faberun 0.17.2 → 0.19.0

package/src/engine/run-command.mjs

@@ -17,6 +17,7 @@ import { processStartToken } from "../run/lock.mjs";
 import { randomUUID } from "node:crypto";
 import { runMutation } from "./mutation.mjs";
 import { spawn } from "node:child_process";
+import { killTarget, spawnInvocation } from "../host/platform.mjs";
 /** @typedef {import("../contract/verification.mjs").VerificationOptions} VerificationOptions */
 
 /** @typedef {import("node:child_process").ChildProcess} ChildProcess */
@@ -228,7 +229,11 @@ function runCommand(command, baseCwd, commandCwd, attempt, signal, options, comm
       };
       options?.onAttemptStart?.({ ...identity });
       const env = verificationEnv(command);
-      child = spawn(command.argv[0], command.argv.slice(1), { cwd, env, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
+      // A verification command names a binary the same way a harness runtime
+      // does, and on Windows `npm test` is `npm.cmd`: the invocation, not the
+      // raw argv, is what can actually be spawned there.
+      const invocation = spawnInvocation(command.argv[0], command.argv.slice(1), { cwd });
+      child = spawn(invocation.command, invocation.args, { cwd, env, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"], ...invocation.options });
       const pid = child.pid ?? null;
       let paused = false;
       if (process.platform !== "win32" && pid) {
@@ -268,8 +273,7 @@ function runCommand(command, baseCwd, commandCwd, attempt, signal, options, comm
  */
 function terminateGroup(child) {
   try {
-    if (process.platform !== "win32") process.kill(-/** @type {number} */ (child.pid), "SIGTERM");
-    else child.kill("SIGTERM");
+    killTarget(process.platform === "win32" ? /** @type {number} */ (child.pid) : -/** @type {number} */ (child.pid), "SIGTERM");
   } catch {
     try { child.kill("SIGTERM"); } catch {
       // ESRCH: the group kill failed and the leader was already gone.
@@ -277,8 +281,7 @@ function terminateGroup(child) {
   }
   setTimeout(() => {
     try {
-      if (process.platform !== "win32") process.kill(-/** @type {number} */ (child.pid), "SIGKILL");
-      else child.kill("SIGKILL");
+      killTarget(process.platform === "win32" ? /** @type {number} */ (child.pid) : -/** @type {number} */ (child.pid), "SIGKILL");
     } catch {
       try { child.kill("SIGKILL"); } catch {
         // ESRCH: the SIGKILL fallback found no leader left to kill.

package/src/engine/run-identity.mjs

@@ -11,8 +11,9 @@
  * version on its first call, and a missing version is indistinguishable from a
  * changed one.
  */
-import { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION, probeRuntime } from "../harnesses/index.mjs";
+import { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION, getHarness, harnessCapabilities, probeRuntime } from "../harnesses/index.mjs";
 import { appendJsonl, writeJsonAtomic } from "../run/store.mjs";
+import { availabilityKey, readAvailability, recordAvailability } from "../run/availability.mjs";
 import { blockingChecks, environmentPreflight, reachableRuntimes } from "../host/preflight.mjs";
 import { captureSourceIdentity } from "../repo/source-identity.mjs";
 import { boundedGitSync } from "../repo/worktree.mjs";
@@ -24,8 +25,12 @@ import { stableJson } from "../util.mjs";
 import { validateRunMetadata } from "../contract/snapshot.mjs";
 import { contractDigest } from "../contract/index.mjs";
 import { RUNS_DIR_NAME, runDirectory } from "../run/paths.mjs";
+import { preflightContract } from "./live-preflight.mjs";
+import { liveSilenceCause } from "./live-silence.mjs";
 
 /** @typedef {import("../harnesses/index.mjs").HarnessRuntime} HarnessRuntime */
+/** @typedef {import("../harnesses/index.mjs").ProbeResult} ProbeResult */
+/** @typedef {import("../engine/runtime-discovery.mjs").RuntimeAvailability} RuntimeAvailability */
 /** @typedef {import("../cli.mjs").LockHandle} LockHandle */
 /** @typedef {import("../contract/index.mjs").NodeSnapshot} NodeSnapshot */
 /** @typedef {import("../contract/index.mjs").RunMetadata} RunMetadata */
@@ -182,6 +187,25 @@ export function setLaunchBaseRef(baseRef) {
   pendingLaunchBaseRef = baseRef ?? null;
 }
 
+/**
+ * Whether this launch must ask every routed runtime again even where the
+ * verdict store holds a fresh answer (`--fresh-preflight`). A module rather
+ * than an option for the same reason `setLaunchBaseRef` is: the gate is
+ * reached through `runContract` and `resumeRun`, which thread no launch
+ * options of their own. A forced launch still records what it observes.
+ *
+ * @type {boolean}
+ */
+let pendingFreshPreflight = false;
+
+/**
+ * @param {boolean} force
+ * @returns {void}
+ */
+export function setFreshPreflight(force) {
+  pendingFreshPreflight = force === true;
+}
+
 /**
  * The base ref a run was launched against, when it was launched with
  * `--base-ref`. A run recorded before this field existed, or launched
@@ -401,32 +425,207 @@ export function serializableContract(contract) {
   };
 }
 /**
- * The dispatch gate: no node starts until the host can carry the run. The
- * report is written as run evidence either way, and a blocking failure leaves
- * the materialized run untouched — the operator fixes the host and resumes,
- * so a run is never silently restarted and already-paid nodes are not redone.
+ * Live failure codes that name the pipeline rather than the provider, so they
+ * are verdicts of nothing and are never recorded: the two silences above, and
+ * `command_invalid`, which never reached a provider at all. The recordable
+ * set is the complement of this one, not of `LIVE_SILENCE_CAUSES` -- a
+ * command that could not be constructed passes the gate (validation owns
+ * that defect) but learned nothing about availability, so there is no verdict
+ * to persist.
+ */
+const LIVE_NO_VERDICT_CAUSES = new Set(["preflight_timeout", "spawn_error", "command_invalid"]);
+
+/**
+ * Whether an asked probe reached a provider and so carries a verdict worth
+ * recording. `done` reached it and completed; a failure whose detail names a
+ * live error code reached it too unless the code is one of the pipeline's own
+ * (see `LIVE_NO_VERDICT_CAUSES`). A refusal, an auth failure, unparsable
+ * output -- anything a provider itself produced -- is an answer.
+ *
+ * @param {ProbeResult} probe
+ * @returns {boolean}
+ */
+function liveVerdictRecorded(probe) {
+  if (probe.liveStatus === "done") return true;
+  const match = / · live \S+ · ([a-z_]+):/u.exec(probe.detail ?? "");
+  return match !== null && !LIVE_NO_VERDICT_CAUSES.has(match[1]);
+}
+
+/**
+ * The dispatch gate: no node starts until the host can carry the run and the
+ * runtimes it routes to have answered. The static half proves the host facts
+ * — disk, git, worktree, a versioned binary per routed runtime. The live half
+ * asks every routed runtime one trivial prompt through `preflightContract`,
+ * read-only in a throwaway repository, because a present, versioned binary
+ * can still hold a dead credential, a spent quota, or a model that no longer
+ * answers — and each of those fails a run minutes in, after a worktree and a
+ * campaign event already exist.
+ *
+ * Answered means answered, not healthy: any verdict a provider returns,
+ * a quota refusal included, counts as having answered, and the run proceeds
+ * onto whatever the contract declares. Only pipeline silence blocks, and a
+ * silent runtime is named with cause unknown — the verdict
+ * `normalizeProviderAvailability` reserves for a probe that named no cause.
+ *
+ * The report is written as run evidence either way, and a blocking failure
+ * leaves the materialized run untouched — the operator fixes the host and
+ * resumes, so a run is never silently restarted and already-paid nodes are
+ * not redone.
+ *
+ * A verdict is no longer single-launch property: before asking, the gate
+ * reads the verdict store under the operator's home (`run/availability.mjs`),
+ * and a provider answered inside its window is reused, the evidence naming
+ * the reuse and the instant the verdict was observed. Every ask that reached
+ * a provider is recorded there for the next launch. `--fresh-preflight`
+ * skips the read; it never skips the record.
  *
  * @param {ValidatedContract} contract
  * @param {string} runDir
  * @param {SourceIdentity|undefined} sourceIdentity
  */
-export function assertEnvironmentReady(contract, runDir, sourceIdentity) {
+export async function assertEnvironmentReady(contract, runDir, sourceIdentity) {
+  const at = new Date().toISOString();
   const report = environmentPreflight({
     cwd: contract.cwd,
     runtimes: reachableRuntimes(contract),
     harnessVersions: sourceIdentity?.harnessVersions ?? {},
   });
-  const evidence = {
+  /** @param {boolean} ok @param {import("../harnesses/index.mjs").ProbeResult[]} [probes] @returns {Record<string, unknown>} */
+  const evidence = (ok, probes) => ({
     schemaVersion: report.schemaVersion,
     contractVersion: CONTRACT_VERSION,
-    at: new Date().toISOString(),
+    at,
     contractId: contract.id,
-    ok: report.ok,
+    ok,
     checks: report.checks,
-  };
-  writeJsonAtomic(join(runDir, "env-preflight.json"), evidence);
-  if (report.ok) return;
-  appendJsonl(join(runDir, "events.jsonl"), { type: "run.env-preflight-failed", ...evidence });
-  const blocking = blockingChecks(report).map((check) => `${check.name}: ${check.detail}`).join(" · ");
+    ...(probes === undefined ? {} : { runtimes: probes }),
+  });
+  writeJsonAtomic(join(runDir, "env-preflight.json"), evidence(report.ok));
+  let blocking = report.ok ? null : blockingChecks(report).map((check) => `${check.name}: ${check.detail}`).join(" · ");
+  // A launch with nothing left to dispatch asks nothing: when every persisted
+  // state reads done, this launch replays an accepted transaction, starts no
+  // worker and no judge, and can spend no availability.
+  if (blocking === null && launchMayDispatch(runDir)) {
+    // measured 2026-09-22: asking four routed runtimes in parallel took about
+    // 18s, so the default budget is 60s. FABERUN_PREFLIGHT_TIMEOUT_SEC stays
+    // the operator override; preflightContract validates it, so only a valid
+    // number is lifted here.
+    const override = Number(process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC);
+    const timeoutSec = process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC !== undefined && Number.isFinite(override) && override > 0 ? override : 60;
+    const probes = await livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec);
+    const silent = probes.filter((probe) => liveSilenceCause(probe) !== null);
+    writeJsonAtomic(join(runDir, "env-preflight.json"), evidence(silent.length === 0, probes));
+    if (silent.length > 0) {
+      blocking = `no runtime answered the live preflight: ${silent.map((probe) => `${probe.id ?? probe.harness} (cause unknown)`).join(" · ")}`;
+    }
+  }
+  if (blocking === null) return;
+  // The blocking failure is durable run evidence. The event carries exactly
+  // these seven fields — the live ProbeResults stay in env-preflight.json and
+  // never enter the event stream — and the append stays in this function: the
+  // field-ownership document names assertEnvironmentReady as the writer.
+  appendJsonl(join(runDir, "events.jsonl"), {
+    type: "run.env-preflight-failed",
+    schemaVersion: report.schemaVersion,
+    contractVersion: CONTRACT_VERSION,
+    at,
+    contractId: contract.id,
+    ok: false,
+    checks: report.checks,
+  });
   throw Object.assign(new Error(`env_preflight_failed: ${blocking} · the run stays resumable: fix the environment and resume ${runDir}`), { code: "env_preflight_failed" });
 }
+
+/**
+ * The live half of the gate for one launch. Every routed runtime either holds
+ * a verdict this machine recorded inside its freshness window -- reused, the
+ * evidence naming the instant it was observed -- or is asked now, and every
+ * ask that reached a provider is recorded for the next launch. Nothing here
+ * decides what an answer means: reuse changes only whether the provider is
+ * asked, never whether a pass is a pass.
+ *
+ * The read keys on what identifies the provider -- harness, model, the
+ * executable the harness adapter itself resolves -- the same resolution a
+ * probe reports, so a runtime re-labelled between contracts is still one
+ * provider and a provider pointing at another binary is a new question.
+ *
+ * @param {ValidatedContract} contract
+ * @param {string} runDir
+ * @param {SourceIdentity|undefined} sourceIdentity
+ * @param {number} timeoutSec
+ * @returns {Promise<ProbeResult[]>}
+ */
+async function livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec) {
+  const routed = reachableRuntimes(contract);
+  /** @type {Map<string, RuntimeAvailability>} */
+  const fresh = new Map();
+  if (!pendingFreshPreflight) {
+    for (const [id, { runtime }] of routed) {
+      const verdict = readAvailability(availabilityKey({
+        harness: runtime.harness,
+        model: runtime.model,
+        executable: getHarness(runtime.harness).executable(runtime),
+      }));
+      if (verdict) fresh.set(id, verdict);
+    }
+  }
+  if (routed.size > 0 && fresh.size === routed.size) {
+    return [...routed.entries()].map(([id, { runtime }]) => {
+      const verdict = /** @type {RuntimeAvailability} */ (fresh.get(id));
+      return {
+        id,
+        harness: runtime.harness,
+        executable: getHarness(runtime.harness).executable(runtime),
+        model: runtime.model,
+        version: sourceIdentity?.harnessVersions?.[id] ?? null,
+        capabilities: harnessCapabilities(runtime),
+        requiredCapabilities: {},
+        requiredCapabilitySets: [],
+        ok: true,
+        live: true,
+        liveStatus: "reused",
+        detail: `live verdict reused · observed ${verdict.observedAt ?? "unknown instant"}`,
+      };
+    });
+  }
+  const probes = await preflightContract(join(runDir, "contract.json"), { liveTimeoutSec: timeoutSec, persisted: true });
+  // What this launch bought is durable from here on: every ask that reached a
+  // provider -- a refusal included, an answer being an answer -- is recorded
+  // under the provider's own identity. Silence and a command that never
+  // reached a provider are verdicts of nothing and are never recorded, so the
+  // operator who fixes the host is never told the fix "already answered".
+  recordAvailability(
+    probes
+      .filter((probe) => probe.live === true && probe.liveStatus !== "reused" && liveVerdictRecorded(probe))
+      .map((probe) => availabilityKey(probe)),
+    Date.now(),
+  );
+  return probes;
+}
+
+/**
+ * Whether this launch can dispatch anything. Read defensively: a missing
+ * nodes directory or an unparseable state means the launch may dispatch, so
+ * the runtimes are asked.
+ *
+ * @param {string} runDir
+ * @returns {boolean}
+ */
+function launchMayDispatch(runDir) {
+  let names;
+  try {
+    names = readdirSync(join(runDir, "nodes"));
+  } catch {
+    return true;
+  }
+  const states = names.filter((name) => name.endsWith(".json"));
+  if (states.length === 0) return true;
+  return states.some((name) => {
+    try {
+      return JSON.parse(readFileSync(join(runDir, "nodes", name), "utf8")).status !== "done";
+    } catch {
+      return true;
+    }
+  });
+}
+

package/src/engine/runtime-discovery.mjs

@@ -234,21 +234,42 @@ function tierOrder(runtime) {
 }
 
 /**
- * Span in seconds of every rate-limit window label a harness reports. The
- * labels are claude's `rateLimitType` values (measured 2026-09-17, the
- * `rate_limit_event` line recorded in `src/harnesses/protocol.mjs`); a label
+ * How long a recorded live-preflight verdict stays fresh, in seconds. This is
+ * the hello's own clock and is never derived from the quota windows below: a
+ * spend allowance expires when the provider resets it, a hello expires
+ * because whatever it proved -- a working credential, a spawning binary, a
+ * model that answers -- has stopped holding. Measured 2026-09-22: the ask
+ * costs about 18s for four runtimes in parallel, so every launch that reuses
+ * instead of asking saves about that. The window bets that a provider which
+ * answered still answers for the next quarter hour -- long enough to cover a
+ * burst of relaunches and retries, short enough that whatever died in
+ * between is bought again within fifteen minutes.
+ */
+const PREFLIGHT_FRESH_SEC = 15 * 60;
+
+/** The window label a persisted live-preflight verdict carries. */
+export const PREFLIGHT_WINDOW = "preflight";
+
+/**
+ * Span in seconds of every window label a catalogue or stored record may
+ * carry. `five_hour` and `seven_day` are claude's rate-limit labels (measured
+ * 2026-09-17, the `rate_limit_event` line recorded in
+ * `src/harnesses/protocol.mjs`); `preflight` is the hello's own clock, whose
+ * duration and reasoning live in `PREFLIGHT_FRESH_SEC` above -- the two kinds
+ * of window expire for different reasons and are never one clock. A label
  * missing here cannot prove staleness, so its observation never self-expires.
  *
  * @type {Readonly<Record<string, number>>}
  */
-const AVAILABILITY_WINDOW_SEC = Object.freeze({ five_hour: 5 * 3600, seven_day: 7 * 86400 });
+const AVAILABILITY_WINDOW_SEC = Object.freeze({ five_hour: 5 * 3600, seven_day: 7 * 86400, [PREFLIGHT_WINDOW]: PREFLIGHT_FRESH_SEC });
 
 /**
  * May a runtime be admitted on this catalogue record? Exhaustion is waited
  * out on `exhaustedUntil`; an observation older than its own window reads as
  * unknown and admits nothing, because unknown must not look rested. This is
  * the one home of the rule: plan routing and engine composition both read it,
- * so the null and staleness semantics cannot drift between readers. The
+ * as does the verdict store's reuse decision in `run/availability.mjs`, so
+ * the null and staleness semantics cannot drift between readers. The
  * parameter is typed on the fields the rule reads, not on the full record --
  * the plan's table copy names no `reason`.
  *

package/src/engine/scheduler.mjs

@@ -315,7 +315,7 @@ export async function runContract(contractPath, options = {}) {
  */
 export async function driveRun(contract, runDir, states, campaign, lock, sourceIdentity, resume = {}, options = {}) {
   lock.assert();
-  assertEnvironmentReady(contract, runDir, sourceIdentity);
+  await assertEnvironmentReady(contract, runDir, sourceIdentity);
   const runsDir = runsRoot(contract.cwd);
   const bootstrapNonce = bootstrapNonceForProcess();
   // Only the CLI entry can answer this: a nonce inherited by evals/run.mjs or

package/src/engine/supervise.mjs

@@ -42,6 +42,7 @@ import { readJson, writeJsonAtomic } from "../run/store.mjs";
 import { delay, errorCode, errorMessage } from "../util.mjs";
 import { loadPersistedContract } from "../contract/index.mjs";
 import { emitScheduledAttention } from "./notify-queue.mjs";
+import { killTarget } from "../host/platform.mjs";
 
 /** What `--interval` defaults to, in seconds: often enough that a dead controller costs a minute of wall clock, rare enough to be free. */
 export const DEFAULT_SUPERVISE_INTERVAL_SEC = 30;
@@ -532,7 +533,7 @@ export async function terminateControllerGroup(runDir, options = {}) {
           if (errorCode(groupError) !== "ESRCH" && errorCode(groupError) !== "EPERM") throw groupError;
         }
       }
-      process.kill(target, signal);
+      killTarget(target, signal);
     } catch (error) {
       if (errorCode(error) !== "ESRCH" && errorCode(error) !== "EPERM") throw error;
     }

package/src/harnesses/catalogue.mjs

@@ -2,6 +2,7 @@ import { spawnSync } from "node:child_process";
 import { getHarness, probeRuntime, registeredHarnesses, resolveVendor } from "./index.mjs";
 import { DISCOVERY_RUNTIME_DEFINITIONS, composeAssignments } from "../engine/runtime-discovery.mjs";
 import { errorMessage } from "../util.mjs";
+import { spawnInvocation } from "../host/platform.mjs";
 
 /**
  * Model catalogue report: which models each registered harness can run, the
@@ -292,8 +293,14 @@ function displayOrder() {
  */
 function agyCliCatalogue(cwd) {
   const executable = getHarness("agy").executable({ harness: "agy", model: "agy-models" });
-  const result = spawnSync(executable, ["models"], {
+  // The provider CLI is reached the way every other one here is: a name
+  // through PATHEXT, a `.cmd` through the interpreter, a script through the
+  // interpreter its shebang names. A raw spawn of it answers ENOENT on
+  // Windows and the declared catalogue silently wins.
+  const invocation = spawnInvocation(executable, ["models"], { cwd });
+  const result = spawnSync(invocation.command, invocation.args, {
     cwd,
+    ...invocation.options,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: AGY_CATALOGUE_TIMEOUT_MS,

package/src/harnesses/dsh/runner.mjs

@@ -23,6 +23,7 @@
  */
 
 import { spawn } from "node:child_process";
+import { spawnInvocation } from "../../host/platform.mjs";
 import { writeSync } from "node:fs";
 
 const HANDSHAKE_ID = 1;
@@ -145,7 +146,11 @@ if (options.sandbox) env.DSH_PERMISSION_MODE = options.sandbox;
 
 const args = ["--profile", "sdk"];
 for (const patch of options.patches) args.push("--patch", patch);
-const child = spawn(options.dsh, args, { cwd: process.cwd(), env, stdio: ["pipe", "pipe", "pipe"] });
+// The harness binary, reached the way this platform reaches one: a name
+// through PATHEXT, a `.cmd` through the command interpreter, a POSIX script
+// through the interpreter its shebang names.
+const invocation = spawnInvocation(options.dsh, args);
+const child = spawn(invocation.command, invocation.args, { cwd: process.cwd(), env, stdio: ["pipe", "pipe", "pipe"], ...invocation.options });
 
 const usage = { inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0 };
 let sawUsage = false;

package/src/harnesses/index.mjs

@@ -7,6 +7,7 @@ import { zcodeHarness } from "./zcode/index.mjs";
 import { execJsonlHarness } from "./exec-jsonl/index.mjs";
 import { replayHarness } from "./replay/index.mjs";
 import { withoutNotifyEnv } from "../notify/index.mjs";
+import { spawnInvocation } from "../host/platform.mjs";
 
 /** Current wire-contract version for runner protocol artifacts. */
 export const PROTOCOL_SCHEMA_VERSION = 3;
@@ -231,7 +232,9 @@ export function normalizeProviderResult(runtimeOrHarness, stdout, exitCode, sign
 
 /**
  * Normalize a provider envelope or recorded response into the availability
- * shape used by doctor and runtime assignment.
+ * shape used by doctor and runtime assignment. The reason names the cause the
+ * provider actually gave; a probe that timed out naming nothing reports
+ * `unknown`, never a guessed cause.
  *
  * @param {string|{harness: string}} runtimeOrHarness
  * @param {unknown} response
@@ -261,7 +264,12 @@ export function normalizeProviderAvailability(runtimeOrHarness, response, exitCo
   if (envelope.status === "exhausted" || classified?.reason === "quota_exhausted") {
     return { available: false, exhaustedUntil: exhaustedUntilOf(envelope), reason: code || "quota_exhausted" };
   }
-  if (classified?.reason === "authentication_failed") return classified;
+  if (classified) return classified;
+  // A probe that timed out names no cause at all, so any of the four would be
+  // invented from a slow answer. measured 2026-09-22: agy reported
+  // preflight_timeout after 15s and the real cause -- no configuration
+  // directory -- was visible only when a human looked at the filesystem.
+  if (/timeout|timed.?out/iu.test(text)) return { available: false, exhaustedUntil: null, reason: "unknown" };
   return { available: false, exhaustedUntil: null, reason: code || "provider_unavailable" };
 }
 
@@ -288,9 +296,10 @@ export function exhaustedUntilOf(envelope, now = Date.now()) {
 /**
  * Classify raw provider-produced text (a structured envelope's `error.code
  * error.message`, or a probe's raw stderr on a non-zero exit) into the same
- * insufficient-balance/quota/authentication reasons `normalizeProviderAvailability`
- * recognizes. Shared so a CLI-missing exit and a raw stderr balance/quota
- * message are classified by one set of patterns, never two drifting copies.
+ * insufficient-balance/quota/credential/model reasons
+ * `normalizeProviderAvailability` recognizes. Shared so a CLI-missing exit
+ * and a raw stderr balance/quota message are classified by one set of
+ * patterns, never two drifting copies.
  *
  * @param {string} text
  * @returns {{available: false, exhaustedUntil: string|null, reason: string}|null} null when text names none of the known patterns
@@ -302,9 +311,22 @@ function classifyAvailabilityText(text) {
   if (/quota|rate.?limit|usage limit|session limit|limit exhausted|1310/iu.test(text)) {
     return { available: false, exhaustedUntil: resetTimestamp(text), reason: "quota_exhausted" };
   }
+  // measured 2026-09-22, a Codex account asked for a model it may not use:
+  // "The <model> model is not supported when using Codex with a ChatGPT
+  // account". The remedy is declaring another model, not a wait or a retry.
+  if (/model .*not supported|unsupported model/iu.test(text)) {
+    return { available: false, exhaustedUntil: null, reason: "model_not_supported" };
+  }
   if (/auth|credential|unauthori[sz]ed|forbidden|invalid.*(?:key|token)|(?:api|access) key|login/iu.test(text)) {
     return { available: false, exhaustedUntil: null, reason: "authentication_failed" };
   }
+  // A harness whose configuration directory does not exist has no credential
+  // to even fail with (measured 2026-09-22: agy), so this sits last: only text
+  // no earlier pattern named reaches it, and no classification that used to
+  // land elsewhere changes.
+  if (/config(?:uration)? (?:directory|dir)\b/iu.test(text)) {
+    return { available: false, exhaustedUntil: null, reason: "credentials_missing" };
+  }
   return null;
 }
 
@@ -450,13 +472,15 @@ export function probeRuntime(runtime, options = {}) {
   return new Promise((settle) => {
     let child;
     try {
-      child = spawn(executable, args, {
+      const invocation = spawnInvocation(executable, args, { cwd: options.cwd });
+      child = spawn(invocation.command, invocation.args, {
         cwd: options.cwd,
         // A worker or judge never delivers a notification; the controller does.
         // In this repository a worker runs the test suite, whose fixture
         // controllers would otherwise inherit a live transport and deliver.
         env: withoutNotifyEnv(process.env),
         stdio: ["ignore", "pipe", "pipe"],
+        ...invocation.options,
       });
     } catch (error) {
       settle({
@@ -485,7 +509,11 @@ export function probeRuntime(runtime, options = {}) {
       child.kill("SIGTERM");
       finish({
         ...base,
-        availability: { available: false, exhaustedUntil: null, reason: "provider_unavailable" },
+        // A probe that ran out of time said nothing about why: `unknown` is
+        // the honest verdict, not one of the four causes. measured 2026-09-22:
+        // agy timed out after 15s while the real cause -- no configuration
+        // directory -- was visible only on the filesystem.
+        availability: { available: false, exhaustedUntil: null, reason: "unknown" },
         detail: `${identity(null)} · ${[missingEnvironmentDetail, `no response within ${timeoutSec}s`].filter(Boolean).join(" · ")}`,
       });
     }, timeoutSec * 1_000);