@avocadostudio-ai/orchestrator-core 0.3.1 → 0.3.3

package/dist/chat/chat-pipeline.js

@@ -3,13 +3,14 @@ import { blockManifestSchema } from "@avocadostudio-ai/shared";
 import { GENERATING_IMAGE_PLACEHOLDER, SEARCHING_IMAGE_PLACEHOLDER, isGeneratingPlaceholder, cleanupImagePlaceholders, buildPageDirectory, isVariationRequestMessage, variationVerbIntent, resolveEffectiveSlug, throwIfCanceled, raceCancel, sleepMs, suppressCancelOnly } from "./chat-pipeline-shared.js";
 import { siteCapabilitiesSchema, isBatchAddRequest, isDuplicateBlockRequest, isBlockCatalogQuery, isInfoQuery, isAdviceQuery, adviceResponse, isContentQuery, isPageListQuery, requestsPlanFirst, plannerMessageWithPendingContext, buildSiteContextBlock, infoResponse } from "../nlp/intent-detection.js";
 import { isLikelyClarificationFollowUp } from "../nlp/intent-helpers.js";
-import { versions, pendingClarificationBySession, chatHistoryBySession, pendingApprovalPlanBySession, continuationChainBySession, imageSourcePreferenceBySession, getSessionDraft, getPage, setPage, pushUndo, bumpVersion, pushRecentEdit, pushVersionEntry, pushChatHistory, schedulePersistState, removePage } from "../state/session-state.js";
-import { toErrorDetail, isNoEffectiveChangeError, isAlreadyCurrentError, classifyGuardrailError, formatValidationError, isDeterministicRepairEligible, buildDeterministicRepairFeedback, validateOperations, applyOpsAtomically, isStructuralOperation, pickFocusBlockId, pickUpdatedSlug } from "../ops/ops-engine.js";
+import { versions, pendingClarificationBySession, chatHistoryBySession, continuationChainBySession, imageSourcePreferenceBySession, getSessionDraft, getPage, setPage, pushUndo, bumpVersion, pushRecentEdit, pushVersionEntry, pushChatHistory, schedulePersistState, removePage } from "../state/session-state.js";
+import { loadPendingPlan, savePendingPlan, clearPendingPlan } from "../durable/pending-plan-store.js";
+import { toErrorDetail, isNoEffectiveChangeError, isAlreadyCurrentError, classifyGuardrailError, formatValidationError, isRepairEligibleCategory, buildDeterministicRepairFeedback, validateOperations, applyOpsAtomically, isStructuralOperation, pickFocusBlockId, pickUpdatedSlug } from "../ops/ops-engine.js";
 import { evaluateDestructiveActions } from "../ops/destructive-action-gate.js";
 import { clarificationSuggestions, postEditSuggestions, demoPlanFromMessage, plannerContextPack, compileDeterministicPlan, inferDeterministicIntent, isHighConfidenceDeterministicCase, tryCompoundDeterministicPlan, resolveImageUrlForAltField } from "../nlp/deterministic-planner.js";
 import { generatePlanWithOpenAI, isPlannerOutputError, isStrictJsonResponseEnabled, parseIntentWithOpenAI } from "./planner.js";
 import { isDemoModeEnabled, splitDemoOps, getDemoAllowedBlockTypes } from "../demo-mode.js";
-import { isCancelError as _isCancelError, OperationError } from "../errors.js";
+import { isCancelError as _isCancelError, OperationError, OrchestrationError } from "../errors.js";
 import { acquireSessionLock } from "../state/session-lock.js";
 const ERROR_CATEGORIES = [
     "schema_violation",
@@ -38,7 +39,7 @@ import { executeToolCall } from "../tools/runtime.js";
 // Re-exports from extracted modules (for backwards compat with external importers)
 // ---------------------------------------------------------------------------
 export { sentenceCase, firstUrlFromText, preferredImageAltText, collectMentionedSlugsFromPlan, collectMentionedSlugsFromOps, normalizePlanCopyForUi, futureToPastTense } from "./chat-pipeline-ui.js";
-export { sanitizeMessageForPlanning, inferTranslationScopeFromMessage, isNonEmptyString, findFullPageTranslationCoverageGap, findExplicitCtaTargetCoverageGap, parseCloneAndTranslateRequest } from "./chat-pipeline-translation.js";
+export { sanitizeMessageForPlanning, inferTranslationScopeFromMessage, isNonEmptyString, findFullPageTranslationCoverageGap, buildFullPageTranslationChecklist, findExplicitCtaTargetCoverageGap, parseCloneAndTranslateRequest } from "./chat-pipeline-translation.js";
 export { shouldPreferFastModelForMessage, shouldUseLlmIntentRouter, compactPlannerContextPack, minimalPlannerContextPack, shouldUseMinimalPlannerContext, shouldPreferFocusedTranslation, shouldEnableReasoningForMessage } from "./chat-pipeline-context.js";
 export { isRewriteLikeMessage, isPerformanceAwareMessage, isLikelyTextField, collectChangedTextFields, buildMetaChangeLogEntries, buildAiInsightChanges, buildOpChangeLogEntries, deterministicCreatePagePlan, deterministicDuplicatePagePlan, deterministicSelectedTextRewritePlan, shouldReturnDeterministicClarification, fmtSlug } from "./chat-pipeline-deterministic.js";
 export { blockHasImageUrlProp, parsePath, getValueAtPath, setValueAtPath, deleteValueAtPath, extractIndexedQueries, extractReferencedItemIndices, blockSupportsImageAtPath, detectImagePaths, imageQueryFromItem, shouldPopulateAllChildImages, findImageTargets, rewriteAddBlockToChildImageUpdate, withUnsplashHeroImage, shouldResolveCreatePageHeroImage, resolveHeroImageForCreatePage, detectImageOps } from "./chat-pipeline-image.js";
@@ -46,6 +47,7 @@ export { GENERATING_IMAGE_PLACEHOLDER, SEARCHING_IMAGE_PLACEHOLDER, isGenerating
 // Internal imports from extracted modules (used by this file)
 import { collectMentionedSlugsFromPlan, normalizePlanCopyForUi, futureToPastTense, pastToFutureTense } from "./chat-pipeline-ui.js";
 import { sanitizeMessageForPlanning, inferTranslationScopeFromMessage, findFullPageTranslationCoverageGap, findExplicitCtaTargetCoverageGap, parseCloneAndTranslateRequest } from "./chat-pipeline-translation.js";
+import { planTranslationChunks, shouldChunkTranslation, generateChunkedTranslationPlan } from "./translation-chunking.js";
 import { shouldPreferFastModelForMessage, shouldUseLlmIntentRouter, compactPlannerContextPack, minimalPlannerContextPack, shouldUseMinimalPlannerContext, shouldPreferFocusedTranslation, classifyMessageComplexity, isRouterPlanTooShallow, shouldEnableReasoningForMessage } from "./chat-pipeline-context.js";
 import { buildAiInsightChanges, buildMetaChangeLogEntries, buildOpChangeLogEntries, deterministicCreatePagePlan, deterministicDuplicatePagePlan, shouldReturnDeterministicClarification, fmtSlug } from "./chat-pipeline-deterministic.js";
 import { getValueAtPath, setValueAtPath, deleteValueAtPath, blockSupportsImageAtPath, detectImageOps, rewriteAddBlockToChildImageUpdate, withUnsplashHeroImage, resolveHeroImageForCreatePage } from "./chat-pipeline-image.js";
@@ -260,7 +262,7 @@ export async function runChatPipeline(ctx, body, options) {
     }
     const siteCapabilities = parsedCapabilities.data;
     if (executionMode === "discard_pending_plan") {
-        const existing = pendingApprovalPlanBySession.get(body.session);
+        const existing = await loadPendingPlan(body.session);
         if (!existing) {
             const defaultProvider = ctx.availableProviders[0] ?? "openai";
             const defaultModelKey = process.env.OPENAI_MODEL_KEY ?? "balanced";
@@ -280,7 +282,7 @@ export async function runChatPipeline(ctx, body, options) {
         if (body.pendingPlanId && body.pendingPlanId !== existing.id) {
             return { code: 409, payload: { error: "pending plan mismatch" } };
         }
-        pendingApprovalPlanBySession.delete(body.session);
+        await clearPendingPlan(body.session, "discarded");
         return {
             code: 200,
             payload: {
@@ -731,7 +733,7 @@ export async function runChatPipeline(ctx, body, options) {
         totalDurationMs: 0
     });
     if (executionMode === "auto") {
-        const existingPendingPlan = pendingApprovalPlanBySession.get(body.session);
+        const existingPendingPlan = await loadPendingPlan(body.session);
         const normalizedIncomingMessage = typeof body.message === "string" ? body.message.trim() : "";
         const normalizedPendingMessage = typeof existingPendingPlan?.originalMessage === "string"
             ? existingPendingPlan.originalMessage.trim()
@@ -1041,7 +1043,7 @@ export async function runChatPipeline(ctx, body, options) {
         strictJsonEnabled: isStrictJsonResponseEnabled()
     };
     const guardrailFailureResponse = (args) => {
-        const category = classifyGuardrailError(args.reason);
+        const category = args.category ?? classifyGuardrailError(args.reason);
         ctx.chatTelemetry.push({
             id: chatRequestId,
             at: new Date().toISOString(),
@@ -1086,7 +1088,7 @@ export async function runChatPipeline(ctx, body, options) {
                 status: "validation_error",
                 summary: "I could not apply that change safely.",
                 changes: [],
-                validationErrors: [formatValidationError(args.reason)],
+                validationErrors: [formatValidationError(args.reason, category)],
                 previewVersion: versions.get(body.session) ?? 0,
                 plannerSource: args.source,
                 modelUsed,
@@ -1098,6 +1100,71 @@ export async function runChatPipeline(ctx, body, options) {
     let usedNativeUnsplashTool = false;
     let usedNativeImageTool = false;
     let deferredNativeImageCalls = [];
+    const streamApplyState = {
+        appliedCount: 0,
+        /**
+         * Ops the stream actually took responsibility for — applied *or* skipped as
+         * a benign no-op. `appliedCount` alone cannot answer "did the stream carry
+         * the whole plan", because a legitimately unchanged op is not a gap.
+         */
+        processedCount: 0,
+        failedAtIndex: null,
+        hasStructuralOps: false,
+        /** Snapshots per slug — `null` means the page didn't exist before streaming (needs removal on rollback). */
+        rollbackSnapshots: new Map()
+    };
+    /*
+     * Undo everything the streamed per-op apply landed on the draft.
+     *
+     * Declared up here, above `respondFromPlan`, because the invariant it exists
+     * to hold is one only `respondFromPlan` can see: **a plan held for approval
+     * has applied nothing.**
+     *
+     * The stream decides what to defer one op at a time, from the op alone, and
+     * three of the four things that hold a plan are properties of the whole plan
+     * — `multi_page_plan` fires on touched-slug count with no destructive op
+     * required, and the compound-image hold fires on a plan that is not
+     * image-only. An additive six-op plan trips both defer lists' blind spot: it
+     * streams clean onto the page, and *then* the gate holds it. The user is
+     * shown an "Approve" card for content the draft already contains, and the
+     * `undoSnapshot` threaded into the applied path never reaches the held path,
+     * so they cannot even undo it. Re-running the same prompt then collides with
+     * the leftovers — `Block id b_featuregrid_wellness already exists` — which is
+     * the visible symptom and not the bug.
+     *
+     * Rolling back where the decision is made, rather than teaching the per-op
+     * defer list to predict it, is what keeps the invariant true for the next
+     * hold condition somebody adds.
+     */
+    const rollbackStreamedApply = (reason) => {
+        if (streamApplyState.rollbackSnapshots.size === 0)
+            return [];
+        const rolledBackSlugs = [];
+        for (const [slug, snapshot] of streamApplyState.rollbackSnapshots) {
+            if (snapshot) {
+                setPage(body.session, { ...snapshot, slug });
+            }
+            else {
+                removePage(body.session, slug);
+            }
+            rolledBackSlugs.push(slug);
+        }
+        ctx.log.warn({
+            event: "streamed_op_rollback",
+            chatRequestId,
+            appliedCount: streamApplyState.appliedCount,
+            processedCount: streamApplyState.processedCount,
+            failedAtIndex: streamApplyState.failedAtIndex,
+            rolledBackSlugs
+        }, `Rolled back ${rolledBackSlugs.length} page(s) — ${reason}`);
+        streamApplyState.appliedCount = 0;
+        streamApplyState.processedCount = 0;
+        streamApplyState.rollbackSnapshots.clear();
+        // The client already rendered every streamed op. Bump so it refetches the
+        // draft it is actually holding rather than the one it was shown.
+        bumpVersion(body.session);
+        return rolledBackSlugs;
+    };
     const respondFromPlan = async (plan, source, applyMode = "apply_now", optionsOverride, plannerTier) => {
         if (plannerTier)
             activePlannerTier = plannerTier;
@@ -1171,6 +1238,7 @@ export async function runChatPipeline(ctx, body, options) {
                         blockId: entry.blockId,
                         blockType: entry.blockType,
                         propName: entry.propName,
+                        allowedProps: entry.allowedProps,
                         plannerSource: source,
                         modelKey,
                         modelUsed
@@ -1471,7 +1539,12 @@ export async function runChatPipeline(ctx, body, options) {
             const forcedInfo = infoResponse({ body, current, plannerSource: source, modelUsed, modelKey });
             return { done: true, response: forcedInfo };
         }
-        if (translationScope === "page") {
+        // The gate gets one shot. On the repair pass it is skipped entirely: by then
+        // the model has already been handed the explicit checklist plus the list of
+        // fields it missed, and a still-imperfect plan is worth applying. Failing it
+        // twice would return 400 and discard every translation that did land —
+        // strictly worse for the user than a page that is 90% translated.
+        if (translationScope === "page" && !optionsOverride?.skipTranslationCoverageGate) {
             const translationCoverageGap = findFullPageTranslationCoverageGap({
                 plan: resolvedPlan,
                 message: plannerMessage,
@@ -1479,7 +1552,7 @@ export async function runChatPipeline(ctx, body, options) {
                 slug: effectiveSlug
             });
             if (translationCoverageGap)
-                return { done: false, reason: translationCoverageGap };
+                return { done: false, reason: translationCoverageGap, reasonCategory: undefined };
         }
         const explicitCtaCoverageGap = findExplicitCtaTargetCoverageGap({
             plan: resolvedPlan,
@@ -1488,7 +1561,7 @@ export async function runChatPipeline(ctx, body, options) {
             slug: effectiveSlug
         });
         if (explicitCtaCoverageGap)
-            return { done: false, reason: explicitCtaCoverageGap };
+            return { done: false, reason: explicitCtaCoverageGap, reasonCategory: undefined };
         // Tier-1 destructive-action gate. Hold any edit_plan containing destructive
         // ops (remove_page on a page with content, multi-page scope, bulk deletes)
         // for explicit approval — undo protects recovery but not accidental intent.
@@ -1641,6 +1714,20 @@ export async function runChatPipeline(ctx, body, options) {
             };
         }
         if (effectiveApplyMode === "plan_only") {
+            /*
+             * A held plan has applied nothing. See `rollbackStreamedApply` for why
+             * this cannot be decided op-by-op while the plan is still streaming.
+             *
+             * This has to run before the dry-run below, not only before the response:
+             * the preview is computed against the live draft, so on a stream that
+             * already landed its `add_block`s the dry run would report every one of
+             * them as a duplicate-id failure and render an approval card claiming the
+             * plan cannot be applied.
+             */
+            const rolledBack = rollbackStreamedApply("plan held for approval");
+            if (rolledBack.length > 0) {
+                options?.onRollbackStarted?.({ appliedCount: rolledBack.length, reason: "plan_held_for_approval" });
+            }
             // Dry-run the held plan up front to build the structured before→after
             // preview the approval card renders AND to learn whether it changes anything.
             // Best-effort: a preview failure must never block showing the plan.
@@ -1665,7 +1752,7 @@ export async function runChatPipeline(ctx, body, options) {
             // with a "Will change X" summary the draft never honours (#23). Return an
             // honest no-effective-change response instead.
             if (planPreview && planPreview.appliedCount === 0 && planPreview.failedCount === 0 && planPreview.skippedCount > 0) {
-                pendingApprovalPlanBySession.delete(body.session);
+                await clearPendingPlan(body.session, "discarded");
                 const onlyUnchanged = planPreview.opResults.every((r) => r.status !== "skipped" || r.reason === "unchanged_value");
                 const noopSummary = onlyUnchanged
                     ? "No changes needed — that content is already set."
@@ -1715,7 +1802,7 @@ export async function runChatPipeline(ctx, body, options) {
             // so the copy matches the "Approve plan" UX.
             const approvalSummary = pastToFutureTense(resolvedPlan.summary_for_user);
             const approvalChangeLog = resolvedPlan.change_log.map(pastToFutureTense);
-            pendingApprovalPlanBySession.set(body.session, {
+            await savePendingPlan(body.session, {
                 id: pendingPlanId,
                 createdAt: new Date().toISOString(),
                 promptHash,
@@ -1794,7 +1881,7 @@ export async function runChatPipeline(ctx, body, options) {
         }
         if (resolvedPlan.ops.length === 0) {
             pendingClarificationBySession.delete(body.session);
-            pendingApprovalPlanBySession.delete(body.session);
+            await clearPendingPlan(body.session, "discarded");
             /*
              * Zero ops is not the same fact as "already correct".
              *
@@ -2435,7 +2522,20 @@ export async function runChatPipeline(ctx, body, options) {
                 pushUndo(body.session, effectiveSlug, undoSnapshot);
             }
             pendingClarificationBySession.delete(body.session);
-            pendingApprovalPlanBySession.delete(body.session);
+            /*
+             * Only the plan we actually applied is `approved`.
+             *
+             * This path is shared: a plain `auto` turn that succeeds runs it too. A
+             * held `plan_ready` proposal the user never looked at — they typed
+             * something else instead — was superseded, not approved, and recording
+             * otherwise poisons the single number this outcome exists to produce.
+             */
+            if (optionsOverride?.approvedPlanId) {
+                await clearPendingPlan(body.session, "approved", optionsOverride.approvedPlanId);
+            }
+            else {
+                await clearPendingPlan(body.session, "discarded");
+            }
             const planUpdatedSlug = pickUpdatedSlug(body.session, effectiveSlug, resolvedPlan.ops);
             const updatedSlug = planUpdatedSlug ?? (effectiveSlug !== requestedSlug ? effectiveSlug : undefined);
             pushRecentEdit(body.session, { slug: updatedSlug ?? effectiveSlug, summary: futureToPastTense(resolvedPlan.summary_for_user), ops: resolvedPlan.ops });
@@ -2530,8 +2630,25 @@ export async function runChatPipeline(ctx, body, options) {
                 applyDurationMs = Date.now() - applyStartedAtMs;
             }
             const reason = toErrorDetail(error);
+            /*
+             * The category the throw already carried, in preference to one guessed
+             * back out of its message.
+             *
+             * The ops engine labels `Block id … already exists` a `schema_violation`
+             * and is right to. By the time it reached here it was a bare string, and
+             * `classifyGuardrailError` matches none of its schema_violation keywords
+             * against those words — so the failure arrived as `internal_error`, which
+             * `isDeterministicRepairEligible` refuses. The one plan a repair pass
+             * could have trivially fixed (rename the block, apply the other five ops)
+             * was the one plan that never reached it, and the user got "I could not
+             * apply that change safely" instead.
+             *
+             * Keyword matching stays as the fallback for reasons that are only ever
+             * strings — planner output failures, coverage gates.
+             */
+            const reasonCategory = error instanceof OrchestrationError ? error.category : undefined;
             if (isNoEffectiveChangeError(reason)) {
-                pendingApprovalPlanBySession.delete(body.session);
+                await clearPendingPlan(body.session, "discarded");
                 ctx.chatTelemetry.push({
                     id: chatRequestId,
                     at: new Date().toISOString(),
@@ -2617,15 +2734,15 @@ export async function runChatPipeline(ctx, body, options) {
                 promptLength: plannerMessage.length,
                 outcome: "apply_failed",
                 reason: reason.slice(0, 300),
-                reasonCategory: classifyGuardrailError(reason),
+                reasonCategory: reasonCategory ?? classifyGuardrailError(reason),
                 plannerTier,
                 ...timingFields()
             });
-            return { done: false, reason };
+            return { done: false, reason, reasonCategory };
         }
     };
     if (executionMode === "apply_pending_plan") {
-        const pending = pendingApprovalPlanBySession.get(body.session);
+        const pending = await loadPendingPlan(body.session);
         if (!pending) {
             const fallbackMessage = typeof body.message === "string" ? body.message.trim() : "";
             if (fallbackMessage.length > 0) {
@@ -2723,7 +2840,7 @@ export async function runChatPipeline(ctx, body, options) {
                 });
                 imageResolutionDurationMs += Date.now() - imageResolutionStartMs;
             }
-            const approvedOutcome = await respondFromPlan(approvalPlan, pending.source, "apply_now", { preResolvedPlan: true });
+            const approvedOutcome = await respondFromPlan(approvalPlan, pending.source, "apply_now", { preResolvedPlan: true, approvedPlanId: pending.id });
             if (approvedOutcome.done)
                 return approvedOutcome.response;
             return guardrailFailureResponse({ reason: approvedOutcome.reason, source: pending.source });
@@ -2731,7 +2848,7 @@ export async function runChatPipeline(ctx, body, options) {
         catch (error) {
             const reason = toErrorDetail(error);
             ctx.log.error({ event: "apply_pending_plan_error", chatRequestId, error: reason }, "Pending plan execution failed");
-            pendingApprovalPlanBySession.delete(body.session);
+            await clearPendingPlan(body.session, "discarded");
             ctx.chatTelemetry.push({
                 id: chatRequestId,
                 at: new Date().toISOString(),
@@ -3092,7 +3209,67 @@ export async function runChatPipeline(ctx, body, options) {
     // `plannerSource === "demo"` is handled earlier; here it's always a real planner.
     const planner = plannerRegistry.get(plannerSource);
     const supportsNativeTools = planner.supportsNativeTools;
-    const generatePlanImpl = planner.generatePlan;
+    // A full-page translation is a fan-out, not one long request: its output length
+    // scales with the page, and one request's output is strictly serial. Splitting
+    // it into independent per-block-group requests turns wall clock from the sum of
+    // the blocks into the slowest chunk, and keeps every chunk far from the token
+    // ceiling that made a single request an all-or-nothing bet. Substituting it
+    // here — rather than at each call site — keeps the planner's contract identical
+    // for the pipeline: same args in, one merged plan out.
+    const translationChunks = translationScope === "page" ? planTranslationChunks({ page: current }) : [];
+    const chunkTranslation = translationScope === "page" && shouldChunkTranslation(current, translationChunks);
+    if (chunkTranslation) {
+        ctx.log.info({
+            event: "translation_chunking_enabled",
+            slug: effectiveSlug,
+            chunkCount: translationChunks.length,
+            blocksPerChunk: translationChunks.map((chunk) => chunk.blockIds.length),
+            bytesPerChunk: translationChunks.map((chunk) => chunk.bytes)
+        }, "Full-page translation will be planned in parallel chunks");
+    }
+    const generatePlanImpl = chunkTranslation
+        ? (plannerArgs) => 
+        // A repair pass is already scoped to the fields the first pass missed —
+        // it is small, targeted, and must see the whole page to fix cross-block
+        // gaps, so it runs unchunked.
+        plannerArgs.feedback
+            ? planner.generatePlan(plannerArgs)
+            : generateChunkedTranslationPlan({
+                plannerArgs,
+                chunks: translationChunks,
+                generate: planner.generatePlan,
+                log: ctx.log,
+                onChunksSettled: (outcomes) => {
+                    const failed = outcomes.filter((outcome) => !outcome.ok);
+                    plannerContextTelemetryFields.translationChunkCount = outcomes.length;
+                    plannerContextTelemetryFields.translationChunksFailed = failed.length;
+                    // The slowest chunk is the request's latency. Logging every chunk's
+                    // wall clock next to its weight is what makes the split tunable —
+                    // a balanced split whose slowest chunk is no faster means the
+                    // bottleneck is somewhere other than chunk size.
+                    ctx.log.info({
+                        event: "translation_chunks_settled",
+                        slug: effectiveSlug,
+                        slowestMs: Math.max(...outcomes.map((outcome) => outcome.durationMs)),
+                        chunks: outcomes.map((outcome) => ({
+                            index: outcome.index,
+                            ms: outcome.durationMs,
+                            bytes: outcome.bytes,
+                            outputTokens: outcome.outputTokens,
+                            ops: outcome.opCount,
+                            attempts: outcome.attempts
+                        }))
+                    }, "Translation chunks settled");
+                    if (failed.length > 0) {
+                        ctx.log.warn({
+                            event: "translation_chunks_failed",
+                            slug: effectiveSlug,
+                            failedChunks: failed.map((outcome) => ({ index: outcome.index, blockIds: outcome.blockIds, reason: outcome.reason?.slice(0, 200) }))
+                        }, "Some translation chunks failed — the coverage gate will repair the gap");
+                    }
+                }
+            })
+        : planner.generatePlan;
     const maxPlanningAttempts = 3;
     let initialPlan = null;
     let routerDetectedInfo = false;
@@ -3587,13 +3764,10 @@ export async function runChatPipeline(ctx, body, options) {
         incrementalPlanStreamEnabled &&
         !/^(0|false|no|off)$/i.test((process.env.CHAT_STREAMED_OP_APPLY ?? "1").trim()) &&
         Boolean(options?.onOpApplied);
-    const streamApplyState = {
-        appliedCount: 0,
-        failedAtIndex: null,
-        hasStructuralOps: false,
-        /** Snapshots per slug — `null` means the page didn't exist before streaming (needs removal on rollback). */
-        rollbackSnapshots: new Map()
-    };
+    // Raised when an attempt dies on `max_tokens`. Retrying a truncation with the
+    // same budget reproduces it exactly — three identical failures cost ~250s and
+    // told us nothing new — so each such retry gets more room to finish.
+    let outputTokenScale = 1;
     // Skip the planning loop if the parallel race already produced an initialPlan
     for (let attempt = initialPlan ? maxPlanningAttempts + 1 : 1; attempt <= maxPlanningAttempts; attempt += 1) {
         throwIfCanceled(options?.signal);
@@ -3609,6 +3783,7 @@ export async function runChatPipeline(ctx, body, options) {
                 currentPage: current,
                 contextPack: plannerContext,
                 model: modelUsed,
+                outputTokenScale,
                 locale: body.locale,
                 imageSourceChoiceOpen,
                 history: isLightweightEdit ? [] : plannerChatHistory,
@@ -3707,6 +3882,7 @@ export async function runChatPipeline(ctx, body, options) {
                                 // would set failedAtIndex and force a full rollback + re-apply of the
                                 // whole plan — discarding the blocks that genuinely changed.
                                 const stepResult = await applyOpsAtomically(body.session, [op], { componentsManifest, allowNoEffectiveChange: true });
+                                streamApplyState.processedCount += 1;
                                 if (stepResult.appliedCount === 0 || stepResult.skippedOps.length > 0) {
                                     options?.onOpSkipped?.({
                                         index,
@@ -3788,6 +3964,11 @@ export async function runChatPipeline(ctx, body, options) {
                 };
             }
             const reasonCategory = isPlannerOutputError(error) ? error.reasonCategory : classifyGuardrailError(reason);
+            // Truncation is a budget failure, not a model failure — an identical retry
+            // hits the same ceiling. Double the output budget for the next attempt
+            // instead (the planner clamps it to the per-path ceiling).
+            if (/truncated \(max_tokens/i.test(errorMsg))
+                outputTokenScale *= 2;
             ctx.log.warn({ event: "plan_attempt_failed", attempt, model: modelUsed, reason: reason.slice(0, 300) }, `Planning attempt ${attempt} failed`);
             ctx.chatTelemetry.push({
                 id: chatRequestId,
@@ -3941,33 +4122,46 @@ export async function runChatPipeline(ctx, body, options) {
             }, { outcome: "planning_missing", plannerTier: "full_llm" })
         };
     }
-    // If streamed per-op apply already applied all ops successfully and no structural
-    // ops are pending, skip the normal apply step in respondFromPlan.
+    // If streamed per-op apply already handled every op successfully and no
+    // structural ops are pending, skip the normal apply step in respondFromPlan.
+    //
+    // The count has to be checked. `appliedCount > 0` read "the stream applied
+    // something" as "the stream applied everything", which is only true when the
+    // planner streams every op it returns. A chunked full-page translation does
+    // not: its chunks run as separate planner calls, and a chunk that produced no
+    // streamed ops still contributes its ops to the merged plan. Marking that plan
+    // pre-applied dropped those ops on the floor — the page kept whole sections in
+    // the source language while the response listed every op as applied.
+    const streamedPlanFullyStreamed = streamApplyState.processedCount >= initialPlan.ops.length;
     const streamedApplyComplete = streamedPerOpApplyEnabled &&
         streamApplyState.appliedCount > 0 &&
         streamApplyState.failedAtIndex === null &&
-        !streamApplyState.hasStructuralOps;
-    // If streamed apply partially failed, roll back and let respondFromPlan re-apply everything
-    if (streamedPerOpApplyEnabled && streamApplyState.failedAtIndex !== null && streamApplyState.rollbackSnapshots.size > 0) {
-        const rolledBackSlugs = [];
-        for (const [slug, snapshot] of streamApplyState.rollbackSnapshots) {
-            if (snapshot) {
-                setPage(body.session, { ...snapshot, slug });
-            }
-            else {
-                removePage(body.session, slug);
-            }
-            rolledBackSlugs.push(slug);
-        }
-        ctx.log.warn({ event: "streamed_op_rollback", chatRequestId, appliedCount: streamApplyState.appliedCount, failedAtIndex: streamApplyState.failedAtIndex, rolledBackSlugs }, `Rolled back ${rolledBackSlugs.length} page(s) after streamed op failure at index ${streamApplyState.failedAtIndex}`);
+        !streamApplyState.hasStructuralOps &&
+        streamedPlanFullyStreamed;
+    // Anything the stream already landed has to be undone before respondFromPlan
+    // replays the plan, or a non-idempotent op (an `add_block` that streamed
+    // before the stream fell short) would apply twice. This covers both an outright
+    // streamed failure and a stream that only carried part of the plan.
+    if (streamedPerOpApplyEnabled &&
+        !streamedApplyComplete &&
+        (streamApplyState.failedAtIndex !== null || streamApplyState.appliedCount > 0) &&
+        streamApplyState.rollbackSnapshots.size > 0) {
+        rollbackStreamedApply(streamApplyState.failedAtIndex !== null
+            ? `streamed op failure at index ${streamApplyState.failedAtIndex}`
+            : `streamed apply covered ${streamApplyState.processedCount} of ${initialPlan.ops.length} planned ops`);
     }
     const initialOutcome = await respondFromPlan(initialPlan, plannerSource, applyMode, streamedApplyComplete
         ? { preApplied: true, undoSnapshot: streamApplyState.rollbackSnapshots.get(effectiveSlug) ?? undefined }
         : undefined, "full_llm");
     if (initialOutcome.done)
         return initialOutcome.response;
-    if (!isDeterministicRepairEligible(initialOutcome.reason)) {
-        return guardrailFailureResponse({ reason: initialOutcome.reason, source: plannerSource });
+    const initialReasonCategory = initialOutcome.reasonCategory ?? classifyGuardrailError(initialOutcome.reason);
+    if (!isRepairEligibleCategory(initialReasonCategory)) {
+        return guardrailFailureResponse({
+            reason: initialOutcome.reason,
+            source: plannerSource,
+            category: initialReasonCategory
+        });
     }
     let repairedPlan;
     try {
@@ -3988,13 +4182,13 @@ export async function runChatPipeline(ctx, body, options) {
             promptLength: plannerMessage.length,
             outcome: "repair_started",
             reason: initialOutcome.reason.slice(0, 300),
-            reasonCategory: classifyGuardrailError(initialOutcome.reason),
+            reasonCategory: initialReasonCategory,
             ...timingFields()
         });
         planningAttempts += 1;
         plannerContextTelemetryFields.schemaRetryUsed = true;
         const repairFeedback = /full-page translation coverage/i.test(initialOutcome.reason)
-            ? `${initialOutcome.reason}. Repair for translation completeness: include missing translated text fields for list children across all affected blocks. Preserve links/hrefs unchanged.`
+            ? `${initialOutcome.reason}. Repair for translation completeness: emit an update_props op for every blockId named above — some of them are blocks your previous plan did not touch at all, so adding fields to existing ops is not enough. Include the missing translated text fields for list children too. Preserve links/hrefs unchanged.`
             : /explicit cta target coverage/i.test(initialOutcome.reason)
                 ? `${initialOutcome.reason}. Repair for multi-target CTA completeness: update both hero and footer CTA text targets requested by the user, keep all CTA links/hrefs unchanged, and preserve user constraints such as punctuation bans.`
                 : buildDeterministicRepairFeedback(initialOutcome.reason);
@@ -4024,7 +4218,57 @@ export async function runChatPipeline(ctx, body, options) {
                 : undefined,
             signal: options?.signal
         }), options?.signal);
-        repairedPlan = repairResult.plan;
+        // The repair supplements the first plan; it does not stand in for it.
+        //
+        // The feedback handed to a repair names only what the first pass missed, so
+        // the plan that comes back answers a narrower question than the one it used
+        // to replace — and replacing meant discarding every op the first pass got
+        // right. A chunked page-wide translation produced eight correct ops, tripped
+        // the coverage gate on blocks that were already in the target language (the
+        // gate walks every block and has no notion of "already translated"), and
+        // then applied the four-op repair on its own. Three of those four were
+        // no-ops. A page with six untranslated sections gained one and reported
+        // success.
+        //
+        // Where both plans address the same target the repair wins — it is the pass
+        // that saw the failure — and it keeps its position in the first plan's
+        // ordering so structural ops stay where they were planned.
+        const opTarget = (op) => "blockId" in op && typeof op.blockId === "string" ? `${op.op}:${op.blockId}` : op.op;
+        const repairByTarget = new Map(repairResult.plan.ops.map((op) => [opTarget(op), op]));
+        const takenFromRepair = new Set();
+        const mergedRepairOps = [];
+        for (const op of initialPlan.ops) {
+            const target = opTarget(op);
+            if (!repairByTarget.has(target)) {
+                mergedRepairOps.push(op);
+                continue;
+            }
+            // Superseded: the repair rewrote this target, so the original is dropped
+            // rather than re-applied on top of the correction.
+            if (takenFromRepair.has(target))
+                continue;
+            takenFromRepair.add(target);
+            mergedRepairOps.push(repairByTarget.get(target));
+        }
+        for (const op of repairResult.plan.ops) {
+            const target = opTarget(op);
+            if (takenFromRepair.has(target))
+                continue;
+            takenFromRepair.add(target);
+            mergedRepairOps.push(op);
+        }
+        if (mergedRepairOps.length > repairResult.plan.ops.length) {
+            ctx.log.info({
+                event: "repair_plan_merged",
+                chatRequestId,
+                repairOpCount: repairResult.plan.ops.length,
+                initialOpCount: initialPlan.ops.length,
+                mergedOpCount: mergedRepairOps.length
+            }, "Repair plan merged with the ops the first plan already had right");
+        }
+        // change_log is left as the repair wrote it; the incomplete-changelog
+        // synthesis downstream fills in entries for the carried-over ops.
+        repairedPlan = { ...repairResult.plan, ops: mergedRepairOps };
         planUsage = repairResult.usage;
         if (repairResult.schemaContext) {
             plannerContextTelemetryFields.contractMode = repairResult.schemaContext.contractMode;
@@ -4091,7 +4335,7 @@ export async function runChatPipeline(ctx, body, options) {
             }, { outcome: "repair_failed", reasonCategory: classifyGuardrailError(reason), reason: reason.slice(0, 300), plannerTier: "full_llm" })
         };
     }
-    const repairedOutcome = await respondFromPlan(repairedPlan, plannerSource, applyMode);
+    const repairedOutcome = await respondFromPlan(repairedPlan, plannerSource, applyMode, { skipTranslationCoverageGate: true });
     if (repairedOutcome.done)
         return repairedOutcome.response;
     const repairedReason = repairedOutcome.reason;
@@ -4136,7 +4380,7 @@ export async function runChatPipeline(ctx, body, options) {
             status: "validation_error",
             summary: "I could not apply that change safely.",
             changes: [],
-            validationErrors: [formatValidationError(repairedReason)],
+            validationErrors: [formatValidationError(repairedReason, repairedOutcome.reasonCategory)],
             previewVersion: versions.get(body.session) ?? 0,
             plannerSource,
             modelUsed,

package/dist/chat/gemini-planner.d.ts

@@ -57,6 +57,8 @@ export declare function generatePlanWithGemini(args: {
         warn: (obj: Record<string, unknown>, msg: string) => void;
     };
     forceFullSchemaContracts?: boolean;
+    /** Restrict block-schema contracts to these types. See CommonGeneratePlanArgs. */
+    contractBlockTypeAllowlist?: string[];
     componentsManifest?: BlockManifest;
     lightweight?: boolean;
     signal?: AbortSignal;

package/dist/chat/gemini-planner.js

@@ -193,7 +193,8 @@ export async function generatePlanWithGemini(args) {
             pageWideTranslation,
             legacyIncludeContracts: includeContracts,
             forceFullContracts: args.forceFullSchemaContracts,
-            componentsManifest: args.componentsManifest
+            componentsManifest: args.componentsManifest,
+            contractBlockTypeAllowlist: args.contractBlockTypeAllowlist
         });
     const userPayload = {
         request: args.message,

package/dist/chat/hallucination-validator.d.ts

@@ -15,6 +15,12 @@ export type HallucinatedProp = {
     blockId: string;
     blockType: string;
     propName: string;
+    /**
+     * What the block *does* accept. Present so the log line that records a strip
+     * carries the answer next to the question — the integrator who hit this spent
+     * nine minutes proving the block was fine, and this is the line they read.
+     */
+    allowedProps: string[];
 };
 export type HallucinationValidationResult = {
     plan: EditPlan;