diff --git a/checkpoint.json b/checkpoint.json
index 22d5beb26..2c7b12b51 100644
--- a/checkpoint.json
+++ b/checkpoint.json
@@ -1,11 +1,13 @@
 {
-  "timestamp": "2026-03-19T15:17:06.997761Z",
-  "current_node": "toolchain",
+  "timestamp": "2026-03-19T15:18:21.134057Z",
+  "current_node": "preflight_compile",
   "completed_nodes": [
     "start",
-    "toolchain"
+    "toolchain",
+    "preflight_compile"
   ],
   "node_retries": {
+    "preflight_compile": 1,
     "start": 1,
     "toolchain": 1
   },
@@ -13,20 +15,22 @@
     "thread.start.current_node": "toolchain",
     "internal.fidelity": "compact",
     "failure_signature": "",
-    "command.output": "cargo 1.94.0 (85eff7c80 2026-01-15)\n",
+    "command.output": "",
+    "internal.retry_count.preflight_compile": 1,
     "outcome": "success",
     "internal.retry_count.start": 1,
     "failure_class": "",
-    "current.preamble": "Goal: # Plan: `fabro provider login` command\n\n## Context\n\nOpenAI OAuth PKCE login is currently only available during the `fabro install` wizard. Users need a way to re-authenticate with providers after initial setup — e.g., when tokens expire or they want to switch accounts. This adds `fabro provider login --provider <name>` as a standalone command. OpenAI gets the browser OAuth flow; all other providers get an API key prompt with validation.\n\n## Changes\n\n### 1. Extract shared auth helpers from `install.rs` into `provider_auth.rs`\n\n**New file:** `lib/crates/fabro-cli/src/provider_auth.rs`\n\nMove these functions from `install.rs` (make them `pub(crate)`):\n- `provider_display_name()` (line 220)\n- `provider_key_url()` (line 206)\n- `openai_oauth_env_pairs()` (line 248)\n- `write_env_file()` (line 537)\n- `validate_api_key()` (line 901)\n- `prompt_and_validate_key()` (line 926) — also needs `prompt_password()` (line 288) and `prompt_confirm()` (line 270)\n\nMove associated tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`).\n\n**Modify:** `lib/crates/fabro-cli/src/install.rs` — replace moved functions with `use crate::provider_auth::*`.\n\n### 2. Create command module\n\n**New file:** `lib/crates/fabro-cli/src/commands/provider.rs`\n\n```\nProviderLoginArgs {\n    #[arg(long)]\n    provider: Provider,   // Provider already implements FromStr\n}\n```\n\n`login_command(args)`:\n- If `provider == OpenAi`: prompt \"Log in via browser (OAuth)?\", run `fabro_openai_oauth::run_browser_flow()`, fall back to API key on failure/decline\n- Otherwise: call `prompt_and_validate_key()`\n- Write credentials via `write_env_file()` (merge semantics, non-destructive)\n\n### 3. Wire into CLI\n\n**Modify:** `lib/crates/fabro-cli/src/commands/mod.rs` — add `pub mod provider;`\n\n**Modify:** `lib/crates/fabro-cli/src/main.rs`:\n- Add `mod provider_auth;`\n- Add `ProviderCommand` enum with `Login(commands::provider::ProviderLoginArgs)`\n- Add `Command::Provider { command: ProviderCommand }` variant (doc: \"Provider operations\")\n- Add dispatch arm and `command_name` arm (\"provider login\")\n\nNo Cargo.toml changes needed — all deps already present.\n\n## Files changed\n\n| File | Action |\n|------|--------|\n| `lib/crates/fabro-cli/src/provider_auth.rs` | New — shared auth helpers |\n| `lib/crates/fabro-cli/src/commands/provider.rs` | New — login command |\n| `lib/crates/fabro-cli/src/commands/mod.rs` | Add `pub mod provider;` |\n| `lib/crates/fabro-cli/src/main.rs` | Add module, enum, variant, dispatch |\n| `lib/crates/fabro-cli/src/install.rs` | Remove extracted functions, import from `provider_auth` |\n\n## Implementation approach: Red/Green TDD\n\nWork in small cycles: write a failing test, then write the minimum code to make it pass.\n\n### Cycle 1: Extract `provider_auth.rs` — tests pass after move\n1. **Red**: Move tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`) to a new `provider_auth.rs` — they fail because the functions aren't there yet\n2. **Green**: Move the functions (`provider_display_name`, `provider_key_url`, `openai_oauth_env_pairs`, `write_env_file`, `validate_api_key`, `prompt_and_validate_key`, `prompt_password`, `prompt_confirm`) from `install.rs` to `provider_auth.rs`, update `install.rs` to import them\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 2: Wire `ProviderCommand` into clap — command is recognized\n1. **Red**: Add a test that parses `[\"provider\", \"login\", \"--provider\", \"openai\"]` via `Cli::try_parse_from` — fails because the command doesn't exist\n2. **Green**: Add `ProviderCommand` enum, `Command::Provider` variant, `ProviderLoginArgs` struct, empty `login_command`, dispatch arm, `command_name` arm, `commands/mod.rs` entry\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 3: Clap rejects bad input\n1. **Red**: Add tests that `[\"provider\", \"login\"]` (missing --provider) and `[\"provider\", \"login\", \"--provider\", \"bogus\"]` both fail to parse\n2. **Green**: Should already pass from cycle 2 (clap handles this). If not, adjust args.\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 4: Implement `login_command` for non-OpenAI providers\n1. **Green**: Implement the API-key path in `login_command` — call `prompt_and_validate_key()` and `write_env_file()`\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider anthropic`\n\n### Cycle 5: Implement `login_command` for OpenAI OAuth\n1. **Green**: Add OpenAI branch — prompt for OAuth, run `run_browser_flow()`, fallback to API key\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider openai`\n\n### Final verification\n1. `cargo test --workspace`\n2. `cargo clippy --workspace -- -D warnings`\n3. `cargo fmt --check --all`\n4. `fabro install` — still works end-to-end\n\n",
+    "current.preamble": "Goal: # Plan: `fabro provider login` command\n\n## Context\n\nOpenAI OAuth PKCE login is currently only available during the `fabro install` wizard. Users need a way to re-authenticate with providers after initial setup — e.g., when tokens expire or they want to switch accounts. This adds `fabro provider login --provider <name>` as a standalone command. OpenAI gets the browser OAuth flow; all other providers get an API key prompt with validation.\n\n## Changes\n\n### 1. Extract shared auth helpers from `install.rs` into `provider_auth.rs`\n\n**New file:** `lib/crates/fabro-cli/src/provider_auth.rs`\n\nMove these functions from `install.rs` (make them `pub(crate)`):\n- `provider_display_name()` (line 220)\n- `provider_key_url()` (line 206)\n- `openai_oauth_env_pairs()` (line 248)\n- `write_env_file()` (line 537)\n- `validate_api_key()` (line 901)\n- `prompt_and_validate_key()` (line 926) — also needs `prompt_password()` (line 288) and `prompt_confirm()` (line 270)\n\nMove associated tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`).\n\n**Modify:** `lib/crates/fabro-cli/src/install.rs` — replace moved functions with `use crate::provider_auth::*`.\n\n### 2. Create command module\n\n**New file:** `lib/crates/fabro-cli/src/commands/provider.rs`\n\n```\nProviderLoginArgs {\n    #[arg(long)]\n    provider: Provider,   // Provider already implements FromStr\n}\n```\n\n`login_command(args)`:\n- If `provider == OpenAi`: prompt \"Log in via browser (OAuth)?\", run `fabro_openai_oauth::run_browser_flow()`, fall back to API key on failure/decline\n- Otherwise: call `prompt_and_validate_key()`\n- Write credentials via `write_env_file()` (merge semantics, non-destructive)\n\n### 3. Wire into CLI\n\n**Modify:** `lib/crates/fabro-cli/src/commands/mod.rs` — add `pub mod provider;`\n\n**Modify:** `lib/crates/fabro-cli/src/main.rs`:\n- Add `mod provider_auth;`\n- Add `ProviderCommand` enum with `Login(commands::provider::ProviderLoginArgs)`\n- Add `Command::Provider { command: ProviderCommand }` variant (doc: \"Provider operations\")\n- Add dispatch arm and `command_name` arm (\"provider login\")\n\nNo Cargo.toml changes needed — all deps already present.\n\n## Files changed\n\n| File | Action |\n|------|--------|\n| `lib/crates/fabro-cli/src/provider_auth.rs` | New — shared auth helpers |\n| `lib/crates/fabro-cli/src/commands/provider.rs` | New — login command |\n| `lib/crates/fabro-cli/src/commands/mod.rs` | Add `pub mod provider;` |\n| `lib/crates/fabro-cli/src/main.rs` | Add module, enum, variant, dispatch |\n| `lib/crates/fabro-cli/src/install.rs` | Remove extracted functions, import from `provider_auth` |\n\n## Implementation approach: Red/Green TDD\n\nWork in small cycles: write a failing test, then write the minimum code to make it pass.\n\n### Cycle 1: Extract `provider_auth.rs` — tests pass after move\n1. **Red**: Move tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`) to a new `provider_auth.rs` — they fail because the functions aren't there yet\n2. **Green**: Move the functions (`provider_display_name`, `provider_key_url`, `openai_oauth_env_pairs`, `write_env_file`, `validate_api_key`, `prompt_and_validate_key`, `prompt_password`, `prompt_confirm`) from `install.rs` to `provider_auth.rs`, update `install.rs` to import them\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 2: Wire `ProviderCommand` into clap — command is recognized\n1. **Red**: Add a test that parses `[\"provider\", \"login\", \"--provider\", \"openai\"]` via `Cli::try_parse_from` — fails because the command doesn't exist\n2. **Green**: Add `ProviderCommand` enum, `Command::Provider` variant, `ProviderLoginArgs` struct, empty `login_command`, dispatch arm, `command_name` arm, `commands/mod.rs` entry\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 3: Clap rejects bad input\n1. **Red**: Add tests that `[\"provider\", \"login\"]` (missing --provider) and `[\"provider\", \"login\", \"--provider\", \"bogus\"]` both fail to parse\n2. **Green**: Should already pass from cycle 2 (clap handles this). If not, adjust args.\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 4: Implement `login_command` for non-OpenAI providers\n1. **Green**: Implement the API-key path in `login_command` — call `prompt_and_validate_key()` and `write_env_file()`\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider anthropic`\n\n### Cycle 5: Implement `login_command` for OpenAI OAuth\n1. **Green**: Add OpenAI branch — prompt for OAuth, run `run_browser_flow()`, fallback to API key\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider openai`\n\n### Final verification\n1. `cargo test --workspace`\n2. `cargo clippy --workspace -- -D warnings`\n3. `cargo fmt --check --all`\n4. `fabro install` — still works end-to-end\n\n\n## Completed stages\n- **toolchain**: success\n  - Script: `command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1`\n  - Stdout:\n    ```\n    cargo 1.94.0 (85eff7c80 2026-01-15)\n    ```\n  - Stderr: (empty)\n",
     "internal.node_visit_count": 1,
     "graph.model_stylesheet": "\n            * { backend: api; model: claude-opus-4-6;}\n        ",
-    "internal.thread_id": "start",
+    "internal.thread_id": "toolchain",
     "command.stderr": "",
     "graph.rankdir": "LR",
     "internal.retry_count.toolchain": 1,
+    "thread.toolchain.current_node": "preflight_compile",
     "graph.goal": "# Plan: `fabro provider login` command\n\n## Context\n\nOpenAI OAuth PKCE login is currently only available during the `fabro install` wizard. Users need a way to re-authenticate with providers after initial setup — e.g., when tokens expire or they want to switch accounts. This adds `fabro provider login --provider <name>` as a standalone command. OpenAI gets the browser OAuth flow; all other providers get an API key prompt with validation.\n\n## Changes\n\n### 1. Extract shared auth helpers from `install.rs` into `provider_auth.rs`\n\n**New file:** `lib/crates/fabro-cli/src/provider_auth.rs`\n\nMove these functions from `install.rs` (make them `pub(crate)`):\n- `provider_display_name()` (line 220)\n- `provider_key_url()` (line 206)\n- `openai_oauth_env_pairs()` (line 248)\n- `write_env_file()` (line 537)\n- `validate_api_key()` (line 901)\n- `prompt_and_validate_key()` (line 926) — also needs `prompt_password()` (line 288) and `prompt_confirm()` (line 270)\n\nMove associated tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`).\n\n**Modify:** `lib/crates/fabro-cli/src/install.rs` — replace moved functions with `use crate::provider_auth::*`.\n\n### 2. Create command module\n\n**New file:** `lib/crates/fabro-cli/src/commands/provider.rs`\n\n```\nProviderLoginArgs {\n    #[arg(long)]\n    provider: Provider,   // Provider already implements FromStr\n}\n```\n\n`login_command(args)`:\n- If `provider == OpenAi`: prompt \"Log in via browser (OAuth)?\", run `fabro_openai_oauth::run_browser_flow()`, fall back to API key on failure/decline\n- Otherwise: call `prompt_and_validate_key()`\n- Write credentials via `write_env_file()` (merge semantics, non-destructive)\n\n### 3. Wire into CLI\n\n**Modify:** `lib/crates/fabro-cli/src/commands/mod.rs` — add `pub mod provider;`\n\n**Modify:** `lib/crates/fabro-cli/src/main.rs`:\n- Add `mod provider_auth;`\n- Add `ProviderCommand` enum with `Login(commands::provider::ProviderLoginArgs)`\n- Add `Command::Provider { command: ProviderCommand }` variant (doc: \"Provider operations\")\n- Add dispatch arm and `command_name` arm (\"provider login\")\n\nNo Cargo.toml changes needed — all deps already present.\n\n## Files changed\n\n| File | Action |\n|------|--------|\n| `lib/crates/fabro-cli/src/provider_auth.rs` | New — shared auth helpers |\n| `lib/crates/fabro-cli/src/commands/provider.rs` | New — login command |\n| `lib/crates/fabro-cli/src/commands/mod.rs` | Add `pub mod provider;` |\n| `lib/crates/fabro-cli/src/main.rs` | Add module, enum, variant, dispatch |\n| `lib/crates/fabro-cli/src/install.rs` | Remove extracted functions, import from `provider_auth` |\n\n## Implementation approach: Red/Green TDD\n\nWork in small cycles: write a failing test, then write the minimum code to make it pass.\n\n### Cycle 1: Extract `provider_auth.rs` — tests pass after move\n1. **Red**: Move tests from `install.rs` (`openai_oauth_env_pairs_*`, `every_provider_has_key_url`) to a new `provider_auth.rs` — they fail because the functions aren't there yet\n2. **Green**: Move the functions (`provider_display_name`, `provider_key_url`, `openai_oauth_env_pairs`, `write_env_file`, `validate_api_key`, `prompt_and_validate_key`, `prompt_password`, `prompt_confirm`) from `install.rs` to `provider_auth.rs`, update `install.rs` to import them\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 2: Wire `ProviderCommand` into clap — command is recognized\n1. **Red**: Add a test that parses `[\"provider\", \"login\", \"--provider\", \"openai\"]` via `Cli::try_parse_from` — fails because the command doesn't exist\n2. **Green**: Add `ProviderCommand` enum, `Command::Provider` variant, `ProviderLoginArgs` struct, empty `login_command`, dispatch arm, `command_name` arm, `commands/mod.rs` entry\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 3: Clap rejects bad input\n1. **Red**: Add tests that `[\"provider\", \"login\"]` (missing --provider) and `[\"provider\", \"login\", \"--provider\", \"bogus\"]` both fail to parse\n2. **Green**: Should already pass from cycle 2 (clap handles this). If not, adjust args.\n3. **Verify**: `cargo test -p fabro-cli`\n\n### Cycle 4: Implement `login_command` for non-OpenAI providers\n1. **Green**: Implement the API-key path in `login_command` — call `prompt_and_validate_key()` and `write_env_file()`\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider anthropic`\n\n### Cycle 5: Implement `login_command` for OpenAI OAuth\n1. **Green**: Add OpenAI branch — prompt for OAuth, run `run_browser_flow()`, fallback to API key\n2. **Verify**: `cargo build --workspace` compiles, manual test `fabro provider login --provider openai`\n\n### Final verification\n1. `cargo test --workspace`\n2. `cargo clippy --workspace -- -D warnings`\n3. `cargo fmt --check --all`\n4. `fabro install` — still works end-to-end\n",
     "internal.run_id": "01KM3AQQTAGGN504HP2FNQXP6A",
-    "current_node": "toolchain"
+    "current_node": "preflight_compile"
   },
   "logs": [],
   "node_outcomes": {
@@ -34,6 +38,15 @@
       "status": "success",
       "duration_ms": 0
     },
+    "preflight_compile": {
+      "status": "success",
+      "context_updates": {
+        "command.stderr": "",
+        "command.output": ""
+      },
+      "notes": "Script completed: cargo check -q --workspace 2>&1",
+      "duration_ms": 71183
+    },
     "toolchain": {
       "status": "success",
       "context_updates": {
@@ -44,8 +57,9 @@
       "duration_ms": 89
     }
   },
-  "next_node_id": "preflight_compile",
+  "next_node_id": "preflight_lint",
   "node_visits": {
+    "preflight_compile": 1,
     "start": 1,
     "toolchain": 1
   }
diff --git a/nodes/preflight_compile/script_invocation.json b/nodes/preflight_compile/script_invocation.json
new file mode 100644
index 000000000..ccbef36c7
--- /dev/null
+++ b/nodes/preflight_compile/script_invocation.json
@@ -0,0 +1,5 @@
+{
+  "command": "cargo check -q --workspace 2>&1",
+  "language": "shell",
+  "timeout_ms": null
+}
\ No newline at end of file
diff --git a/nodes/preflight_compile/script_timing.json b/nodes/preflight_compile/script_timing.json
new file mode 100644
index 000000000..6ad945291
--- /dev/null
+++ b/nodes/preflight_compile/script_timing.json
@@ -0,0 +1,5 @@
+{
+  "duration_ms": 71172,
+  "exit_code": 0,
+  "timed_out": false
+}
\ No newline at end of file
diff --git a/nodes/preflight_compile/status.json b/nodes/preflight_compile/status.json
new file mode 100644
index 000000000..433bdc05b
--- /dev/null
+++ b/nodes/preflight_compile/status.json
@@ -0,0 +1,6 @@
+{
+  "status": "success",
+  "notes": "Script completed: cargo check -q --workspace 2>&1",
+  "failure_reason": null,
+  "timestamp": "2026-03-19T15:18:21.133724+00:00"
+}
\ No newline at end of file