faberun 0.8.0 → 0.10.0

package/src/plan/template.mjs

@@ -0,0 +1,278 @@
+/**
+ * Planning contract templates: the one-node `mode: "discovery"` contracts a
+ * plan pipeline runs outside the control session — draft, review, revise (a
+ * draft carrying the reviewer's findings), spec authoring, and spec review.
+ * Separate from freeze.mjs (which turns an already-built plan into a
+ * validated contract on disk) because this module never touches the
+ * filesystem or a model: it only assembles the JSON object `validateContract`
+ * accepts, from exactly the inputs each role may see. The reviewer's packet
+ * is the enforced case: it carries the spec, the repository facts and the
+ * artefact under review, never the author's packet, transcript or summary.
+ */
+import { assertObject, rejectUnknown, requireId, requireString, requireStringArray } from "../contract/assert.mjs";
+import { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION } from "../contract/index.mjs";
+import { validateDefinitionOfDone } from "../contract/definition-of-done.mjs";
+import { validateVerificationCommands } from "../contract/verification.mjs";
+
+/** @typedef {import("../contract/index.mjs").JsonObject} JsonObject */
+/** @typedef {"draft"|"review"|"revise"|"spec-author"|"spec-review"} PlanningKind */
+/** @typedef {"low"|"standard"|"high"} RiskTier */
+/** @typedef {{campaignId: string, phase: string, n: number, goal?: string, cwd?: string, runtimes: Record<string, JsonObject>, runtimeDefaults: {worker?: string, judge?: string}, specPath?: string, repoFactsPath?: string, planPath?: string, findingsPath?: string, notesPath?: string}} PlanningContractInputs */
+/** @typedef {{id: string, objective: string, taskKind: string, riskTier: RiskTier, dependsOn: string[], readFiles: string[], writeFiles: string[], definitionOfDone: import("../contract/definition-of-done.mjs").DefinitionOfDoneItem[], verification: import("../contract/verification.mjs").VerificationCommand[]}} PlanOutputNode */
+/** @typedef {{nodes: PlanOutputNode[], justification?: string}} PlanOutput */
+/** @typedef {{id: string, severity: "critical"|"major"|"minor", nodeId: string, text: string}} PlanFindingOutput */
+
+/**
+ * The taskKind catalogue a draft or revise classifies against. Exported here,
+ * not read from a separate document, so `TASK_KIND_CATALOGUE_PATH` (this
+ * module's own repo-relative path) is a real, always-present file a
+ * closed-context worker can be told to read for the authoritative list.
+ */
+export const TASK_KINDS = Object.freeze(["docs", "implement", "test", "refactor", "infra", "judge"]);
+
+/** The risk tiers a draft or revise classifies against. */
+export const RISK_TIERS = Object.freeze(["low", "standard", "high"]);
+
+/** This module's own repo-relative path: the taskKind catalogue's home. */
+export const TASK_KIND_CATALOGUE_PATH = "src/plan/template.mjs";
+
+/**
+ * Which of the caller's `runtimeDefaults` roles resolves this contract's
+ * single node. A draft or revise is authored by the worker role; a review or
+ * spec-review is graded by the judge role — there is no gate on this
+ * single-node contract, so the role only decides which runtime id the node
+ * itself carries.
+ *
+ * @type {Record<PlanningKind, "worker"|"judge">}
+ */
+const KIND_ROLE = Object.freeze({
+  draft: "worker",
+  revise: "worker",
+  "spec-author": "worker",
+  review: "judge",
+  "spec-review": "judge",
+});
+
+/** @type {Record<PlanningKind, string[]>} */
+const REQUIRED_INPUTS = Object.freeze({
+  draft: ["specPath", "repoFactsPath"],
+  revise: ["specPath", "repoFactsPath", "findingsPath"],
+  review: ["specPath", "repoFactsPath", "planPath"],
+  "spec-author": ["notesPath"],
+  "spec-review": ["specPath"],
+});
+
+const PLAN_OUTPUT_SHAPE = "{nodes: [{id, objective, taskKind, riskTier, dependsOn, readFiles, writeFiles, definitionOfDone, verification}], justification?}";
+const FINDINGS_SHAPE = "[{id, severity, nodeId, text}]";
+
+/** @type {Record<PlanningKind, string>} */
+const OBJECTIVES = Object.freeze({
+  draft: "Draft an execution plan for this phase: classify every node's taskKind and riskTier from the spec and the repository facts, and propose the dependency graph.",
+  revise: "Revise the plan to resolve every one of the reviewer's findings, keeping the same classification and graph shape as a fresh draft.",
+  review: "Review this plan against the spec and the repository facts, and report only findings.",
+  "spec-author": "Turn free notes into a structured spec document following the spec format.",
+  "spec-review": "Review this spec for traceability and completeness, and report only findings.",
+});
+
+/** @type {Record<PlanningKind, string[]>} */
+const INSTRUCTIONS = Object.freeze({
+  draft: [
+    `Consult ${TASK_KIND_CATALOGUE_PATH}'s exported TASK_KINDS before classifying any node; taskKind must be one of that catalogue and riskTier must be one of ${RISK_TIERS.join(", ")}.`,
+    `Return exactly one worker-result JSON object. Put the plan in output.plan as ${PLAN_OUTPUT_SHAPE} and nothing else in output.`,
+    "Never name a runtime, harness, model, or vendor anywhere in output.plan. taskKind and riskTier are the only classification a draft makes; a routing table assigns a runtime afterward, from those two fields alone.",
+  ],
+  revise: [
+    "Read the findings and resolve every one; do not leave a critical or major finding unaddressed.",
+    `Consult ${TASK_KIND_CATALOGUE_PATH}'s exported TASK_KINDS before classifying any node; taskKind must be one of that catalogue and riskTier must be one of ${RISK_TIERS.join(", ")}.`,
+    `Return exactly one worker-result JSON object. Put the revised plan in output.plan as ${PLAN_OUTPUT_SHAPE} and nothing else in output.`,
+    "Never name a runtime, harness, model, or vendor anywhere in output.plan.",
+  ],
+  review: [
+    "You are given only the spec, the repository facts, and the plan under review; you have not seen how the plan was produced or any reasoning behind it. Review the artefact alone.",
+    `Return exactly one worker-result JSON object. Put your findings in output.findings as ${FINDINGS_SHAPE} and nothing else in output.`,
+    "severity must be one of critical, major, minor. Every finding's nodeId must name a node id that actually appears in the plan under review.",
+  ],
+  "spec-author": [
+    "Read the notes and turn them into a structured spec document: front matter, Intent, Requirements (each with a stable R<n> id and a proof), Non-goals, Constraints, Success criteria, and Risks.",
+    "Return exactly one worker-result JSON object. Put the authored spec text, as one markdown document, in output.spec and nothing else in output.",
+  ],
+  "spec-review": [
+    "You are given only the spec under review; you have not seen the author's notes or reasoning. Review the document alone.",
+    `Return exactly one worker-result JSON object. Put your findings in output.findings as ${FINDINGS_SHAPE} and nothing else in output.`,
+    "severity must be one of critical, major, minor. Every finding's nodeId must name the requirement id, or section heading, it concerns.",
+  ],
+});
+
+/** @type {Record<PlanningKind, string[]>} */
+const NON_GOALS = Object.freeze({
+  draft: ["Assigning a runtime, harness, or model to any node."],
+  revise: ["Assigning a runtime, harness, or model to any node.", "Reopening a finding the reviewer did not raise."],
+  review: ["Proposing a replacement plan.", "Assigning a runtime, harness, or model to any node."],
+  "spec-author": ["Declaring nodes, phases, or architecture in the spec."],
+  "spec-review": ["Proposing a replacement spec."],
+});
+
+/**
+ * @param {PlanningKind} kind
+ * @param {PlanningContractInputs} inputs
+ * @returns {string[]}
+ */
+function readFilesForKind(kind, inputs) {
+  if (kind === "draft") return [/** @type {string} */ (inputs.specPath), /** @type {string} */ (inputs.repoFactsPath), TASK_KIND_CATALOGUE_PATH];
+  if (kind === "revise") {
+    return [/** @type {string} */ (inputs.specPath), /** @type {string} */ (inputs.repoFactsPath), TASK_KIND_CATALOGUE_PATH, /** @type {string} */ (inputs.findingsPath)];
+  }
+  if (kind === "review") return [/** @type {string} */ (inputs.specPath), /** @type {string} */ (inputs.repoFactsPath), /** @type {string} */ (inputs.planPath)];
+  if (kind === "spec-author") return [/** @type {string} */ (inputs.notesPath)];
+  return [/** @type {string} */ (inputs.specPath)];
+}
+
+/**
+ * Build one of the planning pipeline's one-node discovery contracts. Pure:
+ * no file is read or written, and no model is invoked. The returned object is
+ * the raw, not-yet-validated contract JSON `validateContract` accepts.
+ *
+ * @param {PlanningKind} kind
+ * @param {PlanningContractInputs} inputs
+ * @returns {JsonObject}
+ */
+export function buildPlanningContract(kind, inputs) {
+  const required = REQUIRED_INPUTS[kind];
+  if (!required) throw new TypeError(`buildPlanningContract: unknown kind ${kind}`);
+  requireId(inputs.campaignId, "inputs.campaignId");
+  requireString(inputs.phase, "inputs.phase");
+  if (!Number.isInteger(inputs.n) || inputs.n <= 0) throw new TypeError("inputs.n must be a positive integer");
+  assertObject(inputs.runtimes, "inputs.runtimes");
+  assertObject(inputs.runtimeDefaults ?? {}, "inputs.runtimeDefaults");
+  const inputRecord = /** @type {Record<string, unknown>} */ (inputs);
+  for (const field of required) requireString(inputRecord[field], `inputs.${field}`);
+
+  const readFiles = readFilesForKind(kind, inputs);
+  const role = KIND_ROLE[kind];
+  const runtimeId = (inputs.runtimeDefaults ?? {})[role];
+
+  /** @type {JsonObject} */
+  const taskPacket = {
+    mode: "discovery",
+    objective: OBJECTIVES[kind],
+    instructions: INSTRUCTIONS[kind],
+    readFiles,
+    writeFiles: [],
+    symbols: [],
+    decisions: [],
+    nonGoals: NON_GOALS[kind],
+    verification: [],
+  };
+
+  return {
+    schemaVersion: PROTOCOL_SCHEMA_VERSION,
+    contractVersion: CONTRACT_VERSION,
+    id: `${inputs.campaignId}-plan-${inputs.phase}-${kind}-${inputs.n}`,
+    campaignId: inputs.campaignId,
+    goal: inputs.goal ?? `Plan ${kind} for phase ${inputs.phase}`,
+    cwd: inputs.cwd ?? ".",
+    runtimes: inputs.runtimes,
+    runtimeDefaults: inputs.runtimeDefaults ?? {},
+    nodes: [
+      {
+        id: kind,
+        type: kind,
+        phase: inputs.phase,
+        dependsOn: [],
+        ...(runtimeId === undefined ? {} : { runtime: runtimeId }),
+        taskPacket,
+        gate: false,
+      },
+    ],
+  };
+}
+
+const PLAN_FIELDS = new Set(["nodes", "justification"]);
+const PLAN_NODE_FIELDS = new Set(["id", "objective", "taskKind", "riskTier", "dependsOn", "readFiles", "writeFiles", "definitionOfDone", "verification"]);
+
+/**
+ * Validate a draft or revise worker's `output.plan`. Rejects a node naming a
+ * runtime, harness, model, or vendor (an unknown field, since a plan node's
+ * shape never includes one) and a node missing taskKind or riskTier.
+ *
+ * @param {unknown} plan
+ * @returns {PlanOutput}
+ */
+export function validatePlanOutput(plan) {
+  assertObject(plan, "plan");
+  const record = /** @type {Record<string, unknown>} */ (plan);
+  rejectUnknown(record, PLAN_FIELDS, "plan");
+  if (!Array.isArray(record.nodes) || record.nodes.length === 0) {
+    throw new TypeError("plan.nodes must be a non-empty array");
+  }
+  const nodes = record.nodes.map((node, index) => {
+    const label = `plan.nodes[${index}]`;
+    assertObject(node, label);
+    const nodeRecord = /** @type {Record<string, unknown>} */ (node);
+    rejectUnknown(nodeRecord, PLAN_NODE_FIELDS, label);
+    requireId(nodeRecord.id, `${label}.id`);
+    requireString(nodeRecord.objective, `${label}.objective`);
+    if (typeof nodeRecord.taskKind !== "string" || !TASK_KINDS.includes(nodeRecord.taskKind)) {
+      throw new TypeError(`${label}.taskKind must be one of ${TASK_KINDS.join(", ")}`);
+    }
+    if (typeof nodeRecord.riskTier !== "string" || !RISK_TIERS.includes(nodeRecord.riskTier)) {
+      throw new TypeError(`${label}.riskTier must be one of ${RISK_TIERS.join(", ")}`);
+    }
+    const dependsOn = nodeRecord.dependsOn ?? [];
+    requireStringArray(dependsOn, `${label}.dependsOn`);
+    const readFiles = nodeRecord.readFiles ?? [];
+    requireStringArray(readFiles, `${label}.readFiles`);
+    const writeFiles = nodeRecord.writeFiles ?? [];
+    requireStringArray(writeFiles, `${label}.writeFiles`);
+    const definitionOfDone = validateDefinitionOfDone(nodeRecord.definitionOfDone ?? [], `${label}.definitionOfDone`);
+    const verification = validateVerificationCommands(nodeRecord.verification ?? [], `${label}.verification`);
+    return /** @type {PlanOutputNode} */ ({
+      id: /** @type {string} */ (nodeRecord.id),
+      objective: /** @type {string} */ (nodeRecord.objective),
+      taskKind: /** @type {string} */ (nodeRecord.taskKind),
+      riskTier: /** @type {RiskTier} */ (nodeRecord.riskTier),
+      dependsOn: /** @type {string[]} */ (dependsOn),
+      readFiles: /** @type {string[]} */ (readFiles),
+      writeFiles: /** @type {string[]} */ (writeFiles),
+      definitionOfDone,
+      verification,
+    });
+  });
+  if (record.justification !== undefined) requireString(record.justification, "plan.justification");
+  return {
+    nodes,
+    ...(record.justification === undefined ? {} : { justification: /** @type {string} */ (record.justification) }),
+  };
+}
+
+const FINDING_FIELDS = new Set(["id", "severity", "nodeId", "text"]);
+const FINDING_SEVERITIES = new Set(["critical", "major", "minor"]);
+
+/**
+ * Validate a review or spec-review worker's `output.findings`. A finding
+ * without `severity` or `nodeId` is invalid.
+ *
+ * @param {unknown} findings
+ * @returns {PlanFindingOutput[]}
+ */
+export function validateFindings(findings) {
+  if (!Array.isArray(findings)) throw new TypeError("findings must be an array");
+  return findings.map((finding, index) => {
+    const label = `findings[${index}]`;
+    assertObject(finding, label);
+    const record = /** @type {Record<string, unknown>} */ (finding);
+    rejectUnknown(record, FINDING_FIELDS, label);
+    requireId(record.id, `${label}.id`);
+    if (typeof record.severity !== "string" || !FINDING_SEVERITIES.has(record.severity)) {
+      throw new TypeError(`${label}.severity must be one of critical, major, minor`);
+    }
+    requireString(record.nodeId, `${label}.nodeId`);
+    requireString(record.text, `${label}.text`);
+    return /** @type {PlanFindingOutput} */ ({
+      id: /** @type {string} */ (record.id),
+      severity: /** @type {"critical"|"major"|"minor"} */ (record.severity),
+      nodeId: /** @type {string} */ (record.nodeId),
+      text: /** @type {string} */ (record.text),
+    });
+  });
+}

package/src/repo/integrate.mjs

@@ -503,7 +503,7 @@ export function promoteRun({ repo, runId, landBranch, runHead, baseSha, finalVer
   if (!head) throw refusal(`refusing to promote ${runId}: the run ref is unavailable`, "run_ref_missing");
   const checkedOutAt = worktreeCheckedOutAt(repo, landBranch);
   if (checkedOutAt) {
-    throw refusal(`refusing to promote ${landBranch}: it is checked out in ${checkedOutAt}`, "land_branch_checked_out");
+    throw refusal(`refusing to promote ${landBranch}: it is checked out in ${checkedOutAt}; ${landBranchCheckedOutRemedy(checkedOutAt)}`, "land_branch_checked_out");
   }
   const branchRef = `refs/heads/${landBranch}`;
   const current = gitHead(repo, branchRef);
@@ -540,6 +540,11 @@ function refusal(message, code) {
   return Object.assign(new Error(message), { code });
 }
 
+/** @param {string} checkedOutAt @returns {string} */
+function landBranchCheckedOutRemedy(checkedOutAt) {
+  return `detach the checkout at ${checkedOutAt} or run the coordinator from a worktree`;
+}
+
 /** @param {string} path @returns {string} */
 function readTextFile(path) {
   return readFileSync(path, "utf8");

package/src/report/render.mjs

@@ -26,7 +26,7 @@ const POINTER_ATTENTION_CHARS = 80;
 /** @typedef {{costUsd: number|null, costProvenance: CostProvenance, inputTokens: number, outputTokens: number, cacheReadInputTokens: number, pricedInvocations: number, unpricedInvocations: number}} RoleUsage */
 /** @typedef {{inputTokens: number|null, outputTokens: number|null, cacheReadInputTokens: number|null}} StatusPayloadUsage */
 /** @typedef {{index: number, total: number, argv: string}} VerificationProgress */
-/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, verdict: string|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null}} StatusPayloadNode */
+/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, verdict: string|null, gateOutcome: "passed"|"rejected"|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null}} StatusPayloadNode */
 /** @typedef {{schemaVersion: 1, run: string, contractId: string, campaignId: string, goal: string, usage: {inputTokens: number, outputTokens: number, cacheReadInputTokens: number, costUsd: number|null}, roles: {worker: RoleUsage, judge: RoleUsage}, controller: JsonObject, identityWarnings: string[], summary: string, nodes: StatusPayloadNode[]}} StatusPayload */
 
 /** The glyph each terminal state prints in a status table. */
@@ -43,13 +43,11 @@ export const MARK = {
 };
 
 /**
- * `status <run-dir>`: everything the operator needs, in the same order as
- * the dashboard page (TECH-SPEC lean, section 4's last paragraph) —
- * needs-you, now, nodes, cost. Every cell comes from the same payload
- * `status --json` and the per-run `status.json` file emit
- * (`buildStatusPayload`); `nodes` and `identityWarnings` from `loadRun` are
- * used only for the two facts the payload does not carry: throwing on an
- * invalid persisted snapshot, and `controllerStatus`'s lock read.
+ * `status <run-dir>`: needs-you, now, nodes, cost, in the dashboard's order
+ * (TECH-SPEC lean, section 4's last paragraph). Every cell comes from the same
+ * payload `status --json` emits (`buildStatusPayload`); `nodes` and
+ * `identityWarnings` from `loadRun` cover only what the payload does not:
+ * throwing on an invalid snapshot, and `controllerStatus`'s lock read.
  *
  * @param {string} runDir
  * @returns {string}
@@ -75,7 +73,7 @@ export function renderStatus(runDir) {
   const widths = [3, 24, 9, 3, 28, 8, 6, 6, 6, 10, 9, MAX_NOTE_LENGTH];
   /** @type {(cells: unknown[]) => string} */
   const row = (cells) => cells.map((cell, i) => fit(String(cell ?? ""), widths[i])).join(" ");
-  lines.push("```", row(["", "NODE", "STATE", "TRY", "RUNTIME", "ELAPSED", "IN", "CACHE", "OUT", "USD", "VERDICT", "NOTE"]), row(widths.map((width) => "-".repeat(width))));
+  lines.push("```", row(["", "NODE", "STATE", "TRY", "RUNTIME", "ELAPSED", "IN", "CACHE", "OUT", "USD", "GATE", "NOTE"]), row(widths.map((width) => "-".repeat(width))));
   for (const node of payload.nodes) {
     lines.push(row([
       MARK[node.status] ?? "[?]",
@@ -88,7 +86,7 @@ export function renderStatus(runDir) {
       compactTokens(node.usage?.cacheReadInputTokens),
       compactTokens(node.usage?.outputTokens),
       compactCost(node.costUsd),
-      node.verdict ?? "-",
+      node.gateOutcome ?? "-",
       node.note ?? "-",
     ]));
   }
@@ -98,12 +96,10 @@ export function renderStatus(runDir) {
 }
 
 /**
- * The node the operator should look at right now, formatted the same way
- * the dashboard's now strip is (TECH-SPEC lean, section 4, item 1): the
- * active node's elapsed time and cost so far, or an idle line once every
- * node has settled. A node awaiting a controller verification command
- * appends which one, `k/n`, and its argv, so a minutes-long suite is not
- * silent between ticks.
+ * The node the operator should look at right now, formatted like the
+ * dashboard's now strip (TECH-SPEC lean, section 4, item 1): elapsed time and
+ * cost so far, or idle once every node has settled. A node awaiting a
+ * controller verification command appends which one, `k/n`, and its argv.
  *
  * @param {StatusPayload} payload
  * @param {number} now epoch ms
@@ -114,7 +110,8 @@ function nowLine(payload, now) {
   if (active) {
     const progress = active.verificationProgress;
     const verification = progress ? ` · verification ${progress.index}/${progress.total} · ${progress.argv}` : "";
-    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}`;
+    const candidate = !progress && active.executionPhase === "candidate" ? " · candidate verification" : "";
+    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}${candidate}`;
   }
   const allTerminal = payload.nodes.every((node) => SUCCESS.has(node.status));
   return allTerminal ? `now: idle · run done · ${compactCost(payload.usage.costUsd)}` : "now: idle";
@@ -134,6 +131,27 @@ function verificationProgress(node) {
   return verification?.progress ?? null;
 }
 
+/** Set by `verifyCandidateWorkspace` (engine/verify.mjs) for the run of the sealed candidate's own re-verification pass. @param {NodeSnapshot} node @returns {boolean} */
+function candidateVerificationActive(node) {
+  const verification = /** @type {{candidate?: boolean}|null|undefined} */ (node.verification);
+  return verification?.candidate === true;
+}
+
+/** `candidate` while re-verifying the sealed candidate, `verification` mid-attempt-verification, else the persisted phase; the two never overlap. @param {NodeSnapshot} node @returns {string|null} */
+function executionPhaseOf(node) {
+  if (candidateVerificationActive(node)) return "candidate";
+  if (verificationProgress(node)) return "verification";
+  return node.phase;
+}
+
+/** What the gate decided (independent of `verdict`: an advisory review or a below-threshold fail verdict still accepts the node, engine/review.mjs `applyJudgeResult`). @param {NodeSnapshot} node @returns {"passed"|"rejected"|null} */
+export function gateOutcome(node) {
+  if (!node.gate) return null;
+  if (SUCCESS.has(node.status)) return "passed";
+  if (node.status === "failed" || node.status === "exhausted") return "rejected";
+  return null;
+}
+
 /**
  * A node's wall-clock elapsed time: `startedAt` to `updatedAt` once it has
  * settled into a terminal state, `startedAt` to `now` while it is still
@@ -216,7 +234,7 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
         // A running controller verification command does not move
         // `node.phase` (it stays `worker`, the phase that dispatched it), so
         // the surface that shows it is computed here rather than persisted.
-        executionPhase: progress ? "verification" : node.phase,
+        executionPhase: executionPhaseOf(node),
         runtime: node.runtime ? `${node.runtime.harness}/${node.runtime.model}` : null,
         workerRuntime: workerRuntimeLabel(node),
         continuation: continuationMode(node),
@@ -227,6 +245,7 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
         usage: node.usage ? { inputTokens: node.usage.inputTokens ?? null, outputTokens: node.usage.outputTokens ?? null, cacheReadInputTokens: node.usage.cacheReadInputTokens ?? null } : null,
         costUsd: typeof node.costUsd === "number" ? node.costUsd : null,
         verdict: node.gate?.verdict ?? null,
+        gateOutcome: gateOutcome(node),
         pendingHandoff: pendingHandoff(node),
         note: statusNote(node),
         scopeFindings: node.scopeFindings?.unexpectedPaths ?? null,
@@ -256,16 +275,11 @@ function activeStatusNode(nodes) {
 }
 
 /**
- * The bounded pointer record written to `.runs/status.json`: enough for a
- * quick ambient read (statusline, a stale watcher) without opening the
- * per-run status.json. Bounded the same way heartbeat.json used to be, so a
- * cheap bounded read stays valid for any reader still built that way.
- * `generatedAt` is unix seconds, not ISO: the statusline's no-jq fallback has
- * no clock and only jq's builtin `now` can compute an age from a live clock,
- * and neither path needs a `date` process to read an integer. `elapsedSec`
- * is likewise precomputed here (as of `generatedAt`, not live) so the
- * statusline never has to subtract two timestamps to show it — it just
- * prints the integer, whichever reader it is.
+ * The bounded pointer record written to `.runs/status.json`, for a quick
+ * ambient read without opening the per-run status.json (bounded like the old
+ * heartbeat.json). `generatedAt` is unix seconds, not ISO, and `elapsedSec` is
+ * precomputed from it, since the no-jq statusline fallback has no clock to
+ * subtract two timestamps with.
  *
  * @param {JsonObject} payload the per-run status.json payload
  * @param {NodeSnapshot[]} nodes
@@ -340,10 +354,7 @@ export function writeStatusArtifacts(runDir, runsDir, contract, states) {
  */
 export function controllerStatus(runDir, nodes) {
   const lock = readLock(runDir);
-  // The heartbeat's `at` is the live tick, so a working controller and a dead
-  // one are distinguishable on disk. Before this it was hard-coded null here
-  // and computed from node updates only once the lock was already stale, which
-  // is why all 47 recorded status.json files reported a null lastTick.
+  // The heartbeat's `at` distinguishes a working controller from a dead one on disk.
   const heartbeat = readHeartbeat(runDir);
   const lastTick = typeof heartbeat?.at === "string" ? heartbeat.at : null;
   if (!lock || /** @type {{invalid?: true}} */ (lock).invalid) {
@@ -473,14 +484,11 @@ export function renderFindings(runDir) {
 }
 
 /**
- * A node the worker itself stopped on, rendered as the repair it asks for.
- *
- * `findings` used to answer only gate exhaustion, and a run whose nodes all
- * stopped on `blocked_context` reported nothing to act on while the workers
- * had each named exactly what they needed — measured on a four-node campaign
- * where three nodes were blocked and the command printed one line saying so.
- * The question is already structured, so the repair is mechanical: put the
- * named paths in the packet's `readFiles` and take a new run id.
+ * A node the worker itself stopped on, rendered as the repair it asks for:
+ * `findings` used to answer only gate exhaustion, so a run whose nodes all
+ * stopped on `blocked_context` reported nothing to act on (measured on a
+ * four-node campaign with three nodes blocked). The repair is mechanical: put
+ * the named paths in the packet's `readFiles` and take a new run id.
  *
  * @param {NodeSnapshot} node
  * @returns {string|null}
@@ -553,16 +561,11 @@ function continuationMode(node) {
 }
 
 /**
- * Who produced this node's work, for the RUNTIME column of both tables.
- *
- * `state.runtime` is the last runtime *dispatched*, and the judge dispatch
- * overwrites the worker's: every gated node that reached its gate therefore
- * reported its judge as the runtime, and a six-node campaign whose workers
- * were five different harnesses rendered as though three of them had never
- * run (measured 2026-09-13). The invocation ledger keeps both roles, so the
- * label is derived from it: the worker that ran, falling back to the live
- * runtime for a node that has not dispatched one yet. The judge is not lost —
- * it owns the VERDICT column, and `nowLine` still names whatever is running.
+ * Who produced this node's work, for the RUNTIME column: `state.runtime` is
+ * the last runtime *dispatched*, and the judge dispatch overwrites the
+ * worker's (measured 2026-09-13: a six-harness campaign rendered as though
+ * three workers never ran), so this reads the invocation ledger for the
+ * worker that ran, falling back to the live runtime if none dispatched yet.
  *
  * @param {NodeSnapshot} node
  * @returns {string|null}
@@ -633,7 +636,7 @@ function boundedNote(segments, maxLength = MAX_NOTE_LENGTH) {
 export function statusNote(node) {
   const scope = scopeFindingsNote(node.scopeFindings);
   const review = reviewNote(node);
-  const detail = node.gate?.summary ?? node.error?.message ?? node.blockedBy?.join(", ") ?? node.phase;
+  const detail = node.gate?.summary ?? node.error?.message ?? node.blockedBy?.join(", ") ?? (candidateVerificationActive(node) ? "candidate" : node.phase);
   const note = boundedNote([review, detail]);
   if (!scope) return note;
   return boundedNote([scope, note]);
@@ -657,13 +660,10 @@ function nodeNote(node) {
 /** @typedef {{costUsd: number|null, status: "known"|"estimated"|"ambiguous"}} CostProjection */
 
 /**
- * Per-role usage from the invocation ledger alone, with the provenance that
- * says whether the role's cost total is honest. A role whose invocations all
- * carry a provider cost is `priced` and its `costUsd` is the sum; a role with
- * any unpriced invocation is `partial` (some priced) or `unpriced` (none), and
- * its `costUsd` stays null rather than summing the known half and understating
- * it. A role with no invocation is `none`. Token totals are always carried, so
- * a role the provider would not price still reads as work.
+ * Per-role usage from the invocation ledger, with provenance for whether the
+ * cost total is honest: `priced` (all invocations costed), `partial`/`unpriced`
+ * (some/none costed, so `costUsd` stays null rather than understating), or
+ * `none` (no invocation). Token totals are always carried.
  *
  * @param {NodeSnapshot[]} nodes
  * @returns {{worker: RoleUsage, judge: RoleUsage}}