@runfusion/fusion 0.77.0-beta.6 → 0.77.0-beta.8

package/dist/migrations/0065_fn_149_review_convergence_stage.sql

@@ -0,0 +1,3 @@
+-- FN-149 durable bounded review-convergence state.
+ALTER TABLE project.tasks ADD COLUMN IF NOT EXISTS review_convergence_stage integer DEFAULT 0;
+ALTER TABLE project.tasks ADD COLUMN IF NOT EXISTS review_convergence_escalation_count integer DEFAULT 0;

package/dist/pi-claude-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusion/pi-claude-cli",
-  "version": "0.77.0-beta.6",
+  "version": "0.77.0-beta.8",
   "type": "module",
   "private": true,
   "main": "index.ts",

package/dist/plugin-sdk/index.d.ts

@@ -233,7 +233,7 @@ type WorkflowStepMode = "prompt" | "script";
 type WorkflowStepToolMode = "readonly" | "coding";
 type WorkflowStepGateMode = "gate" | "advisory";
 type WorkflowReviewFindingSeverity = "low" | "medium" | "high" | "critical";
-type WorkflowReviewFindingResolution = "open" | "resolved-in-review" | "superseded";
+type WorkflowReviewFindingResolution = "open" | "resolved-in-review" | "superseded" | "dispute-upheld";
 interface WorkflowReviewFinding {
     id: string;
     title: string;
@@ -242,6 +242,10 @@ interface WorkflowReviewFinding {
     line?: number;
     severity?: WorkflowReviewFindingSeverity;
     resolution?: WorkflowReviewFindingResolution;
+    disputeRationale?: string;
+    disputedAt?: string;
+    disputeRebuttedAt?: string;
+    rebutsDisputedFindingId?: string;
 }
 interface WorkflowRepositoryReviewOutcome {
     repository: string;
@@ -327,6 +331,14 @@ interface WorkflowStepResult {
     findings?: WorkflowReviewFinding[];
     repositoryReviewOutcomes?: WorkflowRepositoryReviewOutcome[];
     repositoryScopeRevision?: number;
+    remediationArchivedAt?: string;
+    remediationArchivedFromStatus?: WorkflowStepResult["status"];
+    reviewInputFingerprint?: string;
+    arbitrationDecision?: "UPHOLD_REVIEW" | "UPHOLD_IMPLEMENTER" | "SPLIT";
+    arbitrationBindingFindingCount?: number;
+    arbitratedAttemptAt?: string;
+    arbitratedAt?: string;
+    arbitrationNotes?: string;
     supersededFindingSourceWorkflowStepId?: string;
     supersededFindingIds?: string[];
     verdict?: "APPROVE" | "APPROVE_WITH_NOTES" | "REVISE" | "CLOSE_NO_OP";
@@ -338,7 +350,7 @@ interface WorkflowStepResult {
     bypassedBy?: string;
     bypassedAt?: string;
     bypassReason?: string;
-    bypassedFromStatus?: WorkflowStepResult["status"];
+    bypassedFromStatus?: WorkflowStepResult["status"] | "absent";
     bypassedFromVerdict?: WorkflowStepResult["verdict"];
     supersededAt?: string;
     supersededReason?: "dependency-change";
@@ -610,6 +622,8 @@ interface TaskRow {
     branchConflictRecoveryCount: number | null;
     reviewerContextRetryCount: number | null;
     reviewerFallbackRetryCount: number | null;
+    reviewConvergenceStage: number | null;
+    reviewConvergenceEscalationCount: number | null;
     nextRecoveryAt: string | null;
     error: string | null;
     summary: string | null;
@@ -1188,7 +1202,7 @@ interface CustomFieldRejection {
     detail: string;
 }
 
-type WorkflowLifecycleWarningCode = "missing-completion-summary" | "missing-merge-region" | "unsafe-terminal-before-merge" | "optional-group-after-execution" | "review-gate-without-failure-route";
+type WorkflowLifecycleWarningCode = "missing-completion-summary" | "missing-merge-region" | "unsafe-terminal-before-merge" | "optional-group-after-execution" | "review-gate-without-failure-route" | "write-capable-node-after-code-review";
 interface WorkflowLifecycleWarning {
     code: WorkflowLifecycleWarningCode;
     nodeId?: string;
@@ -5593,6 +5607,8 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
         branchConflictRecoveryCount?: number | null;
         reviewerContextRetryCount?: number | null;
         reviewerFallbackRetryCount?: number | null;
+        reviewConvergenceStage?: number | null;
+        reviewConvergenceEscalationCount?: number | null;
         nextRecoveryAt?: string | null;
         enabledWorkflowSteps?: string[];
         noCommitsExpected?: boolean | null;
@@ -5698,9 +5714,10 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
     dismissAiMergeReviewFinding(taskId: string, findingId: string, reason: string, actor?: string): Promise<Task>;
     linkTaskRecommendation(id: string, recommendationId: string, createdTaskId: string, completeColumns?: ReadonlySet<string>): Promise<Task>;
     normalizeWorkspaceTaskWorktreeMetadata(id: string): Promise<Task>;
-    mergeWorkspaceWorktreeEntry(id: string, repoRelPath: string, patch: Partial<WorkspaceWorktreeEntry>, options?: {
+    mergeWorkspaceWorktreeEntry(id: string, repoRelPath: string, patch: Partial<WorkspaceWorktreeEntry> | ((current: Task) => Promise<Partial<WorkspaceWorktreeEntry>>), options?: {
         requireExistingEntry?: boolean;
         clearSingularWorktree?: boolean;
+        validateBeforePersist?: (current: Task) => Promise<void>;
     }): Promise<Task>;
     updateTaskRepositoryScope(id: string, repositoryScope: TaskRepositoryScope | undefined): Promise<Task>;
     mutateTaskRepositoryScope(id: string, mutation: TaskRepositoryScopeMutation): Promise<Task>;
@@ -5758,6 +5775,12 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
     checkAndRecordUnplannedExecutionBlock(id: string, episode: string): Promise<boolean>;
     transitionQueuedEpisode(id: string, transition: QueuedEpisodeTransition): Promise<QueuedEpisodeTransitionResult>;
     logEntry(id: string, action: string, outcome?: string, runContext?: RunMutationContext): Promise<Task>;
+    logEntryOnce(id: string, input: {
+        action: string;
+        outcome?: string;
+        dedupeKey: string;
+        windowMs: number;
+    }): Promise<boolean>;
     getMutationsForRun(runId: string): Promise<TaskLogEntry[]>;
     rowToMergeQueueEntry(row: MergeQueueRow): MergeQueueEntry;
     normalizeMergeRequestState(value: string): MergeRequestState;
@@ -5792,6 +5815,7 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
     }): Promise<MergeRequestRecord>;
     getMergeRequestRecord(taskId: string): MergeRequestRecord | null;
     getMergeRequestRecordAsync(taskId: string): Promise<MergeRequestRecord | null>;
+    getMergeRequestRecordsAsync(taskIds: readonly string[]): Promise<Map<string, MergeRequestRecord>>;
     projectMergeRequestToWorkflowWorkItem(taskId: string, opts?: MergeRequestWorkflowProjectionOptions): Promise<WorkflowWorkItem | null>;
     createCompletionHandoffWorkflowWork(task: Pick<Task, "id" | "autoMerge" | "priority">, opts?: {
         runId?: string;
@@ -5804,6 +5828,13 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
     replaceActiveTaskWorkflowContinuation(input: WorkflowWorkItemUpsertInput & {
         kind: "task";
     }): Promise<WorkflowWorkItem>;
+    seedWorkspaceCodeReviewContinuationIfIdle(input: WorkflowWorkItemUpsertInput & {
+        kind: "task";
+    }): Promise<{
+        seeded: boolean;
+        reason?: "active-continuation";
+        workItemId?: string;
+    }>;
     seedStrandedPlanReviewContinuation(input: WorkflowWorkItemUpsertInput & {
         kind: "task";
     }, options?: {
@@ -5819,6 +5850,9 @@ declare class TaskStore extends EventEmitter<TaskStoreEvents> {
     listWorkflowWorkItemsForTask(taskId: string, opts?: {
         kinds?: WorkflowWorkItemKind[];
     }): Promise<WorkflowWorkItem[]>;
+    listWorkflowWorkItemsForTasks(taskIds: readonly string[], opts?: {
+        kinds?: WorkflowWorkItemKind[];
+    }): Promise<Map<string, WorkflowWorkItem[]>>;
     listWorkflowWorkItemsForTaskSync(taskId: string, opts?: {
         kinds?: WorkflowWorkItemKind[];
     }): WorkflowWorkItem[];
@@ -6803,7 +6837,7 @@ declare const ANTHROPIC_AUTH_PREFERENCES: readonly ["api-key", "subscription"];
 type AnthropicAuthPreference = (typeof ANTHROPIC_AUTH_PREFERENCES)[number];
 declare const THEME_MODES: readonly ["dark", "light", "system"];
 type ThemeMode = (typeof THEME_MODES)[number];
-declare const COLOR_THEMES: readonly ["default", "ocean", "forest", "sunset", "zen", "berry", "high-contrast", "industrial", "monochrome", "slate", "ash", "air", "graphite", "silver", "solarized", "factory", "factory-mono", "ayu", "one-dark", "nord", "dracula", "gruvbox", "tokyo-night", "catppuccin-mocha", "github-dark", "everforest", "rose-pine", "kanagawa", "night-owl", "palenight", "monokai-pro", "slime", "brutalist", "neon-city", "parchment", "medieval", "terminal", "glass", "glass-silver", "horizon", "vitesse", "outrun", "snazzy", "porple", "espresso", "mars", "poimandres", "ember", "rust", "copper", "foundry", "carbon", "sandstone", "lagoon", "frost", "lavender", "neon-bloom", "sepia", "cobalt", "clay", "moss", "aurora", "calm", "dawn", "sage", "midnight", "velvet", "factory-dark", "factory-light", "shadcn", "shadcn-ember", "shadcn-custom", "shadcn-blue", "shadcn-green", "shadcn-red", "shadcn-purple", "shadcn-pink", "shadcn-orange", "shadcn-yellow", "shadcn-mono", "shadcn-mono-red", "shadcn-mono-blue", "shadcn-mono-green", "shadcn-mono-purple", "shadcn-mono-pink", "shadcn-mono-orange", "shadcn-mono-yellow", "shadcn-black", "shadcn-gray", "shadcn-gray-blue"];
+declare const COLOR_THEMES: readonly ["default", "ocean", "forest", "sunset", "zen", "berry", "high-contrast", "industrial", "monochrome", "slate", "ash", "air", "graphite", "silver", "solarized", "factory", "factory-mono", "ayu", "one-dark", "nord", "dracula", "gruvbox", "tokyo-night", "catppuccin-mocha", "github-dark", "everforest", "rose-pine", "kanagawa", "night-owl", "palenight", "monokai-pro", "slime", "brutalist", "neon-city", "parchment", "medieval", "terminal", "glass", "glass-silver", "horizon", "vitesse", "outrun", "snazzy", "porple", "espresso", "mars", "poimandres", "ember", "rust", "copper", "foundry", "carbon", "sandstone", "lagoon", "frost", "lavender", "neon-bloom", "sepia", "cobalt", "clay", "moss", "aurora", "calm", "dawn", "sage", "midnight", "velvet", "iceberg", "factory-dark", "factory-light", "shadcn", "shadcn-ember", "shadcn-custom", "shadcn-blue", "shadcn-green", "shadcn-red", "shadcn-purple", "shadcn-pink", "shadcn-orange", "shadcn-yellow", "shadcn-mono", "shadcn-mono-red", "shadcn-mono-blue", "shadcn-mono-green", "shadcn-mono-purple", "shadcn-mono-pink", "shadcn-mono-orange", "shadcn-mono-yellow", "shadcn-black", "shadcn-gray", "shadcn-gray-blue"];
 type ColorTheme = (typeof COLOR_THEMES)[number];
 declare const SUPPORTED_LOCALES: readonly ["en", "zh-CN", "zh-TW", "fr", "es", "ko", "pt-BR"];
 type Locale = (typeof SUPPORTED_LOCALES)[number];
@@ -6943,6 +6977,7 @@ interface TaskLogEntry {
     timestamp: string;
     action: string;
     outcome?: string;
+    dedupeKey?: string;
     runContext?: RunMutationContext;
 }
 type WorkflowTransitionNotificationKind = "manual-merge-hold" | "recovery-requeue";
@@ -7008,7 +7043,7 @@ type TaskReviewVerdict = "APPROVE" | "APPROVE_WITH_NOTES" | "REVISE" | "RETHINK"
 type TaskReviewerType = "plan" | "code";
 type TaskReviewItemStatus = "queued" | "in-progress" | "addressed" | "failed";
 type TaskReviewFindingSeverity = "low" | "medium" | "high" | "critical";
-type TaskReviewFindingResolution = "open" | "resolved-in-review" | "superseded";
+type TaskReviewFindingResolution = "open" | "resolved-in-review" | "superseded" | "dispute-upheld";
 interface LegacyTaskReviewItem {
     id: string;
     source: TaskReviewSource;
@@ -7620,6 +7655,16 @@ interface TaskRepositoryScope {
         refusalReason?: string;
     }>;
 }
+interface WorkspaceLandFailure {
+    category: "environment" | "review" | "content-conflict" | "internal-technical";
+    message: string;
+    at: string;
+    branch?: string;
+    repository?: string;
+    resource?: string;
+    action?: string;
+    technicalDetail?: string;
+}
 interface WorkspaceWorktreeEntry {
     worktreePath: string;
     branch: string;
@@ -7628,11 +7673,7 @@ interface WorkspaceWorktreeEntry {
     baseCommitSha?: string;
     landedSha?: string;
     revertBoundarySha?: string;
-    landFailure?: {
-        message: string;
-        at: string;
-        branch?: string;
-    };
+    landFailure?: WorkspaceLandFailure;
 }
 type AiMergeFindingDisposition = "pending" | "corrected" | "absent-from-squash" | "still-present" | "dismissed";
 interface AiMergeReviewFinding {
@@ -7654,6 +7695,7 @@ interface AiMergeReviewReconciliation {
     findings: AiMergeReviewFinding[];
     consecutiveCleanApprovals: number;
     correctivePasses: number;
+    invalidAcknowledgementCandidateSha?: string;
     terminal?: boolean;
 }
 interface Task {
@@ -7781,6 +7823,8 @@ interface Task {
     branchConflictRecoveryCount?: number;
     reviewerContextRetryCount?: number;
     reviewerFallbackRetryCount?: number;
+    reviewConvergenceStage?: number;
+    reviewConvergenceEscalationCount?: number;
     retrySummary?: RetrySummary;
     nextRecoveryAt?: string;
     awaitingApprovalReason?: "release-authorization" | "plan-review-replan-cap" | "merge-blocked-by-policy" | "code-review-non-convergence";
@@ -8176,6 +8220,7 @@ interface GlobalSettings {
     openrouterModelFilters?: OpenRouterModelFilters;
     openrouterProviderPreferences?: OpenRouterProviderPreferences;
     opencodeGoModelSync?: boolean;
+    orcarouterModelSync?: boolean;
     updateCheckEnabled?: boolean;
     fnBinaryCheckEnabled?: boolean;
     githubTrackingDefaultRepo?: string;
@@ -8357,6 +8402,12 @@ interface ProjectSettings {
     executorEscalationProvider?: string;
     executorEscalationModelId?: string;
     executorEscalationNodeId?: string;
+    reviewConvergenceEscalationEnabled?: boolean;
+    reviewConvergenceEscalationProvider?: string;
+    reviewConvergenceEscalationModelId?: string;
+    reviewArbitrationEnabled?: boolean;
+    reviewArbitrationProvider?: string;
+    reviewArbitrationModelId?: string;
     maxConcurrentVerifications?: number;
     maxWorktrees: number;
     worktreeLimitEnabled?: boolean;

package/dist/plugin-sdk/index.js

@@ -5879,6 +5879,8 @@ var tasks = projectSchema.table("tasks", {
   branchConflictRecoveryCount: integer("branch_conflict_recovery_count").default(0),
   reviewerContextRetryCount: integer("reviewer_context_retry_count").default(0),
   reviewerFallbackRetryCount: integer("reviewer_fallback_retry_count").default(0),
+  reviewConvergenceStage: integer("review_convergence_stage").default(0),
+  reviewConvergenceEscalationCount: integer("review_convergence_escalation_count").default(0),
   nextRecoveryAt: text("next_recovery_at"),
   error: text("error"),
   summary: text("summary"),
@@ -8199,7 +8201,16 @@ var projectTableNames = [
   "chat_rooms",
   "chat_room_members",
   "chat_room_messages",
-  "chat_token_usage"
+  "chat_token_usage",
+  /*
+  FNXC:WorkspaceCoordination 2026-08-23-20:05:
+  FN-9059 (migration 0060) added these two tables to the schema without registering them here, so
+  every registry consumer under-counted them: the PostgreSQL test harness never TRUNCATEd them
+  between tests (a held `repo:<repo>` lease leaked from one case into the next and made the next
+  land report the previous test's successor as the busy holder), and health compaction skipped them.
+  */
+  "workspace_coordination_leases",
+  "workspace_land_intents"
 ];
 
 // ../core/src/postgres/schema/central.ts
@@ -8976,6 +8987,7 @@ var DEFAULT_GLOBAL_SETTINGS = {
   openrouterAppAttribution: void 0,
   openrouterModelFilters: void 0,
   openrouterProviderPreferences: void 0,
+  orcarouterModelSync: true,
   opencodeGoModelSync: true,
   updateCheckEnabled: true,
   fnBinaryCheckEnabled: true,
@@ -9391,6 +9403,16 @@ var DEFAULT_PROJECT_SETTINGS = {
   executorEscalationProvider: void 0,
   executorEscalationModelId: void 0,
   executorEscalationNodeId: void 0,
+  /*
+  FNXC:ReviewConvergence 2026-08-23-21:05:
+  FN-149's six review-convergence/arbitration keys are declared in BUILTIN_WORKFLOW_SETTINGS, which
+  the U4 hard-move made the SINGLE source of truth for a moved key's default. Re-declaring them here
+  put them back in the legacy object the hard-move emptied, so an undeclared key on a custom workflow
+  could resolve to this literal instead of the declaration default — the exact drift
+  `workflow-settings-fallback-alignment` guards. The declaration defaults are identical (both
+  `*Enabled` default true, the provider/model lanes carry no default), and the reader uses
+  `!== false`, so removing them here preserves behaviour and restores the invariant.
+  */
   /**
    * FNXC:Merge 2026-06-26-00:00:
    * New and unconfigured projects default AI merge to sync a dirty checked-out integration branch, restoring the legacy stash → fast-forward → restore landing behavior. Explicit persisted merger.allowDirtyLocalCheckoutSync values still win, and no existing-project migration stamps this default into storage.
@@ -10282,6 +10304,20 @@ function classifyWorkflowAgentNode(node) {
   }
 }
 
+// ../core/src/workflows/workflow-merge-region.ts
+var MERGE_REGION_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
+  "merge-gate",
+  "merge-attempt",
+  "manual-merge-hold",
+  "retry-backoff",
+  "recovery-router",
+  "branch-group-member-integration",
+  "branch-group-promotion",
+  "pr-create",
+  "pr-respond",
+  "pr-merge"
+]);
+
 // ../core/src/workflows/workflow-extension-types.ts
 function workflowExtensionRegistryId(pluginId, extensionId) {
   return `plugin:${pluginId}:${extensionId}`;
@@ -10810,18 +10846,7 @@ function reachableFrom(start, outgoing) {
   }
   return seen;
 }
-var INTERPRETER_ENTRY_NODE_KINDS = /* @__PURE__ */ new Set([
-  "merge-gate",
-  "merge-attempt",
-  "manual-merge-hold",
-  "retry-backoff",
-  "recovery-router",
-  "branch-group-member-integration",
-  "branch-group-promotion",
-  "pr-create",
-  "pr-respond",
-  "pr-merge"
-]);
+var INTERPRETER_ENTRY_NODE_KINDS = MERGE_REGION_ENTRY_NODE_KINDS;
 var MERGE_CLASS_NODE_KINDS = /* @__PURE__ */ new Set([
   "merge-gate",
   "merge-attempt",
@@ -12461,6 +12486,49 @@ var BUILTIN_REVIEW_REVISION_SETTINGS = [
     default: DEFAULT_CODE_REVIEW_BLOCKING_SEVERITY,
     description: 'Minimum finding severity that lets Code Review block merge. A REVISE carrying no finding at or above this level is recorded as APPROVE_WITH_NOTES and its findings are handed to the implementer. Choose "any" to block on every REVISE.'
   },
+  /*
+   * FNXC:ReviewConvergence 2026-08-22-05:42:
+   * FN-149 keeps recovery targets workflow-native so operators choose the cost and
+   * capability of automatic review convergence without widening project policy.
+   */
+  {
+    id: "reviewConvergenceEscalationEnabled",
+    name: "Review convergence escalation",
+    type: "boolean",
+    default: true,
+    description: "Run one bounded alternate-model or replan recovery when a review repeats unchanged input."
+  },
+  {
+    id: "reviewConvergenceEscalationProvider",
+    name: "Review convergence escalation provider",
+    type: "string",
+    description: "Provider for the optional alternate-model review remediation target."
+  },
+  {
+    id: "reviewConvergenceEscalationModelId",
+    name: "Review convergence escalation model",
+    type: "string",
+    description: "Model for the optional alternate-model review remediation target."
+  },
+  {
+    id: "reviewArbitrationEnabled",
+    name: "Review arbitration",
+    type: "boolean",
+    default: true,
+    description: "Enable bounded third-model arbitration after a review disagreement persists."
+  },
+  {
+    id: "reviewArbitrationProvider",
+    name: "Review arbitration provider",
+    type: "string",
+    description: "Provider for the optional review arbitration target."
+  },
+  {
+    id: "reviewArbitrationModelId",
+    name: "Review arbitration model",
+    type: "string",
+    description: "Model for the optional review arbitration target."
+  },
   {
     id: "planReviewReplanCap",
     name: "Plan Review replan cap",
@@ -12666,16 +12734,11 @@ You have tools to report progress. The board updates in real-time.
 
 /*
 FNXC:TaskRecommendations 2026-08-09-04:06:
-FN-8850 requires optional, non-blocking discoveries to be captured only at the explicit accepted
-completion boundary. Immediate task creation remains for required dependency coordination or an
-operator-directed filing, while workflow step sessions remain unable to write recommendations.
+FN-125 requires task-execution sessions to preserve optional, non-blocking discoveries only at the
+accepted completion boundary. Durable Workflow Executor sessions cannot create or delegate tasks;
+in-scope work remains in the current task and external blockers use the honest blocked exit.
 */
-**Out-of-scope findings at completion:** Do not automatically create a task for optional, non-blocking work discovered outside this task. When recommendation capture is enabled, at the final accepted \`fn_task_done(outcome="completed")\` checkpoint evaluate genuine task-ready follow-ups and send \`recommendations\` (or \`recommendations: []\` when none qualify). Each recommendation needs a stable unique \`id\`, \`title\`, \`description\`, and \`category\`; never use it for a required current-task fix, blocker, secret, executable command, reasoning transcript, or filler.
-
-Use \`task_create\` or \`fn_delegate_task\` only when the task explicitly requires immediate filing, necessary dependency coordination, or the operator directs it. When creating multiple related tasks, declare dependencies between them:
-\`task_create(description="load door sounds", dependencies=[])\` \u2192 returns KB-050
-\`task_create(description="play sound on door open/close", dependencies=["KB-050"])\`
-
+**Out-of-scope findings at completion:** This task-execution session cannot create or delegate tasks. When recommendation capture is enabled, at the final accepted \`fn_task_done(outcome="completed")\` checkpoint evaluate optional, non-blocking findings as genuine task-ready \`recommendations\` (or \`recommendations: []\` when none qualify). Each recommendation needs a stable unique \`id\`, \`title\`, \`description\`, and \`category\`; never use it for a required current-task fix, blocker, secret, executable command, reasoning transcript, or filler. Implement required in-scope work directly in this task.
 **Discovered a dependency:** \`task_add_dep(task_id="KB-XXX")\` \u2014 use when you discover mid-execution that another task must be completed first. This will return a warning first \u2014 you must call again with \`confirm=true\` to proceed. Adding a dependency stops execution, discards current work, and moves the task to triage for re-specification.
 
 ## Task Documents
@@ -12747,16 +12810,16 @@ If you attempt to write to a path outside the worktree, the file tools will reje
 FNXC:WorkflowRouting 2026-06-22-17:26:
 Executors must not move the workflow of the task they are executing unless the user explicitly asked for that task's workflow. Agents remain free to set workflows on tasks they create because they are the creator for those new tasks.
 -->
-- Do not call \`fn_workflow_select\` to change the workflow of the task you are executing; you did not create that task, the user or triage did. The only exception is when the user explicitly requested a specific workflow for this task in a steering comment, task instruction, or similar direct instruction. You may still set the workflow on tasks you create via \`fn_task_create\` or \`fn_delegate_task\`, because you are the creator of those new tasks.
+- Do not call \`fn_workflow_select\` to change the workflow of the task you are executing; you did not create that task, the user or triage did. The only exception is when the user explicitly requested a specific workflow for this task in a steering comment, task instruction, or similar direct instruction.
 - **NEVER kill processes on port 4040.** Port 4040 is the production dashboard. Do not run \`kill\`, \`pkill\`, \`killall\`, or \`lsof -ti:4040 | xargs kill\` against it. If you need to start a test server, use \`--port 0\` for a random free port. If port 4040 is occupied, pick a different port \u2014 do NOT kill the occupant.
 - Treat the File Scope in PROMPT.md as the expected starting scope, not a hard boundary when quality gates fail
 - Read "Context to Read First" files before starting
 - Follow the "Do NOT" section strictly
 - If tests, lint, build, or typecheck fail and the fix requires touching code outside the declared File Scope, fix those failures directly and keep the repo green
-- Use \`task_create\` for genuinely separate follow-up work, not for mandatory fixes required to make this task land cleanly
+- Implement mandatory and in-scope work directly in this task. Preserve optional out-of-scope follow-ups as completion recommendations.
 - Update documentation listed in "Must Update" and check "Check If Affected"
 - NEVER delete, remove, or gut modules, interfaces, settings, exports, or test files outside your File Scope
-- NEVER remove features as "cleanup" \u2014 if something seems unused, create a task for investigation instead
+- NEVER remove features as "cleanup" \u2014 if something seems unused, record an optional completion recommendation for investigation instead
 - Removing code is acceptable ONLY when it is explicitly part of your task's mission
 - If you remove existing functionality, you MUST create a changeset in \`.changeset/\` explaining the removal and rationale
 
@@ -12803,6 +12866,13 @@ Lint, tests, and typecheck are also hard quality gates:
 - Keep fixing failures caused by your change until lint, impacted tests, build, and typecheck pass.
 - If the repository exposes a typecheck command, run it and fix failures caused by your change.
 - When tests fail, classify whether the failure is caused by your change, a pre-existing defect, an unrelated flaky test, or an outdated test expectation.
+
+**A behavior change owns every test that asserts the old behavior.** Targeted verification runs the tests for files you TOUCHED; the tests encoding the behavior you just changed usually live in files you did NOT touch, so a green targeted run is not evidence that none exist. Before finishing, search for them:
+- Added a guard, validation, or required field? Grep for the FIXTURES it will now refuse \u2014 they are outside your File Scope \u2014 and fix each to state its intent explicitly.
+- Removed a feature? Delete its tests. A test asserting a deliberately removed contract guards nothing, and making it pass later means re-adding removed behavior.
+- Changed an order, default, constant, or prompt string? Grep for the literal; topology lists, prompt-content assertions, and size budgets live far from the code they describe.
+- Added a public store/service method? Update the inventory/drift guards that require every public surface to be classified.
+Fix at the SHARED FIXTURE FACTORY, not per test \u2014 one helper usually explains dozens of failures. Never make a stale test pass by weakening it: update the fixture, record the new truth, or delete the test naming the change that removed its subject.
 - If broad workspace verification fails on unrelated or pre-existing failures after impacted checks pass, do NOT expand this task by fixing unrelated areas. Log the evidence, quarantine flakes per project policy, or create/link a follow-up task.
 - Do not repeatedly rerun a broad failing or hanging workspace command without a new hypothesis and a narrower confirming command.
 
@@ -13075,6 +13145,7 @@ files with assertions that run via a test runner. Typechecks and builds are NOT
 tests. Manual verification is NOT a test.
 
 - Each implementation step should include writing tests for the code being changed
+- **If the task CHANGES, GATES, or REMOVES existing behavior, include a step to find and update the tests that assert the OLD behavior.** Name the search in that step: the fixtures a new guard will now refuse, the tests of a removed feature, or the literal to grep for a changed order/default/constant/prompt string. Those tests live OUTSIDE the File Scope, so targeted verification will not surface them and the executor will not find them by accident. Measured 2026-08-24: five such changes left ~135 stale failing tests behind, every one having passed its own targeted verification; one shared fixture line accounted for 37 of them.
 - For bug fixes and UI-affordance add/remove tasks, the spec MUST include a \`## Surface Enumeration\` section. The workflow Plan Review gate validates this before execution when plan review is enabled; missing coverage is a blocking REVISE.
 - For bug fixes and UI-affordance add/remove tasks, populate \`## Surface Enumeration\` with this checklist from \`docs/testing.md\`: providers/bridges/execution paths; desktop + mobile breakpoints/platforms; empty/undefined/duplicate/populated data states; shared hooks/components/modules/helpers; every component that renders the affordance; leftover shells after removal.
 - For bug fixes and UI-affordance add/remove tasks, regression tests must assert the invariant across all known surfaces \u2014 enumerate every provider/bridge, desktop + mobile breakpoints, empty/undefined/populated data states, and for UI-affordance changes every component rendering the affordance plus leftover shells after removal \u2014 not just the reported repro (see FN-5787/FN-5789/FN-5803, FN-5751, and FN-6115/FN-6118/FN-6123)
@@ -13430,7 +13501,7 @@ You have tools to report progress. The board updates in real-time.
 
 **Logging important actions:** \`task_log(message="what happened")\`
 
-**Out-of-scope findings at completion:** When recommendation capture is enabled, retain optional, non-blocking discoveries as task-ready \`fn_task_done\` recommendations at accepted completion, or send \`recommendations: []\` when none qualify. Use \`task_create\` only for explicit immediate filing, dependency coordination, or operator direction; never recommend required current-task work, blockers, secrets, commands, reasoning, or filler.
+**Out-of-scope findings at completion:** This task-execution session cannot create or delegate tasks. When recommendation capture is enabled, retain optional, non-blocking discoveries as task-ready \`fn_task_done\` recommendations at accepted completion, or send \`recommendations: []\` when none qualify. Implement required in-scope work directly here; use the honest blocked exit only for a real external blocker. Never recommend required current-task work, blockers, secrets, commands, reasoning, or filler.
 
 **Discovered a dependency:** \`task_add_dep(task_id="KB-XXX")\` \u2014 use when you discover mid-execution that another task must be completed first. This will return a warning first \u2014 you must call again with \`confirm=true\` to proceed. Adding a dependency stops execution, discards current work, and moves the task to triage for re-specification.
 
@@ -13500,15 +13571,15 @@ If you attempt to write to a path outside the worktree, the file tools will reje
 FNXC:WorkflowRouting 2026-06-22-17:26:
 Executors must not move the workflow of the task they are executing unless the user explicitly asked for that task's workflow. Agents remain free to set workflows on tasks they create because they are the creator for those new tasks.
 -->
-- Do not call \`fn_workflow_select\` to change the workflow of the task you are executing; you did not create that task, the user or triage did. The only exception is when the user explicitly requested a specific workflow for this task in a steering comment, task instruction, or similar direct instruction. You may still set the workflow on tasks you create via \`fn_task_create\` or \`fn_delegate_task\`, because you are the creator of those new tasks.
+- Do not call \`fn_workflow_select\` to change the workflow of the task you are executing; you did not create that task, the user or triage did. The only exception is when the user explicitly requested a specific workflow for this task in a steering comment, task instruction, or similar direct instruction.
 - **NEVER kill processes on port 4040.** Port 4040 is the production dashboard. Do not run \`kill\`, \`pkill\`, \`killall\`, or \`lsof -ti:4040 | xargs kill\` against it. If you need to start a test server, use \`--port 0\` for a random free port. If port 4040 is occupied, pick a different port \u2014 do NOT kill the occupant.
 - Treat the File Scope in PROMPT.md as the expected starting scope, not a hard boundary when quality gates fail
 - Read "Context to Read First" files before starting
 - Follow the "Do NOT" section strictly
 - If tests, lint, build, or typecheck fail and the fix requires touching code outside the declared File Scope, fix those failures directly and keep the repo green
-- Use \`task_create\` for genuinely separate follow-up work, not for mandatory fixes required to make this task land cleanly
+- Implement mandatory and in-scope work directly in this task. Preserve optional out-of-scope follow-ups as completion recommendations.
 - NEVER delete, remove, or gut modules, interfaces, settings, exports, or test files outside your File Scope
-- NEVER remove features as "cleanup" \u2014 if something seems unused, create a task for investigation instead
+- NEVER remove features as "cleanup" \u2014 if something seems unused, record an optional completion recommendation for investigation instead
 - If you remove existing functionality, you MUST create a changeset in \`.changeset/\` explaining the removal and rationale
 
 ## Spawning Child Agents
@@ -14375,11 +14446,15 @@ var RAW_BUILTIN_CODING_WORKFLOW_IR = {
     // execute → browser-verification (optional-group) → review. When the group is
     // disabled it passes through with outcome=success and routes straight to review.
     { from: "execute", to: "browser-verification", condition: "success" },
-    // browser-verification → code-review → review. Each optional-group passes through with
-    // outcome=success when disabled, so a task with both off routes straight to review.
-    { from: "browser-verification", to: "code-review", condition: "success" },
-    { from: "code-review", to: "completion-summary", condition: "success" },
-    { from: "completion-summary", to: "review", condition: "success" },
+    /*
+    FNXC:WorkspaceReviewSeal 2026-08-21-19:36:
+    Completion summary runs before Code Review because its agent may acquire and write the task
+    worktree. The approving review is the final write-capable pre-merge stage, so landing consumes
+    evidence for the branch it will publish rather than evidence invalidated by a later summary.
+    */
+    { from: "browser-verification", to: "completion-summary", condition: "success" },
+    { from: "completion-summary", to: "code-review", condition: "success" },
+    { from: "code-review", to: "review", condition: "success" },
     { from: "review", to: "merge-gate", condition: "success" },
     { from: "merge-gate", to: "branch-group-member-integration", condition: "outcome:auto-on" },
     { from: "merge-gate", to: "merge-manual-hold", condition: "outcome:auto-off" },
@@ -14392,6 +14467,12 @@ var RAW_BUILTIN_CODING_WORKFLOW_IR = {
     { from: "merge-attempt", to: "post-merge-verification", condition: "success" },
     { from: "post-merge-verification", to: "end", condition: "success" },
     { from: "merge-attempt", to: "merge-retry", condition: "outcome:transient-failure" },
+    /*
+    FNXC:WorkspaceReviewReroute 2026-08-21-20:11:
+    Evidence rejected during an active graph merge is a fresh Code Review obligation, never a
+    merge retry. Route the typed result to the final review gate before another landing attempt.
+    */
+    { from: "merge-attempt", to: "code-review", condition: "outcome:workspace-review-required", kind: "rework" },
     { from: "merge-attempt", to: "merge-manual-hold", condition: "outcome:manual-required" },
     { from: "recovery-router", to: "merge-attempt", condition: "outcome:wake-merge", kind: "rework" },
     { from: "planning", to: "end", condition: "failure" },
@@ -14689,12 +14770,15 @@ var RAW_BUILTIN_STEPWISE_CODING_WORKFLOW_IR = {
     // KTD-5: bounded rework exhaustion → manual hold; release re-enters the group.
     { from: "steps", to: "rework-hold", condition: "outcome:rework-exhausted" },
     { from: "rework-hold", to: "browser-verification", condition: "success" },
-    // browser-verification → code-review → completion-summary → merge-gate; each
-    // optional-group passes through (outcome=success) when disabled, so a task with
-    // both off routes straight to completion summary and merge policy.
-    { from: "browser-verification", to: "code-review", condition: "success" },
-    { from: "code-review", to: "completion-summary", condition: "success" },
-    { from: "completion-summary", to: "merge-gate", condition: "success" },
+    /*
+    FNXC:WorkspaceReviewSeal 2026-08-21-19:36:
+    A completion-summary agent can acquire the task worktree. It therefore precedes Code Review;
+    the approval becomes the final write-sensitive pre-merge gate and cannot be invalidated by the
+    built-in workflow after it is recorded.
+    */
+    { from: "browser-verification", to: "completion-summary", condition: "success" },
+    { from: "completion-summary", to: "code-review", condition: "success" },
+    { from: "code-review", to: "merge-gate", condition: "success" },
     { from: "browser-verification", to: "browser-verification-remediation", condition: "failure" },
     { from: "browser-verification-remediation", to: "browser-verification", condition: "success", kind: "rework" },
     { from: "code-review", to: "code-review-remediation", condition: "failure" },
@@ -14720,6 +14804,12 @@ var RAW_BUILTIN_STEPWISE_CODING_WORKFLOW_IR = {
     { from: "merge-attempt", to: "post-merge-verification", condition: "success" },
     { from: "post-merge-verification", to: "end", condition: "success" },
     { from: "merge-attempt", to: "merge-retry", condition: "outcome:transient-failure" },
+    /*
+    FNXC:WorkspaceReviewReroute 2026-08-21-20:11:
+    A stale workspace approval returns to the final Code Review gate through a bounded rework
+    edge, preserving the existing graph owner instead of burning a merge retry.
+    */
+    { from: "merge-attempt", to: "code-review", condition: "outcome:workspace-review-required", kind: "rework" },
     { from: "merge-attempt", to: "merge-manual-hold", condition: "outcome:manual-required" },
     { from: "recovery-router", to: "merge-attempt", condition: "outcome:wake-merge", kind: "rework" },
     { from: "merge-attempt", to: "end", condition: "failure" }
@@ -14782,11 +14872,11 @@ var RAW_BUILTIN_STEPWISE_FINAL_REVIEW_CODING_WORKFLOW_IR = (() => {
   if (!ir.edges.some((edge) => edge.from === "plan-replan" && edge.to === "plan-review" && edge.condition === "success")) {
     ir.edges.push({ from: "plan-replan", to: "plan-review", condition: "success", kind: "rework" });
   }
-  if (!ir.edges.some((edge) => edge.from === "code-review" && edge.to === "completion-summary" && edge.condition === "success")) {
-    ir.edges.push({ from: "code-review", to: "completion-summary", condition: "success" });
+  if (!ir.edges.some((edge) => edge.from === "completion-summary" && edge.to === "code-review" && edge.condition === "success")) {
+    ir.edges.push({ from: "completion-summary", to: "code-review", condition: "success" });
   }
-  if (!ir.edges.some((edge) => edge.from === "completion-summary" && edge.to === "merge-gate" && edge.condition === "success")) {
-    ir.edges.push({ from: "completion-summary", to: "merge-gate", condition: "success" });
+  if (!ir.edges.some((edge) => edge.from === "code-review" && edge.to === "merge-gate" && edge.condition === "success")) {
+    ir.edges.push({ from: "code-review", to: "merge-gate", condition: "success" });
   }
   return ir;
 })();
@@ -14866,8 +14956,8 @@ var RAW_BUILTIN_CODING_IDEAS_WORKFLOW_IR = (() => {
   ]);
   v2.nodes = v2.nodes.filter((node) => !removedNodeIds.has(node.id));
   v2.edges = v2.edges.filter((edge) => !removedNodeIds.has(edge.from) && !removedNodeIds.has(edge.to));
-  if (!v2.edges.some((edge) => edge.from === "steps" && edge.to === "code-review")) {
-    v2.edges.push({ from: "steps", to: "code-review", condition: "success" });
+  if (!v2.edges.some((edge) => edge.from === "steps" && edge.to === "completion-summary")) {
+    v2.edges.push({ from: "steps", to: "completion-summary", condition: "success" });
   }
   if (!v2.edges.some((edge) => edge.from === "merge-attempt" && edge.to === "end" && edge.condition === "success")) {
     v2.edges.push({ from: "merge-attempt", to: "end", condition: "success" });
@@ -15454,10 +15544,12 @@ function linear(spec) {
     ...hasBrowserVerification ? [browserVerificationRemediationNode("in-progress")] : [],
     ...hasCodeReview ? [codeReviewRemediationNode("in-progress")] : []
   ] : [];
+  const noOpTerminalNode = hasPlanReview ? { id: "plan-review-no-op", kind: "gate", column: "todo", config: { workflowAction: "plan-review-no-op" } } : void 0;
   const nodes2 = [
     { id: "start", kind: "start" },
     ...workflowNodes,
     ...remediationNodes,
+    ...noOpTerminalNode ? [noOpTerminalNode] : [],
     { id: "end", kind: "end" }
   ];
   const edges = [];
@@ -15473,6 +15565,8 @@ function linear(spec) {
   }
   if (hasPlanReview) {
     edges.push({ from: "plan-replan", to: "plan-review", condition: "success", kind: "rework" });
+    edges.push({ from: "plan-review", to: "plan-review-no-op", condition: "outcome:close-no-op" });
+    edges.push({ from: "plan-review-no-op", to: "end", condition: "success" });
   }
   if (hasBrowserVerification) {
     edges.push({