bareloop 0.5.0 → 0.6.0

package/src/plan.js

@@ -9,16 +9,22 @@
 //     `request-red`, which is admission demand against the product menu)
 //   bounds ≤ the shell caps                → `bounds`
 //   scopes/targets inside the signed fence → `scope-escape` / `invalid-value`
+//   …and, on a step that NARROWED the fence with `scope`, the step's WRITES are
+//     judged against that narrowed prefix too → `step-scope-escape` (the runner
+//     gates the step from it, so an in-fence-but-out-of-scope target is a write
+//     denied on every attempt with no red anywhere — W3). Exits are observations,
+//     not writes: only a `tree-changed` scope DISJOINT from the step's scope is
+//     unsatisfiable, and the artifact paths are not constrained at all
 //   exits from the closed menu only        → `exit-illegal` (arbiter
 //     inexpressibility: an exit is declarative data the shell evaluates with
 //     its own fixed code — `run` cannot be laundered through it)
-//   check references resolve against the SIGNED checks menu → `check-unknown`
+//   check references resolve against the menu DERIVED from the signed close → `check-unknown`
 //     (decision 1: a check the spec doesn't sign does not exist)
 //
 // Like its siblings (validate.js, job.js) it never throws on JSON text or
 // plain parsed data; every failure is a named {code, path, detail} red.
 
-import { TOOL_MENU, LOCKED_TOOLS } from './job.js';
+import { TOOL_MENU, LOCKED_TOOLS, WRITE_VERBS, checkMenu } from './job.js';
 import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals } from './validate.js';
 
 /** the closed exit menu (PRD v1.12 §3 + decision 1's `check-passes`): the
@@ -33,14 +39,71 @@ export const MAX_EXITS_PER_STEP = 2;
 export const MAX_PLAN_STEPS = 8;
 /** the write-class verbs (BA-13: `edit` is judged by the same fence as
  * `write`) — a step granting one is a WRITE step for the F17 pairing rule
- * and the v1.18 target requirement */
-export const WRITE_VERBS = Object.freeze(['write', 'edit']);
+ * and the v1.18 target requirement. RE-EXPORTED from job.js, never re-declared:
+ * ONE inventory (the SECRET_PATTERNS precedent) — a second copy lets a third
+ * write-class verb land in one list and stay invisible to the other. */
+export { WRITE_VERBS };
+/** scope-menu bound: the menu is a PROMPT ingredient on every draft and
+ * redraft, so an unbounded repo would price the drafting call by its directory
+ * count. Shallow entries survive the cap (see `legalScopes`) because they are
+ * the useful ones — a deep leaf is reachable via its parent. */
+export const MAX_SCOPE_MENU = 24;
+
+/**
+ * The MENU of legal `tree-changed` scopes — choose-don't-describe (design record
+ * §4, hamr's correction: *"did agent choose from a list or not?"*).
+ *
+ * F60 measured 13 of 18 validator reds as ONE class: the agent writes
+ * `scope: "src/*.js"`, the grammar accepts only a trailing `/**` or `/*`, and
+ * each red costs a redraft call. Teaching the rule in the prompt or widening the
+ * grammar both leave the agent authoring a free-text string and guessing its
+ * shape. Enumerating instead makes an illegal scope INEXPRESSIBLE.
+ *
+ * This is the only producer of scope menus, and it filters by the signed fence —
+ * so a menu entry that escapes containment cannot be constructed, rather than
+ * being caught by a downstream check. `globToPrefix` is untouched: this changes
+ * what the agent is OFFERED, never what the fence ENFORCES.
+ *
+ * @param {string[]} writeScope the signed fence entries (always offerable — they
+ *   cover directories a step has not created yet, which `snapshotScope` treats
+ *   as an empty snapshot)
+ * @param {string[]} [dirs] workdir-relative directories discovered under the
+ *   fence; each becomes `<dir>/**`
+ * @param {number} [cap] the menu bound; `Infinity` asks for the UNCAPPED set, so
+ *   a caller can report how many entries the cap dropped (no silent caps — a menu
+ *   that reads as complete when it is not is the blind-instrument class)
+ * @returns {string[]} the offerable scopes, deduped, shallowest-first, capped
+ */
+export function legalScopes(writeScope, dirs = [], cap = MAX_SCOPE_MENU) {
+  const fence = writeScope.filter(isNonEmptyString).map(globToPrefix).filter((p) => p !== '');
+  const inside = (/** @type {string} */ p) => fence.some((f) => p === f || p.startsWith(f + '/'));
+  /** @type {string[]} */
+  const prefixes = [];
+  for (const p of [...fence, ...dirs.filter(isNonEmptyString).map(globToPrefix)]) {
+    // scopeContained rejects absolutes, drive letters, backslashes and any ".."
+    // segment; `inside` rejects a contained-but-out-of-fence dir. Both, in that
+    // order, on the NORMALIZED prefix.
+    if (!scopeContained(p) || !inside(p) || prefixes.includes(p)) continue;
+    prefixes.push(p);
+  }
+  // depth first, then lexical — a stable order so the same repo yields the same
+  // menu (and the same prompt) across drafts, and so the cap drops leaves
+  // rather than roots.
+  prefixes.sort((a, b) => a.split('/').length - b.split('/').length || a.localeCompare(b));
+  return prefixes.slice(0, cap).map((p) => `${p}/**`);
+}
 const PLAN_FIELDS = ['schema', 'steps'];
 // decision 7: NO dependsOn — v1 is strictly sequential, array order IS the
 // order; a field nothing consumes is a live-looking knob with zero effect
 // (the F16 inert-op class). The arbiter's own vocabulary (close, budget,
 // fence) is absent by construction — unknown-field at every depth.
-const STEP_FIELDS = ['id', 'action', 'tools', 'rounds', 'target', 'exit'];
+const STEP_FIELDS = ['id', 'action', 'tools', 'rounds', 'target', 'exit', 'model', 'attempts', 'scope'];
+/** P (design record 2026-07-28): the signed per-step model-tier menu. Closed by
+ * construction — the agent picks a tier, never names an arbitrary model string
+ * (the tier→model mapping and any effort params are the RUNNER's, per provider).
+ * opus is deliberately absent: reserved for fresh builds hamr explicitly assigns,
+ * never plan-selectable. */
+export const STEP_MODELS = Object.freeze(['sonnet', 'haiku']);
 const EXIT_FIELDS = {
   'artifact-written': ['type', 'path', 'pattern'],
   'tree-changed': ['type', 'scope'],
@@ -49,6 +112,133 @@ const EXIT_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
+/** Length of an UNBOUNDED quantifier token at `src[i]` (`*`, `+`, or `{n,}`,
+ * plus an optional trailing lazy `?`), or 0. Bounded forms (`?`, `{n}`,
+ * `{n,m}`) return 0: they cannot drive exponential backtracking (a bounded
+ * outer repeat is polynomial at worst, and the body is self-authored — F49).
+ * @param {string} src @param {number} i */
+function unboundedQuantLen(src, i) {
+  let len = src[i] === '*' || src[i] === '+' ? 1 : 0;
+  if (!len && src[i] === '{') { const m = /^\{\d+,\}/.exec(src.slice(i)); if (m) len = m[0].length; }
+  if (len && src[i + len] === '?') len++; // the lazy modifier is part of the same token
+  return len;
+}
+
+/**
+ * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
+ * unbounded quantifier applied to a group whose body itself repeats unboundedly
+ * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
+ * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
+ * and is caught by propagating the inner repeat up through the wrapper. Such a
+ * pattern can hang `RegExp.test` for
+ * seconds on a short crafted body, and `evalExits` runs the agent-authored
+ * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
+ * authors both the pattern and (via the worker) the artifact, so a hang burns
+ * only its own run's wall-clock; there is NO arbiter compromise (it cannot
+ * escape the fence, forge a green, or leak a secret). So the reject targets the
+ * dominant exponential class and fails it as a mechanical gap at the validation
+ * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
+ * (an external native dep we do not take for a LOW issue); exotic
+ * overlapping-alternation blowup is out of scope by decision.
+ *
+ * SCOPE IS ASYMMETRIC, both directions named on purpose:
+ *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
+ *     detected — out of scope (self-DoS only, no arbiter compromise).
+ *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
+ *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
+ *     though a real engine runs it linearly — the scan sees the nested-quantifier
+ *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
+ *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
+ *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
+ *     Detecting "safe because anchored" needs the same real engine we declined,
+ *     and guessing it wrong would ADMIT an exponential pattern — so the shape
+ *     reject stands, and the over-rejection is a named, accepted limitation.
+ *
+ * The input is guaranteed to compile as a RegExp (checked first by the caller),
+ * so this scan assumes valid, balanced JS regex syntax.
+ * @param {string} src a compiled regex source string
+ * @returns {boolean} true iff a nested unbounded quantifier is present
+ */
+export function hasNestedQuantifier(src) {
+  /** @type {{ quant: boolean }[]} */
+  const stack = [];
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (c === '\\') { i++; continue; }          // escaped atom — the next char is a literal
+    if (c === '[') {                            // character class: quantifier chars inside are literals
+      i++;
+      if (src[i] === '^') i++;
+      // NO POSIX leading-`]`-is-a-literal rule: JS is not POSIX here. `[]` is the
+      // EMPTY class (matches nothing) and `[^]` the any-char idiom — both close at
+      // that first `]`. Skipping it ran the scan past the class's real end and
+      // swallowed every quantifier after it, so `x[^](a+)+$` read as safe while
+      // RegExp.test on it does not finish in 15s on a 31-char body. A false
+      // NEGATIVE is the dangerous direction (F49), so the scan follows JS.
+      //
+      // Honest limit on the monotonicity claim: this is a PARSE correction, not
+      // the "add rejections only" tightening F49's rule contemplates, and it is
+      // not strictly rejection-monotonic. Measured over 14,862 compilable
+      // generated patterns (2,369 previously rejected): 2 rejections disappear,
+      // both pathological `[]`-bearing shapes whose old `true` came from the very
+      // misparse being fixed, and both verified to finish RegExp.test in ~0ms.
+      // Every entry of the checked-in REDOS_BAD/GOOD/OVERREJECTED corpus is
+      // unchanged. So no real hazard was un-rejected — but the claim is
+      // "measured, no hazard lost", never "monotonic by construction".
+      while (i < src.length && src[i] !== ']') { if (src[i] === '\\') i++; i++; }
+      continue;
+    }
+    if (c === '(') { stack.push({ quant: false }); continue; }
+    if (c === ')') {
+      const g = stack.pop();
+      const qlen = unboundedQuantLen(src, i + 1);
+      if (g && g.quant && qlen) return true;    // group repeats unboundedly AND its body did too
+      // The group is an unbounded-repeated atom of its parent when it is directly
+      // re-quantified (qlen) OR its own body already repeats unboundedly (g.quant):
+      // a redundant wrapper — ((a+))+ , (?:(a+))* , (((\d*)))+ — is the SAME
+      // exponential class as (a+)+, so an inner repeat must propagate THROUGH the
+      // enclosing group or the outer quantifier's close never sees it. Propagation
+      // is MONOTONIC (it only ever SETS quant=true → only ever adds rejections): it
+      // can widen over-rejection — the named FAIL-SAFE direction — but can never
+      // introduce a false negative, which is the dangerous one (F49).
+      if ((qlen || (g && g.quant)) && stack.length) stack[stack.length - 1].quant = true;
+      i += qlen;
+      continue;
+    }
+    const qlen = unboundedQuantLen(src, i);     // a quantifier applying to the preceding atom, inside the current group
+    if (qlen) { if (stack.length) stack[stack.length - 1].quant = true; i += qlen - 1; }
+  }
+  return false;
+}
+
+/**
+ * The close, as the ordered STAGE LIST the plan flow actually executes (PRD
+ * v1.28). A staged close is already that list; the legacy object form is the
+ * ONE-stage list it stands for, named `close`. Anything else — a gold, rubric or
+ * hitl close, which names no command to run — is null, and the runner escalates
+ * `close-unsupported` before any tokens.
+ *
+ * W4 — this is the ONE staging, and it exists because there used to be two. The
+ * runner synthesized the single stage and derived its check menu from THAT, while
+ * `planPrompt` and `validatePlan` called `checkMenu` on the RAW spec — where an
+ * object close is not an array, so the menu came back empty. The result was a
+ * runner announcing and preflighting a stage the drafter was never offered and the
+ * validator would have redded `check-unknown`. Same class as the two-transforms
+ * defects before it: the fix is one derivation every consumer calls, not three
+ * copies kept in step by comment.
+ *
+ * Lives here rather than beside `checkMenu` in job.js only because job.js owns the
+ * SIGNED vocabulary and this is the consumer-side reading of it; `plan.js` is the
+ * lowest module every check-menu consumer already imports (planrun imports plan,
+ * never the reverse), so it is the one place all three can share without a cycle.
+ * @param {any} close the spec's `close` field, any shape
+ * @returns {any[]|null} the stage list, or null when the close names no command
+ */
+export function stageClose(close) {
+  if (Array.isArray(close)) return close;
+  if (!isObj(close) || close.type !== 'predicate') return null;
+  return [{ name: 'close', cmd: close.cmd, expect: close.expect, judged: close.judged, gapKeep: close.gapKeep }];
+}
+
 /** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red */
 
 /**
@@ -56,14 +246,17 @@ const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
  * job spec. Never throws on JSON text or plain parsed data; every failure is
  * a named red. Returns the parsed plan on ok (single parse), null on any red.
  * @param {object|string} input parsed plan, or raw JSON text (parse failures are a red)
- * @param {{ job?: any, maxStepRounds?: number }} [opts] `job`: the
+ * @param {{ job?: any, maxStepRounds?: number, scopes?: string[], capRuns?: number }} [opts] `job`: the
  *   validateJob-GREEN four-field spec (the ceiling, the fence, and the checks
  *   menu all come from it — a missing or non-plan-shape job fails CLOSED);
  *   `maxStepRounds`: the shell's per-step rounds ceiling (interpret's
- *   tool-mode TURNS_PER_ATTEMPT) — a step may tighten it, never exceed it.
+ *   tool-mode TURNS_PER_ATTEMPT) — a step may tighten it, never exceed it;
+ *   `scopes`: the offered `tree-changed` menu from `legalScopes` (the SAME array
+ *   the drafting prompt enumerated). Omitted, it derives from the signed
+ *   writeScope — never a free-text fallback (F50).
  * @returns {{ ok: boolean, reds: Red[], plan: object|null }}
  */
-export function validatePlan(input, { job, maxStepRounds = 40 } = {}) {
+export function validatePlan(input, { job, maxStepRounds = 40, scopes, capRuns = 3 } = {}) {
   /** @type {Red[]} */
   const reds = [];
   /** @type {(code: string, path: string, detail?: string) => void} */
@@ -72,15 +265,36 @@ export function validatePlan(input, { job, maxStepRounds = 40 } = {}) {
   // The signed side, fail-CLOSED (the validate.js fence-invalid pattern): the
   // ceiling/fence/menu are meaningless without a plan-shape spec, and an open
   // gate on a malformed one would validate a plan against nothing.
-  if (!isObj(job) || !isNonEmptyString(/** @type {any} */ (job).goal) || !Array.isArray(/** @type {any} */ (job).writeScope)) {
-    return { ok: false, reds: [{ code: 'job-invalid', path: 'job', detail: 'a plan validates only against a validateJob-green plan shape spec (goal/verdictType/close/checks[]) — validate the job first' }], plan: null };
+  // The writeScope's MEMBERS are checked here too, not just its arrayness:
+  // `globToPrefix` below calls `.replace` on each one, so a non-string member
+  // threw `TypeError: scope.replace is not a function` out of a function whose
+  // contract is that plain data only ever yields a named red. Same
+  // `isNonEmptyString` question `legalScopes` already asks of the same field.
+  if (!isObj(job) || !isNonEmptyString(/** @type {any} */ (job).goal) || !Array.isArray(/** @type {any} */ (job).writeScope)
+    || !(/** @type {any[]} */ (/** @type {any} */ (job).writeScope)).every(isNonEmptyString)) {
+    return { ok: false, reds: [{ code: 'job-invalid', path: 'job', detail: 'a plan validates only against a validateJob-green plan shape spec (goal/verdictType/close) — validate the job first' }], plan: null };
   }
   const spec = /** @type {Record<string, any>} */ (job);
   /** the signed tool ceiling — validateJob permits omission, meaning the full menu */
   const ceiling = Array.isArray(spec.tools) ? spec.tools : [...TOOL_MENU];
   const fence = spec.writeScope.map(globToPrefix);
   const insideFence = (/** @type {string} */ p) => fence.some((f) => p === f || p.startsWith(f + '/'));
-  const checkNames = Array.isArray(spec.checks) ? spec.checks.map((/** @type {any} */ c) => c?.name).filter(isNonEmptyString) : [];
+  // The check menu DERIVES from the close's stages (PRD v1.28) — the agent
+  // references a piece of the operator's own inspection, never a ruler someone
+  // hand-carved beside it. One derivation, shared with the runner, so what the
+  // prompt offers and what the validator accepts cannot drift apart — which means
+  // reading the close through `stageClose`, the same staging the runner EXECUTES
+  // (W4: reading the raw field here made the legacy object form's stage invisible
+  // to the validator and the prompt while the runner ran it).
+  // `?? []` is the null case spelled out: a close that names no command to run
+  // (gold/rubric/hitl) stages nothing, so it offers nothing — the runner
+  // escalates `close-unsupported` on the same null, and an empty menu is already
+  // the honest reading here (every check-passes becomes a check-unknown).
+  const checkNames = checkMenu(stageClose(spec.close) ?? []).map((m) => m.name);
+  // The offered scope menu. A caller-supplied menu must be the same one the
+  // prompt enumerated; with none, derive from the signed fence — fail-CLOSED,
+  // so omitting the option narrows the agent's choices and never widens them.
+  const scopeMenu = Array.isArray(scopes) && scopes.length ? scopes : legalScopes(spec.writeScope);
 
   let p = input;
   if (typeof p === 'string') {
@@ -122,6 +336,7 @@ export function validatePlan(input, { job, maxStepRounds = 40 } = {}) {
       // verb as structured data (the ledger counts overreach per verb) — an
       // unknown string stays a typo (invalid-value), never an escape
       let writeStep = false;
+      let toolsParsed = false;
       if (s.tools === undefined) red('missing-required', `${at}.tools`, 'every step declares its grant — the narrowed menu is the step boundary');
       else if (!(Array.isArray(s.tools) && s.tools.length > 0
                  && s.tools.every((/** @type {unknown} */ t) => typeof t === 'string')
@@ -141,6 +356,7 @@ export function validatePlan(input, { job, maxStepRounds = 40 } = {}) {
           reds.push({ code: 'verb-escape', path: `${at}.tools`, verb: t, detail: `"${t}" is outside the signed ceiling [${ceiling.join(', ')}] — the plan may narrow the grant, never widen it` });
         }
         writeStep = s.tools.some((/** @type {string} */ t) => WRITE_VERBS.includes(t));
+        toolsParsed = true;
       }
 
       // rounds ≤ the shell cap (cap-not-estimate; the step bound IS maxTurns)
@@ -148,6 +364,65 @@ export function validatePlan(input, { job, maxStepRounds = 40 } = {}) {
         red('bounds', `${at}.rounds`, `integer 1..${maxStepRounds} — the step bound is the Gate's maxTurns, it may tighten the shell cap, never exceed it`);
       }
 
+      // P (design record 2026-07-28): the widened vocabulary — every field
+      // optional, every field tighten-only, every legal set handed over as a
+      // MENU (choose-don't-describe: illegal is inexpressible, never described)
+      if (s.model !== undefined && !STEP_MODELS.includes(s.model)) {
+        red('invalid-value', `${at}.model`, `menu: ${STEP_MODELS.join('|')} — the tier menu is signed; the agent picks a tier, never names a model`);
+      }
+      if (s.attempts !== undefined && !(Number.isInteger(s.attempts) && s.attempts >= 1 && s.attempts <= capRuns)) {
+        red('bounds', `${at}.attempts`, `integer 1..${capRuns} — a step may tighten the shell's attempt cap, never exceed it`);
+      }
+      if (s.scope !== undefined && !scopeMenu.includes(s.scope)) {
+        red('invalid-value', `${at}.scope`, `menu: [${scopeMenu.join(', ')}] — a per-step write scope narrows the fence from the same menu tree-changed uses`);
+      }
+      // W3 — a step that NARROWS the fence is gated by its own scope, not the
+      // signed one: planrun's mkWorker builds this step's Gate writeScope from
+      // `globToPrefix(scope)`. So a TARGET that is in-fence but OUTSIDE the step's
+      // own scope is a write the gate denies on every attempt — the step burns its
+      // whole attempt budget on refusals and no red is raised anywhere, because
+      // each half was individually legal and nothing checked the PAIR. Checking it
+      // here makes the incoherent pair inexpressible at the validation gate rather
+      // than discovered at the runtime one.
+      //
+      // The rule binds WRITES, not OBSERVATIONS. An exit is evaluated by the shell
+      // (src/exits.js), never written by the worker, so the step's gate constrains
+      // it only where the evaluator's own semantics say so — measured, not assumed:
+      //   - `tree-changed` passes iff ANY file under ITS scope changed, so a scope
+      //     that CONTAINS the step's scope contains the step's writable ground and
+      //     fires exactly when the narrow one does. Only a DISJOINT scope is
+      //     unsatisfiable: it can pass only if ground this gate refuses changed.
+      //     Hence overlap, not containment (and the menu is shallowest-first while
+      //     the prompt says copy one value, so the widest scope is the LIKELIEST
+      //     draft — containment here would tax the natural plan, the exact F60
+      //     class `legalScopes` exists to eliminate).
+      //   - `artifact-written`/`json-valid` read and parse the named file and ask
+      //     nothing about who wrote it, so a path outside the step's scope naming a
+      //     PRIOR step's artifact is legal AND satisfiable (v1 is strictly
+      //     sequential — that composition is the natural shape). No step-scope red
+      //     belongs on those arms: it would claim a constraint the evaluator does
+      //     not impose. A path nothing ever produces still fails at runtime, with
+      //     the mechanical "<path> was not written (does not exist)" gap.
+      //
+      // Fence FIRST, narrowed scope SECOND (see the target/scope arms): the menu is
+      // fence-filtered by `legalScopes`, so containment in the scope normally
+      // implies containment in the fence — but a caller-supplied menu is data, and
+      // deriving the fence check FROM it would let a bad menu widen what is
+      // accepted. Kept as two ordered checks, the narrowed one can only tighten.
+      // An OFF-MENU scope carries no narrowing (it already redded above): one
+      // defect, one red — a second red derived from a value the agent cannot use
+      // would charge the ledger twice for the same mistake.
+      const stepScope = s.scope !== undefined && scopeMenu.includes(s.scope) ? s.scope : null;
+      const stepPrefix = stepScope === null ? null : globToPrefix(stepScope);
+      /** contained by the step's OWN scope — vacuously true on an unscoped step,
+       * which is what keeps every pre-W3 plan byte-identical. The WRITE test. */
+      const insideStepScope = (/** @type {string} */ p) => stepPrefix === null
+        || p === stepPrefix || p.startsWith(stepPrefix + '/');
+      /** shares ground with the step's own scope — either prefix contains the
+       * other. The OBSERVATION test: what `tree-changed` needs to be satisfiable. */
+      const overlapsStepScope = (/** @type {string} */ p) => stepPrefix === null
+        || p === stepPrefix || p.startsWith(stepPrefix + '/') || stepPrefix.startsWith(p + '/');
+
       // target (v1.18): the per-step deliverable — required on write steps,
       // always inside the signed fence when present
       if (s.target === undefined || s.target === '') {
@@ -156,9 +431,11 @@ export function validatePlan(input, { job, maxStepRounds = 40 } = {}) {
         red('invalid-value', `${at}.target`, 'a relative path inside the run dir — no absolute paths, no ".." segments');
       } else if (!insideFence(globToPrefix(s.target))) {
         red('scope-escape', `${at}.target`, `"${s.target}" is outside the signed fence [${spec.writeScope.join(', ')}]`);
+      } else if (!insideStepScope(globToPrefix(s.target))) {
+        red('step-scope-escape', `${at}.target`, `"${s.target}" is inside the signed fence but outside this step's own scope "${stepScope}" — the step's gate is built from that narrowed prefix, so every write to this target would be denied`);
       }
 
-      validateExit(s, at, red, { checkNames, fence: spec.writeScope, insideFence, writeStep });
+      validateExit(s, at, red, { checkNames, fence: spec.writeScope, insideFence, writeStep, toolsParsed, scopeMenu, stepScope, overlapsStepScope });
     });
   }
 
@@ -175,9 +452,13 @@ export function validatePlan(input, { job, maxStepRounds = 40 } = {}) {
  * @param {Record<string, any>} s the step
  * @param {string} at step path prefix
  * @param {(code: string, path: string, detail?: string) => void} red
- * @param {{ checkNames: string[], fence: string[], insideFence: (p: string) => boolean, writeStep: boolean }} ctx
+ * @param {{ checkNames: string[], fence: string[], insideFence: (p: string) => boolean, writeStep: boolean, toolsParsed: boolean, scopeMenu: string[], stepScope: string|null, overlapsStepScope: (p: string) => boolean }} ctx
+ *   `stepScope`/`overlapsStepScope` (W3): the step's OWN narrowed fence when it
+ *   declared a legal `scope`, null/always-true otherwise. Exits are OBSERVATIONS,
+ *   not writes, so only `tree-changed` is constrained by it and only against
+ *   DISJOINTness — see the arm for the measured semantics.
  */
-function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep }) {
+function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep, toolsParsed, scopeMenu, stepScope, overlapsStepScope }) {
   if (!Array.isArray(s.exit) || s.exit.length === 0) {
     red('missing-required', `${at}.exit`, `non-empty array from the closed menu ${EXIT_TYPES.join('|')} — ALL listed exits must pass (AND-only); a step without an exit has no progress gate`);
     return;
@@ -203,16 +484,50 @@ function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep })
       else if (!checkNames.includes(e.name)) {
         // decision 1: a check the spec doesn't sign DOES NOT EXIST — and the
         // detail names the signed menu so the replan can aim, not guess
-        red('check-unknown', eAt, `"${e.name}" is not a signed check — the agent references checks, never authors them; signed menu: [${checkNames.join(', ') || 'none'}]`);
+        red('check-unknown', eAt, `"${e.name}" is not an offered close stage — the agent references stages of the operator's close, never authors a ruler; offered: [${checkNames.join(', ') || 'none'}]`);
       }
     } else if (e.type === 'tree-changed') {
       hasTreeChanged = true;
-      if (!isNonEmptyString(e.scope) || !scopeContained(e.scope) || globToPrefix(e.scope).includes('*')) {
-        red('invalid-value', `${eAt}.scope`, 'a contained scope (trailing /** or /* only, no ".." or absolute)');
-      } else if (!insideFence(globToPrefix(e.scope))) {
-        red('scope-escape', `${eAt}.scope`, `"${e.scope}" is outside the signed fence [${fence.join(', ')}]`);
+      // choose-don't-describe: membership of the enumerated menu, NOT a shape
+      // grammar the agent has to guess (§4; F60's 72%-of-all-reds class). The
+      // menu derives from the signed writeScope when the caller passes none, so
+      // omitting the option can never restore free-text containment — a
+      // silently-ignored optional param is the F50 blind-instrument class. Every
+      // menu comes from `legalScopes`, which filters by the fence, so
+      // scope-escape here is inexpressible rather than checked.
+      // An off-menu scope splits by CAUSE, because the two carry different
+      // meaning to the ledger's class table: reaching OUTSIDE the signed fence is
+      // a behaviour signal about the agent (`scope-escape`, same code the target
+      // and path arms raise), while an in-fence value that simply is not offered
+      // is drafting friction (`invalid-value`, and the detail carries the menu so
+      // the redraft can choose instead of guess). Collapsing them would launder an
+      // attempted fence escape into a typo class.
+      if (!isNonEmptyString(e.scope) || !scopeMenu.includes(e.scope)) {
+        const contained = isNonEmptyString(e.scope) && scopeContained(e.scope);
+        if (contained && !insideFence(globToPrefix(e.scope))) {
+          red('scope-escape', `${eAt}.scope`, `"${e.scope}" is outside the signed fence [${fence.join(', ')}]`);
+        } else {
+          red('invalid-value', `${eAt}.scope`, `one of the offered scopes: [${scopeMenu.join(', ')}]`);
+        }
+      } else if (!overlapsStepScope(globToPrefix(e.scope))) {
+        // W3: an offered, in-fence scope can still be DISJOINT from the step's own
+        // narrowed fence. Measured against src/exits.js: `tree-changed` passes iff
+        // some file under ITS scope changed against the pre-step snapshot, and that
+        // snapshot already holds every earlier step's bytes — so a disjoint scope
+        // can only pass if ground this step's gate refuses changed. Unsatisfiable on
+        // every attempt, which is exactly the burn W3 closes.
+        // A WIDER (containing) scope is NOT redded: it contains the step's writable
+        // ground and fires exactly when the narrow one does.
+        red('step-scope-escape', `${eAt}.scope`, `"${e.scope}" is disjoint from this step's own scope "${stepScope}" — the step's gate allows writes only under "${stepScope}", and this exit passes only if a file under "${e.scope}" changed, so no write this step can make would ever satisfy it (a scope that contains "${stepScope}" is fine)`);
       }
     } else { // artifact-written | json-valid — a named file path inside the fence
+      // NO step-scope check here, deliberately (W3): src/exits.js reads and parses
+      // the named file and asks nothing about who wrote it, so a path outside the
+      // step's own scope naming a PRIOR step's artifact is legal AND satisfiable —
+      // and v1 is strictly sequential, so that composition is the natural shape.
+      // A red would claim a constraint the evaluator does not impose. A path nothing
+      // ever produces still fails at runtime with the mechanical "was not written"
+      // gap — the honest direction, versus taxing a legal draft with a redraft.
       if (!isNonEmptyString(e.path) || !scopeContained(e.path)) {
         red('invalid-value', `${eAt}.path`, 'a relative file path inside the run dir — no absolute paths, no ".." segments');
       } else if (!insideFence(globToPrefix(e.path))) {
@@ -221,8 +536,15 @@ function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep })
       if (e.type === 'artifact-written' && e.pattern !== undefined) {
         if (!isNonEmptyString(e.pattern)) red('invalid-value', `${eAt}.pattern`, 'regex source string');
         else {
-          try { new RegExp(e.pattern, 'm'); }
+          let compiled = false;
+          try { new RegExp(e.pattern, 'm'); compiled = true; }
           catch { red('invalid-value', `${eAt}.pattern`, 'must compile as a RegExp'); }
+          // F49: a compiled-but-catastrophic pattern (nested unbounded
+          // quantifier) can hang the untimed exit evaluator — reject it here as
+          // a mechanical gap so the replan rewrites it, before any tokens burn.
+          if (compiled && hasNestedQuantifier(e.pattern)) {
+            red('invalid-value', `${eAt}.pattern`, `nested unbounded quantifier (e.g. (a+)+ , (\\d*)* , (x+){1,}) — a catastrophic-backtracking footgun that can hang the exit evaluator (F49); rewrite without a repeated group inside a repeat`);
+          }
         }
       }
     }
@@ -234,4 +556,18 @@ function validateExit(s, at, red, { checkNames, fence, insideFence, writeStep })
   if (writeStep && hasCheck && !hasTreeChanged) {
     red('exit-illegal', `${at}.exit`, 'check-passes on a write-granted step requires the tree-changed conjunct — the seed tree is green, so a lone check would pass on the untouched repo (F17/F46 already-green trap)');
   }
+  // The inverse trap, measured (runs ms4l5p6w/ms57zr7c: 4 of 4 drafted plans):
+  // a failing check's gap is re-delivered to THIS step's own worker, so a step
+  // holding a check must be able to act on it. A read-only "verify" step is a
+  // mailbox with no hands — the gap arrives, nothing can edit, the loop stalls
+  // to cap on a byte-identical gap. The outer close is the run's verification;
+  // forbidding this shape pushes the check onto the step that fixes (the one
+  // shape that has ever greened this job).
+  // …and only when the grant PARSED: with `tools` missing/malformed the step's
+  // hands are unknowable, and a mailbox red derived from the false default would
+  // charge the ledger with a violation the agent never committed (the real
+  // defect already redded as missing-required/invalid-value). One defect, one red.
+  if (toolsParsed && !writeStep && hasCheck) {
+    red('exit-illegal', `${at}.exit`, `check-passes on a step with no write-class tool (${WRITE_VERBS.join('|')}) — the check's failure gap comes back to this step's own worker, which cannot edit; attach the check to the step that fixes (the operator's close already verifies the finished run)`);
+  }
 }