faberun 0.17.2 → 0.19.0

package/src/notify/session.mjs

@@ -31,6 +31,7 @@
 import { spawn as defaultSpawn } from "node:child_process";
 import { createConnection as defaultConnect } from "node:net";
 import { errorMessage } from "../util.mjs";
+import { spawnInvocation } from "../host/platform.mjs";
 
 export const NOTIFY_SESSION_ENV = "FABERUN_NOTIFY_SESSION";
 export const CLAUDE_SOCKET_ENV = "CLAUDE_CODE_MESSAGING_SOCKET";
@@ -44,7 +45,7 @@ export const CODEX_THREAD_ENV = "CODEX_THREAD_ID";
  */
 export const SESSION_DELIVERY_TIMEOUT_MS = 5_000;
 
-/** The values the variable accepts besides `codex:<thread>`. */
+/** The bare words an item of the setting may be; `codex:<thread>` and `claude:<socket>` carry an address. */
 const SETTINGS = new Set(["off", "auto", "claude", "codex"]);
 
 /** @typedef {Record<string, unknown>} JsonObject */
@@ -59,32 +60,66 @@ const SETTINGS = new Set(["off", "auto", "claude", "codex"]);
 /** @typedef {(path: string) => SessionSocket} ConnectFunction */
 
 /**
- * The sessions the variable and the environment together name. `auto` takes
- * every session whose address is present -- a Codex thread opened from a
- * Claude Code shell inherits both, and both are supervising. An explicit
- * `claude` or `codex` whose address is absent resolves to nothing; the
- * doctor reports why through `sessionSettingProblem`, this function never
- * throws, because it backs a lossy dispatcher.
+ * The sessions the variable and the environment together name. The value is
+ * a comma-separated list; each item is one of:
+ *
+ *   auto             every session whose address this process inherited --
+ *                    a Codex thread opened from a Claude Code shell inherits
+ *                    both, and both are supervising
+ *   claude           the inherited Claude Code inbox alone
+ *   codex            the inherited Codex thread alone
+ *   codex:<thread>   a Codex thread by id or name
+ *   claude:<socket>  a Claude Code inbox by socket path -- the operator's
+ *                    own interactive session, which did not launch the run
+ *                    and would otherwise never hear of it (the session that
+ *                    launches a campaign is often a background one nobody
+ *                    reads); the token travels only to the inherited inbox,
+ *                    since it belongs to that session and no other
+ *   off              nothing, whatever else the list says
+ *
+ * An item whose address is absent resolves to nothing; the doctor reports
+ * why through `sessionSettingProblem`. This function never throws, because it
+ * backs a lossy dispatcher. Duplicates collapse: `auto,claude:<own socket>`
+ * is one target.
  *
  * @param {NodeJS.ProcessEnv} [env]
  * @returns {SessionTarget[]}
  */
 export function resolveSessionTargets(env = process.env) {
-  const setting = (env[NOTIFY_SESSION_ENV] ?? "").trim();
-  if (!setting || setting === "off") return [];
+  const items = settingItems(env);
+  if (!items.length || items.includes("off")) return [];
   /** @type {SessionTarget[]} */
   const targets = [];
-  const socketPath = env[CLAUDE_SOCKET_ENV];
-  if ((setting === "auto" || setting === "claude") && socketPath) {
-    targets.push({ kind: "claude", id: "claude-session", socketPath, token: env[CLAUDE_TOKEN_ENV] || null });
-  }
-  const thread = setting.startsWith("codex:") ? setting.slice("codex:".length).trim() : env[CODEX_THREAD_ENV];
-  if ((setting === "auto" || setting === "codex" || setting.startsWith("codex:")) && thread) {
-    targets.push({ kind: "codex", id: "codex-session", thread });
+  /** @param {SessionTarget} target */
+  const add = (target) => {
+    const address = target.kind === "claude" ? target.socketPath : target.thread;
+    if (!targets.some((known) => known.kind === target.kind && (known.kind === "claude" ? known.socketPath : known.thread) === address)) targets.push(target);
+  };
+  const inheritedSocket = env[CLAUDE_SOCKET_ENV];
+  const inheritedThread = env[CODEX_THREAD_ENV];
+  for (const item of items) {
+    if ((item === "auto" || item === "claude") && inheritedSocket) {
+      add({ kind: "claude", id: "claude-session", socketPath: inheritedSocket, token: env[CLAUDE_TOKEN_ENV] || null });
+    }
+    if ((item === "auto" || item === "codex") && inheritedThread) {
+      add({ kind: "codex", id: "codex-session", thread: inheritedThread });
+    }
+    if (item.startsWith("codex:") && item.slice("codex:".length).trim()) {
+      add({ kind: "codex", id: "codex-session", thread: item.slice("codex:".length).trim() });
+    }
+    if (item.startsWith("claude:") && item.slice("claude:".length).trim()) {
+      const socketPath = item.slice("claude:".length).trim();
+      add({ kind: "claude", id: "claude-session", socketPath, token: socketPath === inheritedSocket ? env[CLAUDE_TOKEN_ENV] || null : null });
+    }
   }
   return targets;
 }
 
+/** @param {NodeJS.ProcessEnv} env @returns {string[]} the non-empty items of the setting */
+function settingItems(env) {
+  return (env[NOTIFY_SESSION_ENV] ?? "").split(",").map((item) => item.trim()).filter((item) => item.length > 0);
+}
+
 /**
  * Why the setting names no session, in one sentence for `doctor` and
  * `--wake`; `null` when it is unset, `off`, or resolves to at least one.
@@ -93,15 +128,16 @@ export function resolveSessionTargets(env = process.env) {
  * @returns {string|null}
  */
 export function sessionSettingProblem(env = process.env) {
-  const setting = (env[NOTIFY_SESSION_ENV] ?? "").trim();
-  if (!setting || setting === "off") return null;
-  if (!SETTINGS.has(setting) && !setting.startsWith("codex:")) {
-    return `${NOTIFY_SESSION_ENV}=${setting} is not one of off, auto, claude, codex, codex:<thread>`;
+  const items = settingItems(env);
+  if (!items.length || items.includes("off")) return null;
+  const unknown = items.find((item) => !SETTINGS.has(item) && !(item.startsWith("codex:") && item.length > "codex:".length) && !(item.startsWith("claude:") && item.length > "claude:".length));
+  if (unknown !== undefined) {
+    return `${NOTIFY_SESSION_ENV} item "${unknown}" is not one of off, auto, claude, codex, codex:<thread>, claude:<socket>`;
   }
   if (resolveSessionTargets(env).length) return null;
+  const [setting] = items;
   if (setting === "claude") return `${NOTIFY_SESSION_ENV}=claude but ${CLAUDE_SOCKET_ENV} is not set: this process was not started from inside a Claude Code session`;
   if (setting === "codex") return `${NOTIFY_SESSION_ENV}=codex but ${CODEX_THREAD_ENV} is not set: this process was not started from inside a Codex session`;
-  if (setting.startsWith("codex:")) return `${NOTIFY_SESSION_ENV}=codex: names an empty thread id`;
   return `${NOTIFY_SESSION_ENV}=auto found neither ${CLAUDE_SOCKET_ENV} nor ${CODEX_THREAD_ENV}: no harness session to wake`;
 }
 
@@ -189,7 +225,11 @@ export function createCodexSessionNotifier({ spawn = /** @type {SpawnFunction} *
         const executable = env.FABERUN_CODEX_BIN ?? "codex";
         let child;
         try {
-          child = spawn(executable, ["queue", "--thread", target.thread, "--message", messageText(event)], { stdio: ["ignore", "ignore", "pipe"], env });
+          // The harness CLI, reached the way this platform reaches one: the
+          // `codex` a Windows machine has is `codex.cmd`, and a raw spawn of
+          // the bare name is ENOENT — a wake that silently never arrives.
+          const invocation = spawnInvocation(executable, ["queue", "--thread", target.thread, "--message", messageText(event)]);
+          child = spawn(invocation.command, invocation.args, { stdio: ["ignore", "ignore", "pipe"], env, ...invocation.options });
         } catch (error) {
           resolve({ ok: false, error: errorMessage(error) });
           return;
@@ -228,13 +268,13 @@ export function createCodexSessionNotifier({ spawn = /** @type {SpawnFunction} *
  * @param {SessionEvent} event
  * @param {SessionTarget[]} targets
  * @param {{connect?: ConnectFunction, spawn?: SpawnFunction, timeoutMs?: number, env?: NodeJS.ProcessEnv}} [options]
- * @returns {Promise<{id: string, ok: boolean, error?: string}[]>}
+ * @returns {Promise<{id: string, address: string, ok: boolean, error?: string}[]>}
  */
 export function deliverToSessions(event, targets, options = {}) {
   return Promise.all(targets.map(async (target) => {
     const result = target.kind === "claude"
       ? await createClaudeSessionNotifier(options).deliver(event, target)
       : await createCodexSessionNotifier(options).deliver(event, target);
-    return { id: target.id, ...result };
+    return { id: target.id, address: target.kind === "claude" ? target.socketPath : target.thread, ...result };
   }));
 }

package/src/plan/pipeline.mjs

@@ -24,6 +24,7 @@ import { campaignCli } from "../cli/campaign.mjs";
 import { appendJsonl, writeJsonAtomic } from "../run/store.mjs";
 import { stableJson } from "../util.mjs";
 import { allowanceDelta, allowanceEventFields, sampleAllowance } from "../seat/allowance.mjs";
+import { askPlanningRuntimes, refusePlanningSilence } from "./preflight.mjs";
 import { parseSpec, validateSpec } from "./spec.mjs";
 import { collectRepoFacts } from "./repo-facts.mjs";
 import { RISK_TIERS, buildPlanningContract, validateFindings, validatePlanOutput } from "./template.mjs";
@@ -42,6 +43,7 @@ import { campaignTree, runDirectory } from "../run/paths.mjs";
 /** @typedef {{sizing: import("./sizing.mjs").SizingResult, routing: import("./routing.mjs").RoutingResult, nodes: JsonObject[]}} AssembledPlan */
 /** @typedef {"standard"|"high"|"none"} ApproveBelow */
 /** @typedef {(contractPath: string, contract: ValidatedContract) => Promise<void>|void} LaunchFn */
+/** @typedef {(runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, cwd: string) => Promise<import("../harnesses/index.mjs").ProbeResult[]>} AskFn */
 /** @typedef {(runDir: string) => Promise<import("../engine/supervise.mjs").RunProgress>|import("../engine/supervise.mjs").RunProgress} WaitFn */
 /** @typedef {{status: "frozen", plansDir: string, planPath: string, contractPath: string, approved: boolean, findings: PlanFindingOutput[], warnings: string[]}} FrozenPipelineResult */
 /** @typedef {{status: "contested", plansDir: string, planPath: string, findings: PlanFindingOutput[], round: number}} ContestedPipelineResult */
@@ -80,7 +82,7 @@ export const DEFAULT_NODE_BUDGET_MS = 600_000;
 const APPROVE_BELOW_VALUES = new Set(["standard", "high", "none"]);
 
 /**
- * @param {{specPath: string, campaignId: string, phase: string, cwd?: string, reviewRounds?: number, approveBelow?: ApproveBelow, runtimeDefaults?: {worker?: string, judge?: string}, runtimes: Record<string, JsonObject>, verification?: VerificationSuites, launch: LaunchFn, wait: WaitFn}} options
+ * @param {{specPath: string, campaignId: string, phase: string, cwd?: string, reviewRounds?: number, approveBelow?: ApproveBelow, runtimeDefaults?: {worker?: string, judge?: string}, runtimes: Record<string, JsonObject>, verification?: VerificationSuites, launch: LaunchFn, wait: WaitFn, ask?: AskFn}} options
  * @returns {Promise<FrozenPipelineResult|ContestedPipelineResult>}
  */
 export async function runPlanningPipeline(options) {
@@ -88,6 +90,7 @@ export async function runPlanningPipeline(options) {
     specPath, campaignId, phase, runtimes, launch, wait,
     reviewRounds = 2, runtimeDefaults = {}, verification = {},
   } = options;
+  const ask = options.ask ?? askPlanningRuntimes;
   const approveBelow = /** @type {ApproveBelow} */ (options.approveBelow ?? "standard");
   if (!APPROVE_BELOW_VALUES.has(approveBelow)) throw new TypeError(`approveBelow must be one of ${[...APPROVE_BELOW_VALUES].join(", ")}`);
   if (typeof launch !== "function") throw new TypeError("runPlanningPipeline requires a launch seam");
@@ -97,6 +100,7 @@ export async function runPlanningPipeline(options) {
   const campaignPath = campaignTree(cwd, campaignId);
   const campaign = readCampaign(campaignPath);
   if (campaign.status !== "active") throw new Error(`campaign is closed: ${campaignId}`);
+  refusePlanningSilence(await ask(runtimes, runtimeDefaults, cwd), cwd);
 
   const relativeSpecPath = repoRelativePath(cwd, specPath, "specPath");
   const specText = readFileSync(resolve(cwd, relativeSpecPath), "utf8");

package/src/plan/preflight.mjs

@@ -0,0 +1,77 @@
+/**
+ * The ask `faberun plan` makes before its first stage.
+ *
+ * It lives beside the pipeline rather than inside it because asking is its own
+ * concern -- which runtimes a planning run will spend, and what counts as one
+ * of them not answering -- and because `pipeline.mjs` sits 45 lines from this
+ * tree's 800-line ceiling.
+ */
+import { preflightRuntimes } from "../engine/live-preflight.mjs";
+import { liveSilenceCause } from "../engine/live-silence.mjs";
+import { harnessCapabilities } from "../harnesses/index.mjs";
+import { validateRuntime } from "../contract/runtime.mjs";
+
+/**
+ * The runtimes a planning run will spend, asked once before its first stage.
+ *
+ * Planning routes two roles across nine stages and does not reach them at the
+ * same time: the planner is spent at `draft`, the reviewer not until `review`.
+ * Every stage does launch through `runContract`, so the dispatch gate asks --
+ * but it asks that stage's own contract, and a planning contract carries no
+ * gate (`plan/template.mjs` builds them with `gate: false`), so
+ * `reachableRuntimes` never counts the judge role: it only adds one when a
+ * node's gate is enabled. The reviewer is therefore reached only as the
+ * *worker* of a later stage's contract, which is why a reviewer that never
+ * answers used to surface after the draft had already been bought. Naming both
+ * runtimes directly is the only ask that reaches them before anything is
+ * spent.
+ *
+ * Phase 2's verdict store makes this free at the stage boundary: what is
+ * recorded here is what each stage's own gate reuses instead of asking again.
+ *
+ * @param {Record<string, Record<string, unknown>>} runtimes the catalogue as the pipeline carries it, validated here per entry
+ * @param {{worker?: string, judge?: string}} runtimeDefaults
+ * @param {string} cwd
+ * @returns {Promise<import("../harnesses/index.mjs").ProbeResult[]>}
+ */
+export async function askPlanningRuntimes(runtimes, runtimeDefaults, cwd) {
+  /** @type {string[]} */
+  const ids = [];
+  for (const id of [runtimeDefaults.worker, runtimeDefaults.judge]) {
+    if (typeof id === "string" && id.length > 0 && !ids.includes(id)) ids.push(id);
+  }
+  const entries = ids.flatMap((id) => {
+    const raw = runtimes[id];
+    // A default naming a runtime the catalogue does not carry is the
+    // catalogue loader's refusal to make, not this one's.
+    if (raw === undefined) return [];
+    const runtime = validateRuntime(id, raw);
+    return [{ runtime: { ...runtime, id, capabilities: harnessCapabilities(runtime) } }];
+  });
+  return entries.length === 0 ? [] : preflightRuntimes(entries, { cwd });
+}
+
+/**
+ * Refuse before the first stage when a runtime said nothing at all.
+ *
+ * The rule is the dispatch gate's own, imported rather than restated:
+ * `liveSilenceCause` decides what silence is, so planning and dispatch cannot
+ * drift into disagreeing about whether an answer was an answer. Silence
+ * blocks; any verdict a provider returned -- a quota refusal included -- is an
+ * answer, and the run proceeds onto whatever the contract declares.
+ *
+ * @param {import("../harnesses/index.mjs").ProbeResult[]} checks
+ * @param {string} cwd
+ * @returns {void}
+ */
+export function refusePlanningSilence(checks, cwd) {
+  const silent = checks.flatMap((check) => {
+    const cause = liveSilenceCause(check);
+    return cause === null ? [] : [`runtime ${check.id ?? check.harness} did not answer: ${cause}`];
+  });
+  if (silent.length === 0) return;
+  throw Object.assign(
+    new Error(`env_preflight_failed: ${silent.join(" · ")} · planning stays resumable: fix the environment and plan again in ${cwd}`),
+    { code: "env_preflight_failed" },
+  );
+}

package/src/repo/declared-paths.mjs

@@ -12,6 +12,7 @@
  */
 import { errorCode, exitStatus } from "../util.mjs";
 import { execFileSync } from "node:child_process";
+import { gitArguments } from "../host/platform.mjs";
 import { join, resolve } from "node:path";
 import { lstatSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -70,7 +71,7 @@ function isUnobservableDeclaredPath(cwd, declaredPath, kind) {
 function gitDeclaredPathState(cwd, path, kind) {
   const literals = kind === "writeRoots" ? [path, `${path}/`] : [path];
   try {
-    execFileSync("git", ["-C", cwd, "ls-files", "--cached", "--error-unmatch", "--", path], {
+    execFileSync("git", gitArguments(["-C", cwd, "ls-files", "--cached", "--error-unmatch", "--", path]), {
       stdio: ["ignore", "ignore", "ignore"],
     });
     return "tracked";
@@ -118,7 +119,7 @@ function checkCombinedGitIgnore(cwd, path, extraExclude) {
     const args = ["-C", cwd, "ls-files", "--others", "--exclude-standard"];
     if (extraExclude) args.push(`--exclude-from=${extraExclude}`);
     args.push("-z", "--", path);
-    const output = execFileSync("git", args, { encoding: "buffer", stdio: ["ignore", "pipe", "ignore"] });
+    const output = execFileSync("git", gitArguments(args), { encoding: "buffer", stdio: ["ignore", "pipe", "ignore"] });
     return output.length === 0;
   } catch {
     return "unknown";
@@ -140,13 +141,13 @@ function checkMissingCombinedGitIgnore(cwd, path, extraExclude) {
   if (!extraExclude || standard === "unknown") return standard;
   const temporaryWorktree = mkdtempSync(join(tmpdir(), "faberun-ignore-check-"));
   try {
-    execFileSync("git", ["init", "-q", temporaryWorktree], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync("git", gitArguments(["init", "-q", temporaryWorktree]), { stdio: ["ignore", "ignore", "ignore"] });
     const temporaryGit = resolve(temporaryWorktree, ".git");
     writeFileSync(resolve(temporaryGit, "info", "exclude"), readFileSync(extraExclude), { mode: 0o600 });
     const args = ["--git-dir", temporaryGit, "--work-tree", temporaryWorktree, "-c", `core.excludesFile=${process.platform === "win32" ? "NUL" : "/dev/null"}`, "check-ignore", "--no-index", "--verbose", "--", path];
     let customMatched;
     try {
-      execFileSync("git", args, { stdio: ["ignore", "ignore", "ignore"] });
+      execFileSync("git", gitArguments(args), { stdio: ["ignore", "ignore", "ignore"] });
       customMatched = true;
     } catch (error) {
       if (exitStatus(error) !== 1) return "unknown";
@@ -155,7 +156,7 @@ function checkMissingCombinedGitIgnore(cwd, path, extraExclude) {
 
     if (!customMatched) return standard;
     try {
-      execFileSync("git", args.toSpliced(-3, 1, "--quiet"), { stdio: ["ignore", "ignore", "ignore"] });
+      execFileSync("git", gitArguments(args.toSpliced(-3, 1, "--quiet")), { stdio: ["ignore", "ignore", "ignore"] });
       return true;
     } catch (error) {
       return exitStatus(error) === 1 ? false : "unknown";
@@ -181,7 +182,7 @@ function checkGitIgnore(cwd, path, extraExclude) {
   if (extraExclude) args.push("-c", `core.excludesFile=${extraExclude}`);
   args.push("check-ignore", "--no-index", "--quiet", "--", path);
   try {
-    execFileSync("git", args, { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync("git", gitArguments(args), { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (error) {
     return exitStatus(error) === 1 ? false : "unknown";
@@ -224,3 +225,83 @@ function extractCommandTarget(line) {
   }
   return null;
 }
+
+/**
+ * The `src/` layers a node writes whose mirrored `test/` directory no
+ * verification command touches.
+ *
+ * `test/` mirrors `src/` by directory, and that is an enforced rule of this
+ * tree rather than a habit, so "this node writes the engine and nothing runs
+ * the engine's tests" is a mechanical question with a mechanical answer.
+ *
+ * Measured 2026-09-22, and this is why it exists: a node rewrote the dispatch
+ * gate in `src/engine/run-identity.mjs`, verified `test/engine/live-gate`,
+ * `test/host/preflight` and `test/harnesses/replay-run`, passed every one of
+ * them, passed its judge, and broke 56 of the 385 tests in `test/engine/` --
+ * the directory its own module lives in. No command it ran opened that
+ * directory. The whole contract is searched, not only the node's own
+ * commands, because a shared or final command covering the layer is coverage
+ * just the same.
+ *
+ * A test any node of the contract writes does not count, and that distinction
+ * is the whole detector. The node above *did* name
+ * `test/engine/live-gate.test.mjs` on a command line -- the file it had just
+ * created -- and the run's final verification added
+ * `test/engine/live-verdict.test.mjs`, which its sibling had just created.
+ * Running the tests the campaign is adding proves those tests run, never that
+ * the layer still works. Coverage means naming the directory, or a file in it
+ * that no node in this contract writes.
+ *
+ * A warning, never a refusal: a layer can be honestly verified from another
+ * directory, and only the author knows. But an author who meant it reads one
+ * line, and an author who forgot is handed back a day.
+ *
+ * @param {ValidatedNode} node
+ * @param {number} index
+ * @param {string} cwd
+ * @param {string[]} contractCommands shared and final verification, already joined
+ * @param {Set<string>} contractWrites every path any node of the contract writes
+ * @returns {string[]}
+ */
+export function mirrorCoverageWarnings(node, index, cwd, contractCommands = [], contractWrites = new Set()) {
+  const written = new Set(node.taskPacket.writeFiles ?? []);
+  const authored = new Set([...written, ...contractWrites]);
+  const tokens = [
+    ...node.taskPacket.verification.flatMap((command) => command.argv),
+    ...contractCommands.flatMap((line) => line.split(/\s+/u)),
+  ].filter((token) => !authored.has(token));
+  /** @type {Set<string>} */
+  const layers = new Set();
+  for (const path of written) {
+    const layer = mirroredLayer(path, cwd);
+    if (layer) layers.add(layer);
+  }
+  return [...layers].sort().flatMap((layer) => (
+    tokens.some((token) => token.includes(`test/${layer}/`))
+      ? []
+      : [`nodes[${index}] (${node.id}): writes src/${layer}/ but no verification command runs a test under test/${layer}/ that this contract does not itself write`]
+  ));
+}
+
+/**
+ * The `test/` directory mirroring a written `src/` path, or null when the path
+ * is not source or has no mirror. `src/cli.mjs` mirrors to `test/cli/` because
+ * the entry point is the layer; `src/util.mjs` has no mirror directory and by
+ * the tree's own rule owns no domain, so it names none.
+ *
+ * @param {string} path
+ * @param {string} cwd
+ * @returns {string|null}
+ */
+function mirroredLayer(path, cwd) {
+  const match = /^src\/(?:([^/]+)\/|cli\.mjs$)/u.exec(path);
+  if (!match) return null;
+  const layer = match[1] ?? "cli";
+  try {
+    return lstatSync(join(cwd, "test", layer)).isDirectory() ? layer : null;
+  } catch {
+    // ENOENT: a layer with no mirrored test directory cannot be uncovered by
+    // one, so there is nothing to warn about.
+    return null;
+  }
+}

package/src/repo/signal.mjs

@@ -17,9 +17,21 @@
  * `attention` entry from `.runs/inbox.jsonl`. An attention belongs to one
  * campaign or none: an explicit `campaignId` decides, a null one is resolved
  * from the entry's `runId` (a run belongs to at most one campaign), and an
- * entry whose run no active campaign owns is shown once at run level instead
+ * entry whose run no campaign at all owns is shown once at run level instead
  * of under every campaign at once. It is bounded, because every session pays
  * for it in its first tokens.
+ *
+ * `parked` is decided by `classifyRunProgress`, never by reading `runOutcome`
+ * here. `reduceRunOutcome` is a reduction over snapshots with no notion of
+ * in-flight: a node whose status is `running` is not a success, so it reduces
+ * to `parked` while the controller is still working on it. Measured
+ * 2026-09-22 on a live run: `runOutcome "parked"`, one node `running`,
+ * `controllerAlive true`. The linked-run renderer read that field raw and told
+ * a takeover session to `resume` a run that was 23 minutes into its second
+ * node. The standalone renderer had the conjunct (`&& state === "done"`) and
+ * was right; two copies of one rule, one of them incomplete, so now there is
+ * one copy and it lives in `chain.mjs` with the campaign decision it also
+ * governs.
  */
 
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -30,6 +42,7 @@ import { readInbox } from "../notify/index.mjs";
 import { repositoryForRunsDir } from "../run/paths.mjs";
 import { SIGNAL_END, SIGNAL_START } from "./signal-block.mjs";
 import { HANDOFF_FILE } from "../campaign/layout.mjs";
+import { classifyRunProgress } from "../campaign/chain.mjs";
 
 export { SIGNAL_END, SIGNAL_START } from "./signal-block.mjs";
 
@@ -51,12 +64,15 @@ export function renderAgentSignalBlock(runsDir) {
   const lines = [];
   /** @type {Set<string>} */
   const linked = new Set();
-  const active = discoverCampaigns(runsDir).campaigns.filter(({ campaign }) => campaign.status !== "closed");
-  const ownerByRun = runOwnerIndex(active);
+  const discovered = discoverCampaigns(runsDir).campaigns;
+  // A run any campaign linked is that campaign's business, open or settled.
+  // Only a run no campaign ever named reaches the standalone list.
+  for (const { campaign } of discovered) for (const runId of campaign.linkedRunIds) linked.add(runId);
+  const active = discovered.filter(({ campaign }) => campaign.status !== "closed");
+  const ownerByRun = runOwnerIndex(discovered);
   for (const { campaign } of active) {
     lines.push(`- faberun campaign \`${campaign.id}\`: active — read \`.runs/campaigns/${campaign.id}/${HANDOFF_FILE}\``);
     for (const runId of campaign.linkedRunIds) {
-      linked.add(runId);
       lines.push(...runSignalLines(runsDir, runId));
     }
     const attention = campaignAttentionLine(runsDir, campaign, ownerByRun);
@@ -70,19 +86,26 @@ export function renderAgentSignalBlock(runsDir) {
 }
 
 /**
- * Which active campaign owns each run, read from the campaigns' own
- * `linkedRunIds`. A run belongs to at most one campaign, so the first
- * campaign naming a run wins; a run no active campaign names is absent from
- * the map, and that absence — never a guess — is what makes an inbox entry
- * unattributable.
+ * Which campaign owns each run, read from the campaigns' own `linkedRunIds`.
+ * A run belongs to at most one campaign, so the first campaign naming a run
+ * wins; a run no campaign names is absent from the map, and that absence —
+ * never a guess — is what makes an inbox entry unattributable.
+ *
+ * Closed campaigns are indexed too, and that is the point: an attention from
+ * a closed campaign's run is owned, not orphaned. Indexing only the active
+ * ones made every such attention unattributable, so it was surfaced at run
+ * level and stayed there for good. Measured 2026-09-22: the live block
+ * carried one from `harden-chain-and-verification`, a campaign closed on
+ * 2026-09-16. An owned attention under no active campaign is simply not
+ * shown, which is the correct answer for work its campaign already settled.
  *
- * @param {{campaign: import("../campaign/index.mjs").Campaign}[]} active
+ * @param {{campaign: import("../campaign/index.mjs").Campaign}[]} campaigns
  * @returns {Map<string, string>}
  */
-function runOwnerIndex(active) {
+function runOwnerIndex(campaigns) {
   /** @type {Map<string, string>} */
   const ownerByRun = new Map();
-  for (const { campaign } of active) {
+  for (const { campaign } of campaigns) {
     for (const runId of campaign.linkedRunIds) {
       if (!ownerByRun.has(runId)) ownerByRun.set(runId, campaign.id);
     }
@@ -91,9 +114,9 @@ function runOwnerIndex(active) {
 }
 
 /**
- * One linked run's outcome as block lines. `runProgress` folds the phase-2
- * `runOutcome`, so a parked run is rendered by its own declared nodes rather
- * than being dropped for having no non-terminal one.
+ * One linked run's outcome as block lines. A parked run is rendered by its own
+ * declared nodes rather than being dropped for having no non-terminal one --
+ * but only once `classifyRunProgress` agrees it settled.
  *
  * @param {string} runsDir
  * @param {string} runId
@@ -106,7 +129,7 @@ function runSignalLines(runsDir, runId) {
     return [`  - run \`${runId}\`: missing — resume \`${resume}\``];
   }
   const progress = runProgress(runDir);
-  switch (progress.runOutcome) {
+  switch (classifyRunProgress(progress)) {
     case "succeeded":
       return [`  - run \`${runId}\`: succeeded (${progress.terminal}/${progress.total} nodes)`];
     case "canceled":
@@ -116,8 +139,8 @@ function runSignalLines(runsDir, runId) {
     case "parked":
       break;
     default:
-      // No snapshot yet: the run exists but has not proved an outcome. It is
-      // active work, not parked work, so it must not claim parked nodes.
+      // `unfinished`: either no snapshot yet, or a node still running. Both are
+      // active work, not parked work, so neither may claim parked nodes.
       return [`  - run \`${runId}\`: active — read \`.runs/${runId}/STATUS.md\`; \`resume\` or \`supervise\` it`];
   }
   const nodes = progress.outcomeNodes ?? [];
@@ -127,9 +150,20 @@ function runSignalLines(runsDir, runId) {
 }
 
 /**
- * Standalone runs that no active campaign links. A parked run is included, so
+ * Standalone runs that no campaign links at all. A parked run is included, so
  * a run with no campaign at all still blocks a naive "start fresh".
  *
+ * `linked` spans closed campaigns too. Closing a campaign is the operator
+ * saying its work is settled, but it used to *promote* that campaign's parked
+ * runs: they stopped being indented children of a campaign and became
+ * top-level standalone entries, then stayed there forever. Measured
+ * 2026-09-22: 26 closed campaigns in this project, and the block carried
+ * seven parked runs from three of them -- adversarial-planner,
+ * become-faberun, chain-ergonomics-and-fairness -- against one live run,
+ * each with a `resume` command for work a closed campaign had already
+ * settled. Every session in the repository paid for those lines in its first
+ * tokens and had to decide, one by one, not to act on them.
+ *
  * @param {string} runsDir
  * @param {Set<string>} linked
  * @returns {string[]}
@@ -147,9 +181,10 @@ function activeRunLines(runsDir, linked) {
     // A nodes directory with no committed snapshot is a creation in progress,
     // not evidence of work; the old renderer left it off and so does this one.
     if (progress.runOutcome === undefined && progress.total === 0) continue;
-    if (progress.runOutcome === "succeeded" || progress.runOutcome === "canceled") continue;
+    const classified = classifyRunProgress(progress);
+    if (classified === "succeeded" || classified === "canceled") continue;
     const resume = `node src/cli.mjs resume ${runDir}`;
-    if (progress.runOutcome === "parked" && progress.state === "done") {
+    if (classified === "parked") {
       const nodes = (progress.outcomeNodes ?? []).slice(0, MAX_PARKED_NODES).map(nodeText).join(", ");
       lines.push(`- faberun run \`${name}\`: parked — ${nodes || "no nodes named"} — resume \`${resume}\``);
     } else {

package/src/repo/workspace.mjs

@@ -14,6 +14,7 @@
  * because the verification schema happened to be in the same file.
  */
 import { Buffer } from "node:buffer";
+import { gitArguments } from "../host/platform.mjs";
 import { VERIFICATION_LIMITS } from "../contract/verification.mjs";
 import { basename, isAbsolute, relative, resolve } from "node:path";
 import { closeSync, lstatSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, statSync } from "node:fs";
@@ -278,7 +279,7 @@ function captureIgnoreSources(root) {
   /** @param {string} name @param {string} logical @returns {string|null} */
   const resolveGitPath = (name, logical) => {
     try {
-      const value = execFileSync("git", ["-C", root, "rev-parse", "--git-path", name], {
+      const value = execFileSync("git", gitArguments(["-C", root, "rev-parse", "--git-path", name]), {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
       }).trim();
@@ -460,7 +461,7 @@ function relevantWorkspacePaths(cwd) {
   args.push("-z");
   let output;
   try {
-    output = execFileSync("git", args, {
+    output = execFileSync("git", gitArguments(args), {
       cwd,
       encoding: "buffer",
       maxBuffer: VERIFICATION_LIMITS.snapshotEntries * (VERIFICATION_LIMITS.snapshotPathBytes + 1) + 1,

package/src/repo/worktree.mjs

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { gitArguments } from "../host/platform.mjs";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { RUNS_DIR_NAME, attemptWorktreePath, candidateWorktreePath } from "../run/paths.mjs";
@@ -46,7 +47,7 @@ function gitSyncTimeoutMs(optionMs) {
  */
 export function boundedGitSync(args, options = {}) {
   const timeoutMs = gitSyncTimeoutMs(options.timeoutMs);
-  const result = spawnSync("git", args, {
+  const result = spawnSync("git", gitArguments(args), {
     encoding: options.encoding ?? "utf8",
     stdio: options.stdio ?? ["ignore", "pipe", "pipe"],
     timeout: timeoutMs,

package/src/report/locale.mjs

@@ -16,6 +16,8 @@
  * function there.
  */
 
+import { NOTIFY_LANG_ENV } from "../notify/index.mjs";
+
 /** @typedef {"en"|"pt"} Language */
 
 // `a`, `do` and `no` are left out on purpose: each is also an English word,
@@ -51,6 +53,24 @@ export function detectLanguage(...groups) {
   return "en";
 }
 
+/**
+ * The language the message is written in: `FABERUN_NOTIFY_LANG` when the
+ * operator set it to a language this module has (a campaign whose goal an
+ * orchestrator wrote in English still belongs to a person who reads
+ * Portuguese), else detection over the groups. The override moves the
+ * wording only; quoted text keeps the language it was written in, so a
+ * Portuguese label may sit beside an English objective -- honest, if uneven.
+ *
+ * @param {NodeJS.ProcessEnv} env
+ * @param {...readonly (string|null|undefined)[]} groups
+ * @returns {Language}
+ */
+export function chooseLanguage(env, ...groups) {
+  const forced = (env[NOTIFY_LANG_ENV] ?? "").trim();
+  if (forced === "pt" || forced === "en") return forced;
+  return detectLanguage(...groups);
+}
+
 /**
  * Every phrase the message renders, per language. Node ids, run ids, model
  * names and quoted text are never here: they are data, not wording.