faberun 0.28.0 → 0.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/src/cli/launch.mjs

@@ -16,7 +16,7 @@ import { bootstrapAckPath, bootstrapAttemptPath, bootstrapPath, cleanupBootstrap
 import { bootstrapFailureMatchesChild, bootstrapMatchesChild, processStartToken, readLock, sameProcessStartToken, validBootstrapNonce } from "../run/lock.mjs";
 import { cleanupBootstrapNonce, discardNodeLessRunDirectory } from "../engine/detach.mjs";
 import { delay, errorCode } from "../util.mjs";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -232,16 +232,33 @@ export function bootstrapRunDir(command, target) {
  */
 export function writeBootstrapFailure(command, target, error) {
   const runDir = bootstrapRunDir(command, target);
-  if (!runDir || !existsSync(runDir)) return;
+  if (!runDir) return;
   const nonce = validBootstrapNonce(process.env.FABERUN_BOOTSTRAP_NONCE) ? process.env.FABERUN_BOOTSTRAP_NONCE : null;
   const failure = { status: "failed", pid: process.pid, processStartToken: processStartToken(process.pid), runDir, nonce, at: new Date().toISOString(), error: error.message };
+  const detachedChild = nonce !== null && !process.argv.includes("--detach");
+  if (!existsSync(runDir)) {
+    // A refusal that happens before the run directory exists — a dirty tree, a
+    // base ref that does not resolve — is the one the launcher cannot
+    // otherwise learn: the child's stdio is discarded, so all it could say was
+    // "failed before readiness for pid N". Measured 2026-09-27 (AP10): a whole
+    // `plan` stage died that way over two uncommitted paths. Only a detached
+    // child creates the directory, and only to carry this record;
+    // `waitForBootstrap` removes a node-less one as it reads it.
+    if (!detachedChild) return;
+    try {
+      mkdirSync(runDir, { recursive: true });
+    } catch {
+      // The refusal being reported matters more than the directory that would
+      // have carried it; without one the launcher falls back to its own message.
+      return;
+    }
+  }
   // A `run` that names an existing run directory is refused before it writes
   // anything, and its failure must not be stamped into that run's bootstrap
   // record. The detached child is the exception: it wrote contract.json and
   // then died before readiness, and the launcher has no other channel to
   // learn the controller's error, so it must record that error before it
   // exits.
-  const detachedChild = nonce !== null && !process.argv.includes("--detach");
   if (command === "run" && !detachedChild && existsSync(join(runDir, "contract.json"))) return;
   /** @type {BootstrapRecord|null} */
   let current = null;

package/src/cli/plan.mjs

@@ -5,8 +5,8 @@
  * sequencing and every decision the pipeline makes.
  */
 import { validateJudgeIndependence } from "../contract/judge-independence.mjs";
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
 import { detachArgv, detachSelf, waitForBootstrap } from "./launch.mjs";
 import { classifyRunProgress } from "../campaign/chain.mjs";
 import { runProgress } from "../engine/supervise.mjs";
@@ -17,6 +17,7 @@ import { colorLevel, statusToken } from "./brand.mjs";
 import { delay } from "../util.mjs";
 import { runPlanningPipeline } from "../plan/pipeline.mjs";
 import { parseAnswerFlags, resolvePlanningPipeline } from "../plan/resolve.mjs";
+import { abandonedPlanProgress } from "../plan/progress.mjs";
 import { resolveReviewerList } from "../plan/reviewer.mjs";
 import { campaignTree, runDirectory } from "../run/paths.mjs";
 import { readCampaign } from "../campaign/record.mjs";
@@ -112,6 +113,46 @@ export function loadRuntimesCatalogue(path) {
   return runtimes;
 }
 
+/**
+ * The campaign's own checked-in planning inputs live beside the spec it
+ * already keeps in the repository: `docs/campaigns/<id>/plan-inputs/`. A file
+ * that exists there is used as if it had been passed on the command line,
+ * because that is what it is for; an absent one changes nothing.
+ *
+ * Measured 2026-09-27 (AP19): a campaign carried
+ * `plan-inputs/runtimes.json` with a raised output ceiling, `plan` fell back
+ * to the 8192 default without a word, and the operator found out only after
+ * burning rounds on a truncated draft.
+ *
+ * @param {string} cwd @param {string} campaignId @param {string} file
+ * @returns {string}
+ */
+function campaignInputPath(cwd, campaignId, file) {
+  return join(cwd, "docs", "campaigns", campaignId, "plan-inputs", file);
+}
+
+/**
+ * The catalogue a `plan` reads runtimes from, and the file it came from when
+ * that file is the campaign's own. `--runtimes` wins over the checked-in one:
+ * an operator passing a path is overriding, not asking.
+ *
+ * `source` is returned rather than printed here so a caller decides the
+ * wording; `planCli` says it out loud because silence is the whole defect. The
+ * path is resolved from the launch cwd, never from the plan's own target, so
+ * the same command from a subdirectory reads the same file the campaign does.
+ *
+ * @param {{cwd: string, campaignId: string, runtimes?: unknown}} options
+ * @returns {{runtimes: Record<string, import("../contract/index.mjs").ValidatedRuntime>, source: string|null}}
+ */
+export function resolvePlanRuntimes({ cwd, campaignId, runtimes }) {
+  if (typeof runtimes === "string" && runtimes) return { runtimes: loadRuntimesCatalogue(runtimes), source: null };
+  const campaignRuntimes = campaignInputPath(cwd, campaignId, "runtimes.json");
+  if (!existsSync(campaignRuntimes)) {
+    return { runtimes: /** @type {Record<string, import("../contract/index.mjs").ValidatedRuntime>} */ (DISCOVERY_RUNTIME_DEFINITIONS), source: null };
+  }
+  return { runtimes: loadRuntimesCatalogue(campaignRuntimes), source: campaignRuntimes };
+}
+
 /**
  * A `--verification <path>` catalogue: a JSON object carrying either or both
  * of the contract's own suite keys, `sharedVerification` and
@@ -160,9 +201,10 @@ export async function planCli(target, values) {
   // R19: the planner's own reviewer list, never `runtimeDefaults.judge` --
   // `--reviewers` wins over the machine's own `config.reviewers` default.
   const reviewers = resolveReviewerList({ reviewers: parseReviewerList(values.reviewers) }, readUserConfig(process.env));
-  const runtimes = typeof values.runtimes === "string" && values.runtimes
-    ? loadRuntimesCatalogue(values.runtimes)
-    : DISCOVERY_RUNTIME_DEFINITIONS;
+  const { runtimes, source: runtimesSource } = resolvePlanRuntimes({ cwd: process.cwd(), campaignId, runtimes: values.runtimes });
+  // Said out loud because silence is the whole defect: the default and the
+  // campaign's own catalogue look identical from the outside.
+  if (runtimesSource) process.stdout.write(`[plan] runtimes · ${relative(process.cwd(), runtimesSource)}\n`);
   const verification = typeof values.verification === "string" && values.verification
     ? loadVerificationSuites(values.verification)
     : {};
@@ -171,6 +213,15 @@ export async function planCli(target, values) {
     ? undefined
     : validateJudgeIndependence(values["judge-independence"], "--judge-independence");
 
+  // A record with no live process behind it is the only trace a planning run
+  // that died without a word leaves. Measured 2026-09-26 (AP4): `--detach` pid
+  // 64270 vanished during repo-facts and the phase directory stayed empty, so
+  // the next launch is the one place the operator can still be told.
+  const abandoned = abandonedPlanProgress(process.cwd(), campaignId, phase);
+  if (abandoned) {
+    process.stderr.write(`[plan] a previous planning process (pid ${String(abandoned.pid ?? "?")}) stopped during ${String(abandoned.stage ?? "?")} at ${String(abandoned.at ?? "?")} and never reached the end\n`);
+  }
+
   if (values.detach === true) {
     const argv = ["plan", specPath, "--campaign", campaignId, "--phase", phase, "--review-rounds", String(reviewRounds)];
     if (approveBelow !== undefined) argv.push("--approve-below", approveBelow);

package/src/cli.mjs

@@ -579,7 +579,11 @@ function advisoryToken() {
 function prunedLine(pruned) {
   if (!pruned.length) return "[prune] no finished, integrated run holds a worktree";
   const removed = pruned.reduce((sum, run) => sum + run.removed, 0);
-  return `[prune] released ${removed} worktree${removed === 1 ? "" : "s"} of ${pruned.length} integrated run${pruned.length === 1 ? "" : "s"} · each kept under refs/faberun-archive/`;
+  const branches = pruned.reduce((sum, run) => sum + run.branches.length, 0);
+  const line = removed === 0
+    ? "[prune] an earlier prune already released every worktree of an integrated run"
+    : `[prune] released ${removed} worktree${removed === 1 ? "" : "s"} of ${pruned.length} integrated run${pruned.length === 1 ? "" : "s"} · each kept under refs/faberun-archive/`;
+  return branches === 0 ? line : `${line} · deleted ${branches} attempt branch${branches === 1 ? "" : "es"} already held by another ref`;
 }
 
 /**

package/src/contract/definition-of-done.mjs

@@ -279,6 +279,61 @@ export function assertInlineScriptProofsParse(nodes) {
   }
 }
 
+/**
+ * The quote a command proof's text leaves open, or null when every quote it
+ * opens is closed. `kind: "command"` goes through `/bin/sh -c`, so a text with
+ * an odd number of `'` or `"` is refused by the shell before the command runs,
+ * with `unexpected EOF while looking for matching`. Measured 2026-09-27 (AP13
+ * of safe-to-hand-to-friend): the freeze accepted
+ * `node --test --test-name-pattern=a stranger's first campaign completes
+ * offline test/…` — an apostrophe inside an unquoted test title — the node did
+ * the work and passed its own test in 15 s, and both attempts were spent on a
+ * command `/bin/sh` never ran.
+ *
+ * This is a quote scanner, not a shell parser: it reports the two failures a
+ * proof can carry without expanding anything (an open quote, or nothing at
+ * all), and leaves every other shell construct to the shell. A `$'…'` string
+ * and a quote inside a here-document are the constructs it does not model.
+ *
+ * @param {string} commandText
+ * @returns {string|null}
+ */
+export function unclosedQuote(commandText) {
+  /** @type {string|null} */
+  let quote = null;
+  let escaped = false;
+  for (const character of commandText) {
+    if (escaped) { escaped = false; continue; }
+    // Outside double quotes a backslash escapes the next character; a
+    // backslash inside single quotes is literal, which POSIX also gives it.
+    if (quote !== "'" && character === "\\") { escaped = true; continue; }
+    if (quote === null && (character === "'" || character === '"')) { quote = character; continue; }
+    if (quote === character) quote = null;
+  }
+  return quote;
+}
+
+/**
+ * Refuse a contract whose command proof the shell cannot parse, naming the
+ * node, the item and the open quote. The freeze and the launch both call it:
+ * a command no attempt can run is the same waste as an inline script that
+ * cannot parse, and cheaper to refuse than to discover.
+ *
+ * @param {{id?: unknown, definitionOfDone?: {id?: unknown, proof?: {kind?: unknown, ref?: unknown}}[]}[]} nodes
+ * @returns {void}
+ */
+export function assertProofCommandsParse(nodes) {
+  for (const node of nodes) {
+    for (const item of node.definitionOfDone ?? []) {
+      if (item.proof?.kind !== "command" || typeof item.proof.ref !== "string") continue;
+      const quote = unclosedQuote(item.proof.ref);
+      if (quote === null) continue;
+      const nodeName = node.id === undefined ? "a node" : `node ${node.id}`;
+      throw new TypeError(`${nodeName}, Definition of Done item "${item.id}": the proof command leaves a ${quote} open, so /bin/sh refuses it before it runs ("unexpected EOF while looking for matching \`${quote}'"). Quote the value, as in --test-name-pattern="<title>".`);
+    }
+  }
+}
+
 /** @param {string} token @returns {boolean} */
 function isNodeExecutable(token) {
   const base = (token.split(/[\\/]/u).pop() ?? token).toLowerCase();

package/src/contract/index.mjs

@@ -153,7 +153,7 @@ export function validateContract(raw, contractPath, options = {}) {
     throw new TypeError("contract.runtimes must be an object");
   }
   const runtimes = /** @type {Record<string, ValidatedRuntime>} */ ({});
-  for (const [id, runtime] of Object.entries(rawRuntimes)) runtimes[id] = validateRuntime(id, runtime);
+  for (const [id, runtime] of Object.entries(rawRuntimes)) runtimes[id] = validateRuntime(id, runtime, { persisted });
   // A runtime's fallback is validated against sibling runtimes once every
   // runtime is known, so declaration order never matters.
   for (const [id, runtime] of Object.entries(runtimes)) {

package/src/contract/runtime.mjs

@@ -93,9 +93,11 @@ export function routeRuntime(contract, node, role = "worker", event = {}) {
 /**
  * @param {string} id
  * @param {unknown} runtime
+ * @param {{persisted?: boolean}} [options] `persisted` is a replay of a contract
+ *   already accepted at launch; see the vendor rule below.
  * @returns {ValidatedRuntime}
  */
-export function validateRuntime(id, runtime) {
+export function validateRuntime(id, runtime, options = {}) {
   requireId(id, `runtime ${id}`);
   assertObject(runtime, `runtime ${id}`);
   rejectUnknown(runtime, RUNTIME_FIELDS, `runtime ${id}`);
@@ -103,16 +105,24 @@ export function validateRuntime(id, runtime) {
   const typedRuntime = /** @type {{harness: string, model: string, vendor?: string, config?: Record<string, unknown>}} */ (runtime);
   // The canonical provider derived from the route, the model's family, or the
   // harness default outranks a declared `vendor`: a label that contradicts it
-  // is refused (R18), and the runtime's vendor becomes the derived provider
-  // rather than whatever text the contract declared. `replay` and `exec-jsonl`
-  // derive none — for those the declared vendor stands, as it always has.
+  // is refused (R18) at authoring, and the runtime's vendor becomes the derived
+  // provider rather than whatever text the contract declared. `replay` and
+  // `exec-jsonl` derive none — for those the declared vendor stands, as it
+  // always has. A persisted load takes the derived provider without refusing,
+  // so a run launched before R18 stays readable and cancelable.
   const derived = canonicalProvider(typedRuntime);
   const declared = typeof typedRuntime.vendor === "string" && typedRuntime.vendor.length ? typedRuntime.vendor : undefined;
   let vendor;
   if (derived) {
-    if (declared !== undefined && declared !== derived) {
+    if (declared !== undefined && declared !== derived && options.persisted !== true) {
       throw new TypeError(`runtime ${id} declares vendor ${declared} but ${typedRuntime.harness} ${typedRuntime.model} is provider ${derived}`);
     }
+    // A replay canonicalizes a contradicting label instead of refusing it.
+    // Measured 2026-09-27 (AP6): three runs launched before R18 carried
+    // `vendor: anthropic-sonnet` against the model claude-sonnet-5, and every
+    // reader of their persisted contract — `cancel`, `status`, `report` — threw
+    // on a rule those contracts predate, leaving the runs unsuspended forever.
+    // The rule still refuses the label where it can be acted on: at authoring.
     vendor = derived;
   } else {
     vendor = resolveVendor(typedRuntime);

package/src/contract/worker-result.mjs

@@ -43,12 +43,24 @@ export const SANDBOX_BLOCKED_WRITE = "sandbox_blocked_write";
  * fences it never wrote, and repeated the copy.
  */
 export class WorkerResultSizeError extends TypeError {
-  /** @param {string} field @param {number} limit */
-  constructor(field, limit) {
-    super(`${field} exceeds ${limit} bytes`);
+  /**
+   * `actual` is the measured byte count, never optional: measured 2026-09-28
+   * (AP18 of safe-to-hand-to-friend), a GLM worker returned an `artifacts[0]`
+   * of 19,810 bytes against the 16,384-byte ceiling and the node failed with
+   * "worker result.artifacts[0] exceeds 16384 bytes" -- the operator could not
+   * tell a 20 KiB artifact from a 1 MiB one, and the ceiling reads the same
+   * whether the worker overshot by 3 KiB or by ten times.
+   *
+   * @param {string} field
+   * @param {number} limit
+   * @param {number} actual
+   */
+  constructor(field, limit, actual) {
+    super(`${field} is ${actual} bytes, over the ${limit}-byte ceiling`);
     this.name = "WorkerResultSizeError";
     this.field = field;
     this.limit = limit;
+    this.actual = actual;
   }
 }
 
@@ -73,7 +85,7 @@ export class WorkerResultSizeError extends TypeError {
  */
 export function invalidResultRepair(cause) {
   if (cause instanceof WorkerResultSizeError) {
-    return `the result breaks a size ceiling: ${cause.field} exceeds ${cause.limit} bytes. Keep every field within its ceiling; a node that delivers through \`output\` sends \`artifacts\` as [] and never copies \`output\` into \`artifacts\`.`;
+    return `the result breaks a size ceiling: ${cause.field} is ${cause.actual} bytes, over the ${cause.limit}-byte ceiling. Keep every field within its ceiling; a node that delivers through \`output\` sends \`artifacts\` as [] and never copies \`output\` into \`artifacts\`.`;
   }
   return "the entire final message must be exactly the required JSON object: no markdown fences, no prose before or after it. Return it as the only content of the final message.";
 }
@@ -85,8 +97,9 @@ export function invalidResultRepair(cause) {
 export function parseWorkerResult(value) {
   if (typeof value !== "string") throw new TypeError("worker result must be JSON text");
   const maxRawBytes = RESULT_LIMITS.bytes + RESULT_LIMITS.outputBytes;
-  if (Buffer.byteLength(value, "utf8") > maxRawBytes) {
-    throw new WorkerResultSizeError("worker result", maxRawBytes);
+  const rawBytes = Buffer.byteLength(value, "utf8");
+  if (rawBytes > maxRawBytes) {
+    throw new WorkerResultSizeError("worker result", maxRawBytes, rawBytes);
   }
   let parsed;
   try {
@@ -140,8 +153,9 @@ export function validateWorkerResult(value) {
   let output;
   if (Object.hasOwn(record, "output") && record.output !== undefined) {
     assertObject(record.output, "worker result.output");
-    if (Buffer.byteLength(JSON.stringify(record.output), "utf8") > RESULT_LIMITS.outputBytes) {
-      throw new WorkerResultSizeError("worker result.output", RESULT_LIMITS.outputBytes);
+    const outputBytes = Buffer.byteLength(JSON.stringify(record.output), "utf8");
+    if (outputBytes > RESULT_LIMITS.outputBytes) {
+      throw new WorkerResultSizeError("worker result.output", RESULT_LIMITS.outputBytes, outputBytes);
     }
     output = /** @type {Record<string, unknown>} */ (record.output);
   }
@@ -155,8 +169,9 @@ export function validateWorkerResult(value) {
   // `output` is bounded on its own above and kept outside this envelope cap:
   // it is a discovery node's deliverable, not incidental prose competing with
   // summary/verification for the same 32 KiB budget.
-  if (Buffer.byteLength(JSON.stringify(envelope), "utf8") > RESULT_LIMITS.bytes) {
-    throw new WorkerResultSizeError("worker result", RESULT_LIMITS.bytes);
+  const envelopeBytes = Buffer.byteLength(JSON.stringify(envelope), "utf8");
+  if (envelopeBytes > RESULT_LIMITS.bytes) {
+    throw new WorkerResultSizeError("worker result", RESULT_LIMITS.bytes, envelopeBytes);
   }
   return output === undefined ? envelope : { ...envelope, output };
 }
@@ -206,6 +221,7 @@ function requireList(value, label, maxItems, itemBytes) {
   if (!Array.isArray(value) || value.length > maxItems) throw new TypeError(`${label} must be an array with at most ${maxItems} items`);
   for (const [index, item] of value.entries()) {
     if (typeof item !== "string") throw new TypeError(`${label}[${index}] must be a string`);
-    if (Buffer.byteLength(item, "utf8") > itemBytes) throw new WorkerResultSizeError(`${label}[${index}]`, itemBytes);
+    const bytes = Buffer.byteLength(item, "utf8");
+    if (bytes > itemBytes) throw new WorkerResultSizeError(`${label}[${index}]`, itemBytes, bytes);
   }
 }

package/src/engine/live-preflight.mjs

@@ -23,7 +23,7 @@ import { spawn } from "node:child_process";
 import { boundedGitSync } from "../repo/worktree.mjs";
 import { tmpdir } from "node:os";
 import { validateContract } from "../contract/index.mjs";
-import { assertInlineScriptProofsParse } from "../contract/definition-of-done.mjs";
+import { assertInlineScriptProofsParse, assertProofCommandsParse } from "../contract/definition-of-done.mjs";
 import { validateNodeSnapshot } from "../contract/snapshot.mjs";
 import { compactCost as formatCost } from "../util.mjs";
 import { runsRoot } from "../run/paths.mjs";
@@ -97,6 +97,9 @@ export async function preflightContract(contractPath, options = {}) {
   // first dispatch, so a body no attempt could ever make exit 0 refuses the
   // launch here, naming its node and item, instead of after three paid tries.
   assertInlineScriptProofsParse(contract.nodes);
+  // AP13: a proof command /bin/sh cannot parse never runs, so it refuses here
+  // for the same reason an inline script that does not parse does.
+  assertProofCommandsParse(contract.nodes);
   return preflightRuntimes([...reachableRuntimes(contract).values()], { ...options, cwd: contract.cwd });
 }
 

package/src/engine/prompts.mjs

@@ -267,6 +267,22 @@ export function judgePrompt(node, workerResult, context = {}) {
         "Assess every Definition of Done item by its id and cite the id you are addressing in each finding.");
 }
 
+/**
+ * The one rule the judge has never been given, added after N5 of the
+ * `open-source-readiness` campaign (AP20). A requirement that reads "the
+ * guard refuses these paths, except the declared ones" enumerates its cases,
+ * and a delivery that holds the general shape without covering one of them
+ * passes a judge that only checks whether the shape holds. Measured
+ * 2026-09-27: the `guards-core` node shipped the guard without the default
+ * exclusions its requirement declared, the judge approved, and the operator
+ * had to intervene twice on the integration ref for the phase to close.
+ *
+ * The rule sits with the list it governs, so it is stated exactly when there
+ * are judgment items to arbitrate and never when there are none.
+ */
+const JUDGE_ENUMERATED_ITEM_RULE =
+  "When an item enumerates cases, classes or exclusions (\"A, B and C\", \"every X except Y\"), it is satisfied only when the delivery covers every one of them, checked one by one against the diff: the general shape holding is not coverage. A finding that names such an item must say which of them is missing, and an approval that checked none of them is a protocol failure.";
+
 /**
  * The Definition of Done checklist for the judge prompt: judgment items the
  * judge must arbitrate, plus each deterministic item with the controller-run
@@ -283,7 +299,7 @@ function judgeDoDChecklist(items, deterministic) {
   const parts = [];
   const judgmentItems = items.filter((item) => item.judgment === true);
   parts.push(judgmentItems.length
-    ? `Judgment items — arbitrate only these:\n${judgmentItems.map((item) => `- [${item.id}] ${item.text} (judgment)`).join("\n")}`
+    ? `Judgment items — arbitrate only these:\n${judgmentItems.map((item) => `- [${item.id}] ${item.text} (judgment)`).join("\n")}\n${JUDGE_ENUMERATED_ITEM_RULE}`
     : "No judgment items require arbitration.");
   const proofItems = items.filter((item) => item.proof !== undefined);
   if (proofItems.length) {

package/src/engine/scheduler.mjs

@@ -759,7 +759,14 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
     heartbeat.stop();
     lock.release();
   }
-  renderStatusIfChanged(false, null);
+  // Forced, and after the lock is released: the change-detected render here
+  // was a no-op whenever the last tick had already written the same node
+  // states, which is the usual case, so the stored status.json kept the
+  // `controller: active` the last tick wrote while the lock was still held.
+  // Measured 2026-09-27 (AP12): `safe-to-hand-to-a-friend-phase-2` finished
+  // with `state: "active"` and pid 43002, and a watcher waiting for the
+  // controller to leave spun for two hours on a pid that no longer existed.
+  renderStatusIfChanged(true, null);
   renderCampaignHandoffSafely(campaign, runsDir, runDir);
   writeFindingsArtifact(runDir, contract, states);
   const failed = [...states.values()].filter((state) => state.status !== "done");

package/src/plan/freeze.mjs

@@ -21,6 +21,7 @@ import { assertObject, rejectUnknown, requirePacketHash, requireString } from ".
 import { writeJsonAtomic, writeTextAtomic } from "../run/store.mjs";
 import { VERIFICATION_LIMITS } from "../contract/verification.mjs";
 import { validatePlanPhases } from "./template.mjs";
+import { assertProofCommandsParse } from "../contract/definition-of-done.mjs";
 import { NODE_VALUE_OPTIONS, assertFilteredProofsNameTheirTest } from "./proof-scope.mjs";
 
 /** @typedef {import("../contract/index.mjs").JsonObject} JsonObject */
@@ -134,6 +135,33 @@ export function assertTimeoutsCoverMeasured(contract, facts) {
   if (problems.size) throw new TypeError(`verification timeouts do not cover their measured durations: ${[...problems].join("; ")}`);
 }
 
+/**
+ * Raise whichever of a command list's timeouts sit under
+ * `MEASURED_TIMEOUT_MARGIN` times their measured duration, recording each
+ * raise under `label`. Returns the list unchanged (by identity) when nothing
+ * needed raising, so the caller can tell whether to re-list.
+ *
+ * @param {import("../contract/index.mjs").VerificationCommand[]} commands
+ * @param {MeasuredFacts} facts
+ * @param {string} label
+ * @param {string[]} raised
+ * @returns {import("../contract/index.mjs").VerificationCommand[]}
+ */
+function raiseCommandTimeouts(commands, facts, label, raised) {
+  let changed = false;
+  const next = commands.map((command) => {
+    const measuredMs = measuredMsFor(command.argv, facts);
+    if (measuredMs === null) return command;
+    const requiredSec = Math.ceil((measuredMs * MEASURED_TIMEOUT_MARGIN) / 1_000);
+    const timeoutSec = command.timeoutSec ?? 120;
+    if (timeoutSec >= requiredSec || requiredSec > VERIFICATION_LIMITS.maxTimeoutSec) return command;
+    raised.push(`${label}: ${command.argv.join(" ")} ${timeoutSec}s -> ${requiredSec}s`);
+    changed = true;
+    return { ...command, timeoutSec: requiredSec };
+  });
+  return changed ? next : commands;
+}
+
 /**
  * Raise every plan node's verification timeout that sits under
  * `MEASURED_TIMEOUT_MARGIN` times its measured duration to exactly that
@@ -144,6 +172,11 @@ export function assertTimeoutsCoverMeasured(contract, facts) {
  * plan with no critical from review, contested only because three nodes gave
  * `node --test test/harnesses` 120s against a measured 84.4s (bound 127s).
  *
+ * The plan's own contract-level suites (RM-107) are raised here too, over the
+ * same measurement: `assertTimeoutsCoverMeasured` reads them, so a repair that
+ * skipped them would leave the check naming a repair this function does not
+ * make. Its label is the suite key, since a contract suite belongs to no node.
+ *
  * @param {import("./template.mjs").PlanOutput} plan
  * @param {MeasuredFacts} facts
  * @returns {{plan: import("./template.mjs").PlanOutput, raised: string[]}}
@@ -151,19 +184,22 @@ export function assertTimeoutsCoverMeasured(contract, facts) {
 export function raiseTimeoutsToMeasured(plan, facts) {
   /** @type {string[]} */
   const raised = [];
-  const nodes = plan.nodes.map((node) => ({
-    ...node,
-    verification: (node.verification ?? []).map((command) => {
-      const measuredMs = measuredMsFor(command.argv, facts);
-      if (measuredMs === null) return command;
-      const requiredSec = Math.ceil((measuredMs * MEASURED_TIMEOUT_MARGIN) / 1_000);
-      const timeoutSec = command.timeoutSec ?? 120;
-      if (timeoutSec >= requiredSec || requiredSec > VERIFICATION_LIMITS.maxTimeoutSec) return command;
-      raised.push(`${node.id}: ${command.argv.join(" ")} ${timeoutSec}s -> ${requiredSec}s`);
-      return { ...command, timeoutSec: requiredSec };
-    }),
-  }));
-  return { plan: raised.length ? { ...plan, nodes } : plan, raised };
+  const nodes = plan.nodes.map((node) => {
+    const verification = raiseCommandTimeouts(node.verification ?? [], facts, node.id, raised);
+    return verification === node.verification ? node : { ...node, verification };
+  });
+  const sharedVerification = raiseCommandTimeouts(plan.sharedVerification ?? [], facts, "sharedVerification", raised);
+  const finalVerification = raiseCommandTimeouts(plan.finalVerification ?? [], facts, "finalVerification", raised);
+  if (raised.length === 0) return { plan, raised };
+  return {
+    plan: {
+      ...plan,
+      nodes,
+      ...(plan.sharedVerification === undefined ? {} : { sharedVerification }),
+      ...(plan.finalVerification === undefined ? {} : { finalVerification }),
+    },
+    raised,
+  };
 }
 
 /** @returns {string} the installed package's own version, read once per call so a freeze always names the toolchain that produced it */
@@ -413,6 +449,7 @@ export function freezePlan(plan, { outDir, provenance, phases, spec, humanSteps,
   try {
     const validated = validateContract(raw, contractPath);
     assertFilteredProofsNameTheirTest(validated);
+    assertProofCommandsParse(validated.nodes);
     if (facts) assertTimeoutsCoverMeasured(validated, facts);
   } catch (error) {
     rmSync(contractPath, { force: true });