faberun 0.19.1 → 0.19.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.19.1",
+  "version": "0.19.3",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/skills/faberun/references/contract.md

@@ -46,8 +46,10 @@ typecheck`). Schema version is `3`.
 ```
 
 Every `definitionOfDone` item declares `id`, `text`, and how it is proven:
-`proof.kind` `command` (re-runs the command, capped at `min(timeoutSec, 120s)`)
-or `path` (a file must exist), or `judgment: true` for the judge. `proof: {
+`proof.kind` `command` (re-runs the command through a shell, bounded by the
+node's own `timeoutSec`; quote a flag value containing spaces, which
+`verification`'s argv does not need and a shell splits) or `path` (a file must
+exist), or `judgment: true` for the judge. `proof: {
 kind: "verification", ref: <index> }` reuses a `verification` entry's already
 recorded result by position instead of re-running it — never by comparing argv
 strings, since a joined argv loses shell semantics. A schema-1 string item is
@@ -95,8 +97,11 @@ discovery packet has empty `writeFiles`; with an empty `readFiles` it may
 read the repository read-only to produce an execution packet — the one
 exception to closed scope — otherwise it is closed to the listed files. Each
 `verification` entry is `{argv, cwd?, timeoutSec? (default 120, max 600),
-repeat? (default 1, max 8), env?}` — at most 32 commands, 64 argv items, 32
-KiB argv bytes per command. `env` declares variable *names* only; values
+repeat? (default 1, max 8), env?, requirementId?}` — at most 32 commands, 64
+argv items, 32 KiB argv bytes per command. `requirementId` names the spec
+requirement this command proves, changing nothing about how it runs: it is
+what lets `contract validate` report two copies of one proof that have stopped
+agreeing. `env` declares variable *names* only; values
 never travel in the packet. `prompt`/`promptFile` are
 rejected; a node has `taskPacket` or `taskPacketFile`, never both. Measure a
 candidate command's real duration before naming it in `verification` or a
@@ -289,7 +294,14 @@ only for a harness declaring `streamsOutput` (true for `codex`, `claude`,
 others fall back to `timeoutSec` alone.
 `timeoutSec` (default 2400s) caps one invocation and may be overridden per
 node; a node is bounded by `(1 + maxRevisions) × 2 × timeoutSec`. Both clocks
-are monotonic and pause with host suspend. `maxParallel` above 1 dispatches
+are monotonic and pause with host suspend.
+`maxTurns` (default 150) bounds something else: the *provider requests* one
+attempt may make, overridable per node. Reaching it ends the attempt with
+`errorCode: turn_limit`, sealed then retried once, the spend already spent. It
+bites the nodes that read much and write little — review, synthesis — so raise
+it there; raising `timeoutSec` does not help. The controller says so once at
+80%, and `usage.jsonl` records each invocation's `session.requests`.
+`maxParallel` above 1 dispatches
 every dependency-ready node concurrently, each into its own attempt
 worktree; integration stays serialized. Nodes of one phase need no edge
 between them: a continuation a live invocation already claims is never

package/src/campaign/index.mjs

@@ -132,9 +132,14 @@ export function closeCampaign(campaignPath, { at = new Date().toISOString(), eve
   requireTimestamp(at, "at");
   const campaign = readCampaign(campaignPath);
   if (campaign.status === "closed") throw new Error(`campaign already closed: ${campaign.id}`);
-  if (!readJournalForDedupe(campaignPath).some((entry) => entry.type === "retrospective")) {
+  const journal = readJournalForDedupe(campaignPath);
+  if (!journal.some((entry) => entry.type === "retrospective")) {
     throw new Error(`campaign ${campaign.id} has no recorded retrospective; record one with note --kind retrospective before close`);
   }
+  const unacknowledged = unacknowledgedAdvisories(campaignPath, campaign, journal);
+  if (unacknowledged.length) {
+    throw new Error(`campaign ${campaign.id} has judge findings no note has answered: ${unacknowledged.join("; ")}. Read them with \`faberun findings <run-dir>\`, then name the node in a note (\`campaign note ${campaign.id} --kind outcome --run-id <run-id> --text "...<node>..."\`) before close`);
+  }
   const repoRoot = campaignRepoRoot(campaignPath);
   const ledgerFiles = preserveCampaignLedger(campaignPath, repoRoot);
   // The closure travels on the record itself, computed in one deterministic
@@ -147,6 +152,56 @@ export function closeCampaign(campaignPath, { at = new Date().toISOString(), eve
   return { path: campaignPath, campaign: closed, ledgerFiles };
 }
 
+/**
+ * Judge findings on nodes the gate accepted, which no journal note names.
+ *
+ * A gate that accepts a node whose findings sit below `failOn` is correct and
+ * documented. What was wrong is that the campaign could then be closed with
+ * the finding never read by anyone: measured 2026-09-21, a synthesis node's
+ * `gate.verdict` was `fail` with a real finding, `STATUS` said `passed`, and
+ * the campaign's own retrospective recorded that every gate passed first
+ * time. A close is the last moment the claim can still be corrected.
+ *
+ * Acknowledgement is a note that names the node id. The node id is the
+ * identifier the run, the contract and the findings output all already use,
+ * so matching on it asks the operator for nothing new; matching on a
+ * finding's prose would be matching on text the judge wrote, which is not a
+ * stable name.
+ *
+ * @param {string} campaignPath
+ * @param {Campaign} campaign
+ * @param {{type: string, text?: unknown}[]} journal
+ * @returns {string[]} one `runId/nodeId (N findings, maxSeverity)` per unanswered node, sorted
+ */
+function unacknowledgedAdvisories(campaignPath, campaign, journal) {
+  const runsDir = resolve(campaignPath, "..", "..");
+  const noteText = journal
+    .filter((entry) => typeof entry.text === "string")
+    .map((entry) => /** @type {string} */ (entry.text))
+    .join("\n");
+  /** @type {string[]} */
+  const pending = [];
+  for (const runId of [...campaign.linkedRunIds].sort()) {
+    const contract = readRunJson(join(runsDir, runId, "contract.json"));
+    const nodes = contract !== null && Array.isArray(contract.nodes) ? /** @type {JsonObject[]} */ (contract.nodes) : [];
+    for (const node of nodes) {
+      const nodeId = typeof node.id === "string" ? node.id : "";
+      if (!nodeId) continue;
+      const snapshot = readRunJson(join(runsDir, runId, "nodes", `${nodeId}.json`));
+      if (snapshot === null) continue;
+      // Only an accepted node: on a rejected one the findings are the
+      // rejection itself, and the run already refuses to read as finished.
+      if (snapshot.status !== "done" && snapshot.status !== "no-op") continue;
+      const gate = /** @type {JsonObject|null|undefined} */ (snapshot.gate);
+      const findings = gate && Array.isArray(gate.findings) ? gate.findings : [];
+      if (findings.length === 0) continue;
+      if (noteText.includes(nodeId)) continue;
+      pending.push(`${runId}/${nodeId} (${findings.length} ${findings.length === 1 ? "finding" : "findings"}, ${typeof gate?.maxSeverity === "string" ? gate.maxSeverity : "unknown"})`);
+    }
+  }
+  return pending.sort();
+}
+
 /**
  * The requirement closure a close records: one entry per requirement id the
  * linked runs' contracts declared, correlated only by the identifiers the runs

package/src/campaign/watch.mjs

@@ -0,0 +1,197 @@
+/**
+ * `campaign watch --wake`: the loop that turns a campaign's own records into
+ * the lines an operator is woken with, and the single-watcher lock that keeps
+ * two of them from doubling every wake.
+ *
+ * Separate from `cli/campaign.mjs` because that file owns argv, dispatch and
+ * usage for the campaign verb, and this is neither: it is a long-running
+ * supervisor with a poll interval, an idle policy, a durable dedupe through
+ * the inbox, and a lock with its own staleness rule. `cli/campaign.mjs` keeps
+ * the thin `watch` operation that reads the flags and calls in here.
+ */
+import { closeSync, openSync, readFileSync, unlinkSync, writeSync } from "node:fs";
+import { join } from "node:path";
+import { lockStale, pidAlive, processStartToken, readLock } from "../run/lock.mjs";
+import { readCampaign } from "./record.mjs";
+import { notifyQueueFor } from "../engine/notify-queue.mjs";
+import { appendInbox, readInbox, wakeCapabilityNotice } from "../notify/index.mjs";
+import { errorCode, readJsonTolerant } from "../util.mjs";
+
+/** How often the watcher re-reads the campaign when the operator named no interval. */
+export const DEFAULT_WAKE_POLL_MS = 30_000;
+
+/** How long without a material event before the watcher reports the campaign idle. */
+const WAKE_IDLE_AFTER_MS = 20 * 60_000;
+
+const TERMINAL_NODE_STATUSES = new Set(["done", "no-op", "blocked", "failed", "exhausted", "stalled", "canceled", "cancelled"]);
+const ATTENTION_NODE_STATUSES = new Set(["failed", "exhausted", "stalled", "canceled", "cancelled"]);
+
+/**
+ * The watcher loop. Each line is announced through `notify`, which by default
+ * records it in `<runs-dir>/inbox.jsonl` and delivers it to the campaign's
+ * `notify.jsonl`; the inbox is both the durable record and the dedupe, so a
+ * line already recorded is never re-sent. The injectable seams exist so a
+ * test can drive the loop deterministically.
+ *
+ * @param {string} campaignPath
+ * @param {string} runsDir
+ * @param {{pollMs?: number, once?: boolean, now?: () => number, sleep?: (ms: number) => Promise<void>, emit?: (line: string) => void, notify?: (event: {type: string, campaignId: string, dedupeKey: string, summary: string, runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}) => Promise<void>|void, lock?: {release: () => void}}} [options]
+ * @returns {Promise<void>}
+ */
+export async function watchCampaignWake(campaignPath, runsDir, options = {}) {
+  const pollMs = options.pollMs ?? DEFAULT_WAKE_POLL_MS;
+  const now = options.now ?? (() => Date.now());
+  const sleep = options.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)));
+  const emit = options.emit ?? ((line) => process.stdout.write(`${line}\n`));
+  const notify = options.notify ?? ((event) => notifyQueueFor(campaignPath).enqueue({
+    type: "attention",
+    campaignId: event.campaignId,
+    dedupeKey: event.dedupeKey,
+    summary: event.summary,
+    runId: event.runId ?? null,
+    nodeId: event.nodeId ?? null,
+    status: event.status ?? null,
+    errorCode: event.errorCode ?? null,
+  }));
+  const seen = new Set(readInbox(runsDir).map((entry) => entry.dedupeKey));
+  const lock = options.lock ?? acquireWatchLock(campaignPath);
+  emit(wakeCapabilityNotice());
+  /** @type {Map<string, string>} */
+  const runSignatures = new Map();
+  let lastActiveAt = now();
+  let first = true;
+  try {
+    for (;;) {
+      const campaign = readCampaign(campaignPath);
+      if (campaign.status !== "active") {
+        emit(`campaign-watch: ${campaign.id} is ${campaign.status}; stopping`);
+        return;
+      }
+      /**
+       * Persist first, deliver second: the inbox entry is the durable dedupe,
+       * so a restart or a second watcher skips a line already recorded even
+       * when delivery is injected.
+       *
+       * @param {string} dedupeKey @param {string} summary @param {{runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}} [extra]
+       */
+      const announce = async (dedupeKey, summary, extra = {}) => {
+        if (seen.has(dedupeKey)) return;
+        seen.add(dedupeKey);
+        const appended = appendInbox(runsDir, { type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
+        if (!appended.appended) return;
+        emit(summary);
+        await notify({ type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
+      };
+      let anyActive = false;
+      for (const runId of campaign.linkedRunIds) {
+        const status = /** @type {Record<string, any>|null} */ (readJsonTolerant(join(runsDir, runId, "status.json")));
+        if (!status || !Array.isArray(status.nodes)) continue;
+        const terminal = status.nodes.every((/** @type {any} */ node) => TERMINAL_NODE_STATUSES.has(String(node.status)));
+        const signature = status.nodes.map((/** @type {any} */ node) => `${node.id}:${node.status}:${node.errorCode ?? ""}`).join("|");
+        const previous = runSignatures.get(runId);
+        runSignatures.set(runId, signature);
+        if (!terminal) {
+          anyActive = true;
+          const runLock = readLock(join(runsDir, runId));
+          const stale = !runLock || /** @type {{invalid?: true}} */ (runLock).invalid || lockStale(runLock);
+          if (stale && !first) {
+            await announce(`stale:${runId}`, `campaign-watch: ${runId} has non-terminal nodes but no live controller; resume it`, { runId });
+          }
+        }
+        if (!first && previous !== signature) {
+          for (const node of status.nodes) {
+            const attention = ATTENTION_NODE_STATUSES.has(String(node.status))
+              || (node.status === "blocked" && !(Array.isArray(node.blockedBy) && node.blockedBy.length > 0));
+            if (attention) {
+              const key = `node:${runId}:${node.id}:${node.status}:${node.errorCode ?? ""}`;
+              await announce(
+                key,
+                `campaign-watch: ${runId} node ${node.id} ${node.status}${node.errorCode ? ` [${node.errorCode}]` : ""}${node.note ? ` ${node.note}` : ""}`,
+                { runId, nodeId: String(node.id), status: String(node.status), errorCode: node.errorCode ?? null },
+              );
+            }
+          }
+        }
+        if (terminal) {
+          await announce(`terminal:${runId}`, `campaign-watch: ${runId} terminal · ${status.summary ?? ""}`, { runId });
+        }
+      }
+      const nowMs = now();
+      if (anyActive) lastActiveAt = nowMs;
+      else if (!first && nowMs - lastActiveAt >= WAKE_IDLE_AFTER_MS) {
+        const key = `idle:${Math.floor((nowMs - lastActiveAt) / WAKE_IDLE_AFTER_MS)}`;
+        await announce(key, `campaign-watch: ${campaign.id} active but no run has been active for ${Math.round((nowMs - lastActiveAt) / 60_000)} min; dispatch the next step`);
+      }
+      first = false;
+      if (options.once === true) return;
+      await sleep(pollMs);
+    }
+  } finally {
+    lock.release();
+  }
+}
+
+const WATCH_LOCK_FILE = "watch.lock";
+
+/**
+ * A durable campaign-watch lock, one watcher per campaign across processes.
+ * A live holder is never taken over; a dead or recycled pid's lock is stale
+ * and is replaced, so a restart after a crash is not blocked. The same
+ * liveness rule as the controller lock: a pid is dead only when the probe
+ * proves it.
+ *
+ * @param {string} campaignPath
+ * @returns {{pid: number, processStartToken: string|null, startedAt: string, release: () => void}}
+ */
+export function acquireWatchLock(campaignPath) {
+  const path = join(campaignPath, WATCH_LOCK_FILE);
+  /** @type {{pid?: number, processStartToken?: string|null, startedAt?: string}} */
+  let occupant = {};
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    const record = { pid: process.pid, processStartToken: processStartToken(process.pid), startedAt: new Date().toISOString() };
+    try {
+      const fd = openSync(path, "wx", 0o600);
+      try {
+        writeSync(fd, JSON.stringify(record));
+      } finally {
+        closeSync(fd);
+      }
+      return {
+        ...record,
+        release() {
+          try {
+            unlinkSync(path);
+          } catch (error) {
+            if (errorCode(error) !== "ENOENT") throw error;
+          }
+        },
+      };
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+    }
+    try {
+      occupant = /** @type {{pid?: number, processStartToken?: string|null}} */ (JSON.parse(readFileSync(path, "utf8")));
+    } catch {
+      occupant = {};
+    }
+    if (!watchLockStale(occupant)) {
+      throw new Error(`campaign watch is already running (pid ${occupant.pid})`);
+    }
+    try {
+      unlinkSync(path);
+    } catch (error) {
+      if (errorCode(error) !== "ENOENT") throw error;
+    }
+  }
+  throw new Error("campaign watch lock contention did not settle");
+}
+
+/**
+ * @param {{pid?: number, processStartToken?: string|null}} occupant
+ * @returns {boolean}
+ */
+function watchLockStale(occupant) {
+  if (typeof occupant.pid !== "number") return true;
+  if (!pidAlive(occupant.pid)) return true;
+  return Boolean(occupant.processStartToken) && processStartToken(occupant.pid) !== occupant.processStartToken;
+}

package/src/cli/campaign.mjs

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { closeSync, openSync, readFileSync, unlinkSync, writeSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { parseArgs as parseFlags } from "node:util";
 import {
@@ -11,25 +11,19 @@ import {
   resolveCampaign,
 } from "../campaign/index.mjs";
 import { addContract, replaceContract } from "./campaign-contract.mjs";
-import { lockStale, pidAlive, processStartToken, readLock } from "../run/lock.mjs";
 import { runsRoot } from "../run/paths.mjs";
 import { syncAgentSignal } from "../repo/signal.mjs";
 import { acknowledgeJournalEvent, appendJournal, appendSeatAllowanceEvent, readJournal, watchJournal } from "../campaign/journal.mjs";
 import { driveCampaignChain } from "../campaign/chain.mjs";
 import { unparkCampaign } from "../campaign/unpark.mjs";
 import { readCampaign } from "../campaign/record.mjs";
-import { notifyQueueFor } from "../engine/notify-queue.mjs";
-import { appendInbox, readInbox, wakeCapabilityNotice } from "../notify/index.mjs";
+import { DEFAULT_WAKE_POLL_MS, watchCampaignWake } from "../campaign/watch.mjs";
 import { allowanceEventFields, sampleAllowance } from "../seat/allowance.mjs";
 import { detectOperatorHarness } from "../seat/harnesses.mjs";
 import { detachArgv, detachSelf, waitForBootstrap } from "./launch.mjs";
-import { errorCode, readJsonTolerant } from "../util.mjs";
+import { readJsonTolerant } from "../util.mjs";
 
 const SYNC_OUTPUT_MAX_BYTES = 8000;
-const DEFAULT_WAKE_POLL_MS = 30_000;
-const WAKE_IDLE_AFTER_MS = 20 * 60_000;
-const TERMINAL_NODE_STATUSES = new Set(["done", "no-op", "blocked", "failed", "exhausted", "stalled", "canceled", "cancelled"]);
-const ATTENTION_NODE_STATUSES = new Set(["failed", "exhausted", "stalled", "canceled", "cancelled"]);
 
 const NOTE_KINDS = new Set([
   "intent",
@@ -159,177 +153,6 @@ async function watch(campaignId, values) {
   await watchCampaignWake(path, runsDir, { pollMs, once: values.once === true });
 }
 
-/**
- * The watcher loop. Each line is announced through `notify`, which by default
- * records it in `<runs-dir>/inbox.jsonl` and delivers it to the campaign's
- * `notify.jsonl`; the inbox is both the durable record and the dedupe, so a
- * line already recorded is never re-sent. The injectable seams exist so a
- * test can drive the loop deterministically.
- *
- * @param {string} campaignPath
- * @param {string} runsDir
- * @param {{pollMs?: number, once?: boolean, now?: () => number, sleep?: (ms: number) => Promise<void>, emit?: (line: string) => void, notify?: (event: {type: string, campaignId: string, dedupeKey: string, summary: string, runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}) => Promise<void>|void, lock?: {release: () => void}}} [options]
- * @returns {Promise<void>}
- */
-export async function watchCampaignWake(campaignPath, runsDir, options = {}) {
-  const pollMs = options.pollMs ?? DEFAULT_WAKE_POLL_MS;
-  const now = options.now ?? (() => Date.now());
-  const sleep = options.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)));
-  const emit = options.emit ?? ((line) => process.stdout.write(`${line}\n`));
-  const notify = options.notify ?? ((event) => notifyQueueFor(campaignPath).enqueue({
-    type: "attention",
-    campaignId: event.campaignId,
-    dedupeKey: event.dedupeKey,
-    summary: event.summary,
-    runId: event.runId ?? null,
-    nodeId: event.nodeId ?? null,
-    status: event.status ?? null,
-    errorCode: event.errorCode ?? null,
-  }));
-  const seen = new Set(readInbox(runsDir).map((entry) => entry.dedupeKey));
-  const lock = options.lock ?? acquireWatchLock(campaignPath);
-  emit(wakeCapabilityNotice());
-  /** @type {Map<string, string>} */
-  const runSignatures = new Map();
-  let lastActiveAt = now();
-  let first = true;
-  try {
-    for (;;) {
-      const campaign = readCampaign(campaignPath);
-      if (campaign.status !== "active") {
-        emit(`campaign-watch: ${campaign.id} is ${campaign.status}; stopping`);
-        return;
-      }
-      /**
-       * Persist first, deliver second: the inbox entry is the durable dedupe,
-       * so a restart or a second watcher skips a line already recorded even
-       * when delivery is injected.
-       *
-       * @param {string} dedupeKey @param {string} summary @param {{runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}} [extra]
-       */
-      const announce = async (dedupeKey, summary, extra = {}) => {
-        if (seen.has(dedupeKey)) return;
-        seen.add(dedupeKey);
-        const appended = appendInbox(runsDir, { type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
-        if (!appended.appended) return;
-        emit(summary);
-        await notify({ type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
-      };
-      let anyActive = false;
-      for (const runId of campaign.linkedRunIds) {
-        const status = /** @type {Record<string, any>|null} */ (readJsonTolerant(join(runsDir, runId, "status.json")));
-        if (!status || !Array.isArray(status.nodes)) continue;
-        const terminal = status.nodes.every((/** @type {any} */ node) => TERMINAL_NODE_STATUSES.has(String(node.status)));
-        const signature = status.nodes.map((/** @type {any} */ node) => `${node.id}:${node.status}:${node.errorCode ?? ""}`).join("|");
-        const previous = runSignatures.get(runId);
-        runSignatures.set(runId, signature);
-        if (!terminal) {
-          anyActive = true;
-          const runLock = readLock(join(runsDir, runId));
-          const stale = !runLock || /** @type {{invalid?: true}} */ (runLock).invalid || lockStale(runLock);
-          if (stale && !first) {
-            await announce(`stale:${runId}`, `campaign-watch: ${runId} has non-terminal nodes but no live controller; resume it`, { runId });
-          }
-        }
-        if (!first && previous !== signature) {
-          for (const node of status.nodes) {
-            const attention = ATTENTION_NODE_STATUSES.has(String(node.status))
-              || (node.status === "blocked" && !(Array.isArray(node.blockedBy) && node.blockedBy.length > 0));
-            if (attention) {
-              const key = `node:${runId}:${node.id}:${node.status}:${node.errorCode ?? ""}`;
-              await announce(
-                key,
-                `campaign-watch: ${runId} node ${node.id} ${node.status}${node.errorCode ? ` [${node.errorCode}]` : ""}${node.note ? ` ${node.note}` : ""}`,
-                { runId, nodeId: String(node.id), status: String(node.status), errorCode: node.errorCode ?? null },
-              );
-            }
-          }
-        }
-        if (terminal) {
-          await announce(`terminal:${runId}`, `campaign-watch: ${runId} terminal · ${status.summary ?? ""}`, { runId });
-        }
-      }
-      const nowMs = now();
-      if (anyActive) lastActiveAt = nowMs;
-      else if (!first && nowMs - lastActiveAt >= WAKE_IDLE_AFTER_MS) {
-        const key = `idle:${Math.floor((nowMs - lastActiveAt) / WAKE_IDLE_AFTER_MS)}`;
-        await announce(key, `campaign-watch: ${campaign.id} active but no run has been active for ${Math.round((nowMs - lastActiveAt) / 60_000)} min; dispatch the next step`);
-      }
-      first = false;
-      if (options.once === true) return;
-      await sleep(pollMs);
-    }
-  } finally {
-    lock.release();
-  }
-}
-
-const WATCH_LOCK_FILE = "watch.lock";
-
-/**
- * A durable campaign-watch lock, one watcher per campaign across processes.
- * A live holder is never taken over; a dead or recycled pid's lock is stale
- * and is replaced, so a restart after a crash is not blocked. The same
- * liveness rule as the controller lock: a pid is dead only when the probe
- * proves it.
- *
- * @param {string} campaignPath
- * @returns {{pid: number, processStartToken: string|null, startedAt: string, release: () => void}}
- */
-export function acquireWatchLock(campaignPath) {
-  const path = join(campaignPath, WATCH_LOCK_FILE);
-  /** @type {{pid?: number, processStartToken?: string|null, startedAt?: string}} */
-  let occupant = {};
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const record = { pid: process.pid, processStartToken: processStartToken(process.pid), startedAt: new Date().toISOString() };
-    try {
-      const fd = openSync(path, "wx", 0o600);
-      try {
-        writeSync(fd, JSON.stringify(record));
-      } finally {
-        closeSync(fd);
-      }
-      return {
-        ...record,
-        release() {
-          try {
-            unlinkSync(path);
-          } catch (error) {
-            if (errorCode(error) !== "ENOENT") throw error;
-          }
-        },
-      };
-    } catch (error) {
-      if (errorCode(error) !== "EEXIST") throw error;
-    }
-    try {
-      occupant = /** @type {{pid?: number, processStartToken?: string|null}} */ (JSON.parse(readFileSync(path, "utf8")));
-    } catch {
-      occupant = {};
-    }
-    if (!watchLockStale(occupant)) {
-      throw new Error(`campaign watch is already running (pid ${occupant.pid})`);
-    }
-    try {
-      unlinkSync(path);
-    } catch (error) {
-      if (errorCode(error) !== "ENOENT") throw error;
-    }
-  }
-  throw new Error("campaign watch lock contention did not settle");
-}
-
-/**
- * @param {{pid?: number, processStartToken?: string|null}} occupant
- * @returns {boolean}
- */
-function watchLockStale(occupant) {
-  if (typeof occupant.pid !== "number") return true;
-  if (!pidAlive(occupant.pid)) return true;
-  return Boolean(occupant.processStartToken) && processStartToken(occupant.pid) !== occupant.processStartToken;
-}
-
-
 /**
  * @param {string} campaignId
  * @param {CliValues} values
@@ -467,9 +290,38 @@ function close(campaignId, values) {
   renderHandoff(path, runsDir);
   process.stdout.write(`[campaign] ${closed.campaign.id} closed\n`);
   process.stdout.write(`[campaign] ledger · docs/campaigns/${closed.campaign.id}/ledger · ${closed.ledgerFiles.length} files\n`);
+  reportRequirementClosure(closed.campaign.requirements ?? []);
   if (syncAgentSignal(runsDir)) process.stdout.write(`[campaign] AGENTS.md signal updated\n`);
 }
 
+/**
+ * Say out loud what the close just wrote, and what it measured.
+ *
+ * The record is a correlation between the requirement ids a linked run's
+ * contract declared and the node snapshots that reached `done` carrying them.
+ * It reads the run directory and never the branch, so a requirement the
+ * operator delivered by hand -- because its node blocked, which happens --
+ * lands in the record as `open` while the work is on main. Measured
+ * 2026-09-22 on `availability-is-verified-not-assumed`: R4 read `open` with
+ * an empty `nodes` array and was merged in `a6a5d43`.
+ *
+ * Nothing printed this before, so the only way to meet the closure was to
+ * open the JSON, where `open` reads as "not delivered" instead of "no node of
+ * this campaign proved it". Naming the measurement is the whole fix: a close
+ * cannot know what it did not run.
+ *
+ * @param {import("../campaign/index.mjs").RequirementClosure[]} requirements
+ */
+function reportRequirementClosure(requirements) {
+  if (requirements.length === 0) return;
+  const open = requirements.filter((entry) => entry.status !== "covered");
+  const covered = requirements.length - open.length;
+  process.stdout.write(`[campaign] requirements · ${covered}/${requirements.length} carried by a node that reached done\n`);
+  if (open.length === 0) return;
+  process.stdout.write(`[campaign] no done node carried ${open.map((entry) => entry.requirementId).join(", ")}\n`);
+  process.stdout.write("[campaign] closure reads node snapshots, never the branch: a requirement delivered outside a node reads open here\n");
+}
+
 /**
  * `campaign supervise <id>` (also spelled `supervise campaign <id>`): the
  * idempotent re-invocation that drives the manifest. It takes the campaign's

package/src/cli/launch.mjs

@@ -55,8 +55,14 @@ export function detachSelf(command, target, extraArgs = []) {
  * exactly as for every detached controller: a foreground launcher is the only
  * moment an operator is present.
  *
+ * `stdio` overrides the discarded default for a caller that has somewhere
+ * durable to put the child's output. A detached *run* wants the default: its
+ * bootstrap record is the channel, and a controller's real output belongs in
+ * the run directory. A detached *plan* has no bootstrap record, so discarding
+ * its stdio discarded the only account of why it died.
+ *
  * @param {string[]} argv
- * @param {{nonce?: string, env?: NodeJS.ProcessEnv}} [options]
+ * @param {{nonce?: string, env?: NodeJS.ProcessEnv, stdio?: import("node:child_process").StdioOptions}} [options]
  * @returns {DetachedChild}
  */
 export function detachArgv(argv, options = {}) {
@@ -74,7 +80,7 @@ export function detachArgv(argv, options = {}) {
     // pending forever. There it also means DETACHED_PROCESS: no console
     // window, which is what "ignore" stdio already implies.
     detached: true,
-    stdio: "ignore",
+    stdio: options.stdio ?? "ignore",
   }));
   child.unref();
   child.bootstrapNonce = nonce;