faberun 0.25.0 → 0.26.0

package/src/engine/backoff.mjs

@@ -362,9 +362,10 @@ export function upsertTierExhaustionCandidate(existing, role, runtimeId, exhaust
  * @param {Transition} schedule
  * @param {number} [now] epoch ms the backoff window is measured from
  * @param {string|null} [exhaustedUntil] the reset instant the exhausted candidate announced, if any
- * @returns {{blocked: RouteError|null, nextRuntime: string, ruleIndex: number|undefined, revision: number, hop: number, backoffSec: number, backoffUntil: string, composed: boolean, tierExhaustion: TierExhaustion|null}}
+ * @param {{judgeListState?: import("../contract/index.mjs").JudgeListState}} [options] R18: a judge-list hop already resolved by the impure caller (`engine/judge-list.mjs`'s `nextListJudge` reads the durable refusal and usage-window stores, which this decision module never touches); its `chosen` -- possibly null, once the list is exhausted -- replaces both the declared `runtime.fallback` edge and the dynamic-tier candidate a list-driven judge would otherwise get from `nextSynthesizedRuntime`/`nextSameTierRuntime`
+ * @returns {{blocked: RouteError|null, nextRuntime: string, ruleIndex: number|undefined, revision: number, hop: number, backoffSec: number, backoffUntil: string, composed: boolean, tierExhaustion: TierExhaustion|null, judgeList?: import("../contract/index.mjs").JudgeListState}}
  */
-export function planRoute(contract, node, state, role, error, current, schedule, now = Date.now(), exhaustedUntil = null) {
+export function planRoute(contract, node, state, role, error, current, schedule, now = Date.now(), exhaustedUntil = null, options = {}) {
   const revision = state.revisions ?? 0;
   // Tier routing is scoped by generation, not revision: an invocation counts
   // as attempted here only when it ran in the current tier-exhaustion
@@ -394,17 +395,33 @@ export function planRoute(contract, node, state, role, error, current, schedule,
   // declared" — nextSynthesizedRuntime's own attempted-filter would otherwise
   // make that distinction unreachable.
   const declaredCandidate = synthesizedChain(contract, role, current)[0] ?? null;
-  const fallback = nextSynthesizedRuntime(contract, role, current, attempted)
-    ?? (dynamicComposed ? nextSameTierRuntime(contract, routing, role, current, attempted) : null);
+  // R18: once a list governs this hop (`options.judgeListState` is supplied),
+  // its precomputed pick *replaces* the declared `runtime.fallback` edge
+  // rather than following it -- the list is itself the ordering, and a list
+  // entry that happens to declare its own `fallback` must not hop there
+  // instead of the list's next eligible entry. Only when no list governs does
+  // the declared edge, then the dynamic-tier candidate, apply.
+  const judgeListState = options.judgeListState;
+  const listGoverned = judgeListState !== undefined;
+  const fallback = judgeListState !== undefined
+    ? judgeListState.chosen
+    : nextSynthesizedRuntime(contract, role, current, attempted) ?? (dynamicComposed ? nextSameTierRuntime(contract, routing, role, current, attempted) : null);
   const hop = nextHop(state, role, revision, schedule);
   const nextRuntime = schedule.kind === "reset" ? current : fallback ?? current;
+  // A list-governed hop is bounded by the list's own length (instructions
+  // R18 §4), never the one-hop cap that applies to a declared or dynamic-tier
+  // fallback, so it is exempted from the hop-cap check below exactly as a
+  // dynamic-tier fallback already is.
+  const noHopCap = dynamicComposed || listGoverned;
   const blocked = schedule.kind === "reset"
     ? null
     : fallback === null
-      ? declaredCandidate !== null && attempted.has(declaredCandidate)
-        ? { code: "provider_failover_cycle", message: `runtime ${declaredCandidate} was already attempted in ${role} revision ${revision}` }
-        : { code: dynamicComposed ? "runtime_tier_exhausted" : error.code, message: dynamicComposed ? `no available runtime remains in tier ${String(contract.runtimes[current]?.tier ?? "unknown")} for ${role}` : error.message }
-      : hop > 1 && !dynamicComposed
+      ? listGoverned
+        ? { code: "judge_list_exhausted", message: `no eligible entry remains in the judge list for ${role}` }
+        : declaredCandidate !== null && attempted.has(declaredCandidate)
+          ? { code: "provider_failover_cycle", message: `runtime ${declaredCandidate} was already attempted in ${role} revision ${revision}` }
+          : { code: dynamicComposed ? "runtime_tier_exhausted" : error.code, message: dynamicComposed ? `no available runtime remains in tier ${String(contract.runtimes[current]?.tier ?? "unknown")} for ${role}` : error.message }
+      : hop > 1 && !noHopCap
         ? { code: "provider_failover_hop_cap", message: "provider failover exceeded the one-hop cap" }
         : null;
   const backoffSec = schedule.kind === "reset"
@@ -417,7 +434,7 @@ export function planRoute(contract, node, state, role, error, current, schedule,
   const tierExhaustion = dynamicComposed
     ? upsertTierExhaustionCandidate(state.routing?.tierExhaustion, role, current, exhaustedUntil)
     : null;
-  return { blocked, nextRuntime, ruleIndex: undefined, revision, hop, backoffSec, backoffUntil, composed: composedAssignment, tierExhaustion };
+  return { blocked, nextRuntime, ruleIndex: undefined, revision, hop, backoffSec, backoffUntil, composed: composedAssignment, tierExhaustion, judgeList: options.judgeListState };
 }
 
 /**
@@ -464,6 +481,10 @@ export function buildRouting(state, { role, error, current, plan, schedule, usag
       history: [...(state.routing?.history ?? []), { ...shared, runtime: current, status, errorCode }].slice(-MAX_ROUTING_HISTORY),
       currentOverride: override,
       ...(plan.tierExhaustion ? { tierExhaustion: plan.tierExhaustion } : {}),
+      // Unlike tierExhaustion, an untouched judgeList is not deleted above: a
+      // worker exhaustion round in the same call never resolved one, and the
+      // node's own list evidence must survive it unchanged.
+      ...(plan.judgeList !== undefined ? { judgeList: plan.judgeList } : {}),
     },
     override,
     errorCode,

package/src/engine/dispatch.mjs

@@ -37,7 +37,8 @@ import { mkdirSync, statSync } from "node:fs";
 import { READ_BYTE_LIMIT, READ_LINE_LIMIT, harnessCapabilities, normalizeProviderResult, writesWorkspace } from "../harnesses/index.mjs";
 import { writeJsonAtomic } from "../run/store.mjs";
 import { judgeReaskInstruction, reviewMode } from "../contract/review-modes.mjs";
-import { routeRuntimeForState, runtimeSnapshot } from "./failover.mjs";
+import { isSameProviderReviewPair } from "../contract/judge-independence.mjs";
+import { previousAttemptRuntimeId, routeRuntimeForState, runtimeSnapshot } from "./failover.mjs";
 import { fingerprintRuntime, forceFreshSession, phaseInvocationPlan } from "./phase-session.mjs";
 
 /** @typedef {import("./phase-session.mjs").SessionPolicy} SessionPolicy */
@@ -495,6 +496,22 @@ export async function startJudge(contract, node, state, runDir, running, workerR
     /** @type {import("../contract/index.mjs").VerificationState|null} */ (state.verification),
   );
   state.review = reviewMode(node.gate);
+  // The judge candidate this attempt would actually use, and the worker
+  // runtime read off the durable invocation record rather than
+  // `state.runtime`: on the first judge dispatch of an attempt `state.runtime`
+  // still holds the worker, but `startJudge` overwrites it with the judge's
+  // own runtime below, and a bounded re-ask (review.mjs) or a judge-failure
+  // retry (settle-judge.mjs) then calls `startJudge` again with the judge
+  // already in `state.runtime` -- comparing against that would compare the
+  // judge to itself and always mark the node. The invocation record survives
+  // every such re-dispatch, so the mark reflects the pairing that ran,
+  // fallback included -- not `node.sameProviderReview`, which only says the
+  // pairing was admitted under same-vendor mode at contract validation,
+  // primary or fallback alike.
+  const judgeCandidate = routeRuntimeForState(contract, node, state, "judge");
+  const workerRuntimeId = previousAttemptRuntimeId(state, "worker");
+  const workerRuntime = workerRuntimeId ? contract.runtimes[workerRuntimeId] : state.runtime;
+  state.sameProviderReview = isSameProviderReviewPair(contract, workerRuntime, judgeCandidate);
   if (verdict.verdict === "fail") return { kind: "rejected", verdict };
   // `skipWhen` is checked before the ordinary judgment rule so a green-and-small
   // change settles mechanically even when a Definition of Done item carries
@@ -502,7 +519,7 @@ export async function startJudge(contract, node, state, runDir, running, workerR
   // and a gate whose review mode is `none` is skipped there exactly as before.
   if (judgeSkippedByScope(node, state)) return { kind: "settle", gate: verdict };
   if (!judgeRequired(node)) return { kind: "settle", gate: verdict };
-  const runtime = routeRuntimeForState(contract, node, state, "judge");
+  const runtime = judgeCandidate;
   const paths = logPaths(runDir, node.id, "judge", state.attempt);
   state.phase = "judge";
   state.runtime = runtime;

package/src/engine/failover.mjs

@@ -17,6 +17,7 @@
 import { harnessCapabilities } from "../harnesses/index.mjs";
 import { isRuntimeAvailable, nextSameTierRuntime } from "./runtime-discovery.mjs";
 import { routeRuntime } from "../contract/runtime.mjs";
+import { effectiveProvider } from "../contract/provider.mjs";
 
 /** @typedef {import("../contract/index.mjs").ValidatedNode} ValidatedNode */
 /** @typedef {import("../contract/index.mjs").NodeSnapshot} NodeSnapshot */
@@ -188,11 +189,17 @@ export function routingBackoffActive(state, phase) {
  * survives both a routed hop and the revision boundary: `resetPhaseRouting`
  * clears the routing override between revisions, but never the invocations.
  *
+ * Exported so a same-provider-review mark (R20) can be taken from the worker
+ * invocation that actually ran instead of `state.runtime`, which `startJudge`
+ * overwrites with the judge's own runtime as soon as it dispatches -- a re-ask
+ * or a judge-failure retry then calls `startJudge` again with the judge still
+ * in `state.runtime`, so comparing against it compares the judge to itself.
+ *
  * @param {NodeSnapshot} state
  * @param {"worker"|"judge"} role
  * @returns {string|undefined}
  */
-function previousAttemptRuntimeId(state, role) {
+export function previousAttemptRuntimeId(state, role) {
   const found = [...(state.invocations ?? [])].reverse().find((invocation) => invocation.phase === role)?.runtimeId;
   return typeof found === "string" ? found : undefined;
 }
@@ -223,7 +230,8 @@ function admitsAffinity(contract, state, role, candidate) {
   if (availability && !isRuntimeAvailable(availability)) return false;
   if (role !== "judge") return true;
   const workerId = previousAttemptRuntimeId(state, "worker") ?? state.routing?.assignments?.worker;
-  return runtime.vendor !== (workerId ? contract.runtimes[workerId]?.vendor : null);
+  const workerRuntime = workerId ? contract.runtimes[workerId] : undefined;
+  return effectiveProvider(runtime) !== (workerRuntime ? effectiveProvider(workerRuntime) : null);
 }
 
 /**

package/src/engine/judge-gate.mjs

@@ -142,8 +142,9 @@ function proveVerification(id, proof, recorded) {
  * `--test-skip-pattern`) is judged on more than its exit code, because the
  * runner exits 0 whether its filter selected anything or not. The proof runs
  * with the TAP reporter selected through `NODE_OPTIONS` and is refused when the
- * output carries TAP's zero-plan line. Measured 2026-09-21 on node v26.8.1: a
- * filter that matches emits `1..0` zero times, a filter that matches nothing
+ * output says the filter selected nothing (`tapSelectedNothing`). Measured
+ * 2026-09-21 on node v26.8.1, in a single-file run: a filter that matches
+ * emits `1..0` zero times, a filter that matches nothing
  * emits it exactly once, a run with no filter emits it zero times, and an empty
  * suite under a matching filter emits no nested zero plan. The default reporter
  * cannot make the distinction -- both cases print identical counters, because
@@ -154,7 +155,26 @@ function proveVerification(id, proof, recorded) {
  * never sees it.
  */
 const TEST_FILTER_FLAGS = ["--test-name-pattern", "--test-skip-pattern"];
-const TAP_ZERO_PLAN = /^1\.\.0$/mu;
+const TAP_ZERO_PLAN = /^1\.\.0$/gmu;
+const TAP_TOP_LEVEL_RESULT = /^(?:not )?ok \d+ /gmu;
+
+/**
+ * Whether a filtered run's TAP says its filter selected no test. A run of
+ * several files prints, for each file the filter selected nothing in, an
+ * unindented `1..0` followed by that file's own top-level `ok` line, while a
+ * selected test prints its own top-level result with no zero plan in front of
+ * it. Measured 2026-09-26 on node v26.8.1 (AP1 of safe-to-hand-to-a-friend):
+ * reading a single `1..0` as "nothing selected" refused two proofs whose
+ * filter had selected a passing test in one of several files. Nothing was
+ * selected exactly when every top-level result is one of those file lines.
+ *
+ * @param {string} stdout
+ * @returns {boolean}
+ */
+function tapSelectedNothing(stdout) {
+  const zeroPlans = stdout.match(TAP_ZERO_PLAN)?.length ?? 0;
+  return zeroPlans > 0 && zeroPlans >= (stdout.match(TAP_TOP_LEVEL_RESULT)?.length ?? 0);
+}
 
 /**
  * The environment a filtered proof runs under: the ambient environment with
@@ -252,7 +272,7 @@ async function proveCommand(id, proof, cwd, timeoutMs) {
     child.on("close", (code, signal) => {
       // Its own detail, not an ordinary command failure: the command succeeded,
       // so what failed is that the declared filter selected nothing to prove.
-      if (code === 0 && signal === null && filters.length > 0 && TAP_ZERO_PLAN.test(stdout)) {
+      if (code === 0 && signal === null && filters.length > 0 && tapSelectedNothing(stdout)) {
         finish({
           id,
           kind: "command",

package/src/engine/judge-list.mjs

@@ -0,0 +1,206 @@
+/**
+ * R18: the judge of a gated node is the first eligible entry of a static,
+ * ordered list rather than the single strongest cross-vendor candidate
+ * `composeAssignments` otherwise ranks. Split out of `runtime-discovery.mjs`
+ * and `lifecycle.mjs` -- both already near this repository's 800-line
+ * ceiling -- and kept out of `backoff.mjs`, whose `planRoute` is a pure
+ * decision this module cannot be: picking an entry reads the durable refusal
+ * and usage-window stores.
+ */
+import { effectiveProvider } from "../contract/provider.mjs";
+import { availabilityKey, readRefusal } from "../run/availability.mjs";
+import { readUsageWindows, usageAccountOf } from "../run/usage-windows.mjs";
+import { getHarness } from "../harnesses/index.mjs";
+
+/** @typedef {import("../contract/index.mjs").ValidatedContract} ValidatedContract */
+/** @typedef {{id: string, reason: string}} JudgeSkip */
+/** @typedef {{chosen: string|null, skipped: JudgeSkip[]}} JudgeListPick */
+/** @typedef {{list: string[], chosen: string|null, skipped: JudgeSkip[]}} JudgeListState */
+
+/**
+ * A usage window at or above this spend is treated as unavailable for a judge
+ * pick, so a node's review does not race the account into a refusal the next
+ * call would hit anyway.
+ */
+export const JUDGE_USAGE_WINDOW_LIMIT_PERCENT = 90;
+
+/**
+ * The static judge list a node's assignment reads: the contract's own list
+ * wins over the machine default, exactly as `runtimeDefaults.worker` already
+ * wins over `config.worker` in `composeAssignments`.
+ *
+ * @param {{judges?: string[]}} contract
+ * @param {{judges?: string[]}|null|undefined} config
+ * @returns {string[]|undefined}
+ */
+export function resolveJudgeList(contract, config) {
+  return contract.judges ?? config?.judges ?? undefined;
+}
+
+/**
+ * Every provider a worker attempt on this node could actually run on: its own
+ * canonical provider, plus every hop of its declared fallback chain. A judge
+ * of any of these providers cannot independently review whichever one
+ * actually ran. Walked directly off `runtime.fallback` rather than through
+ * `failover.mjs`'s `synthesizedChain`, so this module does not import a
+ * runtime-discovery consumer and risk a cycle back through
+ * `run/availability.mjs`.
+ *
+ * @param {ValidatedContract} contract
+ * @param {string} workerId
+ * @returns {Set<string|undefined>}
+ */
+function reachableWorkerProviders(contract, workerId) {
+  const providers = new Set([effectiveProvider(contract.runtimes[workerId])]);
+  const seen = new Set([workerId]);
+  let current = workerId;
+  for (;;) {
+    const next = contract.runtimes[current]?.fallback;
+    if (!next || seen.has(next) || !contract.runtimes[next]) break;
+    seen.add(next);
+    providers.add(effectiveProvider(contract.runtimes[next]));
+    current = next;
+  }
+  return providers;
+}
+
+/**
+ * Is this runtime's account inside `JUDGE_USAGE_WINDOW_LIMIT_PERCENT` of a
+ * usage window closing? `null` means no window is known -- unknown must not
+ * read as over budget, exactly as an absent availability record must not read
+ * as exhausted (see `admitsAffinity` in `failover.mjs`).
+ *
+ * @param {import("../contract/index.mjs").ValidatedRuntime} runtime
+ * @param {number} now
+ * @returns {import("../harnesses/codex/usage-window.mjs").UsageWindow|null}
+ */
+function overspentWindow(runtime, now) {
+  const account = usageAccountOf(runtime);
+  if (!account) return null;
+  return readUsageWindows(account, now).find((window) => window.usedPercent > JUDGE_USAGE_WINDOW_LIMIT_PERCENT) ?? null;
+}
+
+/**
+ * The first eligible entry of an ordered judge list, and why every earlier
+ * entry was skipped: already attempted this run, a provider the worker (or
+ * its fallback chain) already runs, a recorded refusal, or an account usage
+ * window over `JUDGE_USAGE_WINDOW_LIMIT_PERCENT`.
+ *
+ * @param {ValidatedContract} contract
+ * @param {string[]} list
+ * @param {string} workerId
+ * @param {{attempted?: Iterable<string>, now?: number}} [options]
+ * @returns {JudgeListPick}
+ */
+export function selectListJudge(contract, list, workerId, options = {}) {
+  const attempted = new Set(options.attempted ?? []);
+  const now = options.now ?? Date.now();
+  const workerProviders = reachableWorkerProviders(contract, workerId);
+  /** @type {JudgeSkip[]} */
+  const skipped = [];
+  for (const id of list) {
+    if (attempted.has(id)) {
+      skipped.push({ id, reason: "already attempted this run" });
+      continue;
+    }
+    const runtime = contract.runtimes[id];
+    if (!runtime) {
+      skipped.push({ id, reason: "not declared in contract.runtimes" });
+      continue;
+    }
+    const provider = effectiveProvider(runtime);
+    if (workerProviders.has(provider)) {
+      skipped.push({ id, reason: `same provider as the worker: ${provider}` });
+      continue;
+    }
+    const key = availabilityKey({ harness: runtime.harness, model: runtime.model, executable: getHarness(runtime.harness).executable(runtime) });
+    const refusal = readRefusal(key, now);
+    if (refusal) {
+      skipped.push({ id, reason: `recorded refusal: ${refusal.reason}` });
+      continue;
+    }
+    const window = overspentWindow(runtime, now);
+    if (window) {
+      skipped.push({ id, reason: `usage window ${window.window} at ${window.usedPercent}%, above ${JUDGE_USAGE_WINDOW_LIMIT_PERCENT}%` });
+      continue;
+    }
+    // An attempted entry after the pick is still recorded: `nextListJudge`
+    // rebuilds the attempted set from these entries alone, so dropping one
+    // here would let a later hop return to a judge that already refused.
+    const after = list.slice(list.indexOf(id) + 1).filter((later) => attempted.has(later));
+    return { chosen: id, skipped: [...skipped, ...after.map((later) => ({ id: later, reason: "already attempted this run" }))] };
+  }
+  return { chosen: null, skipped };
+}
+
+/**
+ * The judge-list evidence a node's initial assignment records: the list it
+ * read, the entry it chose (or null when every entry was skipped), and why
+ * each earlier one was.
+ *
+ * @param {ValidatedContract} contract
+ * @param {string[]} list
+ * @param {string} workerId
+ * @param {number} [now]
+ * @returns {JudgeListState}
+ */
+export function initialJudgeListState(contract, list, workerId, now = Date.now()) {
+  const pick = selectListJudge(contract, list, workerId, { now });
+  return { list, chosen: pick.chosen, skipped: pick.skipped };
+}
+
+/**
+ * The next hop out of a list-driven judge that was just refused: the current
+ * choice joins the excluded set (it is the one that just failed), so the same
+ * eligibility pass never returns to it -- the hop-by-hop rule. Only an entry
+ * that actually ran and then failed belongs in that excluded set; a candidate
+ * that was skipped for cause (same provider, a recorded refusal, an overspent
+ * window) is re-checked fresh instead, so it keeps its real reason rather than
+ * being relabelled "already attempted" on every later hop. A prior hop's own
+ * "already attempted this run" entries name exactly the ids that were chosen
+ * and failed before this one, so folding those back in carries that set
+ * forward without a dedicated field.
+ *
+ * @param {ValidatedContract} contract
+ * @param {JudgeListState} judgeListState
+ * @param {string} workerId
+ * @param {number} [now]
+ * @returns {JudgeListState}
+ */
+export function nextListJudge(contract, judgeListState, workerId, now = Date.now()) {
+  const previouslyChosen = judgeListState.skipped
+    .filter((entry) => entry.reason === "already attempted this run")
+    .map((entry) => entry.id);
+  const attempted = new Set([...previouslyChosen, ...(judgeListState.chosen ? [judgeListState.chosen] : [])]);
+  // A fresh pass re-derives the whole prefix up to (and including) wherever
+  // it lands: every id the loop reaches before returning is pushed to
+  // `pick.skipped`, on the first hop as on the fifth. That is already a
+  // complete accounting of this hop, so carrying the previous hops' entries
+  // forward too would only repeat each of them once per later hop.
+  const pick = selectListJudge(contract, judgeListState.list, workerId, { attempted, now });
+  return { list: judgeListState.list, chosen: pick.chosen, skipped: pick.skipped };
+}
+
+/**
+ * Does a judge's next fallback runtime share the vendor of the worker it
+ * would be reviewing? Reachability depends on which worker runtime actually
+ * ran, which a static contract cannot know, so this is checked at the moment
+ * a fallback is about to be taken rather than at contract validation.
+ * A list-driven pick already excludes the worker's reachable providers
+ * (`selectListJudge`), so this only ever fires for the single declared
+ * `runtime.fallback` edge.
+ *
+ * @param {ValidatedContract} contract
+ * @param {string|null|undefined} workerRuntimeId
+ * @param {string} nextRuntimeId
+ * @returns {{code: string, message: string}|null}
+ */
+export function judgeFallbackVendorConflict(contract, workerRuntimeId, nextRuntimeId) {
+  const workerVendor = workerRuntimeId ? contract.runtimes[workerRuntimeId]?.vendor : undefined;
+  const judgeFallbackVendor = contract.runtimes[nextRuntimeId]?.vendor;
+  if (!workerVendor || !judgeFallbackVendor || workerVendor !== judgeFallbackVendor) return null;
+  return {
+    code: "judge_fallback_vendor_conflict",
+    message: `judge fallback runtime ${nextRuntimeId} shares vendor ${judgeFallbackVendor} with worker runtime ${workerRuntimeId}`,
+  };
+}

package/src/engine/lifecycle.mjs

@@ -35,9 +35,10 @@ import {
 import { exhaustedUntilOf } from "./runtime-discovery.mjs";
 import { getHarness, normalizeProviderAvailability } from "../harnesses/index.mjs";
 import { availabilityKey, recordRefusal, refusalOfAvailability } from "../run/availability.mjs";
+import { judgeFallbackVendorConflict, nextListJudge } from "./judge-list.mjs";
 
 import { acquire as acquireLock } from "../run/lock.mjs";
-import { parseDiscoveryResult } from "../contract/worker-result.mjs";
+import { invalidResultRepair, parseDiscoveryResult } from "../contract/worker-result.mjs";
 import { boundedUtf8, errorCode, errorMessage, excerpt } from "../util.mjs";
 import { readJson, writeJsonAtomic } from "../run/store.mjs";
 import { invocationAlive } from "./process.mjs";
@@ -443,7 +444,7 @@ export async function finalizeClosedJobs(contract, runDir, states, closed, lock,
     // path fails it today.
     if (workerResultError) {
       if (envelope.status === "done") {
-        await applyInvalidWorkerResult(contract, job.node, state, runDir, running, lock, errorMessage(workerResultError), states, campaignPath);
+        await applyInvalidWorkerResult(contract, job.node, state, runDir, running, lock, workerResultError, states, campaignPath);
         continue;
       }
       adoptedWorkerResult = null;
@@ -549,7 +550,7 @@ export async function finalizeClosedJobs(contract, runDir, states, closed, lock,
           }, lock);
           continue;
         }
-        await applyInvalidWorkerResult(contract, job.node, state, runDir, running, lock, errorMessage(error), states, campaignPath);
+        await applyInvalidWorkerResult(contract, job.node, state, runDir, running, lock, error, states, campaignPath);
         continue;
       }
       // The artifact demand follows the documented discovery contract, not the
@@ -562,7 +563,7 @@ export async function finalizeClosedJobs(contract, runDir, states, closed, lock,
         try {
           parseDiscoveryResult(workerResult, attemptWorkspace(state) ?? contract.cwd);
         } catch (error) {
-          await applyInvalidWorkerResult(contract, job.node, state, runDir, running, lock, errorMessage(error), states, campaignPath);
+          await applyInvalidWorkerResult(contract, job.node, state, runDir, running, lock, error, states, campaignPath);
           continue;
         }
       }
@@ -641,7 +642,15 @@ export function handleProviderExhaustion(contract, runDir, node, state, role, en
   const runtime = contract.runtimes?.[current];
   const refusal = runtime ? refusalOfAvailability(normalizeProviderAvailability(runtime, envelope)) : null;
   if (runtime && refusal) recordRefusal(availabilityKey({ harness: runtime.harness, model: runtime.model, executable: getHarness(runtime.harness).executable(runtime) }), refusal);
-  const plan = planRoute(contract, node, state, role, error, current, schedule, now, exhaustedUntil);
+  // R18: a list-driven judge that is about to hop reads the durable refusal
+  // and usage-window stores here -- the impure orchestration layer, not
+  // `planRoute`'s pure decision -- so `current` joins the excluded set before
+  // the next eligible entry is chosen. A reset (wait, no hop) leaves the list
+  // untouched: it costs no runtime and must not spend a list entry either.
+  const judgeListState = role === "judge" && schedule.kind === "failover" && state.routing?.judgeList
+    ? nextListJudge(contract, state.routing.judgeList, sourceWorkerRuntime(state) ?? state.routing?.assignments?.worker ?? current, now)
+    : undefined;
+  const plan = planRoute(contract, node, state, role, error, current, schedule, now, exhaustedUntil, judgeListState ? { judgeListState } : {});
   const status = envelope.status === "failed" ? "failed" : "exhausted";
   if (plan.blocked) {
     // A caller that classified the failure itself also owns what happens when
@@ -659,17 +668,21 @@ export function handleProviderExhaustion(contract, runDir, node, state, role, en
         phase: role,
         result: state.result,
         usage: state.usage,
-        routing: { ...(state.routing ?? {}), tierExhaustion },
+        routing: { ...(state.routing ?? {}), tierExhaustion, ...(judgeListState ? { judgeList: judgeListState } : {}) },
         error: { ...plan.blocked, ...(exhaustedUntil ? { exhaustedUntil } : {}) },
       }, lock);
       void raiseNodeAttention(campaignPath, runDir, state, plan.blocked.code).catch(() => {});
     } else {
-      // Any other block reason is not this feature's evidence to keep.
+      // `judge_list_exhausted` reaches this branch (it is not
+      // `runtime_tier_exhausted`), and its evidence -- naming the judge that
+      // was just refused and why every remaining entry was ineligible -- is
+      // exactly this feature's evidence to keep; only `tierExhaustion` is not.
       clearTierExhaustion(state);
       transition(runDir, state, "exhausted", {
         phase: role,
         result: state.result,
         usage: state.usage,
+        ...(judgeListState ? { routing: { ...(state.routing ?? {}), judgeList: judgeListState } } : {}),
         error: { ...plan.blocked, ...(exhaustedUntil ? { exhaustedUntil } : {}) },
       }, lock);
     }
@@ -681,21 +694,11 @@ export function handleProviderExhaustion(contract, runDir, node, state, role, en
   // so it is refused here, and the node is parked for a human rather than
   // quietly arbitrated by the vendor it is supposed to check.
   if (role === "judge" && plan.nextRuntime !== current) {
-    const workerRuntimeId = sourceWorkerRuntime(state);
-    const workerVendor = workerRuntimeId ? contract.runtimes[workerRuntimeId]?.vendor : undefined;
-    const judgeFallbackVendor = contract.runtimes[plan.nextRuntime]?.vendor;
-    if (workerVendor && judgeFallbackVendor && workerVendor === judgeFallbackVendor) {
+    const conflict = judgeFallbackVendorConflict(contract, sourceWorkerRuntime(state), plan.nextRuntime);
+    if (conflict) {
       if (precomputed) return false;
       clearTierExhaustion(state);
-      transition(runDir, state, "blocked", {
-        phase: role,
-        result: state.result,
-        usage: state.usage,
-        error: {
-          code: "judge_fallback_vendor_conflict",
-          message: `judge fallback runtime ${plan.nextRuntime} shares vendor ${judgeFallbackVendor} with worker runtime ${workerRuntimeId}`,
-        },
-      }, lock);
+      transition(runDir, state, "blocked", { phase: role, result: state.result, usage: state.usage, error: conflict }, lock);
       return true;
     }
   }
@@ -737,19 +740,21 @@ function applyRoute(contract, runDir, state, lock, { role, error, current, plan,
  * told to return. A second one is evidence about the provider rather than the
  * packet, so the node records a protocol_failure and takes its failover edge —
  * and when no edge remains, it blocks and raises attention rather than filing
- * a quiet exhaustion nobody reads.
+ * a quiet exhaustion nobody reads. The repair names what was wrong
+ * (invalidResultRepair), so a broken byte ceiling is not told about fences.
  *
- * @param {ValidatedContract} contract @param {ValidatedNode} node @param {NodeSnapshot} state @param {string} runDir @param {Map<string, Job>|null} running @param {LockHandle} lock @param {string} message @param {Map<string, NodeSnapshot>} states @param {string} campaignPath
+ * @param {ValidatedContract} contract @param {ValidatedNode} node @param {NodeSnapshot} state @param {string} runDir @param {Map<string, Job>|null} running @param {LockHandle} lock @param {unknown} cause @param {Map<string, NodeSnapshot>} states @param {string} campaignPath
  */
-export async function applyInvalidWorkerResult(contract, node, state, runDir, running, lock, message, states, campaignPath) {
+export async function applyInvalidWorkerResult(contract, node, state, runDir, running, lock, cause, states, campaignPath) {
   clearTierExhaustion(state);
+  const message = errorMessage(cause);
   const verdict = /** @type {JudgeVerdict} */ ({
     verdict: "fail",
     maxSeverity: "critical",
     summary: "worker result did not match the structured result protocol",
     findings: [{
       severity: "critical",
-      description: "the entire final message must be exactly the required JSON object: no markdown fences, no prose before or after it. Return it as the only content of the final message.",
+      description: invalidResultRepair(cause),
       evidence: boundedUtf8(message, 4 * 1024),
     }],
   });

package/src/engine/resume.mjs

@@ -44,6 +44,7 @@ import { validateRunMetadata, OPERATOR_ANSWER_MAX_BYTES } from "../contract/snap
 import { verificationFailureVerdict } from "./judge-gate.mjs";
 import { verificationFailureWithScope } from "../contract/scope-findings.mjs";
 import { applyRejection, applyVerificationFailure, raiseNodeAttention, settleDone } from "./settle.mjs";
+import { isHumanStepPending } from "../contract/human-step.mjs";
 
 /** @typedef {import("../repo/integrate.mjs").IntegrationResult} IntegrationResult */
 /** @typedef {import("./lifecycle.mjs").Invocation} Invocation */
@@ -139,16 +140,37 @@ export async function resumeRun(runDirPath, options = {}) {
       const answerNode = contract.nodes.find((node) => node.id === options.answer?.node);
       if (!answerNode) throw new Error(`unknown node id: ${options.answer.node}`);
       const answerState = states.get(options.answer.node);
-      if (!answerState || !isBlockedContextTerminal(answerState)) {
-        throw new Error(`node ${options.answer.node} is not blocked on missing context`);
-      }
       const answerText = readOperatorAnswer(options.answer.path);
-      const answerOverride = /** @type {import("../contract/index.mjs").ExecutionOverride} */ (/** @type {unknown} */ ({
-        kind: "operator-answer",
-        reason: `operator answered missing context for node ${options.answer.node}`,
-        text: answerText,
-      }));
-      recordExecutionOverride(runDir, answerState, answerOverride, lock);
+      if (answerNode.humanStep) {
+        if (!answerState || !isHumanStepPending(answerState)) {
+          throw new Error(`node ${options.answer.node} is not a pending human step`);
+        }
+        recordExecutionOverride(runDir, answerState, /** @type {import("../contract/index.mjs").ExecutionOverride} */ (/** @type {unknown} */ ({
+          kind: "operator-answer",
+          reason: `operator confirmed the human step for node ${options.answer.node}`,
+          text: answerText,
+        })), lock);
+        // A human step never dispatches to a provider and leaves no attempt
+        // worktree for `settleDone` to seal and integrate -- the operator's
+        // confirmation is the whole of its work, so it settles done directly,
+        // here, before `planResumeRetry` (which knows nothing of `humanStep`)
+        // ever classifies it.
+        transition(runDir, answerState, "done", {
+          phase: "complete",
+          error: null,
+          result: { status: "done", summary: boundedSummary(answerText.trim() || answerNode.humanStep.step), verification: [], artifacts: [], missingContext: [] },
+        }, lock);
+      } else {
+        if (!answerState || !isBlockedContextTerminal(answerState)) {
+          throw new Error(`node ${options.answer.node} is not blocked on missing context`);
+        }
+        const answerOverride = /** @type {import("../contract/index.mjs").ExecutionOverride} */ (/** @type {unknown} */ ({
+          kind: "operator-answer",
+          reason: `operator answered missing context for node ${options.answer.node}`,
+          text: answerText,
+        }));
+        recordExecutionOverride(runDir, answerState, answerOverride, lock);
+      }
     }
     const plan = planResumeRetry(contract, states, { node: options.node, reconcile: options.reconcile, answer: options.answer?.node });
     for (const item of plan.attention) {
@@ -164,6 +186,7 @@ export async function resumeRun(runDirPath, options = {}) {
       if (!state) continue;
       if (state.status === "done") continue;
       if (isBlockedContextTerminal(state) && node.id !== options.answer?.node) continue;
+      if (isHumanStepPending(state) && node.id !== options.answer?.node) continue;
       const action = plan.actions.get(node.id) ?? "recover";
       // Adoption before retry: an unresolved blocking review is re-judged from
       // the preserved worker result, never reset to a fresh worker attempt.
@@ -284,7 +307,7 @@ export async function resumeRun(runDirPath, options = {}) {
             ? recoverWorkerResult(runDir, state, contract, node)
             : canonicalWorkerResultText(runDir, node.id) ?? recovery.result;
         } catch (error) {
-          await applyInvalidWorkerResult(contract, node, state, runDir, null, lock, errorMessage(error), states, campaign.path);
+          await applyInvalidWorkerResult(contract, node, state, runDir, null, lock, error, states, campaign.path);
           continue;
         }
         if (recovery.phase === "worker" && workerResult !== null && workerResult !== undefined) {
@@ -301,7 +324,7 @@ export async function resumeRun(runDirPath, options = {}) {
           try {
             parsedWorkerResult = parseWorkerResult(String(extractJson(workerResult) ?? workerResult));
           } catch (error) {
-            await applyInvalidWorkerResult(contract, node, state, runDir, null, lock, errorMessage(error), states, campaign.path);
+            await applyInvalidWorkerResult(contract, node, state, runDir, null, lock, error, states, campaign.path);
             continue;
           }
           // Same discriminator as lifecycle.mjs: the artifact is owed only by
@@ -311,7 +334,7 @@ export async function resumeRun(runDirPath, options = {}) {
             try {
               parseDiscoveryResult(parsedWorkerResult, attemptWorkspace(state) ?? contract.cwd);
             } catch (error) {
-              await applyInvalidWorkerResult(contract, node, state, runDir, null, lock, errorMessage(error), states, campaign.path);
+              await applyInvalidWorkerResult(contract, node, state, runDir, null, lock, error, states, campaign.path);
               continue;
             }
           }
@@ -523,6 +546,20 @@ export async function resumeRun(runDirPath, options = {}) {
 export function isBlockedContextTerminal(state) {
   return state.status === "blocked" && state.error?.code === "context_missing";
 }
+/**
+ * The operator-answer result summary for a human-step node's `done`
+ * transition, bounded to the worker-result protocol's own summary ceiling
+ * (`contract/worker-result.mjs`'s `RESULT_LIMITS.summaryBytes`) since this
+ * writes the same `result.summary` field a provider's own answer would.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+function boundedSummary(text) {
+  const maxBytes = 4 * 1024;
+  if (Buffer.byteLength(text, "utf8") <= maxBytes) return text;
+  return `${Buffer.from(text, "utf8").subarray(0, maxBytes - 1).toString("utf8")}…`;
+}
 /**
  * The routing write that opens the next tier-exhaustion generation, or null
  * when this re-dispatch is not one: the generation counter bumps by exactly