bareloop 0.7.0 → 0.9.0

package/types/plan.d.ts

@@ -24,42 +24,6 @@
  * @returns {string[]} the offerable scopes, deduped, shallowest-first, capped
  */
 export function legalScopes(writeScope: string[], dirs?: string[], cap?: number): string[];
-/**
- * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
- * unbounded quantifier applied to a group whose body itself repeats unboundedly
- * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
- * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
- * and is caught by propagating the inner repeat up through the wrapper. Such a
- * pattern can hang `RegExp.test` for
- * seconds on a short crafted body, and `evalExits` runs the agent-authored
- * `artifact-written` pattern with NO timeout. This is self-DoS only — the agent
- * authors both the pattern and (via the worker) the artifact, so a hang burns
- * only its own run's wall-clock; there is NO arbiter compromise (it cannot
- * escape the fence, forge a green, or leak a secret). So the reject targets the
- * dominant exponential class and fails it as a mechanical gap at the validation
- * gate, before any tokens burn. A full ReDoS analyzer needs a real regex engine
- * (an external native dep we do not take for a LOW issue); exotic
- * overlapping-alternation blowup is out of scope by decision.
- *
- * SCOPE IS ASYMMETRIC, both directions named on purpose:
- *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
- *     detected — out of scope (self-DoS only, no arbiter compromise).
- *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
- *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
- *     though a real engine runs it linearly — the scan sees the nested-quantifier
- *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
- *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
- *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
- *     Detecting "safe because anchored" needs the same real engine we declined,
- *     and guessing it wrong would ADMIT an exponential pattern — so the shape
- *     reject stands, and the over-rejection is a named, accepted limitation.
- *
- * The input is guaranteed to compile as a RegExp (checked first by the caller),
- * so this scan assumes valid, balanced JS regex syntax.
- * @param {string} src a compiled regex source string
- * @returns {boolean} true iff a nested unbounded quantifier is present
- */
-export function hasNestedQuantifier(src: string): boolean;
 /**
  * The close, as the ordered STAGE LIST the plan flow actually executes (PRD
  * v1.28). A staged close is already that list; the legacy object form is the
@@ -84,6 +48,24 @@ export function hasNestedQuantifier(src: string): boolean;
  * @returns {any[]|null} the stage list, or null when the close names no command
  */
 export function stageClose(close: any): any[] | null;
+/**
+ * THE ONE STAGING, one level up: a job's close stages, from EITHER of the two
+ * fields a spec may carry.
+ *
+ * `stageClose` reads a command close; `declaredStages` reads an authored
+ * declaration (M4). A spec declares exactly one of them — the job validator reds
+ * `close-duplicated` on both — so this is a selection, never a merge.
+ *
+ * Every consumer calls THIS rather than `stageClose` directly, for the reason
+ * W4 wrote `stageClose` in the first place: the drafting prompt, the plan
+ * validator, the runner, the bridge registry and the reuse envelope must all see
+ * the same stage list, and a consumer that reads only `close` sees a declared
+ * job as having no close at all — an empty check menu offered to a drafter whose
+ * plan the validator would then red for referencing a stage nobody offered.
+ * @param {any} job the job spec, any shape
+ * @returns {any[]|null} the stage list, or null when the job names no close
+ */
+export function closeStagesOf(job: any): any[] | null;
 /** @typedef {{code: string, path: string, detail?: string, verb?: string}} Red */
 /**
  * Validate an agent-authored plan (`schema: "plan-v1"`) against the SIGNED
@@ -135,7 +117,6 @@ export const MAX_EXITS_PER_STEP: 2;
 /** plan size bound — per-step rounds bound the spend, but an unbounded step
  * COUNT is still an unbounded claim on the wallet; same 8 as loop.maxIterations */
 export const MAX_PLAN_STEPS: 8;
-export { WRITE_VERBS };
 /** scope-menu bound: the menu is a PROMPT ingredient on every draft and
  * redraft, so an unbounded repo would price the drafting call by its directory
  * count. Shallow entries survive the cap (see `legalScopes`) because they are
@@ -145,7 +126,27 @@ export const MAX_SCOPE_MENU: 24;
  * construction — the agent picks a tier, never names an arbitrary model string
  * (the tier→model mapping and any effort params are the RUNNER's, per provider).
  * opus is deliberately absent: reserved for fresh builds hamr explicitly assigns,
- * never plan-selectable. */
+ * never plan-selectable.
+ *
+ * 2026-08-06 — haiku dropped, on hamr's order: "haiku should be dropped to see if
+ * it passes, if it's agent poor work or harness, like always." This is a REVERSIBLE
+ * ATTRIBUTION PROBE, not a finding that haiku is incapable. What the $0 archive read
+ * (186 spines / 71 accepted plans / 255 steps) actually shows is a CONFOUND, in both
+ * directions: only 20 steps ever declared a tier at all — haiku 12 (9 of them on a
+ * REPLANNED plan, 6 the LAST step of their plan, bounds 3–12 rounds, 2 ever green)
+ * against explicitly-declared sonnet 8 (bounds 14–32, 5 green). The planner picks
+ * haiku for steps it judges mechanical, and replanned steps sit on runs already in
+ * trouble, so neither column is a controlled read. All three bareagent-u runs of
+ * 2026-08-06 tiered the REPLANNED step down (haiku/6, haiku/8, haiku/12) and all
+ * three failed, against sonnet initial steps at 30–40 rounds — a confound sitting
+ * on the programme's most recent capability read. Removing the tier is how it gets
+ * attributed: with only one tier expressible, a still-failing replan is agent or
+ * harness, not the tier.
+ *
+ * The `model` FIELD and its validator branch stay: a one-entry menu means a plan (or
+ * a stored bridge) declaring `model:"sonnet"` still validates, and restoring haiku is
+ * a one-token edit. This narrows only what the AGENT may express — `--model haiku`
+ * remains the OPERATOR's probe knob (PRD v1.36), untouched in the runner scripts. */
 export const STEP_MODELS: readonly string[];
 export type Red = {
     code: string;
@@ -154,3 +155,5 @@ export type Red = {
     verb?: string;
 };
 import { WRITE_VERBS } from './job.js';
+import { hasNestedQuantifier } from './validate.js';
+export { WRITE_VERBS, hasNestedQuantifier };

package/types/planrun.d.ts

@@ -1,21 +1,83 @@
 /**
- * Files named in an exit gap that the step's worker never wrote — the mechanical
- * fact behind the prose-prohibition trap (u-msdpuaej, 2026-08-03): a drafter wrote
- * "do not modify any file outside X" into a step whose exit check judges the whole
- * goal, the worker obeyed, and the replanner — handed the gap AND the stall note —
- * rebuilt the same shape, because inferring "the exit reds on files this step never
- * touched" is exactly the semantic leap that fails (F38: mechanical gaps convert,
- * semantic ones stall; 3/3 across the mailbox class). This computes that fact from
- * the two books that already exist: path-like tokens in the gap text (extension
- * required — a bare `step/two` is not a file claim) suffix-matched against the F32
- * write audit's absolute paths. Advisory-only and fail-safe: extraction that finds
- * nothing yields no line, never a guess.
+ * This step's own last EXIT results, rendered for the REPLAN brief.
  *
- * @param {string | undefined} gap the step's last exit gap text
- * @param {string[] | undefined} writes the step's cumulative write-audit paths
- * @returns {string[]} gap-named files with no matching write, in gap order
+ * The label says exits and not "the close", and the distinction is the whole of one
+ * fix: `res.gap` is `lastGap`, the join of EVERY failing exit's detail in exit order.
+ * With `MAX_EXITS_PER_STEP` at 2 and the mandatory `tree-changed` pairing on a write
+ * step, a step that wrote nothing leads the block with the EVALUATOR's own prose
+ * (`0 files changed under src/** …`) — captured verbatim from a real replan prompt,
+ * under a label reading "the verification's own output". The close stage's output is
+ * one of the details here, never reliably all of them. The payload is left alone: "the
+ * step wrote nothing" is exactly what a replanner should be told, and stripping it to
+ * make an old label true would trade a real fact for a tidy sentence.
+ *
+ * u-mshcpdg4: a run one strict error from done, killed with $1.10 and 82 seconds
+ * unspent. The close named the remaining work exactly — `src/recurse.js(978,115)`
+ * — and the worker read that every attempt. The REPLANNER, which is the component
+ * that chooses which files the next plan targets, was handed only the trend line
+ * (`still progressing — typecheck 30 → 15 → 15 → 1`): converging, and silent about
+ * WHERE. It re-targeted `src/loop.js`, already at zero errors; that step wrote
+ * nothing and struck out. F85 gave the brief the trajectory; this gives it the
+ * artifact the trajectory is a summary OF.
+ *
+ * Handed over as TEXT, never as a parsed file list, and the trap is worth naming
+ * because the parse is the obvious-looking fix: line 1 of that very gap reads
+ * `reports 1 error(s) in src/recurse.js, src/loop.js` — every file in SCOPE — and
+ * only line 2 names the culprit. The `never wrote` advisory that used to sit here
+ * did exactly that parse, and on this gap it resolved to `src/loop.js` — the file
+ * already CLEAN — then said so as a directive beside the artifact that said the
+ * opposite. It was deleted with this change (hamr, 2026-08-05): two readers of one
+ * question, the parsed one wrong, is the same failure the variance meter just had.
+ * Nothing generic can tell a summary line from a detail line, and the
+ * shapes differ per close anyway (tsc file:line, pytest test ids, a count close
+ * that names no file at all). A model reading the artifact can make that
+ * distinction; a regex reproduces the bug. So: no extraction, no digest, no
+ * inference — the artifact, bounded and scrubbed.
+ *
+ * Two boundaries, both reused rather than respelled:
+ *   - SCRUB. A prompt is an egress point and this repo has ONE secret inventory
+ *     (`SECRET_PATTERNS` via `redactSecrets`). The gap arrives already scrubbed
+ *     from `judge`, which makes this defense in depth rather than the only guard —
+ *     and defense in depth at the egress is exactly where it belongs, because the
+ *     next caller of this helper will not remember the upstream one.
+ *   - BOUND, and it is a BACKSTOP rather than an envelope. What arrives here has
+ *     ALREADY been bounded: `runClose` ran `boundGap` with the stage's own `gapKeep`,
+ *     which deliberately rescues the `not ok`/`FAILED` names out of the elided middle
+ *     — the mechanical gap F46's conversion mechanism feeds the worker. Re-bounding
+ *     that with a fresh 400/1500 envelope deletes exactly those names a second time,
+ *     which is F28 reintroduced; measured on a 120-red-line close output, the first
+ *     bound rescued 78 names and this one dropped 12 of them. src/exits.js states the
+ *     same rule for the same artifact one seam earlier, and this now uses ITS number:
+ *     `CHECK_GAP_MAX`, imported rather than respelled, so the two seams cannot drift
+ *     on how big a check gap may be. Under it the gap passes through VERBATIM.
+ *
+ *     A backstop is still needed, and the headroom is why the ceiling is not smaller.
+ *     `res.gap` is `lastGap`, the JOIN of up to `MAX_EXITS_PER_STEP` failing exit
+ *     details, and the check-passes branch slices EACH at `CHECK_GAP_MAX` — so what
+ *     arrives is bounded per detail, never in total. Measured, the real maximum is
+ *     comfortably under: `runClose`'s own envelope tops out at ~10.1KB (400 head +
+ *     8192 keep + 1500 tail + labels), and joined with a `tree-changed` line that is
+ *     ~10.2KB, so the shipped path passes through untouched with ~1.8KB to spare. The
+ *     backstop therefore fires only where src/exits.js says it should: a seam that
+ *     returned something never bounded at all.
+ *
+ *     Over the line `boundGap` runs with `REPLAN_GAP_KEEP`, the same envelope the
+ *     close path uses, and every trim announces itself (F28). Note what that keep-set
+ *     cannot do: `\S` matches every non-blank line, so the keep block degenerates into
+ *     "the first 50 lines" and re-surfaces nothing from the middle. That is the honest
+ *     limit of a red-set that cannot know the stage's own pattern (see
+ *     `REPLAN_GAP_KEEP`), and it is affordable precisely because it now applies only
+ *     to a gap nothing upstream ever bounded — on that gap ANY envelope loses names,
+ *     and the choice is a bounded prompt over an unbounded one.
+ *
+ * No gap → the empty string, so the brief renders byte-identically to the pre-F86
+ * one. A labelled empty section would be an invitation to explain an absence the
+ * run never observed (a stall never judged its exits at all).
+ *
+ * @param {string | null | undefined} gap the step's last exit gap text
+ * @returns {string} the labelled block, or '' when there is nothing to show
  */
-export function gapFilesNeverWritten(gap: string | undefined, writes: string[] | undefined): string[];
+export function closeGapBlock(gap: string | null | undefined): string;
 /**
  * The plan-drafting prompt: a schema DESCRIPTION built from the live validator
  * menus — never a copyable example (the drafter must author, not echo; the
@@ -147,6 +209,40 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   `flat` — "revise the goal" — on a run that was converging when its allowance ran
  *   out. Baselines only (src/trend.js's THE SEED): it spends none of this leg's own
  *   bounds and mints none of its strikes. Empty/omitted is the cold path.
+ * @param {{count?: number, grantUsed?: boolean}|null} [opts.resumeReplans] RESUME — the
+ *   replan LEDGER the chain has already spent (`readResume`'s `restart.replans` /
+ *   `restart.replanGrantUsed`), seeding the ceiling below. `resumeGrades`' sibling and
+ *   deliberately NOT its twin: a grade seed feeds a READOUT, this one feeds a BOUND.
+ *
+ *   Without it the ceiling is reborn on every call, and a resume is another call:
+ *   measured, a leg that spent both replans and step-redded handed its checkpoint to a
+ *   second leg that replanned twice more. Two became four by being killed once, which is
+ *   the creep the latch exists to make impossible ("unlimited replanning launders thrash
+ *   as adaptation", PRD v1.12).
+ *
+ *   WHY THIS SEED SPENDS THE LEG'S BOUND WHERE `resumeGrades` DOES NOT. src/trend.js's
+ *   THE SEED refuses to seed the fix loop's ITERATIONS from history "because the leg's
+ *   own bounds must not be spent by history" — and that is right, because an attempt
+ *   allowance is a LEG bound: a restarted leg buys its own attempts with its own money.
+ *   The replan ceiling is a RUN bound by doctrine. It bounds how many times the WORKFLOW
+ *   may be redrawn before redrawing it is thrash, and that question spans exactly the
+ *   chain the halt readout already spans. The two seeds therefore disagree on purpose;
+ *   they are not the same rule applied inconsistently.
+ *
+ *   CHAIN SEMANTICS, and the one place this differs from the grade seed's mechanism.
+ *   `readGradeSeed`'s documented KNOWN LIMIT is that it reads ONE spine, so a resume of a
+ *   resume inherits leg 2's grades and not leg 1's — the chain shortens by one leg per
+ *   resume, which is fail-safe for a READOUT (a shorter chain can only under-claim a
+ *   direction). It is the DANGEROUS direction for a ceiling: an under-claimed ledger is a
+ *   refilled allowance, and every kill would buy one. So this seed does NOT reuse that
+ *   mechanism. It follows the MONEY fold instead (`priorSpentUsd`, `try-start`/
+ *   `job-start`): each leg DECLARES the ledger it inherited on its own spine, and the
+ *   next reader adds only that leg's own `replan` records to the declared number. Leg 3
+ *   therefore inherits the whole chain, not leg 2's slice.
+ *
+ *   `count` seeds `replans` (and, above zero, latches `replanned`); `grantUsed` seeds the
+ *   F85-C variance latch, so a killed leg cannot re-earn an extra the arbiter has already
+ *   granted. Null/omitted is the cold path and is byte-identical to a run nobody resumed.
  * @param {() => boolean} [opts.spendComplete] is the run's spend EXACT, or a floor? The
  *   ledger one level up owns the answer (unpriced rounds, a self-healed stall, a mid-call
  *   cut, an inherited resume floor); the money-halt readout states it beside the remaining
@@ -156,12 +252,18 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   default; a caller supplies this to drive time deterministically (the same seam `createClock`
  *   already exposes — a run's terminal cannot otherwise be exercised without waiting out a cap
  *   whose floor is one close timeout).
+ * @param {string|null} [opts.resumeBranch] RESUME — the WORK BRANCH the killed leg
+ *   recorded on its own spine (`readResume`'s `restart.branch`, off the `work-branch`
+ *   event). With it the resume returns to the branch its own work is sitting on; without
+ *   it the deterministic name would collide with that very branch and the collision walk
+ *   would mint a `-2` beside the progress the resume exists to keep. Absent is the cold
+ *   path. A recorded branch that no longer exists is a STOP, never a fresh start.
  * @returns {Promise<string>} 'green' | 'already-green' | 'escalated' | 'plan-red' |
  *   'check-red' | 'close-red' | 'close-unsupported' | 'recipe-stale' | 'pricing-red' |
- *   'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' | 'step-stalled' |
- *   `step-red:<id>`
+ *   'branch-red' | 'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' |
+ *   'step-stalled' | `step-red:<id>`
  */
-export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, maxStepRounds, layerRoot, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades }: {
+export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, maxStepRounds, layerRoot, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch }: {
     workdir: string;
     provider: any;
     nativeProvider?: ((o: {
@@ -187,8 +289,13 @@ export function runPlan(job: any, { workdir, provider, nativeProvider, providerF
         stage?: string | null;
         value?: number | null;
     }[] | undefined;
+    resumeReplans?: {
+        count?: number;
+        grantUsed?: boolean;
+    } | null | undefined;
     spendComplete?: (() => boolean) | undefined;
     now?: (() => number) | undefined;
+    resumeBranch?: string | null | undefined;
 }): Promise<string>;
 export type CategorizedError = Error & {
     category?: string;

package/types/ralph.d.ts

@@ -111,6 +111,22 @@ export function runStages(stages: any[], redact?: (s: string) => string, { timeo
     timeoutMs?: number;
     cwd?: string;
 }): Promise<any>;
+/**
+ * Bound an over-long close stream to a head sample + elided middle + tail. When
+ * `keepPattern` is set (F28), lines of the WHOLE stream matching it are also
+ * carried in a clearly-delimited block between head and tail — capped — so the
+ * failing-test names buried in the middle still reach the worker.
+ * Exported for the ONE reason `GAP_KEEP_TRIM_MARKER` above is: a second consumer
+ * that needs a gap bounded must reuse THIS envelope, not spell its own. A private
+ * copy would be a second truncation scheme, and the two would drift on exactly the
+ * property that matters — whether the red lines survive, and whether the trim
+ * announces itself (F28: silent truncation is the disease this function cures).
+ * The close path is unchanged: `runClose` still calls it with the stage's own
+ * `gapKeep`, byte-identically.
+ * @param {string} s the (redacted) close output
+ * @param {string} [keepPattern] regex source; matching lines survive the elision
+ */
+export function boundGap(s: string, keepPattern?: string): string;
 /**
  * The exhaustion-by-PROGRESS seam, as a contract rather than "whatever one module
  * happens to return". Two governors implement it and they read different signals —
@@ -256,6 +272,7 @@ export const CLOSE_ENV_DENY: Readonly<{
     prefixes: readonly string[];
     shape: RegExp;
 }>;
+export function stageGap(name: string, gap: string): string;
 export const GAP_KEEP_TRIM_MARKER: "more elided by the";
 /**
  * The forbidden zone, named (PRD v1.11). Each row is an outcome in which the

package/types/reuse.d.ts

@@ -174,7 +174,11 @@ export function selectBridge({ registry, job, ask, provider, pinned, shortlist,
  * **The declared fold, not a re-derivation.** A restarted try's own `try-start`
  * carries the fold it inherited (`priorSpentUsd`/`priorWallMs`), so a resume OF a
  * resume adds only its own new rounds. Re-deriving from the whole file would bill an
- * abandoned attempt twice.
+ * abandoned attempt twice. The REPLAN ledger (`priorReplans`/`priorReplanGrantUsed`)
+ * folds on this same mechanism and deliberately not on `readGradeSeed`'s: a grade seed
+ * feeds a readout, so its documented one-leg-per-resume shortening can only under-claim
+ * a direction, while an under-claimed CEILING is a refilled allowance and every kill
+ * would buy one (PRD v1.12 — the replan bound is the RUN's).
  *
  * **KNOWN LIMIT, stated rather than discovered later.** A call that was killed BEFORE it
  * returned left no event at all — no `worker-round`, no `selection-result` — so money it

package/types/run.d.ts

@@ -74,6 +74,22 @@
  *   chain, not just the leg: without them a leg that re-grades an unchanged tree reports
  *   `flat` — "revise the goal" — on a run that was converging when the money ran out.
  *   Counts and stage names only; no close bytes cross this seam. Absent is the cold path.
+ * @param {{count?: number, grantUsed?: boolean}|null} [opts.resumeReplans] RESUME — the
+ *   replan LEDGER the chain has already spent (`readResume`'s `restart.replans` /
+ *   `restart.replanGrantUsed`), forwarded to the plan flow, which seeds its ceiling with
+ *   it. Its sibling above feeds a READOUT; this one feeds a BOUND, and that is the whole
+ *   difference: `replanned`/`varianceGrantUsed` are locals in `runPlan`, so without this
+ *   every kill hands the next leg a fresh allowance of an allowance PRD v1.12 makes the
+ *   RUN's ("unlimited replanning launders thrash as adaptation"). It also rides onto this
+ *   run's `job-start` as `priorReplans`, the declared-fold precedent `priorSpentUsd`
+ *   already sets, so a resume OF a resume folds once. Absent is the cold path.
+ * @param {string|null} [opts.resumeBranch] RESUME — the WORK BRANCH the killed attempt
+ *   created and recorded on its own spine (`readResume`'s `restart.branch`). The branch
+ *   name is DERIVED from the signed spec and is therefore identical on every leg, so
+ *   without this the restart would collide with its own predecessor's branch and the
+ *   collision walk would mint a `-2` beside the work the resume exists to continue. The
+ *   fold's precedent exactly: the chain's state is DECLARED, never re-derived. Forwarded
+ *   verbatim to the plan flow; absent is the cold path.
  * @param {boolean} [opts.layerRoot=false] Layer R (within-run ratchet) — shell
  *        territory, threaded to the plan flow. Defaults OFF
  *        (decided 2026-07-21): fixation is extinct on every current job (F41), so
@@ -83,10 +99,10 @@
  *        binding.)
  * @returns {Promise<string>} outcome: 'green' | 'already-green' | 'escalated' |
  *   'unapproved-spec' | 'job-red' | 'smoke-red' | 'plan-red' | 'check-red' |
- *   'close-red' | 'close-unsupported' | 'recipe-stale' | 'pricing-red' | 'provider-red' |
+ *   'close-red' | 'close-unsupported' | 'recipe-stale' | 'branch-red' | 'pricing-red' | 'provider-red' |
  *   'interpreter-red' | 'cap-halt' | 'wall-halt' | 'step-stalled' | `step-red:<id>`
  */
-export function runJob(rawSpec: object | string, { approvals, workdir, provider, nativeProvider, providerFor, emit, capRuns, strikeLimit, shellCapUsd, closeTimeoutMs, layerRoot, bridge, priorSpentUsd, priorSpendComplete, priorWallMs, resumeSeed, resumeGrades }: {
+export function runJob(rawSpec: object | string, { approvals, workdir, provider, nativeProvider, providerFor, emit, capRuns, strikeLimit, shellCapUsd, closeTimeoutMs, layerRoot, bridge, priorSpentUsd, priorSpendComplete, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch }: {
     approvals: unknown;
     workdir: string;
     provider: any;
@@ -111,6 +127,11 @@ export function runJob(rawSpec: object | string, { approvals, workdir, provider,
         stage?: string | null;
         value?: number | null;
     }[] | undefined;
+    resumeReplans?: {
+        count?: number;
+        grantUsed?: boolean;
+    } | null | undefined;
+    resumeBranch?: string | null | undefined;
     layerRoot?: boolean | undefined;
 }): Promise<string>;
 export type Red = {

package/types/text.d.ts

@@ -33,3 +33,87 @@ export function priceOf(r: any): {
     costUsd: number | null;
     unpricedRounds: number;
 };
+/**
+ * ONE raw model emission, ready to persist.
+ *
+ * Three things happen here and NONE of them is optional at a call site:
+ *   - the text goes through the ONE redactor (`redactSecrets`, over the ONE
+ *     `SECRET_PATTERNS` inventory). A raw is the single most likely record in
+ *     this system to carry a live credential: it is whatever a model read out
+ *     of a repository, verbatim, and it lands in a file that outlives the run;
+ *   - it is BOUNDED, and the bound ANNOUNCES itself with the full size (F28 —
+ *     a bound eats detail, never evidence). The cut is decoded rather than
+ *     sliced so a multi-byte character is never split in half;
+ *   - it carries its own address: which call produced it (`label`, the same
+ *     spelling the cost book meters under) and which attempt (`attempt`), plus
+ *     the typed failure that describes it when there is one.
+ *
+ * `cause`/`reason` are `null` when the emission was fine — an ABSENT failure is
+ * absent, never an empty string that reads like a diagnosis nobody wrote.
+ * @param {{label: string, attempt: number, text: unknown, cause?: string|null,
+ *   reason?: string|null, cap?: number}} o
+ * @returns {{label: string, attempt: number, bytes: number, trimmed: boolean,
+ *   text: string, cause: string|null, reason: string|null}}
+ */
+export function scrubRaw({ label, attempt, text, cause, reason, cap }: {
+    label: string;
+    attempt: number;
+    text: unknown;
+    cause?: string | null;
+    reason?: string | null;
+    cap?: number;
+}): {
+    label: string;
+    attempt: number;
+    bytes: number;
+    trimmed: boolean;
+    text: string;
+    cause: string | null;
+    reason: string | null;
+};
+/**
+ * Stamp a persisted raw with the verdict that DESCRIBES it — through the same
+ * boundary the raw's own text rode.
+ *
+ * It exists because the verdict is not known when the raw is created: a writer
+ * records the emission the moment the call returns (so a metered call can never
+ * be missing its output), and only classifies it afterwards. The obvious
+ * shape — assigning `cause`/`reason` onto the stored object at that later
+ * point — writes an UNSCRUBBED string into a record that is already past the
+ * one redactor, and `reason` is the worst field to do it to: it quotes the
+ * transport's own error prose, which nobody in this repo wrote and nobody
+ * bounds. So the stamp is a function, not an assignment, and `scrubRaw` renders
+ * its own two fields through it: ONE place decides how a diagnosis becomes
+ * persistable, exactly as ONE place decides it for the text.
+ *
+ * `cause` is enumerated (`SURVEY_CAUSES`) and passes through untouched; a mask
+ * over a closed set would only hide a bug in the set.
+ * @template {{cause: string|null, reason: string|null}} T
+ * @param {T} raw @param {{cause?: string|null, reason?: string|null}} o @returns {T}
+ */
+export function stampRaw<T extends {
+    cause: string | null;
+    reason: string | null;
+}>(raw: T, { cause, reason }: {
+    cause?: string | null;
+    reason?: string | null;
+}): T;
+/**
+ * The ceiling on ONE persisted raw. Sized to the survey's own prompt-ingredient
+ * cap (`AUTHOR_SCOUT_BLOB_MAX`, 8000) rather than picked: the largest raw this
+ * repository produces is a survey, the archive's real surveys ran 5991-8056
+ * bytes, and a record that cannot hold one whole specimen cannot answer the
+ * question it exists for. The two constants are deliberately independent
+ * numbers — one bounds a PROMPT, this one bounds a RECORD.
+ */
+export const RAW_PERSIST_MAX: 8000;
+/**
+ * The announced-trim marker for a persisted raw. A NEW spelling rather than a
+ * reuse of `GAP_TRIM_MARKER` ('gap trimmed:'), and that is a decision, not
+ * decoration: `src/root.js` READS `GAP_TRIM_MARKER` to mean *this gap was cut,
+ * so Layer R must not compare it*, so a second producer of those bytes in a
+ * different population is exactly the F90 hazard — a reader must know every
+ * producer of its marker. Nothing reads this one yet; it exists so the trim
+ * announces itself (F28) and so a future reader has an unambiguous key.
+ */
+export const RAW_TRIM_MARKER: "raw trimmed:";

package/types/validate.d.ts

@@ -62,4 +62,54 @@ export function redactSecrets(raw: unknown): string;
  * @param {(code: string, path: string, detail?: string) => void} red
  */
 export function sweepSecretLiterals(root: any, red: (code: string, path: string, detail?: string) => void): void;
+/**
+ * F49 — a heuristic reject for the catastrophic-backtracking footgun: an
+ * unbounded quantifier applied to a group whose body itself repeats unboundedly
+ * (`(a+)+`, `(\d*)*`, `([a-z]+){1,}`) — including through a redundant wrapping
+ * group (`((a+))+`, `(?:(a+))*`), which is the SAME exponential class as `(a+)+`
+ * and is caught by propagating the inner repeat up through the wrapper. Such a
+ * pattern can hang `RegExp.test` for seconds on a short crafted body, and THREE
+ * fields feed it to an evaluator with NO timeout — one per document:
+ *   - the AGENT's `artifact-written.pattern`, run by `evalExits` (F49, the
+ *     original site). Self-DoS only: the agent authors both the pattern and
+ *     (via the worker) the artifact, so a hang burns only its own run's
+ *     wall-clock, and there is no arbiter compromise — it cannot escape the
+ *     fence, forge a green, or leak a secret.
+ *   - the OPERATOR's `judged.pattern` (`runClose`) and `gapKeep` (`boundGap`),
+ *     compiled and run against close output in BARELOOP'S OWN PROCESS. These
+ *     are worse than an operator self-DoS, and the reason is F67's lesson: the
+ *     regex blocks the MAIN EVENT LOOP, so the in-process stall fuse — a timer
+ *     in that same loop — cannot fire. The run dies to the OUTSIDE watchdog and
+ *     is read as a model stall, so a bad regex in a SIGNED spec presents as a
+ *     provider problem. MEASURED: `boundGap(stream, '(a+)+$')` on a 40-char
+ *     body does not finish in 20s.
+ * So the reject targets the dominant exponential class and fails it as a
+ * mechanical gap at the validation gate, before any tokens burn. A full ReDoS
+ * analyzer needs a real regex engine (an external native dep we do not take for
+ * a LOW issue); exotic overlapping-alternation blowup is out of scope by
+ * decision (PARKED to the close-authoring rung — PRD v1.55).
+ *
+ * SCOPE IS ASYMMETRIC, both directions named on purpose:
+ *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
+ *     detected — there is no inner QUANTIFIER to find, so the shape scan cannot
+ *     see it; the blowup comes from overlapping alternation BRANCHES under a
+ *     repeat. A genuine limit of the approach, not a bug in it. Widening the
+ *     detector changes which SIGNED specs are admissible, which is
+ *     arbiter-adjacent — parked, not chased (PRD v1.55).
+ *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
+ *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
+ *     though a real engine runs it linearly — the scan sees the nested-quantifier
+ *     SHAPE, not the disambiguation. Rejecting it is the FAIL-SAFE direction (it
+ *     never admits an unsafe pattern), and the cost is bounded: the plan drafter
+ *     gets a mechanical gap and rewrites (drop the outer `+`, or match once).
+ *     Detecting "safe because anchored" needs the same real engine we declined,
+ *     and guessing it wrong would ADMIT an exponential pattern — so the shape
+ *     reject stands, and the over-rejection is a named, accepted limitation.
+ *
+ * The input is guaranteed to compile as a RegExp (checked first by the caller),
+ * so this scan assumes valid, balanced JS regex syntax.
+ * @param {string} src a compiled regex source string
+ * @returns {boolean} true iff a nested unbounded quantifier is present
+ */
+export function hasNestedQuantifier(src: string): boolean;
 export const SECRET_PATTERNS: RegExp[];

package/types/workbranch.d.ts

@@ -0,0 +1,102 @@
+/**
+ * The branch name a job's run works on, DERIVED from the signed spec.
+ *
+ * **The source is `spec.job`, and the choice is load-bearing.** It is the one
+ * human-authored, REQUIRED, kebab-case name the spec carries; it is inside the
+ * spec hash, so the branch name cannot drift from what the operator signed; and
+ * it is stable across a resume and across a cold re-run of the same spec, which
+ * is precisely why the collision walk below has to exist. In practice it already
+ * reads as tool-and-problem (`bareagent-u-types`, `litectx-u-types`), which is
+ * the shape hamr's ruling asks for.
+ *
+ * **The goal prose was REJECTED as a source**, and not for tidiness: a goal is
+ * long, is edited freely between runs without changing what the job IS, and
+ * opens on boilerplate ("An existing pytest test suite for the SOAR
+ * orchestrator…"). Deriving from it would make the branch name unstable under
+ * edits that change nothing, and unreadable when it was stable. A run id was
+ * rejected by the ruling itself.
+ *
+ * Deterministic, pure, and total: any input yields a name matching
+ * `WORK_BRANCH_RE`, so a caller never has to check.
+ * @param {any} spec a job-v1 spec (validated or raw)
+ * @returns {string}
+ */
+export function workBranchName(spec: any): string;
+/**
+ * Put the run on its OWN branch, before it can touch any code.
+ *
+ * The three shapes, and each one's honest answer:
+ *
+ *  - **Cold.** `name` is free → create it at HEAD and switch. The handed branch
+ *    keeps its ref and its history; a new branch at HEAD moves no commit, so this
+ *    costs the patient nothing and changes nothing it can measure (the declared
+ *    close's seed is HEAD either way).
+ *  - **Cold, and the name is taken.** Suffix `-2`, `-3`… until one is free.
+ *    Deterministic given the repository, and it NEVER reuses another run's
+ *    branch — a second run of the same spec is a second blast radius.
+ *  - **Resume.** `resume` names the branch the killed leg recorded on its own
+ *    spine. It is checked out, never re-created and never suffixed: the work the
+ *    operator already paid for is sitting on it, and minting `-2` beside it would
+ *    strand exactly the progress a resume exists to keep. A `resume` branch that
+ *    is GONE is a STOP, never a silent fresh start — the run would be grading a
+ *    tree whose history it does not own.
+ *
+ * **Every failure is a stop with a name.** Not a git repository, no git on PATH,
+ * a checkout git refuses, a crowded namespace, a resume branch a human deleted:
+ * each comes back as `stop` and `branch: null`. There is no fallback to "just
+ * work on whatever was handed to us" anywhere in this function, because that
+ * fallback IS the thing the hard rule forbids.
+ *
+ * A DETACHED head is not a failure. Creating a branch from it is exactly the
+ * bounding the rule asks for (and it attaches a head that was floating), so it
+ * succeeds with `from: null` — there was no branch to be handed, and the record
+ * says so rather than inventing one.
+ *
+ * @param {string} workdir the patient (the fence's root)
+ * @param {object} o
+ * @param {string} o.name the derived name (`workBranchName`); refused unless it
+ *   matches `WORK_BRANCH_RE`, which is what makes `main` unreachable even from a
+ *   hand-passed argument
+ * @param {string|null} [o.resume] RESUME — the branch this run already owns
+ * @returns {Promise<{stop: string, branch: null}
+ *   | {stop: null, branch: string, created: boolean, resumed: boolean, from: string|null, base: string|null,
+ *      repo: string, collided: number}>}
+ */
+export function prepareWorkBranch(workdir: string, { name, resume }: {
+    name: string;
+    resume?: string | null | undefined;
+}): Promise<{
+    stop: string;
+    branch: null;
+} | {
+    stop: null;
+    branch: string;
+    created: boolean;
+    resumed: boolean;
+    from: string | null;
+    base: string | null;
+    repo: string;
+    collided: number;
+}>;
+/** Every work branch carries it. It is what makes `main`, `master` and every
+ * branch a human could plausibly have handed the run INEXPRESSIBLE as a work
+ * branch name — a structural guarantee rather than a denylist somebody has to
+ * keep current. */
+export const WORK_BRANCH_PREFIX: "bareloop-";
+/** The full legal shape of a work branch. Deliberately narrower than git's own
+ * `check-ref-format`: the kebab alphabet the job validator already holds every
+ * spec slug to (`src/job.js` SLUG_RE), plus the prefix. Everything git forbids —
+ * `..`, `@{`, a trailing `.lock`, a leading `-`, a `/` component, control
+ * characters — is unreachable inside it, so ref-safety is a property of the
+ * alphabet and never a sanitiser somebody has to remember to call. */
+export const WORK_BRANCH_RE: RegExp;
+/** The slug's ceiling, before any collision suffix. A ref component has a
+ * filesystem-length limit and a human scanning `git branch` has a much smaller
+ * one; 60 characters is longer than every job slug in `jobs/` and short enough
+ * to read in a column. */
+export const MAX_SLUG_LEN: 60;
+/** How far the collision walk goes before it STOPS and says so. A run that
+ * cannot find a free name in this many attempts is looking at a patient nobody
+ * has swept in a very long time, and silently walking to `-500` would be the
+ * runner papering over an operator problem. */
+export const MAX_BRANCH_COLLISIONS: 50;