faberun 0.16.0 → 0.17.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {
@@ -26,7 +26,7 @@
   "scripts": {
     "check": "node -e \"const{readdirSync}=require('node:fs');const{spawnSync}=require('node:child_process');const roots=['bin','.claude/hooks','src','evals','test'];const files=roots.flatMap(r=>readdirSync(r,{recursive:true}).map(String).filter(p=>p.endsWith('.mjs')).map(p=>r+'/'+p));for(const f of files)if(spawnSync(process.execPath,['--check',f],{stdio:'inherit'}).status!==0)process.exit(1);console.log(files.length+' files checked')\"",
     "typecheck": "tsc",
-    "test": "node --test test/*.test.mjs test/*/*.test.mjs",
+    "test": "node --test --import ./test/scoped-home.mjs --import ./test/setup.mjs test/*.test.mjs test/*/*.test.mjs",
     "docs": "node src/cli/manual.mjs --write",
     "docs:check": "node src/cli/manual.mjs --check",
     "prepare": "husky"

package/src/campaign/journal.mjs

@@ -8,7 +8,7 @@
  * the journal's own `eventId` so two sessions cannot consume each other's place.
  */
 import { JOURNAL_FILE, JOURNAL_TEXT_BYTES, JOURNAL_WATCH_CURSOR_DIR, JOURNAL_WATCH_CURSOR_SCHEMA_VERSION } from "./layout.mjs";
-import { boundedText, collapseLines } from "../util.mjs";
+import { collapseLines } from "../util.mjs";
 import { campaignIdOf } from "./record.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
@@ -382,6 +382,11 @@ function normalizeEntry(entry) {
   return /** @type {JournalEntry} */ (normalized);
 }
 /**
+ * Collapse to one line and enforce the byte cap by refusing, not truncating:
+ * the journal is the record of what was written, so a note that does not fit
+ * is the author's to cut -- a silently shortened entry lies about its own
+ * write. Readers of already-stored text never pass through here.
+ *
  * @param {unknown} value
  * @param {string} label
  * @param {number} maxBytes
@@ -391,5 +396,9 @@ export function normalizeText(value, label, maxBytes = JOURNAL_TEXT_BYTES) {
   requireText(value, label);
   const collapsed = collapseLines(value);
   if (!collapsed) throw new TypeError(`${label} must not be blank`);
-  return boundedText(collapsed, maxBytes);
+  const bytes = Buffer.byteLength(collapsed, "utf8");
+  if (bytes > maxBytes) {
+    throw new TypeError(`${label} is ${bytes} bytes, over the ${maxBytes}-byte cap; cut ${bytes - maxBytes} bytes and retry`);
+  }
+  return collapsed;
 }

package/src/campaign/record.mjs

@@ -49,9 +49,14 @@ export function campaignIdOf(campaignPath) {
   }
 }
 /**
+ * The campaign record's schema, in one home. Exported so the repair verb in
+ * `run/migrate.mjs` can prove a record's only defect is the absent `status`
+ * field by validating the record with that default applied, instead of the
+ * schema being restated beside the repair.
+ *
  * @param {unknown} campaign
  */
-function validateCampaign(campaign) {
+export function validateCampaign(campaign) {
   if (!campaign || typeof campaign !== "object" || Array.isArray(campaign)) {
     throw new TypeError("campaign.json must be an object");
   }

package/src/engine/gate.mjs

@@ -30,6 +30,7 @@
 import { existsSync, readFileSync, statSync, openSync, closeSync, readSync, writeSync } from "node:fs";
 import { dirname } from "node:path";
 import { spawn } from "node:child_process";
+import { NOTIFY_ENV_NAMES } from "../notify/index.mjs";
 
 /** @typedef {{executable: string, args: string[], cwd: string, promptTransport: "stdin"|"argv", harness: string, env: Record<string, string|null>|null, stdoutPath: string, stderrPath: string}} GateConfig */
 
@@ -155,9 +156,13 @@ function childEnv() {
     if (value === null) delete merged[key];
     else merged[key] = value;
   }
-  // Worker providers are not a notification surface: strip the controller-only
-  // transport after the harness overlay so no harness can reintroduce it.
-  delete merged.FABERUN_NOTIFY_BIN;
+  // Worker providers are not a notification surface: strip every controller-only
+  // transport after the harness overlay so no harness can reintroduce one. The
+  // list lives in `notify/index.mjs`, not here: this line once named
+  // FABERUN_NOTIFY_BIN alone, and on 2026-09-21 a worker that inherited
+  // FABERUN_NOTIFY_SESSION ran this repository's suite, whose fixture
+  // controllers woke the operator's live session seven times in minutes.
+  for (const name of NOTIFY_ENV_NAMES) delete merged[name];
   return merged;
 }
 

package/src/engine/judge-gate.mjs

@@ -135,6 +135,74 @@ function proveVerification(id, proof, recorded) {
   return { id, kind: "verification", ref: proof.ref, pass: entry.passed === true, detail };
 }
 
+/**
+ * A command proof that declares a node:test filter (`--test-name-pattern`,
+ * `--test-skip-pattern`) is judged on more than its exit code, because the
+ * runner exits 0 whether its filter selected anything or not. The proof runs
+ * with the TAP reporter selected through `NODE_OPTIONS` and is refused when the
+ * output carries TAP's zero-plan line. Measured 2026-09-21 on node v26.8.1: a
+ * filter that matches emits `1..0` zero times, a filter that matches nothing
+ * emits it exactly once, a run with no filter emits it zero times, and an empty
+ * suite under a matching filter emits no nested zero plan. The default reporter
+ * cannot make the distinction -- both cases print identical counters, because
+ * the tick is the file rather than a test. The reporter goes through the
+ * environment because appending `--test-reporter=tap` to the command string is
+ * a no-op whenever a test file precedes it: node reads its own options
+ * left to right, so the flag lands among the script's arguments and the runner
+ * never sees it.
+ */
+const TEST_FILTER_FLAGS = ["--test-name-pattern", "--test-skip-pattern"];
+const TAP_ZERO_PLAN = /^1\.\.0$/mu;
+
+/**
+ * The environment a filtered proof runs under: the ambient environment with
+ * the TAP reporter selected through `NODE_OPTIONS`, minus `NODE_TEST_CONTEXT`.
+ * That marker belongs to whichever test runner spawned this process; a nested
+ * `node --test` that inherits it stays a runner child and emits no TAP at all
+ * (measured 2026-09-21: with the marker the zero-plan line never appears,
+ * without it exactly once) -- and a proof is judged as its own top-level run,
+ * not as the suite's child.
+ *
+ * @returns {NodeJS.ProcessEnv}
+ */
+function envForFilteredProof() {
+  const { NODE_TEST_CONTEXT: _outer, NODE_OPTIONS: existing, ...ambient } = process.env;
+  return { ...ambient, NODE_OPTIONS: existing ? `${existing} --test-reporter=tap` : "--test-reporter=tap" };
+}
+
+/**
+ * The node:test filters a command string declares, in argv order, as flag and
+ * value. Presence alone changes behaviour (the appended reporter and the
+ * zero-plan look-up); the value is read for the refusal detail alone, which is
+ * why a whitespace split is close enough even though the command runs through
+ * a shell.
+ *
+ * @param {string} ref
+ * @returns {Array<{flag: string, value: string}>}
+ */
+function declaredTestFilters(ref) {
+  const tokens = ref.split(/\s+/u).filter(Boolean);
+  /** @type {Array<{flag: string, value: string}>} */
+  const filters = [];
+  for (const [index, token] of tokens.entries()) {
+    for (const flag of TEST_FILTER_FLAGS) {
+      if (token.startsWith(`${flag}=`)) filters.push({ flag, value: unquote(token.slice(flag.length + 1)) });
+      else if (token === flag) filters.push({ flag, value: unquote(tokens[index + 1] ?? "") });
+    }
+  }
+  return filters;
+}
+
+/** @param {string} value @returns {string} */
+function unquote(value) {
+  return value.replace(/^['"]|['"]$/gu, "");
+}
+
+/** @param {Array<{flag: string, value: string}>} filters @returns {string} */
+function filterNames(filters) {
+  return filters.map(({ flag, value }) => `${flag} "${value}"`).join(", ");
+}
+
 /**
  * @param {string} id
  * @param {DefinitionOfDoneProof} proof
@@ -144,11 +212,18 @@ function proveVerification(id, proof, recorded) {
  */
 async function proveCommand(id, proof, cwd, timeoutMs) {
   const ref = proof.ref;
+  const filters = declaredTestFilters(ref);
   return new Promise((settle) => {
     // Detached on POSIX so the shell leads its own process group: `shell: true`
     // means the timeout must kill the group, not the shell, or the command the
     // shell started keeps running and keeps the result pending forever.
-    const child = spawn(ref, { cwd, shell: true, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn(ref, {
+      cwd,
+      shell: true,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", "pipe", "pipe"],
+      ...(filters.length ? { env: envForFilteredProof() } : {}),
+    });
     let stdout = "";
     let stderr = "";
     let settled = false;
@@ -178,6 +253,18 @@ async function proveCommand(id, proof, cwd, timeoutMs) {
       finish({ id, kind: "command", ref, pass: false, detail: boundedText(error.message) });
     });
     child.on("close", (code, signal) => {
+      // Its own detail, not an ordinary command failure: the command succeeded,
+      // so what failed is that the declared filter selected nothing to prove.
+      if (code === 0 && signal === null && filters.length > 0 && TAP_ZERO_PLAN.test(stdout)) {
+        finish({
+          id,
+          kind: "command",
+          ref,
+          pass: false,
+          detail: boundedText(`${filterNames(filters)} selected no test: exit 0 over a TAP plan of 1..0, so the proof measured nothing`),
+        });
+        return;
+      }
       const detail = signal !== null ? `killed by ${signal}` : `exit ${code ?? "?"}`;
       const pass = code === 0 && signal === null;
       finish({ id, kind: "command", ref, pass, detail: pass ? detail : boundedText(`${detail}: ${(stderr || stdout).trim()}`) });

package/src/harnesses/index.mjs

@@ -6,6 +6,7 @@ import { dshHarness } from "./dsh/index.mjs";
 import { zcodeHarness } from "./zcode/index.mjs";
 import { execJsonlHarness } from "./exec-jsonl/index.mjs";
 import { replayHarness } from "./replay/index.mjs";
+import { withoutNotifyEnv } from "../notify/index.mjs";
 
 /** Current wire-contract version for runner protocol artifacts. */
 export const PROTOCOL_SCHEMA_VERSION = 3;
@@ -451,7 +452,10 @@ export function probeRuntime(runtime, options = {}) {
     try {
       child = spawn(executable, args, {
         cwd: options.cwd,
-        env: process.env,
+        // A worker or judge never delivers a notification; the controller does.
+        // In this repository a worker runs the test suite, whose fixture
+        // controllers would otherwise inherit a live transport and deliver.
+        env: withoutNotifyEnv(process.env),
         stdio: ["ignore", "pipe", "pipe"],
       });
     } catch (error) {

package/src/notify/index.mjs

@@ -50,7 +50,7 @@ import { createHash } from "node:crypto";
 import { appendFileSync, closeSync, mkdirSync, openSync, readFileSync, writeSync } from "node:fs";
 import { join } from "node:path";
 import { createMacosNotifier } from "./os-macos.mjs";
-import { deliverToSessions, resolveSessionTargets, sessionWakeNotice } from "./session.mjs";
+import { NOTIFY_SESSION_ENV, deliverToSessions, resolveSessionTargets, sessionWakeNotice } from "./session.mjs";
 import { errorMessage } from "../util.mjs";
 
 /**
@@ -74,6 +74,29 @@ function loadProgressModule() {
 
 export const NOTIFY_BIN_ENV = "FABERUN_NOTIFY_BIN";
 const MACOS_TRANSPORT = "os-macos";
+
+/**
+ * Every variable that binds a notification transport. The controller is the
+ * only process that delivers: a worker, a judge or a verification command
+ * that inherits these would notify on the controller's behalf -- and in this
+ * repository, whose workers run its own test suite, every fixture controller
+ * the suite spawns would deliver its terminal events for real. Measured
+ * 2026-09-21: a run launched with `FABERUN_NOTIFY_SESSION=auto` woke the
+ * operator's session seven times in minutes from `test/repo/base-ref.test.mjs`
+ * fixtures its worker ran. `withoutNotifyEnv` is the boundary every child
+ * crosses; `test/setup.mjs` neutralises the same names inside the suite.
+ */
+export const NOTIFY_ENV_NAMES = Object.freeze([NOTIFY_BIN_ENV, NOTIFY_SESSION_ENV]);
+
+/**
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {NodeJS.ProcessEnv} a copy with every notify transport unbound
+ */
+export function withoutNotifyEnv(env) {
+  const copy = { ...env };
+  for (const name of NOTIFY_ENV_NAMES) delete copy[name];
+  return copy;
+}
 export const NOTIFY_LOG_FILE = "notify.jsonl";
 /**
  * The bounded retry budget the dispatcher used to spend before giving up.

package/src/repo/signal.mjs

@@ -14,8 +14,12 @@
  * about the work that most needs it. The block now renders the phase-2
  * `runOutcome` per linked run: `parked` with its nodes, their error codes and
  * the exact `resume` command; `succeeded` as one line; plus the most recent
- * campaign-level `attention` entry from `.runs/inbox.jsonl`. It is bounded,
- * because every session pays for it in its first tokens.
+ * `attention` entry from `.runs/inbox.jsonl`. An attention belongs to one
+ * campaign or none: an explicit `campaignId` decides, a null one is resolved
+ * from the entry's `runId` (a run belongs to at most one campaign), and an
+ * entry whose run no active campaign owns is shown once at run level instead
+ * of under every campaign at once. It is bounded, because every session pays
+ * for it in its first tokens.
  */
 
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -47,21 +51,45 @@ export function renderAgentSignalBlock(runsDir) {
   const lines = [];
   /** @type {Set<string>} */
   const linked = new Set();
-  const { campaigns } = discoverCampaigns(runsDir);
-  for (const { campaign } of campaigns.filter(({ campaign }) => campaign.status !== "closed")) {
+  const active = discoverCampaigns(runsDir).campaigns.filter(({ campaign }) => campaign.status !== "closed");
+  const ownerByRun = runOwnerIndex(active);
+  for (const { campaign } of active) {
     lines.push(`- faberun campaign \`${campaign.id}\`: active — read \`.runs/campaigns/${campaign.id}/${HANDOFF_FILE}\``);
     for (const runId of campaign.linkedRunIds) {
       linked.add(runId);
       lines.push(...runSignalLines(runsDir, runId));
     }
-    const attention = campaignAttentionLine(runsDir, campaign);
+    const attention = campaignAttentionLine(runsDir, campaign, ownerByRun);
     if (attention) lines.push(attention);
   }
   for (const line of activeRunLines(runsDir, linked)) lines.push(line);
+  const orphan = orphanAttentionLine(runsDir, ownerByRun);
+  if (orphan) lines.push(orphan);
   if (!lines.length) return "";
   return `${SIGNAL_START}\n${HEADER}\n\n${boundLines(lines).join("\n")}\n${SIGNAL_END}`;
 }
 
+/**
+ * Which active campaign owns each run, read from the campaigns' own
+ * `linkedRunIds`. A run belongs to at most one campaign, so the first
+ * campaign naming a run wins; a run no active campaign names is absent from
+ * the map, and that absence — never a guess — is what makes an inbox entry
+ * unattributable.
+ *
+ * @param {{campaign: import("../campaign/index.mjs").Campaign}[]} active
+ * @returns {Map<string, string>}
+ */
+function runOwnerIndex(active) {
+  /** @type {Map<string, string>} */
+  const ownerByRun = new Map();
+  for (const { campaign } of active) {
+    for (const runId of campaign.linkedRunIds) {
+      if (!ownerByRun.has(runId)) ownerByRun.set(runId, campaign.id);
+    }
+  }
+  return ownerByRun;
+}
+
 /**
  * One linked run's outcome as block lines. `runProgress` folds the phase-2
  * `runOutcome`, so a parked run is rendered by its own declared nodes rather
@@ -132,16 +160,17 @@ function activeRunLines(runsDir, linked) {
 }
 
 /**
- * The most recent campaign-level attention: an inbox entry when one exists,
- * otherwise the durable record on the campaign itself.
+ * The most recent attention this campaign owns: an inbox entry when one
+ * exists, otherwise the durable record on the campaign itself.
  *
  * @param {string} runsDir
  * @param {import("../campaign/index.mjs").Campaign} campaign
+ * @param {Map<string, string>} ownerByRun
  * @returns {string|null}
  */
-function campaignAttentionLine(runsDir, campaign) {
+function campaignAttentionLine(runsDir, campaign, ownerByRun) {
   const latest = readInbox(runsDir)
-    .filter((entry) => entry.type === "attention" && (entry.campaignId === campaign.id || entry.campaignId === null))
+    .filter((entry) => entry.type === "attention" && attentionBelongsTo(entry, campaign.id, ownerByRun))
     .at(-1);
   if (latest) return `  - attention: ${boundedAttention(latest.summary)}`;
   if (campaign.attention && typeof campaign.attention.message === "string") {
@@ -151,6 +180,44 @@ function campaignAttentionLine(runsDir, campaign) {
   return null;
 }
 
+/**
+ * An attention belongs to one campaign or none. An explicit `campaignId` is
+ * authoritative; a null one is resolved from the entry's `runId` through the
+ * run-owner index. Measured 2026-09-21: all 12 attention entries in the live
+ * inbox carry null, so the old `campaignId === null` fallback attributed an
+ * orphan to every campaign at once, permanently. An entry whose run resolves
+ * to no active campaign belongs to none and is surfaced once at run level by
+ * `orphanAttentionLine`, not dropped.
+ *
+ * @param {import("../notify/index.mjs").InboxEntry} entry
+ * @param {string} campaignId
+ * @param {Map<string, string>} ownerByRun
+ * @returns {boolean}
+ */
+function attentionBelongsTo(entry, campaignId, ownerByRun) {
+  if (entry.campaignId !== null) return entry.campaignId === campaignId;
+  return entry.runId !== null && ownerByRun.get(entry.runId) === campaignId;
+}
+
+/**
+ * The most recent attention no campaign owns, as one run-level line. Dropping
+ * it would trade the old wrong report (every campaign) for a missing one, and
+ * the run-level section of the block is where campaign-less work already
+ * lives.
+ *
+ * @param {string} runsDir
+ * @param {Map<string, string>} ownerByRun
+ * @returns {string|null}
+ */
+function orphanAttentionLine(runsDir, ownerByRun) {
+  const latest = readInbox(runsDir)
+    .filter((entry) => entry.type === "attention" && entry.campaignId === null && (entry.runId === null || !ownerByRun.has(entry.runId)))
+    .at(-1);
+  if (!latest) return null;
+  const subject = latest.runId ? `run \`${latest.runId}\`` : "an entry with no run";
+  return `- attention: ${subject} resolves to no campaign — ${boundedAttention(latest.summary)}`;
+}
+
 /**
  * @param {import("../engine/supervise.mjs").OutcomeNode} node
  * @returns {string}

package/src/run/migrate.mjs

@@ -24,6 +24,16 @@
  * redone, by the next run: it verifies the published copy still holds every
  * byte the original holds and removes the original.
  *
+ * A published copy that predates a path the original later gained can never
+ * pass that verification, and the branch that sees one runs no copy for the
+ * path to reach: measured 2026-09-21, `.runs/control/second-opinions` was
+ * written into this repository's original tree after the home side had
+ * become authoritative, and every migrate run refused on it identically.
+ * Repairing the copy in place would publish state nobody verified, so the
+ * refusal is made to carry the resolution instead — it names what to carry
+ * into the published copy by hand, and the run after that action completes
+ * the move.
+ *
  * Idempotent by the same shape. A second run after a completed migration
  * finds no legacy root and reports nothing to move — the normal case for an
  * operator rerunning the command to be sure. A re-run after an interrupted
@@ -34,10 +44,18 @@
  * composed here from `projectsDir` plus names `run/paths.mjs` keeps private;
  * widening that module's surface for one caller is worse than spelling the
  * two literals here, next to this comment.
+ *
+ * `repairCampaignRecords` belongs here for the same reason the move does:
+ * both bring state an older faberun wrote to the shape the current code
+ * reads. Read keeps refusing a record it cannot trust, so the repair is a
+ * verb rather than a silent default on read, and it names every record it
+ * repairs and the field it filled — a repair that happens unreported is
+ * corruption by another name.
  */
-import { cpSync, existsSync, lstatSync, readFileSync, readlinkSync, readdirSync, renameSync, rmSync } from "node:fs";
+import { cpSync, existsSync, lstatSync, readFileSync, readlinkSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { campaignsDir } from "../campaign/layout.mjs";
+import { CAMPAIGN_FILE, campaignsDir } from "../campaign/layout.mjs";
+import { validateCampaign } from "../campaign/record.mjs";
 import { readRemotes } from "../cli/project.mjs";
 import { faberunHome } from "../host/home.mjs";
 import { projectsDir, registerProject } from "../host/projects.mjs";
@@ -101,7 +119,7 @@ export function migrateRunState(cwd, options = {}) {
   // became authoritative; this branch never writes to the copy, so nothing
   // of theirs is at risk.
   if (existsSync(target)) {
-    verifyCopy(legacy, target);
+    verifyCopy(legacy, target, "published");
     const runs = countRunDirs(legacy);
     const campaigns = countCampaigns(legacy);
     refuseLiveLeases(leasesOf(legacy));
@@ -117,7 +135,7 @@ export function migrateRunState(cwd, options = {}) {
   // moment the removal ran; verbatim keeps the literal target, so relative
   // links (the worktrees' dependency symlinks) survive the move.
   cpSync(legacy, staging, { recursive: true, verbatimSymlinks: true });
-  verifyCopy(legacy, staging);
+  verifyCopy(legacy, staging, "staging");
   verifyNothingExtra(legacy, staging);
   const runs = countRunDirs(legacy);
   const campaigns = countCampaigns(legacy);
@@ -136,6 +154,65 @@ export function migrateRunState(cwd, options = {}) {
   return { moved: true, legacy, target, runs, campaigns };
 }
 
+/**
+ * Repair every campaign record under `runsDir` whose only defect is the
+ * absent `status` field: a record written before the field existed carries
+ * id, goal and linkedRunIds but no status, and discovery would report it
+ * corrupt forever. The repair fills the default current writes apply, writes
+ * the record back, and names every record it repaired and the field it
+ * filled in the returned list.
+ *
+ * The default is `closed` because an active campaign is one the product is
+ * currently driving, and a record written before the field existed has not
+ * been driven since.
+ *
+ * The predicate is the validator itself, run on the record with the default
+ * applied, so the repair cannot widen: a record that still fails validation
+ * with a valid status — malformed JSON, a missing id, a goal that is not
+ * text, a linkedRunIds that is not an array, a status present but wrong — is
+ * left exactly as discovery reports it. A record already carrying status is
+ * never rewritten, so a second run repairs nothing and writes nothing.
+ *
+ * @param {string} runsDir
+ * @returns {{id: string, field: string}[]} one entry per repaired record
+ */
+export function repairCampaignRecords(runsDir) {
+  const campaigns = campaignsDir(runsDir);
+  if (!existsSync(campaigns)) return [];
+  /** @type {{id: string, field: string}[]} */
+  const repaired = [];
+  for (const entry of readdirSync(campaigns, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const file = join(campaigns, entry.name, CAMPAIGN_FILE);
+    if (!existsSync(file)) continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync(file, "utf8"));
+    } catch {
+      // Unreadable or unparseable: there is no absent field to fill, and
+      // discovery keeps reporting the record corrupt.
+      continue;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) continue;
+    const record = /** @type {Record<string, unknown>} */ (parsed);
+    // A status present but wrong is corruption, not age: only the absent
+    // field is repairable.
+    if (record.status !== undefined) continue;
+    record.status = "closed";
+    try {
+      validateCampaign(record);
+    } catch {
+      // The record fails the schema for a reason other than the absent
+      // status; the fill above dies with this in-memory object and the file
+      // is never written, so discovery's corrupt report stays true.
+      continue;
+    }
+    writeFileSync(file, `${JSON.stringify(record, null, 2)}\n`);
+    repaired.push({ id: String(record.id), field: "status" });
+  }
+  return repaired;
+}
+
 /**
  * Every controller lock under `tree` whose holder is still alive. The lock
  * file's name is spelled here because `run/lock.mjs` keeps the constant
@@ -184,22 +261,28 @@ function refuseLiveLeases(leases) {
  * of what must be true, and byte-for-byte equality is the strongest check
  * that proves it without trusting the copy step's own bookkeeping.
  *
+ * `role` is which copy this is, and it only chooses what a refusal tells the
+ * operator to do about it: a staging copy is discarded and recopied by the
+ * next run, while a published copy is the one every reader answers while
+ * both trees exist, so only the operator can carry the difference into it.
+ *
  * @param {string} source
  * @param {string} copy
+ * @param {"staging"|"published"} role
  * @returns {void}
  */
-function verifyCopy(source, copy) {
+function verifyCopy(source, copy, role) {
   for (const entry of readdirSync(source, { withFileTypes: true })) {
     const from = join(source, entry.name);
     const to = join(copy, entry.name);
     if (entry.isDirectory()) {
       // lstat, not stat: a copied symlink to a directory must not pass as
       // the directory it points at.
-      if (!lstatSync(to, { throwIfNoEntry: false })?.isDirectory()) throw verifyFailure(from, to);
-      verifyCopy(from, to);
+      if (!lstatSync(to, { throwIfNoEntry: false })?.isDirectory()) throw verifyFailure(from, to, role);
+      verifyCopy(from, to, role);
     } else if (entry.isSymbolicLink()) {
-      if (readLinkOrUndefined(to) !== readlinkSync(from)) throw verifyFailure(from, to);
-    } else if (readOrUndefined(to)?.equals(readFileSync(from)) !== true) throw verifyFailure(from, to);
+      if (readLinkOrUndefined(to) !== readlinkSync(from)) throw verifyFailure(from, to, role);
+    } else if (readOrUndefined(to)?.equals(readFileSync(from)) !== true) throw verifyFailure(from, to, role);
   }
 }
 
@@ -233,9 +316,23 @@ function verifyNothingExtra(source, copy) {
   }
 }
 
-/** @param {string} from @param {string} to @returns {Error} */
-function verifyFailure(from, to) {
-  return new Error(`migration copy does not verify: ${from} is missing or different at ${to}; nothing was published or removed`);
+/**
+ * The refusal is the only way out of a copy that does not verify, so it
+ * names the action that lets a later run finish, not just the mismatch. For
+ * a staging copy that action is nothing: the next run discards the staging
+ * and copies anew. For a published copy there is no next-run help — the
+ * branch runs no copy, and migrating must not repair a copy behind the
+ * operator's back — so the refusal carries the whole resolution: what to
+ * carry into the published copy, by hand, and that the run after that
+ * completes the move.
+ *
+ * @param {string} from @param {string} to @param {"staging"|"published"} role @returns {Error}
+ */
+function verifyFailure(from, to, role) {
+  const action = role === "published"
+    ? `${to} is the copy every reader answers while both trees exist: move what ${from} holds that it lacks into it and settle any differing bytes by hand, then run migrate again`
+    : "the staging copy is discarded and recopied by the next run, so run migrate again";
+  return new Error(`migration copy does not verify: ${from} is missing or different at ${to}; nothing was published or removed — ${action}`);
 }
 
 /** @param {string} path @returns {Error} */