faberun 0.29.0 → 0.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/src/plan/freeze.mjs

@@ -135,6 +135,33 @@ export function assertTimeoutsCoverMeasured(contract, facts) {
   if (problems.size) throw new TypeError(`verification timeouts do not cover their measured durations: ${[...problems].join("; ")}`);
 }
 
+/**
+ * Raise whichever of a command list's timeouts sit under
+ * `MEASURED_TIMEOUT_MARGIN` times their measured duration, recording each
+ * raise under `label`. Returns the list unchanged (by identity) when nothing
+ * needed raising, so the caller can tell whether to re-list.
+ *
+ * @param {import("../contract/index.mjs").VerificationCommand[]} commands
+ * @param {MeasuredFacts} facts
+ * @param {string} label
+ * @param {string[]} raised
+ * @returns {import("../contract/index.mjs").VerificationCommand[]}
+ */
+function raiseCommandTimeouts(commands, facts, label, raised) {
+  let changed = false;
+  const next = commands.map((command) => {
+    const measuredMs = measuredMsFor(command.argv, facts);
+    if (measuredMs === null) return command;
+    const requiredSec = Math.ceil((measuredMs * MEASURED_TIMEOUT_MARGIN) / 1_000);
+    const timeoutSec = command.timeoutSec ?? 120;
+    if (timeoutSec >= requiredSec || requiredSec > VERIFICATION_LIMITS.maxTimeoutSec) return command;
+    raised.push(`${label}: ${command.argv.join(" ")} ${timeoutSec}s -> ${requiredSec}s`);
+    changed = true;
+    return { ...command, timeoutSec: requiredSec };
+  });
+  return changed ? next : commands;
+}
+
 /**
  * Raise every plan node's verification timeout that sits under
  * `MEASURED_TIMEOUT_MARGIN` times its measured duration to exactly that
@@ -145,6 +172,11 @@ export function assertTimeoutsCoverMeasured(contract, facts) {
  * plan with no critical from review, contested only because three nodes gave
  * `node --test test/harnesses` 120s against a measured 84.4s (bound 127s).
  *
+ * The plan's own contract-level suites (RM-107) are raised here too, over the
+ * same measurement: `assertTimeoutsCoverMeasured` reads them, so a repair that
+ * skipped them would leave the check naming a repair this function does not
+ * make. Its label is the suite key, since a contract suite belongs to no node.
+ *
  * @param {import("./template.mjs").PlanOutput} plan
  * @param {MeasuredFacts} facts
  * @returns {{plan: import("./template.mjs").PlanOutput, raised: string[]}}
@@ -152,19 +184,22 @@ export function assertTimeoutsCoverMeasured(contract, facts) {
 export function raiseTimeoutsToMeasured(plan, facts) {
   /** @type {string[]} */
   const raised = [];
-  const nodes = plan.nodes.map((node) => ({
-    ...node,
-    verification: (node.verification ?? []).map((command) => {
-      const measuredMs = measuredMsFor(command.argv, facts);
-      if (measuredMs === null) return command;
-      const requiredSec = Math.ceil((measuredMs * MEASURED_TIMEOUT_MARGIN) / 1_000);
-      const timeoutSec = command.timeoutSec ?? 120;
-      if (timeoutSec >= requiredSec || requiredSec > VERIFICATION_LIMITS.maxTimeoutSec) return command;
-      raised.push(`${node.id}: ${command.argv.join(" ")} ${timeoutSec}s -> ${requiredSec}s`);
-      return { ...command, timeoutSec: requiredSec };
-    }),
-  }));
-  return { plan: raised.length ? { ...plan, nodes } : plan, raised };
+  const nodes = plan.nodes.map((node) => {
+    const verification = raiseCommandTimeouts(node.verification ?? [], facts, node.id, raised);
+    return verification === node.verification ? node : { ...node, verification };
+  });
+  const sharedVerification = raiseCommandTimeouts(plan.sharedVerification ?? [], facts, "sharedVerification", raised);
+  const finalVerification = raiseCommandTimeouts(plan.finalVerification ?? [], facts, "finalVerification", raised);
+  if (raised.length === 0) return { plan, raised };
+  return {
+    plan: {
+      ...plan,
+      nodes,
+      ...(plan.sharedVerification === undefined ? {} : { sharedVerification }),
+      ...(plan.finalVerification === undefined ? {} : { finalVerification }),
+    },
+    raised,
+  };
 }
 
 /** @returns {string} the installed package's own version, read once per call so a freeze always names the toolchain that produced it */

package/src/plan/pipeline.mjs

@@ -57,7 +57,7 @@ export { droppedWriteFindings, unresolvedFindings } from "./rounds.mjs";
 /** @typedef {import("./template.mjs").PlanFindingOutput} PlanFindingOutput */
 /** @typedef {import("./template.mjs").PlanPhase} PlanPhase */
 /** @typedef {import("./sizing.mjs").PlanNode & {objective: string}} SizedPlanNode */
-/** @typedef {{sizing: import("./sizing.mjs").SizingResult, routing: import("./routing.mjs").RoutingResult, nodes: JsonObject[], phases?: PlanPhase[]}} AssembledPlan */
+/** @typedef {{sizing: import("./sizing.mjs").SizingResult, routing: import("./routing.mjs").RoutingResult, nodes: JsonObject[], phases?: PlanPhase[], suites: VerificationSuites}} AssembledPlan */
 /** @typedef {"standard"|"high"|"none"} ApproveBelow */
 /** @typedef {(contractPath: string, contract: ValidatedContract) => Promise<void>|void} LaunchFn */
 /** @typedef {(runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, cwd: string) => Promise<import("../harnesses/index.mjs").ProbeResult[]>} AskFn */
@@ -352,7 +352,7 @@ async function runPlanningStages(options) {
    * @param {PlanOutput} currentPlan
    * @returns {AssembledPlan}
    */
-  const assembleFrozenNodes = (currentPlan) => assembleFrozenPlan(currentPlan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence });
+  const assembleFrozenNodes = (currentPlan) => assembleFrozenPlan(currentPlan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence, verification });
 
   /**
    * The raw contract exactly as `freezePlan` will assemble and validate it.
@@ -362,7 +362,7 @@ async function runPlanningStages(options) {
    * @param {AssembledPlan} assembly
    * @returns {JsonObject}
    */
-  const frozenContractRaw = (assembly) => frozenContractRawOf(assembly, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, verification, judgeIndependence });
+  const frozenContractRaw = (assembly) => frozenContractRawOf(assembly, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, judgeIndependence });
 
   const roundsResult = await runReviewRounds({
     reviewRounds, plan, rejectedDraft: plan === null ? draft.output.plan : undefined, findings, cwd, plansDir, scratchDir, workingPlanPath, relativeWorkingPlanPath,
@@ -394,8 +394,10 @@ async function runPlanningStages(options) {
   // is legitimate, an unnoticed one is not. Observed 2026-09-20 on the first
   // contract this planner ever froze: it carried neither suite while the same
   // ratchets, on hand-authored contracts, were catching copied helpers
-  // mid-run — and nothing said so.
-  const freezeWarnings = verification.sharedVerification || verification.finalVerification
+  // mid-run — and nothing said so. Read off the effective suites, so a plan
+  // that authored its own ratchets (RM-107) is not warned about a contract
+  // that carries them.
+  const freezeWarnings = carriesSuites(effectiveVerificationSuites(verification, plan))
     ? []
     : ["the frozen contract carries neither sharedVerification nor finalVerification, so no repository ratchet runs on its nodes and no final check closes the phase; pass --verification <file> if the target repository has ratchets every node must run"];
   try {
@@ -604,6 +606,46 @@ function taggedStageError(planStage, error) {
   return Object.assign(wrapped, { planStage });
 }
 
+/**
+ * Which contract-level suites the frozen contract will carry: the operator's
+ * `--verification`, when it was passed, otherwise the plan's own authored
+ * suites (RM-107). The operator wins because the flag is the one place an
+ * operator can still override a plan they did not trust; the plan's suites are
+ * the fallback because a phase whose whole point is a repository-wide ratchet
+ * must not freeze unratcheted just because nobody remembered the flag —
+ * measured 2026-09-27, `safe-to-hand-to-a-friend` phase 1 integrated a red
+ * tree no node had a command to catch.
+ *
+ * An empty array is dropped rather than carried: it runs nothing, and the
+ * contract reads its absence identically. One home, read by `assembleFrozenPlan`
+ * below and by both freeze-warning sites, so the warning cannot disagree with
+ * the contract about whether a ratchet runs.
+ *
+ * @param {VerificationSuites} operator
+ * @param {PlanOutput} plan
+ * @returns {VerificationSuites}
+ */
+export function effectiveVerificationSuites(operator, plan) {
+  const suites = operator.sharedVerification || operator.finalVerification ? operator : plan;
+  return {
+    ...(suites.sharedVerification?.length ? { sharedVerification: suites.sharedVerification } : {}),
+    ...(suites.finalVerification?.length ? { finalVerification: suites.finalVerification } : {}),
+  };
+}
+
+/**
+ * Whether a suite set carries anything at all. Exported beside
+ * `effectiveVerificationSuites` because the freeze warning in two modules asks
+ * this of its result, and a truthiness test written twice is how the warning
+ * and the contract drift apart.
+ *
+ * @param {VerificationSuites} suites
+ * @returns {boolean}
+ */
+export function carriesSuites(suites) {
+  return Boolean(suites.sharedVerification || suites.finalVerification);
+}
+
 /**
  * The one assembly a plan freezes through: sizing reshapes the drafted
  * nodes, routing assigns worker and judge, and `toContractNode` renders the
@@ -613,12 +655,16 @@ function taggedStageError(planStage, error) {
  * plan came from — a fresh draft/revise or one read back off a contested
  * `plan.json`.
  *
+ * `ctx.verification` takes part here, not in `frozenContractRawOf`, because
+ * which suites the contract carries is a decision the assembly makes once for
+ * every caller; the raw contract is then only the assembly rendered.
+ *
  * @param {PlanOutput} currentPlan
- * @param {{repoFacts: import("./repo-facts.mjs").RepoFacts, packageMode: import("./sizing.mjs").PackageMode, targetedFix: boolean, phase: string, cwd: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, judgeIndependence?: "same-vendor"}} ctx
+ * @param {{repoFacts: import("./repo-facts.mjs").RepoFacts, packageMode: import("./sizing.mjs").PackageMode, targetedFix: boolean, phase: string, cwd: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, judgeIndependence?: "same-vendor", verification?: VerificationSuites}} ctx
  * @returns {AssembledPlan}
  */
 export function assembleFrozenPlan(currentPlan, ctx) {
-  const { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence } = ctx;
+  const { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence, verification } = ctx;
   let sizing;
   try {
     sizing = applySizingRules(
@@ -649,6 +695,9 @@ export function assembleFrozenPlan(currentPlan, ctx) {
     // named it must now name the node that absorbed it or freeze would see
     // an unknown assignment.
     phases: carryPhaseDeclarations(currentPlan.phases, sizing.transformations),
+    // The plan's own suites survive sizing untouched: they are contract-level
+    // proof, so no node merge can absorb or invalidate one.
+    suites: effectiveVerificationSuites(verification ?? {}, currentPlan),
   };
 }
 
@@ -661,11 +710,11 @@ export function assembleFrozenPlan(currentPlan, ctx) {
  * for the same reason.
  *
  * @param {AssembledPlan} assembly
- * @param {{campaignId: string, phase: string, campaignGoal: string, cwd: string, plansDir: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, verification: VerificationSuites, judgeIndependence?: "same-vendor"}} ctx
+ * @param {{campaignId: string, phase: string, campaignGoal: string, cwd: string, plansDir: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, judgeIndependence?: "same-vendor"}} ctx
  * @returns {JsonObject}
  */
-export function frozenContractRawOf({ sizing, nodes }, ctx) {
-  const { campaignId, phase, campaignGoal, cwd, plansDir, runtimes, runtimeDefaults, verification, judgeIndependence } = ctx;
+export function frozenContractRawOf({ sizing, nodes, suites }, ctx) {
+  const { campaignId, phase, campaignGoal, cwd, plansDir, runtimes, runtimeDefaults, judgeIndependence } = ctx;
   return {
     schemaVersion: PROTOCOL_SCHEMA_VERSION,
     contractVersion: CONTRACT_VERSION,
@@ -687,12 +736,14 @@ export function frozenContractRawOf({ sizing, nodes }, ctx) {
     // The operator's opt-in, carried verbatim: the frozen contract is
     // validated under the same judge-independence rule its routing used.
     ...(judgeIndependence === undefined ? {} : { judgeIndependence }),
-    // The operator's ratchets, carried verbatim: which suites a repository
-    // runs on every node is the operator's policy, supplied through
-    // `--verification`, never derived from repository facts. Validated at the
-    // flag boundary, so freeze neither re-derives nor edits them.
-    ...(verification.sharedVerification ? { sharedVerification: verification.sharedVerification } : {}),
-    ...(verification.finalVerification ? { finalVerification: verification.finalVerification } : {}),
+    // The ratchets this phase carries, chosen once by the assembly and carried
+    // verbatim here: the operator's `--verification` when it was passed,
+    // otherwise the suites the plan authored from the repository facts
+    // (RM-107). Validated at both boundaries — the flag loader for one, the
+    // plan validator for the other — so freeze neither re-derives nor edits
+    // them.
+    ...(suites?.sharedVerification ? { sharedVerification: suites.sharedVerification } : {}),
+    ...(suites?.finalVerification ? { finalVerification: suites.finalVerification } : {}),
     nodes,
   };
 }

package/src/plan/repo-facts.mjs

@@ -1,8 +1,9 @@
 /**
  * Repo facts: a deterministic, bounded inventory of the target repository —
  * tracked paths, declared scripts, verification candidates across the Node,
- * Python, Go, Rust, Zig and Makefile ecosystems, and which test file covers
- * which source module — collected without invoking a model. Every candidate
+ * Python, Go, Rust, Zig and Makefile ecosystems, and which source modules each
+ * test file covers, by its name and by what it imports or runs — collected
+ * without invoking a model. Every candidate
  * records the manifest it was read from; only the Node candidates are timed,
  * and no candidate for another ecosystem is ever executed to be found.
  * A planning stage's draft is authored against exactly this JSON instead of
@@ -20,6 +21,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { timeVerificationCommands } from "../host/preflight.mjs";
+import { directReferenceGraph } from "../repo/scope-closure.mjs";
 import { boundedGitSync, gitHead } from "../repo/worktree.mjs";
 import { runShellCapture } from "./proof-run.mjs";
 
@@ -45,7 +47,7 @@ import { runShellCapture } from "./proof-run.mjs";
  *
  * @typedef {{argv: string[], manifest: string, measuredMs: number|null, eligible: boolean}} DetectedVerificationCandidate
  */
-/** @typedef {{path: string, covers: string|null}} TestFileEntry */
+/** @typedef {{path: string, covers: string[]}} TestFileEntry */
 /** @typedef {{formatVersion: number, gitHead: string|null, paths: string[], truncated: boolean, scripts: Record<string, string>, verificationCandidates: VerificationCandidate[], detectedVerificationCandidates?: DetectedVerificationCandidate[], testFiles: TestFileEntry[], requirementMeasurements: RequirementMeasurement[]}} RepoFacts */
 
 const FORMAT_VERSION = 1;
@@ -95,16 +97,36 @@ function testDirectories(paths) {
 }
 
 /**
+ * What each test file covers: the module it is named after, when that module
+ * exists, plus every tracked module it imports or runs (RM-109). The naming
+ * convention alone was the whole answer, so a test that exercises a module
+ * without being named for it — a cross-module integration test, a test that
+ * spawns the CLI by URL — was invisible to planning. Measured on
+ * `safe-to-hand-to-a-friend`: four failures in 1763 reached the integration
+ * branch while every node had passed its own suite.
+ *
+ * Only tracked paths count, so a stray file in the working tree cannot become
+ * part of a plan's verification, and only `test/**\/*.test.mjs` files are
+ * entries at all: a helper is covered by the tests that import it, never a
+ * verifier itself.
+ *
  * @param {string[]} paths
  * @param {Set<string>} pathSet
+ * @param {Map<string, string[]>} references repo-relative references per file
  * @returns {TestFileEntry[]}
  */
-function testFileEntries(paths, pathSet) {
+function testFileEntries(paths, pathSet, references) {
   return paths
     .filter((path) => path.startsWith("test/") && path.endsWith(".test.mjs"))
     .map((path) => {
-      const modulePath = `src/${path.slice("test/".length, -".test.mjs".length)}.mjs`;
-      return { path, covers: pathSet.has(modulePath) ? modulePath : null };
+      /** @type {Set<string>} */
+      const covers = new Set();
+      const namedAfter = `src/${path.slice("test/".length, -".test.mjs".length)}.mjs`;
+      if (pathSet.has(namedAfter)) covers.add(namedAfter);
+      for (const referenced of references.get(path) ?? []) {
+        if (pathSet.has(referenced)) covers.add(referenced);
+      }
+      return { path, covers: [...covers].sort() };
     });
 }
 
@@ -303,7 +325,7 @@ export function collectRepoFacts(cwd, options = {}) {
     // null "no measurement" sentinel freeze.mjs reads and eligibility true.
     verificationCandidates: measured.map((candidate) => ({ ...candidate, manifest: PACKAGE_MANIFEST })),
     detectedVerificationCandidates: detected.map((candidate) => ({ ...candidate, measuredMs: null, eligible: true })),
-    testFiles: testFileEntries(allPaths, pathSet),
+    testFiles: testFileEntries(allPaths, pathSet, directReferenceGraph(cwd)),
     requirementMeasurements: measureRequirements(cwd, options.requirements ?? [], options.measure ?? {}),
   };
 }

package/src/plan/resolve.mjs

@@ -26,7 +26,7 @@ import { freezePlan } from "./freeze.mjs";
 import { collectHumanSteps } from "./human-step.mjs";
 import { highestOf, modelOf } from "./pipeline-shape.mjs";
 import { reviewerProvenanceOf } from "./reviewer.mjs";
-import { PLANNER_SESSION_ID, assembleFrozenPlan, frozenContractRawOf, invalidPlanFinding, writeFrozenPlan } from "./pipeline.mjs";
+import { PLANNER_SESSION_ID, assembleFrozenPlan, carriesSuites, effectiveVerificationSuites, frozenContractRawOf, invalidPlanFinding, writeFrozenPlan } from "./pipeline.mjs";
 import { contestPlan } from "./contest.mjs";
 import { parseSpec } from "./spec.mjs";
 import { RISK_TIERS } from "./template.mjs";
@@ -132,17 +132,19 @@ export async function resolvePlanningPipeline({ plansDir, cwd, answers }) {
   }
   logStage("resolve", { round, answered: criticalFindings.length });
 
-  const freezeWarnings = verification.sharedVerification || verification.finalVerification
+  // The plan resumed here may carry suites of its own (RM-107), so the
+  // warning is read off the same effective set the freeze below will carry.
+  const freezeWarnings = carriesSuites(effectiveVerificationSuites(verification ?? {}, plan))
     ? []
     : ["the frozen contract carries neither sharedVerification nor finalVerification, so no repository ratchet runs on its nodes and no final check closes the phase; pass --verification <file> if the target repository has ratchets every node must run"];
   let stage = "sizing";
   try {
-    const assembled = assembleFrozenPlan(plan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence });
+    const assembled = assembleFrozenPlan(plan, { repoFacts, packageMode, targetedFix, phase, cwd, runtimes, runtimeDefaults, judgeIndependence, verification });
     stage = "freeze";
     logStage("sizing", { transformations: assembled.sizing.transformations.length, nodeCount: assembled.sizing.plan.nodes.length, overheadMinutes: assembled.sizing.estimate.overheadMinutes });
     logStage("routing", { assignments: Object.keys(assembled.routing.assignments).length });
     const highestRiskTier = highestOf(assembled.sizing.plan.nodes.map((node) => node.riskTier ?? RISK_TIERS[0]));
-    const frozen = freezePlan(frozenContractRawOf(assembled, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, verification, judgeIndependence }), {
+    const frozen = freezePlan(frozenContractRawOf(assembled, { campaignId, phase, campaignGoal: campaign.goal, cwd, plansDir, runtimes, runtimeDefaults, judgeIndependence }), {
       outDir: plansDir,
       phases: assembled.phases,
       spec: { path: specPath, digest: specDigest },

package/src/plan/rounds.mjs

@@ -27,11 +27,12 @@ import { writeJsonAtomic } from "../run/store.mjs";
 import { stableJson } from "../util.mjs";
 import { assertTimeoutsCoverMeasured, raiseTimeoutsToMeasured } from "./freeze.mjs";
 import { assertFilteredProofsNameTheirTest, declareDirectoryGuards } from "./proof-scope.mjs";
-import { validateFindings, validatePlanOutput } from "./template.mjs";
+import { applyPlanPatch, validateFindings, validatePlanOutput } from "./template.mjs";
 
 /** @typedef {import("../contract/index.mjs").JsonObject} JsonObject */
 /** @typedef {import("../contract/index.mjs").ValidatedContract} ValidatedContract */
 /** @typedef {import("./template.mjs").PlanOutput} PlanOutput */
+/** @typedef {import("./template.mjs").PlanOutputNode} PlanOutputNode */
 /** @typedef {import("./template.mjs").PlanFindingOutput} PlanFindingOutput */
 /** @typedef {import("./template.mjs").PlanningKind} PlanningKind */
 /** @typedef {import("./contest.mjs").ContestedPipelineResult} ContestedPipelineResult */
@@ -288,21 +289,44 @@ export async function runReviewRounds(options) {
     // the findings redrafted the plan from scratch, renamed files and dropped
     // six writes, and its retry fixed one validator error while introducing
     // another.
-    const revise = await runStage("revise", {
-      specPath: relativeSpecPath, repoFactsPath: relativeRepoFactsPath, cataloguePath: relativeCataloguePath, findingsPath: relative(cwd, path), planPath: relativeWorkingPlanPath, packageMode,
-    });
+    //
+    // RM-110: a revise returns a patch over the nodes it changes rather than
+    // the whole plan, so answering one finding costs the size of that
+    // finding's nodes instead of the phase's. Two calls died on the full-plan
+    // shape at 65,932 and 66,821 output tokens against the 65,536 ceiling.
+    // The patch is only asked for when there is a validated plan to apply it
+    // to: a first round whose draft never validated has no node list to patch,
+    // and that round's revise returns a whole plan.
+    const base = plan;
+    const patchMode = base !== null;
+    const stageInputs = { specPath: relativeSpecPath, repoFactsPath: relativeRepoFactsPath, cataloguePath: relativeCataloguePath, packageMode, ...(patchMode ? { revisePatch: true } : {}) };
+    const revise = await runStage("revise", { ...stageInputs, findingsPath: relative(cwd, path), planPath: relativeWorkingPlanPath });
+    /**
+     * The plan a revise's output produced, before any validation: the merged
+     * patch when the reviser patched a plan, its own `output.plan` when there
+     * was no plan to patch. Null only when the merge itself was refused, so
+     * the retry falls back to the plan the first attempt read.
+     *
+     * @param {unknown} onto
+     * @param {Record<string, unknown>} output
+     * @returns {unknown}
+     */
+    const revisionFrom = (onto, output) => (patchMode ? applyPlanPatch(/** @type {{nodes: PlanOutputNode[]} & Record<string, unknown>} */ (onto), output.patch) : output.plan);
     // The whole deterministic check R14 names runs on the revise's output:
     // the shape validator, and the freeze pre-flight a review round would
     // otherwise only reach a round later. Measured 2026-09-26 on the 3a gate:
     // four rounds with no critical from review each contested on a
     // scope-closure gap the same revise had just opened, because the revise
     // learned of it only after the next review had spent its round.
+    /** @type {{nodes: PlanOutputNode[]} & Record<string, unknown>|null} */
+    let revision = null;
     /** @type {PlanOutput|null} */
     let structurallyValid = null;
     /** @type {PlanFindingOutput} */
     let firstInvalid;
     try {
-      structurallyValid = validatePlanOutput(revise.output.plan);
+      revision = /** @type {{nodes: PlanOutputNode[]} & Record<string, unknown>} */ (revisionFrom(base, revise.output));
+      structurallyValid = validatePlanOutput(revision);
       const preflightError = freezePreflightError(structurallyValid);
       if (preflightError === null) return { plan: structurallyValid, runId: revise.contract.id, firstInvalid: null };
       firstInvalid = invalidPlanFinding(`revise-r${round}-attempt1`, preflightError);
@@ -311,18 +335,18 @@ export async function runReviewRounds(options) {
     }
     const retryPath = join(scratchDir, `findings-round-${round}-retry.json`);
     writeJsonAtomic(retryPath, [...findingsForRevise, firstInvalid]);
-    // The retry repairs the output the check refused, not the plan before
-    // it: that output already carries this round's resolutions, and only the
+    // The retry repairs the revision the check refused, not the plan before
+    // it: that revision already carries this round's resolutions, and only the
     // check's message is left to answer.
     const retryPlanPath = join(scratchDir, `plan-round-${round}-rejected.json`);
-    writeJsonAtomic(retryPlanPath, revise.output.plan ?? null);
-    const retry = await runStage("revise", {
-      specPath: relativeSpecPath, repoFactsPath: relativeRepoFactsPath, cataloguePath: relativeCataloguePath, findingsPath: relative(cwd, retryPath), planPath: relative(cwd, retryPlanPath), packageMode,
-    });
+    writeJsonAtomic(retryPlanPath, revision ?? base);
+    const retry = await runStage("revise", { ...stageInputs, findingsPath: relative(cwd, retryPath), planPath: relative(cwd, retryPlanPath) });
     try {
       // A retry that validates goes to review even if the freeze pre-flight
-      // still refuses it: that round's own pre-flight raises it again.
-      return { plan: validatePlanOutput(retry.output.plan), runId: retry.contract.id, firstInvalid };
+      // still refuses it: that round's own pre-flight raises it again. Its
+      // patch applies to the revision the first attempt produced, which is
+      // the plan the retry was handed.
+      return { plan: validatePlanOutput(revisionFrom(revision ?? base, retry.output)), runId: retry.contract.id, firstInvalid };
     } catch (secondError) {
       // The first attempt still validated: it goes to review rather than
       // contesting a round over a retry that made things worse.

package/src/plan/sizing.mjs

@@ -11,6 +11,7 @@
  */
 
 import { dirname } from "node:path";
+import { VERIFICATION_LIMITS } from "../contract/verification.mjs";
 
 /** @typedef {import("../contract/definition-of-done.mjs").DefinitionOfDoneItem} DefinitionOfDoneItem */
 
@@ -18,7 +19,7 @@ import { dirname } from "node:path";
 /** @typedef {{writeFiles?: string[], writeRoots?: string[], verification: SizingVerificationCommand[], [key: string]: unknown}} SizingTaskPacket */
 /** @typedef {{id: string, dependsOn?: string[], taskKind?: string, riskTier?: string, taskPacket: SizingTaskPacket, definitionOfDone?: DefinitionOfDoneItem[], parallel?: boolean, [key: string]: unknown}} PlanNode */
 /** @typedef {{nodes: PlanNode[], justification?: string, [key: string]: unknown}} Plan */
-/** @typedef {{path: string, covers: string|null}} SizingTestFileEntry */
+/** @typedef {{path: string, covers: string[]}} SizingTestFileEntry */
 /** @typedef {{testFiles?: SizingTestFileEntry[]}} SizingFacts */
 /** @typedef {"implementation"|"exploratory"} PackageMode */
 /** @typedef {{nodeBudgetMs: number, targetedFix?: boolean, facts?: SizingFacts, minWriteFiles?: number, maxMergedWriteFiles?: number, turnCeiling?: number, packageMode?: PackageMode, readVolume?: (path: string) => number|null}} SizingOptions */
@@ -374,6 +375,13 @@ function flagOverTurnCeiling(nodes, ceiling, transformations) {
  * place instead (a repeat pass never re-flags an already-flagged command, nor
  * re-splits a command that no longer carries a measured duration).
  *
+ * A covering set larger than the contract's own command budget (RM-109) is
+ * flagged, not split: a module almost every test references has that many
+ * covering files because the change is genuinely wide, and replacing one
+ * command with more than `maxCommands` of them freezes a contract that cannot
+ * validate. The flag names the count, and the answer for that shape is the
+ * phase-terminal suite (`finalVerification`), which runs the whole tree once.
+ *
  * @param {PlanNode[]} nodes
  * @param {number} nodeBudgetMs
  * @param {SizingFacts} facts
@@ -393,8 +401,9 @@ function splitOverBudgetVerification(nodes, nodeBudgetMs, facts, transformations
         verification.push(command);
         continue;
       }
-      const candidates = dedupe(testFiles.filter((file) => file.covers !== null && writeFiles.includes(file.covers)).map((file) => file.path));
-      if (candidates.length > 0) {
+      const candidates = dedupe(testFiles.filter((file) => coversSomething(file, writeFiles)).map((file) => file.path));
+      const overflow = candidates.length > VERIFICATION_LIMITS.maxCommands;
+      if (candidates.length > 0 && !overflow) {
         transformations.push({
           rule: "over-budget-verification-split",
           nodes: [node.id],
@@ -406,7 +415,9 @@ function splitOverBudgetVerification(nodes, nodeBudgetMs, facts, transformations
         transformations.push({
           rule: "over-budget-verification-flagged",
           nodes: [node.id],
-          detail: `${command.argv.join(" ")} measured ${command.measuredMs}ms over the ${nodeBudgetMs}ms budget; no repo-facts test file covers this node's writeFiles`,
+          detail: overflow
+            ? `${command.argv.join(" ")} measured ${command.measuredMs}ms over the ${nodeBudgetMs}ms budget; ${candidates.length} test files reference this node's writeFiles, above the contract's ${VERIFICATION_LIMITS.maxCommands}-command budget: prove them once on the phase-terminal node instead of naming each here`
+            : `${command.argv.join(" ")} measured ${command.measuredMs}ms over the ${nodeBudgetMs}ms budget; no repo-facts test file covers this node's writeFiles`,
         });
         changed = true;
         verification.push({ ...command, flaggedOverBudget: true });
@@ -416,6 +427,11 @@ function splitOverBudgetVerification(nodes, nodeBudgetMs, facts, transformations
   });
 }
 
+/** @param {SizingTestFileEntry} file @param {string[]} writeFiles @returns {boolean} */
+function coversSomething(file, writeFiles) {
+  return file.covers.some((module) => writeFiles.includes(module));
+}
+
 /**
  * A node with no dependsOn, that no other node depends on, and whose
  * writeFiles shares nothing with any other node's, may run in parallel with

package/src/plan/template.mjs

@@ -16,18 +16,24 @@
  * refusal. A legacy declaration that names no requirements and no nodes is
  * still reported as a finding, never a silent pass. freeze.mjs imports the
  * same phase check for the frozen plan record.
+ *
+ * It also validates the two contract-level suites a plan may author of its own
+ * (RM-107): `sharedVerification` and `finalVerification`, the same schema the
+ * contract carries, so the phase's repository-wide proof is planned rather
+ * than left to an operator remembering `--verification`.
  */
 import { assertObject, positiveInteger, rejectUnknown, requireId, requireString, requireStringArray } from "../contract/assert.mjs";
 import { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION } from "../contract/index.mjs";
 import { validateDefinitionOfDone } from "../contract/definition-of-done.mjs";
+import { validateFinalVerification, validateSharedVerification } from "../contract/final-verification.mjs";
 import { validateVerificationCommands } from "../contract/verification.mjs";
 
 /** @typedef {import("../contract/index.mjs").JsonObject} JsonObject */
 /** @typedef {"draft"|"review"|"revise"|"spec-author"|"spec-review"} PlanningKind */
 /** @typedef {"low"|"standard"|"high"} RiskTier */
-/** @typedef {{campaignId: string, phase: string, n: number, goal?: string, cwd?: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, reviewerId?: string, specPath?: string, repoFactsPath?: string, cataloguePath?: string, packageMode?: import("./sizing.mjs").PackageMode, planPath?: string, findingsPath?: string, notesPath?: string}} PlanningContractInputs */
+/** @typedef {{campaignId: string, phase: string, n: number, goal?: string, cwd?: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, reviewerId?: string, specPath?: string, repoFactsPath?: string, cataloguePath?: string, packageMode?: import("./sizing.mjs").PackageMode, planPath?: string, findingsPath?: string, notesPath?: string, revisePatch?: boolean}} PlanningContractInputs */
 /** @typedef {{id: string, objective: string, taskKind: string, riskTier: RiskTier, dependsOn: string[], readFiles: string[], writeFiles: string[], scopeAcknowledged: string[], definitionOfDone: import("../contract/definition-of-done.mjs").DefinitionOfDoneItem[], verification: import("../contract/verification.mjs").VerificationCommand[], expectedTurns?: number}} PlanOutputNode */
-/** @typedef {{nodes: PlanOutputNode[], phases?: PlanPhase[], findings?: PlanFindingOutput[], justification?: string}} PlanOutput */
+/** @typedef {{nodes: PlanOutputNode[], phases?: PlanPhase[], sharedVerification?: import("../contract/verification.mjs").VerificationCommand[], finalVerification?: import("../contract/verification.mjs").VerificationCommand[], findings?: PlanFindingOutput[], justification?: string}} PlanOutput */
 /** @typedef {{id: string, requirementIds: string[], nodeIds?: string[], deliverable: string}} PlanPhase */
 /** @typedef {{id: string, severity: "critical"|"major"|"minor", nodeId: string, text: string}} PlanFindingOutput */
 
@@ -115,7 +121,18 @@ const REQUIRED_INPUTS = Object.freeze({
 // run had already succeeded. The id charset is requireId's
 // (contract/assert.mjs) verbatim, because an id that is present but invalid
 // fails that same validator just as late.
-const PLAN_OUTPUT_SHAPE = '{nodes: [{id, objective, taskKind, riskTier, dependsOn, readFiles, writeFiles, scopeAcknowledged, definitionOfDone: [{id, text, proof?: {kind: "command"|"path"|"verification", ref}, judgment?: true, reason?: string}], verification: [{argv: [string], cwd?, timeoutSec?, repeat?, env?, mutation?: {threshold}}], expectedTurns?}], phases?: [{id, requirementIds: [string], nodeIds: [string], deliverable}], justification?}; every id in it (node, phase, node assignment, and definitionOfDone item) must match [A-Za-z0-9._-]+ and never be exactly "." or ".."';
+const PLAN_NODE_SHAPE = '{id, objective, taskKind, riskTier, dependsOn, readFiles, writeFiles, scopeAcknowledged, definitionOfDone: [{id, text, proof?: {kind: "command"|"path"|"verification", ref}, judgment?: true, reason?: string}], verification: [{argv: [string], cwd?, timeoutSec?, repeat?, env?, mutation?: {threshold}}], expectedTurns?}';
+const PLAN_PHASE_SHAPE = '[{id, requirementIds: [string], nodeIds: [string], deliverable}]';
+const PLAN_SUITE_SHAPE = '[{argv: [string], cwd?, timeoutSec?, repeat?, env?, mutation?: {threshold}}]';
+const ID_CHARSET_RULE = 'every id in it (node, phase, node assignment, and definitionOfDone item) must match [A-Za-z0-9._-]+ and never be exactly "." or ".."';
+const PLAN_OUTPUT_SHAPE = `{nodes: [${PLAN_NODE_SHAPE}], phases?: ${PLAN_PHASE_SHAPE}, sharedVerification?: ${PLAN_SUITE_SHAPE}, finalVerification?: ${PLAN_SUITE_SHAPE}, justification?}; ${ID_CHARSET_RULE}`;
+/**
+ * What a revise writes instead of the plan again (RM-110). Every node this
+ * names is a complete node, because the plan it patches is in the reviser's
+ * readFiles and the patch says only what changes: the node shape is
+ * `PLAN_NODE_SHAPE`, one home for both strings so they cannot drift.
+ */
+const REVISE_PATCH_SHAPE = `{nodes?: [${PLAN_NODE_SHAPE}], removedNodeIds?: [string], phases?: ${PLAN_PHASE_SHAPE}, sharedVerification?: ${PLAN_SUITE_SHAPE}, finalVerification?: ${PLAN_SUITE_SHAPE}, justification?}; ${ID_CHARSET_RULE}`;
 /**
  * The size guidance every draft and revise carries. measured 2026-09-20 over
  * stored runs: median 49 provider requests per worker turn; cost per turn
@@ -135,6 +152,17 @@ const SIZING_INSTRUCTION = "Size nodes to 4 to 6 write files where the work allo
 const EXPLORATORY_SIZING_INSTRUCTION = "Size nodes by what each must read and by risk, never by what it writes: one write file is the normal shape for a finding, a review or an audit. Give every node an expectedTurns (the provider requests one worker needs end to end), keep the read volume of the nodes within the same order of each other so one does not cost several times its siblings, and split a node you expect past 150 requests, because a run cuts an attempt there.";
 const FINDINGS_SHAPE = "[{id, severity, nodeId, text}]";
 
+/**
+ * The two shapes a revise can be asked for, swapped by `instructionsFor`.
+ * Which one is in force is decided by `inputs.revisePatch`, never by the
+ * worker: the plan in readFiles is a validated plan to patch only when the
+ * pipeline has one, and a draft that never validated is the case where it does
+ * not (`rounds.mjs` starts a round with `plan: null` and the draft's own
+ * rejected output).
+ */
+const REVISE_PLAN_INSTRUCTION = `Return exactly one worker-result JSON object. Put the revised plan in output.plan as ${PLAN_OUTPUT_SHAPE} and nothing else in output.`;
+const REVISE_PATCH_INSTRUCTION = `Return exactly one worker-result JSON object. Put the revision in output.patch as ${REVISE_PATCH_SHAPE} and nothing else in output. The patch applies to the plan JSON in readFiles: a node whose id that plan already has replaces it, a new id adds a node, removedNodeIds names each node the plan must no longer have, and a field you omit keeps the value the plan already has. Carry only the nodes and fields a finding requires — a revise that omits what a finding names has not answered it.`;
+
 /**
  * The instruction list is a frozen table because it is the same for every
  * campaign; only the sizing sentence depends on what kind of package this is.
@@ -144,8 +172,11 @@ const FINDINGS_SHAPE = "[{id, severity, nodeId, text}]";
  * @returns {string[]}
  */
 function instructionsFor(kind, inputs) {
-  if (inputs.packageMode !== "exploratory") return INSTRUCTIONS[kind];
-  return INSTRUCTIONS[kind].map((line) => (line === SIZING_INSTRUCTION ? EXPLORATORY_SIZING_INSTRUCTION : line));
+  const lines = kind !== "revise" || inputs.revisePatch !== true
+    ? INSTRUCTIONS[kind]
+    : INSTRUCTIONS[kind].map((line) => (line === REVISE_PLAN_INSTRUCTION ? REVISE_PATCH_INSTRUCTION : line));
+  if (inputs.packageMode !== "exploratory") return lines;
+  return lines.map((line) => (line === SIZING_INSTRUCTION ? EXPLORATORY_SIZING_INSTRUCTION : line));
 }
 
 // AP1 of safe-to-hand-to-a-friend, measured 2026-09-26: a draft copied the
@@ -164,6 +195,29 @@ const PROOF_NOT_STRICTER_THAN_REQUIREMENT_RULE = "For every node, compare each c
 
 const NAMED_TEST_FILE_RULE = 'A command that filters node:test by name (--test-name-pattern) names the test file it selects from, as in node --test --test-name-pattern="<exact test title>" test/<area>/<file>.test.mjs: with no path node --test runs every test file in the tree and the freeze refuses it. A requirement proof the spec writes without a file gains the file of the test that carries that title.';
 
+// RM-109, measured 2026-09-27 on `safe-to-hand-to-a-friend`: the naming
+// convention alone decided a node's test file, so a node whose module was
+// exercised by a test named after something else passed its own suite and
+// still left four failures for the integration branch (1763 tests, 4 failures,
+// phases 3/4/5/3r8). repo-facts.json's testFiles carries what each test file
+// references, so the planner names the files that can actually break.
+const COVERING_TEST_RULE = 'repo-facts.json\'s testFiles lists, per test file, the repo-relative modules it is named after and the ones it imports or runs. A node\'s verification names every test file whose covers intersects its writeFiles, not only the one named after the module: node --test <file>, one per covering file, and the enclosing test directory when that set is larger than one verification array holds. A test file that references nothing the node writes is not named there; those are the phase\'s finalVerification, which runs the whole suite once when the phase closes.';
+
+// RM-107, measured 2026-09-27 on `safe-to-hand-to-a-friend` phase 1: the phase
+// integrated a red tree -- src/host/preflight.mjs at 840 lines against the 800
+// ceiling, declaredEnvironment exported by seven modules, three test files
+// whose first import was not scoped-home.mjs, one zcode assertion falsified --
+// and no node had run test/repo/source-shape.test.mjs (0.36 s measured).
+// Contract-level verification was operator-only, so a phase whose whole point
+// was a repository-wide ratchet could freeze without one and look fully
+// verified. The planner reads the measured candidates, so it is the one that
+// proposes them here.
+const CONTRACT_VERIFICATION_RULE = Object.freeze([
+  "A plan may carry two suites of its own, over and above the per-node verification: output.plan.sharedVerification, whose commands run on every node of the phase, and output.plan.finalVerification, whose commands run once, when the phase closes. Both take exactly a node's verification-command shape. Use them for the proof no single node owns: a repository-wide conformance or structural suite, in sharedVerification, because any node can break one, and the target's whole suite, in finalVerification, because only the last node can run it.",
+  "Every command in either suite must be an argv repo-facts.json measured (verificationCandidates includes each measured argv with its measuredMs), copied verbatim, with a timeoutSec of at least twice that measuredMs. A command the facts did not measure is written from memory, not measurement, and is the shape this rule exists to stop. Omit a suite the facts measured nothing for; a plan for a repository with no ratchets carries neither.",
+  "A command that already runs in a suite is not repeated in a node's verification, and a node's own verification is never replaced by a suite.",
+]);
+
 // The rule every planned packet is held to at freeze time, worded from
 // AGENTS.md's Faberun protocol and src/repo/scope-closure.mjs ("reading it
 // cannot fix it"): a first draft that ignores it produces a plan that fails
@@ -190,17 +244,21 @@ const INSTRUCTIONS = Object.freeze({
     "Declare every phase the plan serves in output.plan.phases: the requirement ids (R<n> from the spec) the phase satisfies, the planned node ids it assigns, and the deliverable it produces in one sentence. Every planned node must appear in exactly one phase's nodeIds; a missing, duplicate, or unknown node assignment is refused.",
     ...SCOPE_CLOSURE_RULE,
     NAMED_TEST_FILE_RULE,
+    COVERING_TEST_RULE,
+    ...CONTRACT_VERIFICATION_RULE,
     `Return exactly one worker-result JSON object. Put the plan in output.plan as ${PLAN_OUTPUT_SHAPE} and nothing else in output.`,
     "Never name a runtime, harness, model, or vendor anywhere in output.plan. taskKind and riskTier are the only classification a draft makes; a routing table assigns a runtime afterward, from those two fields alone.",
     SIZING_INSTRUCTION,
   ],
   revise: [
-    "Start from the plan JSON in readFiles, the plan the findings were raised against, and return it with only the changes the findings require. Keep every node id, write file and definitionOfDone item that no finding asks you to change: a revise that redrafts from the findings alone loses what the plan already got right.",
+    "Start from the plan JSON in readFiles, the plan the findings were raised against, and return it with only the changes the findings require. Keep every node id, write file, definitionOfDone item and contract-level suite that no finding asks you to change: a revise that redrafts from the findings alone loses what the plan already got right.",
     "Read the findings and resolve every one; do not leave a critical or major finding unaddressed.",
     "Declare every phase the plan serves in output.plan.phases: the requirement ids (R<n> from the spec) the phase satisfies, the planned node ids it assigns, and the deliverable it produces in one sentence. Every planned node must appear in exactly one phase's nodeIds; a missing, duplicate, or unknown node assignment is refused.",
     ...SCOPE_CLOSURE_RULE,
     NAMED_TEST_FILE_RULE,
-    `Return exactly one worker-result JSON object. Put the revised plan in output.plan as ${PLAN_OUTPUT_SHAPE} and nothing else in output.`,
+    COVERING_TEST_RULE,
+    ...CONTRACT_VERIFICATION_RULE,
+    REVISE_PLAN_INSTRUCTION,
     "Never name a runtime, harness, model, or vendor anywhere in output.plan.",
     SIZING_INSTRUCTION,
   ],
@@ -327,45 +385,42 @@ export function buildPlanningContract(kind, inputs) {
   };
 }
 
-const PLAN_FIELDS = new Set(["nodes", "phases", "justification"]);
+const PLAN_FIELDS = new Set(["nodes", "phases", "sharedVerification", "finalVerification", "justification"]);
+/** A patch's fields: the plan's own, minus `nodes`, plus the ids it removes. */
+const PATCH_FIELDS = new Set(["nodes", "removedNodeIds", "phases", "sharedVerification", "finalVerification", "justification"]);
 const PLAN_NODE_FIELDS = new Set(["id", "objective", "taskKind", "riskTier", "dependsOn", "readFiles", "writeFiles", "scopeAcknowledged", "definitionOfDone", "verification", "expectedTurns"]);
 
 /**
- * Validate a draft or revise worker's `output.plan`. Rejects a node naming a
- * runtime, harness, model, or vendor (an unknown field, since a plan node's
- * shape never includes one) and a node missing taskKind or riskTier. A
- * declared phase associated with no requirement is reported as a finding on
- * the result, never a silent pass and never a refusal.
+ * The node list of a plan, or of a revise's `output.patch`, under one
+ * validator: a node's shape is the same in both, so a patch node is refused
+ * for exactly what a plan node is. `label` is the caller's own field path, so
+ * the message a worker reads names the field it actually wrote.
  *
- * @param {unknown} plan
- * @returns {PlanOutput}
+ * @param {unknown} value
+ * @param {string} label
+ * @returns {PlanOutputNode[]}
  */
-export function validatePlanOutput(plan) {
-  assertObject(plan, "plan");
-  const record = /** @type {Record<string, unknown>} */ (plan);
-  rejectUnknown(record, PLAN_FIELDS, "plan");
-  if (!Array.isArray(record.nodes) || record.nodes.length === 0) {
-    throw new TypeError("plan.nodes must be a non-empty array");
-  }
-  const nodes = record.nodes.map((node, index) => {
-    const label = `plan.nodes[${index}]`;
-    assertObject(node, label);
+function validatePlanNodes(value, label) {
+  if (!Array.isArray(value)) throw new TypeError(`${label} must be an array`);
+  return value.map((node, index) => {
+    const nodeLabel = `${label}[${index}]`;
+    assertObject(node, nodeLabel);
     const nodeRecord = /** @type {Record<string, unknown>} */ (node);
-    rejectUnknown(nodeRecord, PLAN_NODE_FIELDS, label);
-    requireId(nodeRecord.id, `${label}.id`);
-    requireString(nodeRecord.objective, `${label}.objective`);
+    rejectUnknown(nodeRecord, PLAN_NODE_FIELDS, nodeLabel);
+    requireId(nodeRecord.id, `${nodeLabel}.id`);
+    requireString(nodeRecord.objective, `${nodeLabel}.objective`);
     if (typeof nodeRecord.taskKind !== "string" || !TASK_KINDS.includes(nodeRecord.taskKind)) {
-      throw new TypeError(`${label}.taskKind must be one of ${TASK_KINDS.join(", ")}`);
+      throw new TypeError(`${nodeLabel}.taskKind must be one of ${TASK_KINDS.join(", ")}`);
     }
     if (typeof nodeRecord.riskTier !== "string" || !RISK_TIERS.includes(nodeRecord.riskTier)) {
-      throw new TypeError(`${label}.riskTier must be one of ${RISK_TIERS.join(", ")}`);
+      throw new TypeError(`${nodeLabel}.riskTier must be one of ${RISK_TIERS.join(", ")}`);
     }
     const dependsOn = nodeRecord.dependsOn ?? [];
-    requireStringArray(dependsOn, `${label}.dependsOn`);
+    requireStringArray(dependsOn, `${nodeLabel}.dependsOn`);
     const readFiles = nodeRecord.readFiles ?? [];
-    requireStringArray(readFiles, `${label}.readFiles`);
+    requireStringArray(readFiles, `${nodeLabel}.readFiles`);
     const writeFiles = nodeRecord.writeFiles ?? [];
-    requireStringArray(writeFiles, `${label}.writeFiles`);
+    requireStringArray(writeFiles, `${nodeLabel}.writeFiles`);
     // A node that reaches an importer it must not change says so here. Without
     // this field the drafter is told (INSTRUCTIONS, draft/revise) to answer a
     // scope-closure finding with `writeFiles or scopeAcknowledged` and has no
@@ -373,17 +428,17 @@ export function validatePlanOutput(plan) {
     // declaring a read-only importer writable. Measured 2026-09-20 -- a revise
     // round could not resolve the finding the preflight had just raised.
     const scopeAcknowledged = nodeRecord.scopeAcknowledged ?? [];
-    requireStringArray(scopeAcknowledged, `${label}.scopeAcknowledged`);
+    requireStringArray(scopeAcknowledged, `${nodeLabel}.scopeAcknowledged`);
     // Verification is validated first so a DoD proof that names a verification
     // command by its exact text (R21) can be checked and normalized to that
     // command's index against this node's own commands, in hand here.
-    const verification = validateVerificationCommands(nodeRecord.verification ?? [], `${label}.verification`);
+    const verification = validateVerificationCommands(nodeRecord.verification ?? [], `${nodeLabel}.verification`);
     const definitionOfDone = validateDefinitionOfDone(
       nodeRecord.definitionOfDone ?? [],
-      `${label}.definitionOfDone`,
+      `${nodeLabel}.definitionOfDone`,
       { commands: verification, nodeId: /** @type {string} */ (nodeRecord.id) },
     );
-    const expectedTurns = nodeRecord.expectedTurns === undefined ? undefined : positiveInteger(nodeRecord.expectedTurns, `${label}.expectedTurns`);
+    const expectedTurns = nodeRecord.expectedTurns === undefined ? undefined : positiveInteger(nodeRecord.expectedTurns, `${nodeLabel}.expectedTurns`);
     return /** @type {PlanOutputNode} */ ({
       id: /** @type {string} */ (nodeRecord.id),
       objective: /** @type {string} */ (nodeRecord.objective),
@@ -398,7 +453,33 @@ export function validatePlanOutput(plan) {
       ...(expectedTurns === undefined ? {} : { expectedTurns }),
     });
   });
+}
+
+/**
+ * Validate a draft's `output.plan`. Rejects a node naming a
+ * runtime, harness, model, or vendor (an unknown field, since a plan node's
+ * shape never includes one) and a node missing taskKind or riskTier. A
+ * declared phase associated with no requirement is reported as a finding on
+ * the result, never a silent pass and never a refusal.
+ *
+ * @param {unknown} plan
+ * @returns {PlanOutput}
+ */
+export function validatePlanOutput(plan) {
+  assertObject(plan, "plan");
+  const record = /** @type {Record<string, unknown>} */ (plan);
+  rejectUnknown(record, PLAN_FIELDS, "plan");
+  if (!Array.isArray(record.nodes) || record.nodes.length === 0) {
+    throw new TypeError("plan.nodes must be a non-empty array");
+  }
+  const nodes = validatePlanNodes(record.nodes, "plan.nodes");
   if (record.justification !== undefined) requireString(record.justification, "plan.justification");
+  // The two contract-level suites, under the validators the contract itself
+  // applies, so a plan cannot author a suite the freeze would then refuse. An
+  // empty array stays legal here and means what absence means; the assembly
+  // (`effectiveVerificationSuites`) is what drops it before the contract.
+  const sharedVerification = validateSharedVerification(record.sharedVerification, "plan.sharedVerification");
+  const finalVerification = validateFinalVerification(record.finalVerification, "plan.finalVerification");
   const phases = validatePlanPhases(record.phases, nodes.map((node) => node.id));
   const findings = (phases ?? [])
     .filter((phase) => phase.requirementIds.length === 0)
@@ -414,11 +495,66 @@ export function validatePlanOutput(plan) {
   return {
     nodes,
     ...(phases === undefined ? {} : { phases }),
+    ...(sharedVerification === undefined ? {} : { sharedVerification }),
+    ...(finalVerification === undefined ? {} : { finalVerification }),
     ...(findings.length > 0 ? { findings } : {}),
     ...(record.justification === undefined ? {} : { justification: /** @type {string} */ (record.justification) }),
   };
 }
 
+/**
+ * The plan a revise's `output.patch` produces, from the plan the reviser read
+ * (RM-110). Measured 2026-09-27 on `safe-to-hand-to-a-friend`: two revise
+ * calls died as `prompt_failed` at 65,932 and 66,821 output tokens against the
+ * 65,536 ceiling — a revise that must reproduce every node it is not changing
+ * pays the whole plan's size for a change to one of them, after the draft and
+ * a review round have already been paid for.
+ *
+ * The merge is deterministic and total: a patch node whose id the plan has
+ * replaces it in place (so the plan's node order, which its phases and its
+ * working file both read, survives a revise that changes nothing), a new id
+ * appends, `removedNodeIds` deletes by name, and a plan-level field the patch
+ * omits keeps the plan's own value. Every node in the result is one the
+ * validator has seen once already, so the caller's `validatePlanOutput` on the
+ * returned record is the same check a draft's output gets, not a weaker one.
+ *
+ * Three shapes are refused here rather than merged: a node id named twice in
+ * the patch, an id removed that the plan does not have (a typo the reviser
+ * would otherwise never hear about), and an id in both lists.
+ *
+ * @param {{nodes: PlanOutputNode[]} & Record<string, unknown>} previous the plan the reviser was handed
+ * @param {unknown} patch a revise worker's `output.patch`
+ * @returns {{nodes: PlanOutputNode[]} & Record<string, unknown>} the merged plan record, for `validatePlanOutput`
+ */
+export function applyPlanPatch(previous, patch) {
+  assertObject(patch, "patch");
+  const record = /** @type {Record<string, unknown>} */ (patch);
+  rejectUnknown(record, PATCH_FIELDS, "patch");
+  const nodes = record.nodes === undefined ? [] : validatePlanNodes(record.nodes, "patch.nodes");
+  const removedNodeIds = /** @type {string[]} */ (record.removedNodeIds ?? []);
+  requireStringArray(removedNodeIds, "patch.removedNodeIds");
+  const previousIds = new Set(previous.nodes.map((node) => node.id));
+  const replacements = new Map(nodes.map((node) => [node.id, node]));
+  if (replacements.size !== nodes.length) throw new TypeError("patch.nodes names the same node id twice");
+  for (const id of removedNodeIds) {
+    if (!previousIds.has(id)) throw new TypeError(`patch.removedNodeIds names ${id}, which the plan it revises does not have`);
+    if (replacements.has(id)) throw new TypeError(`patch names ${id} in both nodes and removedNodeIds: a node is replaced or removed, never both`);
+  }
+  const removed = new Set(removedNodeIds);
+  /** @type {{nodes: PlanOutputNode[]} & Record<string, unknown>} */
+  const merged = {
+    nodes: [
+      ...previous.nodes.filter((node) => !removed.has(node.id)).map((node) => replacements.get(node.id) ?? node),
+      ...nodes.filter((node) => !previousIds.has(node.id)),
+    ],
+  };
+  for (const field of ["phases", "sharedVerification", "finalVerification", "justification"]) {
+    const value = record[field] ?? previous[field];
+    if (value !== undefined) merged[field] = value;
+  }
+  return merged;
+}
+
 // The fields a phase declaration carries beyond its id: requirementIds|nodeIds|deliverable —
 // which spec requirements the phase satisfies, which planned nodes it assigns, and the one
 // sentence naming its result.

package/src/repo/scope-closure.mjs

@@ -103,6 +103,28 @@ export function runtimeImportGraph(root) {
   return graph;
 }
 
+/**
+ * The repo-relative paths each of the repository's own modules points at: the
+ * relative modules it imports and the ones it runs through
+ * `new URL(…, import.meta.url)`. Wider than `runtimeImportGraph`'s edges on
+ * purpose — that one answers "does this import cycle at load time", where a
+ * JSDoc reference and a spawned program are both absent; this one answers
+ * "which files does this file exercise", where a test that spawns a program
+ * counts exactly like one that imports it. RM-109: `plan/repo-facts.mjs` reads
+ * it to name the test files a planned write set touches.
+ *
+ * @param {string} root absolute directory to walk
+ * @returns {Map<string, string[]>} repo-relative path to its references, sorted
+ */
+export function directReferenceGraph(root) {
+  /** @type {Map<string, string[]>} */
+  const graph = new Map();
+  for (const [path, source] of repositorySources(root)) {
+    graph.set(path, [...referencePaths(source, root)].sort());
+  }
+  return graph;
+}
+
 /**
  * Files a node's declared writes drag into the same change, minus those the
  * packet already declares or dismisses.