bareloop 0.7.0 → 0.8.0

package/src/reuse.js

@@ -594,7 +594,11 @@ function readGradeSeed(seen) {
  * **The declared fold, not a re-derivation.** A restarted try's own `try-start`
  * carries the fold it inherited (`priorSpentUsd`/`priorWallMs`), so a resume OF a
  * resume adds only its own new rounds. Re-deriving from the whole file would bill an
- * abandoned attempt twice.
+ * abandoned attempt twice. The REPLAN ledger (`priorReplans`/`priorReplanGrantUsed`)
+ * folds on this same mechanism and deliberately not on `readGradeSeed`'s: a grade seed
+ * feeds a readout, so its documented one-leg-per-resume shortening can only under-claim
+ * a direction, while an under-claimed CEILING is a refilled allowance and every kill
+ * would buy one (PRD v1.12 — the replan bound is the RUN's).
  *
  * **KNOWN LIMIT, stated rather than discovered later.** A call that was killed BEFORE it
  * returned left no event at all — no `worker-round`, no `selection-result` — so money it
@@ -688,6 +692,19 @@ export function readResume(events, { deathAt = null, direct = false, resumableOu
     // declaration existed, or a try nobody resumed — both are honestly zero.
     declaredRounds: !('priorRounds' in ev) ? 0
       : (typeof ev.priorRounds === 'number' && Number.isFinite(ev.priorRounds) && ev.priorRounds >= 0 ? ev.priorRounds : null),
+    // the REPLAN ledger this attempt was already carrying, on the same declared-fold
+    // mechanism and with the same `> 0` belt as the money. It has to fold this way
+    // rather than the grade seed's way: `readGradeSeed`'s chain shortens by one leg
+    // per resume, which under-claims — harmless for a readout, and for a CEILING an
+    // under-claim IS a refilled allowance, one per kill (PRD v1.12).
+    declaredReplans: typeof ev.priorReplans === 'number' && Number.isFinite(ev.priorReplans) && ev.priorReplans > 0 ? Math.floor(ev.priorReplans) : 0,
+    // the F85-C latch rides BESIDE the count, never derived from it: a chain can have
+    // spent the ordinary ceiling with the arbiter's one extra still unearned, and
+    // deriving one from the other would collapse those two states into one
+    declaredGrantUsed: ev.priorReplanGrantUsed === true,
+    // this window's OWN replans, counted from the records the runner emits — the same
+    // `replan` event a human reads, so the ledger and the log cannot disagree
+    windowReplans: 0, windowGrantUsed: false,
     roundsUsd: 0, roundsComplete: true, r1Written: false, jobEnd: null,
     /** @type {any[]} the window's own events, so the SAME `readTry` the live loop uses
      * reads a graded-but-unrecorded try — never a second reader spelling it differently */
@@ -745,6 +762,16 @@ export function readResume(events, { deathAt = null, direct = false, resumableOu
       open.jobEnd = ev;
     } else if (ev.type === 'bridge-write') {
       open.r1Written = true;
+    } else if (ev.type === 'replan') {
+      // ONE record per replan the runner drafts, so counting them IS the leg's ledger
+      // — never re-derived from `plan-accepted` (a resumed leg emits one of those for a
+      // plan it RELOADED, which would read as a redraft nobody paid for).
+      open.windowReplans += 1;
+      // the arbiter stamps `granted` only on the extra it granted past the ordinary
+      // ceiling, and stamps nothing on the ordinary one — so PRESENCE is the whole
+      // signal, and reading it by presence keeps this reader honest about a reading it
+      // does not itself make (never re-deciding whether the trend deserved it).
+      if (ev.granted !== undefined) open.windowGrantUsed = true;
     } else if (ev.type === 'try-end') {
       completed.push({ ...ev, seq: undefined, ts: undefined, inherited: true });
       if (open.bridge) tried.push(open.bridge);
@@ -815,6 +842,19 @@ export function readResume(events, { deathAt = null, direct = false, resumableOu
         // restart already re-graded that tree. Counting both would enter the same
         // reading twice and flatten a chain that moved.
         grades: readGradeSeed(open.seen),
+        // the REPLAN ledger, folded like the money one line below and deliberately
+        // NOT like the grades one line above. A grade seed feeds a READOUT and its
+        // documented shortening chain can only under-claim a direction; this feeds a
+        // BOUND, where under-claiming is a refilled allowance and every kill would buy
+        // one (PRD v1.12: unlimited replanning launders thrash as adaptation). So it
+        // reads the declared fold plus THIS window's own records — the same arithmetic
+        // as `priorSpentUsd`, which is what makes a resume of a resume inherit leg 1.
+        //
+        // The abandoned windows are not read, for the money's exact reason: the
+        // restart DECLARED what it inherited, so counting the window it abandoned
+        // would charge the chain twice for one leg's replans.
+        replans: open.declaredReplans + open.windowReplans,
+        replanGrantUsed: open.declaredGrantUsed || open.windowGrantUsed,
         priorSpentUsd: open.declaredSpentUsd + open.roundsUsd,
         // F83 — was that fold EXACT? Three sources, because `runJob` decides the same
         // question from more than this window can see (src/run.js: `!unpriced &&
@@ -1017,7 +1057,7 @@ export async function runReuse(opts) {
   const runid = opts.runid ?? Date.now().toString(36);
   const resume = isObj(opts.resume) ? /** @type {any} */ (opts.resume) : null;
   /** a try that inherits nothing: the ordinary, non-resumed attempt */
-  const NO_PRIOR = { spentUsd: 0, wallMs: 0, spendComplete: true, rounds: /** @type {number|null} */ (0), grades: /** @type {any[]} */ ([]) };
+  const NO_PRIOR = { spentUsd: 0, wallMs: 0, spendComplete: true, rounds: /** @type {number|null} */ (0), grades: /** @type {any[]} */ ([]), replans: 0, replanGrantUsed: false };
 
   /** @type {any[]} */
   const tries = [];
@@ -1113,7 +1153,7 @@ export async function runReuse(opts) {
 
   /** the shared per-try execution: run the job, read the spine, write the box (R1).
    * @param {any|null} bridge @param {number} n
-   * @param {{spentUsd: number, wallMs: number, spendComplete: boolean, rounds: number|null, grades: any[]}} [prior]
+   * @param {{spentUsd: number, wallMs: number, spendComplete: boolean, rounds: number|null, grades: any[], replans: number, replanGrantUsed: boolean}} [prior]
    *   RESUME — what a KILLED attempt of this same try already consumed, and what it
    *   already measured. Money and wall are FOLDED into the attempt (`runJob`'s own ledger
    *   and clock start partly spent) rather than shrinking the caps, so the signed per-try
@@ -1121,7 +1161,10 @@ export async function runReuse(opts) {
    *   way but on the ROW alone (nothing enforces a round bound here), and `null` — an
    *   attempt whose turns could not be counted — is reported, never folded. `grades` are
    *   the close readings that leg recorded, handed on as the run trend's BASELINES: they
-   *   feed the HALT READOUT alone and spend none of this attempt's bounds.
+   *   feed the HALT READOUT alone and spend none of this attempt's bounds. `replans` /
+   *   `replanGrantUsed` are the opposite kind of inheritance and sit here for that
+   *   contrast: they SPEND a bound (the plan flow's replan ceiling), because that ceiling
+   *   is the RUN's by doctrine and a fresh one per kill is the creep v1.12 forbids.
    * @param {any} [seed] RESUME (v2) — WHERE that attempt was killed (`readResume`'s
    *   `restart.seed`): the plan it accepted and the steps it finished. The fold says how
    *   much of the try's allowance is gone; this says how much of its WORK is done, so the
@@ -1142,6 +1185,15 @@ export async function runReuse(opts) {
       // means "a spine older than this field", and a reader that cannot tell that from a
       // predecessor's honest unknown would launder the unknown into a zero (F6).
       ...(resumed ? { priorSpentUsd: prior.spentUsd, priorWallMs: prior.wallMs, priorSpendComplete: prior.spendComplete, priorRounds: prior.rounds, resumedFrom: resume?.fromRunid ?? runid } : {}),
+      // the REPLAN ledger, declared on the same record and for the same reason as the
+      // money: the next reader adds only its own window's `replan` records to this
+      // number, so a chain of resumes folds once instead of restarting the ceiling at
+      // whichever leg it happens to be reading (PRD v1.12 — the bound is the RUN's).
+      // Declared independently of `resumed`, which is a MONEY/WALL test: a leg can
+      // replan without buying a round the fold would notice, and gating the ledger on
+      // the wallet would drop it exactly there. Only when there is one to state — a
+      // decorative zero is indistinguishable from a leg nobody folded.
+      ...(prior.replans > 0 ? { priorReplans: prior.replans, priorReplanGrantUsed: prior.replanGrantUsed } : {}),
       // WHERE it picks up, on the row's own record: a try that restarts at step 3 of 4 is
       // a materially different attempt from one that restarts at its beginning, and a
       // reader must not have to infer which happened from the absence of a scout.
@@ -1173,6 +1225,11 @@ export async function runReuse(opts) {
         // restarted leg would report `flat` on a run that was converging. Only when there
         // ARE grades: an empty array is the cold path, and the cold path stays identical.
         ...(prior.grades.length ? { resumeGrades: prior.grades } : {}),
+        // and the replan LEDGER. Same omission class as the two above, with a sharper
+        // cost: a grade seam that never arrives makes a readout say `flat`, while a
+        // ceiling that never arrives is spent by the dead leg and fresh in this one —
+        // a bound the operator signed, widened by a kill (PRD v1.12).
+        ...(prior.replans > 0 ? { resumeReplans: { count: prior.replans, grantUsed: prior.replanGrantUsed } } : {}),
         ...(seed ? { resumeSeed: seed } : {}),
         bridge,
       });
@@ -1446,6 +1503,12 @@ export async function runReuse(opts) {
         // this run make progress" and "is this loop out of ideas" are two questions,
         // and one instrument answering both is how they come to disagree.
         grades: Array.isArray(rs.grades) ? rs.grades : [],
+        // the replan LEDGER the chain has spent — belted like the money and NOT like
+        // the grades, because this one seeds a BOUND: a garbage or negative figure
+        // that read through as a widening is the ceiling being refilled by a corrupt
+        // spine (PRD v1.12). The latch rides beside the count, never derived from it.
+        replans: typeof rs.replans === 'number' && Number.isFinite(rs.replans) && rs.replans > 0 ? Math.floor(rs.replans) : 0,
+        replanGrantUsed: rs.replanGrantUsed === true,
       }
       : NO_PRIOR;
     const remainingCapUsd = envelope.perTryBudgetUsd - prior.spentUsd;

package/src/run.js

@@ -116,6 +116,15 @@ async function primitiveSmoke(workdir) {
  *   chain, not just the leg: without them a leg that re-grades an unchanged tree reports
  *   `flat` — "revise the goal" — on a run that was converging when the money ran out.
  *   Counts and stage names only; no close bytes cross this seam. Absent is the cold path.
+ * @param {{count?: number, grantUsed?: boolean}|null} [opts.resumeReplans] RESUME — the
+ *   replan LEDGER the chain has already spent (`readResume`'s `restart.replans` /
+ *   `restart.replanGrantUsed`), forwarded to the plan flow, which seeds its ceiling with
+ *   it. Its sibling above feeds a READOUT; this one feeds a BOUND, and that is the whole
+ *   difference: `replanned`/`varianceGrantUsed` are locals in `runPlan`, so without this
+ *   every kill hands the next leg a fresh allowance of an allowance PRD v1.12 makes the
+ *   RUN's ("unlimited replanning launders thrash as adaptation"). It also rides onto this
+ *   run's `job-start` as `priorReplans`, the declared-fold precedent `priorSpentUsd`
+ *   already sets, so a resume OF a resume folds once. Absent is the cold path.
  * @param {boolean} [opts.layerRoot=false] Layer R (within-run ratchet) — shell
  *        territory, threaded to the plan flow. Defaults OFF
  *        (decided 2026-07-21): fixation is extinct on every current job (F41), so
@@ -128,7 +137,7 @@ async function primitiveSmoke(workdir) {
  *   'close-red' | 'close-unsupported' | 'recipe-stale' | 'pricing-red' | 'provider-red' |
  *   'interpreter-red' | 'cap-halt' | 'wall-halt' | 'step-stalled' | `step-red:<id>`
  */
-export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, layerRoot = false, bridge = null, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [] }) {
+export async function runJob(rawSpec, { approvals, workdir, provider, nativeProvider, providerFor, emit, capRuns = 3, strikeLimit, shellCapUsd = 2, closeTimeoutMs, layerRoot = false, bridge = null, priorSpentUsd = 0, priorSpendComplete = true, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null }) {
   // 0. the ledger's counters, declared FIRST so that every job-end — including
   // the pre-token reds below — can state a real figure. An omitted `spentUsd` is
   // not a zero: a consumer reads `undefined` and either crashes or launders it
@@ -204,6 +213,16 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
     // it inherited, and it is the only field that can carry it forward.
     ...(spentUsd > 0 || priorFloor ? { priorSpentUsd: spentUsd, priorSpendComplete: !priorFloor } : {}),
     ...(typeof priorWallMs === 'number' && Number.isFinite(priorWallMs) && priorWallMs > 0 ? { priorWallMs } : {}),
+    // the REPLAN ledger, on the same declaration and for the same reason — a chain of
+    // resumes must fold once. This is the DIRECT-spine half of it: `readResume`'s
+    // `direct` mode opens its one implicit window on `job-start` and reads the fold off
+    // these very fields, so a U-path run resumed twice inherits leg 1's replans rather
+    // than restarting the ceiling at leg 2's window (PRD v1.12). Emitted only when there
+    // is one — a decorative `0` is indistinguishable from a run nobody folded, and the
+    // grant latch travels beside the count rather than being derived from it.
+    ...(typeof resumeReplans?.count === 'number' && Number.isFinite(resumeReplans.count) && resumeReplans.count > 0
+      ? { priorReplans: Math.floor(resumeReplans.count), priorReplanGrantUsed: resumeReplans.grantUsed === true }
+      : {}),
   });
 
   // 2. known-answer smoke before tokens (A3: silent degradation throws nothing)
@@ -256,7 +275,7 @@ export async function runJob(rawSpec, { approvals, workdir, provider, nativeProv
   // accounts it natively (F12) and the job-end money contract is unchanged.
   {
     const outcome = await runPlan(job, {
-      workdir, provider, nativeProvider, providerFor, emit: meter, capRuns, ...(strikeLimit !== undefined ? { strikeLimit } : {}), closeTimeoutMs, layerRoot, bridge, priorWallMs, resumeSeed, resumeGrades,
+      workdir, provider, nativeProvider, providerFor, emit: meter, capRuns, ...(strikeLimit !== undefined ? { strikeLimit } : {}), closeTimeoutMs, layerRoot, bridge, priorWallMs, resumeSeed, resumeGrades, resumeReplans,
       remainingUsd: () => Math.min(shellCapUsd, job.budgetUsd - spentUsd),
       isUnpriced: () => unpriced, // F6: let the plan flow bail in-flight, not just after it returns
       spendComplete, // …and let its money-halt readout say whether the remaining it quotes is exact

package/src/validate.js

@@ -155,3 +155,124 @@ export function sweepSecretLiterals(root, red) {
     }
   })(root, '');
 }
+
+// ── the catastrophic-backtracking reject (F49) ────────────────────────────────
+// Housed here, with the other primitives BOTH validators share, because THREE
+// regex fields reach an untimed evaluator and they are split across the two
+// documents: the agent's `artifact-written.pattern` (plan.js) and the
+// operator's `judged.pattern` + `gapKeep` (job.js). plan.js already imports
+// job.js, so job.js cannot import plan.js — and a second copy here would be the
+// drift class SECRET_PATTERNS exists to prevent: a shape one side rejects and
+// the other admits. ONE inventory, imported by both.
+
+/** Length of an UNBOUNDED quantifier token at `src[i]` (`*`, `+`, or `{n,}`,
+ * plus an optional trailing lazy `?`), or 0. Bounded forms (`?`, `{n}`,
+ * `{n,m}`) return 0: they cannot drive exponential backtracking (a bounded
+ * outer repeat is polynomial at worst, and the body is self-authored — F49).
+ * @param {string} src @param {number} i */
+function unboundedQuantLen(src, i) {
+  let len = src[i] === '*' || src[i] === '+' ? 1 : 0;
+  if (!len && src[i] === '{') { const m = /^\{\d+,\}/.exec(src.slice(i)); if (m) len = m[0].length; }
+  if (len && src[i + len] === '?') len++; // the lazy modifier is part of the same token
+  return len;
+}
+
+/**
+ * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
+ * unbounded quantifier applied to a group whose body itself repeats unboundedly
+ * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
+ * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
+ * and is caught by propagating the inner repeat up through the wrapper. Such a
+ * pattern can hang `RegExp.test` for seconds on a short crafted body, and THREE
+ * fields feed it to an evaluator with NO timeout — one per document:
+ *   - the AGENT's `artifact-written.pattern`, run by `evalExits` (F49, the
+ *     original site). Self-DoS only: the agent authors both the pattern and
+ *     (via the worker) the artifact, so a hang burns only its own run's
+ *     wall-clock, and there is no arbiter compromise — it cannot escape the
+ *     fence, forge a green, or leak a secret.
+ *   - the OPERATOR's `judged.pattern` (`runClose`) and `gapKeep` (`boundGap`),
+ *     compiled and run against close output in BARELOOP'S OWN PROCESS. These
+ *     are worse than an operator self-DoS, and the reason is F67's lesson: the
+ *     regex blocks the MAIN EVENT LOOP, so the in-process stall fuse — a timer
+ *     in that same loop — cannot fire. The run dies to the OUTSIDE watchdog and
+ *     is read as a model stall, so a bad regex in a SIGNED spec presents as a
+ *     provider problem. MEASURED: `boundGap(stream, '(a+)+$')` on a 40-char
+ *     body does not finish in 20s.
+ * So the reject targets the dominant exponential class and fails it as a
+ * mechanical gap at the validation gate, before any tokens burn. A full ReDoS
+ * analyzer needs a real regex engine (an external native dep we do not take for
+ * a LOW issue); exotic overlapping-alternation blowup is out of scope by
+ * decision (PARKED to the close-authoring rung — PRD v1.55).
+ *
+ * SCOPE IS ASYMMETRIC, both directions named on purpose:
+ *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
+ *     detected — there is no inner QUANTIFIER to find, so the shape scan cannot
+ *     see it; the blowup comes from overlapping alternation BRANCHES under a
+ *     repeat. A genuine limit of the approach, not a bug in it. Widening the
+ *     detector changes which SIGNED specs are admissible, which is
+ *     arbiter-adjacent — parked, not chased (PRD v1.55).
+ *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
+ *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
+ *     though a real engine runs it linearly — the scan sees the nested-quantifier
+ *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
+ *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
+ *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
+ *     Detecting "safe because anchored" needs the same real engine we declined,
+ *     and guessing it wrong would ADMIT an exponential pattern — so the shape
+ *     reject stands, and the over-rejection is a named, accepted limitation.
+ *
+ * The input is guaranteed to compile as a RegExp (checked first by the caller),
+ * so this scan assumes valid, balanced JS regex syntax.
+ * @param {string} src a compiled regex source string
+ * @returns {boolean} true iff a nested unbounded quantifier is present
+ */
+export function hasNestedQuantifier(src) {
+  /** @type {{ quant: boolean }[]} */
+  const stack = [];
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (c === '\\') { i++; continue; }          // escaped atom — the next char is a literal
+    if (c === '[') {                            // character class: quantifier chars inside are literals
+      i++;
+      if (src[i] === '^') i++;
+      // NO POSIX leading-`]`-is-a-literal rule: JS is not POSIX here. `[]` is the
+      // EMPTY class (matches nothing) and `[^]` the any-char idiom — both close at
+      // that first `]`. Skipping it ran the scan past the class's real end and
+      // swallowed every quantifier after it, so `x[^](a+)+$` read as safe while
+      // RegExp.test on it does not finish in 15s on a 31-char body. A false
+      // NEGATIVE is the dangerous direction (F49), so the scan follows JS.
+      //
+      // Honest limit on the monotonicity claim: this is a PARSE correction, not
+      // the "add rejections only" tightening F49's rule contemplates, and it is
+      // not strictly rejection-monotonic. Measured over 14,862 compilable
+      // generated patterns (2,369 previously rejected): 2 rejections disappear,
+      // both pathological `[]`-bearing shapes whose old `true` came from the very
+      // misparse being fixed, and both verified to finish RegExp.test in ~0ms.
+      // Every entry of the checked-in REDOS_BAD/GOOD/OVERREJECTED corpus is
+      // unchanged. So no real hazard was un-rejected — but the claim is
+      // "measured, no hazard lost", never "monotonic by construction".
+      while (i < src.length && src[i] !== ']') { if (src[i] === '\\') i++; i++; }
+      continue;
+    }
+    if (c === '(') { stack.push({ quant: false }); continue; }
+    if (c === ')') {
+      const g = stack.pop();
+      const qlen = unboundedQuantLen(src, i + 1);
+      if (g && g.quant && qlen) return true;    // group repeats unboundedly AND its body did too
+      // The group is an unbounded-repeated atom of its parent when it is directly
+      // re-quantified (qlen) OR its own body already repeats unboundedly (g.quant):
+      // a redundant wrapper — ((a+))+ , (?:(a+))* , (((\d*)))+ — is the SAME
+      // exponential class as (a+)+, so an inner repeat must propagate THROUGH the
+      // enclosing group or the outer quantifier's close never sees it. Propagation
+      // is MONOTONIC (it only ever SETS quant=true → only ever adds rejections): it
+      // can widen over-rejection — the named FAIL-SAFE direction — but can never
+      // introduce a false negative, which is the dangerous one (F49).
+      if ((qlen || (g && g.quant)) && stack.length) stack[stack.length - 1].quant = true;
+      i += qlen;
+      continue;
+    }
+    const qlen = unboundedQuantLen(src, i);     // a quantifier applying to the preceding atom, inside the current group
+    if (qlen) { if (stack.length) stack[stack.length - 1].quant = true; i += qlen - 1; }
+  }
+  return false;
+}

package/types/exits.d.ts

@@ -36,6 +36,20 @@ export function evalExits(exits: Array<Record<string, any>>, { dir, snapshot, ru
     pass: boolean;
     results: ExitResult[];
 }>;
+/** The check gap is ALREADY bounded upstream by runClose's boundGap (head +
+ * gapKeep block ≤ 8192 + tail ≈ 10KB, with the failing-test NAMES preserved).
+ * The evaluator must NOT re-truncate it: a 400-char clamp deletes exactly those
+ * `not ok`/`FAILED` names — the mechanical gap the F46 conversion mechanism
+ * feeds the worker (F28 reintroduced). This cap is a defensive backstop above
+ * boundGap's own envelope: a normal bounded gap passes through intact, and only
+ * a pathological seam that returned an unbounded gap would ever be trimmed.
+ *
+ * Exported for the ONE reason `boundGap`/`GAP_KEEP_TRIM_MARKER` are (src/ralph.js):
+ * the replan brief re-bounds this same artifact one seam later (`closeGapBlock`), and
+ * a second hand-spelled ceiling there would be a second answer to "how big may a
+ * check gap be" — the two would drift on exactly the property that matters, whether
+ * the `not ok`/`FAILED` names survive. */
+export const CHECK_GAP_MAX: 12000;
 /**
  * `fault` present means the INSTRUMENT could not judge (unwired snapshot/seam,
  * a check in runClose's forbidden zone) — it carries the runClose verdict name

package/types/job.d.ts

@@ -1,4 +1,9 @@
-/** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red — `verb` rides request-reds as structured data (the ledger keys on it, never on prose) */
+/** @typedef {{code: string, path: string, detail?: string, verb?: string, lib?: string}} Red — `verb` and `lib` ride request-reds as structured data (the ledger keys on them, never on prose).
+ * `lib` is the TERRITORY the demand lands against, stamped HERE at the emit site
+ * (the typed-lib rule): one code, two catalogues — a locked TOOL verb is demand
+ * against the worker-surface package, a locked VERDICT type is demand against
+ * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
+ * filed as an upstream bug (the BA-2 misattribution class). */
 /**
  * Validate an operator-owned job spec (`schema: "job-v1"`). Never throws on
  * JSON text or plain parsed data — the ingest contract; a live object with a
@@ -165,11 +170,17 @@ export const PROVIDERS: readonly string[];
  * not duplicated here). */
 export const CONDITION_KEYS: readonly string[];
 /**
- * — `verb` rides request-reds as structured data (the ledger keys on it, never on prose)
+ * — `verb` and `lib` ride request-reds as structured data (the ledger keys on them, never on prose).
+ * `lib` is the TERRITORY the demand lands against, stamped HERE at the emit site
+ * (the typed-lib rule): one code, two catalogues — a locked TOOL verb is demand
+ * against the worker-surface package, a locked VERDICT type is demand against
+ * bareloop's OWN menu. Inferring it downstream is how a bareloop refusal gets
+ * filed as an upstream bug (the BA-2 misattribution class).
  */
 export type Red = {
     code: string;
     path: string;
     detail?: string;
     verb?: string;
+    lib?: string;
 };

package/types/plan.d.ts

@@ -24,42 +24,6 @@
  * @returns {string[]} the offerable scopes, deduped, shallowest-first, capped
  */
 export function legalScopes(writeScope: string[], dirs?: string[], cap?: number): string[];
-/**
- * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
- * unbounded quantifier applied to a group whose body itself repeats unboundedly
- * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
- * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
- * and is caught by propagating the inner repeat up through the wrapper. Such a
- * pattern can hang `RegExp.test` for
- * seconds on a short crafted body, and `evalExits` runs the agent-authored
- * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
- * authors both the pattern and (via the worker) the artifact, so a hang burns
- * only its own run's wall-clock; there is NO arbiter compromise (it cannot
- * escape the fence, forge a green, or leak a secret). So the reject targets the
- * dominant exponential class and fails it as a mechanical gap at the validation
- * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
- * (an external native dep we do not take for a LOW issue); exotic
- * overlapping-alternation blowup is out of scope by decision.
- *
- * SCOPE IS ASYMMETRIC, both directions named on purpose:
- *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
- *     detected — out of scope (self-DoS only, no arbiter compromise).
- *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
- *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
- *     though a real engine runs it linearly — the scan sees the nested-quantifier
- *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
- *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
- *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
- *     Detecting "safe because anchored" needs the same real engine we declined,
- *     and guessing it wrong would ADMIT an exponential pattern — so the shape
- *     reject stands, and the over-rejection is a named, accepted limitation.
- *
- * The input is guaranteed to compile as a RegExp (checked first by the caller),
- * so this scan assumes valid, balanced JS regex syntax.
- * @param {string} src a compiled regex source string
- * @returns {boolean} true iff a nested unbounded quantifier is present
- */
-export function hasNestedQuantifier(src: string): boolean;
 /**
  * The close, as the ordered STAGE LIST the plan flow actually executes (PRD
  * v1.28). A staged close is already that list; the legacy object form is the
@@ -135,7 +99,6 @@ export const MAX_EXITS_PER_STEP: 2;
 /** plan size bound — per-step rounds bound the spend, but an unbounded step
  * COUNT is still an unbounded claim on the wallet; same 8 as loop.maxIterations */
 export const MAX_PLAN_STEPS: 8;
-export { WRITE_VERBS };
 /** scope-menu bound: the menu is a PROMPT ingredient on every draft and
  * redraft, so an unbounded repo would price the drafting call by its directory
  * count. Shallow entries survive the cap (see `legalScopes`) because they are
@@ -145,7 +108,27 @@ export const MAX_SCOPE_MENU: 24;
  * construction — the agent picks a tier, never names an arbitrary model string
  * (the tier→model mapping and any effort params are the RUNNER's, per provider).
  * opus is deliberately absent: reserved for fresh builds hamr explicitly assigns,
- * never plan-selectable. */
+ * never plan-selectable.
+ *
+ * 2026-08-06 — haiku dropped, on hamr's order: "haiku should be dropped to see if
+ * it passes, if it's agent poor work or harness, like always." This is a REVERSIBLE
+ * ATTRIBUTION PROBE, not a finding that haiku is incapable. What the $0 archive read
+ * (186 spines / 71 accepted plans / 255 steps) actually shows is a CONFOUND, in both
+ * directions: only 20 steps ever declared a tier at all — haiku 12 (9 of them on a
+ * REPLANNED plan, 6 the LAST step of their plan, bounds 3–12 rounds, 2 ever green)
+ * against explicitly-declared sonnet 8 (bounds 14–32, 5 green). The planner picks
+ * haiku for steps it judges mechanical, and replanned steps sit on runs already in
+ * trouble, so neither column is a controlled read. All three bareagent-u runs of
+ * 2026-08-06 tiered the REPLANNED step down (haiku/6, haiku/8, haiku/12) and all
+ * three failed, against sonnet initial steps at 30–40 rounds — a confound sitting
+ * on the programme's most recent capability read. Removing the tier is how it gets
+ * attributed: with only one tier expressible, a still-failing replan is agent or
+ * harness, not the tier.
+ *
+ * The `model` FIELD and its validator branch stay: a one-entry menu means a plan (or
+ * a stored bridge) declaring `model:"sonnet"` still validates, and restoring haiku is
+ * a one-token edit. This narrows only what the AGENT may express — `--model haiku`
+ * remains the OPERATOR's probe knob (PRD v1.36), untouched in the runner scripts. */
 export const STEP_MODELS: readonly string[];
 export type Red = {
     code: string;
@@ -154,3 +137,5 @@ export type Red = {
     verb?: string;
 };
 import { WRITE_VERBS } from './job.js';
+import { hasNestedQuantifier } from './validate.js';
+export { WRITE_VERBS, hasNestedQuantifier };

package/types/planrun.d.ts

@@ -1,21 +1,83 @@
 /**
- * Files named in an exit gap that the step's worker never wrote — the mechanical
- * fact behind the prose-prohibition trap (u-msdpuaej, 2026-08-03): a drafter wrote
- * "do not modify any file outside X" into a step whose exit check judges the whole
- * goal, the worker obeyed, and the replanner — handed the gap AND the stall note —
- * rebuilt the same shape, because inferring "the exit reds on files this step never
- * touched" is exactly the semantic leap that fails (F38: mechanical gaps convert,
- * semantic ones stall; 3/3 across the mailbox class). This computes that fact from
- * the two books that already exist: path-like tokens in the gap text (extension
- * required — a bare `step/two` is not a file claim) suffix-matched against the F32
- * write audit's absolute paths. Advisory-only and fail-safe: extraction that finds
- * nothing yields no line, never a guess.
+ * This step's own last EXIT results, rendered for the REPLAN brief.
  *
- * @param {string | undefined} gap the step's last exit gap text
- * @param {string[] | undefined} writes the step's cumulative write-audit paths
- * @returns {string[]} gap-named files with no matching write, in gap order
+ * The label says exits and not "the close", and the distinction is the whole of one
+ * fix: `res.gap` is `lastGap`, the join of EVERY failing exit's detail in exit order.
+ * With `MAX_EXITS_PER_STEP` at 2 and the mandatory `tree-changed` pairing on a write
+ * step, a step that wrote nothing leads the block with the EVALUATOR's own prose
+ * (`0 files changed under src/** …`) — captured verbatim from a real replan prompt,
+ * under a label reading "the verification's own output". The close stage's output is
+ * one of the details here, never reliably all of them. The payload is left alone: "the
+ * step wrote nothing" is exactly what a replanner should be told, and stripping it to
+ * make an old label true would trade a real fact for a tidy sentence.
+ *
+ * u-mshcpdg4: a run one strict error from done, killed with $1.10 and 82 seconds
+ * unspent. The close named the remaining work exactly — `src/recurse.js(978,115)`
+ * — and the worker read that every attempt. The REPLANNER, which is the component
+ * that chooses which files the next plan targets, was handed only the trend line
+ * (`still progressing — typecheck 30 → 15 → 15 → 1`): converging, and silent about
+ * WHERE. It re-targeted `src/loop.js`, already at zero errors; that step wrote
+ * nothing and struck out. F85 gave the brief the trajectory; this gives it the
+ * artifact the trajectory is a summary OF.
+ *
+ * Handed over as TEXT, never as a parsed file list, and the trap is worth naming
+ * because the parse is the obvious-looking fix: line 1 of that very gap reads
+ * `reports 1 error(s) in src/recurse.js, src/loop.js` — every file in SCOPE — and
+ * only line 2 names the culprit. The `never wrote` advisory that used to sit here
+ * did exactly that parse, and on this gap it resolved to `src/loop.js` — the file
+ * already CLEAN — then said so as a directive beside the artifact that said the
+ * opposite. It was deleted with this change (hamr, 2026-08-05): two readers of one
+ * question, the parsed one wrong, is the same failure the variance meter just had.
+ * Nothing generic can tell a summary line from a detail line, and the
+ * shapes differ per close anyway (tsc file:line, pytest test ids, a count close
+ * that names no file at all). A model reading the artifact can make that
+ * distinction; a regex reproduces the bug. So: no extraction, no digest, no
+ * inference — the artifact, bounded and scrubbed.
+ *
+ * Two boundaries, both reused rather than respelled:
+ *   - SCRUB. A prompt is an egress point and this repo has ONE secret inventory
+ *     (`SECRET_PATTERNS` via `redactSecrets`). The gap arrives already scrubbed
+ *     from `judge`, which makes this defense in depth rather than the only guard —
+ *     and defense in depth at the egress is exactly where it belongs, because the
+ *     next caller of this helper will not remember the upstream one.
+ *   - BOUND, and it is a BACKSTOP rather than an envelope. What arrives here has
+ *     ALREADY been bounded: `runClose` ran `boundGap` with the stage's own `gapKeep`,
+ *     which deliberately rescues the `not ok`/`FAILED` names out of the elided middle
+ *     — the mechanical gap F46's conversion mechanism feeds the worker. Re-bounding
+ *     that with a fresh 400/1500 envelope deletes exactly those names a second time,
+ *     which is F28 reintroduced; measured on a 120-red-line close output, the first
+ *     bound rescued 78 names and this one dropped 12 of them. src/exits.js states the
+ *     same rule for the same artifact one seam earlier, and this now uses ITS number:
+ *     `CHECK_GAP_MAX`, imported rather than respelled, so the two seams cannot drift
+ *     on how big a check gap may be. Under it the gap passes through VERBATIM.
+ *
+ *     A backstop is still needed, and the headroom is why the ceiling is not smaller.
+ *     `res.gap` is `lastGap`, the JOIN of up to `MAX_EXITS_PER_STEP` failing exit
+ *     details, and the check-passes branch slices EACH at `CHECK_GAP_MAX` — so what
+ *     arrives is bounded per detail, never in total. Measured, the real maximum is
+ *     comfortably under: `runClose`'s own envelope tops out at ~10.1KB (400 head +
+ *     8192 keep + 1500 tail + labels), and joined with a `tree-changed` line that is
+ *     ~10.2KB, so the shipped path passes through untouched with ~1.8KB to spare. The
+ *     backstop therefore fires only where src/exits.js says it should: a seam that
+ *     returned something never bounded at all.
+ *
+ *     Over the line `boundGap` runs with `REPLAN_GAP_KEEP`, the same envelope the
+ *     close path uses, and every trim announces itself (F28). Note what that keep-set
+ *     cannot do: `\S` matches every non-blank line, so the keep block degenerates into
+ *     "the first 50 lines" and re-surfaces nothing from the middle. That is the honest
+ *     limit of a red-set that cannot know the stage's own pattern (see
+ *     `REPLAN_GAP_KEEP`), and it is affordable precisely because it now applies only
+ *     to a gap nothing upstream ever bounded — on that gap ANY envelope loses names,
+ *     and the choice is a bounded prompt over an unbounded one.
+ *
+ * No gap → the empty string, so the brief renders byte-identically to the pre-F86
+ * one. A labelled empty section would be an invitation to explain an absence the
+ * run never observed (a stall never judged its exits at all).
+ *
+ * @param {string | null | undefined} gap the step's last exit gap text
+ * @returns {string} the labelled block, or '' when there is nothing to show
  */
-export function gapFilesNeverWritten(gap: string | undefined, writes: string[] | undefined): string[];
+export function closeGapBlock(gap: string | null | undefined): string;
 /**
  * The plan-drafting prompt: a schema DESCRIPTION built from the live validator
  * menus — never a copyable example (the drafter must author, not echo; the
@@ -147,6 +209,40 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   `flat` — "revise the goal" — on a run that was converging when its allowance ran
  *   out. Baselines only (src/trend.js's THE SEED): it spends none of this leg's own
  *   bounds and mints none of its strikes. Empty/omitted is the cold path.
+ * @param {{count?: number, grantUsed?: boolean}|null} [opts.resumeReplans] RESUME — the
+ *   replan LEDGER the chain has already spent (`readResume`'s `restart.replans` /
+ *   `restart.replanGrantUsed`), seeding the ceiling below. `resumeGrades`' sibling and
+ *   deliberately NOT its twin: a grade seed feeds a READOUT, this one feeds a BOUND.
+ *
+ *   Without it the ceiling is reborn on every call, and a resume is another call:
+ *   measured, a leg that spent both replans and step-redded handed its checkpoint to a
+ *   second leg that replanned twice more. Two became four by being killed once, which is
+ *   the creep the latch exists to make impossible ("unlimited replanning launders thrash
+ *   as adaptation", PRD v1.12).
+ *
+ *   WHY THIS SEED SPENDS THE LEG'S BOUND WHERE `resumeGrades` DOES NOT. src/trend.js's
+ *   THE SEED refuses to seed the fix loop's ITERATIONS from history "because the leg's
+ *   own bounds must not be spent by history" — and that is right, because an attempt
+ *   allowance is a LEG bound: a restarted leg buys its own attempts with its own money.
+ *   The replan ceiling is a RUN bound by doctrine. It bounds how many times the WORKFLOW
+ *   may be redrawn before redrawing it is thrash, and that question spans exactly the
+ *   chain the halt readout already spans. The two seeds therefore disagree on purpose;
+ *   they are not the same rule applied inconsistently.
+ *
+ *   CHAIN SEMANTICS, and the one place this differs from the grade seed's mechanism.
+ *   `readGradeSeed`'s documented KNOWN LIMIT is that it reads ONE spine, so a resume of a
+ *   resume inherits leg 2's grades and not leg 1's — the chain shortens by one leg per
+ *   resume, which is fail-safe for a READOUT (a shorter chain can only under-claim a
+ *   direction). It is the DANGEROUS direction for a ceiling: an under-claimed ledger is a
+ *   refilled allowance, and every kill would buy one. So this seed does NOT reuse that
+ *   mechanism. It follows the MONEY fold instead (`priorSpentUsd`, `try-start`/
+ *   `job-start`): each leg DECLARES the ledger it inherited on its own spine, and the
+ *   next reader adds only that leg's own `replan` records to the declared number. Leg 3
+ *   therefore inherits the whole chain, not leg 2's slice.
+ *
+ *   `count` seeds `replans` (and, above zero, latches `replanned`); `grantUsed` seeds the
+ *   F85-C variance latch, so a killed leg cannot re-earn an extra the arbiter has already
+ *   granted. Null/omitted is the cold path and is byte-identical to a run nobody resumed.
  * @param {() => boolean} [opts.spendComplete] is the run's spend EXACT, or a floor? The
  *   ledger one level up owns the answer (unpriced rounds, a self-healed stall, a mid-call
  *   cut, an inherited resume floor); the money-halt readout states it beside the remaining
@@ -161,7 +257,7 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' | 'step-stalled' |
  *   `step-red:<id>`
  */
-export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, maxStepRounds, layerRoot, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades }: {
+export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, maxStepRounds, layerRoot, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades, resumeReplans }: {
     workdir: string;
     provider: any;
     nativeProvider?: ((o: {
@@ -187,6 +283,10 @@ export function runPlan(job: any, { workdir, provider, nativeProvider, providerF
         stage?: string | null;
         value?: number | null;
     }[] | undefined;
+    resumeReplans?: {
+        count?: number;
+        grantUsed?: boolean;
+    } | null | undefined;
     spendComplete?: (() => boolean) | undefined;
     now?: (() => number) | undefined;
 }): Promise<string>;

package/types/ralph.d.ts

@@ -111,6 +111,22 @@ export function runStages(stages: any[], redact?: (s: string) => string, { timeo
     timeoutMs?: number;
     cwd?: string;
 }): Promise<any>;
+/**
+ * Bound an over-long close stream to a head sample + elided middle + tail. When
+ * `keepPattern` is set (F28), lines of the WHOLE stream matching it are also
+ * carried in a clearly-delimited block between head and tail — capped — so the
+ * failing-test names buried in the middle still reach the worker.
+ * Exported for the ONE reason `GAP_KEEP_TRIM_MARKER` above is: a second consumer
+ * that needs a gap bounded must reuse THIS envelope, not spell its own. A private
+ * copy would be a second truncation scheme, and the two would drift on exactly the
+ * property that matters — whether the red lines survive, and whether the trim
+ * announces itself (F28: silent truncation is the disease this function cures).
+ * The close path is unchanged: `runClose` still calls it with the stage's own
+ * `gapKeep`, byte-identically.
+ * @param {string} s the (redacted) close output
+ * @param {string} [keepPattern] regex source; matching lines survive the elision
+ */
+export function boundGap(s: string, keepPattern?: string): string;
 /**
  * The exhaustion-by-PROGRESS seam, as a contract rather than "whatever one module
  * happens to return". Two governors implement it and they read different signals —