faberun 0.28.0 → 0.29.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/src/cli/launch.mjs

@@ -16,7 +16,7 @@ import { bootstrapAckPath, bootstrapAttemptPath, bootstrapPath, cleanupBootstrap
 import { bootstrapFailureMatchesChild, bootstrapMatchesChild, processStartToken, readLock, sameProcessStartToken, validBootstrapNonce } from "../run/lock.mjs";
 import { cleanupBootstrapNonce, discardNodeLessRunDirectory } from "../engine/detach.mjs";
 import { delay, errorCode } from "../util.mjs";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -232,16 +232,33 @@ export function bootstrapRunDir(command, target) {
  */
 export function writeBootstrapFailure(command, target, error) {
   const runDir = bootstrapRunDir(command, target);
-  if (!runDir || !existsSync(runDir)) return;
+  if (!runDir) return;
   const nonce = validBootstrapNonce(process.env.FABERUN_BOOTSTRAP_NONCE) ? process.env.FABERUN_BOOTSTRAP_NONCE : null;
   const failure = { status: "failed", pid: process.pid, processStartToken: processStartToken(process.pid), runDir, nonce, at: new Date().toISOString(), error: error.message };
+  const detachedChild = nonce !== null && !process.argv.includes("--detach");
+  if (!existsSync(runDir)) {
+    // A refusal that happens before the run directory exists — a dirty tree, a
+    // base ref that does not resolve — is the one the launcher cannot
+    // otherwise learn: the child's stdio is discarded, so all it could say was
+    // "failed before readiness for pid N". Measured 2026-09-27 (AP10): a whole
+    // `plan` stage died that way over two uncommitted paths. Only a detached
+    // child creates the directory, and only to carry this record;
+    // `waitForBootstrap` removes a node-less one as it reads it.
+    if (!detachedChild) return;
+    try {
+      mkdirSync(runDir, { recursive: true });
+    } catch {
+      // The refusal being reported matters more than the directory that would
+      // have carried it; without one the launcher falls back to its own message.
+      return;
+    }
+  }
   // A `run` that names an existing run directory is refused before it writes
   // anything, and its failure must not be stamped into that run's bootstrap
   // record. The detached child is the exception: it wrote contract.json and
   // then died before readiness, and the launcher has no other channel to
   // learn the controller's error, so it must record that error before it
   // exits.
-  const detachedChild = nonce !== null && !process.argv.includes("--detach");
   if (command === "run" && !detachedChild && existsSync(join(runDir, "contract.json"))) return;
   /** @type {BootstrapRecord|null} */
   let current = null;

package/src/cli/plan.mjs

@@ -5,8 +5,8 @@
  * sequencing and every decision the pipeline makes.
  */
 import { validateJudgeIndependence } from "../contract/judge-independence.mjs";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
 import { detachArgv, detachSelf, waitForBootstrap } from "./launch.mjs";
 import { classifyRunProgress } from "../campaign/chain.mjs";
 import { runProgress } from "../engine/supervise.mjs";
@@ -17,6 +17,7 @@ import { colorLevel, statusToken } from "./brand.mjs";
 import { delay } from "../util.mjs";
 import { runPlanningPipeline } from "../plan/pipeline.mjs";
 import { parseAnswerFlags, resolvePlanningPipeline } from "../plan/resolve.mjs";
+import { abandonedPlanProgress } from "../plan/progress.mjs";
 import { resolveReviewerList } from "../plan/reviewer.mjs";
 import { campaignTree, runDirectory } from "../run/paths.mjs";
 import { readCampaign } from "../campaign/record.mjs";
@@ -112,6 +113,46 @@ export function loadRuntimesCatalogue(path) {
   return runtimes;
 }
 
+/**
+ * The campaign's own checked-in planning inputs live beside the spec it
+ * already keeps in the repository: `docs/campaigns/<id>/plan-inputs/`. A file
+ * that exists there is used as if it had been passed on the command line,
+ * because that is what it is for; an absent one changes nothing.
+ *
+ * Measured 2026-09-27 (AP19): a campaign carried
+ * `plan-inputs/runtimes.json` with a raised output ceiling, `plan` fell back
+ * to the 8192 default without a word, and the operator found out only after
+ * burning rounds on a truncated draft.
+ *
+ * @param {string} cwd @param {string} campaignId @param {string} file
+ * @returns {string}
+ */
+function campaignInputPath(cwd, campaignId, file) {
+  return join(cwd, "docs", "campaigns", campaignId, "plan-inputs", file);
+}
+
+/**
+ * The catalogue a `plan` reads runtimes from, and the file it came from when
+ * that file is the campaign's own. `--runtimes` wins over the checked-in one:
+ * an operator passing a path is overriding, not asking.
+ *
+ * `source` is returned rather than printed here so a caller decides the
+ * wording; `planCli` says it out loud because silence is the whole defect. The
+ * path is resolved from the launch cwd, never from the plan's own target, so
+ * the same command from a subdirectory reads the same file the campaign does.
+ *
+ * @param {{cwd: string, campaignId: string, runtimes?: unknown}} options
+ * @returns {{runtimes: Record<string, import("../contract/index.mjs").ValidatedRuntime>, source: string|null}}
+ */
+export function resolvePlanRuntimes({ cwd, campaignId, runtimes }) {
+  if (typeof runtimes === "string" && runtimes) return { runtimes: loadRuntimesCatalogue(runtimes), source: null };
+  const campaignRuntimes = campaignInputPath(cwd, campaignId, "runtimes.json");
+  if (!existsSync(campaignRuntimes)) {
+    return { runtimes: /** @type {Record<string, import("../contract/index.mjs").ValidatedRuntime>} */ (DISCOVERY_RUNTIME_DEFINITIONS), source: null };
+  }
+  return { runtimes: loadRuntimesCatalogue(campaignRuntimes), source: campaignRuntimes };
+}
+
 /**
  * A `--verification <path>` catalogue: a JSON object carrying either or both
  * of the contract's own suite keys, `sharedVerification` and
@@ -160,9 +201,10 @@ export async function planCli(target, values) {
   // R19: the planner's own reviewer list, never `runtimeDefaults.judge` --
   // `--reviewers` wins over the machine's own `config.reviewers` default.
   const reviewers = resolveReviewerList({ reviewers: parseReviewerList(values.reviewers) }, readUserConfig(process.env));
-  const runtimes = typeof values.runtimes === "string" && values.runtimes
-    ? loadRuntimesCatalogue(values.runtimes)
-    : DISCOVERY_RUNTIME_DEFINITIONS;
+  const { runtimes, source: runtimesSource } = resolvePlanRuntimes({ cwd: process.cwd(), campaignId, runtimes: values.runtimes });
+  // Said out loud because silence is the whole defect: the default and the
+  // campaign's own catalogue look identical from the outside.
+  if (runtimesSource) process.stdout.write(`[plan] runtimes · ${relative(process.cwd(), runtimesSource)}\n`);
   const verification = typeof values.verification === "string" && values.verification
     ? loadVerificationSuites(values.verification)
     : {};
@@ -171,6 +213,15 @@ export async function planCli(target, values) {
     ? undefined
     : validateJudgeIndependence(values["judge-independence"], "--judge-independence");
 
+  // A record with no live process behind it is the only trace a planning run
+  // that died without a word leaves. Measured 2026-09-26 (AP4): `--detach` pid
+  // 64270 vanished during repo-facts and the phase directory stayed empty, so
+  // the next launch is the one place the operator can still be told.
+  const abandoned = abandonedPlanProgress(process.cwd(), campaignId, phase);
+  if (abandoned) {
+    process.stderr.write(`[plan] a previous planning process (pid ${String(abandoned.pid ?? "?")}) stopped during ${String(abandoned.stage ?? "?")} at ${String(abandoned.at ?? "?")} and never reached the end\n`);
+  }
+
   if (values.detach === true) {
     const argv = ["plan", specPath, "--campaign", campaignId, "--phase", phase, "--review-rounds", String(reviewRounds)];
     if (approveBelow !== undefined) argv.push("--approve-below", approveBelow);

package/src/cli.mjs

@@ -579,7 +579,11 @@ function advisoryToken() {
 function prunedLine(pruned) {
   if (!pruned.length) return "[prune] no finished, integrated run holds a worktree";
   const removed = pruned.reduce((sum, run) => sum + run.removed, 0);
-  return `[prune] released ${removed} worktree${removed === 1 ? "" : "s"} of ${pruned.length} integrated run${pruned.length === 1 ? "" : "s"} · each kept under refs/faberun-archive/`;
+  const branches = pruned.reduce((sum, run) => sum + run.branches.length, 0);
+  const line = removed === 0
+    ? "[prune] an earlier prune already released every worktree of an integrated run"
+    : `[prune] released ${removed} worktree${removed === 1 ? "" : "s"} of ${pruned.length} integrated run${pruned.length === 1 ? "" : "s"} · each kept under refs/faberun-archive/`;
+  return branches === 0 ? line : `${line} · deleted ${branches} attempt branch${branches === 1 ? "" : "es"} already held by another ref`;
 }
 
 /**

package/src/contract/definition-of-done.mjs

@@ -279,6 +279,61 @@ export function assertInlineScriptProofsParse(nodes) {
   }
 }
 
+/**
+ * The quote a command proof's text leaves open, or null when every quote it
+ * opens is closed. `kind: "command"` goes through `/bin/sh -c`, so a text with
+ * an odd number of `'` or `"` is refused by the shell before the command runs,
+ * with `unexpected EOF while looking for matching`. Measured 2026-09-27 (AP13
+ * of safe-to-hand-to-friend): the freeze accepted
+ * `node --test --test-name-pattern=a stranger's first campaign completes
+ * offline test/…` — an apostrophe inside an unquoted test title — the node did
+ * the work and passed its own test in 15 s, and both attempts were spent on a
+ * command `/bin/sh` never ran.
+ *
+ * This is a quote scanner, not a shell parser: it reports the two failures a
+ * proof can carry without expanding anything (an open quote, or nothing at
+ * all), and leaves every other shell construct to the shell. A `$'…'` string
+ * and a quote inside a here-document are the constructs it does not model.
+ *
+ * @param {string} commandText
+ * @returns {string|null}
+ */
+export function unclosedQuote(commandText) {
+  /** @type {string|null} */
+  let quote = null;
+  let escaped = false;
+  for (const character of commandText) {
+    if (escaped) { escaped = false; continue; }
+    // Outside double quotes a backslash escapes the next character; a
+    // backslash inside single quotes is literal, which POSIX also gives it.
+    if (quote !== "'" && character === "\\") { escaped = true; continue; }
+    if (quote === null && (character === "'" || character === '"')) { quote = character; continue; }
+    if (quote === character) quote = null;
+  }
+  return quote;
+}
+
+/**
+ * Refuse a contract whose command proof the shell cannot parse, naming the
+ * node, the item and the open quote. The freeze and the launch both call it:
+ * a command no attempt can run is the same waste as an inline script that
+ * cannot parse, and cheaper to refuse than to discover.
+ *
+ * @param {{id?: unknown, definitionOfDone?: {id?: unknown, proof?: {kind?: unknown, ref?: unknown}}[]}[]} nodes
+ * @returns {void}
+ */
+export function assertProofCommandsParse(nodes) {
+  for (const node of nodes) {
+    for (const item of node.definitionOfDone ?? []) {
+      if (item.proof?.kind !== "command" || typeof item.proof.ref !== "string") continue;
+      const quote = unclosedQuote(item.proof.ref);
+      if (quote === null) continue;
+      const nodeName = node.id === undefined ? "a node" : `node ${node.id}`;
+      throw new TypeError(`${nodeName}, Definition of Done item "${item.id}": the proof command leaves a ${quote} open, so /bin/sh refuses it before it runs ("unexpected EOF while looking for matching \`${quote}'"). Quote the value, as in --test-name-pattern="<title>".`);
+    }
+  }
+}
+
 /** @param {string} token @returns {boolean} */
 function isNodeExecutable(token) {
   const base = (token.split(/[\\/]/u).pop() ?? token).toLowerCase();

package/src/contract/index.mjs

@@ -153,7 +153,7 @@ export function validateContract(raw, contractPath, options = {}) {
     throw new TypeError("contract.runtimes must be an object");
   }
   const runtimes = /** @type {Record<string, ValidatedRuntime>} */ ({});
-  for (const [id, runtime] of Object.entries(rawRuntimes)) runtimes[id] = validateRuntime(id, runtime);
+  for (const [id, runtime] of Object.entries(rawRuntimes)) runtimes[id] = validateRuntime(id, runtime, { persisted });
   // A runtime's fallback is validated against sibling runtimes once every
   // runtime is known, so declaration order never matters.
   for (const [id, runtime] of Object.entries(runtimes)) {

package/src/contract/runtime.mjs

@@ -93,9 +93,11 @@ export function routeRuntime(contract, node, role = "worker", event = {}) {
 /**
  * @param {string} id
  * @param {unknown} runtime
+ * @param {{persisted?: boolean}} [options] `persisted` is a replay of a contract
+ *   already accepted at launch; see the vendor rule below.
  * @returns {ValidatedRuntime}
  */
-export function validateRuntime(id, runtime) {
+export function validateRuntime(id, runtime, options = {}) {
   requireId(id, `runtime ${id}`);
   assertObject(runtime, `runtime ${id}`);
   rejectUnknown(runtime, RUNTIME_FIELDS, `runtime ${id}`);
@@ -103,16 +105,24 @@ export function validateRuntime(id, runtime) {
   const typedRuntime = /** @type {{harness: string, model: string, vendor?: string, config?: Record<string, unknown>}} */ (runtime);
   // The canonical provider derived from the route, the model's family, or the
   // harness default outranks a declared `vendor`: a label that contradicts it
-  // is refused (R18), and the runtime's vendor becomes the derived provider
-  // rather than whatever text the contract declared. `replay` and `exec-jsonl`
-  // derive none — for those the declared vendor stands, as it always has.
+  // is refused (R18) at authoring, and the runtime's vendor becomes the derived
+  // provider rather than whatever text the contract declared. `replay` and
+  // `exec-jsonl` derive none — for those the declared vendor stands, as it
+  // always has. A persisted load takes the derived provider without refusing,
+  // so a run launched before R18 stays readable and cancelable.
   const derived = canonicalProvider(typedRuntime);
   const declared = typeof typedRuntime.vendor === "string" && typedRuntime.vendor.length ? typedRuntime.vendor : undefined;
   let vendor;
   if (derived) {
-    if (declared !== undefined && declared !== derived) {
+    if (declared !== undefined && declared !== derived && options.persisted !== true) {
       throw new TypeError(`runtime ${id} declares vendor ${declared} but ${typedRuntime.harness} ${typedRuntime.model} is provider ${derived}`);
     }
+    // A replay canonicalizes a contradicting label instead of refusing it.
+    // Measured 2026-09-27 (AP6): three runs launched before R18 carried
+    // `vendor: anthropic-sonnet` against the model claude-sonnet-5, and every
+    // reader of their persisted contract — `cancel`, `status`, `report` — threw
+    // on a rule those contracts predate, leaving the runs unsuspended forever.
+    // The rule still refuses the label where it can be acted on: at authoring.
     vendor = derived;
   } else {
     vendor = resolveVendor(typedRuntime);

package/src/contract/worker-result.mjs

@@ -43,12 +43,24 @@ export const SANDBOX_BLOCKED_WRITE = "sandbox_blocked_write";
  * fences it never wrote, and repeated the copy.
  */
 export class WorkerResultSizeError extends TypeError {
-  /** @param {string} field @param {number} limit */
-  constructor(field, limit) {
-    super(`${field} exceeds ${limit} bytes`);
+  /**
+   * `actual` is the measured byte count, never optional: measured 2026-09-28
+   * (AP18 of safe-to-hand-to-friend), a GLM worker returned an `artifacts[0]`
+   * of 19,810 bytes against the 16,384-byte ceiling and the node failed with
+   * "worker result.artifacts[0] exceeds 16384 bytes" -- the operator could not
+   * tell a 20 KiB artifact from a 1 MiB one, and the ceiling reads the same
+   * whether the worker overshot by 3 KiB or by ten times.
+   *
+   * @param {string} field
+   * @param {number} limit
+   * @param {number} actual
+   */
+  constructor(field, limit, actual) {
+    super(`${field} is ${actual} bytes, over the ${limit}-byte ceiling`);
     this.name = "WorkerResultSizeError";
     this.field = field;
     this.limit = limit;
+    this.actual = actual;
   }
 }
 
@@ -73,7 +85,7 @@ export class WorkerResultSizeError extends TypeError {
  */
 export function invalidResultRepair(cause) {
   if (cause instanceof WorkerResultSizeError) {
-    return `the result breaks a size ceiling: ${cause.field} exceeds ${cause.limit} bytes. Keep every field within its ceiling; a node that delivers through \`output\` sends \`artifacts\` as [] and never copies \`output\` into \`artifacts\`.`;
+    return `the result breaks a size ceiling: ${cause.field} is ${cause.actual} bytes, over the ${cause.limit}-byte ceiling. Keep every field within its ceiling; a node that delivers through \`output\` sends \`artifacts\` as [] and never copies \`output\` into \`artifacts\`.`;
   }
   return "the entire final message must be exactly the required JSON object: no markdown fences, no prose before or after it. Return it as the only content of the final message.";
 }
@@ -85,8 +97,9 @@ export function invalidResultRepair(cause) {
 export function parseWorkerResult(value) {
   if (typeof value !== "string") throw new TypeError("worker result must be JSON text");
   const maxRawBytes = RESULT_LIMITS.bytes + RESULT_LIMITS.outputBytes;
-  if (Buffer.byteLength(value, "utf8") > maxRawBytes) {
-    throw new WorkerResultSizeError("worker result", maxRawBytes);
+  const rawBytes = Buffer.byteLength(value, "utf8");
+  if (rawBytes > maxRawBytes) {
+    throw new WorkerResultSizeError("worker result", maxRawBytes, rawBytes);
   }
   let parsed;
   try {
@@ -140,8 +153,9 @@ export function validateWorkerResult(value) {
   let output;
   if (Object.hasOwn(record, "output") && record.output !== undefined) {
     assertObject(record.output, "worker result.output");
-    if (Buffer.byteLength(JSON.stringify(record.output), "utf8") > RESULT_LIMITS.outputBytes) {
-      throw new WorkerResultSizeError("worker result.output", RESULT_LIMITS.outputBytes);
+    const outputBytes = Buffer.byteLength(JSON.stringify(record.output), "utf8");
+    if (outputBytes > RESULT_LIMITS.outputBytes) {
+      throw new WorkerResultSizeError("worker result.output", RESULT_LIMITS.outputBytes, outputBytes);
     }
     output = /** @type {Record<string, unknown>} */ (record.output);
   }
@@ -155,8 +169,9 @@ export function validateWorkerResult(value) {
   // `output` is bounded on its own above and kept outside this envelope cap:
   // it is a discovery node's deliverable, not incidental prose competing with
   // summary/verification for the same 32 KiB budget.
-  if (Buffer.byteLength(JSON.stringify(envelope), "utf8") > RESULT_LIMITS.bytes) {
-    throw new WorkerResultSizeError("worker result", RESULT_LIMITS.bytes);
+  const envelopeBytes = Buffer.byteLength(JSON.stringify(envelope), "utf8");
+  if (envelopeBytes > RESULT_LIMITS.bytes) {
+    throw new WorkerResultSizeError("worker result", RESULT_LIMITS.bytes, envelopeBytes);
   }
   return output === undefined ? envelope : { ...envelope, output };
 }
@@ -206,6 +221,7 @@ function requireList(value, label, maxItems, itemBytes) {
   if (!Array.isArray(value) || value.length > maxItems) throw new TypeError(`${label} must be an array with at most ${maxItems} items`);
   for (const [index, item] of value.entries()) {
     if (typeof item !== "string") throw new TypeError(`${label}[${index}] must be a string`);
-    if (Buffer.byteLength(item, "utf8") > itemBytes) throw new WorkerResultSizeError(`${label}[${index}]`, itemBytes);
+    const bytes = Buffer.byteLength(item, "utf8");
+    if (bytes > itemBytes) throw new WorkerResultSizeError(`${label}[${index}]`, itemBytes, bytes);
   }
 }

package/src/engine/live-preflight.mjs

@@ -23,7 +23,7 @@ import { spawn } from "node:child_process";
 import { boundedGitSync } from "../repo/worktree.mjs";
 import { tmpdir } from "node:os";
 import { validateContract } from "../contract/index.mjs";
-import { assertInlineScriptProofsParse } from "../contract/definition-of-done.mjs";
+import { assertInlineScriptProofsParse, assertProofCommandsParse } from "../contract/definition-of-done.mjs";
 import { validateNodeSnapshot } from "../contract/snapshot.mjs";
 import { compactCost as formatCost } from "../util.mjs";
 import { runsRoot } from "../run/paths.mjs";
@@ -97,6 +97,9 @@ export async function preflightContract(contractPath, options = {}) {
   // first dispatch, so a body no attempt could ever make exit 0 refuses the
   // launch here, naming its node and item, instead of after three paid tries.
   assertInlineScriptProofsParse(contract.nodes);
+  // AP13: a proof command /bin/sh cannot parse never runs, so it refuses here
+  // for the same reason an inline script that does not parse does.
+  assertProofCommandsParse(contract.nodes);
   return preflightRuntimes([...reachableRuntimes(contract).values()], { ...options, cwd: contract.cwd });
 }
 

package/src/engine/prompts.mjs

@@ -267,6 +267,22 @@ export function judgePrompt(node, workerResult, context = {}) {
         "Assess every Definition of Done item by its id and cite the id you are addressing in each finding.");
 }
 
+/**
+ * The one rule the judge has never been given, added after N5 of the
+ * `open-source-readiness` campaign (AP20). A requirement that reads "the
+ * guard refuses these paths, except the declared ones" enumerates its cases,
+ * and a delivery that holds the general shape without covering one of them
+ * passes a judge that only checks whether the shape holds. Measured
+ * 2026-09-27: the `guards-core` node shipped the guard without the default
+ * exclusions its requirement declared, the judge approved, and the operator
+ * had to intervene twice on the integration ref for the phase to close.
+ *
+ * The rule sits with the list it governs, so it is stated exactly when there
+ * are judgment items to arbitrate and never when there are none.
+ */
+const JUDGE_ENUMERATED_ITEM_RULE =
+  "When an item enumerates cases, classes or exclusions (\"A, B and C\", \"every X except Y\"), it is satisfied only when the delivery covers every one of them, checked one by one against the diff: the general shape holding is not coverage. A finding that names such an item must say which of them is missing, and an approval that checked none of them is a protocol failure.";
+
 /**
  * The Definition of Done checklist for the judge prompt: judgment items the
  * judge must arbitrate, plus each deterministic item with the controller-run
@@ -283,7 +299,7 @@ function judgeDoDChecklist(items, deterministic) {
   const parts = [];
   const judgmentItems = items.filter((item) => item.judgment === true);
   parts.push(judgmentItems.length
-    ? `Judgment items — arbitrate only these:\n${judgmentItems.map((item) => `- [${item.id}] ${item.text} (judgment)`).join("\n")}`
+    ? `Judgment items — arbitrate only these:\n${judgmentItems.map((item) => `- [${item.id}] ${item.text} (judgment)`).join("\n")}\n${JUDGE_ENUMERATED_ITEM_RULE}`
     : "No judgment items require arbitration.");
   const proofItems = items.filter((item) => item.proof !== undefined);
   if (proofItems.length) {

package/src/engine/scheduler.mjs

@@ -759,7 +759,14 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
     heartbeat.stop();
     lock.release();
   }
-  renderStatusIfChanged(false, null);
+  // Forced, and after the lock is released: the change-detected render here
+  // was a no-op whenever the last tick had already written the same node
+  // states, which is the usual case, so the stored status.json kept the
+  // `controller: active` the last tick wrote while the lock was still held.
+  // Measured 2026-09-27 (AP12): `safe-to-hand-to-a-friend-phase-2` finished
+  // with `state: "active"` and pid 43002, and a watcher waiting for the
+  // controller to leave spun for two hours on a pid that no longer existed.
+  renderStatusIfChanged(true, null);
   renderCampaignHandoffSafely(campaign, runsDir, runDir);
   writeFindingsArtifact(runDir, contract, states);
   const failed = [...states.values()].filter((state) => state.status !== "done");

package/src/plan/freeze.mjs

@@ -21,6 +21,7 @@ import { assertObject, rejectUnknown, requirePacketHash, requireString } from ".
 import { writeJsonAtomic, writeTextAtomic } from "../run/store.mjs";
 import { VERIFICATION_LIMITS } from "../contract/verification.mjs";
 import { validatePlanPhases } from "./template.mjs";
+import { assertProofCommandsParse } from "../contract/definition-of-done.mjs";
 import { NODE_VALUE_OPTIONS, assertFilteredProofsNameTheirTest } from "./proof-scope.mjs";
 
 /** @typedef {import("../contract/index.mjs").JsonObject} JsonObject */
@@ -413,6 +414,7 @@ export function freezePlan(plan, { outDir, provenance, phases, spec, humanSteps,
   try {
     const validated = validateContract(raw, contractPath);
     assertFilteredProofsNameTheirTest(validated);
+    assertProofCommandsParse(validated.nodes);
     if (facts) assertTimeoutsCoverMeasured(validated, facts);
   } catch (error) {
     rmSync(contractPath, { force: true });

package/src/plan/pipeline.mjs

@@ -30,6 +30,7 @@ import { validateJudgeIndependence } from "../contract/judge-independence.mjs";
 import { firstEligibleReviewer, reviewerProvenanceOf } from "./reviewer.mjs";
 import { parseSpec, validateSpec } from "./spec.mjs";
 import { collectRepoFacts } from "./repo-facts.mjs";
+import { clearPlanProgress, writePlanProgress } from "./progress.mjs";
 import { checkPlanProofs } from "./proof-check.mjs";
 import { collectHumanSteps } from "./human-step.mjs";
 import { RISK_TIERS, TASK_KIND_CATALOGUE_FILE, buildPlanningContract, renderTaskKindCatalogue, validatePlanOutput } from "./template.mjs";
@@ -38,6 +39,7 @@ import { resolveRuntimes } from "./routing.mjs";
 import { contentDigest, freezePlan, writeFrozenPlanRecord } from "./freeze.mjs";
 import { availabilityOf, fileLineCount, highestOf, modelOf, toContractNode, toSizingNode } from "./pipeline-shape.mjs";
 import { campaignTree, runDirectory } from "../run/paths.mjs";
+import { assertLaunchBaseClean } from "../repo/source-identity.mjs";
 import { contestPlan } from "./contest.mjs";
 import { runReviewRounds } from "./rounds.mjs";
 
@@ -105,6 +107,27 @@ const APPROVE_BELOW_VALUES = new Set(["standard", "high", "none"]);
  * @returns {Promise<FrozenPipelineResult|ContestedPipelineResult>}
  */
 export async function runPlanningPipeline(options) {
+  try {
+    return await runPlanningStages(options);
+  } finally {
+    // The record of a process that is working must not outlive the work. It is
+    // cleared here, in the one place every return and every throw passes
+    // through, rather than by a caller: `plan` already removed it, but a
+    // caller that forgot left a record that makes the next launch report a
+    // death that never happened, and the record is worth nothing if it can be
+    // wrong in that direction.
+    if (typeof options.campaignId === "string" && typeof options.phase === "string") clearPlanProgress(resolve(options.cwd ?? "."), options.campaignId, options.phase);
+  }
+}
+
+/**
+ * The stages themselves, separate from the exported entry point only so that
+ * the liveness record is removed on every path out of them.
+ *
+ * @param {Parameters<typeof runPlanningPipeline>[0]} options
+ * @returns {Promise<FrozenPipelineResult|ContestedPipelineResult>}
+ */
+async function runPlanningStages(options) {
   const {
     specPath, campaignId, phase, runtimes, launch, wait,
     reviewRounds = 2, runtimeDefaults = {}, reviewers = [], verification = {}, targetedFix = false, judgeIndependence,
@@ -125,6 +148,17 @@ export async function runPlanningPipeline(options) {
   const campaignPath = campaignTree(cwd, campaignId);
   const campaign = readCampaign(campaignPath);
   if (campaign.status !== "active") throw new Error(`campaign is closed: ${campaignId}`);
+  // The run this pipeline launches is the last thing it does, and the run
+  // refuses a tree whose HEAD is dirty. Asking the same question here, before
+  // the first stage, is the difference between a refusal and sixteen minutes
+  // spent on repo facts first. Measured 2026-09-27 (AP10): a `plan` stage that
+  // died exactly that way reported "refusing to launch against HEAD: the
+  // working tree has 2 uncommitted paths" only when the operator re-ran it in
+  // the foreground. Nothing this pipeline writes touches the tree
+  // `dirtyTreePaths` reads: the plan artifacts live under the campaign tree in
+  // the home, and the scratch relay inside the repository is excluded by the
+  // same pathspec the launch uses.
+  assertLaunchBaseClean(cwd, undefined);
   refuseUnplannableRuntimes(runtimes, runtimeDefaults, packageMode, judgeIndependence);
   refusePlanningSilence(await ask(runtimes, runtimeDefaults, cwd), cwd);
 
@@ -142,10 +176,18 @@ export async function runPlanningPipeline(options) {
   const plansDir = join(campaignTree(cwd, campaignId), "plans", phase);
   mkdirSync(plansDir, { recursive: true });
   const pipelineLog = join(plansDir, "pipeline.jsonl");
+  // Every stage line is also the liveness record: the file is the answer to
+  // "is this plan still working", and a plan that dies mid-stage leaves the
+  // stage it died in as the last thing it ever said. Nothing removes it here;
+  // the caller clears it when the pipeline returns, so a record that survives
+  // a returned pipeline cannot happen and a record that survives anything
+  // else means exactly one thing.
   /** @param {string} stage @param {Record<string, unknown>} [extra] */
-  const logStage = (stage, extra = {}) => appendJsonl(pipelineLog, {
-    type: "plan.stage", at: new Date().toISOString(), campaignId, phase, stage, ...extra,
-  });
+  const logStage = (stage, extra = {}) => {
+    const at = new Date().toISOString();
+    appendJsonl(pipelineLog, { type: "plan.stage", at, campaignId, phase, stage, ...extra });
+    writePlanProgress(cwd, campaignId, phase, { campaignId, phase, at, stage, ...extra });
+  };
 
   // A discovery node's `readFiles` must resolve inside `cwd` (the task packet's
   // own containment rule), but `plansDir` lives under the home since R2 and no
@@ -160,7 +202,17 @@ export async function runPlanningPipeline(options) {
   // the draft stage reads what the planner measured instead of inferring it
   // from the spec's prose.
   const parsedSpec = parseSpec(specText);
-  const repoFacts = collectRepoFacts(cwd, { requirements: parsedSpec.requirements });
+  // This stage holds the terminal for minutes, which is why it says what it is
+  // about to do before it does it and one line per command as each finishes.
+  // Measured 2026-09-25/26 (AP3): five to eight minutes with nothing written
+  // anywhere, on six relaunches.
+  const repoFacts = collectRepoFacts(cwd, {
+    requirements: parsedSpec.requirements,
+    onProgress: (event) => {
+      if (event.kind === "commands") logStage("repo-facts:start", { commands: event.commands.map((argv) => argv.join(" ")) });
+      else logStage("repo-facts:measured", { argv: event.argv, measuredMs: event.measuredMs, index: event.index, total: event.total });
+    },
+  });
   // R16: an operator step a requirement's constraints declare, detected once
   // here so both the freeze below and a caller inspecting the pipeline agree
   // on the same list.

package/src/plan/progress.mjs

@@ -0,0 +1,101 @@
+/**
+ * The liveness record of a planning process: where a `faberun plan` says which
+ * stage it is in, and how a later reader tells a process that is still working
+ * from one that died without a word.
+ *
+ * It is separate from `pipeline.mjs` because two layers need it and neither
+ * owns it: the pipeline writes it as it advances through stages, and
+ * `cli/plan.mjs` reads it before starting and clears it when the pipeline
+ * returns. `cli/plan.mjs` already owns the sibling record for a plan that dies
+ * before the pipeline is reached (`writePlanBootstrapFailure`); this one
+ * covers the death that record cannot, the one that happens minutes later.
+ *
+ * Measured 2026-09-26 (AP4): a detached `plan` (pid 64270) vanished during the
+ * repo-facts stage, leaving `plans/phase-1` empty, with no `pipeline.jsonl` and
+ * no bootstrap failure. `watchPlanBootstrap` covers a five-second window, so a
+ * death after it recorded nothing at all.
+ *
+ * A record exists because a detached process's stdio is discarded, which is
+ * also why `plan --resolve` writes none: it is never detached, so a death
+ * there is visible where it happens and a record would only add a second
+ * account of something the operator already watched.
+ */
+import { rmSync } from "node:fs";
+import { join } from "node:path";
+import { pidAlive, processStartToken, sameProcessStartToken } from "../run/lock.mjs";
+import { campaignTree } from "../run/paths.mjs";
+import { readJson, writeJsonAtomic } from "../run/store.mjs";
+
+/** @typedef {{pid?: number, processStartToken?: string|null, at?: string, stage?: string, [key: string]: unknown}} PlanProgressRecord */
+
+/**
+ * Beside the phase's durable plan artifacts rather than in the disposable
+ * scratch tree, for the same reason `bootstrap-failure.json` is: a record a
+ * later launch has to find cannot live where the next `plan` may wipe.
+ *
+ * @param {string} cwd @param {string} campaignId @param {string} phase
+ * @returns {string}
+ */
+export function planProgressPath(cwd, campaignId, phase) {
+  return join(campaignTree(cwd, campaignId), "plans", phase, "progress.json");
+}
+
+/**
+ * Write the record of the process that is doing the work right now. It carries
+ * the pid together with the process start token, so a reader an hour later is
+ * not fooled by a pid the operating system handed to somebody else.
+ *
+ * @param {string} cwd @param {string} campaignId @param {string} phase
+ * @param {PlanProgressRecord} record
+ * @returns {void}
+ */
+export function writePlanProgress(cwd, campaignId, phase, record) {
+  writeJsonAtomic(planProgressPath(cwd, campaignId, phase), {
+    pid: process.pid,
+    processStartToken: processStartToken(process.pid),
+    at: new Date().toISOString(),
+    ...record,
+  });
+}
+
+/**
+ * @param {string} cwd @param {string} campaignId @param {string} phase
+ * @returns {PlanProgressRecord|null}
+ */
+export function readPlanProgress(cwd, campaignId, phase) {
+  try {
+    const record = /** @type {PlanProgressRecord} */ (readJson(planProgressPath(cwd, campaignId, phase)));
+    return record && typeof record === "object" && !Array.isArray(record) ? record : null;
+  } catch {
+    // An absent record is the ordinary case: a plan that finished clears it.
+    // A record that will not parse is one a dying process left half-written,
+    // and there is nothing in it a reader could act on either way.
+    return null;
+  }
+}
+
+/**
+ * The record of a process that stopped where it stood, or null when no plan is
+ * running and nothing died. A live pid with the recorded start token is work
+ * in progress, however long it has been in the same stage; anything else means
+ * the pipeline never reached its own end.
+ *
+ * @param {string} cwd @param {string} campaignId @param {string} phase
+ * @returns {PlanProgressRecord|null}
+ */
+export function abandonedPlanProgress(cwd, campaignId, phase) {
+  const record = readPlanProgress(cwd, campaignId, phase);
+  if (!record) return null;
+  const pid = typeof record.pid === "number" ? record.pid : null;
+  const token = typeof record.processStartToken === "string" ? record.processStartToken : null;
+  if (pid !== null && pidAlive(pid) && sameProcessStartToken(processStartToken(pid), token)) return null;
+  return record;
+}
+
+/**
+ * @param {string} cwd @param {string} campaignId @param {string} phase
+ * @returns {void}
+ */
+export function clearPlanProgress(cwd, campaignId, phase) {
+  rmSync(planProgressPath(cwd, campaignId, phase), { force: true });
+}

package/src/plan/proof-check.mjs

@@ -13,7 +13,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { shellWords } from "../util.mjs";
-import { inlineScriptParseError } from "../contract/definition-of-done.mjs";
+import { inlineScriptParseError, unclosedQuote } from "../contract/definition-of-done.mjs";
 import { NAME_PATTERN_FLAG } from "./proof-run.mjs";
 
 /** @typedef {import("./template.mjs").PlanOutput} PlanOutput */
@@ -150,6 +150,18 @@ export function checkPlanProofs(plan, repoFacts, cwd) {
         });
         continue;
       }
+      // AP13: a command the shell cannot parse never runs, so no delivery
+      // makes the item pass; the proof text has to change before the freeze.
+      const openQuote = unclosedQuote(commandText);
+      if (openQuote !== null) {
+        findings.push({
+          id: `proof-unparseable-${node.id}-${item.id}`,
+          severity: "critical",
+          nodeId: node.id,
+          text: `Node ${node.id}'s Definition of Done item "${item.id}" proves itself with a command that leaves a ${openQuote} open ("${commandText}"), which /bin/sh refuses before it runs, so no delivery can make this proof exit 0. Quote the value, as in --test-name-pattern="<title>".`,
+        });
+        continue;
+      }
       const nameFlag = NAME_PATTERN_FLAG.exec(commandText);
       if (nameFlag) {
         const pattern = nameFlag[1] ?? nameFlag[2] ?? nameFlag[3];

package/src/plan/proof-scope.mjs

@@ -30,7 +30,7 @@ const TEST_TITLE = /\b(?:test|it|describe)(?:\.\w+)?\(\s*(["'`])((?:\\.|(?!\1).)
  * @param {string[]} argv
  * @returns {{nameFilters: Array<{flag: string, value: string}>, paths: string[]}|null}
  */
-function nodeTestShape(argv) {
+export function nodeTestShape(argv) {
   if (argv[0] !== "node" || !argv.includes("--test")) return null;
   /** @type {Array<{flag: string, value: string}>} */
   const nameFilters = [];

package/src/plan/repo-facts.mjs

@@ -176,6 +176,19 @@ function manifestCandidateCommands(cwd) {
   return commands;
 }
 
+/**
+ * How a caller watches this stage work. `commands` arrives once, naming every
+ * command about to be timed; `measured` arrives once per command as it
+ * finishes. Neither reaches the returned facts: two calls at the same HEAD
+ * stay byte-identical because no event is written into them.
+ *
+ * Measured 2026-09-25/26 (AP3): this stage took five to eight minutes and said
+ * nothing while it did, so `faberun plan` was indistinguishable from a hang
+ * and the operator checked the process by hand on six relaunches.
+ *
+ * @typedef {(event: {kind: "commands", commands: string[][]} | {kind: "measured", argv: string[], measuredMs: number, index: number, total: number}) => void} RepoFactsProgress
+ */
+
 /**
  * Time every candidate through `timeVerificationCommands`'s own probe —
  * real `spawnSync` and `Date.now` by default, or the caller's fake — instead
@@ -187,9 +200,10 @@ function manifestCandidateCommands(cwd) {
  * @param {string} cwd
  * @param {{argv: string[]}[]} commands
  * @param {MeasureProbes} probes
+ * @param {RepoFactsProgress} [onProgress]
  * @returns {{argv: string[], measuredMs: number, eligible: boolean}[]}
  */
-function measureCandidates(cwd, commands, probes) {
+function measureCandidates(cwd, commands, probes, onProgress) {
   if (commands.length === 0) return [];
   const now = probes.now ?? (() => Date.now());
   /** @type {number[]} */
@@ -201,7 +215,22 @@ function measureCandidates(cwd, commands, probes) {
       taskPacket: { verification: [{ argv: command.argv, timeoutSec: CANDIDATE_TIMEOUT_SEC }] },
     })),
   }));
-  timeVerificationCommands(contract, { ...probes, now: () => { const mark = now(); marks.push(mark); return mark; } });
+  timeVerificationCommands(contract, {
+    ...probes,
+    now: () => {
+      const mark = now();
+      marks.push(mark);
+      // Every command contributes exactly one start mark and one stop mark, in
+      // order, so an even mark count means the command at half that count just
+      // finished. That is the only progress signal this stage has while it
+      // holds the terminal for minutes.
+      const stopped = marks.length;
+      if (stopped % 2 === 0 && onProgress) {
+        onProgress({ kind: "measured", argv: commands[stopped / 2 - 1].argv, measuredMs: mark - marks[stopped - 2], index: stopped / 2, total: commands.length });
+      }
+      return mark;
+    },
+  });
   return commands.map((command, index) => {
     const measuredMs = marks[index * 2 + 1] - marks[index * 2];
     return { argv: command.argv, measuredMs, eligible: measuredMs <= ELIGIBLE_MS_CEILING };
@@ -247,7 +276,7 @@ export function measureRequirements(cwd, requirements, probes = {}) {
 
 /**
  * @param {string} cwd
- * @param {{measure?: MeasureProbes, maxPaths?: number, requirements?: SpecRequirement[]}} [options]
+ * @param {{measure?: MeasureProbes, maxPaths?: number, requirements?: SpecRequirement[], onProgress?: RepoFactsProgress}} [options]
  * @returns {RepoFacts}
  */
 export function collectRepoFacts(cwd, options = {}) {
@@ -255,7 +284,9 @@ export function collectRepoFacts(cwd, options = {}) {
   const allPaths = listTrackedPaths(cwd);
   const pathSet = new Set(allPaths);
   const scripts = readScripts(cwd);
-  const measured = measureCandidates(cwd, nodeCandidateCommands(scripts, allPaths), options.measure ?? {});
+  const candidates = nodeCandidateCommands(scripts, allPaths);
+  options.onProgress?.({ kind: "commands", commands: candidates.map((command) => command.argv) });
+  const measured = measureCandidates(cwd, candidates, options.measure ?? {}, options.onProgress);
   const detected = manifestCandidateCommands(cwd);
   const truncated = allPaths.length > maxPaths;
   return {

package/src/plan/spec.mjs

@@ -6,11 +6,14 @@
  * schedules, or reaches a provider — this module invokes no model.
  */
 import { git } from "../repo/worktree.mjs";
+import { shellWords } from "../util.mjs";
+import { nodeTestShape } from "./proof-scope.mjs";
 import { proveRequirements } from "./proof-run.mjs";
 
 /** @typedef {"command"|"path"|"judgment"} ProofKind */
 /** @typedef {{kind: ProofKind, ref?: string}} SpecProof */
-/** @typedef {{id: string|null, title: string, statement: string|null, proof: SpecProof|null, measure: SpecProof|null, constraints: string|null, line: number}} SpecRequirement */
+/** @typedef {{key: string, line: number}} UnknownBulletKey */
+/** @typedef {{id: string|null, title: string, statement: string|null, proof: SpecProof|null, measure: SpecProof|null, constraints: string|null, unknownBulletKeys: UnknownBulletKey[], line: number}} SpecRequirement */
 /** @typedef {Record<string, string>} SpecFrontMatter */
 /** @typedef {{heading: string, body: string, line: number}} SpecSection */
 /** @typedef {{frontMatter: SpecFrontMatter|null, sections: Map<string, SpecSection>, requirements: SpecRequirement[]}} ParsedSpec */
@@ -98,25 +101,41 @@ function extractSections(lines, startIndex) {
  * A `- **key:** value` bullet, and any following non-blank, non-bullet line as
  * its wrapped continuation.
  *
+ * A bullet whose key does not match is *not* a continuation of the one above
+ * it: measured 2026-09-27 (AP14 of safe-to-hand-to-a-friend), a
+ * `- **esclarecimento (27/09):**` line right after `- **proof:**` was dropped
+ * and the lines under it were appended to the proof above, so R8 read as
+ * having no proof while the text said otherwise. The dropped key is returned
+ * so `validateSpec` can name it instead of letting it vanish.
+ *
  * @param {string[]} lines
- * @returns {Map<string, string>}
+ * @returns {{bullets: Map<string, string>, unknownKeys: Array<{key: string, offset: number}>}}
  */
 function parseBullets(lines) {
   /** @type {Map<string, string>} */
   const bullets = new Map();
+  /** @type {Array<{key: string, offset: number}>} */
+  const unknownKeys = [];
   let currentKey = null;
-  for (const line of lines) {
+  for (let offset = 0; offset < lines.length; offset += 1) {
+    const line = lines[offset];
     const match = /^-\s+\*\*([a-zA-Z-]+):\*\*\s?(.*)$/u.exec(line);
     if (match) {
       currentKey = match[1].toLowerCase();
       bullets.set(currentKey, match[2].trim());
       continue;
     }
+    const unrecognized = /^-\s+\*\*(.+?):\*\*\s?/u.exec(line);
+    if (unrecognized) {
+      unknownKeys.push({ key: unrecognized[1], offset });
+      currentKey = null;
+      continue;
+    }
     const trimmed = line.trim();
     if (!trimmed) { currentKey = null; continue; }
     if (currentKey && !trimmed.startsWith("-")) bullets.set(currentKey, `${bullets.get(currentKey)} ${trimmed}`.trim());
   }
-  return bullets;
+  return { bullets, unknownKeys };
 }
 
 /**
@@ -137,6 +156,44 @@ function parseProof(raw) {
   return kind === "judgment" ? { kind } : { kind, ref: match[2].trim() };
 }
 
+/**
+ * A requirement proof that filters `node:test` by name without naming the file
+ * the test lives in, or null. The same shape the frozen contract refuses
+ * (`plan/proof-scope.mjs`, AP1 of safe-to-hand-to-a-friend); raised here so a
+ * spec author sees it when the spec is written, rather than a plan later.
+ * Measured 2026-09-27 (AP8): R1 to R7 of the `safe-to-hand-to-a-friend` spec
+ * each wrote `--test-name-pattern="<title>"` with no file, and only the
+ * planner's own nodes were refused for it.
+ *
+ * @param {SpecProof|null} proof
+ * @returns {string|null}
+ */
+function proofWithoutNamedTestFile(proof) {
+  if (proof?.kind !== "command" || typeof proof.ref !== "string") return null;
+  const shape = nodeTestShape(shellWords(proof.ref));
+  if (!shape || shape.nameFilters.length === 0 || shape.paths.length > 0) return null;
+  return proof.ref;
+}
+
+/**
+ * The one finding `strict` does not promote. Measured 2026-09-28: 105 of the
+ * 237 `--test-name-pattern` proofs in the 109 documents under
+ * `docs/campaigns/` name no test file, across 20 documents. Every one of them
+ * is the record of a run that already happened, and the repository forbids
+ * editing that record to satisfy a rule written later, so promoting this to
+ * blocking would retroactively refuse twenty specs that were accepted when
+ * they were written. The shape is refused where it costs something anyway:
+ * `assertFilteredProofsNameTheirTest` (plan/proof-scope.mjs) fails the freeze
+ * of any plan that carries it, so a plan cannot be built from a fresh spec
+ * with this proof whatever the spec validator says about it.
+ *
+ * @param {SpecFinding} finding
+ * @returns {boolean}
+ */
+function promotableUnderStrict(finding) {
+  return finding.rule !== "proof-filter-names-no-file";
+}
+
 /**
  * @param {SpecSection|undefined} section
  * @returns {SpecRequirement[]}
@@ -154,7 +211,8 @@ function extractRequirements(section) {
     const blockLine = section.line + i + 1;
     let end = i + 1;
     while (end < lines.length && !/^###\s+/u.test(lines[end])) end += 1;
-    const bullets = parseBullets(lines.slice(i + 1, end));
+    const body = lines.slice(i + 1, end);
+    const { bullets, unknownKeys } = parseBullets(body);
     const idMatch = /^(R\d+)\.\s*(.*)$/u.exec(heading);
     requirements.push({
       id: idMatch ? idMatch[1] : null,
@@ -163,6 +221,7 @@ function extractRequirements(section) {
       proof: parseProof(bullets.get("proof")),
       measure: parseProof(bullets.get("measure")),
       constraints: bullets.get("constraints") ?? null,
+      unknownBulletKeys: unknownKeys.map(({ key, offset }) => ({ key, line: blockLine + offset })),
       line: blockLine,
     });
     i = end;
@@ -318,6 +377,23 @@ export function validateSpec(text, options = {}) {
     if (!requirement.proof) {
       findings.push({ rule: "requirement-missing-proof", severity: "advisory", message: `requirement ${requirement.id ?? requirement.title} has no proof`, line: requirement.line });
     }
+    for (const { key, line } of requirement.unknownBulletKeys) {
+      findings.push({
+        rule: "requirement-unknown-bullet-key",
+        severity: "advisory",
+        message: `requirement ${requirement.id ?? requirement.title} has a bullet keyed "${key}", which the format does not read: a key is letters and hyphens (statement, proof, measure, constraints), so this bullet and the lines under it are dropped instead of reaching the requirement. Reword the bullet or use one of the four keys.`,
+        line,
+      });
+    }
+    const unbacked = proofWithoutNamedTestFile(requirement.proof);
+    if (unbacked !== null) {
+      findings.push({
+        rule: "proof-filter-names-no-file",
+        severity: "advisory",
+        message: `requirement ${requirement.id ?? requirement.title}'s proof "${unbacked}" filters node:test by name but names no test file: with no path node --test runs every test file in the tree, each file the filter selects nothing in prints a zero plan, and the plan's own freeze refuses the shape. Name the file that holds the test, as in node --test --test-name-pattern="<title>" test/<area>/<file>.test.mjs.`,
+        line: requirement.line,
+      });
+    }
   }
   const successCriteria = parsed.sections.get("success criteria");
   if (successCriteria) findings.push(...baselineColumnFindings(successCriteria));
@@ -340,6 +416,6 @@ export function validateSpec(text, options = {}) {
       });
     }
   }
-  const graded = findings.map((finding) => (strict ? { ...finding, severity: /** @type {const} */ ("blocking") } : finding));
+  const graded = findings.map((finding) => (strict && promotableUnderStrict(finding) ? { ...finding, severity: /** @type {const} */ ("blocking") } : finding));
   return { class: "structured", ok: !graded.some((finding) => finding.severity === "blocking"), findings: graded };
 }

package/src/plan/template.mjs

@@ -154,6 +154,14 @@ function instructionsFor(kind, inputs) {
 // tree and read as having measured nothing; two nodes exhausted on it. The
 // freeze now refuses that shape (proof-scope.mjs); this is the same rule told
 // to the author, so the draft never writes it.
+// AP11 of safe-to-hand-to-friend, measured 2026-09-27: the plan proved R6 with
+// `! grep -q "\.runs" README.md docs/*.md` while the requirement allowed the
+// mention inside a section labelled as legacy layout, and the node exhausted
+// both attempts on a proof stricter than the statement it proved. The proof's
+// wording is a claim the reviewer can compare with the requirement's own; no
+// deterministic check does, because "stricter" is a reading of two sentences.
+const PROOF_NOT_STRICTER_THAN_REQUIREMENT_RULE = "For every node, compare each command proof with the requirement statement it proves, sentence by sentence: a proof that asserts more than the statement is a finding, because the node is refused for work the requirement allows. A bare `grep` for an absence the statement does not claim, a pattern narrower than the statement's words, or a whole-file scope where the statement names a section are the three shapes this takes.";
+
 const NAMED_TEST_FILE_RULE = 'A command that filters node:test by name (--test-name-pattern) names the test file it selects from, as in node --test --test-name-pattern="<exact test title>" test/<area>/<file>.test.mjs: with no path node --test runs every test file in the tree and the freeze refuses it. A requirement proof the spec writes without a file gains the file of the test that carries that title.';
 
 // The rule every planned packet is held to at freeze time, worded from
@@ -198,6 +206,7 @@ const INSTRUCTIONS = Object.freeze({
   ],
   review: [
     "You are given only the spec, the repository facts, and the plan under review; you have not seen how the plan was produced or any reasoning behind it. Review the artefact alone.",
+    PROOF_NOT_STRICTER_THAN_REQUIREMENT_RULE,
     `Return exactly one worker-result JSON object. Put your findings in output.findings as ${FINDINGS_SHAPE} and nothing else in output.`,
     "severity must be one of critical, major, minor. Every finding's nodeId must name a node id that actually appears in the plan under review.",
   ],

package/src/repo/worktree-prune.mjs

@@ -13,9 +13,9 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { SETTLED } from "../engine/prompts.mjs";
 import { describeRuns } from "../run/disk-gc.mjs";
 import { worktreeRoot } from "../run/paths.mjs";
-import { git, gitHead, releaseRunWorktrees, runRefName } from "./worktree.mjs";
+import { git, gitHead, releaseAttemptBranches, releaseRunWorktrees, runRefName } from "./worktree.mjs";
 
-/** @typedef {{runId: string, removed: number, archived: string[]}} PrunedRun */
+/** @typedef {{runId: string, removed: number, archived: string[], branches: string[]}} PrunedRun */
 
 /**
  * Is the run's integrated head already on a branch of the operator's? An
@@ -48,7 +48,9 @@ function allNodesSettled(runDir) {
  * nodes are all terminal, and whose run ref a local branch already contains.
  * `releaseRunWorktrees` keeps each attempt's HEAD and uncommitted delta under
  * `refs/faberun-archive/`, so a released attempt can still be recovered.
- * `parked` also takes a run with a blocked or exhausted node: only on the
+ * The attempt branches of the same run go with them (AP21): a released
+ * worktree deletes only the branch it had checked out, so a run that tried
+ * three times kept three. `parked` also takes a run with a blocked or exhausted node: only on the
  * operator's word, because a resume that re-judges an attempt reads its
  * worktree, and only the operator knows the run was superseded.
  *
@@ -64,9 +66,15 @@ export function pruneIntegratedRunWorktrees(repo, runsDir, options = {}) {
     if (run.hasActiveController) continue;
     if (!run.allNodesTerminal && !(options.parked === true && allNodesSettled(run.path))) continue;
     const runId = basename(run.path);
-    if (!existsSync(worktreeRoot(join(runsDir, runId), runId))) continue;
     if (!runRefLanded(repo, runId)) continue;
-    pruned.push({ runId, ...releaseRunWorktrees(repo, join(runsDir, runId), runId) });
+    // The branch sweep is not gated on the worktree root: the run whose
+    // worktrees an earlier prune already released is exactly the run whose
+    // attempt branches are still there (AP21).
+    const runDir = join(runsDir, runId);
+    const released = existsSync(worktreeRoot(runDir, runId)) ? releaseRunWorktrees(repo, runDir, runId) : { removed: 0, archived: [] };
+    const branches = releaseAttemptBranches(repo, runId);
+    if (released.removed === 0 && branches.length === 0) continue;
+    pruned.push({ runId, ...released, branches });
   }
   return pruned;
 }

package/src/repo/worktree.mjs

@@ -482,6 +482,60 @@ export function attemptWorkspace(state) {
   return path && state?.worktree?.status !== "removed" && existsSync(path) ? path : null;
 }
 
+/**
+ * Delete the attempt branches of `runId` whose commit another ref already
+ * holds: the run's own `refs/faberun/<run>/…`, an archive ref written when a
+ * worktree was released, or any branch of the operator's. Measured 2026-09-28
+ * (AP21 of safe-to-hand-to-friend): `prune --parked` released 20 worktrees and
+ * left 133 branches `faberun/<run>/<node>/<n>` behind, every one of them
+ * already reachable from one of those refs; releasing a worktree deletes only
+ * the branch it had checked out.
+ *
+ * A branch nothing else holds is never deleted: an attempt that exists only as
+ * its own branch is the only copy of that work. Attempt branches are not
+ * keepers for each other, so the rule is about the run, not about whichever
+ * attempt happens to be newest.
+ *
+ * @param {string} repo
+ * @param {string} runId
+ * @returns {string[]} the branch names deleted, without `refs/heads/`
+ */
+export function releaseAttemptBranches(repo, runId) {
+  const prefix = `refs/heads/faberun/${runId}/`;
+  /** @type {Array<{ref: string, commit: string}>} */
+  const attempts = git(repo, ["for-each-ref", "--format=%(refname) %(objectname)", "refs/heads/faberun/"])
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const [ref, commit] = line.split(" ");
+      return { ref: ref ?? "", commit: commit ?? "" };
+    })
+    .filter(({ ref }) => ref.startsWith(prefix));
+  if (attempts.length === 0) return [];
+  const keepers = git(repo, ["for-each-ref", "--format=%(refname)", "refs/heads", "refs/faberun", "refs/faberun-archive"])
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith("refs/heads/faberun/"));
+  /** @type {string[]} */
+  const deleted = [];
+  for (const { ref, commit } of attempts) {
+    const held = keepers.some((keeper) => {
+      try {
+        git(repo, ["merge-base", "--is-ancestor", commit, keeper]);
+        return true;
+      } catch {
+        // Not an ancestor of this keeper; the next one may still hold it.
+        return false;
+      }
+    });
+    if (!held) continue;
+    deleteRef(repo, ref);
+    deleted.push(ref.slice("refs/heads/".length));
+  }
+  return deleted;
+}
+
 /**
  * Release every attempt worktree a finished run left behind, keeping what it
  * held. Measured 2026-09-24: attempts that were never accepted (a failed or