bareloop 0.9.0 → 0.11.0

package/types/kinds.d.ts

@@ -36,15 +36,25 @@ export function seedListing(workdir: string, seedRef: string): Promise<{
     files: string[];
 }>;
 /**
- * The two arbiter books, and the shape of each exclusion is the whole point.
+ * The arbiter books, and the shape of each exclusion is the whole point.
  *
- * `.litectx/` is a PREFIX — everything beneath the store belongs to the
- * arbiter. `gate-audit.jsonl` is an EXACT repo-relative path and never a
- * basename or a pattern: the gate audit is written to
+ * `.litectx/` and `.smoke/` are PREFIXES — everything beneath either store
+ * belongs to the arbiter. `gate-audit.jsonl` is an EXACT repo-relative path and
+ * never a basename or a pattern: the gate audit is written to
  * `join(workdir, 'gate-audit.jsonl')` and nowhere else, so a worker-authored
  * `src/gate-audit.jsonl` is NOT an arbiter book and must still count as work.
  * Matching by basename would swallow it — and swallowing a worker's real
- * write is the failure direction that reads as a clean tree.
+ * write is the failure direction that reads as a clean tree. `src/smoke.js` and
+ * `tests/smoke.test.js` are that same decoy for the store below.
+ *
+ * `.smoke/` — F98's parked residual, closed here. The fence has always denied
+ * `join(workdir, '.smoke')` on every worker (src/planrun.js, src/authorscout.js)
+ * and the persona now states the rule; this reader, which decides what COUNTS AS
+ * WORK, was the one place that never knew the name. On patients whose .gitignore
+ * default-denies dot-directories the store never reaches `ls-files --others` and
+ * the gap is masked — by the PATIENT's config, not by anything here. Incidental
+ * masking is not an exclusion: on a patient without that line the arbiter's own
+ * store would enter the changed set as the worker's writing.
  * @param {string} rel a repo-relative POSIX path
  * @returns {string|null} the book it belongs to, or null
  */
@@ -146,13 +156,36 @@ export function normalizeParser(parser: any, at?: string): {
  * that matched BEFORE the filter judged them — kept, unattributable and dropped
  * alike — and it is the only evidence of liveness a caller has once the scope
  * has removed the whole population. It is never the number being read.
+ *
+ * `matched` is the KEPT lines themselves, PER TERM and index-aligned with
+ * `breakdown`: entry i holds, in output order, exactly the lines term i's
+ * subtotal was computed FROM. Run u-msn227nq paid for the echo — the executor
+ * counted 8 real `error TS…` lines and told the worker "8 match(es)", discarding
+ * every address, and a worker with a number and no file to open went looking for
+ * the arbiter's own books instead.
+ *
+ * TWO EXCLUSIONS, both of them "this line is not what the count is made of":
+ *  - a scope-DROPPED line is never in here. It was never counted, so aiming the
+ *    worker at it would aim it outside its own population.
+ *  - under `first`, only the line the aggregate actually READ. The later matches
+ *    are real matches (`breakdown[i].matches` still counts them) but the value
+ *    never contained them, and echoing them points the worker at a number that
+ *    is not in the reading.
+ *
+ * And the GROUPING is the third: a term's sign lives in `breakdown[i]`, so lines
+ * pooled flat across terms lose the one fact that says what they DID to the
+ * number. A subtracted term's line rendered beside an added one reads as a wall
+ * to go fix, and fixing it moves the count the wrong way. Deduplication is
+ * therefore within a term only — one line matched by two terms plays two
+ * arithmetic roles and is named under each. The count is computed from `values`,
+ * never from this list.
  * @param {string} output @param {any[]} terms normalised terms
  * Every stop here is `crashed` in the arbiter's vocabulary — the command RAN,
  * came back, and the number could not be read out of it. Nothing in this
  * function can observe a spawn failure, a timeout or a signal, so it never
  * claims one.
  * @param {{scope?: any, workdir?: string}} [o]
- * @returns {{stop: string, fault: string, notes?: string[]}|{stop: null, value: number, breakdown: any[], notes: string[], preScopeMatches: number}}
+ * @returns {{stop: string, fault: string, notes?: string[]}|{stop: null, value: number, breakdown: any[], notes: string[], preScopeMatches: number, matched: string[][]}}
  */
 export function parseValue(output: string, terms: any[], { scope, workdir }?: {
     scope?: any;
@@ -167,6 +200,7 @@ export function parseValue(output: string, terms: any[], { scope, workdir }?: {
     breakdown: any[];
     notes: string[];
     preScopeMatches: number;
+    matched: string[][];
 };
 /**
  * A caller-scoped holder for detached seed worktrees. Scoped rather than
@@ -177,6 +211,30 @@ export function parseValue(output: string, terms: any[], { scope, workdir }?: {
  * @returns {SeedTrees}
  */
 export function makeSeedTrees(): SeedTrees;
+/**
+ * THE SIGNER'S ANSWER, normalised at the seam that accepts it — the library half
+ * of the three-button gate (2026-08-12 §1).
+ *
+ * `null` is not a refusal: no ruling at all IS the pause path, which is how every
+ * ordinary run and every first leg of a hitl run arrives here. What is refused is
+ * an answer that is not one of the three doors, and — the case the POC's negative
+ * control measured — a `rerun` with no text. Ruling 3 makes the human's words the
+ * gap the worker converts from; an empty one launches a fix worker that re-runs
+ * as though nothing had been said, which is the failure this refusal exists for.
+ *
+ * It never throws and never repairs: a decision that cannot be read is handed
+ * back as a refusal with its reason, and the caller decides what to do about it.
+ * @param {any} ruling
+ * @returns {{ok: boolean, ruling: {decision: string, text: string|null}|null, why: string|null}}
+ */
+export function normalizeHumanRuling(ruling: any): {
+    ok: boolean;
+    ruling: {
+        decision: string;
+        text: string | null;
+    } | null;
+    why: string | null;
+};
 /**
  * Run ONE declared stage against a workdir at a seed.
  *
@@ -220,13 +278,14 @@ export function seedRead(declaration: any, ctx: Ctx): Promise<StageResult[]>;
  * room would break a documented adopter contract for nothing; the new name says
  * exactly what differs. `src/declaredclose.js` is what bridges the two shapes.
  * @param {any} declaration @param {Ctx} ctx
- * @returns {Promise<{verdict: 'green'|'red'|'instrument-stop', exitCode: number, judged: boolean, firstRed: string|null, stages: StageResult[]}>}
+ * @returns {Promise<{verdict: 'green'|'red'|'instrument-stop'|'pause', exitCode: number|null, judged: boolean, firstRed: string|null, pausedAt: string|null, stages: StageResult[]}>}
  */
 export function runDeclaredClose(declaration: any, ctx: Ctx): Promise<{
-    verdict: "green" | "red" | "instrument-stop";
-    exitCode: number;
+    verdict: "green" | "red" | "instrument-stop" | "pause";
+    exitCode: number | null;
     judged: boolean;
     firstRed: string | null;
+    pausedAt: string | null;
     stages: StageResult[];
 }>;
 /** the close's two judgment exits — a stage's verdict, in the shape the
@@ -296,6 +355,46 @@ export const SIGNS: readonly number[];
  * counted demand (the request-red path), and reaching one at runtime is a
  * stop — never a red, and never a silent pass. */
 export const LIVE_KINDS: readonly string[];
+/** RULING 8 — the stages the seed-verdict read (D12) must NOT run. A judged
+ * number at seed is unstable and a person at seed is an interview, not a
+ * measurement; their bar comes from calibration (soft-green) or from the person
+ * themselves (hitl), never from the seed. The skip is RECORDED by name rather
+ * than taken in silence (F59: absent is not empty), so `seedRead` still returns
+ * one row per declared stage. */
+export const SEED_EXEMPT_KINDS: readonly string[];
+/** the one kind a PERSON renders — named once, because the runner keys three
+ * decisions on it (is there a door to answer, which stage paused, whose ruling
+ * this is) and three literals is how they come to disagree */
+export const HUMAN_KIND: "human-confirms";
+/** the three doors the signer is offered at a hitl pause (2026-08-12 §1, doors
+ * re-cut 2026-08-17). No fourth door, and no free-text-only variant: a red that
+ * is not one of these two is not a ruling the run can act on.
+ *
+ * `cancel` was the third door and is DELETED as a concept (hamr: *"what's the
+ * point of cancel anyways? pause can resume — that would be more honest"*). The
+ * case it served — a person who looks and does not want to carry on — is a pause
+ * nobody returns to, which the 60-day checkpoint TTL retires on its own. Nothing
+ * here forces a forever-decision at the one moment the person has least reason
+ * to make one. */
+export const HUMAN_DECISIONS: readonly string[];
+/**
+ * The arbiter's book NAMES, one home. F98's mechanism was exactly this list
+ * living as independent literals: the fence deny arrays (src/planrun.js,
+ * src/authorscout.js) knew `.smoke` while `isArbiterBook` — the reader that
+ * decides what COUNTS AS WORK — did not, and the drift was masked by the
+ * patient's own .gitignore. Every consumer (the fence deny lists, this file's
+ * reader, the persona's stated law, run.js's smoke-store root) now spells the
+ * names from here, so adding or renaming a book is one edit that cannot leave
+ * a site behind.
+ *
+ * `ARBITER_BOOK_STORES` are directory PREFIXES; `GATE_AUDIT_FILE` is an EXACT
+ * repo-relative path (see `isArbiterBook`'s docstring for why never a
+ * basename). Order is the fence deny-list order and the persona's prose order.
+ */
+export const SMOKE_STORE: ".smoke";
+export const LITECTX_STORE: ".litectx";
+export const GATE_AUDIT_FILE: "gate-audit.jsonl";
+export const ARBITER_BOOK_STORES: readonly string[];
 export type Red = {
     code: string;
     path: string;
@@ -304,6 +403,13 @@ export type Red = {
 /**
  * The arbiter's half of a stage run. Every field here is operator/runner
  * territory: a declaration parameterises kinds, never the contracts.
+ * `humanRuling` is the SIGNER's answer at a hitl pause, carried in from the
+ * runner — never authored, never defaulted, and absent on every ordinary run.
+ * `onStage` is a REPORTING seam and nothing else: the seed read spawns a real
+ * toolchain per stage (a suite is the slow one) and a whole read is one opaque
+ * await, so the shell gets told as each stage lands. It decides nothing, it is
+ * never consulted, and no verdict depends on it — the house pattern is
+ * `runJob`'s `emit` (the library reports, the shell prints).
  */
 export type Ctx = {
     workdir: string;
@@ -314,9 +420,27 @@ export type Ctx = {
     gapCap?: number;
     maxBuffer?: number;
     seedTrees?: SeedTrees;
+    humanRuling?: {
+        decision: string;
+        text?: string | null;
+    } | null;
+    onStage?: (row: {
+        stage: string | null;
+        kind: string | null;
+        verdict: string;
+        durationMs: number;
+    }) => void;
 };
+/**
+ * Six outcomes, and only two of them are verdicts. `pause` is N4's fifth: the
+ * close reached a stage a machine cannot render and is WAITING on a person —
+ * neither green nor red, and never graded (the F17 forbidden-zone rule applied
+ * to a non-verdict). `skipped` is the sixth and says a stage was deliberately
+ * not run at THIS reading (ruling 8's seed exemption), which is a different
+ * fact from `not-reached` (an earlier stage decided first).
+ */
 export type StageResult = {
-    verdict: "green" | "red" | "instrument-stop" | "not-reached";
+    verdict: "green" | "red" | "instrument-stop" | "not-reached" | "pause" | "skipped";
     exitCode: number | null;
     value: number | null;
     baseline: number | null;

package/types/planrun.d.ts

@@ -78,6 +78,42 @@
  * @returns {string} the labelled block, or '' when there is nothing to show
  */
 export function closeGapBlock(gap: string | null | undefined): string;
+/**
+ * What the NEXT attempt is told about the bound that cut the previous one.
+ *
+ * Two different bounds used to set the same bare `attemptBounded = roundIteration`
+ * and therefore render the same sentence. For a round-bound cutoff that sentence is
+ * true. For BA-11's deny streak it is false twice over — the rounds did NOT run out
+ * (the fence short-circuited the attempt with budget left), and the count it quotes
+ * is the cap, not what was spent — and it aims the worker at the READ BUDGET when the
+ * thing that stopped it was the FENCE. The reason was already recorded on the spine;
+ * nothing carried it to the one reader who could act on it.
+ *
+ * The denial note is MECHANICAL in the strict sense: it quotes the terminal the
+ * provider actually returned and names which bound fired. It invents nothing —
+ * no streak count and no denied path, because bare-agent's return (`error:
+ * 'denied:<tool>'`, loop.js) carries neither, and a number nobody measured is a
+ * bug with a confident voice. Every other cause keeps the frozen wording byte for
+ * byte: a wall-bounded attempt reads as a round bound exactly as it did before
+ * (and is unreachable anyway — the step head refuses to fund an attempt past the
+ * deadline, W-2), so this change can only ever speak where it has something true
+ * to add.
+ *
+ * The reason arrives ALREADY SCRUBBED (the capture seam in `mkWorker` runs it
+ * through the one `SECRET_PATTERNS` inventory), so this renderer only bounds it —
+ * and announces the trim with the repo's ONE marker rather than a second spelling
+ * of "this text was cut" (F90.2).
+ *
+ * @param {{iteration?: number|string|undefined, cause: string, reason: string|null}|null|undefined} bounded
+ *   the previous attempt's bound state, or nullish when it was not bounded
+ * @param {number} rounds the step's round bound, as quoted by the frozen sentence
+ * @returns {string|null} the note, or null when there is nothing to say
+ */
+export function boundedNote(bounded: {
+    iteration?: number | string | undefined;
+    cause: string;
+    reason: string | null;
+} | null | undefined, rounds: number): string | null;
 /**
  * The plan-drafting prompt: a schema DESCRIPTION built from the live validator
  * menus — never a copyable example (the drafter must author, not echo; the
@@ -258,12 +294,24 @@ export function planPrompt(job: any, scoutBlob: string, reds: any[] | null, maxS
  *   it the deterministic name would collide with that very branch and the collision walk
  *   would mint a `-2` beside the progress the resume exists to keep. Absent is the cold
  *   path. A recorded branch that no longer exists is a STOP, never a fresh start.
+ * @param {{decision: string, text?: string}|null} [opts.humanRuling] N4 — the SIGNER's
+ *   answer at a hitl pause (2026-08-12 §1, re-cut 2026-08-17: accept | rerun <text> | pause), carried in
+ *   by the runner on the leg that RESUMES a paused run. Absent on every ordinary run and
+ *   on the leg that pauses; it is never authored, never defaulted, and never inferred.
+ *
+ *   It is spent ONCE, on this leg's close readings up to the moment the fix loop opens:
+ *   `accept` greens the human stage on fresh evidence (OPEN-3 — the mechanical stages
+ *   re-run first, because the tree can change while a run is paused), `rerun` reds it
+ *   with the human's own words as the gap, and `pause` keeps the checkpoint exactly as it
+ *   is, before anything is read at all. After the fix loop opens the ruling is gone, so once the mechanical
+ *   stages pass again the run PAUSES for a second review rather than converting the same
+ *   sentence forever.
  * @returns {Promise<string>} 'green' | 'already-green' | 'escalated' | 'plan-red' |
  *   'check-red' | 'close-red' | 'close-unsupported' | 'recipe-stale' | 'pricing-red' |
  *   'branch-red' | 'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' |
- *   'step-stalled' | `step-red:<id>`
+ *   'step-stalled' | 'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  */
-export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, maxStepRounds, layerRoot, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch }: {
+export function runPlan(job: any, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced, spendComplete, capRuns, strikeLimit, closeTimeoutMs, maxStepRounds, layerRoot, scoutRounds, bridge, now, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling }: {
     workdir: string;
     provider: any;
     nativeProvider?: ((o: {
@@ -296,7 +344,18 @@ export function runPlan(job: any, { workdir, provider, nativeProvider, providerF
     spendComplete?: (() => boolean) | undefined;
     now?: (() => number) | undefined;
     resumeBranch?: string | null | undefined;
+    humanRuling?: {
+        decision: string;
+        text?: string;
+    } | null | undefined;
 }): Promise<string>;
+/**
+ * The recorded bound-reason's ceiling in the WORKER-facing note. The reason is a
+ * provider string (`denied:<tool>` today, ~20 bytes), not a gap, so this is a
+ * backstop against a future terminal that arrives long — never an envelope the
+ * shipped path routinely rides through.
+ */
+export const BOUND_REASON_MAX: 200;
 export type CategorizedError = Error & {
     category?: string;
     lib?: string;

package/types/reuse.d.ts

@@ -221,7 +221,7 @@ export function selectBridge({ registry, job, ask, provider, pinned, shortlist,
  *   which is later and better evidence than the last event). Defaults to the last
  *   event's own timestamp — the last sign of life there is.
  * @returns {any} `{ started, approvalHash, specHash, patient, job, bridgeTries,
- *   perTryBudgetUsd, perTryWallMs, ended, endOutcome, greened, completed, tried,
+ *   perTryBudgetUsd, perTryWallMs, ended, endOutcome, wallDerivedHalt, greened, completed, tried,
  *   selectionCostUsd, selectionComplete, strayRounds, r1Missing, restart, deathAtKnown,
  *   spentUsd, spendComplete, carrySpentUsd, carrySpendComplete }`
  */
@@ -230,6 +230,43 @@ export function readResume(events: any[], { deathAt, direct, resumableOutcomes }
     direct?: boolean;
     resumableOutcomes?: string[];
 }): any;
+/**
+ * The AGE gate for a paused checkpoint — the sibling of `resumeTreeGate`, and it
+ * asks the other question a 60-day-old checkpoint raises. The tree gate asks
+ * *is this still the tree the run left?*; this asks *is this still a decision
+ * anyone is waiting on?*
+ *
+ * THREE things it deliberately does NOT do:
+ *
+ *  - it does not widen any other resume rule. The 2026-08-12 ruling is about a
+ *    person deciding, so `applies: false` on every other terminal: a cap-halt
+ *    checkpoint is a different stop under a different allowance, and quietly
+ *    ageing it out would be a governance change nobody ruled.
+ *  - it does not treat an unreadable stamp as young (F6). A checkpoint that
+ *    cannot say WHEN it paused has an unknown age, and unknown is refused rather
+ *    than rounded down to fresh — the direction that fails safe.
+ *  - it does not skip silently. An expired checkpoint comes back as a refusal
+ *    that NAMES the age and the TTL, because the operator's next move (start
+ *    fresh) depends on knowing which of the two it hit.
+ *
+ * The clock is injected for the same reason `runPlan`'s is: a rule measured in
+ * months cannot otherwise be tested at all.
+ *
+ * @param {any[]} events the paused run's own spine, parsed, in file order
+ * @param {{now?: () => number, ttlMs?: number}} [opts]
+ * @returns {{ok: boolean, applies: boolean, ageMs: number|null, ttlMs: number, pausedAt: string|null, detail: string|null}}
+ */
+export function checkpointAgeGate(events: any[], { now, ttlMs }?: {
+    now?: () => number;
+    ttlMs?: number;
+}): {
+    ok: boolean;
+    applies: boolean;
+    ageMs: number | null;
+    ttlMs: number;
+    pausedAt: string | null;
+    detail: string | null;
+};
 /**
  * The PATIENT gate for a resume, which is deliberately NOT the fresh-launch one.
  *
@@ -384,6 +421,43 @@ export function runReuse(opts: {
  *    started.
  */
 export const REUSE_GRADED_RED: readonly string[];
+/**
+ * WHICH TERMINALS ARE A CHECKPOINT — the list a runner hands `readResume` as
+ * `resumableOutcomes`, minted HERE rather than in whichever script happens to
+ * launch a run.
+ *
+ * `readResume` deliberately takes it as a parameter and defaults to empty, and
+ * that stays true: the reuse loop's own semantics depend on the empty default.
+ * What did not exist was a canonical ANSWER, so `scripts/run-u.mjs` kept its own
+ * copy — and the exported bundle (PRD v1.44 §2: a thin runner with bareloop as a
+ * dependency) would have had to keep a third. The same reasoning that put the
+ * pause TTL in the library (OPEN-2, hamr, 2026-08-13) puts this here.
+ *
+ * Every entry is a stop that left WORK ON DISK and an allowance unspent — money,
+ * time, a self-healed stall, and now a person who has not answered yet. A verdict
+ * already rendered is never on this list: `green`/`escalated` are graded rows, and
+ * re-buying one would pay twice for an answer already in hand. (The signer's own
+ * `hitl-cancel` terminal used to be the other example; the door was deleted on
+ * 2026-08-17 — a person who does not want to carry on pauses, and the checkpoint
+ * they keep is retired by the TTL rather than by a terminal.)
+ *
+ * The human half is SPLICED IN from `declaredclose.js` rather than spelled again,
+ * because the try loop below reads the two halves differently and a second copy is
+ * how they would come to disagree about which member is which: the first three are
+ * allowances the loop's remaining tries are meant to spend against, and the human
+ * ones are the stop no further try can change (see `hardStop`).
+ */
+export const CHECKPOINT_OUTCOMES: readonly string[];
+/**
+ * THE PAUSE TTL (2026-08-12 §2): a hitl checkpoint is kept for 60 days.
+ *
+ * OPEN-2, RULED (hamr, in-turn, 2026-08-13): **the TTL lives in the LIBRARY**, so
+ * the exported bundle (a headless runner with bareloop as a dependency, PRD v1.44
+ * §2) inherits it instead of every runner re-implementing it. A script-only TTL
+ * would vanish on export — the one place the rule is most needed and least
+ * likely to be re-typed.
+ */
+export const PAUSE_TTL_MS: number;
 export type Red = {
     code: string;
     path: string;

package/types/run.d.ts

@@ -97,12 +97,18 @@
  *        a manufactured-fixation probe). `true` is the ON/experimental arm; the
  *        default is the OFF arm. (Shell-owned seam, same doctrine as the provider
  *        binding.)
+ * @param {{decision: string, text?: string}|null} [opts.humanRuling] N4 — the SIGNER's
+ *   answer at a hitl pause (accept | rerun <text> | pause), carried by the leg that
+ *   RESUMES a paused run and forwarded verbatim to the plan flow. Absent on every
+ *   ordinary run; never authored and never defaulted (a defaulted answer to "is this
+ *   done?" is the rubber-stamp the class exists to prevent, 2026-08-12 §4).
  * @returns {Promise<string>} outcome: 'green' | 'already-green' | 'escalated' |
  *   'unapproved-spec' | 'job-red' | 'smoke-red' | 'plan-red' | 'check-red' |
  *   'close-red' | 'close-unsupported' | 'recipe-stale' | 'branch-red' | 'pricing-red' | 'provider-red' |
- *   'interpreter-red' | 'cap-halt' | 'wall-halt' | 'step-stalled' | `step-red:<id>`
+ *   'interpreter-red' | 'cap-halt' | 'wall-halt' | 'step-stalled' |
+ *   'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  */
-export function runJob(rawSpec: object | string, { approvals, workdir, provider, nativeProvider, providerFor, emit, capRuns, strikeLimit, shellCapUsd, closeTimeoutMs, layerRoot, bridge, priorSpentUsd, priorSpendComplete, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch }: {
+export function runJob(rawSpec: object | string, { approvals, workdir, provider, nativeProvider, providerFor, emit, capRuns, strikeLimit, shellCapUsd, closeTimeoutMs, layerRoot, bridge, priorSpentUsd, priorSpendComplete, priorWallMs, resumeSeed, resumeGrades, resumeReplans, resumeBranch, humanRuling }: {
     approvals: unknown;
     workdir: string;
     provider: any;
@@ -133,6 +139,10 @@ export function runJob(rawSpec: object | string, { approvals, workdir, provider,
     } | null | undefined;
     resumeBranch?: string | null | undefined;
     layerRoot?: boolean | undefined;
+    humanRuling?: {
+        decision: string;
+        text?: string;
+    } | null | undefined;
 }): Promise<string>;
 export type Red = {
     code: string;

package/types/text.d.ts

@@ -33,6 +33,73 @@ export function priceOf(r: any): {
     costUsd: number | null;
     unpricedRounds: number;
 };
+/**
+ * The F6 tally over a list of PRICED CALLS — `priceOf`'s per-call read, summed.
+ *
+ * `knownUsd` carries the priced half explicitly and `costUsd` is the honest
+ * total: null the moment anything went unpriced, never the priced half wearing a
+ * complete coat. An EMPTY list is a complete $0 and not an unknown — nothing
+ * spent is a number somebody can act on.
+ * @param {{costUsd: number|null, unpricedRounds?: number}[]|null|undefined} entries
+ * @returns {{costUsd: number|null, knownUsd: number, spendComplete: boolean,
+ *   nullCostCalls: number, unpricedRounds: number}}
+ */
+export function tallyCalls(entries: {
+    costUsd: number | null;
+    unpricedRounds?: number;
+}[] | null | undefined): {
+    costUsd: number | null;
+    knownUsd: number;
+    spendComplete: boolean;
+    nullCostCalls: number;
+    unpricedRounds: number;
+};
+/**
+ * THE ONE MONEY-CEILING PREDICATE, for the same reason `priceOf` above is one:
+ * the authoring pipeline meters two populations of paid call in two different
+ * accumulators (the survey's `calls[]`, the declaration loop's cost book), and
+ * two hand-spelled answers to "am I over the ceiling?" is two instruments.
+ *
+ * It is asked BETWEEN metered calls and never inside one. A cap that binds
+ * mid-call kills the row before it can be graded — F45 measured that as 3 of 7
+ * launches lost and $5.82 unreadable.
+ *
+ * Three answers, and the order between the last two is load-bearing:
+ *   - NO CEILING → null, always. An absent cap is UNBOUNDED, and unbounded is a
+ *     visible operator choice, never a defaulted number nobody set (the
+ *     `maxWallMs` precedent). There is nothing to enforce, so unpriced spend
+ *     here is merely reported.
+ *   - KNOWN SPEND AT OR OVER THE CEILING → `cap-halt`, even when the total is
+ *     unknown. The breach is CERTAIN on the priced half alone — whatever the
+ *     unpriced remainder turns out to be, it can only be larger — so naming this
+ *     `pricing-red` would send the operator to fix a meter when the fact is that
+ *     the money is gone. At-or-over rather than over: the next call is the one
+ *     that breaches, and it is the one being decided.
+ *   - SPEND THAT CANNOT BE KNOWN → `pricing-red`. `?? 0` launders unknown into
+ *     $0 (F6) and a ceiling enforced against a laundered floor is not enforced
+ *     at all. If the spend cannot be seen the cap cannot govern it, and that is
+ *     its own stop rather than a silent pass.
+ *
+ * A MALFORMED ceiling is the one input it refuses rather than answers: `null` and
+ * an absent field mean UNBOUNDED, and they are the ONLY way to get there. Anything
+ * else that is not a finite number (`'2.50'`, `NaN`, `Infinity`) reading as
+ * unbounded would be F6's laundering in its ceiling form — a caller who set a cap
+ * getting a paid pipeline with nothing enforcing it, which is the exact collapse
+ * the ceiling exists to prevent, wearing the caller's own typo (PRD v1.62). The
+ * CLI's `parseCeiling` guards the FLAG; this guards the LIBRARY, and `authorClose`
+ * / `runAuthorScout` / `authorCloseForJob` are documented adopter seams. It THROWS
+ * rather than clamping, unlike the attempt caps beside it, because those axes have
+ * a safe direction to clamp toward and this one does not: every candidate default
+ * is either a number nobody set or the unbounded run the caller just declined.
+ * @param {{ceilingUsd: number|null|undefined, knownUsd: number, spendComplete: boolean}} o
+ * @returns {'cap-halt'|'pricing-red'|null}
+ * @throws {Error} when the ceiling is neither absent nor a finite number
+ */
+export function capStop({ ceilingUsd, knownUsd, spendComplete }: {
+    ceilingUsd: number | null | undefined;
+    knownUsd: number;
+    spendComplete: boolean;
+}): "cap-halt" | "pricing-red" | null;
 /**
  * ONE raw model emission, ready to persist.
  *

package/types/validate.d.ts

@@ -86,16 +86,40 @@ export function sweepSecretLiterals(root: any, red: (code: string, path: string,
  * So the reject targets the dominant exponential class and fails it as a
  * mechanical gap at the validation gate, before any tokens burn. A full ReDoS
  * analyzer needs a real regex engine (an external native dep we do not take for
- * a LOW issue); exotic overlapping-alternation blowup is out of scope by
- * decision (PARKED to the close-authoring rung — PRD v1.55).
+ * a LOW issue).
+ *
+ * SECOND CLASS, added 2026-08-12 — OVERLAPPING ALTERNATION under an unbounded
+ * repeat (`(a|aa)+`, `(a|a)+`, `(\d|\d\d)*`). F49 recorded this as a genuine
+ * false NEGATIVE of the shape approach and PARKED the widening, because changing
+ * the detector changes which SIGNED specs are admissible. It is closed here on
+ * measurement, one fresh process per point (a hot RegExp tiers up out of the V8
+ * interpreter, and a single-process sweep read a LONGER body as faster —
+ * backwards for an exponential, and the harness rather than the regex).
+ * `(a|aa)+$` against a run of `a` with one non-matching tail character:
+ *
+ *     27ch 218ms · 31ch 1,879ms · 35ch 12,082ms · 39ch 52,563ms · 41ch 189,420ms
+ *
+ * ~6.8× per 4 characters — the Fibonacci decomposition count, φ⁴. `(a|a)+$` (the
+ * 2ⁿ equal-branch case) took 52,256ms on 27ch, and `((a|aa))+$` — the redundant
+ * wrapper the `((a+))+` entry above exists for — 15,426ms on 35ch, which is why
+ * the overlap propagates up through a wrapper exactly as the inner repeat does.
+ * Input-bounding is theater here for F49's own reason: tens of characters suffice.
+ *
+ * The detected core is the PREFIX RELATION between top-level branches (one branch
+ * a prefix of another, equality included — `(a|a)+` is the 2ⁿ case). Whether a
+ * given prefix overlap can actually be DRIVEN exponentially depends on what
+ * follows the group, and deciding that needs the real engine this file declined
+ * to take as a dependency — so the reject is conservative by construction, which
+ * is the fail-safe direction.
+ *
+ * MONOTONIC, and that is the rule this change lives under: it only ever ADDS
+ * rejections. Nothing above is narrowed, and no previously-rejected shape became
+ * admissible (asserted over the whole corpus in tests/plan.test.js). F49's
+ * "never sharpen the detector" bars chasing false POSITIVES; closing a false
+ * NEGATIVE by adding rejections is the opposite, allowed direction — distinct
+ * rules, not in tension (the `((a+))+` widening set the precedent).
  *
  * SCOPE IS ASYMMETRIC, both directions named on purpose:
- *   - false NEGATIVE: overlapping-alternation blowup (`(a|ab)+`-class) is not
- *     detected — there is no inner QUANTIFIER to find, so the shape scan cannot
- *     see it; the blowup comes from overlapping alternation BRANCHES under a
- *     repeat. A genuine limit of the approach, not a bug in it. Widening the
- *     detector changes which SIGNED specs are admissible, which is
- *     arbiter-adjacent — parked, not chased (PRD v1.55).
  *   - false POSITIVE: a group whose repetitions are disambiguated by a literal
  *     anchor/delimiter (`(?:^- .+$\n?)+`, `(?:CHANGELOG:.+\n)+`) is FLAGGED even
  *     though a real engine runs it linearly — the scan sees the nested-quantifier
@@ -106,10 +130,51 @@ export function sweepSecretLiterals(root: any, red: (code: string, path: string,
  *     and guessing it wrong would ADMIT an exponential pattern — so the shape
  *     reject stands, and the over-rejection is a named, accepted limitation.
  *
+ *     The alternation class has its OWN instance of the same limit, measured and
+ *     locked in `REDOS_OVERREJECTED_ALT`: `(ab|abc)+$`, `(x|xy|xyz)+$` and
+ *     `(x(a|aa))+$` carry the prefix relation and did NOT blow up on the bodies
+ *     measured (0.3–0.4ms at 41–91 characters). "Did not blow up on the body
+ *     measured" is the honest claim — no adversarial search was run for a worse
+ *     input — and rejecting them is again the direction that never admits an
+ *     exponential pattern.
+ *
  * The input is guaranteed to compile as a RegExp (checked first by the caller),
  * so this scan assumes valid, balanced JS regex syntax.
  * @param {string} src a compiled regex source string
- * @returns {boolean} true iff a nested unbounded quantifier is present
+ * @returns {boolean} true iff a nested unbounded quantifier, or an unboundedly
+ *   repeated group with overlapping alternation branches, is present
  */
 export function hasNestedQuantifier(src: string): boolean;
+/**
+ * The catastrophic-backtracking reject, applied to a WHOLE signed document by
+ * tree walk — `sweepSecretLiterals`'s twin, and for its reason: some signed
+ * documents carry their regexes at a depth no per-field check enumerates.
+ *
+ * WHY IT EXISTS (PRD v1.60 §1, an OPEN GAP now closed). v1.55 took F49's reject
+ * to the operator's own regex fields, and the admissibility sweep that backed it
+ * walked `jobs/*.json`. That is not the population of signed specs: a REGISTRY
+ * BRIDGE is signed the same way, ships its plans VERBATIM (reuse stores the
+ * whole plan, never a template), and lives outside `jobs/`, so a pathological
+ * pattern arriving through a bridge was never swept. Nothing had decided
+ * bridge-borne patterns were safe — the sweep was written against the directory
+ * that held every spec at the time and was never re-aimed.
+ *
+ * WHAT is rejected is UNCHANGED: `hasNestedQuantifier`, one inventory, shared
+ * with job.js and plan.js. Only WHERE it looks is wider. Widening the DETECTOR
+ * is arbiter-adjacent and stays parked (F49); widening the POPULATION is this.
+ *
+ * KEY-SCOPED, deliberately. `pattern` and `gapKeep` are the exactly-three regex
+ * fields F49 names (`artifact-written.pattern`, `judged.pattern`, `gapKeep`);
+ * every other string in a signed document is prose, a path or a command, and
+ * running a regex-shape scan over prose would red goals for containing `(a+)+`
+ * in a sentence. A field carrying a regex under a NEW key is not swept until
+ * this list names it — stated so the limit is read rather than rediscovered.
+ *
+ * COMPILE-FIRST, like both per-field callers: the scan's contract is that its
+ * input is valid regex syntax, and a string that does not compile is the OTHER
+ * validator's red. Two reds on one string bury the real one.
+ * @param {any} root
+ * @param {(code: string, path: string, detail?: string) => void} red
+ */
+export function sweepNestedQuantifiers(root: any, red: (code: string, path: string, detail?: string) => void): void;
 export const SECRET_PATTERNS: RegExp[];