bareloop 0.6.0 → 0.8.0

package/src/clock.js

@@ -68,6 +68,14 @@ export const MIN_CALL_TIMEOUT_MS = 30_000;
  * it as transport. */
 export const TIMEOUT_CODE = 'ETIMEDOUT';
 
+/** bare-agent's rejection code when its TOTAL-duration deadline trips (BA-19,
+ * `provider-http.js` → `applyRequestDeadline`). A DIFFERENT code from the idle
+ * bound's on purpose — upstream splits them precisely so a consumer routing
+ * governance stops apart from transport casualties can tell which timer fired. Like
+ * `TIMEOUT_CODE` it carries no `category`, so every default-to-transport catch site
+ * would file it as a casualty. */
+export const DEADLINE_CODE = 'EDEADLINE';
+
 /**
  * F64 — is this throw the run's OWN deadline coming back dressed as a provider
  * error? `callTimeoutMs()` hands the provider a bound derived from the wall, so
@@ -90,12 +98,20 @@ export const TIMEOUT_CODE = 'ETIMEDOUT';
  * the same (raise `maxWallMs`), and the alternative — calling a governance stop
  * transport on the chance that it was — is the failure this closes.
  *
+ * BOTH derived bounds land here, because both are derived from the same wall:
+ * BA-18's idle timeout (`callTimeoutMs`) and BA-19's total-duration deadline
+ * (`callDeadlineMs`). Adding the second CODE does not widen the rule — the
+ * discriminator is still `clock.expired()`, never the code. That matters for the
+ * deadline specifically: a provider someone else constructed with its own
+ * `deadlineMs` could throw this code on a run with time left, and that is transport,
+ * exactly as it was before.
+ *
  * @param {any} err the throw as caught
  * @param {Clock} clock the run's clock
  * @returns {boolean}
  */
 export function isWallTimeout(err, clock) {
-  return !!err && err.code === TIMEOUT_CODE && clock.expired();
+  return !!err && (err.code === TIMEOUT_CODE || err.code === DEADLINE_CODE) && clock.expired();
 }
 
 /**
@@ -108,21 +124,37 @@ export function isWallTimeout(err, clock) {
  * @property {() => boolean} expired whether the deadline has passed (always false when unbounded)
  * @property {(closeTimeoutMs: number) => number|null} enforcedMs the HONEST worst case
  * @property {(providerDefaultMs?: number) => number} callTimeoutMs the derived per-call bound
+ * @property {() => number|null} callDeadlineMs the derived per-call TOTAL-duration ceiling; `null` when unbounded
  * @property {(closeTimeoutMs: number) => object} report one spine-safe shape carrying both numbers
  */
 
 /**
  * Start a wall clock for one run.
- * @param {{ maxWallMs?: number|null, closeStages?: number, now?: () => number }} [opts]
+ * @param {{ maxWallMs?: number|null, closeStages?: number, now?: () => number, priorElapsedMs?: number }} [opts]
  *   `maxWallMs`: the signed operator cap, or absent/null for an honestly unbounded
  *   run. `closeStages`: how many stages the job's close runs (W5) — each one gets
  *   the FULL `closeTimeoutMs`, so this is the multiplier on the overshoot, not a
  *   decoration. Defaults to 1, the single-predicate close. `now`: injected for
- *   tests — the default is the real clock.
+ *   tests — the default is the real clock. `priorElapsedMs`: time this attempt's
+ *   PREDECESSOR already consumed (see below).
  * @returns {Clock}
  */
-export function createClock({ maxWallMs = null, closeStages = 1, now = () => Date.now() } = {}) {
-  const startedAt = now();
+export function createClock({ maxWallMs = null, closeStages = 1, now = () => Date.now(), priorElapsedMs = 0 } = {}) {
+  // RESUME (module C) — hamr's checkpoint ruling in a time coat: a run killed
+  // mid-try restarts THAT try under the REMAINDER of its signed per-try numbers,
+  // because "a budget ceiling folds in prior spend so re-invoking cannot silently
+  // widen it". The fold happens HERE rather than by editing `maxWallMs`, and that
+  // is the whole point: the cap the operator signed stays the number reported and
+  // the number hashed (a rewritten cap is a new spec version needing a new
+  // signature), while the clock simply starts already partly spent. A fresh
+  // allotment on every kill would let a resumed run outlive the worst case the
+  // operator signed, one kill at a time.
+  //
+  // Belted like `maxWallMs` above: a non-finite, negative or garbage fold is 0. A
+  // NaN here would make every comparison false and silently unbound the run, which
+  // is the inverse of what the fold exists to do.
+  const prior = typeof priorElapsedMs === 'number' && Number.isFinite(priorElapsedMs) && priorElapsedMs > 0 ? priorElapsedMs : 0;
+  const startedAt = now() - prior;
   // A cap is only a cap if it is a usable positive number. validateJob already
   // reds anything else, so this is the belt (a caller that hand-builds a spec
   // must not be able to turn a garbage value into a silent unbounded run OR a
@@ -162,6 +194,26 @@ export function createClock({ maxWallMs = null, closeStages = 1, now = () => Dat
       // would restore the ~2h OS-TCP hang on the last round of a tight budget.
       return Math.min(providerDefaultMs, Math.max(MIN_CALL_TIMEOUT_MS, remainingMs()));
     },
+    // BA-19 (F72 park D) — the TOTAL-duration ceiling beside the idle one. The idle
+    // bound resets on every byte, so a response that trickles forever never trips it
+    // (F66's 274-minute call, and F67's 81.5-minute freeze happened above it); this
+    // one is a plain timer that no byte resets.
+    //
+    // Three properties, each a rule this repo already paid for:
+    //   - NULL when unbounded. An operator who set no wall gets no ceiling — a
+    //     defaulted cap is a silent second ceiling (F45, and the reason `maxWallMs`
+    //     has no default). The caller must OMIT the knob on null, not pass a number.
+    //   - REMAINING, read at call time. A constant would bound the last call by the
+    //     first call's budget, which is the thing `callTimeoutMs` already refuses.
+    //   - NOT clamped to the provider default. That upper clamp exists on the idle
+    //     bound because a value above the provider's own default is inert; a
+    //     total-duration ceiling above it is the entire point of BA-19.
+    // The lower floor is shared with `callTimeoutMs` and for the same two reasons: a
+    // bound certain to trip manufactures a stop out of arithmetic, and `0` DISABLES
+    // the bound upstream (`if (!(deadlineMs > 0)) return`) — the exact inverse of the
+    // intent. A trip past the floor is still honest: the wall has expired by then, so
+    // `isWallTimeout` reads it as the governance stop it is.
+    callDeadlineMs: () => (cap === null ? null : Math.max(MIN_CALL_TIMEOUT_MS, remainingMs())),
     report: (closeTimeoutMs) => ({
       bounded,
       requestedMs: cap,

package/src/exits.js

@@ -33,8 +33,14 @@ import { globToPrefix } from './validate.js';
  * `not ok`/`FAILED` names — the mechanical gap the F46 conversion mechanism
  * feeds the worker (F28 reintroduced). This cap is a defensive backstop above
  * boundGap's own envelope: a normal bounded gap passes through intact, and only
- * a pathological seam that returned an unbounded gap would ever be trimmed. */
-const CHECK_GAP_MAX = 12000;
+ * a pathological seam that returned an unbounded gap would ever be trimmed.
+ *
+ * Exported for the ONE reason `boundGap`/`GAP_KEEP_TRIM_MARKER` are (src/ralph.js):
+ * the replan brief re-bounds this same artifact one seam later (`closeGapBlock`), and
+ * a second hand-spelled ceiling there would be a second answer to "how big may a
+ * check gap be" — the two would drift on exactly the property that matters, whether
+ * the `not ok`/`FAILED` names survive. */
+export const CHECK_GAP_MAX = 12000;
 
 /** @typedef {{ type: string, pass: boolean, detail?: string, fault?: string }} ExitResult
  * `fault` present means the INSTRUMENT could not judge (unwired snapshot/seam,

package/src/index.js

@@ -32,4 +32,33 @@ export { validatePlan, stageClose, EXIT_TYPES, MAX_EXITS_PER_STEP, MAX_PLAN_STEP
 export { snapshotScope, evalExits } from './exits.js';
 export { runPlan } from './planrun.js';
 export { runJob } from './run.js';
+// Layer 3 — the REUSE registry (bridge-v1) and D3's display half. The registry is a
+// directory of plain files at an OPERATOR-supplied path (never a default location), the
+// load gate is the code half of D2's split, and `renderListing`/`selectionPrompt` are
+// pure text: they send nothing, parse nothing and decide nothing. The selection CALL and
+// the pin/shortlist/force-cold flow are the adopter's, which is why the pieces they need
+// are exported rather than kept internal to the runner.
+export {
+  BRIDGE_SCHEMA, validateBridge, deriveStatus, listingRow, loadGate,
+  mintBridge, appendGreen, appendRed,
+  loadBridge, loadRegistry, saveBridge, makeRegistry, registryExists,
+} from './bridges.js';
+export { renderListing, selectionPrompt } from './selection.js';
+// Layer 3 modules 4+5 — the D7 envelope and the reuse runner. `runReuse` composes
+// `runJob` under an operator-signed envelope (three explicit numbers, tighten-only) and
+// is the only thing in the library that WRITES the registry — minting is a graded
+// green's privilege (R1), never a caller's. `validateEnvelope`/`resolveTrySpec` are
+// exported because an operator runner has to show the resolved per-try spec's HASH at
+// its approval gate: a tightened envelope is a new spec version, and the human signs it.
+// `resolveReuse`/`reuseSpecHash` are the pair that gate must actually PRINT: the try
+// count multiplies the worst case, so a signature over the per-try spec alone leaves it
+// unsigned — a runner showing `jobSpecHash(resolveTrySpec(...))` prints the same hash for
+// 0 tries and for 9.
+// Module C (resume after a kill) exports its two operator-side halves for the same
+// reason: `readResume` is what turns a dead run's spine back into the state a resume
+// continues from (which tries completed, which one restarts, on what remainder), and
+// `resumeTreeGate` is the ruling that a resumed patient is continued dirty and never
+// reset. Both are read by a runner BEFORE the approval gate, so neither can live behind
+// `runReuse`'s own entry.
+export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate } from './reuse.js';
 export { classifyIncidents, foldLedger, ledgerDeltas, updateLedger, LEDGER_CLASSES } from './ledger.js';

package/src/job.js

@@ -14,7 +14,7 @@
 // judgment call. Minting policy is product doctrine, not job-authorable.
 
 import { createHash } from 'node:crypto';
-import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals } from './validate.js';
+import { globToPrefix, scopeContained, isObj, isNonEmptyString, sweepSecretLiterals, hasNestedQuantifier } from './validate.js';
 
 // The menus below ARE the close-authoring hierarchy (PRD §7) and ship frozen:
 // they are read at call time, so a mutable export would let adopter code
@@ -123,7 +123,12 @@ const CLOSE_FIELDS = {
 };
 const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
 
-/** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red — `verb` rides request-reds as structured data (the ledger keys on it, never on prose) */
+/** @typedef {{code: string, path: string, detail?: string, verb?: string, lib?: string}} Red — `verb` and `lib` ride request-reds as structured data (the ledger keys on them, never on prose).
+ * `lib` is the TERRITORY the demand lands against, stamped HERE at the emit site
+ * (the typed-lib rule): one code, two catalogues — a locked TOOL verb is demand
+ * against the worker-surface package, a locked VERDICT type is demand against
+ * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
+ * filed as an upstream bug (the BA-2 misattribution class). */
 
 /**
  * Validate an operator-owned job spec (`schema: "job-v1"`). Never throws on
@@ -278,6 +283,21 @@ function validateClose(close, at, red) {
   return true;
 }
 
+/**
+ * The F49 reject's OPERATOR-side detail. ONE spelling for both regex fields —
+ * they differ only in which untimed evaluator the pattern reaches — so the two
+ * reds can never drift into saying different things about the same hazard.
+ *
+ * The second sentence is the part an operator cannot derive: on the agent side
+ * F49 is self-DoS, but these two patterns are compiled and run in BARELOOP'S OWN
+ * PROCESS, where the hang blocks the event loop the in-process stall fuse lives
+ * on (F67 — a guard sharing the fate of the process it guards). The run then
+ * dies to the outside watchdog and reads as a model stall, so without this red a
+ * bad regex in a SIGNED spec is diagnosed as a provider problem.
+ * @param {string} evaluator the consumer that would run it, named concretely
+ */
+const redosDetail = (evaluator) => `nested unbounded quantifier (e.g. (a+)+ , (\\d*)* , (x+){1,}) — a catastrophic-backtracking footgun that can hang ${evaluator}, untimed (F49). It runs in bareloop's own process, so the hang blocks the event loop the stall fuse lives on (F67) and the run dies to the outside watchdog looking like a model stall; rewrite without a repeated group inside a repeat`;
+
 /**
  * The predicate BODY contract — cmd/expect/judged/gapKeep. Shared verbatim by
  * the predicate close and the Layer 2 named checks (decision 1: a check runs
@@ -330,6 +350,13 @@ function predicateBody(o, at, red) {
         // the fake green this floor exists to catch). Alternation stays
         // fully expressible with non-capturing branches: `(?:a|b) (\d+)`.
         else if (groups > 1) red('invalid-value', `${at}.judged.pattern`, `${groups} capture groups — the count is read from group 1 only; use exactly one capture group and non-capturing (?:…) branches`);
+        // F49, operator side: `runClose` execs this against the close's whole
+        // stdout+stderr with no timeout. Gated on `groups >= 0` — that is the
+        // COMPILED flag in disguise (the catch sets -1), and the scan documents
+        // that it assumes syntactically valid input.
+        if (groups >= 0 && hasNestedQuantifier(j.pattern)) {
+          red('invalid-value', `${at}.judged.pattern`, redosDetail('the close reader (runClose)'));
+        }
       }
       if (!Number.isInteger(j.min) || j.min < 1) {
         red('invalid-value', `${at}.judged.min`, 'integer >= 1 — a floor of 0 is satisfied by judging nothing, which is the check it is meant to make');
@@ -348,8 +375,15 @@ function predicateBody(o, at, red) {
   if (o.gapKeep !== undefined) {
     if (!isNonEmptyString(o.gapKeep)) red('invalid-value', `${at}.gapKeep`, 'regex source string — lines matching it survive the gap bound (F28)');
     else {
-      try { new RegExp(o.gapKeep, 'm'); }
+      let compiled = false;
+      try { new RegExp(o.gapKeep, 'm'); compiled = true; }
       catch { red('invalid-value', `${at}.gapKeep`, 'must compile as a RegExp'); }
+      // F49, operator side and the measured one: `boundGap` runs this per LINE
+      // over the whole close stream, untimed. Measured: `(a+)+$` against a
+      // 40-char line does not finish in 20s.
+      if (compiled && hasNestedQuantifier(o.gapKeep)) {
+        red('invalid-value', `${at}.gapKeep`, redosDetail('the gap bound (boundGap), once per line of close output'));
+      }
     }
   }
 }
@@ -486,8 +520,9 @@ function validatePlanShape(spec, red, reds) {
   else if (LOCKED_VERDICTS.includes(spec.verdictType)) {
     // declared-but-locked (disclosure ≠ admission, the tool-menu pattern):
     // the type rides as a structured field — the ledger keys admission demand
-    // on it, never on prose
-    reds.push({ code: 'request-red', path: 'verdictType', verb: spec.verdictType, detail: `"${spec.verdictType}" is declared-but-locked — not at this rung (v1 admits green only); this red IS the admission evidence, never a grant` });
+    // on it, never on prose. `lib: 'bareloop'`: the refused catalogue is OURS
+    // (VERDICT_TYPES), so this demand is never an upstream ask.
+    reds.push({ code: 'request-red', path: 'verdictType', verb: spec.verdictType, lib: 'bareloop', detail: `"${spec.verdictType}" is declared-but-locked — not at this rung (v1 admits green only); this red IS the admission evidence, never a grant` });
     demanded = CLASS_BY_VERDICT[spec.verdictType];
   } else if (!VERDICT_TYPES.includes(spec.verdictType)) {
     red('invalid-value', 'verdictType', `menu: ${VERDICT_TYPES.join('|')} — an unknown type is a typo, never a request`);
@@ -529,7 +564,9 @@ function validatePlanShape(spec, red, reds) {
       red('invalid-value', 'tools', `non-empty unique subset of ${TOOL_MENU.join('|')}`);
     } else {
       for (const t of spec.tools.filter((/** @type {string} */ t) => LOCKED_TOOLS.includes(t))) {
-        reds.push({ code: 'request-red', path: 'tools', verb: t, detail: `"${t}" is locked-but-listed — this red IS the admission evidence, never a grant; granted menu: ${TOOL_MENU.join('|')}` });
+        // `lib: 'bare-agent'`: a locked TOOL verb is demand against the
+        // worker-surface package that would have to expose it (the original case)
+        reds.push({ code: 'request-red', path: 'tools', verb: t, lib: 'bare-agent', detail: `"${t}" is locked-but-listed — this red IS the admission evidence, never a grant; granted menu: ${TOOL_MENU.join('|')}` });
       }
       const unknown = spec.tools.filter((/** @type {string} */ t) => !TOOL_MENU.includes(t) && !LOCKED_TOOLS.includes(t));
       if (unknown.length) red('invalid-value', 'tools', `unknown tool(s) ${unknown.join(', ')} — menu: ${TOOL_MENU.join('|')}`);

package/src/ladder.js

@@ -0,0 +1,196 @@
+// The step ladder's governor — PROGRESS, not a count (design 2026-08-03).
+//
+// MEASURED reason this exists. The step loop was bounded by a fixed number of
+// check-iterations (`capRuns`, 4 in the operator's runner). Two real spines show
+// what that cost: u-msd916dh went 30 → 22 → 17 → 11 scope errors across its
+// iterations and was cut with $1.30 and ~6 minutes still unspent; u-mscxuziw went
+// 13 → 1 and was cut the same way. The count could not tell converging work from
+// thrash, so it stopped both at the same place. And the one lever the plan could
+// pull — a step's `attempts` field — could only ever TIGHTEN below the shell's
+// number, so the correct heal was inexpressible: drafters measurably tightened to
+// 3, then to 2 on replan.
+//
+// The replacement asks the question the count could not: **is this iteration
+// making progress?** Two signals, read per RED iteration:
+//
+//   gap-new  the failing exits' text, normalized and hashed, against every gap
+//            hash seen so far in this step's ladder. A SEEN-SET, never last-only:
+//            a real A→B→A oscillator exists in the archive and last-only reads it
+//            as progress.
+//   wrote    did the worker make real write-class actions THIS iteration — read
+//            from the gate audit's own record COUNT (the F32 instrument:
+//            run-scoped, allow-decision, write AND edit). Never git status, never
+//            a tree diff. It must be a COUNT and not the path SET, because a plan
+//            step rewrites its one target every attempt — the set is constant
+//            after iteration 1 and would read every later iteration as idle (the
+//            same Finding-3 trap Layer R documents one module over).
+//
+// A **strike** is a red iteration that is a repeat OR wrote nothing. Strikes are
+// STICKY — never reset, never repaid by a good iteration in between — because the
+// question the ceiling answers is "has this step spent enough of the run failing
+// to make progress", and a counter that a single good iteration zeroes can be held
+// open forever by alternating.
+//
+// What still bounds a converging step, so this cannot run away: the wallet (the
+// worker's Gate carries the run's remaining budget), the run's wall clock (W-2, at
+// the head of every attempt), the variance meter (A), and the stall fuse. Those
+// are unchanged and each still ends the ladder on its own authority. This module
+// replaces exactly ONE of the old bounds: exhaustion-by-count.
+
+import { createHash } from 'node:crypto';
+
+/**
+ * The strike ceiling. Shell-owned, exactly where the fixed count was: the runner
+ * sets it, the agent cannot express it, and it is arbiter territory — a step's own
+ * plan may not tighten it and may not raise it. Two is hamr's number.
+ */
+export const STRIKE_LIMIT = 2;
+
+/**
+ * The volatile bytes, stripped before hashing. COMPARISON-ONLY: the gap the worker
+ * sees is never rewritten (the `normalizeRedLine` rule, one module over).
+ *
+ * Every entry is a byte a re-run changes while the failure does not. Without them
+ * a `node --test` gap is never byte-stable (its duration stamps move every run),
+ * so every repeat would read as a novel gap and the repeat signal would be dead —
+ * an instrument that cannot see the variable.
+ * @type {[RegExp, string][]}
+ */
+const VOLATILE = [
+  // TAP's own timing line, dropped WHOLE: its value is the only thing on it
+  [/^[ \t]*#?[ \t]*duration_ms[ \t]*[:=].*$/gm, ''],
+  // ISO-8601 stamps, wherever they appear in a close's output
+  [/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?/g, '<ts>'],
+  // any millisecond figure (`(1.738ms)`, `took 12 ms`)
+  [/\d+(?:\.\d+)?[ \t]*ms\b/g, '<ms>'],
+];
+
+/**
+ * Normalize a gap for comparison. Deliberately NARROW: only bytes a re-run changes
+ * on its own are removed. Error COUNTS, file names and line numbers all survive —
+ * a trajectory like "30 errors" → "22 errors" must read as two different gaps, and
+ * a normalizer that scrubbed numbers would turn the converging case this module
+ * exists to protect into an instant strike.
+ * @param {string} text @returns {string}
+ */
+export function normalizeGap(text) {
+  let s = String(text ?? '');
+  for (const [re, to] of VOLATILE) s = s.replace(re, to);
+  // runs of spaces/tabs collapse (a re-run can re-pad a column); newlines do NOT —
+  // line structure is real content
+  return s.replace(/[ \t]+/g, ' ').replace(/[ \t]+$/gm, '').trim();
+}
+
+/**
+ * The comparable key for a gap: the normalized text, hashed. Hashed rather than
+ * kept whole because the seen-set lives for the whole step and a close's output
+ * can be tens of KB — and because the set holds no content, nothing here can leak
+ * model or file bytes into a record.
+ * @param {string} text @returns {string}
+ */
+export function gapKey(text) {
+  return createHash('sha256').update(normalizeGap(text), 'utf8').digest('hex');
+}
+
+/**
+ * Build one ladder. ONE PER STEP: the seen-set and the strike count are the step's
+ * own history, and a ladder shared across steps would strike a fresh step for a gap
+ * an earlier one had already seen.
+ *
+ * @param {object} opts
+ * @param {number} [opts.limit] strikes that end the step (default `STRIKE_LIMIT`)
+ * @param {() => number} opts.writeCount the CUMULATIVE count of the worker's
+ *   allow-decision write/edit records so far this step (planrun reads it off the
+ *   gate audit). Required, and a throw when it is missing rather than a silent
+ *   degradation to repeats-only: a strike rule running on one of its two signals
+ *   with nothing on the record saying so is the blind-instrument class, and this
+ *   is the BA-4 param-guard class where a throw is the right answer.
+ */
+export function createLadder({ limit = STRIKE_LIMIT, writeCount }) {
+  if (typeof writeCount !== 'function') {
+    throw new TypeError('createLadder requires a writeCount seam — a strike rule with one signal wired is prose, not a bound');
+  }
+  /** @type {Map<string, number>} gap key → the iteration it was FIRST seen at */
+  const firstSeen = new Map();
+  /** @type {{at: number, firstAt: number}[]} */
+  const repeats = [];
+  /** @type {number[]} iterations in which the worker wrote nothing */
+  const idle = [];
+  let strikes = 0;
+  let iterations = 0;
+  let priorWrites = 0;
+
+  return {
+    /**
+     * Read one RED iteration. Called by ralph after the judge has rendered a
+     * non-green, non-fault verdict — a green never reaches here, so every reading
+     * is a failing iteration by construction.
+     * @param {{iteration: number, gap?: string}} o
+     * @returns {{governor: string, iteration: number, strike: boolean, strikes: number,
+     *   limit: number, wrote: boolean, repeatOf: number|null, distinctGaps: number}}
+     */
+    record({ iteration, gap }) {
+      iterations = iteration;
+      const key = gapKey(gap ?? '');
+      const firstAt = firstSeen.get(key);
+      const repeated = firstAt !== undefined;
+      if (repeated) repeats.push({ at: iteration, firstAt: /** @type {number} */ (firstAt) });
+      else firstSeen.set(key, iteration);
+
+      // the DELTA, not the total: the audit is append-only across the whole step
+      const total = writeCount();
+      const wrote = total > priorWrites;
+      priorWrites = total;
+      if (!wrote) idle.push(iteration);
+
+      const strike = repeated || !wrote;
+      if (strike) strikes += 1; // sticky: nothing anywhere decrements this
+      return {
+        // WHICH governor produced this reading. Two of them emit under the one
+        // `ladder` spine type now (this one, and the close-fix loop's per-stage trend
+        // reader), and their fields differ — a reader that cannot tell them apart
+        // would average two different instruments into one number.
+        governor: 'step-ladder',
+        iteration, strike, strikes, limit, wrote,
+        repeatOf: repeated ? /** @type {number} */ (firstAt) : null,
+        distinctGaps: firstSeen.size,
+      };
+    },
+    /** has the step run out of strikes? */
+    struckOut: () => strikes >= limit,
+    /** the ladder's own books — counts and iteration numbers, never gap content */
+    report: () => ({
+      iterations, strikes, limit, distinctGaps: firstSeen.size,
+      repeats: repeats.map((r) => ({ ...r })),
+      idle: [...idle],
+    }),
+    /**
+     * The mechanism, in one sentence, for the replan brief. It is the only channel
+     * the redrafting planner adapts to, so it states WHICH shape ended the step and
+     * the evidence for it — never a label on its own, and never a culprit file
+     * beyond what the close itself reported (F28): the inputs here are iteration
+     * numbers and counts, so naming one is inexpressible.
+     * @returns {string}
+     */
+    brief() {
+      const parts = [];
+      if (repeats.length) {
+        const last = repeats[repeats.length - 1];
+        parts.push(`it repeated itself — the exit output at iteration ${last.at} had already been seen at iteration ${last.firstAt}`);
+      }
+      if (idle.length) parts.push(`it stalled — no file was written in iteration(s) ${idle.join(', ')}`);
+      const trajectory = `${firstSeen.size} distinct exit output(s) over ${iterations} iteration(s)`;
+      // BOTH signals gate it, because "converging" is a claim about the WORK and a
+      // moving exit output is only half the evidence for one. Gated on repeats alone
+      // it fired on an idle strike-out — "no file was written in iteration(s) 1, 2"
+      // and "the step was converging" in the same paragraph, handed to the one
+      // channel the redrafting planner adapts to. A step that wrote nothing was not
+      // converging whatever its exit bytes did (a close re-run moves its own).
+      const converging = repeats.length === 0 && idle.length === 0
+        ? ' Every attempt moved the exit output, so the step was converging when it struck out.'
+        : '';
+      return `The step ladder ended it on ${strikes} strike(s) of ${limit}: ${parts.join('; ')}. `
+        + `Gap trajectory: ${trajectory}.${converging}`;
+    },
+  };
+}

package/src/ledger.js

@@ -79,6 +79,33 @@ const EXCLUDED_ESCALATIONS = new Set([
   'smoke-red',          // already counted via primitive-smoke
   'hitl-close',         // by design: a human is the close
   'close-unsupported',  // honest refusal, by design
+  // Layer 3 (D2 split): the bridge load gate refused a wrong-KIND recipe at the door.
+  // That is the mechanism WORKING — every recipe from a different day is a candidate for
+  // refusal, and the run stopped having spent nothing. Filing it upstream would aim a bug
+  // report at a library for our own gate doing its job (the step-stalled lesson).
+  'recipe-stale',
+  // Layer 3 (D7/D3) — the reuse runner's own three stops. Each is the ENVELOPE or the
+  // OPERATOR speaking, never a library failing: `reuse-exhausted` is the pre-authorized
+  // number of tries being spent (the money/time story, exactly like cap-halt);
+  // `selection-refused` is the model declining a pinned workflow, which D3 requires it to
+  // be able to do; `selection-red` is a model answer that was not the one JSON object it
+  // was asked for — a behaviour, not a transport fault (a real transport fault out of the
+  // selection call is classified as `provider-red` and is NOT excluded).
+  'reuse-exhausted',
+  'selection-refused',
+  'selection-red',
+  // Layer 3 (module C) — a RESUME that refuses to continue: the seed was signed under a
+  // different envelope, or the workflow the killed run was part-way through is no longer
+  // in the registry. Both are the operator's own state speaking (a stale signature, an
+  // edited registry), and both stop having run nothing.
+  'resume-red',
+  'registry-red',       // the operator-supplied registry path does not exist — a typo, not a bug
+  'envelope-red',       // the envelope does not compose with the signed spec — operator input
+  // the reuse runner also STOPS on the three answers no further try could change, and
+  // escalates each under its own name. Both are operator-input stories: an unsigned spec
+  // version and a spec that will not validate. (`smoke-red` is already excluded above.)
+  'unapproved-spec',
+  'job-red',
   'close-timeout',      // close-verdict reds: the arbiter's own named terminals
   'close-killed',       // (F17) — operator/environment stories, never a suite lib
   'close-crashed',
@@ -90,9 +117,15 @@ const ASKS = /** @type {Record<string, (o: {lib: string, verb: string, detail: s
   'runtime-red': (o) => `${o.lib}: \`${o.verb}\` threw at runtime — ${o.detail}`,
   'provider-red': (o) => `bare-agent: the provider path failed — ${o.detail}`,
   'pricing-red': (o) => `bare-agent: a provider result carried no priced cost (unpriced is never free, F6) — ${o.detail}`,
-  'capability-gap': (o) => `bare-agent: locked \`${o.verb}\` was requested and the run cap-halted — admission candidate`,
+  // same rule as request-red below (capability-gap is its cap-halted form): the
+  // ask is seeded at the STAMPED target, so a bareloop-catalogue refusal cannot
+  // render as "bare-agent: …" — fixing the occurrence's lib alone would leave the
+  // misattribution intact in the one field a human actually files from
+  'capability-gap': (o) => `${o.lib}: locked \`${o.verb}\` was requested and the run cap-halted — admission candidate`,
   'broken-close': (o) => `job owner: the close itself cannot run — ${o.detail}`,
-  'request-red': (o) => `admission: locked \`${o.verb}\` requested by a job spec — demand evidence, never a grant`,
+  // the target is the STAMPED lib, never a hardcoded package: a bareloop-catalogue
+  // refusal (a locked verdict type) must not seed an ask that reads "bare-agent: …"
+  'request-red': (o) => `${o.lib}: admission — locked \`${o.verb}\` requested by a job spec — demand evidence, never a grant`,
   'retention-red': (o) => `litectx: on-green retention failed — ${o.detail}`,
   'config-red': (o) => `bareloop: drafting friction at ${o.verb} — ${o.detail}`,
 });
@@ -133,9 +166,20 @@ export function classifyIncidents(events, { spine = 'spine' } = {}) {
       // a repeated signature indicts the drafting prompt/schema, i.e. bareloop
       add(ev, 'config-red', 'bareloop', String(ev.path ?? 'config').split('.')[0] || 'config', `${ev.code} at ${ev.path}: ${ev.detail ?? ''}`);
     } else if (ev.type === 'job-red' && ev.code === 'request-red') {
-      // the structured field wins; the prose-quoted verb stays as the fallback
-      // for spines written before the field existed
-      add(ev, 'request-red', 'bare-agent', ev.verb ?? (String(ev.detail ?? '').match(QUOTED_VERB_RE) ?? [])[1] ?? 'unknown', ev.detail);
+      // the structured fields win; the prose-quoted verb stays as the fallback
+      // for spines written before the field existed, and the hardcoded
+      // 'bare-agent' lib stays as the fallback for the same reason — it was the
+      // only territory `request-red` had when the field did not exist.
+      //
+      // One code, TWO territories: a locked TOOL verb is demand against the
+      // worker-surface package; a locked VERDICT type (and, when D13 lands, a
+      // genre refusal) is demand against bareloop's OWN catalogue and must never
+      // seed an upstream ask. The lib is stamped at the emit site (src/job.js)
+      // per the typed-lib rule — deriving it here from the code or the path is
+      // exactly the BA-2 misattribution class. A new bareloop-territory
+      // request-red therefore routes correctly by stamping its own lib, with no
+      // change to this branch.
+      add(ev, 'request-red', ev.lib ?? 'bare-agent', ev.verb ?? (String(ev.detail ?? '').match(QUOTED_VERB_RE) ?? [])[1] ?? 'unknown', ev.detail);
     } else if (ev.type === 'escalation') {
       if (ev.category === 'broken-close') {
         add(ev, 'broken-close', 'consumer', 'close', ev.detail);
@@ -184,10 +228,41 @@ export function classifyIncidents(events, { spine = 'spine' } = {}) {
 
   if (capHalted) {
     // capability-gap: the run hit its cap in a spine that also asked for a
-    // locked verb — the strongest admission evidence there is (design table)
-    for (const verb of new Set(occs.filter((o) => o.class === 'request-red').map((o) => o.verb))) {
-      const halt = events.find((e) => e.type === 'cap-halt');
-      add(halt, 'capability-gap', 'bare-agent', verb, `locked "${verb}" requested and the run cap-halted`);
+    // locked verb — the strongest admission evidence there is (design table).
+    // STILL DORMANT, exactly as the module header says: a request-red is a
+    // job-validation red, validateJob returns not-ok on any red and run.js
+    // returns on a validation red, so a request-red and a cap-halt cannot share
+    // one spine today. What follows is a latent-consistency fix at a documented
+    // dormant seam, not a live bug fix.
+    //
+    // The territory comes from the OCCURRENCE, never from a hardcoded package.
+    // capability-gap inherits request-red's two territories: a locked TOOL verb
+    // is demand against the worker-surface package, a locked VERDICT type is
+    // demand against bareloop's OWN catalogue. The request-red rows above
+    // already carry the lib stamped at their emit site (src/job.js), so reading
+    // it here is the typed-lib rule; re-hardcoding 'bare-agent' would seed an
+    // upstream ask for our own refusal — the BA-2 misattribution class. The
+    // sibling request-red site was fixed on this branch and this one was missed;
+    // a fix landing at one of two identical sites is the class already paid for
+    // once here (the ripgrep install that landed in ci.yml but not publish.yml).
+    //
+    // The dedup key is (verb, lib), not verb alone. The ledger's own occurrence
+    // key already carries lib, so folding on the verb would merge two
+    // territories into one row and attribute it to whichever lib the Set
+    // happened to hold first — an arbitrary target, which IS the defect. One
+    // gap per (territory, verb) costs nothing and each carries an honest one.
+    // The key is JSON, not a joined string: a delimiter that can appear in
+    // either half makes ("a-b","c") and ("a","b-c") the same key, and picking
+    // an "impossible" delimiter is a guess about names neither of these two
+    // vocabularies has promised to keep.
+    const halt = events.find((e) => e.type === 'cap-halt');
+    const seen = new Set();
+    // .filter() snapshots before add() appends, so the loop cannot feed itself
+    for (const o of occs.filter((x) => x.class === 'request-red')) {
+      const dedup = JSON.stringify([o.lib, o.verb]);
+      if (seen.has(dedup)) continue;
+      seen.add(dedup);
+      add(halt, 'capability-gap', o.lib, o.verb, `locked "${o.verb}" requested and the run cap-halted`);
     }
   }
   return occs;