faberun 0.27.0 → 0.29.0

package/src/engine/resume.mjs

@@ -12,13 +12,14 @@
  * contract left open, and only from runtimes that are available now: a resume
  * after an exhausted provider is exactly when that matters.
  */
-import { JUDGE_SCHEMA, SETTLED } from "./prompts.mjs";
+import { JUDGE_SCHEMA, SETTLED, TERMINAL } from "./prompts.mjs";
 import { Buffer } from "node:buffer";
 import { acquire as acquireLock } from "../run/lock.mjs";
 import { applyInvalidWorkerResult, assertRunMutable, handleProviderExhaustion } from "./lifecycle.mjs";
 import { applyJudgeResult } from "./review.mjs";
 import { assertSourceUnchanged, captureRunIdentity, recordedBaseRef, statesFingerprint } from "./run-identity.mjs";
 import { attemptWorkspace, gitHead, removeWorktree, runRefName } from "../repo/worktree.mjs";
+import { replacePacketInContract, widenTaskPacket } from "../repo/scope-closure.mjs";
 import { attemptWorktreePath } from "../run/paths.mjs";
 import { canonicalWorkerResultText, isResultMaterializationInvocation, materializeAttemptResult, recoverWorkerResult } from "./result-file.mjs";
 import { checkPersistedWorkerScope, persistedScopeBoundary, reconcileAmbiguousWorkerRestart, resolveUnknownEffect } from "./scope.mjs";
@@ -35,16 +36,17 @@ import { hasOperationIntent, hasOperationSettlement, operationNeedsRecovery, pro
 import { isUnknownEffectStop, planResumeRetry, renderPreviousAttemptSection } from "./retry.mjs";
 import { join, resolve } from "node:path";
 import { parseDiscoveryResult, parseWorkerResult } from "../contract/worker-result.mjs";
-import { readJson, writeJsonAtomic } from "../run/store.mjs";
+import { readJson, writeJsonAtomic, appendJsonl } from "../run/store.mjs";
 import { recoverIntegrations } from "../repo/integrate.mjs";
 import { registerRun, resolveCampaign } from "../campaign/index.mjs";
 import { syncAgentSignal } from "../repo/signal.mjs";
 import { validateContract } from "../contract/index.mjs";
 import { validateRunMetadata, OPERATOR_ANSWER_MAX_BYTES } from "../contract/snapshot.mjs";
 import { verificationFailureVerdict } from "./judge-gate.mjs";
-import { verificationFailureWithScope } from "../contract/scope-findings.mjs";
+import { verificationFailureWithScope, reauthorProposalRecord, reauthorWriteConflicts, reauthorRiskTier, reauthorApproved } from "../contract/scope-findings.mjs";
 import { applyRejection, applyVerificationFailure, raiseNodeAttention, settleDone } from "./settle.mjs";
 import { isHumanStepPending } from "../contract/human-step.mjs";
+import { runBoundedRounds } from "../plan/rounds.mjs";
 
 /** @typedef {import("../repo/integrate.mjs").IntegrationResult} IntegrationResult */
 /** @typedef {import("./lifecycle.mjs").Invocation} Invocation */
@@ -84,11 +86,14 @@ export function recoveryExhaustionEnvelope(recovery, invocation) {
 
 /**
  * @param {string} runDirPath
- * @param {{node?: string, reconcile?: string, answer?: {node: string, path: string}, detachedBootstrap?: boolean}} [options]
+ * @param {{node?: string, reconcile?: string, answer?: {node: string, path: string}, detachedBootstrap?: boolean, reauthor?: {node: string, discover: (context: {round: number, node: import("../contract/index.mjs").ValidatedNode, state: NodeSnapshot, missingContext: string[], findings: string[]}) => (import("../contract/scope-findings.mjs").ReauthorAdditions|Promise<import("../contract/scope-findings.mjs").ReauthorAdditions>), rounds?: number, approve?: boolean, approveBelow?: string}}} [options]
  *   `node` limits the retry in place to one node and its dependants,
  *   `reconcile` acknowledges a node stopped as `unknown_effect_reconciled`,
- *   `answer` records an operator's answer for a node blocked on
- *   `context_missing` and re-dispatches it, and
+ *   `answer` records an operator's answer for any non-terminal node and
+ *   re-dispatches it,
+ *   `reauthor` widens one `context_missing` node's packet from a bounded
+ *   discovery pass and re-dispatches it once the widening validates and is
+ *   approved, and
  *   `detachedBootstrap` is set only by the CLI entry when this process is its
  *   own detached child
  * @returns {Promise<RunOutcome>}
@@ -100,10 +105,16 @@ export async function resumeRun(runDirPath, options = {}) {
   if (options.node && options.answer && options.node !== options.answer.node) {
     throw new Error(`--answer ${options.answer.node} conflicts with --node ${options.node}`);
   }
+  if (options.reauthor && options.node && options.reauthor.node !== options.node) {
+    throw new Error(`--reauthor ${options.reauthor.node} conflicts with --node ${options.node}`);
+  }
+  if (options.reauthor && options.answer) {
+    throw new Error(`--reauthor ${options.reauthor.node} cannot be combined with --answer ${options.answer.node}`);
+  }
   const runDir = resolve(runDirPath);
   assertRunMutable(runDir);
   const contractPath = join(runDir, "contract.json");
-  const contract = validateContract(JSON.parse(readFileSync(contractPath, "utf8")), contractPath, { persisted: true });
+  let contract = validateContract(JSON.parse(readFileSync(contractPath, "utf8")), contractPath, { persisted: true });
   const lock = acquireLock(runDir);
   try {
     const storedMetadata = validateRunMetadata(readJson(join(runDir, "run.json")), { requireSourceIdentity: true });
@@ -161,15 +172,51 @@ export async function resumeRun(runDirPath, options = {}) {
           result: { status: "done", summary: boundedSummary(answerText.trim() || answerNode.humanStep.step), verification: [], artifacts: [], missingContext: [] },
         }, lock);
       } else {
-        if (!answerState || !isBlockedContextTerminal(answerState)) {
-          throw new Error(`node ${options.answer.node} is not blocked on missing context`);
+        // Any non-terminal node accepts an operator answer, not only the
+        // `context_missing` boundary. A node that already reached a terminal
+        // status has no attempt left to receive the answer, so it is refused
+        // here -- in the engine, where the resume decisions are made and the
+        // engine test can reach the gate.
+        if (!answerState || TERMINAL.has(answerState.status)) {
+          throw new Error(`node ${options.answer.node} is not blocked on missing context and is terminal, so it cannot accept an operator answer`);
         }
         const answerOverride = /** @type {import("../contract/index.mjs").ExecutionOverride} */ (/** @type {unknown} */ ({
           kind: "operator-answer",
-          reason: `operator answered missing context for node ${options.answer.node}`,
+          reason: `operator answered node ${options.answer.node}`,
           text: answerText,
         }));
         recordExecutionOverride(runDir, answerState, answerOverride, lock);
+        // Render the answer into the bounded `Previous attempt` section before
+        // classification. The retry path below renders it too, but a parked
+        // node the recover path re-dispatches would otherwise carry the
+        // override without ever showing it to the worker.
+        answerState.previousAttempt = renderPreviousAttemptSection(answerState) ?? answerState.previousAttempt;
+      }
+    }
+    /** @type {string|null} */
+    let reauthorAppliedNode = null;
+    if (options.reauthor) {
+      const targetNode = contract.nodes.find((node) => node.id === options.reauthor?.node);
+      const targetState = states.get(options.reauthor.node);
+      if (!targetNode) throw new Error(`unknown node id: ${options.reauthor.node}`);
+      if (!targetState) throw new Error(`missing persisted node snapshot for ${options.reauthor.node}`);
+      const reauthorBudget = options.reauthor.rounds ?? DEFAULT_REAUTHOR_ROUNDS;
+      const outcome = await reauthorRefusedNode({
+        contract, contractPath, runDir, node: targetNode, state: targetState,
+        discover: options.reauthor.discover,
+        rounds: reauthorBudget,
+        approve: options.reauthor.approve === true,
+        approveBelow: options.reauthor.approveBelow,
+      });
+      process.stdout.write(`[resume] ${contract.id} · reauthor ${targetNode.id} · ${outcome.outcome} (${outcome.roundsUsed}/${reauthorBudget} round${reauthorBudget === 1 ? "" : "s"})\n`);
+      if (outcome.applied && outcome.contract && outcome.raw) {
+        contract = outcome.contract;
+        const replacement = contract.nodes.find((node) => node.id === targetNode.id);
+        if (!replacement) throw new Error(`widened contract lost node ${targetNode.id}`);
+        targetState.packetHash = replacement.packetHash;
+        targetState.sourceIdentity = replacement.sourceIdentity;
+        writeJsonAtomic(contractPath, outcome.raw);
+        reauthorAppliedNode = targetNode.id;
       }
     }
     const plan = planResumeRetry(contract, states, { node: options.node, reconcile: options.reconcile, answer: options.answer?.node });
@@ -185,9 +232,9 @@ export async function resumeRun(runDirPath, options = {}) {
       const state = states.get(node.id);
       if (!state) continue;
       if (state.status === "done") continue;
-      if (isBlockedContextTerminal(state) && node.id !== options.answer?.node) continue;
+      if (isBlockedContextTerminal(state) && node.id !== options.answer?.node && node.id !== reauthorAppliedNode) continue;
       if (isHumanStepPending(state) && node.id !== options.answer?.node) continue;
-      const action = plan.actions.get(node.id) ?? "recover";
+      const action = node.id === reauthorAppliedNode ? "retry" : plan.actions.get(node.id) ?? "recover";
       // Adoption before retry: an unresolved blocking review is re-judged from
       // the preserved worker result, never reset to a fresh worker attempt.
       if (action === "rejudge") {
@@ -546,6 +593,66 @@ export async function resumeRun(runDirPath, options = {}) {
 export function isBlockedContextTerminal(state) {
   return state.status === "blocked" && state.error?.code === "context_missing";
 }
+/**
+ * The default number of discovery rounds a `resume --reauthor` spends widening
+ * one refused packet. The budget is hard: the round after this one never runs.
+ */
+export const DEFAULT_REAUTHOR_ROUNDS = 1;
+/** One round of the reauthor budget: its proposal, candidate, verdict, findings. */
+/** @typedef {{accepted: boolean, round: number, additions: import("../contract/scope-findings.mjs").ReauthorAdditions, packet: import("../contract/index.mjs").TaskPacket, candidate: Record<string, unknown>, widened: ValidatedContract|null, findings: string[]}} ReauthorRound */
+/**
+ * Run the bounded discovery pass for one `context_missing` node, validate the
+ * widened packet against the whole contract (per-node closure, the cross-node
+ * pair, and the write-overlap check no single packet can see), and return the
+ * decision. The caller owns applying it: an accepted packet below the approval
+ * threshold, or any packet the operator approved, is persisted and the node
+ * re-dispatched; everything else leaves the node refused.
+ *
+ * @param {{contract: ValidatedContract, contractPath: string, runDir: string, node: import("../contract/index.mjs").ValidatedNode, state: NodeSnapshot, discover: (context: {round: number, node: import("../contract/index.mjs").ValidatedNode, state: NodeSnapshot, missingContext: string[], findings: string[]}) => (import("../contract/scope-findings.mjs").ReauthorAdditions|Promise<import("../contract/scope-findings.mjs").ReauthorAdditions>), rounds?: number, approve?: boolean, approveBelow?: string}} options
+ * @returns {Promise<{accepted: boolean, roundsUsed: number, last: ReauthorRound|null, history: ReauthorRound[], applied: boolean, outcome: string, record: Record<string, unknown>, contract: ValidatedContract|null, raw: Record<string, unknown>|null}>}
+ */
+export async function reauthorRefusedNode(options) {
+  const { contract, contractPath, runDir, node, state, discover, rounds = DEFAULT_REAUTHOR_ROUNDS, approve = false, approveBelow } = options;
+  if (!isBlockedContextTerminal(state)) throw new Error(`node ${node.id} is not blocked on missing context, so it cannot be reauthored`);
+  if (typeof discover !== "function") throw new TypeError("resume --reauthor requires a discovery runner");
+  const raw = JSON.parse(readFileSync(contractPath, "utf8"));
+  const refused = /** @type {{missingContext?: string[]}|null|undefined} */ (state.result);
+  const missingContext = Array.isArray(refused?.missingContext) ? refused.missingContext : [];
+  const budget = await runBoundedRounds(rounds, async (round, history) => {
+    const additions = (await discover({ round, node, state, missingContext, findings: history.flatMap((item) => item.findings) })) ?? {};
+    const packet = widenTaskPacket(node.taskPacket, additions);
+    const candidate = replacePacketInContract(raw, node.id, packet);
+    const findings = reauthorWriteConflicts(contract.nodes, node.id, additions.writeFiles).map((conflict) => conflict.reason);
+    /** @type {ValidatedContract|null} */
+    let widened = null;
+    try {
+      widened = validateContract(candidate, contractPath);
+    } catch (error) {
+      findings.push(errorMessage(error));
+    }
+    const accepted = widened !== null && findings.length === 0;
+    if (accepted && widened) {
+      const replacement = widened.nodes.find((item) => item.id === node.id);
+      if (replacement) /** @type {any} */ (candidate).nodes.find((/** @type {any} */ item) => item.id === node.id).packetHash = replacement.packetHash;
+    }
+    return { accepted, round, additions, packet, candidate, widened, findings };
+  });
+  const last = budget.last;
+  const outcome = budget.accepted ? (reauthorApproved(node, { approve, approveBelow }) ? "applied" : "approval_required") : "rounds_exhausted";
+  const record = reauthorProposalRecord({
+    nodeId: node.id, outcome, riskTier: reauthorRiskTier(node), budget: rounds, roundsUsed: budget.roundsUsed,
+    additions: last?.additions, packet: last?.packet, findings: last?.findings, history: budget.history,
+  });
+  appendJsonl(join(runDir, "reauthor.jsonl"), record);
+  return {
+    ...budget,
+    applied: outcome === "applied",
+    outcome,
+    record,
+    contract: budget.accepted ? last?.widened ?? null : null,
+    raw: budget.accepted ? last?.candidate ?? null : null,
+  };
+}
 /**
  * The operator-answer result summary for a human-step node's `done`
  * transition, bounded to the worker-result protocol's own summary ceiling

package/src/engine/retry.mjs

@@ -15,12 +15,11 @@
  * exhausted run budget needs `--max-input-tokens <n>`.
  */
 import { Buffer } from "node:buffer";
+import { PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES } from "../contract/snapshot.mjs";
 
 /** Heading of the section appended to a retried attempt's worker and judge prompt. */
 const PREVIOUS_ATTEMPT_HEADING = "Previous attempt";
 
-/** Hard ceiling for the whole `Previous attempt` section, in bytes. */
-const PREVIOUS_ATTEMPT_MAX_BYTES = 8 * 1024;
 
 /** Heading under which an operator's answer is rendered inside the section. */
 const OPERATOR_ANSWER_HEADING = "Operator answer";
@@ -267,11 +266,6 @@ export function renderPreviousAttemptSection(state) {
   if (state.error?.code || state.error?.message) {
     parts.push(`Error: ${state.error?.code ?? "unknown"}${state.error?.message ? ` — ${bounded(state.error.message, 1024)}` : ""}`);
   }
-  const answer = mostRecentOperatorAnswer(state);
-  if (answer !== null) {
-    parts.push(`${OPERATOR_ANSWER_HEADING}:`);
-    parts.push(bounded(answer, 1024));
-  }
   const findings = state.gate?.findings ?? [];
   if (findings.length) {
     parts.push(`Judge findings (verdict ${state.gate?.verdict ?? "unknown"}, maxSeverity ${state.gate?.maxSeverity ?? "none"}):`);
@@ -293,8 +287,14 @@ export function renderPreviousAttemptSection(state) {
       if (typeof last?.exitCode === "number" && last.exitCode !== 0) parts.push(`  exit code: ${last.exitCode}`);
     }
   }
-  if (parts.length === 1) return null;
-  return boundSection([`## ${PREVIOUS_ATTEMPT_HEADING}`, "", ...parts].join("\n"));
+  const answer = mostRecentOperatorAnswer(state);
+  if (parts.length === 1 && answer === null) return null;
+  const evidence = boundSection([`## ${PREVIOUS_ATTEMPT_HEADING}`, "", ...parts].join("\n"));
+  // The answer was bounded where it was accepted (OPERATOR_ANSWER_MAX_BYTES),
+  // so it is carried whole, after the evidence and outside its budget.
+  // Measured 2026-09-28: bounded here at 1 KiB inside an 8 KiB section, an
+  // answer the engine had accepted and recorded reached the worker cut short.
+  return answer === null ? evidence : `${evidence}\n${OPERATOR_ANSWER_HEADING}:\n${answer}`;
 }
 
 /**
@@ -315,9 +315,9 @@ export function appendPreviousAttempt(prompt, section) {
  * @returns {string} the text bounded to the section ceiling, with a marker
  */
 function boundSection(text) {
-  if (Buffer.byteLength(text, "utf8") <= PREVIOUS_ATTEMPT_MAX_BYTES) return text;
+  if (Buffer.byteLength(text, "utf8") <= PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES) return text;
   const marker = "\n… (previous attempt section truncated)";
-  const room = PREVIOUS_ATTEMPT_MAX_BYTES - Buffer.byteLength(marker, "utf8") - 1;
+  const room = PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES - Buffer.byteLength(marker, "utf8") - 1;
   const cut = Buffer.from(text, "utf8").subarray(0, room).toString("utf8");
   return `${cut}${marker}`;
 }

package/src/engine/run-command.mjs

@@ -16,10 +16,35 @@ import { mkdirSync, writeFileSync } from "node:fs";
 import { processStartToken } from "../run/lock.mjs";
 import { randomUUID } from "node:crypto";
 import { runMutation } from "./mutation.mjs";
+import { SANDBOX_BLOCKED_WRITE } from "../contract/worker-result.mjs";
+import { isAbsolute, resolve } from "node:path";
+import { isContained } from "../util.mjs";
 import { spawn } from "node:child_process";
 import { killTarget, spawnInvocation } from "../host/platform.mjs";
 /** @typedef {import("../contract/verification.mjs").VerificationOptions} VerificationOptions */
 
+/**
+ * The run-level options plus the sandbox mode the caller knows. The mode is not
+ * part of the shared verification contract: it is controller environment, read
+ * here only to name a refusal the command itself cannot.
+ *
+ * @typedef {VerificationOptions & {sandboxMode?: string|null}} RunVerificationOptions
+ */
+
+/**
+ * The named classification of a `workspace-write` refusal outside the worktree,
+ * carrying the mode that caused it and the path that was denied.
+ *
+ * @typedef {{classification: "sandbox_blocked_write", mode: string, path: string}} SandboxBlockedWrite
+ */
+
+/**
+ * A bounded attempt result plus the controller's sandbox classification, which
+ * rides beside the captured output only when a refusal was recognized.
+ *
+ * @typedef {VerificationAttemptResult & {attempt: number, sandboxBlockedWrite?: SandboxBlockedWrite}} SandboxAwareAttemptResult
+ */
+
 /** @typedef {import("node:child_process").ChildProcess} ChildProcess */
 /** @typedef {import("../contract/verification.mjs").VerificationAttempt} VerificationAttempt */
 /** @typedef {import("../contract/verification.mjs").VerificationAttemptResult} VerificationAttemptResult */
@@ -62,12 +87,51 @@ function verificationEnv(command) {
   }
   return env;
 }
+
+// `workspace-write` denies a toolchain's cache in `$HOME` and the tool reports
+// a read-only filesystem: observed 2026-09-22 with Zig under `dsh`,
+// `manifest_create ReadOnlyFileSystem` before its first source file. The
+// sandbox, not the command, is the cause, so the controller names it. `EROFS`
+// and the POSIX message cover the same refusal from other runners.
+const SANDBOX_READ_ONLY_PATTERN = /ReadOnlyFileSystem|EROFS|read-only file system/iu;
+// A denied path is usually quoted (`unable to load '/path': ReadOnlyFileSystem`)
+// or bare after the operation name; either way it is absolute, since only an
+// effect outside the worktree gets refused.
+const ABSOLUTE_PATH_PATTERNS = Object.freeze([/['"]((?:[A-Za-z]:[\\/]|\/)[^'"]+)['"]/gu, /((?:[A-Za-z]:[\\/]|\/)[^\s'",;:)\]]+)/gu]);
+
+/**
+ * Classify a failed command whose output names a read-only-filesystem refusal
+ * outside the worktree, under `workspace-write`. Returns null for any other
+ * mode, a refusal inside the worktree, or output with no path to name.
+ *
+ * @param {{text?: string, workspace: string, mode?: string|null}} args
+ * @returns {SandboxBlockedWrite|null}
+ */
+export function classifySandboxBlockedWrite({ text, workspace, mode }) {
+  if (mode !== "workspace-write" || typeof text !== "string") return null;
+  const lines = text.split(/\r?\n/u);
+  const markerLines = lines.filter((line) => SANDBOX_READ_ONLY_PATTERN.test(line));
+  if (markerLines.length === 0) return null;
+  // Prefer a path the refusal line itself names; fall back to any path in the
+  // output, since `manifest_create ReadOnlyFileSystem` can put the path on a
+  // neighbouring line.
+  for (const line of [...markerLines, ...lines]) {
+    for (const pattern of ABSOLUTE_PATH_PATTERNS) {
+      for (const match of line.matchAll(pattern)) {
+        const candidate = match[1];
+        const path = isAbsolute(candidate) ? candidate : resolve(workspace, candidate);
+        if (!isContained(workspace, path)) return { classification: SANDBOX_BLOCKED_WRITE, mode, path };
+      }
+    }
+  }
+  return null;
+}
 /**
  * Run every declared command `repeat` times inside the workspace.
  *
  * @param {unknown} commands
  * @param {string} baseCwd
- * @param {VerificationOptions} options
+ * @param {RunVerificationOptions} options
  * @returns {Promise<VerificationResult>}
  */
 export async function runVerification(commands, baseCwd, options = {}) {
@@ -92,7 +156,7 @@ export async function runVerification(commands, baseCwd, options = {}) {
  * @param {VerificationCommand} command
  * @param {string} baseCwd
  * @param {number} commandIndex
- * @param {VerificationOptions} options
+ * @param {RunVerificationOptions} options
  * @returns {Promise<VerificationCommandResult>}
  */
 async function runRepeatedCommand(command, baseCwd, commandIndex, options) {
@@ -132,7 +196,7 @@ function signalDeathRetry(result, signal) {
  * @param {VerificationCommand} command
  * @param {string} baseCwd
  * @param {number} commandIndex
- * @param {VerificationOptions} options
+ * @param {RunVerificationOptions} options
  * @returns {Promise<VerificationCommandResult>}
  */
 async function runMutationCommand(command, baseCwd, commandIndex, options) {
@@ -149,7 +213,7 @@ async function runMutationCommand(command, baseCwd, commandIndex, options) {
  * @param {string} commandCwd
  * @param {number} attempt
  * @param {AbortSignal|undefined} signal
- * @param {VerificationOptions} options
+ * @param {RunVerificationOptions} options
  * @param {number} commandIndex
  * @returns {Promise<VerificationAttemptResult>}
  */
@@ -181,6 +245,7 @@ function runCommand(command, baseCwd, commandCwd, attempt, signal, options, comm
       if (abortHandler) signal?.removeEventListener("abort", abortHandler);
       if (child?.pid && !error && !signalName && !timedOut) terminateGroup(child);
       const durationMs = Number(process.hrtime.bigint() - started) / 1e6;
+      /** @type {SandboxAwareAttemptResult} */
       const result = {
         attempt,
         stdout: stdout.value(),
@@ -192,6 +257,17 @@ function runCommand(command, baseCwd, commandCwd, attempt, signal, options, comm
         error: error ? String(error.message ?? error) : null,
         passed: !error && !timedOut && exitCode === 0 && !signalName,
       };
+      // The controller's own sandbox mode bounds where a toolchain may write;
+      // a caller may name it, and a controller launched under `dsh` inherits it
+      // in `DSH_PERMISSION_MODE`. Only `workspace-write` classifies.
+      if (!result.passed) {
+        const sandboxBlockedWrite = classifySandboxBlockedWrite({
+          text: `${result.stdout}\n${result.stderr}`,
+          workspace: resolve(baseCwd, commandCwd),
+          mode: options?.sandboxMode ?? process.env.DSH_PERMISSION_MODE ?? null,
+        });
+        if (sandboxBlockedWrite) result.sandboxBlockedWrite = sandboxBlockedWrite;
+      }
       if (!completionReported && identity) {
         completionReported = true;
         try { options?.onAttemptComplete?.({ ...identity, status: result.passed ? "closed" : "failed", completedAt: new Date().toISOString(), result }); } catch {

package/src/engine/run-identity.mjs

@@ -21,7 +21,7 @@ import { createHash } from "node:crypto";
 import { lstatSync, readFileSync, readdirSync } from "node:fs";
 import { join, relative, sep } from "node:path";
 import { fileURLToPath } from "node:url";
-import { stableJson } from "../util.mjs";
+import { stableJson, errorCode } from "../util.mjs";
 import { validateRunMetadata } from "../contract/snapshot.mjs";
 import { contractDigest } from "../contract/index.mjs";
 import { RUNS_DIR_NAME, runDirectory } from "../run/paths.mjs";
@@ -97,6 +97,26 @@ function runDirFor(sourceIdentity) {
   return runDirectory(sourceIdentity.cwd, sourceIdentity.contractId);
 }
 
+/**
+ * Whether a run directory never materialized a node. The directory, its
+ * frozen contract and its empty `nodes/` folder are written before runtime
+ * assignment and identity capture; node states are written after. A launch
+ * refused in that window leaves a directory that never held a node, so
+ * nothing can resume it and it would refuse the next attempt as an existing
+ * run.
+ *
+ * @param {string} runDir
+ * @returns {boolean}
+ */
+export function runNeverHeldNode(runDir) {
+  try {
+    return readdirSync(join(runDir, "nodes")).every((name) => !name.endsWith(".json"));
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return true;
+    throw error;
+  }
+}
+
 /**
  * The records a prior run.json already froze, when one exists. On creation
  * this is empty; on every later metadata rewrite it is the source of truth.
@@ -506,14 +526,10 @@ export async function assertEnvironmentReady(contract, runDir, sourceIdentity) {
   // state reads done, this launch replays an accepted transaction, starts no
   // worker and no judge, and can spend no availability.
   if (blocking === null && launchMayDispatch(runDir)) {
-    // measured 2026-09-22: asking four routed runtimes in parallel took about
-    // 18s, so no runtime is given less than 60s here; a runtime at high
-    // reasoning effort gets its longer default (defaultLivePreflightTimeout).
-    // FABERUN_PREFLIGHT_TIMEOUT_SEC stays the operator override for every
-    // runtime; preflightContract validates it, so only a valid number is lifted.
-    const override = Number(process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC);
-    const timeoutSec = process.env.FABERUN_PREFLIGHT_TIMEOUT_SEC !== undefined && Number.isFinite(override) && override > 0 ? override : undefined;
-    const probes = await livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec);
+    // The live budget is `live-preflight.mjs`'s measured default (60s, 180s at xhigh;
+    // `FABERUN_PREFLIGHT_TIMEOUT_SEC` the operator override). It is not
+    // restated here: a second copy is a second default to keep honest.
+    const probes = await livePreflightProbes(contract, runDir, sourceIdentity);
     const silent = probes.filter((probe) => liveSilenceCause(probe) !== null);
     writeJsonAtomic(join(runDir, "env-preflight.json"), evidence(silent.length === 0, probes));
     if (silent.length > 0) {
@@ -537,8 +553,6 @@ export async function assertEnvironmentReady(contract, runDir, sourceIdentity) {
   throw Object.assign(new Error(`env_preflight_failed: ${blocking} · the run stays resumable: fix the environment and resume ${runDir}`), { code: "env_preflight_failed" });
 }
 
-/** No routed runtime is given less than this by the dispatch gate. */
-const GATE_MINIMUM_PREFLIGHT_SEC = 60;
 /**
  * The live half of the gate for one launch. Every routed runtime either holds
  * a verdict this machine recorded inside its freshness window -- reused, the
@@ -555,10 +569,9 @@ const GATE_MINIMUM_PREFLIGHT_SEC = 60;
  * @param {ValidatedContract} contract
  * @param {string} runDir
  * @param {SourceIdentity|undefined} sourceIdentity
- * @param {number|undefined} timeoutSec
  * @returns {Promise<ProbeResult[]>}
  */
-async function livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec) {
+async function livePreflightProbes(contract, runDir, sourceIdentity) {
   const routed = reachableRuntimes(contract);
   /** @type {Map<string, RuntimeAvailability>} */
   const fresh = new Map();
@@ -631,7 +644,7 @@ async function livePreflightProbes(contract, runDir, sourceIdentity, timeoutSec)
       };
     });
   }
-  const probes = await preflightContract(join(runDir, "contract.json"), { ...(timeoutSec === undefined ? {} : { liveTimeoutSec: timeoutSec }), minimumTimeoutSec: GATE_MINIMUM_PREFLIGHT_SEC, persisted: true });
+  const probes = await preflightContract(join(runDir, "contract.json"), { persisted: true });
   // What this launch bought is durable from here on: every ask that reached a
   // provider -- a refusal included, an answer being an answer -- is recorded
   // under the provider's own identity. Silence and a command that never

package/src/engine/runtime-discovery.mjs

@@ -1,6 +1,6 @@
 import { normalizeProviderAvailability, probeRuntime } from "../harnesses/index.mjs";
 import { effectiveProvider } from "../contract/provider.mjs";
-import { SAME_VENDOR_REVIEW_MODE, sameVendorTierRefusal } from "../contract/judge-independence.mjs";
+import { SAME_VENDOR_REVIEW_MODE, effectiveJudgeIndependence, sameVendorTierRefusal } from "../contract/judge-independence.mjs";
 
 // Availability normalization belongs to the adapter registry, which is where
 // each provider's own exhaustion, balance, and authentication wording is
@@ -176,10 +176,12 @@ export function availableCandidates(runtimes, availability = {}) {
  * copied exactly; callers persist the returned pair in run state.
  *
  * An optional `options.config` narrows the candidate set to the harnesses the
- * operator enabled and prefers its named worker and judge. An empty narrowed
- * set falls back to the unrestricted candidates and is reported through
- * `options.onWarning`; config never overrides an explicit node, gate or
- * runtime-default declaration, and the cross-vendor judge rule still applies.
+ * operator enabled, prefers its named worker and judge, and -- when the
+ * contract declares none (R36) -- supplies the machine-wide
+ * `judgeIndependence` opt-in. An empty narrowed set falls back to the
+ * unrestricted candidates and is reported through `options.onWarning`; config
+ * never overrides an explicit node, gate or runtime-default declaration, and
+ * the cross-vendor judge rule still applies.
  *
  * `options.listJudge` (R18) is asked for an omitted judge before the single
  * `config.judge` preference and the strongest-candidate default: it is the
@@ -194,7 +196,7 @@ export function availableCandidates(runtimes, availability = {}) {
  * @param {RuntimeContract} contract
  * @param {Record<string, RuntimeAvailability>} availability
  * @param {ComposeOptions} [options]
- * @returns {Record<string, {worker: string, judge: string}>}
+ * @returns {Record<string, {worker: string, judge: string, judgeIndependence?: "same-vendor"}>}
  */
 export function composeAssignments(contract, availability = {}, options = {}) {
   const allCandidates = availableCandidates(contract.runtimes, availability);
@@ -206,7 +208,7 @@ export function composeAssignments(contract, availability = {}, options = {}) {
     if (restricted.length) candidates = restricted;
     else if (allCandidates.length) options.onWarning?.(`config harnesses · none of ${config.harnesses.join(", ")} is available · using all available runtimes`);
   }
-  /** @type {Record<string, {worker: string, judge: string}>} */
+  /** @type {Record<string, {worker: string, judge: string, judgeIndependence?: "same-vendor"}>} */
   const assignments = {};
   for (const node of contract.nodes ?? []) {
     const workerOmitted = node.runtime === undefined && contract.runtimeDefaults?.worker === undefined;
@@ -235,7 +237,11 @@ export function composeAssignments(contract, availability = {}, options = {}) {
     // R20: in same-vendor mode a judge of the worker's own provider is
     // admissible when it is another model at an equal or higher declared tier;
     // the strongest such candidate is the default only when no other vendor has one.
-    const sameVendorMode = contract.judgeIndependence === SAME_VENDOR_REVIEW_MODE;
+    // R36: a contract that declares no mode inherits the machine config's, and
+    // the effective mode is recorded on the assignment so the launch decision
+    // survives in the run snapshot.
+    const judgeIndependence = effectiveJudgeIndependence(contract, config);
+    const sameVendorMode = judgeIndependence === SAME_VENDOR_REVIEW_MODE;
     const judge = declaredJudge
       ?? judgeListPick?.chosen
       ?? (preferredJudge && effectiveProvider(preferredJudge.runtime) !== workerProvider ? preferredJudge.id : undefined)
@@ -251,7 +257,7 @@ export function composeAssignments(contract, availability = {}, options = {}) {
       const refusal = sameVendorTierRefusal(/** @type {{harness: string, model: string}} */ (workerRuntime), /** @type {{harness: string, model: string}} */ (judgeRuntime));
       if (refusal) throw new Error(`runtime_assignment_judge_unavailable: ${refusal.message} for node ${node.id}`);
     }
-    assignments[node.id] = { worker, judge: judge ?? worker };
+    assignments[node.id] = { worker, judge: judge ?? worker, ...(judgeIndependence === undefined ? {} : { judgeIndependence }) };
   }
   return assignments;
 }

package/src/engine/scheduler.mjs

@@ -759,7 +759,14 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
     heartbeat.stop();
     lock.release();
   }
-  renderStatusIfChanged(false, null);
+  // Forced, and after the lock is released: the change-detected render here
+  // was a no-op whenever the last tick had already written the same node
+  // states, which is the usual case, so the stored status.json kept the
+  // `controller: active` the last tick wrote while the lock was still held.
+  // Measured 2026-09-27 (AP12): `safe-to-hand-to-a-friend-phase-2` finished
+  // with `state: "active"` and pid 43002, and a watcher waiting for the
+  // controller to leave spun for two hours on a pid that no longer existed.
+  renderStatusIfChanged(true, null);
   renderCampaignHandoffSafely(campaign, runsDir, runDir);
   writeFindingsArtifact(runDir, contract, states);
   const failed = [...states.values()].filter((state) => state.status !== "done");