@oscharko-dev/keiko 0.2.0-beta.4 → 0.2.0-beta.6

package/node_modules/@oscharko-dev/keiko-server/dist/qualityIntelligence/reCheckRoutes.js

@@ -15,17 +15,19 @@
 //
 // Both routes go through the central CSRF guard in server.ts (all POSTs do).
 import { randomUUID } from "node:crypto";
+import { isAbsolute } from "node:path";
 import { QualityIntelligence } from "@oscharko-dev/keiko-contracts";
-import { ALL_POLICY_PROFILES, buildAtomCoverageStatuses, buildCoverageMap, compareStaleness, regressionDefault, validateCandidates, } from "@oscharko-dev/keiko-quality-intelligence";
+import { ALL_POLICY_PROFILES, buildAtomCoverageStatuses, buildCoverageMap, compareStaleness, deduplicateCandidates, regressionDefault, validateCandidates, } from "@oscharko-dev/keiko-quality-intelligence";
 import { assertValidRunId, sha256Hex } from "@oscharko-dev/keiko-security";
 import { createInMemoryQualityIntelligenceLocalStore, loadQualityIntelligenceCandidates, loadQualityIntelligenceRun, recordQualityIntelligenceCandidates, recordQualityIntelligenceRun, } from "@oscharko-dev/keiko-evidence";
-import { excerptsByAtomId, runQualityIntelligenceModelRoutedTestDesign, } from "@oscharko-dev/keiko-workflows";
+import { QUALITY_INTELLIGENCE_DEFAULT_WORKFLOW_LIMITS, excerptsByAtomId, runQualityIntelligenceModelRoutedTestDesign, } from "@oscharko-dev/keiko-workflows";
+import { currentRedactionSecrets } from "../deps.js";
 import { makeCapsuleResolver } from "./capsuleAdapter.js";
 import { makeFigmaSnapshotLoader, makeFigmaVisionHintProvider } from "./figmaSnapshotAdapter.js";
 import { createQiGenerationPort, QiGenerationError } from "./generationPort.js";
 import { createQiJudgePort } from "./judgePort.js";
 import { resolveQiTestDesignSelection } from "./modelSelection.js";
-import { ingestInlineSources, QiIngestionError } from "./runIngestion.js";
+import { ingestInlineSourcesAsync, QiIngestionError } from "./runIngestion.js";
 const MAX_BODY_BYTES = 2 * 1024 * 1024;
 const REQUIREMENTS_ENVELOPE_PREFIX = "qi-src-req-";
 const errorResult = (status, code, message) => ({
@@ -49,20 +51,66 @@ const isObject = (value) => typeof value === "object" && value !== null && !Arra
 const readBody = (req) => new Promise((resolve, reject) => {
     const chunks = [];
     let total = 0;
+    let capped = false;
     req.on("data", (chunk) => {
         total += chunk.length;
         if (total > MAX_BODY_BYTES) {
-            reject(new Error("body too large"));
-            req.resume();
+            if (!capped) {
+                capped = true;
+                chunks.length = 0;
+                reject(new Error("body too large"));
+                req.resume();
+            }
             return;
         }
         chunks.push(chunk);
     });
     req.on("end", () => {
-        resolve(Buffer.concat(chunks).toString("utf8"));
+        if (!capped)
+            resolve(Buffer.concat(chunks).toString("utf8"));
     });
     req.on("error", reject);
 });
+function cancellationResult(signal) {
+    return signal.aborted
+        ? errorResult(499, "QI_REQUEST_CANCELLED", "Quality Intelligence request was cancelled.")
+        : null;
+}
+function requestAbortSignal(ctx) {
+    const controller = new AbortController();
+    const abort = () => {
+        if (!controller.signal.aborted) {
+            controller.abort("quality intelligence request cancelled");
+        }
+    };
+    const abortOnIncompleteRequestClose = () => {
+        if (!ctx.req.complete)
+            abort();
+    };
+    const abortOnResponseClose = () => {
+        if (!ctx.res.writableEnded)
+            abort();
+    };
+    if (ctx.req.destroyed) {
+        abort();
+        return { signal: controller.signal, dispose: () => undefined };
+    }
+    ctx.req.once("aborted", abort);
+    ctx.req.once("close", abortOnIncompleteRequestClose);
+    if (typeof ctx.res.once === "function") {
+        ctx.res.once("close", abortOnResponseClose);
+    }
+    return {
+        signal: controller.signal,
+        dispose: () => {
+            ctx.req.off("aborted", abort);
+            ctx.req.off("close", abortOnIncompleteRequestClose);
+            if (typeof ctx.res.off === "function") {
+                ctx.res.off("close", abortOnResponseClose);
+            }
+        },
+    };
+}
 function validateCapsuleSource(label, raw) {
     if (typeof raw.capsuleId !== "string" || raw.capsuleId.trim().length === 0)
         return undefined;
@@ -143,6 +191,12 @@ async function parseSources(req) {
                 result: errorResult(400, "QI_BAD_SOURCE", "A source entry is malformed."),
             };
         }
+        if (source.kind === "file" && !isAbsolute(source.path)) {
+            return {
+                ok: false,
+                result: errorResult(400, "QI_BAD_SOURCE", "File source paths must be absolute local paths."),
+            };
+        }
         sources.push(source);
     }
     return { ok: true, sources };
@@ -165,6 +219,12 @@ function mapCurrentAtomFingerprints(ingestedAtoms) {
         atomId: String(entry.atom.id),
         envelopeId: String(entry.atom.sourceEnvelopeId),
         canonicalHashSha256Hex: entry.atom.canonicalHashSha256Hex,
+        ...(entry.replacementGroupId !== undefined
+            ? { replacementGroupId: entry.replacementGroupId }
+            : {}),
+        ...(entry.replacementOrdinal !== undefined
+            ? { replacementOrdinal: entry.replacementOrdinal }
+            : {}),
     }));
 }
 function mapCurrentSourceFingerprints(ingestion) {
@@ -260,14 +320,15 @@ function loadManifestForDrift(id, evidenceDir) {
         }
         : { ok: true, manifest };
 }
-function ingestSourcesForDrift(sources, ingestRunId, deps) {
+async function ingestSourcesForDrift(sources, ingestRunId, deps) {
     try {
         return {
             ok: true,
-            ingestion: ingestInlineSources({
+            ingestion: await ingestInlineSourcesAsync({
                 request: { sources },
                 runId: ingestRunId,
                 registeredAt: new Date().toISOString(),
+                allowEmpty: true,
                 capsuleResolver: makeCapsuleResolver(deps),
                 // Drift must see the board's LATEST snapshot, not the pinned immutable record — a pinned
                 // write-once runId can never drift under its own identity (#735). Generate keeps pinning.
@@ -283,8 +344,13 @@ function ingestSourcesForDrift(sources, ingestRunId, deps) {
     }
 }
 function buildDriftStaleness(manifest, oldCandidates, ingestion) {
+    const oldAtomFingerprints = manifest.atomFingerprints;
+    const oldFingerprints = oldAtomFingerprints === undefined ? Object.freeze([]) : (manifest.sourceFingerprints ?? []);
     return compareStaleness({
-        oldFingerprints: manifest.sourceFingerprints ?? [],
+        // Newer runs persist atom fingerprints, which are required for exact per-test drift. Older
+        // source-only manifests cannot safely distinguish an unchanged workspace path set from edited
+        // file content, so fail closed instead of reporting "fresh" from envelope fingerprints alone.
+        oldFingerprints,
         evidenceRefs: manifest.evidenceRefs.map((ref) => ({
             envelopeId: ref.envelopeId,
             atomId: ref.atomId,
@@ -295,9 +361,7 @@ function buildDriftStaleness(manifest, oldCandidates, ingestion) {
         })),
         currentFingerprints: mapCurrentSourceFingerprints(ingestion),
         currentAtomFingerprints: mapCurrentAtomFingerprints(ingestion.ingestedAtoms),
-        ...(manifest.atomFingerprints !== undefined
-            ? { oldAtomFingerprints: manifest.atomFingerprints }
-            : {}),
+        ...(oldAtomFingerprints !== undefined ? { oldAtomFingerprints } : {}),
     });
 }
 function buildDriftContext(sources, manifest, ingestion, oldArtifact) {
@@ -318,15 +382,24 @@ async function computeDrift(req, evidenceDir, id, ingestRunId, deps) {
     const loaded = loadManifestForDrift(id, evidenceDir);
     if (!loaded.ok)
         return { ok: false, result: loaded.result };
-    const ingested = ingestSourcesForDrift(parsed.sources, ingestRunId, deps);
+    const ingested = await ingestSourcesForDrift(parsed.sources, ingestRunId, deps);
     if (!ingested.ok)
         return { ok: false, result: ingested.result };
     const oldArtifact = loadQualityIntelligenceCandidates(id, { evidenceDir });
+    if (oldArtifact === undefined && loaded.manifest.totals.candidates > 0) {
+        return {
+            ok: false,
+            result: errorResult(500, "QI_CANDIDATES_MISSING", "The candidate artifact for this Quality Intelligence run is missing."),
+        };
+    }
     return {
         ok: true,
         value: buildDriftContext(parsed.sources, loaded.manifest, ingested.ingestion, oldArtifact),
     };
 }
+const ALIGN_INSERT_DELETE_COST = 3;
+const ALIGN_SUBSTITUTE_COST = 4;
+const ALIGN_CROSS_OLD_ATOM_COST = 10;
 function collectStaleIds(staleness) {
     return new Set([
         ...staleness.changedStale.map((reason) => reason.candidateId),
@@ -354,6 +427,7 @@ function looksLikeLegacyRequirementsFallback(drift, staleIds) {
 function buildCurrentAtomIndexes(ingestion) {
     const byId = new Map(ingestion.ingestedAtoms.map((entry) => [String(entry.atom.id), entry]));
     const byEnvelope = new Map();
+    const replacementEntries = [];
     for (const entry of ingestion.ingestedAtoms) {
         const envelopeId = String(entry.atom.sourceEnvelopeId);
         const current = byEnvelope.get(envelopeId);
@@ -363,19 +437,39 @@ function buildCurrentAtomIndexes(ingestion) {
         else {
             current.push(entry);
         }
+        if (entry.replacementGroupId !== undefined && entry.replacementOrdinal !== undefined) {
+            replacementEntries.push({
+                atomId: String(entry.atom.id),
+                canonicalHashSha256Hex: entry.atom.canonicalHashSha256Hex,
+                replacementGroupId: entry.replacementGroupId,
+                replacementOrdinal: entry.replacementOrdinal,
+            });
+        }
     }
     return {
         byId,
         byEnvelope,
+        replacementEntries,
         envelopeIds: new Set(ingestion.envelopes.map((envelope) => String(envelope.id))),
     };
 }
 function buildOldAtomIndexes(atomFingerprints) {
     const byId = new Map(atomFingerprints.map((fp) => [
         fp.atomId,
-        { envelopeId: fp.envelopeId, canonicalHashSha256Hex: fp.canonicalHashSha256Hex },
+        {
+            envelopeId: fp.envelopeId,
+            canonicalHashSha256Hex: fp.canonicalHashSha256Hex,
+            ...(fp.replacementGroupId !== undefined
+                ? { replacementGroupId: fp.replacementGroupId }
+                : {}),
+            ...(fp.replacementOrdinal !== undefined
+                ? { replacementOrdinal: fp.replacementOrdinal }
+                : {}),
+        },
     ]));
     const idsByEnvelope = new Map();
+    const idsInEnvelope = new Map();
+    const replacementEntries = [];
     for (const fp of atomFingerprints) {
         const ids = idsByEnvelope.get(fp.envelopeId);
         if (ids === undefined) {
@@ -384,42 +478,185 @@ function buildOldAtomIndexes(atomFingerprints) {
         else {
             ids.add(fp.atomId);
         }
+        const orderedIds = idsInEnvelope.get(fp.envelopeId);
+        if (orderedIds === undefined) {
+            idsInEnvelope.set(fp.envelopeId, [fp.atomId]);
+        }
+        else {
+            orderedIds.push(fp.atomId);
+        }
+        if (fp.replacementGroupId !== undefined && fp.replacementOrdinal !== undefined) {
+            replacementEntries.push({
+                atomId: fp.atomId,
+                canonicalHashSha256Hex: fp.canonicalHashSha256Hex,
+                replacementGroupId: fp.replacementGroupId,
+                replacementOrdinal: fp.replacementOrdinal,
+            });
+        }
+    }
+    return { byId, idsByEnvelope, idsInEnvelope, replacementEntries };
+}
+function replacementEntriesByGroup(entries) {
+    const groups = new Map();
+    for (const entry of entries) {
+        const group = groups.get(entry.replacementGroupId);
+        if (group === undefined) {
+            groups.set(entry.replacementGroupId, [entry]);
+        }
+        else {
+            group.push(entry);
+        }
+    }
+    for (const group of groups.values()) {
+        group.sort((a, b) => a.replacementOrdinal - b.replacementOrdinal);
+    }
+    return groups;
+}
+function alignmentPairCost(oldEntry, currentEntry, oldAtomIds) {
+    if (oldEntry.atomId === currentEntry.atomId)
+        return 0;
+    if (currentEntry.canonicalHashSha256Hex === oldEntry.canonicalHashSha256Hex)
+        return 0;
+    return oldAtomIds.has(currentEntry.atomId) ? ALIGN_CROSS_OLD_ATOM_COST : ALIGN_SUBSTITUTE_COST;
+}
+function replacementIndexEntryAt(entries, index) {
+    const entry = entries[index];
+    if (entry === undefined)
+        throw new Error("Replacement alignment index out of bounds.");
+    return entry;
+}
+function matrixValue(matrix, row, col) {
+    const value = matrix[row]?.[col];
+    if (value === undefined)
+        throw new Error("Replacement alignment matrix index out of bounds.");
+    return value;
+}
+function setMatrixValue(matrix, row, col, value) {
+    const rowValues = matrix[row];
+    if (rowValues === undefined) {
+        throw new Error("Replacement alignment matrix index out of bounds.");
+    }
+    rowValues[col] = value;
+}
+function buildAlignmentCostMatrix(oldEntries, currentEntries, oldAtomIds) {
+    const matrix = Array.from({ length: oldEntries.length + 1 }, () => Array.from({ length: currentEntries.length + 1 }, () => 0));
+    for (let oldIndex = 1; oldIndex <= oldEntries.length; oldIndex += 1) {
+        setMatrixValue(matrix, oldIndex, 0, oldIndex * ALIGN_INSERT_DELETE_COST);
+    }
+    for (let currentIndex = 1; currentIndex <= currentEntries.length; currentIndex += 1) {
+        setMatrixValue(matrix, 0, currentIndex, currentIndex * ALIGN_INSERT_DELETE_COST);
+    }
+    for (let oldIndex = 1; oldIndex <= oldEntries.length; oldIndex += 1) {
+        for (let currentIndex = 1; currentIndex <= currentEntries.length; currentIndex += 1) {
+            const pairCost = alignmentPairCost(replacementIndexEntryAt(oldEntries, oldIndex - 1), replacementIndexEntryAt(currentEntries, currentIndex - 1), oldAtomIds);
+            const pair = matrixValue(matrix, oldIndex - 1, currentIndex - 1) + pairCost;
+            const deletion = matrixValue(matrix, oldIndex - 1, currentIndex) + ALIGN_INSERT_DELETE_COST;
+            const insertion = matrixValue(matrix, oldIndex, currentIndex - 1) + ALIGN_INSERT_DELETE_COST;
+            setMatrixValue(matrix, oldIndex, currentIndex, Math.min(pair, deletion, insertion));
+        }
+    }
+    return matrix;
+}
+function alignReplacementEntries(oldEntries, currentEntries) {
+    const mapping = new Map();
+    const oldAtomIds = new Set(oldEntries.map((entry) => entry.atomId));
+    const costs = buildAlignmentCostMatrix(oldEntries, currentEntries, oldAtomIds);
+    let oldIndex = oldEntries.length;
+    let currentIndex = currentEntries.length;
+    while (oldIndex > 0 && currentIndex > 0) {
+        const oldEntry = replacementIndexEntryAt(oldEntries, oldIndex - 1);
+        const currentEntry = replacementIndexEntryAt(currentEntries, currentIndex - 1);
+        const pairCost = alignmentPairCost(oldEntry, currentEntry, oldAtomIds);
+        const currentCost = matrixValue(costs, oldIndex, currentIndex);
+        const pair = matrixValue(costs, oldIndex - 1, currentIndex - 1) + pairCost;
+        const deletion = matrixValue(costs, oldIndex - 1, currentIndex) + ALIGN_INSERT_DELETE_COST;
+        const insertion = matrixValue(costs, oldIndex, currentIndex - 1) + ALIGN_INSERT_DELETE_COST;
+        if (pairCost === 0 && currentCost === pair) {
+            mapping.set(oldEntry.atomId, currentEntry.atomId);
+            oldIndex -= 1;
+            currentIndex -= 1;
+        }
+        else if (currentCost === insertion) {
+            currentIndex -= 1;
+        }
+        else if (currentCost === deletion) {
+            oldIndex -= 1;
+        }
+        else {
+            mapping.set(oldEntry.atomId, currentEntry.atomId);
+            oldIndex -= 1;
+            currentIndex -= 1;
+        }
     }
-    return { byId, idsByEnvelope };
+    return mapping;
 }
-function addReplacementRequirementAtoms(envelopeId, current, old, atomIdsToRegenerate) {
+function buildReplacementAtomMap(oldEntries, currentEntries) {
+    const oldGroups = replacementEntriesByGroup(oldEntries);
+    const currentGroups = replacementEntriesByGroup(currentEntries);
+    const mapping = new Map();
+    for (const [groupId, oldGroup] of oldGroups) {
+        const currentGroup = currentGroups.get(groupId);
+        if (currentGroup === undefined)
+            continue;
+        for (const [oldAtomId, currentAtomId] of alignReplacementEntries(oldGroup, currentGroup)) {
+            mapping.set(oldAtomId, currentAtomId);
+        }
+    }
+    return mapping;
+}
+function addPositionalReplacementRequirementAtom(atomId, envelopeId, current, old, atomIdsToRegenerate) {
     const oldIds = old.idsByEnvelope.get(envelopeId) ?? new Set();
-    for (const replacement of current.byEnvelope.get(envelopeId) ?? []) {
-        const replacementId = String(replacement.atom.id);
-        if (!oldIds.has(replacementId))
-            atomIdsToRegenerate.add(replacementId);
+    const oldIdsInEnvelope = old.idsInEnvelope.get(envelopeId) ?? [];
+    const currentAtomsInEnvelope = current.byEnvelope.get(envelopeId) ?? [];
+    const oldIndex = oldIdsInEnvelope.indexOf(atomId);
+    const replacement = oldIndex >= 0 ? currentAtomsInEnvelope[oldIndex] : undefined;
+    const replacementId = replacement === undefined ? undefined : String(replacement.atom.id);
+    if (replacementId !== undefined && !oldIds.has(replacementId)) {
+        atomIdsToRegenerate.add(replacementId);
     }
 }
-function addRegenerationAtomsForCandidate(candidate, current, old, atomIdsToRegenerate) {
+function addChangedCurrentAtom(oldAtom, currentEntry, atomIdsToRegenerate) {
+    if (currentEntry === undefined)
+        return false;
+    if (currentEntry.atom.canonicalHashSha256Hex === oldAtom.canonicalHashSha256Hex)
+        return false;
+    atomIdsToRegenerate.add(String(currentEntry.atom.id));
+    return true;
+}
+function addMappedReplacementAtom(atomId, current, old, replacementAtomIdsByOldAtomId, atomIdsToRegenerate) {
+    const replacementAtomId = replacementAtomIdsByOldAtomId.get(atomId);
+    if (replacementAtomId === undefined || replacementAtomId === atomId)
+        return false;
+    if (old.byId.has(replacementAtomId) || !current.byId.has(replacementAtomId))
+        return false;
+    atomIdsToRegenerate.add(replacementAtomId);
+    return true;
+}
+function addRegenerationAtomsForCandidate(candidate, current, old, replacementAtomIdsByOldAtomId, atomIdsToRegenerate) {
     for (const atomId of candidate.derivedFromAtomIds) {
         const oldAtom = old.byId.get(atomId);
         const currentAtom = current.byId.get(atomId);
-        if (oldAtom !== undefined &&
-            currentAtom !== undefined &&
-            currentAtom.atom.canonicalHashSha256Hex !== oldAtom.canonicalHashSha256Hex) {
-            atomIdsToRegenerate.add(String(currentAtom.atom.id));
-            continue;
-        }
         if (oldAtom === undefined || !current.envelopeIds.has(oldAtom.envelopeId))
             continue;
+        if (addChangedCurrentAtom(oldAtom, currentAtom, atomIdsToRegenerate))
+            continue;
+        if (addMappedReplacementAtom(atomId, current, old, replacementAtomIdsByOldAtomId, atomIdsToRegenerate)) {
+            continue;
+        }
         if (!oldAtom.envelopeId.startsWith(REQUIREMENTS_ENVELOPE_PREFIX))
             continue;
-        addReplacementRequirementAtoms(oldAtom.envelopeId, current, old, atomIdsToRegenerate);
+        addPositionalReplacementRequirementAtom(atomId, oldAtom.envelopeId, current, old, atomIdsToRegenerate);
     }
 }
 function collectAtomsToRegenerate(drift, staleIds) {
     const current = buildCurrentAtomIndexes(drift.ingestion);
     const old = buildOldAtomIndexes(drift.manifest.atomFingerprints ?? []);
+    const replacementAtomIdsByOldAtomId = buildReplacementAtomMap(old.replacementEntries, current.replacementEntries);
     const atomIdsToRegenerate = new Set();
     for (const candidate of drift.oldCandidates) {
         if (!staleIds.has(candidate.id))
             continue;
-        addRegenerationAtomsForCandidate(candidate, current, old, atomIdsToRegenerate);
+        addRegenerationAtomsForCandidate(candidate, current, old, replacementAtomIdsByOldAtomId, atomIdsToRegenerate);
     }
     return drift.ingestion.ingestedAtoms.filter((entry) => atomIdsToRegenerate.has(String(entry.atom.id)));
 }
@@ -444,9 +681,10 @@ function narrowRegeneration(drift) {
         legacyRequirementsFallback: false,
     };
 }
-function regenWorkflowDeps(deps, target, evidenceStore, capture) {
+function regenWorkflowDeps(deps, target, evidenceStore, capture, signal) {
     return {
         sink: { emit: () => undefined },
+        signal,
         evidenceStore,
         candidatesSink: {
             record: (cands, generatedAt) => {
@@ -454,6 +692,16 @@ function regenWorkflowDeps(deps, target, evidenceStore, capture) {
             },
         },
         generate: createQiGenerationPort(deps, target),
+        // The regenerate-stale judge deliberately shares the auto-selected generation model id rather than
+        // resolving an independent qi:judge-logic model the way the initial run does (runExecution.ts).
+        // This is safe because the regen target comes from resolveQiTestDesignSelection(deps) with NO
+        // explicit model request: auto-selection prefers structured-output models, so whenever a judge is
+        // possible (a structured-output model is configured) the generation model already satisfies
+        // qi:judge-logic, and when only chat-only models exist both generation and the judge degrade
+        // (judge skipped via buildJudgePortIfAvailable's typed-unavailable catch). The initial-run
+        // asymmetry — an explicitly requested chat-only generation model paired with a separate
+        // structured-output judge — cannot arise here because the regen path never carries an explicit
+        // generation-model request.
         ...(target.kind === "model" ? { judge: buildJudgePortIfAvailable(deps, target.modelId) } : {}),
     };
 }
@@ -466,7 +714,7 @@ function buildScopedRegenPlan(newRunId, requestedAt) {
     };
 }
 async function executeScopedWorkflow(args) {
-    const { deps, target, evidenceStore, capture, plan, ingestion, atomsToRegenerate, profile } = args;
+    const { deps, target, evidenceStore, capture, plan, ingestion, atomsToRegenerate, profile, signal, } = args;
     try {
         const summary = await runQualityIntelligenceModelRoutedTestDesign({
             plan,
@@ -474,7 +722,7 @@ async function executeScopedWorkflow(args) {
             ingestedAtoms: atomsToRegenerate,
             provenanceRefs: ingestion.provenanceRefs,
             profile,
-        }, regenWorkflowDeps(deps, target, evidenceStore, capture));
+        }, regenWorkflowDeps(deps, target, evidenceStore, capture, signal));
         return summary.status === "succeeded"
             ? null
             : errorResult(500, "QI_REGEN_FAILED", "Scoped regeneration did not succeed.");
@@ -499,7 +747,7 @@ function finalizeScopedWorkflow(evidenceStore, newRunId, generatedCandidates, ge
     };
 }
 async function runScopedEphemeral(args) {
-    const { deps, target, newRunId, requestedAt, ingestion, atomsToRegenerate, profile } = args;
+    const { deps, target, newRunId, requestedAt, ingestion, atomsToRegenerate, profile, signal } = args;
     const evidenceStore = createInMemoryQualityIntelligenceLocalStore();
     let generatedCandidates = [];
     let generatedAt;
@@ -515,16 +763,23 @@ async function runScopedEphemeral(args) {
         ingestion,
         atomsToRegenerate,
         profile,
+        signal,
     });
     if (failure !== null)
         return { ok: false, result: failure };
     return finalizeScopedWorkflow(evidenceStore, newRunId, generatedCandidates, generatedAt);
 }
 function buildMergedCandidates(newRunId, preservedCandidates, regeneratedCandidates) {
-    return [
+    return deduplicateCandidates([
         ...preservedCandidates.map((candidate) => rowToCandidate(candidate, newRunId)),
         ...regeneratedCandidates,
-    ];
+    ]);
+}
+function assertMergedCandidateBudget(preservedCandidates, regeneratedCandidates) {
+    const limit = QUALITY_INTELLIGENCE_DEFAULT_WORKFLOW_LIMITS.maxCandidatesPerRun;
+    if (preservedCandidates.length + regeneratedCandidates.length <= limit)
+        return null;
+    return errorResult(409, "QI_REGEN_CANDIDATE_CAP_EXCEEDED", "Regenerating the stale tests would exceed the per-run candidate limit. Reduce the stale scope or start a fresh QI run against the current source.");
 }
 function buildCoverageArtifacts(runId, ingestion, mergedCandidates) {
     const atoms = ingestion.ingestedAtoms.map((entry) => entry.atom);
@@ -540,6 +795,18 @@ function buildCoverageArtifacts(runId, ingestion, mergedCandidates) {
             .filter((row) => row !== null),
     };
 }
+// Order by severity (critical -> low) BEFORE truncating, then cap to the per-run limit — mirroring
+// the initial run path (modelRoutedTestDesign). Sorting first guarantees that if the merge hits the
+// cap, the most severe findings (including high-severity uncovered-requirement coverage gaps) survive
+// rather than being dropped by array position. Array.prototype.sort is stable, so same-severity
+// insertion order — coverage-gap rows first — is preserved, matching the initial path exactly.
+function sortAndCapMergedFindings(rows, cap) {
+    return rows
+        .slice()
+        .sort((a, b) => QualityIntelligence.QUALITY_INTELLIGENCE_SEVERITY_RANK[a.severity] -
+        QualityIntelligence.QUALITY_INTELLIGENCE_SEVERITY_RANK[b.severity])
+        .slice(0, cap);
+}
 function buildMergedFindings(args) {
     const preservedIds = new Set(args.preservedCandidates.map((candidate) => candidate.id));
     const regeneratedIds = new Set(args.regeneratedCandidates.map((candidate) => String(candidate.id)));
@@ -547,12 +814,16 @@ function buildMergedFindings(args) {
     const regeneratedJudgeRows = args.regeneratedManifest === undefined
         ? []
         : filteredJudgeFindings(args.regeneratedManifest.findings, regeneratedIds);
-    return Object.freeze([
+    // Source the cap from the default workflow limits: the re-check regeneration sub-run
+    // (regenWorkflowDeps) passes no custom `limits`, so it runs under these defaults — keeping the
+    // merge cap consistent with the sub-run's own maxFindingsPerRun.
+    const merged = sortAndCapMergedFindings([
         ...args.coverageGapRows,
         ...validateCandidates(args.runId, args.mergedCandidates).map(toCandidateFindingRow),
         ...preservedJudgeRows,
         ...regeneratedJudgeRows,
-    ]);
+    ], QUALITY_INTELLIGENCE_DEFAULT_WORKFLOW_LIMITS.maxFindingsPerRun);
+    return Object.freeze(merged);
 }
 function buildMergedRunRecord(args) {
     const { newRunId, requestedAt, profile, oldManifest, ingestion, preservedCandidates } = args;
@@ -600,8 +871,16 @@ function optionalModelFields(regeneratedManifest) {
             : {}),
     };
 }
-function recordMergedManifest(evidenceDir, args) {
-    recordQualityIntelligenceRun(buildMergedRunRecord(args), { evidenceDir });
+function recordMergedManifest(evidenceDir, args, additionalSecrets) {
+    // Persist-time secret scrubbing at parity with the initial-run path (runExecution.ts
+    // buildWorkflowDeps): the merged manifest carries judge rationales forwarded from the regenerated
+    // run, so the live additionalSecrets list must reach the manifest writer here too — otherwise a
+    // configured provider secret echoed in a rationale that the security-package builtin patterns do
+    // not match would survive into the on-disk merged manifest (Issue #747 defence-in-depth).
+    recordQualityIntelligenceRun(buildMergedRunRecord(args), {
+        evidenceDir,
+        redaction: { additionalSecrets },
+    });
 }
 function recordMergedCandidatesArtifact(args) {
     recordQualityIntelligenceCandidates({
@@ -626,6 +905,14 @@ function persistMergedRun(args) {
         regeneratedCandidates: args.regeneratedCandidates,
         regeneratedManifest: args.regeneratedManifest,
     });
+    recordMergedCandidatesArtifact({
+        deps: args.deps,
+        evidenceDir: args.evidenceDir,
+        newRunId: args.newRunId,
+        completedAt: args.completedAt,
+        mergedCandidates,
+        preservedEditedRevisions: args.preservedEditedRevisions,
+    });
     recordMergedManifest(args.evidenceDir, {
         newRunId: args.newRunId,
         requestedAt: args.requestedAt,
@@ -638,23 +925,9 @@ function persistMergedRun(args) {
         completedAt: args.completedAt,
         findings,
         coverageMatrix: coverage.coverageMatrix,
-    });
-    recordMergedCandidatesArtifact({
-        deps: args.deps,
-        evidenceDir: args.evidenceDir,
-        newRunId: args.newRunId,
-        completedAt: args.completedAt,
-        mergedCandidates,
-        preservedEditedRevisions: args.preservedEditedRevisions,
-    });
+    }, currentRedactionSecrets(args.deps));
 }
-function immediateRegenerationResult(id, drift, narrowed) {
-    if (narrowed.staleIds.size === 0) {
-        return {
-            status: 200,
-            body: { runId: id, regeneratedCount: 0, preservedCount: drift.oldCandidates.length },
-        };
-    }
+function immediateRegenerationResult(narrowed) {
     if (narrowed.legacyRequirementsFallback) {
         return errorResult(409, "QI_REGEN_LEGACY_REQUIREMENTS_UNSUPPORTED", "This run predates atom-level requirements drift metadata. Start a new QI run against the current requirements sources instead.");
     }
@@ -663,7 +936,7 @@ function immediateRegenerationResult(id, drift, narrowed) {
     // regenerate), persisting the merge would silently drop the entire run. This is the catastrophic
     // shape an atom-id scheme drift would take; fail closed with an actionable error instead (Epic
     // #735 drift correctness). The legitimate "some tests orphaned, some preserved" case keeps
-    // preserved > 0 and is unaffected; a no-drift run already returned above.
+    // preserved > 0 and is unaffected.
     if (narrowed.preservedCandidates.length === 0 && narrowed.atomsToRegenerate.length === 0) {
         return errorResult(409, "QI_REGEN_WOULD_EMPTY", "Regenerating the stale tests would remove every test in this run because the current source no longer maps to any of them. Start a fresh QI run against the current source instead.");
     }
@@ -690,6 +963,7 @@ async function regenerateCandidateSlice(args) {
         ingestion: args.drift.ingestion,
         atomsToRegenerate: args.narrowed.atomsToRegenerate,
         profile: args.profile,
+        signal: args.signal,
     });
     return outcome.ok
         ? {
@@ -702,12 +976,41 @@ async function regenerateCandidateSlice(args) {
         }
         : outcome;
 }
+function persistRegenerationResult(args) {
+    persistMergedRun({
+        deps: args.deps,
+        evidenceDir: args.evidenceDir,
+        newRunId: args.newRunId,
+        requestedAt: args.requestedAt,
+        profile: args.profile,
+        oldManifest: args.drift.manifest,
+        ingestion: args.drift.ingestion,
+        preservedCandidates: args.narrowed.preservedCandidates,
+        preservedEditedRevisions: args.narrowed.preservedEditedRevisions,
+        regeneratedCandidates: args.regenerated.candidates,
+        regeneratedManifest: args.regenerated.manifest,
+        completedAt: args.regenerated.completedAt,
+    });
+}
+function regenerationSuccessResult(args) {
+    return {
+        status: 200,
+        body: {
+            runId: args.newRunId,
+            regeneratedCount: args.regeneratedCount,
+            preservedCount: args.preservedCount,
+        },
+    };
+}
 async function regenerateFromDrift(args) {
-    const { deps, id, evidenceDir, newRunId, requestedAt, drift } = args;
+    const { deps, evidenceDir, newRunId, requestedAt, drift, signal } = args;
     const narrowed = narrowRegeneration(drift);
-    const immediate = immediateRegenerationResult(id, drift, narrowed);
+    const immediate = immediateRegenerationResult(narrowed);
     if (immediate !== null)
         return immediate;
+    const cancelledBeforeRegeneration = cancellationResult(signal);
+    if (cancelledBeforeRegeneration !== null)
+        return cancelledBeforeRegeneration;
     const profile = resolveProfile(drift.manifest.policyProfileIds[0]);
     const regenerated = await regenerateCandidateSlice({
         deps,
@@ -716,31 +1019,31 @@ async function regenerateFromDrift(args) {
         drift,
         narrowed,
         profile,
+        signal,
     });
     if (!regenerated.ok)
         return regenerated.result;
-    persistMergedRun({
+    const cancelledBeforePersist = cancellationResult(signal);
+    if (cancelledBeforePersist !== null)
+        return cancelledBeforePersist;
+    const budgetError = assertMergedCandidateBudget(narrowed.preservedCandidates, regenerated.value.candidates);
+    if (budgetError !== null)
+        return budgetError;
+    persistRegenerationResult({
         deps,
         evidenceDir,
         newRunId,
         requestedAt,
+        drift,
+        narrowed,
         profile,
-        oldManifest: drift.manifest,
-        ingestion: drift.ingestion,
-        preservedCandidates: narrowed.preservedCandidates,
-        preservedEditedRevisions: narrowed.preservedEditedRevisions,
-        regeneratedCandidates: regenerated.value.candidates,
-        regeneratedManifest: regenerated.value.manifest,
-        completedAt: regenerated.value.completedAt,
+        regenerated: regenerated.value,
+    });
+    return regenerationSuccessResult({
+        newRunId,
+        regeneratedCount: regenerated.value.candidates.length,
+        preservedCount: narrowed.preservedCandidates.length,
     });
-    return {
-        status: 200,
-        body: {
-            runId: newRunId,
-            regeneratedCount: regenerated.value.candidates.length,
-            preservedCount: narrowed.preservedCandidates.length,
-        },
-    };
 }
 export async function handleQiReCheck(ctx, deps) {
     const { id } = ctx.params;
@@ -788,22 +1091,26 @@ export async function handleQiRegenerateStale(ctx, deps) {
     }
     const newRunId = `qi-run-${randomUUID()}`;
     const requestedAt = new Date().toISOString();
+    const abortScope = requestAbortSignal(ctx);
     try {
         const drift = await computeDrift(ctx.req, evidenceDir, id, newRunId, deps);
         if (!drift.ok)
             return drift.result;
         return await regenerateFromDrift({
             deps,
-            id,
             evidenceDir,
             newRunId,
             requestedAt,
             drift: drift.value,
+            signal: abortScope.signal,
         });
     }
     catch {
         return errorResult(500, "QI_REGEN_FAILED", "Failed to regenerate stale candidates.");
     }
+    finally {
+        abortScope.dispose();
+    }
 }
 export const QI_RECHECK_ROUTE_GROUP = [
     {