faberun 0.9.0 → 0.10.0

package/README.md

@@ -2,7 +2,9 @@
 
 <h1 align="center">faberun</h1>
 
-<p align="center">From intent to running software.</p>
+<p align="center"><strong>From intent to running software.</strong></p>
+
+<p align="center">Graph engineering for coding agents.</p>
 
 <p align="center">
   <a href="https://github.com/feliperun/faberun/actions/workflows/ci.yml"><img src="https://github.com/feliperun/faberun/actions/workflows/ci.yml/badge.svg" alt="CI status"></a>
@@ -10,21 +12,162 @@
   <a href="https://www.npmjs.com/package/faberun"><img src="https://img.shields.io/npm/v/faberun" alt="npm version"></a>
 </p>
 
-Faberun is a development orchestration system that turns intent into verified
-software. It manages the process around software creation: plans, tasks,
-dependencies, execution, validation, evidence, retries and progress toward a
-defined outcome. It is not another coding agent, and it does not generate code
-without a definition of done.
+Faberun is a graph-engineering runtime for building software with coding agents.
+It sits above the models and the harnesses and turns an implementation plan into
+a durable graph of tasks, dependencies, workers, proofs, reviews, retries and
+integration gates.
+
+Harnesses are execution environments: Claude Code, Codex, the Gemini, DeepSeek
+and GLM shells, and a generic `exec-jsonl` door for whatever comes next. Models
+are the engines inside them. Faberun owns the graph, the state and the
+definition of done around both.
+
+The goal is not to make a group of agents talk to each other. It is to use the
+right model for each kind of work, keep the process independent of any single
+model or harness, and require evidence before software counts as done.
+
+## Why Faberun
+
+Coding agents are already very good at changing repositories. The remaining
+problem is everything around that execution.
+
+A frontier model earns its cost when it reasons about architecture, challenges a
+design, writes a specification or reviews a difficult decision. The same model
+is usually unnecessary for a small, well-defined implementation task a much
+cheaper one performs well. Without an orchestration layer, though, the model
+driving the current session becomes the model doing everything.
+
+Faberun separates those concerns. One campaign can use a frontier model to
+reason about the problem and author a plan, a second strong model to attack that
+plan, lower-cost models to execute well-defined implementation nodes, a model
+from another vendor to judge the work that genuinely needs judgment, and plain
+deterministic commands wherever no model is needed at all. The expensive
+intelligence goes where it matters, and the rest becomes an execution problem.
+
+It also takes the campaign out of the lifetime of one chat. The work has durable
+state on disk, so Claude Code can start a campaign and Codex, DeepSeek, GLM or
+any other adapted harness can continue it later without reconstructing the
+process from a conversation history.
+
+## Graph engineering
 
-Faberun is model- and harness-agnostic. Claude Code, Codex, OpenCode and
-whatever comes next are workers; Claude, GPT, Gemini, DeepSeek, GLM and other
-models are engines; Faberun sits above them. It keeps the intent, coordinates
-the work, tracks what was actually completed, validates the result and decides
-what should happen next.
+Faberun treats development as an executable graph rather than a long
+conversation.
 
-Software should be built, not merely generated. A craftsman does not depend on
-one hammer, so Faberun does not depend on one model or one agent: tools,
-models and harnesses can change, and the work remains.
+```text
+intent
+  └─ campaign
+       └─ contract
+            ├─ node A ── proof ── review ──┐
+            ├─ node B ── proof ── review ──┼── integration ── promotion
+            └─ node C ── proof ── review ──┘
+```
+
+A campaign carries the durable intent. A contract turns part of that intent into
+a schema-versioned DAG. Each node carries a closed packet: what the worker may
+read, what it may change, what done means, and how that claim has to be proven.
+The graph decides what can run, what must wait, what may retry, what needs a
+human and what is allowed to advance. The models are replaceable participants
+inside it. The graph remains.
+
+## What is different
+
+### Use the right model for the job
+
+A runtime is one harness running one model. Workers, judges and planning
+sessions need not share a provider or a capability tier, so high-cost reasoning
+and low-cost execution live in the same campaign instead of one model owning the
+whole process. Changing providers is a routing decision, not a rewrite of the
+workflow.
+
+### Proof before opinion
+
+A worker saying "done" is not evidence that it is. Every definition-of-done item
+declares how it can be proven: a command that must succeed, a path that must
+exist, or — only when the criterion cannot be mechanised — the judgment of a
+judge. Mechanical verification always runs first, and a node whose proofs are
+all mechanical settles without spending a token on review. A gate may also
+declare `skipWhen`, so a change that is green and small enough skips the judge
+by policy rather than by accident.
+
+### Independent review
+
+When judgment is required, the worker does not grade itself. Validation refuses
+a gated node whose worker and judge resolve to the same vendor. The judge reads
+the recorded result and its evidence, never the reasoning that produced it, and
+never re-runs the work. The point is not to make two agents agree; it is to keep
+implementation and acceptance as separate responsibilities.
+
+### Isolated execution
+
+Each attempt runs in its own git worktree, so independent nodes run at the same
+time without sharing a mutable working tree, and accepted work reaches the
+repository through controlled refs instead of being copied into the operator's
+checkout. The operator keeps working while the campaign runs.
+
+### Durable campaigns
+
+A run is not tied to the terminal that launched it. The controller runs
+detached, state is persisted under `.runs/`, `supervise` resumes a controller
+that died, and a campaign carries its intent across many runs and sessions. If a
+provider goes down or a harness session ends, the work does not have to be
+re-authored.
+
+### Safe integration
+
+Passing a worker's own checks is not the end of the process. An accepted attempt
+is sealed, integrated onto the run ref and verified again in the candidate
+state, and the phase-terminal node runs the contract's final verification. If
+combining individually valid changes breaks the system, the campaign does not
+promote them.
+
+### Measurable model economics
+
+Every invocation records its usage, routing and outcome, and a closed campaign
+keeps that ledger in its own record under `docs/campaigns/<id>/ledger/`. It makes
+questions like these measurable instead of anecdotal: which model handles this
+class of task reliably, where a frontier model is actually worth its price,
+which nodes close mechanically with no judge at all, how many revisions a worker
+needs before acceptance, what one closed checkpoint costs, and how often a
+fallback saves a campaign. The objective is not to spend less. It is to know
+where expensive intelligence creates value.
+
+## Campaigns, not synthetic teams
+
+Faberun does not model an agent process as a human organisation. It needs no "AI
+architect", "AI developer", "AI QA engineer" and "AI product manager" merely
+because human teams carry those titles: models are general enough that those
+boundaries are mostly artificial. The roles it does define are the ones that
+stay useful for agents.
+
+| role | responsibility |
+| --- | --- |
+| worker | produces a result inside its packet. |
+| judge | decides independently whether a result that needs judgment satisfies its contract. |
+| controller | advances the graph deterministically. |
+| operator | supplies the intent and intervenes when a decision genuinely needs a human. |
+
+Everything else belongs in the contract.
+
+## From spec to contract
+
+Planning is part of the product, and it is adversarial on purpose. `faberun spec
+validate` checks a specification's front matter, its `R<n>` requirements and the
+proof each one declares, and invokes no model to do it. `faberun plan` then runs
+the debate in budgeted, isolated runs: an author drafts, a reviewer from another
+vendor attacks the draft holding only the spec, the repository facts and the
+plan under review, and a revision round follows while a critical finding
+remains. A converged draft is sized, routed and frozen into a contract. Freezing
+never launches, and a plan that never converges ends `contested`, with its open
+findings recorded as a campaign question instead of a contract.
+
+None of it is mandatory. The traceability rules are advisory unless you ask for
+`--strict-traceability`, a document with no front matter validates as `legacy`
+rather than being rejected, and you can skip planning altogether and author the
+contract by hand. What Faberun needs is the executable part of the plan:
+objective, nodes, dependencies, read and write scope, definitions of done,
+verification, runtime policy and integration behaviour. Your specification
+process stays yours.
 
 ## Install
 
@@ -92,29 +235,35 @@ The operator writes the intent into a campaign and an authored contract, a
 schema-versioned DAG whose nodes each carry a closed task packet. The controller
 schedules every dependency-ready node and dispatches its packet to a worker
 inside an attempt worktree, where the worker sees only the files the packet
-names. The controller then runs the deterministic verification once, and a
-judge from a different vendor reviews the recorded result without re-running it.
-A passing attempt is sealed and integrated onto the run ref, a campaign promotes
-each run onto its landing branch, and the orchestrator lands that branch.
-Campaigns, handoffs and the `supervise` watchdog carry the work across sessions,
-so an interrupted run is continued in place instead of being re-authored.
+names. Faberun then judges the result in stages, and a free slot dispatches the
+next node while another one is still being verified.
 
 ```text
-intent
-  └─ contract: validate · preflight
-       └─ controller
-            ├─ worker attempt in an attempt worktree
-            │     └─ deterministic verification · cross-vendor judge
-            └─ integration ref · promotion · landing branch
+packet
+  └─ worker attempt in its own worktree
+       └─ mechanical proof ── failure ─→ retry · route · attention
+            └─ judge, when required ── rejection ─→ revision
+                 └─ seal ─→ integration ref ─→ candidate verification
+                      └─ promotion onto the campaign's landing branch
 ```
 
-The vocabulary is in [Concepts](docs/CONCEPTS.md), and the layers, process
-model and gates are in [Architecture](docs/ARCHITECTURE.md).
+A judge reviews recorded evidence rather than re-running arbitrary work. A
+passing attempt is sealed and integrated onto the run ref, a campaign promotes
+each finished run onto its landing branch, and the orchestrator lands that
+branch. Campaigns, handoffs and the `supervise` watchdog carry the work across
+sessions, so an interrupted run is continued in place instead of being
+re-authored.
 
-## Harnesses
+The vocabulary is in [Concepts](docs/CONCEPTS.md), and the layers, process model
+and gates are in [Architecture](docs/ARCHITECTURE.md).
 
-A runtime is one harness running one model. Any runtime can be a worker, and a
-judge of another vendor reviews what it produced.
+## Harnesses and models
+
+Faberun keeps three things apart. A **model** is the reasoning engine, a
+**harness** is the environment that gives a model access to code and tools, and
+a **runtime** is one configured harness-and-model pair Faberun can dispatch. Any
+runtime can act as a worker or as a judge, according to the contract and the
+routing policy.
 
 | Harness | Default vendor | Example model |
 | --- | --- | --- |
@@ -126,6 +275,19 @@ judge of another vendor reviews what it produced.
 | `exec-jsonl` | declared per runtime | the model its command names |
 | `replay` | declared per runtime | the recorded model |
 
+Harness and model support are adapter concerns. The orchestration above them
+depends on no single vendor.
+
+## Philosophy
+
+Software should be built, not merely generated. Generating plausible code is
+becoming cheap; the valuable part is the system around the generation —
+preserving intent, decomposing work, choosing the appropriate intelligence,
+isolating effects, proving outcomes, recovering from failure, and recording why a
+change was accepted. A craftsman does not depend on one hammer, and Faberun does
+not depend on one model. Models change, harnesses change, providers change. The
+intent, the graph, the evidence and the finished work remain.
+
 ## Documentation
 
 - [Documentation map](docs/README.md): every document and the question it answers.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "faberun",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Faberun is a development orchestration system that turns intent into verified software: harness- and model-agnostic, it keeps the intent, coordinates the work, verifies the result and decides what happens next.",
   "type": "module",
   "bin": {

package/src/campaign/chain.mjs

@@ -290,6 +290,25 @@ export function validateContractAgainstRef(raw, contractPath, context = {}) {
   }
 }
 
+/**
+ * Validate a contract for a launch, the one path the CLI's `run` command and
+ * the scheduler's own re-validation both go through: against `baseRef` when
+ * one is given, the checkout otherwise. `repo` defaults to the contract's own
+ * `cwd` when the caller does not know a better one (the campaign chain always
+ * passes its own), since a contract's `cwd` is always inside the repo it
+ * names.
+ *
+ * @param {Record<string, unknown>} raw
+ * @param {string} contractPath
+ * @param {{repo?: string, baseRef?: string}} [context]
+ * @returns {ValidatedContract}
+ */
+export function validateContractForLaunch(raw, contractPath, context = {}) {
+  if (!context.baseRef) return validateContract(raw, contractPath);
+  const repo = context.repo ?? resolve(dirname(contractPath), typeof raw.cwd === "string" ? raw.cwd : ".");
+  return validateContractAgainstRef(raw, contractPath, { repo, baseRef: context.baseRef });
+}
+
 /**
  * Reduce a run's progress to the one decision the chain makes. An in-flight run
  * is `unfinished` even though `reduceRunOutcome` already names its running nodes

package/src/cli.mjs

@@ -24,6 +24,7 @@ import {
   validBootstrapNonce,
 } from "./run/lock.mjs";
 import { renderRunHandoff } from "./campaign/index.mjs";
+import { validateContractForLaunch } from "./campaign/chain.mjs";
 import { campaignCli } from "./cli/campaign.mjs";
 import { seatCli } from "./cli/seat.mjs";
 import { initCommand } from "./cli/init.mjs";
@@ -291,9 +292,9 @@ async function main(argv) {
   if (command === "run") {
     warnIfNoTransport();
     const absolute = resolve(target);
-    const contract = validateContract(JSON.parse(readFileSync(absolute, "utf8")), absolute);
-    const runDir = join(contract.cwd, ".runs", contract.id);
     const baseRef = typeof values["base-ref"] === "string" && values["base-ref"] ? values["base-ref"] : undefined;
+    const contract = validateContractForLaunch(JSON.parse(readFileSync(absolute, "utf8")), absolute, { baseRef });
+    const runDir = join(contract.cwd, ".runs", contract.id);
     setLaunchBaseRef(baseRef);
     // The base is what every worktree is cut from; a dirty tree only blocks
     // when the cwd HEAD *is* that base. A `--base-ref` elsewhere leaves the
@@ -314,7 +315,7 @@ async function main(argv) {
       return;
     }
     for (const warning of [...contract.warnings, ...reusedDoneWarnings(contract)]) process.stdout.write(`${advisoryToken()} ${warning}\n`);
-    const result = await runContract(target, { detachedBootstrap: hasDetachedBootstrapNonce() });
+    const result = await runContract(target, { detachedBootstrap: hasDetachedBootstrapNonce(), baseRef });
     if (!result.ok) process.exitCode = 1;
     return;
   }

package/src/contract/final-verification.mjs

@@ -3,11 +3,13 @@
  * rule 12).
  *
  * `contract.finalVerification` is the contract-wide proof that the phase as a
- * whole closes: the controller runs it before the judge on the phase-terminal
- * node (the node no other node depends on), so no final checkpoint is ever
- * approved on partial verification. `contract.sharedVerification` carries the
- * same command schema but is appended to every node's attempt and integration
- * candidate, for the fast repository ratchets a node's write set can break.
+ * whole closes: the controller runs it before the judge, once, on whichever
+ * phase-terminal node (a node no other node depends on) is the last of them
+ * to settle, so no final checkpoint is ever approved on partial verification
+ * and a flake on one phase-terminal node cannot also cost its siblings a
+ * revision. `contract.sharedVerification` carries the same command schema but
+ * is appended to every node's attempt and integration candidate, for the fast
+ * repository ratchets a node's write set can break.
  * The persisted node-snapshot shape for verification evidence lives here too,
  * next to the schema it records.
  */
@@ -58,20 +60,49 @@ export function sharedVerificationCommands(contract) {
   return contract.sharedVerification ?? [];
 }
 
+/**
+ * Whether no other node in the contract depends on this one. `finalVerification`
+ * is a candidate to run on a phase-terminal node only; a node with a dependant
+ * never carries it, no matter which of its siblings settles last.
+ *
+ * @param {{nodes: {id: string, dependsOn: string[]}[]}} contract
+ * @param {{id: string}} node
+ * @returns {boolean}
+ */
+export function phaseTerminalNode(contract, node) {
+  return !contract.nodes.some((candidate) => candidate.dependsOn.includes(node.id));
+}
+
 /**
  * The contract's `finalVerification` commands when this node is the one that
- * closes the phase, otherwise none. A node is phase-terminal when no other
- * node in the contract depends on it.
+ * closes the phase, otherwise none. A phase can have several phase-terminal
+ * nodes (several nodes no other node depends on); the suite runs once for the
+ * phase, on whichever of them is the last to settle, not on every one of them.
+ *
+ * `settledIds` is the set of sibling node ids (any status a node does not
+ * leave on its own -- see `SETTLED` in `engine/prompts.mjs`) already reached
+ * at the moment this call is made. A phase-terminal node carries the suite
+ * exactly when every *other* phase-terminal node is already in that set --
+ * whichever node that is true for, in whatever order nodes actually settle,
+ * including a node retried after every sibling has already closed. Omitting
+ * `settledIds` (the scheduler's budget estimate, which has no run to inspect)
+ * falls back to the old per-node-shape answer: any phase-terminal node may
+ * still turn out to be the one that carries it, so the estimate stays an
+ * upper bound.
  *
  * @param {{finalVerification?: VerificationCommand[], nodes: {id: string, dependsOn: string[]}[]}} contract
  * @param {{id: string}} node
+ * @param {Set<string>} [settledIds]
  * @returns {VerificationCommand[]}
  */
-export function finalVerificationCommands(contract, node) {
+export function finalVerificationCommands(contract, node, settledIds) {
   const commands = contract.finalVerification ?? [];
   if (commands.length === 0) return [];
-  const hasDependant = contract.nodes.some((candidate) => candidate.dependsOn.includes(node.id));
-  return hasDependant ? [] : commands;
+  if (!phaseTerminalNode(contract, node)) return [];
+  if (!settledIds) return commands;
+  const siblings = contract.nodes.filter((candidate) => candidate.id !== node.id && phaseTerminalNode(contract, candidate));
+  const isLastToClose = siblings.every((sibling) => settledIds.has(sibling.id));
+  return isLastToClose ? commands : [];
 }
 
 /**

package/src/engine/scheduler.mjs

@@ -31,15 +31,15 @@ import {
   terminalErrorCode,
 } from "./lifecycle.mjs";
 import { delay, errorCode } from "../util.mjs";
-import { alreadyNotified, notifyQueueFor, notifyQueuesByRun, renderCampaignHandoffSafely } from "./notify-queue.mjs";
-import { detectStalls, terminateProcess } from "./process.mjs";
+import { alreadyNotified, emitNodeAdvisories, notifyQueueFor, notifyQueuesByRun, renderCampaignHandoffSafely } from "./notify-queue.mjs";
+import { detectStalls, invocationAlive, terminateProcess } from "./process.mjs";
 import { transition, writeNode } from "./state.mjs";
 import { listNodeSnapshots, readNodeSnapshot } from "../run/node-store.mjs";
 import { render, renderFinalReport, writeFindingsArtifact } from "../report/final.mjs";
 import { operationNextState, providerReceipts, settleInvocation } from "../run/operations.mjs";
 import { appendUsageRecord, invocationCost, invocationUsage, recordInvocationUsage } from "../run/usage.mjs";
 import { captureNodeScopeBoundaries, checkWorkerScope, emptyScope } from "./scope.mjs";
-import { validateContract } from "../contract/index.mjs";
+import { validateContractForLaunch } from "../campaign/chain.mjs";
 import { validateNodeSnapshot } from "../contract/snapshot.mjs";
 import { finalVerificationCommands, sharedVerificationCommands } from "../contract/final-verification.mjs";
 import { startJudge, startWorker } from "./dispatch.mjs";
@@ -131,16 +131,22 @@ export function nodeBudgetBasisMs(contract, node) {
  * never touches phase 2's parked `blocked`/`failed`/`exhausted`/`stalled`
  * states, and never overwrites the `runtime_tier_exhausted` waiting shape.
  *
+ * A node whose closed job is being settled in the background (its id is a key
+ * of `pendingSettlements`) is not this dead end either: its invocation has
+ * already exited and left `running`, but the settlement promise still owns
+ * deciding what happens to it, so it is left alone until that promise resolves.
+ *
  * @param {string} runDir
  * @param {Map<string, NodeSnapshot>} states
  * @param {Map<string, Job>} running
  * @param {LockHandle|null} lock
+ * @param {Map<string, Promise<void>>} [pendingSettlements]
  * @returns {string[]} the node ids this pass parked
  */
-export function enforceRunningInvariant(runDir, states, running, lock) {
+export function enforceRunningInvariant(runDir, states, running, lock, pendingSettlements = new Map()) {
   const parked = [];
   for (const [nodeId, state] of states) {
-    if (state.status !== "running" || running.has(nodeId)) continue;
+    if (state.status !== "running" || running.has(nodeId) || pendingSettlements.has(nodeId)) continue;
     transition(runDir, state, "blocked", {
       phase: state.phase,
       error: {
@@ -175,14 +181,17 @@ function renderFingerprint(states) {
 
 /**
  * @param {string} contractPath
- * @param {{detachedBootstrap?: boolean}} [options] `detachedBootstrap` is set
- *   only by the CLI entry when this process is its own detached child, and
- *   makes the controller wait for the launcher's acknowledgement
+ * @param {{detachedBootstrap?: boolean, baseRef?: string}} [options]
+ *   `detachedBootstrap` is set only by the CLI entry when this process is its
+ *   own detached child, and makes the controller wait for the launcher's
+ *   acknowledgement; `baseRef` is the CLI's own `--base-ref`, re-validated
+ *   here so a launch and the run it starts agree about what the contract was
+ *   checked against
  * @returns {Promise<RunOutcome>}
  */
 export async function runContract(contractPath, options = {}) {
   const absoluteContractPath = resolve(contractPath);
-  const contract = validateContract(JSON.parse(readFileSync(absoluteContractPath, "utf8")), absoluteContractPath);
+  const contract = validateContractForLaunch(JSON.parse(readFileSync(absoluteContractPath, "utf8")), absoluteContractPath, { baseRef: options.baseRef });
   const runDir = join(contract.cwd, ".runs", contract.id);
   if (existsSync(runDir)) throw new Error(`run already exists: ${runDir}`);
   mkdirSync(join(contract.cwd, ".runs"), { recursive: true });
@@ -319,12 +328,13 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
     statusFingerprint = fingerprint;
     render(runDir, runsDir, contract, states, renderLock);
   };
-  // The tick that owns a running node's verification can be minutes long
-  // (`executeControllerVerification` is awaited on the critical path below),
-  // and that whole time status.json would otherwise report whatever the last
-  // tick left it at. A timer renders between ticks too; it is cheap even when
-  // idle because `renderFingerprint` still change-detects, so a quiet run
-  // writes nothing extra.
+  // A node's own settlement (its controller verification, its judge round) can
+  // be minutes long, and it now runs off the tick's critical path in
+  // `pendingSettlements` so dispatch never waits behind it -- but that whole
+  // time status.json would otherwise report whatever the last tick left it at.
+  // A timer renders between ticks too; it is cheap even when idle because
+  // `renderFingerprint` still change-detects, so a quiet run writes nothing
+  // extra.
   const statusTimer = setInterval(() => renderStatusIfChanged(), contract.pollIntervalMs);
   statusTimer.unref();
   let handoffFingerprint = statesFingerprint(states);
@@ -364,14 +374,31 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
 
   /** @type {Map<string, Job>} */
   const running = new Map();
+  // One promise per node currently settling a closed job -- its controller
+  // verification, its candidate verification, its judge round -- kept off the
+  // tick's critical path so an eligible sibling still dispatches into a free
+  // slot while this node's own invocation has already exited. A node's own
+  // steps stay ordered because only one settlement per node is ever in flight
+  // (see the dispatch loop below); a *different* node's settlement is queued
+  // behind whichever one is already running (`settlementQueue`), not run
+  // alongside it -- `finalizeClosedJobs` shares state a concurrent second call
+  // would corrupt: the phase-continuation selection that picks at most one
+  // live node to carry a session forward, and `repo/integrate.mjs`'s one
+  // candidate ref and worktree per run. Only *dispatching a sibling* skips
+  // ahead of a node's settlement; two nodes' settlements never interleave.
+  /** @type {Map<string, Promise<void>>} */
+  const pendingSettlements = new Map();
+  /** @type {Promise<void>} */
+  let settlementQueue = Promise.resolve();
   let canceled = false;
   const cancel = () => { canceled = true; };
   process.once("SIGINT", cancel);
   process.once("SIGTERM", cancel);
   process.once("SIGHUP", cancel);
   // The heartbeat's `at` is owned by an unref'd timer inside this writer, never
-  // by the loop body below: the loop awaits controller verification on its own
-  // critical path and must keep answering "the process is alive" while it does.
+  // by the loop body below: a node's settlement can still run for minutes off
+  // the tick's critical path (`pendingSettlements`), and the heartbeat must
+  // keep answering "the process is alive" while it does.
   const heartbeat = createHeartbeat({ runDir, intervalMs: HEARTBEAT_INTERVAL_MS });
   const heartbeatNodes = new Map(contract.nodes.map((node) => [node.id, node]));
   let heartbeatFingerprint = statesFingerprint(states);
@@ -380,11 +407,89 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
   const activeHeartbeatNodes = () => [...states.values()]
     .filter((state) => state.status === "running" && heartbeatNodes.has(state.id))
     .map((state) => ({ nodeId: state.id, budgetBasis: nodeBudgetBasisMs(contract, /** @type {ValidatedNode} */ (heartbeatNodes.get(state.id))) }));
+  // A programmer error surfacing inside a background settlement must still
+  // crash the whole run, exactly as an unguarded `await finalizeClosedJobs`
+  // used to: it is recorded here and thrown from the top of the loop on the
+  // very next tick, rather than immediately, so it cannot itself become the
+  // block a sibling's dispatch is waiting behind. A lost lock is not this --
+  // the loop's own `lock.assert()` calls surface that same condition on their
+  // own schedule, so it is left for them.
+  /** @type {unknown} */
+  let backgroundSettlementFailure = null;
+  // Mark every job that closed this tick as settling, and free its slot,
+  // without waiting for any of them: that alone is what lets an eligible
+  // sibling dispatch into the freed slot while this node's minutes-long
+  // controller verification or judge round is still running. The actual
+  // settlement work is chained onto `settlementQueue`, one node at a time in
+  // the order its job closed, so it still runs exactly as serialized against
+  // every *other* node's settlement as it did when this loop awaited
+  // `finalizeClosedJobs` directly -- `finalizeClosedJobs` runs against a
+  // one-entry map per node, so this is one call per node rather than the one
+  // batched call it used to be, but the chain still runs them one at a time.
+  // A settlement may itself dispatch the node's next phase (a judge, a
+  // revision) through the same `startJudge`/`startWorker` calls dispatch below
+  // uses; those land in `slot`, not the real `running`, so they are copied
+  // back into `running` in a `finally` -- unconditionally, win or lose, so a
+  // job a settlement started before failing (a lost lock, a programmer error)
+  // is still visible to the cleanup sweeps below rather than leaked. The
+  // node's own steps stay ordered by never starting a second settlement for a
+  // node whose first has not yet cleared `pendingSettlements`.
+  const settleClosedJobsInBackground = () => {
+    for (const [nodeId, job] of [...running]) {
+      if (pendingSettlements.has(nodeId) || !job.closed || invocationAlive(job.invocation)) continue;
+      running.delete(nodeId);
+      const slot = new Map([[nodeId, job]]);
+      const settlement = settlementQueue
+        .then(() => finalizeClosedJobs(contract, runDir, states, slot, lock, campaign.path))
+        .finally(() => {
+          for (const [settledId, settledJob] of slot) running.set(settledId, settledJob);
+          pendingSettlements.delete(nodeId);
+        });
+      // The queue itself must never reject -- a rejected settlement (a lost
+      // lock, a programmer error) would otherwise wedge every node queued
+      // behind it. The rejection still reaches whoever awaits the real
+      // `settlement` promise (`pendingSettlements`, below).
+      settlementQueue = settlement.catch(() => {});
+      // Handled here so an in-flight settlement never becomes an unhandled
+      // rejection when nobody happens to await `pendingSettlements` before the
+      // process exits; the original promise, still held below, carries the
+      // rejection to whichever checkpoint (cancel, shutdown) awaits it.
+      settlement.catch((error) => {
+        if (!(error instanceof LockLostError) && backgroundSettlementFailure === null) backgroundSettlementFailure = error;
+      });
+      pendingSettlements.set(nodeId, settlement);
+    }
+  };
+  // Captured once, before the loop, rather than re-derived every tick: it is
+  // "parked when this controller invocation started" (autoRetryParkedNodes's
+  // own contract), and a node a background settlement parks between two ticks
+  // -- rather than synchronously within one, as it always did before
+  // settlement moved off the tick's critical path -- must still read as newly
+  // parked whichever later tick first observes it, not as already-parked
+  // because a per-tick snapshot happened to be taken after it landed.
+  const parkedBefore = new Set([...states.values()].filter((state) => PARKED.has(state.status)).map((state) => state.id));
+  const anyUnsettled = () => [...states.values()].some((state) => !SETTLED.has(state.status));
   try {
-    while ([...states.values()].some((state) => !SETTLED.has(state.status))) {
+    // A `while` that re-checked this at the very top of every tick would exit
+    // the instant a background settlement flips the run's last unsettled node
+    // straight to a terminal status between two ticks -- before the tick body
+    // that would have run `autoRetryParkedNodes` against that new status ever
+    // gets to. The entry guard skips the loop entirely when there is nothing
+    // to do at all (a resume of an already-settled run still does zero
+    // iterations); once inside, the exit check moves to the bottom, after the
+    // body, so that body always sees a freshly-parked node at least once
+    // before the loop is allowed to end.
+    if (anyUnsettled()) for (;;) {
       lock.assert();
+      if (backgroundSettlementFailure !== null) throw backgroundSettlementFailure;
       if (existsSync(join(runDir, "cancel.request.json"))) canceled = true;
       if (canceled) {
+        // A settlement already in flight owns the one decision a cancellation
+        // must not race: what this node's own invocation resolved to. Let it
+        // land on its real terminal status (and, when it re-dispatched a judge
+        // or a revision, on the new job that landed in `running`) before this
+        // branch decides which nodes are merely canceled.
+        await Promise.all([...pendingSettlements.values()]);
         const jobs = [...running.values()];
         await Promise.all(jobs.map((job) => terminateProcess(job)));
         const envelopes = new Map();
@@ -408,8 +513,14 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
         break;
       }
 
-      const parkedBefore = new Set([...states.values()].filter((state) => PARKED.has(state.status)).map((state) => state.id));
-      await finalizeClosedJobs(contract, runDir, states, running, lock, campaign.path);
+      // Advisory spend lines are checked every tick, closed job or not: a
+      // crossing must be visible while the spend is happening on a node still
+      // running, not only once it closes. `finalizeClosedJobs` used to open
+      // with this same check; calling it once here, rather than once per
+      // node settled this tick, is what keeps it at one pass per tick now
+      // that settlement runs per node in `settleClosedJobsInBackground`.
+      await emitNodeAdvisories(contract, runDir, states);
+      settleClosedJobsInBackground();
       await detectStalls(contract, running, async (job, status, error) => {
         const envelope = recordInvocationUsage(job);
         job.state.usage = invocationUsage(job.state);
@@ -450,8 +561,11 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
         writeNode(runDir, job.state, lock);
       });
       // A node left `running` with no job is a dead end; park it before the
-      // dispatch pass so it cannot hide behind a healthy sibling.
-      enforceRunningInvariant(runDir, states, running, lock);
+      // dispatch pass so it cannot hide behind a healthy sibling. A node
+      // whose closed job is settling in the background is not that dead end
+      // -- `pendingSettlements` is what tells this apart from one truly
+      // abandoned.
+      enforceRunningInvariant(runDir, states, running, lock, pendingSettlements);
       // Before dependants are blocked, a node that parked on this tick gets
       // its one automatic retry: it becomes pending, so `blockDependents` sees
       // nothing to block and the dependants stay `pending`/`phase: "waiting"`
@@ -463,14 +577,37 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
       if (slots > 0) {
         const ready = contract.nodes.filter((node) => {
           const state = states.get(node.id);
-          return state?.status === "pending" && node.dependsOn.every((id) => states.get(id)?.status === "done");
+          return state?.status === "pending" && !pendingSettlements.has(node.id)
+            && node.dependsOn.every((id) => states.get(id)?.status === "done");
         });
         for (const node of ready.slice(0, slots)) {
           const state = states.get(node.id);
           if (!state || routingBackoffActive(state, state.phase)) continue;
+          // A node recovered pending a re-ask judge (its own worker attempt
+          // already accepted, `state.result` durable) reaches `settleDone` /
+          // `integrateAttempt` exactly like a closed job's own settlement
+          // does, on the same per-run candidate ref and worktree
+          // `settlementQueue` exists to serialize -- so it is dispatched the
+          // same way: chained onto the queue rather than awaited here, using
+          // its own one-entry `slot` merged back into `running` in a
+          // `finally`. The node's own order is untouched (still one entry at
+          // a time, gated by `pendingSettlements`); only the tick stops
+          // waiting behind it.
           if (state.phase === "judge" && state.result) {
-            await applyJudgeRound(await startJudge(contract, node, state, runDir, running, state.result, lock, states, campaign.path),
-              contract, node, state, runDir, running, lock, states, campaign.path, state.result);
+            const workerResult = state.result;
+            const slot = new Map();
+            const settlement = settlementQueue
+              .then(() => startJudge(contract, node, state, runDir, slot, workerResult, lock, states, campaign.path))
+              .then((round) => applyJudgeRound(round, contract, node, state, runDir, slot, lock, states, campaign.path, workerResult))
+              .finally(() => {
+                for (const [settledId, settledJob] of slot) running.set(settledId, settledJob);
+                pendingSettlements.delete(node.id);
+              });
+            settlementQueue = settlement.catch(() => {});
+            settlement.catch((error) => {
+              if (!(error instanceof LockLostError) && backgroundSettlementFailure === null) backgroundSettlementFailure = error;
+            });
+            pendingSettlements.set(node.id, settlement);
             continue;
           }
           state.attempt += 1;
@@ -499,10 +636,46 @@ export async function driveRun(contract, runDir, states, campaign, lock, sourceI
         }
       }
       heartbeat.setActive(activeHeartbeatNodes());
-      if ([...states.values()].some((state) => !SETTLED.has(state.status))) await delay(contract.pollIntervalMs);
+      // A background settlement can flip a node straight to a parked
+      // terminal status during this same tick's own later awaits
+      // (`detectStalls`, `notifyStateChanges`), after the auto-retry pass
+      // above already ran and saw it as not-yet-parked. Running it once more
+      // here, immediately before the exit check, is what stops the loop from
+      // mistaking that freshly-parked node for settled and exiting before it
+      // ever got its automatic retry; a node it reopens dispatches on the
+      // next tick rather than this one, which `anyUnsettled()` below still
+      // correctly keeps the loop alive for.
+      autoRetryParkedNodes(contract, runDir, states, lock, parkedBefore);
+      if (!anyUnsettled()) break;
+      await delay(contract.pollIntervalMs);
     }
+    // The loop above exits (by the bottom check above or the cancel branch's
+    // `break`) the instant every node's state looks settled, but a
+    // settlement's own trailing work -- sealing a candidate's acceptance,
+    // removing its worktree, enqueueing its terminal notification -- can
+    // still be running after the transition that made the state look
+    // terminal. Nothing past this point (the final render, the findings
+    // artifact, the run-terminal notification, releasing the lock) may run
+    // ahead of that trailing work.
+    await Promise.all([...pendingSettlements.values()]);
+    // A settlement's own `finally` deletes it from `pendingSettlements` the
+    // instant it settles, win or lose -- so a rejection recorded here can
+    // already be gone from the map above by the time this line runs, with
+    // nothing left to await it. The loop's own top-of-tick check
+    // (`if (backgroundSettlementFailure !== null) throw ...`) cannot save
+    // that case either: the loop has already exited. Checked again here,
+    // once, so a background settlement failure can never read as a clean
+    // finish just because it settled on the same tick the run's last node
+    // did.
+    if (backgroundSettlementFailure !== null) throw backgroundSettlementFailure;
   } catch (error) {
     if (!(error instanceof LockLostError)) throw error;
+    // A settlement still merges whatever it started into `running` in its own
+    // `finally`, win or lose, regardless of whether anything awaits it; wait
+    // for that to land (never rejecting itself, so a second lock-loss here
+    // cannot mask the one already being handled) before the termination sweep
+    // reads `running`.
+    await Promise.allSettled([...pendingSettlements.values()]);
     await Promise.all([...running.values()].map((job) => terminateProcess(job)));
     notifyQueuesByRun.delete(runDir);
     return { runDir, states, ok: false, error };

package/src/engine/settle.mjs

@@ -165,7 +165,7 @@ export async function settleDone(contract, node, state, runDir, lock, states, ca
     attemptSha: sealed.sha,
     branch: state.worktree.branch,
     verificationEvidence: state.verification,
-    verifyCandidate: (candidateWorkspace) => verifyCandidateWorkspace(contract, node, state, runDir, candidateWorkspace),
+    verifyCandidate: (candidateWorkspace) => verifyCandidateWorkspace(contract, node, state, runDir, candidateWorkspace, lock),
     onAccepted: async (transaction) => {
       const acceptedPath = state.worktree?.path ?? attemptWorktreePath(runDir, contract.id, node.id, transaction.attempt);
       if (state.attempt === transaction.attempt && state.status !== "done") {

package/src/engine/verify.mjs

@@ -11,8 +11,10 @@
 import { attemptWorkspace } from "../repo/worktree.mjs";
 import { boundedUtf8, errorMessage } from "../util.mjs";
 import { compactVerification } from "../contract/verification.mjs";
-import { finalVerificationCommands, sharedVerificationCommands } from "../contract/final-verification.mjs";
+import { finalVerificationCommands, phaseTerminalNode, sharedVerificationCommands } from "../contract/final-verification.mjs";
 import { join } from "node:path";
+import { listNodeSnapshots, readNodeSnapshot } from "../run/node-store.mjs";
+import { SETTLED } from "./prompts.mjs";
 import { terminateInvocation } from "./process.mjs";
 import { writeNode } from "./state.mjs";
 import { runVerification } from "./run-command.mjs";
@@ -28,6 +30,34 @@ import { runVerification } from "./run-command.mjs";
 /** @typedef {import("../contract/index.mjs").VerificationState} VerificationState */
 /** @typedef {{index: number, total: number, argv: string}} VerificationProgress */
 
+/**
+ * The sibling phase-terminal node ids already settled, read straight off
+ * disk: every node snapshot is persisted from the run's first tick (see
+ * `runContract`), so a node still `pending` reads back honestly, not as
+ * missing. `finalVerificationCommands` uses this to decide, at the moment a
+ * phase-terminal node's own verification runs, whether it is the one that
+ * closes the phase -- recomputed fresh on every call, so a retried node sees
+ * its siblings' current status each time, not a decision frozen from an
+ * earlier attempt.
+ *
+ * @param {string} runDir
+ * @param {ValidatedContract} contract
+ * @param {ValidatedNode} node
+ * @returns {Set<string>}
+ */
+function settledSiblingIds(runDir, contract, node) {
+  const ids = new Set();
+  for (const name of listNodeSnapshots(runDir)) {
+    const id = name.slice(0, -".json".length);
+    if (id === node.id) continue;
+    const sibling = contract.nodes.find((candidate) => candidate.id === id);
+    if (!sibling || !phaseTerminalNode(contract, sibling)) continue;
+    const snapshot = /** @type {{status?: string}} */ (readNodeSnapshot(runDir, id));
+    if (SETTLED.has(/** @type {string} */ (snapshot.status))) ids.add(id);
+  }
+  return ids;
+}
+
 /**
  * The bounded `k/n · argv` shape a running node's status surfaces while a
  * verification command is in flight: the command's 1-based position among
@@ -108,7 +138,7 @@ export async function executeControllerVerification(contract, runDir, node, stat
   };
   writeNode(runDir, state, lock);
   const workspace = attemptWorkspace(state) ?? contract.cwd;
-  const commands = [...node.taskPacket.verification, ...sharedVerificationCommands(contract), ...finalVerificationCommands(contract, node)];
+  const commands = [...node.taskPacket.verification, ...sharedVerificationCommands(contract), ...finalVerificationCommands(contract, node, settledSiblingIds(runDir, contract, node))];
   /** @param {VerificationAttempt} attempt @returns {VerificationProgress} */
   const progressFor = (attempt) => verificationProgress(attempt.commandIndex + 1, commands.length, /** @type {VerificationCommand|undefined} */ (commands[attempt.commandIndex])?.argv);
   try {
@@ -221,16 +251,37 @@ function argvEqual(a, b) {
   if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
   return a.every((item, index) => item === b[index]);
 }
+/**
+ * Marks whether the integration candidate's own verification pass is running
+ * right now, nested inside the attempt's own already-completed verification
+ * record rather than as a new node-snapshot field: that record's validator
+ * (`validateVerificationSnapshot`) accepts extra keys, where the node
+ * snapshot's own strict field list would reject one. Status surfaces read it
+ * to tell "still verifying the sealed candidate" apart from "waiting on the
+ * judge", which otherwise both read as whatever phase the attempt last
+ * dispatched under.
+ *
+ * @param {string} runDir
+ * @param {NodeSnapshot} state
+ * @param {LockHandle|null} lock
+ * @param {boolean} active
+ */
+function markCandidateVerification(runDir, state, lock, active) {
+  state.verification = /** @type {VerificationState} */ ({ ...(state.verification ?? { passed: false, commands: [], completed: false }), candidate: active });
+  writeNode(runDir, state, lock);
+}
 /**
  * @param {ValidatedContract} contract
  * @param {ValidatedNode} node
  * @param {NodeSnapshot} state
  * @param {string} runDir
  * @param {string} workspace
+ * @param {LockHandle|null} [lock]
  * @returns {Promise<import("../repo/integrate.mjs").CandidateEvidence>}
  */
-export async function verifyCandidateWorkspace(contract, node, state, runDir, workspace) {
-  const commands = [...node.taskPacket.verification, ...sharedVerificationCommands(contract), ...finalVerificationCommands(contract, node)];
+export async function verifyCandidateWorkspace(contract, node, state, runDir, workspace, lock = null) {
+  const commands = [...node.taskPacket.verification, ...sharedVerificationCommands(contract), ...finalVerificationCommands(contract, node, settledSiblingIds(runDir, contract, node))];
+  markCandidateVerification(runDir, state, lock, true);
   try {
     const result = await runVerification(commands, workspace, {
       logDir: join(runDir, "logs", `${node.id}.${state.attempt}.candidate-verification`),
@@ -252,5 +303,7 @@ export async function verifyCandidateWorkspace(contract, node, state, runDir, wo
     return settled.retried ? { ...compacted, retried: settled.retried } : compacted;
   } catch (error) {
     return { passed: false, error: boundedUtf8(errorMessage(error), 4 * 1024) };
+  } finally {
+    markCandidateVerification(runDir, state, lock, false);
   }
 }

package/src/repo/integrate.mjs

@@ -503,7 +503,7 @@ export function promoteRun({ repo, runId, landBranch, runHead, baseSha, finalVer
   if (!head) throw refusal(`refusing to promote ${runId}: the run ref is unavailable`, "run_ref_missing");
   const checkedOutAt = worktreeCheckedOutAt(repo, landBranch);
   if (checkedOutAt) {
-    throw refusal(`refusing to promote ${landBranch}: it is checked out in ${checkedOutAt}`, "land_branch_checked_out");
+    throw refusal(`refusing to promote ${landBranch}: it is checked out in ${checkedOutAt}; ${landBranchCheckedOutRemedy(checkedOutAt)}`, "land_branch_checked_out");
   }
   const branchRef = `refs/heads/${landBranch}`;
   const current = gitHead(repo, branchRef);
@@ -540,6 +540,11 @@ function refusal(message, code) {
   return Object.assign(new Error(message), { code });
 }
 
+/** @param {string} checkedOutAt @returns {string} */
+function landBranchCheckedOutRemedy(checkedOutAt) {
+  return `detach the checkout at ${checkedOutAt} or run the coordinator from a worktree`;
+}
+
 /** @param {string} path @returns {string} */
 function readTextFile(path) {
   return readFileSync(path, "utf8");

package/src/report/render.mjs

@@ -26,7 +26,7 @@ const POINTER_ATTENTION_CHARS = 80;
 /** @typedef {{costUsd: number|null, costProvenance: CostProvenance, inputTokens: number, outputTokens: number, cacheReadInputTokens: number, pricedInvocations: number, unpricedInvocations: number}} RoleUsage */
 /** @typedef {{inputTokens: number|null, outputTokens: number|null, cacheReadInputTokens: number|null}} StatusPayloadUsage */
 /** @typedef {{index: number, total: number, argv: string}} VerificationProgress */
-/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, verdict: string|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null}} StatusPayloadNode */
+/** @typedef {{id: string, status: NodeStatus, phase: string|null, executionPhase: string|null, runtime: string|null, workerRuntime: string|null, continuation: string, attempt: number, revisions: number, startedAt: string|null, updatedAt: string|null, usage: StatusPayloadUsage|null, costUsd: number|null, verdict: string|null, gateOutcome: "passed"|"rejected"|null, pendingHandoff: {runtime: string, reason: string}|null, note: string|null, scopeFindings: string[]|null, errorCode: string|null, blockedBy: string[], verificationProgress: VerificationProgress|null, declaredReadBytes: number|null}} StatusPayloadNode */
 /** @typedef {{schemaVersion: 1, run: string, contractId: string, campaignId: string, goal: string, usage: {inputTokens: number, outputTokens: number, cacheReadInputTokens: number, costUsd: number|null}, roles: {worker: RoleUsage, judge: RoleUsage}, controller: JsonObject, identityWarnings: string[], summary: string, nodes: StatusPayloadNode[]}} StatusPayload */
 
 /** The glyph each terminal state prints in a status table. */
@@ -43,13 +43,11 @@ export const MARK = {
 };
 
 /**
- * `status <run-dir>`: everything the operator needs, in the same order as
- * the dashboard page (TECH-SPEC lean, section 4's last paragraph) —
- * needs-you, now, nodes, cost. Every cell comes from the same payload
- * `status --json` and the per-run `status.json` file emit
- * (`buildStatusPayload`); `nodes` and `identityWarnings` from `loadRun` are
- * used only for the two facts the payload does not carry: throwing on an
- * invalid persisted snapshot, and `controllerStatus`'s lock read.
+ * `status <run-dir>`: needs-you, now, nodes, cost, in the dashboard's order
+ * (TECH-SPEC lean, section 4's last paragraph). Every cell comes from the same
+ * payload `status --json` emits (`buildStatusPayload`); `nodes` and
+ * `identityWarnings` from `loadRun` cover only what the payload does not:
+ * throwing on an invalid snapshot, and `controllerStatus`'s lock read.
  *
  * @param {string} runDir
  * @returns {string}
@@ -75,7 +73,7 @@ export function renderStatus(runDir) {
   const widths = [3, 24, 9, 3, 28, 8, 6, 6, 6, 10, 9, MAX_NOTE_LENGTH];
   /** @type {(cells: unknown[]) => string} */
   const row = (cells) => cells.map((cell, i) => fit(String(cell ?? ""), widths[i])).join(" ");
-  lines.push("```", row(["", "NODE", "STATE", "TRY", "RUNTIME", "ELAPSED", "IN", "CACHE", "OUT", "USD", "VERDICT", "NOTE"]), row(widths.map((width) => "-".repeat(width))));
+  lines.push("```", row(["", "NODE", "STATE", "TRY", "RUNTIME", "ELAPSED", "IN", "CACHE", "OUT", "USD", "GATE", "NOTE"]), row(widths.map((width) => "-".repeat(width))));
   for (const node of payload.nodes) {
     lines.push(row([
       MARK[node.status] ?? "[?]",
@@ -88,7 +86,7 @@ export function renderStatus(runDir) {
       compactTokens(node.usage?.cacheReadInputTokens),
       compactTokens(node.usage?.outputTokens),
       compactCost(node.costUsd),
-      node.verdict ?? "-",
+      node.gateOutcome ?? "-",
       node.note ?? "-",
     ]));
   }
@@ -98,12 +96,10 @@ export function renderStatus(runDir) {
 }
 
 /**
- * The node the operator should look at right now, formatted the same way
- * the dashboard's now strip is (TECH-SPEC lean, section 4, item 1): the
- * active node's elapsed time and cost so far, or an idle line once every
- * node has settled. A node awaiting a controller verification command
- * appends which one, `k/n`, and its argv, so a minutes-long suite is not
- * silent between ticks.
+ * The node the operator should look at right now, formatted like the
+ * dashboard's now strip (TECH-SPEC lean, section 4, item 1): elapsed time and
+ * cost so far, or idle once every node has settled. A node awaiting a
+ * controller verification command appends which one, `k/n`, and its argv.
  *
  * @param {StatusPayload} payload
  * @param {number} now epoch ms
@@ -114,7 +110,8 @@ function nowLine(payload, now) {
   if (active) {
     const progress = active.verificationProgress;
     const verification = progress ? ` · verification ${progress.index}/${progress.total} · ${progress.argv}` : "";
-    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}`;
+    const candidate = !progress && active.executionPhase === "candidate" ? " · candidate verification" : "";
+    return `now: ${active.id} ${active.status} (${formatElapsed(active, now)}) · ${active.runtime ?? "-"} · ${compactCost(active.costUsd)}${verification}${candidate}`;
   }
   const allTerminal = payload.nodes.every((node) => SUCCESS.has(node.status));
   return allTerminal ? `now: idle · run done · ${compactCost(payload.usage.costUsd)}` : "now: idle";
@@ -134,6 +131,27 @@ function verificationProgress(node) {
   return verification?.progress ?? null;
 }
 
+/** Set by `verifyCandidateWorkspace` (engine/verify.mjs) for the run of the sealed candidate's own re-verification pass. @param {NodeSnapshot} node @returns {boolean} */
+function candidateVerificationActive(node) {
+  const verification = /** @type {{candidate?: boolean}|null|undefined} */ (node.verification);
+  return verification?.candidate === true;
+}
+
+/** `candidate` while re-verifying the sealed candidate, `verification` mid-attempt-verification, else the persisted phase; the two never overlap. @param {NodeSnapshot} node @returns {string|null} */
+function executionPhaseOf(node) {
+  if (candidateVerificationActive(node)) return "candidate";
+  if (verificationProgress(node)) return "verification";
+  return node.phase;
+}
+
+/** What the gate decided (independent of `verdict`: an advisory review or a below-threshold fail verdict still accepts the node, engine/review.mjs `applyJudgeResult`). @param {NodeSnapshot} node @returns {"passed"|"rejected"|null} */
+export function gateOutcome(node) {
+  if (!node.gate) return null;
+  if (SUCCESS.has(node.status)) return "passed";
+  if (node.status === "failed" || node.status === "exhausted") return "rejected";
+  return null;
+}
+
 /**
  * A node's wall-clock elapsed time: `startedAt` to `updatedAt` once it has
  * settled into a terminal state, `startedAt` to `now` while it is still
@@ -216,7 +234,7 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
         // A running controller verification command does not move
         // `node.phase` (it stays `worker`, the phase that dispatched it), so
         // the surface that shows it is computed here rather than persisted.
-        executionPhase: progress ? "verification" : node.phase,
+        executionPhase: executionPhaseOf(node),
         runtime: node.runtime ? `${node.runtime.harness}/${node.runtime.model}` : null,
         workerRuntime: workerRuntimeLabel(node),
         continuation: continuationMode(node),
@@ -227,6 +245,7 @@ function buildStatusPayload(runDir, contract, nodes, identityWarnings, usage) {
         usage: node.usage ? { inputTokens: node.usage.inputTokens ?? null, outputTokens: node.usage.outputTokens ?? null, cacheReadInputTokens: node.usage.cacheReadInputTokens ?? null } : null,
         costUsd: typeof node.costUsd === "number" ? node.costUsd : null,
         verdict: node.gate?.verdict ?? null,
+        gateOutcome: gateOutcome(node),
         pendingHandoff: pendingHandoff(node),
         note: statusNote(node),
         scopeFindings: node.scopeFindings?.unexpectedPaths ?? null,
@@ -256,16 +275,11 @@ function activeStatusNode(nodes) {
 }
 
 /**
- * The bounded pointer record written to `.runs/status.json`: enough for a
- * quick ambient read (statusline, a stale watcher) without opening the
- * per-run status.json. Bounded the same way heartbeat.json used to be, so a
- * cheap bounded read stays valid for any reader still built that way.
- * `generatedAt` is unix seconds, not ISO: the statusline's no-jq fallback has
- * no clock and only jq's builtin `now` can compute an age from a live clock,
- * and neither path needs a `date` process to read an integer. `elapsedSec`
- * is likewise precomputed here (as of `generatedAt`, not live) so the
- * statusline never has to subtract two timestamps to show it — it just
- * prints the integer, whichever reader it is.
+ * The bounded pointer record written to `.runs/status.json`, for a quick
+ * ambient read without opening the per-run status.json (bounded like the old
+ * heartbeat.json). `generatedAt` is unix seconds, not ISO, and `elapsedSec` is
+ * precomputed from it, since the no-jq statusline fallback has no clock to
+ * subtract two timestamps with.
  *
  * @param {JsonObject} payload the per-run status.json payload
  * @param {NodeSnapshot[]} nodes
@@ -340,10 +354,7 @@ export function writeStatusArtifacts(runDir, runsDir, contract, states) {
  */
 export function controllerStatus(runDir, nodes) {
   const lock = readLock(runDir);
-  // The heartbeat's `at` is the live tick, so a working controller and a dead
-  // one are distinguishable on disk. Before this it was hard-coded null here
-  // and computed from node updates only once the lock was already stale, which
-  // is why all 47 recorded status.json files reported a null lastTick.
+  // The heartbeat's `at` distinguishes a working controller from a dead one on disk.
   const heartbeat = readHeartbeat(runDir);
   const lastTick = typeof heartbeat?.at === "string" ? heartbeat.at : null;
   if (!lock || /** @type {{invalid?: true}} */ (lock).invalid) {
@@ -473,14 +484,11 @@ export function renderFindings(runDir) {
 }
 
 /**
- * A node the worker itself stopped on, rendered as the repair it asks for.
- *
- * `findings` used to answer only gate exhaustion, and a run whose nodes all
- * stopped on `blocked_context` reported nothing to act on while the workers
- * had each named exactly what they needed — measured on a four-node campaign
- * where three nodes were blocked and the command printed one line saying so.
- * The question is already structured, so the repair is mechanical: put the
- * named paths in the packet's `readFiles` and take a new run id.
+ * A node the worker itself stopped on, rendered as the repair it asks for:
+ * `findings` used to answer only gate exhaustion, so a run whose nodes all
+ * stopped on `blocked_context` reported nothing to act on (measured on a
+ * four-node campaign with three nodes blocked). The repair is mechanical: put
+ * the named paths in the packet's `readFiles` and take a new run id.
  *
  * @param {NodeSnapshot} node
  * @returns {string|null}
@@ -553,16 +561,11 @@ function continuationMode(node) {
 }
 
 /**
- * Who produced this node's work, for the RUNTIME column of both tables.
- *
- * `state.runtime` is the last runtime *dispatched*, and the judge dispatch
- * overwrites the worker's: every gated node that reached its gate therefore
- * reported its judge as the runtime, and a six-node campaign whose workers
- * were five different harnesses rendered as though three of them had never
- * run (measured 2026-09-13). The invocation ledger keeps both roles, so the
- * label is derived from it: the worker that ran, falling back to the live
- * runtime for a node that has not dispatched one yet. The judge is not lost —
- * it owns the VERDICT column, and `nowLine` still names whatever is running.
+ * Who produced this node's work, for the RUNTIME column: `state.runtime` is
+ * the last runtime *dispatched*, and the judge dispatch overwrites the
+ * worker's (measured 2026-09-13: a six-harness campaign rendered as though
+ * three workers never ran), so this reads the invocation ledger for the
+ * worker that ran, falling back to the live runtime if none dispatched yet.
  *
  * @param {NodeSnapshot} node
  * @returns {string|null}
@@ -633,7 +636,7 @@ function boundedNote(segments, maxLength = MAX_NOTE_LENGTH) {
 export function statusNote(node) {
   const scope = scopeFindingsNote(node.scopeFindings);
   const review = reviewNote(node);
-  const detail = node.gate?.summary ?? node.error?.message ?? node.blockedBy?.join(", ") ?? node.phase;
+  const detail = node.gate?.summary ?? node.error?.message ?? node.blockedBy?.join(", ") ?? (candidateVerificationActive(node) ? "candidate" : node.phase);
   const note = boundedNote([review, detail]);
   if (!scope) return note;
   return boundedNote([scope, note]);
@@ -657,13 +660,10 @@ function nodeNote(node) {
 /** @typedef {{costUsd: number|null, status: "known"|"estimated"|"ambiguous"}} CostProjection */
 
 /**
- * Per-role usage from the invocation ledger alone, with the provenance that
- * says whether the role's cost total is honest. A role whose invocations all
- * carry a provider cost is `priced` and its `costUsd` is the sum; a role with
- * any unpriced invocation is `partial` (some priced) or `unpriced` (none), and
- * its `costUsd` stays null rather than summing the known half and understating
- * it. A role with no invocation is `none`. Token totals are always carried, so
- * a role the provider would not price still reads as work.
+ * Per-role usage from the invocation ledger, with provenance for whether the
+ * cost total is honest: `priced` (all invocations costed), `partial`/`unpriced`
+ * (some/none costed, so `costUsd` stays null rather than understating), or
+ * `none` (no invocation). Token totals are always carried.
  *
  * @param {NodeSnapshot[]} nodes
  * @returns {{worker: RoleUsage, judge: RoleUsage}}

package/src/web/index.html

@@ -185,18 +185,18 @@ function tabBodyHtml(tab, detail) {
 function drawerHtml(drawer, tab) {
   if (!drawer) return `<section id="drawer"><h2>Run drawer</h2><div class="card" style="padding:16px 18px"><p class="empty">select a run above</p></div></section>`;
   const rows = drawer.nodes.map((node) => `<tr class="clickable ${node.id === drawer.selectedNodeId ? "selected" : ""}" data-node="${esc(node.id)}">
-    <td>${pill(node.status)}</td>
+    <td>${pill(node.status)}${node.executionPhase === "candidate" ? ` <span class="dim">· candidate verification</span>` : node.executionPhase === "verification" ? ` <span class="dim">· verification</span>` : ""}</td>
     <td class="mono">${esc(node.id)}</td>
     <td class="num">${node.attempt}</td>
     <td class="mono">${esc(node.model ?? "–")}</td>
     <td class="num">${fmtDur(node.elapsedMs)}</td>
     <td class="num">${fmtUsd(node.costUsd)}</td>
-    <td>${node.verdict ? pill(node.verdict) : ""}</td>
+    <td>${node.gateOutcome ? pill(node.gateOutcome) : ""}</td>
     <td class="goal" title="${esc(node.note ?? "")}">${esc(node.note ?? "")}</td>
   </tr>`).join("");
   const tabs = TABS.map(([key, label]) => `<button data-tab="${key}" class="${tab === key ? "active" : ""}">${esc(label)}</button>`).join("");
   return `<section id="drawer"><h2>Run drawer · ${esc(drawer.runId)}</h2><div class="card" style="padding:16px 18px">
-    <table><thead><tr><th>state</th><th>node</th><th>try</th><th>model</th><th>elapsed</th><th>USD</th><th>verdict</th><th>note</th></tr></thead>
+    <table><thead><tr><th>state</th><th>node</th><th>try</th><th>model</th><th>elapsed</th><th>USD</th><th>gate</th><th>note</th></tr></thead>
     <tbody>${rows}</tbody></table>
     <div class="tabs">${tabs}</div>
     <div id="tabbody">${tabBodyHtml(tab, drawer.detail)}</div>

package/src/web/server.mjs

@@ -294,7 +294,8 @@ function nodeRow(runDir, statusNode) {
     model: node.runtime?.model ?? null,
     elapsedMs: elapsedMsBetween(node.startedAt, closed ? node.updatedAt : null),
     costUsd: typeof node.costUsd === "number" ? node.costUsd : null,
-    verdict: node.gate?.verdict ?? null,
+    gateOutcome: statusNode.gateOutcome ?? null,
+    executionPhase: statusNode.executionPhase ?? null,
     note: statusNode.note ?? null,
     errorCode: statusNode.errorCode ?? null,
     blockedBy: statusNode.blockedBy ?? [],