faberun 0.3.0 → 0.7.0

package/src/contract/task-packet.mjs

@@ -19,11 +19,18 @@ const FIELDS = new Set([
   "verification",
 ]);
 const PROMPT_MAX_BYTES = 64 * 1024;
+/**
+ * The `## Verification` preamble every worker prompt carries. The controller's
+ * recorded run is the proof; a self-run is optional and must be a quick,
+ * process-free command, so a sandbox that cannot signal processes never hangs
+ * on the node's own verification.
+ */
+const VERIFICATION_PARAGRAPH = "The controller runs every command below after you report; its recorded results are the proof of this node. Running a command yourself is optional and only for one that finishes in seconds and spawns no long-lived process. Keep output bounded (pipe through `| tail -n 200`). Never wait on a background job, never run the whole test suite, and never run tests that start and terminate other processes.";
 
 /**
- * `validateRelativePath`'s answer when a read path is absent and the caller
- * asked to defer the missing-read verdict rather than throw it. Only contract
- * loading opts in; every other caller throws the missing-read error in place.
+ * `validateRelativePath`'s answer when a path is absent and the caller asked to
+ * defer the missing-path verdict rather than throw it. Only contract loading
+ * opts in; every other caller throws the missing-path error in place.
  */
 const DEFERRED_MISSING = Symbol("deferred-missing");
 
@@ -47,7 +54,7 @@ const DEFERRED_MISSING = Symbol("deferred-missing");
  * @param {string} contractDir
  * @param {string} cwd
  * @param {number} index
- * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string}[], persisted?: boolean}} [options]
+ * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string, kind: "read"|"acknowledged"}[], persisted?: boolean}} [options]
  * @returns {TaskPacket}
  */
 export function loadTaskPacket(node, contractDir, cwd, index, options = {}) {
@@ -117,7 +124,7 @@ export function renderWorkerPrompt(packet, nodeId) {
     ...bulletOrNone(packet.nonGoals),
     "",
     "## Verification",
-    "Run each command yourself before reporting done. Keep command output bounded: pipe long output through `| tail -n 200` (or similar) and never paste full test or fuzz logs into your context or results.",
+    VERIFICATION_PARAGRAPH,
     ...packet.verification.map((command) => `- ${command.argv.join(" ")}`),
     "",
     "## Required output",
@@ -134,7 +141,7 @@ export function renderWorkerPrompt(packet, nodeId) {
  * @param {unknown} packet
  * @param {number} index
  * @param {string} cwd
- * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string}[], persisted?: boolean}} [options]
+ * @param {{deferMissingReads?: boolean, deferredReads?: {path: string, label: string, kind: "read"|"acknowledged"}[], persisted?: boolean}} [options]
  * @returns {TaskPacket}
  */
 export function validateTaskPacket(packet, index, cwd, options = {}) {
@@ -207,18 +214,20 @@ export function validateTaskPacket(packet, index, cwd, options = {}) {
 
   if (!persisted) {
     const deferMissingReads = options.deferMissingReads === true;
-    /** @type {{path: string, label: string}[]} */
+    /** @type {{path: string, label: string, kind: "read"|"acknowledged"}[]} */
     const deferredReads = options.deferredReads ?? [];
     normalizedReadFiles.forEach((path, pathIndex) => {
       const label = `nodes[${index}].taskPacket.readFiles[${pathIndex}]`;
       const result = validateRelativePath(path, label, cwd, true, { deferMissing: deferMissingReads });
-      if (result === DEFERRED_MISSING) deferredReads.push({ path, label });
+      if (result === DEFERRED_MISSING) deferredReads.push({ path, label, kind: "read" });
     });
     if (writeFiles !== undefined) /** @type {string[]} */ (writeFiles).forEach((path, pathIndex) => {
       validateRelativePath(path, `nodes[${index}].taskPacket.writeFiles[${pathIndex}]`, cwd, false);
     });
     /** @type {string[]} */ (scopeAcknowledged).forEach((path, pathIndex) => {
-      validateRelativePath(path, `nodes[${index}].taskPacket.scopeAcknowledged[${pathIndex}]`, cwd, true);
+      const label = `nodes[${index}].taskPacket.scopeAcknowledged[${pathIndex}]`;
+      const result = validateRelativePath(path, label, cwd, true, { deferMissing: deferMissingReads });
+      if (result === DEFERRED_MISSING) deferredReads.push({ path, label, kind: "acknowledged" });
     });
     for (const [commandIndex, command] of verification.entries()) {
       if (command.cwd !== undefined) {
@@ -426,6 +435,7 @@ function renderDiscoveryPrompt(packet, nodeId) {
     'Return exactly one worker-result JSON object, with no markdown or prose. Set status to "done", missingContext to [], and artifacts to an array containing exactly one JSON-stringified execution task packet with every required taskPacket field. The packet readFiles and writeFiles must be non-empty and scoped to this repository.',
     "",
     "## Verification",
+    VERIFICATION_PARAGRAPH,
     ...packet.verification.map((command) => `- ${command.argv.join(" ")}`),
   ];
   const prompt = `${lines.join("\n")}\n`;
@@ -467,6 +477,7 @@ function renderAutonomousPrompt(packet, nodeId) {
     ...bulletOrNone(packet.nonGoals),
     "",
     "## Verification",
+    VERIFICATION_PARAGRAPH,
     ...packet.verification.map((command) => `- ${command.argv.join(" ")}`),
     "",
     "## Required output",

package/src/contract/verification.mjs

@@ -38,7 +38,7 @@ export const VERIFICATION_LIMITS = Object.freeze({
 /**
  * Bounded evidence captured for one attempt.
  *
- * @typedef {{passed: boolean, stdout: string, stderr: string, error: string|null, exitCode: number|null, signal: string|null, timedOut: boolean, durationMs: number|null}} VerificationAttemptResult
+ * @typedef {{passed: boolean, stdout: string, stderr: string, error: string|null, exitCode: number|null, signal: string|null, timedOut: boolean, durationMs: number|null, signalDeath?: boolean}} VerificationAttemptResult
  */
 
 /**

package/src/engine/backoff.mjs

@@ -9,7 +9,7 @@
  * third time buys nothing: change provider, or stop and say so.
  *
  * Everything here is a pure decision. Persisting it — the routing history,
- * the override, the node transition — stays in runner.mjs, so this module can
+ * the override, the node transition — stays in cli.mjs, so this module can
  * be tested without a run directory, a lease, or a provider.
  */
 import { nextHop, nextSynthesizedRuntime, synthesizedChain } from "./failover.mjs";

package/src/engine/dispatch.mjs

@@ -9,7 +9,7 @@
  * which made dispatch depend on review policy and on settlement, and that is
  * the shape that kept `engine/` a web instead of a stack.
  */
-import { JUDGE_SCHEMA, judgePrompt } from "./prompts.mjs";
+import { JUDGE_SCHEMA, appendSandboxNotice, judgePrompt } from "./prompts.mjs";
 import { LockLostError } from "../run/lock.mjs";
 import { TOOL_OUTPUT_LIMIT_BYTES } from "../harnesses/exec-jsonl/index.mjs";
 import { appendPreviousAttempt } from "./retry.mjs";
@@ -32,7 +32,7 @@ import { emptyScope, persistedScopeBoundary, workerScope } from "./scope.mjs";
 import { hasOperationIntent, hasOperationSettlement, operationNeedsRecovery, operationNextState, persistInvocationIntent, providerReceipts, settleInvocation } from "../run/operations.mjs";
 import { invocationCost, invocationUsage } from "../run/usage.mjs";
 import { logPaths, readBoundedTail, startProcess } from "./process.mjs";
-import { mkdirSync } from "node:fs";
+import { mkdirSync, statSync } from "node:fs";
 import { READ_LINE_LIMIT, normalizeProviderResult, providerCommand } from "../harnesses/index.mjs";
 import { readJson, writeJsonAtomic } from "../run/store.mjs";
 import { judgeReaskInstruction, reviewMode } from "../contract/review-modes.mjs";
@@ -267,6 +267,30 @@ function phaseHandoffPrompt(contract, node, state, runDir, role) {
   ].join("\n\n");
   return boundedUtf8(handoff, 60 * 1024);
 }
+/**
+ * The declared weight of a node's readFiles at dispatch time: the sum of the
+ * byte sizes of the files that exist in the attempt workspace. This is the
+ * one quantity the controller can measure about a packet's reference load --
+ * the worker prompt lists readFiles and the worker reads them itself, so what
+ * it actually reads is the harness's business. A missing file counts 0 rather
+ * than throwing: a declared path can be produced by a dependency that has not
+ * run yet or removed by the tree since the packet was authored.
+ *
+ * @param {string[]} readFiles
+ * @param {string} workspace
+ * @returns {number}
+ */
+export function declaredReadBytes(readFiles, workspace) {
+  let total = 0;
+  for (const path of readFiles) {
+    try {
+      total += statSync(join(workspace, path)).size;
+    } catch {
+      // Missing or unreadable file: contributes no weight.
+    }
+  }
+  return total;
+}
 /**
  * The mechanical worker tool policy for the provider boundary: hook settings
  * on Claude-compatible commands. Only an adapter whose surface can prove
@@ -404,6 +428,8 @@ export function startWorker(contract, node, state, runDir, running, prompt, lock
   // so it is appended to the resolved prompt rather than the candidate handed
   // to phaseInvocationPlan.
   phasePlan.prompt = appendPreviousAttempt(phasePlan.prompt, state.previousAttempt);
+  // The resolved worker's sandbox is a dispatch-time fact, not a packet one.
+  phasePlan.prompt = appendSandboxNotice(phasePlan.prompt, runtime);
   // The worker prompt directs the provider to write the canonical result file;
   // make sure the directory exists before the provider is asked to.
   const resultPath = attemptWorkerResultPath(runDir, node.id, workspace);
@@ -429,6 +455,7 @@ export function startWorker(contract, node, state, runDir, running, prompt, lock
   writeJsonAtomic(snapshotPath, baseline);
   state.phase = "worker";
   state.runtime = runtime;
+  state.declaredReadBytes = declaredReadBytes(node.taskPacket.readFiles ?? [], workspace);
   // A new worker attempt has no accepted result yet. The canonical result
   // file is cleared when the previous attempt was explicitly rejected (failed
   // gate verdict), when no valid canonical file exists, or when the stale file
@@ -526,11 +553,11 @@ export function startResultMaterialization(contract, node, state, runDir, runnin
   const paths = logPaths(runDir, node.id, "worker", state.attempt);
   const workspace = attemptWorkspace(state) ?? contract.cwd;
   const resultPath = attemptWorkerResultPath(runDir, node.id, workspace);
-  const prompt = [
+  const prompt = appendSandboxNotice([
     `${RESULT_MATERIALIZATION_PROMPT_HEADER} Do not inspect, implement, verify, or invoke tools.`,
     `Your only job in this single bounded turn is to write the required worker-result JSON object to: ${resultPath}`,
     "Then return that same JSON object as the final message.",
-  ].join("\n\n");
+  ].join("\n\n"), materializationRuntime);
   let baseline;
   try {
     baseline = captureWorkspaceSnapshot(workspace);

package/src/engine/gate.mjs

@@ -21,8 +21,14 @@
  *
  * Nothing here is exported for a caller: this file is a program. Every name
  * below is module-local.
+ *
+ * It also exits when the release file's directory is gone (measured
+ * 2026-09-16: gate processes from a prior day's test runs, spawned into a
+ * temp directory the failed test never cleaned up, were still alive and
+ * waiting for a release file that could now never appear).
  */
 import { existsSync, readFileSync, statSync, openSync, closeSync, readSync, writeSync } from "node:fs";
+import { dirname } from "node:path";
 import { spawn } from "node:child_process";
 
 /** @typedef {{executable: string, args: string[], cwd: string, promptTransport: "stdin"|"argv", harness: string, env: Record<string, string|null>|null, stdoutPath: string, stderrPath: string}} GateConfig */
@@ -158,8 +164,14 @@ function childEnv() {
 process.on("SIGTERM", () => stopProvider());
 process.on("SIGINT", () => stopProvider());
 
+/** @returns {boolean} */
+function releaseDirectoryGone() {
+  return !existsSync(dirname(releasePath));
+}
+
 const timer = setInterval(() => {
   if (!parentAlive()) { clearInterval(timer); stopProvider(); return; }
+  if (releaseDirectoryGone()) { clearInterval(timer); stopProvider(); return; }
   if (!existsSync(releasePath)) return;
   clearInterval(timer);
   const stdoutFd = openSync(config.stdoutPath, "wx", 0o600);

package/src/engine/process-identity.mjs

@@ -13,6 +13,41 @@ import { processStartToken } from "../run/lock.mjs";
 /** @typedef {import("node:child_process").ChildProcess} ChildProcess */
 /** @typedef {{pid: number|null, processGroupId?: number|null, processStartToken?: string|null}} InvocationProbe */
 
+/**
+ * Whether a controller may signal a pid's process group at all. It may not when
+ * the pid is the calling process -- whose group is the controller's own -- or
+ * its parent, whose group is the runner (or host scheduler) that spawned the
+ * controller: either signal takes down the caller instead of the invocation.
+ * The refusal is recorded and returned, never thrown.
+ *
+ * The line goes to the injected sink when a caller supplied one, otherwise to
+ * stderr; this function owns no run directory and no event-log schema, so
+ * stderr is the one recorder it always has. Recording is diagnostic, so a
+ * failure to record must never turn the refusal into a throw.
+ *
+ * @param {number} pid
+ * @param {((event: Record<string, unknown>) => void)|undefined} [append] injected event sink
+ * @returns {boolean} true when the pid is this process or its parent and the signal was refused
+ */
+export function refuseSelfSignal(pid, append) {
+  const relation = pid === process.pid ? "self" : pid === process.ppid ? "parent" : null;
+  if (relation === null) return false;
+  const event = {
+    type: "controller_self_signal_refused",
+    at: new Date().toISOString(),
+    pid,
+    processPid: process.pid,
+    relation,
+  };
+  try {
+    if (append) append(event);
+    else process.stderr.write(`[warn] controller_self_signal_refused ${JSON.stringify(event)}\n`);
+  } catch {
+    // The refusal is diagnostic: a failed recorder must never become a throw.
+  }
+  return true;
+}
+
 /**
  * A process group answers a signal-0 probe. EPERM means the group exists but is
  * not this user's, which is no more "ours" than a missing group.
@@ -57,6 +92,10 @@ export function processStartTokenMatches(invocation) {
  */
 export function invocationOwned(invocation, options = {}) {
   if (!invocation?.pid || !Number.isInteger(invocation.pid)) return false;
+  // A controller does not spawn itself or its parent: a recorded pid that names
+  // either can never be an invocation this controller owns, whatever token or
+  // child handle accompanies it, and signalling it would hit the caller.
+  if (invocation.pid === process.pid || invocation.pid === process.ppid) return false;
   try {
     process.kill(invocation.pid, 0);
   } catch {

package/src/engine/prompts.mjs

@@ -1,6 +1,7 @@
 import { validateWorkerResult } from "../contract/worker-result.mjs";
 import { scopeFindingsPromptSection } from "../contract/scope-findings.mjs";
 import { JUDGE_ENVELOPE_REASON, JUDGE_FINDING_ENVELOPE_REASON, JUDGE_LIMITS } from "../contract/judge-envelope.mjs";
+import { harnessCapabilities } from "../harnesses/index.mjs";
 
 /** @typedef {{id: string, definitionOfDone: import("../contract/definition-of-done.mjs").DefinitionOfDoneItem[], taskPacket: {mode?: "execution"|"discovery"|"autonomous", objective: string, instructions: string[], writeFiles?: string[], writeRoots?: string[], verification: {argv: string[]}[]}}} JudgeNode */
 /** @typedef {{verdict: "pass"|"fail"|"invalid_judge_output", maxSeverity: "none"|"minor"|"major"|"critical", summary: string, findings: {severity: "minor"|"major"|"critical", description: string, evidence: string}[]}} JudgeVerdict */
@@ -276,6 +277,23 @@ export function retryPrompt(node, verdict) {
     : prompt;
 }
 
+/**
+ * Append the `## Sandbox` warning a resolved worker runtime earns. Only a
+ * harness whose adapter declares `signalsProcesses === false` gets it: that
+ * sandbox cannot signal child processes or read the process table, so a test
+ * that starts and terminates a child hangs until the executor's cap. An
+ * unmeasured harness (`null`) is left alone — no measurement justifies the
+ * warning.
+ *
+ * @param {string} prompt
+ * @param {{harness: string}} runtime
+ * @returns {string}
+ */
+export function appendSandboxNotice(prompt, runtime) {
+  if (harnessCapabilities(runtime).signalsProcesses !== false) return prompt;
+  return `${prompt}\n\n## Sandbox\nYour harness runs you in a sandbox that cannot signal other processes or read the process table. A test that starts and terminates a child process hangs here until the executor's cap and is then killed as a stall. Do not run such tests; the controller runs them after you report.`;
+}
+
 /**
  * @param {unknown} value
  * @param {number} maxBytes

package/src/engine/resume.mjs

@@ -17,7 +17,7 @@ import { Buffer } from "node:buffer";
 import { acquire as acquireLock } from "../run/lock.mjs";
 import { applyInvalidWorkerResult, assertRunMutable, handleProviderExhaustion } from "./lifecycle.mjs";
 import { applyJudgeResult } from "./review.mjs";
-import { assertSourceUnchanged, captureRunIdentity, statesFingerprint } from "./run-identity.mjs";
+import { assertSourceUnchanged, captureRunIdentity, recordedBaseRef, statesFingerprint } from "./run-identity.mjs";
 import { attemptWorkspace, attemptWorktreePath, gitHead, removeWorktree, runRefName } from "../repo/worktree.mjs";
 import { canonicalWorkerResultText, isResultMaterializationInvocation, materializeAttemptResult, recoverWorkerResult } from "./result-file.mjs";
 import { checkPersistedWorkerScope, persistedScopeBoundary, reconcileAmbiguousWorkerRestart, resolveUnknownEffect } from "./scope.mjs";
@@ -114,7 +114,7 @@ export async function resumeRun(runDirPath, options = {}) {
       node.id,
       persistedScopeBoundary(contract, node, states.get(node.id), attemptWorkspace(states.get(node.id)) ?? contract.cwd),
     ]));
-    const sourceIdentity = await captureRunIdentity(contract, scopeBoundaries);
+    const sourceIdentity = await captureRunIdentity(contract, scopeBoundaries, recordedBaseRef(storedMetadata) ?? undefined);
     const identity = assertSourceUnchanged(storedMetadata.sourceIdentity, sourceIdentity);
     // A resume is an explicit instruction to continue the run: it consumes a
     // stale cancel request instead of letting it re-cancel the retried nodes.

package/src/engine/review.mjs

@@ -21,7 +21,7 @@ import {
 } from "../contract/review-modes.mjs";
 
 import { errorMessage, excerpt } from "../util.mjs";
-import { appendTransitionEvent, transition } from "./state.mjs";
+import { appendTransitionEvent, transition, writeNode } from "./state.mjs";
 import { startJudge } from "./dispatch.mjs";
 import { applyRejection, raiseNodeAttention, settleDone } from "./settle.mjs";
 
@@ -154,6 +154,14 @@ export async function applyJudgeResult(contract, node, state, result, runDir, lo
       await raiseNodeAttention(campaignPath, runDir, state, "judge_protocol");
       return;
     }
+    // The verdict and the spent bound are durable before the blocked
+    // transition: a controller loss in this gap reads the settled re-ask from
+    // the node snapshot instead of spending a second one. No await separates
+    // the two writes, so the durable record cannot be observed only by luck.
+    writeNode(runDir, state, lock);
+    if (process.env.FABERUN_JUDGE_REASK_INTERRUPT === "after-verdict") {
+      throw new Error("judge re-ask interrupted after verdict persistence");
+    }
     transition(runDir, state, "blocked", {
       phase: "judge",
       gate: verdict,

package/src/engine/run-command.mjs

@@ -99,9 +99,30 @@ async function runRepeatedCommand(command, baseCwd, commandIndex, options) {
   const attempts = [];
   const repeat = command.repeat ?? 1;
   for (let attempt = 1; attempt <= repeat; attempt += 1) {
-    attempts.push(await runCommand(command, baseCwd, command.cwd ?? ".", attempt, options.signal, options, commandIndex));
+    const result = await runCommand(command, baseCwd, command.cwd ?? ".", attempt, options.signal, options, commandIndex);
+    if (signalDeathRetry(result, options.signal)) {
+      attempts.push({ ...result, signalDeath: true });
+      attempts.push(await runCommand(command, baseCwd, command.cwd ?? ".", attempt, options.signal, options, commandIndex));
+    } else {
+      attempts.push(result);
+    }
   }
-  return { ...command, cwd: resolveVerificationCwd(baseCwd, command.cwd ?? "."), passed: attempts.every((item) => item.passed), attempts };
+  const passed = attempts.filter((item) => !item.signalDeath).every((item) => item.passed);
+  return { ...command, cwd: resolveVerificationCwd(baseCwd, command.cwd ?? "."), passed, attempts };
+}
+/**
+ * Whether an attempt died from a signal the controller itself did not send.
+ * `terminateGroup` only fires from the timeout and abort paths below, so a
+ * `signal` with neither set is evidence of an external kill (OOM, an operator
+ * `kill`, a flaky sandbox) rather than a verdict on the command under test,
+ * and gets one retry instead of failing the node outright.
+ *
+ * @param {VerificationAttemptResult} result
+ * @param {AbortSignal|undefined} signal
+ * @returns {boolean}
+ */
+function signalDeathRetry(result, signal) {
+  return Boolean(result.signal) && !result.timedOut && !signal?.aborted;
 }
 /**
  * The mutation case: the entry passes on the mutant-kill fraction, and every

package/src/engine/run-identity.mjs

@@ -181,6 +181,20 @@ export function setLaunchBaseRef(baseRef) {
   pendingLaunchBaseRef = baseRef ?? null;
 }
 
+/**
+ * The base ref a run was launched against, when it was launched with
+ * `--base-ref`. A run recorded before this field existed, or launched
+ * without the flag, has none — a resume of that run keeps comparing against
+ * the checkout's own HEAD.
+ *
+ * @param {RunMetadata|undefined} metadata
+ * @returns {string|null}
+ */
+export function recordedBaseRef(metadata) {
+  const baseRef = metadata?.sourceIdentity?.baseRef;
+  return typeof baseRef === "string" && baseRef.length > 0 ? baseRef : null;
+}
+
 /**
  * Capture the run's source identity, including one version-only probe per
  * distinct routed runtime (a local binary call, no model tokens) so a later

package/src/engine/scheduler.mjs

@@ -41,7 +41,7 @@ import { appendUsageRecord, invocationCost, invocationUsage, recordInvocationUsa
 import { captureNodeScopeBoundaries, checkWorkerScope, emptyScope } from "./scope.mjs";
 import { validateContract } from "../contract/index.mjs";
 import { validateNodeSnapshot } from "../contract/snapshot.mjs";
-import { finalVerificationCommands } from "../contract/final-verification.mjs";
+import { finalVerificationCommands, sharedVerificationCommands } from "../contract/final-verification.mjs";
 import { startJudge, startWorker } from "./dispatch.mjs";
 import { assertEnvironmentReady, captureRunIdentity, createRunMetadata, serializableContract, statesFingerprint } from "./run-identity.mjs";
 import { blockDependents, runtimeAssignments } from "./assignment.mjs";
@@ -94,12 +94,13 @@ export function verificationBudgetMs(commands) {
 /**
  * The budget a node is judged against, in milliseconds. It is the sum of every
  * bounded phase the node can legitimately occupy without a state transition:
- * its worker invocation (`timeoutSec`), its packet verification and the
- * contract's `finalVerification` when it is phase-terminal, an integration
- * candidate run of that same set, and the bounded command proofs of its gate.
- * A frozen node is one that has been silent longer than this, not merely
- * longer than the worker timeout, because a legitimate verification can be
- * minutes long and must not be mistaken for a freeze.
+ * its worker invocation (`timeoutSec`), its packet verification plus the
+ * contract's `sharedVerification` and, when it is phase-terminal, the
+ * contract's `finalVerification`, an integration candidate run of that same
+ * set, and the bounded command proofs of its gate. A frozen node is one that
+ * has been silent longer than this, not merely longer than the worker timeout,
+ * because a legitimate verification can be minutes long and must not be
+ * mistaken for a freeze.
  *
  * @param {ValidatedContract} contract
  * @param {ValidatedNode} node
@@ -107,14 +108,17 @@ export function verificationBudgetMs(commands) {
  */
 export function nodeBudgetBasisMs(contract, node) {
   const defaultTimeoutMs = (node.timeoutSec ?? contract.timeoutSec ?? 60) * 1_000;
+  const sharedMs = verificationBudgetMs(sharedVerificationCommands(contract));
   const packetMs = verificationBudgetMs(node.taskPacket?.verification);
   const finalMs = verificationBudgetMs(finalVerificationCommands(contract, node));
-  // The controller runs the packet set once after the worker and once against
-  // the integration candidate, and the finalVerification set with each.
-  const candidateMs = packetMs + finalMs;
+  // The controller runs the packet set (with the contract-level shared set) once
+  // after the worker and once against the integration candidate, and the
+  // finalVerification set with each.
+  const attemptMs = packetMs + sharedMs;
+  const candidateMs = attemptMs + finalMs;
   const gateTimeoutMs = Math.max(1_000, Math.min(defaultTimeoutMs, 120_000));
   const commandProofs = (node.definitionOfDone ?? []).filter((item) => item.proof?.kind === "command").length;
-  return defaultTimeoutMs + packetMs + candidateMs + commandProofs * gateTimeoutMs + finalMs;
+  return defaultTimeoutMs + attemptMs + candidateMs + commandProofs * gateTimeoutMs + finalMs;
 }
 
 /**
@@ -149,6 +153,26 @@ export function enforceRunningInvariant(runDir, states, running, lock) {
   return parked;
 }
 
+/**
+ * The fingerprint that decides whether a render is due: the shared
+ * `statesFingerprint` (status, phase, attempt, revisions) plus each running
+ * node's verification progress. A verification command completing and the
+ * next one starting changes neither status nor phase, so the shared
+ * fingerprint alone would never notice it; this is the one used to gate
+ * `renderStatusIfChanged` and nothing else, so a resume's drift comparison
+ * still uses the unextended `statesFingerprint`.
+ *
+ * @param {Map<string, NodeSnapshot>} states
+ * @returns {string}
+ */
+function renderFingerprint(states) {
+  const progress = [...states.values()].map((state) => {
+    const verification = /** @type {{progress?: {index: number, total: number, argv: string}}|null|undefined} */ (state.verification);
+    return verification?.progress ? `${state.id}:${verification.progress.index}/${verification.progress.total}:${verification.progress.argv}` : "";
+  }).join("|");
+  return `${statesFingerprint(states)}#${progress}`;
+}
+
 /**
  * @param {string} contractPath
  * @param {{detachedBootstrap?: boolean}} [options] `detachedBootstrap` is set
@@ -290,11 +314,19 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
   let statusFingerprint = null;
   /** @param {boolean} force @param {LockHandle|null} [renderLock] */
   const renderStatusIfChanged = (force = false, renderLock = lock) => {
-    const fingerprint = statesFingerprint(states);
+    const fingerprint = renderFingerprint(states);
     if (!force && fingerprint === statusFingerprint) return;
     statusFingerprint = fingerprint;
     render(runDir, runsDir, contract, states, renderLock);
   };
+  // The tick that owns a running node's verification can be minutes long
+  // (`executeControllerVerification` is awaited on the critical path below),
+  // and that whole time status.json would otherwise report whatever the last
+  // tick left it at. A timer renders between ticks too; it is cheap even when
+  // idle because `renderFingerprint` still change-detects, so a quiet run
+  // writes nothing extra.
+  const statusTimer = setInterval(() => renderStatusIfChanged(), contract.pollIntervalMs);
+  statusTimer.unref();
   let handoffFingerprint = statesFingerprint(states);
   const renderHandoffIfChanged = () => {
     const fingerprint = statesFingerprint(states);
@@ -475,6 +507,7 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
     notifyQueuesByRun.delete(runDir);
     return { runDir, states, ok: false, error };
   } finally {
+    clearInterval(statusTimer);
     process.removeListener("SIGINT", cancel);
     process.removeListener("SIGTERM", cancel);
     process.removeListener("SIGHUP", cancel);

package/src/engine/settle.mjs

@@ -86,6 +86,33 @@ export function applyVerificationFailure(contract, node, state, runDir, running,
   applyRejection(contract, node, state, runDir, running, lock, states, campaignPath, verdict, { code: "verification_failed", label: "verification" });
 }
 
+/**
+ * The bounded operator-facing note when the integration candidate needed
+ * `verifyCandidateWorkspace`'s one retry to agree with the attempt. The node
+ * snapshot schema has no free-text `note` field of its own; `gate.summary` is
+ * the one it already carries that `statusNote` (report/render.mjs) surfaces,
+ * so a retried acceptance folds its note there instead of failing on an
+ * unknown field the next time the state is written.
+ *
+ * @param {unknown} candidateEvidence
+ * @returns {string|null}
+ */
+function candidateRetryNote(candidateEvidence) {
+  const record = /** @type {{retried?: unknown, commands?: Array<{argv?: string[]}>}} */ (candidateEvidence ?? {});
+  const indexes = Array.isArray(record.retried) ? record.retried : [];
+  if (!indexes.length) return null;
+  const argvList = indexes.map((index) => (record.commands?.[/** @type {number} */ (index)]?.argv ?? []).join(" ")).join(", ");
+  return boundedUtf8(`candidate verification retried: ${argvList}`, 256);
+}
+/**
+ * @param {import("../contract/index.mjs").GateResult|null|undefined} gate
+ * @param {string} note
+ * @returns {import("../contract/index.mjs").GateResult}
+ */
+function withCandidateRetryNote(gate, note) {
+  if (!gate) return { verdict: "pass", maxSeverity: "none", summary: note, findings: [] };
+  return { ...gate, summary: boundedUtf8(`${gate.summary} · ${note}`, 4 * 1024) };
+}
 /**
  * Seal the current attempt, verify its candidate in a detached worktree, and
  * only then perform the single done-state transition. The integration module
@@ -142,8 +169,10 @@ export async function settleDone(contract, node, state, runDir, lock, states, ca
     onAccepted: async (transaction) => {
       const acceptedPath = state.worktree?.path ?? attemptWorktreePath(runDir, contract.id, node.id, transaction.attempt);
       if (state.attempt === transaction.attempt && state.status !== "done") {
+        const retryNote = candidateRetryNote(/** @type {{verificationEvidence?: {candidate?: unknown}}} */ (transaction).verificationEvidence?.candidate);
         transition(runDir, state, "done", {
           ...patch,
+          ...(retryNote ? { gate: withCandidateRetryNote(/** @type {import("../contract/index.mjs").GateResult|null|undefined} */ (patch.gate ?? state.gate), retryNote) } : {}),
           integratedHead: transaction.candidateSha,
           worktree: { ...(state.worktree ?? {}), status: "removed", commit: transaction.attemptSha, baseSha: transaction.previousRunRefTip },
         }, lock);

package/src/engine/supervise.mjs

@@ -34,6 +34,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { SETTLED, SUCCESS } from "./prompts.mjs";
+import { invocationOwned, refuseSelfSignal } from "./process-identity.mjs";
 import { earliestTierReset } from "./retry.mjs";
 import { lockStale, pidAlive, readLock } from "../run/lock.mjs";
 import { listNodeSnapshots, readNodeSnapshot } from "../run/node-store.mjs";
@@ -495,30 +496,45 @@ export async function waitForGroupGone(pid, alive, graceMs, sleep, now) {
  * the previous holder is gone. The kill and liveness probes are injectable so
  * a test can prove the ordering without signalling a real process.
  *
+ * A lock is a claim until it is proven, exactly as the engine proves one: the
+ * signal goes out only after `invocationOwned` confirms the pid still answers
+ * a signal-0 probe and still carries the token the holder recorded. A recycled
+ * pid is never signalled, and a lock that recorded no token is unverifiable --
+ * the function returns false and the caller's takeover path handles whatever is
+ * left, as it would a dead controller. EPERM is not ownership and not a failure
+ * to surface: like ESRCH it means gone-or-not-ours and never escapes.
+ *
+ * A lock naming this process or its parent is refused one step earlier: that
+ * lock's group is the caller's own, so the refusal is recorded and returns
+ * false without ever probing or signalling it.
+ *
  * @param {string} runDir
- * @param {{kill?: (pid: number, signal: string) => void, alive?: (pid: number) => boolean, sleep?: (ms: number) => Promise<void>, now?: () => number, graceMs?: number, killGraceMs?: number}} [options]
- * @returns {Promise<boolean>} whether a group was found and terminated
+ * @param {{kill?: (pid: number, signal: string) => void, alive?: (pid: number) => boolean, sleep?: (ms: number) => Promise<void>, now?: () => number, graceMs?: number, killGraceMs?: number, append?: (event: Record<string, unknown>) => void}} [options]
+ * @returns {Promise<boolean>} whether a verified group was found and terminated
  */
 export async function terminateControllerGroup(runDir, options = {}) {
   const lock = readLock(runDir);
   if (!lock || /** @type {{invalid?: true}} */ (lock).invalid) return false;
   const record = /** @type {import("../run/lock.mjs").LockRecord} */ (lock);
   const pid = record.pid;
+  if (refuseSelfSignal(pid, options.append)) return false;
+  if (!invocationOwned({ pid, processGroupId: pid, processStartToken: record.processStartToken })) return false;
   const kill = options.kill ?? ((target, signal) => {
     try {
       // The controller is normally detached, so its pid is its process group
       // id; a non-detached holder has no such group, so fall back to the pid.
+      // A group that is gone or not ours falls through to the pid probe.
       if (process.platform !== "win32") {
         try {
           process.kill(-target, signal);
           return;
         } catch (groupError) {
-          if (errorCode(groupError) !== "ESRCH") throw groupError;
+          if (errorCode(groupError) !== "ESRCH" && errorCode(groupError) !== "EPERM") throw groupError;
         }
       }
       process.kill(target, signal);
     } catch (error) {
-      if (errorCode(error) !== "ESRCH") throw error;
+      if (errorCode(error) !== "ESRCH" && errorCode(error) !== "EPERM") throw error;
     }
   });
   const alive = options.alive ?? ((target) => pidAlive(target) || groupAlive(target));
@@ -527,9 +543,19 @@ export async function terminateControllerGroup(runDir, options = {}) {
   const graceMs = options.graceMs ?? DEFAULT_TERMINATE_GRACE_MS;
   const killGraceMs = options.killGraceMs ?? DEFAULT_TERMINATE_KILL_GRACE_MS;
   if (!alive(pid)) return false;
-  kill(pid, "SIGTERM");
+  try {
+    kill(pid, "SIGTERM");
+  } catch (error) {
+    if (errorCode(error) === "ESRCH" || errorCode(error) === "EPERM") return false;
+    throw error;
+  }
   if (await waitForGroupGone(pid, alive, graceMs, sleep, now)) return true;
-  kill(pid, "SIGKILL");
+  try {
+    kill(pid, "SIGKILL");
+  } catch (error) {
+    if (errorCode(error) === "ESRCH" || errorCode(error) === "EPERM") return false;
+    throw error;
+  }
   await waitForGroupGone(pid, alive, killGraceMs, sleep, now);
   return true;
 }