bareloop 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -5,7 +5,1135 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
-## [Unreleased]
+## [0.7.0] — 2026-08-05
+
+### Changed
+- **`ralph()` now REFUSES a call with no exhaustion rule** (public API). `capRuns` became
+  optional in the signature when the `ladder` governor arrived — *"required unless `ladder` is
+  supplied"* — and nothing enforced the "unless". With neither, `1 <= undefined` is false: the
+  middle ran **zero** times and the call still returned `escalated` after emitting `cap-halt`
+  and an escalation reading `undefined/undefined runs spent, close still red` — a governance
+  stop narrated for a loop that was never entered. A param guard at entry now throws, naming
+  both alternatives (either one repairs the call). `capRuns` must be a positive integer;
+  `0`, `2.5`, `'3'`, `null` and `NaN` are refused the same way. **No shipped path changes** —
+  both in-library callers (the step loop and the close-fix loop) pass a `ladder`.
+- **ONE progress instrument for both governance halts.** The wall halt used to run its own
+  reader — byte equality of the last two close gaps, reporting `stalled` / `moving` / `unknown`
+  beside the money halt's `flat` / `converging` / `unknown` on the same run. Two readers for one
+  question is how the two come to disagree, and the byte reader could only ever report MOTION —
+  that something changed, never which way. Both halts now read the run's own `src/trend.js`
+  reader. Where a stage reported a comparable NUMBER it decides (so a wall halt on a converging
+  run now says `converging`, with the series, instead of "it moved"); where none did, the byte
+  comparison survives INSIDE `unknown` as a new `motion` field (`changed | unchanged | null`)
+  and as a clause in the `reading`, with the lever adapting (`unchanged` → revise the goal;
+  `changed` → read the last close output). **Never promoted to a direction and never mapped onto
+  `trend`** — "the close's output changed" is not "the run got better" (F6 in a trend's coat).
+  W-2's semantics are untouched: the grade already minted is kept, the three levers are the same
+  three, and the close is still never bounded by the wall. **Spine change:** the `wall-halt`
+  record's `trend` now carries the money halt's vocabulary and a sibling `motion` field; no
+  `src/` or `scripts/` reader consumed the old values (grepped).
+
+### Added
+- **A MONEY halt is decision-ready, exactly as W-2 made the wall one** (PRD v1.46 §2). A run
+  cut by its budget KEEPS the verdict already minted and emits a new `money-halt` spine record
+  carrying `budgetUsd`, `remainingUsd`, the kept `verdict`/`stage`, a progress `trend`
+  (`converging | flat | unknown`) with the `reading` and `series` it judged, and three
+  `options`: top up and resume, revise the spec, abandon. Emitted at every site that cuts a run
+  on money — the step loop, the close-fix loop, and the scout/draft relay. **The library only
+  reports**: `budgetUsd` is in the spec hash, so a top-up is a spec edit a human signs, and
+  nothing in a run may widen its own budget (unchanged hard line).
+- **The close TREND instrument** (`src/trend.js`, internal). Reads a run's own close grades as
+  a series **per stage**, compared only against that stage's own best so far. Accuracy law:
+  never across stages — merging a staged close's axes reads a real see-saw (suppressions
+  12 → 5 while the type errors that scrub re-exposed went 2 → 0) as a regression. Never model
+  prose: the reading is the first number on the first red-marked line of the stage's output.
+  A stage that reports no number donates nothing — not a zero, not a strike, and the verdict
+  says `unknown` out loud (F6). Reaching a later stage than ever before counts as progress
+  (a staged close is first-red-wins). Known accepted limit, documented at the site: a
+  floor-shaped stage (`N tests executed, below the seed's M`) reads as not-improving rather
+  than converging — the fail-safe direction.
+- **A resumed run's trend judges the WHOLE chain, not just the leg.** `readResume`'s `restart`
+  gains `grades`: the dead leg's close grades in order, as `[{stage, value}]` — counts and stage
+  names only, never a gap byte. `runJob`/`runPlan` take them as `resumeGrades` (beside
+  `resumeSeed`) and `createTrend` takes them as `seed`, folding them into the run trend's series
+  and per-stage bests. Without it a resumed leg restarts the trend at its own first close and can
+  report `flat` — *revise the goal* — on a run that was converging when its allowance ran out; a
+  leg that re-grades an unchanged tree is flat on its own evidence while the RUN is what the
+  top-up decision is about. The seed is history, not this leg's evidence, so it counts no
+  iteration, mints no strike, never sets `comparableEver` on its own (the blind-cap backstop
+  still governs a leg whose own readings never compare) and donates no stage position. The
+  close-fix loop's governor is deliberately **not** seeded — it answers the leg-local question
+  ("is this loop out of ideas"), and seeding it rendered "still progressing" inside the terminal
+  of a loop that had just struck out flat. Grades are read from the `ladder` records the live
+  governor already wrote (`governor: 'close-trend'`, verbatim, never re-parsed), from
+  `close-precheck`/`outer-close`, and — only on a spine predating that governor — from the
+  `close-verdict` records after the `fix-loop` marker, which is the same population and excludes
+  a STEP's failing exit. Known limit: one spine is read, so a resume of a resume inherits the
+  previous leg's chain and not the one before it. `scripts/run-u.mjs --resume` wires it and names
+  the inherited baselines in its preview.
+- **`--resume` on `scripts/run-u.mjs`** (PRD v1.46 §3) — the third leg of the resume rulings.
+  It skips the patient reset (`resumeTreeGate` instead: a dirty tree is what a resume expects;
+  only a moved HEAD stops it), folds the halted run's money and wall in so the signed ceiling
+  cannot widen by being re-invoked, re-enters at the checkpoint the steps already earned, and
+  arms the outside watchdog on the REMAINING wall. `readResume` gains two options, both OFF by
+  default so the reuse loop is byte-unchanged: `direct` reads a plain `runJob` spine as one
+  implicit try, and `resumableOutcomes` reclassifies a landed `job-end` that is a GOVERNANCE
+  HALT (`cap-halt`/`wall-halt`) as a checkpoint rather than a graded row. Green and every red
+  stay non-resumable — a verdict already rendered is never re-bought. `job-start` now carries
+  the declared fold (`priorSpentUsd` with its `priorSpendComplete`, and `priorWallMs`) when
+  there is one, so a chain of resumes adds only each attempt's new rounds instead of
+  re-deriving and double-billing.
+  **Validated live and pinned by cycle tests (F83).** Live: a signed top-up resumed a real
+  money cap-halt at its close checkpoint — finished step skipped, no re-scout or re-draft,
+  patient continued, watchdog armed on the REMAINDER — and greened, with `job-end` stating
+  the folded total across both legs. Pinned deterministically by five `$0` scripted-round
+  tests covering the whole cycle: leg-1 halt → top-up → leg-2 green at the checkpoint (a
+  close-precheck red proving the green was earned, not inherited); a **no-top-up control**
+  where the same budget buys no second pass and leaves a byte-identical tree (one
+  round-boundary overshoot round, the documented behaviour of a cap that binds BETWEEN
+  rounds); an **unsolvable cycle** where a topped-up leg making no per-stage progress
+  strikes out `flat` with the wallet still largely unburned — the fix loop's strike rule
+  governs a resumed leg exactly as it governs a cold one; and an F6 floor surviving halt →
+  fold → green terminal.
+- **Layer 3, the REUSE rung — the registry, the load gate, and the MECHANICAL START**
+  (design record `docs/plans/2026-08-01-layer-3-reuse-design.md`; execution probe green
+  before any of it was built). A green's plan is now an artifact the next run of the same
+  SHAPE can start from, instead of being discarded.
+  - **`src/bridges.js` — the registry (D1/D6).** A directory of plain JSON files at an
+    OPERATOR-supplied path (no database, no new dependency, no default location).
+    `mintBridge` / `appendGreen` / `appendRed` / `saveBridge` / `loadBridge` /
+    `loadRegistry` / `makeRegistry` / `registryExists` / `validateBridge` / `listingRow` /
+    `deriveStatus`, all exported. **Only a green writes the box (R1):** a red writes a
+    history row and never touches `versions`. **Status is DERIVED, never stored (D6):**
+    candidate = one green, proven = greens on two DISTINCT patients, a red on a proven
+    entry demotes it — and a CASUALTY is not a red. There is deliberately no probability
+    score. Costs and durations are a number or an EXPLICIT `null` with the key required
+    either way, so an unknown is said rather than omitted (F6).
+  - **`loadGate(bridge, job)` — D2 as SPLIT (2026-08-01 addendum).** Three shape checks at
+    the door — verdict type, close-stage kinds, verbs within the signed menu — and
+    **nothing about paths, scopes or targets**: those are instance-bound and expected to
+    red, which the pre-probe measured the drafter fixing unaided (3/3 legal after tweak),
+    while the gate as originally frozen would have refused every cross-patient recipe.
+  - **`bridge?` on `runJob` and `runPlan` — the mechanical start (D4).** With a bridge, the
+    gate runs before the clock, the close precheck and any token; on a pass the NEWEST
+    version's plan-as-executed becomes the drafter's STARTING DRAFT inside the ordinary
+    drafting prompt (`planPrompt` gained an optional `startingDraft` argument). The tweaked
+    plan then passes the SAME `validatePlan` every cold draft passes — **no second, looser
+    path exists for an inherited plan** — and the ONE-replan ceiling is untouched (D5): a
+    replan drafts from the run's own state and never re-injects the bridge.
+  - **New terminal `recipe-stale`** (`runJob`/`runPlan`): a bridge that fails the load gate
+    is refused at the door with `bridge-gate {outcome, name, reds}` on the spine, a
+    decision-ready escalation, and **zero spend**. Falling back to cold drafting is the
+    CALLER's decision, never an automatic silent fallback. Classified as a deliberate
+    ledger exclusion — the gate refusing a wrong-KIND recipe is the mechanism working, not
+    a library bug to file upstream.
+  - **New spine events:** `bridge-gate` (a refusal, with its reds) and `bridge-loaded`
+    (`{name, versions, runid}` — which version inherited).
+  - **`src/selection.js` — D3's display half.** `renderListing(registry)` renders the
+    operator/LLM-facing workflow listing (name, goal, status, greens/reds, the cost/time
+    band of the greens), deterministic by name and total on garbage; an unknown cost or
+    time renders `UNKNOWN` and a partial aggregate says how many it skipped, and registry
+    entries that could not be read are NAMED so the listing is never quietly shorter than
+    the directory. `selectionPrompt(listing, ask)` is the pure prompt text for the pick,
+    carrying D3's two standing rules: *"none matches"* is a first-class answer that means
+    drafting new, and a PINNED workflow may be refused only EXPLICITLY, with a reason. Both
+    are pure text — the selection call, the pin/shortlist/force-cold flow and the parse of
+    the answer belong to the caller.
+  - **The cold path is byte-identical without a bridge** (the F47 works-both-ways rule),
+    pinned by test: no new event fires and no starting draft appears anywhere in the prompt.
+  - **`src/reuse.js` — the D7 ENVELOPE and the REUSE RUNNER.** hamr's sentence made
+    executable: *"we ask user for cost/time and how many workflows to try before starting
+    new like $5 and 30 mins x2 then start anew if both red"*.
+    - **`validateEnvelope(input, { job? })`** — `{ perTryBudgetUsd, perTryWallMs,
+      bridgeTries }`, **all three required and explicit, no defaults** (a defaulted cap is
+      a silent second ceiling); `bridgeTries: 0` = force-cold. The envelope may only
+      **TIGHTEN** the signed spec — a per-try number above `job.budgetUsd`/`job.maxWallMs`
+      is `envelope-widens`, never a silent raise.
+    - **`resolveTrySpec(job, envelope)`** — the per-try spec every try runs, cold leg
+      included. Tightening moves the SPEC HASH, so a tightened run is a new spec VERSION
+      the operator signs; `runReuse` passes `approvals` straight through and cannot forge
+      one. An envelope equal to the spec's numbers is hash-identical.
+    - **`selectBridge({registry, job, ask, provider, pinned?, shortlist?, forceCold?,
+      exclude?})`** — ONE model call on the caller's drafter-tier provider (none is
+      constructed inside), parsed through the repo's one `extractArtifact` into a strict
+      `{choice, reason}`. `forceCold` and an empty candidate set skip the call for $0. A
+      name outside the listing is a red, never used. **A pin does not bypass the call**
+      (D3): it is stated in the prompt, and an answer naming anything else returns
+      `{refused: true}` — the substitute is NOT adopted and the decision goes back to the
+      operator. Cost metered and reported (F6).
+    - **`runReuse({job, approvals, registryDir, envelope, patient, workdir, provider,
+      emit, …})`** — selection → try → box → next try → cold. Selection re-reads the
+      registry per try with the tried names excluded; **a green ENDS the loop**; tries
+      exhausted falls through to a cold run under the same per-try numbers, whose green
+      mints a new bridge for the job slug (or appends if that name already holds greens —
+      clobbering a green is what R1 exists to prevent), and whose red writes nothing (the
+      entry bar is a green). Every non-green return is decision-ready. The three answers
+      **no further try could change** — `unapproved-spec` (a tightened envelope is a new
+      spec version, signed not inherited; the decision hands over the exact hash),
+      `job-red`, `smoke-red` — end the run where they happen instead of reproducing
+      themselves down the whole envelope. A cold green also REFUSES to mint over a file of
+      that name it could not read (`mint-collision`): an unreadable entry is not an absent
+      one, and whatever greens it held are gone once overwritten.
+    - **`REUSE_GRADED_RED`** — only `escalated` demotes: the terminal where the close
+      judged the tree, the fix loop spent its attempts with money still on the table, and
+      the close was still red. Every other non-green outcome is a CASUALTY recorded under
+      its own name (`cap-halt`/`wall-halt` governance, `provider-red`/`step-stalled`
+      transport, `close-red` the close FAULTING and rendering no judgment, `recipe-stale`
+      refused at the door, `plan-red`/`step-red:*`/`check-red` stopping before the close
+      ever judged). Full detail still lands on the history row.
+    - **F45 made visible instead of thresholded.** A try's budget must fund the attempt
+      PLUS its close, and nothing in-process can know what a close costs — so **no
+      threshold is invented** (threshold-setting is arbiter territory, from a measured
+      base rate). Instead every try row carries `spentUsd` vs `capUsd`, `wallMs` vs
+      `wallCapMs`, `capBound`, `wallBound` and **`closeReached`**: a cap that died before
+      any grading is a fact on the row, not an inference.
+    - **New spine events:** `reuse-start`, `selection-result`, `try-start`, `try-end`,
+      `bridge-write`, `reuse-end`, plus `envelope-red`. **New escalation categories**
+      `reuse-exhausted` / `selection-refused` / `selection-red` / `registry-red` /
+      `envelope-red`, all added to the ledger's executable excluded-set — the envelope and
+      the operator speaking, never a library failing (a real transport fault out of the
+      selection call still classifies as `provider-red`).
+  - **`selectionPrompt(listing, ask, pinned?)`** gained the optional pin argument, so the
+    pin sentence has ONE spelling rather than being assembled by each caller.
+  - **`scripts/run-reuse.mjs`** — the reference operator runner: `--job` / `--registry` /
+    `--budget` / `--wall` / `--tries` (+ `--pin` / `--force-cold`), approval gate on the
+    RESOLVED per-try hash, seed refusal (it never resets the patient for you), F67 outside
+    watchdog sized for the SUM of the tries, gate-audit relocation, secrets scan, and a
+    sleep-inhibitor note in the header (F72 — a suspend freezes every guard, including the
+    watchdog).
+  - **RESUME AFTER A KILL (module C).** A killed reuse run comes back losing as little as
+    possible — hamr's ruling: *"money, signature and checkpoint (starts from where it
+    stopped) if mid loop, restart that loop"*.
+    - **`readResume(events, {deathAt?})`** turns a dead run's OWN spine back into the
+      state a resume continues from: which tries completed (never re-run, bridges still
+      spoken for), whether a try was mid-flight (a `try-start` with no `try-end` — never
+      graded, so never consumed), what that attempt already spent in money and wall, and
+      which signed envelope the spine belongs to. Spend is summed from `worker-round`
+      ONLY — the same event `runJob`'s ledger accounts — so a selection call's cost is
+      never attributed to a worker (F45); a restarted try DECLARES its inherited fold on
+      its own `try-start`, so a resume of a resume folds once rather than double-billing
+      an abandoned attempt. A try whose `job-end` landed is COMPLETE, not restarted, and
+      a registry row lost to the kill is named (`r1Missing`), never re-derived.
+    - **The remainder, never a fresh allotment.** `runJob` gained `priorSpentUsd` /
+      `priorSpendComplete` / `priorWallMs` and `createClock` gained `priorElapsedMs`: the
+      killed attempt's spend and time FOLD IN, so the restart runs under what is left of the
+      SIGNED per-try numbers. The caps themselves are never rewritten — they are in the spec
+      hash, and editing them would need a signature nobody typed. An unfundable remainder caps
+      honestly (`cap-halt`, or `wall-halt` below one close timeout) having launched
+      nothing. **A floor stays a floor across the resume:** if any round inside the dead
+      attempt came back unpriced, `priorSpendComplete: false` rides one-way onto every
+      `job-end` this run emits, so a resumed attempt states a floor instead of an
+      exact-looking total (F6 — it was previously computed and recorded on `try-start` but
+      never reached the component whose terminal says so). The restart fold reads ALL four
+      of `runJob`'s floor causes: a landed resumable `job-end` carrying
+      `spendComplete: false` (a stall, or a call cut mid-flight) floors the fold exactly
+      like a declared prior floor or an unpriced round (F83's laundering finding, fixed;
+      the no-`job-end` killed-mid-flight restart is control-pinned unchanged).
+    - **`runReuse({… resume})`** seeds the completed tries, restarts the mid-flight one
+      against the SAME workflow with no second selection call, and carries on into
+      whatever the envelope still authorizes. It refuses (`resume-red`, ledger-excluded)
+      a seed signed under a different envelope, or a restart whose workflow has left the
+      registry. New spine event `resume-start`; `try-start` gains the declared fold.
+    - **`resumeTreeGate({head, seed, dirty})`** — a resumed patient is CONTINUED, never
+      reset: the dead tries' edits are real progress. Only HEAD moving off the seed (a
+      commit or rebase under the dead run — operator intervention) stops it.
+    - **`makeSpine(file, {startSeq})`** so a resumed process continues one append-only
+      log with `seq` still monotonic, and **`scripts/run-reuse.mjs --resume <runid|path>`**:
+      it refuses a spine that is missing, corrupt mid-file, already terminal, or whose
+      process is STILL ALIVE (pid from the run's new `runner-start` record and the
+      watchdog report, discriminated by `/proc/<pid>/cmdline` because pids are recycled),
+      prints both hashes on an envelope mismatch, previews the whole reconstruction
+      before you sign, archives the killed run's watchdog record so it cannot be read as
+      this run's, and sizes the watchdog for the REMAINING work.
+
+### Changed
+- **`capRuns` retires as the CLOSE-FIX loop's governor** (PRD v1.46 §4). That loop now ends on
+  the same 2-strike no-progress rule the step ladder uses, read off the close's own per-stage
+  numbers rather than repeats and writes. Validated by a $0 replay over every archived fix
+  loop before the build: 0 greens harmed (all three historical fix-loop greens converted in
+  ≤ 2 verdicts) and 1 real waste case caught (dead flat at 2 errors for 7 consecutive fix
+  verdicts until the wall killed it). `capRuns` survives ONLY as the bound for a close whose
+  output carries no number at all — a governor that cannot see the variable must not be the
+  governor — and lifts the moment a stage reports a comparable number. Money and the wall keep
+  every bit of their authority. The exhaustion terminal is unchanged in both category
+  (`cap-halt`) and outcome (`escalated`); `ralph`'s `ladder` option is now an INTERFACE two
+  governors implement, with an optional `terminal()` that overrides the exhaustion prose only
+  (the step ladder's copy offers a replan and there is no planner at the close). Every `ladder`
+  spine record now names its `governor` (`step-ladder` | `close-trend`). The wall-halt readout
+  no longer quotes `capRuns` as a denominator, because it no longer governs.
+- **A plan step is bounded by PROGRESS, not by a count** (`src/ladder.js`; F77–F79). The step
+  loop's fixed iteration cap is replaced by a strike ladder: a *strike* is a red iteration that
+  repeats an already-seen gap (matched against a seen-set for the whole step, never just the
+  last one) or made no gate-audit writes (the F32 record-count instrument — never `git status`,
+  never a tree diff); strikes are sticky and `strikeLimit` of them (new shell option on
+  `runJob`/`runPlan`, **default 2**) ends the step. Gaps are normalized for comparison only —
+  timing bytes dropped, counts and file names kept — so a shrinking error count reads as
+  progress. The wallet, the wall, the variance meter and the stall fuse keep every bit of their
+  authority; the exhaustion terminal is the same `cap-halt`. Measured motivation: two
+  calibrations died `step-red` while still converging with money and wall unspent; a $0 replay
+  over 110 archived step ladders showed every converging red continuing and thrash ending
+  same-or-one-earlier. **`capRuns` now bounds the CLOSE-FIX loop only.** New per-iteration spine
+  record `ladder`; exhaustion records carry `strikes`/`strikeLimit`/`distinctGaps`.
+- **The replan brief names the MECHANISM.** An exhausted step now tells the redrafting planner
+  which shape ended it (converging-cut / stalled-no-write / repeated-gap, with iteration numbers
+  as evidence), its gap trajectory, and how much money and wall the stop left unspent (time
+  reported UNBOUNDED when no wall was set, never `0`) — replacing *"it ran N attempts and its
+  exits were still red"*, which named no mechanism and read identically for opposite failures.
+- **Layer R's VERBATIM ratchet stage is retired on the STEP path** (hamr's ruling): fixation is
+  a repeat, so a fixated step strikes out before the fourth iteration can open. The stage stays
+  reachable in the close-fix loop and fully unit-covered; Layer R still ships OFF by default.
+
+### Deprecated
+- **`steps[].attempts` is retired and INERT.** It is no longer offered in the drafting prompt
+  and the runner ignores it. It is still ACCEPTED by `validatePlan` — stored bridge plans carry
+  it, and a plan minted under one runner's number must not red under another's — with the shape
+  still checked and the old `<= capRuns` ceiling dropped. It was TIGHTEN-only, which made the
+  correct heal for a converging step inexpressible. `validatePlan`'s `capRuns?` option is
+  removed with the ceiling it fed (it existed only to bound `attempts`; an extra property is
+  ignored, so no direct caller breaks).
+
+### Changed (the close-stage AXIS SPLIT — hamr: "#1 fix")
+- **One POPULATION per close stage, so unlike numbers can never share a trend series.** The
+  trend reads one bucket per stage NAME, and a stage name is not an axis: `typecheck` red
+  either `N error(s) in <scope>` (the in-scope faults) or `the target files are clean but M
+  strict error(s) exist outside them` — a different population, reached only once the first is
+  zero — and `suite-green` mixed a failure count with an executed-count floor. A run crossing
+  either seam donated two genres to one series, so a 29 → 4 across it read **converging** and
+  would have recommended a top-up on work that had only swapped which wall it was behind.
+  Every mixed stage in the six `u-*` closes is now split: **`typecheck-outside`** carries the
+  outside-scope population immediately after `typecheck`, and **`tests-kept`** carries the
+  executed-count floor immediately before `suite-green`. Each new stage sits exactly where its
+  branch already ran, so the gate sequence is byte-order identical to the old single-stage
+  walk and first-red-wins is unchanged; `litectx`/`spawner` `typecheck` was verified
+  single-population and left alone. `src/trend.js`'s KNOWN LIMIT is rewritten as the historical
+  record plus **the law for close authors** — the remedy for a mixed stage is that close's stage
+  list, never a detector taught to tell two prose shapes apart (the F49 precedent).
+  - **All six `u-*` spec hashes flip**, by construction: a close's stage names are in the
+    signed spec, so the runner refuses every one of them until it is re-signed. That is
+    refuse-until-re-signed working, not a migration to smooth over.
+  - **Stored bridges whose `closeStageNames` predate the change refuse to load** — the load
+    gate's close-stage check is the doctrine that a changed close is a different KIND of job.
+    `aurora-u-spawner` and `litectx-u` are in that state now and are re-minted by a green under
+    the new close, never edited into agreement.
+  - **The F28 trim announcement is restored** where the split surfaced its loss: the
+    outside-scope branch pre-sliced its own echo, silently suppressing the "trimmed" notice a
+    gap bound must announce (a 341-line elide is visible again).
+  - **New `tests/close-stages.test.js` (20 tests)**, including a can-it-fail pre-flight against
+    the pre-split tree, spec↔script stage-list agreement over spawned real closes, and the
+    29 → 4 repro reading as two stages with a same-stage contrast proving the test can fail.
+    Live `$0` validation: pulselog green across all four split stages, baremobile
+    `typecheck-outside` RED at 381 reading correctly as its own series. **1007 tests.**
+
+### Fixed (whole-branch review, 2026-08-05 — 4 opus finders over `main...layer-3-reuse`; F84)
+
+*Every confirmed finding fixed, each verified against source before it was believed; no fix
+forced, and three finder claims corrected in detail during the fixing.*
+
+- **CRITICAL — the close trend's BLIND CAP was a one-way latch.** `capRuns` survives as the
+  fallback for a close whose output carries no comparable number, and it was armed by
+  "has this leg ever compared anything" — which a bare STAGE ADVANCE satisfies, on
+  essentially every run that does any work at all. One advance therefore disarmed the
+  fallback **permanently**: a later run of numberless reds (the shipped aurora TESTGEN
+  `verdict` stage is exactly that shape) accrued neither a strike nor a blind tick and was
+  bounded by money and the wall alone, where the retired count would have stopped it.
+  Reproduced by execution before the change — 27 iterations, no terminal. The cap now bounds
+  the **consecutive uncomparable streak**: it lifts the moment the instrument can read and
+  **re-arms the moment it cannot**, binding a recovered run never and a blind-from-birth run
+  on exactly the iteration it always did (pinned byte-stable by test, at every cap). The
+  `report()` `blind` flag follows the same question — a live streak IS blindness, so the
+  terminal no longer offers "0/2 strikes" as the reason a loop it did not strike out was
+  stopped.
+- **`priorFloor` no longer requires money to have been spent.** `runJob` derived it as
+  `spentUsd > 0 && priorSpendComplete === false`, so a resumed leg inheriting a fold of **$0
+  that was not exact** — every round of the dead attempt unpriced — came back reading as an
+  exact zero. A floor OF zero is still a floor (F6). Read off the flag alone now, and the
+  onward `job-start` declaration is emitted for that case too (`spentUsd > 0 || priorFloor`),
+  which is the only field that can carry the unknown forward.
+- **A reuse RESUME's halt readout now spans the chain.** `restart.grades` was computed by
+  `readResume`, declared on the record, and then handed to nobody: only `scripts/run-u.mjs`
+  passed `resumeGrades` on. `runReuse`'s own per-try execution now threads it into `runJob`,
+  so a restarted leg's `money-halt`/`wall-halt` trend judges the RUN rather than restarting at
+  this leg's first close and reporting `flat` — *revise the goal* — on a run that was
+  converging when its allowance ran out. `resume-start`'s `restart` states
+  `gradesInherited` (a COUNT; the seam carries stage names and numbers, never a close byte),
+  and only when there is one — the cold path is unchanged.
+- **The `money-halt` record carries `spendComplete`.** `remainingUsd` is `budget − spent`, so
+  a run whose spend is a FLOOR has a remaining that is a CEILING; quoting it to four decimals
+  read as the number. `runPlan` takes the ledger's own `spendComplete` (one spelling of the
+  four causes, never a second arithmetic) and states it beside the figure — the same duty
+  `wall-halt` has carried since W-2.
+- **A try row's ROUNDS fold across a resume, like its money and its wall.** A restarted try
+  reported only the restart's turns against a span its `$` already covered both legs of.
+  `try-start` declares `priorRounds` (including when it is `null`: absence means a spine older
+  than the field, an explicit null is a predecessor that could not count its own turns — and
+  an unfoldable count stays `null` rather than becoming the half this leg can see, F6). The
+  inherited-graded row's `wallMs` is likewise measured to the try's **own terminal** now, not
+  to a kill that may have landed minutes later.
+- **The replan brief no longer calls an IDLE strike-out "converging".** The sentence was gated
+  on repeats alone, so a step that wrote nothing in any iteration was handed *"no file was
+  written in iteration(s) 1, 2"* and *"the step was converging"* in the same paragraph — to
+  the one channel the redrafting planner adapts to. Both signals gate it now; a moving exit
+  output on a step that wrote nothing is a close re-running, not work converging.
+- **`planPrompt`'s JSDoc was detached from `planPrompt`.** An intervening helper landed between
+  the block and the function, so every parameter shipped as `any` in the generated `.d.ts`.
+  Reattached; no behaviour change, and the types are the contract.
+- **W-2 on the LAUNCH side: a zero wall remainder now REFUSES, loudly.** `--wall-ms 0` reached
+  `scripts/u-watchdog.mjs`, which defaulted a non-positive value to `null` and armed **no
+  deadline at all** while the runner's own banner still advertised one — a guard reading zero
+  and saying nothing. The watchdog now refuses any PRESENT-but-unreadable numeric flag
+  (`0`, negative, garbage) with exit 2, while an OMITTED `--wall-ms` stays the legal unbounded
+  choice with the stale trigger armed. Both runners refuse above the spawn, before the key and
+  before the patient: `scripts/run-u.mjs` on an exhausted resume remainder, `scripts/run-reuse.mjs`
+  on `plannedWallMs <= 0`. **Two zeros, two levers** — a restart whose wall is burned wants
+  `--wall` (NO WALL LEFT), a run whose authorized attempts have all run wants `--tries` or
+  nothing (NOTHING TO ARM) — because naming the wrong lever sends the operator to re-sign a
+  number that buys no attempt. Both are in the approval hash, so either is a new signature.
+- **`scripts/run-reuse.mjs` hardening.** A corrupt/truncated watchdog report can no longer abort
+  a signed resume at the last gate (it is parsed once, defensively, and reused; the archive
+  suffix falls back to the ARCHIVE moment so a second unreadable report cannot overwrite the
+  first). `runner-start`'s `argv` is redacted **at the write site** with the shipped
+  `redactSecrets` inventory — an append-only log that captures a key captures it forever, so an
+  after-the-fact whole-file scan is too late. A trailing value-flag (`--tries` with nothing
+  after it) now refuses instead of reading `Number('') === 0` and silently reshaping the run
+  being signed. The header's deliberate-differences list gains the fourth: the end-of-run leak
+  scan is a READOUT here, not a gate, because `runReuse` writes registry rows mid-run.
+- **Archived runners annotated** (`reuse-preprobe`, `run-calibration-testgen`, `run-poc-layer2`,
+  `run-probe-testgen`): their `CAP_RUNS` comments described the retired drafting-prompt
+  interpolation, not the close-fix loop's blind fallback it actually is now.
+
+- **Tests: 987 total** (from 959). The mutation-proven hole: a widening of `REUSE_GRADED_RED` — the
+  set whose members DEMOTE a proven bridge — survived the entire suite, so the demotion table
+  is now pinned outcome by outcome (`escalated` demotes; `step-red`/`cap-halt`/`wall-halt`/
+  `provider-red`/`close-red`/`step-stalled`/`pricing-red` are casualties and proven stays
+  proven). Plus the blind-cap backstop battery (blind-from-birth pin, streak-not-birth,
+  never-fires-while-reading, recovery resets), the launch-side refusals at all three sites,
+  the resume grade/round folds with their absent-baseline controls, the money-halt floor
+  readout, and a first battery for `scripts/migrate-bridge-patient-slugs.mjs` (dry-run
+  byte-identity, whole-file refusal over half-migration, name/filename disagreement — 4
+  mutants killed).
+
+## [0.6.0] — 2026-07-31
+
+### Added
+- **P — the worker's palette widens 6 → 14 verbs, and a step gains a vocabulary** (design
+  record 2026-07-28). The plan surface exposed two of litectx's verbs and the agent could
+  choose almost nothing about HOW a step ran (F56).
+  - `TOOL_MENU` (`src/job.js`) is now four components: **write** (`write` · `edit`), **select**
+    (`read` · `grep` · `recall` · `get` · `impact` · `related` · `recent`), **compress**
+    (`compress` · `peek`), **isolate** (`stash` · `remember` · `forget`). Every verb maps to an
+    EXISTING litectx/bare-agent implementation — the menu is an INVENTORY, nothing was built to
+    fill it. Select/compress verbs are gate-judged as `read` actions through the same fence;
+    isolate verbs write the `.litectx` STORE and carry their OWN gate action types, so a store
+    park can never be counted as a tree write by the F32 `workerWrites` instrument. `run` stays
+    locked at every layer.
+  - New `WRITE_VERBS` / `STORE_VERBS` split: **neither class is read-capable**, so the scout's
+    grant filters both, and a ceiling made only of them reds `invalid-value` at sign time (a
+    write-only ceiling hands the scout an empty menu and it surveys blind).
+  - Each component ships its F19 strategy line (`COMPONENT_STRATEGIES`, `src/tools.js`),
+    composed into the persona only for components with a granted verb — capability without
+    strategy is inert, and a strategy for a verb the worker does not hold is noise.
+  - **Three new step fields, each legal set handed over as a MENU** (`src/plan.js`,
+    choose-don't-describe): `model` (`sonnet` | `haiku`, `STEP_MODELS` — `opus` deliberately
+    absent, hamr-assigned only, never plan-selectable), `attempts` (integer `1..capRuns`), and
+    `scope` (one value from the same `legalScopes` menu `tree-changed` uses). All optional, all
+    **tighten-only** — a plan may narrow the shell's caps and the signed fence, never widen them.
+  - **Each field is WIRED or REFUSED, never silently ignored** (the F50 blind-instrument class):
+    `scope` narrows the live gate fence (proven — an in-job-fence write denied by the step's own
+    scope), `attempts` tightens `ralph`'s cap (proven — exactly one iteration), and `model` routes
+    that step's worker through a new **`providerFor(tier)`** factory on `runJob`/`runPlan`.
+    **A step naming a tier when the caller supplied no factory is a NAMED `interpreter-red` stop**
+    — a wiring gap, not a plan defect — never a silent run on the default tier as if the choice
+    had been honoured.
+  - `scripts/run-u.mjs` supplies that factory (the tier→model mapping is the RUNNER's territory,
+    never the schema's) and gains a `--model` tier flag, and now **deletes `.litectx` at every
+    reset — cold means cold**: the isolate verbs persist across runs, so an uncleaned store would
+    leak run N's memory into run N+1's "cold" baseline and quietly poison the reuse rung's OFF arm.
+  - The U job specs widen to the full catalog, which is a NEW spec hash and therefore UNSIGNED
+    until hamr's explicit in-turn approval — widening the menu never silently changes a signed
+    spec's meaning.
+  - POC-first paid three times before a line of module code (recall hits carry no id — the path
+    IS the key; `impact`'s `confirmed`/`mentions` are counts, not arrays; `purge()` covers neither
+    stash nor memory, so a cold reset must delete the store). The tool tests run against a REAL
+    LiteCtx over a real fixture: the impact-shape test failed once against live data and was fixed
+    from the measured shape, not the assumed one.
+- **F66 — the in-process stall fuse** (`src/stall.js`): bare-agent's `timeoutMs` bounds
+  socket INACTIVITY (resets on every byte), so a slow-but-trickling call hung a run for 274
+  minutes (U run ms3197n8). The fuse's heartbeat is a completed ROUND — no round for 5
+  minutes abandons the call and silently reissues it (self-heal, hamr's ruling); three
+  stalls throw `step-stalled`, the third replan trigger. Validated on the paid surface: a
+  real slow call stalled and its reissue answered; three real in-flight calls abandoned at
+  the ceiling; late answers from abandoned sockets swallowed. Mutation battery 6/6 (the
+  surviving mutant was a real hole matching the production failure shape — fixed).
+- **F67 — the outside watchdog** (`scripts/u-watchdog.mjs`): U run ms3jh76q froze its event
+  loop 81.5 minutes and every in-process guard froze with it. A separate process sharing
+  nothing with the run — reads one file's mtime, calls kill(2), records the reason on disk
+  BEFORE the signal. Two triggers: stale spine and wall+grace. Battery includes a
+  hard-frozen-loop victim (`for(;;);`) — the exact case it exists for. Mutation 5/5.
+- **Event-loop lag sampler** in `scripts/run-u.mjs`: records any ≥3s loop block with
+  from/until timestamps to `<spine>.lag.jsonl` — the instrument that localized the
+  spawnSync-close blocks (below) on its first run.
+- **BREAKING for plan authors — `step-scope-escape`: a scoped step's TARGET must sit inside
+  its OWN narrowed scope** (`src/plan.js`, W3). A plan that validated before can red now. A
+  step may narrow the signed fence with `scope`, and `runPlan` builds that step's gate from
+  the narrowed prefix — so a target inside the signed fence but outside the step's own scope
+  was a write the gate denied on every attempt: the step burned its whole attempt budget on
+  refusals with no red anywhere, because each half was individually legal and nothing checked
+  the PAIR. The rule binds WRITES, not observations, and the exit arms were measured against
+  `src/exits.js` rather than assumed. `tree-changed` reds only when its scope is DISJOINT from
+  the step's — a scope that CONTAINS the step's contains its writable ground and fires exactly
+  when the narrow one does, and the menu is shallowest-first while the prompt says copy one
+  value, so containment would tax the likeliest draft (the F60 class `legalScopes` exists to
+  remove). `artifact-written`/`json-valid` paths carry NO step-scope red at all: the evaluator
+  reads and parses the named file and asks nothing about who wrote it, so a path naming a
+  PRIOR step's artifact is legal AND satisfiable under strictly-sequential v1 — a red there
+  would claim a constraint the evaluator does not impose. An off-menu `scope` carries no
+  narrowing (it already redded): one defect, one red.
+- **Four documented names are now actually exported** (`src/index.js`): `runStages`,
+  `checkMenu`, `STORE_VERBS` and `stageClose`. Each was named as adopter-reachable in this
+  CHANGELOG or in `bareloop.context.md` while the index never handed it out — a
+  documented-but-unexported name is a false contract the adopter discovers by importing it.
+  `tests/index.test.js` pins the documented surface by name (a NAME check; each export's
+  semantics stay owned by its own module's tests), so the docs and the index cannot drift
+  apart silently again.
+- **A per-payload cap on the isolate verbs** — `ISOLATE_MAX_BYTES` = 64KB, hamr's threshold
+  (`src/tools.js`). `ctx_stash`/`ctx_remember` write the `.litectx` store, which the
+  writeScope fence does not judge: the one worker surface that writes UNGATED bytes, and
+  unbounded it grows for as many rounds as the wallet funds. Over-cap comes back as a refusal
+  RESULT naming the actual size and the limit — worker feedback, never a throw (throws stay
+  the BA-4 param-guard class) — and nothing enters the store; both tool descriptions state
+  the bound. The residual is named rather than hidden: this bounds ONE PAYLOAD, and N
+  distinct ids are N payloads, so the aggregate stays unbounded. An aggregate cap is a
+  threshold, and thresholds are hamr's call.
+- **`step-stalled` has its own DECISIONS entry** (`src/ralph.js`). F66's terminal fell through
+  to the generic default, which points a human at the interpreter — the one component that did
+  nothing wrong. A stall is not a fault: the socket stayed alive the whole time (that is the
+  measured mechanism), so the entry says so and leads with the planner's lever (replan) instead
+  of sending anyone to debug transport.
+- **`ctx_impact` ships litectx's hedges** (`src/tools.js`), as `caveat` lines. litectx's impact
+  is deliberately asymmetric — over-count safe, under-count dangerous — so "isolated / low
+  risk" only ever ships HEDGED, and dropping the caveat left `risk low — 0 confirmed caller(s)`
+  reading as a licence to change the symbol freely, the one act the asymmetry exists to
+  prevent. The spine's `hits` field is counted BEFORE the caveats are appended and keeps its
+  old meaning (impact content) — a caveat qualifies the count, it is not more of it, and
+  re-meaning a shipped field is how a field stops measuring what its readers think it measures.
+
+### Fixed
+- **The close-fix loop laundered a transport casualty into a flat `escalated`**
+  (`src/planrun.js`). The step loop restores an escalation's own category (F11: the outcome and
+  the spine escalation must agree); the fix loop did not, so a `provider-red` raised there came
+  back as `escalated` — and `run.js` keys the F44 `spendComplete:false` floor on the OUTCOME, so
+  the run reported an exact-looking total for a call that may never have billed back. Now
+  mirrored. Found by the hardening pass, PARKED, and fixed only on hamr's explicit go.
+- **The close-fix loop could not tell a drained wallet from spent attempts** (`src/planrun.js`,
+  F45 class). The shell spells BOTH terminals `cap-halt` — attempt-exhaustion and a money-gate
+  halt thrown mid-attempt — so the category alone cannot split them and only the wallet can.
+  The fix worker's gate is built with the wallet at its MOST drained (every step's spend is
+  behind it), which is precisely where a money cut masquerades as "the fix failed" and becomes
+  a false capability read. The fix loop now reads the wallet exactly as the step loop does: a
+  drained wallet returns `cap-halt` (the resume-to-cap checkpoint — the stop IS the
+  checkpoint), attempts spent with money still on the table stays the designed `escalated`
+  terminal ("the close is still red"). Reachability validated before the fix: nothing guards
+  money between the last step and the close. Verdict routing is arbiter territory — fixed only
+  on hamr's explicit go.
+- **`ctx_recall` was blind to the memory axis, so `ctx_remember` was write-only through the tool
+  surface** (`src/tools.js`). The isolate strategy promises *"record a durable conclusion with
+  `ctx_remember` so a later step can `ctx_recall` it"* — and the recall handler hardcoded
+  `kind: 'code'`, so no note ever came back. The library-level round-trip test could not see it:
+  it called `lc.recall` directly, not the verb the worker holds. Recall now queries the fact axis
+  alongside code and returns each note on a line labeled `memory` with its BODY inline (capped at
+  400 chars, so a bloated note cannot page the context). The body rides because a note is a
+  CONCLUSION, not a pointer — there is no worker verb that dereferences a memory id. Same parked-
+  then-explicit-go path as above.
+- **The aurora U close type-checked another repository** (`scripts/u-spawner-close.mjs`):
+  mypy's `explicit_package_bases` named the patient's files `packages.spawner.src.*`, so
+  sibling imports fell through to the editable install — a symlink to a DIFFERENT aurora
+  checkout. Proven with a planted probe, fixed with `MYPYPATH`; latent not active (seed
+  error count unchanged, both prior greens re-verified under the fixed instrument).
+- **The stall fuse could be disarmed by the very call it abandoned** (`src/stall.js`, F70). An
+  abandoned call is not dead — it keeps streaming (ms3197n8's socket lived 274 minutes past
+  the fuse) — so a late beat from that corpse re-armed the watch timing its REPLACEMENT, and
+  the replacement could then hang forever without tripping the fuse built for exactly that.
+  One shared `Loop` compounded it, letting a corpse's round bound stop the live call. Now
+  generation-scoped: `watch`/`beat`/`isCurrent` all carry the generation of the call that
+  issued them, and each issued call gets its own `Loop`. Orphan rounds stay metered — an
+  abandoned call may already have been billed.
+- **The outside watchdog could kill a stranger, or kill a live verdict**
+  (`scripts/u-watchdog.mjs`, `scripts/run-u.mjs`, F70). Liveness was `kill(pid, 0)`, which
+  answers "does SOME process hold this pid" — and after the SIGKILL/OOM case the watchdog
+  exists for, the kernel can recycle that pid onto an unrelated process. Liveness is now the
+  PARENT LINK (`process.ppid === pid`), which pid reuse cannot forge, and a guard aimed at a
+  non-parent REFUSES to arm at startup (exit 2, no marker) rather than running as a
+  plausible-looking guard pointed at nothing. Separately, its stale-spine window was sized
+  BELOW the longest legal silence — `runStages` emits nothing between stages, so a legal close
+  can be quiet for `closeTimeoutMs × stages` — and is now sized from the spec's own stage count
+  plus a margin. Test fixtures rewritten so the victim spawns its own watchdog: the only shape
+  that exercises the real parent link. **That closed the stale trigger's half of "kill a live
+  verdict" only:** the DEADLINE trigger still killed on the clock alone, on a wall grace whose
+  default covered one close stage, and hamr ruled the whole trigger must read activity before
+  it signals — the redesign is under *Changed*, below.
+- **The ledger counted every stall as a bareloop bug, and then aimed it at the wrong package**
+  (`src/ledger.js`, F70 + review). `classifyIncidents` had no branch for `step-stalled`, so the
+  F66 fuse's own terminal fell through to "unclassified escalation category" — real upstream
+  evidence filed as a fake defect of ours. It was first routed through the TYPED-LIB branch
+  `interpreter-red` uses, and the rendered ask refuted that: `StallError` stamps
+  `lib: 'bare-agent'` at the throw site, so a live ask read *"bare-agent: the provider path
+  failed — worker stalled…"* when **nothing observed the provider path fail**. A stall is the
+  ABSENCE of beats. `step-stalled` is now a NAMED member of `EXCLUDED_ESCALATIONS` beside
+  `cap-halt` and `wall-halt` (operator ruling, on the wall-halt shape): our own governance
+  firing is not an upstream bug, and the stall evidence still rides the spine's own escalation
+  event, which is where a real ask would be sourced from anyway. Excluded by name, never
+  silently dropped — the excluded-set is executable and counted.
+- **`checkMenu` expanded `needs` one level only** (`src/job.js`, F70), so a chain of
+  prerequisites ran incomplete — reproducing the false red `needs` exists to prevent, one level
+  deeper. Now a transitive fixed-point walk, ordered by close position, visiting each stage at
+  most once (cycle-safe by construction).
+- **`ctx_impact` printed `calls undefined:undefined` for every callee** (`src/tools.js`, F70).
+  litectx returns `defs` and `callers` as objects with a path and a line, but `callees` as bare
+  NAMES; the readout assumed the object shape uniformly.
+- **The aurora U close floored on tests PASSED, not EXECUTED** (`scripts/u-spawner-close.mjs`,
+  the F40 class recurring in a close written after the rule was minted). A skipped or deselected
+  test could hide a red without pushing the passed-count under the floor, and only one summary
+  bucket was read. Now floors on `executed = collected − (skipped + deselected)` and sums every
+  red tally; validated on the real patient (209 executed).
+- `WRITE_VERBS` was declared twice — `src/plan.js` held its own frozen copy of `src/job.js`'s
+  array, so a third write-class verb could land in one and not the other. `plan.js` now
+  re-exports the one inventory (identity-tested, not deep-equal).
+- **One defect, one red:** the mailbox rule fired on a step whose `tools` grant failed to
+  parse, deriving a second red from a false default on top of the correct
+  `missing-required`/`invalid-value` for the bad field. It now fires only on a PARSED grant —
+  the step's hands are unknowable otherwise, and the real defect already redded.
+- **The retrieval verbs' line numbers are named as ONE 0-based handle space**
+  (`src/tools.js`). `recall`, `get` and `impact` all print the index's own 0-based positions —
+  one lower than the line an editor shows — and each now says so in its own tool contract. The
+  tempting alternative (render `impact` 1-based, since its numbers look display-only) was
+  tested against a real index and REFUTED: `impact`'s def range dereferences through `get`
+  verbatim and `recall` prints the same number for the same chunk, so renumbering one tool
+  would print two numbers for one chunk and turn `get`'s clean chunk-boundary refusal into a
+  guessing game.
+- **The wall clock advertised a one-stage close** (`src/clock.js`, `src/planrun.js`, W5).
+  Enforcement is `maxWallMs + closeTimeoutMs` only when the close is ONE command; a staged
+  close (PRD v1.28) runs its stages one at a time and hands EACH the full `closeTimeoutMs`, so
+  a 4-stage close at 900s is 60 minutes of close, not 15 — and the run's own outside watchdog
+  already sized its stale window that way, which made it the same arithmetic disagreeing with
+  itself. `createClock` now takes `closeStages` (threaded from `stageClose`, the ONE staging
+  the runner executes — never a second count), `enforcedMs` is the one expression both the
+  advertised record and the worst case are computed from, and `report()` puts `closeStages` on
+  the `wall-clock` record: without it a reader seeing enforced 90min against a requested 30min
+  cannot tell one 60-minute timeout from four 15-minute stages, and an unexplained gap is
+  exactly the number a later reader rounds back down to the requested one. The `MIN_WALL_MS`
+  floor is deliberately left at one stage — a threshold is operator territory, parked in
+  PRD v1.39 rather than re-derived here.
+- **A run that ABSORBED a stall reported its spend as exact** (`src/run.js`, W1). The terminal
+  `step-stalled` already carried `spendComplete: false`; the common case does not reach it —
+  the F66 fuse abandons the hung call and silently reissues it (self-heal), and an abandoned
+  call is not a call that was never billed. So a run that stalls and then ends green, escalated
+  or at the cap also holds a FLOOR, not a total. `runJob` now watches the `stall` event and the
+  flag is one-way: any absorbed stall makes `spendComplete: false` on the job-end, whatever the
+  outcome. The same honesty applies to the wall: a `wall-halt` that cut a call mid-flight
+  (`cutMidCall`) reports a floor, while a wall stop read BETWEEN iterations — where no call was
+  in flight — stays exact.
+- **The ctx verbs' spine channel was unscrubbed** (`src/planrun.js`). Every field a `ctx-tool`
+  event carries is MODEL-CHOSEN text — a recall query, a stash id, a symbol, a path the worker
+  spelled — and the spine is append-only: a log that captures a key captures it forever. The
+  emitter is now scrubbed once at the WIRING, with the same ONE inventory (`SECRET_PATTERNS`)
+  the close output goes through, so a new ctx verb cannot forget it — seventeen scrubbed call
+  sites would have been seventeen chances to.
+- **A failing `json-valid` exit could put file bytes on the spine** (`src/planrun.js`). An exit
+  detail is supposed to be names and counts, but `json-valid` embeds `JSON.parse`'s own message
+  and V8 quotes a window of the SOURCE inside it — a body of 20 characters or fewer is quoted
+  WHOLE, and the short-prefix secret shapes (`xoxb-…`) fit inside that window — so the detail
+  can carry file bytes the WORKER chose, into a log that is append-only forever. `runPlan` now
+  scrubs every detail once at the `judge()` boundary, with the same ONE inventory
+  (`SECRET_PATTERNS`) the close output and the ctx-verb channel ride through. The boundary is
+  the place, not the three consumers below it: the same details become the `exit-eval` record,
+  a fault's escalation `detail`, and the worker gap ralph puts on the spine as
+  `close-verdict.gap` — scrubbing at the source makes the leak inexpressible, scrubbing per
+  consumer makes it something the next consumer has to remember. `evalExits` itself is
+  untouched and does NOT scrub; it is a public export, so an adopter wiring its results into
+  their own log applies their own redaction.
+- **The stall fuse could reissue a call past the run's wall** (`src/stall.js`, L4). The clock is
+  consulted where a ROUND completes and after a step returns; a stall completes no round and
+  returns from no step, so nothing read it between the wall passing and the next reissue — a
+  worker stalling at its wall could be reissued for up to `maxStalls × stallMs` of calls the run
+  had already declined to authorize. The watch now takes the wall as a callback and reads it
+  FIRST, before the decision to spend again: past the deadline it gives up as `wall-halt`
+  (never `step-stalled`, which is a replan trigger — there is nothing left to re-allocate, and
+  the only remedy is `maxWallMs`). Not a retreat from the self-heal ruling: self-heal is what a
+  run does with time left.
+- **A close that refused SIGTERM hung the run forever** (`src/ralph.js`). On a fault
+  (`ENOBUFS`, timeout) the child is asked to leave, but SIGTERM is a REQUEST — a runner with
+  its own handler or a trapping wrapper can decline it — and there was no second deadline, so
+  no `close` event ever arrived and the run's only remaining stop was the out-of-process
+  watchdog. A 2s grace, then SIGKILL, which nothing can refuse; the timer is `unref`'d so it
+  can never hold the host loop open (F68's whole point) and cleared on `close` so it cannot
+  fire at a child that already left. Verdict semantics are untouched: the FIRST fault already
+  named the outcome and the kill only enforces it.
+- **The ReDoS detector mis-parsed an EMPTY character class and passed the hazard through**
+  (`src/plan.js`, F49). The scan carried the POSIX rule *"a leading `]` is a literal member"* —
+  which is not JS: `[]` is the EMPTY class and `[^]` the any-char idiom, and both CLOSE at that
+  first `]`. Skipping it ran the scan past the class's real end and swallowed every quantifier
+  after it, so `x[^](a+)+$` read as SAFE while `RegExp.test` on it does not finish in 15s on a
+  31-char body — an agent-authored exit pattern that passed validation and then hangs the run's
+  event loop, which is the whole failure F49 exists to make inexpressible. A false NEGATIVE is
+  the dangerous direction, so the scan now follows JS. Four cases join `REDOS_BAD`
+  (`x[^](a+)+$`, `(([^]+))+`, `(([]a+))+`, `[^]x(a+)+`). **The monotonicity claim is stated
+  honestly rather than assumed:** this is a PARSE correction, not the add-rejections-only
+  tightening F49's rule contemplates, and it is not rejection-monotonic by construction.
+  Measured over 14,862 compilable generated patterns (2,369 previously rejected), exactly 2
+  rejections disappear — both pathological `[]`-bearing shapes whose old `true` came from the
+  very misparse being fixed, both verified to finish `RegExp.test` in ~0ms — and every entry of
+  the checked-in `REDOS_BAD`/`GOOD`/`OVERREJECTED` corpus is unchanged. The claim is "measured,
+  no hazard lost", never "monotonic by construction".
+- **The isolate verbs wrote model-authored text into the tree unscrubbed** (`src/tools.js`,
+  `src/validate.js`). `ctx_stash`/`ctx_remember` park worker-chosen bytes in
+  `<workdir>/.litectx` — a file INSIDE the tree that outlives the step and reads back inline
+  through `ctx_recall` — which is the hard line's own sentence (*a record that captures a key
+  captures it forever*), one hop away from the spine it was already written for. Both the
+  PAYLOAD and the KEY now go through `redactSecrets`, a new export housed beside the inventory
+  in `src/validate.js` so detection (`scanSecrets`) and redaction read the ONE
+  `SECRET_PATTERNS` list and cannot drift apart. It is IMPORTED, not injected: an injected
+  redactor is one a future caller can forget to pass, and this leak has to be inexpressible,
+  not optional. Every id-taking verb (`ctx_peek`, `ctx_forget`) scrubs on LOOKUP with the same
+  transform, or a stash would be unreachable by the id the worker spelled; and the
+  `ISOLATE_MAX_BYTES` cap is measured on the SCRUBBED payload — the one that actually enters
+  the store — because a size read off the pre-redaction text reports bytes that never landed
+  (the F6 blind-instrument class). The plan flow's own `scrub` collapses onto the same helper.
+- **The gate audit was the one persistent channel still logging worker-chosen text in
+  cleartext** (`src/planrun.js`). `gate-audit.jsonl` lives IN THE TREE and is append-only, and
+  the `Gate` was built without a `secrets` config — so it ran on bareguard's default-on
+  backstop, which covers `apiKey`/`authorization`/`Bearer …`/`sk-…` and nothing else. Measured:
+  a `ghp_` token landed in cleartext through every model-authored identifier an action carries
+  (an isolate verb's `id`, a path the worker spelled), and masked once the gate is handed
+  `SECRET_PATTERNS`. Content was never reachable here — `toolAction` reduces a write to
+  `{bytes}` — but the identifiers are raw model text. Third channel, same ONE inventory.
+- **A plan `parse-error` could carry the DRAFT's bytes onto the spine** (`src/planrun.js`, the
+  `judge()` precedent one layer up). A `parse-error` red's detail is `JSON.parse`'s own message,
+  and V8 quotes a window of the SOURCE inside it — a body of 20 characters or fewer is quoted
+  WHOLE, which is exactly the short-prefix secret shapes. That source is the model's draft, so
+  the red rode onto `plan-validate`, onto `plan-red`, and back into the redraft prompt. Every
+  red's detail is now scrubbed ONCE at the validation boundary, before any consumer reads it —
+  the boundary, not the three emit sites, because scrubbing here makes the leak inexpressible
+  while scrubbing per consumer makes it something the next consumer has to remember.
+- **A strategy line could name a tool the worker was never granted** (`src/tools.js`,
+  `src/planrun.js`) — F19 inverted, and worse than silence: the model spends rounds reaching
+  for a menu entry that does not exist. The strategy prose was gated per COMPONENT, so any one
+  isolate verb lit a paragraph prescribing `ctx_peek` (a COMPRESS verb), either retrieval verb
+  lit the two-step `ctx_recall` → `ctx_get` recipe, and any one select verb named all three.
+  New `strategyFor(granted)` assembles the same prose SENTENCE BY SENTENCE, each clause gated
+  on its own verb, with the select paragraph's `a, b, and c` grammar preserved. The full-menu
+  text is unchanged BY TEST, not by comment: `strategyFor(TOOL_MENU)` is asserted
+  byte-identical to the concatenated paragraphs, so a partial grant can only ever see LESS,
+  never different.
+- **The eight palette verbs had no failure path** (`src/tools.js`). `ctx_get` has always
+  wrapped its own failures into a refusal RESULT and emitted them; the eight verbs P added
+  (`impact`, `related`, `recent`, `compress`, `stash`, `peek`, `remember`, `forget`) threw
+  straight out of the tool loop instead — and a thrown call is the most invisible result there
+  is, indistinguishable from a verb that was never reached, so the worker's fall-back to a
+  whole-file read reads as a free choice instead of a forced one (the F18 blindness rule). A
+  shared `guarded()` wrapper now hands the worker a refusal naming the real cause (a locked
+  store, a corrupt index) and emits `outcome:'error', bytes:0` to the spine — one round instead
+  of the run, and never a rethrow (L1: throws stay reserved for the BA-4 param-guard class).
+  Its field reader is deliberately defensive, since a field reader that throws would take the
+  emit down with it — the hole this closes.
+- **`validatePlan` could THROW on plain parsed data** (`src/plan.js`). Its contract is that
+  every failure is a named red; `Array.isArray(job.writeScope)` admitted the array and asked
+  nothing about its MEMBERS, so the next line's `globToPrefix` hit `scope.replace is not a
+  function` and a `TypeError` escaped the validator. The fail-closed guard now asks the same
+  `isNonEmptyString` question of each member that `legalScopes` already asks of the same field.
+- **Three enforced rules the drafter prompt never stated** (`src/planrun.js`). A bound the
+  validator reds but the prompt omits is a round burnt on a rule the drafter had no way to
+  know: `attempts` said "integer" while `validatePlan` reds outside `1..capRuns`, and BOTH
+  `step-scope-escape` reds (a `target` outside its own step's narrowed scope; a `tree-changed`
+  scope disjoint from it) were enforced silently. `planPrompt` now takes `capRuns` from the
+  SAME source the validator bounds against — one number, so prompt and validator cannot drift
+  — and states both scope rules in its own voice.
+- **The `check-passes` exit example was the one malformed line among four** (`src/planrun.js`).
+  It carried the enumerated check menu INSIDE its JSON `"name"` string, so the example the
+  drafter is most likely to copy did not parse. The menu now sits BESIDE the example as its own
+  copy-it-character-for-character line, and the regression test parses EVERY exit example, one
+  per `EXIT_TYPES` entry, rather than the single `tree-changed` line it happened to pick.
+- **The U close scripts' suppression rules missed two escapes that the paid runs actually
+  emit, and mislabelled a broken instrument as a timeout** (`scripts/u-litectx-close.mjs`,
+  `scripts/u-spawner-close.mjs`).
+  - The JSDoc WILDCARD (`{*}`, `{?}`) is `any` under a spelling the `any` rule cannot see — it
+    contains no letters. Measured against this repo's own `tsc` (`--noEmit --strict --allowJs
+    --checkJs`): a naked `function f(v)` reports TS7006, while `@param {*}`, `@param { * }`,
+    `@param {?}` and a `@typedef {*} Loose` used from a `@param {Loose}` each report ZERO
+    errors. So the new `any-star` rule matches the tag GENERICALLY (`@\w+`) rather than from a
+    list of tags — a list of tags is a list of holes. `{*[]}` / `{Array<*>}` are deliberately
+    NOT matched: measured, they still error on non-array use, so they are `any[]`, which the
+    `any` rule already covers.
+  - The CAST rule read its type body with `[^}]*`, which an inner brace closes early — so
+    `/** @type {{ a: number }[]} */ (expr)` walked straight through. That shape is not
+    hypothetical: it appears in this repo's own paid U-run diffs (`run3-ms3wawub`,
+    `run-ms5uxhej`). Now `.*`, which is bounded by construction — every rule is tested against
+    ONE diff line at a time.
+  - A `spawnSync` that produced NO exit code was reported as *"timed out"* whatever killed it.
+    Measured shapes (node 22): a timeout is `{status:null, signal:'SIGTERM',
+    error.code:'ETIMEDOUT'}`, a `maxBuffer` overflow is the same with `ENOBUFS`, an external
+    kill is `{status:null, signal:'SIGKILL'}` with no error at all. Collapsing them hands the
+    operator a wrong cause and hides a broken instrument behind a bound that never fired (the
+    casualty-vs-evidence class); each now names itself. The spawner close also gains the
+    sibling's `maxBuffer` (1 << 28) — a red pytest run prints every traceback, and the overflow
+    does not truncate, it SIGTERMs the child, i.e. a real red arriving dressed as an instrument
+    stop.
+- **A close child ending in `process.exit()` drops its own queued stdout, and the runner read
+  the short capture as a short close** (F71, `tests/staged-run.test.js`,
+  `tests/ralph.test.js`). One test's staged-close fixture arrived truncated about 1 run in 250
+  under load — stream ending mid-line, the `FAILED:` names gone, exit code still 1 — which is
+  the F28 failure-names-lost class arriving nondeterministically. Root cause is the CHILD's:
+  node discards whatever is still queued on its stdout pipe when the process calls
+  `process.exit()`, and the parent then sees a clean EOF, a real exit code and no fault, so a
+  lost tail is indistinguishable from a close that simply printed less. Measured 7/500 shorts
+  with `process.exit(1)` against 0/500 with `process.exitCode = 1` on the identical fixture, and
+  12/12 deterministically with a 50ms reader stall. The earlier reading in that test's comment —
+  *"pipe writes are synchronous on Linux, so there is nothing pending to drop"*, and *"only the
+  runClose path loses bytes"* — is REFUTED on both halves and rewritten with the measurements
+  that refuted it. What shipped is the fixture's `process.exitCode` spelling (now named as the
+  fix it is, not a free tidy), a precondition asserting the stage's LAST line reached the gap
+  so a short arrival can never again surface as a confusing `gapKeep` failure three assertions
+  later, and a whole-capture guard pinning the half the RUNNER owns: past the pipe's 64KB
+  capacity, with the host loop frozen mid-stream, a close that exits cleanly is captured WHOLE
+  (mutation-checked — it kills a reader that caps accumulation at 64KB, 4/4). The residual is
+  named, not hidden: the production close scripts still end in `process.exit()`, safe today
+  only because they self-cap their output at 40 lines, which is inside the measured-immune
+  band. See F71.
+
+### Changed
+- **BREAKING for adopters — `runClose` and `runStages` are async and return Promises**
+  (`src/ralph.js`). The close child is awaited instead of `spawnSync`, so a running close no
+  longer freezes the host event loop (F68 — measured: a 3-stage close went from 0 host ticks
+  during 3.5s of close to 126 ticks with a worst gap of 26ms). Every close semantic is
+  byte-identical, verified by a 25-case old-vs-new differential: timeout signal (SIGTERM →
+  `timed-out`), 1 MiB per-stream output ceiling (`ENOBUFS` → broken-close, deliberately not
+  widened — an over-long close must not be judged on truncated output), gap shape/bounds,
+  exit bands, redaction, cwd, stdin EOF. The one visible difference: a spawn fault's detail
+  prose says `spawn` instead of `spawnSync` (nothing parses it).
+- **BREAKING for plan authors — `check-passes` now requires a write-class verb (`write`/`edit`)
+  on the SAME step** (`src/plan.js`, `exit-illegal`). A shape that validated before is rejected
+  now: a read-only "verify" step that carries a check. Measured before it was built (P-read runs
+  ms4l5p6w / ms57zr7c): 4 of 4 drafted plans put every `check-passes` on a read-only verify step,
+  and both runs stalled to cap on a byte-identical gap delivered to a worker that could not edit.
+  A failing check's gap is re-delivered to THAT step's own worker, so the step must be able to act
+  on it — a read-only one is a mailbox with no hands. The check belongs on the step that fixes;
+  the run's final verification is the operator's close, which the agent never authors. The drafter
+  prompt states the same law, so prompt and validator can never disagree. The red is SUPPRESSED
+  when `tools` failed to parse: the step's hands are unknowable then, and charging the ledger with
+  a violation derived from a false default would double-red one defect.
+- **BREAKING for an adopter holding an approval for an omitted-`tools` spec — the spec hash is
+  taken over the RESOLVED spec** (`src/job.js`, MED-1). `tools` is optional and its absence
+  means the whole `TOOL_MENU`; `plan.js` and `planrun.js` resolve it with exactly that
+  predicate at runtime, so an omitted-`tools` spec's ceiling GREW every time the menu did while
+  its bytes never moved — and that widening was unsigned. `jobSpecHash` and `checkApproval` now
+  canonicalize the same resolved form, with an omitted `tools` filled in as the concrete current
+  menu, so a signature pins WHICH menu it covers and a menu change flips the hash straight into
+  the existing refuse-until-reapproved machinery. A spec that named its own ceiling hashes
+  byte-for-byte as before — no migration for a signature already in flight — and an approval
+  minted for an omitted-`tools` spec re-signs once. Writing today's full menu into a spec that
+  omitted `tools` is hash-NEUTRAL, which is the point: the two spell the same ceiling. The
+  resolve sits INSIDE each path's existing throw guard, because a spread runs getters.
+- **The wall PAUSES the run; it never cuts the grade** (`src/planrun.js`, `src/ralph.js`, W-2 —
+  hamr: *"when time is up, keep the grade we already have and stop"*). The close is never
+  bounded by the wall and always runs to completion: a deadline that kills grading leaves the
+  run unreadable after the money is already spent (the F45 class, generalized from money to
+  time). What the wall stops is the START of new work — past the deadline the close-fix loop
+  opens no further iteration, and the same rule covers a step that would begin already expired.
+  The run then stops on the verdict the last close minted, and nothing after the deadline is
+  allowed to change it. The iteration it declines was guaranteed worthless anyway: the metered
+  round check stops the fix worker on its FIRST round so it writes nothing, and the iteration
+  then re-runs the FULL staged close over an unchanged tree to mint the verdict already on the
+  record — `capRuns` times over. The stop is a decision-ready `wall-halt` carrying the verdict
+  that stands, how much of the loop was actually spent, and a progress TREND read off the two
+  most recent close gaps: byte-identical is `stalled`, different is `moving`, and one grade
+  alone is `unknown` — never rounded up to `stalled`, which would recommend rewriting a goal on
+  no evidence (F6's rule applied to a trend). The trend exists because the two levers point
+  opposite ways, and both are spec edits whose new hash needs re-approval: raise `maxWallMs`
+  and resume (resume-to-cap — the stop IS the checkpoint) or revise the goal so the work fits
+  the time; abandon is the third. `cutMidCall` still splits the two readings, so which
+  instrument saw the deadline stays on the record, and the step-site record names its two
+  caps SEPARATELY: `capRuns` is the RUN's attempt cap — what the fix-site record has always
+  written — and `stepAttemptCap` is the step's own tightened cap, the number that actually
+  bounded THIS step. Previously the one key carried both meanings depending on which site
+  emitted it, leaving a reader of two records of the same type no way to tell which. It is
+  not a universal bound and is not claimed as one: a STEP already under way still runs its
+  own exit checks after the deadline.
+- **The close child no longer inherits the operator's credentials** (`src/ralph.js`,
+  `CLOSE_ENV_DENY`, PRD v1.41 — hamr: *"strip it when unnecessary, minimize unneeded
+  exposure"*). `runClose` built the child's env as `{...process.env}` minus
+  `NODE_TEST_CONTEXT`, and that child is not an ordinary subprocess: `npm test`, `pytest`,
+  `tsc` execute **worker-authored code**, with network, in the tree they are about to judge.
+  Nothing that judges a tree needs a provider key, so the exposure bought nothing. Two rules,
+  deliberately both: the KNOWNS (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`,
+  `GOOGLE_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `GITHUB_TOKEN`, `GH_TOKEN`, `NPM_TOKEN`, the whole
+  `AWS_*` prefix) exist only for names the shape rule cannot see, and the NAME-SHAPE rule —
+  anything ending `_API_KEY`/`_SECRET`/`_TOKEN`/`_PASSWORD`/`_CREDENTIAL(S)`, case-insensitive
+  — is the load-bearing one, because a literal denylist is a chase every new provider extends.
+  A COPY is stripped, never `process.env`: the host keeps the key bare-agent spends every
+  round. Placed at `runClose`, the single close-spawn seam, so `runStages` and every derived
+  `check-passes` inherit the same blinding — one instrument, never two. **Stated as what it is:
+  exposure reduction, NOT a sandbox.** bareloop runs locally as the operator's OS user, so
+  worker-authored code still has that user's file access (including the shell profile that
+  exports the variables just stripped) and the network. Real containment is a different
+  mechanism, unbuilt, and claimed nowhere; README and `bareloop.context.md` carry the same
+  boundary note. Arbiter territory: no drafted plan or config can express, widen, or opt out.
+- **Scripts — unshipped, but the surface a user actually runs.**
+  - The outside watchdog's DEADLINE kill is ACTIVITY-AWARE (hamr: *"the kill from outside should
+    check for activity/bytes or other markers for activity, not a silent kill"*). Past the
+    deadline it kills only when the spine has ALSO been flat for a full stall-fuse window;
+    past-deadline-but-still-writing logs LOUD every poll and is never killed — the in-process
+    fuses and the money cap own bounding a run that is alive, this guard owns processes that are
+    dead. Every kill states the trigger, the deadline arithmetic and the marker's value and age
+    before the signal goes out. ONE marker, spine bytes: a CPU marker (`/proc` utime+stime) was
+    built alongside it and REMOVED after measuring broken in BOTH directions — a close runs its
+    suite in a CHILD whose ticks are credited only at reap, so a live close read DEAD; and
+    `run-u`'s own 1s lag sampler wakes the watchdog, so a wedged run read ALIVE at production
+    constants (its kill tests passed only at a dead-window:poll ratio of 5:1 where production
+    runs 60:1). hamr: *"keep what is simpler/available"*.
+  - The wall grace is `stages × closeTimeoutMs`, and `run-u` passes it. The watchdog's own
+    default is ONE stage, so a 4-stage close left on the default put the outside deadline at
+    wall+15min while a legal close can still be mid-verdict at wall+60min. A spec that sets no
+    `maxWallMs` now OMITS `--wall-ms` and names the unbounded choice out loud on both sides of
+    the process boundary, instead of passing the string `undefined` — which fell back to the
+    null default and silently disarmed the deadline trigger while the header still claimed a
+    wall. Same NaN-disarms-a-guard class, one flag over.
+  - `run-u`'s spine leak check is a TRIPWIRE, not a note in the margin: on any hit the run exits
+    **3** (distinct from 2 = operator/config and 1 = stale `--approve`) and the BRIDGE is NOT
+    written — a spine carrying a secret must never graduate into a reusable artifact that
+    outlives the run. Count and path only, never the matched content: echoing it to stdout is
+    the same leak, one hop on.
+  - `run-u` can no longer be killed by its own guard's startup. The watchdog path was taken
+    from `new URL(...).pathname`, which stays percent-ENCODED — a checkout under a directory
+    with a space hands `spawn` a `%20` path that does not exist, and the guard dies at second
+    zero on the one run it exists to protect (`fileURLToPath` now, the spelling the sibling
+    scripts already use). And a spawn failure arrives as an EVENT: an unhandled `'error'` on a
+    ChildProcess is an uncaught exception, so a guard that could not start would have ENDED the
+    paid run. It is handled LOUDLY instead — the run continues UNGUARDED from outside, under
+    its own fuses, wall and money cap, and says so, because a reader must never mistake a
+    missing watchdog marker for "the guard was watching and never fired".
+  - **All nine remaining hand-rolled secret scans in `scripts/` now call the canonical
+    `scanSecrets`** (11 call sites, 2 already canonical). F40 parked the conversion; hamr
+    retired the park on his word, and both risks it guarded were closed by MEASUREMENT rather
+    than assumption — equivalence on 900 spiked real-spine cases (670 hits, 0 divergences,
+    with the comparison demonstrated ABLE to diverge), and archived evidence that can no longer
+    shift. FINDINGS addendum sits on the F40 block; the JSONL spine-reader park is untouched.
+- **litectx ^0.29.1 → ^0.31.0** (LC-3 delivered, yield-only shape — atomicity intact,
+  `setImmediate` between parses). Every worker's index call now passes `{ yield: true }`, so the
+  F66 stall fuse's timers, the wall clock and the lag sampler stay alive through an index pass
+  instead of dying inside one long block. Consumed on the BINDING max-block clause (189–252ms,
+  n=4, 2× headroom) **with the miss on record**: liveness read 54–58% on our fixture against a
+  60% proxy bar, and the criterion was NOT re-amended after measurement.
+- bare-agent 0.34.0 → 0.35.0 (BA-19 delivered: `deadlineMs` total-call bound, `EDEADLINE`,
+  `context.bound` discriminator, terminal by design; bareloop wiring PARKED — the F66 fuse
+  already self-heals this class above the transport).
+
+### Removed
+- **BREAKING — the legacy operator-authored `steps[]` path is deleted** (PRD v1.32, hamr:
+  *"i just want to get rid of it"*). `steps[]` is the shape where the OPERATOR hand-writes the
+  workflow steps — the exact thing bareloop exists to remove (*"there shouldn't be user
+  authoring anywhere"*, v1.28) — and it had been co-existing scaffolding since Layer 2 landed,
+  forcing every downstream schema decision to carry two spellings.
+  - **Gone from the public surface:** `interpret`, `STALL_REDS`, `validateConfig`, `diffPaths`,
+    `extractRules`, `MAX_RULES`, `MAX_RULE_CHARS`, `LOOP_SHAPES`, `SLOTS`, `VERBS`, `CLASSES`,
+    `STEP_MODES`, and `runJob`'s `opts.target` / `opts.execCmd`. **config-v1 is fully removed**,
+    not merely declared dead (F22 declared it): the drafted-workflow-config schema, its knobs,
+    the drafting call, the rules extractor, and the hitl draft-PR mechanics went with the path
+    that consumed them. A spec still carrying `steps[]` reds `shape-retired:steps` **by name**,
+    so an old spec is told what happened instead of half-running.
+  - **What it costs, stated plainly:** `hitl` is not dead code — `jobs/litectx-maintainer.json`
+    ran 6 times and opened a real draft PR once, and it is the only job that produced the
+    product's actual end state (a change for a human to merge) rather than a benchmark grade.
+    **That job goes dark** until the plan shape implements hitl. `soft-green` was never
+    implemented past its declaration. **How both come back is deferred to Layer 3 and
+    deliberately undecided** — by standing doctrine graduation between rungs is a REWRITE, never
+    a copy, so keeping the old implementation alive for a later rung preserved code that would
+    never have been copied.
+  - **What survived, and where it lives now:** the machinery the plan flow imports was housed in
+    the deleted files but was never part of the dead path. The worker tool menu (`TOOL_BY_VERB`,
+    the ctx tools, the gate action translator, the personas and strategy lines) moved
+    `src/interpret.js` → **`src/tools.js`**, which is what it always was; the fence and secret
+    primitives (`globToPrefix`, `scopeContained`, `sweepSecretLiterals`, `SECRET_PATTERNS`,
+    `scanSecrets`) stay in `src/validate.js`, now purely the shared primitives both validators
+    go through. The ledger's prose verb-sniff list was relocated VERBATIM rather than re-derived,
+    so incident classification is byte-identical across the deletion.
+  - **Coverage was re-pointed, not dropped.** The suite goes 616 → 395 tests because the tests
+    of a deleted path die with it; every guard that OUTLIVED the path was moved rather than
+    deleted — the approval binding, the pre-token smoke and four money-contract readings are
+    ports onto the plan shape in `tests/run.test.js`, the fence/secret assertions were re-pointed
+    at the primitives themselves in `tests/validate.test.js`, and the close-body rules
+    (`judged`, `gapKeep`, quotes-in-cmd, secret sweep) now address the plan close. Guards that
+    simply moved house are named where they now live: `close-unsupported`, `broken-close`,
+    `already-green` and the close's cwd in `tests/planrun.test.js`; `close-crashed` and the
+    close-output scrub in `tests/ralph.test.js`.
+
+### Added
+- **T — a run has a CLOCK, and time is a material the planner is told as a balance**
+  (PRD v1.27/v1.29, design record 2026-07-26 + addenda 1–3). Money was the only bound in the
+  system; nothing bounded TIME, and job #5's own plan authorised ~630 worker turns (F56).
+  - `maxWallMs` joins the SIGNED job spec (`src/job.js`) — integer ms, **no default**, floor
+    one close timeout (`MIN_WALL_MS`). A run without it is time-unbounded *by explicit
+    operator choice*, never by an unnoticed fallback (F45: a defaulted cap is a silent second
+    ceiling). Adding it changes the spec hash — re-sign.
+  - New `src/clock.js` (`createClock`, `PROVIDER_TIMEOUT_MS`, `MIN_CALL_TIMEOUT_MS`): one
+    wall clock per run. Enforcement is a **between-round deadline** because `loop.stop()`
+    cannot cut an in-flight call — F61 measured it fired at 500ms and returned at 4,018ms —
+    so the honest enforced worst case is `maxWallMs + closeTimeoutMs` and BOTH numbers are
+    reported (`wall-clock`, `report()`), never the flattering one. Unbounded reports as
+    `null`, never `0` and never `Infinity` (F6 extended to time: an unknown duration is
+    reported as unknown).
+  - `runPlan` emits `wall-clock` (at start), `wall-bounded` (an attempt cut by the deadline —
+    the same seam the round bound rides; the partial work is judged and its gap fed forward)
+    and terminates `wall-halt` with a decision-ready escalation naming the requested vs
+    elapsed ms. The stop IS the checkpoint: raise `maxWallMs` and rerun.
+  - **Materials at draft** — `runPlan` emits `materials` and the plan/replan prompt now
+    carries `{ balanceUsd, remainingMs }`: what is LEFT, as a balance, never a per-round rate
+    (hamr's correction, PRD v1.29). F57 measured a 150× spread on verification-gap duration,
+    so a per-round constant describes almost no real round and a rate framing creates a
+    rush-or-fake incentive. The agent sees both axes; the arbiter is untouched — materials go
+    to the PLANNER at draft, and the worker stays blind (no budget, no close, no clock).
+- **A — the replan trigger gains a VARIANCE axis** (design record §3.4): a step that has
+  consumed `VARIANCE_THRESHOLD` (0.5, hamr's number) of the run's *remaining* money or time
+  with its exits still red is stopped at the head of its next attempt and routed as a
+  `step-variance` replan — the planner re-allocates what is left instead of the step eating
+  the run. Emits `variance {step, iteration, threshold, moneyShare, timeShare, axis}`. The
+  hard ceiling of **ONE** replan is unchanged (unlimited replanning launders thrash as
+  adaptation, v1.12); a second `step-variance` after the replan is spent is a STOP.
+  - **Recorded honestly: this trigger is INERT on every workload with data (F63).** Replayed
+    across 18 archived spines / 54 steps / 101 judged attempts it would have fired **0
+    times** (near misses 0.35 · 0.35 · 0.40 · 0.45), and the premise it was built on —
+    F56's *"a replan has never fired in the entire programme"* — is FALSE: eight replans had
+    already fired, four days before F56 was written.
+  - **Threshold decided at 0.5 with that inertness on the table** (hamr, *"keep 0.5"*, PRD
+    v1.31). It is therefore a guard set ABOVE the observed population, not a tuned trigger —
+    moving it to 0.35 to catch those four points would be fitting the number to the data.
+- **The staged close — the user authors the DESTINATION, never the road** (PRD v1.28, hamr:
+  *"there shouldn't be user authoring anywhere, that defies the point of bareloop"*). `checks[]`
+  is retired outright: a spec that still declares it reds `checks-derived` **by name**, not a
+  bare `unknown-field`. In its place the operator's close becomes an ORDERED LIST of NAMED
+  STAGES, and the check menu the agent picks from is DERIVED from that list — nobody
+  hand-authors a check per job, ever.
+  - `close: [{ name, cmd, expect, judged?, gapKeep?, offer?, needs? }, ...]` (`src/job.js`) —
+    kebab-case unique names, every stage a `predicate` command body (a rubric/hitl stage is
+    inexpressible by shape); `needs` must name EARLIER stages and is incoherent with
+    `offer: false` on the same stage (a chain with nothing to reach it). A single `predicate`
+    close object is legal shorthand the plan flow adapts into a one-stage list; a
+    `gold`/`rubric`/`hitl` object close still validates (the declared-but-locked verdict
+    classes) but the plan flow refuses it at runtime as `close-unsupported` — it names no
+    command to run. `checkMenu(close)` (`src/job.js`) derives the offerable stages, each
+    carrying the ordered chain (prerequisites, then itself) that a `check-passes(name)` pick
+    must run.
+  - `runStages` (`src/ralph.js`) runs a stage list as ONE close: first red renders the verdict,
+    later stages never run; the gap names the failing STAGE, never a culprit file (v1.12/F28
+    untouched); the secrets scrub runs on every stage.
+  - `runPlan` (`src/planrun.js`) wires the close precheck, the check-menu preflight (now
+    emitting `check-menu {offered, hidden?, meaning?}` — a partial menu is a stage that cannot
+    stand alone as a ruler, never a failure), the `check-passes` seam, the outer close, and the
+    fix loop through `runStages`; `validatePlan` (`src/plan.js`) derives its legal
+    `check-passes` names from `checkMenu(job.close)` instead of a separately-signed list. Every
+    job spec in `jobs/` migrated to the staged shape.
+  - **Two decisions taken 2026-07-26 (hamr, *"agreed on both, validate your claims"*), built and
+    validated:**
+    - **Layer R's red-set is the FAILING STAGE's, per attempt.** A staged close has N
+      `gapKeep`s, so `createRoot().observe()` (`src/root.js`) now takes `redStage`/`redKeep`
+      and REFUSES to compare red-sets across a stage change (a different wall is a different
+      failure — the same bucket as one-known-one-UNKNOWN, never a fire). `root-injected` gains
+      an optional `redStage`. **Measured, not assumed:** the rejected alternative — one union
+      `gapKeep` pattern fixed for the run — was rejected because job #4's two close stages are
+      near-clones of one grader (7 of 12 kept-line templates byte-identical), so a union
+      kept-set can read identical across a stage change and false-fire, which "inert when not
+      stuck" forbids.
+    - **The grading stage is not lendable.** Of the six specs in `jobs/`, the four with a final
+      `verdict` stage set `offer: false` on it; the other two have no grading stage at all and
+      hide a `changed-from-seed` PRECONDITION instead. The flag is kept **per-spec**, not as a
+      schema rule — "the last stage is the grade" holds where it applies and is unproven in
+      general. `check-menu` preflight always
+      announces the derived menu either way, so a forgotten flag is visible in the run's own
+      record; a test reads every spec in `jobs/` and reds if any offers a stage NAMED `verdict`.
+      The guard is stated over the convention that exists rather than over position — the fifth
+      spec proved "the last stage is the grade" is not structural.
+  - **Scripted-provider evidence only — the staged close has not yet run against a real
+    model.**
+
+### Changed
+- **The `tree-changed` scope is now a MENU the agent picks from, not a glob it authors and
+  guesses the shape of** (design record 2026-07-26 §4, hamr's *"did agent choose from a list or
+  not?"*). F60 measured **13 of 18 validator reds as this one class**: the agent writes
+  `{"type":"tree-changed","scope":"src/*.js"}`, the grammar accepts only a trailing `/**` or
+  `/*`, and every red costs a redraft call. Teaching the rule in the prompt or widening the
+  grammar both leave the agent authoring free text; enumerating makes an illegal scope
+  **inexpressible**.
+  - New `legalScopes(writeScope, dirs, cap?)` (`src/plan.js`) is the ONLY producer of scope
+    menus: the signed fence entries (always offerable — they cover directories a step has not
+    created yet) plus the real directories beneath them, fence-filtered, deduped,
+    shallowest-first, capped at `MAX_SCOPE_MENU` (24). Because it filters by the fence, a menu
+    entry that escapes containment cannot be constructed rather than being caught downstream.
+  - `planPrompt` gains a `scopes` parameter and lists the values verbatim, one per line;
+    `validatePlan` gains `opts.scopes` and accepts **membership only**. Omitting the option
+    derives the menu from the signed `writeScope` — fail-CLOSED, never a free-text containment
+    fallback (F50: a silently-ignored optional param is the blind-instrument class).
+  - An off-menu scope **splits by cause**: outside the signed fence stays `scope-escape` (a
+    behaviour signal the ledger keys on), in-fence-but-unoffered is `invalid-value` carrying the
+    menu so the redraft can choose. Collapsing them would launder an attempted fence escape into
+    a typo class.
+  - `runPlan` emits `scope-menu {offered, truncated, offerableCount?, cap?}` — no silent caps.
+  - `globToPrefix` is **untouched**: this changes what the agent is offered, never what the
+    fence enforces.
+
+### Fixed
+- **F64 — a wall-derived call timeout was reported as a network failure**, so the operator's own
+  governance stop was filed as a transport casualty (never evidence, retried, carrying the F44
+  `spendComplete:false` floor) and the human was told to fix the provider binding. `clock.callTimeoutMs()`
+  bounds each provider call by the time left, and bare-agent's `TimeoutError` carries a code but no
+  category — which the runner defaulted to `provider-red` at four separate seams.
+  - New `isWallTimeout(err, clock)` + `TIMEOUT_CODE` (`src/clock.js`) is the whole discriminator: an
+    `ETIMEDOUT` on an **expired** clock is the wall's own stop. One `categorize()` inside `runPlan`
+    is now the ONLY place an uncategorised throw is classified, so the worker seam, the native seam,
+    the scout/drafting relay and the close-fix loop cannot drift apart. A throw that named its own
+    category still keeps it.
+  - Every wall stop emits ONE record shape, with `cutMidCall` splitting a deadline that landed
+    inside a provider call from one read between steps; `ralph` gained a `wall-halt` decision entry
+    so a governance stop no longer reads as "the middle broke", and its options are raise-the-cap,
+    not retry-the-provider. `runPlan` can now return `wall-halt` from the drafting and fix paths too.
+  - **The controls are part of the fix:** the same error with time still on the clock stays
+    `provider-red` (a real dead socket is never laundered into a governance stop), and an unbounded
+    run can never produce a `wall-halt`. Stated limit: a genuine hang on a run whose wall has ALSO
+    passed reads as `wall-halt` — the run is out of time either way and the remedy is identical.
+  - Also closed a coverage hole found en route: the **between-steps** wall terminal had no test at
+    all since it shipped. `runPlan` gains an injected `now` (the seam `createClock` already exposes)
+    because `maxWallMs`'s floor is one close timeout, so real time cannot exercise the terminal.
+- **F59 — the SCOUT returned nothing on 15 of 18 runs, so the planner drafted blind.** The
+  round bound is enforced from the metering callback (`loop.stop`), so a scout still calling
+  tools on its last round was halted mid-tool-use and its `text` was empty: it spent its whole
+  allowance exploring and never wrote the survey that is its only deliverable. `planPrompt`
+  then substituted `(no scout notes)` — a legal prompt, so the failure was silent. Measured
+  across every archived plan-v1 run: 15 of 16 bounded scouts produced 0–86 bytes; both scouts
+  that finished on their own produced full 6–8KB surveys. Two fixes:
+  - **The summary round is now reserved.** A bounded-and-short scout gets one **toolless**
+    round on the same conversation (`askFrom`), where text is the only possible output — a
+    mechanical guarantee, never a prose request (F19/F37: a persona pacing mandate was violated
+    6/6). Native is excluded by design: a toolless native session reports no cost (F48), so a
+    recovery round there would be unmetered spend.
+  - **An empty survey is now loud.** `scout-empty` is a named spine event. It is never a halt —
+    3 of 5 archived greens had an empty scout, so failing the run there would be a worse error
+    than the one being fixed.
+  - `scoutRounds` is now a shell-owned option (like `capRuns`/`maxStepRounds`).
+  - **Confirmed live:** the patient that returned 0 bytes returned 5379 bytes after the fix.
+    F60 then measured what that survey is worth: it carries ~15× more real repository
+    specifics into the plan, and roughly triples the plan's declared work.
+
+### Changed
+- **bare-agent 0.33.1 → 0.34.0** (BA-18 delivered). The provider now bounds socket
+  **inactivity** itself (`timeoutMs`, 10-minute default, per-call overridable, rejecting with a
+  retryable `TimeoutError`/`ETIMEDOUT`), so a silently-dropped socket is a 10-minute error
+  instead of a ~2-hour hang. The harness-side stale-socket guards in `scripts/run-screen-types.mjs`
+  and `scripts/probe-materials.mjs` are deleted as superseded. **`Retry` stays deliberately
+  unwired:** a BA-14 `EPIPE` dies on write so the request never reached the API and a retry is
+  free, but a timed-out request may have been accepted and processed — retrying pays twice for
+  one completion. A trip is a clean `provider-red`, and the escalation's own "retry the run"
+  option recovers it without the double-bill.
+- `planPrompt` is exported from `src/planrun.js` (in-repo seam for probe drivers; **not** added
+  to `src/index.js`, so the adopter surface is unchanged). Probes now import the shipped prompt
+  instead of copying it — the N3 pre-probe's verbatim copy was diffed against source and found
+  identical, so F51–F55 stand, but a copy is a fixture and new drivers do not take that risk.
 
 ## [0.5.1] — 2026-07-24