@akagilnc/pi-workflow-roles 0.1.2169 → 0.1.2173

package/dist/public-cli/main.js

@@ -14505,6 +14505,9 @@ async function savePublicCliConfig(config, home = homedir()) {
 function setPersistentSeatConfig(config, seat, selection) {
   const previous = config.seats[seat];
   return {
+    // Spread preserves sibling top-level keys such as autoResumeLimit (#422):
+    // a seat write must never silently drop them.
+    ...config,
     seats: {
       ...config.seats,
       [seat]: {
@@ -14528,6 +14531,7 @@ function setPersistentSeatEngine(config, seat, engine) {
   if (engine === void 0) {
     const { engine: _dropped, ...modelOnly } = previous;
     return {
+      ...config,
       seats: {
         ...config.seats,
         [seat]: modelOnly
@@ -14535,12 +14539,24 @@ function setPersistentSeatEngine(config, seat, engine) {
     };
   }
   return {
+    ...config,
     seats: {
       ...config.seats,
       [seat]: { ...previous, engine }
     }
   };
 }
+function parseAutoResumeLimit(value) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new Error(
+      `auto-resume limit must be a non-negative integer, got ${JSON.stringify(value)}`
+    );
+  }
+  return value;
+}
+function setAutoResumeLimit(config, limit) {
+  return { ...config, autoResumeLimit: parseAutoResumeLimit(limit) };
+}
 function seatModelOnly(seat) {
   return seat.thinking === void 0 ? { provider: seat.provider, model: seat.model } : { provider: seat.provider, model: seat.model, thinking: seat.thinking };
 }
@@ -14610,8 +14626,15 @@ function parsePublicCliConfig(value) {
     throw new Error("public CLI config must be an object");
   }
   const record4 = value;
+  let autoResumeLimit;
+  if (record4.autoResumeLimit !== void 0) {
+    autoResumeLimit = parseAutoResumeLimit(record4.autoResumeLimit);
+  }
   if (record4.seats === void 0) {
-    return { seats: {} };
+    return {
+      seats: {},
+      ...autoResumeLimit === void 0 ? {} : { autoResumeLimit }
+    };
   }
   if (record4.seats === null || typeof record4.seats !== "object" || Array.isArray(record4.seats)) {
     throw new Error("public CLI config.seats must be an object");
@@ -14625,7 +14648,10 @@ function parsePublicCliConfig(value) {
     }
     seats[key] = parseSeatModelConfig(raw, key);
   }
-  return { seats };
+  return {
+    seats,
+    ...autoResumeLimit === void 0 ? {} : { autoResumeLimit }
+  };
 }
 function parseSeatModelConfig(value, seat) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -16470,11 +16496,13 @@ var init_option_definitions = __esm({
         usage: [
           "ak-role config set <seat> <provider/model[:thinking]> [<seat> <spec> ...]",
           "ak-role config set-engine <seat> <name>",
-          "ak-role config unset-engine <seat>"
+          "ak-role config unset-engine <seat>",
+          "ak-role config set-auto-resume-limit <N>"
         ],
         examples: [
           "ak-role config set judge openai-codex/gpt-5.6-sol:high",
-          "ak-role config set-engine judge opus"
+          "ak-role config set-engine judge opus",
+          "ak-role config set-auto-resume-limit 3"
         ]
       },
       help: {
@@ -22607,6 +22635,8 @@ function presentTerminal(terminal, io) {
   }
 }
 async function runWithAutoResumeLoop(options) {
+  const limit = options.autoResumeLimit ?? AUTO_RESUME_LIMIT;
+  parseAutoResumeLimit(limit);
   let autoResumeAttempts = 0;
   let isFirst = true;
   let currentExtraArgs = options.buildInitialArgs();
@@ -22636,7 +22666,7 @@ async function runWithAutoResumeLoop(options) {
       }
       return result2;
     }
-    if (autoResumeAttempts >= AUTO_RESUME_LIMIT) {
+    if (autoResumeAttempts >= limit) {
       if (terminal !== void 0) presentTerminal(terminal, options.io);
       return result2;
     }
@@ -22654,6 +22684,7 @@ var init_auto_resume = __esm({
   "src/public-cli/auto-resume.ts"() {
     "use strict";
     init_run_lifecycle();
+    init_config2();
     init_terminal();
     init_settlement();
     dummyIo = { stdout: () => {
@@ -22930,6 +22961,8 @@ async function runPublicCoder(argv, env, io, parseCoderArgv2) {
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () => buildCoderActivationExtraArgs(admitted, {
       packageRoot: env.packageRoot,
       ...env.model === void 0 ? {} : { model: env.model },
@@ -23814,6 +23847,8 @@ async function runPublicFixer(argv, env, io, parseFixerArgv2) {
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () => buildFixerActivationExtraArgs(admitted, {
       packageRoot: env.packageRoot,
       ...env.model === void 0 ? {} : { model: env.model },
@@ -24178,6 +24213,8 @@ async function runPublicJudge(argv, env, io, parseJudgeArgv2) {
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () => buildJudgeActivationExtraArgs(admitted, {
       packageRoot: env.packageRoot,
       ...env.model === void 0 ? {} : { model: env.model },
@@ -24625,6 +24662,8 @@ async function runPublicMerger(argv, env, io, parseMergerArgv2) {
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () => buildMergerActivationExtraArgs(admitted, {
       packageRoot: env.packageRoot,
       ...env.model === void 0 ? {} : { model: env.model },
@@ -25041,6 +25080,8 @@ async function runPublicReviewer(argv, env, io, parseReviewerArgv2) {
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () => buildReviewerActivationExtraArgs(admitted, {
       packageRoot: env.packageRoot,
       ...env.model === void 0 ? {} : { model: env.model },
@@ -27594,6 +27635,7 @@ function renderConfig(config) {
       lines.push(`${seat}	${formatModelSpec(selection)}	${engine}`);
     }
   }
+  lines.push(`autoResumeLimit	${config.autoResumeLimit ?? AUTO_RESUME_LIMIT}`);
   return `${lines.join("\n")}
 `;
 }
@@ -27687,6 +27729,30 @@ async function runConfigCommand(args, home, packageRoot2, io) {
     io.stdout(renderConfig(config));
     return 0;
   }
+  if (args[0] === "set-auto-resume-limit") {
+    if (args.length !== 2) {
+      throw new CliUsageError(
+        "usage: ak-role config set-auto-resume-limit <N>"
+      );
+    }
+    const raw = args[1];
+    if (!/^[0-9]+$/.test(raw)) {
+      throw new CliUsageError(
+        `auto-resume limit must be a non-negative integer, got ${raw}`
+      );
+    }
+    const converted = Number(raw);
+    if (!Number.isFinite(converted) || BigInt(converted) !== BigInt(raw)) {
+      throw new CliUsageError(
+        `auto-resume limit ${raw} is not exactly representable as a number; refusing to silently round the value`
+      );
+    }
+    let config = await loadAndValidateConfig(home, packageRoot2);
+    config = setAutoResumeLimit(config, converted);
+    await savePublicCliConfig(config, home);
+    io.stdout(renderConfig(config));
+    return 0;
+  }
   throw new CliUsageError(`unknown config subcommand: ${args[0]}`);
 }
 async function runAkRole(argv, env) {
@@ -27896,7 +27962,9 @@ async function runAkRole(argv, env) {
           ...projectSeatEngine(seat),
           ...env.judgeExtraPiArgs === void 0 ? {} : { extraPiArgs: env.judgeExtraPiArgs },
           ...env.judgeTimeoutMs === void 0 ? {} : { timeoutMs: env.judgeTimeoutMs },
-          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...config.autoResumeLimit === void 0 ? {} : { autoResumeLimit: config.autoResumeLimit }
         },
         io,
         PUBLIC_ROLE_ARGV.judge.parse
@@ -27931,7 +27999,9 @@ async function runAkRole(argv, env) {
           ...projectSeatEngine(seat),
           ...env.coderExtraPiArgs === void 0 ? {} : { extraPiArgs: env.coderExtraPiArgs },
           ...env.coderTimeoutMs === void 0 ? {} : { timeoutMs: env.coderTimeoutMs },
-          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...config.autoResumeLimit === void 0 ? {} : { autoResumeLimit: config.autoResumeLimit }
         },
         io,
         PUBLIC_ROLE_ARGV.coder.parse
@@ -27966,7 +28036,9 @@ async function runAkRole(argv, env) {
           ...projectSeatEngine(seat),
           ...env.fixerExtraPiArgs === void 0 ? {} : { extraPiArgs: env.fixerExtraPiArgs },
           ...env.fixerTimeoutMs === void 0 ? {} : { timeoutMs: env.fixerTimeoutMs },
-          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...config.autoResumeLimit === void 0 ? {} : { autoResumeLimit: config.autoResumeLimit }
         },
         io,
         PUBLIC_ROLE_ARGV.fixer.parse
@@ -28036,7 +28108,9 @@ async function runAkRole(argv, env) {
           ...projectSeatEngine(seat),
           ...env.reviewerExtraPiArgs === void 0 ? {} : { extraPiArgs: env.reviewerExtraPiArgs },
           ...env.reviewerTimeoutMs === void 0 ? {} : { timeoutMs: env.reviewerTimeoutMs },
-          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...config.autoResumeLimit === void 0 ? {} : { autoResumeLimit: config.autoResumeLimit }
         },
         io,
         PUBLIC_ROLE_ARGV.reviewer.parse
@@ -28106,7 +28180,9 @@ async function runAkRole(argv, env) {
           ...projectSeatEngine(seat),
           ...env.mergerExtraPiArgs === void 0 ? {} : { extraPiArgs: env.mergerExtraPiArgs },
           ...env.mergerTimeoutMs === void 0 ? {} : { timeoutMs: env.mergerTimeoutMs },
-          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId }
+          ...env.createRunId === void 0 ? {} : { createRunId: env.createRunId },
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...config.autoResumeLimit === void 0 ? {} : { autoResumeLimit: config.autoResumeLimit }
         },
         io,
         PUBLIC_ROLE_ARGV.merger.parse

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akagilnc/pi-workflow-roles",
-  "version": "0.1.2169",
+  "version": "0.1.2173",
   "description": "Soul-bound workflow roles for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/public-cli/auto-resume.ts

@@ -1,9 +1,12 @@
 /**
  * Single generic auto-resume loop for #416 (owner scope = single LLM call).
- * Call-local retries, at most AUTO_RESUME_LIMIT times, in-place (same runId/session).
+ * Call-local retries, at most the effective autoResumeLimit times (injected once
+ * per call by the caller, #422 — never re-read from disk inside the loop),
+ * in-place (same runId/session).
  * Unifies presentation: intermediate attempts use dummyIo, only final Terminal is presented.
  */
 import { AUTO_RESUME_LIMIT, isSessionPrincipalAvailable, acquireRunWriterLease, RunWriterLeaseHeldError, type RunWriterLease } from "./run-lifecycle.ts";
+import { parseAutoResumeLimit } from "./config.ts";
 import { isLawfulTypedTerminalOutcome, formatTerminalResult, type TerminalResult } from "./terminal.ts";
 import { presentFailureTerminal, presentStructuralRejection } from "./settlement.ts";
 import type { CliIo } from "./cli-io.ts";
@@ -26,10 +29,21 @@ export type AutoResumeDispatchResult = {
 export async function runWithAutoResumeLoop<T extends AutoResumeDispatchResult>(options: {
   admitted: { sessionFile: string; runDirectory: string };
   io: CliIo;
+  /**
+   * Effective ceiling (#422), resolved by the caller before the loop; never re-read
+   * per round. undefined = package default (AUTO_RESUME_LIMIT). Domain-validated at
+   * this single entry point (#422): NaN/negative/fractional/Infinity reject loudly
+   * before the first dispatch instead of silently bypassing the ceiling comparison.
+   */
+  autoResumeLimit?: number | undefined;
   buildInitialArgs: () => string[];
   buildResumeArgs: () => string[];
   dispatch: (extraArgs: string[], lease: RunWriterLease, isFirst: boolean, attemptIo: CliIo) => Promise<T>;
 }): Promise<T> {
+  // #422 single-point resolution + domain validation. NaN would bypass every
+  // `attempts >= limit` comparison (always false) — reject here, before any dispatch.
+  const limit = options.autoResumeLimit ?? AUTO_RESUME_LIMIT;
+  parseAutoResumeLimit(limit);
   let autoResumeAttempts = 0;
   let isFirst = true;
   let currentExtraArgs = options.buildInitialArgs();
@@ -64,7 +78,7 @@ export async function runWithAutoResumeLoop<T extends AutoResumeDispatchResult>(
       return result;
     }
 
-    if (autoResumeAttempts >= AUTO_RESUME_LIMIT) {
+    if (autoResumeAttempts >= limit) {
       if (terminal !== undefined) presentTerminal(terminal, options.io);
       return result;
     }

package/src/public-cli/cli.ts

@@ -17,6 +17,7 @@ import {
   parseModelSpec,
   resolveEffectiveSeat,
   savePublicCliConfig,
+  setAutoResumeLimit,
   setPersistentSeatConfig,
   setPersistentSeatEngine,
   validatePublicCliConfigEngines,
@@ -58,7 +59,7 @@ import { runPublicJudge, runPublicResume } from "./judge-run.ts";
 import { runPublicMerger, runPublicMergerResume } from "./merger-run.ts";
 import { runPublicReviewer, runPublicReviewerResume } from "./reviewer-run.ts";
 import { runPublicTaishi } from "./taishi-run.ts";
-import { peekRoleRunRole } from "./run-lifecycle.ts";
+import { AUTO_RESUME_LIMIT, peekRoleRunRole } from "./run-lifecycle.ts";
 import {
   AUTOMATIC_NAVIGATOR_SEAT,
   INTERNAL_ROLE_ENTRYPOINT_RELATIVE,
@@ -527,6 +528,8 @@ function renderConfig(config: PublicCliConfig): string {
       lines.push(`${seat}\t${formatModelSpec(selection)}\t${engine}`);
     }
   }
+  // #422: show the effective auto-resume ceiling (configured value or default).
+  lines.push(`autoResumeLimit\t${config.autoResumeLimit ?? AUTO_RESUME_LIMIT}`);
   return `${lines.join("\n")}\n`;
 }
 
@@ -631,6 +634,39 @@ async function runConfigCommand(
     return 0;
   }
 
+  // #422: standalone verb per the set-engine/unset-engine precedent — the
+  // existing `config set` grammar stays strictly even-position seat/spec pairs.
+  if (args[0] === "set-auto-resume-limit") {
+    if (args.length !== 2) {
+      throw new CliUsageError(
+        "usage: ak-role config set-auto-resume-limit <N>",
+      );
+    }
+    const raw = args[1]!;
+    if (!/^[0-9]+$/.test(raw)) {
+      throw new CliUsageError(
+        `auto-resume limit must be a non-negative integer, got ${raw}`,
+      );
+    }
+    // #422 fidelity boundary (not an upper bound — ADR 0035 stays intact): the
+    // persisted representation is a JS number, and Number() silently rounds
+    // integers beyond 2^53-1 (e.g. 9007199254740993 → 9007199254740992). Refuse
+    // loudly instead of persisting a different N; every exactly-representable
+    // non-negative integer remains legal. The regex above guarantees pure
+    // digits, so BigInt(raw) has no leading-zero ambiguity.
+    const converted = Number(raw);
+    if (!Number.isFinite(converted) || BigInt(converted) !== BigInt(raw)) {
+      throw new CliUsageError(
+        `auto-resume limit ${raw} is not exactly representable as a number; refusing to silently round the value`,
+      );
+    }
+    let config = await loadAndValidateConfig(home, packageRoot);
+    config = setAutoResumeLimit(config, converted);
+    await savePublicCliConfig(config, home);
+    io.stdout(renderConfig(config));
+    return 0;
+  }
+
   throw new CliUsageError(`unknown config subcommand: ${args[0]}`);
 }
 
@@ -922,6 +958,10 @@ export async function runAkRole(
             ? {}
             : { timeoutMs: env.judgeTimeoutMs }),
           ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...(config.autoResumeLimit === undefined
+            ? {}
+            : { autoResumeLimit: config.autoResumeLimit }),
         },
         io,
         PUBLIC_ROLE_ARGV.judge.parse,
@@ -966,6 +1006,10 @@ export async function runAkRole(
             ? {}
             : { timeoutMs: env.coderTimeoutMs }),
           ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...(config.autoResumeLimit === undefined
+            ? {}
+            : { autoResumeLimit: config.autoResumeLimit }),
         },
         io,
         PUBLIC_ROLE_ARGV.coder.parse,
@@ -1010,6 +1054,10 @@ export async function runAkRole(
             ? {}
             : { timeoutMs: env.fixerTimeoutMs }),
           ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...(config.autoResumeLimit === undefined
+            ? {}
+            : { autoResumeLimit: config.autoResumeLimit }),
         },
         io,
         PUBLIC_ROLE_ARGV.fixer.parse,
@@ -1098,6 +1146,10 @@ export async function runAkRole(
             ? {}
             : { timeoutMs: env.reviewerTimeoutMs }),
           ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...(config.autoResumeLimit === undefined
+            ? {}
+            : { autoResumeLimit: config.autoResumeLimit }),
         },
         io,
         PUBLIC_ROLE_ARGV.reviewer.parse,
@@ -1186,6 +1238,10 @@ export async function runAkRole(
             ? {}
             : { timeoutMs: env.mergerTimeoutMs }),
           ...(env.createRunId === undefined ? {} : { createRunId: env.createRunId }),
+          // #422: effective auto-resume ceiling resolved once here; the loop never re-reads disk.
+          ...(config.autoResumeLimit === undefined
+            ? {}
+            : { autoResumeLimit: config.autoResumeLimit }),
         },
         io,
         PUBLIC_ROLE_ARGV.merger.parse,

package/src/public-cli/coder-run.ts

@@ -86,6 +86,8 @@ export type CoderRunEnv = {
   engine?: string;
   credentials?: CredentialProviders;
   createRunId?: () => string;
+  /** #422: effective single-call auto-resume ceiling; undefined = package default (AUTO_RESUME_LIMIT). */
+  autoResumeLimit?: number;
   extraPiArgs?: readonly string[];
   timeoutMs?: number;
 };
@@ -475,6 +477,8 @@ export async function runPublicCoder(
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () =>
       buildCoderActivationExtraArgs(admitted, {
         packageRoot: env.packageRoot,

package/src/public-cli/config.ts

@@ -33,6 +33,13 @@ export type PersistentSeatConfig = SeatModelConfig & {
 
 export type PublicCliConfig = {
   seats: Partial<Record<PublicConfigurableSeat, PersistentSeatConfig>>;
+  /**
+   * #422: single-call auto-resume retry ceiling, sibling of `seats`.
+   * Non-negative integer; 0 disables auto-resume (one dispatch per call).
+   * undefined = package default (AUTO_RESUME_LIMIT). No package-local upper
+   * bound (ADR 0035).
+   */
+  autoResumeLimit?: number;
 };
 
 export type EffectiveSource = "persistent" | "startup" | "invocation" | "unconfigured";
@@ -108,6 +115,9 @@ export function setPersistentSeatConfig(
 ): PublicCliConfig {
   const previous = config.seats[seat];
   return {
+    // Spread preserves sibling top-level keys such as autoResumeLimit (#422):
+    // a seat write must never silently drop them.
+    ...config,
     seats: {
       ...config.seats,
       [seat]: {
@@ -146,6 +156,7 @@ export function setPersistentSeatEngine(
   if (engine === undefined) {
     const { engine: _dropped, ...modelOnly } = previous;
     return {
+      ...config,
       seats: {
         ...config.seats,
         [seat]: modelOnly,
@@ -155,6 +166,7 @@ export function setPersistentSeatEngine(
   // Engine-name path-safety syntax is owned solely by assertLegalEngineName
   // (call-request + config-parse seams). Setter is pure seat mutation.
   return {
+    ...config,
     seats: {
       ...config.seats,
       [seat]: { ...previous, engine },
@@ -162,6 +174,32 @@ export function setPersistentSeatEngine(
   };
 }
 
+/**
+ * #422 value domain authority for the auto-resume ceiling: non-negative integer,
+ * no package-local upper bound (ADR 0035). `0` is legal and means auto-resume is
+ * disabled (a single dispatch, no in-place retry). Negative numbers, fractions,
+ * NaN, Infinity and non-number types are rejected loudly — never silently coerced.
+ */
+export function parseAutoResumeLimit(value: unknown): number {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 0) {
+    throw new Error(
+      `auto-resume limit must be a non-negative integer, got ${JSON.stringify(value)}`,
+    );
+  }
+  return value;
+}
+
+/**
+ * #422: set the persistent autoResumeLimit top-level key. Pure mutation that
+ * preserves all sibling keys (seats included).
+ */
+export function setAutoResumeLimit(
+  config: PublicCliConfig,
+  limit: number,
+): PublicCliConfig {
+  return { ...config, autoResumeLimit: parseAutoResumeLimit(limit) };
+}
+
 /** Strip optional engine so activation model argv never sees the engine axis. */
 export function seatModelOnly(seat: PersistentSeatConfig): SeatModelConfig {
   return seat.thinking === undefined
@@ -261,9 +299,18 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new Error("public CLI config must be an object");
   }
-  const record = value as { seats?: unknown };
+  const record = value as { seats?: unknown; autoResumeLimit?: unknown };
+  // #422 round-trip preservation: the sibling top-level key must survive every
+  // parse→save cycle; an unknown-key drop would silently erase it on any write.
+  let autoResumeLimit: number | undefined;
+  if (record.autoResumeLimit !== undefined) {
+    autoResumeLimit = parseAutoResumeLimit(record.autoResumeLimit);
+  }
   if (record.seats === undefined) {
-    return { seats: {} };
+    return {
+      seats: {},
+      ...(autoResumeLimit === undefined ? {} : { autoResumeLimit }),
+    };
   }
   if (
     record.seats === null ||
@@ -281,7 +328,10 @@ function parsePublicCliConfig(value: unknown): PublicCliConfig {
     }
     seats[key as PublicConfigurableSeat] = parseSeatModelConfig(raw, key);
   }
-  return { seats };
+  return {
+    seats,
+    ...(autoResumeLimit === undefined ? {} : { autoResumeLimit }),
+  };
 }
 
 function parseSeatModelConfig(value: unknown, seat: string): PersistentSeatConfig {

package/src/public-cli/fixer-run.ts

@@ -89,6 +89,8 @@ export type FixerRunEnv = {
   engine?: string;
   credentials?: CredentialProviders;
   createRunId?: () => string;
+  /** #422: effective single-call auto-resume ceiling; undefined = package default (AUTO_RESUME_LIMIT). */
+  autoResumeLimit?: number;
   extraPiArgs?: readonly string[];
   timeoutMs?: number;
 };
@@ -494,6 +496,8 @@ export async function runPublicFixer(
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () =>
       buildFixerActivationExtraArgs(admitted, {
         packageRoot: env.packageRoot,

package/src/public-cli/judge-run.ts

@@ -89,6 +89,8 @@ export type JudgeRunEnv = {
    */
   credentials?: CredentialProviders;
   createRunId?: () => string;
+  /** #422: effective single-call auto-resume ceiling; undefined = package default (AUTO_RESUME_LIMIT). */
+  autoResumeLimit?: number;
   /** Extra Pi args inserted before the prompt (tests: faux provider extension). */
   extraPiArgs?: readonly string[];
   /** Override default role-run timeout. */
@@ -463,6 +465,8 @@ export async function runPublicJudge(
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () =>
       buildJudgeActivationExtraArgs(admitted, {
         packageRoot: env.packageRoot,

package/src/public-cli/merger-run.ts

@@ -90,6 +90,8 @@ export type MergerRunEnv = {
   engine?: string;
   credentials?: CredentialProviders;
   createRunId?: () => string;
+  /** #422: effective single-call auto-resume ceiling; undefined = package default (AUTO_RESUME_LIMIT). */
+  autoResumeLimit?: number;
   extraPiArgs?: readonly string[];
   timeoutMs?: number;
 };
@@ -575,6 +577,8 @@ export async function runPublicMerger(
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () =>
       buildMergerActivationExtraArgs(admitted, {
         packageRoot: env.packageRoot,

package/src/public-cli/option-definitions.ts

@@ -1098,10 +1098,12 @@ const SUPPORT_COMMAND_HELP = {
       "ak-role config set <seat> <provider/model[:thinking]> [<seat> <spec> ...]",
       "ak-role config set-engine <seat> <name>",
       "ak-role config unset-engine <seat>",
+      "ak-role config set-auto-resume-limit <N>",
     ],
     examples: [
       "ak-role config set judge openai-codex/gpt-5.6-sol:high",
       "ak-role config set-engine judge opus",
+      "ak-role config set-auto-resume-limit 3",
     ],
   },
   help: {

package/src/public-cli/reviewer-run.ts

@@ -91,6 +91,8 @@ export type ReviewerRunEnv = {
   engine?: string;
   credentials?: CredentialProviders;
   createRunId?: () => string;
+  /** #422: effective single-call auto-resume ceiling; undefined = package default (AUTO_RESUME_LIMIT). */
+  autoResumeLimit?: number;
   extraPiArgs?: readonly string[];
   timeoutMs?: number;
 };
@@ -514,6 +516,8 @@ export async function runPublicReviewer(
   return runWithAutoResumeLoop({
     admitted,
     io,
+    // #422: pass-through only; the loop entry resolves the default and validates the domain once.
+    autoResumeLimit: env.autoResumeLimit,
     buildInitialArgs: () =>
       buildReviewerActivationExtraArgs(admitted, {
         packageRoot: env.packageRoot,

package/src/public-cli/run-lifecycle.ts

@@ -52,7 +52,10 @@ export type TypedHttp429Observation = {
   readonly provider: V1ResumableProvider;
 };
 
-/** Per single LLM call auto-resume retries (call-local, no persistence). See #416 scope correction 2026-08-22. */
+/** Default for the #422 configurable single-call auto-resume ceiling
+ * (public-cli.json top-level `autoResumeLimit`). No longer the runtime truth
+ * source: runWithAutoResumeLoop receives the effective value once per call.
+ */
 export const AUTO_RESUME_LIMIT = 2 as const;
 
 export type RoleRunRecord = {