faberun 0.18.0 → 0.19.1

package/src/engine/live-silence.mjs

@@ -0,0 +1,49 @@
+/**
+ * What counts as a provider saying nothing at all.
+ *
+ * This is one rule with three readers -- the dispatch gate
+ * (`engine/run-identity.mjs`), planning's pre-stage refusal
+ * (`plan/preflight.mjs`) and `doctor` (`host/preflight.mjs`) -- and it is its
+ * own module because those three cannot all import each other. `doctor` owns
+ * `reachableRuntimes`, which `engine/live-preflight.mjs` imports, so a
+ * `doctor` that read the rule out of the engine closed a runtime import
+ * cycle. This module imports nothing: it reads a probe's recorded detail and
+ * says whether a provider answered, and nothing else.
+ *
+ * The rule itself is the campaign's claim in one line. Any verdict a provider
+ * returned is an answer, a quota refusal included, and the run proceeds onto
+ * whatever the contract declares. Only silence blocks.
+ */
+
+/**
+ * The causes that mean no runtime said anything at all: the provider was
+ * asked and did not answer, or could not be started to be asked.
+ *
+ * `command_invalid` is deliberately not one of them. A command that could not
+ * be constructed never reached a provider, so there is no availability
+ * verdict either way -- that is a contract defect and validation already owns
+ * it. Measured 2026-09-22: three deterministic evals declare a fallback and a
+ * judge runtime they never invoke, so those carry no replay recording and the
+ * replay adapter throws when asked to build their command. Blocking there
+ * refuses a run over a runtime it would never have used, for a fault the
+ * provider never had.
+ */
+const LIVE_SILENCE_CAUSES = new Set(["preflight_timeout", "spawn_error"]);
+
+/**
+ * Whether a live probe is pipeline silence rather than a verdict, and which
+ * cause. `preflightContract` embeds the provider envelope's error code in the
+ * probe detail (`… · live failed · <code>: …`), and the repository-failure
+ * wording means no runtime was even asked. Everything else -- a quota
+ * refusal, an auth failure, unparsable output -- is a provider that answered,
+ * and an answer is hello enough.
+ *
+ * @param {import("../harnesses/index.mjs").ProbeResult} probe
+ * @returns {string|null}
+ */
+export function liveSilenceCause(probe) {
+  if (probe.ok) return null;
+  if (/live preflight repository failed/u.test(probe.detail ?? "")) return "spawn_error";
+  const match = / · live \S+ · ([a-z_]+):/u.exec(probe.detail ?? "");
+  return match !== null && LIVE_SILENCE_CAUSES.has(match[1]) ? match[1] : null;
+}

package/src/engine/process-identity.mjs

@@ -86,6 +86,17 @@ export function processStartTokenMatches(invocation) {
  * -- a pid this user cannot signal is not the child this controller spawned --
  * and a null token with no handle is unverifiable, so it is never owned.
  *
+ * Except on Windows, which records no token at all: `wmic` is gone from
+ * Windows 11 26200 and the PowerShell that replaced it costs about 400 ms a
+ * probe (`run/lock.mjs`). Holding POSIX's answer there means every recorded
+ * invocation is unverifiable, so a controller never terminates the provider it
+ * started: measured 2026-09-20, a suite run left 105 node fixtures alive and
+ * then waited on one of them, and `cancel` reported providers it had not
+ * stopped. A live pid this controller recorded is the evidence that platform
+ * has, and it is the same evidence `killTarget` already acts on there. What is
+ * given up is the pid-reuse defence: a pid recycled into an unrelated process
+ * between the record and the kill reads as owned.
+ *
  * @param {InvocationProbe} invocation
  * @param {{child?: ChildProcess|null}} [options]
  * @returns {boolean}
@@ -106,6 +117,6 @@ export function invocationOwned(invocation, options = {}) {
   const child = options.child;
   if (child && child.exitCode === null && child.signalCode === null) return true;
   const token = invocation.processStartToken;
-  if (!token) return false;
+  if (!token) return process.platform === "win32";
   return processStartToken(invocation.pid) === token;
 }

package/src/engine/process.mjs

@@ -23,6 +23,7 @@ import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { appendJsonl, writeJsonAtomic } from "../run/store.mjs";
 import { writeNodeSnapshot } from "../run/node-store.mjs";
+import { killTarget } from "../host/platform.mjs";
 
 /** @typedef {import("../contract/index.mjs").ValidatedContract} ValidatedContract */
 /** @typedef {import("../contract/index.mjs").ValidatedNode} ValidatedNode */
@@ -35,7 +36,7 @@ import { writeNodeSnapshot } from "../run/node-store.mjs";
 /** @typedef {{prompt: string|null, stdout: string, stderr: string}} PathSet */
 /** @typedef {{id: string, pid: number, processGroupId: number|null, processStartToken: string|null, harness: string, runtimeId: string|null, runtimeFingerprint?: string, revision?: number, phase: string, promptPath: string|null, stdoutPath: string, stderrPath: string, startedAt: string, deadlineAt: string|null, updatedAt: string, closedAt: string|null, exitCode: number|null, signal: string|null, status: "active"|"closed"|"terminated", executable: string, snapshotPath?: string, usage?: Usage, usageEstimated?: boolean, costUsd?: number|null, costProvenance?: "priced", runId?: string, campaignId?: string, nodeId?: string, attempt?: number, workspace?: string, worktreeBranch?: string|null, worktreeBaseSha?: string|null, planPhase?: string, role?: "worker"|"judge", model?: string, reasoning?: string|null, sandbox?: string|null, continuationId?: string|null, continuationMode?: "fresh"|"reuse"|"rotate", session?: import("../harnesses/session-metrics.mjs").SessionLedger|null}} Invocation */
 /** @typedef {{pid: number|null, processGroupId?: number|null, processStartToken?: string|null}} InvocationProbe */
-/** @typedef {{child: ChildProcess, contract: ValidatedContract, node: ValidatedNode, state: NodeSnapshot, runtime: HarnessRuntime & {id: string|null}, cwd: string, paths: PathSet, phase: string, invocation: Invocation, startedAt: string, startedTicks: bigint, progressTicks: bigint, lastOutputAt: number, closed: boolean, exitCode: number|null, signal: string|null, spawnError: Error|null, terminating: Promise<void>|null, gateConfigPath: string, gateReleasePath: string, scopeBaseline?: unknown, scopeChecked?: boolean, scopeViolation?: boolean, resultMaterialization?: boolean, recoveryBaseline?: unknown, observeTimer?: ReturnType<typeof setInterval>, monitorOffset?: number, monitorParser?: import("../harnesses/session-metrics.mjs").SessionMetricsParser, lastEventCount?: number, observedOnce?: boolean, onClose?: (invocation: Invocation) => void, onInvocationUpdate?: (invocation: Invocation) => void, onProgress?: (state: NodeSnapshot) => void}} Job */
+/** @typedef {{child: ChildProcess, contract: ValidatedContract, node: ValidatedNode, state: NodeSnapshot, runtime: HarnessRuntime & {id: string|null}, cwd: string, paths: PathSet, phase: string, invocation: Invocation, startedAt: string, startedTicks: bigint, progressTicks: bigint, lastOutputAt: number, closed: boolean, exitCode: number|null, signal: string|null, spawnError: Error|null, terminating: Promise<void>|null, gateConfigPath: string, gateReleasePath: string, scopeBaseline?: unknown, scopeChecked?: boolean, scopeViolation?: boolean, resultMaterialization?: boolean, recoveryBaseline?: unknown, observeTimer?: ReturnType<typeof setInterval>, monitorOffset?: number, monitorParser?: import("../harnesses/session-metrics.mjs").SessionMetricsParser, lastEventCount?: number, lastMonitorOffset?: number, observedOnce?: boolean, onClose?: (invocation: Invocation) => void, onInvocationUpdate?: (invocation: Invocation) => void, onProgress?: (state: NodeSnapshot) => void}} Job */
 /** @typedef {{graceMs?: number, killGraceMs?: number, escalate?: boolean, runDir?: string, kill?: (pid: number, signal: string|number) => unknown, child?: ChildProcess|null}} TerminateOptions */
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -433,8 +434,26 @@ export async function detectStalls(contract, running, onTimeout, onProgress, onB
     if (streaming) {
       const monitored = monitorInvocation(job);
       const events = monitored.turns + monitored.toolCalls;
-      if (events !== job.lastEventCount || job.observedOnce !== true) {
+      // Transcript bytes the monitor consumed count as liveness beside the
+      // events, because a turn can transmit for a long time without finishing
+      // one. Codex meters progress as `turn.completed` plus tool calls, so a
+      // single long reasoning stretch -- streaming `item.completed` records
+      // that are neither -- advanced no counter and was killed as a stall
+      // while it was actively transmitting. This is not the mtime the module
+      // header rejects: mtime moves for a buffered harness that has written
+      // nothing a provider produced, and this branch is the streaming
+      // harnesses only, where new bytes on the transcript are the provider's
+      // own output and the monitor's offset only ever advances. A process
+      // that transmits forever without ending is still held by the wall clock
+      // and the turn cap below.
+      // An offset this job has never recorded is not growth: `observedOnce`
+      // below is what covers the first pass, and reading `undefined` as a
+      // change would make every first observation look like progress.
+      const consumed = job.monitorOffset ?? 0;
+      const grew = consumed !== (job.lastMonitorOffset ?? consumed);
+      if (events !== job.lastEventCount || grew || job.observedOnce !== true) {
         job.lastEventCount = events;
+        job.lastMonitorOffset = consumed;
         job.progressTicks = now;
         // `lastOutputAt` is the supervised controller's provider-progress
         // signal (scheduler.mjs): keep it advancing for an event that counts
@@ -572,7 +591,7 @@ function signalInvocation(invocation, signal, options = {}) {
   const pid = invocation.pid;
   if (pid === null || pid === undefined) return false;
   const target = process.platform === "win32" ? pid : -(invocation.processGroupId ?? pid);
-  const kill = options.kill ?? process.kill;
+  const kill = options.kill ?? killTarget;
   try {
     kill(target, signal);
     return true;

package/src/engine/resume.mjs

@@ -23,7 +23,8 @@ import { attemptWorktreePath } from "../run/paths.mjs";
 import { canonicalWorkerResultText, isResultMaterializationInvocation, materializeAttemptResult, recoverWorkerResult } from "./result-file.mjs";
 import { checkPersistedWorkerScope, persistedScopeBoundary, reconcileAmbiguousWorkerRestart, resolveUnknownEffect } from "./scope.mjs";
 import { closePersistedInvocation, recoverOrphan, recoveryFromOverride } from "./recover.mjs";
-import { driveRun, readRunNodes } from "./scheduler.mjs";
+import { driveRun } from "./scheduler.mjs";
+import { readRunNodes } from "../run/node-store.mjs";
 import { emptyUsage, invocationCost, invocationUsage, persistRecoveryUsage } from "../run/usage.mjs";
 import { ensureTerminalEvent, hasDoneEvent, recordExecutionOverride, transition, writeNode } from "./state.mjs";
 import { errorMessage, excerpt } from "../util.mjs";

package/src/engine/run-command.mjs

@@ -17,6 +17,7 @@ import { processStartToken } from "../run/lock.mjs";
 import { randomUUID } from "node:crypto";
 import { runMutation } from "./mutation.mjs";
 import { spawn } from "node:child_process";
+import { killTarget, spawnInvocation } from "../host/platform.mjs";
 /** @typedef {import("../contract/verification.mjs").VerificationOptions} VerificationOptions */
 
 /** @typedef {import("node:child_process").ChildProcess} ChildProcess */
@@ -228,7 +229,11 @@ function runCommand(command, baseCwd, commandCwd, attempt, signal, options, comm
       };
       options?.onAttemptStart?.({ ...identity });
       const env = verificationEnv(command);
-      child = spawn(command.argv[0], command.argv.slice(1), { cwd, env, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
+      // A verification command names a binary the same way a harness runtime
+      // does, and on Windows `npm test` is `npm.cmd`: the invocation, not the
+      // raw argv, is what can actually be spawned there.
+      const invocation = spawnInvocation(command.argv[0], command.argv.slice(1), { cwd });
+      child = spawn(invocation.command, invocation.args, { cwd, env, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"], ...invocation.options });
       const pid = child.pid ?? null;
       let paused = false;
       if (process.platform !== "win32" && pid) {
@@ -268,8 +273,7 @@ function runCommand(command, baseCwd, commandCwd, attempt, signal, options, comm
  */
 function terminateGroup(child) {
   try {
-    if (process.platform !== "win32") process.kill(-/** @type {number} */ (child.pid), "SIGTERM");
-    else child.kill("SIGTERM");
+    killTarget(process.platform === "win32" ? /** @type {number} */ (child.pid) : -/** @type {number} */ (child.pid), "SIGTERM");
   } catch {
     try { child.kill("SIGTERM"); } catch {
       // ESRCH: the group kill failed and the leader was already gone.
@@ -277,8 +281,7 @@ function terminateGroup(child) {
   }
   setTimeout(() => {
     try {
-      if (process.platform !== "win32") process.kill(-/** @type {number} */ (child.pid), "SIGKILL");
-      else child.kill("SIGKILL");
+      killTarget(process.platform === "win32" ? /** @type {number} */ (child.pid) : -/** @type {number} */ (child.pid), "SIGKILL");
     } catch {
       try { child.kill("SIGKILL"); } catch {
         // ESRCH: the SIGKILL fallback found no leader left to kill.

package/src/engine/run-identity.mjs

@@ -11,8 +11,9 @@
  * version on its first call, and a missing version is indistinguishable from a
  * changed one.
  */
-import { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION, probeRuntime } from "../harnesses/index.mjs";
+import { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION, getHarness, harnessCapabilities, probeRuntime } from "../harnesses/index.mjs";
 import { appendJsonl, writeJsonAtomic } from "../run/store.mjs";
+import { availabilityKey, readAvailability, recordAvailability } from "../run/availability.mjs";
 import { blockingChecks, environmentPreflight, reachableRuntimes } from "../host/preflight.mjs";
 import { captureSourceIdentity } from "../repo/source-identity.mjs";
 import { boundedGitSync } from "../repo/worktree.mjs";
@@ -24,8 +25,12 @@ import { stableJson } from "../util.mjs";
 import { validateRunMetadata } from "../contract/snapshot.mjs";
 import { contractDigest } from "../contract/index.mjs";
 import { RUNS_DIR_NAME, runDirectory } from "../run/paths.mjs";
+import { preflightContract } from "./live-preflight.mjs";
+import { liveSilenceCause } from "./live-silence.mjs";
 
 /** @typedef {import("../harnesses/index.mjs").HarnessRuntime} HarnessRuntime */
+/** @typedef {import("../harnesses/index.mjs").ProbeResult} ProbeResult */
+/** @typedef {import("../engine/runtime-discovery.mjs").RuntimeAvailability} RuntimeAvailability */
 /** @typedef {import("../cli.mjs").LockHandle} LockHandle */
 /** @typedef {import("../contract/index.mjs").NodeSnapshot} NodeSnapshot */
 /** @typedef {import("../contract/index.mjs").RunMetadata} RunMetadata */
@@ -182,6 +187,25 @@ export function setLaunchBaseRef(baseRef) {
   pendingLaunchBaseRef = baseRef ?? null;
 }
 
+/**
+ * Whether this launch must ask every routed runtime again even where the
+ * verdict store holds a fresh answer (`--fresh-preflight`). A module rather
+ * than an option for the same reason `setLaunchBaseRef` is: the gate is
+ * reached through `runContract` and `resumeRun`, which thread no launch
+ * options of their own. A forced launch still records what it observes.
+ *
+ * @type {boolean}
+ */
+let pendingFreshPreflight = false;
+
+/**
+ * @param {boolean} force
+ * @returns {void}
+ */
+export function setFreshPreflight(force) {
+  pendingFreshPreflight = force === true;
+}
+
 /**
  * The base ref a run was launched against, when it was launched with
  * `--base-ref`. A run recorded before this field existed, or launched
@@ -401,32 +425,207 @@ export function serializableContract(contract) {
   };
 }
 /**
- * The dispatch gate: no node starts until the host can carry the run. The
- * report is written as run evidence either way, and a blocking failure leaves
- * the materialized run untouched — the operator fixes the host and resumes,
- * so a run is never silently restarted and already-paid nodes are not redone.
+ * Live failure codes that name the pipeline rather than the provider, so they
+ * are verdicts of nothing and are never recorded: the two silences above, and
+ * `command_invalid`, which never reached a provider at all. The recordable
+ * set is the complement of this one, not of `LIVE_SILENCE_CAUSES` -- a
+ * command that could not be constructed passes the gate (validation owns
+ * that defect) but learned nothing about availability, so there is no verdict
+ * to persist.
+ */
+const LIVE_NO_VERDICT_CAUSES = new Set(["preflight_timeout", "spawn_error", "command_invalid"]);
+
+/**
+ * Whether an asked probe reached a provider and so carries a verdict worth
+ * recording. `done` reached it and completed; a failure whose detail names a
+ * live error code reached it too unless the code is one of the pipeline's own
+ * (see `LIVE_NO_VERDICT_CAUSES`). A refusal, an auth failure, unparsable
+ * output -- anything a provider itself produced -- is an answer.
+ *
+ * @param {ProbeResult} probe
+ * @returns {boolean}
+ */
+function liveVerdictRecorded(probe) {
+  if (probe.liveStatus === "done") return true;
+  const match = / · live \S+ · ([a-z_]+):/u.exec(probe.detail ?? "");
+  return match !== null && !LIVE_NO_VERDICT_CAUSES.has(match[1]);
+}
+
+/**
+ * The dispatch gate: no node starts until the host can carry the run and the
+ * runtimes it routes to have answered. The static half proves the host facts
+ * — disk, git, worktree, a versioned binary per routed runtime. The live half
+ * asks every routed runtime one trivial prompt through `preflightContract`,
+ * read-only in a throwaway repository, because a present, versioned binary
+ * can still hold a dead credential, a spent quota, or a model that no longer
+ * answers — and each of those fails a run minutes in, after a worktree and a
+ * campaign event already exist.
+ *
+ * Answered means answered, not healthy: any verdict a provider returns,
+ * a quota refusal included, counts as having answered, and the run proceeds
+ * onto whatever the contract declares. Only pipeline silence blocks, and a
+ * silent runtime is named with cause unknown — the verdict
+ * `normalizeProviderAvailability` reserves for a probe that named no cause.
+ *
+ * The report is written as run evidence either way, and a blocking failure
+ * leaves the materialized run untouched — the operator fixes the host and
+ * resumes, so a run is never silently restarted and already-paid nodes are
+ * not redone.
+ *
+ * A verdict is no longer single-launch property: before asking, the gate
+ * reads the verdict store under the operator's home (`run/availability.mjs`),
+ * and a provider answered inside its window is reused, the evidence naming
+ * the reuse and the instant the verdict was observed. Every ask that reached
+ * a provider is recorded there for the next launch. `--fresh-preflight`
+ * skips the read; it never skips the record.
  *
  * @param {ValidatedContract} contract
  * @param {string} runDir
  * @param {SourceIdentity|undefined} sourceIdentity
  */
-export function assertEnvironmentReady(contract, runDir, sourceIdentity) {
+export async function assertEnvironmentReady(contract, runDir, sourceIdentity) {
+  const at = new Date().toISOString();
   const report = environmentPreflight({
     cwd: contract.cwd,
     runtimes: reachableRuntimes(contract),
     harnessVersions: sourceIdentity?.harnessVersions ?? {},
   });
-  const evidence = {
+  /** @param {boolean} ok @param {import("../harnesses/index.mjs").ProbeResult[]} [probes] @returns {Record<string, unknown>} */
+  const evidence = (ok, probes) => ({
     schemaVersion: report.schemaVersion,
     contractVersion: CONTRACT_VERSION,
-    at: new Date().toISOString(),
+    at,
     contractId: contract.id,
-    ok: report.ok,
+    ok,
     checks: report.checks,
-  };
-  writeJsonAtomic(join(runDir, "env-preflight.json"), evidence);
-  if (report.ok) return;
-  appendJsonl(join(runDir, "events.jsonl"), { type: "run.env-preflight-failed", ...evidence });
-  const blocking = blockingChecks(report).map((check) => `${check.name}: ${check.detail}`).join(" · ");
+    ...(probes === undefined ? {} : { runtimes: probes }),
+  });
+  writeJsonAtomic(join(runDir, "env-preflight.json"), evidence(report.ok));
+  let blocking = report.ok ? null : blockingChecks(report).map((check) => `${check.name}: ${check.detail}`).join(" · ");
+  // A launch with nothing left to dispatch asks nothing: when every persisted
+  // state reads done, this launch replays an accepted transaction, starts no
+  // worker and no judge, and can spend no availability.
+  if (blocking === null && launchMayDispatch(runDir)) {
+    // measured 2026-09-22: asking four routed runtimes in parallel took about
+    // 18s, so the default budget is 60s. FABERUN_PREFLIGHT_TIMEOUT_SEC stays
+    // the operator override; preflightContract validates it, so only a valid
+    // number is lifted here.
+    const override = Number(process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC);
+    const timeoutSec = process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC !== undefined && Number.isFinite(override) && override > 0 ? override : 60;
+    const probes = await livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec);
+    const silent = probes.filter((probe) => liveSilenceCause(probe) !== null);
+    writeJsonAtomic(join(runDir, "env-preflight.json"), evidence(silent.length === 0, probes));
+    if (silent.length > 0) {
+      blocking = `no runtime answered the live preflight: ${silent.map((probe) => `${probe.id ?? probe.harness} (cause unknown)`).join(" · ")}`;
+    }
+  }
+  if (blocking === null) return;
+  // The blocking failure is durable run evidence. The event carries exactly
+  // these seven fields — the live ProbeResults stay in env-preflight.json and
+  // never enter the event stream — and the append stays in this function: the
+  // field-ownership document names assertEnvironmentReady as the writer.
+  appendJsonl(join(runDir, "events.jsonl"), {
+    type: "run.env-preflight-failed",
+    schemaVersion: report.schemaVersion,
+    contractVersion: CONTRACT_VERSION,
+    at,
+    contractId: contract.id,
+    ok: false,
+    checks: report.checks,
+  });
   throw Object.assign(new Error(`env_preflight_failed: ${blocking} · the run stays resumable: fix the environment and resume ${runDir}`), { code: "env_preflight_failed" });
 }
+
+/**
+ * The live half of the gate for one launch. Every routed runtime either holds
+ * a verdict this machine recorded inside its freshness window -- reused, the
+ * evidence naming the instant it was observed -- or is asked now, and every
+ * ask that reached a provider is recorded for the next launch. Nothing here
+ * decides what an answer means: reuse changes only whether the provider is
+ * asked, never whether a pass is a pass.
+ *
+ * The read keys on what identifies the provider -- harness, model, the
+ * executable the harness adapter itself resolves -- the same resolution a
+ * probe reports, so a runtime re-labelled between contracts is still one
+ * provider and a provider pointing at another binary is a new question.
+ *
+ * @param {ValidatedContract} contract
+ * @param {string} runDir
+ * @param {SourceIdentity|undefined} sourceIdentity
+ * @param {number} timeoutSec
+ * @returns {Promise<ProbeResult[]>}
+ */
+async function livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec) {
+  const routed = reachableRuntimes(contract);
+  /** @type {Map<string, RuntimeAvailability>} */
+  const fresh = new Map();
+  if (!pendingFreshPreflight) {
+    for (const [id, { runtime }] of routed) {
+      const verdict = readAvailability(availabilityKey({
+        harness: runtime.harness,
+        model: runtime.model,
+        executable: getHarness(runtime.harness).executable(runtime),
+      }));
+      if (verdict) fresh.set(id, verdict);
+    }
+  }
+  if (routed.size > 0 && fresh.size === routed.size) {
+    return [...routed.entries()].map(([id, { runtime }]) => {
+      const verdict = /** @type {RuntimeAvailability} */ (fresh.get(id));
+      return {
+        id,
+        harness: runtime.harness,
+        executable: getHarness(runtime.harness).executable(runtime),
+        model: runtime.model,
+        version: sourceIdentity?.harnessVersions?.[id] ?? null,
+        capabilities: harnessCapabilities(runtime),
+        requiredCapabilities: {},
+        requiredCapabilitySets: [],
+        ok: true,
+        live: true,
+        liveStatus: "reused",
+        detail: `live verdict reused · observed ${verdict.observedAt ?? "unknown instant"}`,
+      };
+    });
+  }
+  const probes = await preflightContract(join(runDir, "contract.json"), { liveTimeoutSec: timeoutSec, persisted: true });
+  // What this launch bought is durable from here on: every ask that reached a
+  // provider -- a refusal included, an answer being an answer -- is recorded
+  // under the provider's own identity. Silence and a command that never
+  // reached a provider are verdicts of nothing and are never recorded, so the
+  // operator who fixes the host is never told the fix "already answered".
+  recordAvailability(
+    probes
+      .filter((probe) => probe.live === true && probe.liveStatus !== "reused" && liveVerdictRecorded(probe))
+      .map((probe) => availabilityKey(probe)),
+    Date.now(),
+  );
+  return probes;
+}
+
+/**
+ * Whether this launch can dispatch anything. Read defensively: a missing
+ * nodes directory or an unparseable state means the launch may dispatch, so
+ * the runtimes are asked.
+ *
+ * @param {string} runDir
+ * @returns {boolean}
+ */
+function launchMayDispatch(runDir) {
+  let names;
+  try {
+    names = readdirSync(join(runDir, "nodes"));
+  } catch {
+    return true;
+  }
+  const states = names.filter((name) => name.endsWith(".json"));
+  if (states.length === 0) return true;
+  return states.some((name) => {
+    try {
+      return JSON.parse(readFileSync(join(runDir, "nodes", name), "utf8")).status !== "done";
+    } catch {
+      return true;
+    }
+  });
+}
+

package/src/engine/runtime-discovery.mjs

@@ -60,7 +60,18 @@ export const DISCOVERY_RUNTIME_DEFINITIONS = Object.freeze({
     costRank: 1,
   },
   "agy-gemini": { harness: "agy", model: "gemini-3.8-flash-low", vendor: "google", tier: 1, costRank: 1 },
+  // Three codex rows, because the harness declares three models and an
+  // account is entitled to only some of them: measured 2026-09-21 on the
+  // owner's ChatGPT account, plain `gpt-5.6` answers HTTP 400 while
+  // `gpt-5.6-sol` answers normally. One row meant `setup` could offer only the
+  // model that account cannot use, and the operator's only way out was to hand
+  // every contract its own catalogue through `--runtimes`. Declaration order is
+  // unchanged, so the composed default is still `codex-gpt`: which of the three
+  // an account can reach is not something this file can know, and the live
+  // preflight is what reports it per id.
   "codex-gpt": { harness: "codex", model: "gpt-5.6", vendor: "openai", tier: 2, costRank: 2 },
+  "codex-sol": { harness: "codex", model: "gpt-5.6-sol", vendor: "openai", tier: 2, costRank: 2 },
+  "codex-luna": { harness: "codex", model: "gpt-5.6-luna", vendor: "openai", tier: 2, costRank: 2 },
   "claude-sonnet": { harness: "claude", model: "claude-sonnet-5", vendor: "anthropic", tier: 2, costRank: 2 },
 });
 
@@ -234,21 +245,42 @@ function tierOrder(runtime) {
 }
 
 /**
- * Span in seconds of every rate-limit window label a harness reports. The
- * labels are claude's `rateLimitType` values (measured 2026-09-17, the
- * `rate_limit_event` line recorded in `src/harnesses/protocol.mjs`); a label
+ * How long a recorded live-preflight verdict stays fresh, in seconds. This is
+ * the hello's own clock and is never derived from the quota windows below: a
+ * spend allowance expires when the provider resets it, a hello expires
+ * because whatever it proved -- a working credential, a spawning binary, a
+ * model that answers -- has stopped holding. Measured 2026-09-22: the ask
+ * costs about 18s for four runtimes in parallel, so every launch that reuses
+ * instead of asking saves about that. The window bets that a provider which
+ * answered still answers for the next quarter hour -- long enough to cover a
+ * burst of relaunches and retries, short enough that whatever died in
+ * between is bought again within fifteen minutes.
+ */
+const PREFLIGHT_FRESH_SEC = 15 * 60;
+
+/** The window label a persisted live-preflight verdict carries. */
+export const PREFLIGHT_WINDOW = "preflight";
+
+/**
+ * Span in seconds of every window label a catalogue or stored record may
+ * carry. `five_hour` and `seven_day` are claude's rate-limit labels (measured
+ * 2026-09-17, the `rate_limit_event` line recorded in
+ * `src/harnesses/protocol.mjs`); `preflight` is the hello's own clock, whose
+ * duration and reasoning live in `PREFLIGHT_FRESH_SEC` above -- the two kinds
+ * of window expire for different reasons and are never one clock. A label
  * missing here cannot prove staleness, so its observation never self-expires.
  *
  * @type {Readonly<Record<string, number>>}
  */
-const AVAILABILITY_WINDOW_SEC = Object.freeze({ five_hour: 5 * 3600, seven_day: 7 * 86400 });
+const AVAILABILITY_WINDOW_SEC = Object.freeze({ five_hour: 5 * 3600, seven_day: 7 * 86400, [PREFLIGHT_WINDOW]: PREFLIGHT_FRESH_SEC });
 
 /**
  * May a runtime be admitted on this catalogue record? Exhaustion is waited
  * out on `exhaustedUntil`; an observation older than its own window reads as
  * unknown and admits nothing, because unknown must not look rested. This is
  * the one home of the rule: plan routing and engine composition both read it,
- * so the null and staleness semantics cannot drift between readers. The
+ * as does the verdict store's reuse decision in `run/availability.mjs`, so
+ * the null and staleness semantics cannot drift between readers. The
  * parameter is typed on the fields the rule reads, not on the full record --
  * the plan's table copy names no `reason`.
  *

package/src/engine/scheduler.mjs

@@ -37,13 +37,11 @@ import { delay, errorCode } from "../util.mjs";
 import { alreadyNotified, emitNodeAdvisories, notifyQueueFor, notifyQueuesByRun, renderCampaignHandoffSafely } from "./notify-queue.mjs";
 import { detectStalls, invocationAlive, terminateProcess } from "./process.mjs";
 import { transition, writeNode } from "./state.mjs";
-import { listNodeSnapshots, readNodeSnapshot } from "../run/node-store.mjs";
 import { render, renderFinalReport, writeFindingsArtifact } from "../report/final.mjs";
 import { operationNextState, providerReceipts, settleInvocation } from "../run/operations.mjs";
 import { appendUsageRecord, invocationCost, invocationUsage, recordInvocationUsage } from "../run/usage.mjs";
 import { captureNodeScopeBoundaries, checkWorkerScope, emptyScope } from "./scope.mjs";
 import { validateContractForLaunch } from "../campaign/chain.mjs";
-import { validateNodeSnapshot } from "../contract/snapshot.mjs";
 import { finalVerificationCommands, sharedVerificationCommands } from "../contract/final-verification.mjs";
 import { startJudge, startWorker } from "./dispatch.mjs";
 import { assertEnvironmentReady, captureRunIdentity, createRunMetadata, serializableContract, statesFingerprint } from "./run-identity.mjs";
@@ -238,6 +236,19 @@ export async function runContract(contractPath, options = {}) {
   }
   const lock = acquireLock(runDir);
   try {
+    // `contract.json` is written before anything else claims a name outside
+    // this directory, because `cancel` is the only verb that releases those
+    // names and it reads the contract from here. Everything below can fail or
+    // be killed -- `runtimeAssignments` probes providers, `captureRunIdentity`
+    // shells out to git, `createRunRef` claims `refs/faberun/<id>/run` -- and a
+    // launch that died between the ref and this write used to leave an
+    // occupied ref plus a run directory `cancel` could not parse: the operator
+    // was refused the directory, deleted it, was then refused the ref, and had
+    // no single verb for either. Written first, the directory is always
+    // cancellable from the instant it exists.
+    mkdirSync(join(runDir, "nodes"), { recursive: true });
+    mkdirSync(join(runDir, "logs"), { recursive: true });
+    writeJsonAtomic(join(runDir, "contract.json"), serializableContract(contract));
     const runtimePlan = await runtimeAssignments(contract);
     const scopeBoundaries = captureNodeScopeBoundaries(contract);
     const sourceIdentity = await captureRunIdentity(contract, scopeBoundaries);
@@ -245,9 +256,6 @@ export async function runContract(contractPath, options = {}) {
     lock.assert();
     const runsDir = runsRoot(contract.cwd);
     const campaign = resolveCampaign(runsDir, contract.campaignId);
-    mkdirSync(join(runDir, "nodes"), { recursive: true });
-    mkdirSync(join(runDir, "logs"), { recursive: true });
-    writeJsonAtomic(join(runDir, "contract.json"), serializableContract(contract));
     writeJsonAtomic(join(runDir, "judge.schema.json"), JUDGE_SCHEMA);
     writeJsonAtomic(join(runDir, "run.json"), createRunMetadata(lock, sourceIdentity, {}, integrationRef));
     registerRun(campaign.path, contract.id);
@@ -315,7 +323,7 @@ export async function runContract(contractPath, options = {}) {
  */
 export async function driveRun(contract, runDir, states, campaign, lock, sourceIdentity, resume = {}, options = {}) {
   lock.assert();
-  assertEnvironmentReady(contract, runDir, sourceIdentity);
+  await assertEnvironmentReady(contract, runDir, sourceIdentity);
   const runsDir = runsRoot(contract.cwd);
   const bootstrapNonce = bootstrapNonceForProcess();
   // Only the CLI entry can answer this: a nonce inherited by evals/run.mjs or
@@ -755,20 +763,3 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
   }
   return { runDir, states, ok: failed.length === 0 };
 }
-
-/**
- * @param {string} runDir
- * @param {ValidatedContract} contract
- * @returns {NodeSnapshot[]}
- */
-export function readRunNodes(runDir, contract) {
-  const names = listNodeSnapshots(runDir);
-  const expected = new Map(contract.nodes.map((node) => [`${node.id}.json`, node]));
-  for (const name of names) if (!expected.has(name)) throw new TypeError(`unexpected persisted node snapshot ${name}`);
-  return contract.nodes.map((node) => {
-    const name = `${node.id}.json`;
-    if (!names.includes(name)) throw new TypeError(`missing persisted node snapshot ${name}`);
-    return validateNodeSnapshot(readNodeSnapshot(runDir, node.id), node);
-  });
-}
-

package/src/engine/scope.mjs

@@ -15,7 +15,7 @@ import { SETTLED } from "./prompts.mjs";
 import { appendTransitionEvent, recordExecutionOverride, transition, writeNode } from "./state.mjs";
 import { attemptWorkspace } from "../repo/worktree.mjs";
 
-import { errorCode, errorMessage, excerpt, isContained } from "../util.mjs";
+import { errorCode, errorMessage, excerpt, isContained, shellWords } from "../util.mjs";
 import { executeControllerVerification } from "./verify.mjs";
 import { providerReceiptsFromInvocationTail, settleInvocation } from "../run/operations.mjs";
 import { readJson } from "../run/store.mjs";
@@ -108,10 +108,17 @@ export function workerScope(taskPacket) {
 
 /**
  * Everything a node's own proofs name: a Definition of Done `path` proof's
- * path, the words of a `command` proof (a command proof carries a display
- * string, not an argv, so a quoted path holding a space is not recovered), the
- * argv of the verification entry a `verification` proof references, and the
- * argv of every verification command the packet declares.
+ * path, the words of a `command` proof, the argv of the verification entry a
+ * `verification` proof references, and the argv of every verification command
+ * the packet declares.
+ *
+ * A command proof carries a display string, not an argv, so its words are
+ * recovered with `shellWords` rather than a whitespace split -- the split lost
+ * exactly what the shell it runs under preserves. Measured 2026-09-22:
+ * `spawn(ref, {shell: true})` hands the whole string to `sh -c`, which groups
+ * `"b c"` into one argument, while the split here cut it into `"b` and `c"`,
+ * so a proof naming a real path with a space cited two fragments that matched
+ * no file and the write it excused read as unexpected.
  *
  * @param {ValidatedNode} node
  * @returns {ProofCitation[]}
@@ -129,7 +136,7 @@ function proofCitations(node) {
     if (proof.kind === "path") {
       citations.push({ tokens: [proof.ref], cwd: ".", literal: true, citation: `${item.id} path proof` });
     } else if (proof.kind === "command") {
-      citations.push({ tokens: proof.ref.split(/\s+/u), cwd: ".", literal: false, citation: `${item.id} command proof` });
+      citations.push({ tokens: shellWords(proof.ref), cwd: ".", literal: false, citation: `${item.id} command proof` });
     } else {
       const command = commands[Number.parseInt(proof.ref, 10)];
       if (command) citations.push({ tokens: command.argv, cwd: command.cwd ?? ".", literal: false, citation: `${item.id} verification[${proof.ref}] proof` });