faberun 0.14.0 → 0.16.0

package/src/engine/lifecycle.mjs

@@ -280,22 +280,35 @@ export function clearTierExhaustion(state) {
 }
 
 /**
+ * Settle what a closed invocation produced, and start whatever the outcome
+ * earns next.
+ *
+ * The two maps are two different things, and conflating them is what let a run
+ * exceed its own `maxParallel` (measured 2026-09-21, run
+ * state-location-and-routing-economics-13): `closed` is the job this call owns
+ * -- the scheduler hands one node's job at a time so two settlements never
+ * interleave -- while `running` is the run's live dispatch authority, the very
+ * map the scheduler's `maxParallel - running.size` counts. Anything started
+ * here lands in `running` and is accounted from that instant; nothing started
+ * here may be settled by this call.
+ *
  * @param {ValidatedContract} contract
  * @param {string} runDir
  * @param {Map<string, NodeSnapshot>} states
- * @param {Map<string, Job>} running
+ * @param {Map<string, Job>} closed
  * @param {LockHandle} lock
  * @param {string} campaignPath
+ * @param {Map<string, Job>} running
  * @returns {Promise<void>}
  */
-export async function finalizeClosedJobs(contract, runDir, states, running, lock, campaignPath) {
+export async function finalizeClosedJobs(contract, runDir, states, closed, lock, campaignPath, running) {
   // Advisory spend lines are checked every tick, before outcome handling: a
   // crossing must be visible while the spend is happening, not only when the
   // run is already over. The check never stops or transitions a node.
   await emitNodeAdvisories(contract, runDir, states);
-  for (const [nodeId, job] of running) {
+  for (const [nodeId, job] of closed) {
     if (!job.closed || invocationAlive(job.invocation)) continue;
-    running.delete(nodeId);
+    closed.delete(nodeId);
     const state = states.get(nodeId);
     if (!state) continue;
     // Usage is extracted and persisted BEFORE any outcome-specific handling:

package/src/engine/mutation.mjs

@@ -9,6 +9,14 @@
  * break syntax and the sample is a deterministic eight, because a gate that
  * fails at random, or on a mutant that does not compile, is worse than no gate.
  *
+ * The kill fraction is declared by tier, not hand-picked per entry: the entry
+ * declares a risk tier and `MUTATION_TIERS` (`contract/verification.mjs`)
+ * fixes what each tier demands, so two nodes at the same tier sit the same
+ * bar. The whole entry — baseline plus sample — is held inside
+ * `MUTATION_TIME_BUDGET_MS`, and mutants the budget cannot afford stay in the
+ * denominator, so a suite too slow to sample inside the budget fails rather
+ * than passing on a narrowed set.
+ *
  * It is a separate module from `run-command.mjs` so that the "doing" of a
  * verification run and the "which file to break" policy do not grow together;
  * the runner receives the argv executor as a callback rather than importing it,
@@ -16,10 +24,27 @@
  */
 import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { MUTATION_TIERS } from "../contract/verification.mjs";
 
 /** At most this many mutants run for one verification entry. */
 export const MUTATION_BUDGET = 8;
 
+/**
+ * Wall-clock budget for one mutation entry — baseline plus every mutant run —
+ * in milliseconds. Each mutant re-runs the same argv, so each one costs what
+ * the baseline cost, and the runner refuses to start a mutant the remaining
+ * budget cannot afford.
+ *
+ * measured 2026-09-21 on this repository: the scenarios in
+ * test/engine/mutation.test.mjs cost 0.08–0.37s per run, so a node-sized entry
+ * (baseline plus eight mutants over a targeted suite) costs ~1–4s and samples
+ * in full. The budget admits any suite up to ~3.3s per run and denies slower
+ * ones every mutant — measured counter-example: `node --test test/contract`
+ * costs ~20s per run, and a mutation entry is scoped to the node's own
+ * verification command, not to a whole suite directory.
+ */
+export const MUTATION_TIME_BUDGET_MS = 30_000;
+
 /**
  * The six operators, and only these: comparison and logical swaps. Each swap
  * keeps the expression well formed, so a surviving mutant is signal about the
@@ -109,18 +134,31 @@ function evenlySpaced(candidates, budget) {
  */
 export async function runMutation(command, baseCwd, options) {
   const mutation = command.mutation;
-  if (!mutation) throw new TypeError("mutation runner requires a command.mutation threshold");
-  const threshold = mutation.threshold;
-  const selected = evenlySpaced(mutationCandidates(baseCwd, options.writeFiles ?? []), MUTATION_BUDGET);
+  if (!mutation) throw new TypeError("mutation runner requires a command.mutation risk tier");
+  const threshold = MUTATION_TIERS[mutation.tier];
+  const sample = evenlySpaced(mutationCandidates(baseCwd, options.writeFiles ?? []), MUTATION_BUDGET);
   /** @type {VerificationAttemptResult[]} */
   const attempts = [];
   const baseline = await options.run(1);
   attempts.push(baseline);
-  if (!baseline.passed) return { passed: false, killed: 0, total: selected.length, threshold, attempts };
+  if (!baseline.passed) return { passed: false, killed: 0, total: sample.length, threshold, attempts };
+  // Every mutant re-runs the same argv, so the baseline's own measured duration
+  // is what one more attempt costs, and the budget is spent in those units. An
+  // executor that reports no duration (the unit-test seam) is charged zero and
+  // is never denied a mutant.
+  const attemptMs = Number.isFinite(baseline.durationMs) ? /** @type {number} */ (baseline.durationMs) : 0;
   /** @type {Map<string, string>} */
   const originals = new Map();
   let killed = 0;
-  for (const [index, candidate] of selected.entries()) {
+  let spentMs = attemptMs;
+  let attempt = 1;
+  for (const candidate of sample) {
+    // Mutants the budget cannot afford are not silently dropped from the
+    // denominator: `total` stays the full sample, so truncation can only lower
+    // the kill fraction. A suite too slow to sample inside the budget fails a
+    // gate it is too slow to sit for — the narrowing the budget exists to
+    // prevent.
+    if (attemptMs > 0 && spentMs + attemptMs > MUTATION_TIME_BUDGET_MS) break;
     let original = originals.get(candidate.absolute);
     if (original === undefined) {
       original = readFileSync(candidate.absolute, "utf8");
@@ -129,16 +167,18 @@ export async function runMutation(command, baseCwd, options) {
     const mutated = `${original.slice(0, candidate.offset)}${candidate.to}${original.slice(candidate.offset + candidate.from.length)}`;
     /** @type {VerificationAttemptResult} */
     let result;
+    attempt += 1;
     try {
       writeFileSync(candidate.absolute, mutated);
-      result = await options.run(index + 2);
+      result = await options.run(attempt);
     } finally {
       writeFileSync(candidate.absolute, original);
     }
     attempts.push(result);
+    spentMs += Number.isFinite(result.durationMs) ? /** @type {number} */ (result.durationMs) : 0;
     if (!result.passed) killed += 1;
   }
-  const total = selected.length;
+  const total = sample.length;
   // No operators to break is a vacuous pass: there is no mutant the suite could
   // have failed to kill. The caller declared the entry, so an empty target is a
   // measurement of nothing, not a suite that proved nothing.

package/src/engine/resume.mjs

@@ -609,7 +609,7 @@ export async function recoverIntegrationTransactions(contract, runDir, states, l
       const node = contract.nodes.find((candidate) => candidate.id === transaction.node);
       const state = states.get(transaction.node);
       if (!node || !state || SETTLED.has(state.status)) return;
-      const verdict = verificationFailureWithScope(verificationFailureVerdict(state), state.scope);
+      const verdict = verificationFailureWithScope(verificationFailureVerdict(contract, state), state.scope);
       verdict.summary = "integrated candidate verification failed during recovery";
       applyRejection(contract, node, state, runDir, null, lock, states, campaignPath, verdict, {
         code: "verification_failed",

package/src/engine/runtime-discovery.mjs

@@ -9,7 +9,14 @@ export { exhaustedUntilOf, normalizeProviderAvailability } from "../harnesses/in
 /** @typedef {import("../contract/index.mjs").ValidatedContract} ValidatedContract */
 /** @typedef {{harness?: string, model?: string, vendor: string, tier?: number|string, costRank?: number, [key: string]: unknown}} RuntimeLike */
 /** @typedef {{runtimes: Record<string, RuntimeLike>, runtimeDefaults?: {worker?: string, judge?: string}, nodes?: {id: string, runtime?: string, gate: {enabled: boolean, runtime?: string}}[]}} RuntimeContract */
-/** @typedef {{available: boolean, exhaustedUntil: string|null, reason: string}} RuntimeAvailability */
+/**
+ * One runtime's catalogue record: what the harness de facto reported, and
+ * when. An unobservable datum is null -- never zero and never full allowance,
+ * so a runtime that reports nothing cannot look rested -- and an absent key on
+ * a record that predates the field reads as null at every reader. An
+ * observation older than its own window reads as unknown (`isRuntimeAvailable`).
+ * @typedef {{available: boolean, exhaustedUntil: string|null, reason: string, observedAt?: string|null, window?: string|null, remaining?: number|null}} RuntimeAvailability
+ */
 /** @typedef {{harness: string, model: string, vendor: string, tier: number, costRank: number, config?: Record<string, unknown>}} DiscoveryRuntime */
 /** @typedef {{id: string, runtime: RuntimeLike, order: number}} RuntimeCandidate */
 /** @typedef {import("../host/config.mjs").UserConfig} UserConfig */
@@ -89,7 +96,7 @@ export async function discoverRuntimes(runtimes, options = {}) {
  */
 export function availableCandidates(runtimes, availability = {}) {
   return Object.entries(runtimes)
-    .filter(([id]) => isAvailable(availability[id]))
+    .filter(([id]) => isRuntimeAvailable(availability[id]))
     .map(([id, runtime], order) => ({ id, runtime, order }));
 }
 
@@ -172,7 +179,7 @@ export function nextSameTierRuntime(contract, stateRouting, role, current, attem
   const used = new Set(attempted);
   return Object.entries(contract.runtimes)
     .filter(([id, runtime]) => id !== current && !used.has(id) && sameTier(runtime, currentRuntime))
-    .filter(([id]) => isAvailable(stateRouting.availability?.[id]))
+    .filter(([id]) => isRuntimeAvailable(stateRouting.availability?.[id]))
     .filter(([, runtime]) => role !== "judge" || runtime.vendor !== workerVendor)
     .sort((left, right) => runtimeOrder(left[1]) - runtimeOrder(right[1]))
     .map(([id]) => id)
@@ -226,10 +233,40 @@ function tierOrder(runtime) {
   return typeof runtime.tier === "number" ? runtime.tier : runtime.costRank ?? Number.MAX_SAFE_INTEGER;
 }
 
-/** @param {RuntimeAvailability|undefined} availability @returns {boolean} */
-function isAvailable(availability) {
+/**
+ * Span in seconds of every rate-limit window label a harness reports. The
+ * labels are claude's `rateLimitType` values (measured 2026-09-17, the
+ * `rate_limit_event` line recorded in `src/harnesses/protocol.mjs`); a label
+ * missing here cannot prove staleness, so its observation never self-expires.
+ *
+ * @type {Readonly<Record<string, number>>}
+ */
+const AVAILABILITY_WINDOW_SEC = Object.freeze({ five_hour: 5 * 3600, seven_day: 7 * 86400 });
+
+/**
+ * May a runtime be admitted on this catalogue record? Exhaustion is waited
+ * out on `exhaustedUntil`; an observation older than its own window reads as
+ * unknown and admits nothing, because unknown must not look rested. This is
+ * the one home of the rule: plan routing and engine composition both read it,
+ * so the null and staleness semantics cannot drift between readers. The
+ * parameter is typed on the fields the rule reads, not on the full record --
+ * the plan's table copy names no `reason`.
+ *
+ * @param {{available: boolean, exhaustedUntil: string|null, observedAt?: string|null, window?: string|null, [key: string]: unknown}|undefined} availability
+ * @param {number} [now] epoch milliseconds; defaults to the current clock
+ * @returns {boolean}
+ */
+export function isRuntimeAvailable(availability, now = Date.now()) {
   if (!availability) return false;
-  if (availability.available === true) return !availability.exhaustedUntil || Date.parse(availability.exhaustedUntil) <= Date.now();
-  return Boolean(availability.exhaustedUntil && Date.parse(availability.exhaustedUntil) <= Date.now());
+  const rested = availability.available === true
+    ? !availability.exhaustedUntil || Date.parse(availability.exhaustedUntil) <= now
+    : Boolean(availability.exhaustedUntil && Date.parse(availability.exhaustedUntil) <= now);
+  if (!rested) return false;
+  const windowSec = availability.window === undefined || availability.window === null
+    ? undefined
+    : AVAILABILITY_WINDOW_SEC[availability.window];
+  if (windowSec === undefined || availability.observedAt === undefined || availability.observedAt === null) return true;
+  const observedAt = Date.parse(availability.observedAt);
+  return !Number.isNaN(observedAt) && observedAt + windowSec * 1000 >= now;
 }
 

package/src/engine/scheduler.mjs

@@ -463,23 +463,23 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
   // batched call it used to be, but the chain still runs them one at a time.
   // A settlement may itself dispatch the node's next phase (a judge, a
   // revision) through the same `startJudge`/`startWorker` calls dispatch below
-  // uses; those land in `slot`, not the real `running`, so they are copied
-  // back into `running` in a `finally` -- unconditionally, win or lose, so a
-  // job a settlement started before failing (a lost lock, a programmer error)
-  // is still visible to the cleanup sweeps below rather than leaked. The
-  // node's own steps stay ordered by never starting a second settlement for a
-  // node whose first has not yet cleared `pendingSettlements`.
+  // uses, so it is handed the real `running` to dispatch into: a job it starts
+  // is counted against `maxParallel` from the instant the process exists, and
+  // `applyRejection` reads that same map to decide whether the run has a slot
+  // for the revision at all. It used to dispatch into the throwaway one-entry
+  // map instead, copied back only once the settlement returned, which is how
+  // run state-location-and-routing-economics-13 came to hold two workers under
+  // `maxParallel: 1` on 2026-09-21. What it may *settle* is still only its own
+  // node: the one-entry map below is the job, not the run. The node's own
+  // steps stay ordered by never starting a second settlement for a node whose
+  // first has not yet cleared `pendingSettlements`.
   const settleClosedJobsInBackground = () => {
     for (const [nodeId, job] of [...running]) {
       if (pendingSettlements.has(nodeId) || !job.closed || invocationAlive(job.invocation)) continue;
       running.delete(nodeId);
-      const slot = new Map([[nodeId, job]]);
       const settlement = settlementQueue
-        .then(() => finalizeClosedJobs(contract, runDir, states, slot, lock, campaign.path))
-        .finally(() => {
-          for (const [settledId, settledJob] of slot) running.set(settledId, settledJob);
-          pendingSettlements.delete(nodeId);
-        });
+        .then(() => finalizeClosedJobs(contract, runDir, states, new Map([[nodeId, job]]), lock, campaign.path, running))
+        .finally(() => pendingSettlements.delete(nodeId));
       // The queue itself must never reject -- a rejected settlement (a lost
       // lock, a programmer error) would otherwise wedge every node queued
       // behind it. The rejection still reaches whoever awaits the real
@@ -635,20 +635,16 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
           // does, on the same per-run candidate ref and worktree
           // `settlementQueue` exists to serialize -- so it is dispatched the
           // same way: chained onto the queue rather than awaited here, using
-          // its own one-entry `slot` merged back into `running` in a
-          // `finally`. The node's own order is untouched (still one entry at
-          // a time, gated by `pendingSettlements`); only the tick stops
-          // waiting behind it.
+          // `running` itself as its dispatch map, so the judge it starts is
+          // counted the instant it exists. The node's own order is untouched
+          // (still one entry at a time, gated by `pendingSettlements`); only
+          // the tick stops waiting behind it.
           if (state.phase === "judge" && state.result) {
             const workerResult = state.result;
-            const slot = new Map();
             const settlement = settlementQueue
-              .then(() => startJudge(contract, node, state, runDir, slot, workerResult, lock, states, campaign.path))
-              .then((round) => applyJudgeRound(round, contract, node, state, runDir, slot, lock, states, campaign.path, workerResult))
-              .finally(() => {
-                for (const [settledId, settledJob] of slot) running.set(settledId, settledJob);
-                pendingSettlements.delete(node.id);
-              });
+              .then(() => startJudge(contract, node, state, runDir, running, workerResult, lock, states, campaign.path))
+              .then((round) => applyJudgeRound(round, contract, node, state, runDir, running, lock, states, campaign.path, workerResult))
+              .finally(() => pendingSettlements.delete(node.id));
             settlementQueue = settlement.catch(() => {});
             settlement.catch((error) => {
               if (!(error instanceof LockLostError) && backgroundSettlementFailure === null) backgroundSettlementFailure = error;

package/src/engine/scope.mjs

@@ -3,15 +3,19 @@
  * touched, and what to do when those differ.
  *
  * Scope is advisory by design -- an unexpected write is recorded as a finding
- * and shown to the judge, not treated as a crime -- with one exception:
+ * and shown to the judge, not treated as a crime -- with two exceptions:
  * `resolveUnknownEffect` decides whether an invocation whose effect is unproven
- * may be replayed at all, and a dirty scope there is a refusal.
+ * may be replayed at all, and a dirty scope there is a refusal; and a write
+ * that lands on a file the node's own proof names is never deferred, because a
+ * verification that passes over an edited prover has proven nothing.
  */
+import { relative, resolve } from "node:path";
+
 import { SETTLED } from "./prompts.mjs";
 import { appendTransitionEvent, recordExecutionOverride, transition, writeNode } from "./state.mjs";
 import { attemptWorkspace } from "../repo/worktree.mjs";
 
-import { errorCode, errorMessage, excerpt } from "../util.mjs";
+import { errorCode, errorMessage, excerpt, isContained } from "../util.mjs";
 import { executeControllerVerification } from "./verify.mjs";
 import { providerReceiptsFromInvocationTail, settleInvocation } from "../run/operations.mjs";
 import { readJson } from "../run/store.mjs";
@@ -98,6 +102,94 @@ export function workerScope(taskPacket) {
     roots: taskPacket.writeRoots ?? [],
   };
 }
+/**
+ * @typedef {{tokens: string[], cwd: string, literal: boolean, citation: string}} ProofCitation
+ */
+
+/**
+ * Everything a node's own proofs name: a Definition of Done `path` proof's
+ * path, the words of a `command` proof (a command proof carries a display
+ * string, not an argv, so a quoted path holding a space is not recovered), the
+ * argv of the verification entry a `verification` proof references, and the
+ * argv of every verification command the packet declares.
+ *
+ * @param {ValidatedNode} node
+ * @returns {ProofCitation[]}
+ */
+function proofCitations(node) {
+  const commands = node.taskPacket.verification ?? [];
+  /** @type {ProofCitation[]} */
+  const citations = [];
+  // Definition of Done items come first so that a path both a checklist item
+  // and a verification command name is reported under the checklist item, the
+  // name a human reading the failure can act on.
+  for (const item of node.definitionOfDone ?? []) {
+    const proof = item.proof;
+    if (!proof) continue;
+    if (proof.kind === "path") {
+      citations.push({ tokens: [proof.ref], cwd: ".", literal: true, citation: `${item.id} path proof` });
+    } else if (proof.kind === "command") {
+      citations.push({ tokens: proof.ref.split(/\s+/u), cwd: ".", literal: false, citation: `${item.id} command proof` });
+    } else {
+      const command = commands[Number.parseInt(proof.ref, 10)];
+      if (command) citations.push({ tokens: command.argv, cwd: command.cwd ?? ".", literal: false, citation: `${item.id} verification[${proof.ref}] proof` });
+    }
+  }
+  for (const [index, command] of commands.entries()) {
+    citations.push({ tokens: command.argv, cwd: command.cwd ?? ".", literal: false, citation: `verification[${index}]` });
+  }
+  return citations;
+}
+const PATH_SEPARATOR = /[\\/]/u;
+
+/**
+ * The unexpected writes that landed on a file the node's own proof names.
+ * Matching a command's argv against files is inherently approximate, so this is
+ * lexical and deliberately narrow. A word is read as a path only when it is not
+ * an option, is shaped like one (a `path` proof's ref, or a word carrying a
+ * separator or an extension), and resolves inside the workspace; it then claims
+ * an unexpected path it equals, or -- when it carries a separator or is a `path`
+ * proof's ref, so a directory really was named -- one it is the directory
+ * prefix of.
+ *
+ * What it deliberately does not catch: a file a proof reaches through a script
+ * (`npm test`), a shell string, or a glob the tool expands itself. The bare
+ * words of a command are never paths, which is what keeps the ordinary case
+ * advisory -- measured against the real node `requirement-ids-reach-the-node`
+ * (run `state-location-and-routing-economics-10-requirement-ids-and-closure`),
+ * whose legitimate out-of-scope write to `src/plan/freeze.mjs` is claimed by
+ * none of its proofs: not by `npm run typecheck`, not by the two test files its
+ * `command` proofs name, and not by the loose words of a quoted
+ * `--test-name-pattern`.
+ *
+ * @param {ValidatedNode} node
+ * @param {string[]} unexpectedPaths
+ * @param {string} workspace
+ * @returns {{path: string, citation: string}[]}
+ */
+function proofCitedWrites(node, unexpectedPaths, workspace) {
+  /** @type {Map<string, string>} */
+  const cited = new Map();
+  for (const citation of proofCitations(node)) {
+    const base = resolve(workspace, citation.cwd);
+    for (const token of citation.tokens) {
+      if (!token || token.startsWith("-")) continue;
+      const directory = citation.literal || PATH_SEPARATOR.test(token);
+      if (!directory && !/\.[A-Za-z0-9]+$/u.test(token)) continue;
+      const target = resolve(base, token);
+      if (!isContained(workspace, target)) continue;
+      const named = relative(workspace, target).replaceAll("\\", "/");
+      // The workspace root itself names no file in particular: a proof run from
+      // the root must not make every unexpected write a proof-citing one.
+      if (!named) continue;
+      for (const path of unexpectedPaths) {
+        if (cited.has(path)) continue;
+        if (path === named || (directory && path.startsWith(`${named}/`))) cited.set(path, citation.citation);
+      }
+    }
+  }
+  return [...cited].map(([path, citation]) => ({ path, citation }));
+}
 /**
  * @param {ValidatedContract} contract
  * @param {string} runDir
@@ -122,9 +214,19 @@ export function checkWorkerScope(contract, runDir, job, lock, options = {}) {
     // A completed attempt whose controller verification passes never fails
     // on scope alone (TECH-SPEC lean, rule 1): the caller defers the verdict
     // until verification has run and records an advisory finding instead.
-    if (options.deferViolation) return true;
-    const shown = bounded.unexpectedPaths.slice(0, 8).join(", ");
-    const message = `unexpected paths changed (${scope.unexpectedPaths.length}): ${shown}`;
+    // The single exception is a write onto a file the node's own proof names:
+    // verification then passes because the attempt edited the thing doing the
+    // proving, and an advisory nobody must read before the gate is too weak a
+    // signal for that. Scanned over the bounded path list -- the same first 64
+    // paths every other surface reports.
+    const cited = proofCitedWrites(job.node, bounded.unexpectedPaths, job.cwd);
+    if (options.deferViolation && !cited.length) return true;
+    const message = cited.length
+      // Kept short on purpose: an error message is capped at 120 characters,
+      // and the proof that names the path is the part a reader cannot recover
+      // from `state.scope` afterwards.
+      ? `proof-cited unexpected write (${cited.length}): ${cited.slice(0, 8).map(({ path, citation }) => `${path} (${citation})`).join(", ")}`
+      : `unexpected paths changed (${scope.unexpectedPaths.length}): ${bounded.unexpectedPaths.slice(0, 8).join(", ")}`;
     if (!SETTLED.has(state.status)) {
       transition(runDir, state, "failed", { phase: "worker", error: { code: "unexpected_write", message: excerpt(message) } }, lock);
       appendTransitionEvent(runDir, state, "failed", "failed", {

package/src/engine/settle.mjs

@@ -69,18 +69,29 @@ export function applyRejection(contract, node, state, runDir, running, lock, sta
     // dispatch below and a later scheduler dispatch (the `running` is null
     // path) carry it.
     state.previousAttempt = renderPreviousAttemptSection(state) ?? state.previousAttempt;
-    if (running) {
+    // A revision is a new attempt, and a new attempt is a dispatch: it starts
+    // here only against a slot the run actually has free. `running` is the
+    // scheduler's own map, with this node's own closed job already out of it,
+    // so `running.size` is exactly what the dispatch loop's own
+    // `maxParallel - running.size` will read. A settlement that dispatched
+    // regardless is how run state-location-and-routing-economics-13 ran two
+    // workers under `maxParallel: 1` on 2026-09-21, and two of that day's
+    // three OOM kills happened with more running than the contract declared.
+    if (running && running.size < contract.maxParallel) {
       // Dispatching here owns the increment, because `startWorker` expects the
       // attempt number it is about to run under.
       state.attempt += 1;
       startWorker(contract, node, state, runDir, running, retryPrompt(node, verdict), lock, states, campaignPath, { forceFresh });
       return;
     }
-    // Handing the node back to the scheduler instead: its dispatch increments
-    // on the way out, so incrementing here too spent two attempt numbers on one
-    // retry. Observed 2026-09-13 on a resume after a killed controller — a node
-    // that ran twice reported attempt 3, with no `…2.*` logs and a
-    // `worktree.previousAttempt` naming an attempt that never existed.
+    // Handing the node back to the scheduler instead -- because there is no
+    // loop to hand it to (recovery, resume), or because the run is full and
+    // the scheduler is the one place that knows when it stops being full. Its
+    // dispatch increments on the way out, so incrementing here too spent two
+    // attempt numbers on one retry. Observed 2026-09-13 on a resume after a
+    // killed controller — a node that ran twice reported attempt 3, with no
+    // `…2.*` logs and a `worktree.previousAttempt` naming an attempt that
+    // never existed.
     transition(runDir, state, "pending", { phase: "worker", error: null }, lock);
     return;
   }
@@ -91,7 +102,7 @@ export function applyRejection(contract, node, state, runDir, running, lock, sta
   }, lock);
 }
 /** Deterministic verification failure settles through the shared rejection path. The verdict carries this attempt's unexpected paths, so a red attempt reports them whether it stops here or starts its revision (TECH-SPEC lean, rule 1). @param {ValidatedContract} contract @param {ValidatedNode} node @param {NodeSnapshot} state @param {string} runDir @param {Map<string, Job>|null} running @param {LockHandle} lock @param {Map<string, NodeSnapshot>} states @param {string} campaignPath @param {JudgeVerdict} [verdict] */
-export function applyVerificationFailure(contract, node, state, runDir, running, lock, states, campaignPath, verdict = verificationFailureWithScope(verificationFailureVerdict(state), state.scope)) {
+export function applyVerificationFailure(contract, node, state, runDir, running, lock, states, campaignPath, verdict = verificationFailureWithScope(verificationFailureVerdict(contract, state), state.scope)) {
   applyRejection(contract, node, state, runDir, running, lock, states, campaignPath, verdict, { code: "verification_failed", label: "verification" });
 }
 
@@ -193,7 +204,7 @@ export async function settleDone(contract, node, state, runDir, lock, states, ca
       removeWorktree(contract.cwd, acceptedPath);
     },
     onVerificationFailure: async (transaction) => {
-      const verdict = verificationFailureWithScope(verificationFailureVerdict(state), state.scope);
+      const verdict = verificationFailureWithScope(verificationFailureVerdict(contract, state), state.scope);
       verdict.summary = "integrated candidate verification failed";
       const divergent = candidateOnlyFailures(state.verification, transaction.candidateEvidence);
       verdict.findings = [...(verdict.findings ?? []), {

package/src/host/preflight.mjs

@@ -27,6 +27,7 @@ import { errorMessage } from "../util.mjs";
 import { boundedGitSync } from "../repo/worktree.mjs";
 import { routeRuntime } from "../contract/runtime.mjs";
 import { NOTIFY_BIN_ENV, noTransportWarning } from "../notify/index.mjs";
+import { NOTIFY_SESSION_ENV, sessionWakeNotice } from "../notify/session.mjs";
 import { findExecutable } from "./platform.mjs";
 import { colorLevel, statusToken } from "../cli/brand.mjs";
 import { RUNS_DIR_NAME } from "../run/paths.mjs";
@@ -209,9 +210,9 @@ export function environmentPreflight(options) {
  */
 export function notifyTransportCheck(env = process.env) {
   const warning = noTransportWarning(env);
-  return warning
-    ? fail("notify transport", warning, true)
-    : pass("notify transport", `${NOTIFY_BIN_ENV}=${env[NOTIFY_BIN_ENV]}`);
+  if (warning) return fail("notify transport", warning, true);
+  const external = env[NOTIFY_BIN_ENV] ? `${NOTIFY_BIN_ENV}=${env[NOTIFY_BIN_ENV]}` : `${NOTIFY_BIN_ENV} unset`;
+  return pass("notify transport", `${external} · ${sessionWakeNotice(env)}`);
 }
 
 /** @param {EnvReport} report @returns {EnvCheck[]} the checks that block a dispatch */
@@ -265,6 +266,7 @@ export function declaredVerificationCommands(contract) {
  */
 const SIDE_EFFECT_ENV_KEYS = [
   NOTIFY_BIN_ENV, // a measurement must not notify a human
+  NOTIFY_SESSION_ENV, // nor wake the harness session it was measured from
   "FABERUN_CODEX_BIN", // could redirect the timed command at a live, paid codex binary instead of this repository's own fixtures
   "FABERUN_CLAUDE_BIN", // same, for the claude harness
   "FABERUN_AGY_BIN", // same, for the agy harness