bareloop 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -7,6 +7,30 @@ feature lands, **patch** = docs, fixes, scaffolding.
 
 ## [Unreleased]
 
+## [0.5.1] — 2026-07-24
+
+### Added
+- **Layer R wired into the plan-v1 flow** (F50). The within-run ratchet (`layerRoot`) now
+  engages in `runPlan` — one root per EXECUTE step (red-set = the exit evaluator's own gap)
+  AND in the outer close-fix loop (red-set = the close's own `gapKeep`) — not only on the
+  legacy `steps[]` path. So a plan-shape job can emit `root-injected` and the pre-registered
+  ON-vs-OFF default-flip read becomes possible on the accepted surface. The write-tee is wired
+  so same-path target rewrites are visible to the detector. Still OFF by default (`layerRoot:
+  false`, F41). Excluded on native/clipipe (no `onToolResult` seam — F48 fallback surface).
+
+### Fixed
+- **F49 (security-hardening): the agent-authored `artifact-written` regex can no longer hang
+  the exit evaluator.** `plan.js` rejects nested-quantifier ReDoS patterns (`(a+)+`, `(\d*)*`,
+  `(x+){1,}`, and redundant-wrapper forms like `((a+))+` / `(?:(a+))*` / `(((a+)))+`) at the
+  validation gate, before any tokens burn. The wrapper class was a review-caught false negative
+  in the first (flat-only) scan — each measured to hang `RegExp.test` >8s on ~29 chars — closed
+  by propagating an inner repeat up through the enclosing group; the change is MONOTONIC (it only
+  ever adds rejections, the fail-safe direction, and cannot introduce a new false negative). LOW
+  self-DoS, no arbiter compromise; input-bounding was rejected as theater (a 33-char body hangs)
+  and a JS regex timeout as disproportionate (worker/RE2 dep).
+- **F50: `runJob` no longer silently ignores `layerRoot` for plan-shape jobs** (was accepted
+  and dropped — an advertised no-op).
+
 ## [0.5.0] — 2026-07-23
 
 ### Added

package/bareloop.context.md

@@ -173,7 +173,7 @@ middle writes; `validatePlan` gates it against the SIGNED job spec before tokens
 | `steps[].tools` | non-empty unique subset of the SPEC ceiling | a verb beyond the ceiling reds `verb-escape` with the verb as structured data (overreach, distinct from the operator-side `request-red`); `run` is `verb-escape` at every layer |
 | `steps[].rounds` | int 1..shell cap (default 40) | the step's per-attempt tool-round bound (the Gate's `maxTurns` natively) |
 | `steps[].target` | path inside the fence | v1.18 deliverable; REQUIRED on write-granted steps |
-| `steps[].exit` | 1..2 items (`MAX_EXITS_PER_STEP`), ALL must pass (AND-only, no OR/NOT) | closed menu (`EXIT_TYPES`): `artifact-written(path, pattern?)` · `tree-changed(scope)` · `json-valid(path)` · `check-passes(name)`. `check-passes` must name a SIGNED check (`check-unknown` red names the signed menu); on a write-granted step it must be paired with `tree-changed` (`exit-illegal` — the seed tree is green, a lone check would pass untouched, F17/F46). Exits verify FORM, not truth — progress gates; the operator's close stays the one arbiter |
+| `steps[].exit` | 1..2 items (`MAX_EXITS_PER_STEP`), ALL must pass (AND-only, no OR/NOT) | closed menu (`EXIT_TYPES`): `artifact-written(path, pattern?)` · `tree-changed(scope)` · `json-valid(path)` · `check-passes(name)`. `check-passes` must name a SIGNED check (`check-unknown` red names the signed menu); on a write-granted step it must be paired with `tree-changed` (`exit-illegal` — the seed tree is green, a lone check would pass untouched, F17/F46). `artifact-written.pattern` must compile AND survive a ReDoS shape check — an unbounded quantifier over a group that itself repeats unboundedly (`(a+)+`, `(\d*)*`, even wrapped: `((a+))+`) is an `invalid-value` red (F49, catastrophic-backtracking footgun; rewrite without a repeated group inside a repeat). Exits verify FORM, not truth — progress gates; the operator's close stays the one arbiter |
 
 Red vocabulary (all three validators): `parse-error`, `unknown-field`, `missing-required`,
 `invalid-value`, `bounds`, `duplicate-id`, `close-type`, `close-hierarchy`,
@@ -376,14 +376,19 @@ through `Loop`'s `onToolResult`). So a repeat that never applied is told its anc
 missed, and only content actually in the file is ever described as having landed. Spine event `root-injected` carries
 `{stage, mode, streak, paths, redSetSize}` — counts and paths only, NEVER content (the
 spine is append-only). State dies with the run: this is within-run scratch, not
-across-run memory. `layerRoot: true` (on `interpret` and `runJob`) is the ON/experimental
-arm; the default is OFF. Status (F41): the ratchet is MEASURED inert on every current
-job — two frozen probes + an archive sweep read 0 fixated pairs in 14 (the F21 repetition
-disease was a broken-loop symptom, since cured). Because ON has therefore never won its
-own A/B, it ships **OFF by default (decided 2026-07-21)** — armed and correct, but not
-default-enabled until a stuck job (Layer 2, or a manufactured-fixation probe) shows ON
-beats OFF. Flip the default to `true` the day that evidence lands; a `root-injected` event
-on your spine (when you pass `layerRoot: true`) is a signal worth reading, not noise.
+across-run memory. `layerRoot: true` is the ON/experimental arm; the default is OFF. It is
+wired on BOTH surfaces (F50): the legacy `steps[]` path (`interpret`) and the accepted
+plan-v1 flow (`runPlan`, one root per EXECUTE step plus one in the outer close-fix loop). On
+the plan flow the per-step red-set is the exit evaluator's OWN gap (the whole normalized
+complaint) rather than a single close's gapKeep, while the fix loop uses the close's own
+gapKeep (raw close output); the write-tee makes same-path target rewrites visible to the
+detector. It is NOT wired on the native/clipipe worker (no `onToolResult` seam — F48 fallback). Status (F41):
+the ratchet is MEASURED inert on every current job — two frozen probes + an archive sweep
+read 0 fixated pairs in 14 (the F21 repetition disease was a broken-loop symptom, since
+cured). Because ON has therefore never won its own A/B, it ships **OFF by default (decided
+2026-07-21)** — armed and correct, but not default-enabled until a stuck job shows ON beats
+OFF. Flip the default to `true` the day that evidence lands; a `root-injected` event on your
+spine (when you pass `layerRoot: true`) is a signal worth reading, not noise.
 
 ### `runJob(spec, { approvals, workdir, provider, nativeProvider?, emit, target?, capRuns?, shellCapUsd?, closeTimeoutMs?, execCmd?, layerRoot? })` → outcome — `src/run.js`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",

package/src/plan.js

@@ -49,6 +49,89 @@ const EXIT_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
+/** Length of an UNBOUNDED quantifier token at `src[i]` (`*`, `+`, or `{n,}`,
+ * plus an optional trailing lazy `?`), or 0. Bounded forms (`?`, `{n}`,
+ * `{n,m}`) return 0: they cannot drive exponential backtracking (a bounded
+ * outer repeat is polynomial at worst, and the body is self-authored — F49).
+ * @param {string} src @param {number} i */
+function unboundedQuantLen(src, i) {
+  let len = src[i] === '*' || src[i] === '+' ? 1 : 0;
+  if (!len && src[i] === '{') { const m = /^\{\d+,\}/.exec(src.slice(i)); if (m) len = m[0].length; }
+  if (len && src[i + len] === '?') len++; // the lazy modifier is part of the same token
+  return len;
+}
+
+/**
+ * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
+ * unbounded quantifier applied to a group whose body itself repeats unboundedly
+ * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
+ * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
+ * and is caught by propagating the inner repeat up through the wrapper. Such a
+ * pattern can hang `RegExp.test` for
+ * seconds on a short crafted body, and `evalExits` runs the agent-authored
+ * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
+ * authors both the pattern and (via the worker) the artifact, so a hang burns
+ * only its own run's wall-clock; there is NO arbiter compromise (it cannot
+ * escape the fence, forge a green, or leak a secret). So the reject targets the
+ * dominant exponential class and fails it as a mechanical gap at the validation
+ * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
+ * (an external native dep we do not take for a LOW issue); exotic
+ * overlapping-alternation blowup is out of scope by decision.
+ *
+ * SCOPE IS ASYMMETRIC, both directions named on purpose:
+ *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
+ *     detected — out of scope (self-DoS only, no arbiter compromise).
+ *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
+ *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
+ *     though a real engine runs it linearly — the scan sees the nested-quantifier
+ *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
+ *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
+ *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
+ *     Detecting "safe because anchored" needs the same real engine we declined,
+ *     and guessing it wrong would ADMIT an exponential pattern — so the shape
+ *     reject stands, and the over-rejection is a named, accepted limitation.
+ *
+ * The input is guaranteed to compile as a RegExp (checked first by the caller),
+ * so this scan assumes valid, balanced JS regex syntax.
+ * @param {string} src a compiled regex source string
+ * @returns {boolean} true iff a nested unbounded quantifier is present
+ */
+export function hasNestedQuantifier(src) {
+  /** @type {{ quant: boolean }[]} */
+  const stack = [];
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (c === '\\') { i++; continue; }          // escaped atom — the next char is a literal
+    if (c === '[') {                            // character class: quantifier chars inside are literals
+      i++;
+      if (src[i] === '^') i++;
+      if (src[i] === ']') i++;                  // a leading ] is a literal member, not the close
+      while (i < src.length && src[i] !== ']') { if (src[i] === '\\') i++; i++; }
+      continue;
+    }
+    if (c === '(') { stack.push({ quant: false }); continue; }
+    if (c === ')') {
+      const g = stack.pop();
+      const qlen = unboundedQuantLen(src, i + 1);
+      if (g && g.quant && qlen) return true;    // group repeats unboundedly AND its body did too
+      // The group is an unbounded-repeated atom of its parent when it is directly
+      // re-quantified (qlen) OR its own body already repeats unboundedly (g.quant):
+      // a redundant wrapper — ((a+))+ , (?:(a+))* , (((\d*)))+ — is the SAME
+      // exponential class as (a+)+, so an inner repeat must propagate THROUGH the
+      // enclosing group or the outer quantifier's close never sees it. Propagation
+      // is MONOTONIC (it only ever SETS quant=true → only ever adds rejections): it
+      // can widen over-rejection — the named FAIL-SAFE direction — but can never
+      // introduce a false negative, which is the dangerous one (F49).
+      if ((qlen || (g && g.quant)) && stack.length) stack[stack.length - 1].quant = true;
+      i += qlen;
+      continue;
+    }
+    const qlen = unboundedQuantLen(src, i);     // a quantifier applying to the preceding atom, inside the current group
+    if (qlen) { if (stack.length) stack[stack.length - 1].quant = true; i += qlen - 1; }
+  }
+  return false;
+}
+
 /** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red */
 
 /**
@@ -221,8 +304,15 @@ function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep })
       if (e.type === 'artifact-written' && e.pattern !== undefined) {
         if (!isNonEmptyString(e.pattern)) red('invalid-value', `${eAt}.pattern`, 'regex source string');
         else {
-          try { new RegExp(e.pattern, 'm'); }
+          let compiled = false;
+          try { new RegExp(e.pattern, 'm'); compiled = true; }
           catch { red('invalid-value', `${eAt}.pattern`, 'must compile as a RegExp'); }
+          // F49: a compiled-but-catastrophic pattern (nested unbounded
+          // quantifier) can hang the untimed exit evaluator — reject it here as
+          // a mechanical gap so the replan rewrites it, before any tokens burn.
+          if (compiled && hasNestedQuantifier(e.pattern)) {
+            red('invalid-value', `${eAt}.pattern`, `nested unbounded quantifier (e.g. (a+)+ , (\\d*)* , (x+){1,}) — a catastrophic-backtracking footgun that can hang the exit evaluator (F49); rewrite without a repeated group inside a repeat`);
+          }
         }
       }
     }

package/src/planrun.js

@@ -15,6 +15,7 @@
 
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { join, resolve } from 'node:path';
 import { Gate, redact } from 'bareguard';
 import { LiteCtx } from 'litectx';
@@ -22,6 +23,7 @@ import { runClose, ralph, CLOSE_FAULTS } from './ralph.js';
 import { validatePlan } from './plan.js';
 import { WRITE_VERBS, EXIT_TYPES, MAX_EXITS_PER_STEP, MAX_PLAN_STEPS } from './plan.js';
 import { snapshotScope, evalExits } from './exits.js';
+import { createRoot } from './root.js';
 import { TOOL_MENU } from './job.js';
 import { TOOL_BY_VERB, CTX_TOOLS, createCtxTools, toolAction, PERSONA_TOOLS, RETRIEVAL_STRATEGY, EDIT_STRATEGY } from './interpret.js';
 import { globToPrefix, SECRET_PATTERNS } from './validate.js';
@@ -127,11 +129,20 @@ ${scoutBlob || '(no scout notes)'}`;
  * @param {number} [opts.capRuns] shell-owned per-step attempt cap
  * @param {number} [opts.closeTimeoutMs] close/check wall-clock cap (shell territory)
  * @param {number} [opts.maxStepRounds] the shell's per-step rounds ceiling (validatePlan's bound)
+ * @param {boolean} [opts.layerRoot=false] Layer R — the within-run ratchet (src/root.js),
+ *   scoped PER STEP's ralph loop (each micro-wheel is the Layer-1 atom). Shell-assembled from
+ *   the step's own books: per-attempt write-sets from the F32 workerWrites audit (teed for
+ *   same-path rewrites, which the cumulative audit alone cannot see) and the red-set from the
+ *   exit evaluator's own gap. Defaults OFF (decided 2026-07-21, F41): fixation is extinct on
+ *   every current job, so ON has never won its A/B; `true` is the ON/experimental arm, and the
+ *   first plan-flow job to emit `root-injected` runs the pre-registered ON-vs-OFF acceptance
+ *   read (the Layer R default-flip, LAYERS.md ⚠). Excluded on native (clipipe): the native
+ *   worker has no onToolResult seam, so the tee cannot settle and same-path rewrites are blind.
  * @returns {Promise<string>} 'green' | 'already-green' | 'escalated' | 'plan-red' |
  *   'check-red' | 'close-red' | 'close-unsupported' | 'pricing-red' | 'cap-halt' |
  *   'provider-red' | 'interpreter-red' | `step-red:<id>`
  */
-export async function runPlan(job, { workdir, provider, nativeProvider, emit, remainingUsd, isUnpriced = () => false, capRuns = 3, closeTimeoutMs, maxStepRounds = 40 }) {
+export async function runPlan(job, { workdir, provider, nativeProvider, emit, remainingUsd, isUnpriced = () => false, capRuns = 3, closeTimeoutMs, maxStepRounds = 40, layerRoot = false }) {
   workdir = resolve(workdir);
   const scrub = (/** @type {string} */ s) => redact(s, { patterns: SECRET_PATTERNS });
 
@@ -228,9 +239,13 @@ export async function runPlan(job, { workdir, provider, nativeProvider, emit, re
    * denied, the wallet as its budget), granted tools only (the menu IS the
    * grant), per-attempt round bound via loop.stop() (F20), every round metered
    * with a phase label (F12).
-   * @param {{granted: string[], phase: string, attemptRounds: number, attempts: number, writable: boolean}} o
+   * @param {{granted: string[], phase: string, attemptRounds: number, attempts: number, writable: boolean, root?: ReturnType<typeof createRoot>|null}} o
+   *   `root` (Layer R): when present, the worker's write-class actions are teed
+   *   for the within-run ratchet — staged before the gate decides, discarded on
+   *   deny/halt, settled to landed-or-not after execution (the two axes, F43/F7).
+   *   Wired ONLY on the Loop path: the native session exposes no onToolResult seam.
    */
-  async function mkWorker({ granted, phase, attemptRounds, attempts, writable }) {
+  async function mkWorker({ granted, phase, attemptRounds, attempts, writable, root = null }) {
     const gate = new Gate({
       fs: {
         writeScope: writable ? fencePrefixes : [],
@@ -259,7 +274,69 @@ export async function runPlan(job, { workdir, provider, nativeProvider, emit, re
         return [...paths];
       } catch { return []; }
     };
-    const { policy, onLlmResult } = wireGate(gate, { actionTranslator: (/** @type {string} */ n, /** @type {any} */ a) => toolAction(n, a, workdir) });
+    // Layer R tee (design record 2026-07-19; created per-step by executeStep).
+    // The translator STAGES write/edit content and snapshots the pre-write hash
+    // BEFORE the gate decides (Finding 6); the policy wrapper DISCARDS on a deny
+    // or a halt (the tool never runs); onToolOutcome SETTLES landed-vs-not after
+    // execution (Finding 7 — the gate's allow is intent, the file is outcome).
+    // All no-ops when root is null: every scout/drafter and every native worker.
+    const fileHash = (/** @type {string} */ p) => {
+      try { return createHash('sha256').update(readFileSync(p)).digest('hex'); } catch { return null; }
+    };
+    /** @type {{path: string, content: string, type: string, before: string|null}|null} the write-class action awaiting its OUTCOME */
+    let pendingProbe = null;
+    const teeingTranslator = (/** @type {string} */ n, /** @type {any} */ a) => {
+      // classify by action TYPE, never a name list (the workerWrites filter uses
+      // the same write|edit test — a third enumeration would let a future
+      // write-class verb bypass the tee, the blind-instrument class)
+      const act = toolAction(n, a, workdir);
+      if (root && (act.type === 'write' || act.type === 'edit')) {
+        const path = /** @type {string} */ (act.path);
+        const content = String((act.type === 'edit' ? a?.newText : a?.content) ?? '');
+        root.stageWrite(path, content); // content read off RAW args, never onto the action (the audit stays bytes-only)
+        pendingProbe = { path, content, type: act.type, before: fileHash(path) };
+      }
+      return act;
+    };
+    const { policy: gatePolicy, onLlmResult } = wireGate(gate, { actionTranslator: teeingTranslator });
+    // Settle the stage on the verdict. A DENY/HALT means the tool never runs, so
+    // the outcome seam below never fires for it — discard here (an allow is NOT
+    // settled here: the bytes are not written yet; settling on the verdict is the
+    // exact Finding 7 defect). The catch RE-THROWS so cap-halt routing still reads
+    // the throw. Non-write actions stage nothing, so both settlements are no-ops.
+    const policy = root
+      ? async (/** @type {string} */ n, /** @type {any} */ a, /** @type {any} */ c) => {
+        try {
+          const verdict = await gatePolicy(n, a, c);
+          if (verdict !== true) { root.discardWrite(); pendingProbe = null; }
+          return verdict;
+        } catch (e) { root.discardWrite(); pendingProbe = null; throw e; }
+      }
+      : gatePolicy;
+    /**
+     * Finding 7 — settle the staged write on what the tool ACTUALLY did. Fires
+     * after every tool.execute (bare-agent loop.js), success or error, and tool
+     * calls run strictly sequentially, so exactly one probe is ever in flight. A
+     * probe that never reaches here (a halt out of a tool body) leaves the stage
+     * unsettled — correct: nothing landed, and the attempt boundary drops it.
+     * @param {{result?: any}} [info] the tool's return value
+     */
+    const onToolOutcome = async (info) => {
+      if (!root || !pendingProbe) return;
+      const { path: p, content, type, before } = pendingProbe;
+      pendingProbe = null;
+      let after = null;
+      try { after = readFileSync(p, 'utf8'); } catch { /* absent → after stays null */ }
+      let landed = after !== null && createHash('sha256').update(after, 'utf8').digest('hex') !== before;
+      if (!landed && after !== null) {
+        // no-byte-change: a write always writes (identical bytes ⇒ content IS the
+        // file, exact-equal never substring); a no-op edit is an idempotent apply
+        // OR a missed anchor — the tool RESULT is the only honest signal (F2)
+        if (type === 'write') landed = after === content;
+        else landed = typeof info?.result === 'string' && info.result.startsWith('edited ');
+      }
+      root.settleWrite(landed);
+    };
     /** @type {number|string|undefined} */
     let roundIteration;
     let roundsThisAttempt = 0;
@@ -383,7 +460,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, emit, re
       }
       return onLlmResult(arg);
     };
-    const loop = new Loop({ provider: loopProvider, system, policy, onLlmResult: metered });
+    const loop = new Loop({ provider: loopProvider, system, policy, onLlmResult: metered, onToolResult: onToolOutcome });
     /** @param {string} prompt @param {typeof toolDefs} [defs] */
     const ask = async (prompt, defs = toolDefs) => {
       let r;
@@ -507,13 +584,33 @@ export async function runPlan(job, { workdir, provider, nativeProvider, emit, re
     for (const e of step.exit) {
       if (e.type === 'tree-changed') for (const [k, v] of await snapshotScope(workdir, e.scope)) snapshot.set(k, v);
     }
-    const w = await mkWorker({ granted: step.tools, phase: `step:${step.id}`, attemptRounds: step.rounds, attempts: capRuns, writable: true });
+    // Layer R — one root per step's ralph loop (each micro-wheel is the Layer-1
+    // atom, LAYERS.md). The red-set is the exit evaluator's OWN gap: fixation
+    // here means "the worker rewrote the same file(s) AND the exit evaluator's
+    // complaint is byte-identical" — so the whole normalized gap is the
+    // comparable set (gapKeep `\S` = every non-blank line). That is more robust
+    // than reusing a check's `^`-anchored gapKeep, which the exit wrapper
+    // (`check "x" red: …`) would break. writesInformative is true (tool mode,
+    // always) but never fires on write-overlap ALONE — a plan step rewrites its
+    // one target every attempt, so only a KNOWN-unmoved red-set can distinguish
+    // repetition from progress (Finding 3). Native is excluded (no onToolResult
+    // seam → the tee cannot settle → same-path rewrites are blind).
+    const root = layerRoot && !native
+      ? createRoot({ gapKeep: '\\S', redact: scrub, writesInformative: true })
+      : null;
+    const w = await mkWorker({ granted: step.tools, phase: `step:${step.id}`, attemptRounds: step.rounds, attempts: capRuns, writable: true, root });
     let lastText = '';
     let iterationNow = 0;
     /** @param {number} iteration @param {string} [gap] */
     const middle = async (iteration, gap) => {
       w.setIteration(iteration);
       iterationNow = iteration;
+      // Layer R observe: finalize the prior attempt from the books (workerWrites
+      // audit + teed same-path rewrites), run the fixation detector, and inject
+      // its escalating note into THIS attempt's prompt (null = inert). The event
+      // carries counts and paths only — never content (the spine is forever).
+      const rootInj = root ? root.observe({ iteration, gap, writes: w.workerWrites() }) : null;
+      if (rootInj) emit('root-injected', { step: step.id, ...rootInj.event });
       const r = await w.ask([
         step.action,
         `Repository root (absolute): ${workdir}\nEvery path you pass to a tool MUST be absolute and inside this root — a relative path resolves against a different directory and will be denied by the gate.`,
@@ -522,6 +619,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, emit, re
         gap && `Previous attempt failed this step's checks:\n${gap}`,
         w.wasBounded() === iteration - 1
           && `Your previous attempt was CUT OFF after ${step.rounds} tool rounds. Reading is bounded; writing is not. Form a hypothesis EARLY and make the change.`,
+        rootInj && rootInj.note,
       ].filter(Boolean).join('\n\n'));
       lastText = scrub(r.text ?? '').slice(0, ARTIFACT_MAX);
     };
@@ -651,16 +749,29 @@ export async function runPlan(job, { workdir, provider, nativeProvider, emit, re
   emit('fix-loop', { gapBytes: Buffer.byteLength(post.gap ?? '') });
   let fixOutcome;
   try {
-    const w = await mkWorker({ granted: ceiling, phase: 'fix', attemptRounds: maxStepRounds, attempts: capRuns, writable: true });
+    // Layer R for the close-fix loop — the plan flow's single ralph loop judged
+    // by the REAL close (the closest analog to interpret.js's loop, and the
+    // likeliest place fixation manifests: the fix worker has the full menu and
+    // is judged by a command, not a form-only exit). The red-set is the CLOSE's
+    // own gapKeep (the gap here is the raw close output, unwrapped — so the
+    // `^`-anchored pattern matches, unlike the exec steps' exit-eval gap). Same
+    // native exclusion (no onToolResult seam ⇒ the tee cannot settle).
+    const fixRoot = layerRoot && !native
+      ? createRoot({ gapKeep: job.close.gapKeep, redact: scrub, writesInformative: true })
+      : null;
+    const w = await mkWorker({ granted: ceiling, phase: 'fix', attemptRounds: maxStepRounds, attempts: capRuns, writable: true, root: fixRoot });
     /** @param {number} iteration @param {string} [gap] */
     const middle = async (iteration, gap) => {
       w.setIteration(iteration);
+      const rootInj = fixRoot ? fixRoot.observe({ iteration, gap, writes: w.workerWrites() }) : null;
+      if (rootInj) emit('root-injected', { phase: 'fix', ...rootInj.event });
       await w.ask([
         'The job\'s final verification is failing. Fix the repository so it passes.',
         `Repository root (absolute): ${workdir}\nEvery path you pass to a tool MUST be absolute and inside this root.`,
         artifacts.length > 0 && `Working context (read-only) — the plan's steps produced:\n${artifacts.map((a) => `[${a.id}] ${a.text}`).join('\n\n')}`,
         !gap && post.gap && `The verification's output on the tree as it stands (not an attempt of yours):\n${post.gap}`,
         gap && `Previous attempt failed the verification:\n${gap}`,
+        rootInj && rootInj.note,
       ].filter(Boolean).join('\n\n'));
     };
     fixOutcome = await ralph({

package/src/run.js

@@ -303,7 +303,7 @@ export async function runJob(rawSpec, { approvals, workdir, target, provider, na
   // money contract is identical to the legacy path.
   if (planShape) {
     const outcome = await runPlan(job, {
-      workdir, provider, nativeProvider, emit: meter, capRuns, closeTimeoutMs,
+      workdir, provider, nativeProvider, emit: meter, capRuns, closeTimeoutMs, layerRoot,
       remainingUsd: () => Math.min(shellCapUsd, job.budgetUsd - spentUsd),
       isUnpriced: () => unpriced, // F6: let the plan flow bail in-flight, not just after it returns
     });

package/types/plan.d.ts

@@ -1,3 +1,39 @@
+/**
+ * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
+ * unbounded quantifier applied to a group whose body itself repeats unboundedly
+ * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
+ * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
+ * and is caught by propagating the inner repeat up through the wrapper. Such a
+ * pattern can hang `RegExp.test` for
+ * seconds on a short crafted body, and `evalExits` runs the agent-authored
+ * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
+ * authors both the pattern and (via the worker) the artifact, so a hang burns
+ * only its own run's wall-clock; there is NO arbiter compromise (it cannot
+ * escape the fence, forge a green, or leak a secret). So the reject targets the
+ * dominant exponential class and fails it as a mechanical gap at the validation
+ * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
+ * (an external native dep we do not take for a LOW issue); exotic
+ * overlapping-alternation blowup is out of scope by decision.
+ *
+ * SCOPE IS ASYMMETRIC, both directions named on purpose:
+ *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
+ *     detected — out of scope (self-DoS only, no arbiter compromise).
+ *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
+ *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
+ *     though a real engine runs it linearly — the scan sees the nested-quantifier
+ *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
+ *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
+ *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
+ *     Detecting "safe because anchored" needs the same real engine we declined,
+ *     and guessing it wrong would ADMIT an exponential pattern — so the shape
+ *     reject stands, and the over-rejection is a named, accepted limitation.
+ *
+ * The input is guaranteed to compile as a RegExp (checked first by the caller),
+ * so this scan assumes valid, balanced JS regex syntax.
+ * @param {string} src a compiled regex source string
+ * @returns {boolean} true iff a nested unbounded quantifier is present
+ */
+export function hasNestedQuantifier(src: string): boolean;
 /** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red */
 /**
  * Validate an agent-authored plan (`schema: "plan-v1"`) against the SIGNED

package/types/planrun.d.ts

@@ -23,11 +23,20 @@
  * @param {number} [opts.capRuns] shell-owned per-step attempt cap
  * @param {number} [opts.closeTimeoutMs] close/check wall-clock cap (shell territory)
  * @param {number} [opts.maxStepRounds] the shell's per-step rounds ceiling (validatePlan's bound)
+ * @param {boolean} [opts.layerRoot=false] Layer R — the within-run ratchet (src/root.js),
+ *   scoped PER STEP's ralph loop (each micro-wheel is the Layer-1 atom). Shell-assembled from
+ *   the step's own books: per-attempt write-sets from the F32 workerWrites audit (teed for
+ *   same-path rewrites, which the cumulative audit alone cannot see) and the red-set from the
+ *   exit evaluator's own gap. Defaults OFF (decided 2026-07-21, F41): fixation is extinct on
+ *   every current job, so ON has never won its A/B; `true` is the ON/experimental arm, and the
+ *   first plan-flow job to emit `root-injected` runs the pre-registered ON-vs-OFF acceptance
+ *   read (the Layer R default-flip, LAYERS.md ⚠). Excluded on native (clipipe): the native
+ *   worker has no onToolResult seam, so the tee cannot settle and same-path rewrites are blind.
  * @returns {Promise<string>} 'green' | 'already-green' | 'escalated' | 'plan-red' |
  *   'check-red' | 'close-red' | 'close-unsupported' | 'pricing-red' | 'cap-halt' |
  *   'provider-red' | 'interpreter-red' | `step-red:<id>`
  */
-export function runPlan(job: any, { workdir, provider, nativeProvider, emit, remainingUsd, isUnpriced, capRuns, closeTimeoutMs, maxStepRounds }: {
+export function runPlan(job: any, { workdir, provider, nativeProvider, emit, remainingUsd, isUnpriced, capRuns, closeTimeoutMs, maxStepRounds, layerRoot }: {
     workdir: string;
     provider: any;
     nativeProvider?: ((o: {
@@ -42,6 +51,7 @@ export function runPlan(job: any, { workdir, provider, nativeProvider, emit, rem
     capRuns?: number | undefined;
     closeTimeoutMs?: number | undefined;
     maxStepRounds?: number | undefined;
+    layerRoot?: boolean | undefined;
 }): Promise<string>;
 export type CategorizedError = Error & {
     category?: string;