@robmclarty/volley 0.9.0 → 0.10.0

package/dist/cli.js

@@ -73,6 +73,34 @@ async function warn_small_local_context(provider, model, base_url, warn, abort)
 	if (warning !== null) warn(warning);
 }
 //#endregion
+//#region src/builder/countdown.ts
+/** How many of a session's last steps carry the countdown: five, or a tenth
+* of a long budget, but never more than half of it, so a short session still
+* starts without one. */
+function countdown_window(max_steps) {
+	return Math.min(Math.max(5, Math.ceil(max_steps / 10)), Math.floor(max_steps / 2));
+}
+/** The note for a turn with `steps_left` steps left, this one included.
+* `check` names how to run the check. On the last step fascicle runs only a
+* call that ends the session, which for the builder is `finish`. */
+function countdown_note(steps_left, check) {
+	if (steps_left <= 1) return "[volley] This is the last step of this session, and only finish runs on it. Call finish now, with a summary that says what's done and what isn't verified.";
+	return `[volley] ${String(steps_left)} steps left in this session, this one included, and on the last one only finish runs. If you haven't run ${check} since your last edit, run it now, then fix what it reports or call finish.`;
+}
+/** The `prepare_step` hook that adds the countdown to a session of
+* `max_steps` steps. */
+function step_countdown(max_steps, check) {
+	const window = countdown_window(max_steps);
+	return ({ step_index, messages }) => {
+		const steps_left = max_steps - step_index;
+		if (steps_left > window) return void 0;
+		return { messages: [...messages, {
+			role: "user",
+			content: countdown_note(steps_left, check)
+		}] };
+	};
+}
+//#endregion
 //#region src/workspace_tools.ts
 /**
 * Shared workspace tools: `contain()` path confinement plus the read-only
@@ -183,6 +211,7 @@ function read_only_tools(workspace) {
 	return [
 		{
 			name: "read_file",
+			read_only: true,
 			description: `Read a UTF-8 text file from the workspace. Returns the file content (truncated at ${String(READ_FILE_MAX_BYTES)} bytes).`,
 			input_schema: read_file_input,
 			execute: (raw) => {
@@ -193,6 +222,7 @@ function read_only_tools(workspace) {
 		},
 		{
 			name: "search_files",
+			read_only: true,
 			description: `Search workspace files for lines matching a regular expression. Returns up to ${String(200)} "relative/path:line: text" hits.`,
 			input_schema: search_files_input,
 			execute: (raw) => {
@@ -222,6 +252,7 @@ function read_only_tools(workspace) {
 		},
 		{
 			name: "list_files",
+			read_only: true,
 			description: "List files under a workspace directory (recursively; skips node_modules, .git, and other build/output directories).",
 			input_schema: list_files_input,
 			execute: (raw) => {
@@ -642,6 +673,273 @@ function finish_tool() {
 	};
 }
 //#endregion
+//#region src/types.ts
+function config_error(message) {
+	return Object.assign(new Error(message), { kind: "config_error" });
+}
+function check_error(message) {
+	return Object.assign(new Error(message), { kind: "check_error" });
+}
+/** Wraps a provider/schema failure with the phase and iteration it hit. */
+function phase_error(phase, iteration, cause) {
+	const detail = cause instanceof Error ? cause.message : String(cause);
+	return Object.assign(/* @__PURE__ */ new Error(`${phase} failed on iteration ${iteration}: ${detail}`), {
+		kind: "phase_error",
+		phase,
+		iteration,
+		cause
+	});
+}
+function error_kind(err) {
+	if (typeof err === "object" && err !== null && "kind" in err) {
+		const kind = err.kind;
+		return typeof kind === "string" ? kind : null;
+	}
+	return null;
+}
+//#endregion
+//#region src/check/checkride.ts
+/**
+* checkride runner: spawn `pnpm exec checkride --json --digest`, gate on the
+* `.check/summary.json` contract (`schema_version: 1`), and collect raw
+* failing-slot artifacts for the critic — the critic reads what the tool
+* actually said, not a normalized digest. The digest checkride writes on a red
+* run is kept beside them for the next builder, which needs a short list of
+* what to fix more than the whole of every slot's output.
+*/
+const CHECK_ARTIFACT_MAX_CHARS = 8e3;
+const CHECKRIDE_SCHEMA_VERSION = 1;
+/** How long a check's output may stay open after its shell exits, while
+* something that escaped its process group still holds it, before the reads
+* stop so the check can finish. */
+const OUTPUT_GRACE_MS = 2e3;
+/** Kill a check's whole process group with SIGKILL. A test runner's workers,
+* and anything the check started in the background, sit in the shell's group,
+* so killing the shell alone would leave them running. Windows has no process
+* groups to signal, so there only the shell goes. */
+function kill_group(proc) {
+	if (proc.pid === void 0) return;
+	try {
+		if (process.platform === "win32") proc.kill("SIGKILL");
+		else process.kill(-proc.pid, "SIGKILL");
+	} catch {}
+}
+/** Run a check to its end in a process group of its own, capturing its
+* output. The abort kills the whole group and rejects with `aborted_error`,
+* and the shell's exit kills whatever it left behind, so a stopped run leaves
+* no test workers or servers running. */
+function spawn_capture(cmd, args, options) {
+	const { abort } = options;
+	if (abort?.aborted === true) return Promise.reject(new aborted_error("check aborted"));
+	return new Promise((resolve_promise, reject) => {
+		const proc = spawn(cmd, args, {
+			cwd: options.cwd,
+			...options.env !== void 0 ? { env: options.env } : {},
+			detached: process.platform !== "win32",
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let stdout = "";
+		let stderr = "";
+		let grace;
+		const on_abort = () => {
+			kill_group(proc);
+			reject(new aborted_error("check aborted"));
+		};
+		const finish = () => {
+			clearTimeout(grace);
+			abort?.removeEventListener("abort", on_abort);
+		};
+		proc.stdout.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		proc.stderr.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		proc.on("error", (err) => {
+			finish();
+			reject(check_error(`check command failed to start: ${err.message}`));
+		});
+		proc.on("exit", () => {
+			kill_group(proc);
+			grace = setTimeout(() => {
+				proc.stdout.destroy();
+				proc.stderr.destroy();
+			}, OUTPUT_GRACE_MS);
+		});
+		proc.on("close", (code) => {
+			finish();
+			resolve_promise({
+				exit_code: code,
+				stdout,
+				stderr
+			});
+		});
+		abort?.addEventListener("abort", on_abort, { once: true });
+	});
+}
+/** Best-effort parse of the summary contract. `pnpm exec` talks over the
+* command's stdout (pnpm 11's dep-verify prints an "Already up to date"
+* install line ahead of the JSON), so the object is extracted between the
+* first `{` and the last `}` rather than parsed from byte 0. An unexpected
+* schema_version warns and still parses; no JSON object at all is a harness
+* error (exit 4). */
+function parse_checkride_summary(stdout) {
+	const start = stdout.indexOf("{");
+	const end = stdout.lastIndexOf("}");
+	let raw;
+	try {
+		if (start === -1 || end < start) throw new Error("no JSON object in stdout");
+		raw = JSON.parse(stdout.slice(start, end + 1));
+	} catch {
+		throw check_error("checkride --json produced unparseable stdout");
+	}
+	if (typeof raw !== "object" || raw === null || !Array.isArray(raw.checks)) throw check_error("checkride summary missing checks array");
+	const summary = raw;
+	return {
+		summary,
+		warning: summary.schema_version === CHECKRIDE_SCHEMA_VERSION ? null : `checkride summary schema_version ${String(summary.schema_version)} != ${String(CHECKRIDE_SCHEMA_VERSION)}; parsing best-effort`
+	};
+}
+/** Parse the summary from stdout, falling back to the on-disk contract:
+* `.check/summary.json` is what checkride documents; stdout is its mirror and
+* wrappers may talk over it beyond what the tolerant slice can recover. */
+function parse_summary_with_fallback(stdout, workspace) {
+	try {
+		return parse_checkride_summary(stdout);
+	} catch (err) {
+		const file = join(workspace, ".check", "summary.json");
+		if (!existsSync(file)) throw err;
+		return parse_checkride_summary(readFileSync(file, "utf8"));
+	}
+}
+function failing_checks(summary) {
+	return summary.checks.filter((c) => !c.ok && c.skipped !== true);
+}
+/** Whether `path` sits under `dir`. */
+function within(dir, path) {
+	const from_dir = relative(dir, path);
+	return from_dir !== ".." && !from_dir.startsWith(`..${sep}`) && !isAbsolute(from_dir);
+}
+/** Per failing slot: the raw artifact (`<output_file>` when present, else
+* `<slot>.stdout.txt`) in `check_dir`, a workspace's `.check/` or an archived
+* iteration's copy of it, truncated with a pointer to the file. The names come
+* from a summary the builder could have written, so a path that leaves
+* `check_dir` has no artifact, rather than putting a file from elsewhere in
+* front of a model. */
+function read_failing_artifacts(check_dir, failing) {
+	return failing.map((check) => {
+		const file = check.output_file ?? `${check.name}.stdout.txt`;
+		const path = join(check_dir, file);
+		if (!within(check_dir, path) || !existsSync(path) || !statSync(path).isFile()) return {
+			slot: check.name,
+			path: null,
+			content: "(no artifact found)",
+			truncated: false
+		};
+		const raw = readFileSync(path, "utf8");
+		const truncated = raw.length > CHECK_ARTIFACT_MAX_CHARS;
+		return {
+			slot: check.name,
+			path,
+			content: truncated ? raw.slice(0, CHECK_ARTIFACT_MAX_CHARS) : raw,
+			truncated
+		};
+	});
+}
+/** checkride's digest of a red run (`.check/digest.md`, written under
+* `--digest` and removed on a green one), or undefined when there is none. It
+* is capped by checkride itself, at 8 kB. */
+function read_digest(workspace) {
+	const path = join(workspace, ".check", "digest.md");
+	return existsSync(path) ? readFileSync(path, "utf8") : void 0;
+}
+async function run_checkride(opts) {
+	const { workspace, ...spawn_options } = opts;
+	const proc = await spawn_capture("pnpm", [
+		"exec",
+		"checkride",
+		"--json",
+		"--digest"
+	], {
+		...spawn_options,
+		cwd: workspace
+	});
+	if (proc.exit_code === 2) throw check_error(`checkride harness error: ${proc.stderr.trim()}`);
+	const { summary } = parse_summary_with_fallback(proc.stdout, opts.workspace);
+	const failing = failing_checks(summary);
+	const digest = summary.ok ? void 0 : read_digest(opts.workspace);
+	return {
+		ran: true,
+		runner: "checkride",
+		ok: summary.ok,
+		exit_code: proc.exit_code,
+		duration_ms: summary.total_duration_ms,
+		failing_slots: failing.map((c) => c.name),
+		detail: read_failing_artifacts(join(opts.workspace, ".check"), failing),
+		summary,
+		...digest !== void 0 ? { digest } : {}
+	};
+}
+//#endregion
+//#region src/check/command.ts
+/**
+* Generic command runner: `sh -c <command>`, combined
+* output captured, exit-0 semantics. Command-not-found is an operator error
+* (exit 4), not an iterable failure.
+*/
+async function run_command_check(opts) {
+	const { command, workspace, ...spawn_options } = opts;
+	const started = Date.now();
+	const proc = await spawn_capture("sh", ["-c", command], {
+		...spawn_options,
+		cwd: workspace
+	});
+	if (proc.exit_code === 127 || proc.exit_code === 126) throw check_error(`check command failed to start (exit ${String(proc.exit_code)}): ${command}`);
+	const log = `${proc.stdout}${proc.stderr}`;
+	return {
+		ran: true,
+		runner: "command",
+		ok: proc.exit_code === 0,
+		exit_code: proc.exit_code,
+		duration_ms: Date.now() - started,
+		failing_slots: [],
+		detail: [],
+		log
+	};
+}
+function skipped_check(reason) {
+	return {
+		ran: false,
+		runner: "none",
+		ok: reason === "none",
+		exit_code: null,
+		duration_ms: 0,
+		failing_slots: [],
+		detail: []
+	};
+}
+/** What a rejected check says in place of its output. */
+const CHECK_REJECTED = "the check was rejected when it asked to run, so it never ran";
+/** A check the user rejected when it asked to run: recorded as a failed
+* check, with the refusal as its output, so a round can't converge on work
+* nothing checked, and the critic hears why there's no result. */
+function rejected_check(runner) {
+	return {
+		ran: true,
+		runner,
+		ok: false,
+		exit_code: null,
+		duration_ms: 0,
+		failing_slots: [],
+		detail: [],
+		log: CHECK_REJECTED
+	};
+}
+//#endregion
 //#region src/cost.ts
 /**
 * Cost and usage accumulation. All pricing knowledge lives in
@@ -681,6 +979,7 @@ function cost_source_of(result) {
 * its whole degradation ladder. */
 function phase_record(result, model, duration_ms = result.timing?.duration_ms ?? 0) {
 	const rate = throughput(result);
+	const truncated = result.steps.filter((step) => step.truncated === true).length;
 	return {
 		provider: result.model_resolved.provider,
 		model,
@@ -692,6 +991,7 @@ function phase_record(result, model, duration_ms = result.timing?.duration_ms ??
 		finish_reason: result.finish_reason,
 		tool_calls: result.tool_calls.length,
 		salvaged_tool_calls: result.tool_calls.filter((call) => call.salvaged === true).length,
+		...truncated > 0 ? { truncated_turns: truncated } : {},
 		...rate !== void 0 ? { throughput: rate } : {}
 	};
 }
@@ -715,31 +1015,6 @@ function cost_cap_hit(config, state) {
 	return config.max_cost_usd !== null && state.total_cost_usd >= config.max_cost_usd;
 }
 //#endregion
-//#region src/types.ts
-function config_error(message) {
-	return Object.assign(new Error(message), { kind: "config_error" });
-}
-function check_error(message) {
-	return Object.assign(new Error(message), { kind: "check_error" });
-}
-/** Wraps a provider/schema failure with the phase and iteration it hit. */
-function phase_error(phase, iteration, cause) {
-	const detail = cause instanceof Error ? cause.message : String(cause);
-	return Object.assign(/* @__PURE__ */ new Error(`${phase} failed on iteration ${iteration}: ${detail}`), {
-		kind: "phase_error",
-		phase,
-		iteration,
-		cause
-	});
-}
-function error_kind(err) {
-	if (typeof err === "object" && err !== null && "kind" in err) {
-		const kind = err.kind;
-		return typeof kind === "string" ? kind : null;
-	}
-	return null;
-}
-//#endregion
 //#region src/engine.ts
 /**
 * The ONLY module that calls fascicle's `create_engine`. Every
@@ -1192,6 +1467,7 @@ function write_resolved_config(config, env = process.env) {
 		builder_url: config.builder_url,
 		builder_max_steps: config.builder_max_steps,
 		builder_max_tool_calls: config.builder_max_tool_calls,
+		builder_max_output_tokens: config.builder_max_output_tokens,
 		critic_model: config.critic_model,
 		critic_provider: config.critic_provider,
 		critic_url: config.critic_url,
@@ -1219,6 +1495,29 @@ function write_resolved_config(config, env = process.env) {
 	writeFileSync(state_path(config, CONFIG_SIGNATURE), `${signature}\n`);
 	return true;
 }
+/** The identity volley's own commits fall back to. git won't commit without a
+* name and an email, and the sandbox image carries no git config, so inside
+* it a checkpoint or a worktree's salvage commit failed outright; a machine
+* never set up for git can be the same. `.invalid` is reserved, so the email
+* can't reach anyone. */
+const FALLBACK_IDENTITY = [["user.name", "volley"], ["user.email", "volley@volley.invalid"]];
+/** The `-c` flags that give a commit in `cwd` the fallback identity for each
+* part git has no value for. One the repo or the user configured wins, and so
+* does a `GIT_AUTHOR_*` or `GIT_COMMITTER_*` variable, which git ranks above
+* any config. Put them ahead of the subcommand. */
+function commit_identity(cwd) {
+	return FALLBACK_IDENTITY.flatMap(([key, value]) => {
+		const set = spawnSync("git", [
+			"config",
+			"--get",
+			key
+		], {
+			cwd,
+			encoding: "utf8"
+		});
+		return set.status === 0 && set.stdout.trim() !== "" ? [] : ["-c", `${key}=${value}`];
+	});
+}
 /**
 * `--git`: commit everything under `root` after a phase (`git -C <root>`, run
 * here via the spawn `cwd`). `root` is the build root (`build_root`): the
@@ -1244,6 +1543,7 @@ function git_checkpoint(root, message, excluded_dir = null) {
 	], { cwd: root });
 	if (add.error !== void 0 || add.status !== 0) throw check_error(`git add failed: ${add.stderr?.toString() ?? String(add.error)}`);
 	const commit = spawnSync("git", [
+		...commit_identity(root),
 		"commit",
 		"-m",
 		message,
@@ -1277,6 +1577,7 @@ function integrate_worktree(workspace, branch, message) {
 	if (squash.error !== void 0) throw check_error(`git merge --squash failed to start: ${String(squash.error)}`);
 	if (squash.status !== 0) throw check_error(`git merge --squash ${branch} failed: ${(squash.stderr || squash.stdout).trim()}`);
 	const commit = spawnSync("git", [
+		...commit_identity(workspace),
 		"commit",
 		"-m",
 		message,
@@ -1541,6 +1842,7 @@ function salvage_worktree(repo, path, branch) {
 	if (existsSync(path)) {
 		git_quiet(path, ["add", "-A"]);
 		git_quiet(path, [
+			...commit_identity(path),
 			"commit",
 			"-m",
 			`volley: salvage unintegrated worktree (${branch})`,
@@ -1669,14 +1971,9 @@ const HARNESS_APPENDS = {
 const ONE_CALL_A_TURN = "2. Call one tool at a time and read its result before deciding the next\n   call.";
 /** Step 2 for a builder that may make several calls a turn: fascicle runs a
 * turn's calls in order, so a read can't race an edit, but each change or
-* command is still worth reading before the next. */
-function batched_calls(max_tool_calls) {
-	return [
-		`2. Batch independent reads into one turn, up to ${String(max_tool_calls)} calls, but`,
-		"   make one change or command per turn, and read its result before",
-		"   deciding the next call."
-	].join("\n");
-}
+* command is still worth reading before the next. Reads don't count toward
+* the cap, so the step names no number. */
+const BATCHED_CALLS = ["2. Batch independent reads into one turn, but make one change or command per", "   turn, and read its result before deciding the next call."].join("\n");
 function compose_builder_system_local(tool_set = "volley", max_tool_calls = 1) {
 	const identity = [
 		"You are the builder inside the volley harness: an autonomous agent",
@@ -1684,7 +1981,7 @@ function compose_builder_system_local(tool_set = "volley", max_tool_calls = 1) {
 		"criteria."
 	].join("\n");
 	const append = readFileSync(join(builder_presets_dir(), HARNESS_APPENDS[tool_set]), "utf8");
-	return `${identity}\n\n${(max_tool_calls > 1 ? append.replace(ONE_CALL_A_TURN, batched_calls(max_tool_calls)) : append).trimEnd()}`;
+	return `${identity}\n\n${(max_tool_calls > 1 ? append.replace(ONE_CALL_A_TURN, BATCHED_CALLS) : append).trimEnd()}`;
 }
 /** The builder system prompt for the active provider: the `claude_cli`
 * prompt (implicit built-in tools, "the current working directory") for the
@@ -1695,15 +1992,25 @@ function resolve_builder_system(config, tool_set) {
 	return config.builder_provider === "claude_cli" ? compose_builder_system() : compose_builder_system_local(tool_set, config.builder_max_tool_calls);
 }
 const BUILDER_TOOL_CALL_REPAIR_ATTEMPTS = 3;
+/** How the step countdown tells the builder to run the check: the command
+* volley gates on, with the digest and without `--json`, the configured
+* command, or the project's own tests when no check gates the run. A
+* workspace can hold checkride with no `check` script, so not `pnpm check`. */
+function check_hint(config) {
+	if (config.check_resolved === "checkride") return "the check (`pnpm exec checkride --digest`)";
+	if (config.check_resolved === "command") return `the check (\`${config.check}\`)`;
+	return "the project's tests";
+}
 /** Per-provider tool wiring for the builder, mirroring `critic_tool_options`.
 * The `claude_cli` builder is confined at the CLI permission layer (allowlist +
 * permission mode) and brings its own built-in tools — this arm is unchanged
 * from v2, and takes no injected tools or approval handler. Every other
 * builder, local or `openrouter`, brings none, so volley supplies its whole
 * workspace tool surface (or the set the caller injected in its place, with
-* the handler that answers its approvals) plus the five per-call loop knobs
-* and **no** schema (it produces a workspace, not a verdict); per-call values
-* win over engine defaults. */
+* the handler that answers its approvals), the per-call loop knobs, the step
+* countdown (`./builder/countdown.ts`), the output cap when one is set, and
+* **no** schema (it produces a workspace, not a verdict); per-call values win
+* over engine defaults. */
 function builder_tool_options(deps) {
 	const { config } = deps;
 	const bash_executor = deps.bash_executor ?? null;
@@ -1717,9 +2024,75 @@ function builder_tool_options(deps) {
 		max_steps: config.builder_max_steps,
 		tool_error_policy: "feed_back",
 		tool_call_repair_attempts: BUILDER_TOOL_CALL_REPAIR_ATTEMPTS,
-		max_tool_calls_per_step: config.builder_max_tool_calls
+		max_tool_calls_per_step: config.builder_max_tool_calls,
+		prepare_step: step_countdown(config.builder_max_steps, check_hint(config)),
+		...config.builder_max_output_tokens !== null ? {
+			max_tokens: config.builder_max_output_tokens,
+			truncated_turn_policy: "continue"
+		} : {}
 	};
 }
+/** How much of the last check's output the builder's prompt carries: a few KB,
+* whatever the runner. checkride's digest already fits in 8 kB, and the builder
+* can run the check again for the rest. */
+const PREVIOUS_CHECK_MAX_CHARS = 6e3;
+/** The first `max` characters of `text`, saying where it was cut. */
+function head(text, max, rest) {
+	return text.length <= max ? text : `${text.slice(0, max)}\n… (cut at ${String(max)} characters; ${rest})`;
+}
+/** The last `max` characters of `text`, saying what came before was cut. */
+function tail(text, max) {
+	return text.length <= max ? text : `… (the last ${String(max)} characters of ${String(text.length)})\n${text.slice(-max)}`;
+}
+/** The part of a failed check the builder reads first: checkride's digest,
+* else the start of each failing slot's raw output, else the end of a
+* command's output, where test runners and compilers sum up. */
+function check_excerpt(check) {
+	const max = PREVIOUS_CHECK_MAX_CHARS;
+	if (check.digest !== void 0) return head(check.digest.trimEnd(), max, ".check/digest.md has the rest");
+	if (check.detail.length > 0) return head(check.detail.map((artifact) => {
+		const source = artifact.path === null ? "" : ` (.check/${basename(artifact.path)})`;
+		return `${artifact.slot}${source}:\n${artifact.content.trimEnd()}`;
+	}).join("\n\n"), max, "each slot's raw output under .check/ has the rest");
+	return tail((check.log ?? "").trimEnd(), max);
+}
+/** The check section of a later iteration's prompt: what the deterministic
+* gate itself said about the last session's work, so the builder starts from
+* its words rather than the critic's account of them, or re-running it to
+* find out. Empty unless that check ran and failed. A check the user rejected
+* when it asked to run is recorded as failed but said nothing, and the
+* section says so rather than call the work failed. */
+function previous_check_section(check) {
+	if (check === null || !check.ran || check.ok) return [];
+	const heading = [
+		"",
+		"PREVIOUS CHECK RESULT",
+		"---------------------"
+	];
+	if (check.log === "the check was rejected when it asked to run, so it never ran") return [
+		...heading,
+		"The check never ran on the work your last session left: it was rejected when it",
+		"asked to run, so nothing has verified that work yet."
+	];
+	const runner = check.runner === "checkride" ? "checkride, " : "";
+	const exit = check.exit_code === null ? "no exit code" : `exit ${String(check.exit_code)}`;
+	const lines = [...heading, `The check failed on the work your last session left (${runner}${exit}).`];
+	if (check.failing_slots.length > 0) lines.push(`Failing slots: ${check.failing_slots.join(", ")}.`);
+	const excerpt = check_excerpt(check);
+	if (excerpt.length > 0) lines.push("", excerpt);
+	return lines;
+}
+/** The line a later iteration's prompt carries when the last session ran out
+* of steps: it never got to verify, so this one should check first. */
+function step_limit_lines(step_limit_hit) {
+	if (step_limit_hit === null) return [];
+	return [
+		"",
+		`Your last session hit its ${String(step_limit_hit)}-step limit before it called finish, so`,
+		"it may never have verified its work. Run the check first this time, and keep",
+		"enough steps in hand to verify again before you finish."
+	];
+}
 function compose_builder_prompt(input) {
 	const parts = [
 		"TASK",
@@ -1733,7 +2106,8 @@ function compose_builder_prompt(input) {
 		`ITERATION: ${input.iteration}`
 	];
 	if (input.iteration > 1 && input.feedback !== null) parts.push("", "PREVIOUS CRITIC FEEDBACK", "------------------------", input.feedback, "", "Address the feedback above. The workspace already contains your prior work;", "read the current state, then make the necessary changes.");
-	if (input.checkride) parts.push("", "The definition of done for this workspace includes `pnpm check` (checkride)", "exiting 0. Run it yourself before finishing; on failure, read", ".check/summary.json, then the failing slot's raw output, fix, and re-run.");
+	if (input.iteration > 1 && input.previous !== null) parts.push(...previous_check_section(input.previous.check), ...step_limit_lines(input.previous.step_limit_hit));
+	if (input.checkride) parts.push("", "The definition of done for this workspace includes checkride exiting 0. Run", "`pnpm exec checkride --digest`, the check volley gates on, after each batch of", "edits and again before you finish. When it fails, read .check/digest.md", "first: it lists each failing slot's first findings. Open a slot's raw", "output under .check/ only if the digest isn't enough, then fix and re-run.");
 	return parts.join("\n");
 }
 function builder_max_steps_warning(max_steps) {
@@ -1755,7 +2129,9 @@ function make_builder_step(deps) {
 		...builder_tool_options(deps)
 	});
 }
-async function run_builder(deps, state, ctx) {
+/** Run one builder session on the opened iteration `state`, told what the
+* iteration before it left behind (`previous`, null on the first). */
+async function run_builder(deps, state, previous, ctx) {
 	const { config } = deps;
 	try {
 		if (config.builder_provider === "ollama") {
@@ -1768,10 +2144,16 @@ async function run_builder(deps, state, ctx) {
 			criteria: config.criteria,
 			feedback: state.feedback,
 			iteration: state.iteration,
-			checkride: config.check_resolved === "checkride"
+			checkride: config.check_resolved === "checkride",
+			previous
 		}));
-		if (result.finish_reason === "max_steps") deps.warn(builder_max_steps_warning(config.builder_max_steps));
-		return accumulate(state, "builder", result, config.builder_model);
+		const built = accumulate(state, "builder", result, config.builder_model);
+		if (result.finish_reason !== "max_steps") return built;
+		deps.warn(builder_max_steps_warning(config.builder_max_steps));
+		return {
+			...built,
+			builder_max_steps_hits: built.builder_max_steps_hits + 1
+		};
 	} catch (err) {
 		throw phase_error("builder", state.iteration, err);
 	}
@@ -2042,227 +2424,6 @@ function collect_changes(options) {
 	};
 }
 //#endregion
-//#region src/check/checkride.ts
-/**
-* checkride runner: spawn `pnpm exec checkride --json`, gate on the
-* `.check/summary.json` contract (`schema_version: 1`), and collect raw
-* failing-slot artifacts for the critic — the critic reads what the tool
-* actually said, not a normalized digest.
-*/
-const CHECK_ARTIFACT_MAX_CHARS = 8e3;
-const CHECKRIDE_SCHEMA_VERSION = 1;
-/** How long a check's output may stay open after its shell exits, while
-* something that escaped its process group still holds it, before the reads
-* stop so the check can finish. */
-const OUTPUT_GRACE_MS = 2e3;
-/** Kill a check's whole process group with SIGKILL. A test runner's workers,
-* and anything the check started in the background, sit in the shell's group,
-* so killing the shell alone would leave them running. Windows has no process
-* groups to signal, so there only the shell goes. */
-function kill_group(proc) {
-	if (proc.pid === void 0) return;
-	try {
-		if (process.platform === "win32") proc.kill("SIGKILL");
-		else process.kill(-proc.pid, "SIGKILL");
-	} catch {}
-}
-/** Run a check to its end in a process group of its own, capturing its
-* output. The abort kills the whole group and rejects with `aborted_error`,
-* and the shell's exit kills whatever it left behind, so a stopped run leaves
-* no test workers or servers running. */
-function spawn_capture(cmd, args, options) {
-	const { abort } = options;
-	if (abort?.aborted === true) return Promise.reject(new aborted_error("check aborted"));
-	return new Promise((resolve_promise, reject) => {
-		const proc = spawn(cmd, args, {
-			cwd: options.cwd,
-			...options.env !== void 0 ? { env: options.env } : {},
-			detached: process.platform !== "win32",
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			]
-		});
-		let stdout = "";
-		let stderr = "";
-		let grace;
-		const on_abort = () => {
-			kill_group(proc);
-			reject(new aborted_error("check aborted"));
-		};
-		const finish = () => {
-			clearTimeout(grace);
-			abort?.removeEventListener("abort", on_abort);
-		};
-		proc.stdout.on("data", (chunk) => {
-			stdout += chunk.toString();
-		});
-		proc.stderr.on("data", (chunk) => {
-			stderr += chunk.toString();
-		});
-		proc.on("error", (err) => {
-			finish();
-			reject(check_error(`check command failed to start: ${err.message}`));
-		});
-		proc.on("exit", () => {
-			kill_group(proc);
-			grace = setTimeout(() => {
-				proc.stdout.destroy();
-				proc.stderr.destroy();
-			}, OUTPUT_GRACE_MS);
-		});
-		proc.on("close", (code) => {
-			finish();
-			resolve_promise({
-				exit_code: code,
-				stdout,
-				stderr
-			});
-		});
-		abort?.addEventListener("abort", on_abort, { once: true });
-	});
-}
-/** Best-effort parse of the summary contract. `pnpm exec` talks over the
-* command's stdout (pnpm 11's dep-verify prints an "Already up to date"
-* install line ahead of the JSON), so the object is extracted between the
-* first `{` and the last `}` rather than parsed from byte 0. An unexpected
-* schema_version warns and still parses; no JSON object at all is a harness
-* error (exit 4). */
-function parse_checkride_summary(stdout) {
-	const start = stdout.indexOf("{");
-	const end = stdout.lastIndexOf("}");
-	let raw;
-	try {
-		if (start === -1 || end < start) throw new Error("no JSON object in stdout");
-		raw = JSON.parse(stdout.slice(start, end + 1));
-	} catch {
-		throw check_error("checkride --json produced unparseable stdout");
-	}
-	if (typeof raw !== "object" || raw === null || !Array.isArray(raw.checks)) throw check_error("checkride summary missing checks array");
-	const summary = raw;
-	return {
-		summary,
-		warning: summary.schema_version === CHECKRIDE_SCHEMA_VERSION ? null : `checkride summary schema_version ${String(summary.schema_version)} != ${String(CHECKRIDE_SCHEMA_VERSION)}; parsing best-effort`
-	};
-}
-/** Parse the summary from stdout, falling back to the on-disk contract:
-* `.check/summary.json` is what checkride documents; stdout is its mirror and
-* wrappers may talk over it beyond what the tolerant slice can recover. */
-function parse_summary_with_fallback(stdout, workspace) {
-	try {
-		return parse_checkride_summary(stdout);
-	} catch (err) {
-		const file = join(workspace, ".check", "summary.json");
-		if (!existsSync(file)) throw err;
-		return parse_checkride_summary(readFileSync(file, "utf8"));
-	}
-}
-function failing_checks(summary) {
-	return summary.checks.filter((c) => !c.ok && c.skipped !== true);
-}
-/** Per failing slot: the raw artifact (`.check/<output_file>` when present,
-* else `.check/<slot>.stdout.txt`), truncated with a pointer to the file. */
-function read_failing_artifacts(workspace, failing) {
-	return failing.map((check) => {
-		const file = check.output_file ?? `${check.name}.stdout.txt`;
-		const path = join(workspace, ".check", file);
-		if (!existsSync(path)) return {
-			slot: check.name,
-			path: null,
-			content: "(no artifact found)",
-			truncated: false
-		};
-		const raw = readFileSync(path, "utf8");
-		const truncated = raw.length > CHECK_ARTIFACT_MAX_CHARS;
-		return {
-			slot: check.name,
-			path,
-			content: truncated ? raw.slice(0, CHECK_ARTIFACT_MAX_CHARS) : raw,
-			truncated
-		};
-	});
-}
-async function run_checkride(opts) {
-	const { workspace, ...spawn_options } = opts;
-	const proc = await spawn_capture("pnpm", [
-		"exec",
-		"checkride",
-		"--json"
-	], {
-		...spawn_options,
-		cwd: workspace
-	});
-	if (proc.exit_code === 2) throw check_error(`checkride harness error: ${proc.stderr.trim()}`);
-	const { summary } = parse_summary_with_fallback(proc.stdout, opts.workspace);
-	const failing = failing_checks(summary);
-	return {
-		ran: true,
-		runner: "checkride",
-		ok: summary.ok,
-		exit_code: proc.exit_code,
-		duration_ms: summary.total_duration_ms,
-		failing_slots: failing.map((c) => c.name),
-		detail: read_failing_artifacts(opts.workspace, failing),
-		summary
-	};
-}
-//#endregion
-//#region src/check/command.ts
-/**
-* Generic command runner: `sh -c <command>`, combined
-* output captured, exit-0 semantics. Command-not-found is an operator error
-* (exit 4), not an iterable failure.
-*/
-async function run_command_check(opts) {
-	const { command, workspace, ...spawn_options } = opts;
-	const started = Date.now();
-	const proc = await spawn_capture("sh", ["-c", command], {
-		...spawn_options,
-		cwd: workspace
-	});
-	if (proc.exit_code === 127 || proc.exit_code === 126) throw check_error(`check command failed to start (exit ${String(proc.exit_code)}): ${command}`);
-	const log = `${proc.stdout}${proc.stderr}`;
-	return {
-		ran: true,
-		runner: "command",
-		ok: proc.exit_code === 0,
-		exit_code: proc.exit_code,
-		duration_ms: Date.now() - started,
-		failing_slots: [],
-		detail: [],
-		log
-	};
-}
-function skipped_check(reason) {
-	return {
-		ran: false,
-		runner: "none",
-		ok: reason === "none",
-		exit_code: null,
-		duration_ms: 0,
-		failing_slots: [],
-		detail: []
-	};
-}
-/** What a rejected check says in place of its output. */
-const CHECK_REJECTED = "the check was rejected when it asked to run, so it never ran";
-/** A check the user rejected when it asked to run: recorded as a failed
-* check, with the refusal as its output, so a round can't converge on work
-* nothing checked, and the critic hears why there's no result. */
-function rejected_check(runner) {
-	return {
-		ran: true,
-		runner,
-		ok: false,
-		exit_code: null,
-		duration_ms: 0,
-		failing_slots: [],
-		detail: [],
-		log: CHECK_REJECTED
-	};
-}
-//#endregion
 //#region src/critic/prompt.ts
 /**
 * Critic prompt resolution and composition. Presets live as
@@ -2791,6 +2952,7 @@ function phase_summary(record) {
 		tool_calls: record.tool_calls,
 		salvaged_tool_calls: record.salvaged_tool_calls,
 		salvage_rate: record.tool_calls === 0 ? 0 : record.salvaged_tool_calls / record.tool_calls,
+		...record.truncated_turns !== void 0 ? { truncated_turns: record.truncated_turns } : {},
 		...record.retries !== void 0 ? { retries: record.retries } : {},
 		...record.retry_cause_kind !== void 0 ? { retry_cause_kind: record.retry_cause_kind } : {},
 		...record.critic_degraded === true ? { critic_degraded: true } : {},
@@ -2813,6 +2975,8 @@ function archive_iteration(config, state) {
 		if (check.runner === "checkride") {
 			if (check.summary !== void 0) write_json(join(dir, "check", "summary.json"), check.summary);
 			for (const artifact of check.detail) if (artifact.path !== null && existsSync(artifact.path)) writeFileSync(join(dir, "check", basename(artifact.path)), readFileSync(artifact.path));
+			if (check.digest !== void 0) writeFileSync(join(dir, "check", "digest.md"), check.digest);
+			if (check.log !== void 0) writeFileSync(join(dir, "check", "check.log"), check.log);
 		} else {
 			writeFileSync(join(dir, "check", "check.log"), check.log ?? "");
 			writeFileSync(join(dir, "check", "check.exit"), `${String(check.exit_code)}\n`);
@@ -2853,6 +3017,7 @@ function run_result_from_state(config, state, status, completed_at) {
 		builder_cost_usd: state.builder_cost_usd,
 		critic_cost_usd: state.critic_cost_usd,
 		check_duration_ms: state.check_duration_ms,
+		builder_max_steps_hits: state.builder_max_steps_hits,
 		final_verdict: state.verdict,
 		salvaged_branch: null,
 		run_state_dir: run_state_dir(config),
@@ -2911,6 +3076,95 @@ function refuse_symlinks(dir) {
 		if (entry.isDirectory()) refuse_symlinks(path);
 	}
 }
+/** An archived file's text, or undefined when there's no file to read there. */
+function read_text(path) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return;
+	}
+}
+function read_json(path) {
+	const text = read_text(path);
+	if (text === void 0) return null;
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+/** The failing slots' raw artifacts from an archived iteration's `check/`,
+* which holds each under its base name, found through the archived checkride
+* summary. */
+function archived_artifacts(check_dir, failing_slots) {
+	const summary = read_json(join(check_dir, "summary.json"));
+	const checks = Array.isArray(summary?.checks) ? summary.checks : [];
+	return read_failing_artifacts(check_dir, failing_slots.map((name) => {
+		const output_file = checks.find((check) => check.name === name)?.output_file;
+		return {
+			name,
+			adapter: null,
+			ok: false,
+			exit_code: null,
+			duration_ms: 0,
+			output_file: typeof output_file === "string" ? basename(output_file) : null
+		};
+	}));
+}
+/** The check an archived iteration ran, rebuilt from its directory with the
+* output its failure is shown by: the digest and the failing slots' artifacts
+* for checkride, the log for a command or a rejected check. Null when it ran
+* none. */
+function archived_check(dir, recorded) {
+	if (recorded?.ran !== true || typeof recorded.ok !== "boolean") return null;
+	const runner = recorded.runner === "checkride" ? "checkride" : "command";
+	const failing_slots = Array.isArray(recorded.failing_slots) ? recorded.failing_slots.filter((slot) => typeof slot === "string") : [];
+	const check = {
+		ran: true,
+		runner,
+		ok: recorded.ok,
+		exit_code: typeof recorded.exit_code === "number" ? recorded.exit_code : null,
+		duration_ms: typeof recorded.duration_ms === "number" ? recorded.duration_ms : 0,
+		failing_slots,
+		detail: []
+	};
+	if (check.ok) return check;
+	const check_dir = join(dir, "check");
+	const log = read_text(join(check_dir, "check.log"));
+	const logged = log === void 0 ? check : {
+		...check,
+		log
+	};
+	if (runner === "command") return logged;
+	const digest = read_text(join(check_dir, "digest.md"));
+	return {
+		...logged,
+		detail: archived_artifacts(check_dir, failing_slots),
+		...digest !== void 0 ? { digest } : {}
+	};
+}
+/** An archived builder record, as `archive_iteration` wrote it from the
+* phase's own, or null when there is none with a finish reason. */
+function archived_builder(recorded) {
+	if (typeof recorded !== "object" || recorded === null) return null;
+	return typeof recorded.finish_reason === "string" ? recorded : null;
+}
+/** What the last completed iteration left for the next build: its check and
+* its builder's record, which tell the resumed run's first builder what the
+* gate said and whether the last session ran out of steps, as a run that never
+* stopped would have. Null for both before the first iteration. */
+function archived_round(run, completed) {
+	if (completed === 0) return {
+		check: null,
+		builder: null
+	};
+	const dir = iteration_dir(run, completed);
+	const recorded = read_json(join(dir, "summary.json"));
+	return {
+		check: archived_check(dir, recorded?.check),
+		builder: archived_builder(recorded?.builder)
+	};
+}
 /** Recover a resumable run from its state directory (`.volley/`, or
 * `<state_dir>/<run_id>/` under a state root): settings from config.json,
 * totals from summary.json, feedback from feedback.md. An iteration directory
@@ -2959,6 +3213,7 @@ function load_resume_state(workspace, run_id, state_dir = null, options = {}) {
 		...typeof recorded["builder_url"] === "string" ? { builder_url: recorded["builder_url"] } : {},
 		...recorded["builder_max_steps"] === void 0 ? {} : { builder_max_steps: Number(recorded["builder_max_steps"]) },
 		...recorded["builder_max_tool_calls"] === void 0 ? {} : { builder_max_tool_calls: Number(recorded["builder_max_tool_calls"]) },
+		...typeof recorded["builder_max_output_tokens"] === "number" ? { builder_max_output_tokens: recorded["builder_max_output_tokens"] } : {},
 		critic_model: String(recorded["critic_model"]),
 		critic_provider: recorded["critic_provider"] ?? "claude_cli",
 		...typeof recorded["critic_url"] === "string" ? { critic_url: recorded["critic_url"] } : {},
@@ -2980,15 +3235,15 @@ function load_resume_state(workspace, run_id, state_dir = null, options = {}) {
 		feedback,
 		verdict: null,
 		unmet_criteria: [],
-		check: null,
+		...archived_round(run, completed),
 		changes: null,
-		builder: null,
 		critic: null,
 		total_usage: summary?.total_usage ?? EMPTY_USAGE,
 		total_cost_usd: summary?.total_cost_usd ?? 0,
 		builder_cost_usd: summary?.builder_cost_usd ?? 0,
 		critic_cost_usd: summary?.critic_cost_usd ?? 0,
 		check_duration_ms: summary?.check_duration_ms ?? 0,
+		builder_max_steps_hits: summary?.builder_max_steps_hits ?? 0,
 		iteration_cost_usd: 0,
 		halt: null,
 		cost_warned: false
@@ -3155,7 +3410,7 @@ function record_check_chunk(ctx, chunk) {
 }
 /** The command line the check runs, or null when no check is configured. */
 function check_command(config) {
-	if (config.check_resolved === "checkride") return "pnpm exec checkride --json";
+	if (config.check_resolved === "checkride") return "pnpm exec checkride --json --digest";
 	if (config.check_resolved === "command") return config.check;
 	return null;
 }
@@ -3237,6 +3492,17 @@ function next_iteration(s) {
 		unmet_criteria: []
 	};
 }
+/** What the builder of the iteration after `s` hears about it beyond the
+* critic's feedback: its check, and whether its builder ran out of steps. Null
+* before the first iteration. A resumed run's state carries both, read back
+* from the last archived iteration. */
+function previous_round(config, s) {
+	if (s.iteration === 0) return null;
+	return {
+		check: s.check,
+		step_limit_hit: s.builder?.finish_reason === "max_steps" ? config.builder_max_steps : null
+	};
+}
 /** What changed in the build root since the baseline, reported as it's
 * measured: the count, and a warning for any gate edit. A run measures the
 * builder's work this way after every build, and a critique measures the
@@ -3267,7 +3533,7 @@ async function build_phase(deps, builder, s, ctx) {
 		builder,
 		config,
 		warn: renderer.warn
-	}, next, ctx);
+	}, next, previous_round(config, s), ctx);
 	renderer.phase_end(built.iteration, "builder", true);
 	renderer.cost_line(built.iteration, "builder", built.builder?.cost_usd ?? null, built.total_cost_usd);
 	if (built.cost_warned && !s.cost_warned) renderer.warn("cost unavailable for this phase; recording null (run totals sum what is known)");
@@ -3790,6 +4056,7 @@ function resolve_check_runner(check, workspace) {
 	return /(^|\s)checkride(\s|$)/.test(check.trim()) ? "checkride" : "command";
 }
 const DEFAULT_CRITIC_MODEL = "opus";
+const DEFAULT_BUILDER_MAX_OUTPUT_TOKENS = 16384;
 const DEFAULT_CHECK = "auto";
 const DEFAULT_CRITIC = "reviewer";
 const DEFAULT_BUILDER_PROVIDER = "claude_cli";
@@ -3881,6 +4148,7 @@ const CRITIQUE_REFUSED = [
 	["builder_url", "--builder-url"],
 	["builder_max_steps", "--builder-max-steps"],
 	["builder_max_tool_calls", "--builder-max-tool-calls"],
+	["builder_max_output_tokens", "--builder-max-output-tokens"],
 	["builder_permission_mode", "--builder-permission-mode"],
 	["allow_unsandboxed_builder", "--allow-unsandboxed-builder"],
 	["sandbox_image", "--sandbox-image"],
@@ -3904,6 +4172,22 @@ const BUILDER_MAX_TOOL_CALLS = {
 	env_var: "VOLLEY_BUILDER_MAX_TOOL_CALLS",
 	fallback: 1
 };
+/** The builders whose turns are capped when nothing sets a cap: the local
+* ones, where nothing else bounds a turn. Ollama's MLX runner lets an unset
+* `num_predict` run to the model's trained context less the prompt, which is
+* how one qwen3.8 turn spent 30,847 tokens thinking. A hosted model on
+* OpenRouter has its own output limit, and a request for more than it allows
+* can be refused, so it's capped only when asked. */
+const CAPPED_BY_DEFAULT = ["ollama", "lmstudio"];
+/** The output cap's flag and env var, and its default for `provider`: 16k
+* tokens on a local builder, else the provider's own limit (null). */
+function builder_max_output_tokens_count(provider) {
+	return {
+		flag: "--builder-max-output-tokens",
+		env_var: "VOLLEY_BUILDER_MAX_OUTPUT_TOKENS",
+		fallback: CAPPED_BY_DEFAULT.includes(provider) ? DEFAULT_BUILDER_MAX_OUTPUT_TOKENS : null
+	};
+}
 /** A builder count's flag or config value wins over its env var, which wins
 * over the default, and either must be a positive integer. Local builder
 * only; ignored by the `claude_cli` arm. */
@@ -4037,6 +4321,7 @@ function resolve_config(raw, options = {}) {
 	if (TOOL_LOOP_BUILDER_PROVIDERS.includes(builder_provider) && options.uncontained_builder !== "ask" && unguarded_builder(raw, builder_env)) throw config_error(`builder-provider '${builder_provider}' runs volley's tool loop with a real bash (write + exec) — refused unless contained. Launch volley inside its sandbox container (docker run <hardened flags> <image> volley run …, which sets VOLLEY_CONTAINED=1), or pass --allow-unsandboxed-builder (VOLLEY_ALLOW_UNSANDBOXED_BUILDER=1) to run uncontained on the host.`);
 	const builder_max_steps = resolve_builder_count(raw.builder_max_steps, builder_env, BUILDER_MAX_STEPS);
 	const builder_max_tool_calls = resolve_builder_count(raw.builder_max_tool_calls, builder_env, BUILDER_MAX_TOOL_CALLS);
+	const builder_max_output_tokens = resolve_builder_count(raw.builder_max_output_tokens, builder_env, builder_max_output_tokens_count(builder_provider));
 	const critic_provider = raw.critic_provider ?? DEFAULT_CRITIC_PROVIDER;
 	if (!CRITIC_PROVIDERS.includes(critic_provider)) throw config_error(`--critic-provider must be one of ${CRITIC_PROVIDERS.join(", ")}; got: ${String(raw.critic_provider)}`);
 	const builder_url = resolve_seat_url("builder", raw.builder_url, builder_provider);
@@ -4074,6 +4359,7 @@ function resolve_config(raw, options = {}) {
 		builder_url,
 		builder_max_steps,
 		builder_max_tool_calls,
+		builder_max_output_tokens,
 		allow_unsandboxed_builder,
 		critic_model: raw.critic_model ?? DEFAULT_CRITIC_MODEL,
 		critic_provider,
@@ -4121,6 +4407,7 @@ function initial_state() {
 		builder_cost_usd: 0,
 		critic_cost_usd: 0,
 		check_duration_ms: 0,
+		builder_max_steps_hits: 0,
 		iteration_cost_usd: 0,
 		halt: null,
 		cost_warned: false
@@ -4436,8 +4723,10 @@ function finalize_failed_run(config, err) {
 	const status = kind === "aborted_error" || cause === "aborted_error" ? "interrupted" : "error";
 	try {
 		const summary_path = state_path(config, "summary.json");
+		const prior = existsSync(summary_path) ? JSON.parse(readFileSync(summary_path, "utf8")) : run_result_from_state(config, initial_state(), status, null);
 		write_run_summary(config, {
-			...existsSync(summary_path) ? JSON.parse(readFileSync(summary_path, "utf8")) : run_result_from_state(config, initial_state(), status, null),
+			...prior,
+			builder_max_steps_hits: prior.builder_max_steps_hits ?? 0,
 			run_state_dir: run_state_dir(config),
 			status,
 			completed_at: (/* @__PURE__ */ new Date()).toISOString()
@@ -5353,6 +5642,7 @@ async function preflight(config, renderer, env, probes = {}) {
 		renderer.info(seat_line("builder", config.builder_model, config.builder_provider, config.builder_url, env));
 		renderer.info(`builder max steps: ${config.builder_max_steps}`);
 		renderer.info(`builder tool calls per turn: ${config.builder_max_tool_calls}`);
+		renderer.info(`builder output tokens per turn: ${config.builder_max_output_tokens ?? "the provider's limit"}`);
 	}
 	if (tool_loop_builder) {
 		const contained = detect_containment(env);
@@ -5484,7 +5774,7 @@ function with_critic_options(command, required = false) {
 function with_seat_options(command, required = false) {
 	const model_note = required ? " (required)" : "";
 	const provider_note = required ? "required" : "default: claude_cli";
-	return with_critic_options(command.option("--builder-model <model>", `Builder model${model_note}`).option("--builder-provider <name>", `claude_cli | ollama | lmstudio | openrouter (${provider_note})`).option("--builder-url <url>", "Builder's model server base URL, ollama, lmstudio, or openrouter only (default: VOLLEY_OLLAMA_URL / VOLLEY_LMSTUDIO_URL / VOLLEY_OPENROUTER_URL)").option("--builder-max-steps <n>", "Tool-loop builder step cap per iteration, any provider but claude_cli (default: 50)").option("--builder-max-tool-calls <n>", "Tool calls a tool-loop builder may make per turn, any provider but claude_cli (default: 1)").option("--allow-unsandboxed-builder", "Permit a builder other than claude_cli to run without a sandbox (real host bash + write)"), required);
+	return with_critic_options(command.option("--builder-model <model>", `Builder model${model_note}`).option("--builder-provider <name>", `claude_cli | ollama | lmstudio | openrouter (${provider_note})`).option("--builder-url <url>", "Builder's model server base URL, ollama, lmstudio, or openrouter only (default: VOLLEY_OLLAMA_URL / VOLLEY_LMSTUDIO_URL / VOLLEY_OPENROUTER_URL)").option("--builder-max-steps <n>", "Tool-loop builder step cap per iteration, any provider but claude_cli (default: 50)").option("--builder-max-tool-calls <n>", "Tool calls a tool-loop builder may make per turn, reads aside, any provider but claude_cli (default: 1)").option("--builder-max-output-tokens <n>", "Output tokens a tool-loop builder may generate per turn, reasoning included, any provider but claude_cli (default: 16384 on ollama and lmstudio, the provider's on openrouter)").option("--allow-unsandboxed-builder", "Permit a builder other than claude_cli to run without a sandbox (real host bash + write)"), required);
 }
 /** What a critique declares only so that it can refuse each by name, with
 * exit 5: cac would answer an undeclared one with a bare "Unknown option".
@@ -5495,6 +5785,7 @@ const CRITIQUE_REFUSED_OPTIONS = [
 	"--builder-url <url>",
 	"--builder-max-steps <n>",
 	"--builder-max-tool-calls <n>",
+	"--builder-max-output-tokens <n>",
 	"--builder-permission-mode <mode>",
 	"--allow-unsandboxed-builder",
 	"--sandbox-image <tag>",
@@ -5518,6 +5809,7 @@ function merge_flags(base, flags) {
 		...flags.builderUrl !== void 0 ? { builder_url: flags.builderUrl } : {},
 		...flags.builderMaxSteps !== void 0 ? { builder_max_steps: Number(flags.builderMaxSteps) } : {},
 		...flags.builderMaxToolCalls !== void 0 ? { builder_max_tool_calls: Number(flags.builderMaxToolCalls) } : {},
+		...flags.builderMaxOutputTokens !== void 0 ? { builder_max_output_tokens: Number(flags.builderMaxOutputTokens) } : {},
 		...flags.allowUnsandboxedBuilder === true ? { allow_unsandboxed_builder: true } : {},
 		...flags.criticModel !== void 0 ? { critic_model: flags.criticModel } : {},
 		...flags.criticProvider !== void 0 ? { critic_provider: flags.criticProvider } : {},