@@ -2177,7 +2177,14 @@ std::optional<int> run_ninja_fast(const std::string& ninjaProgram,
     }
 
     std::optional<mcpp::build::schedule::detach::RunScope> compilerRun;
-    if (mcpp::build::read_schedule(ninjaPath) == "detach-codegen") {
+    // A graph whose compilers run through the capped executor replays inside a
+    // generation, as its first drive did.
+    const bool capped = [&] {
+        std::ifstream in(ninjaPath, std::ios::binary);
+        const std::string text{std::istreambuf_iterator<char>(in), {}};
+        return text.find(" __compiler-cap ") != std::string::npos;
+    }();
+    if (capped) {
         auto opened = mcpp::build::schedule::detach::RunScope::begin(outputDir);
         if (!opened) { mcpp::ui::error(opened.error()); return 1; }
         compilerRun.emplace(std::move(*opened));
 
@@ -1472,7 +1472,9 @@ std::string emit_ninja_string(const BuildPlan& plan, std::string* placements,
     // Ninja has extra slots for BMI publication and join edges. Ordinary
     // compilers must share the supervisors' semaphore rather than use that
     // larger slot count as their own concurrency bound.
-    const std::string compilerPrefix = splitBmi
+    // Every capped graph (2026.11.7.1): the executor also registers each
+    // compiler as a participant of the build's generation.
+    const std::string compilerPrefix = plan.scheduleCompilerCap > 0
         ? std::format("$mcpp __compiler-cap --sem .mcpp-sched --cap {} --output $out --depfile $out.d -- ", plan.scheduleCompilerCap)
         : std::string{};
     // The other split shape. Clang publishes no BMI early — it writes the BMI
@@ -4542,13 +4544,12 @@ std::expected<BuildResult, BuildError> NinjaBackend::build(const BuildPlan& plan
                                                       plan.outputDir.string(), ec.message()),
                                           plan.outputDir});
     std::optional<mcpp::build::schedule::detach::RunScope> compilerRun;
-    if (!opts.dryRun && plan.scheduleTag == "detach-codegen") {
+    if (!opts.dryRun && plan.scheduleCompilerCap > 0) {
         auto opened = mcpp::build::schedule::detach::RunScope::begin(plan.outputDir);
         if (!opened) return std::unexpected(BuildError{opened.error(), plan.outputDir});
         compilerRun.emplace(std::move(*opened));
-    }
-    if (!opts.dryRun && plan.scheduleTag == "detach-codegen")
         reclaim_stale_schedule_tokens(plan.outputDir);
+    }
 
     auto ninja_path = plan.outputDir / "build.ninja";
     // Written beside build.ninja and not into it: the fast path replays the
 
@@ -178,11 +178,27 @@ int resolve_jobs(const manifest::Manifest& m,
 // peaks near a gigabyte.
 Decision decide(const toolchain::Toolchain& tc, std::string_view requested, int hostJobs,
                 int autoJobs = 0);
+// The module-edge shape alone, before the generation's compiler cap is applied.
+Decision decide_shape(const toolchain::Toolchain& tc, std::string_view requested, int hostJobs,
+                      int autoJobs = 0);
 
 // ---------------------------------------------------------------------------
 
 Decision decide(const toolchain::Toolchain& tc, std::string_view requested, int hostJobs,
                 int autoJobs) {
+    Decision d = decide_shape(tc, requested, hostJobs, autoJobs);
+    // EVERY COMPILER OF A BUILD IS A PARTICIPANT OF ITS GENERATION (2026.11.7.1).
+    // Under every strategy a compile edge runs through the capped executor, so a
+    // later build does not enter the build directory while a compiler of an
+    // earlier one -- whose mcpp was killed -- still writes there (design
+    // 2026-11-07 §4.1.2). The cap is the strategy's, else the job count, else
+    // what this machine would choose.
+    if (d.compilerCap <= 0) d.compilerCap = hostJobs > 0 ? hostJobs : autoJobs;
+    return d;
+}
+
+Decision decide_shape(const toolchain::Toolchain& tc, std::string_view requested, int hostJobs,
+                      int autoJobs) {
     Decision d;
     const int cap = hostJobs > 0 ? hostJobs : 0;
 
 
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# requires: gcc
+# A BUILD WHOSE mcpp IS KILLED DOES NOT RACE THE NEXT ONE (2026.11.7.1, design
+# 2026-11-07 §4.1.2). Killing the mcpp that holds the build directory leaves
+# its compilers running. The next build waited only for the directory lock, so
+# it entered while those compilers still wrote BMIs and objects: 2026.11.5.1
+# failed 3 of 75 such rounds under the default schedule and 12 of 15 under the
+# split schedule. Every compiler is now a participant of its build's
+# generation, and the next build enters only after they end. Both schedules,
+# twelve rounds each: the waiting build succeeds and the build after it does
+# nothing.
+set -e
+MCPP="${MCPP:-mcpp}"
+TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
+make_project() {   # make_project <dir> <schedule>
+    mkdir -p "$1/src"
+    printf '[package]\nname = "kg"\nversion = "0.1.0"\nstandard = "c++23"\n[toolchain]\ndefault = "gcc@16.1.0"\n' > "$1/mcpp.toml"
+    [ "$2" = split ] && printf '[build]\nbmi_schedule = "on"\n' >> "$1/mcpp.toml"
+    for i in $(seq 1 24); do
+        printf 'export module m%d;\nimport std;\nexport int f%d(){ std::vector<int> v(%d); return (int)v.size(); }\n' "$i" "$i" "$i" > "$1/src/m$i.cppm"
+    done
+    { echo 'import std;'; for i in $(seq 1 24); do echo "import m$i;"; done
+      echo 'int main(){ std::println("{}", f1()+f24()); }'; } > "$1/src/main.cpp"
+}
+for schedule in default split; do
+    dir="$TMP/$schedule"; make_project "$dir" "$schedule"
+    ( cd "$dir" && "$MCPP" build > "$TMP/warm.log" 2>&1 ) || { cat "$TMP/warm.log"; exit 1; }
+    for round in $(seq 1 12); do
+        rm -rf "$dir/target"
+        ( cd "$dir" && exec "$MCPP" build > "$TMP/a.log" 2>&1 ) & a=$!
+        ( sleep 0.2; cd "$dir"; rc=0; "$MCPP" build > "$TMP/b.log" 2>&1 || rc=$?; echo "$rc" > "$TMP/b.rc" ) & b=$!
+        sleep 0.9; kill -9 "$a" 2>/dev/null || true; wait "$a" 2>/dev/null || true
+        wait "$b" || true
+        if [ "$(cat "$TMP/b.rc")" != 0 ]; then
+            echo "FAIL: $schedule round $round: the build after the killed one failed"; cat "$TMP/b.log"; exit 1
+        fi
+        ( cd "$dir" && "$MCPP" build > "$TMP/c.log" 2>&1 ) || { cat "$TMP/c.log"; exit 1; }
+        if grep -q "Compiling" "$TMP/c.log"; then
+            echo "FAIL: $schedule round $round: the following build compiled again"; cat "$TMP/c.log"; exit 1
+        fi
+        out=$(cd "$dir" && "$MCPP" run 2>/dev/null | tail -1)
+        [ "$out" = 25 ] || { echo "FAIL: $schedule round $round: the program printed '$out'"; exit 1; }
+    done
+    echo "OK: $schedule: 12 killed builds, each followed by a successful build and a no-op"
+done
@@ -15,6 +15,7 @@ import mcpp.manifest;
 
 using mcpp::build::schedule::Strategy;
 using mcpp::build::schedule::decide;
+using mcpp::build::schedule::decide_shape;
 using mcpp::build::schedule::requested_switch;
 using mcpp::toolchain::CompilerId;
 using mcpp::toolchain::Toolchain;
@@ -256,3 +257,16 @@ TEST(SchedulePolicy, EnvironmentBeatsManifestAndIsValidatedToo) {
         EXPECT_EQ(seen, "ON");
     }
 }
+
+// EVERY STRATEGY CAPS ITS COMPILERS (2026.11.7.1): the capped executor is what
+// registers a compiler in its build's generation, so a strategy without a split
+// still has a cap -- the job count, else what this machine would choose.
+TEST(SchedulePolicy, EveryStrategyCarriesACompilerCap) {
+    for (auto id : {CompilerId::GCC, CompilerId::Clang, CompilerId::MSVC, CompilerId::Unknown}) {
+        EXPECT_EQ(decide(with(id), "auto", 8).compilerCap, 8) << static_cast<int>(id);
+        EXPECT_EQ(decide(with(id), "off", 0, 6).compilerCap, 6) << static_cast<int>(id);
+    }
+    // The shape alone is unchanged: only the split strategies carry a cap there.
+    EXPECT_EQ(decide_shape(with(CompilerId::MSVC), "auto", 8).compilerCap, 0);
+}
+