faberun 0.18.0 → 0.19.0

package/src/repo/declared-paths.mjs

@@ -12,6 +12,7 @@
  */
 import { errorCode, exitStatus } from "../util.mjs";
 import { execFileSync } from "node:child_process";
+import { gitArguments } from "../host/platform.mjs";
 import { join, resolve } from "node:path";
 import { lstatSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -70,7 +71,7 @@ function isUnobservableDeclaredPath(cwd, declaredPath, kind) {
 function gitDeclaredPathState(cwd, path, kind) {
   const literals = kind === "writeRoots" ? [path, `${path}/`] : [path];
   try {
-    execFileSync("git", ["-C", cwd, "ls-files", "--cached", "--error-unmatch", "--", path], {
+    execFileSync("git", gitArguments(["-C", cwd, "ls-files", "--cached", "--error-unmatch", "--", path]), {
       stdio: ["ignore", "ignore", "ignore"],
     });
     return "tracked";
@@ -118,7 +119,7 @@ function checkCombinedGitIgnore(cwd, path, extraExclude) {
     const args = ["-C", cwd, "ls-files", "--others", "--exclude-standard"];
     if (extraExclude) args.push(`--exclude-from=${extraExclude}`);
     args.push("-z", "--", path);
-    const output = execFileSync("git", args, { encoding: "buffer", stdio: ["ignore", "pipe", "ignore"] });
+    const output = execFileSync("git", gitArguments(args), { encoding: "buffer", stdio: ["ignore", "pipe", "ignore"] });
     return output.length === 0;
   } catch {
     return "unknown";
@@ -140,13 +141,13 @@ function checkMissingCombinedGitIgnore(cwd, path, extraExclude) {
   if (!extraExclude || standard === "unknown") return standard;
   const temporaryWorktree = mkdtempSync(join(tmpdir(), "faberun-ignore-check-"));
   try {
-    execFileSync("git", ["init", "-q", temporaryWorktree], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync("git", gitArguments(["init", "-q", temporaryWorktree]), { stdio: ["ignore", "ignore", "ignore"] });
     const temporaryGit = resolve(temporaryWorktree, ".git");
     writeFileSync(resolve(temporaryGit, "info", "exclude"), readFileSync(extraExclude), { mode: 0o600 });
     const args = ["--git-dir", temporaryGit, "--work-tree", temporaryWorktree, "-c", `core.excludesFile=${process.platform === "win32" ? "NUL" : "/dev/null"}`, "check-ignore", "--no-index", "--verbose", "--", path];
     let customMatched;
     try {
-      execFileSync("git", args, { stdio: ["ignore", "ignore", "ignore"] });
+      execFileSync("git", gitArguments(args), { stdio: ["ignore", "ignore", "ignore"] });
       customMatched = true;
     } catch (error) {
       if (exitStatus(error) !== 1) return "unknown";
@@ -155,7 +156,7 @@ function checkMissingCombinedGitIgnore(cwd, path, extraExclude) {
 
     if (!customMatched) return standard;
     try {
-      execFileSync("git", args.toSpliced(-3, 1, "--quiet"), { stdio: ["ignore", "ignore", "ignore"] });
+      execFileSync("git", gitArguments(args.toSpliced(-3, 1, "--quiet")), { stdio: ["ignore", "ignore", "ignore"] });
       return true;
     } catch (error) {
       return exitStatus(error) === 1 ? false : "unknown";
@@ -181,7 +182,7 @@ function checkGitIgnore(cwd, path, extraExclude) {
   if (extraExclude) args.push("-c", `core.excludesFile=${extraExclude}`);
   args.push("check-ignore", "--no-index", "--quiet", "--", path);
   try {
-    execFileSync("git", args, { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync("git", gitArguments(args), { stdio: ["ignore", "ignore", "ignore"] });
     return true;
   } catch (error) {
     return exitStatus(error) === 1 ? false : "unknown";
@@ -224,3 +225,83 @@ function extractCommandTarget(line) {
   }
   return null;
 }
+
+/**
+ * The `src/` layers a node writes whose mirrored `test/` directory no
+ * verification command touches.
+ *
+ * `test/` mirrors `src/` by directory, and that is an enforced rule of this
+ * tree rather than a habit, so "this node writes the engine and nothing runs
+ * the engine's tests" is a mechanical question with a mechanical answer.
+ *
+ * Measured 2026-09-22, and this is why it exists: a node rewrote the dispatch
+ * gate in `src/engine/run-identity.mjs`, verified `test/engine/live-gate`,
+ * `test/host/preflight` and `test/harnesses/replay-run`, passed every one of
+ * them, passed its judge, and broke 56 of the 385 tests in `test/engine/` --
+ * the directory its own module lives in. No command it ran opened that
+ * directory. The whole contract is searched, not only the node's own
+ * commands, because a shared or final command covering the layer is coverage
+ * just the same.
+ *
+ * A test any node of the contract writes does not count, and that distinction
+ * is the whole detector. The node above *did* name
+ * `test/engine/live-gate.test.mjs` on a command line -- the file it had just
+ * created -- and the run's final verification added
+ * `test/engine/live-verdict.test.mjs`, which its sibling had just created.
+ * Running the tests the campaign is adding proves those tests run, never that
+ * the layer still works. Coverage means naming the directory, or a file in it
+ * that no node in this contract writes.
+ *
+ * A warning, never a refusal: a layer can be honestly verified from another
+ * directory, and only the author knows. But an author who meant it reads one
+ * line, and an author who forgot is handed back a day.
+ *
+ * @param {ValidatedNode} node
+ * @param {number} index
+ * @param {string} cwd
+ * @param {string[]} contractCommands shared and final verification, already joined
+ * @param {Set<string>} contractWrites every path any node of the contract writes
+ * @returns {string[]}
+ */
+export function mirrorCoverageWarnings(node, index, cwd, contractCommands = [], contractWrites = new Set()) {
+  const written = new Set(node.taskPacket.writeFiles ?? []);
+  const authored = new Set([...written, ...contractWrites]);
+  const tokens = [
+    ...node.taskPacket.verification.flatMap((command) => command.argv),
+    ...contractCommands.flatMap((line) => line.split(/\s+/u)),
+  ].filter((token) => !authored.has(token));
+  /** @type {Set<string>} */
+  const layers = new Set();
+  for (const path of written) {
+    const layer = mirroredLayer(path, cwd);
+    if (layer) layers.add(layer);
+  }
+  return [...layers].sort().flatMap((layer) => (
+    tokens.some((token) => token.includes(`test/${layer}/`))
+      ? []
+      : [`nodes[${index}] (${node.id}): writes src/${layer}/ but no verification command runs a test under test/${layer}/ that this contract does not itself write`]
+  ));
+}
+
+/**
+ * The `test/` directory mirroring a written `src/` path, or null when the path
+ * is not source or has no mirror. `src/cli.mjs` mirrors to `test/cli/` because
+ * the entry point is the layer; `src/util.mjs` has no mirror directory and by
+ * the tree's own rule owns no domain, so it names none.
+ *
+ * @param {string} path
+ * @param {string} cwd
+ * @returns {string|null}
+ */
+function mirroredLayer(path, cwd) {
+  const match = /^src\/(?:([^/]+)\/|cli\.mjs$)/u.exec(path);
+  if (!match) return null;
+  const layer = match[1] ?? "cli";
+  try {
+    return lstatSync(join(cwd, "test", layer)).isDirectory() ? layer : null;
+  } catch {
+    // ENOENT: a layer with no mirrored test directory cannot be uncovered by
+    // one, so there is nothing to warn about.
+    return null;
+  }
+}

package/src/repo/signal.mjs

@@ -17,9 +17,21 @@
  * `attention` entry from `.runs/inbox.jsonl`. An attention belongs to one
  * campaign or none: an explicit `campaignId` decides, a null one is resolved
  * from the entry's `runId` (a run belongs to at most one campaign), and an
- * entry whose run no active campaign owns is shown once at run level instead
+ * entry whose run no campaign at all owns is shown once at run level instead
  * of under every campaign at once. It is bounded, because every session pays
  * for it in its first tokens.
+ *
+ * `parked` is decided by `classifyRunProgress`, never by reading `runOutcome`
+ * here. `reduceRunOutcome` is a reduction over snapshots with no notion of
+ * in-flight: a node whose status is `running` is not a success, so it reduces
+ * to `parked` while the controller is still working on it. Measured
+ * 2026-09-22 on a live run: `runOutcome "parked"`, one node `running`,
+ * `controllerAlive true`. The linked-run renderer read that field raw and told
+ * a takeover session to `resume` a run that was 23 minutes into its second
+ * node. The standalone renderer had the conjunct (`&& state === "done"`) and
+ * was right; two copies of one rule, one of them incomplete, so now there is
+ * one copy and it lives in `chain.mjs` with the campaign decision it also
+ * governs.
  */
 
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -30,6 +42,7 @@ import { readInbox } from "../notify/index.mjs";
 import { repositoryForRunsDir } from "../run/paths.mjs";
 import { SIGNAL_END, SIGNAL_START } from "./signal-block.mjs";
 import { HANDOFF_FILE } from "../campaign/layout.mjs";
+import { classifyRunProgress } from "../campaign/chain.mjs";
 
 export { SIGNAL_END, SIGNAL_START } from "./signal-block.mjs";
 
@@ -51,12 +64,15 @@ export function renderAgentSignalBlock(runsDir) {
   const lines = [];
   /** @type {Set<string>} */
   const linked = new Set();
-  const active = discoverCampaigns(runsDir).campaigns.filter(({ campaign }) => campaign.status !== "closed");
-  const ownerByRun = runOwnerIndex(active);
+  const discovered = discoverCampaigns(runsDir).campaigns;
+  // A run any campaign linked is that campaign's business, open or settled.
+  // Only a run no campaign ever named reaches the standalone list.
+  for (const { campaign } of discovered) for (const runId of campaign.linkedRunIds) linked.add(runId);
+  const active = discovered.filter(({ campaign }) => campaign.status !== "closed");
+  const ownerByRun = runOwnerIndex(discovered);
   for (const { campaign } of active) {
     lines.push(`- faberun campaign \`${campaign.id}\`: active — read \`.runs/campaigns/${campaign.id}/${HANDOFF_FILE}\``);
     for (const runId of campaign.linkedRunIds) {
-      linked.add(runId);
       lines.push(...runSignalLines(runsDir, runId));
     }
     const attention = campaignAttentionLine(runsDir, campaign, ownerByRun);
@@ -70,19 +86,26 @@ export function renderAgentSignalBlock(runsDir) {
 }
 
 /**
- * Which active campaign owns each run, read from the campaigns' own
- * `linkedRunIds`. A run belongs to at most one campaign, so the first
- * campaign naming a run wins; a run no active campaign names is absent from
- * the map, and that absence — never a guess — is what makes an inbox entry
- * unattributable.
+ * Which campaign owns each run, read from the campaigns' own `linkedRunIds`.
+ * A run belongs to at most one campaign, so the first campaign naming a run
+ * wins; a run no campaign names is absent from the map, and that absence —
+ * never a guess — is what makes an inbox entry unattributable.
+ *
+ * Closed campaigns are indexed too, and that is the point: an attention from
+ * a closed campaign's run is owned, not orphaned. Indexing only the active
+ * ones made every such attention unattributable, so it was surfaced at run
+ * level and stayed there for good. Measured 2026-09-22: the live block
+ * carried one from `harden-chain-and-verification`, a campaign closed on
+ * 2026-09-16. An owned attention under no active campaign is simply not
+ * shown, which is the correct answer for work its campaign already settled.
  *
- * @param {{campaign: import("../campaign/index.mjs").Campaign}[]} active
+ * @param {{campaign: import("../campaign/index.mjs").Campaign}[]} campaigns
  * @returns {Map<string, string>}
  */
-function runOwnerIndex(active) {
+function runOwnerIndex(campaigns) {
   /** @type {Map<string, string>} */
   const ownerByRun = new Map();
-  for (const { campaign } of active) {
+  for (const { campaign } of campaigns) {
     for (const runId of campaign.linkedRunIds) {
       if (!ownerByRun.has(runId)) ownerByRun.set(runId, campaign.id);
     }
@@ -91,9 +114,9 @@ function runOwnerIndex(active) {
 }
 
 /**
- * One linked run's outcome as block lines. `runProgress` folds the phase-2
- * `runOutcome`, so a parked run is rendered by its own declared nodes rather
- * than being dropped for having no non-terminal one.
+ * One linked run's outcome as block lines. A parked run is rendered by its own
+ * declared nodes rather than being dropped for having no non-terminal one --
+ * but only once `classifyRunProgress` agrees it settled.
  *
  * @param {string} runsDir
  * @param {string} runId
@@ -106,7 +129,7 @@ function runSignalLines(runsDir, runId) {
     return [`  - run \`${runId}\`: missing — resume \`${resume}\``];
   }
   const progress = runProgress(runDir);
-  switch (progress.runOutcome) {
+  switch (classifyRunProgress(progress)) {
     case "succeeded":
       return [`  - run \`${runId}\`: succeeded (${progress.terminal}/${progress.total} nodes)`];
     case "canceled":
@@ -116,8 +139,8 @@ function runSignalLines(runsDir, runId) {
     case "parked":
       break;
     default:
-      // No snapshot yet: the run exists but has not proved an outcome. It is
-      // active work, not parked work, so it must not claim parked nodes.
+      // `unfinished`: either no snapshot yet, or a node still running. Both are
+      // active work, not parked work, so neither may claim parked nodes.
       return [`  - run \`${runId}\`: active — read \`.runs/${runId}/STATUS.md\`; \`resume\` or \`supervise\` it`];
   }
   const nodes = progress.outcomeNodes ?? [];
@@ -127,9 +150,20 @@ function runSignalLines(runsDir, runId) {
 }
 
 /**
- * Standalone runs that no active campaign links. A parked run is included, so
+ * Standalone runs that no campaign links at all. A parked run is included, so
  * a run with no campaign at all still blocks a naive "start fresh".
  *
+ * `linked` spans closed campaigns too. Closing a campaign is the operator
+ * saying its work is settled, but it used to *promote* that campaign's parked
+ * runs: they stopped being indented children of a campaign and became
+ * top-level standalone entries, then stayed there forever. Measured
+ * 2026-09-22: 26 closed campaigns in this project, and the block carried
+ * seven parked runs from three of them -- adversarial-planner,
+ * become-faberun, chain-ergonomics-and-fairness -- against one live run,
+ * each with a `resume` command for work a closed campaign had already
+ * settled. Every session in the repository paid for those lines in its first
+ * tokens and had to decide, one by one, not to act on them.
+ *
  * @param {string} runsDir
  * @param {Set<string>} linked
  * @returns {string[]}
@@ -147,9 +181,10 @@ function activeRunLines(runsDir, linked) {
     // A nodes directory with no committed snapshot is a creation in progress,
     // not evidence of work; the old renderer left it off and so does this one.
     if (progress.runOutcome === undefined && progress.total === 0) continue;
-    if (progress.runOutcome === "succeeded" || progress.runOutcome === "canceled") continue;
+    const classified = classifyRunProgress(progress);
+    if (classified === "succeeded" || classified === "canceled") continue;
     const resume = `node src/cli.mjs resume ${runDir}`;
-    if (progress.runOutcome === "parked" && progress.state === "done") {
+    if (classified === "parked") {
       const nodes = (progress.outcomeNodes ?? []).slice(0, MAX_PARKED_NODES).map(nodeText).join(", ");
       lines.push(`- faberun run \`${name}\`: parked — ${nodes || "no nodes named"} — resume \`${resume}\``);
     } else {

package/src/repo/workspace.mjs

@@ -14,6 +14,7 @@
  * because the verification schema happened to be in the same file.
  */
 import { Buffer } from "node:buffer";
+import { gitArguments } from "../host/platform.mjs";
 import { VERIFICATION_LIMITS } from "../contract/verification.mjs";
 import { basename, isAbsolute, relative, resolve } from "node:path";
 import { closeSync, lstatSync, openSync, readFileSync, readSync, readdirSync, readlinkSync, realpathSync, statSync } from "node:fs";
@@ -278,7 +279,7 @@ function captureIgnoreSources(root) {
   /** @param {string} name @param {string} logical @returns {string|null} */
   const resolveGitPath = (name, logical) => {
     try {
-      const value = execFileSync("git", ["-C", root, "rev-parse", "--git-path", name], {
+      const value = execFileSync("git", gitArguments(["-C", root, "rev-parse", "--git-path", name]), {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
       }).trim();
@@ -460,7 +461,7 @@ function relevantWorkspacePaths(cwd) {
   args.push("-z");
   let output;
   try {
-    output = execFileSync("git", args, {
+    output = execFileSync("git", gitArguments(args), {
       cwd,
       encoding: "buffer",
       maxBuffer: VERIFICATION_LIMITS.snapshotEntries * (VERIFICATION_LIMITS.snapshotPathBytes + 1) + 1,

package/src/repo/worktree.mjs

@@ -1,4 +1,5 @@
 import { spawnSync } from "node:child_process";
+import { gitArguments } from "../host/platform.mjs";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { RUNS_DIR_NAME, attemptWorktreePath, candidateWorktreePath } from "../run/paths.mjs";
@@ -46,7 +47,7 @@ function gitSyncTimeoutMs(optionMs) {
  */
 export function boundedGitSync(args, options = {}) {
   const timeoutMs = gitSyncTimeoutMs(options.timeoutMs);
-  const result = spawnSync("git", args, {
+  const result = spawnSync("git", gitArguments(args), {
     encoding: options.encoding ?? "utf8",
     stdio: options.stdio ?? ["ignore", "pipe", "pipe"],
     timeout: timeoutMs,

package/src/report/next.mjs

@@ -432,12 +432,26 @@ function renderLine(item) {
 
 /**
  * Quote a shell argument only when it needs it, so a normal path stays bare and
- * a path with a space (or any other shell metacharacter) is single-quoted.
+ * a path with a space (or any other shell metacharacter) is quoted the way the
+ * shell reading this line quotes.
  *
  * @param {string} value
  * @returns {string}
  */
 function quoteArg(value) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/u.test(value)) return value;
+  // A Windows path is not a POSIX word: every separator is a backslash, so the
+  // rule above rejects even a plain run directory. Quoting it the POSIX way
+  // would leave the line worse than bare — cmd.exe reads a single quote as a
+  // literal character and would look for a directory named with one. There the
+  // separator is ordinary, and only a space (or a character the shell reads)
+  // needs the quotes that platform does understand.
+  // `~` is in the set because a Windows temporary directory is routinely an
+  // 8.3 short name — `C:\Users\RUNNER~1\AppData\Local\Temp` on a CI runner —
+  // and nothing reads a tilde inside a path: cmd.exe has no expansion for it,
+  // and PowerShell expands one only at the start of a path.
+  if (process.platform === "win32") {
+    return /^[A-Za-z0-9_@%+=:,.~\\/-]+$/u.test(value) ? value : `"${value.replaceAll('"', '\\"')}"`;
+  }
   return `'${value.replaceAll("'", `'\\''`)}'`;
 }

package/src/run/availability.mjs

@@ -0,0 +1,138 @@
+/**
+ * The durable store of live-preflight verdicts: which providers answered the
+ * dispatch gate's hello, and when.
+ *
+ * The gate's verdicts used to live only in a run's own env-preflight.json and
+ * died with the run, so every launch paid the ask again -- measured
+ * 2026-09-22 at about 18s for four runtimes in parallel. This store is the
+ * home that outlives the launch, and it is keyed on the provider -- harness,
+ * model and the executable actually resolved -- never on a contract's local
+ * runtime id: whether `codex` answers is a fact about this machine and this
+ * operator, so two contracts naming the same provider share one answer and
+ * one provider reached under two local names stays one record.
+ *
+ * A record is the catalogue's own RuntimeAvailability shape, so reuse is
+ * decided by `isRuntimeAvailable` -- the one home of the freshness rule --
+ * and the window a record names (`PREFLIGHT_WINDOW`) is the hello's own
+ * clock, declared beside the quota windows it must never be derived from.
+ */
+import { validateRuntimeAvailability } from "../contract/runtime.mjs";
+import { isRuntimeAvailable, PREFLIGHT_WINDOW } from "../engine/runtime-discovery.mjs";
+import { mkdirSync, readFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { availabilityPath } from "./paths.mjs";
+import { writeJsonAtomic } from "./store.mjs";
+
+/** @typedef {import("../engine/runtime-discovery.mjs").RuntimeAvailability} RuntimeAvailability */
+
+/** The store shape this module reads and writes; a foreign shape reads as empty. */
+const STORE_SCHEMA_VERSION = 1;
+
+/**
+ * The key one verdict is stored under. The executable is the path the harness
+ * adapter itself resolves -- the same string a probe reports -- so a runtime
+ * whose model, harness or binary changed is a different question by
+ * construction, and no second catalogue-change mechanism is needed. The
+ * contract-local runtime id is absent on purpose.
+ *
+ * @param {{harness: string, model: string, executable: string}} provider
+ * @returns {string}
+ */
+export function availabilityKey(provider) {
+  return `${provider.harness}:${provider.model}:${provider.executable}`;
+}
+
+/**
+ * The fresh verdict stored for one provider, or null whenever nothing may
+ * skip the ask: no record, a record that fails its own validator, and an
+ * observation outside its window all read as null, because the caller's only
+ * fallback is to ask again and asking again is always safe.
+ *
+ * @param {string} key
+ * @param {number} [now] epoch milliseconds; defaults to the current clock
+ * @returns {RuntimeAvailability|null}
+ */
+export function readAvailability(key, now = Date.now()) {
+  const record = loadVerdicts()[key];
+  return record && isRuntimeAvailable(record, now) ? record : null;
+}
+
+/**
+ * Record that the named providers answered the live preflight at `now`. The
+ * only verdict this store ever holds is "answered": silence
+ * (preflight_timeout, spawn_error) and a command that never reached a
+ * provider are the gate's to report and are never persisted, so the cache can
+ * never turn a pass into a block or the reverse -- it decides only whether
+ * the next launch asks.
+ *
+ * The observation instant is fixed when the verdict is recorded, never
+ * refreshed on read: a sliding window would let a continuously launching
+ * operator keep a long-dead provider admitted forever.
+ *
+ * A launch racing another on this store loses at most its own entries, and a
+ * lost verdict costs one extra ask -- operator-scale launches are not a hot
+ * loop, so the read-modify-write takes no lock.
+ *
+ * @param {string[]} keys
+ * @param {number} [now] epoch milliseconds; the instant the verdicts were observed
+ * @returns {void}
+ */
+export function recordAvailability(keys, now = Date.now()) {
+  if (keys.length === 0) return;
+  const store = loadStore();
+  for (const key of keys) {
+    store.verdicts[key] = {
+      available: true,
+      exhaustedUntil: null,
+      // This store's own verdict name: the provider answered the ask. Nothing
+      // here claims spend-readiness -- a refusal is an answer too.
+      reason: "answered",
+      observedAt: new Date(now).toISOString(),
+      window: PREFLIGHT_WINDOW,
+    };
+  }
+  const path = availabilityPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeJsonAtomic(path, store);
+}
+
+/**
+ * @returns {{schemaVersion: number, verdicts: Record<string, RuntimeAvailability>}}
+ */
+function loadStore() {
+  try {
+    const parsed = JSON.parse(readFileSync(availabilityPath(), "utf8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      && parsed.schemaVersion === STORE_SCHEMA_VERSION
+      && parsed.verdicts && typeof parsed.verdicts === "object" && !Array.isArray(parsed.verdicts)) {
+      return parsed;
+    }
+  } catch {
+    // ENOENT (the first launch on this machine) and a store a truncated write
+    // or a future shape left unparseable mean the same thing here: no verdict
+    // is known, so every provider is asked. That is the safe direction.
+  }
+  return { schemaVersion: STORE_SCHEMA_VERSION, verdicts: {} };
+}
+
+/**
+ * The stored verdicts that pass their own validator. Anything the store
+ * cannot vouch for is dropped rather than trusted or repaired: a dropped
+ * verdict costs one ask, a trusted one costs a launch gated on bytes nobody
+ * can type.
+ *
+ * @returns {Record<string, RuntimeAvailability>}
+ */
+function loadVerdicts() {
+  /** @type {Record<string, RuntimeAvailability>} */
+  const verdicts = {};
+  for (const [key, record] of Object.entries(loadStore().verdicts)) {
+    try {
+      validateRuntimeAvailability(record, `availability verdict ${key}`);
+    } catch {
+      continue;
+    }
+    verdicts[key] = /** @type {RuntimeAvailability} */ (record);
+  }
+  return verdicts;
+}

package/src/run/disk-gc.mjs

@@ -16,7 +16,7 @@
  * what a caller passes in.
  */
 import { readFileSync, readdirSync, rmSync, statSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve, sep } from "node:path";
 import { TERMINAL } from "../engine/prompts.mjs";
 import { lockStale, readLock } from "./lock.mjs";
 
@@ -214,7 +214,11 @@ export function writeRunTextWithDiskPressureRetry(runDir, path, text) {
  */
 function simulateEnospcForTest(path) {
   const match = process.env.FABERUN_SIMULATE_ENOSPC_MATCH;
-  if (!match || !path.includes(match)) return;
+  // The substring is authored in the portable spelling — a case names
+  // `nodes/build.json` — while the path carries this host's separator, so both
+  // are compared in that spelling. Raw, the match never fires on Windows and
+  // the injection is inert while the case still reports what it proved.
+  if (!match || !posixSpelling(path).includes(posixSpelling(match))) return;
   const remaining = Number(process.env.FABERUN_SIMULATE_ENOSPC_COUNT ?? "0");
   if (!Number.isInteger(remaining) || remaining <= 0) return;
   process.env.FABERUN_SIMULATE_ENOSPC_COUNT = String(remaining - 1);
@@ -224,6 +228,16 @@ function simulateEnospcForTest(path) {
   );
 }
 
+/**
+ * One path spelled with forward slashes, whatever separator this host uses.
+ *
+ * @param {string} path
+ * @returns {string}
+ */
+function posixSpelling(path) {
+  return path.split(sep).join("/");
+}
+
 /**
  * Deterministic stand-in for "free space is still below the threshold",
  * paired with `simulateEnospcForTest` so a case can prove the removal loop

package/src/run/lock.mjs

@@ -57,6 +57,14 @@ export function lockPath(runDir) {
  * different one for whatever process next reuses that pid, without a
  * compiled addon or elevated privileges. Every other platform has no cheap
  * equivalent, so the pid probe alone decides there.
+ *
+ * Windows is that other platform, measured 2026-09-21 on Windows 11 26200:
+ * `wmic` — the one cheap process-table reader — is no longer installed, and
+ * the PowerShell that replaced it costs about 400 ms per probe cold, on a path
+ * a controller walks every time it reads a lock. So the token stays null and
+ * ownership falls back to liveness alone: a lock whose pid has been recycled
+ * into an unrelated process reads as still held there, and its holder has to
+ * be taken over by the stale-heartbeat path rather than recognized as gone.
  * @param {number|null} pid @returns {string|null}
  */
 export function processStartToken(pid) {

package/src/run/paths.mjs

@@ -134,6 +134,19 @@ export function runDirectory(cwd, runId) {
   return join(runsRoot(cwd), runId);
 }
 
+/**
+ * The live-preflight verdict store, at the top of the home. Whether a
+ * provider answers is a fact about this machine and this operator -- the same
+ * binary, model and credential whatever repository or contract asks -- so the
+ * record outlives any one run and is shared by every project. This module
+ * owns every path under the home and is the only place that names this one.
+ *
+ * @returns {string}
+ */
+export function availabilityPath() {
+  return join(faberunHome(), "availability.json");
+}
+
 /**
  * The campaigns directory beneath a runs root: `<runs>/campaigns`.
  * Composes `campaign/layout.mjs`'s `campaignsDir`, which owns the shape given

package/src/seat/allowance.mjs

@@ -21,6 +21,7 @@
  */
 import { spawn as nodeSpawn } from "node:child_process";
 import { getHarness } from "../harnesses/index.mjs";
+import { spawnInvocation } from "../host/platform.mjs";
 
 // `window` is optional on the type (not every construction site names one --
 // `plan/pipeline.mjs` rebuilds a start sample from journal fields that predate
@@ -70,8 +71,10 @@ export function defaultInvoke(harness, { spawn = nodeSpawn } = {}) {
   return new Promise((settle) => {
     let child;
     try {
-      child = spawn(command.executable, command.args, {
+      const invocation = spawnInvocation(command.executable, command.args);
+      child = spawn(invocation.command, invocation.args, {
         stdio: ["pipe", "pipe", "pipe"],
+        ...invocation.options,
       });
     } catch {
       settle(null);

package/src/seat/tmux.mjs

@@ -10,6 +10,7 @@
 import { execFileSync } from "node:child_process";
 import { NOTIFY_SESSION_ENV } from "../notify/session.mjs";
 import { errorCode, exitStatus } from "../util.mjs";
+import { spawnInvocation } from "../host/platform.mjs";
 
 /** The single seat session every campaign window lives in. */
 export const SEAT_SESSION = "faberun-seat";
@@ -43,8 +44,15 @@ const TMUX_TIMEOUT_MS = 10_000;
  */
 function runTmux(args, options = {}) {
   try {
-    const stdout = execFileSync("tmux", args, {
+    // The seat reaches tmux the way this platform reaches any command: a
+    // name through PATHEXT, a shim through the interpreter that runs it.
+    // Nothing here claims tmux exists on Windows -- ADR 0009 says it does
+    // not -- only that the probe answers `tmux_unavailable` for the right
+    // reason instead of failing to spell the name.
+    const invocation = spawnInvocation("tmux", args, { cwd: options.cwd });
+    const stdout = execFileSync(invocation.command, invocation.args, {
       cwd: options.cwd,
+      ...invocation.options,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: TMUX_TIMEOUT_MS,