faberun 0.12.0 → 0.13.0

package/src/engine/phase-session.mjs

@@ -0,0 +1,217 @@
+/**
+ * Which provider session a node's next invocation runs in: fresh, a
+ * continuation of a compatible earlier session in the same plan phase, or a
+ * rotation -- a fresh session that carries the prior nodes' structured
+ * summaries. Separate from dispatch.mjs, which spawns whatever this decides,
+ * because the decision reads only persisted node snapshots and the routing
+ * table, and because dispatch.mjs crossed the 800-line ceiling carrying it.
+ */
+import { basename, join } from "node:path";
+import { createHash } from "node:crypto";
+import { boundedUtf8, stableJson } from "../util.mjs";
+import { providerCommand } from "../harnesses/index.mjs";
+import { readJson } from "../run/store.mjs";
+import { routeRuntimeForState } from "./failover.mjs";
+import { validateNodeSnapshot } from "../contract/snapshot.mjs";
+
+/** @typedef {import("../contract/index.mjs").ValidatedContract} ValidatedContract */
+/** @typedef {import("../contract/index.mjs").ValidatedNode} ValidatedNode */
+/** @typedef {import("../contract/index.mjs").NodeSnapshot} NodeSnapshot */
+/** @typedef {import("../contract/index.mjs").RuntimeSnapshot} RuntimeSnapshot */
+/** @typedef {import("./process.mjs").Invocation} Invocation */
+
+/** @typedef {{forceFresh?: boolean}} SessionPolicy */
+
+/**
+ * Resolve the session policy one dispatch runs under, then consume the copy the
+ * node persisted. The explicit argument comes from a caller that is dispatching
+ * on the spot; `state.sessionPolicy` is the copy a rejection decision left when
+ * it handed the node back to the scheduler, whose own `startWorker` call passes
+ * nothing at all.
+ *
+ * Persisting is the whole point: `phaseInvocationPlan` rediscovers a compatible
+ * continuation from the persisted ledger, so nulling a local continuation id at
+ * the call site would let the scheduler's later dispatch find it again. Clearing
+ * the stored policy here makes it one-shot — it governs exactly the dispatch it
+ * was recorded for, and the next unrelated attempt reuses normally.
+ *
+ * @param {{sessionPolicy?: SessionPolicy|null}} state
+ * @param {SessionPolicy} [explicit]
+ * @returns {SessionPolicy}
+ */
+export function forceFreshSession(state, explicit = {}) {
+  const persisted = /** @type {SessionPolicy|undefined} */ (state?.sessionPolicy ?? undefined);
+  const policy = { ...(persisted ?? {}), ...explicit };
+  if (state && state.sessionPolicy !== undefined && state.sessionPolicy !== null) state.sessionPolicy = null;
+  return policy;
+}
+
+/**
+ * Select the only continuation that is allowed for this plan phase and role.
+ * The search is intentionally limited to persisted node snapshots in this run.
+ *
+ * `policy.forceFresh` is the explicit session policy a rejection decision
+ * carries: it short-circuits the search before it can rediscover a compatible
+ * continuation, so a retry after a gate rejection starts a fresh provider
+ * session instead of re-reading the failed transcript. Nulling a local id at
+ * the call site is not enough, because this function rediscovers the prior
+ * continuation from the persisted ledger.
+ *
+ * @param {ValidatedContract} contract
+ * @param {ValidatedNode} node
+ * @param {NodeSnapshot} state
+ * @param {string} runDir
+ * @param {"worker"|"judge"} role
+ * @param {string} prompt
+ * @param {SessionPolicy} [policy]
+ * @returns {{prompt: string, continuationId: string|null, mode: "fresh"|"reuse"|"rotate"}}
+ */
+export function phaseInvocationPlan(contract, node, state, runDir, role, prompt, policy = {}) {
+  if (policy.forceFresh === true) {
+    return { prompt, continuationId: null, mode: "fresh" };
+  }
+  const runId = basename(runDir);
+  const session = phaseSessionCandidates(contract, node, state, runDir, role).at(-1);
+  const runtime = routeRuntimeForState(contract, node, state, role);
+  const identityMatches = session && session.invocation.runId === runId
+    && session.invocation.campaignId === contract.campaignId
+    && session.invocation.planPhase === node.phase
+    && session.invocation.role === role
+    && session.invocation.harness === runtime.harness
+    && session.invocation.runtimeId === runtime.id
+    && session.invocation.runtimeFingerprint === fingerprintRuntime(runtime)
+    && session.invocation.model === runtime.model
+    && session.invocation.reasoning === (runtime.reasoning ?? null)
+    && session.invocation.sandbox === (runtime.sandbox ?? null);
+  const canContinue = runtime.capabilities.continuation === true;
+  // A node continuing its own earlier session keeps it. A phase sibling's
+  // session is reused only when the contract opts in (`phaseSessionReuse`):
+  // measured 2026-09-20 over 21 runs with both kinds of turn, a turn opened
+  // on a sibling's session cost 1.87x the fresh one at the same request
+  // count -- it began with 200k tokens of context instead of 45k and re-read
+  // them on every request -- while the rotation below hands the sibling's
+  // structured summary to a fresh session whose first request is already 90%
+  // served from the shared prefix cache.
+  const ownSession = session !== undefined && session.nodeId === node.id;
+  if (identityMatches && canContinue && (ownSession || contract.phaseSessionReuse === true)) {
+    return { prompt, continuationId: session.invocation.continuationId ?? null, mode: "reuse" };
+  }
+  // A harness that cannot continue at all, or a session picked up from a
+  // different phase-sibling node whose identity does not match this one, has
+  // no native continuity: the fresh attempt carries the prior nodes'
+  // structured summaries forward instead of starting blind.
+  if (session && (!canContinue || session.nodeId !== node.id)) {
+    return {
+      prompt: phaseHandoffPrompt(contract, node, state, runDir, role),
+      continuationId: null,
+      mode: "rotate",
+    };
+  }
+  // A capable harness continuing its own node whose identity merely drifted
+  // (the run directory moved, or a runtime edge) still gets the caller's own
+  // prompt — already carrying the node's bounded "Previous attempt" section —
+  // in a fresh session, never a synthesized handoff.
+  return { prompt, continuationId: null, mode: session ? "rotate" : "fresh" };
+}
+
+/**
+ * Continuation ids a live invocation is already driving, anywhere in the run.
+ *
+ * This is what makes concurrent nodes of one phase safe, and it is read from
+ * the persisted ledger rather than from an in-memory registry so a controller
+ * that took over a run inherits the claims instead of racing them.
+ *
+ * @param {ValidatedContract} contract
+ * @param {NodeSnapshot} currentState
+ * @param {string} runDir
+ * @returns {Set<string>}
+ */
+function claimedContinuations(contract, currentState, runDir) {
+  /** @type {Set<string>} */
+  const claimed = new Set();
+  for (const candidate of contract.nodes) {
+    let state = candidate.id === currentState.id ? currentState : null;
+    if (!state) {
+      try { state = validateNodeSnapshot(readJson(join(runDir, "nodes", `${candidate.id}.json`)), candidate); } catch { continue; }
+    }
+    for (const invocation of state.invocations ?? []) {
+      if (invocation.status === "active" && invocation.continuationId) claimed.add(invocation.continuationId);
+    }
+  }
+  return claimed;
+}
+
+/**
+ * @param {ValidatedContract} contract
+ * @param {ValidatedNode} node
+ * @param {NodeSnapshot} currentState
+ * @param {string} runDir
+ * @param {"worker"|"judge"} role
+ * @returns {{nodeId: string, invocation: Invocation}[]}
+ */
+function phaseSessionCandidates(contract, node, currentState, runDir, role) {
+  /** @type {{nodeId: string, invocation: Invocation}[]} */
+  const candidates = [];
+  const claimed = claimedContinuations(contract, currentState, runDir);
+  for (const candidate of contract.nodes) {
+    if (candidate.phase !== node.phase) continue;
+    let state = candidate.id === currentState.id ? currentState : null;
+    if (!state) {
+      try { state = validateNodeSnapshot(readJson(join(runDir, "nodes", `${candidate.id}.json`)), candidate); } catch { continue; }
+    }
+    for (const invocation of state.invocations ?? []) {
+      if (invocation.role !== role || invocation.planPhase !== node.phase || !invocation.continuationId) continue;
+      if (invocation.nodeId !== candidate.id || invocation.attempt !== state.attempt || invocation.workspace !== state.worktree?.path) continue;
+      // One provider session, one live turn. With `maxParallel` above one,
+      // two nodes of a phase can be dispatched in the same tick, and without
+      // this both would hand the same continuation id to their own provider
+      // process. The claim is read from the persisted ledger, which the
+      // in-tick dispatch already wrote for the node that went first.
+      if (claimed.has(invocation.continuationId)) continue;
+      candidates.push({ nodeId: candidate.id, invocation });
+    }
+  }
+  return candidates.sort((left, right) => {
+    const leftStarted = Date.parse(left.invocation.startedAt);
+    const rightStarted = Date.parse(right.invocation.startedAt);
+    if (leftStarted !== rightStarted) return leftStarted - rightStarted;
+    const leftUpdated = Date.parse(left.invocation.updatedAt);
+    const rightUpdated = Date.parse(right.invocation.updatedAt);
+    if (leftUpdated !== rightUpdated) return leftUpdated - rightUpdated;
+    return left.invocation.id.localeCompare(right.invocation.id);
+  });
+}
+
+/** @param {RuntimeSnapshot} runtime @returns {string} */
+export function fingerprintRuntime(runtime) {
+  const executable = providerCommand(runtime, "").executable;
+  return createHash("sha256").update(stableJson({ runtime, executable })).digest("hex");
+}
+
+/** @param {ValidatedContract} contract @param {ValidatedNode} node @param {NodeSnapshot} state @param {string} runDir @param {"worker"|"judge"} role @returns {string} */
+function phaseHandoffPrompt(contract, node, state, runDir, role) {
+  const summaries = phaseSessionCandidates(contract, node, state, runDir, role)
+    .map(({ nodeId }) => {
+      const candidate = contract.nodes.find((item) => item.id === nodeId);
+      let snapshot = null;
+      try { snapshot = readJson(join(runDir, "nodes", `${nodeId}.json`)); } catch {
+        // ENOENT or unreadable snapshot: this prior node contributes no summary.
+      }
+      const result = snapshot?.result;
+      const record = result && typeof result === "object" && !Array.isArray(result)
+        ? /** @type {Record<string, unknown>} */ (result)
+        : null;
+      const summary = typeof record?.summary === "string" ? record.summary : null;
+      return summary && candidate ? `${candidate.id}: ${boundedUtf8(summary, 1024)}` : null;
+    })
+    .filter(Boolean)
+    .slice(-8);
+  const handoff = [
+    `Continue phase ${node.phase} as the ${role} agent in a fresh provider session.`,
+    "Prior structured node summaries:",
+    summaries.length ? summaries.map((summary) => `- ${summary}`).join("\n") : "- (none)",
+    "Current closed task packet:",
+    boundedUtf8(node.prompt, 48 * 1024),
+  ].join("\n\n");
+  return boundedUtf8(handoff, 60 * 1024);
+}

package/src/engine/process.mjs

@@ -7,8 +7,8 @@
  * a judge decides, or when a run is done. That separation is the point: a stuck
  * provider is killed by the same code whatever it was asked to do.
  */
-import { SessionMetricsParser } from "../harnesses/exec-jsonl/index.mjs";
-import { closeSync, existsSync, fsyncSync, openSync, readFileSync, readSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { boundedRegion, monitorInvocation } from "./transcript.mjs";
+import { closeSync, existsSync, fsyncSync, openSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { errorCode, errorMessage } from "../util.mjs";
 import { fileURLToPath } from "node:url";
@@ -33,19 +33,14 @@ import { writeNodeSnapshot } from "../run/node-store.mjs";
 /** @typedef {ProviderEnvelope & {costProvenance?: "priced"}} PricedEnvelope */
 /** @typedef {import("node:child_process").ChildProcess} ChildProcess */
 /** @typedef {{prompt: string|null, stdout: string, stderr: string}} PathSet */
-/** @typedef {{id: string, pid: number, processGroupId: number|null, processStartToken: string|null, harness: string, runtimeId: string|null, runtimeFingerprint?: string, revision?: number, phase: string, promptPath: string|null, stdoutPath: string, stderrPath: string, startedAt: string, deadlineAt: string|null, updatedAt: string, closedAt: string|null, exitCode: number|null, signal: string|null, status: "active"|"closed"|"terminated", executable: string, snapshotPath?: string, usage?: Usage, usageEstimated?: boolean, costUsd?: number|null, costProvenance?: "priced", runId?: string, campaignId?: string, nodeId?: string, attempt?: number, workspace?: string, worktreeBranch?: string|null, worktreeBaseSha?: string|null, planPhase?: string, role?: "worker"|"judge", model?: string, reasoning?: string|null, sandbox?: string|null, continuationId?: string|null, continuationMode?: "fresh"|"reuse"|"rotate"}} Invocation */
+/** @typedef {{id: string, pid: number, processGroupId: number|null, processStartToken: string|null, harness: string, runtimeId: string|null, runtimeFingerprint?: string, revision?: number, phase: string, promptPath: string|null, stdoutPath: string, stderrPath: string, startedAt: string, deadlineAt: string|null, updatedAt: string, closedAt: string|null, exitCode: number|null, signal: string|null, status: "active"|"closed"|"terminated", executable: string, snapshotPath?: string, usage?: Usage, usageEstimated?: boolean, costUsd?: number|null, costProvenance?: "priced", runId?: string, campaignId?: string, nodeId?: string, attempt?: number, workspace?: string, worktreeBranch?: string|null, worktreeBaseSha?: string|null, planPhase?: string, role?: "worker"|"judge", model?: string, reasoning?: string|null, sandbox?: string|null, continuationId?: string|null, continuationMode?: "fresh"|"reuse"|"rotate", session?: import("../harnesses/session-metrics.mjs").SessionLedger|null}} Invocation */
 /** @typedef {{pid: number|null, processGroupId?: number|null, processStartToken?: string|null}} InvocationProbe */
-/** @typedef {{child: ChildProcess, contract: ValidatedContract, node: ValidatedNode, state: NodeSnapshot, runtime: HarnessRuntime & {id: string|null}, cwd: string, paths: PathSet, phase: string, invocation: Invocation, startedAt: string, startedTicks: bigint, progressTicks: bigint, lastOutputAt: number, closed: boolean, exitCode: number|null, signal: string|null, spawnError: Error|null, terminating: Promise<void>|null, gateConfigPath: string, gateReleasePath: string, scopeBaseline?: unknown, scopeChecked?: boolean, scopeViolation?: boolean, resultMaterialization?: boolean, recoveryBaseline?: unknown, observeTimer?: ReturnType<typeof setInterval>, monitorOffset?: number, monitorParser?: import("../harnesses/exec-jsonl/index.mjs").SessionMetricsParser, lastEventCount?: number, observedOnce?: boolean, onClose?: (invocation: Invocation) => void, onInvocationUpdate?: (invocation: Invocation) => void, onProgress?: (state: NodeSnapshot) => void}} Job */
+/** @typedef {{child: ChildProcess, contract: ValidatedContract, node: ValidatedNode, state: NodeSnapshot, runtime: HarnessRuntime & {id: string|null}, cwd: string, paths: PathSet, phase: string, invocation: Invocation, startedAt: string, startedTicks: bigint, progressTicks: bigint, lastOutputAt: number, closed: boolean, exitCode: number|null, signal: string|null, spawnError: Error|null, terminating: Promise<void>|null, gateConfigPath: string, gateReleasePath: string, scopeBaseline?: unknown, scopeChecked?: boolean, scopeViolation?: boolean, resultMaterialization?: boolean, recoveryBaseline?: unknown, observeTimer?: ReturnType<typeof setInterval>, monitorOffset?: number, monitorParser?: import("../harnesses/session-metrics.mjs").SessionMetricsParser, lastEventCount?: number, observedOnce?: boolean, onClose?: (invocation: Invocation) => void, onInvocationUpdate?: (invocation: Invocation) => void, onProgress?: (state: NodeSnapshot) => void}} Job */
 /** @typedef {{graceMs?: number, killGraceMs?: number, escalate?: boolean, runDir?: string, kill?: (pid: number, signal: string|number) => unknown, child?: ChildProcess|null}} TerminateOptions */
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const DEFAULT_GRACE_MS = 2_000;
 const GATE_PATH = join(HERE, "gate.mjs");
-const MAX_PROVIDER_LOG_BYTES = 512 * 1024;
-/** Fixed-size read for incremental transcript observation. */
-const MONITOR_CHUNK_BYTES = 64 * 1024;
-/** Per-observation read budget: one tick never blocks on a huge backlog. */
-const MONITOR_CALL_BUDGET_BYTES = 1024 * 1024;
 /**
  * @param {{contract: ValidatedContract, node: ValidatedNode, state: NodeSnapshot, runtime: HarnessRuntime & {id: string|null}, prompt: string, paths: PathSet, phase: string, workspace?: string, commandOptions?: import("../harnesses/index.mjs").CommandOptions, onInvocation: (invocation: Invocation, job: Job) => void, onInvocationUpdate?: (invocation: Invocation) => void, onProgress?: (state: NodeSnapshot) => void}} args
  * @returns {Job}
@@ -201,47 +196,6 @@ function observeInvocation(job) {
     // id must not be able to kill the job that is being observed.
   }
 }
-/**
- * Observe the transcript incrementally: read only the bytes appended since
- * the last observation, in fixed-size chunks folded into a parser whose
- * retained state never scales with the unread length — so the metrics
- * survive both a transcript that outgrows any fixed window and an
- * already-large transcript on the first call after a controller restart.
- * The gate caps the log only at close, so byte offsets stay valid while the
- * provider is live. Only newline-terminated records are evidence; a
- * trailing partial record stays unconsumed for the next observation. The
- * generic metrics are zero for a provider that does not expose them.
- *
- * @param {Job} job
- * @returns {{continuationId: string|null, turns: number, cacheReadInputTokens: number, toolCalls: number, completed: boolean}}
- */
-export function monitorInvocation(job) {
-  try {
-    const parser = job.monitorParser ?? (job.monitorParser = new SessionMetricsParser(job.runtime.harness));
-    const size = statSync(job.paths.stdout).size;
-    let offset = job.monitorOffset ?? 0;
-    let budget = MONITOR_CALL_BUDGET_BYTES;
-    if (size > offset) {
-      const fd = openSync(job.paths.stdout, "r");
-      try {
-        const chunk = Buffer.alloc(MONITOR_CHUNK_BYTES);
-        while (offset < size && budget > 0) {
-          const read = readSync(fd, chunk, 0, Math.min(chunk.length, size - offset, budget), offset);
-          if (read <= 0) break;
-          parser.push(chunk.subarray(0, read));
-          offset += read;
-          budget -= read;
-        }
-      } finally {
-        closeSync(fd);
-      }
-      job.monitorOffset = offset;
-    }
-    return { continuationId: parser.continuationId, ...parser.metrics() };
-  } catch {
-    return { continuationId: null, turns: 0, cacheReadInputTokens: 0, toolCalls: 0, completed: false };
-  }
-}
 /**
  * @param {string} path
  */
@@ -321,7 +275,7 @@ export async function terminateInvocation(invocation, options = {}) {
  * sealing here, a timeout parks with an empty seal and the recorded work is
  * abandoned in a worktree the next attempt never reads.
  */
-const SEAL_BEFORE_KILL_CODES = new Set(["wall_clock_timeout", "stall_timeout"]);
+const SEAL_BEFORE_KILL_CODES = new Set(["wall_clock_timeout", "stall_timeout", "turn_limit"]);
 
 /**
  * How long a `SIGSTOP`ped process group is given to actually stop before the
@@ -393,8 +347,8 @@ function resumeInvocation(invocation) {
 }
 
 /**
- * The pre-termination seam, filled: on `wall_clock_timeout` and `stall_timeout`
- * quiesce the provider, seal the attempt worktree, and only then let the caller
+ * The pre-termination seam, filled: on `wall_clock_timeout`, `stall_timeout`
+ * and `turn_limit` quiesce the provider, seal the attempt worktree, and only then let the caller
  * terminate it, so the next attempt is cut from the seal. The seal is bounded
  * by the same git timeout every synchronous git call uses
  * (`GIT_SYNC_TIMEOUT_MS`, overridable with `FABERUN_GIT_TIMEOUT_MS`);
@@ -487,6 +441,25 @@ export async function detectStalls(contract, running, onTimeout, onProgress, onB
         // as liveness, not only for an mtime that no longer does.
         job.lastOutputAt = Date.now();
       }
+      // The attempt's request ceiling: a turn still making requests past it
+      // is the runaway shape, not progress. measured 2026-09-20: two 600-request
+      // turns re-sent 190M and 167M tokens of context and produced no result;
+      // the 23 turns with no result held 25% of all context spend. Ends the
+      // attempt the way a timeout does: sealed, then one automatic retry.
+      // (`turns` counts provider requests for claude, dsh and agy; codex
+      // reports whole turns, so its cap is in effect a turn count.)
+      const turnCap = job.node?.maxTurns ?? contract.maxTurns;
+      if (typeof turnCap === "number" && monitored.turns >= turnCap) {
+        const limit = {
+          code: "turn_limit",
+          message: `${job.phase} made ${monitored.turns} provider requests, the attempt's maxTurns of ${turnCap}`,
+        };
+        await onBeforeTerminate(job, limit);
+        await terminateProcess(job);
+        running.delete(nodeId);
+        await onTimeout(job, "exhausted", limit);
+        continue;
+      }
     } else if (job.observedOnce !== true) {
       job.progressTicks = now;
       job.lastOutputAt = Date.now();
@@ -583,28 +556,6 @@ export function priceUsage(runtime, usage, reportedCostUsd) {
   }
   return { costUsd: total / 1_000_000, costProvenance: "priced" };
 }
-/**
- * @param {string} path
- * @param {number} maxBytes
- * @returns {string}
- */
-function boundedRegion(path, maxBytes = MAX_PROVIDER_LOG_BYTES) {
-  try {
-    return dropPartialLogLine(readFileSync(`${path}.tail`, "utf8"));
-  } catch (error) {
-    if (errorCode(error) !== "ENOENT") throw error;
-  }
-  const size = statSync(path).size;
-  if (size <= maxBytes) return readFileSync(path, "utf8");
-  const fd = openSync(path, "r");
-  try {
-    const bytes = Buffer.alloc(maxBytes);
-    readSync(fd, bytes, 0, maxBytes, size - maxBytes);
-    return dropPartialLogLine(bytes.toString("utf8"));
-  } finally {
-    closeSync(fd);
-  }
-}
 /**
  * Signal the invocation's process group only when ownership is proven. Never
  * throws: ESRCH is gone, EPERM is a group this user cannot signal and therefore
@@ -746,36 +697,3 @@ export function logPaths(runDir, nodeId, phase, attempt) {
     stderr: join(runDir, "logs", `${stem}.err`),
   };
 }
-/**
- * @param {string} path
- * @param {number} [maxBytes]
- * @returns {string}
- */
-export function readBoundedTail(path, maxBytes = 512 * 1024) {
-  try {
-    try { return dropPartialLogLine(readFileSync(`${path}.tail`, "utf8")); } catch (tailError) {
-      if (errorCode(tailError) !== "ENOENT") throw tailError;
-    }
-    const size = statSync(path).size;
-    if (size <= maxBytes) return readFileSync(path, "utf8");
-    const fd = openSync(path, "r");
-    try {
-      const bytes = Buffer.alloc(maxBytes);
-      readSync(fd, bytes, 0, maxBytes, size - maxBytes);
-      return dropPartialLogLine(bytes.toString("utf8"));
-    } finally {
-      closeSync(fd);
-    }
-  } catch (error) {
-    if (errorCode(error) === "ENOENT") return "";
-    throw error;
-  }
-}
-/**
- * @param {unknown} value
- * @returns {string}
- */
-function dropPartialLogLine(value) {
-  const newline = String(value).indexOf("\n");
-  return newline < 0 ? "" : String(value).slice(newline + 1);
-}

package/src/engine/scheduler.mjs

@@ -7,7 +7,8 @@ import {
   applyJudgeRound,
 } from "./review.mjs";
 import { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION } from "../harnesses/index.mjs";
-import { routingBackoffActive } from "./failover.mjs";
+import { routeRuntimeForState, routingBackoffActive } from "./failover.mjs";
+import { quotaHeldRuntimes, runningPerRuntime, runtimeHasCapacity } from "./capacity.mjs";
 
 import {
   bootstrapAttemptPath,
@@ -583,7 +584,7 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
         // A judge killed on its own wall clock produced no verdict. That is a
         // judge protocol defect, not a node outcome: it earns the one bounded
         // re-ask, and only then the review mode settles the node.
-        if (job.phase === "judge" && error.code === "wall_clock_timeout") {
+        if (job.phase === "judge" && (error.code === "wall_clock_timeout" || error.code === "turn_limit")) {
           await applyJudgeProtocolFailure(contract, job.node, job.state, runDir, running, lock, states, campaign.path, error.message);
           return;
         }
@@ -614,9 +615,20 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
           return state?.status === "pending" && !pendingSettlements.has(node.id)
             && node.dependsOn.every((id) => states.get(id)?.status === "done");
         });
-        for (const node of ready.slice(0, slots)) {
+        // Per-runtime capacity is judged per dispatch, not per tick: the
+        // counts include what this tick has already started, and a runtime a
+        // sibling is waiting out a quota reset on accepts nothing new.
+        const counts = runningPerRuntime(running.values());
+        const held = quotaHeldRuntimes(states.values(), Date.now());
+        let dispatched = 0;
+        for (const node of ready) {
+          if (dispatched >= slots) break;
           const state = states.get(node.id);
           if (!state || routingBackoffActive(state, state.phase)) continue;
+          const routed = routeRuntimeForState(contract, node, state, state.phase === "judge" ? "judge" : "worker");
+          if (!runtimeHasCapacity(routed.id, contract, counts, held)) continue;
+          counts.set(routed.id, (counts.get(routed.id) ?? 0) + 1);
+          dispatched += 1;
           // A node recovered pending a re-ask judge (its own worker attempt
           // already accepted, `state.result` durable) reaches `settleDone` /
           // `integrateAttempt` exactly like a closed job's own settlement

package/src/engine/settle.mjs

@@ -40,11 +40,20 @@ import { verifyCandidateWorkspace } from "./verify.mjs";
 /** @typedef {import("../contract/index.mjs").ValidatedContract} ValidatedContract */
 /** @typedef {import("../contract/index.mjs").ValidatedNode} ValidatedNode */
 
-/** Settle one worker-generation rejection: bounded revision when one remains, otherwise terminal exhausted/failed. @param {ValidatedContract} contract @param {ValidatedNode} node @param {NodeSnapshot} state @param {string} runDir @param {Map<string, Job>|null} running @param {LockHandle} lock @param {Map<string, NodeSnapshot>} states @param {string} campaignPath @param {JudgeVerdict} verdict @param {{code: string, label: string, phase?: "worker"|"judge", message?: string, forceFresh?: boolean}} options */
+/**
+ * Settle one worker-generation rejection: bounded revision when one remains,
+ * otherwise terminal exhausted/failed. The revision budget is the node's
+ * (`gate.maxRevisions`, default 1) whether or not the gate reviews: a red
+ * deterministic verification earns the same fresh attempt with the failure in
+ * front of the worker that a judge rejection does. Measured 2026-09-20 in the
+ * orchestration-arms campaign: with the budget behind `gate.enabled`, a node
+ * under `gate: false` died on one timing test that flaked under load, and its
+ * dependant with it, while the judged twin of the same node got its retry.
+ * @param {ValidatedContract} contract @param {ValidatedNode} node @param {NodeSnapshot} state @param {string} runDir @param {Map<string, Job>|null} running @param {LockHandle} lock @param {Map<string, NodeSnapshot>} states @param {string} campaignPath @param {JudgeVerdict} verdict @param {{code: string, label: string, phase?: "worker"|"judge", message?: string, forceFresh?: boolean}} options */
 export function applyRejection(contract, node, state, runDir, running, lock, states, campaignPath, verdict, options) {
   const { code, label, phase = "worker", message = verdict.summary, forceFresh = true } = options;
   state.gate = verdict;
-  if (node.gate.enabled && state.revisions < (node.gate.maxRevisions ?? 1)) {
+  if (state.revisions < (node.gate.maxRevisions ?? 1)) {
     resetPhaseRouting(state);
     state.revisions += 1;
     // The fresh-session decision travels with the node, not just this call:

package/src/engine/transcript.mjs

@@ -0,0 +1,145 @@
+/**
+ * The provider transcript as the controller reads it: bounded tail reads at
+ * settlement, incremental observation while the provider runs (the liveness
+ * signal and the per-request ledger), and the drain at close. Separate from
+ * process.mjs, which owns the process itself -- spawn, gate, kill, seal --
+ * because reading the log never touches the process, and because process.mjs
+ * crossed the 800-line ceiling carrying both jobs.
+ */
+import { closeSync, openSync, readFileSync, readSync, statSync } from "node:fs";
+import { Buffer } from "node:buffer";
+import { SessionMetricsParser } from "../harnesses/session-metrics.mjs";
+import { errorCode } from "../util.mjs";
+
+/** @typedef {import("./process.mjs").Job} Job */
+
+const MAX_PROVIDER_LOG_BYTES = 512 * 1024;
+/** Fixed-size read for incremental transcript observation. */
+const MONITOR_CHUNK_BYTES = 64 * 1024;
+/** Per-observation read budget: one tick never blocks on a huge backlog. */
+const MONITOR_CALL_BUDGET_BYTES = 1024 * 1024;
+/** Settlement drain bound: 64 budgets is 64 MiB, above the largest stored transcript (25.8 MB, measured 2026-09-20). */
+const MONITOR_DRAIN_CALLS = 64;
+
+/**
+ * Observe the transcript incrementally: read only the bytes appended since
+ * the last observation, in fixed-size chunks folded into a parser whose
+ * retained state never scales with the unread length — so the metrics
+ * survive both a transcript that outgrows any fixed window and an
+ * already-large transcript on the first call after a controller restart.
+ * The gate caps the log only at close, so byte offsets stay valid while the
+ * provider is live. Only newline-terminated records are evidence; a
+ * trailing partial record stays unconsumed for the next observation. The
+ * generic metrics are zero for a provider that does not expose them.
+ *
+ * @param {Job} job
+ * @returns {{continuationId: string|null, turns: number, cacheReadInputTokens: number, toolCalls: number, completed: boolean}}
+ */
+export function monitorInvocation(job) {
+  try {
+    const parser = job.monitorParser ?? (job.monitorParser = new SessionMetricsParser(job.runtime.harness));
+    const size = statSync(job.paths.stdout).size;
+    let offset = job.monitorOffset ?? 0;
+    let budget = MONITOR_CALL_BUDGET_BYTES;
+    if (size > offset) {
+      const fd = openSync(job.paths.stdout, "r");
+      try {
+        const chunk = Buffer.alloc(MONITOR_CHUNK_BYTES);
+        while (offset < size && budget > 0) {
+          const read = readSync(fd, chunk, 0, Math.min(chunk.length, size - offset, budget), offset);
+          if (read <= 0) break;
+          parser.push(chunk.subarray(0, read));
+          offset += read;
+          budget -= read;
+        }
+      } finally {
+        closeSync(fd);
+      }
+      job.monitorOffset = offset;
+    }
+    return { continuationId: parser.continuationId, ...parser.metrics() };
+  } catch {
+    return { continuationId: null, turns: 0, cacheReadInputTokens: 0, toolCalls: 0, completed: false };
+  }
+}
+
+/**
+ * Drain what the live monitor has not read yet and return the per-request
+ * ledger the transcript proves. Called at settlement, before any outcome is
+ * decided: the gate caps the log to its last 512 KiB at close, so the head of
+ * a long turn -- the requests that show how its context grew -- survives only
+ * in what the monitor folded while the provider was alive (measured
+ * 2026-09-20: 132 of 715 stored logs sit exactly at the cap). A harness the
+ * monitor never observed (no live stream) is read here from offset zero.
+ *
+ * @param {Job} job
+ * @returns {import("../harnesses/session-metrics.mjs").SessionLedger}
+ */
+export function sessionLedger(job) {
+  for (let call = 0; call < MONITOR_DRAIN_CALLS; call += 1) {
+    const before = job.monitorOffset ?? 0;
+    monitorInvocation(job);
+    if ((job.monitorOffset ?? 0) === before) break;
+  }
+  const parser = job.monitorParser ?? (job.monitorParser = new SessionMetricsParser(job.runtime.harness));
+  parser.flush();
+  return parser.session();
+}
+
+/**
+ * @param {string} path
+ * @param {number} maxBytes
+ * @returns {string}
+ */
+export function boundedRegion(path, maxBytes = MAX_PROVIDER_LOG_BYTES) {
+  try {
+    return dropPartialLogLine(readFileSync(`${path}.tail`, "utf8"));
+  } catch (error) {
+    if (errorCode(error) !== "ENOENT") throw error;
+  }
+  const size = statSync(path).size;
+  if (size <= maxBytes) return readFileSync(path, "utf8");
+  const fd = openSync(path, "r");
+  try {
+    const bytes = Buffer.alloc(maxBytes);
+    readSync(fd, bytes, 0, maxBytes, size - maxBytes);
+    return dropPartialLogLine(bytes.toString("utf8"));
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/**
+ * @param {string} path
+ * @param {number} [maxBytes]
+ * @returns {string}
+ */
+export function readBoundedTail(path, maxBytes = 512 * 1024) {
+  try {
+    try { return dropPartialLogLine(readFileSync(`${path}.tail`, "utf8")); } catch (tailError) {
+      if (errorCode(tailError) !== "ENOENT") throw tailError;
+    }
+    const size = statSync(path).size;
+    if (size <= maxBytes) return readFileSync(path, "utf8");
+    const fd = openSync(path, "r");
+    try {
+      const bytes = Buffer.alloc(maxBytes);
+      readSync(fd, bytes, 0, maxBytes, size - maxBytes);
+      return dropPartialLogLine(bytes.toString("utf8"));
+    } finally {
+      closeSync(fd);
+    }
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return "";
+    throw error;
+  }
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function dropPartialLogLine(value) {
+  const newline = String(value).indexOf("\n");
+  return newline < 0 ? "" : String(value).slice(newline + 1);
+}

package/src/harnesses/claude/index.mjs

@@ -84,6 +84,11 @@ export const claudeHarness = {
     ];
     if (options.toolPolicy) args.push("--settings", JSON.stringify(hookSettings(options.toolPolicy)));
     if (runtime.reasoning) args.push("--effort", runtime.reasoning);
+    // The attempt's request ceiling, enforced by the CLI itself; the
+    // controller's monitor enforces the same number for every streaming
+    // harness, so this only makes the stop cleaner (a result event instead of
+    // a kill) for the one harness that can take it as a flag.
+    if (typeof options.maxTurns === "number") args.push("--max-turns", String(options.maxTurns));
     if (options.schema) args.push("--json-schema", JSON.stringify(options.schema));
     return { executable: this.executable(runtime), args, promptTransport: "stdin", input: prompt };
   },