bareloop 0.41.0 → 0.43.0

package/src/runlist.js

@@ -128,6 +128,41 @@ export function appendRunEvent(event, opts = {}) {
   try { chmodSync(path, 0o600); } catch { /* best-effort perms */ }
 }
 
+/**
+ * RULED 2026-10-15 ("Remove from Needs you"): the person took a stopped run's card out of the Needs-you list. ONE row
+ * `{runid, type:'needs-removed', at}` appended beside the run rows; it is not a run, a claim or an event ({@link readRunList}
+ * ignores it, so the monthly limit, the run counter and the scheduler never see it). Nothing is rewritten.
+ * @param {string} runid
+ * @param {{ home?: string, now?: () => number }} [opts]
+ * @returns {string} the `at` written
+ */
+export function appendNeedsRemoved(runid, opts = {}) {
+  const at = new Date((opts.now ?? Date.now)()).toISOString();
+  const path = runlistPath(opts.home);
+  mkdirSync(runlistHome(opts.home), { recursive: true, mode: 0o700 });
+  appendFileSync(path, `${JSON.stringify({ runid, type: 'needs-removed', at })}\n`);
+  try { chmodSync(path, 0o600); } catch { /* best-effort perms */ }
+  return at;
+}
+
+/**
+ * The newest `needs-removed` time (ms) per run id. An absent file is an empty map; a row with no readable time is not a removal.
+ * @param {{ home?: string }} [opts]
+ * @returns {Map<string, number>}
+ */
+export function readNeedsRemovals(opts = {}) {
+  /** @type {Map<string, number>} */
+  const out = new Map();
+  const path = runlistPath(opts.home);
+  if (!existsSync(path)) return out;
+  for (const r of parseJsonl(path).records) {
+    if (!r || r.type !== 'needs-removed' || typeof r.runid !== 'string') continue;
+    const t = typeof r.at === 'string' ? Date.parse(r.at) : NaN;
+    if (Number.isFinite(t) && t >= (out.get(r.runid) ?? -Infinity)) out.set(r.runid, t);
+  }
+  return out;
+}
+
 /**
  * @typedef {{ type: 'leg-start', runid: string, leg: number, pid?: number, capUsd?: number, at: string }} LegStart
  * A resumed run's NEW claim (P5-R, hamr 2026-10-02: one run, one id, one row): appended beside the run's row

package/src/schedulewords.js

@@ -0,0 +1,296 @@
+// T Part 3 (PANEL-BUILD.md T addendum, C.3 / C.6): the WORDS of a schedule. ONE owner of these strings. Pure
+// functions: typed facts in, a fixed sentence out. No model text ever reaches a sentence (the only slot-fills are
+// numbers, a file or folder name and the person's own path). `home` is injected (never a default inside a test).
+// Rewritten from fwdloop src/summary-words.js (`scheduledWords`, `slotWords`, `nextTimeWords`, `nextInWords`,
+// `scheduledNextFor`, `catchUpWords`), minus `endedWords` and every ask (bareloop has neither:
+// its ENDED block is `endedFor` in src/panel/server.js).
+import { basename } from 'node:path';
+import { panelMoney2 } from './panel/authorroutes.js';
+
+/** @typedef {import('./trigger.js').Trigger} Trigger */
+
+const DAY_PLURAL = { mon: 'Mondays', tue: 'Tuesdays', wed: 'Wednesdays', thu: 'Thursdays', fri: 'Fridays', sat: 'Saturdays', sun: 'Sundays' };
+const DAY_SHORT = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+const MONTH_SHORT = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+
+/** @param {number} n */
+const two = (n) => String(n).padStart(2, '0');
+/** @param {{hour: number, minute: number}} s */
+const hhmm = (s) => `${two(s.hour)}:${two(s.minute)}`;
+
+/** A path with the home folder shown as `~`. @param {string} p @param {string|undefined} home */
+function tilde(p, home) {
+  if (home && (p === home || p.startsWith(`${home}/`))) return `~${p.slice(home.length)}`;
+  return p;
+}
+
+/**
+ * Every schedule button/word the page shows lives here, so a reword is ONE edit (hamr will reword on his walk).
+ * The server sends this table with the run detail and the schedule card; the page reads every label from it.
+ */
+export const SCHEDULE_WORDS = Object.freeze({
+  byHand: 'By hand',
+  cancelSchedule: 'Cancel schedule',
+  cancelWords: 'Cancel schedule',
+  // the Run tab's buttons (never relabelled in place: a different state is a different button)
+  scheduleRun: 'Schedule run',
+  cancelModify: 'Cancel / modify schedule',
+  // the one main button of the schedule card
+  signSchedule: 'Sign schedule',
+  nothingChanged: 'Nothing changed yet. This card only sets or adjusts the schedule; it never runs the job.',
+  confirmPrefix: 'Confirm: ',
+  // the When field and the blocks
+  whenLabel: 'When',
+  nowPrefix: 'Now: ',
+  scheduledLabel: 'SCHEDULE',
+  nextLabel: 'NEXT',
+  options: Object.freeze({
+    hand: 'By hand',
+    daily: 'Every day at HH:MM',
+    weekdays: 'Weekdays at HH:MM',
+    weekly: 'Every <day> at HH:MM',
+    'file-updated': 'When <file> is updated',
+    'new-file': 'When a new file arrives in <folder>',
+  }),
+  // RULED 2026-10-15: the Needs-you pill of a schedule that gave up (hamr may reword)
+  gaveUpPill: 'Check',
+  // RULED 2026-10-15 (aligned with fwdloop M9 am7): the SCHEDULE row's second line when the last fire started nothing
+  problemNext: 'next: fix it in Cancel / modify schedule',
+  monthNext: 'next: raise the limit in Settings, or it starts on the 1st',
+  acceptWaiting: 'waiting for your Accept (the next run does not wait)',
+  scheduleGroup: 'schedule',
+  notGreen: 'This job has not had a good run yet. Run it by hand and get it right first; then you can set when it runs. A rubric job also needs your Accept once. Nothing was changed.',
+  stale: 'What you were shown is not what is on the card now. Nothing was signed. Look again, then sign.',
+});
+
+/**
+ * What starts the job, in words. `null` (by hand) has no sentence.
+ * @param {Trigger|null|undefined} t @param {string} [home]
+ * @returns {string|null}
+ */
+export function scheduledWords(t, home) {
+  if (!t) return null;
+  if (t.kind === 'daily') return `Every day at ${hhmm(t)}`;
+  if (t.kind === 'weekdays') return `Weekdays at ${hhmm(t)}`;
+  if (t.kind === 'weekly') return `${DAY_PLURAL[/** @type {keyof typeof DAY_PLURAL} */ (t.day)] ?? t.day} at ${hhmm(t)}`;
+  if (t.kind === 'file-updated') return `When ${basename(t.path)} is updated`;
+  const folder = tilde(/** @type {{folder: string}} */ (t).folder, home);
+  return `When a new file arrives in ${folder.endsWith('/') ? folder : `${folder}/`}`;
+}
+
+/** "Mon 13 Oct, 09:00" — local time, fixed English names (never the machine's locale). @param {number} ms */
+export function slotWords(ms) {
+  const d = new Date(ms);
+  return `${DAY_SHORT[d.getDay()]} ${d.getDate()} ${MONTH_SHORT[d.getMonth()]}, ${two(d.getHours())}:${two(d.getMinutes())}`;
+}
+
+/**
+ * The Scheduled card's first line: "today 17:00", "tomorrow 09:00", else the date the NEXT line already says
+ * ("Tue 20 Oct, 09:05"). Local time, by calendar day. @param {number} ms the next run @param {number} now
+ */
+export function nextTimeWords(ms, now) {
+  const d = new Date(ms);
+  const day = (/** @type {Date} */ x) => new Date(x.getFullYear(), x.getMonth(), x.getDate()).getTime();
+  const apart = Math.round((day(d) - day(new Date(now))) / 86_400_000);
+  if (apart === 0) return `today ${two(d.getHours())}:${two(d.getMinutes())}`;
+  if (apart === 1) return `tomorrow ${two(d.getHours())}:${two(d.getMinutes())}`;
+  return slotWords(ms);
+}
+
+/** "next in 20m" / "next in 3h" / "next in 3d" (whole units, rounded down, never "0m"). @param {number} ms @param {number} now */
+export function nextInWords(ms, now) {
+  const mins = Math.max(1, Math.floor((ms - now) / 60_000));
+  if (mins < 60) return `next in ${mins}m`;
+  const hours = Math.floor(mins / 60);
+  return hours < 48 ? `next in ${hours}h` : `next in ${Math.floor(hours / 24)}d`;
+}
+
+/**
+ * NEXT of a scheduled job: one sentence, first match wins.
+ *  1. a run of this job is waiting for the person's Accept (the next scheduled run does NOT wait for it, T7);
+ *  2. the latest outcome this month is `monthly-exhausted` (amounts from the row), RED;
+ *  3. a clock kind with a next slot; 4. a file kind that is armed; 5. not armed yet.
+ * A last outcome of `refused` goes in front of 3-5, so a trigger that cannot start is never silent.
+ * `red` is the typed flag for "the person must act": the page paints it and never guesses from the text.
+ * @param {{trigger: Trigger, armed: boolean, nextSlotMs: number|null, lastOutcome: any, waitingRunNo: number|null, now: number, retryInMs?: number|null, gaveUp?: any}} f
+ *   `lastOutcome` = the newest outcome row of the CURRENT signing (`kind`, `at` in ms, `why`, `leftUsd`, `needUsd`, `atLeast`)
+ * @returns {{text: string, red: boolean}}
+ */
+export function scheduledNextFor(f) {
+  const { trigger, armed, nextSlotMs, lastOutcome, waitingRunNo, now, retryInMs = null, gaveUp = null } = f;
+  /** @param {string} text @param {boolean} [red] */
+  const say = (text, red = false) => ({ text, red });
+  if (waitingRunNo !== null) return say(`Run ${waitingRunNo} is waiting for your Accept. The next scheduled run does not wait for it.`);
+  if (gaveUp && typeof gaveUp === 'object') return say(gaveUpNextWords(gaveUp.why), true);
+  const last = lastOutcome && typeof lastOutcome === 'object' ? lastOutcome : null;
+  const sameMonth = last !== null && sameMonthAs(last.at, now);
+  if (last !== null && last.kind === 'monthly-exhausted' && sameMonth && typeof last.leftUsd === 'number' && typeof last.needUsd === 'number') {
+    const left = last.atLeast === true ? `at most ${panelMoney2(last.leftUsd)} left` : `${panelMoney2(last.leftUsd)} left`;
+    return say(`Paused: not enough money left this month (${left}, a run needs up to ${panelMoney2(last.needUsd)}). Raise the monthly limit in Settings, or it starts again on the 1st.`, true);
+  }
+  const lead = last !== null && last.kind === 'refused' && typeof last.why === 'string' && last.why !== '' ? `The last try did not start: ${last.why} ${retryWords(retryInMs)}` : '';
+  const red = lead !== '';
+  if (!armed) return say(`${lead}Not armed yet: the panel arms it on its next check.`, red);
+  if (trigger.kind === 'file-updated') return say(`${lead}Watching for it. A run starts when its contents change.`, red);
+  if (trigger.kind === 'new-file') return say(`${lead}Watching for it. A run starts for each new file.`, red);
+  if (nextSlotMs === null) return say(`${lead}Not armed yet: the panel arms it on its next check.`, red);
+  return say(`${lead}Next run ${slotWords(nextSlotMs)}.`, red);
+}
+
+/** Is `atMs` in the same local calendar month as `nowMs`? A non-number is never. @param {unknown} atMs @param {number} nowMs */
+export function sameMonthAs(atMs, nowMs) {
+  if (typeof atMs !== 'number' || !Number.isFinite(atMs)) return false;
+  const a = new Date(atMs); const n = new Date(nowMs);
+  return a.getFullYear() === n.getFullYear() && a.getMonth() === n.getMonth();
+}
+
+/** RULED 2026-10-15: the red NEXT of a schedule that gave up. @param {unknown} why the refusal's own words */
+export function gaveUpNextWords(why) {
+  const w = typeof why === 'string' ? why.trim().replace(/\.$/, '') : '';
+  return `Stopped trying after 60 minutes: ${w}. Fix it, then Cancel / modify schedule to start again.`;
+}
+
+/** The give-up date on the Needs-you card, local `MM/DD HH:MM`. @param {number} ms */
+export function gaveUpDateWords(ms) {
+  const d = new Date(ms);
+  return `${two(d.getMonth() + 1)}/${two(d.getDate())} ${two(d.getHours())}:${two(d.getMinutes())}`;
+}
+
+/** RULED 2026-10-15: after an install-needed refusal, the wait that is left, in whole minutes rounded up; '' when no wait. @param {number|null|undefined} ms */
+export function retryWords(ms) {
+  if (typeof ms !== 'number' || !(ms > 0)) return '';
+  const m = Math.ceil(ms / 60_000);
+  return `Trying again in ${m} minute${m === 1 ? '' : 's'}. `;
+}
+
+/** The fixed catch-up sentence from a run's `trigger.json`. @param {any} rec */
+export function catchUpWords(rec) {
+  return rec && typeof rec === 'object' && rec.catchUp === true ? 'This run was a catch-up: it started more than 2 minutes after its set time (the panel was off).' : null;
+}
+
+/**
+ * A spawn error AFTER the consuming row: `tries` releases so far, `max` the bound. Under the bound it will be tried again;
+ * at the bound it stays consumed and says so. @param {string} why @param {number} tries @param {number} max
+ */
+export function lateRefusalWords(why, tries, max) {
+  return tries < max ? `${why} It will be tried again.` : `${why} It was tried ${max} times and is given up on.`;
+}
+
+// ---------------------------------------------------------------------------------------------------------------------------
+// RULED 2026-10-15 (aligned with fwdloop M9 am7): the schedule on the Run, Job and Audit tabs. ONE owner of these sentences.
+
+/** "10/15 13:40" — local time. @param {number} ms */
+export const dateTimeWords = (ms) => gaveUpDateWords(ms);
+
+/** @param {string} s */
+export const lowerFirst = (s) => (s === '' ? s : s[0].toLowerCase() + s.slice(1));
+
+/** "Thu 10/16 08:15" — local time, fixed English day names. @param {number} ms */
+export function nextSlotShort(ms) {
+  const d = new Date(ms);
+  return `${DAY_SHORT[d.getDay()]} ${two(d.getMonth() + 1)}/${two(d.getDate())} ${two(d.getHours())}:${two(d.getMinutes())}`;
+}
+
+/** @param {any} rec a run's `trigger.json` @returns {boolean} */
+function isNewFile(rec) {
+  if (rec.triggerKind) return rec.triggerKind === 'new-file';
+  return typeof rec.trigger === 'string' && rec.trigger.startsWith('When a new file arrives');
+}
+
+/**
+ * Job tab, "Started": how the run began, then its local start time. `rec` = the run's `trigger.json` (null on a hand run).
+ * @param {any} rec @param {number|null} atMs the run's start
+ */
+export function startedWords(rec, atMs) {
+  const when = atMs === null ? '' : ` · ${dateTimeWords(atMs)}`;
+  if (!rec || typeof rec !== 'object') return `${SCHEDULE_WORDS.byHand}${when}`;
+  const trig = typeof rec.trigger === 'string' ? rec.trigger : '';
+  let how;
+  if (rec.kind === 'file') {
+    const name = basename(String(rec.file ?? ''));
+    how = isNewFile(rec) ? `By a new file: ${name}` : `By a file update: ${name}`;
+  } else {
+    how = `By the schedule: ${lowerFirst(trig)}`;
+    if (rec.catchUp === true) {
+      const min = typeof rec.lateMs === 'number' && rec.lateMs > 0 ? Math.round(rec.lateMs / 60_000) : null;
+      how += min === null ? ' · catch-up' : ` · catch-up, ${min} min late`;
+    }
+  }
+  return `${how}${when}`;
+}
+
+/**
+ * Audit, first row of a run a schedule started. @param {any} rec `trigger.json` @param {number|null} originNo the origin run's number
+ */
+export function startedAuditWords(rec, originNo) {
+  const from = originNo === null ? '' : ` · from run-${originNo}`;
+  if (rec.kind === 'file') return `started by the schedule · ${isNewFile(rec) ? 'new file' : 'file update'} ${basename(String(rec.file ?? ''))}${from}`;
+  const slot = typeof rec.slot === 'number' ? ` · slot ${two(new Date(rec.slot).getHours())}:${two(new Date(rec.slot).getMinutes())}` : '';
+  return `started by the schedule · ${lowerFirst(String(rec.trigger ?? ''))}${slot}${from}${rec.catchUp === true ? ' · catch-up' : ''}`;
+}
+
+/** a refusal's own words without its trailing "Nothing started." @param {unknown} why */
+function reasonOf(why) {
+  return String(why ?? '').replace(/\s*Nothing (started|spent)\.\s*$/, '').trim().replace(/\.$/, '');
+}
+
+/**
+ * A fire that started nothing, in plain words. `short` = the SCHEDULE row's `last` reason; else the Audit group's line.
+ * @param {any} row a ledger row (`busy` | `monthly-exhausted` | `refused` | `gave-up`) @param {boolean} [short]
+ */
+export function skippedWords(row, short = false) {
+  if (row.kind === 'busy') return short ? 'busy: a run of this job was still working' : 'busy: a run of this job was still working. Nothing started.';
+  if (row.kind === 'monthly-exhausted') {
+    const left = typeof row.leftUsd === 'number' ? `${row.atLeast === true ? 'at most ' : ''}${panelMoney2(row.leftUsd)}` : 'little';
+    const need = typeof row.needUsd === 'number' ? panelMoney2(row.needUsd) : 'more';
+    return short ? `month used up: ${left} left, needs ${need}` : `month used up: ${left} left, needs ${need}. Nothing spent.`;
+  }
+  const r = lowerFirst(reasonOf(row.why));
+  return short ? `refused: ${r}` : `refused: ${r}. Nothing started.`;
+}
+
+/**
+ * Job tab, "Schedule": the job's schedule NOW and what it is bound to. The first part IS the Run tab's line ({@link scheduledWords}),
+ * first letter lowered, so the two can never disagree.
+ * @param {{trigger: Trigger|null, originNo: number|null, model: string|null, destination: string|null, home?: string}} f
+ */
+export function jobScheduleWords(f) {
+  const w = f.trigger ? scheduledWords(f.trigger, f.home) : null;
+  if (w === null) return 'none';
+  const parts = [lowerFirst(w)];
+  if (f.originNo !== null) parts.push(`from run-${f.originNo}`);
+  if (f.model) parts.push(f.model);
+  if (f.destination) parts.push(tilde(f.destination, f.home));
+  return parts.join(' · ');
+}
+
+/** RULED 2026-10-15: the SCHEDULE row's `next` while an install-needed refusal is waiting to be tried again. @param {number} ms */
+export function retryNextWords(ms) {
+  const m = Math.max(1, Math.ceil(ms / 60_000));
+  return `next: tries again in ${m} min`;
+}
+
+/**
+ * RULED 2026-10-15: the sign on the head of the Audit's `schedule` section. ONE small rule (hamr may still adjust it): [▶] only while a
+ * run of the job is running (as everywhere in the panel), [✗] when the SCHEDULE row is red, else [·] (on, waiting).
+ * @param {{running: boolean, red: boolean}} f @returns {{sign: string}}
+ */
+export function scheduleSignFor(f) {
+  return { sign: f.running ? '▶' : f.red ? '✗' : '·' };
+}
+
+/** Audit schedule section, the `this run` words of a run the schedule started (the head already says which schedule and from where). @param {any} rec `trigger.json` */
+export function sectionThisRunWords(rec) {
+  if (rec.kind === 'file') return `started by the schedule · ${isNewFile(rec) ? 'new file' : 'file update'} ${basename(String(rec.file ?? ''))}`;
+  let late = '';
+  if (rec.catchUp === true) {
+    const min = typeof rec.lateMs === 'number' && rec.lateMs > 0 ? Math.round(rec.lateMs / 60_000) : null;
+    late = min === null ? ' · catch-up' : ` · catch-up, ${min} min late`;
+  }
+  return `started by the schedule · ${lowerFirst(String(rec.trigger ?? ''))}${late}`;
+}
+
+/** Audit schedule section, folded tail: `1 try started nothing` / `N tries started nothing`; '' for none. @param {number} n */
+export function triesTailWords(n) {
+  return n > 0 ? `${n} ${n === 1 ? 'try' : 'tries'} started nothing` : '';
+}

package/src/source.js

@@ -23,14 +23,16 @@
 // on rather than catch.
 
 import { createHash } from 'node:crypto';
+import { tmpdir } from 'node:os';
 import { existsSync, lstatSync, readFileSync } from 'node:fs';
-import { mkdir, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
+import { mkdir, mkdtemp, readdir, readFile, writeFile, lstat, stat, chmod, access, copyFile, cp, open, rm, realpath, readlink, symlink, constants as fsConstants } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep, basename, isAbsolute } from 'node:path';
 import { git } from './kinds.js';
 import { addWorktree, hideBareloopDir } from './worktree.js';
 import { MAX_BUFFER } from './kinds.js';
 import { PROVIDER_TIMEOUT_MS } from './clock.js';
 import { scanSecrets, SECRET_PATTERNS, SECRET_PATTERN_NAMES } from './validate.js';
+import { fetchPageText, isWebUrl } from './pagefetch.js';
 
 /** @typedef {{stop: string, code: string}} SourceRefusal a named, non-throwing stop */
 
@@ -1223,3 +1225,166 @@ export async function proveInputFiles(inputs) {
   }
   return { ok: true, repo, root };
 }
+
+/** the per-file ceiling for a rubric input: bareguard's `cited` check searches a quote in a source only up to this size
+ * (its `quoteSourceMaxBytes`); a bigger file could never be cited from, so the door refuses it at $0 */
+export const RUBRIC_INPUT_MAX_BYTES = 5 * 1024 * 1024;
+
+/**
+ * Does this source manifest belong to a rubric job on local files (`proveRubricInputs` wrote it)? One spelling for both
+ * doors (the panel session and the CLI author run): a non-repo source that froze numbered, labelled input files.
+ * @param {Record<string, any>|null|undefined} manifest
+ * @returns {boolean}
+ */
+export function isRubricFilesManifest(manifest) {
+  return !!manifest && manifest.kind !== 'repo' && Array.isArray(manifest.inputs) && manifest.inputs.length > 0;
+}
+
+/**
+ * PART 1a (docs/product/ITEM33-BUILD.md, "Addendum 2026-10-12"): the front door for a RUBRIC job whose inputs are the
+ * person's own LOCAL FILES, not a repo. Each numbered `label: /absolute/file` line is proven at $0 and frozen into the
+ * same hidden-git tree a plain folder gets (`prepareSource`, which also refuses a secret shape, an environment file
+ * and a symlink), under `input/`; the manifest then also records `inputs: [{label, rel, sha256}]` — the bytes the
+ * rubric's `cited` check will search a quote in, hashed once, here. A line that is a web address is fetched ONCE with
+ * barebrowse (PART 1c, read only) and its text frozen under `input/` like a file (the manifest row also records its `url`,
+ * so run start can fetch it again); a `search:` line is a named refusal (a later build); so is a relative path, a missing file, a folder, a file over
+ * {@link RUBRIC_INPUT_MAX_BYTES}, and text that is not valid UTF-8. Every refusal is plain words naming the line and
+ * ends "Nothing spent." — nothing here touches a model.
+ * @param {{inputs: {n: number, label: string, value: string}[], into: string, destination?: string, fetchUrl?: (url: string) => Promise<{ok: true, text: string, url: string}|{ok: false, error: string}>}} o `fetchUrl` - how a web address is read (default barebrowse via `fetchPageText`; a test injects a stub, never the network)
+ * @returns {Promise<{ok: true, prep: {stop: null, into: string, tree: string, manifestPath: string, manifest: Record<string, any>}}|{ok: false, error: string, code: string}>}
+ */
+export async function proveRubricInputs({ inputs, into, destination, fetchUrl = (u) => fetchPageText(u) }) {
+  /** @param {string} code @param {number} n @param {string} msg @returns {{ok: false, error: string, code: string}} */
+  const bad = (code, n, msg) => ({ ok: false, code, error: `line ${n}: ${msg} Nothing spent.` });
+  if (!Array.isArray(inputs) || inputs.length === 0) return { ok: false, code: 'inputs-missing', error: 'Inputs is required. Nothing spent.' };
+  /** @type {Set<string>} */
+  const labels = new Set();
+  /** @type {{label: string, name: string, buf: Buffer, url?: string}[]} */
+  const staged = [];
+  /** @type {Set<string>} */
+  const names = new Set();
+  const utf8 = new TextDecoder('utf-8', { fatal: true });
+  for (const inp of inputs) {
+    const { n, label, value } = inp;
+    if (/^search$/i.test(label) || (/^[a-z][a-z0-9+.-]*:\/\//i.test(value) && !isWebUrl(value))) {
+      return bad('web-input', n, 'a search, or an address that is not http or https, is not an input yet.');
+    }
+    if (labels.has(label.toLowerCase())) return bad('label-repeat', n, `the label "${label}" is already used by an earlier line.`);
+    labels.add(label.toLowerCase());
+    if (isWebUrl(value)) {
+      const got = await fetchUrl(value.trim());
+      if (!got.ok) return bad('input-url-unreadable', n, `${got.error.replace(/[.\s]+$/, '')}.`);
+      const pageBuf = Buffer.from(got.text, 'utf8');
+      const leak = secretPatternNames(got.text);
+      if (leak.length) return bad('input-url-secret', n, `the page at ${got.url} carries a known secret shape (${leak.join(', ')}) - refused, secrets never enter a job.`);
+      const stem = label.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'page';
+      const pageName = names.has(`${stem}.txt`) ? `${n}-${stem}.txt` : `${stem}.txt`;
+      names.add(pageName);
+      staged.push({ label, name: pageName, buf: pageBuf, url: got.url });
+      continue;
+    }
+    if (!isAbsolute(value)) return bad('input-not-absolute', n, `${value} must be the full path of a file, like /home/me/notes.md.`);
+    const abs = resolve(value);
+    let ls;
+    try { ls = await lstat(abs); } catch { return bad('input-missing', n, `${abs} does not exist.`); }
+    if (ls.isSymbolicLink()) return bad('input-symlink', n, `${abs} is a symlink — refused, never followed.`);
+    if (!ls.isFile()) return bad('input-not-file', n, `${abs} is not a file — each input line is one file.`);
+    const base = basename(abs);
+    if (ENV_FILE.test(base)) return bad('input-env-file', n, `${abs} is an environment file — refused by name, whatever it contains.`);
+    if (ls.size > RUBRIC_INPUT_MAX_BYTES) return bad('input-oversize', n, `${abs} is over the ${RUBRIC_INPUT_MAX_BYTES / (1024 * 1024)} MiB limit for a quoted input.`);
+    const buf = await readFile(abs);
+    try { utf8.decode(buf); } catch { return bad('input-not-utf8', n, `${abs} is not UTF-8 text — text files only for now.`); }
+    if (hasNulByte(buf)) return bad('input-not-text', n, `${abs} is not a text file — text files only for now.`);
+    // two files with one name keep the line number in front, so neither overwrites the other under input/
+    const name = names.has(base) ? `${n}-${base}` : base;
+    names.add(name);
+    staged.push({ label, name, buf });
+  }
+  const stage = await mkdtemp(join(tmpdir(), 'bareloop-rubric-inputs-'));
+  try {
+    for (const f of staged) await writeFile(join(stage, f.name), f.buf);
+    const prep = await prepareSource({ source: stage, into, ...(destination === undefined ? {} : { destination }) });
+    if (prep.stop !== null) return { ok: false, code: prep.code, error: prep.stop };
+    // `source` names the person's own first file, never the scratch staging folder that was already removed
+    const manifest = {
+      ...prep.manifest,
+      source: isWebUrl(inputs[0].value) ? inputs[0].value.trim() : resolve(inputs[0].value),
+      inputs: staged.map((f) => ({ label: f.label, rel: `input/${f.name}`, sha256: sha256Hex(f.buf), ...(f.url === undefined ? {} : { url: f.url }) })),
+    };
+    await writeFile(prep.manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    return { ok: true, prep: { ...prep, manifest } };
+  } finally {
+    await rm(stage, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Is this Inputs value a path to an existing regular FILE on this machine (not a repo folder, not a web address, not a
+ * missing path)? The $0 peek that tells a rubric job on local files from a rubric job on a repo before a session exists;
+ * `proveRubricInputs` makes the authoritative, line-by-line proof.
+ * @param {string} value
+ * @returns {boolean}
+ */
+export function looksLikeLocalFile(value) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value) || !isAbsolute(value)) return false;
+  try { return lstatSync(resolve(value)).isFile(); } catch { return false; }
+}
+
+/**
+ * Is this Inputs value one a rubric job can work on without a repo: a regular FILE on this machine, or a web address (PART 1c)?
+ * @param {string} value
+ * @returns {boolean}
+ */
+export function looksLikeRubricInput(value) {
+  return isWebUrl(value) || looksLikeLocalFile(value);
+}
+
+/**
+ * RUN START for a rubric job with web inputs (PART 1c, RF22): fetch every web input AGAIN and make that text the run's frozen input
+ * BEFORE the worker starts. The drafting copy was only for the look (prices change); the close grades, and the worker reads, THIS
+ * copy. It is written into the prepared tree, committed as the new seed (so the page is never read as a worker write), and
+ * `source.json` is rewritten (new sha256 per input, new seed, `draftSha256` keeps what the look saw). Nothing but the text of a
+ * recorded web address is ever refetched; a job with only file inputs returns at once and changes nothing.
+ * @param {{into: string, fetchUrl?: (url: string) => Promise<{ok: true, text: string, url: string}|{ok: false, error: string}>}} o `into` - the prepared copy (source.json + tree/)
+ * @returns {Promise<{ok: true, refreshed: string[], seed: string|null}|{ok: false, error: string}>}
+ */
+export async function refreezeUrlInputs({ into, fetchUrl = (u) => fetchPageText(u) }) {
+  const read = await readSourceManifest(into);
+  if (read.stop !== null) return { ok: false, error: read.stop };
+  if (!read.present || !read.manifest) return { ok: true, refreshed: [], seed: null };
+  const manifest = read.manifest;
+  const rows = Array.isArray(manifest.inputs) ? manifest.inputs.filter((/** @type {any} */ r) => r && typeof r.url === 'string' && r.url !== '') : [];
+  if (rows.length === 0) return { ok: true, refreshed: [], seed: null };
+  const tree = join(resolve(into), 'tree');
+  /** @type {{row: any, buf: Buffer}[]} */
+  const fresh = [];
+  for (const row of rows) {
+    const got = await fetchUrl(row.url);
+    if (!got.ok) return { ok: false, error: `Input "${row.label}": ${got.error}. The run did not start. Nothing spent.` };
+    const leak = secretPatternNames(got.text);
+    if (leak.length) return { ok: false, error: `Input "${row.label}": the page at ${got.url} carries a known secret shape (${leak.join(', ')}) - refused, secrets never enter a job. The run did not start. Nothing spent.` };
+    fresh.push({ row, buf: Buffer.from(got.text, 'utf8') });
+  }
+  for (const f of fresh) await writeFile(join(tree, f.row.rel), f.buf);
+  const add = await git(tree, [...NO_HOOKS, 'add', '-A', '-f']);
+  if (!add.ok) return { ok: false, error: `the fresh page copy could not be staged: ${add.err}. The run did not start. Nothing spent.` };
+  const commit = await git(tree, [...GIT_IDENTITY, ...NO_HOOKS, 'commit', '-q', '--allow-empty', '-m', 'bareloop: run start - fresh copy of the web inputs']);
+  if (!commit.ok) return { ok: false, error: `the fresh page copy could not be committed: ${commit.err}. The run did not start. Nothing spent.` };
+  const head = await git(tree, ['rev-parse', 'HEAD']);
+  if (!head.ok) return { ok: false, error: `git rev-parse HEAD failed in ${tree}: ${head.err}. The run did not start. Nothing spent.` };
+  const seed = head.out.trim();
+  const byLabel = new Map(fresh.map((f) => [f.row.label, f.buf]));
+  const inputs = manifest.inputs.map((/** @type {any} */ r) => {
+    const buf = byLabel.get(r.label);
+    return buf === undefined || typeof r.url !== 'string' ? r : { ...r, draftSha256: r.draftSha256 ?? r.sha256, sha256: sha256Hex(buf) };
+  });
+  const files = Array.isArray(manifest.files) ? manifest.files.map((/** @type {any} */ m) => {
+    const hit = inputs.find((/** @type {any} */ r) => typeof r.url === 'string' && r.rel === `input/${m.path}`);
+    if (!hit) return m;
+    const buf = byLabel.get(hit.label);
+    return buf === undefined ? m : { ...m, bytes: buf.length, sha256: sha256Hex(buf) };
+  }) : manifest.files;
+  const next = { ...manifest, inputs, files, seed, refrozenAt: new Date().toISOString() };
+  await writeFile(join(resolve(into), 'source.json'), `${JSON.stringify(next, null, 2)}\n`);
+  return { ok: true, refreshed: rows.map((/** @type {any} */ r) => r.label), seed };
+}

package/src/trigger.js

@@ -0,0 +1,48 @@
+// T Part 3 (docs/product/PANEL-BUILD.md, "T: triggers build spec", C.3): the `trigger` field of a signed spec,
+// as typed data. Pure. Never cron text, never a model's word: the agent does not write this field (assembleSpec
+// refuses a draft carrying it) and the interview never does either. By hand = the key is ABSENT (never null),
+// so a by-hand spec hashes exactly as it did before triggers existed.
+//   {kind:'daily'|'weekdays', hour, minute}
+//   {kind:'weekly', day:'mon'..'sun', hour, minute}
+//   {kind:'new-file', folder}        absolute path
+//   {kind:'file-updated', path}      absolute path
+// Rewritten from fwdloop src/trigger-line.js (its prose-line grammar is replaced: the signed thing is the JSON spec).
+import { isAbsolute } from 'node:path';
+import { validateSchedule } from './triggerclock.js';
+
+/** @typedef {import('./triggerclock.js').Schedule | {kind:'new-file', folder:string} | {kind:'file-updated', path:string}} Trigger */
+
+export const TRIGGER_KINDS = Object.freeze(['daily', 'weekdays', 'weekly', 'new-file', 'file-updated']);
+export const CLOCK_KINDS = Object.freeze(['daily', 'weekdays', 'weekly']);
+export const FILE_KINDS = Object.freeze(['new-file', 'file-updated']);
+
+/** @param {unknown} t @returns {t is {kind:'daily'|'weekdays'|'weekly', hour:number, minute:number}} */
+export const isClockTrigger = (t) => !!t && typeof t === 'object' && CLOCK_KINDS.includes(/** @type {any} */ (t).kind);
+/** @param {unknown} t @returns {t is {kind:'new-file', folder:string} | {kind:'file-updated', path:string}} */
+export const isFileTrigger = (t) => !!t && typeof t === 'object' && FILE_KINDS.includes(/** @type {any} */ (t).kind);
+
+/**
+ * The only way a trigger enters the system. Returns the typed trigger, or says what to fix (and which field).
+ * @param {unknown} t
+ * @returns {{ok: true, trigger: Trigger} | {ok: false, say: string, code: 'invalid-value'|'unknown-field', path: string}}
+ */
+export function validateTrigger(t) {
+  /** @param {string} say @param {string} [path] @param {'invalid-value'|'unknown-field'} [code] */
+  const no = (say, path = 'trigger', code = 'invalid-value') => ({ ok: /** @type {const} */ (false), say, code, path });
+  if (!t || typeof t !== 'object' || Array.isArray(t)) return no('a trigger is an object like {kind, hour, minute}, not text');
+  const o = /** @type {Record<string, unknown>} */ (t);
+  if (!TRIGGER_KINDS.includes(/** @type {string} */ (o.kind))) return no(`trigger kind "${o.kind}" is not one of ${TRIGGER_KINDS.join(', ')}`, 'trigger.kind');
+  if (CLOCK_KINDS.includes(/** @type {string} */ (o.kind))) {
+    const allowed = o.kind === 'weekly' ? ['kind', 'day', 'hour', 'minute'] : ['kind', 'hour', 'minute'];
+    const extra = Object.keys(o).find((k) => !allowed.includes(k));
+    if (extra !== undefined) return no(`trigger field "${extra}" is not allowed on a ${o.kind} trigger`, `trigger.${extra}`, 'unknown-field');
+    try { return { ok: true, trigger: validateSchedule(o) }; } catch (e) { return no(/** @type {Error} */ (e).message.replace(/^schedule/, 'trigger')); }
+  }
+  const where = o.kind === 'new-file' ? 'folder' : 'path';
+  const extra = Object.keys(o).find((k) => k !== 'kind' && k !== where);
+  if (extra !== undefined) return no(`trigger field "${extra}" is not allowed on a ${o.kind} trigger (it takes a ${where})`, `trigger.${extra}`, 'unknown-field');
+  const p = o[where];
+  // eslint-disable-next-line no-control-regex
+  if (typeof p !== 'string' || p === '' || !isAbsolute(p) || /[\x00-\x1f\x7f]/.test(p)) return no(`the ${where} must be a full path on one line, like /home/you/inbox`, `trigger.${where}`);
+  return { ok: true, trigger: /** @type {Trigger} */ (o.kind === 'new-file' ? { kind: 'new-file', folder: p } : { kind: 'file-updated', path: p }) };
+}