {{kind: string, no: number, at: string, [k: string]: any}} DraftEvent
+ */
+
+/**
+ * Append one event to `<dir>/draft-log.jsonl`. Best-effort like draft-spend.json: a disk fault never stops the draft.
+ * @param {string} dir the session's folder
+ * @param {DraftEvent} ev
+ * @returns {void}
+ */
+export function appendDraftLog(dir, ev) {
+  try { appendFileSync(join(dir, DRAFT_LOG_FILE), `${JSON.stringify(ev)}\n`); } catch { /* money already spent stays in memory */ }
+}
+
+/**
+ * @typedef {object} DraftSpend
+ * @property {string} sessionId
+ * @property {number} spentUsd the known floor of the session's drafting spend
+ * @property {boolean} spendComplete false = `spentUsd` is a floor ("at least")
+ * @property {string|null} provider the worker's provider shape (`anthropic-api` | `openai-api` | ...)
+ * @property {string|null} baseUrl
+ * @property {string|null} model
+ * @property {string} startedAt ISO, the first metered call
+ * @property {string} updatedAt ISO, the latest metered call
+ */
+
+/**
+ * (Re)write `<dir>/draft-spend.json` atomically (tmp + rename).
+ * @param {string} dir the session's folder
+ * @param {DraftSpend} rec
+ * @returns {void}
+ */
+export function writeDraftSpend(dir, rec) {
+  const file = join(dir, DRAFT_SPEND_FILE);
+  const tmp = `${file}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(rec, null, 2)}\n`);
+  renameSync(tmp, file);
+}
+
+/** @param {string} p @param {string} dir @returns {boolean} */
+const inside = (p, dir) => typeof p === 'string' && (resolve(p) === dir || resolve(p).startsWith(dir + sep));
+
+/**
+ * Every session folder's drafting spend that never became a run.
+ * @param {{ home?: string, sessionsRoot?: string }} [opts] `home` = the bareloop config dir (as everywhere in src/monthly.js); the sessions live in `<home>/panel-sessions` unless `sessionsRoot` names them
+ * @returns {DraftSpend[]}
+ */
+export function readOrphanDraftSpends(opts = {}) {
+  const root = resolve(opts.sessionsRoot ?? join(runlistHome(opts.home), 'panel-sessions'));
+  if (!existsSync(root)) return [];
+  /** @type {string[]} */
+  let names;
+  try { names = readdirSync(root); } catch { return []; }
+  const { rows } = readRunList({ home: opts.home });
+  /** @type {DraftSpend[]} */
+  const out = [];
+  for (const name of names) {
+    const dir = join(root, name);
+    const file = join(dir, DRAFT_SPEND_FILE);
+    if (!existsSync(file)) continue;
+    if (rows.some((r) => inside(r.spine, dir) || (r.patient && inside(r.patient, dir)))) continue;
+    try {
+      const j = JSON.parse(readFileSync(file, 'utf8'));
+      if (!j || typeof j !== 'object' || !Number.isFinite(j.spentUsd)) throw new Error('unreadable');
+      out.push({
+        sessionId: String(j.sessionId ?? name), spentUsd: j.spentUsd, spendComplete: j.spendComplete === true,
+        provider: typeof j.provider === 'string' ? j.provider : null, baseUrl: typeof j.baseUrl === 'string' ? j.baseUrl : null,
+        model: typeof j.model === 'string' ? j.model : null, startedAt: String(j.startedAt), updatedAt: String(j.updatedAt),
+      });
+    } catch {
+      // a file that names money but cannot be read is unknown spend: an "at least" of $0, dated unknown
+      out.push({ sessionId: name, spentUsd: 0, spendComplete: false, provider: null, baseUrl: null, model: null, startedAt: 'unreadable', updatedAt: 'unreadable' });
+    }
+  }
+  return out;
+}
+
+/**
+ * The session folder a run-list row became a run in: the folder under `<home>/panel-sessions` that carries a drafting
+ * log and holds the row's `spine` or `patient` ("became a run", the same rule as {@link readOrphanDraftSpends}).
+ * A Reuse-workflow run, a CLI run and an imported run sit in no such folder.
+ * @param {{spine?: string, patient?: string|null}} row
+ * @param {{ home?: string, sessionsRoot?: string }} [opts]
+ * @returns {string|null}
+ */
+export function sessionDirForRow(row, opts = {}) {
+  const root = resolve(opts.sessionsRoot ?? join(runlistHome(opts.home), 'panel-sessions'));
+  /** @type {string[]} */
+  let names;
+  try { names = readdirSync(root); } catch { return null; }
+  for (const name of names) {
+    const dir = join(root, name);
+    if (!existsSync(join(dir, DRAFT_LOG_FILE))) continue;
+    if (inside(/** @type {string} */ (row.spine), dir) || (row.patient && inside(row.patient, dir))) return dir;
+  }
+  return null;
+}
+
+/**
+ * Fold `<dir>/draft-log.jsonl` into one record per drafting step, each with its calls. A line that cannot be parsed is
+ * skipped (a torn last line must not hide the rest).
+ * @param {string} dir
+ * @returns {{no: number, id: string, label: string, status: 'running'|'done'|'failed', startedAt: string, endedAt: string|null, wallMs: number|null,
+ *   calls: {label: string, model: string|null, costUsd: number|null, unpricedRounds: number, at: string}[]}[]}
+ */
+export function readDraftSteps(dir) {
+  /** @type {string} */
+  let text;
+  try { text = readFileSync(join(dir, DRAFT_LOG_FILE), 'utf8'); } catch { return []; }
+  /** @type {Map<number, any>} */
+  const byNo = new Map();
+  /** @type {any[]} */
+  const orphanCalls = [];
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue;
+    let ev;
+    try { ev = JSON.parse(line); } catch { continue; }
+    if (!ev || typeof ev !== 'object' || !Number.isInteger(ev.no)) continue;
+    if (ev.kind === 'step-start') {
+      byNo.set(ev.no, { no: ev.no, id: String(ev.id), label: String(ev.label), status: 'running', startedAt: ev.at, endedAt: null, wallMs: null, calls: [] });
+    } else if (ev.kind === 'step-end' && byNo.has(ev.no)) {
+      const x = byNo.get(ev.no);
+      x.status = ev.status === 'failed' ? 'failed' : 'done';
+      x.endedAt = ev.at;
+      if (typeof ev.label === 'string') x.label = ev.label;
+    } else if (ev.kind === 'step-reopen' && byNo.has(ev.no)) {
+      const x = byNo.get(ev.no);
+      x.status = 'running';
+      x.endedAt = null;
+    } else if (ev.kind === 'call') {
+      const c = { label: String(ev.label), model: typeof ev.model === 'string' ? ev.model : null, costUsd: typeof ev.costUsd === 'number' ? ev.costUsd : null, unpricedRounds: Number(ev.unpricedRounds) || 0, at: String(ev.at) };
+      (byNo.get(ev.no)?.calls ?? orphanCalls).push(c);
+    }
+  }
+  const steps = [...byNo.values()].sort((a, b) => a.no - b.no);
+  for (const x of steps) {
+    const a = Date.parse(x.startedAt);
+    const b = x.endedAt === null ? NaN : Date.parse(x.endedAt);
+    x.wallMs = Number.isFinite(a) && Number.isFinite(b) ? Math.max(0, b - a) : null;
+  }
+  return steps;
+}
+
+/**
+ * The DRAFTING PART of a run (hamr 2026-10-06, option A): the first part of the run's views, built from the session's
+ * drafting log. `null` when the run did not come out of a panel session, or the log carries no metered call (a Reuse
+ * workflow run, a CLI run, a run older than the log). The part's money is the SPINE's figure (`job-start.draftSpentUsd`,
+ * passed in) — the log's calls are shown beside it, never summed into a second total; `null` spine figure = no part.
+ * @param {{spine?: string, patient?: string|null}} row
+ * @param {{draftSpentUsd: number|null, draftSpendComplete: boolean|null}} spine the run's own drafting figures
+ * @param {{ home?: string, sessionsRoot?: string }} [opts]
+ * @returns {any|null}
+ */
+export function draftingPartFor(row, spine, opts = {}) {
+  if (spine.draftSpentUsd === null) return null;
+  const dir = sessionDirForRow(row, opts);
+  if (!dir) return null;
+  const steps = readDraftSteps(dir);
+  const calls = steps.reduce((n, x) => n + x.calls.length, 0);
+  if (calls === 0) return null;
+  const starts = steps.map((x) => Date.parse(x.startedAt)).filter(Number.isFinite);
+  const ends = steps.map((x) => (x.endedAt === null ? NaN : Date.parse(x.endedAt))).filter(Number.isFinite);
+  return {
+    kind: 'drafting', id: 'drafting', label: 'drafting', occurrence: 1, leg: 1, outcome: null, blocked: 0,
+    attempts: [], rounds: calls, toolCalls: 0, byTool: null,
+    wallMs: starts.length && ends.length ? Math.max(0, Math.max(...ends) - Math.min(...starts)) : null,
+    spentUsd: spine.draftSpentUsd, spendComplete: spine.draftSpendComplete !== false, unpricedRounds: 0,
+    draftSteps: steps,
+  };
+}

package/src/exits.js

@@ -23,7 +23,7 @@
 //     unrunnable check is a stop, never a silent pass).
 
 import { createHash } from 'node:crypto';
-import { readFile, readdir } from 'node:fs/promises';
+import { readFile, readdir, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { globToPrefix } from './validate.js';
 
@@ -62,6 +62,15 @@ export async function snapshotScope(dir, scope) {
   const prefix = globToPrefix(scope);
   /** @type {Map<string, string>} */
   const snap = new Map();
+  // A scope whose prefix names a single regular FILE (a file-valued writeScope
+  // becomes `src/x.js/**`) snapshots that one file, keyed by the prefix itself —
+  // readdir on a file throws ENOTDIR, which read as an empty tree forever (F212).
+  try {
+    if ((await stat(join(dir, prefix))).isFile()) {
+      snap.set(prefix, createHash('sha256').update(await readFile(join(dir, prefix))).digest('hex'));
+      return snap;
+    }
+  } catch { /* missing or unreadable: fall through to the directory path */ }
   /** @type {string[]} */
   let entries;
   try {

package/src/index.js

@@ -153,9 +153,9 @@ export { answerReviewDoor } from './reviewdoor.js';
 // but no longer read by any grading path), the rulebook a card SELECTS from,
 // the card gate, and the two halves themselves so a calibration harness can
 // grade the whole pipe without running a close.
-// `defaultJudgeLoop` is the one spelling of how this repo drives a judge; the
-// runner reaches it through `runPlan`'s `judgeProvider`, and it is exported so a
-// caller building its own harness does not spell a second one.
+// `defaultJudgeLoop` (src/judged.js) is the one spelling of how this repo drives a
+// judge; the runner reaches it through `runPlan`'s `judgeProvider`. It is internal:
+// the package root does not export it.
 export {
   JUDGE_MODEL, resolveJudge, JUDGE_RULES, JUDGE_RULE_IDS,
   runLocate, decide,

package/src/interviewrun.js

@@ -743,7 +743,7 @@ export async function main(argv, deps = {}) {
     say(`It runs under the AUTHORING ceiling (${CEILING_USD === null ? 'UNBOUNDED — you gave no --budget' : `$${CEILING_USD}`}), which is not the job's $${draft.budgetUsd}.`);
     say('It stops at prepareSigning: it never signs, and it never runs the job.');
   } else {
-    say('NEXT — running run-author.mjs on this source stops right away, at $0: no scout, no confirm turn, no model call.');
+    say('NEXT — running bareloop author on this source stops right away, at $0: no scout, no confirm turn, no model call.');
     say('It never signs and never runs the job — bareloop has no checks for this kind of job yet.');
   }
   say('');
@@ -781,11 +781,11 @@ export async function main(argv, deps = {}) {
   if (!KEYED) {
     say('');
     if (providerEnvKey && keyProblem) {
-      say(`  (${providerEnvKey} is set but ${keyProblem} — run-author refuses without a clean key; secrets are never trimmed or repaired, only reported)`);
+      say(`  (${providerEnvKey} is set but ${keyProblem} — bareloop author refuses without a clean key; secrets are never trimmed or repaired, only reported)`);
     } else {
       say(providerEnvKey
-        ? `  (${providerEnvKey} is not set in this shell — run-author refuses without it; secrets load from the environment, never the tree)`
-        : `  (provider "${PROVIDER}" is not in the runnable table — run-author will refuse it loud; this is not a key problem)`);
+        ? `  (${providerEnvKey} is not set in this shell — bareloop author refuses without it; secrets load from the environment, never the tree)`
+        : `  (provider "${PROVIDER}" is not in the runnable table — bareloop author will refuse it loud; this is not a key problem)`);
     }
     // The repair, in plain words and WITHOUT a command: which secret store a person
     // keeps their key in is theirs, and printing one specific incantation would be
@@ -802,9 +802,9 @@ export async function main(argv, deps = {}) {
     : null;
   if (depsGapAtHandoff) {
     say('');
-    say(`  The copy still has no installed packages (${depsGapAtHandoff.reason}) — run-author would only instrument-stop on it.`);
+    say(`  The copy still has no installed packages (${depsGapAtHandoff.reason}) — bareloop author would only instrument-stop on it.`);
     say(`    cd ${prep.tree} && ${depsGapAtHandoff.command}`);
-    say('  then run run-author.mjs yourself with the command above.');
+    say('  then run bareloop author yourself with the command above.');
   }
   say('');
   // The default is NO, and it is the same lean the pause's doors take: the answer that
@@ -835,7 +835,7 @@ export async function main(argv, deps = {}) {
     say('');
     const child = spawnSyncFn(process.execPath, [BARELOOP_BIN, 'author', ...childArgs], { stdio: 'inherit' });
     if (child.error) {
-      say(`run-author could not be started (${child.error.message}) — the command above still stands.`);
+      say(`bareloop author could not be started (${child.error.message}) — the command above still stands.`);
       exitCode = 2;
     } else {
       // the child's own exit is the answer: a refusal there is a RESULT, and flattening

package/src/job.js

@@ -884,6 +884,43 @@ export function jobSpecHash(job) {
   return createHash('sha256').update(c).digest('hex');
 }
 
+/**
+ * The fields a "Reuse workflow" run may change: where the work lands (the write fence, `writeScope`, and a
+ * `destination`/`source` where a spec ever carries them) and the two ceilings. Everything else in a signed spec is
+ * the WORKFLOW — goal, checks, guardrails, close (the worker model is the third kind, {@link WORKFLOW_KEY_IDENTITY_FIELDS}). ONE list, shared by {@link workflowKey} and by the panel's
+ * reuse (so what the key ignores is exactly what the person may edit, never two spellings).
+ */
+export const REUSE_OPEN_SPEC_FIELDS = Object.freeze(['source', 'destination', 'writeScope', 'budgetUsd', 'maxWallMs']);
+
+/**
+ * The worker-identity fields {@link workflowKey} ALSO ignores (hamr 2026-10-04: Model is open on a reuse; the Name
+ * chosen in Settings carries its provider and baseUrl with it). They stay inside {@link jobSpecHash}, so what the person
+ * signs still covers the model the run will use. Kept apart from {@link REUSE_OPEN_SPEC_FIELDS} on purpose: those are the
+ * fields the page's boxes edit directly; these three change together, as one Settings row.
+ */
+export const WORKFLOW_KEY_IDENTITY_FIELDS = Object.freeze(['provider', 'baseUrl', 'model']);
+
+/**
+ * The identity of a WORKFLOW (Reuse workflow, hamr 2026-10-03): sha256 over the signed spec WITHOUT the fields a
+ * reuse may change ({@link REUSE_OPEN_SPEC_FIELDS}) and the worker identity ({@link WORKFLOW_KEY_IDENTITY_FIELDS}). Two runs
+ * share a workflow key iff they ran the same goal, checks, guardrails and close — whatever source they ran on, wherever they wrote, whatever caps they had.
+ * It is NOT a signature: {@link jobSpecHash} (which covers the caps and the fence) stays what the person signs, and
+ * a reuse lands on a NEW jobSpecHash with the SAME workflowKey. Same never-throws contract as `jobSpecHash`, and
+ * the same resolved-`tools` form, so an omitted-`tools` spec and its spelled-out menu share a key.
+ * @param {object} job
+ * @returns {string} sha256 hex
+ */
+export function workflowKey(job) {
+  let c;
+  try {
+    /** @type {any} */
+    const rest = isObj(job) ? { ...job } : job;
+    if (isObj(rest)) for (const f of [...REUSE_OPEN_SPEC_FIELDS, ...WORKFLOW_KEY_IDENTITY_FIELDS]) delete rest[f];
+    c = canon(resolveSpec(rest));
+  } catch { c = '\u0000unhashable'; }
+  return createHash('sha256').update(`workflow-key-v1\n${c}`).digest('hex');
+}
+
 /**
  * Does an approval record cover this exact spec version? Pure predicate — the
  * N2 runner refuses to run without it; nothing here writes or prompts. The

package/src/judged.js

@@ -64,7 +64,7 @@
 // redacts at its emission boundary, the same split `src/kinds.js` documents.
 
 import { createRequire } from 'node:module';
-import { extractArtifact, priceOf, scrubRaw } from './text.js';
+import { extractArtifact, priceOf, scrubRaw, rateSourceFields } from './text.js';
 import { resolveProvider } from './providers.js';
 
 const require = createRequire(import.meta.url);
@@ -872,7 +872,7 @@ export async function runLocate({
     const { costUsd, unpricedRounds } = r === null ? { costUsd: null, unpricedRounds: 0 } : priceOf(r);
     // BA-21: the round's provenance rides beside the cost when the loop carried it (see
     // `defaultJudgeLoop`); a loop that never metered a rate adds no key.
-    onCost({ costUsd, unpricedRounds, ...(r && typeof r === 'object' && 'rateSource' in r ? { rateSource: r.rateSource } : {}) });
+    onCost({ costUsd, unpricedRounds, ...rateSourceFields(r) });
     return {
       ok: red === null, facts, red, costUsd, unpricedRounds, truncated, parseError,
       raw: scrubRaw({

package/src/kinds.js

@@ -67,6 +67,7 @@ import { join, sep } from 'node:path';
 import { globToPrefix, isNonEmptyString } from './validate.js';
 import { CLOSE_ENV_DENY } from './ralph.js';
 import { runLocate, decide, validateCard, LOCATE_AXES, LOCATE_LABEL } from './judged.js';
+import { rateSourceFields } from './text.js';
 
 /** the close's two judgment exits — a stage's verdict, in the shape the
  * hand-written closes already spoke (exit code is truth) */
@@ -1871,7 +1872,7 @@ async function runJudgedFloor(stage, ctx) {
           ctx.onJudgeCost({
             stage: stage?.name ?? null, kind: stage?.kind ?? null, path: rel, attempt,
             label: LOCATE_LABEL, model: judgeModel, costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
-            ...('rateSource' in c ? { rateSource: c.rateSource } : {}),
+            ...rateSourceFields(c),
           });
         },
       });

package/src/ledger.js

@@ -23,6 +23,7 @@ import { readFileSync, appendFileSync, existsSync } from 'node:fs';
 import { basename } from 'node:path';
 import { createHash } from 'node:crypto';
 import { HITL_PAUSE, HITL_DECISION_RED } from './declaredclose.js';
+import { legsOf } from './legs.js';
 
 /** severity order, worst-first (the fold's display order; frequency ranks within) */
 export const LEDGER_CLASSES = Object.freeze([
@@ -67,6 +68,7 @@ const QUOTED_VERB_RE = /"([a-z0-9-]+)"/;
 const EXCLUDED_ESCALATIONS = new Set([
   'cap-halt',           // a budget story, not a lib bug
   'wall-halt',          // the TIME budget's version of the same story (T, PRD v1.27)
+  'stopped',            // the PERSON's stop (P5 item 5) — a checkpoint, never a lib bug
   // A stall is the ABSENCE of beats, not an observed provider failure: nothing
   // saw the transport fail, so the typed-lib route rendered a live ask reading
   // "bare-agent: the provider path failed — worker stalled…" and aimed a bug at
@@ -408,7 +410,7 @@ export function updateLedger({ ledgerFile, spineFiles }) {
 // ── BA-21 pricing provenance: the READ side (REPORTING ONLY) ─────────────────
 // bare-agent >=0.37 rides `rateSource` beside `pricing` on every metering payload,
 // and the plan flow forwards it verbatim onto `worker-round`/`judge-round`/`worker-turn`
-// (`rateSourceFields`, src/planrun.js — the write side).
+// (`rateSourceFields`, src/text.js — the write side).
 //
 // `judge-round`'s payload (src/kinds.js's `onJudgeCost({...})`) forwards `rateSource` from the
 // judge Loop's per-call metering (`defaultJudgeLoop`, src/judged.js); a judge round whose loop
@@ -525,9 +527,103 @@ export function floorsFromRecords(records) {
   }
   const spendFloorUsd = pricedCount > 0 ? spendSum : null;
 
-  const withTs = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string');
-  const firstMs = withTs.length ? Date.parse(withTs[0].ts) : NaN;
-  const lastMs = withTs.length ? Date.parse(withTs[withTs.length - 1].ts) : NaN;
-  const wallFloorMs = Number.isFinite(firstMs) && Number.isFinite(lastMs) && lastMs >= firstMs ? lastMs - firstMs : null;
+  // P5-R: a resumed run is one spine of several legs — the wall floor is the sum of each leg's own
+  // first -> last window, the quiet time between legs excluded (hamr 2026-10-02, 2A). One leg (every spine
+  // before P5-R) reads exactly as it always did.
+  const legs = legsOf(records.filter((r) => r && typeof r === 'object'));
+  let wallFloorMs = null;
+  let sum = 0;
+  let known = 0;
+  for (const l of legs) {
+    const withTs = l.records.filter((r) => typeof r.ts === 'string');
+    const firstMs = withTs.length ? Date.parse(withTs[0].ts) : NaN;
+    const lastMs = withTs.length ? Date.parse(withTs[withTs.length - 1].ts) : NaN;
+    if (Number.isFinite(firstMs) && Number.isFinite(lastMs) && lastMs >= firstMs) { sum += lastMs - firstMs; known += 1; }
+  }
+  if (known > 0) wallFloorMs = sum;
   return { spendFloorUsd, wallFloorMs };
 }
+
+/**
+ * One run's own spend, off its spine records: this LEG's figure (never the chain fold),
+ * plus the drafting spend the run was signed with (counted once — on the first leg only).
+ * @param {any[]} records ONE leg's records
+ * @param {{ withDraft?: boolean }} [o] `withDraft: false` leaves the drafting spend out (a caller folding the CHAIN's own spend, which never held it)
+ * @returns {{ usd: number, complete: boolean }}
+ */
+export function legSpend(records, { withDraft = true } = {}) {
+  const jobStart = records.find((r) => r && r.type === 'job-start') ?? null;
+  const jobEnd = records.findLast((r) => r && r.type === 'job-end') ?? null;
+  const rounds = records.filter((r) => r && SPEND_RECORD_TYPES.includes(r.type));
+  const pricedSum = rounds.reduce((a, r) => (typeof r.costUsd === 'number' && Number.isFinite(r.costUsd) ? a + r.costUsd : a), 0);
+  const unpriced = rounds.filter((r) => !(typeof r.costUsd === 'number' && Number.isFinite(r.costUsd))).length;
+  let usd = pricedSum;
+  let complete = false;
+  if (jobEnd) {
+    const eng = jobEnd.engagementSpentUsd;
+    usd = typeof eng === 'number' && Number.isFinite(eng) ? eng : pricedSum;
+    complete = jobEnd.spendComplete === true && unpriced === 0;
+  }
+  // drafting spend: a RESUMED / door-rerun leg carries the flag again but the first leg already counted it
+  const resumed = !!jobStart && 'priorSpentUsd' in jobStart;
+  if (withDraft && jobStart && !resumed && typeof jobStart.draftSpentUsd === 'number' && Number.isFinite(jobStart.draftSpentUsd) && jobStart.draftSpentUsd > 0) {
+    usd += jobStart.draftSpentUsd;
+    if (jobStart.draftSpendComplete === false) complete = false;
+  }
+  return { usd, complete };
+}
+
+/**
+ * A WHOLE RUN's own spend (P5-R: a resumed run is one spine of several legs): the sum of each leg's own
+ * figure ({@link legSpend}), never the declared chain fold. ONE basis — every leg's own rounds — so a leg is
+ * counted once: the last leg's `job-end.spentUsd` also carries the earlier legs, and adding it to the
+ * earlier legs' own figures would count them twice. A leg with no terminal (it died) is a floor, so the run
+ * is `complete: false`. A spine with no marker is one leg and reads exactly as {@link legSpend} always did.
+ * @param {any[]} records one spine's records
+ * @param {{ withDraft?: boolean }} [o]
+ * @returns {{ usd: number, complete: boolean, lastLegUsd: number }} `lastLegUsd`: the latest leg's own share (what a claim still held for it is measured against)
+ */
+export function runSpend(records, o = {}) {
+  const legs = legsOf(records);
+  if (legs.length === 0) return { usd: 0, complete: false, lastLegUsd: 0 };
+  let usd = 0;
+  let complete = true;
+  let lastLegUsd = 0;
+  for (const l of legs) {
+    const s = legSpend(l.records, o);
+    usd += s.usd;
+    if (!s.complete) complete = false;
+    lastLegUsd = s.usd;
+  }
+  return { usd, complete, lastLegUsd };
+}
+
+/**
+ * What a FINISHED run's whole chain spent, for a caller that folds it forward (the review door's rerun opens a
+ * new run under the same signed ceiling). One basis per shape: a spine of ONE leg is read by its terminal's own
+ * chain total (`job-end.spentUsd`, which already carries whatever fold that leg inherited — what every door has
+ * always read); a resumed run's several legs are the first leg's own inherited fold (spend the file does not
+ * hold) plus each leg's OWN spend, so a later leg's terminal total — which also carries the earlier legs — is
+ * never added on top of them. Not finite / no terminal = `usd: 0, complete: false` (never an exact-looking 0).
+ * @param {any[]} records one spine's records
+ * @returns {{ usd: number, complete: boolean }}
+ */
+export function chainSpend(records) {
+  const legs = legsOf(records);
+  const num = (/** @type {unknown} */ v) => typeof v === 'number' && Number.isFinite(v);
+  if (legs.length <= 1) {
+    const je = legs[0]?.jobEnd ?? null;
+    const known = num(je?.spentUsd);
+    return { usd: known ? je.spentUsd : 0, complete: known && je?.spendComplete !== false };
+  }
+  const head = legs[0].jobStart;
+  let usd = num(head?.priorSpentUsd) && head.priorSpentUsd > 0 ? head.priorSpentUsd : 0;
+  let complete = head?.priorSpendComplete !== false;
+  for (const l of legs) {
+    const s = legSpend(l.records, { withDraft: false });
+    usd += s.usd;
+    if (!s.complete) complete = false;
+  }
+  return { usd, complete };
+}
+