bareloop 0.8.0 → 0.9.0

package/bareloop.context.md

@@ -98,6 +98,7 @@ the step plan at run time (gated by `validatePlan`); the human signs only:
 | `goal` | non-empty text | what the agent plans against |
 | `verdictType` | `green` \| `soft-green` \| `hitl` | declared radio, never inferred (`VERDICT_TYPES`, frozen). v1 ADMITS only `green`; declaring `soft-green`/`hitl` reds `request-red` with the type as a structured `verb` field (declared-but-locked — the tool-menu pattern). Every `request-red` also carries `lib` — the territory the demand lands against, stamped at the emit site (`verdictType` → `bareloop`, a locked tool verb → `bare-agent`): the ledger keys and its `suggestedAsk` seed on it, so a bareloop-catalogue refusal never files as an upstream ask |
 | `close` | **an ORDERED LIST of named stages** `[{ name, cmd, expect, judged?, gapKeep?, offer?, needs? }, ...]` (PRD v1.28), or a close object (table below) **only** for the declared-but-locked verdict classes | the destination, the only thing hand-authored; the check menu DERIVES from it (below). The plan flow executes a staged close directly and adapts a bare `predicate` object into a one-stage list; a `gold`/`rubric`/`hitl` object close validates (the declared-but-locked verdict classes still parse) but the plan flow refuses it at runtime as `close-unsupported` — it names no command to run |
+| `closeDecl` | **the AUTHORED close** `{ genre: "TYPES", lang: "js"\|"python", stages: [{ name, kind, params }], notes? }` | the ALTERNATIVE to `close`, and the point of the close-authoring rung: the user answers an interview and an LLM composes a DECLARATION over kinds whose implementations we own — never a script, never a shell fragment, never a new kind. **`close` and `closeDecl` are alternatives**: declaring both reds `close-duplicated` (two closes are two arbiters). It is HARD-class by construction (`CLASS_BY_CLOSE.declared`), so a locked verdict on one reds `close-hierarchy` as well as `request-red`. The declaration is validated by `validateCloseDecl`; the TREE-GROUNDED half of that gate (the path rule, and the scoped-job derivation that arms the F84 one-population law) is DEFERRED at spec-validation time — a job spec is validated with no repository in hand — and the runner re-runs it GROUNDED against the real seed before any stage and before any token. It stores the counting RULE and never a number (D12): there is no seed field, and `baseline: "seed"` is measured at each run's own HEAD |
 | `checks` | **RETIRED** (PRD v1.28/v1.32) | hand-authored checks are gone, not merely discouraged: declaring `checks` reds `checks-derived` by name. The check menu is DERIVED from the close's own stages instead — see **Staged close** below. The hazard this removes is measured, not theoretical: job #5's three hand-written checks were re-implementations of three stages the close already ran, and a hand-carved copy can drift LENIENT (the worker passes the operator's ruler and fails the real inspection) |
 | `tools` | optional unique subset of `TOOL_MENU` (14 verbs, below) | the CEILING every plan step's grant must fit inside (omitting it means the full menu — and the hash is taken over that RESOLVED form, so a `TOOL_MENU` widening flips an omitted-`tools` spec's hash and forces a re-sign; see `jobSpecHash`, MED-1); `run` is `LOCKED_TOOLS` and reds `request-red` — locked-but-listed, and the red IS the admission evidence the ledger tallies (a typo stays `invalid-value`). A ceiling of write-class and store-class verbs ONLY reds `invalid-value`: the scout surveys read-only, so it would be handed an empty menu and survey blind |
 
@@ -306,9 +307,12 @@ on refusals). It binds WRITES, not observations: on the exit side it fires only
 the narrow one does), and `artifact-written`/`json-valid` paths carry no step-scope red at
 all — the evaluator asks nothing about who wrote the file, so naming a prior step's artifact
 is legal and satisfiable. `job-invalid` — a plan validated against a
-missing or non-plan-shape job fails CLOSED). `stageClose(close)` is the ONE staging
-every check-menu consumer shares (array → itself; legacy object predicate → its
-one-stage list, named `close`; gold/rubric/hitl → null). The `secret-literal` sweep is
+missing or non-plan-shape job fails CLOSED). `closeStagesOf(job)` is the ONE staging
+every check-menu consumer shares — it reads whichever close field the spec carries:
+`closeDecl` → its declared stages (each enriched with the arbiter's own `gapKeep`), else
+`stageClose(close)` (array → itself; legacy object predicate → its one-stage list, named
+`close`; gold/rubric/hitl → null). A consumer reading `close` alone would see a declared
+job as closeless and offer the drafter an empty check menu. The `secret-literal` sweep is
 defense-in-depth against known token shapes — env-only loading remains the law, not the
 sweep.
 
@@ -449,7 +453,117 @@ retired-but-accepted, so a plan carries no iteration bound to check; `scopes` is
 `tree-changed` scope menu — the array of scope strings the drafter prompt listed, which
 `runJob`/`runPlan` build internally from the signed fence plus the real directories beneath
 it (a direct `validatePlan` caller may pass its own array); omitted, it derives from the
-signed `writeScope` alone, never a free-text fallback. Menus exported: `EXIT_TYPES`, `MAX_EXITS_PER_STEP`, `MAX_PLAN_STEPS`, `WRITE_VERBS` — plus `stageClose`.
+signed `writeScope` alone, never a free-text fallback. Menus exported: `EXIT_TYPES`, `MAX_EXITS_PER_STEP`, `MAX_PLAN_STEPS`, `WRITE_VERBS` — plus `stageClose` and `closeStagesOf`.
+
+### Close authoring — the user declares what done means (`src/kinds.js`, `src/authoring.js`, `src/authorscout.js`, `src/authorflow.js`, `src/declaredclose.js`, `src/authorjob.js`)
+
+The one layer where a human still wrote code. A close used to be a hand-written script
+per patient; now the user PICKS A VERDICT CLASS, answers that class's questions, and an LLM
+composes a DECLARATION over kinds whose implementations bareloop owns. **v1 admits exactly
+ONE genre** (`TYPES`: a type checker stops complaining without breaking the tests) and
+exactly one verdict class (`green`) — everything else refuses honestly, and every refusal
+is COUNTED.
+
+**The verdict class is the USER's answer (PRD v1.57 §1), and it DRIVES the authoring.**
+`verdictType` is a declared radio the preflight validates, never inferred:
+`VERDICT_CLASSES` = `green` | `soft-green` | `hitl`, with `LOCKED_CLASSES` =
+`soft-green` | `hitl` declared-but-locked. Picking a locked one returns a counted
+`request-red` refusal at ADMISSION — before that class's questions are ever asked. The
+pick is also a PROMISE: every catalogue kind carries the `verdictClass` it can honestly
+render, `closeCeiling(declaration)` reports the highest class a declaration demands, and a
+declaration ABOVE the pick is a `class-ceiling` red naming the kind that raised it (inert
+in v1 by construction — every live kind is mechanical).
+
+**The pipeline, in call order.** Each piece is exported so an adopter can drive it, cache
+a step, or test it without a provider.
+
+| step | call | what it is |
+|---|---|---|
+| interview | `runInterview({ verdictType, answers, repoPath })` → `{ ok, answers, verdictType, refusal, reds }` | PURE — no model, no repo, no clock. THREE frozen question sets keyed by verdict class (`QUESTION_SETS`; `questionsFor(cls)` / `requiredAnswersFor(cls)`), and the interview asks NOTHING about a genre. The green set is six questions, answers keyed by number; the soft-green and hitl sets are named but LOCKED (`questions: null`, absent rather than empty) and their selection refuses before they run. `verdictType` and `repoPath` are STRUCTURED input, never parsed out of prose. Answers are scrubbed at INGEST |
+| survey | `runAuthorScout({ workdir, provider, attempts? })` → `{ state, facts, reason, meta, raw, raws, calls }` | a bounded READ-ONLY LLM survey. Read-only by MENU CONSTRUCTION (`AUTHOR_SCOUT_VERBS` = the full menu minus write-class and store-class verbs), 8 rounds, F59's reserved toolless final round. **`state: 'ABSENT'` means the scout did not complete — never "no special facts are needed"**, and a parsed `{}` is one of its five ABSENT routes. Up to `SCOUT_ATTEMPTS` (**3**, hardcoded — PRD v1.58) attempts: `attempts` is TIGHTEN-ONLY and CLAMPS rather than throws (floor **1**, because a scout that never ran is an ABSENT nobody can act on), the direction every cap in this system runs in. **A retry fires on the typed MALFORMED class alone** (`SCOUT_RETRY_CAUSES` = `empty` \| `unparseable`); what is excluded is excluded for a reason — `call-failed` covers transport and `truncated:max_tokens`, both provider-red with NO redraft; `short` is F59's cut-off population and already has its own instrument INSIDE the attempt; `non-object` and `empty-object` are valid JSON with wrong or vacuous content, which is a SEMANTIC failure, and F38/F39 measured what re-asking one buys (the same distribution, sampled twice) — that is the self-healing line, and it is not crossed here. The re-ask is TOOLLESS over the conversation the survey already produced (the repository was already read; only the emission was unreadable) and names the mechanical parse error and nothing else. **There is no JSON repair behind it and there never will be** — a repairer decides what the model MEANT and writes it down as though the model had said it, in the one artefact whose whole job is to be honest about what a repository contains. `meta.attempts` / `meta.attemptsAllowed` record what was paid for; every attempt is metered under its own label (`author-scout`, `author-scout#2`, …) and leaves its raw behind |
+| listing | `buildSeedListing({ workdir, seedRef, sourcePaths, testPaths })` | mechanical, `$0`, no model. `files` is the WHOLE tree (what the validator judges paths against); `block` is scoped to the survey's own paths and capped in ANNOUNCED tiers (what the prompt carries). Handing the validator the scoped half would make a job scoped to `src/` read as whole-tree and silently disarm the one-population law |
+| authoring | `authorClose({ workdir, seedRef, lang, verdictType, answers, scout, listing, generate })` | the grounded loop: author → validate → run EVERY stage at the seed → feed the MEASURED results back → revise, bounded at `MAX_REVISIONS` (2) — a passed `maxRevisions` is TIGHTEN-ONLY, so a caller may LOWER that ceiling and never buy more revise rounds than the constant (floor **0**: one authoring call with no revise round is a legal ask, and unlimited revising would launder thrash as adaptation) — early-stop on an unchanged declaration. The declaration is emitted through a SCHEMA-FORCED TOOL CALL (`declare_close`), never parsed out of prose; the feedback is EXECUTION OUTPUT only — no model ever reviews another model's close. The return carries **`raws`**: what every model call actually SAID, the scout's attempts absorbed together with the declaration's, in the cost book's own order and under the same labels it meters. Each is `{ label, attempt, bytes, trimmed, text, cause, reason }` through the ONE persist helper (`scrubRaw` — redacted over the ONE `SECRET_PATTERNS` inventory, since a raw is the record most likely in this system to carry a live credential; bounded at `RAW_PERSIST_MAX` (8000) with the trim ANNOUNCING its own full size, and the cut walked back off a continuation byte so a multi-byte character is never split). `raws` is present on EVERY path **including the `$0` preflight refusals** — the path that spends nothing more is exactly the one whose evidence used to vanish with the process. `iterations` records what each turn MEANT (declaration, validation, seed read); `raws` records what it SAID, and a malformation is only ever visible in the second |
+| everything above, composed | `authorCloseForJob({ verdictType, answers, repoPath, lang, generate, ... })` → `{ ok, closeDecl, verdictType, refusal, cost, ... }` | refuses at the cheapest gate that can refuse: an interview refusal costs **zero**. THE GENRE REFUSAL LIVES HERE (not in the interview): a language the catalogue owns no data for, and a LOCKED KIND the model reached for, both come back as counted `request-red` demand |
+| assembly | `assembleSpec(specDraft, { closeDecl, verdictType })` | folds the authored half into the OPERATOR's half. Budgets, the fence, cadence, escalation and the provider are never authored by anything here. The GOAL is passed through, not generated. **A draft that ALREADY carries the authored half is REFUSED — it THROWS, never merges and never overwrites.** `AUTHORED_SPEC_FIELDS` (`close`, `closeDecl`, `verdictType`) names the fields this fold WRITES, as data, so the refusal and the fold cannot disagree about which half of the spec is which; the rule is `job.js`'s one step earlier (two closes are two arbiters, and picking one silently is how a signed artefact stops meaning what the signer read). `scripts/run-author.mjs` asks the same question at **$0 BEFORE the scout**, so the answer never arrives after the model has been paid |
+| the three gates | `prepareSigning({ spec, workdir, seedRef? })` → `{ ok, specHash, gates, work, guards, refusal }` | D9, and it NEVER signs |
+
+**D5 — the mandatory guards are SHOWN and FIXED, and the battery keys off the VERDICT
+CLASS** (PRD v1.57 §2 — what a battery is FOR is the class of dishonesty that class of
+verdict admits). `CLASS_BATTERIES` is the attachment point (structure, un-removability,
+which slot is the model's); the tool-specific CONTENTS — which suppression patterns, which
+extensions — resolve at COMPOSITION from the language the declaration names. The green
+battery injects `changed-from-seed`
+and `no-suppressions` FULLY PARAMETERISED (`classGuards({ verdictType, lang })`, which
+THROWS rather than ever hand back an empty battery for a known class and language); the
+model fills exactly one
+slot (the target prefixes) and cannot change, drop, rename, re-kind or NARROW them —
+`validateDeclaration` reds `guard-weakened` on any of it, including on an added `scope` that
+would shrink what the suppression scan covers. `genreEnv(lang, { sourcePrefixes })` is the
+same idea for environment: `MYPYPATH` on a Python patient is a fact no user can supply and
+no model found, it moves no seed number, and a declaration that authors it itself reds
+`genre-owned-env`.
+
+**The kind catalogue** (`KIND_CATALOGUE`, and it IS the whole vocabulary): `command-exit`,
+`count-not-worse`, `pattern-absent-in-diff`, `files-changed` are live; `judged-floor` and
+`human-confirms` are NAMED BUT LOCKED (and carry `verdictClass` `soft-green`/`hitl`), so
+declaring one is a counted `locked-kind` red rather than an unknown-kind typo; `harness-loop` (TESTGEN) is ABSENT from v1 entirely. In
+tool mode a locked kind is INEXPRESSIBLE — the schema carries one branch per live kind — so
+that demand arrives through the interview layer instead (`refuseLockedKind(kind)`).
+
+**The three gates, and the signature (D9).** Nothing LLM-judges a close.
+1. `validateCloseDecl(closeDecl, { verdictType, ... })` — schema, kinds, params, the F84
+   one-population law, F49's static nested-quantifier reject, the D5 guard equality, the
+   class ceiling, and the listing rule (a declared path SELECTS from the seed tree or it
+   does not exist). `verdictType` is REQUIRED and has no default: the guard battery hangs
+   off it, and a validator with no class in hand reds `class-absent` rather than reporting
+   a declaration it never checked D5 against.
+2. the CLOSE PRECHECK — every stage runs against the real patient. A stage that cannot run
+   is `broken-close`: a CASUALTY, never a red.
+3. the SEED-VERDICT READ — every stage, offered or not, at the seed. Which are RED (that is
+   the work) and which are GREEN (those are the guards) is handed back for the user to read.
+   **A close with no WORK stage red at seed is refused decision-ready** — it grades nothing,
+   and an instrument that scans nothing reads clean exactly like one that measures correctly.
+
+Then the human signs `specHash`, unchanged: the approvals array and the human's word are
+the arbiter relocating to the user, not disappearing. **Re-authoring is a spec edit (D6)** —
+a different declaration is different bytes, a different resolved hash, and a new signature.
+The guards are stored ENUMERATED and every short-form parser is expanded, so no
+omittable-with-a-default field can change what runs without changing what was signed.
+
+**Refusals are COUNTED (D13).** `refusalEvents(refusal)` returns the spine events: a
+`job-red` carrying `{ code: 'request-red', verb, lib: 'bareloop' }` — the `lib` stamped at
+the EMIT SITE, so `classifyIncidents` files it against bareloop's own catalogue and its
+`suggestedAsk` reads `bareloop: …` rather than seeding an upstream ask — plus one
+decision-ready `escalation` under `close-unauthorable`, which is in the ledger's excluded
+set precisely because the demand is already counted once. A refusal that is a STOP rather
+than demand (a broken instrument, a close with nothing to do) emits the escalation ALONE.
+**Known limit, stated:** v1's derivation cannot tell `soft-green` from `hitl` and does not
+try — both refuse under one verb (`non-green-verdict`), because naming which locked class a
+job belongs to would be a guess about prose.
+
+**At run time** the declared close is executed by the kind executor, never compiled down to
+shell (that would turn owned kinds back into authored strings — the exact thing D3 makes
+inexpressible). `runPlan` picks the executor from which field the signed spec carries and
+everything downstream is the same code: first-red-wins, the `CLOSE_FAULTS` forbidden zone
+(routed by a TYPED fault, so a timeout still offers "raise the close timeout"), the same
+`close stage "<name>" failed:` gap header the trend reader parses, the same scrub at the
+emission boundary, and the check menu still derived from stage names one hop. The seed is
+READ at run start (`seedAtHead`) and recorded on a `close-decl` spine event together with
+the grounded re-validation's result. Direct executor access: `runDeclaredStages(stages,
+redact, { cwd, seedRef, timeoutMs })` returns `runClose`'s verdict shape **plus one added
+field, `notes`** — the DIAGNOSTIC channel, per stage and on the summary, ABSENT when empty
+(never `''`). M1's kinds announce some things whichever way a stage lands (a declared env var
+that was dropped, the scope filter's own arithmetic), and a RED carries those out inside its
+`gap` while a GREEN and an instrument stop had nowhere to put them — checking the GREENS is
+doctrine, and an audit trail that only survives a red cannot do it. It is deliberately NOT
+`gap`: every consumer guards with `if (gap)`, so a green carrying one would read as
+revision-worthy and a stop carrying one would look like a verdict it never rendered. **Nothing
+routes on it, nothing bounds on it, and no verdict moves because of it** — it rides the records
+that already spread the whole verdict (`close-precheck`, `outer-close`, ralph's
+`close-verdict`). `runDeclaredClose`
+and `seedRead` are the kind executor's own two entries (`runDeclaredClose` is named apart
+from ralph's shipped `runClose` because one runs a DECLARATION and the other an argv);
+`closeStagesOf(job)` is the ONE staging every close consumer reads, widened to both fields.
 
 ### `snapshotScope(dir, scope)` / `evalExits(exits, { dir, snapshot?, runCheck? })` — `src/exits.js`
 
@@ -504,10 +618,10 @@ Reserved spine vocabulary (V7, machinery-free until job #1 surfaces one):
 `coordination-red` — a failure between units (scope contention, step order, store
 races), never to be folded into worker/interpreter reds.
 
-### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans? })` → outcome — `src/run.js`
+### `runJob(spec, { approvals, workdir, provider, nativeProvider?, providerFor?, emit, capRuns?, strikeLimit?, shellCapUsd?, closeTimeoutMs?, layerRoot?, bridge?, priorSpentUsd?, priorSpendComplete?, priorWallMs?, resumeSeed?, resumeGrades?, resumeReplans?, resumeBranch? })` → outcome — `src/run.js`
 
-The last six are the RESUME fold and are documented under *Resuming a killed run* below; they
-default to `0` / `true` / `0` / `null` / `[]` / `null`, so a fresh run passes none of them.
+The last seven are the RESUME fold and are documented under *Resuming a killed run* below; they
+default to `0` / `true` / `0` / `null` / `[]` / `null` / `null`, so a fresh run passes none of them.
 Three of them are folds of a bound the operator SIGNED (money, wall, replans) and one is a
 readout seed (grades) — the distinction matters and is spelled out there.
 
@@ -519,8 +633,11 @@ known-answer round-trip before tokens: `smoke-red` — a silent degradation thro
 `min(job budget − spent, shell cap)`.
 
 Outcomes: `green | already-green | escalated | unapproved-spec | job-red | smoke-red |
-plan-red | check-red | close-red | close-unsupported | recipe-stale | pricing-red |
-provider-red | interpreter-red | cap-halt | wall-halt | step-stalled | step-red:<id>`. `provider-red` is a
+plan-red | check-red | close-red | close-unsupported | recipe-stale | branch-red | pricing-red |
+provider-red | interpreter-red | cap-halt | wall-halt | step-stalled | step-red:<id>`.
+`branch-red` is the WORK BRANCH refusing (below): the patient is not a git checkout, its
+branch namespace has no free name, or a resume's recorded branch is gone. Zero tokens, and
+never a fallback to working on the branch the run was handed. `provider-red` is a
 transport throw or a worker round the API cut off mid-generation (`truncated:max_tokens`,
 BA-6 — before which it laundered into a clean finish, F25): no verdict exists and the failed
 round's spend is only partly known (F6). `cap-halt` is the wallet; `wall-halt` is the clock
@@ -568,7 +685,9 @@ their own ledger): **close precheck** (`already-green` is a
 DISTINCT zero-token outcome; a forbidden-zone verdict escalates before spend) → **check-menu
 preflight** (`check-menu` names the derived menu, then every OFFERED stage's chain runs once
 at $0 — an unrunnable stage is a `check-red` stop before tokens, not a fault mid-plan) →
-**SCOUT** (read-only by construction: neither the
+**THE WORK BRANCH** (below — created before the first paid call, `branch-red` if it cannot
+be; on a RESUME it runs FIRST, ahead of the precheck and the preflight, because the recorded
+branch IS the tree those instruments must measure) → **SCOUT** (read-only by construction: neither the
 write-class nor the store-class verbs are in its menu; hard-bounded rounds) → **PLAN** (the decompose call —
 the planner never sees the repo, only the scout blob; drafted against a schema
 description with check NAMES only; `validatePlan` gates it, one redraft with the reds
@@ -586,6 +705,56 @@ plan-red | check-red | close-red | wall-halt`. Worker prompts hold the v1.12 §5
 (mutation-proven): the absolute repo root, the step's action/target, prior artifacts,
 the gap — NEVER the budget, the close command, a check's command, or the arbiter's books.
 
+**THE WORK BRANCH — a hard rule, and a REQUIREMENT on the patient (PRD v1.57 §3).** hamr's
+ruling, verbatim: *"The agent creates a NEW BRANCH before it touches any code — a HARD RULE,
+no exceptions. Not a default, not a preference: no job edits the branch it was handed, and
+none edits `main`."* So **the patient must be a git repository with at least one commit** —
+that is new, and it is the honest consequence of the rule rather than an option. And the
+patient itself is **ALWAYS a separate COPY of the repo being treated, never the original**
+(hamr, 2026-08-09): the branch bounds where writes land, but workers and close stages
+still mutate the patient tree (branches per try, caches, worktrees) — the copy is the
+blast radius; the original never carries it. What the run does, before its first paid
+call:
+
+- **The name is DERIVED from the SIGNED spec**, never model-authored (a branch name is
+  arbiter bookkeeping): `bareloop-` + the spec's own `job` slug — `bareloop-typecheck-fix`.
+  `workBranchName(spec)` is exported so a runner can show it at its approval gate. The goal
+  prose is deliberately NOT an input: it is edited between runs without changing what the
+  job is, and the branch name would move with it.
+- **A name already taken is SUFFIXED** `-2`, `-3`… — a second run of the same spec is a
+  second blast radius and never reuses the first one's branch.
+- **A RESUME returns to ITS OWN branch.** Pass `resumeBranch` (read off the dead spine by
+  `readResume` as `restart.branch`); without it the deterministic name would collide with the
+  killed leg's own branch and mint a `-2` beside the work the resume exists to keep. The
+  recorded branch is the ONLY branch a resume can land on — it is validated and checked out,
+  never re-derived from the spec and never suffixed. A recorded branch that no longer exists
+  is a `branch-red` STOP, never a fresh start.
+- **On a RESUME this step runs FIRST**, ahead of the close precheck and the check preflight
+  (cold, it runs after them — see the already-green bullet). Both are $0 readings OF A TREE,
+  and on a resume the tree they must read is the recorded branch's: standing on whatever ref
+  the operator handed back, the precheck could read `already-green` off a tree that is not
+  this run's and every `baseline: "seed"` stage would baseline against it. Nothing is minted
+  by moving it — the resume arm creates nothing — and a resume whose branch is gone or foreign
+  now stops `branch-red` before the arbiter grades anything at all.
+- **`work-branch { branch, created, resumed, from, base, repo, collided? }`** lands on the
+  spine at creation — the run's books say where its work went.
+- **Every failure is `branch-red`**, escalated decision-ready with zero spend. There is no
+  fallback to the handed branch anywhere; and `mkWorker`, the ONE seam that grants
+  write-class verbs, refuses to build a write-capable worker with no branch prepared, so the
+  ordering is a convenience and the guard is the rule.
+- **A COLD run's `already-green` tree leaves no branch behind** — the precheck returns above
+  this step, and a run with no work has no blast radius to bound. The clause is about
+  MINTING: a RESUME that reads `already-green` off its own branch (which it is standing on by
+  then) leaves that branch and the paid work on it exactly where they were.
+
+**What it does NOT do.** bareloop never commits, so the branch bounds where work LANDS: the
+tree stands on a branch nobody handed the run, and the handed ref is never moved or written
+through. It is not containment — v1.41's local-trust model is unchanged, and worker/close
+children still run as the operator's OS user with network egress. A workdir that is a
+SUBDIRECTORY of a repository gets its branch in the enclosing repository (git resolves
+upwards, exactly as every other git read in the flow does); the `work-branch` record's `repo`
+field names which repository that was, rather than leaving it to be discovered.
+
 **The strike ladder — how a STEP ends (F77–F79).** A plan step is **not** bounded by a
 number of iterations. It runs until it stops making PROGRESS: a *strike* is a red iteration
 that repeats an already-seen gap or wrote nothing, and `strikeLimit` strikes (shell option on
@@ -713,7 +882,7 @@ is read, so a resume of a resume inherits the previous leg's chain and not the o
 (`createClock`, `src/clock.js`) from the signed `maxWallMs` and emits `wall-clock` with the
 requested AND enforced numbers up front, plus the `closeStages` count that explains the gap
 between them (`enforcedMs = maxWallMs + closeStages × closeTimeoutMs`, one expression — the
-stage count comes from `stageClose`, the same staging the runner executes). Enforcement is a
+stage count comes from `closeStagesOf`, the same staging the runner executes). Enforcement is a
 **between-round deadline** — the only seam that exists, since `loop.stop()` cannot cut an
 in-flight call (F61: fired at 500ms,
 returned at 4,018ms) — so an attempt that crosses the deadline mid-flight emits `wall-bounded`,
@@ -1054,8 +1223,8 @@ the secrets scan.
 A reuse run is up to `tries + 1` full jobs long, so a kill mid-run is a real event and it
 must not cost the whole envelope. **`readResume(events, {deathAt?, direct?, resumableOutcomes?})`**
 reads the dead run's own spine back into the state a resume continues from: `{ started,
-approvalHash, completed[], tried[], restart (with its step-level `seed` and its close
-`grades`), r1Missing, spentUsd,
+approvalHash, completed[], tried[], restart (with its step-level `seed`, its close
+`grades`, and its work `branch`), r1Missing, spentUsd,
 spendComplete, carrySpentUsd, carrySpendComplete, ended, greened, … }`. Hand that object to
 **`runReuse({…, resume})`** and the run picks up where it stopped.
 
@@ -1079,10 +1248,17 @@ semantics are byte-unchanged (PRD v1.46 §3):
   work on disk and the plan on the spine. A green or any red stays non-resumable under every
   setting — a verdict already rendered is never re-bought.
 
+`restart.branch` is the WORK BRANCH the dead leg was working on, READ off its `work-branch`
+record and never re-derived: the name is deterministic from the signed spec, so a restart that
+recomputed it would collide with its own predecessor and be handed a fresh `-2` beside the work
+it came back for (the declared-fold precedent, `priorSpentUsd`'s exactly). Pass it on as
+`resumeBranch`; `runReuse` does it for you. `null` — a leg killed before it ever branched — is
+the cold path, and correct, because a leg that never branched has no work to strand.
+
 `scripts/run-u.mjs --resume <runid|path>` is the operator-side consumer: it skips the patient
 reset (`resumeTreeGate` instead — a dirty tree is what a resume expects; only a moved HEAD
-stops it), folds the halted run's money and wall in, re-enters at the checkpoint, and arms the
-outside watchdog on the REMAINING wall. The top-up itself stays a spec edit the human signs.
+stops it), folds the halted run's money and wall in, returns to the dead leg's own work branch,
+re-enters at the checkpoint, and arms the outside watchdog on the REMAINING wall. The top-up itself stays a spec edit the human signs.
 **A zero wall remainder REFUSES the launch** (exit 2, before the key and before the patient):
 W-2 says a run out of time keeps the grade it has and stops, so a resume with no time to start
 anything in is a decision, not an unbounded launch — and launching it used to hand the outside
@@ -1221,12 +1397,17 @@ whichever territory was seen first), `broken-close` (consumer-attributed),
 `verb` field, prose-quoted verb as legacy fallback; both classes take their `lib` from the
 red's own stamp, so neither seeds an upstream ask for a bareloop-catalogue refusal),
 `retention-red`, `config-red`
-(drafting friction — attributed to bareloop's own schema/prompt). Deliberate exclusions
+(drafting friction — attributed to bareloop's own schema/prompt). Close-authoring
+refusals ride the SAME `request-red` channel with `lib: 'bareloop'` stamped at the emit
+site (`refusalEvents`), so genre/verdict/locked-kind demand is counted without ever
+seeding an upstream ask. Deliberate exclusions
 (`EXCLUDED_ESCALATIONS`, a runtime set — anything outside classified ∪ excluded is
 counted as unmapped, never dropped): `cap-halt`/`wall-halt` (budget stories, money and
 time), `step-stalled` (the stall fuse firing is our governance, not an observed provider
 failure), `step-variance` (a planning story), `gate-red`/`smoke-red` (governance working
-as intended / already counted), `hitl-close`/`close-unsupported` (by design),
+as intended / already counted), `hitl-close`/`close-unsupported`/`close-unauthorable` (by design — and the last one
+is excluded for a SECOND reason: its demand is already counted once as the `request-red`
+the same refusal emits, so counting the escalation too would double every refusal),
 `close-timeout`/`close-killed`/`close-crashed` (the arbiter's own named terminals, F17);
 `close-verdict`/`artifact-red` stay worker stories, `pr-red` operator environment.
 `suggestedAsk` on every row is a template seed for an upstream ask — filing stays human;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bareloop",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Workflows that earn their own design, with receipts — agent-authored workflows for repeated, long, verifiable jobs that improve across runs under an un-gameable gate.",
   "type": "module",
   "main": "./src/index.js",