bareloop 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -5,6 +5,696 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.8.0] — 2026-08-07
+
+### Changed
+- **The variance meter REPORTS progress — and still decides nothing on it** (F85, A+B;
+  `src/planrun.js`). The meter stopped a step that was CONVERGING and then told the redrafting
+  planner that step's exits were *"unmoved"*. Two instruments over one run, and only one of them
+  right. Live on `u-msh70zla`: the close gaps went 30 → 24 → 15 → 14 with the ladder recording
+  `distinctGaps 3` / `strikes 0`, while the replan brief said nothing had moved and the materials
+  said *"0 step(s) completed"* — so the replanner, told it had achieved nothing, rebuilt a file
+  that was already at zero errors, wrote nothing twice, and the run died with $1.09 and 7 minutes
+  unspent. hamr's ruling, verbatim: *"meter is right but missing a piece … it should give heads up
+  on money/time + progress for llm to judge."*
+  - **The firing condition is byte-identical** — `moneyShare`/`timeShare >= 0.5`, both axes, the
+    same threshold, the same throw. A progress term in the TRIGGER would make a governance
+    instrument over an operator-owned allowance judge capability, so a converging step that is
+    eating the run is still stopped. What was missing was never a term in the condition; it was
+    the READING.
+  - **The reading is read off `src/trend.js` — the SAME instance the money halt reads.** Nothing
+    new is computed at the meter: no second reader, because two instruments answering one question
+    is the exact defect being fixed. Per-stage, stage names and numbers only, and `unknown` stays
+    `unknown` — a close that reports no number donates nothing (F6).
+  - **The hardcoded `with its exits unmoved` string is DELETED.** It printed on every step-variance
+    stop whatever had happened, and on `u-msh70zla` it was simply false. The escalation detail —
+    which a human reads and which the replan brief quotes — now states the meter's fact (*a share of
+    the run was consumed*) and then the trend instrument's measured reading, as two separate claims
+    rather than one fused verdict on the work. The materials `progress` line keeps its structural
+    sentence (*"step N of M did not finish; K step(s) completed before it"* — a plan's shape is what
+    the planner re-allocates) and gains the close trend beside it.
+  - **Spine change:** the `variance` record gains `trend` / `motion` / `reading` / `series` — the
+    same four names and the same shapes the money halt already emits, so one reader parses a
+    progress reading wherever it appears. ADDED fields, never repurposed ones (the spine is
+    append-only forever). Measured post-fix on `u-mshcpdg4`, iteration 3 on `finish-strict-typecheck`:
+    `moneyShare 0.497`, `timeShare 0.769`, `axis time`, `trend "converging"`,
+    `reading "still progressing — typecheck 30 → 15 → 15 → 1"`,
+    `series [{stage:"typecheck",values:[30,15,15,1]}]` — against `u-msh70zla`'s pre-fix record, which
+    carried the shares and nothing else.
+- **`runTrend` was blind to everything a STEP achieves** (F85, the prerequisite found en route). The
+  run's trend reader was fed only the close PRECHECK and the outer fix loop, so a meter firing
+  mid-step had nothing to report about a step that had just gone 24 → 15 → 14. Two folds corrected:
+  a step's failing check is an arbiter-rendered close grade (same `runStages`, same chain, same stage
+  names) and is now recorded like one; and it is recorded on the RAW gap, because `evalExits` wraps
+  stage output as `check "<name>" red: …` and that wrapper line carries the word "red" with no number
+  on it — so every step grade used to donate a null. Measured on `u-msh70zla`'s own archived gaps:
+  raw reads `typecheck 24 → 15 → 14`, wrapped reads nothing at all. Plus a **preflight seed** so the
+  counter has a baseline: the precheck reds at the close's FIRST failing stage (first-red-wins) and
+  every shipped close opens with `changed-from-seed`, so the numeric stages had no baseline at all and
+  a run would read `unknown` on exactly the stop the readout exists for. Seeded ONCE PER STAGE, off the
+  reader's own books — the precheck and the preflight menu grade the same unchanged tree back to back,
+  and a repeated baseline in a series reads as an attempt that achieved nothing, which is the phantom
+  flat step this change exists to remove.
+- **`tests/resume-u.test.js` is decoupled from the live job spec.** It read
+  `jobs/bareagent-u-types.json` while hardcoding $8 / 45min, so an operator budget edit on a live spec
+  turned the suite red. Every number now derives from the spec it reads, proven by passing at a third
+  budget value. Suite: **1023 tests** (1027 minus the 4 deleted with the `never wrote` feature below);
+  typecheck and `build:types` exit 0.
+- **The per-step model tier menu narrows to `['sonnet']`** (`STEP_MODELS`, `src/plan.js` — a PUBLIC
+  surface: a plan declaring `model: "haiku"` is now REDDED by `validatePlan` with `invalid-value` at
+  `steps.N.model`, carrying the menu). hamr's order, verbatim: *"haiku should be dropped to see if it
+  passes, if it's agent poor work or harness, like always."* **This is a reversible ATTRIBUTION PROBE,
+  not a finding that haiku is incapable** — what the $0 archive read behind it shows is a CONFOUND, in
+  both directions. Over 186 spines / 71 accepted plans / 255 steps, only **20 steps ever declared a tier
+  at all**: haiku **12** — 9 of them on a REPLANNED plan, 6 the LAST step of their plan, round bounds
+  3–12, **2 ever green** — against explicitly-declared sonnet **8**, 2 on a replan, 3 last, bounds 14–32,
+  **5 green**. The planner reaches for haiku on steps it judges mechanical, and a replanned step sits on
+  a run already in trouble, so neither column is a controlled read; and all three bareagent-u runs of
+  2026-08-06 tiered their replanned step down (haiku/6, haiku/8, haiku/12) and all three failed. That
+  confound sat directly on top of the programme's most recent capability read (F86's tail). Removing the
+  tier is how it gets attributed: with one tier expressible, a still-failing replan is agent or harness,
+  never the tier.
+  - **The `model` field and its validator branch STAY.** A one-entry menu means a plan — or a stored
+    bridge — declaring `model: "sonnet"` still validates, and restoring haiku is a one-token edit. No
+    stored bridge declares haiku (verified).
+  - **The drafter prompt's `model` line is DELETED** rather than reduced to a one-item menu: it
+    advertised *"a cheaper tier for mechanical steps"* and there is no cheaper tier now, and reciting a
+    single legal value spends tokens to invite a no-op field (`attempts` is the existing
+    legal-but-not-offered precedent). Verified by RENDERING the real prompt — 0 lines match
+    `/model|tier|haiku|sonnet|cheaper/i` in either the fresh or the replan form.
+  - **Only what the AGENT may express narrows**, which is the safe direction. `--model haiku` remains
+    the OPERATOR's probe knob (PRD v1.36), untouched in `scripts/run-u.mjs`; two comments there called
+    the runner's tier map *"the same closed menu the planner uses"* and now say plainly that it is
+    deliberately wider.
+  - **No spec hash moved.** `jobSpecHash` covers the resolved spec, not `STEP_MODELS`; all 10 job specs
+    were re-hashed and none moved — bareagent-u and bareguard-u are still the hashes hamr signed.
+  - Measured on the first sonnet-only run against the last haiku-era one, same patient: **10.9 → 17.5
+    seconds per round** (1.6× slower), 120 → 87 rounds, and the failure CLASS changed — struck out at 2
+    remaining errors with money and clock left, versus still converging at 1 error when the wall
+    expired. Better rounds are slower rounds, and the binding constraint moved from the strike ladder to
+    the clock. That sonnet-only run was also the first to reach the outer close, where it was redded for
+    **silencing the type checker instead of typing the code** (F87's suppression genre) — the close
+    refused it, and the eventual green removed the suppressions.
+- **`bareloop.context.md` named `sonnet | haiku` in two places and is corrected** — the shipped adopter
+  contract carried the old menu in the `steps[].model` schema row and in the `providerFor` (P) section,
+  so an integrating agent reading it would have drafted a plan that reds. Both now name the one-entry
+  menu and say why it is one entry.
+
+### Fixed
+- **A locked-VERDICT `request-red` no longer files as a bare-agent upstream ask** (`src/job.js`,
+  `src/ledger.js`). `classifyIncidents` hardcoded `lib: 'bare-agent'` for every `request-red`, but the
+  code covers two territories: a locked TOOL verb (bare-agent, the original case) and a locked VERDICT
+  type (`soft-green`/`hitl`) — demand against bareloop's OWN `VERDICT_TYPES` menu, live-misfiled for
+  every `LOCKED_VERDICTS` declaration (the BA-2 misattribution class). Per the typed-lib rule the
+  territory is now stamped at the EMIT site (`Red` gains `lib?`; `verdictType` → `bareloop`, `tools` →
+  `bare-agent`) and the ledger reads it, keeping the hardcode only as the pre-field legacy-spine
+  fallback (zero archived rows carry the code, verified). The `suggestedAsk` template renders the
+  stamped target, so a bareloop-catalogue refusal can never seed a bare-agent ask; D13's genre refusals
+  (close-authoring design record) route by stamping their own lib with no ledger change. 5 new
+  failing-first tests; `capability-gap` still hardcodes bare-agent — flagged, structurally unreachable
+  today (a validation red returns before any provider call; the module header says so).
+- **…and `capability-gap` no longer hardcodes it either — the flag above is CLOSED** (`src/ledger.js`).
+  `capability-gap` is `request-red`'s cap-halted form and inherits both of its territories, but the fix
+  landed at one of the two sites and not the other: the synthesis loop still wrote `'bare-agent'`
+  literally, and so did its `suggestedAsk` template — the one field a human actually files from, where
+  fixing only the occurrence's `lib` would have left the misattribution fully intact. The territory now
+  comes from the OCCURRENCE (the `request-red` rows already carry the lib stamped at their emit site),
+  and the **dedup key becomes `(verb, lib)` rather than the verb alone**: the ledger's own occurrence
+  key carries `lib`, so a `Set` over verbs would merge two territories into one row and attribute it to
+  whichever the set happened to hold first — an arbitrary target, which is the defect itself. One gap
+  per (territory, verb) costs nothing and each carries an honest one. **Reachability is unchanged and
+  still DORMANT** — `validateJob` returns not-ok on any red and `run.js` returns on a validation red, so
+  a `request-red` and a `cap-halt` cannot share one spine today; this is a latent-consistency fix at a
+  seam the module header documents as dormant, and it claims no live bug. 3 new failing-first tests,
+  each labelled in-file as a FUNCTION-CONTRACT fixture (`classifyIncidents` is pure) so a later reader
+  cannot mistake the synthetic stream for something a run can produce. Closed now rather than left
+  flagged because a fix that lands at one of two identical sites is the class this repo has already
+  paid for once — the ripgrep install that went into `ci.yml` and not `publish.yml`, which then failed
+  on the identical cause.
+- **The replan ceiling reset on EVERY resume leg — a kill refilled a bound the operator signed**
+  (`src/planrun.js`, `src/run.js`, `src/reuse.js`, `scripts/run-u.mjs`). `replanned`/`varianceGrantUsed`
+  were locals in `runPlan`, and a resume is another `runPlan` call. Confirmed by execution before any
+  remedy: leg 1 replanned and stopped; leg 2, driven with a `resumeSeed`, replanned again — a run total
+  of 2 with every record showing 1. Two became four by being killed once, which is precisely the creep
+  the latch exists to make impossible (*"unlimited replanning launders thrash as adaptation"*, PRD
+  v1.12).
+  - **Fixed on the MONEY-FOLD precedent, not the grade-seed one, and the choice is the fix.**
+    `readGradeSeed`'s documented known limit is that it reads ONE spine, so a resume of a resume
+    inherits leg 2's grades and not leg 1's — the chain shortens by a leg per kill. That is fail-safe
+    for a READOUT (a short chain can only under-claim a direction) and it is the DANGEROUS direction
+    for a CEILING, where an under-claimed ledger is a refilled allowance. So each leg DECLARES the
+    ledger it inherited on its own spine (`priorSpentUsd`'s mechanism) and the next reader adds only
+    its own window's `replan` records. Leg 3 inherits the whole chain, not leg 2's slice.
+  - **The counter-argument was answered, not stepped over.** `src/trend.js` deliberately refuses to
+    seed the fix loop's ITERATIONS from history, and that stays right: an attempt allowance is a LEG
+    bound, and a restarted leg buys its own attempts with its own money. A replan ceiling bounds how
+    many times the WORKFLOW may be redrawn, which is the run's span — the same span the halt readout
+    already covers. The two seeds disagree on purpose and both now say so in-source.
+  - **SPINE FIELDS — `job-start` gains `priorReplans` / `priorReplanGrantUsed`.** Emitted only when
+    there is a fold (a decorative `0` is indistinguishable from a run nobody folded), on the same
+    declaration `priorSpentUsd`/`priorWallMs` already ride. The grant latch travels BESIDE the count
+    rather than being derived from it: a leg can inherit a spent ordinary ceiling with the arbiter's
+    extra still unearned (`1`, `false`), and deriving one from the other would collapse two real states
+    into one. `readResume`'s `direct` mode reads the fold off these very fields, so a U-path run
+    resumed twice inherits leg 1.
+  - **SPINE MEANING CHANGE — `plan-executed.replans` counts the CHAIN, not the leg** (and `replanned`
+    with it). **An adopter parsing spines must re-read this field.** The change was made rather than
+    shadowed by a second field precisely because `replans` shipped only on this unreleased branch, so
+    no archived spine carries the leg reading for a reader to be confused by. The leg's own number is
+    not lost: a leg emits one `replan` record per replan it drafts, so `chain − records-in-this-window`
+    is the fold it inherited — the same arithmetic `readResume` runs — and a second field stating a
+    derivable number would be a second reader of one question.
+  - **New option: `runJob(spec, { resumeReplans })`** (and `runPlan`'s identically-named option),
+    `{count, grantUsed} | null`, defaulting to `null` = the cold path, byte-identical to a run nobody
+    resumed. Belted like every declared fold entering the arbiter's arithmetic: a garbage, negative or
+    non-finite seed reads as `0` rather than poisoning later comparisons as `NaN`, and a negative one
+    can never cancel a real replan and widen the ceiling. `scripts/run-u.mjs --resume` and `runReuse`
+    both pass it. **The disarm control holds** — a resumed leg with an UNSPENT ceiling still replans, so
+    the bound is bounded and not switched off.
+- **The replan brief's `closeGapBlock` re-bounded an ALREADY-bounded gap and deleted the red names the
+  first envelope had rescued** (`src/planrun.js`, `src/exits.js`). `src/exits.js` states the rule for
+  this same artifact one seam earlier: the check gap arrives already enveloped by `runClose`'s
+  `boundGap` under the stage's own `gapKeep`, which deliberately rescues the `not ok`/`FAILED` names
+  out of the elided middle — the mechanical gap F46's conversion mechanism feeds the worker. A second
+  400/1500 envelope deleted exactly those a second time, which is F28 reintroduced; measured on a
+  120-red-line close output, the first bound rescued **78** names and the second dropped **12** of
+  them. `CHECK_GAP_MAX` (12,000) is now **exported** from `src/exits.js` and imported here rather than
+  respelled, so the two seams cannot drift on how big a check gap may be, and it is applied as a
+  **backstop, not an envelope**: under it the gap passes through VERBATIM. The headroom is measured,
+  which is why the ceiling is not smaller — `runClose`'s own envelope tops out at ~10.1KB (400 head +
+  8192 keep + 1500 tail + labels), and joined with a `tree-changed` detail that is ~10.2KB, leaving
+  ~1.8KB to spare, so the shipped path is untouched and the backstop fires only where `src/exits.js`
+  says it should: a seam that returned something never bounded at all. Length is measured AFTER the
+  secret scrub, because a mask is wider than most literals it replaces and bounding the raw string
+  would let a gap cross the ceiling on its way through the one transformation that always runs.
+- **The replan brief's block was LABELLED as the close's own output but could lead with ours**
+  (`src/planrun.js`). `res.gap` is `lastGap` — the join of EVERY failing exit's detail in exit order —
+  and with `MAX_EXITS_PER_STEP` at 2 plus the mandatory `tree-changed` pairing on a write step, a step
+  that wrote nothing opens the block with the EVALUATOR's own prose (`0 files changed under src/** …`)
+  under a label reading *"the verification's own output"*. Captured verbatim from a real replan prompt.
+  The **label** is corrected to *"What this step's exits reported on its last attempt (their own
+  output, verbatim)"*; the **payload is deliberately kept** — "the step wrote nothing" is exactly what
+  a replanner should be told, and stripping it to make an old label true would trade a real fact for a
+  tidy sentence. F86's thesis (the artifact travels as TEXT, never parsed) is restated, not weakened.
+- **F49's ReDoS reject now covers the OPERATOR's two regex fields, not just the agent's**
+  (`src/job.js`, `src/validate.js`, `src/plan.js`). `hasNestedQuantifier` shipped wired at exactly ONE
+  site — the agent-authored `artifact-written.pattern`. Two operator-authored patterns reach an
+  equally untimed evaluator and were uncovered: `judged.pattern`, exec'd by `runClose` against the
+  close's whole stdout+stderr, and `gapKeep`, compiled by `boundGap` and run **once per line** of
+  close output. Both now red `invalid-value` at the validation gate, before any tokens burn.
+  - **Measured, not argued:** `boundGap(stream, '(a+)+$')` against a 40-character line does not finish
+    in 20 seconds (`timeout` exit 124).
+  - **Why this is worse than an operator self-DoS, and F67 is the reason.** On the agent side F49's
+    own scope note holds — the agent authors both the pattern and the artifact, so a hang burns only
+    its own wall-clock and compromises no arbiter. These two run in **bareloop's own process**, so the
+    hang blocks the MAIN EVENT LOOP — and the in-process stall fuse is a timer in that same loop, so
+    it cannot fire (*a guard living inside the process it guards shares that process's fate*). The run
+    then dies to the OUTSIDE watchdog and reads as a model stall: **a bad regex in a SIGNED spec
+    presents as a provider problem.** The cost is a misdiagnosis, not just a stop.
+  - **The detector MOVED to `src/validate.js` — one inventory, never a second copy.** `plan.js`
+    imports `job.js`, so `job.js` cannot import `plan.js`; housing the scan with the other shared
+    primitives is what lets both documents reject through the same function. `plan.js` re-exports the
+    name (the `WRITE_VERBS` precedent), so the F49 site is byte-identical in behaviour. A second copy
+    would be precisely the drift class `SECRET_PATTERNS` exists to prevent — a shape one validator
+    rejects and the other admits. `hasNestedQuantifier` is not exported from `src/index.js`, so the
+    move is internal and breaks no adopter.
+  - **Admissibility swept before the change and re-run after:** all **92** operator regexes across all
+    **10** signed specs in `jobs/` — **zero** newly red. No spec breaks, no spec-hash churn (no spec
+    file is touched). The shipped shapes are pinned in the suite as the control that can produce the
+    negative: if the reject ever reds one of them, it has broken the live fleet.
+  - **Known limit, PARKED not chased:** the scan misses the alternation-overlap class (`(a|aa)+$`,
+    `(x|xy)*$` — no inner quantifier exists to find; the blowup comes from overlapping branches under
+    a repeat). Widening it changes which SIGNED specs are admissible, which is arbiter-adjacent.
+    Docked to the close-authoring rung, where hand-authored operator regexes may cease to be a surface
+    at all — see **PRD v1.55**. Recorded there too, so it is not re-chased: `([^])*$` is NOT caught and
+    that is CORRECT (`[^]` is the any-char idiom, so the pattern is linear); the genuinely nested
+    `([^]*)*$` IS caught.
+
+### Added
+- **A SECOND variance stop can earn ONE more replan — granted by the ARBITER, on a mechanical
+  reading** (F85, C). A second `step-variance` after the one-replan ceiling was spent used to be a
+  hard stop, and on a run that was still converging that stop threw away work already paid for. Every
+  clause of the grant is a constraint: **ONE**, bounded by a LATCH rather than a comparison so the
+  ceiling cannot creep by arithmetic (unlimited replanning launders thrash as adaptation, v1.12) — a
+  third variance stop is the stop, however well it is going; **the arbiter's**, read mechanically off
+  the same `runTrend` instance the meter and the money halt read, with the agent given no channel to
+  it — it never asks, is never offered it, and cannot influence it (no self-adjusted budgets, ever);
+  **`converging` only**, the trend instrument's own category with no fresh number invented here
+  (threshold-setting is the operator's), so `flat` and `unknown` stop exactly as before and an unknown
+  is never rounded up into a reason to spend (F6); and **`step-variance` only** — an exhaustion or a
+  stall after the ceiling is unchanged. `remainingUsd() > MONEY_MIN` still gates it, as it gates the
+  ordinary replan. **Spine change:** `replan` gains `replan` (which replan this is) and — only when the
+  arbiter granted one past the ordinary ceiling — `granted` with the reading it was granted on, so a
+  reader can never mistake the ceiling for a grant; `plan-executed` gains a `replans` count riding
+  BESIDE the shipped `replanned` boolean, never repurposing it. Live on `u-mshcpdg4`: three
+  `plan-accepted` records — the initial draft and two replans, the second granted on `converging`.
+- **`closeGapBlock(gap)` — the replan brief carries the close's OWN output** (F86; `src/planrun.js`).
+  `u-mshcpdg4` reached ONE remaining strict error and still died. The close gap named the work exactly
+  — `src/recurse.js(978,115)` — and the worker read it every attempt; the REPLANNER, which is the
+  component that chooses which files the next plan targets, saw only
+  *"still progressing — typecheck 30 → 15 → 15 → 1"*: a number with no address. It aimed the last plan
+  at `src/loop.js`, already at zero errors, wrote nothing twice, and took two strikes — with $1.10 and
+  82 seconds still on the clock at the moment that replan was granted (the run itself ended $0.8174 and
+  ~6 seconds short of its caps). F85 gave the brief the trajectory; this gives it the artifact the trajectory
+  is a summary OF. Handed over as **TEXT**, with both boundaries reused rather than respelled: scrubbed
+  through the one secret inventory (`redactSecrets`/`SECRET_PATTERNS`) because a prompt is an egress
+  point and the next caller will not remember the upstream scrub, and bounded by ralph's own `boundGap`
+  — now **exported** from `src/ralph.js` for it, since a private slice would be a second truncation
+  scheme that drifts on exactly the property that matters (whether the red lines survive, and whether
+  the trim announces itself, F28); the close path still calls it with the stage's own `gapKeep`,
+  byte-identically. The red-set is `REPLAN_GAP_KEEP = '\S'` — every non-blank line — because a shipped
+  `gapKeep` is `^`-anchored (`^BAREAGENT `, `^red`, `^FAILED`) and the exit evaluator wraps stage output
+  in `check "x" red: …`, so the anchor no longer sits where the pattern expects it; a gap that reaches
+  here is ALREADY a red-set (`judge` builds it out of the failing exits only), so keeping every line is
+  the correct instrument, not a widened one. **No spine field** — `src/trend.js`'s rule is that no
+  record carries a close byte. An empty gap yields the empty string, so the brief renders
+  byte-identically to the pre-F86 one (a labelled empty section would invite the planner to explain an
+  absence the run never observed). Verified by execution, not by reading: sabotaging the wiring
+  (`gapBlock = ''`) turns the `u-mshcpdg4` regression test red (`not ok 121`); restored byte-clean.
+
+### Removed
+- **`gapFilesNeverWritten()` and the `never wrote` replan advisory** (F86) — an EXPORT of
+  `src/planrun.js` is gone (it was never re-exported through the package entry, whose `exports` map
+  admits only `.`, so no adopter import breaks). hamr's order, verbatim: *"delete it and rerun
+  bareagent"*. The measured reason, on `u-mshcpdg4`'s own gap: the advisory resolved to
+  `src/loop.js` — the file already at zero errors — and said so as a DIRECTIVE, beside the artifact
+  that said the opposite; this worker follows directive prose (positive-scope confinement). It also had
+  no evidence of ever converting anything: it fired by construction on `u-msdsmkid`, and that run still
+  step-redded. The general rule it broke is why `closeGapBlock` hands over text instead: **a parsed
+  file list cannot tell a summary line from a detail line**. Line 1 of that very gap reads
+  `reports 1 error(s) in src/recurse.js, src/loop.js` — every file in SCOPE — and only line 2 names the
+  culprit; and the shapes differ per close anyway (tsc `file:line`, pytest test ids, a count close that
+  names no file at all). A model reading the artifact can make that distinction; a regex reproduces the
+  bug. Two readers of one question with the parsed one wrong is the same failure the variance meter just
+  had. Its 4 tests went with it, and its sole caller was the brief — no speculative code left behind.
+
+## [0.7.0] — 2026-08-05
+
+### Changed
+- **`ralph()` now REFUSES a call with no exhaustion rule** (public API). `capRuns` became
+  optional in the signature when the `ladder` governor arrived — *"required unless `ladder` is
+  supplied"* — and nothing enforced the "unless". With neither, `1 <= undefined` is false: the
+  middle ran **zero** times and the call still returned `escalated` after emitting `cap-halt`
+  and an escalation reading `undefined/undefined runs spent, close still red` — a governance
+  stop narrated for a loop that was never entered. A param guard at entry now throws, naming
+  both alternatives (either one repairs the call). `capRuns` must be a positive integer;
+  `0`, `2.5`, `'3'`, `null` and `NaN` are refused the same way. **No shipped path changes** —
+  both in-library callers (the step loop and the close-fix loop) pass a `ladder`.
+- **ONE progress instrument for both governance halts.** The wall halt used to run its own
+  reader — byte equality of the last two close gaps, reporting `stalled` / `moving` / `unknown`
+  beside the money halt's `flat` / `converging` / `unknown` on the same run. Two readers for one
+  question is how the two come to disagree, and the byte reader could only ever report MOTION —
+  that something changed, never which way. Both halts now read the run's own `src/trend.js`
+  reader. Where a stage reported a comparable NUMBER it decides (so a wall halt on a converging
+  run now says `converging`, with the series, instead of "it moved"); where none did, the byte
+  comparison survives INSIDE `unknown` as a new `motion` field (`changed | unchanged | null`)
+  and as a clause in the `reading`, with the lever adapting (`unchanged` → revise the goal;
+  `changed` → read the last close output). **Never promoted to a direction and never mapped onto
+  `trend`** — "the close's output changed" is not "the run got better" (F6 in a trend's coat).
+  W-2's semantics are untouched: the grade already minted is kept, the three levers are the same
+  three, and the close is still never bounded by the wall. **Spine change:** the `wall-halt`
+  record's `trend` now carries the money halt's vocabulary and a sibling `motion` field; no
+  `src/` or `scripts/` reader consumed the old values (grepped).
+
+### Added
+- **A MONEY halt is decision-ready, exactly as W-2 made the wall one** (PRD v1.46 §2). A run
+  cut by its budget KEEPS the verdict already minted and emits a new `money-halt` spine record
+  carrying `budgetUsd`, `remainingUsd`, the kept `verdict`/`stage`, a progress `trend`
+  (`converging | flat | unknown`) with the `reading` and `series` it judged, and three
+  `options`: top up and resume, revise the spec, abandon. Emitted at every site that cuts a run
+  on money — the step loop, the close-fix loop, and the scout/draft relay. **The library only
+  reports**: `budgetUsd` is in the spec hash, so a top-up is a spec edit a human signs, and
+  nothing in a run may widen its own budget (unchanged hard line).
+- **The close TREND instrument** (`src/trend.js`, internal). Reads a run's own close grades as
+  a series **per stage**, compared only against that stage's own best so far. Accuracy law:
+  never across stages — merging a staged close's axes reads a real see-saw (suppressions
+  12 → 5 while the type errors that scrub re-exposed went 2 → 0) as a regression. Never model
+  prose: the reading is the first number on the first red-marked line of the stage's output.
+  A stage that reports no number donates nothing — not a zero, not a strike, and the verdict
+  says `unknown` out loud (F6). Reaching a later stage than ever before counts as progress
+  (a staged close is first-red-wins). Known accepted limit, documented at the site: a
+  floor-shaped stage (`N tests executed, below the seed's M`) reads as not-improving rather
+  than converging — the fail-safe direction.
+- **A resumed run's trend judges the WHOLE chain, not just the leg.** `readResume`'s `restart`
+  gains `grades`: the dead leg's close grades in order, as `[{stage, value}]` — counts and stage
+  names only, never a gap byte. `runJob`/`runPlan` take them as `resumeGrades` (beside
+  `resumeSeed`) and `createTrend` takes them as `seed`, folding them into the run trend's series
+  and per-stage bests. Without it a resumed leg restarts the trend at its own first close and can
+  report `flat` — *revise the goal* — on a run that was converging when its allowance ran out; a
+  leg that re-grades an unchanged tree is flat on its own evidence while the RUN is what the
+  top-up decision is about. The seed is history, not this leg's evidence, so it counts no
+  iteration, mints no strike, never sets `comparableEver` on its own (the blind-cap backstop
+  still governs a leg whose own readings never compare) and donates no stage position. The
+  close-fix loop's governor is deliberately **not** seeded — it answers the leg-local question
+  ("is this loop out of ideas"), and seeding it rendered "still progressing" inside the terminal
+  of a loop that had just struck out flat. Grades are read from the `ladder` records the live
+  governor already wrote (`governor: 'close-trend'`, verbatim, never re-parsed), from
+  `close-precheck`/`outer-close`, and — only on a spine predating that governor — from the
+  `close-verdict` records after the `fix-loop` marker, which is the same population and excludes
+  a STEP's failing exit. Known limit: one spine is read, so a resume of a resume inherits the
+  previous leg's chain and not the one before it. `scripts/run-u.mjs --resume` wires it and names
+  the inherited baselines in its preview.
+- **`--resume` on `scripts/run-u.mjs`** (PRD v1.46 §3) — the third leg of the resume rulings.
+  It skips the patient reset (`resumeTreeGate` instead: a dirty tree is what a resume expects;
+  only a moved HEAD stops it), folds the halted run's money and wall in so the signed ceiling
+  cannot widen by being re-invoked, re-enters at the checkpoint the steps already earned, and
+  arms the outside watchdog on the REMAINING wall. `readResume` gains two options, both OFF by
+  default so the reuse loop is byte-unchanged: `direct` reads a plain `runJob` spine as one
+  implicit try, and `resumableOutcomes` reclassifies a landed `job-end` that is a GOVERNANCE
+  HALT (`cap-halt`/`wall-halt`) as a checkpoint rather than a graded row. Green and every red
+  stay non-resumable — a verdict already rendered is never re-bought. `job-start` now carries
+  the declared fold (`priorSpentUsd` with its `priorSpendComplete`, and `priorWallMs`) when
+  there is one, so a chain of resumes adds only each attempt's new rounds instead of
+  re-deriving and double-billing.
+  **Validated live and pinned by cycle tests (F83).** Live: a signed top-up resumed a real
+  money cap-halt at its close checkpoint — finished step skipped, no re-scout or re-draft,
+  patient continued, watchdog armed on the REMAINDER — and greened, with `job-end` stating
+  the folded total across both legs. Pinned deterministically by five `$0` scripted-round
+  tests covering the whole cycle: leg-1 halt → top-up → leg-2 green at the checkpoint (a
+  close-precheck red proving the green was earned, not inherited); a **no-top-up control**
+  where the same budget buys no second pass and leaves a byte-identical tree (one
+  round-boundary overshoot round, the documented behaviour of a cap that binds BETWEEN
+  rounds); an **unsolvable cycle** where a topped-up leg making no per-stage progress
+  strikes out `flat` with the wallet still largely unburned — the fix loop's strike rule
+  governs a resumed leg exactly as it governs a cold one; and an F6 floor surviving halt →
+  fold → green terminal.
+- **Layer 3, the REUSE rung — the registry, the load gate, and the MECHANICAL START**
+  (design record `docs/plans/2026-08-01-layer-3-reuse-design.md`; execution probe green
+  before any of it was built). A green's plan is now an artifact the next run of the same
+  SHAPE can start from, instead of being discarded.
+  - **`src/bridges.js` — the registry (D1/D6).** A directory of plain JSON files at an
+    OPERATOR-supplied path (no database, no new dependency, no default location).
+    `mintBridge` / `appendGreen` / `appendRed` / `saveBridge` / `loadBridge` /
+    `loadRegistry` / `makeRegistry` / `registryExists` / `validateBridge` / `listingRow` /
+    `deriveStatus`, all exported. **Only a green writes the box (R1):** a red writes a
+    history row and never touches `versions`. **Status is DERIVED, never stored (D6):**
+    candidate = one green, proven = greens on two DISTINCT patients, a red on a proven
+    entry demotes it — and a CASUALTY is not a red. There is deliberately no probability
+    score. Costs and durations are a number or an EXPLICIT `null` with the key required
+    either way, so an unknown is said rather than omitted (F6).
+  - **`loadGate(bridge, job)` — D2 as SPLIT (2026-08-01 addendum).** Three shape checks at
+    the door — verdict type, close-stage kinds, verbs within the signed menu — and
+    **nothing about paths, scopes or targets**: those are instance-bound and expected to
+    red, which the pre-probe measured the drafter fixing unaided (3/3 legal after tweak),
+    while the gate as originally frozen would have refused every cross-patient recipe.
+  - **`bridge?` on `runJob` and `runPlan` — the mechanical start (D4).** With a bridge, the
+    gate runs before the clock, the close precheck and any token; on a pass the NEWEST
+    version's plan-as-executed becomes the drafter's STARTING DRAFT inside the ordinary
+    drafting prompt (`planPrompt` gained an optional `startingDraft` argument). The tweaked
+    plan then passes the SAME `validatePlan` every cold draft passes — **no second, looser
+    path exists for an inherited plan** — and the ONE-replan ceiling is untouched (D5): a
+    replan drafts from the run's own state and never re-injects the bridge.
+  - **New terminal `recipe-stale`** (`runJob`/`runPlan`): a bridge that fails the load gate
+    is refused at the door with `bridge-gate {outcome, name, reds}` on the spine, a
+    decision-ready escalation, and **zero spend**. Falling back to cold drafting is the
+    CALLER's decision, never an automatic silent fallback. Classified as a deliberate
+    ledger exclusion — the gate refusing a wrong-KIND recipe is the mechanism working, not
+    a library bug to file upstream.
+  - **New spine events:** `bridge-gate` (a refusal, with its reds) and `bridge-loaded`
+    (`{name, versions, runid}` — which version inherited).
+  - **`src/selection.js` — D3's display half.** `renderListing(registry)` renders the
+    operator/LLM-facing workflow listing (name, goal, status, greens/reds, the cost/time
+    band of the greens), deterministic by name and total on garbage; an unknown cost or
+    time renders `UNKNOWN` and a partial aggregate says how many it skipped, and registry
+    entries that could not be read are NAMED so the listing is never quietly shorter than
+    the directory. `selectionPrompt(listing, ask)` is the pure prompt text for the pick,
+    carrying D3's two standing rules: *"none matches"* is a first-class answer that means
+    drafting new, and a PINNED workflow may be refused only EXPLICITLY, with a reason. Both
+    are pure text — the selection call, the pin/shortlist/force-cold flow and the parse of
+    the answer belong to the caller.
+  - **The cold path is byte-identical without a bridge** (the F47 works-both-ways rule),
+    pinned by test: no new event fires and no starting draft appears anywhere in the prompt.
+  - **`src/reuse.js` — the D7 ENVELOPE and the REUSE RUNNER.** hamr's sentence made
+    executable: *"we ask user for cost/time and how many workflows to try before starting
+    new like $5 and 30 mins x2 then start anew if both red"*.
+    - **`validateEnvelope(input, { job? })`** — `{ perTryBudgetUsd, perTryWallMs,
+      bridgeTries }`, **all three required and explicit, no defaults** (a defaulted cap is
+      a silent second ceiling); `bridgeTries: 0` = force-cold. The envelope may only
+      **TIGHTEN** the signed spec — a per-try number above `job.budgetUsd`/`job.maxWallMs`
+      is `envelope-widens`, never a silent raise.
+    - **`resolveTrySpec(job, envelope)`** — the per-try spec every try runs, cold leg
+      included. Tightening moves the SPEC HASH, so a tightened run is a new spec VERSION
+      the operator signs; `runReuse` passes `approvals` straight through and cannot forge
+      one. An envelope equal to the spec's numbers is hash-identical.
+    - **`selectBridge({registry, job, ask, provider, pinned?, shortlist?, forceCold?,
+      exclude?})`** — ONE model call on the caller's drafter-tier provider (none is
+      constructed inside), parsed through the repo's one `extractArtifact` into a strict
+      `{choice, reason}`. `forceCold` and an empty candidate set skip the call for $0. A
+      name outside the listing is a red, never used. **A pin does not bypass the call**
+      (D3): it is stated in the prompt, and an answer naming anything else returns
+      `{refused: true}` — the substitute is NOT adopted and the decision goes back to the
+      operator. Cost metered and reported (F6).
+    - **`runReuse({job, approvals, registryDir, envelope, patient, workdir, provider,
+      emit, …})`** — selection → try → box → next try → cold. Selection re-reads the
+      registry per try with the tried names excluded; **a green ENDS the loop**; tries
+      exhausted falls through to a cold run under the same per-try numbers, whose green
+      mints a new bridge for the job slug (or appends if that name already holds greens —
+      clobbering a green is what R1 exists to prevent), and whose red writes nothing (the
+      entry bar is a green). Every non-green return is decision-ready. The three answers
+      **no further try could change** — `unapproved-spec` (a tightened envelope is a new
+      spec version, signed not inherited; the decision hands over the exact hash),
+      `job-red`, `smoke-red` — end the run where they happen instead of reproducing
+      themselves down the whole envelope. A cold green also REFUSES to mint over a file of
+      that name it could not read (`mint-collision`): an unreadable entry is not an absent
+      one, and whatever greens it held are gone once overwritten.
+    - **`REUSE_GRADED_RED`** — only `escalated` demotes: the terminal where the close
+      judged the tree, the fix loop spent its attempts with money still on the table, and
+      the close was still red. Every other non-green outcome is a CASUALTY recorded under
+      its own name (`cap-halt`/`wall-halt` governance, `provider-red`/`step-stalled`
+      transport, `close-red` the close FAULTING and rendering no judgment, `recipe-stale`
+      refused at the door, `plan-red`/`step-red:*`/`check-red` stopping before the close
+      ever judged). Full detail still lands on the history row.
+    - **F45 made visible instead of thresholded.** A try's budget must fund the attempt
+      PLUS its close, and nothing in-process can know what a close costs — so **no
+      threshold is invented** (threshold-setting is arbiter territory, from a measured
+      base rate). Instead every try row carries `spentUsd` vs `capUsd`, `wallMs` vs
+      `wallCapMs`, `capBound`, `wallBound` and **`closeReached`**: a cap that died before
+      any grading is a fact on the row, not an inference.
+    - **New spine events:** `reuse-start`, `selection-result`, `try-start`, `try-end`,
+      `bridge-write`, `reuse-end`, plus `envelope-red`. **New escalation categories**
+      `reuse-exhausted` / `selection-refused` / `selection-red` / `registry-red` /
+      `envelope-red`, all added to the ledger's executable excluded-set — the envelope and
+      the operator speaking, never a library failing (a real transport fault out of the
+      selection call still classifies as `provider-red`).
+  - **`selectionPrompt(listing, ask, pinned?)`** gained the optional pin argument, so the
+    pin sentence has ONE spelling rather than being assembled by each caller.
+  - **`scripts/run-reuse.mjs`** — the reference operator runner: `--job` / `--registry` /
+    `--budget` / `--wall` / `--tries` (+ `--pin` / `--force-cold`), approval gate on the
+    RESOLVED per-try hash, seed refusal (it never resets the patient for you), F67 outside
+    watchdog sized for the SUM of the tries, gate-audit relocation, secrets scan, and a
+    sleep-inhibitor note in the header (F72 — a suspend freezes every guard, including the
+    watchdog).
+  - **RESUME AFTER A KILL (module C).** A killed reuse run comes back losing as little as
+    possible — hamr's ruling: *"money, signature and checkpoint (starts from where it
+    stopped) if mid loop, restart that loop"*.
+    - **`readResume(events, {deathAt?})`** turns a dead run's OWN spine back into the
+      state a resume continues from: which tries completed (never re-run, bridges still
+      spoken for), whether a try was mid-flight (a `try-start` with no `try-end` — never
+      graded, so never consumed), what that attempt already spent in money and wall, and
+      which signed envelope the spine belongs to. Spend is summed from `worker-round`
+      ONLY — the same event `runJob`'s ledger accounts — so a selection call's cost is
+      never attributed to a worker (F45); a restarted try DECLARES its inherited fold on
+      its own `try-start`, so a resume of a resume folds once rather than double-billing
+      an abandoned attempt. A try whose `job-end` landed is COMPLETE, not restarted, and
+      a registry row lost to the kill is named (`r1Missing`), never re-derived.
+    - **The remainder, never a fresh allotment.** `runJob` gained `priorSpentUsd` /
+      `priorSpendComplete` / `priorWallMs` and `createClock` gained `priorElapsedMs`: the
+      killed attempt's spend and time FOLD IN, so the restart runs under what is left of the
+      SIGNED per-try numbers. The caps themselves are never rewritten — they are in the spec
+      hash, and editing them would need a signature nobody typed. An unfundable remainder caps
+      honestly (`cap-halt`, or `wall-halt` below one close timeout) having launched
+      nothing. **A floor stays a floor across the resume:** if any round inside the dead
+      attempt came back unpriced, `priorSpendComplete: false` rides one-way onto every
+      `job-end` this run emits, so a resumed attempt states a floor instead of an
+      exact-looking total (F6 — it was previously computed and recorded on `try-start` but
+      never reached the component whose terminal says so). The restart fold reads ALL four
+      of `runJob`'s floor causes: a landed resumable `job-end` carrying
+      `spendComplete: false` (a stall, or a call cut mid-flight) floors the fold exactly
+      like a declared prior floor or an unpriced round (F83's laundering finding, fixed;
+      the no-`job-end` killed-mid-flight restart is control-pinned unchanged).
+    - **`runReuse({… resume})`** seeds the completed tries, restarts the mid-flight one
+      against the SAME workflow with no second selection call, and carries on into
+      whatever the envelope still authorizes. It refuses (`resume-red`, ledger-excluded)
+      a seed signed under a different envelope, or a restart whose workflow has left the
+      registry. New spine event `resume-start`; `try-start` gains the declared fold.
+    - **`resumeTreeGate({head, seed, dirty})`** — a resumed patient is CONTINUED, never
+      reset: the dead tries' edits are real progress. Only HEAD moving off the seed (a
+      commit or rebase under the dead run — operator intervention) stops it.
+    - **`makeSpine(file, {startSeq})`** so a resumed process continues one append-only
+      log with `seq` still monotonic, and **`scripts/run-reuse.mjs --resume <runid|path>`**:
+      it refuses a spine that is missing, corrupt mid-file, already terminal, or whose
+      process is STILL ALIVE (pid from the run's new `runner-start` record and the
+      watchdog report, discriminated by `/proc/<pid>/cmdline` because pids are recycled),
+      prints both hashes on an envelope mismatch, previews the whole reconstruction
+      before you sign, archives the killed run's watchdog record so it cannot be read as
+      this run's, and sizes the watchdog for the REMAINING work.
+
+### Changed
+- **`capRuns` retires as the CLOSE-FIX loop's governor** (PRD v1.46 §4). That loop now ends on
+  the same 2-strike no-progress rule the step ladder uses, read off the close's own per-stage
+  numbers rather than repeats and writes. Validated by a $0 replay over every archived fix
+  loop before the build: 0 greens harmed (all three historical fix-loop greens converted in
+  ≤ 2 verdicts) and 1 real waste case caught (dead flat at 2 errors for 7 consecutive fix
+  verdicts until the wall killed it). `capRuns` survives ONLY as the bound for a close whose
+  output carries no number at all — a governor that cannot see the variable must not be the
+  governor — and lifts the moment a stage reports a comparable number. Money and the wall keep
+  every bit of their authority. The exhaustion terminal is unchanged in both category
+  (`cap-halt`) and outcome (`escalated`); `ralph`'s `ladder` option is now an INTERFACE two
+  governors implement, with an optional `terminal()` that overrides the exhaustion prose only
+  (the step ladder's copy offers a replan and there is no planner at the close). Every `ladder`
+  spine record now names its `governor` (`step-ladder` | `close-trend`). The wall-halt readout
+  no longer quotes `capRuns` as a denominator, because it no longer governs.
+- **A plan step is bounded by PROGRESS, not by a count** (`src/ladder.js`; F77–F79). The step
+  loop's fixed iteration cap is replaced by a strike ladder: a *strike* is a red iteration that
+  repeats an already-seen gap (matched against a seen-set for the whole step, never just the
+  last one) or made no gate-audit writes (the F32 record-count instrument — never `git status`,
+  never a tree diff); strikes are sticky and `strikeLimit` of them (new shell option on
+  `runJob`/`runPlan`, **default 2**) ends the step. Gaps are normalized for comparison only —
+  timing bytes dropped, counts and file names kept — so a shrinking error count reads as
+  progress. The wallet, the wall, the variance meter and the stall fuse keep every bit of their
+  authority; the exhaustion terminal is the same `cap-halt`. Measured motivation: two
+  calibrations died `step-red` while still converging with money and wall unspent; a $0 replay
+  over 110 archived step ladders showed every converging red continuing and thrash ending
+  same-or-one-earlier. **`capRuns` now bounds the CLOSE-FIX loop only.** New per-iteration spine
+  record `ladder`; exhaustion records carry `strikes`/`strikeLimit`/`distinctGaps`.
+- **The replan brief names the MECHANISM.** An exhausted step now tells the redrafting planner
+  which shape ended it (converging-cut / stalled-no-write / repeated-gap, with iteration numbers
+  as evidence), its gap trajectory, and how much money and wall the stop left unspent (time
+  reported UNBOUNDED when no wall was set, never `0`) — replacing *"it ran N attempts and its
+  exits were still red"*, which named no mechanism and read identically for opposite failures.
+- **Layer R's VERBATIM ratchet stage is retired on the STEP path** (hamr's ruling): fixation is
+  a repeat, so a fixated step strikes out before the fourth iteration can open. The stage stays
+  reachable in the close-fix loop and fully unit-covered; Layer R still ships OFF by default.
+
+### Deprecated
+- **`steps[].attempts` is retired and INERT.** It is no longer offered in the drafting prompt
+  and the runner ignores it. It is still ACCEPTED by `validatePlan` — stored bridge plans carry
+  it, and a plan minted under one runner's number must not red under another's — with the shape
+  still checked and the old `<= capRuns` ceiling dropped. It was TIGHTEN-only, which made the
+  correct heal for a converging step inexpressible. `validatePlan`'s `capRuns?` option is
+  removed with the ceiling it fed (it existed only to bound `attempts`; an extra property is
+  ignored, so no direct caller breaks).
+
+### Changed (the close-stage AXIS SPLIT — hamr: "#1 fix")
+- **One POPULATION per close stage, so unlike numbers can never share a trend series.** The
+  trend reads one bucket per stage NAME, and a stage name is not an axis: `typecheck` red
+  either `N error(s) in <scope>` (the in-scope faults) or `the target files are clean but M
+  strict error(s) exist outside them` — a different population, reached only once the first is
+  zero — and `suite-green` mixed a failure count with an executed-count floor. A run crossing
+  either seam donated two genres to one series, so a 29 → 4 across it read **converging** and
+  would have recommended a top-up on work that had only swapped which wall it was behind.
+  Every mixed stage in the six `u-*` closes is now split: **`typecheck-outside`** carries the
+  outside-scope population immediately after `typecheck`, and **`tests-kept`** carries the
+  executed-count floor immediately before `suite-green`. Each new stage sits exactly where its
+  branch already ran, so the gate sequence is byte-order identical to the old single-stage
+  walk and first-red-wins is unchanged; `litectx`/`spawner` `typecheck` was verified
+  single-population and left alone. `src/trend.js`'s KNOWN LIMIT is rewritten as the historical
+  record plus **the law for close authors** — the remedy for a mixed stage is that close's stage
+  list, never a detector taught to tell two prose shapes apart (the F49 precedent).
+  - **All six `u-*` spec hashes flip**, by construction: a close's stage names are in the
+    signed spec, so the runner refuses every one of them until it is re-signed. That is
+    refuse-until-re-signed working, not a migration to smooth over.
+  - **Stored bridges whose `closeStageNames` predate the change refuse to load** — the load
+    gate's close-stage check is the doctrine that a changed close is a different KIND of job.
+    `aurora-u-spawner` and `litectx-u` are in that state now and are re-minted by a green under
+    the new close, never edited into agreement.
+  - **The F28 trim announcement is restored** where the split surfaced its loss: the
+    outside-scope branch pre-sliced its own echo, silently suppressing the "trimmed" notice a
+    gap bound must announce (a 341-line elide is visible again).
+  - **New `tests/close-stages.test.js` (20 tests)**, including a can-it-fail pre-flight against
+    the pre-split tree, spec↔script stage-list agreement over spawned real closes, and the
+    29 → 4 repro reading as two stages with a same-stage contrast proving the test can fail.
+    Live `$0` validation: pulselog green across all four split stages, baremobile
+    `typecheck-outside` RED at 381 reading correctly as its own series. **1007 tests.**
+
+### Fixed (whole-branch review, 2026-08-05 — 4 opus finders over `main...layer-3-reuse`; F84)
+
+*Every confirmed finding fixed, each verified against source before it was believed; no fix
+forced, and three finder claims corrected in detail during the fixing.*
+
+- **CRITICAL — the close trend's BLIND CAP was a one-way latch.** `capRuns` survives as the
+  fallback for a close whose output carries no comparable number, and it was armed by
+  "has this leg ever compared anything" — which a bare STAGE ADVANCE satisfies, on
+  essentially every run that does any work at all. One advance therefore disarmed the
+  fallback **permanently**: a later run of numberless reds (the shipped aurora TESTGEN
+  `verdict` stage is exactly that shape) accrued neither a strike nor a blind tick and was
+  bounded by money and the wall alone, where the retired count would have stopped it.
+  Reproduced by execution before the change — 27 iterations, no terminal. The cap now bounds
+  the **consecutive uncomparable streak**: it lifts the moment the instrument can read and
+  **re-arms the moment it cannot**, binding a recovered run never and a blind-from-birth run
+  on exactly the iteration it always did (pinned byte-stable by test, at every cap). The
+  `report()` `blind` flag follows the same question — a live streak IS blindness, so the
+  terminal no longer offers "0/2 strikes" as the reason a loop it did not strike out was
+  stopped.
+- **`priorFloor` no longer requires money to have been spent.** `runJob` derived it as
+  `spentUsd > 0 && priorSpendComplete === false`, so a resumed leg inheriting a fold of **$0
+  that was not exact** — every round of the dead attempt unpriced — came back reading as an
+  exact zero. A floor OF zero is still a floor (F6). Read off the flag alone now, and the
+  onward `job-start` declaration is emitted for that case too (`spentUsd > 0 || priorFloor`),
+  which is the only field that can carry the unknown forward.
+- **A reuse RESUME's halt readout now spans the chain.** `restart.grades` was computed by
+  `readResume`, declared on the record, and then handed to nobody: only `scripts/run-u.mjs`
+  passed `resumeGrades` on. `runReuse`'s own per-try execution now threads it into `runJob`,
+  so a restarted leg's `money-halt`/`wall-halt` trend judges the RUN rather than restarting at
+  this leg's first close and reporting `flat` — *revise the goal* — on a run that was
+  converging when its allowance ran out. `resume-start`'s `restart` states
+  `gradesInherited` (a COUNT; the seam carries stage names and numbers, never a close byte),
+  and only when there is one — the cold path is unchanged.
+- **The `money-halt` record carries `spendComplete`.** `remainingUsd` is `budget − spent`, so
+  a run whose spend is a FLOOR has a remaining that is a CEILING; quoting it to four decimals
+  read as the number. `runPlan` takes the ledger's own `spendComplete` (one spelling of the
+  four causes, never a second arithmetic) and states it beside the figure — the same duty
+  `wall-halt` has carried since W-2.
+- **A try row's ROUNDS fold across a resume, like its money and its wall.** A restarted try
+  reported only the restart's turns against a span its `$` already covered both legs of.
+  `try-start` declares `priorRounds` (including when it is `null`: absence means a spine older
+  than the field, an explicit null is a predecessor that could not count its own turns — and
+  an unfoldable count stays `null` rather than becoming the half this leg can see, F6). The
+  inherited-graded row's `wallMs` is likewise measured to the try's **own terminal** now, not
+  to a kill that may have landed minutes later.
+- **The replan brief no longer calls an IDLE strike-out "converging".** The sentence was gated
+  on repeats alone, so a step that wrote nothing in any iteration was handed *"no file was
+  written in iteration(s) 1, 2"* and *"the step was converging"* in the same paragraph — to
+  the one channel the redrafting planner adapts to. Both signals gate it now; a moving exit
+  output on a step that wrote nothing is a close re-running, not work converging.
+- **`planPrompt`'s JSDoc was detached from `planPrompt`.** An intervening helper landed between
+  the block and the function, so every parameter shipped as `any` in the generated `.d.ts`.
+  Reattached; no behaviour change, and the types are the contract.
+- **W-2 on the LAUNCH side: a zero wall remainder now REFUSES, loudly.** `--wall-ms 0` reached
+  `scripts/u-watchdog.mjs`, which defaulted a non-positive value to `null` and armed **no
+  deadline at all** while the runner's own banner still advertised one — a guard reading zero
+  and saying nothing. The watchdog now refuses any PRESENT-but-unreadable numeric flag
+  (`0`, negative, garbage) with exit 2, while an OMITTED `--wall-ms` stays the legal unbounded
+  choice with the stale trigger armed. Both runners refuse above the spawn, before the key and
+  before the patient: `scripts/run-u.mjs` on an exhausted resume remainder, `scripts/run-reuse.mjs`
+  on `plannedWallMs <= 0`. **Two zeros, two levers** — a restart whose wall is burned wants
+  `--wall` (NO WALL LEFT), a run whose authorized attempts have all run wants `--tries` or
+  nothing (NOTHING TO ARM) — because naming the wrong lever sends the operator to re-sign a
+  number that buys no attempt. Both are in the approval hash, so either is a new signature.
+- **`scripts/run-reuse.mjs` hardening.** A corrupt/truncated watchdog report can no longer abort
+  a signed resume at the last gate (it is parsed once, defensively, and reused; the archive
+  suffix falls back to the ARCHIVE moment so a second unreadable report cannot overwrite the
+  first). `runner-start`'s `argv` is redacted **at the write site** with the shipped
+  `redactSecrets` inventory — an append-only log that captures a key captures it forever, so an
+  after-the-fact whole-file scan is too late. A trailing value-flag (`--tries` with nothing
+  after it) now refuses instead of reading `Number('') === 0` and silently reshaping the run
+  being signed. The header's deliberate-differences list gains the fourth: the end-of-run leak
+  scan is a READOUT here, not a gate, because `runReuse` writes registry rows mid-run.
+- **Archived runners annotated** (`reuse-preprobe`, `run-calibration-testgen`, `run-poc-layer2`,
+  `run-probe-testgen`): their `CAP_RUNS` comments described the retired drafting-prompt
+  interpolation, not the close-fix loop's blind fallback it actually is now.
+
+- **Tests: 987 total** (from 959). The mutation-proven hole: a widening of `REUSE_GRADED_RED` — the
+  set whose members DEMOTE a proven bridge — survived the entire suite, so the demotion table
+  is now pinned outcome by outcome (`escalated` demotes; `step-red`/`cap-halt`/`wall-halt`/
+  `provider-red`/`close-red`/`step-stalled`/`pricing-red` are casualties and proven stays
+  proven). Plus the blind-cap backstop battery (blind-from-birth pin, streak-not-birth,
+  never-fires-while-reading, recovery resets), the launch-side refusals at all three sites,
+  the resume grade/round folds with their absent-baseline controls, the money-halt floor
+  readout, and a first battery for `scripts/migrate-bridge-patient-slugs.mjs` (dry-run
+  byte-identity, whole-file refusal over half-migration, name/filename disagreement — 4
+  mutants killed).
+
 ## [0.6.0] — 2026-07-31
 
 ### Added