bareloop 0.9.0 → 0.11.0

package/src/authorscout.js

@@ -50,11 +50,11 @@ import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import { Gate } from 'bareguard';
 import { LiteCtx } from 'litectx';
-import { seedListing } from './kinds.js';
+import { seedListing, GATE_AUDIT_FILE, ARBITER_BOOK_STORES } from './kinds.js';
 import { TOOL_MENU, WRITE_VERBS, STORE_VERBS } from './job.js';
 import { TOOL_BY_VERB, CTX_TOOLS, createCtxTools, toolAction, strategyFor } from './tools.js';
 import { redactSecrets, SECRET_PATTERNS } from './validate.js';
-import { extractArtifact, priceOf, scrubRaw, stampRaw } from './text.js';
+import { extractArtifact, priceOf, scrubRaw, stampRaw, tallyCalls, capStop } from './text.js';
 
 const require = createRequire(import.meta.url);
 const { Loop, wireGate } = require('bare-agent');
@@ -115,6 +115,16 @@ export const SURVEY_CAUSES = Object.freeze({
   NON_OBJECT: 'non-object',
   /** valid JSON, no content — F59's whole point, and a SEMANTIC failure */
   EMPTY_OBJECT: 'empty-object',
+  /**
+   * THE SURVEY WAS NEVER ASKED FOR: the operator's money ceiling was already
+   * spent when the first attempt came due, so no call was made. Named as its own
+   * cause for the reason this enum exists at all — a new route to ABSENT has to
+   * be named, and naming it is the moment somebody decides whether it retries.
+   * This one does not, and cannot: a retry is precisely what the cap forbade.
+   * It is deliberately ABSENT of the model's own doing, and the prose says so —
+   * "the scout did not complete" would blame a model that never spoke.
+   */
+  NOT_FUNDED: 'not-funded',
 });
 
 /**
@@ -280,9 +290,9 @@ export function classifySurvey(blob, meta) {
  * `runAuthorScout` where they can be proven.
  * @param {{workdir: string, granted: readonly string[], auditPath?: string, ctx?: boolean}} o
  */
-export async function defaultSurveyor({ workdir, granted, auditPath = join(workdir, 'gate-audit.jsonl'), ctx = true }) {
+export async function defaultSurveyor({ workdir, granted, auditPath = join(workdir, GATE_AUDIT_FILE), ctx = true }) {
   const gate = new Gate({
-    fs: { writeScope: [], readScope: [workdir], deny: [auditPath, join(workdir, '.smoke'), join(workdir, '.litectx')] },
+    fs: { writeScope: [], readScope: [workdir], deny: [auditPath, ...ARBITER_BOOK_STORES.map((s) => join(workdir, s))] },
     limits: { maxTurns: AUTHOR_SCOUT_ROUNDS + 2 },
     audit: { path: auditPath },
     secrets: { patterns: SECRET_PATTERNS },
@@ -338,11 +348,13 @@ const defaultLoop = (/** @type {any} */ { system, policy, onLlmResult, provider
  *
  * @param {{workdir: string, provider?: any,
  *   rounds?: number, minBytes?: number, blobMax?: number, maxTokens?: number, ctx?: boolean,
- *   attempts?: number,
+ *   attempts?: number, ceilingUsd?: number|null,
+ *   onCall?: (call: {label: string, costUsd: number|null, unpricedRounds: number}) => void,
  *   createLoop?: (o: {system: string, policy: any, onLlmResult: any, provider: any}) => any,
  *   createSurveyor?: (o: {workdir: string, granted: readonly string[], ctx: boolean}) => Promise<any>}} o
  * @returns {Promise<Survey & {raw: string, raws: ReturnType<typeof scrubRaw>[],
- *   calls: {label: string, costUsd: number|null, unpricedRounds: number}[]}>}
+ *   calls: {label: string, costUsd: number|null, unpricedRounds: number}[],
+ *   budgetStop: 'cap-halt'|'pricing-red'|null}>}
  */
 export async function runAuthorScout({
   workdir, provider = null,
@@ -352,6 +364,8 @@ export async function runAuthorScout({
   maxTokens = AUTHOR_SCOUT_MAX_TOKENS,
   ctx = true,
   attempts = SCOUT_ATTEMPTS,
+  ceilingUsd = null,
+  onCall = () => {},
   createLoop = defaultLoop,
   createSurveyor = defaultSurveyor,
 }) {
@@ -372,7 +386,17 @@ export async function runAuthorScout({
    * @param {string} label @param {number} attempt @param {any} r @returns {number}
    */
   const record = (label, attempt, r) => {
-    calls.push({ label, ...priceOf(r) });
+    const call = { label, ...priceOf(r) };
+    calls.push(call);
+    // …and the SHELL is told, at the same instant and off the same entry. A run
+    // killed from outside used to lose 100% of its spend record (F6/F12: a
+    // halted attempt's spend was invisible by 300×) — the totals only ever
+    // existed in this array, which dies with the process. Fired from inside the
+    // one recorder rather than at the call sites, so a paid call cannot be
+    // metered without the report going out: exactly the pairing invariant the
+    // raw already rides. It REPORTS and decides nothing; the ceiling still binds
+    // through `capStop` between calls, untouched.
+    onCall({ ...call });
     return raws.push(scrubRaw({ label, attempt, text: r?.text })) - 1;
   };
   // TIGHTEN-ONLY: an operator may lower the ceiling, never raise it. A garbage
@@ -395,8 +419,21 @@ export async function runAuthorScout({
      * judged. An instrument that misaddresses its own reading is the blind
      * -instrument class, one field wide. */
     let verdictAt = -1;
+    /** the operator's money ceiling, when it is what ended the ladder. `null` on
+     * every other path INCLUDING the unbounded one, so a reader never has to
+     * infer a governance stop from an absence.
+     * @type {'cap-halt'|'pricing-red'|null} */
+    let budgetStop = null;
 
     while (attempt < allowed) {
+      // THE CEILING, between attempts. The attempt cap bounds how many times the
+      // survey may ask; it says nothing about what those asks cost, and this is
+      // the pipeline's FIRST paid stage — a ladder that spends the whole wallet
+      // before the declaration is ever authored is the failure this closes.
+      // Checked before the counter moves, so `attempt` stays the number of
+      // attempts that actually happened.
+      const halt = capStop({ ceilingUsd, ...tallyCalls(calls) });
+      if (halt) { budgetStop = halt; break; }
       attempt += 1;
       const label = attempt === 1 ? 'author-scout' : `author-scout#${attempt}`;
 
@@ -432,7 +469,29 @@ export async function runAuthorScout({
         // F59's reserved TOOLLESS final round. It fires on the ONE population it
         // was sized for — a survey that was CUT OFF and came back short — never
         // on a survey that simply finished with little to say.
-        if (bounded && Buffer.byteLength(blob) < minBytes && Array.isArray(r?.msgs) && r.msgs.length) {
+        // …and the reserved round is a PAID CALL like any other, so it sits behind
+        // the same ceiling. Left outside it, the one call the cap most needs to
+        // stop is the one that escapes: the recovery fires exactly when the first
+        // call was cut off, which is exactly when the wallet is thinnest.
+        //
+        // THE CEILING IS ASKED ABOUT A CALL THAT WOULD ACTUALLY BE MADE, and the
+        // ORDER is what makes that true: the recovery predicate is settled FIRST,
+        // and `capStop` is consulted only when a recovery was genuinely pending.
+        // Asked unconditionally it answers a question nobody put — the wallet is
+        // over, but nothing was refused — and `budgetStop` means the ceiling is
+        // WHAT ENDED THE LADDER, which is then a lie on every other attempt-1
+        // ending: a dead socket on an unbounded first call, or a survey that came
+        // back PRESENT and needed no second call at all. Both then render as
+        // `cap-halt` at `path: budgetUsd`, steering the operator to raise a number
+        // that cannot move the outcome. Nothing about the REFUSAL moves here — the
+        // same predicate, the same tally, the same call not made (the top-of-loop
+        // latch still names the ceiling whenever a retry was due). This is which
+        // ending gets the label, and nothing else.
+        const recoveryWanted = bounded && Buffer.byteLength(blob) < minBytes
+          && Array.isArray(r?.msgs) && r.msgs.length > 0;
+        const recoveryHalt = recoveryWanted ? capStop({ ceilingUsd, ...tallyCalls(calls) }) : null;
+        if (recoveryHalt) budgetStop = recoveryHalt;
+        if (recoveryWanted && !recoveryHalt) {
           const recovery = createLoop({ system, policy: surveyor.policy, onLlmResult: surveyor.onLlmResult, provider });
           s2 = await recovery.run([...r.msgs, { role: 'user', content: SCOUT_RECOVERY_PROMPT }], [],
             { cacheMessages: true, maxTokens });
@@ -484,12 +543,26 @@ export async function runAuthorScout({
       if (!SCOUT_RETRY_CAUSES.includes(/** @type {string} */ (survey.cause))) break;
     }
 
-    const final = /** @type {Survey} */ (survey);
+    // THE SURVEY THAT WAS NEVER ASKED FOR. The ceiling was already spent when the
+    // first attempt came due, so no call was made and there is no reply to
+    // classify. It is spelled out rather than run through `classifySurvey`, which
+    // would read the empty blob and report that the model came back EMPTY — a
+    // model that never spoke cannot have said nothing, and blaming it would send
+    // the operator to the scout when the fact is the wallet.
+    const final = /** @type {Survey} */ (survey ?? {
+      state: 'ABSENT',
+      facts: null,
+      cause: SURVEY_CAUSES.NOT_FUNDED,
+      reason: budgetStop === 'pricing-red'
+        ? 'the survey was never asked for: spend could not be priced, so the ceiling could not be enforced (F6)'
+        : `the survey was never asked for: the $${ceilingUsd} ceiling was already spent`,
+      meta: { bytes: 0, rounds: 0, bounded: false, recovered: false, error: null, attempts: 0, attemptsAllowed: allowed },
+    });
     // Exhaustion is still the same honest ABSENT — it now says how many times we
     // paid to find out. One attempt says nothing about retries, because there
     // were none.
     const reason = final.reason !== null && attempt > 1 ? `${final.reason} — after ${attempt} attempts` : final.reason;
-    return { ...final, reason, raw: blob, raws, calls };
+    return { ...final, reason, raw: blob, raws, calls, budgetStop };
   } finally {
     // a leaked surveyor leaks a gate handle and a litectx index — always, even
     // when the loop threw

package/src/bridges.js

@@ -1,5 +1,5 @@
 // Layer 3 — the REUSE registry (design record:
-// docs/plans/2026-08-01-layer-3-reuse-design.md, D1/D2/D6, frozen 2026-08-01).
+// docs/02-features/2026-08-01-layer-3-reuse-design.md, D1/D2/D6, frozen 2026-08-01).
 //
 // A BRIDGE is the plan a green actually executed, kept so the next run of the same
 // SHAPE starts from it instead of cold. This module is the box and the label on it:
@@ -34,7 +34,7 @@
 
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { isObj, isNonEmptyString } from './validate.js';
+import { isObj, isNonEmptyString, sweepNestedQuantifiers } from './validate.js';
 import { TOOL_MENU, LOCKED_TOOLS } from './job.js';
 import { closeStagesOf } from './plan.js';
 
@@ -183,6 +183,19 @@ export function validateBridge(input) {
   if (!Array.isArray(e.history)) red('invalid-value', 'history', 'array of per-run rows');
   else e.history.forEach((/** @type {unknown} */ h, /** @type {number} */ i) => validateHistoryRow(h, `history.${i}.`, red));
 
+  // PRD v1.60 §1 — the operator-regex admissibility sweep, whose population was
+  // `jobs/*.json` and is now every signed spec wherever it lives. A bridge ships
+  // its plans VERBATIM, and a stored `artifact-written.pattern` reaches the same
+  // untimed exit evaluator on the same main event loop that F49 measured. The
+  // reject is UNCHANGED (`hasNestedQuantifier`, one inventory) — only the
+  // population is wider, so a clean bridge is byte-identically clean.
+  //
+  // Whole-entry rather than per-field, because a bridge's regexes sit inside a
+  // plan stored as opaque data (`isObj(o.plan)` is all this validator asserts
+  // about it): enumerating a path into a document this one deliberately does not
+  // parse is how a sweep goes blind the next time the plan schema moves.
+  sweepNestedQuantifiers(e, red);
+
   // R1's coherence, checked only once everything it reads is itself valid (a
   // second red on an already-broken field would bury the real defect): every green
   // mints exactly one version, and a red mints none.

package/src/clock.js

@@ -43,6 +43,21 @@
 //      it from the remaining budget is what stops the LAST round outliving the run.
 //   3. ~90% accuracy is the bar, by hamr's ruling (addendum 3). This module does
 //      not chase precision; it reports honestly at the precision it has.
+//   4. SUSPENDED MINUTES NEVER CHARGE A SIGNED WALL (hamr's ruling, 2026-08-15:
+//      "if computer suspended, time shouldn't count"). The default source is
+//      therefore MONOTONIC — `performance.now()`, which reads libuv's `uv_hrtime`
+//      and so CLOCK_MONOTONIC, which per clock_gettime(2) "does not count time
+//      that the system is suspended" on Linux (CLOCK_BOOTTIME is the one that
+//      would). `Date.now()` is CLOCK_REALTIME and counts every suspended minute:
+//      that was not a hypothetical, it charged 45 phantom minutes against a
+//      45-minute wall when an s2idle suspend landed mid-run, and it is the same
+//      exposure for an NTP step or a hand-set date. Nothing here corrects for a
+//      suspend after the fact; the reading simply never includes one.
+//      The epoch change is safe by construction: every use of `now()` below is
+//      RELATIVE (`now() - startedAt`), and no value derived from this clock is
+//      ever published as a calendar timestamp — `report()` carries durations only,
+//      and the `at:`/`ts:` stamps a run writes come from their own `Date.now`
+//      seams (src/reuse.js), which stay calendar-correct on purpose.
 //
 // Unbounded is a REAL state, not a large number: hamr ruled `maxWallMs` has no
 // default, so a run without one is time-unbounded by explicit operator choice and
@@ -135,11 +150,14 @@ export function isWallTimeout(err, clock) {
  *   run. `closeStages`: how many stages the job's close runs (W5) — each one gets
  *   the FULL `closeTimeoutMs`, so this is the multiplier on the overshoot, not a
  *   decoration. Defaults to 1, the single-predicate close. `now`: injected for
- *   tests — the default is the real clock. `priorElapsedMs`: time this attempt's
- *   PREDECESSOR already consumed (see below).
+ *   tests — the default is the real clock, and it stays injectable precisely so
+ *   every test here can drive time deterministically without a sleep. That default
+ *   is MONOTONIC (fact 4 above), not `Date.now`: a wall-clock jump — a suspend, an
+ *   NTP step, a hand-set date — must not be able to reach a signed deadline.
+ *   `priorElapsedMs`: time this attempt's PREDECESSOR already consumed (see below).
  * @returns {Clock}
  */
-export function createClock({ maxWallMs = null, closeStages = 1, now = () => Date.now(), priorElapsedMs = 0 } = {}) {
+export function createClock({ maxWallMs = null, closeStages = 1, now = () => performance.now(), priorElapsedMs = 0 } = {}) {
   // RESUME (module C) — hamr's checkpoint ruling in a time coat: a run killed
   // mid-try restarts THAT try under the REMAINDER of its signed per-try numbers,
   // because "a budget ceiling folds in prior spend so re-invoking cannot silently

package/src/declaredclose.js

@@ -71,7 +71,7 @@
 import { runStage, makeSeedTrees, STOP_FAULTS, EXIT_RED } from './kinds.js';
 import {
   validateDeclaration, classGuards, genreOwnedEnvNames, ungroundedGenreEnv, GENRE_LANGUAGES, TYPES_GENRE,
-  VERDICT_CLASSES, LIVE_CLASSES,
+  VERDICT_CLASSES, LIVE_CLASSES, NEVER_OFFERED_KINDS,
 } from './authoring.js';
 import { stageGap } from './ralph.js';
 import { isObj, isNonEmptyString } from './validate.js';
@@ -112,12 +112,68 @@ export const DECLARED_GAP_PREFIX = 'close: ';
  * whole judged output rather than a hand-picked slice of it. */
 export const DECLARED_GAP_KEEP = `^${DECLARED_GAP_PREFIX.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`;
 
-/** The verdict class a DECLARED close may claim. Hard, and by CONSTRUCTION
- * rather than by assertion: every live kind is a mechanical command whose
- * measurement is the truth, and the two judgment kinds are locked out at the
- * catalogue (M2) and absent from the executor (M1). Named as data so the job
- * validator reads one hierarchy table rather than hard-coding a class. */
-export const DECLARED_CLOSE_CLASSES = Object.freeze(['hard']);
+/**
+ * The close verdict word for a run WAITING on a person (N4 §1.3/§1.4). A
+ * literal, exported, because three readers key on it — the runner's pause
+ * branch, the ledger's excluded set, and the trend reader's blind rule — and
+ * three hand-spelled copies of one terminal is how they come to disagree.
+ *
+ * It is not in `CLOSE_FAULTS` and must never be added: a fault says the close
+ * could not render a verdict, and this says the close is not FINISHED rendering
+ * one. The first escalates; the second is a checkpoint the operator returns to.
+ */
+export const HUMAN_PAUSE = 'human-pause';
+
+/**
+ * The RUN-level terminal names the hitl class mints one layer up from
+ * `HUMAN_PAUSE` (N4 §1.3–§1.5): the checkpoint, and the honest refusal of the
+ * operator's rerun input. Spelled once here, beside the close-verdict word they
+ * translate, for the same reason `HUMAN_PAUSE` is — the emitters (`planrun.js`),
+ * the ledger's excluded set, the resume reader (`reuse.js`), and the runner
+ * script all key on them, and hand-spelled copies of one terminal is how they
+ * come to disagree.
+ *
+ * There were three (2026-08-17): `hitl-cancel` was the signer's own terminal and
+ * is DELETED with the door it belonged to. A person who does not want to carry on
+ * now PAUSES — the same checkpoint, resumable, retired by the TTL if nobody comes
+ * back — so nothing in this tree mints that name any more. The ledger keeps the
+ * bare string in its excluded set so a spine written before this change still
+ * reads as governance rather than as a capability gap; that is a READER's
+ * backward compatibility, and deliberately not a constant a writer could reach.
+ */
+export const HITL_PAUSE = 'hitl-pause';
+export const HITL_DECISION_RED = 'hitl-decision-red';
+
+/**
+ * The terminals above that leave the run WAITING ON A PERSON — as a list, minted
+ * beside the names it holds so a reader keys on membership rather than on a
+ * spelling, and a rename here travels to every reader for free.
+ *
+ * It is deliberately NOT `reuse.js`'s `CHECKPOINT_OUTCOMES`, which is the wider
+ * RESUME list: every stop that left work on disk and an allowance unspent, money
+ * and time included. Those are governance stops the reuse loop is meant to try
+ * again under its remaining tries; this is the half no further attempt can
+ * change, because the allowance still unspent is a human answer. `CHECKPOINT_OUTCOMES`
+ * is composed FROM this list so the two can never disagree about which is which.
+ *
+ * `HITL_DECISION_RED` is not here: it is a verdict already rendered on the operator's
+ * own input, not a question still open.
+ */
+export const HUMAN_CHECKPOINTS = Object.freeze([HITL_PAUSE]);
+
+/** The verdict classes a DECLARED close may claim. Named as data so the job
+ * validator reads one hierarchy table rather than hard-coding a class.
+ *
+ * `hard` is by CONSTRUCTION: every mechanical kind is a command whose measurement
+ * is the truth. `hitl` joined it at N4 slice 1, and only because `human-confirms`
+ * is genuinely LIVE — the widening and the kind go in one commit, or this table
+ * admits a class the executor cannot render. The `soft` class is still absent:
+ * `judged-floor` is locked, so no declaration can reach above hitl.
+ *
+ * The direction that matters is unchanged. This says which class a declaration
+ * MAY claim; `closeCeiling` says which class its stages actually NEED. A pick
+ * below the ceiling is still the silent upgrade `class-ceiling` refuses. */
+export const DECLARED_CLOSE_CLASSES = Object.freeze(['hard', 'hitl']);
 
 /** @param {any} job @returns {boolean} */
 export function isDeclaredClose(job) {
@@ -135,7 +191,15 @@ export function isDeclaredClose(job) {
  */
 export function declaredStages(closeDecl) {
   if (!isObj(closeDecl) || !Array.isArray(closeDecl.stages)) return null;
-  return closeDecl.stages.map((s) => (isObj(s) ? { ...s, gapKeep: DECLARED_GAP_KEEP } : s));
+  return closeDecl.stages.map((s) => (isObj(s)
+    // RULING 5, stamped by the ARBITER rather than trusted from the artefact:
+    // a judged or human stage is `offer: false` BY LAW, so `checkMenu` can never
+    // hand the agent `check-passes(<a person>)`. The validator refuses a
+    // declaration that says anything else (`human-stage-offered`), so this is
+    // never overwriting a signer-visible value — it is filling in a law the
+    // declaration schema deliberately gives the composer no way to state.
+    ? { ...s, gapKeep: DECLARED_GAP_KEEP, ...(NEVER_OFFERED_KINDS.includes(s.kind) ? { offer: false } : {}) }
+    : s));
 }
 
 // ── the spec-level gate ──────────────────────────────────────────────────────
@@ -361,7 +425,7 @@ export function guardNames(closeDecl, verdictType) {
  * @param {any} r an M1 `StageResult`
  * @param {(s: string) => string} redact
  * @returns {{verdict: string, notes?: string, gap?: string, detail?: string,
- *   exitCode?: number, judgedCount?: number}} `notes` is absent, never empty —
+ *   exitCode?: number, judgedCount?: number, ask?: string|null}} `notes` is absent, never empty —
  *   a field that is always there says nothing; a RED carries its diagnostics
  *   inside `gap` and so has none of its own.
  */
@@ -370,6 +434,13 @@ function translate(r, redact) {
   /** absent rather than empty: a field that is always there says nothing */
   const notes = gapText ? { notes: gapText } : {};
   if (r.verdict === 'green') return { verdict: 'satisfied', judgedCount: 1, ...notes };
+  // THE PAUSE (N4 §1.3) — its own verdict word, and deliberately NOT one of the
+  // three below. `satisfied` would mint a green nobody gave; `needs_revision`
+  // would hand the fix worker a gap the person has not written yet; a
+  // `CLOSE_FAULTS` word would file a working arbiter as a broken instrument.
+  // No `gap` and no `judgedCount`: nothing was judged, and every consumer guards
+  // with `if (gap)`.
+  if (r.verdict === 'pause') return { verdict: HUMAN_PAUSE, ask: r.detail?.ask ?? null, ...notes };
   if (r.verdict === 'red') {
     return {
       verdict: 'needs_revision',
@@ -408,11 +479,12 @@ function translate(r, redact) {
  * @param {any[]} stages declared stage descriptors, already validated
  * @param {(s: string) => string} [redact] the scrub, applied at THIS boundary
  * @param {{timeoutMs?: number, cwd?: string, seedRef?: string,
- *   seedTrees?: any, gapCap?: number, maxBuffer?: number, baselineMode?: 'auto'|'worktree'}} [opts]
+ *   seedTrees?: any, gapCap?: number, maxBuffer?: number, baselineMode?: 'auto'|'worktree',
+ *   humanRuling?: {decision: string, text?: string|null}|null}} [opts]
  * @returns {Promise<any>}
  */
 export async function runDeclaredStages(stages, redact = (s) => s, opts = {}) {
-  const { timeoutMs, cwd, seedRef, seedTrees: shared, gapCap, maxBuffer, baselineMode } = opts;
+  const { timeoutMs, cwd, seedRef, seedTrees: shared, gapCap, maxBuffer, baselineMode, humanRuling = null } = opts;
   if (!isNonEmptyString(cwd) || !isNonEmptyString(seedRef)) {
     // Refuse rather than guess. A declared close measures against a SEED; a
     // missing one is the close unable to run, not a red about the worker.
@@ -436,6 +508,11 @@ export async function runDeclaredStages(stages, redact = (s) => s, opts = {}) {
     ...(gapCap !== undefined ? { gapCap } : {}),
     ...(maxBuffer !== undefined ? { maxBuffer } : {}),
     ...(baselineMode !== undefined ? { baselineMode } : {}),
+    // the SIGNER's answer, when this close has a human stage and a leg is
+    // carrying one. Absent (null) is the ordinary path AND the pause path — the
+    // human stage reads the absence as "nobody has answered yet", which is the
+    // whole of what a pause means.
+    humanRuling,
     seedTrees,
   };
   try {

package/src/index.js

@@ -60,7 +60,7 @@ export { renderListing, selectionPrompt } from './selection.js';
 // `resumeTreeGate` is the ruling that a resumed patient is continued dirty and never
 // reset. Both are read by a runner BEFORE the approval gate, so neither can live behind
 // `runReuse`'s own entry.
-export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate } from './reuse.js';
+export { validateEnvelope, resolveTrySpec, resolveReuse, reuseSpecHash, selectBridge, runReuse, REUSE_GRADED_RED, readResume, resumeTreeGate, CHECKPOINT_OUTCOMES, PAUSE_TTL_MS, checkpointAgeGate } from './reuse.js';
 export { classifyIncidents, foldLedger, ledgerDeltas, updateLedger, LEDGER_CLASSES } from './ledger.js';
 // THE WORK BRANCH (PRD v1.57 §3). `workBranchName` is exported so an operator runner can
 // SHOW, before the approval gate, which branch the run will work on — the same reason the
@@ -89,6 +89,10 @@ export { workBranchName, prepareWorkBranch, WORK_BRANCH_PREFIX, WORK_BRANCH_RE }
 export {
   runDeclaredClose, runStage, seedRead, seedAtHead, seedListing, changedSet, makeSeedTrees,
   LIVE_KINDS, STOP_FAULTS, JUDGED_MARKER, EXIT_GREEN, EXIT_RED, EXIT_STOP,
+  // N4 slice 1 — the hitl surface an adopting runner needs: the three doors, the
+  // gate that reads a signer's answer (and refuses an empty one), and the seed
+  // exemption ruling 8 states.
+  HUMAN_DECISIONS, SEED_EXEMPT_KINDS, normalizeHumanRuling,
 } from './kinds.js';
 // M2 — what a declaration may SAY, and whether one said it legally. The
 // catalogue and the genre are DATA an integrating UI renders (the kind menu, the
@@ -96,10 +100,15 @@ export {
 export {
   validateDeclaration, normalizeDeclaration, KIND_CATALOGUE, CATALOGUE_KINDS, CATALOGUE_LIVE_KINDS,
   LOCKED_KINDS, TYPES_GENRE, TYPES_GENRE_TEMPLATE, GENRE_LANGUAGES, genreEnv, genreOwnedEnvNames,
+  // how the genre's own tools PRINT — genre property for the same reason the
+  // suppression battery is (2026-08-09, run msmbpjk6)
+  genreInstruments,
   DIRECTIONS, BASELINES, MAX_STAGES,
   // the verdict-class surface (PRD v1.57 §1–§2): the radio's own menu, the guard
   // battery keyed off it, and the ceiling that makes the pick a promise
   VERDICT_CLASSES, LOCKED_CLASSES, LIVE_CLASSES, CLASS_BATTERIES, classGuards, closeCeiling,
+  // ruling 5 as data: the kinds no agent may ever be offered as an in-run ruler
+  NEVER_OFFERED_KINDS,
 } from './authoring.js';
 // M3 — the looking half and the writing half. `authorClose` is the grounded
 // loop; `runAuthorScout`/`buildSeedListing` are exported because a caller that
@@ -125,6 +134,7 @@ export {
 export {
   validateCloseDecl, runDeclaredStages, declaredStages, isDeclaredClose, guardNames, closeGrade,
   DECLARED_GENRES, DECLARED_GAP_PREFIX, DECLARED_GAP_KEEP, DECLARED_CLOSE_CLASSES, CLOSE_DECL_FIELDS,
+  HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED, HUMAN_CHECKPOINTS,
 } from './declaredclose.js';
 export { closeStagesOf } from './plan.js';
 // M4b — the interview, the refusal, the composition, and D9's three gates.

package/src/job.js

@@ -1,5 +1,5 @@
 // Job-spec validator — the OPERATOR-owned half of the config story (N1,
-// design record: docs/plans/2026-07-12-n1-job-close-schema-design.md).
+// design record: docs/02-features/2026-07-12-n1-job-close-schema-design.md).
 // A job spec is the arbiter's rulebook: the close chain, the budget, the
 // outer write fence, the escalation route. It is pure declarative data —
 // no freeform code is expressible anywhere in it — and it validates
@@ -103,7 +103,12 @@ export const LOCKED_TOOLS = Object.freeze(['run']);
  * pattern: disclosure ≠ admission), so the ledger counts the demand and the
  * non-code rung later fills a declared slot instead of reshaping the schema. */
 export const VERDICT_TYPES = Object.freeze(['green', 'soft-green', 'hitl']);
-export const LOCKED_VERDICTS = Object.freeze(['soft-green', 'hitl']);
+/** N4 slice 1: `hitl` is ADMITTED — the class whose *done* needs a person runs
+ * through the same signed spec, the same agent-authored plan and the same
+ * arbiter as a green job (the nine rulings, 2026-08-07; the three-button surface,
+ * 2026-08-12). `soft-green` stays declared-but-locked until its judged floor is
+ * built and proven (slice 2): a wobbly ruler must not mint anything. */
+export const LOCKED_VERDICTS = Object.freeze(['soft-green']);
 /** which close CLASS a declared verdictType demands — the close hierarchy one
  * level up: the same laundering guard as CLASS_BY_CLOSE, applied to the plan
  * shape's single close (green on a rubric would be a fake-hard verdict). */