bareloop 0.9.0 → 0.11.0

package/src/planrun.js

@@ -33,8 +33,11 @@ import { globToPrefix, redactSecrets, SECRET_PATTERNS } from './validate.js';
 import { validateBridge, loadGate } from './bridges.js';
 import { extractArtifact } from './text.js';
 import { createClock, isWallTimeout } from './clock.js';
-import { isDeclaredClose, runDeclaredStages, validateCloseDecl, closeGrade } from './declaredclose.js';
-import { seedAtHead, seedListing } from './kinds.js';
+import { isDeclaredClose, runDeclaredStages, validateCloseDecl, closeGrade, HUMAN_PAUSE, HITL_PAUSE, HITL_DECISION_RED } from './declaredclose.js';
+import {
+  seedAtHead, seedListing, changedSet, GAP_TRIM_MARKER, GATE_AUDIT_FILE, ARBITER_BOOK_STORES,
+  HUMAN_KIND, HUMAN_DECISIONS, normalizeHumanRuling,
+} from './kinds.js';
 import { workBranchName, prepareWorkBranch } from './workbranch.js';
 
 const require = createRequire(import.meta.url);
@@ -65,6 +68,11 @@ const NATIVE_READ_STRATEGY = '\nINTERFACE LIMIT: on this surface a whole-file re
 const SCOUT_MIN_BYTES = 200;
 /** feed-forward artifact bound per step (prompt ingredient, spine-bound) */
 const ARTIFACT_MAX = 2000;
+/** how many changed paths ride the hitl pause's evidence package. Bounded like
+ * every other list this repo puts on a spine, and the trim ANNOUNCED (F28): the
+ * person needs to see WHAT moved, and a run that touched a thousand files is
+ * telling them something a thousand lines would not. */
+const PAUSE_CHANGED_CAP = 50;
 /** the wallet floor below which a replan is a stop, not an adaptation (review
  * #5): a money-gate halt drains the wallet to ~0, so replanning against dust
  * just burns another draft and mislabels the money-cut as "exits still red"
@@ -260,6 +268,60 @@ export function closeGapBlock(gap) {
     + (scrubbed.length > CHECK_GAP_MAX ? boundGap(scrubbed, REPLAN_GAP_KEEP) : scrubbed);
 }
 
+/**
+ * The recorded bound-reason's ceiling in the WORKER-facing note. The reason is a
+ * provider string (`denied:<tool>` today, ~20 bytes), not a gap, so this is a
+ * backstop against a future terminal that arrives long — never an envelope the
+ * shipped path routinely rides through.
+ */
+export const BOUND_REASON_MAX = 200;
+
+/**
+ * What the NEXT attempt is told about the bound that cut the previous one.
+ *
+ * Two different bounds used to set the same bare `attemptBounded = roundIteration`
+ * and therefore render the same sentence. For a round-bound cutoff that sentence is
+ * true. For BA-11's deny streak it is false twice over — the rounds did NOT run out
+ * (the fence short-circuited the attempt with budget left), and the count it quotes
+ * is the cap, not what was spent — and it aims the worker at the READ BUDGET when the
+ * thing that stopped it was the FENCE. The reason was already recorded on the spine;
+ * nothing carried it to the one reader who could act on it.
+ *
+ * The denial note is MECHANICAL in the strict sense: it quotes the terminal the
+ * provider actually returned and names which bound fired. It invents nothing —
+ * no streak count and no denied path, because bare-agent's return (`error:
+ * 'denied:<tool>'`, loop.js) carries neither, and a number nobody measured is a
+ * bug with a confident voice. Every other cause keeps the frozen wording byte for
+ * byte: a wall-bounded attempt reads as a round bound exactly as it did before
+ * (and is unreachable anyway — the step head refuses to fund an attempt past the
+ * deadline, W-2), so this change can only ever speak where it has something true
+ * to add.
+ *
+ * The reason arrives ALREADY SCRUBBED (the capture seam in `mkWorker` runs it
+ * through the one `SECRET_PATTERNS` inventory), so this renderer only bounds it —
+ * and announces the trim with the repo's ONE marker rather than a second spelling
+ * of "this text was cut" (F90.2).
+ *
+ * @param {{iteration?: number|string|undefined, cause: string, reason: string|null}|null|undefined} bounded
+ *   the previous attempt's bound state, or nullish when it was not bounded
+ * @param {number} rounds the step's round bound, as quoted by the frozen sentence
+ * @returns {string|null} the note, or null when there is nothing to say
+ */
+export function boundedNote(bounded, rounds) {
+  if (!bounded) return null;
+  if (bounded.cause !== 'denied') {
+    return `Your previous attempt was CUT OFF after ${rounds} tool rounds. `
+      + 'Reading is bounded; writing is not. Form a hypothesis EARLY and make the change.';
+  }
+  const raw = String(bounded.reason ?? '');
+  const shown = raw.length > BOUND_REASON_MAX
+    ? `${raw.slice(0, BOUND_REASON_MAX)} [${GAP_TRIM_MARKER} ${raw.length - BOUND_REASON_MAX} of ${raw.length} characters withheld — the cap is ${BOUND_REASON_MAX}]`
+    : raw;
+  return 'Your previous attempt was CUT OFF by the gate: it denied consecutive tool calls '
+    + `until the streak guard ended the attempt. The gate recorded: ${shown}. `
+    + 'The round budget was not what stopped you — repeating a denied call ends this attempt the same way.';
+}
+
 /**
  * The plan-drafting prompt: a schema DESCRIPTION built from the live validator
  * menus — never a copyable example (the drafter must author, not echo; the
@@ -321,7 +383,7 @@ Shape: { "schema": "plan-v1", "steps": [ ... 1..${MAX_PLAN_STEPS} steps ... ] }
 strictly in array order. Each step (no other fields exist):
 - "id": kebab-case slug, unique
 - "action": the step's task, precise enough for a worker that sees ONLY this step
-- "tools": non-empty unique subset of ${JSON.stringify(ceiling)} (write/edit change the tree; recall/get/impact/related/recent search and navigate the repository index; compress/peek read cheaply; stash/remember/forget park and record notes across steps)
+- "tools": non-empty unique subset of ${JSON.stringify(ceiling)} (read/grep are the worker's ONLY way to see the tree — there is no shell; write/edit change the tree; recall/get/impact/related/recent search and navigate the repository index; compress/peek read cheaply; stash/remember/forget park and record notes across steps)
 - "rounds": integer 1..${maxStepRounds} — the step's per-attempt tool-round bound
 - "target": the step's deliverable path (REQUIRED when tools include write/edit), inside ${JSON.stringify(job.writeScope)}
 - "scope" (optional): narrow this step's WRITE fence — copy one value from the offered scopes below.
@@ -351,6 +413,15 @@ strictly in array order. Each step (no other fields exist):
   exit reds on that file can never finish, on any attempt.${seedRedLaw}${priorChecksLaw}
   Reference checks by NAME only; you cannot author or modify one.
 
+The worker has NO SHELL. It cannot run a command, a compiler, a linter, or a test suite,
+and it cannot execute a script it writes: its only verbs are the tools you grant that step
+in "tools". The check named in a "check-passes" exit is the ONLY execution in this run —
+the shell runs it after each attempt and hands the worker its raw output. So write every
+"action" for a worker that locates its work by READING and GREPPING files and by reading
+the check output it is given. Never tell it to run, execute, re-run, or verify by running
+anything (an action that opens with "Run \`<command>\`…" costs the whole step: the worker
+has no way to obey it and spends its rounds hunting by hand).
+
 Offered "scope" values for tree-changed — copy ONE of these exactly, character for
 character. No other value is accepted, and patterns of your own (like "src/*.js")
 are not accepted:
@@ -518,12 +589,24 @@ ${scoutBlob || '(no scout notes)'}`;
  *   it the deterministic name would collide with that very branch and the collision walk
  *   would mint a `-2` beside the progress the resume exists to keep. Absent is the cold
  *   path. A recorded branch that no longer exists is a STOP, never a fresh start.
+ * @param {{decision: string, text?: string}|null} [opts.humanRuling] N4 — the SIGNER's
+ *   answer at a hitl pause (2026-08-12 §1, re-cut 2026-08-17: accept | rerun <text> | pause), carried in
+ *   by the runner on the leg that RESUMES a paused run. Absent on every ordinary run and
+ *   on the leg that pauses; it is never authored, never defaulted, and never inferred.
+ *
+ *   It is spent ONCE, on this leg's close readings up to the moment the fix loop opens:
+ *   `accept` greens the human stage on fresh evidence (OPEN-3 — the mechanical stages
+ *   re-run first, because the tree can change while a run is paused), `rerun` reds it
+ *   with the human's own words as the gap, and `pause` keeps the checkpoint exactly as it
+ *   is, before anything is read at all. After the fix loop opens the ruling is gone, so once the mechanical
+ *   stages pass again the run PAUSES for a second review rather than converting the same
+ *   sentence forever.
  * @returns {Promise<string>} 'green' | 'already-green' | 'escalated' | 'plan-red' |
  *   'check-red' | 'close-red' | 'close-unsupported' | 'recipe-stale' | 'pricing-red' |
  *   'branch-red' | 'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' |
- *   'step-stalled' | `step-red:<id>`
+ *   'step-stalled' | 'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  */
-export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, maxStepRounds = 40, layerRoot = false, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null }) {
+export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, maxStepRounds = 40, layerRoot = false, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null }) {
   workdir = resolve(workdir);
   // ONE spelling of the redaction, housed next to the inventory it reads
   // (src/validate.js) — the same helper the isolate verbs scrub the litectx store
@@ -575,6 +658,79 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     return 'close-unsupported';
   }
 
+  // ── THE SIGNER'S ANSWER (N4 §1.4), read before anything costs anything.
+  //
+  // Three gates, and each refuses rather than guesses. A decision that is not one
+  // of the three doors — or a `rerun` whose text is empty — is refused at the
+  // seam that ACCEPTS it, because the whole of what a rerun gives the fix worker
+  // is the human's words, and an empty gap re-runs the worker as though nothing
+  // had been said (the POC's negative control measured exactly that). A decision
+  // handed to a close with no human stage is refused too: there is nothing for it
+  // to rule on, and silently ignoring it would leave a person believing they had
+  // answered. It is a terminal of its own rather than an `interpreter-red` — no
+  // library failed, the operator's own input is what could not be read.
+  const hasHumanStage = stagedClose.some((/** @type {any} */ s) => s?.kind === HUMAN_KIND);
+  const ruling = normalizeHumanRuling(humanRuling);
+  const decisionRed = (/** @type {string} */ detail) => {
+    emit('escalation', {
+      category: HITL_DECISION_RED, decisionReady: true,
+      decision: 'The decision handed to this run could not be applied, so nothing was run and nothing was spent.',
+      options: [
+        `re-run the resume with one of: ${HUMAN_DECISIONS.join(' | ')} (a rerun carries the text the worker converts)`,
+        'abandon the task',
+      ],
+      detail: scrub(detail),
+    });
+    return HITL_DECISION_RED;
+  };
+  if (!ruling.ok) return decisionRed(/** @type {string} */ (ruling.why));
+  if (ruling.ruling !== null && !hasHumanStage) {
+    return decisionRed(`this job's close has no ${HUMAN_KIND} stage, so a signer's "${ruling.ruling.decision}" has `
+      + 'nothing to rule on — the verdict class is a promise about the CLOSE, and only a close that asks a person '
+      + 'can be answered by one');
+  }
+  /** the ruling still to be spent. Cleared the moment the fix loop opens: the
+   * human's words are what OPENS that loop, and once the worker holds them the
+   * next machine-clean tree is a new question for the person, not the old one. */
+  let liveRuling = ruling.ruling;
+
+  // ── PAUSE: the third door, and it costs nothing at all (2026-08-12 §1, doors
+  // re-cut 2026-08-17). Before the branch, the seed, the precheck and the clock,
+  // because a person who answered "not now" has asked for nothing to be done: no
+  // gap, no continuation, no worker round. It is deliberately NOT routed through
+  // the close — running four stages to arrive back at the question the person has
+  // just declined to answer is wall time spent on an answer already in hand.
+  //
+  // hamr's ruling, verbatim: *"what's the point of cancel anyways? pause can
+  // resume — that would be more honest"*. So this mints the SAME checkpoint
+  // terminal the machine-side pause mints, which is what keeps it resumable under
+  // the existing TTL: the run re-enters at the start of its last step whenever
+  // somebody comes back, and if nobody does, the checkpoint expires on its own.
+  // That expiry IS the case cancel used to serve, without forcing a person into a
+  // forever-decision at the moment they least want to make one.
+  //
+  // The record is EXPLICIT (`humanDecision`) rather than a silent re-pause: "a
+  // person looked and kept it" and "nobody has looked yet" are two different
+  // facts, and one record spelling both is how a reader comes to confuse them.
+  // The evidence package is not re-assembled here — it is already on the spine of
+  // the leg that asked, and this leg measured nothing, so it states nothing (F6:
+  // absent, never an empty list dressed as a reading).
+  if (liveRuling?.decision === 'pause') {
+    emit(HITL_PAUSE, {
+      stage: stagedClose.find((/** @type {any} */ s) => s?.kind === HUMAN_KIND)?.name ?? null,
+      humanDecision: 'pause',
+      decisionReady: true,
+      // EXPLICITLY null, never absent: every gap consumer guards with `if (gap)`,
+      // and the field states the ruling rather than leaving it to be inferred.
+      gap: null,
+      decision: 'The signer looked and paused: nothing was asked for, so nothing was run and nothing was spent. The '
+        + 'checkpoint stands exactly as it was — the work, the plan and the money are where the paused leg left them.',
+      options: [...HUMAN_DECISIONS],
+      meaning: 'not a verdict — the run is still paused, the clock is still stopped, and the same three doors are open',
+    });
+    return HITL_PAUSE;
+  }
+
   // ── native wiring: a clipipe-subscription job needs the native provider
   // FACTORY (native governance is constructor-time + per-worker, so the runner
   // cannot reuse one injected instance). A missing factory is an adopter wiring
@@ -764,7 +920,14 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
    * @param {any[]} stages
    */
   const runCloseStages = (stages) => (declared
-    ? runDeclaredStages(stages, scrub, { ...closeOpts, seedRef: /** @type {any} */ (declaredCtx).seedRef })
+    ? runDeclaredStages(stages, scrub, {
+      ...closeOpts,
+      seedRef: /** @type {any} */ (declaredCtx).seedRef,
+      // the signer's answer reaches the human stage the same way every other
+      // arbiter-owned fact reaches a stage: through the ctx, never through the
+      // declaration. A command close has no human stage to hand it to.
+      humanRuling: liveRuling,
+    })
     : runStages(stages, scrub, closeOpts));
   /** @type {string|undefined} the stage that rendered the LAST close verdict (Layer R's red-set source) */
   let closeStage;
@@ -821,6 +984,41 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       ...extra,
     });
   };
+  /**
+   * THE PAUSE (N4 §1.3/§1.4, rulings 1 and 2) — a decision-ready checkpoint, and
+   * never a bare "approve?". What the person is shown is assembled here rather
+   * than by whatever surface renders it: every mechanical stage's own result, the
+   * question the close itself declared, and the set of files this run changed.
+   *
+   * The changed set is the "before/after" half, at the granularity a library can
+   * state honestly — WHICH files moved. Rendering the lines belongs to the
+   * surface that has a screen; carrying the list is what makes the surface's job
+   * possible without it re-deriving the run's own facts.
+   * @param {any} v the close verdict that paused @returns {Promise<void>}
+   */
+  const emitHitlPause = async (v) => {
+    const cs = declaredCtx ? await changedSet(workdir, declaredCtx.seedRef) : { stop: 'no seed', paths: [] };
+    const paths = cs.stop === null ? cs.paths : [];
+    const shown = paths.slice(0, PAUSE_CHANGED_CAP);
+    emit(HITL_PAUSE, {
+      stage: v.stage ?? null,
+      ask: v.ask ?? null,
+      decisionReady: true,
+      // ruling 2: the whole evidence package, never a bare "approve?"
+      stages: v.stages ?? [],
+      changed: {
+        paths: shown,
+        // the trim is ANNOUNCED (F28), and an unreadable set is UNKNOWN, never
+        // an empty list dressed as "nothing changed" (F6)
+        ...(paths.length > shown.length ? { more: paths.length - shown.length } : {}),
+        ...(cs.stop === null ? {} : { unreadable: scrub(String(cs.stop)) }),
+      },
+      decision: `The close reached its human stage and is waiting on you: ${v.ask ?? 'review the result'}`,
+      options: [...HUMAN_DECISIONS],
+      meaning: 'not a verdict — the run is paused, the clock is stopped, and the last thing it did stands until you answer',
+    });
+  };
+
   /** the close, as ONE verdict: every stage in order, first red wins */
   const judgeClose = async () => {
     const v = await runCloseStages(stagedClose);
@@ -994,6 +1192,13 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
   const pre = await judgeClose();
   emit('close-precheck', { ...pre });
   if (pre.verdict === 'satisfied') return 'already-green';
+  // …and the pause's own arm of the same gate. Reaching a human stage HERE means
+  // every mechanical stage already passes on the untouched tree: the machine half
+  // of this job is done and the only thing left is a person. Pausing costs $0 and
+  // is the honest answer; running a plan first would spend a budget to arrive at
+  // exactly this question. No `planExecuted` — there is no plan yet, and an empty
+  // one on the spine would be a record of work nobody did.
+  if (pre.verdict === HUMAN_PAUSE) { await emitHitlPause(pre); return HITL_PAUSE; }
   const preFault = Object.hasOwn(CLOSE_FAULTS, pre.verdict) ? CLOSE_FAULTS[pre.verdict] : undefined;
   if (preFault) {
     emit('escalation', { category: preFault.category, decisionReady: true, decision: preFault.decision, options: preFault.options, detail: pre.detail });
@@ -1062,7 +1267,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
   const lc = new LiteCtx({ root: workdir });
   const ceiling = Array.isArray(job.tools) ? job.tools : [...TOOL_MENU];
   const fencePrefixes = job.writeScope.map((/** @type {string} */ g) => resolve(workdir, globToPrefix(g)));
-  const auditPath = join(workdir, 'gate-audit.jsonl');
+  const auditPath = join(workdir, GATE_AUDIT_FILE);
   const chainByName = new Map(menu.map((m) => [m.name, m.run]));
   // Choose-don't-describe (§4): the offered `tree-changed` scopes, enumerated from
   // the signed fence plus the directories that actually exist beneath it. ONE menu
@@ -1198,7 +1403,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         // uses), so this can only tighten, never widen
         writeScope: writable ? (fence ?? fencePrefixes) : [],
         readScope: [workdir],
-        deny: [auditPath, join(workdir, '.smoke'), join(workdir, '.litectx')],
+        deny: [auditPath, ...ARBITER_BOOK_STORES.map((s) => join(workdir, s))],
       },
       budget: { maxCostUsd: Math.max(remainingUsd(), 0.0001) },
       limits: { maxTurns },
@@ -1312,7 +1517,23 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     /** @type {number|string|undefined} */
     let roundIteration;
     let roundsThisAttempt = 0;
-    /** @type {number|string|undefined} */
+    /**
+     * WHICH bound cut the last attempt, and — when the provider recorded one — its
+     * reason. A bare iteration number was the whole state here, so three different
+     * bounds (round cap, wall, BA-11 deny streak) were indistinguishable to the one
+     * consumer that speaks to the worker, which then told every one of them the
+     * round cap had run out. The cause travels WITH the iteration because they are
+     * read together and can never be allowed to drift apart.
+     *
+     * `reason` is scrubbed at THIS seam — the boundary, once, before any reader —
+     * so no consumer has to remember to do it (the same placement the exit results
+     * get in `judge`). It rides the spine event in the same scrubbed spelling: one
+     * value, one inventory, and an append-only log is forever.
+     * `iteration` mirrors `roundIteration` exactly, undefined included: the bound
+     * cannot know a label the run never set, and inventing one here would be the
+     * only place in this file that claims to.
+     * @type {{iteration: number|string|undefined, cause: 'rounds'|'wall'|'denied', reason: string|null}|undefined}
+     */
     let attemptBounded;
     /**
      * Open an iteration: label the rounds, reset the per-iteration round counter,
@@ -1413,19 +1634,24 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         }
         // a maxTurns session is a BOUNDED attempt, not an escalation — the same
         // role loop.stop() plays on the Loop path: judge the partial work and
-        // feed the gap forward (the CLI preserves lastText, BA-5).
-        if (r.error === 'max_turns') {
-          attemptBounded = roundIteration;
-          emit('attempt-bounded', { phase, iteration: roundIteration, cap: attemptRounds, native: true });
-          return r;
-        }
+        // feed the gap forward (the CLI preserves lastText, BA-5). A DENIAL
+        // STREAK is the same shape and takes the same lane (see the Loop path's
+        // note below — one doctrine, both surfaces).
         if (r.error) {
+          if (r.error === 'max_turns' || r.error.startsWith('denied:')) {
+            // the CAUSE is kept, not just the fact: `max_turns` really is the round
+            // cap, a `denied:` terminal is the fence, and the next attempt is told
+            // which one it was (`boundedNote`)
+            const denied = r.error.startsWith('denied:');
+            const reason = scrub(r.error);
+            attemptBounded = { iteration: roundIteration, cause: denied ? 'denied' : 'rounds', reason };
+            emit('attempt-bounded', { phase, iteration: roundIteration, cap: attemptRounds, native: true, reason });
+            return r;
+          }
           const err = /** @type {CategorizedError} */ (new Error(`native session: ${r.error}`));
-          // halt → cap-halt, denial streak → gate-red; a bridge/session terminal
-          // (bridge-failed, session_timeout, session:*) is provider-owned transport
-          err.category = r.error.startsWith('halt:') ? 'cap-halt'
-            : r.error.startsWith('denied:') ? 'gate-red'
-            : 'provider-red';
+          // halt → cap-halt; a bridge/session terminal (bridge-failed,
+          // session_timeout, session:*) is provider-owned transport
+          err.category = r.error.startsWith('halt:') ? 'cap-halt' : 'provider-red';
           err.lib = 'bare-agent';
           throw err;
         }
@@ -1523,11 +1749,11 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
           // (a step that would BEGIN past the deadline is never funded), and the head of
           // a close-fix iteration (W-2 — the run stops on the verdict already minted).
           if (clock.expired()) {
-            attemptBounded = roundIteration;
+            attemptBounded = { iteration: roundIteration, cause: 'wall', reason: null };
             emit('wall-bounded', { phase, iteration: roundIteration, ...clock.report(closeTimeoutForReport) });
             self.stop();
           } else if (roundsThisAttempt >= attemptRounds) {
-            attemptBounded = roundIteration;
+            attemptBounded = { iteration: roundIteration, cause: 'rounds', reason: null };
             emit('attempt-bounded', { phase, iteration: roundIteration, rounds: roundsThisAttempt, cap: attemptRounds });
             self.stop();
           }
@@ -1561,12 +1787,25 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       } catch (e) {
         throw categorize(e).err;
       }
-      // same error-return taxonomy as interpret's ask (one map, same doctrine):
-      // halt → cap-halt, denial streak → gate-red, API truncation → provider-red
+      // BA-11's deny streak is a BOUNDED ATTEMPT, not a terminal. It is the same
+      // shape `loop.stop()` has at the round bound thirty lines up: the attempt
+      // ran, produced real work, and was cut short by a governance bound doing
+      // exactly its job — the fence HELD, which is the opposite of a fault. So it
+      // takes the same lane: judge the partial work, feed the gap forward, the
+      // loop continues under unchanged caps. Routing it as a terminal killed a
+      // converging run with money and wall left (u-msn227nq). The native surface
+      // takes the identical lane above — one doctrine, both surfaces.
+      if (r.error && r.error.startsWith('denied:')) {
+        const reason = scrub(r.error);
+        attemptBounded = { iteration: roundIteration, cause: 'denied', reason };
+        emit('attempt-bounded', { phase, iteration: roundIteration, rounds: roundsThisAttempt, cap: attemptRounds, reason });
+        return r;
+      }
+      // the remaining error-return taxonomy (one map, same doctrine as native's):
+      // halt → cap-halt, API truncation → provider-red, anything else is wiring
       if (r.error) {
         const err = /** @type {CategorizedError} */ (new Error(`worker loop: ${r.error}`));
         err.category = r.error.startsWith('halt:') ? 'cap-halt'
-          : r.error.startsWith('denied:') ? 'gate-red'
           : r.error.startsWith('truncated:') ? 'provider-red'
           : 'interpreter-red';
         err.lib = 'bare-agent';
@@ -2044,14 +2283,19 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       // carries counts and paths only — never content (the spine is forever).
       const rootInj = root ? root.observe({ iteration, gap, writes: w.workerWrites() }) : null;
       if (rootInj) emit('root-injected', { step: step.id, ...rootInj.event });
+      // read ONCE: the note and the "was it the attempt just before this one" test
+      // are two questions about the same record, and two reads is how they drift
+      const bound = w.wasBounded();
       const r = await w.ask([
         step.action,
         `Repository root (absolute): ${workdir}\nEvery path you pass to a tool MUST be absolute and inside this root — a relative path resolves against a different directory and will be denied by the gate.`,
         step.target && `Write your deliverable to: ${resolve(workdir, step.target)}`,
         artifacts.length > 0 && `Working context (read-only) — prior steps' results:\n${artifacts.map((a) => `[${a.id}] ${a.text}`).join('\n\n')}`,
         gap && `Previous attempt failed this step's checks:\n${gap}`,
-        w.wasBounded() === iteration - 1
-          && `Your previous attempt was CUT OFF after ${step.rounds} tool rounds. Reading is bounded; writing is not. Form a hypothesis EARLY and make the change.`,
+        // the note names the bound that ACTUALLY fired — a deny streak and a spent
+        // round cap are different diagnoses with different remedies, and telling a
+        // fenced worker to "form a hypothesis early" aims it at the wrong wall
+        bound?.iteration === iteration - 1 && boundedNote(bound, step.rounds),
         rootInj && rootInj.note,
       ].filter(Boolean).join('\n\n'));
       lastText = scrub(r.text ?? '').slice(0, ARTIFACT_MAX);
@@ -2234,7 +2478,32 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       && cat === 'step-variance'
       && !varianceGrantUsed
       && stopTrend.trend === 'converging';
-    if ((!replanned || grantExtraReplan) && replanTrigger && remainingUsd() > MONEY_MIN) {
+    // W-2 at the replan GATE, hamr's ruling: *"past the wall no new fix cycle or step
+    // starts"* — and a replan is the first move of starting a new step. Past the
+    // deadline the whole cycle is doomed by construction and it is not free: the
+    // drafting call is bought (money the operator's time allowance no longer covers),
+    // the redrafted plan's first step is then refused at its own head by the W-2 check
+    // one level down, and the run wall-halts anyway. u-msmt91t3 paid for exactly that
+    // and called the result `step-red`. So the gate declines to FUND it.
+    //
+    // Nothing is routed here and no readout is duplicated: declining simply lets the
+    // stop fall through to the `step-variance` terminal below, which is the one site
+    // that mints the wall-halt package (record + F11-consistent escalation + levers).
+    // One site, one spelling — a second copy here is how two instruments come to
+    // disagree about one event.
+    //
+    // TRIGGER-AGNOSTIC (hamr: "extend"). It first covered the variance trigger only,
+    // the one measured on u-msmt91t3; the ladder's exhaustion and the stall fuse reach
+    // this gate past the deadline too, and a doomed cycle costs the same money whichever
+    // instrument named the stop. Each trigger then lands on its own honest terminal
+    // below — the wall for the two that would otherwise mint `step-red`, its own name
+    // for the stall (which already rides out as `step-stalled` and must, because run.js
+    // keys the F44 spend FLOOR on that outcome).
+    //
+    // The latch is NOT consumed — no grant was spent, because no replan was bought.
+    // With time on the clock this is byte-identical to today, for every trigger.
+    const wallStopsReplan = clock.expired();
+    if (!wallStopsReplan && (!replanned || grantExtraReplan) && replanTrigger && remainingUsd() > MONEY_MIN) {
       if (grantExtraReplan) varianceGrantUsed = true;
       replanned = true;
       replans += 1;
@@ -2333,6 +2602,38 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       skipCount = 0;
       continue;
     }
+    /**
+     * W-2's STEP-LOOP terminal, and the ONE place it is spelled. Reached whenever a
+     * trigger that would otherwise mint `step-red:<id>` lands with the deadline already
+     * passed: the meter's stop (F85's variance) and the ladder's (attempt exhaustion
+     * with money still on the table). Both are the same event wearing two instruments'
+     * names — the clock is what ended the run — and `step-red` is a CAPABILITY label,
+     * so minting it there files a governance stop as "the work failed". u-msmt91t3 is
+     * the measured instance: `step-red` 9.9 seconds after the run's own `wall-bounded`.
+     *
+     * One site, one spelling, because the record, the F11-consistent escalation and the
+     * lever list must be identical wherever the clock stops a step — a second copy per
+     * trigger is how two instruments come to disagree about one event. The instrument
+     * that named the stop FIRST is not discarded: it rides in the detail, so the human
+     * reads why the step was stopped as well as which lever fits.
+     *
+     * `stepWallStop` is never consulted here by construction: that record is written
+     * only by the head-of-attempt check, and both triggers above are read BEFORE it, so
+     * a step either of them stopped never reached it.
+     * @param {string} stoppedBy the instrument that named the stop first
+     */
+    const wallHaltTerminal = (stoppedBy) => {
+      emitWallHalt({ cutMidCall: false, phase: `step:${step.id}`, stepsDone: idx, stepsPlanned: plan.steps.length });
+      emit('escalation', {
+        category: 'wall-halt', decisionReady: true, phase: `step:${step.id}`,
+        decision: `The run reached its wall-clock cap while step "${step.id}" was running. Time ran out, not capability — the verdict the run already has stands.`,
+        options: WALL_OPTIONS,
+        detail: `requested ${clock.requestedMs}ms, elapsed ${clock.elapsedMs()}ms. `
+          + `${stoppedBy}: ${lastEscalation?.detail ?? '(none)'} `
+          + `Progress trend: ${stopTrend.trend} — ${stopTrend.reading}; ${stopTrend.lever}.`,
+      });
+      return 'wall-halt';
+    };
     // F64 — the wall stopped this attempt from INSIDE a provider call (the derived
     // call timeout is the deadline in the provider's own coin). ralph already
     // emitted the escalation under this category, so the outcome and the record
@@ -2355,7 +2656,19 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     // stays a step-red (the stop is a result).
     if (cat === 'cap-halt') {
       planExecuted();
-      if (remainingUsd() > MONEY_MIN) return `step-red:${step.id}`;
+      if (remainingUsd() > MONEY_MIN) {
+        // W-2 EXTENDED to the ladder's stop (hamr: "extend"). This arm is the sibling of
+        // the variance terminal below and carries the identical defect: with money still
+        // on the table it minted `step-red` whatever the clock said, so a step the
+        // deadline ended was filed as a capability failure. The wallet is re-read (it
+        // always was); the clock is re-read too, and it is read FIRST inside this arm
+        // only — a DRAINED wallet keeps its own `cap-halt` terminal below, because money
+        // is the allowance actually blocking that run and its levers are the ones the
+        // human needs (a wall-halt readout there would offer "raise maxWallMs and rerun"
+        // into an immediate money cut).
+        if (clock.expired()) return wallHaltTerminal('The ladder ended the step first');
+        return `step-red:${step.id}`;
+      }
       // v1.46 §2: the money cut is decision-ready HERE too, and for the same reason
       // W-2 gave the wall a record at every site it stops a run — a category that
       // hands the human a readout at one seam and silence at another is the readout
@@ -2371,8 +2684,22 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     // upward would mint an outcome run.js and the ledger's class table do not know,
     // and an unmapped category is counted as a library bug (ledger.js) when this is a
     // planning story. The escalation ralph already emitted carries the real detail.
+    //
+    // W-2 at the meter's own terminal. A `step-variance` stop that lands PAST the
+    // deadline is a TIME stop wearing the meter's name — the clock is what ended the
+    // run, and hamr's ruling names that stop: *"when time is up, keep the grade we
+    // already have and stop"*. Its cap-halt sibling directly above already re-reads its
+    // own governor (the wallet) before minting a terminal; this branch did not, and on
+    // u-msmt91t3 it minted `step-red` 9.9 seconds AFTER the run's own `wall-bounded`
+    // record — a governance stop filed as a capability read, and (the resume gate's
+    // half of the same defect) a checkpoint filed as an answer.
+    //
+    // The clock is read HERE, with nothing in flight, exactly as the three other
+    // terminal sites read it. With time still on the clock this is byte-identical to
+    // what it was: the step-red is the designed stop, and the stop is the result.
     if (cat === 'step-variance') {
       planExecuted();
+      if (clock.expired()) return wallHaltTerminal('The meter stopped the step first');
       return `step-red:${step.id}`;
     }
     // Any OTHER terminal escalation category is NOT a capability failure: a
@@ -2394,6 +2721,16 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     planExecuted();
     return 'green';
   }
+  // ── THE THIRD BRANCH (N4 §1.3): between `satisfied` and the fix loop, because
+  // a pause is neither. It is not green (nobody said so), not a red (nobody has
+  // written a gap), and not a CLOSE_FAULT (nothing broke) — so it must be caught
+  // before the fix loop, which would otherwise buy a worker round to convert a
+  // wall that does not exist yet.
+  if (post.verdict === HUMAN_PAUSE) {
+    await emitHitlPause(post);
+    planExecuted();
+    return HITL_PAUSE;
+  }
   const postFault = Object.hasOwn(CLOSE_FAULTS, post.verdict) ? CLOSE_FAULTS[post.verdict] : undefined;
   if (postFault) {
     emit('escalation', { category: postFault.category, decisionReady: true, decision: postFault.decision, options: postFault.options, detail: post.detail });
@@ -2401,6 +2738,15 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     return 'close-red';
   }
   emit('fix-loop', { gapBytes: Buffer.byteLength(post.gap ?? '') });
+  // ── THE RULING IS SPENT HERE (N4 §1.5). The human's words are what OPENS this
+  // loop; the worker now holds them. Leaving the ruling live would make the human
+  // stage red on every judgment for the rest of the leg, so the loop would keep
+  // converting one sentence until the governor or the money stopped it. Cleared,
+  // the next machine-clean tree pauses for a SECOND review — which is the honest
+  // cycle: a person asked for a change, the change happened, the person looks
+  // again. A mechanical red in between is still converted normally, because
+  // first-red-wins reaches it before the person's stage.
+  liveRuling = null;
   let fixOutcome;
   /** @type {object|null} W-2 — set when the WALL stopped the fix loop BETWEEN
    * iterations. It carries that stop's own record fields, and its presence is what
@@ -2482,6 +2828,15 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     const fixGovernor = {
       record: (/** @type {{iteration: number, gap?: string}} */ o) => {
         fixIterationsUsed = o.iteration;
+        // A PAUSE IS NEVER GRADED. ralph records every non-satisfied iteration,
+        // and a pause is one — but it carries no gap and no number, so feeding it
+        // to the trend would mint a strike out of a non-verdict and could strike
+        // the loop out into a `cap-halt` that never happened. The reading says
+        // what it is and the meter is left untouched; `middle` stops the loop on
+        // the next iteration, before anything is bought.
+        if (lastCloseVerdict?.verdict === HUMAN_PAUSE) {
+          return { governor: 'close-trend', trend: 'unknown', reading: 'the close is waiting on a person — not a grade', iteration: o.iteration, paused: true };
+        }
         return { governor: 'close-trend', ...fixTrend.record({ gap: o.gap }), iteration: o.iteration };
       },
       struckOut: fixTrend.struckOut,
@@ -2523,6 +2878,19 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       // until the next iteration is about to start. The close is never bounded — a
       // wall that kills grading leaves the run unreadable after the money is spent
       // (the F45 class), so the one thing this must never do is stop a close.
+      // ── THE CLOSE IS WAITING ON A PERSON. Read here, in the same place and for
+      // the same reason the wall is: past this point the iteration is guaranteed
+      // to be worthless, because the machine half of the close already passes and
+      // nothing a worker writes can answer a question only a person can. So the
+      // loop stops ON that reading — the run pauses again, with everything it has
+      // done kept, exactly as the first pause did.
+      if (lastCloseVerdict?.verdict === HUMAN_PAUSE) {
+        const err = /** @type {CategorizedError} */ (new Error(
+          `the close is waiting on the signer at stage "${lastCloseVerdict.stage ?? 'unknown'}" — every mechanical `
+          + `stage passes, so fix attempt ${iteration} could not change the answer`));
+        err.category = HITL_PAUSE;
+        throw err;
+      }
       if (clock.expired()) {
         // ONE progress instrument, shared with the money halt (PRD v1.46 §2/§4).
         // This site used to run its own `gapTrend`: byte equality of the last two
@@ -2604,6 +2972,13 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
     return relay(e, 'fix');
   }
   planExecuted();
+  // The fix loop ran into the person again (the `middle` stop above). Same
+  // terminal as the first pause, and never `escalated`: nothing failed, and the
+  // work this loop did is exactly what the signer is now being asked about.
+  if (fixOutcome !== 'green' && lastEscalation?.category === HITL_PAUSE) {
+    await emitHitlPause(lastCloseVerdict);
+    return HITL_PAUSE;
+  }
   if (fixOutcome !== 'green' && lastEscalation?.category === 'wall-halt') {
     // F64 in the close-fix loop: the same governance stop, and it must not ride out
     // as a bare `escalated` either — that reads as "the fix failed" when the fix was