bareloop 0.39.0 → 0.41.0

package/src/authoring.js

@@ -1199,7 +1199,10 @@ function readPath(p, dotted) {
  * @param {{catalogue?: Record<string, KindSpec>, listing?: string[]|null,
  *   guards?: {name: string, kind: string, params: Record<string, any>, fill: string[]}[]|null,
  *   envOwned?: string[]|null, envInjected?: Record<string, string>|null, deferListing?: boolean,
- *   verdictType?: string|null, writeScope?: string[]|null}} [opts]
+ *   verdictType?: string|null, writeScope?: string[]|null, jobLines?: {n: number}[]|null}} [opts]
+ *   `jobLines` — the person's numbered job lines (P7). Present, every stage must name the line it serves and every
+ *     line needs a stage or a refusal ({@link checkJobLines}); absent (every spec that predates the job block), the
+ *     rule is not run.
  *   `writeScope` — the job's signed write fence. Every path a judged stage judges must sit inside it
  *     ({@link judgedOutsideFence}); absent, the rule is not run (the plain-folder deferral has no fence).
  *   `listing` — repo-relative paths at the seed (`git ls-tree -r --name-only`).
@@ -1218,7 +1221,7 @@ function readPath(p, dotted) {
 export function validateDeclaration(declaration, opts = {}) {
   const {
     catalogue = KIND_CATALOGUE, listing = null, guards = null, envOwned = null, envInjected = null,
-    verdictType = null, writeScope = null,
+    verdictType = null, writeScope = null, jobLines = null,
   } = opts;
   const deferListing = opts.deferListing === true;
   /** @type {Red[]} */
@@ -1443,11 +1446,71 @@ export function validateDeclaration(declaration, opts = {}) {
   });
 
   if (haveGuards) checkGuards({ declaration, guards: /** @type {any[]} */ (guards), red });
+  checkJobLines({ declaration, stages, jobLines, guards: haveGuards ? /** @type {any[]} */ (guards) : [], red });
 
   const ok = reds.length === 0;
   return { ok, reds, declaration: ok ? normalizeDeclaration(declaration) : null, grounded: haveListing, scoped, ceiling };
 }
 
+/**
+ * P7 rules 1-3 of the job block, at $0, in the gate that can still revise: every `fromLine` is a non-empty, duplicate-free array of real job line numbers (one check may serve several lines);
+ * every numbered job line has at least one stage OR a refusal reason in `refused` (a note in `notes` does NOT cover a
+ * line); the mandatory guards serve no line and carry no `fromLine`. The SHAPE of `fromLine` / `refused` is checked
+ * whenever they appear; the coverage half runs only when the person's `jobLines` were handed in.
+ * @param {{declaration: any, stages: any[], jobLines: {n: number}[]|null|undefined,
+ *   guards: {name: string}[], red: (c: string, p: string, d: string, e?: object) => void}} o
+ */
+function checkJobLines({ declaration, stages, jobLines, guards, red }) {
+  const known = Array.isArray(jobLines) && jobLines.length > 0 ? jobLines.map((l) => l.n) : null;
+  const guardNames = new Set(guards.map((g) => g.name));
+  /** @type {Set<number>} */
+  const served = new Set();
+  stages.forEach((/** @type {any} */ s, /** @type {number} */ i) => {
+    if (!isObj(s)) return;
+    const at = `stages[${i}].fromLine`;
+    const label = isNonEmptyString(s.name) ? s.name : `stages[${i}]`;
+    const guard = isNonEmptyString(s.name) && guardNames.has(s.name);
+    if (Object.hasOwn(s, 'fromLine')) {
+      if (guard) {
+        red('invalid-value', at, `stage "${label}" is a mandatory guard and serves no job line — remove its fromLine`);
+      } else if (!Array.isArray(s.fromLine) || s.fromLine.length === 0 || !s.fromLine.every((/** @type {any} */ x) => Number.isInteger(x) && x >= 1)) {
+        red('invalid-value', at, `stage "${label}" has fromLine ${JSON.stringify(s.fromLine)} — a non-empty array of job line numbers, e.g. [1] or [1, 3]`);
+      } else if (new Set(s.fromLine).size !== s.fromLine.length) {
+        red('invalid-value', at, `stage "${label}" lists a job line twice in fromLine ${JSON.stringify(s.fromLine)}`);
+      } else if (known !== null && s.fromLine.some((/** @type {number} */ x) => !known.includes(x))) {
+        red('invalid-value', at, `stage "${label}" has fromLine ${JSON.stringify(s.fromLine)}, but the job has lines ${known.join(', ')} only`);
+      } else for (const x of s.fromLine) served.add(x);
+    } else if (known !== null && !guard) {
+      red('missing-field', at, `stage "${label}" does not say which job lines it serves — give it fromLine: [N, ...] (${known.join(', ')}); `
+        + 'only a mandatory guard carries none');
+    }
+  });
+  /** @type {Set<number>} */
+  const refused = new Set();
+  if (declaration.refused !== undefined) {
+    if (!Array.isArray(declaration.refused)) {
+      red('invalid-value', 'refused', 'an array of {line, reason} — the job lines no stage can check, each with a reason');
+    } else {
+      declaration.refused.forEach((/** @type {any} */ r, /** @type {number} */ j) => {
+        const at = `refused[${j}]`;
+        if (!isObj(r) || !Number.isInteger(r.line) || r.line < 1 || !isNonEmptyString(r.reason)) {
+          red('invalid-value', at, '{line, reason}: a job line number and a plain-words reason');
+        } else if (known !== null && !known.includes(r.line)) {
+          red('invalid-value', `${at}.line`, `refused line ${r.line}, but the job has lines ${known.join(', ')} only`);
+        } else refused.add(r.line);
+      });
+    }
+  }
+  if (known !== null) {
+    for (const n of known) {
+      if (!served.has(n) && !refused.has(n)) {
+        red('job-line-uncovered', 'stages', `job line ${n} has no stage and no refusal. Give it a stage whose fromLine lists ${n}, or list `
+          + `it in "refused" as {"line": ${n}, "reason": "..."} — a note does not cover a line`, { line: n });
+      }
+    }
+  }
+}
+
 /**
  * COMPLETENESS — the deletion half of the owned-env rule, and the half a
  * by-VALUE comparison structurally cannot cover.

package/src/authorjob.js

@@ -113,6 +113,7 @@ import {
   QUESTION_SETS, questionsFor, requiredAnswersFor, authorClose, makeCostBook,
   runConfirmTurn, LANGUAGE_PICK_FIELD,
 } from './authorflow.js';
+import { thinkingCallOptions, assertThinkingMode } from './thinking.js';
 import { runAuthorScout, buildSeedListing, SCOUT_ATTEMPTS } from './authorscout.js';
 import {
   DECLARED_GAP_PREFIX, DECLARED_GENRES, guardNames, isDeclaredClose, validateCloseDecl,
@@ -416,16 +417,19 @@ function composerRefusal(reds) {
  * one-genre-at-a-time law is untouched.
  *
  * @param {{answers: Record<string|number, any>, repoPath?: string|null, lang: string,
+ *   jobLines?: {n: number, text: string}[]|null, inputs?: {n: number, label: string, value: string}[]|null,
  *   verdictType?: string|null,
  *   questions?: Record<string|number, string>|null, generate?: Function, provider?: any,
  *   seedRef?: string|null, scout?: any, listing?: any, ceilingUsd?: number|null, judgeModel?: string|null,
- *   rates?: {in: number, out: number}|null,
+ *   rates?: {in: number, out: number}|null, draftThinking?: 'on'|'off',
  *   onPhase?: (phase: string, data?: any) => void,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   seedFn?: Function, scoutFn?: Function, listingFn?: Function,
  *   authorFn?: Function, authorOpts?: object, writeScope?: string[]|null,
  *   signerFix?: Function|any, proposeFn?: Function, compileOpts?: object,
  *   ask?: ((step: {kind: string, [k: string]: any}) => Promise<string|null>)|null,
+ *   answerQuestions?: ((o: {questions: {line: number, question: string}[], dropped: {reason: string, raw: any}[], confirmed: any}) =>
+ *     Promise<{jobLines: {n: number, text: string, rule?: string}[], answers: Record<string|number, any>}|null>)|null,
  *   confirmGenerate?: Function|null, isRepo?: boolean,
  *   langResult?: {kind: string, candidates?: string[], [k: string]: any}|null}} o
  * @returns {Promise<{ok: boolean, refusal: Refusal|null, verdictType: string|null,
@@ -434,9 +438,15 @@ function composerRefusal(reds) {
  */
 export async function authorCloseForJob({
   answers, repoPath = null, lang, verdictType = null, questions = null,
+  // P7: the person's numbered job lines and numbered inputs (src/jobblock.js). Absent = every caller that predates the
+  // job block (no line tagging, no coverage rule).
+  jobLines = null, inputs = null,
   generate, provider = null, seedRef = null, scout = null, listing = null,
   ceilingUsd = null,
   rates = null,
+  // The drafter's THINKING knob ('on' | 'off', default 'off'; an operator param, never read from env here). It reaches the scout through
+  // `callOptions`; the `generate`/`confirmGenerate` the caller passes must be built with the SAME mode (`makeLoopGenerate`).
+  draftThinking = 'off',
   // Q2 IS GONE from the numbered interview (PRD item 33 M3 piece 3) — the
   // fence it used to describe in prose is now Destination's own proven
   // `writeScope`, and this is what carries it into the composer prompt
@@ -479,7 +489,14 @@ export async function authorCloseForJob({
   //                  shape matters here (a $0 language pick before the scout,
   //                  D7); every other kind leaves `lang` exactly as given.
   ask = null, confirmGenerate = null, isRepo = false, langResult = null,
+  // P7 item 5 (fwdloop am24/25): the seam that can really ASK the person. Present = the last drafting try, and only after
+  // the two before it both failed, may ask (`offerQuestions` below); the seam takes the machine-filtered questions, gets
+  // each answer (required, no skip), and hands back the job lines with the answers added as `~` rules plus the matching
+  // answers text. ABSENT (the CLI, every older caller) = nothing is ever offered and this file is byte-identical.
+  answerQuestions = null,
 }) {
+  // an operator-param guard: a typo never silently means "default" (throws before any work, even when the survey is supplied)
+  assertThinkingMode(draftThinking);
   /** @type {any} */
   const base = {
     ok: false, refusal: null, verdictType: null, closeDecl: null, seedRef: null,
@@ -580,7 +597,8 @@ export async function authorCloseForJob({
     // real tree. `attempts` is the ceiling the scout enforces on itself, so the
     // reader knows how many the line could repeat for.
     onPhase('scout', { attempts: SCOUT_ATTEMPTS });
-    survey = await scoutFn({ workdir, provider, ceilingUsd, onCall, ...(rates ? { rates } : {}) });
+    const scoutCallOptions = thinkingCallOptions(provider, draftThinking);
+    survey = await scoutFn({ workdir, provider, ceilingUsd, onCall, ...(rates ? { rates } : {}), ...(Object.keys(scoutCallOptions).length ? { callOptions: scoutCallOptions } : {}) });
     // …and the survey's own VERDICT, said the moment it lands. `state` is what
     // every downstream refusal keys on (F59: absent is never "no facts needed"),
     // and the fact count is the one number that says whether the ladder came
@@ -627,7 +645,7 @@ export async function authorCloseForJob({
     onPhase('confirm', {});
     const confirm = await runConfirmTurn({
       verdictType: picked, answers: interview.answers, questions: questions ?? questionsFor(picked),
-      facts: survey.facts, listing: null, writeScope, isRepo, lang, worseThanBefore,
+      facts: survey.facts, listing: null, writeScope, isRepo, lang, worseThanBefore, inputs,
       generate: confirmGenerate, book: confirmBook, ask, onPhase,
     });
     // DISTINCT from `runConfirmTurn`'s own per-round 'confirm-done' (fired once
@@ -671,13 +689,38 @@ export async function authorCloseForJob({
   // loop obeys — `author-call` carries the enforced cap instead, from where it
   // is computed.
   onPhase('author', {});
-  const authored = await authorFn({
+  /** the answers text the later stages read; the try-3 redraft replaces it (the person's answers are new `~` rules) @type {Record<string|number, any>} */
+  let stageAnswers = interview.answers;
+  let authored = await authorFn({
     workdir, seedRef: seed, lang, verdictType: picked,
-    answers: interview.answers, questions: questions ?? questionsFor(picked),
+    answers: stageAnswers, questions: questions ?? questionsFor(picked),
     scout: survey, listing: seeds, generate, ceilingUsd, onPhase, onCall, writeScope,
-    priorCalls: confirmPriorCalls, priorRaws: confirmPriorRaws, confirmed,
+    priorCalls: confirmPriorCalls, priorRaws: confirmPriorRaws, confirmed, jobLines, inputs,
+    ...(answerQuestions ? { offerQuestions: true } : {}),
     ...authorOpts,
   });
+  // P7 item 5: the drafter, on the last try after two failed ones, asked. The person answers (required, no skip); each
+  // answer becomes a `~` rule on its job line; the draft then runs ONCE more over the same survey, listing and confirmed
+  // plan, and may not ask again. The first leg's calls are carried as prior spend so the one ceiling still binds.
+  if (!authored.ok && authored.stop === 'questions-open' && answerQuestions && Array.isArray(authored.questions) && authored.questions.length) {
+    const dropped = (authored.iterations ?? []).flatMap((/** @type {any} */ it) => it?.droppedQuestions ?? []);
+    const updated = await answerQuestions({ questions: authored.questions, dropped, confirmed });
+    if (updated === null) return { ...base, interview, authoring: authored, reds: [], stop: 'confirm-abandoned', cost: authored.cost };
+    const scoutCalls = (survey?.calls ?? []).length;
+    const scoutRaws = (survey?.raws ?? []).length;
+    jobLines = updated.jobLines;
+    stageAnswers = updated.answers;
+    onPhase('author', {});
+    authored = await authorFn({
+      workdir, seedRef: seed, lang, verdictType: picked,
+      answers: stageAnswers, questions: questions ?? questionsFor(picked),
+      scout: survey, listing: seeds, generate, ceilingUsd, onPhase, onCall, writeScope,
+      priorCalls: (authored.cost?.calls ?? []).slice(scoutCalls), priorRaws: (authored.raws ?? []).slice(scoutRaws),
+      confirmed, jobLines, inputs,
+      ...authorOpts,
+      offerQuestions: false,
+    });
+  }
 
   if (!authored.ok) {
     return {
@@ -724,6 +767,11 @@ export async function authorCloseForJob({
     ...(authored.declaration.notes?.length
       ? { notes: authored.declaration.notes.map((/** @type {any} */ n) => (typeof n === 'string' ? redactSecrets(n) : n)) }
       : {}),
+    // P7: the job lines the drafter could not turn into a stage, each with its reason — the Job tab shows them. Free
+    // text the model wrote, so it rides the same redactor `notes` does.
+    ...(authored.declaration.refused?.length
+      ? { refused: authored.declaration.refused.map((/** @type {any} */ r) => ({ line: r.line, reason: redactSecrets(String(r.reason)) })) }
+      : {}),
   };
 
   // ── THE TWO SIGNED ARTIFACTS (softgreen module 4, wired here by module 5) ──
@@ -750,7 +798,7 @@ export async function authorCloseForJob({
     book.absorb(authored.cost?.calls ?? []);
     onPhase('rubric', { size: CALIBRATION_SIZE });
     const proposed = await proposeFn({
-      answers: interview.answers,
+      answers: stageAnswers,
       questions: questions ?? questionsFor(picked),
       generate,
       book,
@@ -1253,7 +1301,7 @@ export async function prepareSigning({
   }
   // the class rides from the SPEC (PRD v1.57 §2) — gate 1a already refused a spec
   // whose class is unknown or locked, so this is the class D5's battery hangs off
-  const dv = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', listing: listed.files, verdictType: spec.verdictType, writeScope: spec.writeScope });
+  const dv = validateCloseDecl(spec.closeDecl, { at: 'closeDecl', listing: listed.files, verdictType: spec.verdictType, writeScope: spec.writeScope, jobLines: Array.isArray(spec.jobLines) ? spec.jobLines : null });
   // the grounded gate's reds quote BOTH untrusted sources — the declaration, and
   // the seed listing itself (the listing rule names what really sits beside an
   // invented path). The listing half is a channel gate 1a structurally cannot

package/src/authorreadout.js

@@ -53,7 +53,7 @@ export function declarationLines({ goal, closeDecl }) {
  * F176'S FALLBACK, SAID OUT LOUD — the revise ladder kept the NEWEST SOUND
  * declaration rather than the last one it happened to try, because "kept the
  * last accepted revision" is not the same claim as "kept the best revision"
- * (docs/logs/FINDINGS.md F176). Absent on every run where the fallback never
+ * (docs/wiki/FINDINGS.md F176). Absent on every run where the fallback never
  * fired (the overwhelming majority), which is why this returns an EMPTY list
  * rather than a "no fallback" line — a green close has nothing to say here and
  * printing it every run would be noise, not information.
@@ -572,6 +572,54 @@ export function proposalStopText({ stop, reds, cases = null, spend = null, sourc
   return lines.join('\n');
 }
 
+// ── ANY DRAFTING STOP, in plain words (P7 item 6, live session smv2bzdqmp0f8, 2026-10-10) ───────────────────────────
+// A provider-red used to reach the panel as the bare line "Stopped: provider-red" — a code, no reason. Every stop of the
+// drafting loop that is not a rubric-proposal or signing refusal (those have their own wording above and below) now says
+// what happened, what it cost and what to do, in words. The stop's own reds are quoted (scrubbed, bounded), never dropped.
+
+/** the reason inside a `scout-absent` red's detail: `the survey is ABSENT (<reason>) — an absent facts object ...` (src/authorflow.js) */
+const SCOUT_REASON_RE = /^the survey is [^(]*\((.*)\) — an absent facts/s;
+
+/**
+ * @param {{stop: string, reds?: PlainRed[]|null, refusal?: {detail?: string}|null,
+ *   spend?: {knownUsd?: number|null, spendComplete?: boolean|null}|null}} o
+ * @returns {string}
+ */
+export function draftStopText({ stop, reds = null, refusal = null, spend = null }) {
+  const spent = spendText(spend);
+  /** @type {Record<string, string>} */
+  const heads = {
+    'provider-red': 'The AI provider failed before a usable plan came back — a connection or service fault, not a problem with your job.',
+    'artifact-red': 'The AI answered, but its answer could not be used as a plan.',
+    'cap-halt': 'Drafting stopped on your cost cap.',
+    'pricing-red': 'Drafting stopped: the cost of a call could not be priced, so the cap cannot be enforced.',
+    'max-revisions': 'The AI used all its tries without a plan that passed the checks.',
+    precheck: 'Drafting stopped before any call: something it needs was missing.',
+    unchanged: 'Drafting stopped: the AI sent the same plan twice.',
+    'scout-absent': 'Drafting stopped: the first look at your repo did not complete.',
+  };
+  const redList = Array.isArray(reds) ? reds : [];
+  // F217: the first look at the repo failing (a dropped connection, a timeout) arrives as a `precheck` stop with a
+  // `scout-absent` red. That is NOT "something it needs was missing", and its reason sits past the 60-char quote bound
+  // behind a fixed lead-in, so the person saw neither. Word it as the scout's stop and quote the reason in full (scrubbed).
+  const scoutRed = stop === 'precheck' ? redList.find((r) => r?.code === 'scout-absent') : undefined;
+  const head = scoutRed ? heads['scout-absent'] : (heads[stop] ?? `Drafting stopped (${safeText(stop)}).`);
+  /** @type {string[]} */
+  const said = scoutRed
+    ? [SCOUT_REASON_RE.exec(String(scoutRed.detail ?? ''))?.[1]
+      ?.replace(/\s+/g, ' ').trim().slice(0, 240) ?? safeText(scoutRed.detail)].map((x) => redactSecrets(x)).filter(Boolean)
+    : [...new Set(redList.map((r) => safeText(r?.detail)).filter(Boolean))];
+  if (said.length === 0 && refusal?.detail) said.push(safeText(refusal.detail));
+  const lines = [`${head} Spent so far: ${spent ?? 'unknown'}.`];
+  if (said.length) {
+    lines.push('What it said:');
+    for (const x of said.slice(0, PLAIN_MAX_BULLETS)) lines.push(` • ${x}`);
+    if (said.length > PLAIN_MAX_BULLETS) lines.push(` • …and ${said.length - PLAIN_MAX_BULLETS} more.`);
+  }
+  lines.push(stop === 'cap-halt' || stop === 'pricing-red' ? 'What to do: raise the cap or fix the price in Settings, then draft again.' : 'What to do: draft again.');
+  return lines.join('\n');
+}
+
 // ── THE SIGNING GATES' REFUSAL, in plain words (hamr, 2026-10-09) ──────────────────────────
 //
 // `prepareSigning` (src/authorjob.js) can refuse with a list of reds from four gates. The panel used to say
@@ -598,7 +646,7 @@ export function proposalStopText({ stop, reds, cases = null, spend = null, sourc
 export const DECLARATION_CODES = Object.freeze([
   'bounds', 'class-absent', 'class-battery-locked', 'class-ceiling', 'cmd-denied', 'duplicate-kind', 'duplicate-name',
   'env-ownership-absent', 'genre-env-missing', 'genre-env-ungrounded', 'genre-owned-env', 'guard-missing',
-  'guard-weakened', 'guards-absent', 'human-stage-not-last', 'human-stage-offered', 'invalid-value', 'judged-outside-write-scope', 'judged-stage-order',
+  'guard-weakened', 'guards-absent', 'human-stage-not-last', 'human-stage-offered', 'invalid-value', 'job-line-uncovered', 'judged-outside-write-scope', 'judged-stage-order',
   'listing-absent', 'listing-conflict', 'locked-kind', 'missing-field', 'missing-required', 'one-population',
   'path-not-in-listing', 'secret-literal', 'unknown-field', 'unknown-kind',
 ]);

package/src/authorrun.js

@@ -101,7 +101,7 @@
 //                  in; a draft missing one, or naming one the provider factory
 //                  does not know, dies here loud, listing the known table.
 import { keysForDoor } from './keysfile.js';
-import { applyConfiguredKey, judgeRatesFor, keyNameFor, ratesFor, rowsForHome } from './providerrows.js';
+import { judgeRatesFor, judgeRowFor, keyNameFor, keyValueOf, ratesFor, ratesOfLine, resolveWorker, rowsForHome } from './providerrows.js';
 import { ConfigError } from './config.js';
 import {
   readFileSync, writeFileSync, appendFileSync, mkdirSync, existsSync, statSync,
@@ -466,13 +466,15 @@ export async function main(argv, deps = {}) {
     try { return resolveProvider(draft?.provider); } catch (e) { return die(/** @type {Error} */ (e).message); }
   })();
   const PROVIDER_NAME = /** @type {string} */ (draft.provider);
-  // The same tier run-u drafts and works on. The declaration is authored by a
-  // model, so the floor is the drafter floor (PRD v1.36: sonnet MINIMUM).
-  const MODEL = /** @type {NonNullable<typeof providerEntry>} */ (providerEntry).tiers.sonnet;
-  // spec.baseUrl (PRD item 28, ruling (d)) — the same forwarding rule run-u
-  // applies: forwarded only when the draft names one, every provider
-  // constructor defaults it on its own when absent.
-  const baseUrl = typeof draft?.baseUrl === 'string' ? draft.baseUrl : undefined;
+  // The Settings LINE this authoring run works on (P8): the draft's own `model` on a ticked, priced line of a key row on the
+  // draft's API shape (and Base URL, when it names one). The row is the key, the Base URL and the old-max_tokens tick. Nothing is
+  // built in: a draft naming no model, or a model no row ticks, stops here at $0.
+  const keyCfg = rowsForHome(keys.home, env);
+  const W = resolveWorker(keyCfg, draft);
+  if (!W.ok) { err(W.say.includes('Nothing was spent') ? W.say : `${W.say} Nothing was spent.`); throw new ExitSignal(2); }
+  const MODEL = W.model;
+  const baseUrl = W.baseUrl;
+  const AUTHOR_ROW = W.row;
 
   // THE JUDGE THIS RUN'S OWN WORKER RESOLVES TO (PRD item 32.1) — resolved ONCE,
   // here, from the DRAFT, and reused for BOTH the compose-time stamp (the
@@ -508,12 +510,9 @@ export async function main(argv, deps = {}) {
 
   // Secrets load from the environment; they never enter argv (a command line is
   // world-readable on /proc) and they are never printed.
-  // P4a item 4 — the key variable the person picked in Settings (config.json) stands in for
-  // the provider's built-in one; none picked = the built-in. Names only.
-  const keyCfg = rowsForHome(keys.home);
-  const authorEnv = applyConfiguredKey(env, PROVIDER_NAME, baseUrl, keyCfg);
-  const AUTHOR_ENV_KEY = keyNameFor(PROVIDER_NAME, baseUrl, keyCfg).name;
-  const apiKey = authorEnv[/** @type {NonNullable<typeof providerEntry>} */ (providerEntry).envKey];
+  // The key is the chosen row's own variable (P8: no built-in name). Names only.
+  const AUTHOR_ENV_KEY = AUTHOR_ROW.envName;
+  const apiKey = keyValueOf(env, AUTHOR_ENV_KEY);
   if (!apiKey) { err(`${AUTHOR_ENV_KEY} not set (secrets load from the environment — never the tree, never argv)`); throw new ExitSignal(2); }
   // F181 — a key that carries a line break/control char/stray whitespace (a
   // two-line secret-store entry, e.g.) reads as "set" by the presence check
@@ -527,17 +526,17 @@ export async function main(argv, deps = {}) {
   // loop, confirm turn, calibration judge). A bad price refuses here; it never falls back to the guess.
   /** @type {ReturnType<typeof ratesFor>} */
   let authorPrice = null;
-  try { authorPrice = ratesFor(PROVIDER_NAME, baseUrl, keyCfg); } catch (e) {
-    if (!(e instanceof ConfigError)) throw e;
-    err(`${e.message} — refusing to start rather than guess a price. Nothing spent.`);
-    throw new ExitSignal(2);
+  {
+    const al = ratesOfLine(W.line);
+    authorPrice = al ? { ...al, envName: AUTHOR_ROW.envName } : null;
   }
   /** The judge's key follows the RESOLVED judge provider's own env var, with
    * `JUDGE_API_KEY` as the role-named override in front (PRD item 32.3) — the same
    * contract `scripts/run-u.mjs` keeps, so one story covers both surfaces. When the
    * judge IS the authoring provider this is the key already read above. */
+  const judgeRowOf = (/** @type {{provider: string, model?: string|null}} */ j) => judgeRowFor(keyCfg, j, PROVIDER_NAME, AUTHOR_ROW);
   const judgeKeyFor = (/** @type {string} */ providerName) => (
-    env.JUDGE_API_KEY ?? (providerName === PROVIDER_NAME ? authorEnv : applyConfiguredKey(env, providerName, undefined, keyCfg))[resolveProvider(providerName).envKey]
+    env.JUDGE_API_KEY ?? (providerName === PROVIDER_NAME ? apiKey : keyValueOf(env, judgeRowFor(keyCfg, { provider: providerName }, PROVIDER_NAME, AUTHOR_ROW)?.envName))
   );
 
   /** F6 — an unpriced call makes the TOTAL unknown, and unknown is reported as
@@ -570,7 +569,7 @@ export async function main(argv, deps = {}) {
   out(`  ${ceilingLine(CEILING_USD)}`);
   out('  stops at prepareSigning — this script NEVER signs and NEVER runs the job\n');
 
-  // F190 (docs/logs/FINDINGS.md) — this used to be a hand-rolled `makeProvider`
+  // F190 (docs/wiki/FINDINGS.md) — this used to be a hand-rolled `makeProvider`
   // call, a duplicate of the SAME construction `buildRunnerProviders` already
   // owns for `src/cli.js`. Routed through the one owner now: the judge half of
   // this call is a THROWAWAY (`judgeProviderName`/`judgeModel`/`judgeBaseUrl` all
@@ -579,7 +578,7 @@ export async function main(argv, deps = {}) {
   // one) — the real judge identity is not resolved until after `validateJob`,
   // further down, where a second call takes only its `.judgeProvider`.
   const { provider } = buildRunnerProviders({
-    providerName: PROVIDER_NAME, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl,
+    providerName: PROVIDER_NAME, apiKey, model: MODEL, baseUrl, legacyMaxTokens: AUTHOR_ROW.legacyMaxTokens,
     judgeApiKey: apiKey, judgeModel: MODEL, judgeProviderName: PROVIDER_NAME, judgeBaseUrl: baseUrl,
   });
   emit('author-start', { runid, source: SOURCE, lang: LANG, verdictType: VERDICT, provider: PROVIDER_NAME, model: MODEL, baseUrl: baseUrl ?? null, job: draft?.job ?? null, timeoutMs: TIMEOUT_MS, ceilingUsd: CEILING_USD });
@@ -818,7 +817,7 @@ export async function main(argv, deps = {}) {
   // piece 4, step S6, D5 amended 2026-09-21) ──────────────────────────────────
   // This USED TO run the whole confirm turn first (over a $0 manual listing,
   // via `runConfirmTurn`), THEN give this stop once the person confirmed a plan
-  // — D5's original shape. Live run `mu4hc7sp` (docs/logs/FINDINGS.md F191)
+  // — D5's original shape. Live run `mu4hc7sp` (docs/wiki/FINDINGS.md F191)
   // crashed inside that confirm turn instead: `confirmProtections`
   // (`src/authorflow.js`) calls `classGuards` (`src/authoring.js`), which is
   // keyed by CODE LANGUAGE and THROWS on a plain folder's `lang:
@@ -879,6 +878,9 @@ export async function main(argv, deps = {}) {
       // fence is not this script's business to invent one for, so an absent or
       // malformed field travels as `null` and `authorPrompt` simply states nothing.
       writeScope: Array.isArray(draft.writeScope) ? draft.writeScope : null,
+      // P7: the person's numbered job lines and inputs ride the draft; the drafter tags every stage with a line
+      jobLines: Array.isArray(draft.jobLines) ? draft.jobLines : null,
+      inputs: Array.isArray(draft.inputs) ? draft.inputs : null,
       provider,
       generate: makeLoopGenerate(provider, { rates: authorPrice?.rates ?? null }),
       rates: authorPrice?.rates ?? null,
@@ -1112,7 +1114,7 @@ export async function main(argv, deps = {}) {
           const judgeKeyValue = judgeKeyFor(judge.provider);
           const judgeKeyProblem = judgeKeyValue ? apiKeyProblem(judgeKeyValue) : null;
           if (judgeKeyProblem) {
-            const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : resolveProvider(judge.provider).envKey;
+            const judgeEnvName = env.JUDGE_API_KEY ? 'JUDGE_API_KEY' : (judgeRowOf(judge)?.envName ?? judge.provider);
             err(`${judgeEnvName} ${judgeKeyProblem} — refusing rather than crashing mid-call (never trimmed or repaired; fix the value at its source)`);
             // F186 — the scout above already ran and may have left its own gate
             // audit in the tree. Under `process.exit()` this path used to skip
@@ -1146,9 +1148,10 @@ export async function main(argv, deps = {}) {
         let judgeProvider = null;
         if (judge) {
           judgeProvider = buildRunnerProviders({
-            providerName: PROVIDER_NAME, apiKey, model: MODEL, tierModels: providerEntry.tiers, baseUrl,
+            providerName: PROVIDER_NAME, apiKey, model: MODEL, baseUrl, legacyMaxTokens: AUTHOR_ROW.legacyMaxTokens,
             judgeApiKey: judgeKeyFor(judge.provider), judgeModel: judge.model, judgeProviderName: judge.provider,
-            judgeBaseUrl: judge.provider === PROVIDER_NAME ? baseUrl : undefined,
+            judgeBaseUrl: judge.provider === PROVIDER_NAME ? baseUrl : (judgeRowOf(judge)?.baseUrl.trim() || undefined),
+            judgeLegacyMaxTokens: judge.provider === PROVIDER_NAME ? AUTHOR_ROW.legacyMaxTokens : (judgeRowOf(judge)?.legacyMaxTokens ?? false),
           }).judgeProvider;
         }
         if (judge) {
@@ -1167,7 +1170,7 @@ export async function main(argv, deps = {}) {
           // number would silently widen it.
           ceilingUsd: CEILING_USD,
           priorCalls: [...metered],
-          judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null }) : null,
+          judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null, thinking: spec.thinking === true }) : null,
           // the seam's other half (PRD item 32.1): the graded set is STAMPED with
           // this, and the close later refuses to grade under any other identity.
           judgeModel: judge?.model ?? null,
@@ -1294,7 +1297,7 @@ export async function main(argv, deps = {}) {
               + 'and run-u will enforce the remainder (Cap $ minus this) as ITS ceiling — pass --draft-spent-usd exactly as shown below, never a rounded or re-typed figure.');
           }
           out('\nTo run it (the same signature and gates as any other job — nothing here bypasses them):');
-          out(`  ${keyNameFor(PROVIDER_NAME, baseUrl, keyCfg, spec.model).name}=... ${commandFor('run-u', deps.invokedAs)} --spec ${specFile} --approve ${hash}${draftSpentUsd > 0 ? ` --draft-spent-usd ${draftSpentUsd}${draftIncomplete ? ' --draft-spend-incomplete' : ''}` : ''}`);
+          out(`  ${AUTHOR_ENV_KEY}=... ${commandFor('run-u', deps.invokedAs)} --spec ${specFile} --approve ${hash}${draftSpentUsd > 0 ? ` --draft-spent-usd ${draftSpentUsd}${draftIncomplete ? ' --draft-spend-incomplete' : ''}` : ''}`);
           emit('author-end', { outcome: 'prepared', specHash: hash });
         }
       }

package/src/authorscout.js

@@ -375,9 +375,9 @@ const defaultLoop = (/** @type {any} */ { system, policy, onLlmResult, provider,
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
  *   attempts?: number, ceilingUsd?: number|null, callTimeoutMs?: number,
- *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number, thinkingStatus?: string}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any, rates?: {in: number, out: number}}) => any,
- *   rates?: {in: number, out: number}|null,
+ *   rates?: {in: number, out: number}|null, callOptions?: Record<string, any>,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
  * @returns {Promise<Survey & {raw: string, raws: ReturnType<typeof scrubRaw>[],
  *   calls: {label: string, costUsd: number|null, unpricedRounds: number}[],
@@ -400,6 +400,8 @@ export async function runAuthorScout({
   onCall = () => {},
   createLoop = defaultLoop,
   rates = null,
+  // the drafter's per-call model options (`thinkingCallOptions`, src/thinking.js; e.g. thinking off) — {} = nothing extra, byte-identical
+  callOptions = {},
   createSurveyor = defaultSurveyor,
 }) {
   const callTimeout = Number.isFinite(Number(callTimeoutMs)) && Number(callTimeoutMs) > 0
@@ -434,7 +436,8 @@ export async function runAuthorScout({
     // metered without the report going out: exactly the pairing invariant the
     // raw already rides. It REPORTS and decides nothing; the ceiling still binds
     // through `capStop` between calls, untouched.
-    onCall({ ...call });
+    // bare-agent's per-run `thinkingStatus` rides the reporting seam only, never the stored entry (see makeCostBook.add)
+    onCall({ ...call, ...(r?.thinkingStatus === undefined ? {} : { thinkingStatus: r.thinkingStatus }) });
     return raws.push(scrubRaw({ label, attempt, text: r?.text })) - 1;
   };
   // TIGHTEN-ONLY: an operator may lower the ceiling, never raise it. A garbage
@@ -526,7 +529,7 @@ export async function runAuthorScout({
         loop = createLoop({ system, policy: surveyor.policy, onLlmResult: metered, provider, ...priced });
 
         const r = await settled(loop.run([{ role: 'user', content: scoutPrompt(workdir) }], surveyor.tools,
-          { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions }));
         verdictAt = record(label, attempt, r);
         blob = redactSecrets(String(r?.text ?? '')).slice(0, blobMax);
         lastMsgs = Array.isArray(r?.msgs) && r.msgs.length ? r.msgs : null;
@@ -572,7 +575,7 @@ export async function runAuthorScout({
           // backends 400 on it. Strip the leading one before re-running.
           const rMsgs = r.msgs[0]?.role === 'system' ? r.msgs.slice(1) : r.msgs;
           s2 = await settled(recovery.run([...rMsgs, { role: 'user', content: SCOUT_RECOVERY_PROMPT }], [],
-            { cacheMessages: true, maxTokens, timeoutMs: callTimeout }));
+            { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions }));
           const recoveryAt = record('author-scout-recovery', attempt, s2);
           const t = redactSecrets(String(s2?.text ?? '')).slice(0, blobMax);
           // the verdict follows the blob that WON, never the call that came last
@@ -603,7 +606,7 @@ export async function runAuthorScout({
         const askMsgs = lastMsgs[0]?.role === 'system' ? lastMsgs.slice(1) : lastMsgs;
         const rr = await settled(reask.run(
           [...askMsgs, { role: 'user', content: scoutReaskTurn(/** @type {Survey} */ (survey).reason ?? '') }], [],
-          { cacheMessages: true, maxTokens, timeoutMs: callTimeout },
+          { cacheMessages: true, maxTokens, timeoutMs: callTimeout, ...callOptions },
         ));
         verdictAt = record(label, attempt, rr);
         blob = redactSecrets(String(rr?.text ?? '')).slice(0, blobMax);

package/src/bridges.js

@@ -1,5 +1,5 @@
 // Layer 3 — the REUSE registry (design record:
-// docs/product/2026-08-01-layer-3-reuse-design.md, D1/D2/D6, frozen 2026-08-01).
+// docs/logs/2026-08-01-layer-3-reuse-design.md, D1/D2/D6, frozen 2026-08-01).
 //
 // A BRIDGE is the plan a green actually executed, kept so the next run of the same
 // SHAPE starts from it instead of cold. This module is the box and the label on it:

package/src/bundle.js

@@ -459,13 +459,16 @@ export function exportBundle({ spec, closeScripts, registryDir, outDir, bareloop
     '',
     '## Running this bundle',
     '',
-    '  ./node_modules/.bin/bareloop run . --repo <path> [--budget N] [--wall MIN] [--approve <bundleHash>]',
+    '  ./node_modules/.bin/bareloop run . --repo <path> [--model <id>] [--budget N] [--wall MIN] [--approve <bundleHash>]',
     '',
     'Answer these, in the order `bareloop run` asks them:',
     '',
-    '1. Provider key — set ANTHROPIC_API_KEY in your environment (never on the',
-    '   command line, never in a file). Absent, `bareloop run` prints these',
-    '   questions and the bundleHash again, and spends nothing.',
+    "1. Provider key — put your provider's API key in your keys file (the NAME your",
+    '   Settings row uses), never on the command line. A bundle signed without a',
+    '   model needs `--model <id>` of a line ticked in Settings > Providers (with',
+    '   both prices), plus `--provider <KEY>` when two keys tick it. With neither,',
+    '   `bareloop run` prints these questions and the bundleHash again, and spends',
+    '   nothing.',
     `2. Approve — the FIRST run on this machine requires --approve ${hash}`,
     "   (this bundle's own signed hash, shown above) to prove a human read and",
     '   accepted it before anything runs. Once that first run GREENS, the',

package/src/bundlerun.js

@@ -204,13 +204,16 @@ export async function bundleMain(args, {
       workdir: worktree,
       seed,
       approve: approveHash,
+      // an exported bundle follows the run-u rule: a spec that names no model takes `--model <id>` (+ `--provider <KEY>` when two keys tick it)
+      ...(typeof flags.model === 'string' ? { model: flags.model } : {}),
+      ...(typeof flags.provider === 'string' ? { providerKey: flags.provider } : {}),
       deps: { ...deps, env, out, err, ...(keysHome === undefined ? {} : { keysHome }) },
       bundle: {
         runid,
         runDir,
         // the bare re-invocation prefix; the leg's OWN tightened ceilings (only those the person passed) ride as
         // DATA so the engine, which knows the halt kind and the spend, spells the printed line. Text only.
-        invoke: `bareloop run ${bundleDirArg} --repo ${repo}`,
+        invoke: `bareloop run ${bundleDirArg} --repo ${repo}${typeof flags.model === 'string' ? ` --model ${flags.model}` : ''}${typeof flags.provider === 'string' ? ` --provider ${flags.provider}` : ''}`,
         tightened: {
           ...(envelope.budgetUsd === undefined ? {} : { budgetUsd: envelope.budgetUsd }),
           ...(flags.wall === undefined ? {} : { wallMin: Number(flags.wall) }),

package/src/calibrate.js

@@ -1,5 +1,5 @@
 // THE CALIBRATION GATE — softgreen module 5 (design record
-// docs/product/2026-08-17-softgreen-review-door-design.md §4.4, the
+// docs/logs/2026-08-17-softgreen-review-door-design.md §4.4, the
 // 2026-08-18 threshold addendum rulings 1–3, and the second same-day addendum's
 // rulings 1 and 3).
 //

package/src/cardauthor.js

@@ -1,5 +1,5 @@
 // THE TWO SIGNED ARTIFACTS — softgreen module 4 (design record
-// docs/product/2026-08-17-softgreen-review-door-design.md §4.3 and §4.4,
+// docs/logs/2026-08-17-softgreen-review-door-design.md §4.3 and §4.4,
 // plus the 2026-08-18 threshold addendum).
 //
 // Module 1 built the judged floor's core, module 2 wired the stage into a close,
@@ -240,6 +240,9 @@ THEIR ANSWER — verbatim, and the only input you have
 Q${qKey}. ${q}
 A${qKey}. ${answers?.[qKey] ?? '(no answer given)'}
 
+Each example is kept with the number of the job line the person wrote it under. Never attach an example to a different
+line than the one it names (run mv1j01sl guessed which example belonged to which part of the goal).
+
 ---
 
 THE RULEBOOK — the only rules that exist. You SELECT from it; a rule that is not here cannot be asked for.

package/src/cli.js

@@ -7,7 +7,7 @@
 // run-u` drives (`src/userrun.js`): providers, keys (the keys file / env, any provider the
 // bundle's spec names), judge, monthly limit and readout are that engine's. The test seam is
 // the engine's too: `deps.provider` (and `providerFor`/`judgeProvider`) supplies a scripted
-// provider and skips the real-key check (same as `tests/planrun.test.js`'s pattern).
+// provider and skips the real-key check (same as `tests/planrun-*.test.js`'s pattern).
 //
 // Money/arbiter rules the bundle door keeps: `--budget`/`--wall` only TIGHTEN a bundle's
 // signed ceilings (`checkEnvelope`, M1); a bundle's `bundleHash` (the human-facing