faberun 0.19.1 → 0.19.3

package/src/cli/plan.mjs

@@ -4,8 +4,8 @@
  * contested. This file only owns the wire — `src/plan/pipeline.mjs` owns the
  * sequencing and every decision the pipeline makes.
  */
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import { detachArgv, detachSelf, waitForBootstrap } from "./launch.mjs";
 import { classifyRunProgress } from "../campaign/chain.mjs";
 import { runProgress } from "../engine/supervise.mjs";
@@ -15,11 +15,23 @@ import { validateFinalVerification, validateSharedVerification } from "../contra
 import { colorLevel, statusToken } from "./brand.mjs";
 import { delay } from "../util.mjs";
 import { runPlanningPipeline } from "../plan/pipeline.mjs";
-import { runDirectory } from "../run/paths.mjs";
+import { campaignTree, runDirectory } from "../run/paths.mjs";
+import { readCampaign } from "../campaign/record.mjs";
 
 /** How often a foreground `plan` polls a launched stage's run directory. */
 const DEFAULT_POLL_MS = 1_000;
 
+/**
+ * How long a `--detach` launcher stays to see whether the planning process it
+ * started is actually up. Long enough to cover the bootstrap work that fails
+ * synchronously -- spec read, strict validation, catalogue load, the runtime
+ * ask -- and short enough that a launcher is not a supervisor: past this
+ * window, a planning run that dies is a running campaign's problem and leaves
+ * its evidence in the run directory, not here.
+ */
+const PLAN_BOOTSTRAP_WINDOW_MS = 5_000;
+const PLAN_BOOTSTRAP_POLL_MS = 100;
+
 /**
  * `--runtime-defaults worker=<id>,judge=<id>`, either key optional, comma
  * separated. Absent entirely, the pipeline falls through to plain
@@ -114,7 +126,7 @@ export function loadVerificationSuites(path) {
 
 /**
  * @param {string} target
- * @param {{campaign?: string, phase?: string, "review-rounds"?: string, "approve-below"?: string, "runtime-defaults"?: string, runtimes?: string, verification?: string, detach?: boolean, json?: boolean}} values
+ * @param {{campaign?: string, phase?: string, "review-rounds"?: string, "approve-below"?: string, "runtime-defaults"?: string, runtimes?: string, verification?: string, package?: string, "targeted-fix"?: boolean, detach?: boolean, json?: boolean}} values
  * @returns {Promise<void>}
  */
 export async function planCli(target, values) {
@@ -131,6 +143,7 @@ export async function planCli(target, values) {
   const verification = typeof values.verification === "string" && values.verification
     ? loadVerificationSuites(values.verification)
     : {};
+  const packageMode = packageModeOf(values.package);
 
   if (values.detach === true) {
     const argv = ["plan", specPath, "--campaign", campaignId, "--phase", phase, "--review-rounds", String(reviewRounds)];
@@ -138,35 +151,71 @@ export async function planCli(target, values) {
     if (values["runtime-defaults"] !== undefined) argv.push("--runtime-defaults", values["runtime-defaults"]);
     if (typeof values.runtimes === "string" && values.runtimes) argv.push("--runtimes", resolve(values.runtimes));
     if (typeof values.verification === "string" && values.verification) argv.push("--verification", resolve(values.verification));
+    if (packageMode !== "implementation") argv.push("--package", packageMode);
+    if (values["targeted-fix"] === true) argv.push("--targeted-fix");
+    const failurePath = planBootstrapFailurePath(process.cwd(), campaignId, phase);
+    // Read the campaign before creating anything: the failure record lives
+    // inside the campaign tree, so a typo in --campaign would otherwise leave
+    // a campaign directory with no record in it for `discoverCampaigns` to
+    // find. The child reads it too; this is the launcher refusing what it can
+    // see for itself rather than detaching into a certain failure.
+    readCampaign(campaignTree(process.cwd(), campaignId));
+    mkdirSync(dirname(failurePath), { recursive: true });
+    rmSync(failurePath, { force: true });
     const child = detachArgv(argv);
     if (child.pid === undefined) throw new Error("detached plan has no pid");
+    // The child's stdio is discarded (detachArgv), so a planning run that dies
+    // during bootstrap used to take its own reason with it while the launcher
+    // had already printed a pid and exited 0. Measured 2026-09-21 on macOS and
+    // Linux the same day: a run died after collecting repo facts and the stderr
+    // went with the closed connection. Waiting out a bounded window is the
+    // whole check -- a controller still alive past it is up, and one that is
+    // not has written why.
+    const failure = await watchPlanBootstrap(child, failurePath);
+    if (failure) {
+      process.stderr.write(`[plan] bootstrap failed · ${failure.error}\n[plan] recorded at ${failurePath}\n`);
+      process.exitCode = 1;
+      return;
+    }
     process.stdout.write(`[plan] detached · pid ${child.pid} · ${specPath}\n`);
     return;
   }
 
-  const result = await runPlanningPipeline({
-    specPath,
-    campaignId,
-    phase,
-    reviewRounds,
-    approveBelow,
-    runtimeDefaults,
-    runtimes,
-    verification,
-    launch: async (contractPath, contract) => {
-      const child = detachSelf("run", contractPath);
-      if (child.pid === undefined) throw new Error("detached planning run has no pid");
-      await waitForBootstrap(runDirectory(contract.cwd, contract.id), child.pid, child);
-    },
-    wait: async (runDir) => {
-      for (;;) {
-        const progress = runProgress(runDir);
-        const classification = classifyRunProgress(progress);
-        if (classification !== "unfinished" && classification !== "waiting") return progress;
-        await delay(DEFAULT_POLL_MS);
-      }
-    },
-  });
+  // A detached child arrives here with its stdio already discarded, so what
+  // it throws reaches nobody unless it is written down first. The record is
+  // written on every path, detached or not: a foreground failure that also
+  // leaves the file costs nothing and reads the same.
+  let result;
+  try {
+    result = await runPlanningPipeline({
+      specPath,
+      campaignId,
+      phase,
+      reviewRounds,
+      approveBelow,
+      runtimeDefaults,
+      runtimes,
+      verification,
+      targetedFix: values["targeted-fix"] === true,
+      packageMode,
+      launch: async (contractPath, contract) => {
+        const child = detachSelf("run", contractPath);
+        if (child.pid === undefined) throw new Error("detached planning run has no pid");
+        await waitForBootstrap(runDirectory(contract.cwd, contract.id), child.pid, child);
+      },
+      wait: async (runDir) => {
+        for (;;) {
+          const progress = runProgress(runDir);
+          const classification = classifyRunProgress(progress);
+          if (classification !== "unfinished" && classification !== "waiting") return progress;
+          await delay(DEFAULT_POLL_MS);
+        }
+      },
+    });
+  } catch (error) {
+    writePlanBootstrapFailure(process.cwd(), campaignId, phase, error instanceof Error ? error : new Error(String(error)));
+    throw error;
+  }
 
   if (values.json === true) {
     process.stdout.write(`${JSON.stringify(result)}\n`);
@@ -180,3 +229,100 @@ export async function planCli(target, values) {
   for (const warning of result.warnings) process.stdout.write(`${statusToken("warn", colorLevel(process.env, process.stdout.isTTY))} ${warning}\n`);
   process.stdout.write(`[plan] ${campaignId} phase ${phase} frozen · approved ${result.approved} · ${result.contractPath}\n`);
 }
+
+/**
+ * Where a detached planning run records why it never came up. It sits beside
+ * the phase's durable plan artifacts rather than in the disposable scratch
+ * tree, and it is derived from campaign and phase alone -- the launcher and
+ * the child compute the same path without either having to parse the spec.
+ *
+ * @param {string} cwd
+ * @param {string} campaignId
+ * @param {string} phase
+ * @returns {string}
+ */
+export function planBootstrapFailurePath(cwd, campaignId, phase) {
+  return join(campaignTree(cwd, campaignId), "plans", phase, "bootstrap-failure.json");
+}
+
+/**
+ * Record a detached planning run's bootstrap failure where its launcher can
+ * read it. Best effort: a failure to write this must never replace the
+ * failure it was describing.
+ *
+ * @param {string} cwd
+ * @param {string} campaignId
+ * @param {string} phase
+ * @param {Error} error
+ * @returns {void}
+ */
+export function writePlanBootstrapFailure(cwd, campaignId, phase, error) {
+  try {
+    const path = planBootstrapFailurePath(cwd, campaignId, phase);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify({ at: new Date().toISOString(), pid: process.pid, campaignId, phase, error: error.message }, null, 2)}\n`);
+  } catch {
+    // Nothing left to do: the caller is already reporting the real failure.
+  }
+}
+
+/**
+ * Watch a freshly detached planning child through its bootstrap window.
+ *
+ * Returns the recorded failure when the child died inside the window, and
+ * null when it is still running at the end of it. A child that exits zero
+ * inside the window also reads as no failure: a planning run can legitimately
+ * be that fast only by refusing early, and it will have written its own
+ * record if it refused.
+ *
+ * @param {import("node:child_process").ChildProcess} child
+ * @param {string} failurePath
+ * @param {{windowMs?: number, pollMs?: number}} [options]
+ * @returns {Promise<{error: string}|null>}
+ */
+export async function watchPlanBootstrap(child, failurePath, { windowMs = PLAN_BOOTSTRAP_WINDOW_MS, pollMs = PLAN_BOOTSTRAP_POLL_MS } = {}) {
+  let exitCode = /** @type {number|null|undefined} */ (undefined);
+  let exited = false;
+  child.once("exit", (code) => { exited = true; exitCode = code; });
+  const deadline = Date.now() + windowMs;
+  while (Date.now() < deadline) {
+    // Typed checks, not `!== null`: a child object that never carried the
+    // property at all would otherwise read as one that has already exited.
+    if (exited || typeof child.exitCode === "number" || typeof child.signalCode === "string") {
+      const recorded = readPlanBootstrapFailure(failurePath);
+      if (recorded) return recorded;
+      const code = typeof exitCode === "number" ? exitCode : child.exitCode;
+      if (typeof code === "number" && code !== 0) return { error: `the detached planning process exited ${code} without recording a reason` };
+      const signal = child.signalCode;
+      if (typeof signal === "string") return { error: `the detached planning process was killed by ${signal} without recording a reason` };
+      return null;
+    }
+    await delay(pollMs);
+  }
+  return null;
+}
+
+/** @param {string} failurePath @returns {{error: string}|null} */
+function readPlanBootstrapFailure(failurePath) {
+  try {
+    const record = JSON.parse(readFileSync(failurePath, "utf8"));
+    return typeof record?.error === "string" ? { error: record.error } : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `--package implementation|exploratory`. Implementation is the default and
+ * the only mode there was: nodes sized by their write set. Exploratory sizes
+ * by what a node reads, accepts a one-file write set as the normal shape of a
+ * finding, and reports a node whose read surface dwarfs its siblings'.
+ *
+ * @param {unknown} value
+ * @returns {import("../plan/sizing.mjs").PackageMode}
+ */
+export function packageModeOf(value) {
+  if (value === undefined) return "implementation";
+  if (value === "implementation" || value === "exploratory") return value;
+  throw new Error(`--package must be implementation or exploratory: ${String(value)}`);
+}

package/src/cli/spec.mjs

@@ -14,7 +14,7 @@ import { validateSpec } from "../plan/spec.mjs";
 /** Flags are scoped to the operation that declares them; all others are rejected. */
 /** @type {Record<string, import("node:util").ParseArgsOptionsConfig>} */
 const OPERATION_OPTIONS = {
-  validate: { "strict-traceability": { type: "boolean" }, json: { type: "boolean" } },
+  validate: { "strict-traceability": { type: "boolean" }, "run-proofs": { type: "boolean" }, json: { type: "boolean" } },
   scaffold: { id: { type: "string" } },
 };
 
@@ -63,9 +63,13 @@ export function specCli(args) {
   }
   const target = parsed.positionals[0];
   if (!target || parsed.positionals.length > 1) return usage();
-  const values = /** @type {{"strict-traceability"?: boolean, json?: boolean, id?: string}} */ (parsed.values);
+  const values = /** @type {{"strict-traceability"?: boolean, "run-proofs"?: boolean, json?: boolean, id?: string}} */ (parsed.values);
   if (operation === "validate") {
-    validateSpecFile(resolve(target), { strict: values["strict-traceability"] === true, json: values.json === true });
+    validateSpecFile(resolve(target), {
+      strict: values["strict-traceability"] === true,
+      runProofs: values["run-proofs"] === true,
+      json: values.json === true,
+    });
     return;
   }
   try {
@@ -80,12 +84,18 @@ export function specCli(args) {
  * Validate a spec file and print its class, its overall verdict, and one
  * line per finding. Exits `1` when the verdict is not `ok`.
  *
+ * `runProofs` is the only operation here that spawns anything: it runs each
+ * requirement's declared proof instead of only checking that one is written
+ * down. It is opt-in because running a repository's proofs costs real time,
+ * and default-off keeps `spec validate` the deterministic, side-effect-free
+ * read it has always been.
+ *
  * @param {string} path
- * @param {{strict: boolean, json: boolean}} options
+ * @param {{strict: boolean, json: boolean, runProofs?: boolean}} options
  * @returns {SpecValidation}
  */
-export function validateSpecFile(path, { strict, json }) {
-  const result = validateSpec(readFileSync(path, "utf8"), { cwd: process.cwd(), strict });
+export function validateSpecFile(path, { strict, json, runProofs = false }) {
+  const result = validateSpec(readFileSync(path, "utf8"), { cwd: process.cwd(), strict, runProofs });
   if (json) {
     process.stdout.write(`${JSON.stringify(result)}\n`);
   } else {
@@ -112,7 +122,7 @@ export function scaffoldSpec(path, id) {
 
 /** @returns {void} */
 function usage() {
-  process.stderr.write("usage: faberun spec <validate|scaffold> <path> [--strict-traceability] [--json] [--id <value>]\n");
+  process.stderr.write("usage: faberun spec <validate|scaffold> <path> [--strict-traceability] [--run-proofs] [--json] [--id <value>]\n");
   process.exitCode = 2;
 }
 

package/src/cli.mjs

@@ -123,6 +123,8 @@ export const COMMAND_OPTIONS = {
     "runtime-defaults": { type: "string" },
     runtimes: { type: "string" },
     verification: { type: "string" },
+    package: { type: "string" },
+    "targeted-fix": { type: "boolean" },
     detach: { type: "boolean" },
     json: { type: "boolean" },
   },

package/src/contract/definition-of-done.mjs

@@ -95,3 +95,53 @@ function validateVerificationRef(value, label, options) {
   return String(index);
 }
 
+/**
+ * A `kind: "command"` proof's `ref` runs through a shell (`judge-gate.mjs`'s
+ * `proveCommand`), while a task packet's `verification` entries run as argv
+ * arrays -- the opposite quoting convention for the same author intent.
+ * Measured 2026-09-22: six DoD refs on one campaign wrote
+ * `--test-name-pattern=a b c` the way an argv array would take it, the shell
+ * split it into three words, and the gate rejected work whose identical
+ * command had just passed as verification. Nothing warned the author, because
+ * a shell that receives extra bare words after an unquoted flag value does not
+ * itself know they were meant to be one argument.
+ *
+ * This flags the same shape rather than every proof: a node:test filter flag
+ * (the flags `declaredTestFilters` in judge-gate.mjs recognizes) whose
+ * unquoted value is immediately followed by bare words is the pattern the
+ * incident measured, and it is precise enough that a legitimate `ref` rarely
+ * has trailing bare words right after such a flag by accident.
+ *
+ * @param {DefinitionOfDoneItem[]} items
+ * @param {number} index
+ * @returns {string[]}
+ */
+export function unquotedFilterValueWarnings(items, index) {
+  /** @type {string[]} */
+  const warnings = [];
+  items.forEach((item, itemIndex) => {
+    if (item.proof?.kind !== "command") return;
+    const tokens = item.proof.ref.split(/\s+/u).filter(Boolean);
+    for (const flag of TEST_FILTER_FLAGS) {
+      for (let position = 0; position < tokens.length; position++) {
+        const prefix = `${flag}=`;
+        if (!tokens[position].startsWith(prefix)) continue;
+        const value = tokens[position].slice(prefix.length);
+        if (/^['"]/u.test(value)) continue;
+        let end = position + 1;
+        while (end < tokens.length && !tokens[end].startsWith("-")) end++;
+        if (end === position + 1) continue;
+        const spilled = [value, ...tokens.slice(position + 1, end)].join(" ");
+        warnings.push(
+          `nodes[${index}] (definitionOfDone[${itemIndex}]): proof.ref's ${flag} value "${spilled}" is unquoted; ` +
+          `kind: "command" runs through a shell, unlike taskPacket.verification's argv, so the space splits it into extra words -- quote it as ${flag}="${spilled}"`,
+        );
+      }
+    }
+  });
+  return warnings;
+}
+
+/** The node:test filter flags a `kind: "command"` proof's shell can split on an unquoted value. */
+const TEST_FILTER_FLAGS = ["--test-name-pattern", "--test-skip-pattern"];
+

package/src/contract/final-verification.mjs

@@ -60,6 +60,27 @@ export function sharedVerificationCommands(contract) {
   return contract.sharedVerification ?? [];
 }
 
+/**
+ * The timeout a Definition of Done `command` proof is spawned with. It used
+ * to be capped at a hardcoded 120s regardless of what the node's own attempt
+ * was given, so a contract that raised `timeoutSec` to run a slow command as
+ * `taskPacket.verification` still had the identical command fail its DoD
+ * proof on the same run: measured 2026-09-22, six proofs rejected work whose
+ * argv had just passed with a `timeoutSec` well past 120s. A command proof
+ * gets the same budget the node's own attempt has, because that is the
+ * budget the author already reasoned about; nothing here invents a second
+ * number for the gate to disagree with. Shared by `dispatch.mjs` (the actual
+ * spawn) and `scheduler.mjs` (the freeze-detection budget that must not judge
+ * a node frozen before its own gate's timeout has had a chance to fire).
+ *
+ * @param {{timeoutSec?: number}} node
+ * @param {{timeoutSec?: number}} contract
+ * @returns {number}
+ */
+export function gateProofTimeoutMs(node, contract) {
+  return Math.max(1_000, (node.timeoutSec ?? contract.timeoutSec ?? 60) * 1_000);
+}
+
 /**
  * Whether no other node in the contract depends on this one. `finalVerification`
  * is a candidate to run on a phase-terminal node only; a node with a dependant

package/src/contract/index.mjs

@@ -3,9 +3,9 @@ import { readFileSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { loadTaskPacket, renderWorkerPrompt } from "./task-packet.mjs";
 import { RESERVED_ARTICLES } from "./articles.mjs";
-import { validateDefinitionOfDone } from "./definition-of-done.mjs";
+import { unquotedFilterValueWarnings, validateDefinitionOfDone } from "./definition-of-done.mjs";
 import { validateFinalVerification, validateSharedVerification } from "./final-verification.mjs";
-import { VERIFICATION_LIMITS } from "./verification.mjs";
+import { VERIFICATION_LIMITS, requirementProofWarnings } from "./verification.mjs";
 import {
   validateCapabilityRequirements,
 } from "../harnesses/index.mjs";
@@ -374,12 +374,24 @@ export function validateContract(raw, contractPath, options = {}) {
   const sharedVerification = validateSharedVerification(raw.sharedVerification, "contract.sharedVerification");
   const contractCommands = [...finalVerification ?? [], ...sharedVerification ?? []].map((command) => command.argv.join(" "));
   const contractWrites = new Set(nodes.flatMap((node) => node.taskPacket.writeFiles ?? []));
-  const warnings = nodes.flatMap((node, index) => [
-    ...commandCoverageWarnings(node, index),
-    ...(persisted ? [] : mirrorCoverageWarnings(node, index, cwd, contractCommands, contractWrites)),
-    ...(persisted ? [] : unsnapshottedWriteWarnings(node, index, cwd)),
-    ...(persisted ? [] : writeFileLineBudgetWarnings(node, index, cwd)),
-  ]);
+  const warnings = [
+    ...nodes.flatMap((node, index) => [
+      ...commandCoverageWarnings(node, index),
+      ...unquotedFilterValueWarnings(node.definitionOfDone ?? [], index),
+      ...(persisted ? [] : mirrorCoverageWarnings(node, index, cwd, contractCommands, contractWrites)),
+      ...(persisted ? [] : unsnapshottedWriteWarnings(node, index, cwd)),
+      ...(persisted ? [] : writeFileLineBudgetWarnings(node, index, cwd)),
+    ]),
+    // Cross-node by construction: a requirement proven in two nodes is only
+    // visible when every node's commands are read together, which is the
+    // whole point -- one copy repaired and six left behind is what a per-node
+    // read cannot see.
+    ...requirementProofWarnings([
+      ...nodes.map((node, index) => ({ id: `nodes[${index}] (${node.id})`, requirementIds: node.requirementIds, commands: node.taskPacket.verification ?? [] })),
+      { id: "contract.sharedVerification", commands: sharedVerification ?? [] },
+      { id: "contract.finalVerification", commands: finalVerification ?? [] },
+    ]),
+  ];
   const contract = /** @type {ValidatedContract} */ ({
     ...raw,
     schemaVersion: /** @type {number} */ (raw.schemaVersion),

package/src/contract/verification.mjs

@@ -8,7 +8,18 @@ export const VERIFICATION_LIMITS = Object.freeze({
   stderrBytes: 16 * 1024,
   maxCommands: 32,
   maxRepeat: 8,
-  maxTimeoutSec: 600,
+  // A verification command may declare up to half an hour. It was 600s, which
+  // is below this repository's own suite: measured 2026-09-22, `npm test`
+  // takes 434-473s at the default parallelism on the author's machine and 650s
+  // on a Windows CI runner, and `node --test --test-concurrency=1 test/engine/`
+  // -- the way a packet's verification actually runs it -- takes 1035-1058s.
+  // So the one command that proves the engine could not be declared at all,
+  // and a packet author's way out was `--test-name-pattern`, which exits 0
+  // when it matches nothing (see AGENTS.md). A cap that pushes authors toward
+  // a proof that certifies nothing is worse than a longer runaway. The node's
+  // own wall clock (`contract.timeoutSec`, 2400s by default) still bounds the
+  // attempt above this.
+  maxTimeoutSec: 1_800,
   stateStdoutBytes: 2 * 1024,
   stateCommands: 16,
   stateAttempts: 4,
@@ -42,7 +53,14 @@ export const MUTATION_TIERS = Object.freeze({
 /**
  * One declared deterministic check: an argv command run by the controller.
  *
- * @typedef {{argv: string[], cwd?: string, timeoutSec?: number, repeat?: number, env?: string[], mutation?: {tier: MutationTier}}} VerificationCommand
+ * `requirementId` names the spec requirement this command is the proof of. It
+ * changes nothing about how the command runs; it is what makes a duplicated
+ * proof visible. Measured 2026-09-22: one broken command lived in a spec's R3,
+ * in its R4 and in seven nodes' verification, and the repair reached one of
+ * them — nothing could tell that the other copies had stopped agreeing,
+ * because nothing recorded that they were copies of one claim.
+ *
+ * @typedef {{argv: string[], cwd?: string, timeoutSec?: number, repeat?: number, env?: string[], mutation?: {tier: MutationTier}, requirementId?: string}} VerificationCommand
  */
 
 /**
@@ -122,7 +140,7 @@ export function validateVerificationCommands(commands, label = "verification") {
 function validateVerificationCommand(command, label = "verification command") {
   if (!command || typeof command !== "object" || Array.isArray(command)) throw new TypeError(`${label} must be an argv command object`);
   const record = /** @type {Record<string, unknown>} */ (command);
-  const allowed = new Set(["argv", "cwd", "timeoutSec", "repeat", "env", "mutation"]);
+  const allowed = new Set(["argv", "cwd", "timeoutSec", "repeat", "env", "mutation", "requirementId"]);
   for (const key of Object.keys(record)) if (!allowed.has(key)) throw new TypeError(`${label} has unexpected field ${key}`);
   if (!Array.isArray(record.argv) || record.argv.length === 0 || record.argv.length > 64 || record.argv.some((item) => typeof item !== "string" || !item.trim() || Buffer.byteLength(item, "utf8") > 8 * 1024)) {
     throw new TypeError(`${label}.argv must be a non-empty array of strings`);
@@ -157,10 +175,18 @@ function validateVerificationCommand(command, label = "verification command") {
     }
     mutation = { tier: /** @type {MutationTier} */ (mutationRecord.tier) };
   }
+  // Bounded exactly like the node-level `requirementIds` it must match against
+  // (at most 128 bytes), so the two sides of the claim cannot accept different
+  // ids.
+  if (record.requirementId !== undefined
+    && (typeof record.requirementId !== "string" || !record.requirementId.trim() || Buffer.byteLength(record.requirementId, "utf8") > 128)) {
+    throw new TypeError(`${label}.requirementId must be a requirement id of at most 128 bytes`);
+  }
   /** @type {VerificationCommand} */
   const normalized = { argv: [.../** @type {string[]} */ (record.argv)], timeoutSec, repeat, env: [.../** @type {string[]} */ (env)] };
   if (record.cwd !== undefined) normalized.cwd = /** @type {string} */ (record.cwd);
   if (mutation !== undefined) normalized.mutation = mutation;
+  if (record.requirementId !== undefined) normalized.requirementId = /** @type {string} */ (record.requirementId);
   return normalized;
 }
 
@@ -199,3 +225,49 @@ export function compactVerification(result) {
   return { passed: Boolean(result?.passed), commands };
 }
 
+
+/**
+ * One proof, one source. A command that declares `requirementId` says it is
+ * the proof of that requirement; this reports the two ways such a claim can
+ * be false.
+ *
+ * A claim the node does not carry is a mislabel: the node's own
+ * `requirementIds` are what the phase assigned it, and a command proving
+ * something outside them is either the wrong id or the wrong node.
+ *
+ * Copies that stopped agreeing are the measured one. 2026-09-22: a broken
+ * command lived in a spec's R3, its R4, and seven nodes' verification, and
+ * the repair reached one copy. Nothing could see that the others had drifted,
+ * because nothing recorded that they were copies of a single claim. Argv is
+ * compared against argv, never a joined string against a shell command: a
+ * joined argv loses argument boundaries, which is the same reason a
+ * `verification` proof references an index instead of comparing text.
+ *
+ * @param {Array<{id: string, requirementIds?: string[], commands: VerificationCommand[]}>} owners
+ * @returns {string[]}
+ */
+export function requirementProofWarnings(owners) {
+  /** @type {string[]} */
+  const warnings = [];
+  /** @type {Map<string, Array<{owner: string, position: number, argv: string[]}>>} */
+  const claims = new Map();
+  for (const owner of owners) {
+    owner.commands.forEach((command, position) => {
+      const requirementId = command.requirementId;
+      if (requirementId === undefined) return;
+      if (owner.requirementIds !== undefined && !owner.requirementIds.includes(requirementId)) {
+        warnings.push(`${owner.id}: verification[${position}] declares requirementId "${requirementId}", which this node does not carry in requirementIds`);
+      }
+      const claimed = claims.get(requirementId) ?? [];
+      claimed.push({ owner: owner.id, position, argv: command.argv });
+      claims.set(requirementId, claimed);
+    });
+  }
+  for (const [requirementId, claimed] of claims) {
+    const distinct = new Map(claimed.map((claim) => [JSON.stringify(claim.argv), claim]));
+    if (distinct.size < 2) continue;
+    const listed = [...distinct.values()].map((claim) => `${claim.owner}: verification[${claim.position}] runs ${JSON.stringify(claim.argv)}`).join("; ");
+    warnings.push(`requirementId "${requirementId}" is proven by commands that no longer agree: ${listed}`);
+  }
+  return warnings;
+}

package/src/engine/dispatch.mjs

@@ -25,6 +25,7 @@ import { attemptWorkspace, createAttemptWorktree, sealAttempt } from "../repo/wo
 import { attemptWorktreePath } from "../run/paths.mjs";
 import { basename, dirname, join } from "node:path";
 import { errorCode, errorMessage } from "../util.mjs";
+import { gateProofTimeoutMs } from "../contract/final-verification.mjs";
 import { captureWorkspaceScope, captureWorkspaceSnapshot } from "../repo/workspace.mjs";
 import { deterministicGate, judgeReaskReason, judgeRequired, judgeSkippedByScope } from "./judge-gate.mjs";
 import { emptyScope, persistedScopeBoundary, workerScope } from "./scope.mjs";
@@ -459,7 +460,7 @@ export async function startJudge(contract, node, state, runDir, running, workerR
     node,
     workspace,
     reask,
-    Math.max(1_000, Math.min((node.timeoutSec ?? contract.timeoutSec ?? 60) * 1000, 120_000)),
+    gateProofTimeoutMs(node, contract),
     /** @type {import("../contract/index.mjs").VerificationState|null} */ (state.verification),
   );
   state.review = reviewMode(node.gate);

package/src/engine/gate.mjs

@@ -25,7 +25,8 @@
  * It also exits when the release file's directory is gone (measured
  * 2026-09-16: gate processes from a prior day's test runs, spawned into a
  * temp directory the failed test never cleaned up, were still alive and
- * waiting for a release file that could now never appear).
+ * waiting for a release file that could now never appear), and it keeps
+ * asking both of those questions after the provider starts, not only before.
  */
 import { existsSync, readFileSync, statSync, openSync, closeSync, readSync, writeSync } from "node:fs";
 import { dirname } from "node:path";
@@ -186,11 +187,32 @@ function releaseDirectoryGone() {
   return !existsSync(dirname(releasePath));
 }
 
+/**
+ * How often the gate re-asks its two liveness questions once the provider is
+ * running. Before release the tick below asks them every 10ms, because it is
+ * also polling for the release file; after release it used to stop asking
+ * entirely, leaving the provider's own exit as the gate's only remaining
+ * liveness check. A controller that died without cleaning up, or a run
+ * directory deleted underneath a live attempt, therefore left the provider
+ * running with nobody watching -- the stranded-process shape ADR 0010
+ * describes, in the one window the pre-release check does not cover.
+ *
+ * A second, not ten milliseconds: this watches a provider that runs for
+ * minutes, and three syscalls a second is the whole cost of never stranding
+ * one.
+ */
+const WATCHDOG_INTERVAL_MS = 1_000;
+
 const timer = setInterval(() => {
   if (!parentAlive()) { clearInterval(timer); stopProvider(); return; }
   if (releaseDirectoryGone()) { clearInterval(timer); stopProvider(); return; }
   if (!existsSync(releasePath)) return;
   clearInterval(timer);
+  const watchdog = setInterval(() => {
+    if (parentAlive() && !releaseDirectoryGone()) return;
+    clearInterval(watchdog);
+    stopProvider();
+  }, WATCHDOG_INTERVAL_MS);
   const stdoutFd = openSync(config.stdoutPath, "wx", 0o600);
   const stderrFd = openSync(config.stderrPath, "wx", 0o600);
   const invocation = spawnInvocation(config.executable, config.args, { cwd: config.cwd });
@@ -207,6 +229,7 @@ const timer = setInterval(() => {
   }
   provider.once("error", () => process.exitCode = 127);
   provider.once("close", (code) => {
+    clearInterval(watchdog);
     capLog(config.stdoutPath, config.harness === "codex");
     capLog(config.stderrPath);
     process.exit(code ?? 1);

package/src/engine/lifecycle.mjs

@@ -147,8 +147,19 @@ export function terminalErrorCode(state) {
  * `turn_limit` is here and not among the timeout codes below: a turn the CLI
  * stopped itself at `--max-turns` exits cleanly with no seal yet, and the
  * next dispatch seals its worktree as it does for any previous attempt.
+ *
+ * `incomplete_stream` is a stream that ended before its terminal envelope --
+ * Claude with no `result`, codex with no `turn.completed`, dsh with neither
+ * terminal record (`harnesses/protocol.mjs`). That is the provider's transport
+ * dying mid-turn, not the run's own doing, so it is the same class as
+ * `provider_error` and earns the same one retry. It was absent, and a worker
+ * whose provider dropped its connection parked on the first attempt while a
+ * worker whose provider returned an error envelope got a second one -- the
+ * harsher treatment for the less informative failure. The judge role is
+ * unaffected: `engine/settle-judge.mjs` routes this code to its own bounded
+ * re-ask before anything parks.
  */
-export const AUTO_RETRY_CODES = new Set(["judge_unavailable", "provider_error", "stall_timeout", "wall_clock_timeout", "turn_limit"]);
+export const AUTO_RETRY_CODES = new Set(["judge_unavailable", "provider_error", "incomplete_stream", "stall_timeout", "wall_clock_timeout", "turn_limit"]);
 
 /**
  * Timeout codes earn their automatic retry only when phase 5b sealed work