faberun 0.19.2 → 0.19.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.19.2",
+  "version": "0.19.3",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/src/campaign/watch.mjs

@@ -0,0 +1,197 @@
+/**
+ * `campaign watch --wake`: the loop that turns a campaign's own records into
+ * the lines an operator is woken with, and the single-watcher lock that keeps
+ * two of them from doubling every wake.
+ *
+ * Separate from `cli/campaign.mjs` because that file owns argv, dispatch and
+ * usage for the campaign verb, and this is neither: it is a long-running
+ * supervisor with a poll interval, an idle policy, a durable dedupe through
+ * the inbox, and a lock with its own staleness rule. `cli/campaign.mjs` keeps
+ * the thin `watch` operation that reads the flags and calls in here.
+ */
+import { closeSync, openSync, readFileSync, unlinkSync, writeSync } from "node:fs";
+import { join } from "node:path";
+import { lockStale, pidAlive, processStartToken, readLock } from "../run/lock.mjs";
+import { readCampaign } from "./record.mjs";
+import { notifyQueueFor } from "../engine/notify-queue.mjs";
+import { appendInbox, readInbox, wakeCapabilityNotice } from "../notify/index.mjs";
+import { errorCode, readJsonTolerant } from "../util.mjs";
+
+/** How often the watcher re-reads the campaign when the operator named no interval. */
+export const DEFAULT_WAKE_POLL_MS = 30_000;
+
+/** How long without a material event before the watcher reports the campaign idle. */
+const WAKE_IDLE_AFTER_MS = 20 * 60_000;
+
+const TERMINAL_NODE_STATUSES = new Set(["done", "no-op", "blocked", "failed", "exhausted", "stalled", "canceled", "cancelled"]);
+const ATTENTION_NODE_STATUSES = new Set(["failed", "exhausted", "stalled", "canceled", "cancelled"]);
+
+/**
+ * The watcher loop. Each line is announced through `notify`, which by default
+ * records it in `<runs-dir>/inbox.jsonl` and delivers it to the campaign's
+ * `notify.jsonl`; the inbox is both the durable record and the dedupe, so a
+ * line already recorded is never re-sent. The injectable seams exist so a
+ * test can drive the loop deterministically.
+ *
+ * @param {string} campaignPath
+ * @param {string} runsDir
+ * @param {{pollMs?: number, once?: boolean, now?: () => number, sleep?: (ms: number) => Promise<void>, emit?: (line: string) => void, notify?: (event: {type: string, campaignId: string, dedupeKey: string, summary: string, runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}) => Promise<void>|void, lock?: {release: () => void}}} [options]
+ * @returns {Promise<void>}
+ */
+export async function watchCampaignWake(campaignPath, runsDir, options = {}) {
+  const pollMs = options.pollMs ?? DEFAULT_WAKE_POLL_MS;
+  const now = options.now ?? (() => Date.now());
+  const sleep = options.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)));
+  const emit = options.emit ?? ((line) => process.stdout.write(`${line}\n`));
+  const notify = options.notify ?? ((event) => notifyQueueFor(campaignPath).enqueue({
+    type: "attention",
+    campaignId: event.campaignId,
+    dedupeKey: event.dedupeKey,
+    summary: event.summary,
+    runId: event.runId ?? null,
+    nodeId: event.nodeId ?? null,
+    status: event.status ?? null,
+    errorCode: event.errorCode ?? null,
+  }));
+  const seen = new Set(readInbox(runsDir).map((entry) => entry.dedupeKey));
+  const lock = options.lock ?? acquireWatchLock(campaignPath);
+  emit(wakeCapabilityNotice());
+  /** @type {Map<string, string>} */
+  const runSignatures = new Map();
+  let lastActiveAt = now();
+  let first = true;
+  try {
+    for (;;) {
+      const campaign = readCampaign(campaignPath);
+      if (campaign.status !== "active") {
+        emit(`campaign-watch: ${campaign.id} is ${campaign.status}; stopping`);
+        return;
+      }
+      /**
+       * Persist first, deliver second: the inbox entry is the durable dedupe,
+       * so a restart or a second watcher skips a line already recorded even
+       * when delivery is injected.
+       *
+       * @param {string} dedupeKey @param {string} summary @param {{runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}} [extra]
+       */
+      const announce = async (dedupeKey, summary, extra = {}) => {
+        if (seen.has(dedupeKey)) return;
+        seen.add(dedupeKey);
+        const appended = appendInbox(runsDir, { type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
+        if (!appended.appended) return;
+        emit(summary);
+        await notify({ type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
+      };
+      let anyActive = false;
+      for (const runId of campaign.linkedRunIds) {
+        const status = /** @type {Record<string, any>|null} */ (readJsonTolerant(join(runsDir, runId, "status.json")));
+        if (!status || !Array.isArray(status.nodes)) continue;
+        const terminal = status.nodes.every((/** @type {any} */ node) => TERMINAL_NODE_STATUSES.has(String(node.status)));
+        const signature = status.nodes.map((/** @type {any} */ node) => `${node.id}:${node.status}:${node.errorCode ?? ""}`).join("|");
+        const previous = runSignatures.get(runId);
+        runSignatures.set(runId, signature);
+        if (!terminal) {
+          anyActive = true;
+          const runLock = readLock(join(runsDir, runId));
+          const stale = !runLock || /** @type {{invalid?: true}} */ (runLock).invalid || lockStale(runLock);
+          if (stale && !first) {
+            await announce(`stale:${runId}`, `campaign-watch: ${runId} has non-terminal nodes but no live controller; resume it`, { runId });
+          }
+        }
+        if (!first && previous !== signature) {
+          for (const node of status.nodes) {
+            const attention = ATTENTION_NODE_STATUSES.has(String(node.status))
+              || (node.status === "blocked" && !(Array.isArray(node.blockedBy) && node.blockedBy.length > 0));
+            if (attention) {
+              const key = `node:${runId}:${node.id}:${node.status}:${node.errorCode ?? ""}`;
+              await announce(
+                key,
+                `campaign-watch: ${runId} node ${node.id} ${node.status}${node.errorCode ? ` [${node.errorCode}]` : ""}${node.note ? ` ${node.note}` : ""}`,
+                { runId, nodeId: String(node.id), status: String(node.status), errorCode: node.errorCode ?? null },
+              );
+            }
+          }
+        }
+        if (terminal) {
+          await announce(`terminal:${runId}`, `campaign-watch: ${runId} terminal · ${status.summary ?? ""}`, { runId });
+        }
+      }
+      const nowMs = now();
+      if (anyActive) lastActiveAt = nowMs;
+      else if (!first && nowMs - lastActiveAt >= WAKE_IDLE_AFTER_MS) {
+        const key = `idle:${Math.floor((nowMs - lastActiveAt) / WAKE_IDLE_AFTER_MS)}`;
+        await announce(key, `campaign-watch: ${campaign.id} active but no run has been active for ${Math.round((nowMs - lastActiveAt) / 60_000)} min; dispatch the next step`);
+      }
+      first = false;
+      if (options.once === true) return;
+      await sleep(pollMs);
+    }
+  } finally {
+    lock.release();
+  }
+}
+
+const WATCH_LOCK_FILE = "watch.lock";
+
+/**
+ * A durable campaign-watch lock, one watcher per campaign across processes.
+ * A live holder is never taken over; a dead or recycled pid's lock is stale
+ * and is replaced, so a restart after a crash is not blocked. The same
+ * liveness rule as the controller lock: a pid is dead only when the probe
+ * proves it.
+ *
+ * @param {string} campaignPath
+ * @returns {{pid: number, processStartToken: string|null, startedAt: string, release: () => void}}
+ */
+export function acquireWatchLock(campaignPath) {
+  const path = join(campaignPath, WATCH_LOCK_FILE);
+  /** @type {{pid?: number, processStartToken?: string|null, startedAt?: string}} */
+  let occupant = {};
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    const record = { pid: process.pid, processStartToken: processStartToken(process.pid), startedAt: new Date().toISOString() };
+    try {
+      const fd = openSync(path, "wx", 0o600);
+      try {
+        writeSync(fd, JSON.stringify(record));
+      } finally {
+        closeSync(fd);
+      }
+      return {
+        ...record,
+        release() {
+          try {
+            unlinkSync(path);
+          } catch (error) {
+            if (errorCode(error) !== "ENOENT") throw error;
+          }
+        },
+      };
+    } catch (error) {
+      if (errorCode(error) !== "EEXIST") throw error;
+    }
+    try {
+      occupant = /** @type {{pid?: number, processStartToken?: string|null}} */ (JSON.parse(readFileSync(path, "utf8")));
+    } catch {
+      occupant = {};
+    }
+    if (!watchLockStale(occupant)) {
+      throw new Error(`campaign watch is already running (pid ${occupant.pid})`);
+    }
+    try {
+      unlinkSync(path);
+    } catch (error) {
+      if (errorCode(error) !== "ENOENT") throw error;
+    }
+  }
+  throw new Error("campaign watch lock contention did not settle");
+}
+
+/**
+ * @param {{pid?: number, processStartToken?: string|null}} occupant
+ * @returns {boolean}
+ */
+function watchLockStale(occupant) {
+  if (typeof occupant.pid !== "number") return true;
+  if (!pidAlive(occupant.pid)) return true;
+  return Boolean(occupant.processStartToken) && processStartToken(occupant.pid) !== occupant.processStartToken;
+}

package/src/cli/campaign.mjs

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { closeSync, openSync, readFileSync, unlinkSync, writeSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { parseArgs as parseFlags } from "node:util";
 import {
@@ -11,25 +11,19 @@ import {
   resolveCampaign,
 } from "../campaign/index.mjs";
 import { addContract, replaceContract } from "./campaign-contract.mjs";
-import { lockStale, pidAlive, processStartToken, readLock } from "../run/lock.mjs";
 import { runsRoot } from "../run/paths.mjs";
 import { syncAgentSignal } from "../repo/signal.mjs";
 import { acknowledgeJournalEvent, appendJournal, appendSeatAllowanceEvent, readJournal, watchJournal } from "../campaign/journal.mjs";
 import { driveCampaignChain } from "../campaign/chain.mjs";
 import { unparkCampaign } from "../campaign/unpark.mjs";
 import { readCampaign } from "../campaign/record.mjs";
-import { notifyQueueFor } from "../engine/notify-queue.mjs";
-import { appendInbox, readInbox, wakeCapabilityNotice } from "../notify/index.mjs";
+import { DEFAULT_WAKE_POLL_MS, watchCampaignWake } from "../campaign/watch.mjs";
 import { allowanceEventFields, sampleAllowance } from "../seat/allowance.mjs";
 import { detectOperatorHarness } from "../seat/harnesses.mjs";
 import { detachArgv, detachSelf, waitForBootstrap } from "./launch.mjs";
-import { errorCode, readJsonTolerant } from "../util.mjs";
+import { readJsonTolerant } from "../util.mjs";
 
 const SYNC_OUTPUT_MAX_BYTES = 8000;
-const DEFAULT_WAKE_POLL_MS = 30_000;
-const WAKE_IDLE_AFTER_MS = 20 * 60_000;
-const TERMINAL_NODE_STATUSES = new Set(["done", "no-op", "blocked", "failed", "exhausted", "stalled", "canceled", "cancelled"]);
-const ATTENTION_NODE_STATUSES = new Set(["failed", "exhausted", "stalled", "canceled", "cancelled"]);
 
 const NOTE_KINDS = new Set([
   "intent",
@@ -159,177 +153,6 @@ async function watch(campaignId, values) {
   await watchCampaignWake(path, runsDir, { pollMs, once: values.once === true });
 }
 
-/**
- * The watcher loop. Each line is announced through `notify`, which by default
- * records it in `<runs-dir>/inbox.jsonl` and delivers it to the campaign's
- * `notify.jsonl`; the inbox is both the durable record and the dedupe, so a
- * line already recorded is never re-sent. The injectable seams exist so a
- * test can drive the loop deterministically.
- *
- * @param {string} campaignPath
- * @param {string} runsDir
- * @param {{pollMs?: number, once?: boolean, now?: () => number, sleep?: (ms: number) => Promise<void>, emit?: (line: string) => void, notify?: (event: {type: string, campaignId: string, dedupeKey: string, summary: string, runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}) => Promise<void>|void, lock?: {release: () => void}}} [options]
- * @returns {Promise<void>}
- */
-export async function watchCampaignWake(campaignPath, runsDir, options = {}) {
-  const pollMs = options.pollMs ?? DEFAULT_WAKE_POLL_MS;
-  const now = options.now ?? (() => Date.now());
-  const sleep = options.sleep ?? ((ms) => new Promise((resolveSleep) => setTimeout(resolveSleep, ms)));
-  const emit = options.emit ?? ((line) => process.stdout.write(`${line}\n`));
-  const notify = options.notify ?? ((event) => notifyQueueFor(campaignPath).enqueue({
-    type: "attention",
-    campaignId: event.campaignId,
-    dedupeKey: event.dedupeKey,
-    summary: event.summary,
-    runId: event.runId ?? null,
-    nodeId: event.nodeId ?? null,
-    status: event.status ?? null,
-    errorCode: event.errorCode ?? null,
-  }));
-  const seen = new Set(readInbox(runsDir).map((entry) => entry.dedupeKey));
-  const lock = options.lock ?? acquireWatchLock(campaignPath);
-  emit(wakeCapabilityNotice());
-  /** @type {Map<string, string>} */
-  const runSignatures = new Map();
-  let lastActiveAt = now();
-  let first = true;
-  try {
-    for (;;) {
-      const campaign = readCampaign(campaignPath);
-      if (campaign.status !== "active") {
-        emit(`campaign-watch: ${campaign.id} is ${campaign.status}; stopping`);
-        return;
-      }
-      /**
-       * Persist first, deliver second: the inbox entry is the durable dedupe,
-       * so a restart or a second watcher skips a line already recorded even
-       * when delivery is injected.
-       *
-       * @param {string} dedupeKey @param {string} summary @param {{runId?: string|null, nodeId?: string|null, status?: string|null, errorCode?: string|null}} [extra]
-       */
-      const announce = async (dedupeKey, summary, extra = {}) => {
-        if (seen.has(dedupeKey)) return;
-        seen.add(dedupeKey);
-        const appended = appendInbox(runsDir, { type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
-        if (!appended.appended) return;
-        emit(summary);
-        await notify({ type: "attention", campaignId: campaign.id, dedupeKey, summary, ...extra });
-      };
-      let anyActive = false;
-      for (const runId of campaign.linkedRunIds) {
-        const status = /** @type {Record<string, any>|null} */ (readJsonTolerant(join(runsDir, runId, "status.json")));
-        if (!status || !Array.isArray(status.nodes)) continue;
-        const terminal = status.nodes.every((/** @type {any} */ node) => TERMINAL_NODE_STATUSES.has(String(node.status)));
-        const signature = status.nodes.map((/** @type {any} */ node) => `${node.id}:${node.status}:${node.errorCode ?? ""}`).join("|");
-        const previous = runSignatures.get(runId);
-        runSignatures.set(runId, signature);
-        if (!terminal) {
-          anyActive = true;
-          const runLock = readLock(join(runsDir, runId));
-          const stale = !runLock || /** @type {{invalid?: true}} */ (runLock).invalid || lockStale(runLock);
-          if (stale && !first) {
-            await announce(`stale:${runId}`, `campaign-watch: ${runId} has non-terminal nodes but no live controller; resume it`, { runId });
-          }
-        }
-        if (!first && previous !== signature) {
-          for (const node of status.nodes) {
-            const attention = ATTENTION_NODE_STATUSES.has(String(node.status))
-              || (node.status === "blocked" && !(Array.isArray(node.blockedBy) && node.blockedBy.length > 0));
-            if (attention) {
-              const key = `node:${runId}:${node.id}:${node.status}:${node.errorCode ?? ""}`;
-              await announce(
-                key,
-                `campaign-watch: ${runId} node ${node.id} ${node.status}${node.errorCode ? ` [${node.errorCode}]` : ""}${node.note ? ` ${node.note}` : ""}`,
-                { runId, nodeId: String(node.id), status: String(node.status), errorCode: node.errorCode ?? null },
-              );
-            }
-          }
-        }
-        if (terminal) {
-          await announce(`terminal:${runId}`, `campaign-watch: ${runId} terminal · ${status.summary ?? ""}`, { runId });
-        }
-      }
-      const nowMs = now();
-      if (anyActive) lastActiveAt = nowMs;
-      else if (!first && nowMs - lastActiveAt >= WAKE_IDLE_AFTER_MS) {
-        const key = `idle:${Math.floor((nowMs - lastActiveAt) / WAKE_IDLE_AFTER_MS)}`;
-        await announce(key, `campaign-watch: ${campaign.id} active but no run has been active for ${Math.round((nowMs - lastActiveAt) / 60_000)} min; dispatch the next step`);
-      }
-      first = false;
-      if (options.once === true) return;
-      await sleep(pollMs);
-    }
-  } finally {
-    lock.release();
-  }
-}
-
-const WATCH_LOCK_FILE = "watch.lock";
-
-/**
- * A durable campaign-watch lock, one watcher per campaign across processes.
- * A live holder is never taken over; a dead or recycled pid's lock is stale
- * and is replaced, so a restart after a crash is not blocked. The same
- * liveness rule as the controller lock: a pid is dead only when the probe
- * proves it.
- *
- * @param {string} campaignPath
- * @returns {{pid: number, processStartToken: string|null, startedAt: string, release: () => void}}
- */
-export function acquireWatchLock(campaignPath) {
-  const path = join(campaignPath, WATCH_LOCK_FILE);
-  /** @type {{pid?: number, processStartToken?: string|null, startedAt?: string}} */
-  let occupant = {};
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    const record = { pid: process.pid, processStartToken: processStartToken(process.pid), startedAt: new Date().toISOString() };
-    try {
-      const fd = openSync(path, "wx", 0o600);
-      try {
-        writeSync(fd, JSON.stringify(record));
-      } finally {
-        closeSync(fd);
-      }
-      return {
-        ...record,
-        release() {
-          try {
-            unlinkSync(path);
-          } catch (error) {
-            if (errorCode(error) !== "ENOENT") throw error;
-          }
-        },
-      };
-    } catch (error) {
-      if (errorCode(error) !== "EEXIST") throw error;
-    }
-    try {
-      occupant = /** @type {{pid?: number, processStartToken?: string|null}} */ (JSON.parse(readFileSync(path, "utf8")));
-    } catch {
-      occupant = {};
-    }
-    if (!watchLockStale(occupant)) {
-      throw new Error(`campaign watch is already running (pid ${occupant.pid})`);
-    }
-    try {
-      unlinkSync(path);
-    } catch (error) {
-      if (errorCode(error) !== "ENOENT") throw error;
-    }
-  }
-  throw new Error("campaign watch lock contention did not settle");
-}
-
-/**
- * @param {{pid?: number, processStartToken?: string|null}} occupant
- * @returns {boolean}
- */
-function watchLockStale(occupant) {
-  if (typeof occupant.pid !== "number") return true;
-  if (!pidAlive(occupant.pid)) return true;
-  return Boolean(occupant.processStartToken) && processStartToken(occupant.pid) !== occupant.processStartToken;
-}
-
-
 /**
  * @param {string} campaignId
  * @param {CliValues} values
@@ -467,9 +290,38 @@ function close(campaignId, values) {
   renderHandoff(path, runsDir);
   process.stdout.write(`[campaign] ${closed.campaign.id} closed\n`);
   process.stdout.write(`[campaign] ledger · docs/campaigns/${closed.campaign.id}/ledger · ${closed.ledgerFiles.length} files\n`);
+  reportRequirementClosure(closed.campaign.requirements ?? []);
   if (syncAgentSignal(runsDir)) process.stdout.write(`[campaign] AGENTS.md signal updated\n`);
 }
 
+/**
+ * Say out loud what the close just wrote, and what it measured.
+ *
+ * The record is a correlation between the requirement ids a linked run's
+ * contract declared and the node snapshots that reached `done` carrying them.
+ * It reads the run directory and never the branch, so a requirement the
+ * operator delivered by hand -- because its node blocked, which happens --
+ * lands in the record as `open` while the work is on main. Measured
+ * 2026-09-22 on `availability-is-verified-not-assumed`: R4 read `open` with
+ * an empty `nodes` array and was merged in `a6a5d43`.
+ *
+ * Nothing printed this before, so the only way to meet the closure was to
+ * open the JSON, where `open` reads as "not delivered" instead of "no node of
+ * this campaign proved it". Naming the measurement is the whole fix: a close
+ * cannot know what it did not run.
+ *
+ * @param {import("../campaign/index.mjs").RequirementClosure[]} requirements
+ */
+function reportRequirementClosure(requirements) {
+  if (requirements.length === 0) return;
+  const open = requirements.filter((entry) => entry.status !== "covered");
+  const covered = requirements.length - open.length;
+  process.stdout.write(`[campaign] requirements · ${covered}/${requirements.length} carried by a node that reached done\n`);
+  if (open.length === 0) return;
+  process.stdout.write(`[campaign] no done node carried ${open.map((entry) => entry.requirementId).join(", ")}\n`);
+  process.stdout.write("[campaign] closure reads node snapshots, never the branch: a requirement delivered outside a node reads open here\n");
+}
+
 /**
  * `campaign supervise <id>` (also spelled `supervise campaign <id>`): the
  * idempotent re-invocation that drives the manifest. It takes the campaign's

package/src/cli/launch.mjs

@@ -55,8 +55,14 @@ export function detachSelf(command, target, extraArgs = []) {
  * exactly as for every detached controller: a foreground launcher is the only
  * moment an operator is present.
  *
+ * `stdio` overrides the discarded default for a caller that has somewhere
+ * durable to put the child's output. A detached *run* wants the default: its
+ * bootstrap record is the channel, and a controller's real output belongs in
+ * the run directory. A detached *plan* has no bootstrap record, so discarding
+ * its stdio discarded the only account of why it died.
+ *
  * @param {string[]} argv
- * @param {{nonce?: string, env?: NodeJS.ProcessEnv}} [options]
+ * @param {{nonce?: string, env?: NodeJS.ProcessEnv, stdio?: import("node:child_process").StdioOptions}} [options]
  * @returns {DetachedChild}
  */
 export function detachArgv(argv, options = {}) {
@@ -74,7 +80,7 @@ export function detachArgv(argv, options = {}) {
     // pending forever. There it also means DETACHED_PROCESS: no console
     // window, which is what "ignore" stdio already implies.
     detached: true,
-    stdio: "ignore",
+    stdio: options.stdio ?? "ignore",
   }));
   child.unref();
   child.bootstrapNonce = nonce;

package/src/cli/plan.mjs

@@ -16,6 +16,7 @@ import { colorLevel, statusToken } from "./brand.mjs";
 import { delay } from "../util.mjs";
 import { runPlanningPipeline } from "../plan/pipeline.mjs";
 import { campaignTree, runDirectory } from "../run/paths.mjs";
+import { readCampaign } from "../campaign/record.mjs";
 
 /** How often a foreground `plan` polls a launched stage's run directory. */
 const DEFAULT_POLL_MS = 1_000;
@@ -125,7 +126,7 @@ export function loadVerificationSuites(path) {
 
 /**
  * @param {string} target
- * @param {{campaign?: string, phase?: string, "review-rounds"?: string, "approve-below"?: string, "runtime-defaults"?: string, runtimes?: string, verification?: string, package?: string, detach?: boolean, json?: boolean}} values
+ * @param {{campaign?: string, phase?: string, "review-rounds"?: string, "approve-below"?: string, "runtime-defaults"?: string, runtimes?: string, verification?: string, package?: string, "targeted-fix"?: boolean, detach?: boolean, json?: boolean}} values
  * @returns {Promise<void>}
  */
 export async function planCli(target, values) {
@@ -151,7 +152,14 @@ export async function planCli(target, values) {
     if (typeof values.runtimes === "string" && values.runtimes) argv.push("--runtimes", resolve(values.runtimes));
     if (typeof values.verification === "string" && values.verification) argv.push("--verification", resolve(values.verification));
     if (packageMode !== "implementation") argv.push("--package", packageMode);
+    if (values["targeted-fix"] === true) argv.push("--targeted-fix");
     const failurePath = planBootstrapFailurePath(process.cwd(), campaignId, phase);
+    // Read the campaign before creating anything: the failure record lives
+    // inside the campaign tree, so a typo in --campaign would otherwise leave
+    // a campaign directory with no record in it for `discoverCampaigns` to
+    // find. The child reads it too; this is the launcher refusing what it can
+    // see for itself rather than detaching into a certain failure.
+    readCampaign(campaignTree(process.cwd(), campaignId));
     mkdirSync(dirname(failurePath), { recursive: true });
     rmSync(failurePath, { force: true });
     const child = detachArgv(argv);
@@ -188,6 +196,7 @@ export async function planCli(target, values) {
       runtimeDefaults,
       runtimes,
       verification,
+      targetedFix: values["targeted-fix"] === true,
       packageMode,
       launch: async (contractPath, contract) => {
         const child = detachSelf("run", contractPath);

package/src/cli.mjs

@@ -124,6 +124,7 @@ export const COMMAND_OPTIONS = {
     runtimes: { type: "string" },
     verification: { type: "string" },
     package: { type: "string" },
+    "targeted-fix": { type: "boolean" },
     detach: { type: "boolean" },
     json: { type: "boolean" },
   },

package/src/contract/verification.mjs

@@ -8,7 +8,18 @@ export const VERIFICATION_LIMITS = Object.freeze({
   stderrBytes: 16 * 1024,
   maxCommands: 32,
   maxRepeat: 8,
-  maxTimeoutSec: 600,
+  // A verification command may declare up to half an hour. It was 600s, which
+  // is below this repository's own suite: measured 2026-09-22, `npm test`
+  // takes 434-473s at the default parallelism on the author's machine and 650s
+  // on a Windows CI runner, and `node --test --test-concurrency=1 test/engine/`
+  // -- the way a packet's verification actually runs it -- takes 1035-1058s.
+  // So the one command that proves the engine could not be declared at all,
+  // and a packet author's way out was `--test-name-pattern`, which exits 0
+  // when it matches nothing (see AGENTS.md). A cap that pushes authors toward
+  // a proof that certifies nothing is worse than a longer runaway. The node's
+  // own wall clock (`contract.timeoutSec`, 2400s by default) still bounds the
+  // attempt above this.
+  maxTimeoutSec: 1_800,
   stateStdoutBytes: 2 * 1024,
   stateCommands: 16,
   stateAttempts: 4,

package/src/engine/gate.mjs

@@ -25,7 +25,8 @@
  * It also exits when the release file's directory is gone (measured
  * 2026-09-16: gate processes from a prior day's test runs, spawned into a
  * temp directory the failed test never cleaned up, were still alive and
- * waiting for a release file that could now never appear).
+ * waiting for a release file that could now never appear), and it keeps
+ * asking both of those questions after the provider starts, not only before.
  */
 import { existsSync, readFileSync, statSync, openSync, closeSync, readSync, writeSync } from "node:fs";
 import { dirname } from "node:path";
@@ -186,11 +187,32 @@ function releaseDirectoryGone() {
   return !existsSync(dirname(releasePath));
 }
 
+/**
+ * How often the gate re-asks its two liveness questions once the provider is
+ * running. Before release the tick below asks them every 10ms, because it is
+ * also polling for the release file; after release it used to stop asking
+ * entirely, leaving the provider's own exit as the gate's only remaining
+ * liveness check. A controller that died without cleaning up, or a run
+ * directory deleted underneath a live attempt, therefore left the provider
+ * running with nobody watching -- the stranded-process shape ADR 0010
+ * describes, in the one window the pre-release check does not cover.
+ *
+ * A second, not ten milliseconds: this watches a provider that runs for
+ * minutes, and three syscalls a second is the whole cost of never stranding
+ * one.
+ */
+const WATCHDOG_INTERVAL_MS = 1_000;
+
 const timer = setInterval(() => {
   if (!parentAlive()) { clearInterval(timer); stopProvider(); return; }
   if (releaseDirectoryGone()) { clearInterval(timer); stopProvider(); return; }
   if (!existsSync(releasePath)) return;
   clearInterval(timer);
+  const watchdog = setInterval(() => {
+    if (parentAlive() && !releaseDirectoryGone()) return;
+    clearInterval(watchdog);
+    stopProvider();
+  }, WATCHDOG_INTERVAL_MS);
   const stdoutFd = openSync(config.stdoutPath, "wx", 0o600);
   const stderrFd = openSync(config.stderrPath, "wx", 0o600);
   const invocation = spawnInvocation(config.executable, config.args, { cwd: config.cwd });
@@ -207,6 +229,7 @@ const timer = setInterval(() => {
   }
   provider.once("error", () => process.exitCode = 127);
   provider.once("close", (code) => {
+    clearInterval(watchdog);
     capLog(config.stdoutPath, config.harness === "codex");
     capLog(config.stderrPath);
     process.exit(code ?? 1);

package/src/engine/lifecycle.mjs

@@ -147,8 +147,19 @@ export function terminalErrorCode(state) {
  * `turn_limit` is here and not among the timeout codes below: a turn the CLI
  * stopped itself at `--max-turns` exits cleanly with no seal yet, and the
  * next dispatch seals its worktree as it does for any previous attempt.
+ *
+ * `incomplete_stream` is a stream that ended before its terminal envelope --
+ * Claude with no `result`, codex with no `turn.completed`, dsh with neither
+ * terminal record (`harnesses/protocol.mjs`). That is the provider's transport
+ * dying mid-turn, not the run's own doing, so it is the same class as
+ * `provider_error` and earns the same one retry. It was absent, and a worker
+ * whose provider dropped its connection parked on the first attempt while a
+ * worker whose provider returned an error envelope got a second one -- the
+ * harsher treatment for the less informative failure. The judge role is
+ * unaffected: `engine/settle-judge.mjs` routes this code to its own bounded
+ * re-ask before anything parks.
  */
-export const AUTO_RETRY_CODES = new Set(["judge_unavailable", "provider_error", "stall_timeout", "wall_clock_timeout", "turn_limit"]);
+export const AUTO_RETRY_CODES = new Set(["judge_unavailable", "provider_error", "incomplete_stream", "stall_timeout", "wall_clock_timeout", "turn_limit"]);
 
 /**
  * Timeout codes earn their automatic retry only when phase 5b sealed work

package/src/plan/pipeline.mjs

@@ -82,13 +82,17 @@ export const DEFAULT_NODE_BUDGET_MS = 600_000;
 const APPROVE_BELOW_VALUES = new Set(["standard", "high", "none"]);
 
 /**
- * @param {{specPath: string, campaignId: string, phase: string, cwd?: string, reviewRounds?: number, approveBelow?: ApproveBelow, runtimeDefaults?: {worker?: string, judge?: string}, runtimes: Record<string, JsonObject>, verification?: VerificationSuites, packageMode?: import("./sizing.mjs").PackageMode, launch: LaunchFn, wait: WaitFn, ask?: AskFn}} options
+ * @param {{specPath: string, campaignId: string, phase: string, cwd?: string, reviewRounds?: number, approveBelow?: ApproveBelow, runtimeDefaults?: {worker?: string, judge?: string}, runtimes: Record<string, JsonObject>, verification?: VerificationSuites, packageMode?: import("./sizing.mjs").PackageMode, targetedFix?: boolean, launch: LaunchFn, wait: WaitFn, ask?: AskFn}} options
+ *   `targetedFix` allows a plan with a single node. Sizing refuses one by
+ *   default because a phase that decomposes into one node is usually a plan
+ *   that was never decomposed; a targeted fix is the case where one node is
+ *   the honest answer, and the operator says so.
  * @returns {Promise<FrozenPipelineResult|ContestedPipelineResult>}
  */
 export async function runPlanningPipeline(options) {
   const {
     specPath, campaignId, phase, runtimes, launch, wait,
-    reviewRounds = 2, runtimeDefaults = {}, verification = {},
+    reviewRounds = 2, runtimeDefaults = {}, verification = {}, targetedFix = false,
   } = options;
   const ask = options.ask ?? askPlanningRuntimes;
   // Implementation work is sized by what it writes; exploratory work -- an
@@ -258,7 +262,7 @@ export async function runPlanningPipeline(options) {
     stage = "sizing";
     const sizing = applySizingRules(
       { nodes: currentPlan.nodes.map(toSizingNode), justification: currentPlan.justification },
-      { nodeBudgetMs: DEFAULT_NODE_BUDGET_MS, facts: repoFacts, minWriteFiles: MIN_WRITE_FILES, turnCeiling: DEFAULT_MAX_TURNS, packageMode, readVolume: (path) => fileLineCount(join(cwd, path)) },
+      { nodeBudgetMs: DEFAULT_NODE_BUDGET_MS, facts: repoFacts, minWriteFiles: MIN_WRITE_FILES, turnCeiling: DEFAULT_MAX_TURNS, packageMode, readVolume: (path) => fileLineCount(join(cwd, path)), targetedFix },
     );
     stage = "routing";
     const routing = resolveRuntimes(sizing.plan.nodes, {