bareloop 0.39.0 → 0.40.0

package/src/panel/server.js

@@ -36,7 +36,7 @@ import {
   replayOne, parseJsonl, resolveSiblings, isSidecarByName,
 } from '../replayio.js';
 import { summarizeForAllLine, auditWindowsOf } from '../replay.js';
-import { legsOf, legsWallMs, stopFilePath } from '../legs.js';
+import { legsOf, legsWallMs, stopFilePath, capKindOf } from '../legs.js';
 import { chainSpend } from '../ledger.js';
 import { runBehaviour } from '../behaviour.js';
 import { SPEND_RECORD_TYPES, floorsFromRecords } from '../ledger.js';
@@ -55,6 +55,7 @@ import { REUSE_LOCKED_FIELDS, REUSE_OPEN_FIELDS } from './authorsession.js';
 import { readResume, checkpointAgeGate, CHECKPOINT_OUTCOMES } from '../reuse.js';
 import { statusFor, partStatusFor, GOAL_MET_LINE } from './status.js';
 import { createSettingsRoutes } from './settingsroutes.js';
+import { planFromSpec } from './jobplan.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -479,7 +480,7 @@ function endedBase(summary, death, o) {
   if (outcome === 'escalated') {
     const strikes = esc?.spend?.strikes;
     const limit = esc?.spend?.strikeLimit;
-    if (cat === 'cap-halt' && o.moneyHalt) {
+    if (capKindOf({ outcome, category: cat, moneyHalt: o.moneyHalt }) === 'money') {
       const money = typeof summary.spentUsd === 'number' && typeof summary.budgetUsd === 'number'
         ? ` (${panelMoney2(summary.spentUsd)} of ${panelMoney2(summary.budgetUsd)})` : '';
       return {
@@ -494,7 +495,7 @@ function endedBase(summary, death, o) {
         actions: [],
       };
     }
-    if (cat === 'wall-halt') {
+    if (capKindOf({ outcome, category: cat, moneyHalt: o.moneyHalt }) === 'time') {
       return { reason: 'Time cap reached.', next: CHANGE, line: 'time cap', actions: [] };
     }
     if (cat === 'provider-red') {
@@ -2098,6 +2099,42 @@ function toolsFromSpec(spec) {
   return names ? names.join(' · ') : null;
 }
 
+/**
+ * The Signed row of the Job tab: `YYYY-MM-DD HH:MM · <first 6 of specHash>`, the time being the run's FIRST `job-start`
+ * in local time (hamr, P7). `null` when either part is not on record — never a made-up stamp.
+ * @param {string|null|undefined} ts an ISO stamp @param {string|null|undefined} hash
+ * @returns {string|null}
+ */
+export function signedLine(ts, hash) {
+  const t = typeof ts === 'string' ? new Date(ts) : null;
+  if (!t || Number.isNaN(t.getTime()) || typeof hash !== 'string' || hash.length < 6) return null;
+  const p2 = (/** @type {number} */ n) => String(n).padStart(2, '0');
+  return `${t.getFullYear()}-${p2(t.getMonth() + 1)}-${p2(t.getDate())} ${p2(t.getHours())}:${p2(t.getMinutes())} · ${hash.slice(0, 6)}`;
+}
+
+/**
+ * The Job box's text for a signed spec: the person's own numbered lines (a `~` line per entry of `rules`, or — for a spec
+ * signed before `rules` existed — per '; '-split piece of `rule`), or — for
+ * an older job that saved no job lines — the signed goal sentence as the one line.
+ * @param {any} spec @returns {string}
+ */
+export function jobTextFromSpec(spec) {
+  if (Array.isArray(spec?.jobLines) && spec.jobLines.length) {
+    return spec.jobLines.map((/** @type {any} */ l) => [String(l.text), ...(Array.isArray(l.rules) ? l.rules.map((r) => `~ ${r}`) : l.rule ? String(l.rule).split('; ').map((r) => `~ ${r}`) : [])].join('\n')).join('\n');
+  }
+  return typeof spec?.goal === 'string' ? spec.goal : '';
+}
+
+/**
+ * The Inputs box's text for a signed spec: its numbered inputs, or — for an older job — `repo: <source>` from the
+ * caller's best knowledge of the source (or empty).
+ * @param {any} spec @param {string} source @returns {string}
+ */
+export function inputsTextFromSpec(spec, source) {
+  if (Array.isArray(spec?.inputs) && spec.inputs.length) return spec.inputs.map((/** @type {any} */ i) => `${i.label}: ${i.value}`).join('\n');
+  return source ? `repo: ${source}` : '';
+}
+
 /**
  * `<src/panel>/../../jobs` — the repo's `jobs/` directory of signed specs,
  * resolved from the bareloop PACKAGE ROOT (this module's own on-disk
@@ -2180,8 +2217,20 @@ export function getRunJob(runid, opts = {}) {
       : (typeof jobStart?.model === 'string' ? jobStart.model : null),
   );
 
+  // the Signed row: the run's FIRST job-start, local time (P7)
+  let firstStart = null;
+  if (existsSync(row.spine)) {
+    try { firstStart = parseJsonl(row.spine).records.find((r) => r && typeof r === 'object' && r.type === 'job-start') ?? null; } catch { firstStart = null; }
+  }
   /** @param {any} spec @param {boolean} resolved @param {string} resolvedFrom @param {string|null} note */
   const fromSpec = (spec, resolved, resolvedFrom, note) => ({
+    // P7: the same plan model the chat's plan bubble is drawn from (src/panel/jobplan.js), read from the SIGNED spec
+    plan: planFromSpec(spec),
+    jobLines: Array.isArray(spec.jobLines) ? spec.jobLines : null,
+    inputs: Array.isArray(spec.inputs) && spec.inputs.length ? spec.inputs : [{ n: 1, label: 'repo', value: sourceDisplay() }],
+    signedAt: typeof firstStart?.ts === 'string' ? firstStart.ts : null,
+    specHash: typeof jobStart?.specHash === 'string' ? jobStart.specHash : null,
+    signed: signedLine(firstStart?.ts, typeof jobStart?.specHash === 'string' ? jobStart.specHash : null),
     runid,
     job: typeof spec.job === 'string' ? spec.job : row.job,
     resolved,
@@ -2202,6 +2251,7 @@ export function getRunJob(runid, opts = {}) {
     note,
   });
   const none = () => ({
+    plan: null, jobLines: null, inputs: [{ n: 1, label: 'repo', value: sourceDisplay() }], signedAt: null, specHash: null, signed: null,
     runid,
     job: row.job,
     resolved: false,
@@ -2263,6 +2313,10 @@ export function getRunJob(runid, opts = {}) {
   // (d) the run's own job-start record — narrower, unsigned.
   if (jobStart) {
     return {
+      plan: null, jobLines: null, inputs: [{ n: 1, label: 'repo', value: sourceDisplay() }],
+      signedAt: typeof jobStart.ts === 'string' ? jobStart.ts : null,
+      specHash: typeof jobStart.specHash === 'string' ? jobStart.specHash : null,
+      signed: signedLine(jobStart.ts, jobStart.specHash),
       runid,
       job: typeof jobStart.job === 'string' ? jobStart.job : row.job,
       resolved: false,
@@ -2456,7 +2510,8 @@ export function getStartFrom(runid, opts = {}) {
       : (findRow(rowsForHome(keysHome(opts.home)), { provider: spec.provider, baseUrl: spec.baseUrl, model: spec.model })?.name
         ?? (typeof jobStart?.model === 'string' ? jobStart.model : '')),
     source: typeof saved.source === 'string' && saved.source ? saved.source : (typeof manifest?.source === 'string' ? manifest.source : (typeof row.patient === 'string' ? row.patient : '')),
-    judgeExamples: typeof saved.judgeExamples === 'string' ? saved.judgeExamples : '',
+    // a card saved by P7 or later keeps the Inputs text the person typed
+    inputs: typeof saved.inputs === 'string' && saved.inputs ? saved.inputs : '',
     jobName: row.job,
   });
   const key = workflowKey(spec);
@@ -2470,7 +2525,7 @@ export function getStartFrom(runid, opts = {}) {
     from: 'signed job',
     locked: REUSE_LOCKED_FIELDS,
     open: REUSE_OPEN_FIELDS,
-    note: card.checkType === 'rubric' && card.judgeExamples === '' ? 'judge examples were not saved for this run' : null,
+    note: Array.isArray(spec.jobLines) && spec.jobLines.length ? null : 'older job — numbered lines were not saved',
     specHash: signed.specHash,
     workflowKey: key,
     spec,
@@ -2518,7 +2573,7 @@ export function listReuseJobs(opts = {}) {
  * The reuse card for a signed spec: locked boxes from the spec through the Job tab's own readers, open boxes from
  * the spec's own fence and caps (Source and the saved text from the caller — a spec carries neither).
  * @param {any} spec
- * @param {{model: string, source: string, judgeExamples: string, jobName: string}} extra
+ * @param {{model: string, source: string, inputs?: string, jobName: string}} extra `inputs` = the Inputs text the person saved (else built from the spec's inputs, else `repo: <source>`)
  * @returns {Record<string, any>}
  */
 function reuseCardFromSpec(spec, extra) {
@@ -2527,12 +2582,9 @@ function reuseCardFromSpec(spec, extra) {
     jobName: typeof spec.job === 'string' && spec.job ? spec.job : extra.jobName,
     checkType: spec.verdictType === 'soft-green' ? 'rubric' : 'deterministic',
     model: typeof spec.model === 'string' && spec.model && !extra.model ? spec.model : extra.model,
-    goal: typeof spec.goal === 'string' ? spec.goal : '',
-    source: extra.source,
+    jobText: jobTextFromSpec(spec),
+    inputs: extra.inputs || inputsTextFromSpec(spec, extra.source),
     destination: writeScope.join(', '),
-    success: successFromSpec(spec) ?? '',
-    guardrails: guardrailsFromSpec(spec) ?? '',
-    judgeExamples: extra.judgeExamples,
     capUsd: typeof spec.budgetUsd === 'number' ? spec.budgetUsd : null,
     maxWallMs: typeof spec.maxWallMs === 'number' ? spec.maxWallMs : undefined,
   };
@@ -2542,7 +2594,7 @@ function reuseCardFromSpec(spec, extra) {
  * P5 item 4 — the facts of a spec for an IMPORTED job's view, read by the SAME readers the Job tab uses for a run
  * (so an imported job and a run read alike): check type, goal, success checks, guardrails, model, caps.
  * @param {any} spec
- * @returns {{checkType: string, goal: string, success: string, guardrails: string, model: string, budgetUsd: number|null, maxWallMs: number|null}}
+ * @returns {{checkType: string, goal: string, success: string, guardrails: string, plan: ReturnType<typeof planFromSpec>, inputs: any[]|null, model: string, budgetUsd: number|null, maxWallMs: number|null}}
  */
 function describeSpec(spec) {
   const nr = (/** @type {string|null} */ v) => (typeof v === 'string' && v.length > 0 ? v : 'not recorded');
@@ -2551,6 +2603,8 @@ function describeSpec(spec) {
     goal: nr(typeof spec.goal === 'string' ? spec.goal : null),
     success: nr(successFromSpec(spec)),
     guardrails: nr(guardrailsFromSpec(spec)),
+    plan: planFromSpec(spec),
+    inputs: Array.isArray(spec.inputs) && spec.inputs.length ? spec.inputs : null,
     model: nr(typeof spec.model === 'string' ? spec.model : null),
     budgetUsd: typeof spec.budgetUsd === 'number' ? spec.budgetUsd : null,
     maxWallMs: typeof spec.maxWallMs === 'number' ? spec.maxWallMs : null,
@@ -2587,7 +2641,7 @@ export function getStartFromImport(id, opts = {}) {
   // The card opens on the row matching the bundle's own provider when there is one, else blank (the page's menu picks).
   const rows = rowsForHome(keysHome(opts.home));
   const named = findRow(rows, { provider: spec.provider, baseUrl: spec.baseUrl, model: spec.model })?.name ?? '';
-  const card = reuseCardFromSpec(spec, { model: named, source: '', judgeExamples: '', jobName: row.job });
+  const card = reuseCardFromSpec(spec, { model: named, source: '', jobName: row.job });
   const key = workflowKey(spec);
   const trackRecord = trackRecordFor(key, { ...opts, worker: workerOfChoice(opts.model ?? card.model, opts) });
   return {

package/src/planrun.js

@@ -795,7 +795,7 @@ ${scoutBlob || '(no scout notes)'}`;
  *   item 27/M3 Part B), forwarded to every close invocation as
  *   `BARELOOP_CLOSE_DIR`
  * @param {number} [opts.maxStepRounds] the shell's per-step rounds ceiling (validatePlan's bound)
- * @param {boolean} [opts.scout=true] operator-only switch (docs/product/SCOUT-CONTRAST.md):
+ * @param {boolean} [opts.scout=true] operator-only switch (docs/logs/SCOUT-CONTRAST.md):
  *        `false` on a FRESH run (no `resumeSeed`) skips the survey entirely — `scoutBlob`
  *        stays `''`, no `scout-start`/`scout-result`/`scout-empty` is emitted, and a single
  *        `scout-skipped {reason:'operator-off'}` records it (a RECORD, never silence — the
@@ -1001,7 +1001,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
   // The scout switch's guard, same class and same door: a mis-typed value
   // coerced by truthiness would run the scout under an "off" label (or skip it
   // under an "on" one) and no reading of the results afterwards could recover
-  // which arm actually ran (docs/product/SCOUT-CONTRAST.md).
+  // which arm actually ran (docs/logs/SCOUT-CONTRAST.md).
   if (typeof scout !== 'boolean') throw new TypeError(`scout: expected boolean, got ${JSON.stringify(scout)}`);
   // G1's OTHER half, refused at the same $0 door. `validatePlan` reds `read-blind`
   // when a step grants `read` without the retrieval pair — but a step cannot grant
@@ -2036,7 +2036,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     }
     const listed = await seedListing(workdir, s.seedRef);
     const v = listed.stop === null
-      ? validateCloseDecl(job.closeDecl, { at: 'closeDecl', listing: listed.files, verdictType: job.verdictType, writeScope: job.writeScope })
+      ? validateCloseDecl(job.closeDecl, { at: 'closeDecl', listing: listed.files, verdictType: job.verdictType, writeScope: job.writeScope, jobLines: Array.isArray(job.jobLines) ? job.jobLines : null })
       : { ok: false, grounded: false, reds: [{ code: 'listing-unreadable', path: 'closeDecl', detail: listed.stop }] };
     emit('close-decl', {
       genre: job.closeDecl.genre,
@@ -2939,7 +2939,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       meaning: 'the killed run already paid for this survey; its plan is reloaded, not re-drafted. A replan after this point drafts from an empty survey plus the failure brief.',
     });
   } else if (scout === false) {
-    // The operator-off arm (docs/product/SCOUT-CONTRAST.md): a fresh run whose
+    // The operator-off arm (docs/logs/SCOUT-CONTRAST.md): a fresh run whose
     // operator asked for no survey. Precedence already settled above — the
     // resume branch fires first and wins its own reason, so this arm is only
     // ever reached when there is nothing to resume from.

package/src/promptregisters.js

@@ -2,7 +2,7 @@
 // (hamr, 2026-08-25): "a check". A commit that changes a prompt register must
 // say, in its message, the failure that caused the change, what it addresses,
 // and what it corrects — doctrine already stated once ("a frozen rule without
-// a wired detector is prose", docs/product/2026-08-23-agreed-build-list.md:187-189)
+// a wired detector is prose", docs/logs/2026-08-23-agreed-build-list.md:187-189)
 // so convention-only was rejected. This module is the ONE place that inventory
 // lives: `scripts/prompt-commit-check.mjs` reads it to decide which commits the
 // rule applies to, and this file's own doc-comment is where a human reads it.

package/src/providers.js

@@ -24,7 +24,7 @@
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { AnthropicProvider, OpenAIProvider, GeminiProvider } = require('bare-agent/providers');
+const { AnthropicProvider, OpenAIProvider, GeminiProvider, thinkingSupport } = require('bare-agent/providers');
 
 /**
  * Today's anthropic-api tier table — EXACTLY the `DEFAULT_TIER_MODELS` both
@@ -116,30 +116,112 @@ const OPENAI_MODEL_OPTIONS = Object.freeze({
 });
 
 /**
- * Per-MODEL JUDGE-ONLY request options (F192, hamr ruling A 2026-10-09). deepseek-flash
- * thinks by default and bills the reasoning as output: run mv117wde's rubric judge locate
- * truncated at JUDGE_MAX_TOKENS=4000 four times, and a probe measured 1835 of 2409
- * completion tokens as reasoning. The judge extracts quotes and decides nothing, so it
- * runs with thinking off. These are PER-CALL options (bare-agent >=0.49 forwards
- * `thinking` verbatim to `body.thinking`), never constructor options: the judge may be
- * the very same provider instance as the worker (`buildRunnerProviders` reuses it), and
- * the worker is deliberately left as it was. A model with no entry gets nothing; the
- * field is never sent to a model not listed here (OpenAI/Anthropic would reject or
- * misread it). Read through `judgeCallOptions` only — one owner.
+ * THINKING (hamr 2026-10-11: no hardcoded per-model lists in bareloop — bare-agent >=0.51 owns the shapes). The drafter and the
+ * rubric judge run thinking OFF by default (deepseek-flash thinks by default and bills the reasoning as output: F192 run mv117wde
+ * truncated judge locates at the cap, and a drafter answer that runs to the output cap is a failed try). This module is the ONE
+ * owner of what a call sends: it asks bare-agent's `thinkingSupport(kind, model)` (pure lookup, no network) and sends the
+ * normalized per-call `thinkingMode: 'off'` ONLY when the model is measured switchable. A model measured NOT switchable
+ * (claude-opus-5-5 …) gets nothing — asking would throw before send — and a model bare-agent has not measured ('unverified') also
+ * gets nothing on this DEFAULT path, so a local/unknown model's drafting never breaks by default. PER-CALL, never constructor
+ * options (the drafter's provider is the worker's instance; the worker is deliberately left as it was). The raw `thinking`
+ * option is never sent (bare-agent throws if both are set).
  */
-const OPENAI_JUDGE_CALL_OPTIONS = Object.freeze({
-  'deepseek-flash': Object.freeze({ thinking: Object.freeze({ type: 'disabled' }) }),
-});
 
 /**
- * The per-call options the rubric JUDGE's model calls carry for this provider
- * instance, from the allow-list above. Empty for any provider/model not listed.
+ * The thinking-ladder kind bare-agent's `thinkingSupport` is keyed by, from a constructed provider; null for anything that is
+ * not one of the three admitted constructors (a test double, a clipipe) — such a provider is never sent the switch.
+ * OpenAI-shaped providers are DeepSeek by model id `deepseek-*` or a `deepseek.com` baseUrl (bare-agent's documented rule,
+ * provider-openai.js:80), else OpenAI.
+ * @param {any} provider
+ * @returns {'anthropic'|'openai'|'deepseek'|'gemini'|null}
+ */
+function thinkingKind(provider) {
+  if (provider instanceof AnthropicProvider) return 'anthropic';
+  if (provider instanceof GeminiProvider) return 'gemini';
+  if (provider instanceof OpenAIProvider) {
+    return /^deepseek-/i.test(String(provider.model)) || /deepseek\.com/i.test(String(provider.baseUrl)) ? 'deepseek' : 'openai';
+  }
+  return null;
+}
+
+/**
+ * What an 'off' request means for this provider instance, for the draft log and the panel row: `'off'` (measured switchable —
+ * the switch is sent), `'not-switchable'` (measured NOT switchable — nothing sent, the model thinks as it would),
+ * `'unverified'` (bare-agent has not measured this model — nothing sent on the default path).
+ * @param {any} provider a constructed bare-agent provider
+ * @returns {'off'|'not-switchable'|'unverified'}
+ */
+function offOutcome(provider) {
+  const kind = thinkingKind(provider);
+  if (kind === null) return 'not-switchable';
+  const support = thinkingSupport(kind, provider.model);
+  if (support.switchable === true) return 'off';
+  return support.switchable === 'unverified' ? 'unverified' : 'not-switchable';
+}
+
+/**
+ * The per-call options the rubric JUDGE's model calls carry for this provider instance: `{ thinkingMode: 'off' }` when
+ * bare-agent measures the model switchable, else `{}` (F192: judge runs thinking off; a judge on a model that cannot turn it
+ * off must not throw).
  * @param {any} provider a constructed bare-agent provider
  * @returns {Record<string, any>}
  */
 export function judgeCallOptions(provider) {
-  if (!(provider instanceof OpenAIProvider)) return {};
-  return OPENAI_JUDGE_CALL_OPTIONS[/** @type {keyof typeof OPENAI_JUDGE_CALL_OPTIONS} */ (provider.model)] ?? {};
+  return offOutcome(provider) === 'off' ? { thinkingMode: 'off' } : {};
+}
+
+/**
+ * The drafter's THINKING knob — an enumerated OPERATOR param, never model output and never read from env inside the library.
+ * `'on'` sends nothing (the model's own thinking, byte-identical to a no-knob call); `'off'` sends `thinkingMode: 'off'` where
+ * bare-agent measures the model switchable. The DEFAULT is `'off'` (hamr 2026-10-11, decided by the frozen ON/OFF contrast,
+ * docs/logs/2026-10-10-drafter-thinking-contrast-prereg.md); `'on'` stays selectable for a later Settings checkbox.
+ */
+export const DRAFT_THINKING_MODES = Object.freeze(['on', 'off']);
+
+/**
+ * Throw unless `mode` is one of {@link DRAFT_THINKING_MODES} — an operator-param guard, so a typo never silently means a mode.
+ * @param {unknown} mode
+ * @returns {'on'|'off'}
+ */
+export function assertDraftThinking(mode) {
+  if (mode === 'on' || mode === 'off') return mode;
+  throw new Error(`[providers] draftThinking must be one of ${DRAFT_THINKING_MODES.join(' | ')}, got ${JSON.stringify(mode)}`);
+}
+
+/**
+ * What the drafting calls on this provider ACTUALLY carry for thinking, for the draft log and the panel row: `'on'` (mode on,
+ * nothing sent), `'off'` (mode off and the switch is sent), `'not-switchable'` (mode off, model measured not switchable —
+ * nothing sent), `'unverified'` (mode off, model not measured by bare-agent — nothing sent). Never re-derives a model list.
+ * @param {any} provider a constructed bare-agent provider
+ * @param {unknown} [mode] 'on' | 'off' (default 'off')
+ * @returns {'on'|'off'|'not-switchable'|'unverified'}
+ */
+export function draftThinkingSent(provider, mode = 'off') {
+  if (assertDraftThinking(mode) === 'on') return 'on';
+  return offOutcome(provider);
+}
+
+/**
+ * {@link draftThinkingSent} for a model the caller has only NAMED (provider shape, model id, baseUrl) — no key, no network. For
+ * the panel's first drafting row, which is shown before the key is read. Constructing the provider only makes the class and
+ * the model id available to `thinkingSupport`; it sends nothing.
+ * @param {{providerName: string, model: string, baseUrl?: string|null}} o
+ * @param {unknown} [mode] 'on' | 'off' (default 'off')
+ * @returns {'on'|'off'|'not-switchable'|'unverified'}
+ */
+export function draftThinkingFor({ providerName, model, baseUrl }, mode = 'off') {
+  return draftThinkingSent(makeProvider(providerName, { apiKey: 'unset', model, ...(baseUrl ? { baseUrl } : {}) }), mode);
+}
+
+/**
+ * The ONE owner of the per-call options every DRAFTING model call carries (scout, confirm, author, revise, structure retries).
+ * `{ thinkingMode: 'off' }` exactly when {@link draftThinkingSent} says `'off'`, else `{}`.
+ * @param {any} provider a constructed bare-agent provider
+ * @param {unknown} [mode] 'on' | 'off' (default 'off')
+ * @returns {Record<string, any>}
+ */
+export function draftCallOptions(provider, mode = 'off') {
+  return draftThinkingSent(provider, mode) === 'off' ? { thinkingMode: 'off' } : {};
 }
 
 /**
@@ -232,7 +314,7 @@ export function resolveProvider(providerName) {
 /**
  * Report whether a resolved API key VALUE (not its presence — every call
  * site already presence-checks separately) carries a shape an HTTP header
- * value cannot: F181 (`docs/logs/FINDINGS.md`) — a two-line secret-store
+ * value cannot: F181 (`docs/wiki/FINDINGS.md`) — a two-line secret-store
  * entry put the key plus a trailing metadata line into `OPENAI_API_KEY`
  * (`"<key>\nmeta"`), the presence-only check at every door passed, and Node
  * crashed `TypeError [ERR_INVALID_CHAR]` inside its own header-encode at the

package/src/reuse.js

@@ -1,5 +1,5 @@
 // Layer 3 — the D7 ENVELOPE and the REUSE RUNNER (design record
-// docs/product/2026-08-01-layer-3-reuse-design.md, D3/D5/D6/D7 + R1).
+// docs/logs/2026-08-01-layer-3-reuse-design.md, D3/D5/D6/D7 + R1).
 //
 // hamr's sentence is the whole specification of this file, verbatim:
 //

package/src/root.js

@@ -1,5 +1,5 @@
 // Layer R — the root: the within-run ratchet (LAYERS.md item 2; design record
-// docs/product/2026-07-19-layer-r-design.md). One state that survives attempts
+// docs/logs/2026-07-19-layer-r-design.md). One state that survives attempts
 // inside ONE run so a never-green run stops repeating itself (F21). Role is
 // CONTINUITY ONLY — F39 measured that hand-delivered state buys no conversion;
 // the semantic converter is Layer 2's job, not this module's.

package/src/run.js

@@ -3,7 +3,7 @@
 // smoke, the ONE budget ledger (cap-not-estimate; unpriced is never free, F6),
 // and the decision-ready stops. It composes the plan flow below it and
 // interprets nothing itself.
-// Design record: docs/product/2026-07-12-n2-headless-loop-design.md.
+// Design record: docs/logs/2026-07-12-n2-headless-loop-design.md.
 //
 // The legacy operator-authored `steps[]` path was DELETED 2026-07-26 (PRD
 // v1.32): the drafting call, config-v1, the per-step interpret loops and the
@@ -219,7 +219,7 @@ async function primitiveSmoke(workdir) {
  *        frozen A0 baseline arm has to be exactly today, so a guard firing under a disabled
  *        shim would make the baseline a treatment arm. The default-flip belongs to a
  *        paid contrast nobody has approved yet (the `layerRoot` precedent, F41).
- * @param {boolean} [opts.scout=true] operator-only switch (docs/product/SCOUT-CONTRAST.md),
+ * @param {boolean} [opts.scout=true] operator-only switch (docs/logs/SCOUT-CONTRAST.md),
  *   forwarded verbatim to the plan flow: `false` on a fresh run (no `resumeSeed`) skips the
  *   read-only survey and records `scout-skipped {reason:'operator-off'}` instead — the
  *   planner drafts from `(no scout notes)`. Runner territory exactly like `readShim`: the
@@ -282,7 +282,7 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   // blind-instrument failure this programme keeps logging. Only the guard runs
   // here; the flag itself is threaded onward to the plan flow as written.
   readShimArm(readShim);
-  // The scout switch's guard, same class and same door (docs/product/SCOUT-CONTRAST.md):
+  // The scout switch's guard, same class and same door (docs/logs/SCOUT-CONTRAST.md):
   // a mis-coerced value would run under the wrong label with no way to recover which arm
   // actually fired from the results afterwards.
   if (typeof scout !== 'boolean') throw new TypeError(`scout: expected boolean, got ${JSON.stringify(scout)}`);

package/src/selection.js

@@ -1,5 +1,5 @@
 // Layer 3 — D3's DISPLAY half: the workflow LISTING, and the prompt that asks for a
-// pick (design record docs/product/2026-08-01-layer-3-reuse-design.md, D3).
+// pick (design record docs/logs/2026-08-01-layer-3-reuse-design.md, D3).
 //
 // hamr's ruling, verbatim: *"i think there should be a listing for workflows names that
 // user can choose or auto-choose, or do we want llm to always decide (we still need to

package/src/source.js

@@ -25,7 +25,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
-import { dirname, join, relative, resolve, sep, basename } from 'node:path';
+import { dirname, join, relative, resolve, sep, basename, isAbsolute } from 'node:path';
 import { git } from './kinds.js';
 import { addWorktree, hideBareloopDir } from './worktree.js';
 import { MAX_BUFFER } from './kinds.js';
@@ -1160,3 +1160,66 @@ export function nonRepoSourceMessage(kind) {
   if (kind === 'folder') return "Source is a plain folder, not a code project (no git repo found). bareloop can't check this kind of job yet. Nothing spent.";
   return "Source is not a code project (no git repo found). bareloop can't check this kind of job yet. Nothing spent.";
 }
+
+/**
+ * P7 (docs/product/PANEL-BUILD.md, "Inputs"): prove the NUMBERED INPUTS at $0, before any token. Line 1 is the repo
+ * (an absolute path to an existing folder); lines 2+ are files or folders INSIDE that repo, repo-relative. A line
+ * that is not one of those is a named red naming its line number — never a throw, never a silent skip:
+ *   - a `search:` line or a URL, and a path that leaves the repo: "only files inside the repo for now" (search and
+ *     outside-the-repo inputs arrive with the plain-folder piece);
+ *   - a path that does not exist, or that git does not track (a repo job would not see it);
+ *   - the front door's own refusals for a file: an environment file by NAME, a symlink, a non-text file, an oversize
+ *     file. A known secret shape in its content is NOT a refusal (masked where recorded, as the P6 worktree door does).
+ * A folder value is checked for existence and tracking only (its files are the repo's own, which the worktree door
+ * already masks). Reads the tree; writes nothing.
+ * @param {{n: number, label: string, value: string}[]} inputs the parsed Inputs (`parseInputs`)
+ * @returns {Promise<{ok: true, repo: string, root: string|null}|{ok: false, error: string}>} `repo` = line 1's absolute path; `root` = the git root it sits in (null when line 1 alone was given and it is not in a git repo)
+ */
+export async function proveInputFiles(inputs) {
+  const first = inputs[0];
+  if (!first) return { ok: false, error: 'Inputs, line 1: the repo is required' };
+  /** @param {number} n @param {string} msg @returns {{ok: false, error: string}} */
+  const bad = (n, msg) => ({ ok: false, error: `Inputs, line ${n}: ${msg}` });
+  if (/^https?:\/\//i.test(first.value) || !isAbsolute(first.value)) return bad(1, 'the repo must be an absolute path, like /home/me/myrepo');
+  const repo = resolve(first.value);
+  let st;
+  try { st = lstatSync(repo); } catch { return bad(1, `${repo} does not exist`); }
+  // line 1 alone is the repo the job works on; whether it IS a code repo is the source door's own refusal (and
+  // `nonRepoSourceMessage`) downstream — only lines 2+ need a git tree to be proven against
+  const found = st.isDirectory() ? nearestGitAncestor(repo) : null;
+  if (inputs.length === 1) return { ok: true, repo, root: found && !found.isFile ? found.dir : null };
+  if (!st.isDirectory()) return bad(1, `${repo} is not a folder — line 1 is the repo`);
+  if (found === null || found.isFile) return bad(1, `${repo} is not inside a git repo, so the other inputs cannot be checked`);
+  const root = found.dir;
+  const rootReal = await realpath(root);
+  const repoReal = await realpath(repo);
+  for (const inp of inputs.slice(1)) {
+    const { n, label, value } = inp;
+    if (/^search$/i.test(label) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value)) return bad(n, 'only files inside the repo for now');
+    // like-for-like: resolve against the repo as the REAL filesystem sees it, so a repo reached through a symlinked parent
+    // compares against `rootReal` in the same spelling (a symlinked INPUT FILE is still refused below, by lstat)
+    const abs = resolve(repoReal, value);
+    const outside = (/** @type {string} */ p) => !(p === rootReal || p.startsWith(`${rootReal}${sep}`));
+    if (outside(abs)) return bad(n, 'only files inside the repo for now');
+    let ls;
+    try { ls = await lstat(abs); } catch { return bad(n, `${value} does not exist in the repo`); }
+    if (ls.isSymbolicLink()) return bad(n, `${value} is a symlink — refused, never followed`);
+    let real;
+    try { real = await realpath(abs); } catch { return bad(n, `${value} does not exist in the repo`); }
+    if (outside(real)) return bad(n, 'only files inside the repo for now');
+    const rel = relative(rootReal, abs).split(sep).join('/');
+    const tracked = await git(root, ['ls-files', '-z', '--', rel === '' ? '.' : rel]);
+    if (!tracked.ok || tracked.out.split('\0').filter(Boolean).length === 0) {
+      return bad(n, `${value} is not tracked by git — a repo job only sees tracked files; commit it first`);
+    }
+    if (ls.isDirectory()) continue;
+    if (ENV_FILE.test(basename(abs))) return bad(n, `${value} is an environment file — refused by NAME, whatever it contains (secrets never enter a job)`);
+    if (ls.size > MAX_BUFFER) return bad(n, `${value} is over the ${MAX_BUFFER}B per-file ceiling`);
+    const buf = await readFile(abs);
+    if (hasNulByte(buf.subarray(0, 8192))) return bad(n, `${value} is not a text file — text only for now`);
+    // a secret-shaped CONTENT is not refused (P6 worktree repo door, hamr 2026-10-05 Q2=A, same ruling for inputs): the file is
+    // the person's own, left in place; bareloop masks a secret wherever IT records one (`redactSecrets`, the one inventory) and
+    // never copies this file's text into a record — only its path travels. `.env` by name and symlinks stay refused above.
+  }
+  return { ok: true, repo, root };
+}

package/src/text.js

@@ -191,6 +191,19 @@ export function callCasualty(err) {
   if (err instanceof HaltError) return null;
   const e = /** @type {any} */ (err);
   if (e?.code === 'ETIMEDOUT' || e?.name === 'TimeoutError') return String(e?.message ?? e);
+  // F217 — a DROPPED CONNECTION is the same class as an idle timeout: a call that produced nothing usable. Two REAL
+  // shapes reach this seam out of bare-agent 0.49.0's OpenAIProvider (read in node_modules/bare-agent/src/provider-
+  // openai.js `_request` + provider-http.js), both thrown straight through `Loop.run` (loop.js rethrows non-Halt errors):
+  //   1. `req.on('error', reject)` passes node's RAW socket error unwrapped: `Error{code:'ECONNRESET', message:'socket
+  //      hang up'}` (the server closed before any response).
+  //   2. `guardResponseSettles` (BA-25), the connection cut after the headers: `ProviderError{code:'PROVIDER_ERROR',
+  //      retryable:true, context:{bound:'transport'}}`, message "response stream aborted/error/close before the body
+  //      completed". An HTTP-status ProviderError never carries `bound:'transport'`, so it is not admitted here.
+  // Other raw codes (ECONNREFUSED, ENOTFOUND, EPIPE...) reach the same raw path but name a wrong URL / no network, not a
+  // connection that DROPPED; they are deliberately not admitted (they re-raise loudly, as before).
+  if (e?.code === 'ECONNRESET' || e?.context?.bound === 'transport') {
+    return `the connection to the provider dropped (${String(e?.message ?? e)})`;
+  }
   return null;
 }
 

package/src/transport.js

@@ -1,5 +1,5 @@
 // hamr's ruling, verbatim: "one retry for transport layer failure and
-// reporting with the rest end of gate." (F115, docs/logs/FINDINGS.md.)
+// reporting with the rest end of gate." (F115, docs/wiki/FINDINGS.md.)
 //
 // A transport failure is fetch THROWING — the request never produced an HTTP
 // response at all (a TLS fault mid-record, a reset socket, a DNS/network

package/src/userrun.js

@@ -111,7 +111,7 @@ const JOBS = {
     seed: '92d71a7c1253f8f2430e2d308ecfef01c826b5c2',
   },
   // Bench row G3 (the NEGATIVE row) — the planted contract contradiction
-  // (docs/product/G3-SCOPING.md). A copy of the pulselog-u patient (patients are
+  // (docs/logs/G3-SCOPING.md). A copy of the pulselog-u patient (patients are
   // always copies) with one extra commit: two test/** files that pin
   // assembleEmail's subject to two different strings, unsatisfiable together
   // inside writeScope: src/**. Not frozen, not signed, no run — BUILT ON BRANCH
@@ -153,7 +153,7 @@ const JOBS = {
   // Bench row G2 (the NEGATIVE row) — TESTGEN cold start in plan-v1. The legacy
   // steps[] config went 0-of-43 (F38); this config's rate is UNKNOWN until its
   // establishing run. Same patient/seed/grader as the l2accept battery
-  // (TESTGEN-PREREG); the spec is the cold goal. See docs/product/G2-SCOPING.md.
+  // (TESTGEN-PREREG); the spec is the cold goal. See docs/logs/G2-SCOPING.md.
   'aurora-testgen-cold': {
     spec: 'aurora-testgen-cold.json',
     workdir: '/home/hamr/PycharmProjects/bareloop-patients/aurora-soar',
@@ -445,7 +445,7 @@ async function execute(ctx) {
   const SHIM_TAIL = shimArg === null ? '' : ` --read-shim ${shimArg}`;
 
   // --scout picks whether the plan flow pays for the read-only survey at all
-  // (docs/product/SCOUT-CONTRAST.md). Runner territory exactly like --read-shim
+  // (docs/logs/SCOUT-CONTRAST.md). Runner territory exactly like --read-shim
   // and --model: the spec names no scout, so the signed hash is unaffected. An
   // unrecognised value throws at argv, before the approval gate — the same
   // param-guard class as --read-shim above, for the same reason: a silently