bareloop 0.39.0 → 0.41.0

package/src/providers.js

@@ -21,63 +21,13 @@
 // (`buildRunnerProviders`, below); it never prices a round (F113: rates
 // passthrough is dead), and never decides a budget.
 
+import { listModels } from './modellist.js';
+import { SHAPE_IDS } from './providershapes.js';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { AnthropicProvider, OpenAIProvider, GeminiProvider } = require('bare-agent/providers');
 
-/**
- * Today's anthropic-api tier table — EXACTLY the `DEFAULT_TIER_MODELS` both
- * runners hardcoded before this factory existed. Any change to these two
- * values is a change to shipped anthropic-api behaviour, not a refactor.
- */
-export const ANTHROPIC_TIER_MODELS = Object.freeze({
-  sonnet: 'claude-sonnet-5',
-  haiku: 'claude-haiku-4-5-20251001',
-});
-
-/**
- * DeepSeek (F149/F150) is a SINGLE model, not a tiered family — hamr's
- * ruling above: one secondary provider, not a menu. Both tiers map to the
- * same model id ON PURPOSE: `resolveWorkerModel`/a runner's `providerFor
- * (tier)` only ever LOOK UP a tier's model id (src/job.js:818-827,
- * scripts/run-u.mjs's `providerFor`) — neither assumes the tiers name
- * different models — so repeating the one id is the honest representation
- * of a single-model provider, not a second model masquerading as `haiku`.
- * If DeepSeek (or a future openai-api entrant) ever ships a genuinely
- * cheaper tier model, this is where it would earn its own `haiku` id.
- *
- * MODEL SWAP (F171, item 34 L16, hamr 2026-09-13): `deepseek-chat` is no
- * longer served — a live `/models` call returned only `deepseek-flash` and
- * `deepseek-v4-pro`. Switched to `deepseek-flash` (DeepSeek V4.1). F149's
- * `legacyMaxTokens` measurement (asked 64 output tokens, got 665/608) was
- * taken on `deepseek-chat` and is UNVERIFIED on `deepseek-flash` — kept on
- * below as the fail-safe (over-capping direction is safe; see F171).
- */
-export const OPENAI_TIER_MODELS = Object.freeze({
-  sonnet: 'deepseek-flash',
-  haiku: 'deepseek-flash',
-});
-
-/**
- * Gemini (PRD item 31.3, hamr 2026-09-09: "anthropic, openai, gemini drop
- * ollama for now"). Two real tiers, unlike DeepSeek's single model: `flash` is
- * the cheap tier by design, so `haiku` maps to it honestly rather than
- * repeating one id.
- *
- * ADMITTED-PENDING-PROBE. The probe rule stands (PRD item 28 ruling (d),
- * 2026-09-09): no endpoint is in the menu without its own clean paid probe,
- * and `gemini-api` has ZERO runs. `anthropic-api` is the original (~167
- * archived runs) and `openai-api` was probed green through the shipped runner
- * (run mtu12vks, $1.64/$4, F157); gemini owes that fire and has not paid it.
- * `PROBE_STATUS` below is the machine-readable form of that debt — nothing in
- * here silently pretends the provider is proven.
- */
-export const GEMINI_TIER_MODELS = Object.freeze({
-  sonnet: 'gemini-2.5-pro',
-  haiku: 'gemini-2.5-flash',
-});
-
 /**
  * Which admitted providers have paid for their own end-to-end probe, and which
  * have not. Read by the runner to print a loud marker; never read to REFUSE —
@@ -91,64 +41,10 @@ export const PROBE_STATUS = Object.freeze({
   'gemini-api': Object.freeze({ probed: false, evidence: 'ZERO runs — admitted to the menu, owes its own paid probe (PRD item 31.3)' }),
 });
 
-/**
- * Per-MODEL request-key gating (F149, live-measured 2026-09-09): DeepSeek
- * silently IGNORES the modern `max_completion_tokens` key — asked for 64
- * output tokens, it returned 665/608 — and only honours the legacy
- * `max_tokens` key. `bare-agent`'s `OpenAIProvider` already exposes the
- * switch (`legacyMaxTokens`, BA-24; no model-name sniffing inside
- * bare-agent itself — "the caller declares the dialect"), so THIS table is
- * bareloop's routing of it, keyed per model, never a global default. An
- * output cap that does not bind is a money hazard: a reasoning model can
- * run to its own ceiling on every round, silently, so getting this wrong
- * for even one model defeats every budget that model's tier sets.
- *
- * A model with no entry here gets `{}` — bare-agent's own default
- * (`max_completion_tokens`, GPT-5-safe) applies, unmodified.
- *
- * F171 (2026-09-13): `deepseek-chat` was retired and swapped for
- * `deepseek-flash` (item 34 L16). This gating was measured on
- * `deepseek-chat` only and carried forward onto `deepseek-flash`
- * UNVERIFIED — re-verify before any paid DeepSeek run relies on it.
- */
-const OPENAI_MODEL_OPTIONS = Object.freeze({
-  'deepseek-flash': Object.freeze({ legacyMaxTokens: true }),
-});
-
-/**
- * Per-MODEL JUDGE-ONLY request options (F192, hamr ruling A 2026-10-09). deepseek-flash
- * thinks by default and bills the reasoning as output: run mv117wde's rubric judge locate
- * truncated at JUDGE_MAX_TOKENS=4000 four times, and a probe measured 1835 of 2409
- * completion tokens as reasoning. The judge extracts quotes and decides nothing, so it
- * runs with thinking off. These are PER-CALL options (bare-agent >=0.49 forwards
- * `thinking` verbatim to `body.thinking`), never constructor options: the judge may be
- * the very same provider instance as the worker (`buildRunnerProviders` reuses it), and
- * the worker is deliberately left as it was. A model with no entry gets nothing; the
- * field is never sent to a model not listed here (OpenAI/Anthropic would reject or
- * misread it). Read through `judgeCallOptions` only — one owner.
- */
-const OPENAI_JUDGE_CALL_OPTIONS = Object.freeze({
-  'deepseek-flash': Object.freeze({ thinking: Object.freeze({ type: 'disabled' }) }),
-});
-
-/**
- * The per-call options the rubric JUDGE's model calls carry for this provider
- * instance, from the allow-list above. Empty for any provider/model not listed.
- * @param {any} provider a constructed bare-agent provider
- * @returns {Record<string, any>}
- */
-export function judgeCallOptions(provider) {
-  if (!(provider instanceof OpenAIProvider)) return {};
-  return OPENAI_JUDGE_CALL_OPTIONS[/** @type {keyof typeof OPENAI_JUDGE_CALL_OPTIONS} */ (provider.model)] ?? {};
-}
-
 /**
  * @typedef {object} ProviderTableEntry
  * @property {new (options: any) => any} ctor the bare-agent provider class
- * @property {string} envKey the environment variable this provider reads its key from
- * @property {Readonly<Record<string, string>>} tiers tier name -> model id
  * @property {string} endpointKey the CONSTRUCTOR OPTION NAME this provider reads its endpoint from — NOT assumed to be `baseUrl` (see below)
- * @property {(model: string|undefined) => Record<string, any>} paramsFor per-model request-key/param gating, applied on TOP of {exposeErrorBody:true, apiKey, model, <endpointKey>?}
  */
 
 // ── WHY `endpointKey` IS A FIELD AND NOT THE LITERAL `baseUrl` ──────────────
@@ -178,35 +74,16 @@ export function judgeCallOptions(provider) {
 // the menu holds only http-shaped API providers, and the FIRST thing that
 // changes when Ollama is admitted is the one line nobody would think to look at.
 
-/** @type {Readonly<Record<string, ProviderTableEntry>>} */
+/**
+ * The three client classes bare-agent exports, chosen by shape id. NO key name, model id or per-model gating lives here: a row's
+ * key is its own env name (src/providerrows.js), a job carries its own model, and the old max_tokens spelling is the ROW's tick
+ * (`legacyMaxTokens`, `makeProvider`).
+ * @type {Readonly<Record<string, ProviderTableEntry>>}
+ */
 const PROVIDER_TABLE = Object.freeze({
-  'anthropic-api': Object.freeze({
-    ctor: AnthropicProvider,
-    envKey: 'ANTHROPIC_API_KEY',
-    tiers: ANTHROPIC_TIER_MODELS,
-    endpointKey: 'baseUrl',
-    // Anthropic has only ever had one request key for the output cap
-    // (`max_tokens`) — nothing to gate here, ever (unlike OpenAI-shaped
-    // backends, which fork on `max_tokens` vs `max_completion_tokens`).
-    paramsFor: () => ({}),
-  }),
-  'openai-api': Object.freeze({
-    ctor: OpenAIProvider,
-    envKey: 'OPENAI_API_KEY',
-    tiers: OPENAI_TIER_MODELS,
-    endpointKey: 'baseUrl',
-    paramsFor: (model) => OPENAI_MODEL_OPTIONS[/** @type {string} */ (model)] ?? {},
-  }),
-  'gemini-api': Object.freeze({
-    ctor: GeminiProvider,
-    envKey: 'GEMINI_API_KEY',
-    tiers: GEMINI_TIER_MODELS,
-    endpointKey: 'baseUrl',
-    // Gemini carries no `max_tokens`/`max_completion_tokens` fork of its own —
-    // bare-agent's GeminiProvider maps the cap internally. Nothing to gate, and
-    // an empty object is the honest statement of that, not an omission.
-    paramsFor: () => ({}),
-  }),
+  'anthropic-api': Object.freeze({ ctor: AnthropicProvider, endpointKey: 'baseUrl' }),
+  'openai-api': Object.freeze({ ctor: OpenAIProvider, endpointKey: 'baseUrl' }),
+  'gemini-api': Object.freeze({ ctor: GeminiProvider, endpointKey: 'baseUrl' }),
 });
 
 /**
@@ -232,7 +109,7 @@ export function resolveProvider(providerName) {
 /**
  * Report whether a resolved API key VALUE (not its presence — every call
  * site already presence-checks separately) carries a shape an HTTP header
- * value cannot: F181 (`docs/logs/FINDINGS.md`) — a two-line secret-store
+ * value cannot: F181 (`docs/wiki/FINDINGS.md`) — a two-line secret-store
  * entry put the key plus a trailing metadata line into `OPENAI_API_KEY`
  * (`"<key>\nmeta"`), the presence-only check at every door passed, and Node
  * crashed `TypeError [ERR_INVALID_CHAR]` inside its own header-encode at the
@@ -266,15 +143,15 @@ export function apiKeyProblem(value) {
 }
 
 /**
- * Construct ONE provider instance for `providerName`/`model`, applying
- * `exposeErrorBody: true` (F153 — every constructed provider, unconditionally)
- * and the model's own request-key gating (`paramsFor`). `baseUrl` (PRD item
- * 28, ruling (d), 2026-09-09: admitted in v1) is forwarded only when given —
- * every provider constructor here defaults it on its own when absent.
+ * Construct ONE provider instance for `providerName`/`model`, applying `exposeErrorBody: true` (F153 — every constructed
+ * provider, unconditionally). `baseUrl` (PRD item 28, ruling (d), 2026-09-09: admitted in v1) is forwarded only when given.
+ * `legacyMaxTokens` is the Settings ROW's "old max_tokens" tick: a server that ignores `max_completion_tokens` (F149) does not
+ * bind the output cap until it is on. It is forwarded only for `openai-api` and only when `true` — nothing here sniffs a host
+ * or a model id to decide it.
  * @param {string} providerName
- * @param {{apiKey?: string, model?: string, baseUrl?: string}} [options]
+ * @param {{apiKey?: string, model?: string, baseUrl?: string, legacyMaxTokens?: boolean}} [options]
  */
-export function makeProvider(providerName, { apiKey, model, baseUrl } = {}) {
+export function makeProvider(providerName, { apiKey, model, baseUrl, legacyMaxTokens } = {}) {
   const entry = resolveProvider(providerName);
   return new entry.ctor({
     exposeErrorBody: true,
@@ -287,105 +164,59 @@ export function makeProvider(providerName, { apiKey, model, baseUrl } = {}) {
     // is spelled differently would otherwise IGNORE the endpoint silently and
     // run against its own default; see the note above the table.
     ...(baseUrl !== undefined ? { [entry.endpointKey]: baseUrl } : {}),
-    ...entry.paramsFor(model),
+    ...(providerName === 'openai-api' && legacyMaxTokens === true ? { legacyMaxTokens: true } : {}),
   });
 }
 
 /**
- * Build the `{provider, providerFor, judgeProvider}` triple both runners
- * need (`src/authorrun.js` and `src/panel/authorsession.js` call it) — ONE seam instead of two copies of the same construction and
- * tier-memoization logic. `model`/`tierModels` are already-RESOLVED inputs
- * (the caller runs `resolveWorkerModel` itself, exactly as both runners did
- * before this factory existed — that decision stays where each runner's own
- * `--model` flag/spec precedence lives, not duplicated in here).
- *
- * THE JUDGE IS NO LONGER PINNED TO ANTHROPIC (PRD item 32.2, hamr 2026-09-10:
- * *"what i care about is that judge becomes llm agnostic and not set to one
- * model or provider"*). It is constructed through this same factory, from a
- * `judgeProviderName`/`judgeModel` pair the CALLER resolved (`resolveJudge`,
- * src/judged.js — the spec's signed `judge` override, else the job's own worker
- * provider and model). Item 28's pin, and item 28 part (2)'s deferral of a
- * signed `judge:{provider,model}` field, both close here.
+ * Build the `{provider, providerFor, judgeProvider}` triple both authoring runners need (`src/authorrun.js` and
+ * `src/panel/authorsession.js` call it) — ONE seam instead of two copies of the same construction. `model` is the
+ * already-RESOLVED worker model id (the caller picked the Settings line).
  *
- * `judgeApiKey` stays a SEPARATE argument rather than being derived: the judge
- * may legitimately be a different provider from the worker, and reading its key
- * for it would put a second env-var reader in a module whose whole job is to
- * have exactly one. The caller reads the resolved judge provider's own `envKey`
- * and hands the key in — the same contract the worker key already has here.
+ * THE JUDGE IS NOT PINNED (PRD item 32.2): it is constructed through this same factory from a `judgeProviderName`/`judgeModel`
+ * pair the CALLER resolved. `judgeApiKey` stays a SEPARATE argument: the judge may be a different provider from the worker,
+ * and each key is read by the caller from its own row.
  * @param {object} args
- * @param {string} args.providerName spec.provider (or the anthropic-api default)
- * @param {string|undefined} args.apiKey the WORKER's key, read from the provider's own `envKey`
+ * @param {string} args.providerName the worker's API shape id
+ * @param {string|undefined} args.apiKey the WORKER's key, read from its row's env name
  * @param {string} args.model the already-resolved worker model id
- * @param {Readonly<Record<string, string>>} args.tierModels the already-resolved tier -> model map (spec override folded in by the caller)
- * @param {string|undefined} [args.baseUrl] spec.baseUrl, if any
- * @param {string|undefined} args.judgeApiKey the judge's own key, read by the caller from the RESOLVED judge provider's `envKey`
+ * @param {string|undefined} [args.baseUrl] the worker row's Base URL
+ * @param {boolean} [args.legacyMaxTokens] the worker row's old max_tokens tick
+ * @param {string|undefined} args.judgeApiKey the judge's own key
  * @param {string} args.judgeModel the resolved judge model id
- * @param {string} [args.judgeProviderName] the resolved judge provider name; defaults to `providerName` (the job's own worker provider), which is `resolveJudge`'s own default
- * @param {string|undefined} [args.judgeBaseUrl] the judge provider's endpoint, when it takes one
+ * @param {string} [args.judgeProviderName] the resolved judge shape; defaults to `providerName`
+ * @param {string|undefined} [args.judgeBaseUrl] the judge row's endpoint
+ * @param {boolean} [args.judgeLegacyMaxTokens] the judge row's old max_tokens tick (defaults to the worker's when the judge shares its provider)
  */
 export function buildRunnerProviders({
-  providerName, apiKey, model, tierModels, baseUrl, judgeApiKey, judgeModel,
-  judgeProviderName = providerName, judgeBaseUrl = undefined,
+  providerName, apiKey, model, baseUrl, legacyMaxTokens = false, judgeApiKey, judgeModel,
+  judgeProviderName = providerName, judgeBaseUrl = undefined, judgeLegacyMaxTokens = undefined,
 }) {
-  const provider = makeProvider(providerName, { apiKey, model, baseUrl });
-  /** @type {Record<string, any>} */
-  const tierCache = {};
-  const providerFor = (/** @type {string} */ tier) => (tierCache[tier] ??= (
-    tierModels[tier] === model
-      ? provider
-      : makeProvider(providerName, { apiKey, model: tierModels[tier], baseUrl })
-  ));
-  // the judge goes through the SAME table as the worker — one place names a
-  // provider identity, which is the entire reason this factory exists. Reusing
-  // the worker instance when the identity matches exactly is not an optimisation
-  // for its own sake: a second instance against the same endpoint/model is a
-  // second prompt-cache prefix, and cache writes are ~41% of the bill.
+  const provider = makeProvider(providerName, { apiKey, model, baseUrl, legacyMaxTokens });
+  // a plan step's `model` is the one schema token `sonnet` (STEP_MODELS, src/plan.js): it means THE JOB'S worker model
+  const providerFor = (/** @type {string} */ _tier) => provider;
+  // the judge goes through the SAME table as the worker. Reusing the worker instance when the identity matches exactly is not an
+  // optimisation for its own sake: a second instance against the same endpoint/model is a second prompt-cache prefix, and cache
+  // writes are ~41% of the bill.
+  const judgeLegacy = judgeLegacyMaxTokens ?? (judgeProviderName === providerName ? legacyMaxTokens : false);
   const judgeProvider = (judgeProviderName === providerName && judgeModel === model && judgeApiKey === apiKey
-    && judgeBaseUrl === baseUrl)
+    && judgeBaseUrl === baseUrl && judgeLegacy === legacyMaxTokens)
     ? provider
-    : makeProvider(judgeProviderName, { apiKey: judgeApiKey, model: judgeModel, baseUrl: judgeBaseUrl });
+    : makeProvider(judgeProviderName, { apiKey: judgeApiKey, model: judgeModel, baseUrl: judgeBaseUrl, legacyMaxTokens: judgeLegacy });
   return { provider, providerFor, judgeProvider };
 }
 
 /**
- * A `providerName`'s own models-list GET endpoint — the shape this
- * function's ONE caller (`checkProviderReachable`, below) needs and nothing
- * else reads: `anthropic-api` and `openai-api` (the panel's Model select,
- * PANEL-BUILD.md P3 build item 7) are the only two shapes this build knows
- * how to ask, both a plain unauthenticated-body GET with the key in a
- * header — never a completion/chat endpoint, so this never spends a token.
- * @param {string} providerName
- * @param {string} [baseUrl]
- * @returns {{url: string, headers: Record<string,string>}|null} `null` when
- *   this provider's models-list shape is not known (never guessed at)
- */
-function modelsListRequest(providerName, baseUrl) {
-  if (providerName === 'anthropic-api') {
-    return {
-      url: `${baseUrl || 'https://api.anthropic.com/v1'}/models`,
-      headers: { 'x-api-key': '', 'anthropic-version': '2023-06-01' },
-    };
-  }
-  if (providerName === 'openai-api') {
-    return { url: `${baseUrl || 'https://api.openai.com/v1'}/models`, headers: {} };
-  }
-  return null;
-}
-
-/**
- * $0 reachability check: a GET against `providerName`'s own models-list
- * endpoint, server-side, with the key in a header — NEVER a completion
- * request, so it never spends a token (PANEL-BUILD.md P3 build item 7: "the
- * person must get feedback BEFORE drafting if the chosen model can't
- * work"). Reused, unmodified, by the panel's model-readiness route today
- * (`src/panel/authorroutes.js`) and by the future Settings providers
- * table's own "test" column (PANEL-BUILD.md P4) — ONE function, not two
- * hand-typed copies of the same probe.
+ * $0 reachability check: ONE GET of the provider's models list (`src/modellist.js`, the one owner of
+ * that call), server-side, with the key in a header — NEVER a completion request, so it never spends
+ * a token (PANEL-BUILD.md P3 build item 7: "the person must get feedback BEFORE drafting if the
+ * chosen model can't work"). Used by the panel's model-readiness route (`src/panel/authorroutes.js`);
+ * Settings > Providers' Test and Refresh call `listModels` directly. A blank `baseUrl` makes no call.
  *
- * NEVER returns the key, never logs it — the key only ever appears in a
- * request header sent straight to the provider's own host.
+ * NEVER returns the key, never logs it — the key only ever appears in a request header sent
+ * straight to the provider's own host.
  * @param {object} o
- * @param {string} o.providerName
+ * @param {string} o.providerName an API shape id
  * @param {string} o.apiKey
  * @param {string} [o.model] when given, the response is also checked for this model id
  * @param {string} [o.baseUrl]
@@ -396,39 +227,16 @@ function modelsListRequest(providerName, baseUrl) {
 export async function checkProviderReachable({
   providerName, apiKey, model, baseUrl, fetchImpl = fetch, timeoutMs = 4000,
 }) {
-  const req = modelsListRequest(providerName, baseUrl);
-  if (!req) {
+  if (!SHAPE_IDS.includes(providerName)) {
     return {
       reachable: false, modelListed: null, status: 'unsupported-provider',
       note: `no models-list check known for "${providerName}"`,
     };
   }
-  const headers = { ...req.headers };
-  if (providerName === 'anthropic-api') headers['x-api-key'] = apiKey;
-  else headers.Authorization = `Bearer ${apiKey}`;
-
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    // GET ONLY — no body, no completion/chat call, no tokens spent.
-    const res = await fetchImpl(req.url, { method: 'GET', headers, signal: controller.signal });
-    if (!res.ok) {
-      return { reachable: false, modelListed: null, status: `HTTP ${res.status}`, note: `models list returned HTTP ${res.status}` };
-    }
-    /** @type {any} */
-    let body = null;
-    try { body = await res.json(); } catch { body = null; }
-    const ids = Array.isArray(body?.data) ? body.data.map((/** @type {any} */ m) => m?.id).filter(Boolean) : [];
-    const modelListed = model ? ids.includes(model) : null;
-    return { reachable: true, modelListed, status: 'ok', note: null };
-  } catch (/** @type {any} */ e) {
-    const cls = e?.name === 'AbortError' ? 'timeout' : (e?.code || e?.name || 'network-error');
-    // connection refused surfaces as fetch's bare TypeError ("fetch failed") — say it plainly
-    const refused = e?.name === 'TypeError' || e?.code === 'ECONNREFUSED' || e?.cause?.code === 'ECONNREFUSED';
-    return { reachable: false, modelListed: null, status: String(cls), note: refused ? `nothing answering at ${req.url}` : `request failed: ${cls}` };
-  } finally {
-    clearTimeout(timer);
-  }
+  const r = await listModels({ shape: providerName, baseUrl: baseUrl ?? '', key: apiKey, fetchImpl, timeoutMs });
+  if (r.ok) return { reachable: true, modelListed: model ? r.models.includes(model) : null, status: 'ok', note: null };
+  const note = r.status.startsWith('HTTP ') ? `models list returned ${r.status}` : (r.detail ?? r.why);
+  return { reachable: false, modelListed: null, status: r.status, note };
 }
 
 /**

package/src/providershapes.js

@@ -0,0 +1,18 @@
+// rewritten-from: fwdloop src/providershapes.js@f9449e8
+// PANEL-BUILD.md P8 — the API shapes the Settings > Providers dropdown offers, ONE owner.
+// A shape is a wire protocol, never a place: no web address lives here (each row's Base URL
+// is typed in Settings). Only a shape `makeProvider` (src/providers.js) can really build is listed.
+// Kept in its own file so config.js can validate a shape without importing providers.js.
+
+/**
+ * `id` is the value saved in config.json (and the signed spec's `provider`).
+ * @type {readonly {id: string, label: string}[]}
+ */
+export const SHAPES = Object.freeze([
+  Object.freeze({ id: 'anthropic-api', label: 'Anthropic' }),
+  Object.freeze({ id: 'openai-api', label: 'OpenAI-compatible' }),
+  Object.freeze({ id: 'gemini-api', label: 'Gemini' }),
+]);
+
+/** @type {readonly string[]} */
+export const SHAPE_IDS = Object.freeze(SHAPES.map((s) => s.id));

package/src/replay.js

@@ -1520,7 +1520,7 @@ export function replayRun(spineEvents, auditEvents = [], { runId = null, auditAv
     // never hidden. `null` when there is nothing to compare (a resumed run,
     // where a gap is expected and already explained; or `thisFileSpend`
     // itself unknown) or when the two already agree within $0.0001.
-    spendMismatch: (!resumed && spentUsd !== null && thisFileSpend.value !== null && Math.abs(spentUsd - thisFileSpend.value) > 0.0001)
+    spendMismatch: (!resumed && spentUsd !== null && thisFileSpend.value !== null && Math.abs(spentUsd - thisFileSpend.value) > 1e-4)
       ? { spentUsd, thisFileUsd: thisFileSpend.value, diffUsd: spentUsd - thisFileSpend.value }
       : null,
     timelineKind,

package/src/reuse.js

@@ -1,5 +1,5 @@
 // Layer 3 — the D7 ENVELOPE and the REUSE RUNNER (design record
-// docs/product/2026-08-01-layer-3-reuse-design.md, D3/D5/D6/D7 + R1).
+// docs/logs/2026-08-01-layer-3-reuse-design.md, D3/D5/D6/D7 + R1).
 //
 // hamr's sentence is the whole specification of this file, verbatim:
 //

package/src/root.js

@@ -1,5 +1,5 @@
 // Layer R — the root: the within-run ratchet (LAYERS.md item 2; design record
-// docs/product/2026-07-19-layer-r-design.md). One state that survives attempts
+// docs/logs/2026-07-19-layer-r-design.md). One state that survives attempts
 // inside ONE run so a never-green run stops repeating itself (F21). Role is
 // CONTINUITY ONLY — F39 measured that hand-delivered state buys no conversion;
 // the semantic converter is Layer 2's job, not this module's.

package/src/run.js

@@ -3,7 +3,7 @@
 // smoke, the ONE budget ledger (cap-not-estimate; unpriced is never free, F6),
 // and the decision-ready stops. It composes the plan flow below it and
 // interprets nothing itself.
-// Design record: docs/product/2026-07-12-n2-headless-loop-design.md.
+// Design record: docs/logs/2026-07-12-n2-headless-loop-design.md.
 //
 // The legacy operator-authored `steps[]` path was DELETED 2026-07-26 (PRD
 // v1.32): the drafting call, config-v1, the per-step interpret loops and the
@@ -219,7 +219,7 @@ async function primitiveSmoke(workdir) {
  *        frozen A0 baseline arm has to be exactly today, so a guard firing under a disabled
  *        shim would make the baseline a treatment arm. The default-flip belongs to a
  *        paid contrast nobody has approved yet (the `layerRoot` precedent, F41).
- * @param {boolean} [opts.scout=true] operator-only switch (docs/product/SCOUT-CONTRAST.md),
+ * @param {boolean} [opts.scout=true] operator-only switch (docs/logs/SCOUT-CONTRAST.md),
  *   forwarded verbatim to the plan flow: `false` on a fresh run (no `resumeSeed`) skips the
  *   read-only survey and records `scout-skipped {reason:'operator-off'}` instead — the
  *   planner drafts from `(no scout notes)`. Runner territory exactly like `readShim`: the
@@ -282,7 +282,7 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   // blind-instrument failure this programme keeps logging. Only the guard runs
   // here; the flag itself is threaded onward to the plan flow as written.
   readShimArm(readShim);
-  // The scout switch's guard, same class and same door (docs/product/SCOUT-CONTRAST.md):
+  // The scout switch's guard, same class and same door (docs/logs/SCOUT-CONTRAST.md):
   // a mis-coerced value would run under the wrong label with no way to recover which arm
   // actually fired from the results afterwards.
   if (typeof scout !== 'boolean') throw new TypeError(`scout: expected boolean, got ${JSON.stringify(scout)}`);

package/src/selection.js

@@ -1,5 +1,5 @@
 // Layer 3 — D3's DISPLAY half: the workflow LISTING, and the prompt that asks for a
-// pick (design record docs/product/2026-08-01-layer-3-reuse-design.md, D3).
+// pick (design record docs/logs/2026-08-01-layer-3-reuse-design.md, D3).
 //
 // hamr's ruling, verbatim: *"i think there should be a listing for workflows names that
 // user can choose or auto-choose, or do we want llm to always decide (we still need to

package/src/source.js

@@ -25,7 +25,7 @@
 import { createHash } from 'node:crypto';
 import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
-import { dirname, join, relative, resolve, sep, basename } from 'node:path';
+import { dirname, join, relative, resolve, sep, basename, isAbsolute } from 'node:path';
 import { git } from './kinds.js';
 import { addWorktree, hideBareloopDir } from './worktree.js';
 import { MAX_BUFFER } from './kinds.js';
@@ -1160,3 +1160,66 @@ export function nonRepoSourceMessage(kind) {
   if (kind === 'folder') return "Source is a plain folder, not a code project (no git repo found). bareloop can't check this kind of job yet. Nothing spent.";
   return "Source is not a code project (no git repo found). bareloop can't check this kind of job yet. Nothing spent.";
 }
+
+/**
+ * P7 (docs/product/PANEL-BUILD.md, "Inputs"): prove the NUMBERED INPUTS at $0, before any token. Line 1 is the repo
+ * (an absolute path to an existing folder); lines 2+ are files or folders INSIDE that repo, repo-relative. A line
+ * that is not one of those is a named red naming its line number — never a throw, never a silent skip:
+ *   - a `search:` line or a URL, and a path that leaves the repo: "only files inside the repo for now" (search and
+ *     outside-the-repo inputs arrive with the plain-folder piece);
+ *   - a path that does not exist, or that git does not track (a repo job would not see it);
+ *   - the front door's own refusals for a file: an environment file by NAME, a symlink, a non-text file, an oversize
+ *     file. A known secret shape in its content is NOT a refusal (masked where recorded, as the P6 worktree door does).
+ * A folder value is checked for existence and tracking only (its files are the repo's own, which the worktree door
+ * already masks). Reads the tree; writes nothing.
+ * @param {{n: number, label: string, value: string}[]} inputs the parsed Inputs (`parseInputs`)
+ * @returns {Promise<{ok: true, repo: string, root: string|null}|{ok: false, error: string}>} `repo` = line 1's absolute path; `root` = the git root it sits in (null when line 1 alone was given and it is not in a git repo)
+ */
+export async function proveInputFiles(inputs) {
+  const first = inputs[0];
+  if (!first) return { ok: false, error: 'Inputs, line 1: the repo is required' };
+  /** @param {number} n @param {string} msg @returns {{ok: false, error: string}} */
+  const bad = (n, msg) => ({ ok: false, error: `Inputs, line ${n}: ${msg}` });
+  if (/^https?:\/\//i.test(first.value) || !isAbsolute(first.value)) return bad(1, 'the repo must be an absolute path, like /home/me/myrepo');
+  const repo = resolve(first.value);
+  let st;
+  try { st = lstatSync(repo); } catch { return bad(1, `${repo} does not exist`); }
+  // line 1 alone is the repo the job works on; whether it IS a code repo is the source door's own refusal (and
+  // `nonRepoSourceMessage`) downstream — only lines 2+ need a git tree to be proven against
+  const found = st.isDirectory() ? nearestGitAncestor(repo) : null;
+  if (inputs.length === 1) return { ok: true, repo, root: found && !found.isFile ? found.dir : null };
+  if (!st.isDirectory()) return bad(1, `${repo} is not a folder — line 1 is the repo`);
+  if (found === null || found.isFile) return bad(1, `${repo} is not inside a git repo, so the other inputs cannot be checked`);
+  const root = found.dir;
+  const rootReal = await realpath(root);
+  const repoReal = await realpath(repo);
+  for (const inp of inputs.slice(1)) {
+    const { n, label, value } = inp;
+    if (/^search$/i.test(label) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value)) return bad(n, 'only files inside the repo for now');
+    // like-for-like: resolve against the repo as the REAL filesystem sees it, so a repo reached through a symlinked parent
+    // compares against `rootReal` in the same spelling (a symlinked INPUT FILE is still refused below, by lstat)
+    const abs = resolve(repoReal, value);
+    const outside = (/** @type {string} */ p) => !(p === rootReal || p.startsWith(`${rootReal}${sep}`));
+    if (outside(abs)) return bad(n, 'only files inside the repo for now');
+    let ls;
+    try { ls = await lstat(abs); } catch { return bad(n, `${value} does not exist in the repo`); }
+    if (ls.isSymbolicLink()) return bad(n, `${value} is a symlink — refused, never followed`);
+    let real;
+    try { real = await realpath(abs); } catch { return bad(n, `${value} does not exist in the repo`); }
+    if (outside(real)) return bad(n, 'only files inside the repo for now');
+    const rel = relative(rootReal, abs).split(sep).join('/');
+    const tracked = await git(root, ['ls-files', '-z', '--', rel === '' ? '.' : rel]);
+    if (!tracked.ok || tracked.out.split('\0').filter(Boolean).length === 0) {
+      return bad(n, `${value} is not tracked by git — a repo job only sees tracked files; commit it first`);
+    }
+    if (ls.isDirectory()) continue;
+    if (ENV_FILE.test(basename(abs))) return bad(n, `${value} is an environment file — refused by NAME, whatever it contains (secrets never enter a job)`);
+    if (ls.size > MAX_BUFFER) return bad(n, `${value} is over the ${MAX_BUFFER}B per-file ceiling`);
+    const buf = await readFile(abs);
+    if (hasNulByte(buf.subarray(0, 8192))) return bad(n, `${value} is not a text file — text only for now`);
+    // a secret-shaped CONTENT is not refused (P6 worktree repo door, hamr 2026-10-05 Q2=A, same ruling for inputs): the file is
+    // the person's own, left in place; bareloop masks a secret wherever IT records one (`redactSecrets`, the one inventory) and
+    // never copies this file's text into a record — only its path travels. `.env` by name and symlinks stay refused above.
+  }
+  return { ok: true, repo, root };
+}

package/src/text.js

@@ -191,6 +191,19 @@ export function callCasualty(err) {
   if (err instanceof HaltError) return null;
   const e = /** @type {any} */ (err);
   if (e?.code === 'ETIMEDOUT' || e?.name === 'TimeoutError') return String(e?.message ?? e);
+  // F217 — a DROPPED CONNECTION is the same class as an idle timeout: a call that produced nothing usable. Two REAL
+  // shapes reach this seam out of bare-agent 0.49.0's OpenAIProvider (read in node_modules/bare-agent/src/provider-
+  // openai.js `_request` + provider-http.js), both thrown straight through `Loop.run` (loop.js rethrows non-Halt errors):
+  //   1. `req.on('error', reject)` passes node's RAW socket error unwrapped: `Error{code:'ECONNRESET', message:'socket
+  //      hang up'}` (the server closed before any response).
+  //   2. `guardResponseSettles` (BA-25), the connection cut after the headers: `ProviderError{code:'PROVIDER_ERROR',
+  //      retryable:true, context:{bound:'transport'}}`, message "response stream aborted/error/close before the body
+  //      completed". An HTTP-status ProviderError never carries `bound:'transport'`, so it is not admitted here.
+  // Other raw codes (ECONNREFUSED, ENOTFOUND, EPIPE...) reach the same raw path but name a wrong URL / no network, not a
+  // connection that DROPPED; they are deliberately not admitted (they re-raise loudly, as before).
+  if (e?.code === 'ECONNRESET' || e?.context?.bound === 'transport') {
+    return `the connection to the provider dropped (${String(e?.message ?? e)})`;
+  }
   return null;
 }