- provider_context.py: require_model() resolves the model from the
ambient provider context; missing context fails LOUDLY
(PROVIDER_UNRESOLVED, exit 3) — no silent default provider anywhere.
- t14/t15 builder drivers, evidence_probe, research executor/relay:
hardcoded 'Verboo Code/glm-5.3-flash' defaults REMOVED (6+ sites);
provider/model selection now belongs exclusively to the provider
layer via the ambient context. No caller anywhere set MIMO_MODEL —
every run silently used the code-chosen provider until now.
- failure_recovery: PROVIDER_UNAVAILABLE class (context-forced; real
status/API code preserved verbatim in evidence; policy
block_branch_preserve_error, 0 retries, no fallback — 16G-D).
- tests/test_provider_ownership.py: structural guard (provider names
in Scaffolding code lines fail the suite; module list live-discovered)
+ 16G held-outs (verbatim codes, zero fallback attempts, resumable
after block, provider preference never mutates scaffold truth).
- 16U root-cause completion: pyright skew 117⇄124 driven by ambient
VIRTUAL_ENV/PATH leakage into pyright's interpreter resolution —
the ratchet now neutralizes ambient-venv signals (PYTHONNOUSERSITE
was necessary but not sufficient; reproduced and closed).
- spine reconciliation: T15 modules (event_wait, stage_guards,
failure_recovery, programme_continuation) were missing belongs_to
relationships in the tracked store while the generated manifest had
them — registered with SCAFFOLD-TRANCHE-015 evidence; provider_context
registered under capability; manifest regenerated via export-umbrellas.
Suite 1869 green; ratchets PASS; Henxels rc=0.
ConstructionInterface.discover_active_contract: ONE canonical home for
fresh-builder resume discovery (per-project scaffolds + main store;
most-recent contract; pure readback). T14/T15 driver helpers are now
shims. capabilities() advertises the op. Held-out: empty store invents
nothing; seeded store discovers the right contract.
15S: breaking-change lifecycle held-out — old API + consumer governed
before change; verifying→migrating→superseding enforced by the phase
map; the old path survives as governed history (supersession is
lifecycle state, not erasure); BUILD NEW never destroys before migration.
15T: src/rune/failure_recovery.py — deterministic classification
(TRANSIENT/INTERMITTENT/KNOWN_PROCESS_DEFECT/PERMANENT/APPROVAL_
REQUIRED/UNKNOWN) with explicit retry budgets; PERMANENT/APPROVAL
never auto-retry; no infinite loops possible. 2 held-outs.
scripts/t15_builder_session.py: real model builder (mimo run/Verboo) under
the event notifier; driver YIELDS on the bridge FIFO (no polling on the
normal path); readiness canary before launch; exit canaries + 15G test
truth after; evidence-gated closure.
Live findings (recorded honestly):
- real model builds run 10-65 min — the 900s watchdog misfired twice as a
false PROCESS_LOST; root cause: (a) deadline < real build time, (b)
node builders re-group/detach children so pgid AND cmdline liveness
scans can miss the work. Repair: await_resume_event re-arms bounded on
liveness; the driver consults CANONICAL WAITSTORE STATE after watchdog
expiry — a recorded verdict means completion, process-table absence is
not truth (§15E canonical-state-wins).
- an orphaned T14-era builder process (old .mjs-scope prompt, quota-stuck)
was discovered polluting process checks — killed and recorded.
Result: contract closed from evidence; 10/10 node tests; both builder
exit events processed by the bridge (verdict success both runs).
Evidence: store/evidence/t15/.
Nick