@pmelab/gtd 35.0.0 → 37.0.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gtd",
-  "version": "35.0.0",
+  "version": "37.0.0",
   "description": "Drive the gtd loop inside Claude Code: agent turns run as subagents, gtd decides every beat",
   "author": {
     "name": "Philipp Melab"

package/README.md

@@ -307,6 +307,13 @@ Or skip writing one: **`gtd loop`** is that loop, shipped with gtd. It drives
 to real model names through per-machine settings — see
 [`gtd loop`](https://github.com/pmelab/gtd/blob/main/docs/driver.md#the-bundled-driver-gtd-loop).
 
+Both it and the Claude Code mod stop an agent turn that outgrows its context:
+past 60% of the model's window the agent is asked to wrap up with a handoff
+note, past 70% (or when the context is about to be compacted) the turn stops and
+nothing lands. A step's `context` option, or the bundled workflows'
+`contextLimit` option, moves the two limits — see
+[Context limits](https://github.com/pmelab/gtd/blob/main/docs/driver.md#context-limits).
+
 ### Or drive it from inside Claude Code
 
 The gtd mod runs the same loop inside an interactive Claude Code session
@@ -430,18 +437,19 @@ you open the `review` door.
 3. **You wait.** The agent first implements the requirements the quickest way
    that works — the naive pass — and a judge reads where it changed code (see
    [the naive pass](#the-naive-pass) below; with [flag mode](#the-naive-pass)
-   off, neither runs). Then the change is built test-first, checked against the
-   full suite (`testCommand`) and fixed until it passes — so keep that suite
-   fast; gtd has no lighter one. Scenario wording is not frozen: a review's
-   `## Scenarios` chunk marks any assertion an existing scenario lost as
-   `Weakened:` — **risk: `feature` has no review, so a build turn that weakens a
-   scenario reaches `idle` unflagged unless you open the `review` door.** After
-   the build the quality lap runs, and the process ends: the feature workflow
-   has no human review of the finished change. Two points along the process (one
-   with flag mode off) are judged rather than always asking you outright — each
-   stops and hands you a verdict to make (`gtd judge answer`, or land with a
-   clean tree to accept the conservative default, which never skips work;
-   `gtd judge run --provider fixed --answers <path>` — or the
+   off, no judge runs). A pass the judge lets through is the implementation; one
+   whose seam is refactored first is built again test-first. Then it is checked
+   against the full suite (`testCommand`) and fixed until it passes — so keep
+   that suite fast; gtd has no lighter one. Scenario wording is not frozen: a
+   review's `## Scenarios` chunk marks any assertion an existing scenario lost
+   as `Weakened:` — **risk: `feature` has no review, so a build turn that
+   weakens a scenario reaches `idle` unflagged unless you open the `review`
+   door.** After the build the quality lap runs, and the process ends: the
+   feature workflow has no human review of the finished change. Two points along
+   the process (one with flag mode off) are judged rather than always asking you
+   outright — each stops and hands you a verdict to make (`gtd judge answer`, or
+   land with a clean tree to accept the conservative default, which never skips
+   work; `gtd judge run --provider fixed --answers <path>` — or the
    `GTD_JUDGE_ANSWERS` env var, inline JSON — answers one from a file, piped
    between `gtd judge --json` and `gtd judge answer`;
    `gtd judge run --provider jev` asks TypeSafe's Jev instead, with the key in
@@ -605,16 +613,23 @@ its ID (`[AC-3] …`) and reaches only code that existed before the pass. The pa
 is sent back while a criterion's ID is missing from its tests, a test imports a
 file it added, or the suite is red on it. A judge checks whether it changed
 anything outside the expected set (tests, steering files; see `seamAllow`).
-Incidental changes land; a needed seam change is refactored first, in its own
-slice with its own quality lap (`refactorQualityReviews`) and review, before the
-feature is implemented; a wrong approach is retried twice, then rests for you to
-steer or overrule it. `gtd slices` lists the `refactor` and `feature` slices. A
-refactor that already carried the whole feature leaves the implementation
-nothing to do: its empty turn passes, and the feature's quality lap covers the
-whole change. Once the implementation is green, a judge checks every criterion
-ID has a covering test: an uncovered one goes back to the agent (twice, then to
-you) instead of ending the feature, and each covered ID is recorded as a
-`Gtd-Mark: covers=<id>` trailer. See
+Incidental changes land: the pass itself is the implementation, with no rebuild,
+straight through the health loop and the quality lap. A needed seam change
+resets: the pass is never applied. An agent reads its whole diff and writes a
+refactor note (`.gtd/REFACTOR-NOTE.md`: which seams, which shape); the seam is
+refactored first, flag-free with the existing suite green, in its own slice with
+its own quality lap (`refactorQualityReviews`) and review; then the feature is
+rebuilt on the refactored base, behind a release flag, with the note and the
+naive diff as reference. The rebuild is refused until its tests carry every
+criterion ID the naive pass's tests named, and the suite must be green with
+them. A wrong approach is retried twice, then rests for you to steer or overrule
+it. `gtd slices` lists the `refactor` and `feature` slices. A refactor that
+already carried the whole feature leaves the rebuild only the carried-over
+tests, and the feature's quality lap covers the whole change. Once the
+implementation is green, a judge checks every criterion ID has a covering test:
+an uncovered one goes back to the agent (twice, then to you) instead of ending
+the feature, and each covered ID is recorded as a `Gtd-Mark: covers=<id>`
+trailer. See
 [Acceptance-criteria coverage](docs/configuration.md#acceptance-criteria-coverage).
 Feedback at the refactor review re-runs the refactor, never design; a
 refactor-review change the refactor cannot build is refused, and the only way
@@ -623,12 +638,13 @@ out is `gtd abandon`. A process from 27.5.0 or later whose judge ruled
 that slice. Details in
 [the naive-pass path](docs/configuration.md#the-naive-pass-path).
 
-**Flag mode (`flagMode`, on by default).** On, the implementation is asked for a
-new release flag (none at a `low` risk tier) and the naive pass and its judge
-run as above. A project that is not publicly released turns it off explicitly —
+**Flag mode (`flagMode`, on by default).** On, the naive pass's judge runs as
+above and a rebuilt implementation is asked for a new release flag (none at a
+`low` risk tier); a pass the judge lets land is not asked for one. A project
+that is not publicly released turns it off explicitly —
 `feature({ flagMode: false })` in `gtd.config.ts`, it is never detected: then no
-flag is asked for, no seam judge or refactor runs, and the implementation is the
-naive version, straight through the health loop and the quality lap. See
+flag is asked for, no seam judge or refactor runs, and the naive pass lands as
+the implementation, straight through the health loop and the quality lap. See
 [`flagMode`](docs/configuration.md#the-bundled-workflows-settings).
 
 **Risk tier (flag `GTD_FLAG_RISK_TIER=1`, off by default).** Triage proposes a
@@ -751,8 +767,8 @@ install for any of these but `./testkit`: gtd resolves a `gtd.config.ts`'s
 The `gtd` bin's commands — `next`, `land`, `abandon`, `restore`, `validate`,
 `check`, `uncheck`, `install`, `summary`, `base`, `door`, `doors`, `slices`,
 `version`, `help`, `history list`, `history show`, `history fetch`, `strays`,
-and the tools `ui`, `lsp`, `loop`, `judge` (`judge answer`, `judge run`) — are
-listed in the
+and the tools `ui`, `lsp`, `loop`, `context-hook`, `judge` (`judge answer`,
+`judge run`) — are listed in the
 [CLI reference](https://github.com/pmelab/gtd/blob/main/docs/cli.md).
 `gtd slices` lists the spans a flow's `slice()` calls mark. It refuses (exit 1)
 when HEAD neither closes nor sits inside a process, or when today's config

package/claude/hooks/context.ts

@@ -0,0 +1,66 @@
+import {
+  contextHook,
+  contextLimitFault,
+  contextWindowFor,
+  DEFAULT_CONTEXT_LIMIT,
+  parseContextWindow,
+  subagentTranscriptPath,
+  transcriptTokens,
+} from "../../src/wire/ContextLimit.js"
+import type { ContextDecision, ContextLimit } from "../../src/wire/ContextLimit.js"
+
+// The mod's half of `gtd context-hook`: the same decision, for a worker
+// subagent instead of a `claude -p` session.
+
+export type Guard = { limit: ContextLimit; window: number }
+
+/** A turn's limits from its beat's `context`, the model the subagent runs on and the window override; a bad window is ignored. */
+export function guardOf(
+  context: { soft?: number; hard?: number } | undefined,
+  model: string | undefined,
+  windowEnv: string | undefined,
+  sessionWindow?: number,
+): Guard | undefined {
+  const limit = { ...DEFAULT_CONTEXT_LIMIT, ...context }
+  if (contextLimitFault(limit) !== undefined) return undefined
+  // A worker with no model of its own runs on the session's, window included.
+  const own = model === undefined ? sessionWindow : undefined
+  return { limit, window: parseContextWindow(windowEnv) ?? own ?? contextWindowFor(model) }
+}
+
+export type HookEvent = {
+  hook_event_name: string
+  transcript_path: string
+  agent_id?: string
+}
+
+/**
+ * A worker's hook event decided. It is handed the MAIN session's transcript,
+ * so the worker's own is read instead.
+ */
+export async function decide(
+  e: HookEvent,
+  guard: Guard | undefined,
+  read: (path: string) => Promise<string | undefined>,
+): Promise<ContextDecision | undefined> {
+  const event = e.hook_event_name
+  if (!guard || !e.agent_id || (event !== "PostToolUse" && event !== "PreCompact")) return undefined
+  const transcript =
+    event === "PostToolUse" && e.transcript_path
+      ? await read(subagentTranscriptPath(e.transcript_path, e.agent_id))
+      : undefined
+  return contextHook({
+    event,
+    tokens: transcript === undefined ? undefined : transcriptTokens(transcript),
+    ...guard,
+  })
+}
+
+/**
+ * A decision as a classic PostToolUse result. A hard stop only blocks here:
+ * the mod stops the worker's task itself, since `continue: false` from a
+ * subagent's hook is not documented to stop just that subagent.
+ */
+export function classicResult(decision: ContextDecision) {
+  return { block: decision.kind === "soft" ? decision.reason : decision.stopReason }
+}

package/claude/hooks/drive.ts

@@ -20,6 +20,7 @@ export type Beat = {
   skills?: string[]
   validate?: string
   access?: AccessDef
+  context?: { soft?: number; hard?: number }
   judge?: unknown
   changes?: { status: string; path: string }[]
   session?: { id?: string; resume?: boolean | string }
@@ -42,6 +43,7 @@ export type Turn = {
   skills: readonly string[]
   scope: string
   access?: AccessDef
+  context?: { soft?: number; hard?: number }
 }
 
 // `isLost`: the scope's subagent no longer takes messages.
@@ -183,6 +185,7 @@ function turnOf(b: Beat): Turn {
     skills: b.skills ?? [],
     scope: memory.split("#")[0]!,
     access: b.access,
+    context: b.context,
   }
 }
 

package/claude/hooks/register.tsx

@@ -14,6 +14,9 @@ import { personaSpec, resumable } from "./persona"
 import { JUDGE_SYSTEM, judgePrompt, judgeQuestions, judgeRunEnv, toVerdicts } from "./judge"
 import type { Judgment } from "./judge"
 import { catchFrom, throwTo } from "./handoff"
+import { classicResult, decide, guardOf } from "./context"
+import { contextHook } from "../../src/wire/ContextLimit.js"
+import type { Guard, HookEvent } from "./context"
 import { jobs } from "./jobs"
 import { documents, readDocument } from "./schema"
 import { READ_ONLY_GIT, ship } from "./ship"
@@ -70,6 +73,23 @@ const ours = new Set<string>()
 const accesses = new Map<string, AccessDef>()
 const setAccess = (id: string, a: AccessDef | undefined) =>
   void (a ? accesses.set(id, a) : accesses.delete(id))
+// Each turn agent's context limit, reset with its access; and why a worker
+// was stopped at it, for the turn's end to report.
+const guards = new Map<string, Guard>()
+const contextStops = new Map<string, string>()
+async function workerModel($: $, hint: string | undefined) {
+  return subagentModel(hint, {
+    smart: await $.env.get("GTD_PLANNERMODEL"),
+    base: await $.env.get("GTD_CODERMODEL"),
+  })
+}
+async function setGuard($: $, id: string, t: Pick<Turn, "context" | "model">) {
+  const model = await workerModel($, t.model)
+  const session = model === undefined ? (await $.session.usage()).context.window : undefined
+  const guard = guardOf(t.context, model, await $.env.get("GTD_LOOP_CONTEXT_WINDOW"), session)
+  if (guard) guards.set(id, guard)
+  else guards.delete(id)
+}
 const waiting = new Map<string, (end: TurnEnd) => void>()
 const ended = new Map<string, TurnEnd>()
 const personas = new Set<string>()
@@ -122,6 +142,8 @@ async function send($: $, agentId: string, text: string) {
 async function forget($: $, memory: string, agentId: string) {
   $.ui.log(lostLine(memory.split("#")[0]!))
   accesses.delete(agentId)
+  guards.delete(agentId)
+  contextStops.delete(agentId)
   await update($, scopes, (s) => {
     const rest = { ...s }
     if (rest[memory]?.agentId === agentId) delete rest[memory]
@@ -193,6 +215,7 @@ function io($: $): Io {
       if (t.resume && entry && !known) $.ui.log(restartLine(t.scope))
       if (t.resume && known) {
         setAccess(known, t.access)
+        await setGuard($, known, t)
         const end = send($, known, t.prompt)
         await update($, run, (r) => ({ ...r, inflight: { agentId: known, memory: t.memory } }))
         const ended = await end
@@ -205,16 +228,14 @@ function io($: $): Io {
         subagentType: await persona($, t),
         prompt: t.prompt,
         description: t.label || "gtd",
-        model: subagentModel(t.model, {
-          smart: await $.env.get("GTD_PLANNERMODEL"),
-          base: await $.env.get("GTD_CODERMODEL"),
-        }),
+        model: await workerModel($, t.model),
         cwd: root,
       })
       const id = spawned.agentId
       if (!id) return settle($, { ok: false, why: spawned.deny ?? "subagent spawn refused" })
       ours.add(id)
       setAccess(id, t.access)
+      await setGuard($, id, t)
       await update($, agents, (list) => [...list, id].slice(-200))
       await update($, scopes, (s) => ({ ...s, [t.memory]: { agentId: id, persona: name } }))
       await update($, run, (r) => ({ ...r, inflight: { agentId: id, memory: t.memory } }))
@@ -912,6 +933,40 @@ async function isOurs($: $, id: string) {
   return isWorker
 }
 
+// `gtd context-hook`'s decision for a worker: past its soft limit it is asked
+// for a handoff note; past its hard limit, or about to compact, its task is
+// stopped and its turn ends as a failure carrying the stop reason. Stopped off
+// the hook, which runs inside the worker's own tool call.
+async function stopWorker($: $, id: string, stopReason: string) {
+  if (contextStops.has(id)) return
+  contextStops.set(id, stopReason)
+  $.clock.after(0, () => {
+    void $.tool.call({ tool: "TaskStop", task_id: id }).catch((err: unknown) => {
+      $.ui.log(`gtd could not stop a subagent at its context limit: ${String(err)}`)
+    })
+  })
+}
+
+async function contextGuard($: $, e: HookEvent) {
+  const id = e.agent_id
+  if (!id || !ours.has(id)) return undefined
+  const decision = await decide(e, guards.get(id), async (path) =>
+    (await $.fs.exists(path)) ? $.fs.read(path) : undefined,
+  )
+  if (decision?.kind === "hard") await stopWorker($, id, decision.stopReason)
+  return decision && classicResult(decision)
+}
+
+// A worker's own compaction carries its id here (`classic.PreCompact` is not
+// documented to): compaction about to happen means its limit was missed.
+async function compactGuard($: $, agentId: string | undefined) {
+  if (!agentId || !ours.has(agentId) || !guards.has(agentId)) return undefined
+  const decision = contextHook({ event: "PreCompact", tokens: undefined, ...guards.get(agentId)! })
+  if (decision?.kind !== "hard") return undefined
+  await stopWorker($, agentId, decision.stopReason)
+  return { skip: decision.stopReason }
+}
+
 // What a subagent this mod spawned may not do: write outside its step's
 // access, or, answering into a file, anything but that.
 function subagentDenial(agentId: string, e: Record<string, unknown>) {
@@ -982,8 +1037,13 @@ export const register: Register = (on) => {
       void launchPending($)
     }
     if (e.agentId && ours.has(e.agentId)) {
-      const end: TurnEnd =
-        e.reason === "answer" ? { ok: true } : { ok: false, why: `agent turn ended: ${e.reason}` }
+      const stopped = contextStops.get(e.agentId)
+      contextStops.delete(e.agentId)
+      const end: TurnEnd = stopped
+        ? { ok: false, why: stopped }
+        : e.reason === "answer"
+          ? { ok: true }
+          : { ok: false, why: `agent turn ended: ${e.reason}` }
       delegates.delete(e.agentId)
       const resolve = waiting.get(e.agentId)
       waiting.delete(e.agentId)
@@ -1014,6 +1074,9 @@ export const register: Register = (on) => {
     return next(e)
   })
 
+  on("classic.PostToolUse", async ($, e, next) => (await contextGuard($, e)) ?? next(e))
+  on("session.compact", async ($, e, next) => (await compactGuard($, e.agentId)) ?? next(e))
+
   // A subagent's hand-back arrives as a prompt to the main session, whose model
   // would then act on it. gtd reads the turn's result from git instead.
   on("prompt.submit", async ($, e, next) => {

package/dist/chunks/{reserved-C8Fm3s72.mjs → reserved-zAfoJtR7.mjs}

@@ -1,6 +1,6 @@
 import { accessFor, agent, answered, changesSince, check, codeThreads, defineWorkflow, displayPath, env, head, human, judge, numeric, quote, read, refuse, scope, skillsFor, start, vars } from "../flows.mjs";
 import { escalation as escalation$1, gate as gate$1, healthy as healthy$1, lensScopes, lensesOf, removedAssertions } from "../workflow-kit.mjs";
-import { c as String$, g as standardSchemaV1, h as optionalWith, l as Struct, n as Boolean$ } from "./Schema-DO5ttJaI.mjs";
+import { c as String$, g as standardSchemaV1, h as optionalWith, l as Struct, n as Boolean$, s as Number$ } from "./Schema-DO5ttJaI.mjs";
 //#region src/workflows/shared/registry.ts
 const FILL = "
";
 const commentLength = (rest) => {
@@ -391,6 +391,7 @@ const agentWithSkills = (name, prompt, options = {}) => {
 	return agent(name, withSkills(skillsFor(name).join(", "), body), options);
 };
 const unwindFailure = (commit) => `gtd could not unwind ${commit} out of your working tree.`;
+const naiveApplyFailure = (commit) => `gtd could not apply the naive pass ${commit} to the working tree; it is built fresh instead.`;
 const idleMessage = () => `No active gtd process.
 
 To start one, make ANY change — a hand-edit to real code, a scratch
@@ -634,9 +635,11 @@ ${strays.map((path) => `  - \`${displayPath(path)}\``).join("\n")}
 - Introduce no new flag read and add no second read of an existing one:
   every match of \`${pattern}\` may move, never increase in number`;
 const withRules = (rules) => rules === void 0 ? "" : `${rules}\n`;
-const refactorBuildingPrompt = ({ pkg, strays, pattern, reference, feedback = false }) => `${stateFileRules}
+const refactorBuildingPrompt = ({ pkg, strays, pattern, reference, feedback = false, note = false }) => `${stateFileRules}
 - The package to implement is \`${pkg}\`; never delete it
-${feedback ? `- The package carries a \`## Review feedback\` section: a human's review of the
+${note ? `- The package's \`## Refactor note\` section names the seams to open and the
+  shape each takes, written from the whole naive pass: build exactly those
+` : ""}${feedback ? `- The package carries a \`## Review feedback\` section: a human's review of the
   last refactor. Act on it, within the rules below
 ` : ""}${refactorRules(strays, pattern)}
 ${reference === void 0 ? "" : `- Reference only: \`git show ${reference} -- ${strays.map(quote).join(" ")}\` shows an
@@ -1239,8 +1242,8 @@ const naivePassPrompt = (retry) => `${stateFileRules}
 - Read \`.gtd/REQUIREMENTS.md\`: the settled requirements for this change
 ${criteriaBinding(false)}
 - Implement them the quickest way that works — the naive version. Do not
-  restructure, abstract or refactor around the change; a later step judges
-  the shape of your diff and a reviewer makes it fit
+  restructure, abstract or refactor around the change; it may land exactly as
+  you leave it, and a reviewer makes it fit
 - Work breadth-first: rough out every part of the change before finishing any
   one, so a run cut off midway still shows the whole shape
 - Write behaviour-level acceptance tests, at least one per criterion, each
@@ -1255,21 +1258,50 @@ ${criteriaBinding(false)}
 - Leave \`.gtd/\` untouched
 - Leave everything uncommitted and finish your turn — do not commit
 ${retry === void 0 ? "" : naiveRetry(retry)}`;
-const implementBuildingPrompt = (reference, tier, amend, afterRefactor, flagMode = true) => `${stateFileRules}
+const carries = (rebuild) => (rebuild.acceptance?.ids.length ?? 0) > 0;
+const rebuildLines = ({ note, acceptance }) => `${note === void 0 ? "" : `- The refactor note (\`.gtd/REFACTOR-NOTE.md\`) named the seams the refactor
+  opened; plug the change into them:
+
+${note.trimEnd().split("\n").map((line) => line === "" ? "" : `  > ${line}`).join("\n")}
+
+`}${acceptance === void 0 || !carries({ acceptance }) ? "" : `- Carry over the naive pass's acceptance tests for ${acceptance.ids.join(", ")}, the
+  one part of it you take as it is: \`git show ${acceptance.hash} -- ${acceptance.tests.map(quote).join(" ")}\`.
+  Copy each test with its \`[AC-<n>]\` name into the tree as the refactor left
+  it — check a file out of the tip whole only where the refactor did not touch
+  it — changing only what reaches the release flag. A turn whose changed tests
+  leave an ID out is refused, and the suite must be green with them
+`}`;
+const refactorNotePrompt = (reference, strays) => `${stateFileRules}
+- The seam judge ruled the naive pass refactor-first: it is never applied.
+  A behaviour-neutral refactor lands first, then the change is rebuilt on
+  the refactored base. Both turns read the note you write
+- Read the whole naive pass: \`git show ${reference}\`. It changed these
+  existing files outside the allowlist:
+${listed(strays)}
+- Write \`.gtd/REFACTOR-NOTE.md\`: which seams the refactor opens (the existing
+  code to restructure, by path and symbol) and the shape each takes — the
+  signatures and where the new behaviour will plug in. Name only the files
+  listed above: the refactor may change no other path. Never the feature's own
+  behaviour, and no flag read: the refactor adds neither
+- Change nothing else — a turn that does is refused
+- Leave everything uncommitted and finish your turn — do not commit
+`;
+const afterRefactorLine = (rebuild) => `- A reviewed refactor has just landed and may already carry part of the change,
+  though never a release flag. Build only what is still missing, held to every
+  rule below; if nothing is, ${carries(rebuild) ? "carry over the acceptance tests below and change nothing else" : "change nothing and finish your turn"}
+`;
+const implementBuildingPrompt = (reference, tier, amend, afterRefactor, flagMode = true, rebuild = {}) => `${stateFileRules}
 - Read \`.gtd/REQUIREMENTS.md\`: the settled requirements for this change
 ${criteriaBinding(true)}
-${afterRefactor === true ? `- A reviewed refactor has just landed and may already carry part of the change,
-  though never a release flag. Build only what is still missing, held to every
-  rule below; if nothing is, change nothing and finish your turn
-` : ""}${amend === true ? `- The change already exists in the tree from an earlier lap; amend it to meet
+${afterRefactor === true ? afterRefactorLine(rebuild) : ""}${amend === true ? `- The change already exists in the tree from an earlier lap; amend it to meet
   the re-derived requirements instead of rewriting it
 ` : flagMode ? `- Implement them properly, fitting the codebase's seams and conventions
 ` : `- Implement them the quickest way that works — the naive version. Do not
   restructure, abstract or refactor around the change
 `}${reference === void 0 || amend === true ? "" : `- Reference only: \`git show ${reference}\` shows an earlier naive attempt.
   Read it for ideas; never apply, cherry-pick or check it out — write
-  the change fresh
-`}${!flagMode ? "- Add no release flag — this project ships without release flags" : tier === "low" ? "- Add no release flag — this change is low risk tier" : amend === true ? "- Keep the release flag the earlier lap added, if it added one; otherwise put\n  the behaviour behind a new release flag" : `- Put the new behaviour behind a new release flag, following the
+  the change fresh${carries(rebuild) ? ", its acceptance tests excepted (below)" : ""}
+`}${rebuildLines(rebuild)}${!flagMode ? "- Add no release flag — this project ships without release flags" : tier === "low" ? "- Add no release flag — this change is low risk tier" : amend === true ? "- Keep the release flag the earlier lap added, if it added one; otherwise put\n  the behaviour behind a new release flag" : `- Put the new behaviour behind a new release flag, following the
   repository's flag conventions`}
 - Write the tests first, then the code that makes them pass. Name each
   criterion's ID in the test that covers it (\`[AC-3] …\`): once the suite is
@@ -1290,12 +1322,13 @@ An edit together with an approval counts as steer. Only
 \`.gtd/REQUIREMENTS.md\` is meant to change here: any other edit lands on the
 branch unjudged.
 `;
-const seamSteerMessage = (retry) => isFault(retry) ? `The naive pass failed three times and the retries are spent. The last
+/** `judged`: whether an overruled pass still meets the seam judge (`flagMode` on). */
+const seamSteerMessage = (retry, judged = true) => isFault(retry) ? `The naive pass failed three times and the retries are spent. The last
 attempt's tests (\`git show ${retry.hash}\`) fall short:
 ${retry.fault}
 
 ${steerChoices(`land a clean tree to go on with the last attempt as it is:
-  \`seam.check\` runs its suite and the seam judge rules on its shape. Use it
+  \`seam.check\` runs its suite and ${judged ? "the seam judge rules on its shape" : "it lands as the implementation"}. Use it
   when the rule cannot fit this change (tests the globs do not see, or no
   entry point that existed before). Risk: a criterion may have no test that
   survives a later refactor — the choice is recorded in history.`)}` : isRed(retry) ? `The naive pass failed three times and the retries are spent. The last
@@ -1306,7 +1339,7 @@ Two ways forward (then run \`gtd land\`):
 - **Steer** — edit \`.gtd/REQUIREMENTS.md\` to redirect the change; the naive
   pass runs again with a fresh retry budget
 - **Overrule** — land a clean tree to go on with the last attempt as it is:
-  the seam judge rules on its shape, and the implementation's health loop
+  ${judged ? "the seam judge rules on its shape" : "it lands as the implementation"}, and the implementation's health loop
   must turn the suite green. Risk: the criteria's tests never passed on the
   naive pass — the choice is recorded in history.
 
@@ -1322,9 +1355,8 @@ Two ways forward (then run \`gtd land\`):
 - **Steer** — edit \`.gtd/REQUIREMENTS.md\` to redirect the change; the naive
   pass runs again with a fresh retry budget (the risk tier stays as the
   design gate settled it; a tier edit here is not applied)
-- **Overrule** — land a clean tree to accept the last attempt's approach:
-  the implementation is built against it as reference, with no seam gate
-  and no refactor. Risk: this ships the seam the judge objected to,
+- **Overrule** — land a clean tree to accept the last attempt as it is: it
+  lands as the implementation, with no seam gate and no refactor. Risk: this ships the seam the judge objected to,
   unaddressed — the choice is recorded in history.
 
 An edit together with an approval counts as steer. Only
@@ -1378,6 +1410,7 @@ const ESCALATION = ".gtd/ESCALATION.md";
 const REQUIREMENTS = ".gtd/REQUIREMENTS.md";
 const REVIEW = ".gtd/REVIEW.md";
 const REFACTOR = ".gtd/REFACTOR.md";
+const REFACTOR_NOTE = ".gtd/REFACTOR-NOTE.md";
 const QUALITY = ".gtd/QUALITY.md";
 const planner = () => env.plannerModel ?? "";
 const coder = () => env.coderModel ?? "";
@@ -1577,7 +1610,11 @@ const ShippedOptions = Struct({
 	testCommand: setting,
 	plannerModel: setting,
 	coderModel: setting,
-	flagMode: optionalWith(Boolean$, { exact: true })
+	flagMode: optionalWith(Boolean$, { exact: true }),
+	contextLimit: optionalWith(Struct({
+		soft: optionalWith(Number$, { exact: true }),
+		hard: optionalWith(Number$, { exact: true })
+	}), { exact: true })
 });
 const over = (base, options) => ({
 	...base,
@@ -1589,12 +1626,13 @@ const flagModeOn = () => {
 	if (value !== "true" && value !== "false") refuse(`gtd: flagMode must be "true" or "false", got ${JSON.stringify(value)}`);
 	return value === "true";
 };
+const limited = (flow, context) => context === void 0 ? flow : () => scope({ context }, flow);
 /** A shipped flow as a factory: its options override the settings it declares, each in its own kind. */
 const shipped = (flow, doors, base) => defineWorkflow(standardSchemaV1(ShippedOptions, {
 	onExcessProperty: "error",
 	errors: "all"
-}), (options) => ({
-	flow,
+}), ({ contextLimit, ...options }) => ({
+	flow: limited(flow, contextLimit),
 	defaults: over(defaults, options),
 	envDefaults: over(envDefaults, options),
 	doors,
@@ -1607,14 +1645,14 @@ const FlagOptions = Struct({
 const flagShipped = (flow, name) => defineWorkflow(standardSchemaV1(FlagOptions, {
 	onExcessProperty: "error",
 	errors: "all"
-}), (options) => {
+}), ({ contextLimit, ...options }) => {
 	const flagDefaults = {
 		...defaults,
 		flag: "",
 		flagRegistry: defaultFlagRegistry
 	};
 	return {
-		flow,
+		flow: limited(flow, contextLimit),
 		defaults: over(flagDefaults, options),
 		envDefaults: over(envDefaults, options),
 		doors: { [name]: {
@@ -1672,4 +1710,4 @@ const steering = {
 	[REVIEW]: "review"
 };
 //#endregion
-export { refactorBuildingPrompt as $, buildReviewCollectingPrompt as A, deferNotesScript as B, planner as C, agentWithSkills as D, reviewing as E, clearCriteriaQuestion as F, fixReviewNotesPrompt as G, designSystem as H, coverageMessage as I, implementBuildingPrompt as J, handOffAwaitReviewMessage as K, coverageQuestion as L, buildReviewTriageMessage as M, builderSystem as N, buildReviewAnswerQuestionsPrompt as O, clearCriteriaMessage as P, qualityUnresolvedMessage as Q, coveringPrompt as R, fixRisks as S, reviewQuality as T, designTriagePrompt as U, designGateAnswerMessage as V, finisherSystem as W, naivePassPrompt as X, implementFixPrompt as Y, normaliseCriteriaScript as Z, REVIEW as _, flagMentions as _t, flagModeOn as a, reviewGateBlockedMessage as at, fixCheck as b, registryEntry as bt, baseline as c, seamByHandMessage as ct, guarded as d, uncoveredMessage as dt, refactorDroppedRefusal as et, healthy as f, unwindFailedMessage as ft, REQUIREMENTS as g, testFileGlobs as gt, REFACTOR as h, envDefaults as ht, skills as i, reviewEditsCapture as it, buildReviewFixNitsPrompt as j, buildReviewAwaitAfterDeferMessage as k, escalation as l, seamSteerMessage as lt, QUALITY as m, defaults as mt, summary as n, refactorRules as nt, flagShipped as o, reviewNotesCapture as ot, FEEDBACK as p, unwindFailure as pt, idleMessage as q, access as r, reviewEditNotesCapture as rt, shipped as s, reviewerSystem as st, steering as t, refactorFixPrompt as tt, gate as u, startGateBlockedMessage as ut, awaitReview as v, flagReferences as vt, reviewMissing as w, fixQuality as x, requireFlag as xt, coder as y, flipProblems as yt, criterionLine as z };
+export { normaliseCriteriaScript as $, buildReviewAwaitAfterDeferMessage as A, criterionLine as B, fixRisks as C, registryEntry as Ct, reviewing as D, reviewQuality as E, clearCriteriaMessage as F, finisherSystem as G, designGateAnswerMessage as H, clearCriteriaQuestion as I, idleMessage as J, fixReviewNotesPrompt as K, coverageMessage as L, buildReviewFixNitsPrompt as M, buildReviewTriageMessage as N, agentWithSkills as O, builderSystem as P, naivePassPrompt as Q, coverageQuestion as R, fixQuality as S, flipProblems as St, reviewMissing as T, designSystem as U, deferNotesScript as V, designTriagePrompt as W, implementFixPrompt as X, implementBuildingPrompt as Y, naiveApplyFailure as Z, REQUIREMENTS as _, defaults as _t, flagModeOn as a, refactorRules as at, coder as b, flagMentions as bt, baseline as c, reviewGateBlockedMessage as ct, guarded as d, seamByHandMessage as dt, qualityUnresolvedMessage as et, healthy as f, seamSteerMessage as ft, REFACTOR_NOTE as g, unwindFailure as gt, REFACTOR as h, unwindFailedMessage as ht, skills as i, refactorNotePrompt as it, buildReviewCollectingPrompt as j, buildReviewAnswerQuestionsPrompt as k, escalation as l, reviewNotesCapture as lt, QUALITY as m, uncoveredMessage as mt, summary as n, refactorDroppedRefusal as nt, flagShipped as o, reviewEditNotesCapture as ot, FEEDBACK as p, startGateBlockedMessage as pt, handOffAwaitReviewMessage as q, access as r, refactorFixPrompt as rt, shipped as s, reviewEditsCapture as st, steering as t, refactorBuildingPrompt as tt, gate as u, reviewerSystem as ut, REVIEW as v, envDefaults as vt, planner as w, requireFlag as wt, fixCheck as x, flagReferences as xt, awaitReview as y, testFileGlobs as yt, coveringPrompt as z };

package/dist/chunks/{tail-oaYewBN_.mjs → tail-BRC4DGdV.mjs}

@@ -1,6 +1,6 @@
 import { read, refuse, removeScript, run, scope, showScript, vars } from "../flows.mjs";
 import { fixFindings, lensEntriesOf, lensOf, qualityLap as qualityLap$1, reviewToHandOff } from "../workflow-kit.mjs";
-import { E as reviewing, K as handOffAwaitReviewMessage, S as fixRisks, T as reviewQuality, _ as REVIEW, b as fixCheck, d as guarded, f as healthy, l as escalation, m as QUALITY, v as awaitReview, w as reviewMissing, x as fixQuality } from "./reserved-C8Fm3s72.mjs";
+import { C as fixRisks, D as reviewing, E as reviewQuality, S as fixQuality, T as reviewMissing, d as guarded, f as healthy, l as escalation, m as QUALITY, q as handOffAwaitReviewMessage, v as REVIEW, x as fixCheck, y as awaitReview } from "./reserved-zAfoJtR7.mjs";
 //#region src/workflows/shared/tail.ts
 /** The reviewer's own `.gtd/REVIEW.md`, kept beside the human's notes so `fix` can tell them apart. */
 const REVIEW_ORIG = ".gtd/REVIEW.orig.md";