bareloop 0.42.0 → 0.43.0

package/src/triggerclock.js

@@ -0,0 +1,127 @@
+// T Part 1 (docs/product/PANEL-BUILD.md, "T: triggers build spec", C.1): the clock trigger's schedule maths.
+// Rewritten from fwdloop src/trigger-clock.js (its readRows/appendOnce are replaced by triggerledger.js).
+//
+// A schedule is a typed object, never cron text:
+//   { kind:'daily'|'weekdays', hour, minute } | { kind:'weekly', day:'mon'|..., hour, minute }
+// Times are LOCAL. One slot per calendar day at most (built with the local Date constructor), so a DST
+// change day can neither lose nor double a slot: a 02:30 that does not exist shifts to 03:30, one that
+// happens twice is the first. Missed slots (panel off or machine asleep) collapse to ONE catch-up.
+//
+// Rows (in the job's ledger.jsonl, every row carrying `sig`):
+//   { id:'armed:<ms>', kind:'armed', at }                          the trigger was set: the starting point
+//   { id:'fire:<slotMs>', kind:'fire', slot, at, catchUp, missed } one run is starting for that slot
+// RULED 2026-10-14: `recordFire` is the CONSUMING row; the scheduler's starter calls it only after busy,
+// monthly and wouldAccept have all said yes, so a refused or busy slot stays due and retries.
+import { appendRow, withoutReleased } from './triggerledger.js';
+
+/** @typedef {{kind:'daily'|'weekdays', hour:number, minute:number} | {kind:'weekly', day:string, hour:number, minute:number}} Schedule */
+/** @typedef {import('./triggerledger.js').LedgerRow} ClockRow */
+/** @typedef {{fire:boolean, catchUp:boolean, missed:number, slot?:number}} Due */
+
+/** A slot seen MORE than this after its set time is a catch-up. Exactly this late is on time. */
+export const GRACE_MS = 120_000;
+
+export const DAYS = ['sun', 'mon', 'tue', 'wed', 'thu', 'fri', 'sat'];
+
+/**
+ * The only way a clock schedule enters the system. Refuses anything else, naming the field.
+ * @param {unknown} s
+ * @returns {Schedule}
+ */
+export function validateSchedule(s) {
+  if (!s || typeof s !== 'object' || Array.isArray(s)) throw new Error('schedule must be an object like { kind, hour, minute }, not text');
+  const o = /** @type {Record<string, unknown>} */ (s);
+  const kinds = ['daily', 'weekdays', 'weekly'];
+  if (!kinds.includes(/** @type {string} */ (o.kind))) throw new Error(`schedule kind "${o.kind}" is not one of ${kinds.join(', ')}`);
+  const allowed = o.kind === 'weekly' ? ['kind', 'day', 'hour', 'minute'] : ['kind', 'hour', 'minute'];
+  for (const k of Object.keys(o)) if (!allowed.includes(k)) throw new Error(`schedule field "${k}" is not allowed on a ${o.kind} schedule`);
+  const hour = o.hour; const minute = o.minute;
+  if (!Number.isInteger(hour) || /** @type {number} */ (hour) < 0 || /** @type {number} */ (hour) > 23) throw new Error('schedule hour must be a whole number 0-23');
+  if (!Number.isInteger(minute) || /** @type {number} */ (minute) < 0 || /** @type {number} */ (minute) > 59) throw new Error('schedule minute must be a whole number 0-59');
+  if (o.kind === 'weekly') {
+    if (typeof o.day !== 'string' || !DAYS.includes(o.day)) throw new Error(`schedule day must be one of ${DAYS.join(', ')}`);
+    return { kind: 'weekly', day: o.day, hour: /** @type {number} */ (hour), minute: /** @type {number} */ (minute) };
+  }
+  return { kind: /** @type {'daily'|'weekdays'} */ (o.kind), hour: /** @type {number} */ (hour), minute: /** @type {number} */ (minute) };
+}
+
+/**
+ * Slots (epoch ms) in (afterMs, untilMs], oldest first.
+ * @param {Schedule} sc
+ * @param {number} afterMs
+ * @param {number} untilMs
+ * @returns {number[]}
+ */
+function slotsBetween(sc, afterMs, untilMs) {
+  const out = [];
+  const s = new Date(afterMs);
+  for (let i = 0; ; i++) {
+    const d = new Date(s.getFullYear(), s.getMonth(), s.getDate() + i);
+    if (d.getTime() > untilMs) break;
+    const dow = d.getDay();
+    const ok = sc.kind === 'daily'
+      || (sc.kind === 'weekdays' && dow >= 1 && dow <= 5)
+      || (sc.kind === 'weekly' && dow === DAYS.indexOf(/** @type {{day:string}} */ (sc).day));
+    if (!ok) continue;
+    const slot = new Date(d.getFullYear(), d.getMonth(), d.getDate(), sc.hour, sc.minute).getTime();
+    if (slot > afterMs && slot <= untilMs) out.push(slot);
+  }
+  return out;
+}
+
+/**
+ * The starting point: the latest of the arm time(s) and every consumed fire slot. No arm row = null.
+ * @param {ClockRow[]} rows
+ */
+function lastPoint(rows) {
+  let armed = false; let last = -Infinity;
+  for (const r of withoutReleased(rows)) {
+    if (r.kind === 'armed') { armed = true; last = Math.max(last, /** @type {number} */ (r.at)); } else if (r.kind === 'fire') last = Math.max(last, /** @type {number} */ (r.slot));
+  }
+  return armed ? last : null;
+}
+
+/**
+ * Is a run due at `now`? Slots missed (panel off) collapse to ONE fire, for the latest slot, marked catch-up.
+ * Catch-up = more than one slot was missed, or the latest slot is more than GRACE_MS old.
+ * @param {Schedule} schedule
+ * @param {ClockRow[]} rows
+ * @param {number} now epoch ms
+ * @returns {Due}
+ */
+export function due(schedule, rows, now) {
+  const last = lastPoint(rows);
+  if (last === null) return { fire: false, catchUp: false, missed: 0 };
+  const slots = slotsBetween(validateSchedule(schedule), last, now);
+  if (!slots.length) return { fire: false, catchUp: false, missed: 0 };
+  const slot = slots[slots.length - 1];
+  const catchUp = slots.length > 1 || now - slot > GRACE_MS;
+  return { fire: true, catchUp, missed: catchUp ? slots.length : 0, slot };
+}
+
+/**
+ * The next slot time strictly after `afterMs` (epoch ms). Words are the caller's (schedulewords.js).
+ * @param {Schedule} schedule
+ * @param {number} afterMs
+ * @returns {number}
+ */
+export function nextSlot(schedule, afterMs) {
+  const sc = validateSchedule(schedule);
+  // a week plus a day always holds a slot of any kind
+  const found = slotsBetween(sc, afterMs, afterMs + 9 * 86_400_000)[0];
+  return /** @type {number} */ (found);
+}
+
+/** The trigger was set at `now` under signature `sig`: no slot before this ever fires. @param {string} file @param {number} now @param {string} sig */
+export function armTrigger(file, now, sig) {
+  appendRow(file, { id: `armed:${now}`, kind: 'armed', at: now, sig }, { once: true });
+}
+
+/**
+ * Record that the run for this due slot is starting (the consuming row). Write-once per slot.
+ * @param {string} file @param {Due} d the result of `due` with fire true @param {number} now @param {string} sig
+ */
+export function recordFire(file, d, now, sig) {
+  if (!d.fire || d.slot === undefined) throw new Error('recordFire needs a due result with fire true');
+  appendRow(file, { id: `fire:${d.slot}`, kind: 'fire', slot: d.slot, at: now, catchUp: d.catchUp, missed: d.missed, sig }, { once: true });
+}

package/src/triggerfiles.js

@@ -0,0 +1,215 @@
+// T Part 2 (docs/product/PANEL-BUILD.md, "T: triggers build spec", C.2): the file triggers.
+// Rewritten from fwdloop src/trigger-files.js. Poll-based, NOT fs.watch (EMFILE, and it misses atomic renames).
+// This file only says WHAT to run ({path, sha, size}); starting the run, pinning the input and the busy,
+// monthly and wouldAccept checks are the caller's (src/panel/schedules.js `fire`).
+//
+// Modes:   'updated' — one file;   'new' — one folder, top level only, regular files only.
+// Symlinks are refused, checked at use time (realpathSync on the folder, lstat on the file), never lexically.
+// A file is taken only after its size AND mtime were unchanged for STABLE_POLLS consecutive polls.
+//
+// Seen rows live in the job's ONE ledger (triggerledger.js reads and appends; every row carries `sig`):
+//   { id, kind:'baseline'|'arrived'|'ran'|'dropped', sha, name, size, at, sig }  (+ `path` on arrived, `why` and `of` on dropped)
+// 'baseline' = present when the trigger was armed: never runs. 'arrived' = a finished file with a never-seen sha was
+// seen (a 2nd arrival of a dropped sha gets id `arrived:<sha>:<n>`). 'ran' = the CONSUMING row, written by the
+// starter's `beforeSpawn` hook only AFTER busy, monthly and wouldAccept said yes (T16, RULED 2026-10-14): a refused
+// start writes no `ran`, so the file stays at the head of the queue and the next tick tries again. A `released`
+// row (a spawn error after `ran`) cancels the `ran`, and the file is retryable. 'dropped' = deleted or changed
+// before its turn. A sha with a live `ran` row never arrives again, whatever its name or mtime.
+// poll() writes nothing: it only reports finished files whose sha is new.
+import {
+  existsSync, lstatSync, readFileSync, readdirSync, realpathSync,
+} from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { appendRow, readLedger, withoutReleased } from './triggerledger.js';
+
+/** @typedef {{id:string, kind:'baseline'|'arrived'|'ran'|'dropped', sha:string, name:string, size:number, at:number, sig?:string, path?:string, why?:string, of?:string}} SeenRow */
+/** @typedef {{path:string, sha:string, size:number}} ToRun */
+/** @typedef {{path:string, why:string}} Refused */
+
+/** Consecutive polls with the same size and mtime before a file is taken. (Two matches in a row = taken on the third sighting.) */
+export const STABLE_POLLS = 2;
+
+const SEEN_KINDS = ['baseline', 'arrived', 'ran', 'dropped'];
+
+/** The file-kind rows of the job's ledger that still count (a released `ran` does not). @param {string} file @returns {SeenRow[]} */
+export function readSeen(file) {
+  return /** @type {SeenRow[]} */ (withoutReleased(readLedger(file).rows).filter((r) => SEEN_KINDS.includes(r.kind)));
+}
+
+/** The ONE appender here: write-once by live id (a second row with the same id is not written). @param {string} file @param {SeenRow} row @returns {boolean} written */
+function appendSeen(file, row) {
+  if (readSeen(file).some((r) => r.id === row.id)) return false;
+  appendRow(file, row);
+  return true;
+}
+/** Rows of one sha, file order. @param {SeenRow[]} rows @param {string} sha */
+const ofSha = (rows, sha) => rows.filter((r) => r.sha === sha);
+/** An arrived row is still waiting: neither its sha ran nor a dropped row names it. @param {SeenRow[]} rows @param {SeenRow} a */
+const waiting = (rows, a) => a.kind === 'arrived'
+  && !rows.some((r) => (r.kind === 'ran' && r.sha === a.sha) || (r.kind === 'dropped' && ((/** @type {any} */ (r)).of ?? `arrived:${r.sha}`) === a.id));
+
+/**
+ * Does this finished version arrive? Item 6 + am2: only a sha that already RAN never arrives again; one already arrived and still queued does not
+ * arrive twice; one that was dropped (never ran) may. A `baseline` blocks only while it is still the starting point: file-updated = until the file
+ * has changed away (any later arrived/ran/dropped row of ANOTHER sha); new-file = for that sha for good (hamr 2026-10-13: content present at arm never runs, so a renamed or copied baseline file is not new).
+ * @param {SeenRow[]} rows @param {{sha:string}} it @param {'new'|'updated'} mode
+ */
+function arrives(rows, it, mode) {
+  const mine = ofSha(rows, it.sha);
+  if (mine.some((r) => r.kind === 'ran' || waiting(rows, r))) return false;
+  const bi = rows.findLastIndex((r) => r.kind === 'baseline' && r.sha === it.sha);
+  if (bi < 0) return true;
+  return mode === 'updated' && rows.slice(bi + 1).some((r) => r.kind !== 'baseline' && r.sha !== it.sha);
+}
+
+/** Arrived rows are never overwritten: the 2nd arrival of a sha (after a drop) gets its own id. @param {string} ledger @param {ToRun & {name?:string}} item @param {number} at the scheduler's clock, never the file's mtime @param {string} sig */
+export function recordArrived(ledger, item, at, sig) {
+  const rows = readSeen(ledger);
+  if (rows.some((r) => r.sha === item.sha && (r.kind === 'ran' || waiting(rows, r)))) return false; // one writer decides: ran or already queued
+  const n = rows.filter((r) => r.kind === 'arrived' && r.sha === item.sha).length;
+  return appendSeen(ledger, { id: n ? `arrived:${item.sha}:${n}` : `arrived:${item.sha}`, kind: 'arrived', sha: item.sha, name: basename(item.path), size: item.size, path: item.path, at, sig });
+}
+/** The consuming row. Called ONLY by the starter's `beforeSpawn` hook, after the starter agreed (T16). @param {string} ledger @param {{sha:string, path:string, size:number}} item @param {number} at @param {string} sig */
+export const recordRan = (ledger, item, at, sig) => appendSeen(ledger, { id: `ran:${item.sha}`, kind: 'ran', sha: item.sha, name: basename(item.path), size: item.size, at, sig });
+/** `of` = the arrived row it cancels (item.id when a queue row is passed). @param {string} ledger @param {{sha:string, path:string, size:number, id?:string}} item @param {string} why a plain reason: deleted, changed, schedule-changed, schedule-cancelled @param {number} at @param {string} sig */
+export function recordDropped(ledger, item, why, at, sig) {
+  const of = item.id ?? `arrived:${item.sha}`;
+  return appendSeen(ledger, { id: `dropped:${of}`, kind: 'dropped', sha: item.sha, name: basename(item.path), size: item.size, why, at, of, sig });
+}
+
+/**
+ * The queue: arrived and neither ran nor dropped, oldest arrival first. Identical arrival times: by name, then by sha (deterministic).
+ * @param {SeenRow[]} rows @returns {(SeenRow & {path:string})[]}
+ */
+export function queueOf(rows) {
+  const cmp = (/** @type {string} */ x, /** @type {string} */ y) => (x < y ? -1 : x > y ? 1 : 0);
+  return /** @type {any} */ (rows.filter((r) => waiting(rows, r)))
+    .sort((x, y) => x.at - y.at || cmp(x.name, y.name) || cmp(x.sha, y.sha));
+}
+
+/**
+ * At a queued file's turn, look at it again, at use time: lstat (no symlink, a regular file), realpath of its folder, re-hash.
+ * @param {{path:string, sha:string}} item
+ * @returns {{state:'ok', path:string, sha:string, size:number} | {state:'deleted', say:string} | {state:'changed', sha:string}}
+ */
+export function recheck(item) {
+  let parent;
+  try { parent = realpathSync(dirname(item.path)); } catch { return { state: 'deleted', say: 'its folder is gone' }; }
+  const p = join(parent, basename(item.path));
+  let st;
+  try { st = lstatSync(p); } catch { return { state: 'deleted', say: 'it was deleted' }; }
+  if (st.isSymbolicLink() || !st.isFile()) return { state: 'deleted', say: 'it is no longer a regular file (a symlink is refused)' };
+  let buf;
+  try { buf = readFileSync(p); } catch { return { state: 'deleted', say: 'it was deleted' }; }
+  const sha = sha256(buf);
+  return sha === item.sha ? { state: 'ok', path: p, sha, size: buf.length } : { state: 'changed', sha };
+}
+
+/** @param {Buffer} buf */
+const sha256 = (buf) => createHash('sha256').update(buf).digest('hex');
+
+/**
+ * The target is usable NOW, or an Error naming why: a file that is not a symlink and not something else (a file that does not exist yet
+ * is allowed: it may arrive), a folder that exists, resolved with realpathSync. The one rule `arm` and a door's set-time check share.
+ * @param {'new'|'updated'} mode @param {string} target
+ */
+export function checkTarget(mode, target) {
+  if (mode === 'updated') {
+    if (existsSync(target) && lstatSync(target).isSymbolicLink()) throw new Error(`file to watch ${target} is a symlink; a symlink is refused`);
+    if (existsSync(target) && !lstatSync(target).isFile()) throw new Error(`${target} is not a file`);
+  } else {
+    let real;
+    try { real = realpathSync(target); } catch { throw new Error(`folder to watch ${target} does not exist`); }
+    if (!lstatSync(real).isDirectory()) throw new Error(`${target} is not a folder`);
+  }
+}
+
+/**
+ * @param {{mode:'new'|'updated', target:string, ledger:string, sig:string, now?:() => number}} opts target = folder (new) or file (updated)
+ */
+export function createFileTrigger({ mode, target, ledger, sig, now = Date.now }) {
+  if (mode !== 'new' && mode !== 'updated') throw new Error(`file trigger mode "${mode}" is not one of new, updated`);
+  /** @type {Map<string, {key:string, same:number, takenKey:string|null}>} */
+  const track = new Map();
+  const toldRefused = new Set();
+
+  /**
+   * The regular-file candidates right now, re-resolved at use time.
+   * @returns {{files:string[], refused:Refused[]}}
+   */
+  function candidates() {
+    /** @type {Refused[]} */ const refused = [];
+    if (mode === 'updated') {
+      let parent;
+      try { parent = realpathSync(dirname(target)); } catch { return { files: [], refused }; }
+      const p = join(parent, basename(target));
+      let st;
+      try { st = lstatSync(p); } catch { return { files: [], refused }; }
+      if (st.isSymbolicLink()) return { files: [], refused: [{ path: p, why: 'a symlink is refused' }] };
+      if (!st.isFile()) return { files: [], refused: [{ path: p, why: 'not a regular file' }] };
+      return { files: [p], refused };
+    }
+    let real;
+    try { real = realpathSync(target); } catch { return { files: [], refused }; }
+    const files = [];
+    for (const name of readdirSync(real)) {
+      const p = join(real, name);
+      let st;
+      try { st = lstatSync(p); } catch { continue; }
+      if (st.isSymbolicLink()) refused.push({ path: p, why: 'a symlink is refused' });
+      else if (st.isFile()) files.push(p);
+    }
+    return { files, refused };
+  }
+
+  /** Validate the target now and record what is already there as the baseline: it never runs. */
+  function arm() {
+    checkTarget(mode, target);
+    for (const p of candidates().files) {
+      const buf = readFileSync(p);
+      const sha = sha256(buf);
+      appendSeen(ledger, { id: `baseline:${sha}:${basename(p)}`, kind: 'baseline', sha, name: basename(p), size: buf.length, at: now(), sig }); // write-once: re-arming adds nothing
+    }
+  }
+
+  /** @param {string} p @param {{key:string}} t @returns {ToRun|null|'changed'} null = this sha already ran */
+  function take(p, t) {
+    const buf = readFileSync(p);
+    const st2 = lstatSync(p);
+    if (`${st2.size}:${st2.mtimeMs}` !== t.key) return 'changed'; // changed while reading: retry next poll
+    const sha = sha256(buf);
+    if (!arrives(readSeen(ledger), { sha }, mode)) return null; // ran, still queued, or still the starting point
+    return { path: p, sha, size: buf.length };
+  }
+
+  /**
+   * One poll. Synchronous, so a caller drives it from setInterval and a test drives it by hand.
+   * @returns {{arrived: ToRun[], refused: Refused[]}} finished files with a never-seen sha (the caller records them); refused paths are told once per trigger object
+   */
+  function poll() {
+    const { files, refused } = candidates();
+    const arrived = [];
+    const present = new Set(files);
+    for (const p of [...track.keys()]) if (!present.has(p)) track.delete(p);
+    for (const p of files) {
+      let st;
+      try { st = lstatSync(p); } catch { continue; }
+      const key = `${st.size}:${st.mtimeMs}`;
+      let t = track.get(p);
+      if (!t) { t = { key, same: 0, takenKey: null }; track.set(p, t); } else if (t.key !== key) { t.key = key; t.same = 0; } else t.same++;
+      if (t.same >= STABLE_POLLS && t.takenKey !== key) {
+        let got;
+        try { got = take(p, t); } catch { continue; } // vanished while reading
+        if (got === 'changed') continue;
+        t.takenKey = key;
+        if (got) arrived.push(got);
+      }
+    }
+    const told = refused.filter((r) => !toldRefused.has(r.path));
+    for (const r of told) toldRefused.add(r.path);
+    return { arrived, refused: told };
+  }
+
+  return { arm, poll };
+}

package/src/triggerledger.js

@@ -0,0 +1,79 @@
+// T Part 1 (docs/product/PANEL-BUILD.md, "T: triggers build spec", C.1 and E.2): the ONE reader and the ONE
+// appender of a job's trigger ledger, `<home>/triggers/<job>/ledger.jsonl`. Append-only JSONL, one file for
+// every row kind, every row carrying `sig` (the signature hash it was written under).
+// Rewritten from fwdloop's trigger-clock.js readRows/appendOnce, with two fixes landed together (T17): a line
+// that does not parse (a torn append) is SKIPPED and counted, and an append starts on a fresh line when the
+// file does not end in a newline, so a torn line can never glue onto the next row. One half without the other
+// is worse than neither: skip-only loses the next good row into the torn line, fresh-line-only throws on read.
+import {
+  appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync,
+} from 'node:fs';
+import { dirname } from 'node:path';
+
+/** @typedef {{id?: string, kind: string, sig?: string, at?: number, [k: string]: unknown}} LedgerRow */
+
+/**
+ * Every row that parses, oldest first, and how many lines did not. A missing file is no rows.
+ * @param {string} file
+ * @returns {{rows: LedgerRow[], skipped: number}}
+ */
+export function readLedger(file) {
+  if (!existsSync(file)) return { rows: [], skipped: 0 };
+  const rows = [];
+  let skipped = 0;
+  for (const line of readFileSync(file, 'utf8').split('\n')) {
+    if (!line) continue;
+    let row;
+    try { row = JSON.parse(line); } catch { skipped++; continue; }
+    if (!row || typeof row !== 'object' || Array.isArray(row)) { skipped++; continue; }
+    rows.push(row);
+  }
+  return { rows, skipped };
+}
+
+/** @param {string} file @returns {boolean} the file is non-empty and its last byte is not a newline (a torn tail). */
+function endsTorn(file) {
+  if (!existsSync(file)) return false;
+  const fd = openSync(file, 'r');
+  try {
+    const size = fstatSync(fd).size;
+    if (size === 0) return false;
+    const b = Buffer.alloc(1);
+    readSync(fd, b, 0, 1, size - 1);
+    return b[0] !== 0x0a;
+  } finally { closeSync(fd); }
+}
+
+/**
+ * Append one row (dir 0700, file 0600). A torn tail gets a newline first. `once` refuses a row whose `id` is
+ * already on disk (write-once ids), by throwing.
+ * @param {string} file
+ * @param {LedgerRow} row
+ * @param {{once?: boolean}} [opts]
+ */
+export function appendRow(file, row, opts = {}) {
+  if (opts.once) {
+    if (row.id === undefined) throw new Error('a write-once ledger row needs an id');
+    if (withoutReleased(readLedger(file).rows).some((r) => r.id === row.id)) throw new Error(`ledger row ${row.id} already written`);
+  }
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const lead = endsTorn(file) ? '\n' : '';
+  appendFileSync(file, `${lead}${JSON.stringify(row)}\n`, { mode: 0o600 });
+}
+
+/**
+ * Walk the rows in order: a `released` row (`of` = an id) cancels the latest earlier live row with that id, and
+ * is itself dropped. A released `fire` or `ran` is not consumed, so its slot or file is retryable (Part 4) and
+ * the same id may be written again.
+ * @param {LedgerRow[]} rows
+ * @returns {LedgerRow[]}
+ */
+export function withoutReleased(rows) {
+  /** @type {LedgerRow[]} */
+  const live = [];
+  for (const r of rows) {
+    if (r.kind !== 'released') { live.push(r); continue; }
+    for (let i = live.length - 1; i >= 0; i--) if (live[i].id === r.of) { live.splice(i, 1); break; }
+  }
+  return live;
+}

package/src/userrun.js

@@ -54,7 +54,8 @@ import { resolveJudge } from './judged.js';
 // path uses (never a second one) and keeps its patient the way it left it.
 import { readResume, resumeTreeGate, checkpointAgeGate, writeRunGreenRow, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS } from './reuse.js';
 // PRD item 28's provider factory (src/providers.js): the WORKER provider's
-// ctor/envKey/tier-table/param-gating come from here now — one seam instead
+// ctor/param-gating come from here now (its key variable and price come from the
+// Settings row, src/providerrows.js) — one seam instead
 // of an `if (provider === …)` scattered across this script. PRD item 32.2
 // moved the JUDGE onto this SAME factory: it used to be separately pinned
 // below to a hardcoded Anthropic constructor at the judged tier because the
@@ -507,10 +508,8 @@ async function execute(ctx) {
   // and tested apart from this script. The JUDGE's model is resolved separately
   // (`resolveJudge`, below the key block): it defaults to this same resolved
   // worker model and a signed `judge` override wins over it.
-  // The provider's OWN tier table (src/providers.js) supplies the default —
-  // not the anthropic-only DEFAULT_TIER_MODELS above (that map is the
-  // `--model` FLAG's vocabulary only, sonnet/haiku, unrelated to which
-  // provider the spec names). `spec.provider` is not validateJob'd until
+  // There is no default model: a spec or flag that names none dies below with
+  // REFUSE_NAME_MODEL (the model is one ticked in Settings). `spec.provider` is not validateJob'd until
   // runJob below, so an unrecognized value dies here with the same operator-
   // facing message resolveWorkerModel's own errors use, rather than an
   // unhandled throw.
@@ -1405,8 +1404,8 @@ async function execute(ctx) {
   // token against. That made "provider-agnostic" half-true: you could run on
   // another provider only if you also held an Anthropic account.
   //
-  // The WORKER's key comes from the provider's own `envKey` (the factory's, so
-  // there is one table saying which provider reads which variable) and is
+  // The WORKER's key comes from its Settings row's own env name (`keyValueOf`, src/providerrows.js,
+  // so there is one place saying which row reads which variable) and is
   // ALWAYS required — the worker always runs.
   //
   // The JUDGE's key is required only when the close actually judges

package/types/declaredclose.d.ts

@@ -187,7 +187,7 @@ export const CLOSE_DECL_FIELDS: readonly string[];
 /** what a stored calibration set carries, ENUMERATED: the frozen cases and the judge
  * tier that graded them. Both are inside the spec, so `jobSpecHash` covers both — which
  * is the whole mechanism behind "a judge-model bump forces a full recalibration"
- * (src/judged.js, `JUDGE_MODEL`): the field moves, the hash moves, the signature dies,
+ * (src/judged.js, `resolveJudge`): the field moves, the hash moves, the signature dies,
  * and the re-sign re-runs the gate. Anything else in there is a field nobody reads. */
 export const CALIBRATION_FIELDS: readonly string[];
 /**

package/types/job.d.ts

@@ -99,7 +99,8 @@ export function jobSpecHash(job: object): string;
  * share a workflow key iff they ran the same goal, checks, guardrails and close — whatever source they ran on, wherever they wrote, whatever caps they had.
  * It is NOT a signature: {@link jobSpecHash} (which covers the caps and the fence) stays what the person signs, and
  * a reuse lands on a NEW jobSpecHash with the SAME workflowKey. Same never-throws contract as `jobSpecHash`, and
- * the same resolved-`tools` form, so an omitted-`tools` spec and its spelled-out menu share a key.
+ * the same resolved-`tools` form, so an omitted-`tools` spec and its spelled-out menu share a key. A soft-green spec keys on its
+ * RESOLVED judge identity (an absent `judge` is its worker's), so pinning the default judge never changes the key.
  * @param {object} job
  * @returns {string} sha256 hex
  */
@@ -277,6 +278,12 @@ export const CONDITION_KEYS: readonly string[];
  * reuse (so what the key ignores is exactly what the person may edit, never two spellings).
  */
 export const REUSE_OPEN_SPEC_FIELDS: readonly string[];
+/**
+ * The signed spec's schedule fields: {@link workflowKey} ignores them too, so a scheduled spec keeps the workflow
+ * key of the green run it was scheduled from (else Reuse would refuse every scheduled spec). They stay inside
+ * {@link jobSpecHash}. Kept apart from {@link REUSE_OPEN_SPEC_FIELDS}, which names the Reuse boxes.
+ */
+export const SCHEDULE_SPEC_FIELDS: readonly string[];
 /**
  * The worker-identity fields {@link workflowKey} ALSO ignores (hamr 2026-10-04: Model is open on a reuse; the Name
  * chosen in Settings carries its provider and baseUrl with it). They stay inside {@link jobSpecHash}, so what the person

package/types/panel/authorroutes.d.ts

@@ -41,6 +41,9 @@ export function checkHumanGuard(req: import("node:http").IncomingMessage, { toke
  * @param {{ port: number, token: string, env?: Record<string,string|undefined>,
  *   sessionsRoot?: string, spawnFn?: typeof realSpawn, bareloopBin?: string,
  *   jobsDir?: string, fetchImpl?: typeof fetch, home?: string,
+ *   schedules?: ReturnType<typeof import('./schedules.js').createScheduleDoor>,
+ *   sessionDeps?: Record<string, any>,
+ *   runJobNames?: () => string[],
  *   startFrom?: {get: (runid: string, o?: {model?: string}) => any, getImport: (id: string, o?: {model?: string}) => any, listJobs?: (o?: {model?: string}) => any[]} }} opts
  */
 export function createAuthorRoutes(opts: {
@@ -53,6 +56,9 @@ export function createAuthorRoutes(opts: {
     jobsDir?: string;
     fetchImpl?: typeof fetch;
     home?: string;
+    schedules?: ReturnType<typeof import("./schedules.js").createScheduleDoor>;
+    sessionDeps?: Record<string, any>;
+    runJobNames?: () => string[];
     startFrom?: {
         get: (runid: string, o?: {
             model?: string;
@@ -67,6 +73,26 @@ export function createAuthorRoutes(opts: {
 }): {
     handle: (req: import("node:http").IncomingMessage, res: import("node:http").ServerResponse, pathname: string, body: any) => boolean;
     sessions: Map<string, any>;
+    headless: Map<string, any>;
+    startSession: (card: any, reuse: {
+        spec: any;
+        workflowKey: string;
+    } | null, inputs: import("../jobblock.js").JobInput[], o?: {
+        headless?: boolean;
+        filesJob?: boolean;
+    }) => Promise<{
+        ok: true;
+        session: ReturnType<typeof createSession>;
+    } | {
+        ok: false;
+        status: number;
+        error: string;
+    }>;
+    envNow: () => Record<string, string | undefined>;
+    spawnFn: typeof realSpawn;
+    bareloopBin: string;
+    /** a headless session the starter has removed from disk leaves its map too @param {string} id */
+    forgetHeadless: (id: string) => void;
 };
 /**
  * The panel's OWN 2-decimal money render for a chat line — hamr's ruling
@@ -89,7 +115,7 @@ export function panelMoney2(n: number): string;
  * it to sign"), and this is where it is checked, not trusted.
  * @param {ReturnType<typeof createSession>} session
  * @param {string} claimedHash
- * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string, home?: string}} o
+ * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string, home?: string, reviewDoor?: boolean, onSpawnError?: (e: Error) => void, onExit?: (code: number|null) => void}} o
  * @returns {{ok: boolean, error?: string, job?: string}}
  */
 export function signRun(session: ReturnType<typeof createSession>, claimedHash: string, o: {
@@ -98,10 +124,17 @@ export function signRun(session: ReturnType<typeof createSession>, claimedHash:
     bareloopBin: string;
     sessionsRoot?: string;
     home?: string;
+    reviewDoor?: boolean;
+    onSpawnError?: (e: Error) => void;
+    onExit?: (code: number | null) => void;
 }): {
     ok: boolean;
     error?: string;
     job?: string;
 };
+/** plain words for a run whose saved job no longer passes today's `validateJob` (RULED 2026-10-15): never the raw red codes */
+export const OLD_JOB_REUSE_WORDS: "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be reused. Start a new job instead.";
+export const OLD_JOB_RESUME_WORDS: "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be resumed. Use Reuse workflow on a newer run, or start a new job.";
+export const OLD_JOB_ACCEPT_WORDS: "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be accepted. Use Reuse workflow on a newer run, or start a new job.";
 import { spawn as realSpawn } from 'node:child_process';
 import { createSession } from './authorsession.js';