bareloop 0.41.0 → 0.43.0

package/src/triggerclock.js

@@ -0,0 +1,127 @@
+// T Part 1 (docs/product/PANEL-BUILD.md, "T: triggers build spec", C.1): the clock trigger's schedule maths.
+// Rewritten from fwdloop src/trigger-clock.js (its readRows/appendOnce are replaced by triggerledger.js).
+//
+// A schedule is a typed object, never cron text:
+//   { kind:'daily'|'weekdays', hour, minute } | { kind:'weekly', day:'mon'|..., hour, minute }
+// Times are LOCAL. One slot per calendar day at most (built with the local Date constructor), so a DST
+// change day can neither lose nor double a slot: a 02:30 that does not exist shifts to 03:30, one that
+// happens twice is the first. Missed slots (panel off or machine asleep) collapse to ONE catch-up.
+//
+// Rows (in the job's ledger.jsonl, every row carrying `sig`):
+//   { id:'armed:<ms>', kind:'armed', at }                          the trigger was set: the starting point
+//   { id:'fire:<slotMs>', kind:'fire', slot, at, catchUp, missed } one run is starting for that slot
+// RULED 2026-10-14: `recordFire` is the CONSUMING row; the scheduler's starter calls it only after busy,
+// monthly and wouldAccept have all said yes, so a refused or busy slot stays due and retries.
+import { appendRow, withoutReleased } from './triggerledger.js';
+
+/** @typedef {{kind:'daily'|'weekdays', hour:number, minute:number} | {kind:'weekly', day:string, hour:number, minute:number}} Schedule */
+/** @typedef {import('./triggerledger.js').LedgerRow} ClockRow */
+/** @typedef {{fire:boolean, catchUp:boolean, missed:number, slot?:number}} Due */
+
+/** A slot seen MORE than this after its set time is a catch-up. Exactly this late is on time. */
+export const GRACE_MS = 120_000;
+
+export const DAYS = ['sun', 'mon', 'tue', 'wed', 'thu', 'fri', 'sat'];
+
+/**
+ * The only way a clock schedule enters the system. Refuses anything else, naming the field.
+ * @param {unknown} s
+ * @returns {Schedule}
+ */
+export function validateSchedule(s) {
+  if (!s || typeof s !== 'object' || Array.isArray(s)) throw new Error('schedule must be an object like { kind, hour, minute }, not text');
+  const o = /** @type {Record<string, unknown>} */ (s);
+  const kinds = ['daily', 'weekdays', 'weekly'];
+  if (!kinds.includes(/** @type {string} */ (o.kind))) throw new Error(`schedule kind "${o.kind}" is not one of ${kinds.join(', ')}`);
+  const allowed = o.kind === 'weekly' ? ['kind', 'day', 'hour', 'minute'] : ['kind', 'hour', 'minute'];
+  for (const k of Object.keys(o)) if (!allowed.includes(k)) throw new Error(`schedule field "${k}" is not allowed on a ${o.kind} schedule`);
+  const hour = o.hour; const minute = o.minute;
+  if (!Number.isInteger(hour) || /** @type {number} */ (hour) < 0 || /** @type {number} */ (hour) > 23) throw new Error('schedule hour must be a whole number 0-23');
+  if (!Number.isInteger(minute) || /** @type {number} */ (minute) < 0 || /** @type {number} */ (minute) > 59) throw new Error('schedule minute must be a whole number 0-59');
+  if (o.kind === 'weekly') {
+    if (typeof o.day !== 'string' || !DAYS.includes(o.day)) throw new Error(`schedule day must be one of ${DAYS.join(', ')}`);
+    return { kind: 'weekly', day: o.day, hour: /** @type {number} */ (hour), minute: /** @type {number} */ (minute) };
+  }
+  return { kind: /** @type {'daily'|'weekdays'} */ (o.kind), hour: /** @type {number} */ (hour), minute: /** @type {number} */ (minute) };
+}
+
+/**
+ * Slots (epoch ms) in (afterMs, untilMs], oldest first.
+ * @param {Schedule} sc
+ * @param {number} afterMs
+ * @param {number} untilMs
+ * @returns {number[]}
+ */
+function slotsBetween(sc, afterMs, untilMs) {
+  const out = [];
+  const s = new Date(afterMs);
+  for (let i = 0; ; i++) {
+    const d = new Date(s.getFullYear(), s.getMonth(), s.getDate() + i);
+    if (d.getTime() > untilMs) break;
+    const dow = d.getDay();
+    const ok = sc.kind === 'daily'
+      || (sc.kind === 'weekdays' && dow >= 1 && dow <= 5)
+      || (sc.kind === 'weekly' && dow === DAYS.indexOf(/** @type {{day:string}} */ (sc).day));
+    if (!ok) continue;
+    const slot = new Date(d.getFullYear(), d.getMonth(), d.getDate(), sc.hour, sc.minute).getTime();
+    if (slot > afterMs && slot <= untilMs) out.push(slot);
+  }
+  return out;
+}
+
+/**
+ * The starting point: the latest of the arm time(s) and every consumed fire slot. No arm row = null.
+ * @param {ClockRow[]} rows
+ */
+function lastPoint(rows) {
+  let armed = false; let last = -Infinity;
+  for (const r of withoutReleased(rows)) {
+    if (r.kind === 'armed') { armed = true; last = Math.max(last, /** @type {number} */ (r.at)); } else if (r.kind === 'fire') last = Math.max(last, /** @type {number} */ (r.slot));
+  }
+  return armed ? last : null;
+}
+
+/**
+ * Is a run due at `now`? Slots missed (panel off) collapse to ONE fire, for the latest slot, marked catch-up.
+ * Catch-up = more than one slot was missed, or the latest slot is more than GRACE_MS old.
+ * @param {Schedule} schedule
+ * @param {ClockRow[]} rows
+ * @param {number} now epoch ms
+ * @returns {Due}
+ */
+export function due(schedule, rows, now) {
+  const last = lastPoint(rows);
+  if (last === null) return { fire: false, catchUp: false, missed: 0 };
+  const slots = slotsBetween(validateSchedule(schedule), last, now);
+  if (!slots.length) return { fire: false, catchUp: false, missed: 0 };
+  const slot = slots[slots.length - 1];
+  const catchUp = slots.length > 1 || now - slot > GRACE_MS;
+  return { fire: true, catchUp, missed: catchUp ? slots.length : 0, slot };
+}
+
+/**
+ * The next slot time strictly after `afterMs` (epoch ms). Words are the caller's (schedulewords.js).
+ * @param {Schedule} schedule
+ * @param {number} afterMs
+ * @returns {number}
+ */
+export function nextSlot(schedule, afterMs) {
+  const sc = validateSchedule(schedule);
+  // a week plus a day always holds a slot of any kind
+  const found = slotsBetween(sc, afterMs, afterMs + 9 * 86_400_000)[0];
+  return /** @type {number} */ (found);
+}
+
+/** The trigger was set at `now` under signature `sig`: no slot before this ever fires. @param {string} file @param {number} now @param {string} sig */
+export function armTrigger(file, now, sig) {
+  appendRow(file, { id: `armed:${now}`, kind: 'armed', at: now, sig }, { once: true });
+}
+
+/**
+ * Record that the run for this due slot is starting (the consuming row). Write-once per slot.
+ * @param {string} file @param {Due} d the result of `due` with fire true @param {number} now @param {string} sig
+ */
+export function recordFire(file, d, now, sig) {
+  if (!d.fire || d.slot === undefined) throw new Error('recordFire needs a due result with fire true');
+  appendRow(file, { id: `fire:${d.slot}`, kind: 'fire', slot: d.slot, at: now, catchUp: d.catchUp, missed: d.missed, sig }, { once: true });
+}

package/src/triggerfiles.js

@@ -0,0 +1,215 @@
+// T Part 2 (docs/product/PANEL-BUILD.md, "T: triggers build spec", C.2): the file triggers.
+// Rewritten from fwdloop src/trigger-files.js. Poll-based, NOT fs.watch (EMFILE, and it misses atomic renames).
+// This file only says WHAT to run ({path, sha, size}); starting the run, pinning the input and the busy,
+// monthly and wouldAccept checks are the caller's (src/panel/schedules.js `fire`).
+//
+// Modes:   'updated' — one file;   'new' — one folder, top level only, regular files only.
+// Symlinks are refused, checked at use time (realpathSync on the folder, lstat on the file), never lexically.
+// A file is taken only after its size AND mtime were unchanged for STABLE_POLLS consecutive polls.
+//
+// Seen rows live in the job's ONE ledger (triggerledger.js reads and appends; every row carries `sig`):
+//   { id, kind:'baseline'|'arrived'|'ran'|'dropped', sha, name, size, at, sig }  (+ `path` on arrived, `why` and `of` on dropped)
+// 'baseline' = present when the trigger was armed: never runs. 'arrived' = a finished file with a never-seen sha was
+// seen (a 2nd arrival of a dropped sha gets id `arrived:<sha>:<n>`). 'ran' = the CONSUMING row, written by the
+// starter's `beforeSpawn` hook only AFTER busy, monthly and wouldAccept said yes (T16, RULED 2026-10-14): a refused
+// start writes no `ran`, so the file stays at the head of the queue and the next tick tries again. A `released`
+// row (a spawn error after `ran`) cancels the `ran`, and the file is retryable. 'dropped' = deleted or changed
+// before its turn. A sha with a live `ran` row never arrives again, whatever its name or mtime.
+// poll() writes nothing: it only reports finished files whose sha is new.
+import {
+  existsSync, lstatSync, readFileSync, readdirSync, realpathSync,
+} from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { appendRow, readLedger, withoutReleased } from './triggerledger.js';
+
+/** @typedef {{id:string, kind:'baseline'|'arrived'|'ran'|'dropped', sha:string, name:string, size:number, at:number, sig?:string, path?:string, why?:string, of?:string}} SeenRow */
+/** @typedef {{path:string, sha:string, size:number}} ToRun */
+/** @typedef {{path:string, why:string}} Refused */
+
+/** Consecutive polls with the same size and mtime before a file is taken. (Two matches in a row = taken on the third sighting.) */
+export const STABLE_POLLS = 2;
+
+const SEEN_KINDS = ['baseline', 'arrived', 'ran', 'dropped'];
+
+/** The file-kind rows of the job's ledger that still count (a released `ran` does not). @param {string} file @returns {SeenRow[]} */
+export function readSeen(file) {
+  return /** @type {SeenRow[]} */ (withoutReleased(readLedger(file).rows).filter((r) => SEEN_KINDS.includes(r.kind)));
+}
+
+/** The ONE appender here: write-once by live id (a second row with the same id is not written). @param {string} file @param {SeenRow} row @returns {boolean} written */
+function appendSeen(file, row) {
+  if (readSeen(file).some((r) => r.id === row.id)) return false;
+  appendRow(file, row);
+  return true;
+}
+/** Rows of one sha, file order. @param {SeenRow[]} rows @param {string} sha */
+const ofSha = (rows, sha) => rows.filter((r) => r.sha === sha);
+/** An arrived row is still waiting: neither its sha ran nor a dropped row names it. @param {SeenRow[]} rows @param {SeenRow} a */
+const waiting = (rows, a) => a.kind === 'arrived'
+  && !rows.some((r) => (r.kind === 'ran' && r.sha === a.sha) || (r.kind === 'dropped' && ((/** @type {any} */ (r)).of ?? `arrived:${r.sha}`) === a.id));
+
+/**
+ * Does this finished version arrive? Item 6 + am2: only a sha that already RAN never arrives again; one already arrived and still queued does not
+ * arrive twice; one that was dropped (never ran) may. A `baseline` blocks only while it is still the starting point: file-updated = until the file
+ * has changed away (any later arrived/ran/dropped row of ANOTHER sha); new-file = for that sha for good (hamr 2026-10-13: content present at arm never runs, so a renamed or copied baseline file is not new).
+ * @param {SeenRow[]} rows @param {{sha:string}} it @param {'new'|'updated'} mode
+ */
+function arrives(rows, it, mode) {
+  const mine = ofSha(rows, it.sha);
+  if (mine.some((r) => r.kind === 'ran' || waiting(rows, r))) return false;
+  const bi = rows.findLastIndex((r) => r.kind === 'baseline' && r.sha === it.sha);
+  if (bi < 0) return true;
+  return mode === 'updated' && rows.slice(bi + 1).some((r) => r.kind !== 'baseline' && r.sha !== it.sha);
+}
+
+/** Arrived rows are never overwritten: the 2nd arrival of a sha (after a drop) gets its own id. @param {string} ledger @param {ToRun & {name?:string}} item @param {number} at the scheduler's clock, never the file's mtime @param {string} sig */
+export function recordArrived(ledger, item, at, sig) {
+  const rows = readSeen(ledger);
+  if (rows.some((r) => r.sha === item.sha && (r.kind === 'ran' || waiting(rows, r)))) return false; // one writer decides: ran or already queued
+  const n = rows.filter((r) => r.kind === 'arrived' && r.sha === item.sha).length;
+  return appendSeen(ledger, { id: n ? `arrived:${item.sha}:${n}` : `arrived:${item.sha}`, kind: 'arrived', sha: item.sha, name: basename(item.path), size: item.size, path: item.path, at, sig });
+}
+/** The consuming row. Called ONLY by the starter's `beforeSpawn` hook, after the starter agreed (T16). @param {string} ledger @param {{sha:string, path:string, size:number}} item @param {number} at @param {string} sig */
+export const recordRan = (ledger, item, at, sig) => appendSeen(ledger, { id: `ran:${item.sha}`, kind: 'ran', sha: item.sha, name: basename(item.path), size: item.size, at, sig });
+/** `of` = the arrived row it cancels (item.id when a queue row is passed). @param {string} ledger @param {{sha:string, path:string, size:number, id?:string}} item @param {string} why a plain reason: deleted, changed, schedule-changed, schedule-cancelled @param {number} at @param {string} sig */
+export function recordDropped(ledger, item, why, at, sig) {
+  const of = item.id ?? `arrived:${item.sha}`;
+  return appendSeen(ledger, { id: `dropped:${of}`, kind: 'dropped', sha: item.sha, name: basename(item.path), size: item.size, why, at, of, sig });
+}
+
+/**
+ * The queue: arrived and neither ran nor dropped, oldest arrival first. Identical arrival times: by name, then by sha (deterministic).
+ * @param {SeenRow[]} rows @returns {(SeenRow & {path:string})[]}
+ */
+export function queueOf(rows) {
+  const cmp = (/** @type {string} */ x, /** @type {string} */ y) => (x < y ? -1 : x > y ? 1 : 0);
+  return /** @type {any} */ (rows.filter((r) => waiting(rows, r)))
+    .sort((x, y) => x.at - y.at || cmp(x.name, y.name) || cmp(x.sha, y.sha));
+}
+
+/**
+ * At a queued file's turn, look at it again, at use time: lstat (no symlink, a regular file), realpath of its folder, re-hash.
+ * @param {{path:string, sha:string}} item
+ * @returns {{state:'ok', path:string, sha:string, size:number} | {state:'deleted', say:string} | {state:'changed', sha:string}}
+ */
+export function recheck(item) {
+  let parent;
+  try { parent = realpathSync(dirname(item.path)); } catch { return { state: 'deleted', say: 'its folder is gone' }; }
+  const p = join(parent, basename(item.path));
+  let st;
+  try { st = lstatSync(p); } catch { return { state: 'deleted', say: 'it was deleted' }; }
+  if (st.isSymbolicLink() || !st.isFile()) return { state: 'deleted', say: 'it is no longer a regular file (a symlink is refused)' };
+  let buf;
+  try { buf = readFileSync(p); } catch { return { state: 'deleted', say: 'it was deleted' }; }
+  const sha = sha256(buf);
+  return sha === item.sha ? { state: 'ok', path: p, sha, size: buf.length } : { state: 'changed', sha };
+}
+
+/** @param {Buffer} buf */
+const sha256 = (buf) => createHash('sha256').update(buf).digest('hex');
+
+/**
+ * The target is usable NOW, or an Error naming why: a file that is not a symlink and not something else (a file that does not exist yet
+ * is allowed: it may arrive), a folder that exists, resolved with realpathSync. The one rule `arm` and a door's set-time check share.
+ * @param {'new'|'updated'} mode @param {string} target
+ */
+export function checkTarget(mode, target) {
+  if (mode === 'updated') {
+    if (existsSync(target) && lstatSync(target).isSymbolicLink()) throw new Error(`file to watch ${target} is a symlink; a symlink is refused`);
+    if (existsSync(target) && !lstatSync(target).isFile()) throw new Error(`${target} is not a file`);
+  } else {
+    let real;
+    try { real = realpathSync(target); } catch { throw new Error(`folder to watch ${target} does not exist`); }
+    if (!lstatSync(real).isDirectory()) throw new Error(`${target} is not a folder`);
+  }
+}
+
+/**
+ * @param {{mode:'new'|'updated', target:string, ledger:string, sig:string, now?:() => number}} opts target = folder (new) or file (updated)
+ */
+export function createFileTrigger({ mode, target, ledger, sig, now = Date.now }) {
+  if (mode !== 'new' && mode !== 'updated') throw new Error(`file trigger mode "${mode}" is not one of new, updated`);
+  /** @type {Map<string, {key:string, same:number, takenKey:string|null}>} */
+  const track = new Map();
+  const toldRefused = new Set();
+
+  /**
+   * The regular-file candidates right now, re-resolved at use time.
+   * @returns {{files:string[], refused:Refused[]}}
+   */
+  function candidates() {
+    /** @type {Refused[]} */ const refused = [];
+    if (mode === 'updated') {
+      let parent;
+      try { parent = realpathSync(dirname(target)); } catch { return { files: [], refused }; }
+      const p = join(parent, basename(target));
+      let st;
+      try { st = lstatSync(p); } catch { return { files: [], refused }; }
+      if (st.isSymbolicLink()) return { files: [], refused: [{ path: p, why: 'a symlink is refused' }] };
+      if (!st.isFile()) return { files: [], refused: [{ path: p, why: 'not a regular file' }] };
+      return { files: [p], refused };
+    }
+    let real;
+    try { real = realpathSync(target); } catch { return { files: [], refused }; }
+    const files = [];
+    for (const name of readdirSync(real)) {
+      const p = join(real, name);
+      let st;
+      try { st = lstatSync(p); } catch { continue; }
+      if (st.isSymbolicLink()) refused.push({ path: p, why: 'a symlink is refused' });
+      else if (st.isFile()) files.push(p);
+    }
+    return { files, refused };
+  }
+
+  /** Validate the target now and record what is already there as the baseline: it never runs. */
+  function arm() {
+    checkTarget(mode, target);
+    for (const p of candidates().files) {
+      const buf = readFileSync(p);
+      const sha = sha256(buf);
+      appendSeen(ledger, { id: `baseline:${sha}:${basename(p)}`, kind: 'baseline', sha, name: basename(p), size: buf.length, at: now(), sig }); // write-once: re-arming adds nothing
+    }
+  }
+
+  /** @param {string} p @param {{key:string}} t @returns {ToRun|null|'changed'} null = this sha already ran */
+  function take(p, t) {
+    const buf = readFileSync(p);
+    const st2 = lstatSync(p);
+    if (`${st2.size}:${st2.mtimeMs}` !== t.key) return 'changed'; // changed while reading: retry next poll
+    const sha = sha256(buf);
+    if (!arrives(readSeen(ledger), { sha }, mode)) return null; // ran, still queued, or still the starting point
+    return { path: p, sha, size: buf.length };
+  }
+
+  /**
+   * One poll. Synchronous, so a caller drives it from setInterval and a test drives it by hand.
+   * @returns {{arrived: ToRun[], refused: Refused[]}} finished files with a never-seen sha (the caller records them); refused paths are told once per trigger object
+   */
+  function poll() {
+    const { files, refused } = candidates();
+    const arrived = [];
+    const present = new Set(files);
+    for (const p of [...track.keys()]) if (!present.has(p)) track.delete(p);
+    for (const p of files) {
+      let st;
+      try { st = lstatSync(p); } catch { continue; }
+      const key = `${st.size}:${st.mtimeMs}`;
+      let t = track.get(p);
+      if (!t) { t = { key, same: 0, takenKey: null }; track.set(p, t); } else if (t.key !== key) { t.key = key; t.same = 0; } else t.same++;
+      if (t.same >= STABLE_POLLS && t.takenKey !== key) {
+        let got;
+        try { got = take(p, t); } catch { continue; } // vanished while reading
+        if (got === 'changed') continue;
+        t.takenKey = key;
+        if (got) arrived.push(got);
+      }
+    }
+    const told = refused.filter((r) => !toldRefused.has(r.path));
+    for (const r of told) toldRefused.add(r.path);
+    return { arrived, refused: told };
+  }
+
+  return { arm, poll };
+}

package/src/triggerledger.js

@@ -0,0 +1,79 @@
+// T Part 1 (docs/product/PANEL-BUILD.md, "T: triggers build spec", C.1 and E.2): the ONE reader and the ONE
+// appender of a job's trigger ledger, `<home>/triggers/<job>/ledger.jsonl`. Append-only JSONL, one file for
+// every row kind, every row carrying `sig` (the signature hash it was written under).
+// Rewritten from fwdloop's trigger-clock.js readRows/appendOnce, with two fixes landed together (T17): a line
+// that does not parse (a torn append) is SKIPPED and counted, and an append starts on a fresh line when the
+// file does not end in a newline, so a torn line can never glue onto the next row. One half without the other
+// is worse than neither: skip-only loses the next good row into the torn line, fresh-line-only throws on read.
+import {
+  appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync,
+} from 'node:fs';
+import { dirname } from 'node:path';
+
+/** @typedef {{id?: string, kind: string, sig?: string, at?: number, [k: string]: unknown}} LedgerRow */
+
+/**
+ * Every row that parses, oldest first, and how many lines did not. A missing file is no rows.
+ * @param {string} file
+ * @returns {{rows: LedgerRow[], skipped: number}}
+ */
+export function readLedger(file) {
+  if (!existsSync(file)) return { rows: [], skipped: 0 };
+  const rows = [];
+  let skipped = 0;
+  for (const line of readFileSync(file, 'utf8').split('\n')) {
+    if (!line) continue;
+    let row;
+    try { row = JSON.parse(line); } catch { skipped++; continue; }
+    if (!row || typeof row !== 'object' || Array.isArray(row)) { skipped++; continue; }
+    rows.push(row);
+  }
+  return { rows, skipped };
+}
+
+/** @param {string} file @returns {boolean} the file is non-empty and its last byte is not a newline (a torn tail). */
+function endsTorn(file) {
+  if (!existsSync(file)) return false;
+  const fd = openSync(file, 'r');
+  try {
+    const size = fstatSync(fd).size;
+    if (size === 0) return false;
+    const b = Buffer.alloc(1);
+    readSync(fd, b, 0, 1, size - 1);
+    return b[0] !== 0x0a;
+  } finally { closeSync(fd); }
+}
+
+/**
+ * Append one row (dir 0700, file 0600). A torn tail gets a newline first. `once` refuses a row whose `id` is
+ * already on disk (write-once ids), by throwing.
+ * @param {string} file
+ * @param {LedgerRow} row
+ * @param {{once?: boolean}} [opts]
+ */
+export function appendRow(file, row, opts = {}) {
+  if (opts.once) {
+    if (row.id === undefined) throw new Error('a write-once ledger row needs an id');
+    if (withoutReleased(readLedger(file).rows).some((r) => r.id === row.id)) throw new Error(`ledger row ${row.id} already written`);
+  }
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const lead = endsTorn(file) ? '\n' : '';
+  appendFileSync(file, `${lead}${JSON.stringify(row)}\n`, { mode: 0o600 });
+}
+
+/**
+ * Walk the rows in order: a `released` row (`of` = an id) cancels the latest earlier live row with that id, and
+ * is itself dropped. A released `fire` or `ran` is not consumed, so its slot or file is retryable (Part 4) and
+ * the same id may be written again.
+ * @param {LedgerRow[]} rows
+ * @returns {LedgerRow[]}
+ */
+export function withoutReleased(rows) {
+  /** @type {LedgerRow[]} */
+  const live = [];
+  for (const r of rows) {
+    if (r.kind !== 'released') { live.push(r); continue; }
+    for (let i = live.length - 1; i >= 0; i--) if (live[i].id === r.of) { live.splice(i, 1); break; }
+  }
+  return live;
+}

package/src/u-readout.js

@@ -202,7 +202,7 @@ export function reviewDoorPackage({ door, diff }) {
   const out = [];
   out.push(`REVIEW DOOR — this run's close minted ${String(d.outcome ?? 'a verdict')} and it STANDS. Nothing you do here changes it.`);
   if (held) {
-    out.push('  held     this green was rendered by the judged floor, so it has earned NO reuse and NO learning credit until you accept it');
+    out.push('  held     this is a rubric (soft-green) job, so its green earns NO reuse and NO learning credit until you accept it, whether or not a judge ran');
   }
   // the body: what the machine judged, what moved, and the lines themselves —
   // rendered by the SAME code the pause screen uses, off the same record shape.

package/src/userrun.js

@@ -42,7 +42,7 @@ import { makeSpine } from './spine.js';
 // signed into the job spec — a job is a repeatable SHAPE, the source/
 // destination a per-run value, exactly like `bareloop run <bundle> --repo
 // <path>` varies the repo without touching the bundle's signature).
-import { readSourceManifest, frontDoorFromManifest, proveDestination, copyOut } from './source.js';
+import { readSourceManifest, frontDoorFromManifest, proveDestination, copyOut, refreezeUrlInputs } from './source.js';
 import { scanSecrets, redactSecrets } from './validate.js';
 import { runBehaviour, formatBehaviour } from './behaviour.js';
 // the three doors' SEMANTICS live in the library; this script surfaces them
@@ -54,7 +54,8 @@ import { resolveJudge } from './judged.js';
 // path uses (never a second one) and keeps its patient the way it left it.
 import { readResume, resumeTreeGate, checkpointAgeGate, writeRunGreenRow, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS } from './reuse.js';
 // PRD item 28's provider factory (src/providers.js): the WORKER provider's
-// ctor/envKey/tier-table/param-gating come from here now — one seam instead
+// ctor/param-gating come from here now (its key variable and price come from the
+// Settings row, src/providerrows.js) — one seam instead
 // of an `if (provider === …)` scattered across this script. PRD item 32.2
 // moved the JUDGE onto this SAME factory: it used to be separately pinned
 // below to a hardcoded Anthropic constructor at the judged tier because the
@@ -235,6 +236,7 @@ class ExitSignal extends Error {
  * @property {any} [provider] the TEST SEAM: supplying this skips the real-key
  *   check entirely, the same shape `src/cli.js`'s `main(argv, deps)` uses.
  * @property {(tier: string) => any} [providerFor]
+ * @property {(url: string) => Promise<{ok: true, text: string, url: string}|{ok: false, error: string}>} [fetchUrl] PART 1c - a test seam: how a web input is read at run start (production: barebrowse)
  * @property {any} [judgeProvider]
  * @property {string} [runlistHome] F196 — a test seam for `appendRun`'s
  *   (src/runlist.js) `home` override, the same shape `deps.provider` already
@@ -506,10 +508,8 @@ async function execute(ctx) {
   // and tested apart from this script. The JUDGE's model is resolved separately
   // (`resolveJudge`, below the key block): it defaults to this same resolved
   // worker model and a signed `judge` override wins over it.
-  // The provider's OWN tier table (src/providers.js) supplies the default —
-  // not the anthropic-only DEFAULT_TIER_MODELS above (that map is the
-  // `--model` FLAG's vocabulary only, sonnet/haiku, unrelated to which
-  // provider the spec names). `spec.provider` is not validateJob'd until
+  // There is no default model: a spec or flag that names none dies below with
+  // REFUSE_NAME_MODEL (the model is one ticked in Settings). `spec.provider` is not validateJob'd until
   // runJob below, so an unrecognized value dies here with the same operator-
   // facing message resolveWorkerModel's own errors use, rather than an
   // unhandled throw.
@@ -1404,8 +1404,8 @@ async function execute(ctx) {
   // token against. That made "provider-agnostic" half-true: you could run on
   // another provider only if you also held an Anthropic account.
   //
-  // The WORKER's key comes from the provider's own `envKey` (the factory's, so
-  // there is one table saying which provider reads which variable) and is
+  // The WORKER's key comes from its Settings row's own env name (`keyValueOf`, src/providerrows.js,
+  // so there is one place saying which row reads which variable) and is
   // ALWAYS required — the worker always runs.
   //
   // The JUDGE's key is required only when the close actually judges
@@ -2592,13 +2592,24 @@ export async function main(argv, deps = {}) {
           + 'with exactly one source-*/ sibling.');
       }
       const into = candidates[0];
-      const manifestRead = await readSourceManifest(into);
+      let manifestRead = await readSourceManifest(into);
       if (manifestRead.stop !== null) {
         die(`--spec ${specPath}: ${manifestRead.code} — ${manifestRead.stop}`);
       }
       if (!manifestRead.present || !manifestRead.manifest) {
         die(`--spec ${specPath}: ${into} carries no source.json — not a prepared copy this runner can trust`);
       }
+      // PART 1c (RF22): a FRESH run of a rubric job with web inputs fetches each address again and makes that text the run's frozen
+      // input BEFORE the worker starts (the drafting copy was only for the look). A resume / door / decision keeps the copy its
+      // first start froze. A refusal is plain words, $0.
+      if (argFlag('resume') === null && argFlag('door') === null && argFlag('decide') === null) {
+        const fresh = await refreezeUrlInputs({ into, ...(deps.fetchUrl ? { fetchUrl: deps.fetchUrl } : {}) });
+        if (!fresh.ok) die(`--spec ${specPath}: ${fresh.error}`);
+        if (fresh.refreshed.length > 0) {
+          manifestRead = await readSourceManifest(into);
+          if (manifestRead.stop !== null || !manifestRead.manifest) die(`--spec ${specPath}: the run copy's record could not be read after the fresh fetch`);
+        }
+      }
       const seed = manifestRead.manifest.seed;
       if (typeof seed !== 'string' || !seed) {
         die(`--spec ${specPath}: ${into}/source.json carries no seed commit — not a prepared copy this runner can trust`);