bareloop 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -5,6 +5,289 @@ All notable changes to bareloop are documented here. Format:
 [SemVer](https://semver.org/spec/v2.0.0.html). Pre-1.0: **minor** = a ladder rung or
 feature lands, **patch** = docs, fixes, scaffolding.
 
+## [0.8.0] — 2026-08-07
+
+### Changed
+- **The variance meter REPORTS progress — and still decides nothing on it** (F85, A+B;
+  `src/planrun.js`). The meter stopped a step that was CONVERGING and then told the redrafting
+  planner that step's exits were *"unmoved"*. Two instruments over one run, and only one of them
+  right. Live on `u-msh70zla`: the close gaps went 30 → 24 → 15 → 14 with the ladder recording
+  `distinctGaps 3` / `strikes 0`, while the replan brief said nothing had moved and the materials
+  said *"0 step(s) completed"* — so the replanner, told it had achieved nothing, rebuilt a file
+  that was already at zero errors, wrote nothing twice, and the run died with $1.09 and 7 minutes
+  unspent. hamr's ruling, verbatim: *"meter is right but missing a piece … it should give heads up
+  on money/time + progress for llm to judge."*
+  - **The firing condition is byte-identical** — `moneyShare`/`timeShare >= 0.5`, both axes, the
+    same threshold, the same throw. A progress term in the TRIGGER would make a governance
+    instrument over an operator-owned allowance judge capability, so a converging step that is
+    eating the run is still stopped. What was missing was never a term in the condition; it was
+    the READING.
+  - **The reading is read off `src/trend.js` — the SAME instance the money halt reads.** Nothing
+    new is computed at the meter: no second reader, because two instruments answering one question
+    is the exact defect being fixed. Per-stage, stage names and numbers only, and `unknown` stays
+    `unknown` — a close that reports no number donates nothing (F6).
+  - **The hardcoded `with its exits unmoved` string is DELETED.** It printed on every step-variance
+    stop whatever had happened, and on `u-msh70zla` it was simply false. The escalation detail —
+    which a human reads and which the replan brief quotes — now states the meter's fact (*a share of
+    the run was consumed*) and then the trend instrument's measured reading, as two separate claims
+    rather than one fused verdict on the work. The materials `progress` line keeps its structural
+    sentence (*"step N of M did not finish; K step(s) completed before it"* — a plan's shape is what
+    the planner re-allocates) and gains the close trend beside it.
+  - **Spine change:** the `variance` record gains `trend` / `motion` / `reading` / `series` — the
+    same four names and the same shapes the money halt already emits, so one reader parses a
+    progress reading wherever it appears. ADDED fields, never repurposed ones (the spine is
+    append-only forever). Measured post-fix on `u-mshcpdg4`, iteration 3 on `finish-strict-typecheck`:
+    `moneyShare 0.497`, `timeShare 0.769`, `axis time`, `trend "converging"`,
+    `reading "still progressing — typecheck 30 → 15 → 15 → 1"`,
+    `series [{stage:"typecheck",values:[30,15,15,1]}]` — against `u-msh70zla`'s pre-fix record, which
+    carried the shares and nothing else.
+- **`runTrend` was blind to everything a STEP achieves** (F85, the prerequisite found en route). The
+  run's trend reader was fed only the close PRECHECK and the outer fix loop, so a meter firing
+  mid-step had nothing to report about a step that had just gone 24 → 15 → 14. Two folds corrected:
+  a step's failing check is an arbiter-rendered close grade (same `runStages`, same chain, same stage
+  names) and is now recorded like one; and it is recorded on the RAW gap, because `evalExits` wraps
+  stage output as `check "<name>" red: …` and that wrapper line carries the word "red" with no number
+  on it — so every step grade used to donate a null. Measured on `u-msh70zla`'s own archived gaps:
+  raw reads `typecheck 24 → 15 → 14`, wrapped reads nothing at all. Plus a **preflight seed** so the
+  counter has a baseline: the precheck reds at the close's FIRST failing stage (first-red-wins) and
+  every shipped close opens with `changed-from-seed`, so the numeric stages had no baseline at all and
+  a run would read `unknown` on exactly the stop the readout exists for. Seeded ONCE PER STAGE, off the
+  reader's own books — the precheck and the preflight menu grade the same unchanged tree back to back,
+  and a repeated baseline in a series reads as an attempt that achieved nothing, which is the phantom
+  flat step this change exists to remove.
+- **`tests/resume-u.test.js` is decoupled from the live job spec.** It read
+  `jobs/bareagent-u-types.json` while hardcoding $8 / 45min, so an operator budget edit on a live spec
+  turned the suite red. Every number now derives from the spec it reads, proven by passing at a third
+  budget value. Suite: **1023 tests** (1027 minus the 4 deleted with the `never wrote` feature below);
+  typecheck and `build:types` exit 0.
+- **The per-step model tier menu narrows to `['sonnet']`** (`STEP_MODELS`, `src/plan.js` — a PUBLIC
+  surface: a plan declaring `model: "haiku"` is now REDDED by `validatePlan` with `invalid-value` at
+  `steps.N.model`, carrying the menu). hamr's order, verbatim: *"haiku should be dropped to see if it
+  passes, if it's agent poor work or harness, like always."* **This is a reversible ATTRIBUTION PROBE,
+  not a finding that haiku is incapable** — what the $0 archive read behind it shows is a CONFOUND, in
+  both directions. Over 186 spines / 71 accepted plans / 255 steps, only **20 steps ever declared a tier
+  at all**: haiku **12** — 9 of them on a REPLANNED plan, 6 the LAST step of their plan, round bounds
+  3–12, **2 ever green** — against explicitly-declared sonnet **8**, 2 on a replan, 3 last, bounds 14–32,
+  **5 green**. The planner reaches for haiku on steps it judges mechanical, and a replanned step sits on
+  a run already in trouble, so neither column is a controlled read; and all three bareagent-u runs of
+  2026-08-06 tiered their replanned step down (haiku/6, haiku/8, haiku/12) and all three failed. That
+  confound sat directly on top of the programme's most recent capability read (F86's tail). Removing the
+  tier is how it gets attributed: with one tier expressible, a still-failing replan is agent or harness,
+  never the tier.
+  - **The `model` field and its validator branch STAY.** A one-entry menu means a plan — or a stored
+    bridge — declaring `model: "sonnet"` still validates, and restoring haiku is a one-token edit. No
+    stored bridge declares haiku (verified).
+  - **The drafter prompt's `model` line is DELETED** rather than reduced to a one-item menu: it
+    advertised *"a cheaper tier for mechanical steps"* and there is no cheaper tier now, and reciting a
+    single legal value spends tokens to invite a no-op field (`attempts` is the existing
+    legal-but-not-offered precedent). Verified by RENDERING the real prompt — 0 lines match
+    `/model|tier|haiku|sonnet|cheaper/i` in either the fresh or the replan form.
+  - **Only what the AGENT may express narrows**, which is the safe direction. `--model haiku` remains
+    the OPERATOR's probe knob (PRD v1.36), untouched in `scripts/run-u.mjs`; two comments there called
+    the runner's tier map *"the same closed menu the planner uses"* and now say plainly that it is
+    deliberately wider.
+  - **No spec hash moved.** `jobSpecHash` covers the resolved spec, not `STEP_MODELS`; all 10 job specs
+    were re-hashed and none moved — bareagent-u and bareguard-u are still the hashes hamr signed.
+  - Measured on the first sonnet-only run against the last haiku-era one, same patient: **10.9 → 17.5
+    seconds per round** (1.6× slower), 120 → 87 rounds, and the failure CLASS changed — struck out at 2
+    remaining errors with money and clock left, versus still converging at 1 error when the wall
+    expired. Better rounds are slower rounds, and the binding constraint moved from the strike ladder to
+    the clock. That sonnet-only run was also the first to reach the outer close, where it was redded for
+    **silencing the type checker instead of typing the code** (F87's suppression genre) — the close
+    refused it, and the eventual green removed the suppressions.
+- **`bareloop.context.md` named `sonnet | haiku` in two places and is corrected** — the shipped adopter
+  contract carried the old menu in the `steps[].model` schema row and in the `providerFor` (P) section,
+  so an integrating agent reading it would have drafted a plan that reds. Both now name the one-entry
+  menu and say why it is one entry.
+
+### Fixed
+- **A locked-VERDICT `request-red` no longer files as a bare-agent upstream ask** (`src/job.js`,
+  `src/ledger.js`). `classifyIncidents` hardcoded `lib: 'bare-agent'` for every `request-red`, but the
+  code covers two territories: a locked TOOL verb (bare-agent, the original case) and a locked VERDICT
+  type (`soft-green`/`hitl`) — demand against bareloop's OWN `VERDICT_TYPES` menu, live-misfiled for
+  every `LOCKED_VERDICTS` declaration (the BA-2 misattribution class). Per the typed-lib rule the
+  territory is now stamped at the EMIT site (`Red` gains `lib?`; `verdictType` → `bareloop`, `tools` →
+  `bare-agent`) and the ledger reads it, keeping the hardcode only as the pre-field legacy-spine
+  fallback (zero archived rows carry the code, verified). The `suggestedAsk` template renders the
+  stamped target, so a bareloop-catalogue refusal can never seed a bare-agent ask; D13's genre refusals
+  (close-authoring design record) route by stamping their own lib with no ledger change. 5 new
+  failing-first tests; `capability-gap` still hardcodes bare-agent — flagged, structurally unreachable
+  today (a validation red returns before any provider call; the module header says so).
+- **…and `capability-gap` no longer hardcodes it either — the flag above is CLOSED** (`src/ledger.js`).
+  `capability-gap` is `request-red`'s cap-halted form and inherits both of its territories, but the fix
+  landed at one of the two sites and not the other: the synthesis loop still wrote `'bare-agent'`
+  literally, and so did its `suggestedAsk` template — the one field a human actually files from, where
+  fixing only the occurrence's `lib` would have left the misattribution fully intact. The territory now
+  comes from the OCCURRENCE (the `request-red` rows already carry the lib stamped at their emit site),
+  and the **dedup key becomes `(verb, lib)` rather than the verb alone**: the ledger's own occurrence
+  key carries `lib`, so a `Set` over verbs would merge two territories into one row and attribute it to
+  whichever the set happened to hold first — an arbitrary target, which is the defect itself. One gap
+  per (territory, verb) costs nothing and each carries an honest one. **Reachability is unchanged and
+  still DORMANT** — `validateJob` returns not-ok on any red and `run.js` returns on a validation red, so
+  a `request-red` and a `cap-halt` cannot share one spine today; this is a latent-consistency fix at a
+  seam the module header documents as dormant, and it claims no live bug. 3 new failing-first tests,
+  each labelled in-file as a FUNCTION-CONTRACT fixture (`classifyIncidents` is pure) so a later reader
+  cannot mistake the synthetic stream for something a run can produce. Closed now rather than left
+  flagged because a fix that lands at one of two identical sites is the class this repo has already
+  paid for once — the ripgrep install that went into `ci.yml` and not `publish.yml`, which then failed
+  on the identical cause.
+- **The replan ceiling reset on EVERY resume leg — a kill refilled a bound the operator signed**
+  (`src/planrun.js`, `src/run.js`, `src/reuse.js`, `scripts/run-u.mjs`). `replanned`/`varianceGrantUsed`
+  were locals in `runPlan`, and a resume is another `runPlan` call. Confirmed by execution before any
+  remedy: leg 1 replanned and stopped; leg 2, driven with a `resumeSeed`, replanned again — a run total
+  of 2 with every record showing 1. Two became four by being killed once, which is precisely the creep
+  the latch exists to make impossible (*"unlimited replanning launders thrash as adaptation"*, PRD
+  v1.12).
+  - **Fixed on the MONEY-FOLD precedent, not the grade-seed one, and the choice is the fix.**
+    `readGradeSeed`'s documented known limit is that it reads ONE spine, so a resume of a resume
+    inherits leg 2's grades and not leg 1's — the chain shortens by a leg per kill. That is fail-safe
+    for a READOUT (a short chain can only under-claim a direction) and it is the DANGEROUS direction
+    for a CEILING, where an under-claimed ledger is a refilled allowance. So each leg DECLARES the
+    ledger it inherited on its own spine (`priorSpentUsd`'s mechanism) and the next reader adds only
+    its own window's `replan` records. Leg 3 inherits the whole chain, not leg 2's slice.
+  - **The counter-argument was answered, not stepped over.** `src/trend.js` deliberately refuses to
+    seed the fix loop's ITERATIONS from history, and that stays right: an attempt allowance is a LEG
+    bound, and a restarted leg buys its own attempts with its own money. A replan ceiling bounds how
+    many times the WORKFLOW may be redrawn, which is the run's span — the same span the halt readout
+    already covers. The two seeds disagree on purpose and both now say so in-source.
+  - **SPINE FIELDS — `job-start` gains `priorReplans` / `priorReplanGrantUsed`.** Emitted only when
+    there is a fold (a decorative `0` is indistinguishable from a run nobody folded), on the same
+    declaration `priorSpentUsd`/`priorWallMs` already ride. The grant latch travels BESIDE the count
+    rather than being derived from it: a leg can inherit a spent ordinary ceiling with the arbiter's
+    extra still unearned (`1`, `false`), and deriving one from the other would collapse two real states
+    into one. `readResume`'s `direct` mode reads the fold off these very fields, so a U-path run
+    resumed twice inherits leg 1.
+  - **SPINE MEANING CHANGE — `plan-executed.replans` counts the CHAIN, not the leg** (and `replanned`
+    with it). **An adopter parsing spines must re-read this field.** The change was made rather than
+    shadowed by a second field precisely because `replans` shipped only on this unreleased branch, so
+    no archived spine carries the leg reading for a reader to be confused by. The leg's own number is
+    not lost: a leg emits one `replan` record per replan it drafts, so `chain − records-in-this-window`
+    is the fold it inherited — the same arithmetic `readResume` runs — and a second field stating a
+    derivable number would be a second reader of one question.
+  - **New option: `runJob(spec, { resumeReplans })`** (and `runPlan`'s identically-named option),
+    `{count, grantUsed} | null`, defaulting to `null` = the cold path, byte-identical to a run nobody
+    resumed. Belted like every declared fold entering the arbiter's arithmetic: a garbage, negative or
+    non-finite seed reads as `0` rather than poisoning later comparisons as `NaN`, and a negative one
+    can never cancel a real replan and widen the ceiling. `scripts/run-u.mjs --resume` and `runReuse`
+    both pass it. **The disarm control holds** — a resumed leg with an UNSPENT ceiling still replans, so
+    the bound is bounded and not switched off.
+- **The replan brief's `closeGapBlock` re-bounded an ALREADY-bounded gap and deleted the red names the
+  first envelope had rescued** (`src/planrun.js`, `src/exits.js`). `src/exits.js` states the rule for
+  this same artifact one seam earlier: the check gap arrives already enveloped by `runClose`'s
+  `boundGap` under the stage's own `gapKeep`, which deliberately rescues the `not ok`/`FAILED` names
+  out of the elided middle — the mechanical gap F46's conversion mechanism feeds the worker. A second
+  400/1500 envelope deleted exactly those a second time, which is F28 reintroduced; measured on a
+  120-red-line close output, the first bound rescued **78** names and the second dropped **12** of
+  them. `CHECK_GAP_MAX` (12,000) is now **exported** from `src/exits.js` and imported here rather than
+  respelled, so the two seams cannot drift on how big a check gap may be, and it is applied as a
+  **backstop, not an envelope**: under it the gap passes through VERBATIM. The headroom is measured,
+  which is why the ceiling is not smaller — `runClose`'s own envelope tops out at ~10.1KB (400 head +
+  8192 keep + 1500 tail + labels), and joined with a `tree-changed` detail that is ~10.2KB, leaving
+  ~1.8KB to spare, so the shipped path is untouched and the backstop fires only where `src/exits.js`
+  says it should: a seam that returned something never bounded at all. Length is measured AFTER the
+  secret scrub, because a mask is wider than most literals it replaces and bounding the raw string
+  would let a gap cross the ceiling on its way through the one transformation that always runs.
+- **The replan brief's block was LABELLED as the close's own output but could lead with ours**
+  (`src/planrun.js`). `res.gap` is `lastGap` — the join of EVERY failing exit's detail in exit order —
+  and with `MAX_EXITS_PER_STEP` at 2 plus the mandatory `tree-changed` pairing on a write step, a step
+  that wrote nothing opens the block with the EVALUATOR's own prose (`0 files changed under src/** …`)
+  under a label reading *"the verification's own output"*. Captured verbatim from a real replan prompt.
+  The **label** is corrected to *"What this step's exits reported on its last attempt (their own
+  output, verbatim)"*; the **payload is deliberately kept** — "the step wrote nothing" is exactly what
+  a replanner should be told, and stripping it to make an old label true would trade a real fact for a
+  tidy sentence. F86's thesis (the artifact travels as TEXT, never parsed) is restated, not weakened.
+- **F49's ReDoS reject now covers the OPERATOR's two regex fields, not just the agent's**
+  (`src/job.js`, `src/validate.js`, `src/plan.js`). `hasNestedQuantifier` shipped wired at exactly ONE
+  site — the agent-authored `artifact-written.pattern`. Two operator-authored patterns reach an
+  equally untimed evaluator and were uncovered: `judged.pattern`, exec'd by `runClose` against the
+  close's whole stdout+stderr, and `gapKeep`, compiled by `boundGap` and run **once per line** of
+  close output. Both now red `invalid-value` at the validation gate, before any tokens burn.
+  - **Measured, not argued:** `boundGap(stream, '(a+)+$')` against a 40-character line does not finish
+    in 20 seconds (`timeout` exit 124).
+  - **Why this is worse than an operator self-DoS, and F67 is the reason.** On the agent side F49's
+    own scope note holds — the agent authors both the pattern and the artifact, so a hang burns only
+    its own wall-clock and compromises no arbiter. These two run in **bareloop's own process**, so the
+    hang blocks the MAIN EVENT LOOP — and the in-process stall fuse is a timer in that same loop, so
+    it cannot fire (*a guard living inside the process it guards shares that process's fate*). The run
+    then dies to the OUTSIDE watchdog and reads as a model stall: **a bad regex in a SIGNED spec
+    presents as a provider problem.** The cost is a misdiagnosis, not just a stop.
+  - **The detector MOVED to `src/validate.js` — one inventory, never a second copy.** `plan.js`
+    imports `job.js`, so `job.js` cannot import `plan.js`; housing the scan with the other shared
+    primitives is what lets both documents reject through the same function. `plan.js` re-exports the
+    name (the `WRITE_VERBS` precedent), so the F49 site is byte-identical in behaviour. A second copy
+    would be precisely the drift class `SECRET_PATTERNS` exists to prevent — a shape one validator
+    rejects and the other admits. `hasNestedQuantifier` is not exported from `src/index.js`, so the
+    move is internal and breaks no adopter.
+  - **Admissibility swept before the change and re-run after:** all **92** operator regexes across all
+    **10** signed specs in `jobs/` — **zero** newly red. No spec breaks, no spec-hash churn (no spec
+    file is touched). The shipped shapes are pinned in the suite as the control that can produce the
+    negative: if the reject ever reds one of them, it has broken the live fleet.
+  - **Known limit, PARKED not chased:** the scan misses the alternation-overlap class (`(a|aa)+$`,
+    `(x|xy)*$` — no inner quantifier exists to find; the blowup comes from overlapping branches under
+    a repeat). Widening it changes which SIGNED specs are admissible, which is arbiter-adjacent.
+    Docked to the close-authoring rung, where hand-authored operator regexes may cease to be a surface
+    at all — see **PRD v1.55**. Recorded there too, so it is not re-chased: `([^])*$` is NOT caught and
+    that is CORRECT (`[^]` is the any-char idiom, so the pattern is linear); the genuinely nested
+    `([^]*)*$` IS caught.
+
+### Added
+- **A SECOND variance stop can earn ONE more replan — granted by the ARBITER, on a mechanical
+  reading** (F85, C). A second `step-variance` after the one-replan ceiling was spent used to be a
+  hard stop, and on a run that was still converging that stop threw away work already paid for. Every
+  clause of the grant is a constraint: **ONE**, bounded by a LATCH rather than a comparison so the
+  ceiling cannot creep by arithmetic (unlimited replanning launders thrash as adaptation, v1.12) — a
+  third variance stop is the stop, however well it is going; **the arbiter's**, read mechanically off
+  the same `runTrend` instance the meter and the money halt read, with the agent given no channel to
+  it — it never asks, is never offered it, and cannot influence it (no self-adjusted budgets, ever);
+  **`converging` only**, the trend instrument's own category with no fresh number invented here
+  (threshold-setting is the operator's), so `flat` and `unknown` stop exactly as before and an unknown
+  is never rounded up into a reason to spend (F6); and **`step-variance` only** — an exhaustion or a
+  stall after the ceiling is unchanged. `remainingUsd() > MONEY_MIN` still gates it, as it gates the
+  ordinary replan. **Spine change:** `replan` gains `replan` (which replan this is) and — only when the
+  arbiter granted one past the ordinary ceiling — `granted` with the reading it was granted on, so a
+  reader can never mistake the ceiling for a grant; `plan-executed` gains a `replans` count riding
+  BESIDE the shipped `replanned` boolean, never repurposing it. Live on `u-mshcpdg4`: three
+  `plan-accepted` records — the initial draft and two replans, the second granted on `converging`.
+- **`closeGapBlock(gap)` — the replan brief carries the close's OWN output** (F86; `src/planrun.js`).
+  `u-mshcpdg4` reached ONE remaining strict error and still died. The close gap named the work exactly
+  — `src/recurse.js(978,115)` — and the worker read it every attempt; the REPLANNER, which is the
+  component that chooses which files the next plan targets, saw only
+  *"still progressing — typecheck 30 → 15 → 15 → 1"*: a number with no address. It aimed the last plan
+  at `src/loop.js`, already at zero errors, wrote nothing twice, and took two strikes — with $1.10 and
+  82 seconds still on the clock at the moment that replan was granted (the run itself ended $0.8174 and
+  ~6 seconds short of its caps). F85 gave the brief the trajectory; this gives it the artifact the trajectory
+  is a summary OF. Handed over as **TEXT**, with both boundaries reused rather than respelled: scrubbed
+  through the one secret inventory (`redactSecrets`/`SECRET_PATTERNS`) because a prompt is an egress
+  point and the next caller will not remember the upstream scrub, and bounded by ralph's own `boundGap`
+  — now **exported** from `src/ralph.js` for it, since a private slice would be a second truncation
+  scheme that drifts on exactly the property that matters (whether the red lines survive, and whether
+  the trim announces itself, F28); the close path still calls it with the stage's own `gapKeep`,
+  byte-identically. The red-set is `REPLAN_GAP_KEEP = '\S'` — every non-blank line — because a shipped
+  `gapKeep` is `^`-anchored (`^BAREAGENT `, `^red`, `^FAILED`) and the exit evaluator wraps stage output
+  in `check "x" red: …`, so the anchor no longer sits where the pattern expects it; a gap that reaches
+  here is ALREADY a red-set (`judge` builds it out of the failing exits only), so keeping every line is
+  the correct instrument, not a widened one. **No spine field** — `src/trend.js`'s rule is that no
+  record carries a close byte. An empty gap yields the empty string, so the brief renders
+  byte-identically to the pre-F86 one (a labelled empty section would invite the planner to explain an
+  absence the run never observed). Verified by execution, not by reading: sabotaging the wiring
+  (`gapBlock = ''`) turns the `u-mshcpdg4` regression test red (`not ok 121`); restored byte-clean.
+
+### Removed
+- **`gapFilesNeverWritten()` and the `never wrote` replan advisory** (F86) — an EXPORT of
+  `src/planrun.js` is gone (it was never re-exported through the package entry, whose `exports` map
+  admits only `.`, so no adopter import breaks). hamr's order, verbatim: *"delete it and rerun
+  bareagent"*. The measured reason, on `u-mshcpdg4`'s own gap: the advisory resolved to
+  `src/loop.js` — the file already at zero errors — and said so as a DIRECTIVE, beside the artifact
+  that said the opposite; this worker follows directive prose (positive-scope confinement). It also had
+  no evidence of ever converting anything: it fired by construction on `u-msdsmkid`, and that run still
+  step-redded. The general rule it broke is why `closeGapBlock` hands over text instead: **a parsed
+  file list cannot tell a summary line from a detail line**. Line 1 of that very gap reads
+  `reports 1 error(s) in src/recurse.js, src/loop.js` — every file in SCOPE — and only line 2 names the
+  culprit; and the shapes differ per close anyway (tsc `file:line`, pytest test ids, a count close that
+  names no file at all). A model reading the artifact can make that distinction; a regex reproduces the
+  bug. Two readers of one question with the parsed one wrong is the same failure the variance meter just
+  had. Its 4 tests went with it, and its sole caller was the brief — no speculative code left behind.
+
 ## [0.7.0] — 2026-08-05
 
 ### Changed

package/README.md

@@ -49,8 +49,10 @@ it and never disappears.
 > kill-switch question). As of 0.7.0 N3's machinery **ships** — the bridge registry, the
 > operator-signed reuse envelope, the selection call and step-level resume are all in the
 > public API — but shipping is not acceptance: one execution green proves reuse safe and
-> legal, never *beneficial*. The lift claim waits on the ON-vs-forced-cold contrast, which
-> has not fired. Until it does, treat reuse as available and unproven.
+> legal, never *beneficial*. The contrast that was to prove the lift is now retired (F88): a
+> validation rule hands every cold run the plan shape a bridge was carrying, so the gap it
+> would have measured is gone. Treat reuse as available and unproven — what a bridge should
+> carry instead is open.
 
 ## Quick start
 

package/bareloop.context.md

@@ -96,7 +96,7 @@ the step plan at run time (gated by `validatePlan`); the human signs only:
 | field | shape | notes |
 |---|---|---|
 | `goal` | non-empty text | what the agent plans against |
-| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). v1 ADMITS only `green`; declaring `soft-green`/`hitl` reds `request-red` with the type as a structured `verb` field (declared-but-locked — the tool-menu pattern) |
+| `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). v1 ADMITS only `green`; declaring `soft-green`/`hitl` reds `request-red` with the type as a structured `verb` field (declared-but-locked — the tool-menu pattern). Every `request-red` also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
 | `close` | **an ORDERED LIST of named stages** `[{ name, cmd, expect, judged?, gapKeep?, offer?, needs? }, ...]` (PRD v1.28), or a close object (table below) **only** for the declared-but-locked verdict classes | the destination, the only thing hand-authored; the check menu DERIVES from it (below). The plan flow executes a staged close directly and adapts a bare `predicate` object into a one-stage list; a `gold`/`rubric`/`hitl` object close validates (the declared-but-locked verdict classes still parse) but the plan flow refuses it at runtime as `close-unsupported` — it names no command to run |
 | `checks` | **RETIRED** (PRD v1.28/v1.32) | hand-authored checks are gone, not merely discouraged: declaring `checks` reds `checks-derived` by name. The check menu is DERIVED from the close's own stages instead — see **Staged close** below. The hazard this removes is measured, not theoretical: job #5's three hand-written checks were re-implementations of three stages the close already ran, and a hand-carved copy can drift LENIENT (the worker passes the operator's ruler and fails the real inspection) |
 | `tools` | optional unique subset of `TOOL_MENU` (14 verbs, below) | the CEILING every plan step's grant must fit inside (omitting it means the full menu — and the hash is taken over that RESOLVED form, so a `TOOL_MENU` widening flips an omitted-`tools` spec's hash and forces a re-sign; see `jobSpecHash`, MED-1); `run` is `LOCKED_TOOLS` and reds `request-red` — locked-but-listed, and the red IS the admission evidence the ledger tallies (a typo stays `invalid-value`). A ceiling of write-class and store-class verbs ONLY reds `invalid-value`: the scout surveys read-only, so it would be handed an empty menu and survey blind |
@@ -174,6 +174,20 @@ reader for every close, deliberately (the F49 precedent). **Splitting a stage mo
 hash** — stage names are in the signed spec — so it is a spec edit the operator re-signs, and
 it changes what stored bridges match (below).
 
+**The law for spec authors: your `goal` must state everything your close will judge.**
+Nothing derives the goal from the close or the close from the goal, and nothing checks the
+two against each other — the ONE derivation in the library is close stages → the agent's
+`check-passes` menu, one hop, one direction. That separation is the arbiter rule (the agent
+references the operator's ruler and never authors it) and it is not negotiable, so the drift
+is yours to close: the planner and the worker read the `goal` text, not your stage list, and
+they will spend their single check slot (above) on the constraint the goal sentence names.
+A stage your goal never mentions is a **cost trap, not a safety hole** — the close still
+refuses the tree and the run still cannot mint a green — but the run discovers that stage at
+the tail, after paying for work aimed elsewhere, and may not have the money or wall left to
+redo it. Write the goal from the close's own stage list, in the close's own words; keep it to
+a few explicit requirements rather than prose. Preflight already names every stage on the
+`check-menu` spine event — read it back and check your goal against it before you sign.
+
 **Close types and the hierarchy — the OBJECT form, which survives only for the
 declared-but-locked verdict classes** (a close is data, never code; verdict-class laundering
 is a named red `close-hierarchy`). The go-forward shape is the staged list above; a
@@ -233,6 +247,19 @@ first) so a pathological close cannot rebuild the very bloat the bound exists to
 when the cap trims matches it **says so** with an explicit marker (silent truncation is the
 disease this cures, never a cure that truncates silently). Validated like `judged.pattern`:
 a non-empty string that must **compile as a RegExp**, else a spec red before any tokens.
+
+**Both operator patterns must also survive the ReDoS shape check** (`invalid-value`, F49 —
+the same reject the agent's `artifact-written.pattern` gets): an unbounded quantifier over a
+group that itself repeats unboundedly (`(a+)+`, `(\d*)*`, even wrapped: `((a+))+`) is
+rejected at the gate. **This is stricter than an "it compiles" contract, and deliberately
+so.** `judged.pattern` is exec'd by `runClose` over the close's whole stdout+stderr and
+`gapKeep` is run by `boundGap` **once per line** — both untimed, both in bareloop's own
+process. Measured: `boundGap(stream, "(a+)+$")` on a 40-character line does not finish in
+20 seconds. Because the hang blocks the main event loop, the in-process stall fuse cannot
+fire, the run dies to the outside watchdog, and **a bad regex in a signed spec presents as a
+provider problem** — so this reds at signing time rather than being diagnosed later. All 92
+operator regexes across the 10 in-repo specs pass unchanged. Known limit, parked: the scan
+does not catch the alternation-overlap class (`(a|aa)+$`) — see PRD v1.55.
 Omitting it is exactly today's bound. Like `judged`, it is **arbiter territory** — the
 drafted workflow config cannot express it (unknown-field red). The gap path also combines
 **both** streams (stdout + stderr), so a failure printed to stdout survives stderr noise
@@ -249,11 +276,23 @@ middle writes; `validatePlan` gates it against the SIGNED job spec before tokens
 | `steps[].tools` | non-empty unique subset of the SPEC ceiling | a verb beyond the ceiling reds `verb-escape` with the verb as structured data (overreach, distinct from the operator-side `request-red`); `run` is `verb-escape` at every layer |
 | `steps[].rounds` | int 1..shell cap (default 40) | the step's per-attempt tool-round bound (the Gate's `maxTurns` natively) |
 | `steps[].target` | path inside the fence | v1.18 deliverable; REQUIRED on write-granted steps |
-| `steps[].model` | optional; `sonnet` \| `haiku` (`STEP_MODELS`) | the step's model TIER — a menu, never a model string the agent spells (the tier→model mapping and any per-model effort params are the runner's). `opus` is deliberately absent: reserved for work the human assigns, never plan-selectable. Off-menu reds `invalid-value`. A step naming a tier when the caller supplied no `providerFor` factory is an `interpreter-red` STOP, never a silent run on the default tier |
+| `steps[].model` | optional; `sonnet` (`STEP_MODELS`) | the step's model TIER — a menu, never a model string the agent spells (the tier→model mapping and any per-model effort params are the runner's). `opus` is deliberately absent: reserved for work the human assigns, never plan-selectable; `haiku` was removed 2026-08-06 as a reversible ATTRIBUTION PROBE (F87, see `STEP_MODELS`), so the menu is one entry deep and the field is no longer offered in the drafting prompt. The field and its validator branch STAY: `model: "sonnet"` still validates, a stored bridge declaring it still loads, and restoring haiku is a one-token edit — this is not a finding that haiku is incapable. **The narrowing binds only what the AGENT may express.** Which real model a tier maps to, and what the caller runs as its own default worker model, stay the OPERATOR's: `providerFor` is yours, and the in-repo runner's `--model haiku` probe knob is untouched (PRD v1.36) — the runner's tier map is deliberately WIDER than the plan menu. Off-menu reds `invalid-value`. A step naming a tier when the caller supplied no `providerFor` factory is an `interpreter-red` STOP, never a silent run on the default tier |
 | `steps[].attempts` | optional; int `>= 1` | **RETIRED and INERT (F79) — it bounds nothing.** A step's iterations are governed by the STRIKE LADDER (below), which is shell-owned and inexpressible from the plan. The field is no longer offered in the drafting prompt and the runner ignores it; it is deliberately still ACCEPTED, because stored bridge plans carry it and a plan minted under one runner's number must not red under another's. The shape is still checked (a known field holding garbage stays a `bounds` red); the old `<= capRuns` ceiling is gone with the cap it named. It was previously TIGHTEN-only — which meant a step that needed MORE iterations could not ask, and drafters measurably tightened it instead (F77) |
 | `steps[].scope` | optional; one value from the SAME menu `tree-changed` uses | narrows this step's live WRITE fence to a subset of the signed `writeScope` — chosen from the offered scope menu (below), never authored. Off-menu reds `invalid-value` carrying the menu |
 | `steps[].exit` | 1..2 items (`MAX_EXITS_PER_STEP`), ALL must pass (AND-only, no OR/NOT) | closed menu (`EXIT_TYPES`): `artifact-written(path, pattern?)` · `tree-changed(scope)` · `json-valid(path)` · `check-passes(name)`. **`tree-changed.scope` is a MENU, not a glob the agent authors** — the runner enumerates the signed fence entries plus the real directories beneath them (shallowest-first, capped at `MAX_SCOPE_MENU`=24; `legalScopes` in `src/plan.js`), `planPrompt` lists them verbatim, and `validatePlan` accepts membership only — the SAME array on both sides, so what was offered is what is accepted; omitted, it derives from `writeScope` alone — never a free-text fallback. An off-menu value that escapes the fence still reds `scope-escape` (the ledger's attribution class), an in-fence unoffered value reds `invalid-value` carrying the menu. `runPlan` emits `scope-menu {offered, truncated, offerableCount?, cap?}` so a capped menu is never silently complete. `check-passes` must name a stage on the close's DERIVED menu (`check-unknown` red names the offered menu — no operator authors this list, it comes straight from `checkMenu(close)`); on a write-granted step it must be paired with `tree-changed` (`exit-illegal` — the seed tree is green, a lone check would pass untouched, F17/F46). **`check-passes` also requires a write-class verb (`write`/`edit`) on the SAME step** (`exit-illegal` — BREAKING for plan authors: a read-only "verify" step carrying a check used to validate and no longer does). A failing check's gap is re-delivered to that step's OWN worker, so a step holding a check must be able to act on it; a read-only one is a mailbox with no hands and stalls to cap on a byte-identical gap (measured on 4 of 4 drafted plans). The check belongs on the step that fixes; the run's final verification is the operator's close, which the agent never authors. The rule is stated identically in the drafter prompt and the validator, so the two can never disagree — and it is suppressed when `tools` failed to parse (the step's hands are unknowable then, and the real defect already redded: one defect, one red). `artifact-written.pattern` must compile AND survive a ReDoS shape check — an unbounded quantifier over a group that itself repeats unboundedly (`(a+)+`, `(\d*)*`, even wrapped: `((a+))+`) is an `invalid-value` red (F49, catastrophic-backtracking footgun; rewrite without a repeated group inside a repeat). Exits verify FORM, not truth — progress gates; the operator's close stays the one arbiter |
 
+**A step has exactly ONE check slot — plan for it.** The three exit rules above compose into
+a ceiling worth stating on its own, because it decides what a plan can enforce *during* a
+run: `MAX_EXITS_PER_STEP` is **2**, the two are ANDed (no OR/NOT, `exit-illegal` past the
+bound), and a `check-passes` on a write-granted step MUST be paired with a `tree-changed`
+exit. Both slots are therefore spent the moment a step carries one check, so **a step cannot
+carry two checks** — `check-passes(typecheck)` and `check-passes(no-suppressions)` together
+on one step is inexpressible today, not merely discouraged. The consequence for an adopter:
+if your close judges N stages, at most ONE of them can be enforced inside a step; the other
+N−1 are enforced only at the close, at the end of the run. That is a COST shape, not a safety
+hole — the close still refuses a tree that fails any stage, and nothing green is minted mid-run
+— but a stage first tested at the tail is a stage the run pays full price to discover.
+
 Red vocabulary (both validators): `parse-error`, `unknown-field`, `missing-required`,
 `invalid-value`, `bounds`, `duplicate-id`, `close-type`, `close-hierarchy`,
 `secret-literal`, `scope-escape`,
@@ -431,6 +470,17 @@ ONE inventory) at the emission boundary, before anything rides the append-only s
 module itself does not scrub: a direct `evalExits` caller wiring results into its own log
 must apply its own redaction.
 
+A `check-passes` detail is sliced at `CHECK_GAP_MAX` (12,000 chars) — a defensive backstop
+above the close path's own `boundGap` envelope, not a second trim of it: a normally-bounded
+gap passes through intact and only a seam that returned something unbounded is ever cut. The
+constant is now `export`ed from `src/exits.js` so the replan brief's own backstop imports it
+rather than respelling it (two spellings would drift on the one property that matters —
+whether the `not ok`/`FAILED` names survive). **It is NOT part of the adopter surface:** the
+package `exports` map admits only `"."`, and `src/index.js` re-exports `snapshotScope` and
+`evalExits` from this module and nothing else, so `CHECK_GAP_MAX` and `boundGap` are internal
+by construction and a deep import cannot reach them. They are named here to explain the
+behaviour you WILL see in a detail string, not as API to call.
+
 ### `jobSpecHash(job)` / `checkApproval(job, approvals)` — `src/job.js`
 
 The pure half of **human-signs-always**: an agent may draft a job spec, but no job runs
@@ -454,10 +504,12 @@ Reserved spine vocabulary (V7, machinery-free until job #1 surfaces one):
 `coordination-red` — a failure between units (scope contention, step order, store
 races), never to be folded into worker/interpreter reds.
 
-### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades? })` → outcome — `src/run.js`
+### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans? })` → outcome — `src/run.js`
 
-The last four are the RESUME fold and are documented under *Resuming a killed run* below;
-they default to `0` / `true` / `0` / `null`, so a fresh run passes none of them.
+The last six are the RESUME fold and are documented under *Resuming a killed run* below; they
+default to `0` / `true` / `0` / `null` / `[]` / `null`, so a fresh run passes none of them.
+Three of them are folds of a bound the operator SIGNED (money, wall, replans) and one is a
+readout seed (grades) — the distinction matters and is spelled out there.
 
 The runner — the shell's top layer, and the ONE entry. It composes everything below it and
 interprets nothing itself. Sequence: **approval gate** (human-signs-always — refuses an
@@ -524,8 +576,9 @@ fed back, then `plan-red`) → **EXECUTE** (strictly sequential micro-loops: `ra
 the exit-evaluator judge, each step under its own STRIKE LADDER — below; tree snapshots at
 step start; the gap names every failing
 wall — mechanical genre, F46's measured mechanism; artifacts feed forward labeled by
-step id) → **ONE replan**, triggered by exhaustion OR variance (an instrument stop never
-replans) → **the operator's close**, a red feeding ONE bounded fix loop judged by the
+step id) → **ONE replan**, triggered by exhaustion OR variance OR a stall (an instrument stop
+never replans) — plus at most ONE arbiter-granted extra on a second variance stop that reads
+`converging`, below → **the operator's close**, a red feeding ONE bounded fix loop judged by the
 REAL close and governed by the close TREND rule below (`capRuns`, default 3, survives only as
 its blind fallback). `plan-executed` (the plan-as-executed record, design law #2) lands on the
 spine on every path that executed steps. Additional outcomes: `already-green |
@@ -557,8 +610,26 @@ escalation and wall-stop records carry `strikes`/`strikeLimit`/`distinctGaps` be
 iteration count rather than a cap the step no longer has. **The replan brief
 names the mechanism**: which shape ended the step (converging-cut / stalled-no-write /
 repeated-gap, with the iteration numbers as evidence), the gap trajectory, and how much money
-and wall the stop left unspent (time reported UNBOUNDED when no wall was set, never `0`). It
-names no culprit file — F28 applies to the replan channel too.
+and wall the stop left unspent (time reported UNBOUNDED when no wall was set, never `0`).
+**It also carries that step's own last EXIT output, verbatim** (F86) — masked through the repo's
+one secret inventory, and labelled as *the exits'* words rather than the close's, because the
+payload is `lastGap`: the join of EVERY failing exit's detail in exit order. The close stage's
+output is one of those details, never reliably all of them, so a step that wrote nothing opens
+the block with the exit evaluator's own `0 files changed under …` prose. That line is kept (it is
+exactly what a replanner should be told); only the label was wrong. The bound over it is a
+**backstop, not a second envelope** — what arrives has already been bounded by `runClose` under
+the stage's own `gapKeep`, which deliberately rescues the `not ok`/`FAILED` names out of the
+elided middle, and re-enveloping that deletes them a second time (F28 reintroduced; measured, a
+second 400/1500 pass dropped 12 of the 78 names the first had rescued). Under `CHECK_GAP_MAX` —
+`src/exits.js`'s own ceiling, imported rather than respelled so the two seams cannot drift — the
+gap passes through VERBATIM, with ~1.8KB of measured headroom over the largest thing the close
+envelope can produce; the backstop fires only on a gap nothing upstream ever bounded. No gap, no
+block, and the brief is byte-identical to one drafted before this existed.
+Handed over as TEXT: the runner makes **no parsed file claim of its own** in this channel —
+a close's summary line ("N error(s) in a.js, b.js" — every file in scope) and its detail line
+(the one location actually failing) are indistinguishable to a regex, and the shapes differ per
+close anyway. What the planner is told about WHERE the work is comes from the close's own
+bytes, never from the runner's reading of them.
 
 **The close TREND rule — how the CLOSE-FIX LOOP ends (PRD v1.46 §4).** `capRuns` retired as
 that loop's governor once its own $0 replay over every archived fix loop came back clean (0
@@ -608,7 +679,9 @@ on money (the step loop, the close-fix loop, and the scout/draft relay), exactly
 close rendered no number (F6). **The library only ever REPORTS**: `budgetUsd` is in the spec
 hash, so a top-up is a spec edit a human signs — nothing in a run may widen its own budget.
 
-**ONE progress instrument, read by both halts.** The wall halt used to run its own: byte
+**ONE progress instrument, read by both halts — and REPORTED by the variance meter.** The
+`variance` record and its escalation carry the same four fields off the same instance (below);
+the meter is the one consumer that never decides on the reading. The wall halt used to run its own: byte
 equality of the last two close gaps, reading `stalled` / `moving` / `unknown` beside the money
 halt's `flat` / `converging` / `unknown` on the same run. Both now read `runTrend`, the run's
 own `src/trend.js` reader. Where a stage reported a comparable NUMBER it decides; where none
@@ -671,14 +744,57 @@ The planner (never the worker) receives a **materials** block at draft and at re
 spread on verification-gap duration, so a per-round constant describes almost no real round
 and a rate framing creates a rush-or-fake incentive. The replan trigger gains a second axis
 (`step-variance`): a step consuming ≥ `VARIANCE_THRESHOLD` (0.5) of the run's REMAINING money
-or time with its exits unmoved is pre-empted at the head of its next attempt so the planner
+or time — either axis — is pre-empted at the head of its next attempt so the planner
 re-allocates instead. **Known and recorded (F63): that trigger fired 0 times across 18
 archived spines / 54 steps** (near misses 0.35–0.45) — the threshold is arbiter territory,
-deliberately not fitted to those points. The ONE-replan ceiling is unchanged.
+deliberately not fitted to those points. It is no longer inert: it fires on real runs (F85).
+
+**The meter REPORTS progress; it never decides on it (F85).** The firing condition above is
+the whole trigger — a progress term inside it would let a governance instrument over an
+operator-owned allowance judge capability, and a converging step that is eating the run is
+still stopped. What the meter says about the work is a MEASURED reading, not an assertion: the
+`variance` spine record gains `trend` (`converging | flat | unknown`), `motion`, `reading` and
+`series` beside its unchanged `step`/`iteration`/`threshold`/`moneyShare`/`timeShare`/`axis`,
+and the escalation `detail` (which the replan brief quotes) ends with that same `reading` as a
+second, separate claim — "it was stopped for eating the run" and "here is what it achieved" are
+different statements. All of it is read off the SAME `src/trend.js` instance the money and wall
+halts read — one reader, so the meter and the halts can never disagree, and `unknown` stays
+`unknown` when the close reported no number (F6). This
+replaces a fixed sentence ("with its exits unmoved") that used to print on every variance stop
+whatever had happened; a consumer parsing that string will not find it.
+
+**The replan ceiling is no longer flatly ONE.** A SECOND `step-variance` stop earns exactly one
+more replan when the run's own reading is mechanically `converging`; it is granted by the
+ARBITER off that same reader, bounded by a latch rather than a counter compared against a
+limit, so it cannot creep — a third variance stop is the stop however well the run is going.
+`flat` and `unknown` stop exactly as before, and an exhaustion or stall stop past the ceiling
+is unchanged. The agent has no channel to it: it never asks, is never offered it, and cannot
+influence it (no self-adjusted budgets, ever). Observable on the spine as ADDED fields, never
+repurposed ones: `replan` records carry `replan: <n>` and — only on a granted one — `granted:
+"converging"`, and `plan-executed` carries `replans` beside the unchanged `replanned` boolean.
+
+**Both of those count the RUN, not the leg — the ceiling spans a resume chain.** `replanned`
+and `replans` were locals in `runPlan`, and a resume is another `runPlan` call, so a kill used
+to hand the next leg a fresh allowance of an allowance that is the RUN's by doctrine (measured:
+leg 1 replanned and stopped, leg 2 replanned twice more — a run total of 2 with every record
+showing 1). **`plan-executed.replans` therefore now means the CHAIN total**; if you parse spines,
+re-read that field. Each leg DECLARES what it inherited on its own `job-start` — new fields
+`priorReplans` and `priorReplanGrantUsed`, present only when there is a fold — and the next
+reader adds only its own window's `replan` records, exactly the way `priorSpentUsd` folds money.
+The grant latch travels beside the count rather than being derived from it (`1` + `false` is a
+real state: an ordinary ceiling spent, the arbiter's extra still unearned). The leg's own number
+is not lost — a leg emits one `replan` record per replan it drafts, so `chain −
+records-in-this-window` is the fold it inherited. You seed it with `resumeReplans` (below);
+omitted is the cold path and byte-identical to a run nobody resumed.
 
 **Per-step model tiers — `providerFor` (P).** A plan step may declare a `model` TIER
-(`sonnet` \| `haiku`, `STEP_MODELS`). The tier menu is signed into the schema; mapping a tier
-onto a real model (and any per-model provider params) is the RUNNER's territory, so both
+(`sonnet`, `STEP_MODELS` — `haiku` removed 2026-08-06 as a reversible attribution probe,
+F87; the field stays legal and one-token reversible, and the narrowing binds only what the
+AGENT may express, never what the operator may run).
+The tier menu is signed into the schema; mapping a tier
+onto a real model (and any per-model provider params) is the RUNNER's territory — nothing
+forces the `sonnet` tier onto any particular model, and running haiku as your default worker
+model stays an operator choice the plan menu never governed — so both
 `runJob` and `runPlan` take `providerFor?: (tier: string) => provider`. It is called ONLY for
 a step that declared a tier, once per such step — the scout, the plan drafter and every
 untiered step stay on `opts.provider`, so a caller that never plans tiers can omit it
@@ -792,7 +908,7 @@ their next green, not repaired.
 door**: before the clock, before the close precheck, before any token. On a pass, the
 **newest** version's plan rides into the FIRST drafting prompt as a starting draft
 (`bridge-loaded {name, versions, runid}` on the spine) and everything after it is the
-ordinary shipped path — same validator, same redraft-on-reds, same ONE-replan ceiling, and a
+ordinary shipped path — same validator, same redraft-on-reds, the same replan ceiling, and a
 **replan never re-injects the bridge** (it drafts from the run's own state). On a fail the
 run returns the distinct terminal **`recipe-stale`** with `bridge-gate {outcome, name, reds}`
 and a decision-ready escalation, having spent nothing. **Falling back to cold is the
@@ -950,7 +1066,8 @@ semantics are byte-unchanged (PRD v1.46 §3):
   implicit try opened at `job-start`, through the same window machinery rather than a second
   reader. Without it such a spine is honestly refused (`started: false`), which is what a
   reuse runner needs. `job-start` carries the DECLARED fold (`priorSpentUsd` with its
-  `priorSpendComplete`, and `priorWallMs`, each present only when there is one) exactly as
+  `priorSpendComplete`, `priorWallMs`, and `priorReplans` with its `priorReplanGrantUsed`, each
+  present only when there is one) exactly as
   `try-start` does, so a chain of resumes adds only each attempt's own new rounds instead of
   re-deriving and double-billing. **An inherited FLOOR is one** even when the money it qualifies
   is `$0`: a leg whose every round came back unpriced folds nothing countable and is still not
@@ -1018,6 +1135,23 @@ and is re-signed.
   that re-grades an unchanged tree is flat on its own evidence while the RUN — what the
   top-up decision is actually about — may have been converging when the money ran out. See
   the trend section above for what the seed does and, deliberately, does not touch.
+- **Its REPLAN LEDGER comes with it too — and this one is a BOUND, not a readout.**
+  `restart.replans` / `restart.replanGrantUsed` ride into `runJob`/`runPlan` as **`resumeReplans`**
+  (`{count, grantUsed} | null`), seeding the replan ceiling instead of leaving it reborn per call.
+  Without it a kill refilled an allowance PRD v1.12 makes the RUN's — measured, a leg that spent
+  both replans and step-redded handed its checkpoint to a second leg that replanned twice more.
+  **It deliberately does NOT use `resumeGrades`' mechanism.** The grade seed reads ONE spine, so a
+  resume of a resume inherits the previous leg's grades and not the whole chain; that shortening is
+  fail-safe for a READOUT (it can only under-claim a direction) and is the DANGEROUS direction for
+  a ceiling, where an under-claimed ledger is a refilled allowance and every kill buys one. So this
+  seed follows the MONEY fold: each leg declares `priorReplans`/`priorReplanGrantUsed` on its own
+  spine and the next reader adds only its own window, so leg 3 inherits the whole chain. It is also
+  not the same class as the trend's ITERATIONS, which `src/trend.js` refuses to seed on purpose: an
+  attempt allowance is a LEG bound bought with the leg's own money, while a replan ceiling bounds
+  how many times the WORKFLOW may be redrawn, which is the run's span. Belted like every declared
+  fold — a garbage, non-finite or negative `count` reads as `0` rather than widening the ceiling.
+  Null/omitted is the cold path. The disarm control is pinned: a resumed leg with an UNSPENT
+  ceiling still replans, so the bound is bounded, not switched off.
 - **Under the REMAINDER, never a fresh allotment.** The killed attempt's spend and wall
   FOLD IN (`runJob`'s `priorSpentUsd`/`priorSpendComplete`/`priorWallMs`, `createClock`'s
   `priorElapsedMs`), so
@@ -1080,9 +1214,13 @@ the same corpus), and `seq` continues monotonically across appends. Keys are
 across runs dedupes and distinct bugs in one verb don't merge. Classes, worst-first
 (`LEDGER_CLASSES`, frozen): `silent-degradation` (a failed `primitive-smoke` — the class
 failures can't derive), `runtime-red`, `provider-red`, `pricing-red` (F6), possibly-dormant
-`capability-gap` (cap-halt + request-red in one spine), `broken-close` (consumer-attributed),
+`capability-gap` (cap-halt + request-red in one spine — one row per `(verb, lib)`, never per
+verb, so two territories asking for one verb string stay two rows rather than collapsing onto
+whichever territory was seen first), `broken-close` (consumer-attributed),
 `request-red` (admission demand for a locked verb — keyed on the red's structured
-`verb` field, prose-quoted verb as legacy fallback), `retention-red`, `config-red`
+`verb` field, prose-quoted verb as legacy fallback; both classes take their `lib` from the
+red's own stamp, so neither seeds an upstream ask for a bareloop-catalogue refusal),
+`retention-red`, `config-red`
 (drafting friction — attributed to bareloop's own schema/prompt). Deliberate exclusions
 (`EXCLUDED_ESCALATIONS`, a runtime set — anything outside classified ∪ excluded is
 counted as unmapped, never dropped): `cap-halt`/`wall-halt` (budget stories, money and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",