bareloop 0.9.0 → 0.10.0

package/src/planrun.js

@@ -34,7 +34,7 @@ import { validateBridge, loadGate } from './bridges.js';
 import { extractArtifact } from './text.js';
 import { createClock, isWallTimeout } from './clock.js';
 import { isDeclaredClose, runDeclaredStages, validateCloseDecl, closeGrade } from './declaredclose.js';
-import { seedAtHead, seedListing } from './kinds.js';
+import { seedAtHead, seedListing, GAP_TRIM_MARKER, GATE_AUDIT_FILE, ARBITER_BOOK_STORES } from './kinds.js';
 import { workBranchName, prepareWorkBranch } from './workbranch.js';
 
 const require = createRequire(import.meta.url);
@@ -260,6 +260,60 @@ export function closeGapBlock(gap) {
     + (scrubbed.length > CHECK_GAP_MAX ? boundGap(scrubbed, REPLAN_GAP_KEEP) : scrubbed);
 }
 
+/**
+ * The recorded bound-reason's ceiling in the WORKER-facing note. The reason is a
+ * provider string (`denied:<tool>` today, ~20 bytes), not a gap, so this is a
+ * backstop against a future terminal that arrives long — never an envelope the
+ * shipped path routinely rides through.
+ */
+export const BOUND_REASON_MAX = 200;
+
+/**
+ * What the NEXT attempt is told about the bound that cut the previous one.
+ *
+ * Two different bounds used to set the same bare `attemptBounded = roundIteration`
+ * and therefore render the same sentence. For a round-bound cutoff that sentence is
+ * true. For BA-11's deny streak it is false twice over — the rounds did NOT run out
+ * (the fence short-circuited the attempt with budget left), and the count it quotes
+ * is the cap, not what was spent — and it aims the worker at the READ BUDGET when the
+ * thing that stopped it was the FENCE. The reason was already recorded on the spine;
+ * nothing carried it to the one reader who could act on it.
+ *
+ * The denial note is MECHANICAL in the strict sense: it quotes the terminal the
+ * provider actually returned and names which bound fired. It invents nothing —
+ * no streak count and no denied path, because bare-agent's return (`error:
+ * 'denied:<tool>'`, loop.js) carries neither, and a number nobody measured is a
+ * bug with a confident voice. Every other cause keeps the frozen wording byte for
+ * byte: a wall-bounded attempt reads as a round bound exactly as it did before
+ * (and is unreachable anyway — the step head refuses to fund an attempt past the
+ * deadline, W-2), so this change can only ever speak where it has something true
+ * to add.
+ *
+ * The reason arrives ALREADY SCRUBBED (the capture seam in `mkWorker` runs it
+ * through the one `SECRET_PATTERNS` inventory), so this renderer only bounds it —
+ * and announces the trim with the repo's ONE marker rather than a second spelling
+ * of "this text was cut" (F90.2).
+ *
+ * @param {{iteration?: number|string|undefined, cause: string, reason: string|null}|null|undefined} bounded
+ *   the previous attempt's bound state, or nullish when it was not bounded
+ * @param {number} rounds the step's round bound, as quoted by the frozen sentence
+ * @returns {string|null} the note, or null when there is nothing to say
+ */
+export function boundedNote(bounded, rounds) {
+  if (!bounded) return null;
+  if (bounded.cause !== 'denied') {
+    return `Your previous attempt was CUT OFF after ${rounds} tool rounds. `
+      + 'Reading is bounded; writing is not. Form a hypothesis EARLY and make the change.';
+  }
+  const raw = String(bounded.reason ?? '');
+  const shown = raw.length > BOUND_REASON_MAX
+    ? `${raw.slice(0, BOUND_REASON_MAX)} [${GAP_TRIM_MARKER} ${raw.length - BOUND_REASON_MAX} of ${raw.length} characters withheld — the cap is ${BOUND_REASON_MAX}]`
+    : raw;
+  return 'Your previous attempt was CUT OFF by the gate: it denied consecutive tool calls '
+    + `until the streak guard ended the attempt. The gate recorded: ${shown}. `
+    + 'The round budget was not what stopped you — repeating a denied call ends this attempt the same way.';
+}
+
 /**
  * The plan-drafting prompt: a schema DESCRIPTION built from the live validator
  * menus — never a copyable example (the drafter must author, not echo; the
@@ -321,7 +375,7 @@ Shape: { "schema": "plan-v1", "steps": [ ... 1..${MAX_PLAN_STEPS} steps ... ] }
 strictly in array order. Each step (no other fields exist):
 - "id": kebab-case slug, unique
 - "action": the step's task, precise enough for a worker that sees ONLY this step
-- "tools": non-empty unique subset of ${JSON.stringify(ceiling)} (write/edit change the tree; recall/get/impact/related/recent search and navigate the repository index; compress/peek read cheaply; stash/remember/forget park and record notes across steps)
+- "tools": non-empty unique subset of ${JSON.stringify(ceiling)} (read/grep are the worker's ONLY way to see the tree — there is no shell; write/edit change the tree; recall/get/impact/related/recent search and navigate the repository index; compress/peek read cheaply; stash/remember/forget park and record notes across steps)
 - "rounds": integer 1..${maxStepRounds} — the step's per-attempt tool-round bound
 - "target": the step's deliverable path (REQUIRED when tools include write/edit), inside ${JSON.stringify(job.writeScope)}
 - "scope" (optional): narrow this step's WRITE fence — copy one value from the offered scopes below.
@@ -351,6 +405,15 @@ strictly in array order. Each step (no other fields exist):
   exit reds on that file can never finish, on any attempt.${seedRedLaw}${priorChecksLaw}
   Reference checks by NAME only; you cannot author or modify one.
 
+The worker has NO SHELL. It cannot run a command, a compiler, a linter, or a test suite,
+and it cannot execute a script it writes: its only verbs are the tools you grant that step
+in "tools". The check named in a "check-passes" exit is the ONLY execution in this run —
+the shell runs it after each attempt and hands the worker its raw output. So write every
+"action" for a worker that locates its work by READING and GREPPING files and by reading
+the check output it is given. Never tell it to run, execute, re-run, or verify by running
+anything (an action that opens with "Run \`<command>\`…" costs the whole step: the worker
+has no way to obey it and spends its rounds hunting by hand).
+
 Offered "scope" values for tree-changed — copy ONE of these exactly, character for
 character. No other value is accepted, and patterns of your own (like "src/*.js")
 are not accepted:
@@ -1062,7 +1125,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
   const lc = new LiteCtx({ root: workdir });
   const ceiling = Array.isArray(job.tools) ? job.tools : [...TOOL_MENU];
   const fencePrefixes = job.writeScope.map((/** @type {string} */ g) => resolve(workdir, globToPrefix(g)));
-  const auditPath = join(workdir, 'gate-audit.jsonl');
+  const auditPath = join(workdir, GATE_AUDIT_FILE);
   const chainByName = new Map(menu.map((m) => [m.name, m.run]));
   // Choose-don't-describe (§4): the offered `tree-changed` scopes, enumerated from
   // the signed fence plus the directories that actually exist beneath it. ONE menu
@@ -1198,7 +1261,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         // uses), so this can only tighten, never widen
         writeScope: writable ? (fence ?? fencePrefixes) : [],
         readScope: [workdir],
-        deny: [auditPath, join(workdir, '.smoke'), join(workdir, '.litectx')],
+        deny: [auditPath, ...ARBITER_BOOK_STORES.map((s) => join(workdir, s))],
       },
       budget: { maxCostUsd: Math.max(remainingUsd(), 0.0001) },
       limits: { maxTurns },
@@ -1312,7 +1375,23 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     /** @type {number|string|undefined} */
     let roundIteration;
     let roundsThisAttempt = 0;
-    /** @type {number|string|undefined} */
+    /**
+     * WHICH bound cut the last attempt, and — when the provider recorded one — its
+     * reason. A bare iteration number was the whole state here, so three different
+     * bounds (round cap, wall, BA-11 deny streak) were indistinguishable to the one
+     * consumer that speaks to the worker, which then told every one of them the
+     * round cap had run out. The cause travels WITH the iteration because they are
+     * read together and can never be allowed to drift apart.
+     *
+     * `reason` is scrubbed at THIS seam — the boundary, once, before any reader —
+     * so no consumer has to remember to do it (the same placement the exit results
+     * get in `judge`). It rides the spine event in the same scrubbed spelling: one
+     * value, one inventory, and an append-only log is forever.
+     * `iteration` mirrors `roundIteration` exactly, undefined included: the bound
+     * cannot know a label the run never set, and inventing one here would be the
+     * only place in this file that claims to.
+     * @type {{iteration: number|string|undefined, cause: 'rounds'|'wall'|'denied', reason: string|null}|undefined}
+     */
     let attemptBounded;
     /**
      * Open an iteration: label the rounds, reset the per-iteration round counter,
@@ -1413,19 +1492,24 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         }
         // a maxTurns session is a BOUNDED attempt, not an escalation — the same
         // role loop.stop() plays on the Loop path: judge the partial work and
-        // feed the gap forward (the CLI preserves lastText, BA-5).
-        if (r.error === 'max_turns') {
-          attemptBounded = roundIteration;
-          emit('attempt-bounded', { phase, iteration: roundIteration, cap: attemptRounds, native: true });
-          return r;
-        }
+        // feed the gap forward (the CLI preserves lastText, BA-5). A DENIAL
+        // STREAK is the same shape and takes the same lane (see the Loop path's
+        // note below — one doctrine, both surfaces).
         if (r.error) {
+          if (r.error === 'max_turns' || r.error.startsWith('denied:')) {
+            // the CAUSE is kept, not just the fact: `max_turns` really is the round
+            // cap, a `denied:` terminal is the fence, and the next attempt is told
+            // which one it was (`boundedNote`)
+            const denied = r.error.startsWith('denied:');
+            const reason = scrub(r.error);
+            attemptBounded = { iteration: roundIteration, cause: denied ? 'denied' : 'rounds', reason };
+            emit('attempt-bounded', { phase, iteration: roundIteration, cap: attemptRounds, native: true, reason });
+            return r;
+          }
           const err = /** @type {CategorizedError} */ (new Error(`native session: ${r.error}`));
-          // halt → cap-halt, denial streak → gate-red; a bridge/session terminal
-          // (bridge-failed, session_timeout, session:*) is provider-owned transport
-          err.category = r.error.startsWith('halt:') ? 'cap-halt'
-            : r.error.startsWith('denied:') ? 'gate-red'
-            : 'provider-red';
+          // halt → cap-halt; a bridge/session terminal (bridge-failed,
+          // session_timeout, session:*) is provider-owned transport
+          err.category = r.error.startsWith('halt:') ? 'cap-halt' : 'provider-red';
           err.lib = 'bare-agent';
           throw err;
         }
@@ -1523,11 +1607,11 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
           // (a step that would BEGIN past the deadline is never funded), and the head of
           // a close-fix iteration (W-2 — the run stops on the verdict already minted).
           if (clock.expired()) {
-            attemptBounded = roundIteration;
+            attemptBounded = { iteration: roundIteration, cause: 'wall', reason: null };
             emit('wall-bounded', { phase, iteration: roundIteration, ...clock.report(closeTimeoutForReport) });
             self.stop();
           } else if (roundsThisAttempt >= attemptRounds) {
-            attemptBounded = roundIteration;
+            attemptBounded = { iteration: roundIteration, cause: 'rounds', reason: null };
             emit('attempt-bounded', { phase, iteration: roundIteration, rounds: roundsThisAttempt, cap: attemptRounds });
             self.stop();
           }
@@ -1561,12 +1645,25 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       } catch (e) {
         throw categorize(e).err;
       }
-      // same error-return taxonomy as interpret's ask (one map, same doctrine):
-      // halt → cap-halt, denial streak → gate-red, API truncation → provider-red
+      // BA-11's deny streak is a BOUNDED ATTEMPT, not a terminal. It is the same
+      // shape `loop.stop()` has at the round bound thirty lines up: the attempt
+      // ran, produced real work, and was cut short by a governance bound doing
+      // exactly its job — the fence HELD, which is the opposite of a fault. So it
+      // takes the same lane: judge the partial work, feed the gap forward, the
+      // loop continues under unchanged caps. Routing it as a terminal killed a
+      // converging run with money and wall left (u-msn227nq). The native surface
+      // takes the identical lane above — one doctrine, both surfaces.
+      if (r.error && r.error.startsWith('denied:')) {
+        const reason = scrub(r.error);
+        attemptBounded = { iteration: roundIteration, cause: 'denied', reason };
+        emit('attempt-bounded', { phase, iteration: roundIteration, rounds: roundsThisAttempt, cap: attemptRounds, reason });
+        return r;
+      }
+      // the remaining error-return taxonomy (one map, same doctrine as native's):
+      // halt → cap-halt, API truncation → provider-red, anything else is wiring
       if (r.error) {
         const err = /** @type {CategorizedError} */ (new Error(`worker loop: ${r.error}`));
         err.category = r.error.startsWith('halt:') ? 'cap-halt'
-          : r.error.startsWith('denied:') ? 'gate-red'
           : r.error.startsWith('truncated:') ? 'provider-red'
           : 'interpreter-red';
         err.lib = 'bare-agent';
@@ -2044,14 +2141,19 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       // carries counts and paths only — never content (the spine is forever).
       const rootInj = root ? root.observe({ iteration, gap, writes: w.workerWrites() }) : null;
       if (rootInj) emit('root-injected', { step: step.id, ...rootInj.event });
+      // read ONCE: the note and the "was it the attempt just before this one" test
+      // are two questions about the same record, and two reads is how they drift
+      const bound = w.wasBounded();
       const r = await w.ask([
         step.action,
         `Repository root (absolute): ${workdir}\nEvery path you pass to a tool MUST be absolute and inside this root — a relative path resolves against a different directory and will be denied by the gate.`,
         step.target && `Write your deliverable to: ${resolve(workdir, step.target)}`,
         artifacts.length > 0 && `Working context (read-only) — prior steps' results:\n${artifacts.map((a) => `[${a.id}] ${a.text}`).join('\n\n')}`,
         gap && `Previous attempt failed this step's checks:\n${gap}`,
-        w.wasBounded() === iteration - 1
-          && `Your previous attempt was CUT OFF after ${step.rounds} tool rounds. Reading is bounded; writing is not. Form a hypothesis EARLY and make the change.`,
+        // the note names the bound that ACTUALLY fired — a deny streak and a spent
+        // round cap are different diagnoses with different remedies, and telling a
+        // fenced worker to "form a hypothesis early" aims it at the wrong wall
+        bound?.iteration === iteration - 1 && boundedNote(bound, step.rounds),
         rootInj && rootInj.note,
       ].filter(Boolean).join('\n\n'));
       lastText = scrub(r.text ?? '').slice(0, ARTIFACT_MAX);
@@ -2234,7 +2336,32 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       && cat === 'step-variance'
       && !varianceGrantUsed
       && stopTrend.trend === 'converging';
-    if ((!replanned || grantExtraReplan) && replanTrigger && remainingUsd() > MONEY_MIN) {
+    // W-2 at the replan GATE, hamr's ruling: *"past the wall no new fix cycle or step
+    // starts"* — and a replan is the first move of starting a new step. Past the
+    // deadline the whole cycle is doomed by construction and it is not free: the
+    // drafting call is bought (money the operator's time allowance no longer covers),
+    // the redrafted plan's first step is then refused at its own head by the W-2 check
+    // one level down, and the run wall-halts anyway. u-msmt91t3 paid for exactly that
+    // and called the result `step-red`. So the gate declines to FUND it.
+    //
+    // Nothing is routed here and no readout is duplicated: declining simply lets the
+    // stop fall through to the `step-variance` terminal below, which is the one site
+    // that mints the wall-halt package (record + F11-consistent escalation + levers).
+    // One site, one spelling — a second copy here is how two instruments come to
+    // disagree about one event.
+    //
+    // TRIGGER-AGNOSTIC (hamr: "extend"). It first covered the variance trigger only,
+    // the one measured on u-msmt91t3; the ladder's exhaustion and the stall fuse reach
+    // this gate past the deadline too, and a doomed cycle costs the same money whichever
+    // instrument named the stop. Each trigger then lands on its own honest terminal
+    // below — the wall for the two that would otherwise mint `step-red`, its own name
+    // for the stall (which already rides out as `step-stalled` and must, because run.js
+    // keys the F44 spend FLOOR on that outcome).
+    //
+    // The latch is NOT consumed — no grant was spent, because no replan was bought.
+    // With time on the clock this is byte-identical to today, for every trigger.
+    const wallStopsReplan = clock.expired();
+    if (!wallStopsReplan && (!replanned || grantExtraReplan) && replanTrigger && remainingUsd() > MONEY_MIN) {
       if (grantExtraReplan) varianceGrantUsed = true;
       replanned = true;
       replans += 1;
@@ -2333,6 +2460,38 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       skipCount = 0;
       continue;
     }
+    /**
+     * W-2's STEP-LOOP terminal, and the ONE place it is spelled. Reached whenever a
+     * trigger that would otherwise mint `step-red:<id>` lands with the deadline already
+     * passed: the meter's stop (F85's variance) and the ladder's (attempt exhaustion
+     * with money still on the table). Both are the same event wearing two instruments'
+     * names — the clock is what ended the run — and `step-red` is a CAPABILITY label,
+     * so minting it there files a governance stop as "the work failed". u-msmt91t3 is
+     * the measured instance: `step-red` 9.9 seconds after the run's own `wall-bounded`.
+     *
+     * One site, one spelling, because the record, the F11-consistent escalation and the
+     * lever list must be identical wherever the clock stops a step — a second copy per
+     * trigger is how two instruments come to disagree about one event. The instrument
+     * that named the stop FIRST is not discarded: it rides in the detail, so the human
+     * reads why the step was stopped as well as which lever fits.
+     *
+     * `stepWallStop` is never consulted here by construction: that record is written
+     * only by the head-of-attempt check, and both triggers above are read BEFORE it, so
+     * a step either of them stopped never reached it.
+     * @param {string} stoppedBy the instrument that named the stop first
+     */
+    const wallHaltTerminal = (stoppedBy) => {
+      emitWallHalt({ cutMidCall: false, phase: `step:${step.id}`, stepsDone: idx, stepsPlanned: plan.steps.length });
+      emit('escalation', {
+        category: 'wall-halt', decisionReady: true, phase: `step:${step.id}`,
+        decision: `The run reached its wall-clock cap while step "${step.id}" was running. Time ran out, not capability — the verdict the run already has stands.`,
+        options: WALL_OPTIONS,
+        detail: `requested ${clock.requestedMs}ms, elapsed ${clock.elapsedMs()}ms. `
+          + `${stoppedBy}: ${lastEscalation?.detail ?? '(none)'} `
+          + `Progress trend: ${stopTrend.trend} — ${stopTrend.reading}; ${stopTrend.lever}.`,
+      });
+      return 'wall-halt';
+    };
     // F64 — the wall stopped this attempt from INSIDE a provider call (the derived
     // call timeout is the deadline in the provider's own coin). ralph already
     // emitted the escalation under this category, so the outcome and the record
@@ -2355,7 +2514,19 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     // stays a step-red (the stop is a result).
     if (cat === 'cap-halt') {
       planExecuted();
-      if (remainingUsd() > MONEY_MIN) return `step-red:${step.id}`;
+      if (remainingUsd() > MONEY_MIN) {
+        // W-2 EXTENDED to the ladder's stop (hamr: "extend"). This arm is the sibling of
+        // the variance terminal below and carries the identical defect: with money still
+        // on the table it minted `step-red` whatever the clock said, so a step the
+        // deadline ended was filed as a capability failure. The wallet is re-read (it
+        // always was); the clock is re-read too, and it is read FIRST inside this arm
+        // only — a DRAINED wallet keeps its own `cap-halt` terminal below, because money
+        // is the allowance actually blocking that run and its levers are the ones the
+        // human needs (a wall-halt readout there would offer "raise maxWallMs and rerun"
+        // into an immediate money cut).
+        if (clock.expired()) return wallHaltTerminal('The ladder ended the step first');
+        return `step-red:${step.id}`;
+      }
       // v1.46 §2: the money cut is decision-ready HERE too, and for the same reason
       // W-2 gave the wall a record at every site it stops a run — a category that
       // hands the human a readout at one seam and silence at another is the readout
@@ -2371,8 +2542,22 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     // upward would mint an outcome run.js and the ledger's class table do not know,
     // and an unmapped category is counted as a library bug (ledger.js) when this is a
     // planning story. The escalation ralph already emitted carries the real detail.
+    //
+    // W-2 at the meter's own terminal. A `step-variance` stop that lands PAST the
+    // deadline is a TIME stop wearing the meter's name — the clock is what ended the
+    // run, and hamr's ruling names that stop: *"when time is up, keep the grade we
+    // already have and stop"*. Its cap-halt sibling directly above already re-reads its
+    // own governor (the wallet) before minting a terminal; this branch did not, and on
+    // u-msmt91t3 it minted `step-red` 9.9 seconds AFTER the run's own `wall-bounded`
+    // record — a governance stop filed as a capability read, and (the resume gate's
+    // half of the same defect) a checkpoint filed as an answer.
+    //
+    // The clock is read HERE, with nothing in flight, exactly as the three other
+    // terminal sites read it. With time still on the clock this is byte-identical to
+    // what it was: the step-red is the designed stop, and the stop is the result.
     if (cat === 'step-variance') {
       planExecuted();
+      if (clock.expired()) return wallHaltTerminal('The meter stopped the step first');
       return `step-red:${step.id}`;
     }
     // Any OTHER terminal escalation category is NOT a capability failure: a

package/src/ralph.js

@@ -590,6 +590,11 @@ export async function ralph({ middle, close, judge, capRuns, ladder, emit, redac
       const DECISIONS = {
         'cap-halt': [`Budget gate tripped mid-run (${e && e.message}). Continue with a higher cap, change approach, or stop?`,
           ['raise the cap and rerun', 'change the middle/harness', 'abandon the task']],
+        // No site in this tree mints `gate-red` any more: a BA-11 denial streak is
+        // a bounded attempt now (planrun's two `ask`s), not a terminal, because the
+        // fence HOLDING is governance working, not a fault. The entry stays because
+        // this catch is a dumb passthrough — it files whatever category the thrower
+        // names, so an unlisted one would read out with the generic text.
         'gate-red': ['The gate denied an action mid-run — the harness asked for something outside its scope.',
           ['widen the write scope deliberately', 'change the middle/harness', 'abandon the task']],
         'provider-red': ['The provider path failed mid-run (transport, not logic) — no verdict exists and the spend for the failed call is unknown (F6).',

package/src/reuse.js

@@ -665,7 +665,7 @@ function readGradeSeed(seen) {
  *   which is later and better evidence than the last event). Defaults to the last
  *   event's own timestamp — the last sign of life there is.
  * @returns {any} `{ started, approvalHash, specHash, patient, job, bridgeTries,
- *   perTryBudgetUsd, perTryWallMs, ended, endOutcome, greened, completed, tried,
+ *   perTryBudgetUsd, perTryWallMs, ended, endOutcome, wallDerivedHalt, greened, completed, tried,
  *   selectionCostUsd, selectionComplete, strayRounds, r1Missing, restart, deathAtKnown,
  *   spentUsd, spendComplete, carrySpentUsd, carrySpendComplete }`
  */
@@ -816,7 +816,50 @@ export function readResume(events, { deathAt = null, direct = false, resumableOu
    * CHECKPOINT and re-entering it is the ruling, not a second payment for an answer
    * already in hand. Empty by default, which is what keeps the reuse loop's own
    * graded-row semantics exactly where they were. */
-  const haltedResumable = open?.jobEnd ? resumableHalt.has(String(open.jobEnd.outcome)) : false;
+  const recordedOutcome = open?.jobEnd ? String(open.jobEnd.outcome) : null;
+  /** D4a — the MISLABELLED wall stop, derived from the run's own primary records.
+   *
+   * `step-red` is a verdict-shaped terminal and stays non-resumable: a red is an
+   * answer. But on u-msmt91t3 the runner minted one 9.9 seconds AFTER its own
+   * `wall-bounded` record — a governance stop wearing a capability label, because the
+   * step-variance terminal did not re-read the clock (fixed at the source, src/planrun.js).
+   * Spines already written under the defect are not re-runnable and cannot be edited (a
+   * spine is append-only forever), so the READER derives the truth the file already
+   * holds: a run whose own record says the wall was crossed BEFORE it ended is a wall
+   * stop, and W-2's ruling applies — it keeps the grades it minted and pauses.
+   *
+   * Three constraints, each of them load-bearing:
+   *   * a DERIVATION, never an override. The evidence is the run's own `wall-bounded`
+   *     event, emitted by the runner at the round seam; no caller can assert this.
+   *   * `step-red` ONLY, and only when `wall-halt` is itself resumable for this caller.
+   *     Every other outcome — green, escalated, provider-red, a step-red with no wall
+   *     record — is untouched, so "a red is an answer" survives intact.
+   *   * it touches NO close verdict. `step-red` here is a GOVERNANCE stop label; the
+   *     grades the close rendered are exactly what they were, and the resume seeds
+   *     from them.
+   * @param {any[]} seen @param {any} jobEnd */
+  const wallCrossedBefore = (seen, jobEnd) => {
+    // strictly BEFORE the terminal: a record written after the run ended could not have
+    // been what stopped it. `indexOf` on the window's own array is the ordering there is
+    // (the reader never re-sorts), and a jobEnd somehow absent from it reads nothing.
+    const end = seen.indexOf(jobEnd);
+    if (end < 0) return false;
+    for (let i = 0; i < end; i += 1) {
+      const e = seen[i];
+      if (!isObj(e) || e.type !== 'wall-bounded' || e.bounded !== true) continue;
+      // the clock's OWN two spellings of "the deadline passed", both off `clock.report`.
+      // Never a re-derivation from timestamps: a second arithmetic for one question is
+      // how two instruments come to disagree.
+      if (e.remainingMs === 0) return true;
+      if (typeof e.elapsedMs === 'number' && typeof e.requestedMs === 'number' && e.elapsedMs >= e.requestedMs) return true;
+    }
+    return false;
+  };
+  const wallDerivedHalt = recordedOutcome === 'step-red'
+    && resumableHalt.has('wall-halt')
+    && wallCrossedBefore(open.seen, open.jobEnd);
+  const haltedResumable = recordedOutcome !== null
+    && (resumableHalt.has(recordedOutcome) || wallDerivedHalt);
   if (open) {
     if (open.jobEnd && !haltedResumable) {
       // GRADED: runJob returned and the close had its say. Not a restart — the row is
@@ -963,7 +1006,14 @@ export function readResume(events, { deathAt = null, direct = false, resumableOu
     perTryBudgetUsd: head?.perTryBudgetUsd ?? directHead?.budgetUsd ?? null,
     perTryWallMs: head?.perTryWallMs ?? null,
     ended: end !== null || (directEnd !== null && !haltedResumable),
+    // the RECORDED terminal, always — the derivation below never rewrites what the run
+    // said about itself, it only says how this reader read it
     endOutcome: end?.outcome ?? directEnd?.outcome ?? null,
+    /** D4a — true when a recorded `step-red` was re-read as a wall-halt off this run's
+     * OWN `wall-bounded` record. Surfaced rather than silent: an operator resuming a
+     * run whose spine says `step-red` must be told which record turned it into a
+     * checkpoint, or the gate looks like it simply stopped refusing. */
+    wallDerivedHalt,
     greened: completed.some((t) => t.verdictClass === 'green'),
     completed,
     tried,

package/src/run.js

@@ -15,6 +15,7 @@ import { join } from 'node:path';
 import { LiteCtx } from 'litectx';
 import { validateJob, jobSpecHash, checkApproval } from './job.js';
 import { runPlan } from './planrun.js';
+import { SMOKE_STORE } from './kinds.js';
 
 /** @typedef {{code: string, path: string, detail?: string}} Red */
 
@@ -29,7 +30,7 @@ import { runPlan } from './planrun.js';
  */
 async function primitiveSmoke(workdir) {
   try {
-    const lc = new LiteCtx({ root: join(workdir, '.smoke') });
+    const lc = new LiteCtx({ root: join(workdir, SMOKE_STORE) });
     await lc.remember('smoke-known-answer', 'bareloop primitive smoke: the answer is 42', { kind: 'fact' });
     const hits = await lc.recall('bareloop primitive smoke known answer', { kind: 'fact', n: 5, body: true });
     const ok = hits.some((h) => String(h.body ?? '').includes('the answer is 42'));

package/src/text.js

@@ -70,6 +70,85 @@ export function priceOf(r) {
   };
 }
 
+/**
+ * The F6 tally over a list of PRICED CALLS — `priceOf`'s per-call read, summed.
+ *
+ * `knownUsd` carries the priced half explicitly and `costUsd` is the honest
+ * total: null the moment anything went unpriced, never the priced half wearing a
+ * complete coat. An EMPTY list is a complete $0 and not an unknown — nothing
+ * spent is a number somebody can act on.
+ * @param {{costUsd: number|null, unpricedRounds?: number}[]|null|undefined} entries
+ * @returns {{costUsd: number|null, knownUsd: number, spendComplete: boolean,
+ *   nullCostCalls: number, unpricedRounds: number}}
+ */
+export function tallyCalls(entries) {
+  const list = Array.isArray(entries) ? entries : [];
+  const known = list.reduce((a, e) => a + (typeof e.costUsd === 'number' ? e.costUsd : 0), 0);
+  const nullCostCalls = list.filter((e) => e.costUsd === null).length;
+  const unpricedRounds = list.reduce((a, e) => a + (e.unpricedRounds || 0), 0);
+  const spendComplete = nullCostCalls === 0 && unpricedRounds === 0;
+  return {
+    costUsd: spendComplete ? Number(known.toFixed(6)) : null,
+    knownUsd: Number(known.toFixed(6)),
+    spendComplete,
+    nullCostCalls,
+    unpricedRounds,
+  };
+}
+
+/**
+ * THE ONE MONEY-CEILING PREDICATE, for the same reason `priceOf` above is one:
+ * the authoring pipeline meters two populations of paid call in two different
+ * accumulators (the survey's `calls[]`, the declaration loop's cost book), and
+ * two hand-spelled answers to "am I over the ceiling?" is two instruments.
+ *
+ * It is asked BETWEEN metered calls and never inside one. A cap that binds
+ * mid-call kills the row before it can be graded — F45 measured that as 3 of 7
+ * launches lost and $5.82 unreadable.
+ *
+ * Three answers, and the order between the last two is load-bearing:
+ *   - NO CEILING → null, always. An absent cap is UNBOUNDED, and unbounded is a
+ *     visible operator choice, never a defaulted number nobody set (the
+ *     `maxWallMs` precedent). There is nothing to enforce, so unpriced spend
+ *     here is merely reported.
+ *   - KNOWN SPEND AT OR OVER THE CEILING → `cap-halt`, even when the total is
+ *     unknown. The breach is CERTAIN on the priced half alone — whatever the
+ *     unpriced remainder turns out to be, it can only be larger — so naming this
+ *     `pricing-red` would send the operator to fix a meter when the fact is that
+ *     the money is gone. At-or-over rather than over: the next call is the one
+ *     that breaches, and it is the one being decided.
+ *   - SPEND THAT CANNOT BE KNOWN → `pricing-red`. `?? 0` launders unknown into
+ *     $0 (F6) and a ceiling enforced against a laundered floor is not enforced
+ *     at all. If the spend cannot be seen the cap cannot govern it, and that is
+ *     its own stop rather than a silent pass.
+ *
+ * A MALFORMED ceiling is the one input it refuses rather than answers: `null` and
+ * an absent field mean UNBOUNDED, and they are the ONLY way to get there. Anything
+ * else that is not a finite number (`'2.50'`, `NaN`, `Infinity`) reading as
+ * unbounded would be F6's laundering in its ceiling form — a caller who set a cap
+ * getting a paid pipeline with nothing enforcing it, which is the exact collapse
+ * the ceiling exists to prevent, wearing the caller's own typo (PRD v1.62). The
+ * CLI's `parseCeiling` guards the FLAG; this guards the LIBRARY, and `authorClose`
+ * / `runAuthorScout` / `authorCloseForJob` are documented adopter seams. It THROWS
+ * rather than clamping, unlike the attempt caps beside it, because those axes have
+ * a safe direction to clamp toward and this one does not: every candidate default
+ * is either a number nobody set or the unbounded run the caller just declined.
+ * @param {{ceilingUsd: number|null|undefined, knownUsd: number, spendComplete: boolean}} o
+ * @returns {'cap-halt'|'pricing-red'|null}
+ * @throws {Error} when the ceiling is neither absent nor a finite number
+ */
+export function capStop({ ceilingUsd, knownUsd, spendComplete }) {
+  if (ceilingUsd === null || ceilingUsd === undefined) return null;
+  if (typeof ceilingUsd !== 'number' || !Number.isFinite(ceilingUsd)) {
+    throw new Error(`capStop: a money ceiling must be a finite number of dollars or null — got ${typeof ceilingUsd} `
+      + `${String(ceilingUsd)}. A malformed ceiling is an ERROR, never a silent fall back to UNBOUNDED: omit it, or `
+      + 'pass an explicit null, to run unbounded — that is a stated operator choice and never a typo arrived at');
+  }
+  if (knownUsd >= ceilingUsd) return 'cap-halt';
+  if (!spendComplete) return 'pricing-red';
+  return null;
+}
+
 // ── THE RAW MODEL OUTPUT, AS A PERSISTED RECORD ─────────────────────────────
 //
 // Run mslhn707 died on a survey that broke JSON at position 1339 and left NO

package/src/tools.js

@@ -31,6 +31,7 @@ import { extractArtifact, priceOf } from './text.js';
 // caller can forget to pass, and this leak has to be inexpressible, not optional.
 // Same ONE inventory the spine channel and the close output ride through.
 import { redactSecrets } from './validate.js';
+import { GATE_AUDIT_FILE, ARBITER_BOOK_STORES } from './kinds.js';
 
 /** @typedef {{body?: string|null, text?: string|null}} RecallHit litectx recall hit — body present only with `{body: true}` */
 
@@ -45,6 +46,16 @@ const PERSONA = 'You are a senior engineer. Reply with ONLY the complete content
 // cheap, wrong attempt the rational move — which is exactly what the loop wants.
 export const PERSONA_TOOLS = 'You are a senior engineer working in a repository through file tools. '
   + 'ALWAYS use absolute paths — relative paths resolve against the process, not the repository, and will be denied. '
+  // F98's residual: the fence ALREADY denies these (planrun's Gate deny list), and the
+  // spine is written outside the patient entirely — but nothing ever SAID so, and a
+  // denial is a wall while a stated law is a map. The way a worker learned the rule was
+  // by spending rounds of a bounded attempt probing bookkeeping files, and the rounds a
+  // probe costs are rounds the fix does not get. Registered here, beside the other fence
+  // fact a worker cannot infer, so it renders for every worker on every grant.
+  // the names are SPELLED FROM the one home (`ARBITER_BOOK_STORES`) so the stated
+  // law can never drift from the fence that enforces it
+  + `The repository root also holds the arbiter's own books — ${GATE_AUDIT_FILE}, ${ARBITER_BOOK_STORES.join(', ')}, and this run's spine. `
+  + 'They are ALWAYS denied and record how you are being judged, never anything about the task: never read them, and never try to route around the denial. '
   + 'You are ONE attempt inside an automated loop: when you finish, a test suite runs and, if it still fails, you are called again with its output. '
   + 'So do not try to be certain before acting. Read only what you need to form your best hypothesis, make the change with the write tool, and stop. '
   + 'A wrong cheap attempt is corrected by the next round; exhaustive reading is not — every file you read is re-sent on every later round and the run has a hard budget it can exhaust before you ever write. '