faberun 0.26.3 → 0.28.0

package/src/engine/judge-gate.mjs

@@ -177,18 +177,31 @@ function tapSelectedNothing(stdout) {
 }
 
 /**
- * The environment a filtered proof runs under: the ambient environment with
- * the TAP reporter selected through `NODE_OPTIONS`, minus `NODE_TEST_CONTEXT`.
- * That marker belongs to whichever test runner spawned this process; a nested
- * `node --test` that inherits it stays a runner child and emits no TAP at all
- * (measured 2026-09-21: with the marker the zero-plan line never appears,
- * without it exactly once) -- and a proof is judged as its own top-level run,
- * not as the suite's child.
+ * The full controller environment a Definition of Done verification proof runs
+ * under. A worker or judge receives the allowlist of `worker-env.mjs`; a
+ * verification command is the operator's own check and keeps today's
+ * environment (R1 constraint), secrets included. Exported so the gate test can
+ * assert that the verification spawn really carries the whole thing.
+ *
+ * @returns {NodeJS.ProcessEnv}
+ */
+export function verificationEnvironment() {
+  return { ...process.env };
+}
+
+/**
+ * The environment a filtered proof runs under: the full controller environment
+ * with the TAP reporter selected through `NODE_OPTIONS`, minus
+ * `NODE_TEST_CONTEXT`. That marker belongs to whichever test runner spawned
+ * this process; a nested `node --test` that inherits it stays a runner child
+ * and emits no TAP at all (measured 2026-09-21: with the marker the zero-plan
+ * line never appears, without it exactly once) -- and a proof is judged as its
+ * own top-level run, not as the suite's child.
  *
  * @returns {NodeJS.ProcessEnv}
  */
 function envForFilteredProof() {
-  const { NODE_TEST_CONTEXT: _outer, NODE_OPTIONS: existing, ...ambient } = process.env;
+  const { NODE_TEST_CONTEXT: _outer, NODE_OPTIONS: existing, ...ambient } = verificationEnvironment();
   return { ...ambient, NODE_OPTIONS: existing ? `${existing} --test-reporter=tap` : "--test-reporter=tap" };
 }
 
@@ -239,7 +252,9 @@ async function proveCommand(id, proof, cwd, timeoutMs) {
       shell: true,
       detached: process.platform !== "win32",
       stdio: ["ignore", "pipe", "pipe"],
-      ...(filters.length ? { env: envForFilteredProof() } : {}),
+      // A proof keeps the full controller environment, filtered or not; only
+      // the test-filter case swaps in the TAP reporter.
+      env: filters.length ? envForFilteredProof() : verificationEnvironment(),
     });
     let stdout = "";
     let stderr = "";

package/src/engine/live-preflight.mjs

@@ -23,6 +23,7 @@ import { spawn } from "node:child_process";
 import { boundedGitSync } from "../repo/worktree.mjs";
 import { tmpdir } from "node:os";
 import { validateContract } from "../contract/index.mjs";
+import { assertInlineScriptProofsParse } from "../contract/definition-of-done.mjs";
 import { validateNodeSnapshot } from "../contract/snapshot.mjs";
 import { compactCost as formatCost } from "../util.mjs";
 import { runsRoot } from "../run/paths.mjs";
@@ -34,6 +35,46 @@ import { runsRoot } from "../run/paths.mjs";
 
 const LIVE_PREFLIGHT_PROMPT = "Respond with exactly FABERUN_PREFLIGHT_OK and do not use tools.";
 const LIVE_PREFLIGHT_OUTPUT_LIMIT_BYTES = 512 * 1024;
+/** How much of a timed-out provider's tail reaches the detail. */
+const LIVE_PREFLIGHT_EXCERPT_BYTES = 512;
+/**
+ * The measured live-preflight budget, in seconds, and the floor under every
+ * runtime's default. Measured 2026-09-22: four routed runtimes asked in
+ * parallel took about 18s, so 60s holds for every caller -- the dispatch gate,
+ * `doctor`, `faberun plan` and `faberun preflight`. It lives here and only
+ * here; `run-identity.mjs` and `host/preflight.mjs` used to carry their own
+ * copies, and the CLI's preflight used to default to 15s.
+ * `FABERUN_PREFLIGHT_TIMEOUT_SEC` stays the operator override.
+ */
+export const LIVE_PREFLIGHT_TIMEOUT_SEC = 60;
+/**
+ * The lowest reasoning effort each harness accepts, applied to the liveness
+ * hello. The hello is one token: paying the effort a contract declares for the
+ * node's work -- a judge at `xhigh`, F10 -- to prove a credential works is what
+ * turned a deadline into a false failure. `zcode`, `exec-jsonl` and `replay`
+ * expose no effort transport, so there is nothing to lower for them.
+ *
+ * @type {Readonly<Record<string, string>>}
+ */
+const LIVE_PREFLIGHT_REASONING = Object.freeze({
+  claude: "low",
+  codex: "low",
+  agy: "low",
+  dsh: "off",
+});
+/**
+ * The causes `normalizeProviderAvailability` classifies out of provider text.
+ * A timeout whose tail names one of these is a provider that answered and then
+ * stopped talking, not silence, and the code the gate reads has to say so: a
+ * 401 the provider re-tried used to surface as `preflight_timeout` (F9).
+ */
+const PROVIDER_NAMED_CAUSES = new Set([
+  "authentication_failed",
+  "quota_exhausted",
+  "insufficient_balance",
+  "model_not_supported",
+  "credentials_missing",
+]);
 /**
  * `persisted` is for the dispatch gate, which hands over the run's own
  * serialized contract: that one was validated when it was authored, and
@@ -46,12 +87,16 @@ const LIVE_PREFLIGHT_OUTPUT_LIMIT_BYTES = 512 * 1024;
  * whole is part of the answer.
  *
  * @param {string} contractPath
- * @param {{static?: boolean, liveTimeoutSec?: number, minimumTimeoutSec?: number, persisted?: boolean}} [options]
+ * @param {{static?: boolean, liveTimeoutSec?: number, persisted?: boolean}} [options]
  * @returns {Promise<ProbeResult[]>}
  */
 export async function preflightContract(contractPath, options = {}) {
   const absoluteContractPath = resolve(contractPath);
   const contract = validateContract(JSON.parse(readFileSync(absoluteContractPath, "utf8")), absoluteContractPath, options.persisted === true ? { persisted: true } : {});
+  // R34: every command proof that is an inline script is parsed before the
+  // first dispatch, so a body no attempt could ever make exit 0 refuses the
+  // launch here, naming its node and item, instead of after three paid tries.
+  assertInlineScriptProofsParse(contract.nodes);
   return preflightRuntimes([...reachableRuntimes(contract).values()], { ...options, cwd: contract.cwd });
 }
 
@@ -70,7 +115,7 @@ export async function preflightContract(contractPath, options = {}) {
  * once, so a caller cannot accidentally ask a different question.
  *
  * @param {{runtime: RuntimeSnapshot, requiredCapabilitySets?: import("../harnesses/index.mjs").CapabilityRequirements[]}[]} entries
- * @param {{static?: boolean, liveTimeoutSec?: number, minimumTimeoutSec?: number, cwd?: string}} [options]
+ * @param {{static?: boolean, liveTimeoutSec?: number, cwd?: string}} [options]
  * @returns {Promise<ProbeResult[]>}
  */
 export async function preflightRuntimes(entries, options = {}) {
@@ -95,7 +140,7 @@ export async function preflightRuntimes(entries, options = {}) {
   }
   try {
     return await Promise.all(staticChecks.map(async (check, index) => {
-      const live = await livePreflight(runtimes[index], liveRepo, configuredTimeoutSec ?? Math.max(options.minimumTimeoutSec ?? 0, defaultLivePreflightTimeout(runtimes[index])));
+      const live = await livePreflight(runtimes[index], liveRepo, configuredTimeoutSec ?? defaultLivePreflightTimeout(runtimes[index]));
       const liveDetail = live.status === "done"
         ? `live done · usage ${formatUsage(live.usage)} · cost ${formatCost(live.costUsd)}`
         : `live ${live.status} · ${live.error?.code ?? "provider_error"}: ${redactProviderText(live.error?.message ?? "generation failed")} · usage ${formatUsage(live.usage)} · cost ${formatCost(live.costUsd)}`;
@@ -146,8 +191,7 @@ export function defaultLivePreflightTimeout(runtime) {
   // Keep LIVE_PREFLIGHT_CEILING_SEC equal to the largest value returned here.
   const reasoning = /** @type {{reasoning?: unknown}} */ (runtime).reasoning;
   if (reasoning === "xhigh" || reasoning === "max") return 180;
-  if (reasoning === "high") return 60;
-  return 15;
+  return LIVE_PREFLIGHT_TIMEOUT_SEC;
 }
 /**
  * The longest a live preflight can take without an explicit budget: what a
@@ -180,13 +224,15 @@ function createLivePreflightRepo() {
  * @returns {RuntimeSnapshot}
  */
 function safeLiveRuntime(runtime) {
-  if (runtime.harness === "codex") return { ...runtime, sandbox: "read-only" };
-  if (runtime.harness === "dsh") return { ...runtime, sandbox: "read-only" };
-  if (runtime.harness === "claude") return { ...runtime, permissionMode: "plan" };
+  const effort = LIVE_PREFLIGHT_REASONING[runtime.harness];
+  const safe = effort ? { ...runtime, reasoning: effort } : { ...runtime };
+  if (safe.harness === "codex") return { ...safe, sandbox: "read-only" };
+  if (safe.harness === "dsh" || safe.harness === "fx") return { ...safe, sandbox: "read-only" };
+  if (safe.harness === "claude") return { ...safe, permissionMode: "plan" };
   // `plan` is the ZCode mode that reads without writing; the adapter's own
   // default is `yolo`, which a preflight prompt must never reach.
-  if (runtime.harness === "zcode") return { ...runtime, permissionMode: "plan" };
-  return { ...runtime };
+  if (safe.harness === "zcode") return { ...safe, permissionMode: "plan" };
+  return safe;
 }
 /**
  * @param {RuntimeSnapshot} runtime
@@ -274,14 +320,7 @@ function livePreflight(runtime, cwd, timeoutSec) {
     }));
     child.once("close", (exitCode, signalName) => {
       if (timedOut) {
-        finish({
-          status: "failed",
-          result: null,
-          continuationId: null,
-          usage: emptyUsage(),
-          costUsd: null,
-          error: { code: "preflight_timeout", message: `live generation timed out after ${timeoutSec}s` },
-        });
+        finish(timedOutEnvelope(safeRuntime, stdout, stderr, timeoutSec));
         return;
       }
       /** @type {ProviderEnvelope} */
@@ -314,6 +353,63 @@ function appendBounded(current, chunk, limit) {
   const combined = Buffer.concat([Buffer.from(current), Buffer.from(chunk)]);
   return (combined.length > limit ? combined.subarray(combined.length - limit) : combined).toString("utf8");
 }
+/**
+ * A timed-out process is not automatically a silent one. A provider that
+ * re-tries a 401, or prints a quota refusal and then hangs, said plenty before
+ * the wall-clock kill; the kill signal is ours, not the provider's, so the tail
+ * is classified the way a closed process is classified and the redacted excerpt
+ * is attached. Only a tail that names no provider cause stays
+ * `preflight_timeout`.
+ *
+ * @param {RuntimeSnapshot} runtime
+ * @param {string} stdout
+ * @param {string} stderr
+ * @param {number} timeoutSec
+ * @returns {ProviderEnvelope}
+ */
+function timedOutEnvelope(runtime, stdout, stderr, timeoutSec) {
+  const tail = appendBounded(stdout, `\n${stderr}`, LIVE_PREFLIGHT_EXCERPT_BYTES).trim();
+  const cause = classifiedTimeoutCause(runtime, stdout, stderr, tail);
+  const excerpt = redactProviderText(tail);
+  return {
+    status: "failed",
+    result: null,
+    continuationId: null,
+    usage: emptyUsage(),
+    costUsd: null,
+    error: {
+      code: cause ?? "preflight_timeout",
+      message: `live generation timed out after ${timeoutSec}s${excerpt ? ` · ${excerpt}` : ""}`,
+    },
+  };
+}
+/**
+ * The provider cause a timed-out tail names, or null when it names none. The
+ * harness adapter knows which event or line carries it, so the output is first
+ * normalized as if it had exited -- with the signal suppressed, because the
+ * signal at this point is ours -- and then classified through the same
+ * availability vocabulary an exited process uses. A harness that wrote the
+ * cause only to stderr still named it: the bounded raw tail is classified
+ * directly as the fallback.
+ *
+ * @param {RuntimeSnapshot} runtime
+ * @param {string} stdout
+ * @param {string} stderr
+ * @param {string} tail
+ * @returns {string|null}
+ */
+function classifiedTimeoutCause(runtime, stdout, stderr, tail) {
+  try {
+    const envelope = normalizeProviderResult(runtime, stdout, null, null, { stderr });
+    const availability = normalizeProviderAvailability(runtime, envelope);
+    if (PROVIDER_NAMED_CAUSES.has(availability.reason)) return availability.reason;
+  } catch {
+    // An unparsable tail still gets the raw-text classification below.
+  }
+  if (!tail) return null;
+  const availability = normalizeProviderAvailability(runtime, { status: "failed", error: { code: "provider_error", message: tail } });
+  return PROVIDER_NAMED_CAUSES.has(availability.reason) ? availability.reason : null;
+}
 /** @param {{inputTokens: number|null, outputTokens: number|null, cacheReadInputTokens: number|null}|undefined} usage */
 function formatUsage(usage) {
   if (!usage) return "in - out - cache -";

package/src/engine/prompts.mjs

@@ -1,9 +1,10 @@
 import { validateWorkerResult } from "../contract/worker-result.mjs";
 import { scopeFindingsPromptSection } from "../contract/scope-findings.mjs";
 import { JUDGE_ENVELOPE_REASON, JUDGE_FINDING_ENVELOPE_REASON, JUDGE_LIMITS } from "../contract/judge-envelope.mjs";
+import { RESERVED_OWNER_DECISIONS, uncoveredReservedOwnerDecisions } from "../contract/articles.mjs";
 import { harnessCapabilities } from "../harnesses/index.mjs";
 
-/** @typedef {{id: string, definitionOfDone: import("../contract/definition-of-done.mjs").DefinitionOfDoneItem[], taskPacket: {mode?: "execution"|"discovery"|"autonomous", objective: string, instructions: string[], writeFiles?: string[], writeRoots?: string[], verification: {argv: string[]}[]}}} JudgeNode */
+/** @typedef {{id: string, definitionOfDone: import("../contract/definition-of-done.mjs").DefinitionOfDoneItem[], taskPacket: {mode?: "execution"|"discovery"|"autonomous", objective: string, instructions: string[], decisions?: string[], writeFiles?: string[], writeRoots?: string[], verification: {argv: string[]}[]}}} JudgeNode */
 /** @typedef {{verdict: "pass"|"fail"|"invalid_judge_output", maxSeverity: "none"|"minor"|"major"|"critical", summary: string, findings: {severity: "minor"|"major"|"critical", description: string, evidence: string}[]}} JudgeVerdict */
 
 /**
@@ -178,10 +179,33 @@ function judgeVerificationEvidence(verification) {
   };
 }
 
+/** Heading `renderPreviousAttemptSection` (engine/retry.mjs) writes an operator answer under. */
+const OPERATOR_ANSWER_HEADING = "Operator answer:";
+
+/**
+ * The latest operator answer carried by a `Previous attempt` section, or null.
+ * `renderPreviousAttemptSection` writes it verbatim under the heading, so the
+ * judge reads the same newest answer the worker read without a second copy on
+ * the node snapshot. A second `--answer` appends an override and the section is
+ * rebuilt from the newest record on the next resume.
+ *
+ * @param {unknown} previousAttempt
+ * @returns {string|null}
+ */
+export function previousAttemptOperatorAnswer(previousAttempt) {
+  if (typeof previousAttempt !== "string") return null;
+  const start = previousAttempt.indexOf(OPERATOR_ANSWER_HEADING);
+  if (start < 0) return null;
+  const rest = previousAttempt.slice(start + OPERATOR_ANSWER_HEADING.length);
+  const stop = rest.search(/^(?:Attempt \d+ failed|Error:|Judge findings|Scope findings|Failing verification:)/mu);
+  const answer = (stop >= 0 ? rest.slice(0, stop) : rest).trim();
+  return answer || null;
+}
+
 /**
  * @param {JudgeNode} node
  * @param {unknown} workerResult
- * @param {{diff?: unknown[], verification?: unknown, deterministic?: unknown, scopeFindings?: {unexpectedPaths: string[]}|null, previousAttempt?: string}} context
+ * @param {{diff?: unknown[], verification?: unknown, deterministic?: unknown, scopeFindings?: {unexpectedPaths: string[]}|null, previousAttempt?: string, operatorAnswer?: string}} context
  * @returns {string}
  */
 export function judgePrompt(node, workerResult, context = {}) {
@@ -211,9 +235,23 @@ export function judgePrompt(node, workerResult, context = {}) {
   const diff = Array.isArray(context.diff) ? /** @type {unknown[]} */ (context.diff).slice(0, 64) : [];
   const verificationResult = judgeVerificationEvidence(context.verification);
   const scopeSection = scopeFindingsPromptSection(context.scopeFindings);
+  const decisions = node.taskPacket.decisions ?? [];
+  const uncoveredReserved = uncoveredReservedOwnerDecisions(decisions);
+  const operatorAnswer = typeof context.operatorAnswer === "string" && context.operatorAnswer.trim()
+    ? context.operatorAnswer.trim()
+    : previousAttemptOperatorAnswer(context.previousAttempt);
+  const decisionsSection =
+    `Decisions already made by the operator:\n${decisions.length ? decisions.map((decision) => `- ${decision}`).join("\n") : "- (none)"}\n\n` +
+    `Reserved owner decisions (the repository owner alone decides these):\n${RESERVED_OWNER_DECISIONS.map((decision) => `- ${decision}`).join("\n")}\n\n` +
+    `Reserved owner decisions with no coverage in the decisions above:\n${uncoveredReserved.length ? uncoveredReserved.map((decision) => `- ${decision}`).join("\n") : "- (none)"}\n\n` +
+    "A diff that takes an owner decision with no coverage is a blocking finding: fail and name the decision. Referencing an existing owner decision does not take it.";
+  const operatorSection = operatorAnswer
+    ? `Operator answer:\n${operatorAnswer}\n\nThat operator answer is a blocking judgment item: an unmet answer is a blocking finding, so fail with a finding that cites the Definition of Done judgment item the answer bears on, and do not pass work that ignores it.`
+    : "";
   return `Review node ${node.id} independently. The review context is closed: inspect only the ${node.taskPacket.mode === "autonomous" ? "write roots" : "write files"} below and do not perform repository-wide discovery. Do not re-run the verification commands — the controller already executed them and attached the results; re-running suites duplicates cost without adding evidence.\n\n` +
     `${writeBoundaryLabel}:\n${writeFiles}\n\nVerification commands (already executed by the controller):\n${verification}\n\n` +
-    `Task brief:\n${node.taskPacket.objective}\n\nInstructions:\n${taskInstructions}\n\nDefinition of Done:\n${criteria}\n\n` +
+    `Task brief:\n${node.taskPacket.objective}\n\nInstructions:\n${taskInstructions}\n\n${decisionsSection}\n\nDefinition of Done:\n${criteria}\n\n` +
+    (operatorSection ? `${operatorSection}\n\n` : "") +
     `Worker result (structured):\n${structured ? JSON.stringify(structured) : "(invalid worker result withheld)"}\n\n` +
     `Controller diff paths:\n${diff.length ? diff.map((path) => `- ${path}`).join("\n") : "- (none)"}\n\n` +
     `Controller verification:\n${JSON.stringify(verificationResult)}\n\n` +

package/src/engine/resume.mjs

@@ -12,13 +12,14 @@
  * contract left open, and only from runtimes that are available now: a resume
  * after an exhausted provider is exactly when that matters.
  */
-import { JUDGE_SCHEMA, SETTLED } from "./prompts.mjs";
+import { JUDGE_SCHEMA, SETTLED, TERMINAL } from "./prompts.mjs";
 import { Buffer } from "node:buffer";
 import { acquire as acquireLock } from "../run/lock.mjs";
 import { applyInvalidWorkerResult, assertRunMutable, handleProviderExhaustion } from "./lifecycle.mjs";
 import { applyJudgeResult } from "./review.mjs";
 import { assertSourceUnchanged, captureRunIdentity, recordedBaseRef, statesFingerprint } from "./run-identity.mjs";
 import { attemptWorkspace, gitHead, removeWorktree, runRefName } from "../repo/worktree.mjs";
+import { replacePacketInContract, widenTaskPacket } from "../repo/scope-closure.mjs";
 import { attemptWorktreePath } from "../run/paths.mjs";
 import { canonicalWorkerResultText, isResultMaterializationInvocation, materializeAttemptResult, recoverWorkerResult } from "./result-file.mjs";
 import { checkPersistedWorkerScope, persistedScopeBoundary, reconcileAmbiguousWorkerRestart, resolveUnknownEffect } from "./scope.mjs";
@@ -35,16 +36,17 @@ import { hasOperationIntent, hasOperationSettlement, operationNeedsRecovery, pro
 import { isUnknownEffectStop, planResumeRetry, renderPreviousAttemptSection } from "./retry.mjs";
 import { join, resolve } from "node:path";
 import { parseDiscoveryResult, parseWorkerResult } from "../contract/worker-result.mjs";
-import { readJson, writeJsonAtomic } from "../run/store.mjs";
+import { readJson, writeJsonAtomic, appendJsonl } from "../run/store.mjs";
 import { recoverIntegrations } from "../repo/integrate.mjs";
 import { registerRun, resolveCampaign } from "../campaign/index.mjs";
 import { syncAgentSignal } from "../repo/signal.mjs";
 import { validateContract } from "../contract/index.mjs";
 import { validateRunMetadata, OPERATOR_ANSWER_MAX_BYTES } from "../contract/snapshot.mjs";
 import { verificationFailureVerdict } from "./judge-gate.mjs";
-import { verificationFailureWithScope } from "../contract/scope-findings.mjs";
+import { verificationFailureWithScope, reauthorProposalRecord, reauthorWriteConflicts, reauthorRiskTier, reauthorApproved } from "../contract/scope-findings.mjs";
 import { applyRejection, applyVerificationFailure, raiseNodeAttention, settleDone } from "./settle.mjs";
 import { isHumanStepPending } from "../contract/human-step.mjs";
+import { runBoundedRounds } from "../plan/rounds.mjs";
 
 /** @typedef {import("../repo/integrate.mjs").IntegrationResult} IntegrationResult */
 /** @typedef {import("./lifecycle.mjs").Invocation} Invocation */
@@ -84,11 +86,14 @@ export function recoveryExhaustionEnvelope(recovery, invocation) {
 
 /**
  * @param {string} runDirPath
- * @param {{node?: string, reconcile?: string, answer?: {node: string, path: string}, detachedBootstrap?: boolean}} [options]
+ * @param {{node?: string, reconcile?: string, answer?: {node: string, path: string}, detachedBootstrap?: boolean, reauthor?: {node: string, discover: (context: {round: number, node: import("../contract/index.mjs").ValidatedNode, state: NodeSnapshot, missingContext: string[], findings: string[]}) => (import("../contract/scope-findings.mjs").ReauthorAdditions|Promise<import("../contract/scope-findings.mjs").ReauthorAdditions>), rounds?: number, approve?: boolean, approveBelow?: string}}} [options]
  *   `node` limits the retry in place to one node and its dependants,
  *   `reconcile` acknowledges a node stopped as `unknown_effect_reconciled`,
- *   `answer` records an operator's answer for a node blocked on
- *   `context_missing` and re-dispatches it, and
+ *   `answer` records an operator's answer for any non-terminal node and
+ *   re-dispatches it,
+ *   `reauthor` widens one `context_missing` node's packet from a bounded
+ *   discovery pass and re-dispatches it once the widening validates and is
+ *   approved, and
  *   `detachedBootstrap` is set only by the CLI entry when this process is its
  *   own detached child
  * @returns {Promise<RunOutcome>}
@@ -100,10 +105,16 @@ export async function resumeRun(runDirPath, options = {}) {
   if (options.node && options.answer && options.node !== options.answer.node) {
     throw new Error(`--answer ${options.answer.node} conflicts with --node ${options.node}`);
   }
+  if (options.reauthor && options.node && options.reauthor.node !== options.node) {
+    throw new Error(`--reauthor ${options.reauthor.node} conflicts with --node ${options.node}`);
+  }
+  if (options.reauthor && options.answer) {
+    throw new Error(`--reauthor ${options.reauthor.node} cannot be combined with --answer ${options.answer.node}`);
+  }
   const runDir = resolve(runDirPath);
   assertRunMutable(runDir);
   const contractPath = join(runDir, "contract.json");
-  const contract = validateContract(JSON.parse(readFileSync(contractPath, "utf8")), contractPath, { persisted: true });
+  let contract = validateContract(JSON.parse(readFileSync(contractPath, "utf8")), contractPath, { persisted: true });
   const lock = acquireLock(runDir);
   try {
     const storedMetadata = validateRunMetadata(readJson(join(runDir, "run.json")), { requireSourceIdentity: true });
@@ -161,15 +172,51 @@ export async function resumeRun(runDirPath, options = {}) {
           result: { status: "done", summary: boundedSummary(answerText.trim() || answerNode.humanStep.step), verification: [], artifacts: [], missingContext: [] },
         }, lock);
       } else {
-        if (!answerState || !isBlockedContextTerminal(answerState)) {
-          throw new Error(`node ${options.answer.node} is not blocked on missing context`);
+        // Any non-terminal node accepts an operator answer, not only the
+        // `context_missing` boundary. A node that already reached a terminal
+        // status has no attempt left to receive the answer, so it is refused
+        // here -- in the engine, where the resume decisions are made and the
+        // engine test can reach the gate.
+        if (!answerState || TERMINAL.has(answerState.status)) {
+          throw new Error(`node ${options.answer.node} is not blocked on missing context and is terminal, so it cannot accept an operator answer`);
         }
         const answerOverride = /** @type {import("../contract/index.mjs").ExecutionOverride} */ (/** @type {unknown} */ ({
           kind: "operator-answer",
-          reason: `operator answered missing context for node ${options.answer.node}`,
+          reason: `operator answered node ${options.answer.node}`,
           text: answerText,
         }));
         recordExecutionOverride(runDir, answerState, answerOverride, lock);
+        // Render the answer into the bounded `Previous attempt` section before
+        // classification. The retry path below renders it too, but a parked
+        // node the recover path re-dispatches would otherwise carry the
+        // override without ever showing it to the worker.
+        answerState.previousAttempt = renderPreviousAttemptSection(answerState) ?? answerState.previousAttempt;
+      }
+    }
+    /** @type {string|null} */
+    let reauthorAppliedNode = null;
+    if (options.reauthor) {
+      const targetNode = contract.nodes.find((node) => node.id === options.reauthor?.node);
+      const targetState = states.get(options.reauthor.node);
+      if (!targetNode) throw new Error(`unknown node id: ${options.reauthor.node}`);
+      if (!targetState) throw new Error(`missing persisted node snapshot for ${options.reauthor.node}`);
+      const reauthorBudget = options.reauthor.rounds ?? DEFAULT_REAUTHOR_ROUNDS;
+      const outcome = await reauthorRefusedNode({
+        contract, contractPath, runDir, node: targetNode, state: targetState,
+        discover: options.reauthor.discover,
+        rounds: reauthorBudget,
+        approve: options.reauthor.approve === true,
+        approveBelow: options.reauthor.approveBelow,
+      });
+      process.stdout.write(`[resume] ${contract.id} · reauthor ${targetNode.id} · ${outcome.outcome} (${outcome.roundsUsed}/${reauthorBudget} round${reauthorBudget === 1 ? "" : "s"})\n`);
+      if (outcome.applied && outcome.contract && outcome.raw) {
+        contract = outcome.contract;
+        const replacement = contract.nodes.find((node) => node.id === targetNode.id);
+        if (!replacement) throw new Error(`widened contract lost node ${targetNode.id}`);
+        targetState.packetHash = replacement.packetHash;
+        targetState.sourceIdentity = replacement.sourceIdentity;
+        writeJsonAtomic(contractPath, outcome.raw);
+        reauthorAppliedNode = targetNode.id;
       }
     }
     const plan = planResumeRetry(contract, states, { node: options.node, reconcile: options.reconcile, answer: options.answer?.node });
@@ -185,9 +232,9 @@ export async function resumeRun(runDirPath, options = {}) {
       const state = states.get(node.id);
       if (!state) continue;
       if (state.status === "done") continue;
-      if (isBlockedContextTerminal(state) && node.id !== options.answer?.node) continue;
+      if (isBlockedContextTerminal(state) && node.id !== options.answer?.node && node.id !== reauthorAppliedNode) continue;
       if (isHumanStepPending(state) && node.id !== options.answer?.node) continue;
-      const action = plan.actions.get(node.id) ?? "recover";
+      const action = node.id === reauthorAppliedNode ? "retry" : plan.actions.get(node.id) ?? "recover";
       // Adoption before retry: an unresolved blocking review is re-judged from
       // the preserved worker result, never reset to a fresh worker attempt.
       if (action === "rejudge") {
@@ -546,6 +593,66 @@ export async function resumeRun(runDirPath, options = {}) {
 export function isBlockedContextTerminal(state) {
   return state.status === "blocked" && state.error?.code === "context_missing";
 }
+/**
+ * The default number of discovery rounds a `resume --reauthor` spends widening
+ * one refused packet. The budget is hard: the round after this one never runs.
+ */
+export const DEFAULT_REAUTHOR_ROUNDS = 1;
+/** One round of the reauthor budget: its proposal, candidate, verdict, findings. */
+/** @typedef {{accepted: boolean, round: number, additions: import("../contract/scope-findings.mjs").ReauthorAdditions, packet: import("../contract/index.mjs").TaskPacket, candidate: Record<string, unknown>, widened: ValidatedContract|null, findings: string[]}} ReauthorRound */
+/**
+ * Run the bounded discovery pass for one `context_missing` node, validate the
+ * widened packet against the whole contract (per-node closure, the cross-node
+ * pair, and the write-overlap check no single packet can see), and return the
+ * decision. The caller owns applying it: an accepted packet below the approval
+ * threshold, or any packet the operator approved, is persisted and the node
+ * re-dispatched; everything else leaves the node refused.
+ *
+ * @param {{contract: ValidatedContract, contractPath: string, runDir: string, node: import("../contract/index.mjs").ValidatedNode, state: NodeSnapshot, discover: (context: {round: number, node: import("../contract/index.mjs").ValidatedNode, state: NodeSnapshot, missingContext: string[], findings: string[]}) => (import("../contract/scope-findings.mjs").ReauthorAdditions|Promise<import("../contract/scope-findings.mjs").ReauthorAdditions>), rounds?: number, approve?: boolean, approveBelow?: string}} options
+ * @returns {Promise<{accepted: boolean, roundsUsed: number, last: ReauthorRound|null, history: ReauthorRound[], applied: boolean, outcome: string, record: Record<string, unknown>, contract: ValidatedContract|null, raw: Record<string, unknown>|null}>}
+ */
+export async function reauthorRefusedNode(options) {
+  const { contract, contractPath, runDir, node, state, discover, rounds = DEFAULT_REAUTHOR_ROUNDS, approve = false, approveBelow } = options;
+  if (!isBlockedContextTerminal(state)) throw new Error(`node ${node.id} is not blocked on missing context, so it cannot be reauthored`);
+  if (typeof discover !== "function") throw new TypeError("resume --reauthor requires a discovery runner");
+  const raw = JSON.parse(readFileSync(contractPath, "utf8"));
+  const refused = /** @type {{missingContext?: string[]}|null|undefined} */ (state.result);
+  const missingContext = Array.isArray(refused?.missingContext) ? refused.missingContext : [];
+  const budget = await runBoundedRounds(rounds, async (round, history) => {
+    const additions = (await discover({ round, node, state, missingContext, findings: history.flatMap((item) => item.findings) })) ?? {};
+    const packet = widenTaskPacket(node.taskPacket, additions);
+    const candidate = replacePacketInContract(raw, node.id, packet);
+    const findings = reauthorWriteConflicts(contract.nodes, node.id, additions.writeFiles).map((conflict) => conflict.reason);
+    /** @type {ValidatedContract|null} */
+    let widened = null;
+    try {
+      widened = validateContract(candidate, contractPath);
+    } catch (error) {
+      findings.push(errorMessage(error));
+    }
+    const accepted = widened !== null && findings.length === 0;
+    if (accepted && widened) {
+      const replacement = widened.nodes.find((item) => item.id === node.id);
+      if (replacement) /** @type {any} */ (candidate).nodes.find((/** @type {any} */ item) => item.id === node.id).packetHash = replacement.packetHash;
+    }
+    return { accepted, round, additions, packet, candidate, widened, findings };
+  });
+  const last = budget.last;
+  const outcome = budget.accepted ? (reauthorApproved(node, { approve, approveBelow }) ? "applied" : "approval_required") : "rounds_exhausted";
+  const record = reauthorProposalRecord({
+    nodeId: node.id, outcome, riskTier: reauthorRiskTier(node), budget: rounds, roundsUsed: budget.roundsUsed,
+    additions: last?.additions, packet: last?.packet, findings: last?.findings, history: budget.history,
+  });
+  appendJsonl(join(runDir, "reauthor.jsonl"), record);
+  return {
+    ...budget,
+    applied: outcome === "applied",
+    outcome,
+    record,
+    contract: budget.accepted ? last?.widened ?? null : null,
+    raw: budget.accepted ? last?.candidate ?? null : null,
+  };
+}
 /**
  * The operator-answer result summary for a human-step node's `done`
  * transition, bounded to the worker-result protocol's own summary ceiling

package/src/engine/retry.mjs

@@ -15,12 +15,11 @@
  * exhausted run budget needs `--max-input-tokens <n>`.
  */
 import { Buffer } from "node:buffer";
+import { PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES } from "../contract/snapshot.mjs";
 
 /** Heading of the section appended to a retried attempt's worker and judge prompt. */
 const PREVIOUS_ATTEMPT_HEADING = "Previous attempt";
 
-/** Hard ceiling for the whole `Previous attempt` section, in bytes. */
-const PREVIOUS_ATTEMPT_MAX_BYTES = 8 * 1024;
 
 /** Heading under which an operator's answer is rendered inside the section. */
 const OPERATOR_ANSWER_HEADING = "Operator answer";
@@ -267,11 +266,6 @@ export function renderPreviousAttemptSection(state) {
   if (state.error?.code || state.error?.message) {
     parts.push(`Error: ${state.error?.code ?? "unknown"}${state.error?.message ? ` — ${bounded(state.error.message, 1024)}` : ""}`);
   }
-  const answer = mostRecentOperatorAnswer(state);
-  if (answer !== null) {
-    parts.push(`${OPERATOR_ANSWER_HEADING}:`);
-    parts.push(bounded(answer, 1024));
-  }
   const findings = state.gate?.findings ?? [];
   if (findings.length) {
     parts.push(`Judge findings (verdict ${state.gate?.verdict ?? "unknown"}, maxSeverity ${state.gate?.maxSeverity ?? "none"}):`);
@@ -293,8 +287,14 @@ export function renderPreviousAttemptSection(state) {
       if (typeof last?.exitCode === "number" && last.exitCode !== 0) parts.push(`  exit code: ${last.exitCode}`);
     }
   }
-  if (parts.length === 1) return null;
-  return boundSection([`## ${PREVIOUS_ATTEMPT_HEADING}`, "", ...parts].join("\n"));
+  const answer = mostRecentOperatorAnswer(state);
+  if (parts.length === 1 && answer === null) return null;
+  const evidence = boundSection([`## ${PREVIOUS_ATTEMPT_HEADING}`, "", ...parts].join("\n"));
+  // The answer was bounded where it was accepted (OPERATOR_ANSWER_MAX_BYTES),
+  // so it is carried whole, after the evidence and outside its budget.
+  // Measured 2026-09-28: bounded here at 1 KiB inside an 8 KiB section, an
+  // answer the engine had accepted and recorded reached the worker cut short.
+  return answer === null ? evidence : `${evidence}\n${OPERATOR_ANSWER_HEADING}:\n${answer}`;
 }
 
 /**
@@ -315,9 +315,9 @@ export function appendPreviousAttempt(prompt, section) {
  * @returns {string} the text bounded to the section ceiling, with a marker
  */
 function boundSection(text) {
-  if (Buffer.byteLength(text, "utf8") <= PREVIOUS_ATTEMPT_MAX_BYTES) return text;
+  if (Buffer.byteLength(text, "utf8") <= PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES) return text;
   const marker = "\n… (previous attempt section truncated)";
-  const room = PREVIOUS_ATTEMPT_MAX_BYTES - Buffer.byteLength(marker, "utf8") - 1;
+  const room = PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES - Buffer.byteLength(marker, "utf8") - 1;
   const cut = Buffer.from(text, "utf8").subarray(0, room).toString("utf8");
   return `${cut}${marker}`;
 }