bareloop 0.42.0 → 0.44.0

package/src/panel/authorroutes.js

@@ -19,19 +19,27 @@
 
 import { randomBytes } from 'node:crypto';
 import { spawn as realSpawn } from 'node:child_process';
-import { openSync } from 'node:fs';
+import { openSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { readFileSync } from 'node:fs';
 import { planMatchesClose } from '../rubricstep.js';
-import { createSession, validateJobCard, validateReuseCard, lockedFieldChanged, buildReuseSpec, cardFields, STEP_LABELS } from './authorsession.js';
+import { createSession, validateJobCard, validateReuseCard, jobBoxesChanged, buildReuseSpec, cardFields, nextFreeJobName, startDestinationProblem, STEP_LABELS } from './authorsession.js';
 import { parseInputs } from '../jobblock.js';
-import { proveInputFiles, looksLikeRubricInput } from '../source.js';
+import { proveInputFiles, looksLikeRubricInput, webFetchState } from '../source.js';
 import { validateJob } from '../job.js';
+
+/** plain words for a run whose saved job no longer passes today's `validateJob` (RULED 2026-10-15): never the raw red codes */
+export const OLD_JOB_REUSE_WORDS = "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be reused. Start a new job instead.";
+export const OLD_JOB_RESUME_WORDS = "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be resumed. Use Reuse workflow on a newer run, or start a new job.";
+export const OLD_JOB_ACCEPT_WORDS = "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be accepted. Use Reuse workflow on a newer run, or start a new job.";
+export const OLD_JOB_RERUN_WORDS = "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be rerun. Use Reuse workflow on a newer run, or start a new job.";
+export const OLD_JOB_PAUSE_WORDS = "This run was made by an older bareloop. Its saved job doesn't pass today's checks, so it can't be paused from here. Use Reuse workflow on a newer run, or start a new job.";
 import { checkMonthlyRoom, monthlyRefusalText } from '../monthly.js';
 import { ConfigError } from '../config.js';
 import { keysForDoor, keysHome } from '../keysfile.js';
 import { endpointOf, judgePick, keyValueOf, rowsForHome, tickedLines } from '../providerrows.js';
 import { thinkingForLine } from '../thinking.js';
+import { panelMoney2 } from '../panelmoney.js';
 import { apiKeyProblem, checkProviderReachable } from '../providers.js';
 
 /** @returns {string} a fresh per-process token — never persisted, never logged */
@@ -85,6 +93,18 @@ export function checkHumanGuard(req, { token, port }) {
  * one; a terminal session is kept (so its chat/hash stay readable) but no
  * longer counts against the one-at-a-time rule.
  */
+/**
+ * PRD v1.106 Part 5 Q2: the "fetching the page..." step is done once the run's own refetch has written `refrozenAt` (source.json, written last).
+ * Settled when the state is read, so nothing polls and the step never stays running after the fetch.
+ * @param {any} state
+ */
+export function settleFetchingStep(state) {
+  const st = Array.isArray(state?.steps) ? state.steps.find((/** @type {any} */ x) => x.id === 'fetching') : null;
+  if (!st || st.status !== 'running') return;
+  const file = join(String(state.outDir), 'source-seed', 'source.json');
+  if (existsSync(file) && !webFetchState(file, st.since).fetching) st.status = 'done';
+}
+
 const TERMINAL_PHASES = new Set(['refused', 'abandoned', 'error', 'signed', 'signing-failed']);
 
 /**
@@ -95,6 +115,9 @@ const TERMINAL_PHASES = new Set(['refused', 'abandoned', 'error', 'signed', 'sig
  * @param {{ port: number, token: string, env?: Record<string,string|undefined>,
  *   sessionsRoot?: string, spawnFn?: typeof realSpawn, bareloopBin?: string,
  *   jobsDir?: string, fetchImpl?: typeof fetch, home?: string,
+ *   schedules?: ReturnType<typeof import('./schedules.js').createScheduleDoor>,
+ *   sessionDeps?: Record<string, any>,
+ *   runJobNames?: () => string[],
  *   startFrom?: {get: (runid: string, o?: {model?: string}) => any, getImport: (id: string, o?: {model?: string}) => any, listJobs?: (o?: {model?: string}) => any[]} }} opts
  */
 export function createAuthorRoutes(opts) {
@@ -110,8 +133,43 @@ export function createAuthorRoutes(opts) {
   /** @type {Map<string, ReturnType<typeof createSession>>} */
   const sessions = new Map();
 
+  /** Headless (scheduled) sessions live apart from the person's: neither blocks nor is blocked by the other (T I.5). Not addressable over HTTP. */
+  /** @type {Map<string, ReturnType<typeof createSession>>} */
+  const headless = new Map();
+
   const hasLiveSession = () => [...sessions.values()].some((s) => !TERMINAL_PHASES.has(s.state.phase));
 
+  /**
+   * THE one session start (T Part 4, C.4.2): prove the Inputs at $0, then create the session — the route's tail, factored so the
+   * HTTP route and the schedule starter share ONE function. A scheduled fire is exactly a Reuse the person did not click.
+   * `headless` puts the session in its own map and skips the one-live-session rule.
+   * @param {any} card the form (fields only)
+   * @param {{spec: any, workflowKey: string}|null} reuse
+   * @param {import('../jobblock.js').JobInput[]} inputs the parsed Inputs
+   * @param {{headless?: boolean}} [o]
+   * @returns {Promise<{ok: true, session: ReturnType<typeof createSession>}|{ok: false, status: number, error: string}>}
+   */
+  function startSession(card, reuse, inputs, o = {}) {
+    // ONE owner of "is this a rubric job on files": a reuse (and so a scheduled fire) reads it from the signed spec's verdict type,
+    // never from the card; a fresh job reads the card. A rubric job whose line 1 is a file or URL has no repo to prove inputs against;
+    // the session proves every line itself (`proveRubricInputs`), at $0, before any model call.
+    const rubric = reuse ? reuse.spec?.verdictType === 'soft-green' : card?.checkType === 'rubric';
+    if (reuse) card = { ...card, checkType: rubric ? 'rubric' : 'deterministic' };
+    const filesJob = rubric && inputs.length > 0 && looksLikeRubricInput(inputs[0].value);
+    return (filesJob ? Promise.resolve(/** @type {{ok: true}} */ ({ ok: true })) : proveInputFiles(inputs)).then((proof) => {
+      if (!proof.ok) return { ok: /** @type {false} */ (false), status: 400, error: proof.error };
+      if (!o.headless && hasLiveSession()) return { ok: /** @type {false} */ (false), status: 409, error: 'an authoring session is already live — one at a time' };
+      // the SAME Destination check the session runs, at $0, BEFORE the session (and its folder) exists
+      const destProblem = startDestinationProblem(card);
+      if (destProblem !== null) return { ok: /** @type {false} */ (false), status: 400, error: destProblem };
+      const session = createSession(cardFields(card), {
+        env: envNow(), sessionsRoot: opts.sessionsRoot, ...(opts.home !== undefined ? { home: opts.home } : {}), ...(reuse ? { reuse } : {}), ...(opts.sessionDeps ?? {}),
+      });
+      (o.headless ? headless : sessions).set(session.id, session);
+      return { ok: /** @type {true} */ (true), session };
+    }).catch((e) => ({ ok: /** @type {false} */ (false), status: 500, error: `could not check the inputs: ${/** @type {Error} */ (e)?.message ?? e}` }));
+  }
+
   /**
    * @param {import('node:http').IncomingMessage} req
    * @param {import('node:http').ServerResponse} res
@@ -217,10 +275,20 @@ export function createAuthorRoutes(opts) {
       const pre = sp.has('import') ? opts.startFrom.getImport(sp.get('import') ?? '', asModel) : opts.startFrom.get(runid, asModel);
       if (pre === null) { send(404, { ok: false, error: 'no such run' }); return true; }
       if (!pre.ok) { send(409, pre); return true; }
+      // the card of a SCHEDULED job opens with the folder that schedule delivers to (a plain-files job keeps it on the schedule, not in the spec)
+      const sched = sp.get('mode') === 'schedule' && opts.schedules ? opts.schedules.readSchedule(pre.origin.job) : null;
+      const card = typeof sched?.destination === 'string' ? { ...pre.card, destination: sched.destination } : pre.card;
       send(200, {
-        ok: true, origin: pre.origin, card: pre.card, from: pre.from, note: pre.note,
-        locked: pre.locked, open: pre.open, specHash: pre.specHash, workflowKey: pre.workflowKey, trackRecord: pre.trackRecord,
+        ok: true, origin: pre.origin, card, from: pre.from, note: pre.note,
+        // ONE door (v1.101): `green` = the origin earned a real green (an imported job counts), so an unchanged job reuses the signed plan;
+        // `nextName` = the Job name box once a job box changes (the box shows the origin's name until then). Nothing is locked.
+        green: pre.origin.importId !== undefined || pre.outcome === 'green' || pre.outcome === 'already-green',
+        nextName: nextFreeJobName(pre.origin.job, opts.runJobNames ? opts.runJobNames() : [], { jobsDir: opts.jobsDir }),
+        specHash: pre.specHash, workflowKey: pre.workflowKey, trackRecord: pre.trackRecord,
         line: pre.line, specNamesModel: pre.specNamesModel, specWorker: pre.specWorker,
+        // T Part 3: `mode=schedule` also returns the job's current schedule (data only) for the When field's prefill; Part 7 adds the
+        // card's own words (`scheduleCard`: now / refusal / the button table). A reuse never touches a schedule (v1.100).
+        ...(sp.get('mode') === 'schedule' && opts.schedules ? { schedule: opts.schedules.read(pre.origin.job), scheduleCard: opts.schedules.cardFor(pre.origin.job) } : {}),
       });
       return true;
     }
@@ -236,11 +304,23 @@ export function createAuthorRoutes(opts) {
       return true;
     }
 
+    // ── T Part 3: the schedule door, two clicks, both $0 (no drafter, no run, no provider call). Click 1 signs and
+    // writes nothing; click 2 carries the hash it was shown. `when: null` cancels (never refused). Placed with the
+    // other exact matches, before the session regex below.
+    if (pathname === '/api/author/schedule-prepare' || pathname === '/api/author/schedule') {
+      if (!opts.schedules) { send(404, { ok: false, error: 'not found' }); return true; }
+      if (req.method !== 'POST') { send(405, { ok: false, error: 'POST only' }); return true; }
+      const r = pathname.endsWith('-prepare') ? opts.schedules.prepare(body ?? {}) : opts.schedules.set(body ?? {});
+      send(r.status, r.body);
+      return true;
+    }
+
     // A refreshed page re-attaches to the one live (non-terminal) session: its id and state (card, messages, steps),
     // or `null`. The server's session map is the only truth; nothing is stored page-side.
     if (pathname === '/api/author/live') {
       if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
       const live = [...sessions.values()].find((s) => !TERMINAL_PHASES.has(s.state.phase));
+      if (live) settleFetchingStep(live.state);
       send(200, { ok: true, sessionId: live ? live.state.id : null, state: live ? live.state : null });
       return true;
     }
@@ -250,11 +330,15 @@ export function createAuthorRoutes(opts) {
       if (hasLiveSession()) { send(409, { ok: false, error: 'an authoring session is already live — one at a time' }); return true; }
       const card = body ?? {};
       const rows = rowsForHome(keysHome(opts.home), envNow());
-      // Reuse workflow — started from a green run or an imported job: only Source, Destination and the two caps may
-      // differ from the signed workflow. The SERVER refuses any other change (the page greys those boxes, but is
-      // never trusted); the spec it signs is a copy of the origin's with just those four set. Nothing is drafted.
+      // Reuse workflow, ONE DOOR (v1.101): every box is open; the CARD's job boxes (job text, check type, thinking) are compared with
+      // the origin run's. A GREEN origin (or an imported job) with no job box changed signs the origin's plan verbatim, under the
+      // origin's name, with no drafting. Any other start drafts: a changed job is a NEW workflow under the Job name box; an unchanged
+      // job from a run that is neither green nor already-green drafts again under the ORIGIN's name (another try of the same job). The name is decided
+      // here, before drafting, so the hash the person signs already covers it. The server never trusts the page.
       /** @type {{spec: any, workflowKey: string}|null} */
       let reuse = null;
+      /** @type {string|undefined} */
+      let allowName;
       const from = card.startFrom;
       const fromRunid = typeof from === 'string' ? from : (typeof from?.runid === 'string' ? from.runid : null);
       const fromImport = typeof from?.importId === 'string' ? from.importId : null;
@@ -262,42 +346,43 @@ export function createAuthorRoutes(opts) {
         const pre = opts.startFrom ? (fromImport !== null ? opts.startFrom.getImport(fromImport) : opts.startFrom.get(fromRunid)) : null;
         if (pre === null || pre === undefined) { send(404, { ok: false, error: 'no such run to reuse' }); return true; }
         if (!pre.ok) { send(409, pre); return true; }
-        // only a run that earned a real green is a reuse source (hamr 2026-10-08) — the pickers already filter, but a
-        // hand-made POST must not sign a reuse of an already-green, red or still-running run. Imports are green by ruling;
-        // Edit in chat and Resume only READ start-from (GET) and never post a startFrom, so this gate never touches them.
-        if (fromImport === null && pre.outcome !== 'green') {
-          send(409, { ok: false, error: 'only a run that finished green can be reused — this one did not' });
-          return true;
+        const changed = jobBoxesChanged(card, pre.card);
+        if (changed) {
+          // a NEW workflow: its name may not be any existing job's, the origin's included (a different job cannot pass for the old one)
+          if (typeof card.jobName === 'string' && (card.jobName === pre.origin.job || (opts.runJobNames && opts.runJobNames().includes(card.jobName)))) {
+            send(400, { ok: false, error: `A job named "${card.jobName}" already exists and is a different job. Pick another name.` });
+            return true;
+          }
+        } else {
+          // a scheduled run's green waits for the person's Accept (quarantine): its plan is neither reused nor re-drafted until then
+          if (pre.outcome === 'green-held') { send(409, { ok: false, error: 'This run was started by a schedule and is waiting for your Accept. Accept it first, then it can be reused.' }); return true; }
+          card.jobName = pre.origin.job; // an unchanged job keeps its name; a typed one is ignored
+          if (fromImport !== null || pre.outcome === 'green' || pre.outcome === 'already-green') {
+            const rv = validateReuseCard(card, { rows });
+            if (!rv.ok) { send(400, { ok: false, error: rv.error }); return true; }
+            const spec = buildReuseSpec(pre.spec, card, rows);
+            // validateJob can THROW (not only red) on a saved job the guard-battery lookup no longer admits: same plain words, never a raw 500
+            /** @type {ReturnType<typeof validateJob>|null} */
+            let jv = null;
+            try { jv = validateJob(spec, { shellCapUsd: spec.budgetUsd }); } catch { jv = null; }
+            // RULED 2026-10-15: an old run's saved job that fails today's checks gets plain words; the raw red codes ride in `reds`, which the page never shows
+            if (jv === null || !jv.ok) { send(400, { ok: false, error: OLD_JOB_REUSE_WORDS, reds: jv === null ? [] : jv.reds.map((r) => `${r.code} at ${r.path}`) }); return true; }
+            reuse = { spec, workflowKey: pre.workflowKey };
+          } else allowName = pre.origin.job;
         }
-        const locked = lockedFieldChanged(card, pre.card);
-        if (locked !== null) { send(400, { ok: false, error: `${locked} is locked on a reused workflow — Clear the card to change it` }); return true; }
-        const rv = validateReuseCard(card, { rows });
-        if (!rv.ok) { send(400, { ok: false, error: rv.error }); return true; }
-        const spec = buildReuseSpec(pre.spec, card, rows);
-        const jv = validateJob(spec, { shellCapUsd: spec.budgetUsd });
-        if (!jv.ok) { send(400, { ok: false, error: `the spec this reuse would sign is not valid (${jv.reds.map((r) => `${r.code} at ${r.path}`).join('; ')})` }); return true; }
-        reuse = { spec, workflowKey: pre.workflowKey };
       }
       if (reuse === null) {
-        const v = validateJobCard(card, { jobsDir: opts.jobsDir, rows });
+        const v = validateJobCard(card, { jobsDir: opts.jobsDir, rows, ...(allowName !== undefined ? { allowName } : {}) });
         if (!v.ok) { send(400, { ok: false, error: v.error }); return true; }
       }
       // P7: the Inputs are proven at $0 before a session (so before any token): line 1 the repo, lines 2+ tracked files inside it.
       // A miss is a plain 400 naming the line, shown under the card exactly like every other refused start.
       const ip = parseInputs(card.inputs);
       if (!ip.ok) { send(400, { ok: false, error: ip.error }); return true; }
-      // Part 1a: a rubric job whose first input is a local FILE has no repo to prove inputs against; the session proves every
-      // line itself (`proveRubricInputs`), at $0, before any model call
-      const filesJob = reuse === null && card?.checkType === 'rubric' && looksLikeRubricInput(ip.inputs[0].value);
-      (filesJob ? Promise.resolve(/** @type {{ok: true}} */ ({ ok: true })) : proveInputFiles(ip.inputs)).then((proof) => {
-        if (!proof.ok) { send(400, { ok: false, error: proof.error }); return; }
-        if (hasLiveSession()) { send(409, { ok: false, error: 'an authoring session is already live — one at a time' }); return; }
-        const session = createSession(cardFields(card), {
-          env: envNow(), sessionsRoot: opts.sessionsRoot, ...(opts.home !== undefined ? { home: opts.home } : {}), ...(reuse ? { reuse } : {}),
-        });
-        sessions.set(session.id, session);
-        send(200, { ok: true, sessionId: session.id, reuse: reuse !== null, state: session.state });
-      }).catch((e) => { send(500, { ok: false, error: `could not check the inputs: ${/** @type {Error} */ (e)?.message ?? e}` }); });
+      startSession(card, reuse, ip.inputs).then((r) => {
+        if (!r.ok) { send(r.status, { ok: false, error: r.error }); return; }
+        send(200, { ok: true, sessionId: r.session.id, reuse: reuse !== null, state: r.session.state });
+      });
       return true;
     }
 
@@ -309,6 +394,7 @@ export function createAuthorRoutes(opts) {
 
     if (sub === null) {
       if (req.method !== 'GET') { send(405, { ok: false, error: 'GET only' }); return true; }
+      settleFetchingStep(session.state);
       send(200, { ok: true, state: session.state });
       return true;
     }
@@ -336,7 +422,7 @@ export function createAuthorRoutes(opts) {
     }
     if (sub === 'sign') {
       const claimedHash = String(body?.specHash ?? '');
-      const r = signRun(session, claimedHash, { env: envNow(), spawnFn, bareloopBin, sessionsRoot: opts.sessionsRoot, home: opts.home });
+      const r = signRun(session, claimedHash, { env: envNow(), spawnFn, bareloopBin, sessionsRoot: opts.sessionsRoot, home: opts.home, ...(opts.schedules ? { schedules: opts.schedules } : {}) });
       send(r.ok ? 200 : 400, r);
       return true;
     }
@@ -344,31 +430,14 @@ export function createAuthorRoutes(opts) {
     return true;
   }
 
-  return { handle, sessions };
+  return {
+    handle, sessions, headless, startSession, envNow, spawnFn, bareloopBin,
+    /** a headless session the starter has removed from disk leaves its map too @param {string} id */
+    forgetHeadless: (id) => { headless.delete(id); },
+  };
 }
 
-/**
- * The panel's OWN 2-decimal money render for a chat line — hamr's ruling
- * 2026-09-28 (2nd addendum, panel money 2-decimals): a positive amount below
- * a cent reads `<$0.01`, never `$0.00` (a real cost must never read as
- * free). This is the server-side (Node, chat-text) sibling of
- * `src/panel/index.html`'s own inline `panelMoney` — the two can't share
- * code (one runs in the browser as inlined script, the other in Node), the
- * same duplication `src/replay.js`'s `money()`/`index.html`'s `money()`
- * already carry, so both apply the identical rule rather than drift.
- * @param {number} n a non-negative dollar amount
- * @returns {string}
- */
-export function panelMoney2(n) {
-  if (n > 0 && n < 0.01) return '<$0.01';
-  // two-step rounding (matching index.html's own panelMoney): clean to
-  // 6-decimal precision first (the same precision src/text.js's tallyCalls
-  // sums to) before rounding to cents, so a summed float landing just under
-  // an exact cent boundary is never mis-rounded.
-  const clean = Math.round(n * 1e6) / 1e6;
-  const cents = Math.round(clean * 100 + 1e-6);
-  return `$${(cents / 100).toFixed(2)}`;
-}
+export { panelMoney2 };
 
 /**
  * THE ONLY function in this file (or anywhere in the panel) that spawns a
@@ -378,7 +447,7 @@ export function panelMoney2(n) {
  * it to sign"), and this is where it is checked, not trusted.
  * @param {ReturnType<typeof createSession>} session
  * @param {string} claimedHash
- * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string, home?: string}} o
+ * @param {{env: any, spawnFn: typeof realSpawn, bareloopBin: string, sessionsRoot?: string, home?: string, reviewDoor?: boolean, onSpawnError?: (e: Error) => void, onExit?: (code: number|null) => void}} o
  * @returns {{ok: boolean, error?: string, job?: string}}
  */
 export function signRun(session, claimedHash, o) {
@@ -430,6 +499,8 @@ export function signRun(session, claimedHash, o) {
     'systemd-inhibit', '--why=bareloop panel run',
     process.execPath, o.bareloopBin,
     'run-u', '--spec', session.state.resolvedSpecPath, '--approve', session.state.specHash,
+    // T (F.1): a scheduled run opens the review door even when deterministic, so its green waits for the person's Accept
+    ...(o.reviewDoor === true ? ['--review-door'] : []),
     ...(draftSpentUsd !== null ? ['--draft-spent-usd', String(draftSpentUsd), ...(draftIncomplete ? ['--draft-spend-incomplete'] : [])] : []),
   ];
   /** @type {number|null} */
@@ -439,6 +510,8 @@ export function signRun(session, claimedHash, o) {
     detached: true, stdio: ['ignore', logFd ?? 'ignore', logFd ?? 'ignore'], env: o.env,
   });
   if (typeof child?.unref === 'function') child.unref();
+  if (o.onSpawnError && typeof child?.once === 'function') child.once('error', o.onSpawnError);
+  if (o.onExit && typeof child?.once === 'function') child.once('exit', o.onExit);
   session.state.phase = 'signed';
   // hamr 2026-10-05: the sign shows as the last step of the one progress list, never as a thread bubble
   // hamr 2026-10-05 (option A): the drafting-spend line is that step's detail — nothing when there was no drafting spend (a Reuse)
@@ -446,5 +519,10 @@ export function signRun(session, claimedHash, o) {
     ? `drafting spent ${draftIncomplete ? 'at least ' : ''}${panelMoney2(draftSpentUsd)} (folds out of the run's own cap)`
     : '';
   if (Array.isArray(session.state.steps)) session.state.steps.push({ id: 'signed', label: STEP_LABELS.signed, status: 'done', detail: draftLine });
+  // PRD v1.106 Part 5 Q2: a run with a web input fetches the page again before its log exists (3-5 s of silence): say so, next to the sign step
+  const sinceIso = new Date().toISOString();
+  if (Array.isArray(session.state.steps) && webFetchState(join(session.state.outDir, 'source-seed', 'source.json'), sinceIso).hasWeb) {
+    session.state.steps.push({ id: 'fetching', label: STEP_LABELS.fetching, status: 'running', since: sinceIso });
+  }
   return { ok: true, job: session.state.resolvedSpecPath };
 }

package/src/panel/authorsession.js

@@ -53,6 +53,7 @@ import { closeJudges } from '../kinds.js';
 import { RUBRIC_LANG } from '../authoring.js';
 import { rubricGoal, reconcileRubricPlan } from '../rubricstep.js';
 import { redactSecrets } from '../validate.js';
+import { isDropIt, isAgree } from '../pagemap.js';
 import { tallyCalls } from '../text.js';
 import { writeDraftSpend, appendDraftLog } from '../draftspend.js';
 import { PLAIN_PROPOSAL_STOPS, proposalStopText, signingStopText, draftStopText, redsRecord, declarationRecord, calibrationSummary, tryRefusedText } from '../authorreadout.js';
@@ -85,6 +86,7 @@ export const STEP_LABELS = Object.freeze({
   gates: 'checking signing gates',
   hash: 'generating hash',
   signed: 'signed hash',
+  fetching: 'fetching the page…',
 });
 
 /**
@@ -198,6 +200,25 @@ export function jobNameTaken(name, opts = {}) {
   } catch { return false; }
 }
 
+/**
+ * The next free name for a NEW workflow made from `origin` (RULED 2026-10-15, v1.101): `<base>-N`, N the next free number from 2.
+ * Base: when the origin ends in `-<digits>` AND the part before it is itself a job (in the run list or jobs/), that part (so `x-2`
+ * suggests `x-3`, never `x-2-2`); else the origin's own name. Free = not a run-list job and not {@link jobNameTaken}.
+ * @param {string} origin
+ * @param {Iterable<string>} runJobs job names in the panel's run list
+ * @param {{jobsDir?: string}} [opts] test seam for {@link jobNameTaken}
+ * @returns {string}
+ */
+export function nextFreeJobName(origin, runJobs, opts = {}) {
+  const used = new Set(runJobs);
+  const m = /^(.+)-\d+$/.exec(origin);
+  const base = m && (used.has(m[1]) || jobNameTaken(m[1], opts)) ? m[1] : origin;
+  for (let n = 2; ; n += 1) {
+    const name = `${base}-${n}`;
+    if (!used.has(name) && !jobNameTaken(name, opts)) return name;
+  }
+}
+
 /** the form's fields, in card order — what `card.json` stores, verbatim (P5 item 3) */
 export const CARD_FIELDS = Object.freeze(['jobName', 'checkType', 'provider', 'model', 'thinking', 'jobText', 'inputs', 'destination', 'capUsd', 'maxWallMs']);
 
@@ -225,30 +246,25 @@ export function cardFields(card) {
 }
 
 /**
- * REUSE WORKFLOW (hamr 2026-10-03, replaces P5 item 3's same-job rule; Model opened 2026-10-04): a reuse card has exactly
- * FIVE open boxes — Inputs, Destination, Model, $ cap, Time cap — and every other box is the signed workflow, shown greyed and never
- * editable. The page greys them; THIS is what refuses (the server never trusts the page). Changing any locked box
- * is a different job: Clear the card, which drafts.
+ * REUSE WORKFLOW, ONE DOOR (RULED 2026-10-15, v1.101; replaces v1.88's five open boxes). Every box on the card is open. What decides
+ * the path is the CARD compared with the origin run's card, never the drafted spec: the JOB boxes are the job text (numbered lines,
+ * `~` rules, `~ PASS`/`~ FAIL`), the check type and the thinking tick. The RUN boxes (Inputs, Destination, Model, $ cap, Time cap)
+ * never decide it. A green origin with no job box changed reuses the signed plan verbatim (no drafting); anything else drafts.
  */
-export const REUSE_OPEN_FIELDS = Object.freeze(['inputs', 'destination', 'model', 'capUsd', 'maxWallMs']);
-/** every card field that is NOT open on a reuse card, in card order */
-export const REUSE_LOCKED_FIELDS = Object.freeze(CARD_FIELDS.filter((f) => !REUSE_OPEN_FIELDS.includes(f)));
-const REUSE_LABELS = Object.freeze(/** @type {Record<string, string>} */ ({
-  jobName: 'Job name', checkType: 'Check type', jobText: 'The job',
-}));
+export const JOB_BOXES = Object.freeze(['jobText', 'checkType', 'thinking']);
 
 /**
- * The first LOCKED box on `card` that differs from what the signed workflow prefilled (`origin`), or `null` when
- * every locked box is untouched. Blank and absent read alike; whitespace is not compared.
+ * Did any JOB box on `card` change from what the origin run prefilled (`origin`)? Whitespace is not compared (a one-line input drops
+ * a text's newlines); an absent thinking tick reads as off.
  * @param {Record<string, any>} card the form as it was submitted
  * @param {Record<string, any>} origin the form as the server prefilled it
- * @returns {string|null} the offending field's label
+ * @returns {boolean}
  */
-export function lockedFieldChanged(card, origin) {
-  // whitespace is ignored: a one-line <input> drops a goal's newlines, and the signed copy never takes text from the card anyway
-  const norm = (/** @type {any} */ v) => (v === undefined || v === null ? '' : (typeof v === 'string' ? v.replace(/\s+/g, '') : v));
-  const bad = REUSE_LOCKED_FIELDS.find((f) => norm(card?.[f]) !== norm(origin?.[f]));
-  return bad === undefined ? null : (REUSE_LABELS[bad] ?? bad);
+export function jobBoxesChanged(card, origin) {
+  const text = (/** @type {any} */ v) => (typeof v === 'string' ? v.replace(/\s+/g, '') : '');
+  return text(card?.jobText) !== text(origin?.jobText)
+    || (card?.checkType === 'rubric') !== (origin?.checkType === 'rubric')
+    || (card?.thinking === true) !== (origin?.thinking === true);
 }
 
 /**
@@ -267,7 +283,9 @@ export function lockedFieldChanged(card, origin) {
  */
 export function buildReuseSpec(originSpec, card, rows) {
   const spec = JSON.parse(JSON.stringify(originSpec));
-  spec.writeScope = String(card.destination ?? '').split(/[,\n]/).map((x) => x.trim()).filter(Boolean);
+  // an ABSOLUTE Destination is a per-run output folder (a plain-files job): it is never part of the signed spec, and the spec's own
+  // fence (inside the run's tree) stays as signed. A repo job's Destination is the fence and is relative (an absolute one is refused).
+  if (!isAbsoluteDestination(String(card.destination ?? '').trim())) spec.writeScope = String(card.destination ?? '').split(/[,\n]/).map((x) => x.trim()).filter(Boolean);
   const ip = parseInputs(card.inputs);
   if (ip.ok) spec.inputs = ip.inputs; else delete spec.inputs;
   spec.budgetUsd = card.capUsd;
@@ -310,6 +328,27 @@ const isAbsoluteDestination = (destination) => /^(\/|[a-zA-Z]:[\\/])/.test(desti
 
 export { nonRepoSourceMessage };
 
+/** the refusal for a plain-files rubric job whose Destination is not an absolute folder (ends with the words the session start shows) */
+export const FILES_DESTINATION_WORDS = 'Destination must be the full path of a folder, like /home/me/out — the finished files are delivered there. Nothing spent.';
+
+/**
+ * THE ONE Destination check of a session start, at $0, before any session, copy or model call. The session's own pipeline, the HTTP
+ * start (`startSession`), the schedule's two clicks and a scheduled fire's `wouldAccept` all call THIS (never a copy of it), so a start
+ * that would be refused for its Destination is refused before anything is made.
+ * @param {{inputs?: unknown, destination?: unknown, checkType?: unknown}} card the Inputs text (line 1 = the source), the Destination and the check type
+ * @returns {string|null} the plain refusal, or null when the Destination is fine
+ */
+export function startDestinationProblem(card) {
+  const ip = parseInputs(card?.inputs);
+  const source = ip.ok ? (ip.inputs[0]?.value ?? '') : '';
+  const destination = typeof card?.destination === 'string' ? card.destination : '';
+  const isRepoLike = looksLikeRepoSource(source);
+  const repo = repoDestinationProblem(destination, isRepoLike);
+  if (repo !== null) return repo;
+  if (card?.checkType === 'rubric' && !isRepoLike && !isAbsoluteDestination(destination)) return FILES_DESTINATION_WORDS;
+  return null;
+}
+
 /**
  * The ONE Destination rule for a REPO source (fresh card and Reuse card alike): there Destination is the write fence,
  * relative to the repo, so an absolute path is refused — at $0, before any copy or model call. A FOLDER source (or a
@@ -327,14 +366,14 @@ export function repoDestinationProblem(destination, isRepoLike) {
  * creates a session or spends anything — never inside the async pipeline,
  * so a bad card refuses synchronously, in the same HTTP response.
  * @param {any} card
- * @param {{jobsDir?: string, rows?: readonly import('../providerrows.js').KeyRow[]}} [opts] `rows` = the Settings rows (the Model menu); jobsDir is a server-side test seam — NEVER read off the client card
+ * @param {{jobsDir?: string, allowName?: string, rows?: readonly import('../providerrows.js').KeyRow[]}} [opts] `rows` = the Settings rows (the Model menu); jobsDir is a server-side test seam — NEVER read off the client card; `allowName` = the origin job's own name on an unchanged red Reuse (it is the same job, not a collision)
  * @returns {{ok: true}|{ok: false, error: string}}
  */
 export function validateJobCard(card, opts = {}) {
   if (!card || typeof card !== 'object') return { ok: false, error: 'missing job card' };
   const { jobName, checkType, model, destination, capUsd } = card;
   if (!isSlug(jobName)) return { ok: false, error: 'Job name must be a kebab-case slug (letters, digits, dashes)' };
-  if (jobNameTaken(jobName, { jobsDir: opts.jobsDir })) {
+  if (jobName !== opts.allowName && jobNameTaken(jobName, { jobsDir: opts.jobsDir })) {
     return { ok: false, error: `a job named "${jobName}" already exists — P3 is new jobs only (Q4=A)` };
   }
   if (checkType !== 'deterministic' && checkType !== 'rubric') return { ok: false, error: 'Check type must be deterministic or rubric' };
@@ -502,7 +541,20 @@ export function createSession(card, deps = {}) {
    * @param {{kind: string, [k: string]: any}} step
    * @returns {Promise<string|null>}
    */
-  const ask = (step) => new Promise((resolveFn) => {
+  const ask = (step) => new Promise((resolveFn0) => {
+    // PRD v1.106 Part 5 Q1: every question the person answers (the confirm card's, the early look ask, the last-try ask) is one `human` row in the
+    // drafting log, with the answer secret-masked BEFORE it is written. Written only when the answer exists (a blank one re-asks and leaves nothing).
+    const resolveFn = step.kind !== 'answer' ? resolveFn0 : (/** @type {string|null} */ value) => {
+      const said = value === null ? '' : redactSecrets(String(value).trim());
+      if (said !== '' && typeof step.question === 'string') {
+        const running = state.steps.findLastIndex((/** @type {any} */ x) => x.status === 'running');
+        appendDraftLog(outDir, {
+          kind: 'human', no: running === -1 ? Math.max(0, state.steps.length - 1) : running, source: typeof step.source === 'string' ? step.source : 'confirm',
+          question: redactSecrets(step.question), answer: said, ...(Number.isInteger(step.line) ? { line: step.line } : {}), at: new Date().toISOString(),
+        });
+      }
+      resolveFn0(value);
+    };
     state.pendingAsk = step;
     resolvePending = resolveFn;
     if (step.kind === 'language') say('bot', `${step.field?.prompt ?? 'Which language is this job about?'} (${(step.candidates ?? []).join(', ')})`);
@@ -602,6 +654,8 @@ export function createSession(card, deps = {}) {
       kind: 'call', no: callNo, step: state.steps[callNo]?.id ?? null, label: call.label, model: draftIdentity?.model ?? null,
       thinking: draftThinkingPlan === null ? null : draftThinkingPlan.mode, thinkingSupport: draftThinkingPlan === null ? null : draftThinkingPlan.support,
       ...(call.thinkingStatus === undefined ? {} : { thinkingStatus: call.thinkingStatus }),
+      // idea A core: the page-word map's scrubbed answer (src/pagemap.js) - unsigned, kept so a run can be replayed at $0
+      ...(typeof call.raw === 'string' ? { raw: call.raw } : {}),
       costUsd: call.costUsd ?? null, unpricedRounds: call.unpricedRounds ?? 0, at: nowIso,
     });
     try {
@@ -685,7 +739,7 @@ export function createSession(card, deps = {}) {
     // line is one file, frozen by `proveRubricInputs`; there is no repo, no language and no scout (docs/product/ITEM33-BUILD.md)
     const RUBRIC_FILES = card.checkType === 'rubric' && !isRepoLike;
     // hamr's ruling B (2026-10-05): ONE rule for both a fresh card and a reuse card, at $0, before the copy and any model call
-    const destProblem = repoDestinationProblem(card.destination, isRepoLike);
+    const destProblem = startDestinationProblem(card);
     if (destProblem !== null) { refuse(destProblem); return; }
 
     state.phase = 'preparing-source';
@@ -707,10 +761,6 @@ export function createSession(card, deps = {}) {
     // fence read as a directory and refused as "not absolute" — hiding the real problem with the Source. A scope-shaped
     // (relative) Destination is therefore handed to the door only when the source is repo-like.
     const destIsDir = isAbsoluteDestination(card.destination);
-    if (RUBRIC_FILES && !destIsDir) {
-      refuse('Destination must be the full path of a folder, like /home/me/out — the finished files are delivered there. Nothing spent.');
-      return;
-    }
     /** @type {any} */
     let prep;
     if (RUBRIC_FILES) {
@@ -945,7 +995,6 @@ export function createSession(card, deps = {}) {
       model: modelChoice.name,
       // the "Thinking on" tick is signed ONLY when ticked (unticked writes no field: the hash stays what it would have been)
       ...(card.thinking === true && draftThinkingPlan?.support !== false ? { thinking: true } : {}),
-      cadence: { unit: 'day', every: 1 },
       budgetUsd: card.capUsd,
       ...(typeof card.maxWallMs === 'number' ? { maxWallMs: card.maxWallMs } : {}),
       writeScope,
@@ -989,27 +1038,34 @@ export function createSession(card, deps = {}) {
     // ask path as every other (the chat box + Send); the answer is REQUIRED (a blank one asks again, there is no skip) and is
     // added WORD FOR WORD as a `~` rule on the job line it names — never rewritten. The lines are mutated in place, so the
     // signed `jobLines`, the answers text and the plan card all read the same words.
-    const answerQuestions = async (/** @type {{questions: {line: number, question: string}[], dropped: {reason: string, raw: any}[], confirmed: any}} */ o) => {
+    const answerQuestions = async (/** @type {{questions: {line: number, question: string, rule?: number, source?: string, ask?: string, reading?: string}[], dropped: {reason: string, raw: any}[], confirmed: any}} */ o) => {
       if (o.dropped.length) appendDraftLog(outDir, { kind: 'questions-dropped', no: Math.max(0, state.steps.length - 1), dropped: o.dropped, at: new Date().toISOString() });
       const total = o.questions.length;
+      /** @type {{line: number, rule: number}[]} */
+      const left = [];
       for (let k = 0; k < total; k += 1) {
         const q = o.questions[k];
         let text = '';
         for (;;) {
-          const a = await ask({ kind: 'answer', index: k + 1, total, question: q.question, line: q.line });
+          const a = await ask({ kind: 'answer', source: typeof q.source === 'string' ? q.source : 'try-3', index: k + 1, total, question: q.question, line: q.line });
           if (a === null) return null;
           // one `~` line is one line: the person's own words, newlines folded to spaces, nothing else touched
           text = String(a).replace(/\s*\n\s*/g, ' ').trim();
           if (text) break;
           say('bot', 'An answer is needed here — there is no skip. Type it in the box below and press Send.');
         }
+        // PRD v1.107 Part 5b: a code-forced look question about a `~` rule. A can't-check ask answered "drop it" adds NO rule; the caller puts that
+        // rule on the look's Not checked list. A reading ask answered "agree" adds the code's reading, in plain words, as the `~` rule (so the
+        // bound is now the person's own words); anything else typed is the person's own rule, word for word.
+        if (q.source === 'look' && q.ask === 'reading' && typeof q.reading === 'string' && isAgree(text)) text = q.reading;
+        if (q.source === 'look' && q.ask === 'cant-check' && Number.isInteger(q.rule) && isDropIt(text)) { left.push({ line: q.line, rule: /** @type {number} */ (q.rule) }); continue; }
         const line = jobLines.find((l) => l.n === q.line);
         if (line) { line.rule = line.rule ? `${line.rule}; ${text}` : text; line.rules.push(text); }
       }
       draft.jobLines = signedJobLines(jobLines);
       answers[1] = renderJobLines(jobLines);
-      state.messages.push({ ...planMessage(o.confirmed ?? {}, jobLines), text: 'Your answers are in as ~ rules on those job lines. Drafting again.' });
-      return { jobLines, answers };
+      state.messages.push({ ...planMessage(o.confirmed ?? {}, jobLines), text: left.length === total ? 'Noted: those stay Not checked. Drafting.' : 'Your answers are in as ~ rules on those job lines. Drafting again.' });
+      return { jobLines, answers, left };
     };
 
     state.phase = 'drafting';