@tea-agent/loop-agent 0.33.6-beta.0 → 0.33.6

package/dist/workflows/dag/init-hybrid.js

@@ -3508,29 +3508,23 @@ const readme=fs.existsSync('testcase/md/README.md')?fs.readFileSync('testcase/md
 const norm=s=>String(s).toLowerCase().replace(/[^a-z0-9]+/g,'_').replace(/^_+|_+$/g,'').replace(/_+/g,'_');
 const bt=String.fromCharCode(96);
 const stripBackticks=s=>s.split(bt).join('');
-const invalidReason=raw=>{const st=norm(raw);if(/^p[0-2]$/.test(st))return 'priority-only-module-stem';if(/^[a-f][a-f0-9]{6,63}$/.test(st))return 'opaque-hash-module-stem';if(st==='readme')return 'reserved-module-stem';if(!/^[a-z][a-z0-9_]*$/.test(st))return 'invalid-syntax';if(/^(?:be|tp|ac|req|br)[_-]/i.test(st))return 'case-like-module-stem';return null;};
+const invalidReason=raw=>{const st=norm(raw);if(/^p[0-2]$/.test(st))return 'priority-only-module-stem';if(st==='readme')return 'reserved-module-stem';if(!/^[a-z][a-z0-9_]*$/.test(st))return 'invalid-syntax';if(/^(?:be|tp|ac|req|br)[_-]/i.test(st))return 'case-like-module-stem';return null;};
 const valid=raw=>invalidReason(raw)===null;
 const rxMdPath=/testcase\\/md\\/([A-Za-z0-9_.-]+)\\.md/g;
 const rxTableRow=/\\|\\s*([A-Za-z0-9_.-]+)\\s*\\|\\s*testcase\\/test_/g;
 const rxRelLink=/\\[[^\\]]+\\]\\(\\.\\/([A-Za-z0-9_.-]+)\\.md\\)/g;
-const allLines=readme.replace(/\\r\\n/g,'\\n').replace(/\\r/g,'\\n').split('\\n');
-const headings=[];for(let i=0;i<allLines.length;i++){if(allLines[i].trim()==='## Module Index')headings.push(i);}
-if(headings.length!==1){process.stderr.write((headings.length===0?'missing-module-index':'duplicate-module-index')+'; require exactly one exact ## Module Index section\\n');process.exit(2);}
-const start=headings[0]+1;let end=allLines.length;for(let i=start;i<allLines.length;i++){if(/^##\\s+\\S/.test(allLines[i].trim())){end=i;break;}}
-const section=allLines.slice(start,end).join('\\n');
 const raw=[];
-const lines=section.split('\\n').filter(l=>l.includes('|'));
+const lines=readme.replace(/\\r\\n/g,'\\n').replace(/\\r/g,'\\n').split('\\n').filter(l=>l.includes('|'));
 for(const line of lines){
   const bare=stripBackticks(line);
   for(const m of bare.matchAll(rxMdPath)){raw.push(m[1]);}
-  for(const m of bare.matchAll(rxTableRow)){if(valid(m[1])||invalidReason(m[1])!=='invalid-syntax')raw.push(m[1]);}
+  for(const m of bare.matchAll(rxTableRow)){if(valid(m[1])||invalidReason(m[1])==='priority-only-module-stem')raw.push(m[1]);}
 }
-for(const m of section.matchAll(rxRelLink)){raw.push(m[1]);}
+for(const m of readme.matchAll(rxRelLink)){raw.push(m[1]);}
 const invalid=[];for(const r of raw){const reason=invalidReason(r);if(reason)invalid.push({stem:norm(r),reason});}
 if(invalid.length){for(const item of invalid)process.stderr.write(item.reason+': '+item.stem+'; use a stable business resource/domain stem\\n');process.exit(2);}
 const seen=new Set();const modules=[];
 for(const r of raw){const st=norm(r);if(valid(r)&&!seen.has(st)){seen.add(st);modules.push({stem:st});}}
-if(modules.length>8){process.stderr.write('excessive-module-count: '+modules.length+' > 8; merge by the smallest stable business resource/domain set\\n');process.exit(2);}
 process.stdout.write(JSON.stringify({modules}));
 `;
     const encoded = Buffer.from(script, "utf8").toString("base64");
@@ -3608,7 +3602,7 @@ async function buildBackendTestHybridDag(sources) {
             "Each Rule Key must appear in exactly one Matrix row. Preserve each AC/REQ/BR Rule Key as one row; if one product rule spans multiple dimensions, use a concise composite Dimension in that single row instead of duplicating the key. Derive OpenAPI Rule Keys exactly as the deterministic analyzer does: operation token is `<HTTP-METHOD>-<PATH>` with braces removed and every non-alphanumeric run replaced by a hyphen, uppercase (for example POST `/api/resource-notes` → `POST-API-RESOURCE-NOTES`); response statuses use `API-<OPERATION>-RESPONSE-STATUS`; body/parameter fields use `API-<OPERATION>-<FIELD>-REQUIRED|ENUM|MIN-LENGTH|MAX-LENGTH|MINIMUM|MAXIMUM|PATTERN|FORMAT`. Do not invent aliases such as API-CREATE-FIELDS when a deterministic key applies.",
             "Coverage priority is strict inside the declared scope: P0 product requirements/task hard constraints always remain in scope; P1 exhaustively supplements documented operations, fields, business rules, statuses and errors only for Affected Operations; P2 adds bounded protocol robustness only when it is relevant to the change and does not invent product behavior. Coverage percentages describe the declared affected scope, never whole-API completeness unless every operation is explicitly listed. Conflicts or undefined expectations must stay visible as GAP/CONFLICT with precise source pointers, never guessed.",
             "For uniqueness/lifecycle rules cover absent, active-existing, deleted-existing, create-delete-recreate, restore-then-recreate and documented scope/case-normalization states. For every enum cover every valid value plus bounded invalid equivalence classes (unknown, case variant, whitespace, empty, null/missing and wrong types as applicable). For every length/number rule cover min-1, min, nominal, max and max+1. For format rules cover each allowed class separately plus a valid mixed value, and representative forbidden classes including uppercase, internal/leading/trailing whitespace, tab/newline, unsupported punctuation, slash, emoji or control characters when the source contract supports that expectation.",
-            "Mandatory module index: include a `## Module Index` table in README that lists every planned module as a canonical relative link of the exact form `[label](./<stem>.md)` plus a `testcase/md/<stem>.md` path cell, so a downstream deterministic manifest can parse the module list. Group by stable business resource/domain, not by CRUD operation: one resource's list/detail/create/update/delete cases belong in one module such as `resource_notes`; split only when a single module would exceed the per-child 16K output protocol, keep the total module count at the smallest safe value, and never exceed 8 modules. Name each module file with a stable lowercase business stem such as `health` or `resource_notes`. Pure hexadecimal/hash-like opaque stems such as `a401606` or `deadbeef` are forbidden. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix and never defines module files. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. The relative link target MUST equal the on-disk filename stem the sharded writer will create. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+            "Mandatory module index: include a `## Module Index` table in README that lists every planned module as a canonical relative link of the exact form `[label](./<stem>.md)` plus a `testcase/md/<stem>.md` path cell, so a downstream deterministic manifest can parse the module list. Group by stable business resource/domain, not by CRUD operation: one resource's list/detail/create/update/delete cases belong in one module such as `resource_notes`; split only when a single module would exceed the per-child 16K output budget, and keep the total module count at the smallest safe value. Name each module file with a stable lowercase business stem such as `health` or `resource_notes`. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix and never defines module files. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. The relative link target MUST equal the on-disk filename stem the sharded writer will create. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
             "Before finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
             intake.boundedSourceContext,
             "## Authoritative reference index",
@@ -3653,11 +3647,10 @@ async function buildBackendTestHybridDag(sources) {
             workflowNodeId: "generate-backend-md-cases-map",
             itemsFrom: "$.nodes['materialize-backend-md-module-manifest-shell'].output.modules",
             itemName: "item",
-            maxItems: 8,
-            maxExpandedNodes: 8,
+            maxItems: 64,
+            maxExpandedNodes: 64,
             childIdPrefix: "generate-backend-md-case",
-            tokenBudget: { maxTotalTokens: 600000 },
-            failOnTokenBudgetExhaustion: true,
+            tokenBudget: { maxTokensPerCase: 16384, maxTotalTokens: 600000 },
             childTask: {
                 executor: "pi",
                 role: "implementer",
@@ -3680,7 +3673,7 @@ async function buildBackendTestHybridDag(sources) {
                     "The first non-empty response line must be exactly IMPLEMENTATION_OUTCOME: changed after the module file has been written, or IMPLEMENTATION_OUTCOME: blocked when precise missing evidence prevents safe generation. already-satisfied is not valid for this node.",
                     "Write human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.",
                     'Write the module {{item.stem}} as readable case cards covering every in-scope rule/Test Point the README Coverage Matrix assigns to this module. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. `<NNN>` is exactly three zero-padded digits (`001`, `002`, ...), never two digits (`01`), a bare number, or an alphabetic suffix such as `011A`. Every case must include `### 覆盖规则`, `### 测试点`, `### 场景类型`, `### 前置条件`, `### 操作步骤`, `### 预期结果`, and `### 自动化映射` Do not group cases under "## 测试类 ..." (or any h2 grouping) headings that force Cases down to h3; each Case must be a direct h2 (`##`), and its seven sections must be h3 (`###`) children of that Case. If you need to convey a pytest class, state it inside the Case\'s `### 自动化映射` instead. Forbidden: `## 测试类 X` then `### BE-PD-001` and `### 覆盖规则` at the same h3 level. Required: `## BE-PD-001` then `### 覆盖规则`.; `覆盖规则` and `测试点` must reference exact Matrix Rule Keys/Test Points. Add `测试目的`, `验收标准`, `需求依据`, and `测试数据` for readable evidence. The `验收标准` section must list the exact applicable `AC-...` IDs, and every explicit task AC must appear in at least one Case. Every automatable case explicitly names its target pytest script and exactly one primary symbol so traceability scans only that script/symbol.',
-                    "Name this module file with the stable lowercase business stem `{{item.stem}}` (filename `testcase/md/{{item.stem}}.md`). Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Pure hexadecimal/hash-like opaque stems such as `a401606` and `deadbeef` are also forbidden. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `testcase/test_{{item.stem}}.py`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+                    "Name this module file with the stable lowercase business stem `{{item.stem}}` (filename `testcase/md/{{item.stem}}.md`). Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `testcase/test_{{item.stem}}.py`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
                     "Every Case must keep at least one numbered executable line under `### 操作步骤`; a compact variant/result table may follow but must not replace the numbered action anchor. Keep numbered/bulleted independently assertable results under `### 预期结果`. The exact `### 操作步骤` and `### 预期结果` headings must remain present for every Case, including compact/table-based Cases; never compress later Cases by dropping required headings. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.",
                     "In every `自动化映射`, use exactly these machine-readable list labels: `脚本`, `primary symbol`, `变体测试点`, `场景断言测试点`, `横切证据测试点`. Each Test Point from `### 测试点` must appear in exactly one binding list, and every Test Point named in any binding list must also be declared in that Case's `### 测试点`; write `无` for an empty list. A variant Test Point is atomic: one exact endpoint/input/precondition/outcome row equals one exact pytest item and one exact TP ID. If a parameter table has five rows, declare five distinct variant TP IDs in Markdown; never declare one family TP and append row suffixes only in pytest. Classify as `variant` only when endpoint, request input, precondition business state, or expected outcome genuinely changes and therefore needs an independent pytest parameter item. Classify CRUD checkpoints, status/body/header/schema assertions and multiple checks over the same response/journey as `assertion`; classify shared HTTP logging/redaction/truncation evidence as `cross-cutting`. Never create a Test Point merely to parameterize a checkpoint. Every non-cross-cutting TP ID is owned by exactly one Case; when the same response/schema/error assertion is needed in different Cases, use distinct Case-specific TP IDs instead of reusing one assertion TP across Cases. Keep the script path identical to the module one-to-one path and declare exactly one primary symbol named with the canonical Case prefix, for example `BE-RN-003` → `test_BE_RN_003_<description>`; non-Case-prefixed primary symbols are forbidden because parameterized item association must remain deterministic. For redaction scenarios, list sensitive header/field key names only. Never write any header-name-and-value pair, credential placeholder, fake token, anti-example, or other secret-shaped literal in Markdown; state only that a test-only value is supplied at runtime and omitted. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
                     intake.boundedSourceContext,
@@ -3784,11 +3777,10 @@ async function buildBackendTestHybridDag(sources) {
             workflowNodeId: "generate-backend-pytest-cases-map",
             itemsFrom: "$.nodes['materialize-backend-pytest-module-manifest-shell'].output.modules",
             itemName: "item",
-            maxItems: 8,
-            maxExpandedNodes: 8,
+            maxItems: 64,
+            maxExpandedNodes: 64,
             childIdPrefix: "generate-backend-pytest-case",
-            tokenBudget: { maxTotalTokens: 600000 },
-            failOnTokenBudgetExhaustion: true,
+            tokenBudget: { maxTokensPerCase: 16384, maxTotalTokens: 600000 },
             childTask: {
                 executor: "pi",
                 role: "implementer",

package/dist/workflows/dag/types.js

@@ -555,13 +555,6 @@ export const dagDynamicExpansionSchema = z.object({
         maxTotalTokens: z.number().int().positive().optional(),
     })
         .optional(),
-    /**
-     * When true, any child blocked by the aggregate token budget fails the map
-     * barrier instead of being retained as a case-level blocked outcome.
-     * Backend-test enables this because partial Markdown/pytest module sets are
-     * invalid generation assets; frontend-test keeps the default false.
-     */
-    failOnTokenBudgetExhaustion: z.boolean().optional(),
     /**
      * When true, map child ERROR/auth/timeout is recorded as case-level
      * failed/blocked evidence and the map barrier still succeeds (frontend-test).

package/dist/workflows/dag/workspace-checkpoint.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { spawn } from "node:child_process";
 import { lstat, readFile, realpath } from "node:fs/promises";
 import path from "node:path";
+import { runResilientGitCommand } from "../../shared/resilient-git.js";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 /**
  * Workspace checkpoint for DAG continuation safety.
@@ -13,30 +13,10 @@ function sha256Hex(input) {
     return createHash("sha256").update(input).digest("hex");
 }
 async function runGit(cwd, args) {
-    return new Promise((resolve, reject) => {
-        const child = spawn("git", args, {
-            cwd,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.setEncoding("utf-8");
-        child.stderr.setEncoding("utf-8");
-        child.stdout.on("data", (chunk) => {
-            stdout += chunk;
-        });
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk;
-        });
-        child.on("error", reject);
-        child.on("close", (code) => {
-            if (code === 0) {
-                resolve(stdout);
-                return;
-            }
-            reject(new Error(`git ${args.join(" ")} failed: ${stderr.trim() || stdout.trim()}`));
-        });
-    });
+    const result = await runResilientGitCommand({ cwd, args, readOnly: true });
+    if (result.code === 0)
+        return result.stdout;
+    throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
 }
 function normalizeGitPath(value) {
     const target = value.includes(" -> ")
@@ -137,9 +117,10 @@ async function hashStableGovernanceInputs(repoRoot, taskId) {
  * When `taskId` is provided, fingerprint includes stable ignored Task Contract inputs.
  */
 export async function captureWorkspaceCheckpoint(repoRoot, options) {
+    const run = options?.dependencies?.runGit ?? runGit;
     const capturedAt = (options?.now ?? new Date()).toISOString();
-    const gitHeadSha = (await runGit(repoRoot, ["rev-parse", "HEAD"])).trim();
-    const porcelain = await runGit(repoRoot, [
+    const gitHeadSha = (await run(repoRoot, ["rev-parse", "HEAD"])).trim();
+    const porcelain = await run(repoRoot, [
         "status",
         "--porcelain=v1",
         "--untracked-files=all",

package/docs/templates/backend-test-dag.json

@@ -140,7 +140,7 @@
 				]
 			},
 			"outputContract": "Write a Chinese, human-readable testcase/md/README.md as the single Markdown-first entry page with Coverage Scope, Coverage Matrix and a machine-parseable module index. Do not write module case cards here; do not execute pytest or modify production code/config.",
-			"subtask_prompt": "This is a required file-generation node. After reading the bounded inputs, immediately use write tools to create testcase/md/README.md. Do not end after analysis or planning, and do not return before a non-empty bounded diff exists. Write ONLY testcase/md/README.md in this node; module case cards are written by downstream sharded nodes.\n\nOutput budget protocol (hard, max output <=16K per turn): Never paste full Matrix, case bodies, or source text into assistant chat. README holds only Scope+Matrix+module index; never inline full case bodies. If a Completeness Gate / OUTPUT_LIMIT_RECOVERY retry is injected, continue only listed target paths.\n\nThe first non-empty response line must be exactly IMPLEMENTATION_OUTCOME: changed after the README has been written, or IMPLEMENTATION_OUTCOME: blocked when precise missing evidence prevents safe generation. already-satisfied is not valid for this node.\n\nRead the upstream environment report. Generate the Markdown-first backend test README under testcase/md/README.md.\n\nWrite human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.\n\nCreate testcase/md/README.md as the concise entry page: test objective, target/environment, isolation/cleanup, module summary and a linked case index table with Case ID, Chinese case name, scenario type, endpoint and expected status/result. Avoid repeating every case body in README.\n\nBefore the Coverage Matrix, write a mandatory machine-readable `## Coverage Scope` section in README using exactly `| Field | Value |`, immediately followed by the separator row `|---|---|`, and these six unique rows: `Change Classification`, `Coverage Policy`, `Affected Operations`, `Affected Rule Keys`, `Regression Floor`, `Scope Evidence`. Always set `Change Classification` to `new-operation` and `Coverage Policy` to `full-contract`; do NOT reason about whether operations are new or existing. Cover all in-scope rules from the requirement document at full depth; treat the product requirement as the coverage baseline and use API contract evidence (fields/status/enum/boundary/format) to supplement scenario dimensions. Scope is limited to operations/rules the requirement document (or its referenced API contract) explicitly describes; do not expand to unrelated operations that the requirement does not mention. List affected operations exactly as `METHOD /path`, stable rule keys separated by semicolons, and precise source pointers as Scope Evidence.\n\nCoverage depth is full over the in-scope rules: fully cover every documented status, request/response field rule, requiredness, enum, boundary, format, auth and business state of each affected operation the requirement describes, but do not re-test unrelated operations the requirement does not mention. Inspect shared validator/helper/DTO/query builder evidence and expand Affected Operations when the same affected path can affect them; unresolved impact stays visible as GAP/CONFLICT.\n\nBefore writing cases, build the mandatory machine-readable Coverage Matrix inside `testcase/md/README.md` itself. Its section heading line must be exactly `## Coverage Matrix` with no numeric prefix/suffix; never place the canonical Matrix only in a module file. Use this exact header: `| Rule Key | Priority | Source | Endpoint/Field | Dimension | Rule | Required Test Points | Case IDs | Status |`. Every data row must contain exactly 9 pipe-delimited cells and must never omit `Dimension`; use concise dimensions such as requirement, operation, response-status, requiredness, enum, boundary, format, business-state or error. Use only P0/P1/P2 and COVERED/PARTIAL/GAP/CONFLICT. Use stable `TP-<UPPERCASE-HYPHENATED-ID>` test points separated by semicolons.\n\nEach Rule Key must appear in exactly one Matrix row. Preserve each AC/REQ/BR Rule Key as one row; if one product rule spans multiple dimensions, use a concise composite Dimension in that single row instead of duplicating the key. Derive OpenAPI Rule Keys exactly as the deterministic analyzer does: operation token is `<HTTP-METHOD>-<PATH>` with braces removed and every non-alphanumeric run replaced by a hyphen, uppercase (for example POST `/api/resource-notes` → `POST-API-RESOURCE-NOTES`); response statuses use `API-<OPERATION>-RESPONSE-STATUS`; body/parameter fields use `API-<OPERATION>-<FIELD>-REQUIRED|ENUM|MIN-LENGTH|MAX-LENGTH|MINIMUM|MAXIMUM|PATTERN|FORMAT`. Do not invent aliases such as API-CREATE-FIELDS when a deterministic key applies.\n\nCoverage priority is strict inside the declared scope: P0 product requirements/task hard constraints always remain in scope; P1 exhaustively supplements documented operations, fields, business rules, statuses and errors only for Affected Operations; P2 adds bounded protocol robustness only when it is relevant to the change and does not invent product behavior. Coverage percentages describe the declared affected scope, never whole-API completeness unless every operation is explicitly listed. Conflicts or undefined expectations must stay visible as GAP/CONFLICT with precise source pointers, never guessed.\n\nFor uniqueness/lifecycle rules cover absent, active-existing, deleted-existing, create-delete-recreate, restore-then-recreate and documented scope/case-normalization states. For every enum cover every valid value plus bounded invalid equivalence classes (unknown, case variant, whitespace, empty, null/missing and wrong types as applicable). For every length/number rule cover min-1, min, nominal, max and max+1. For format rules cover each allowed class separately plus a valid mixed value, and representative forbidden classes including uppercase, internal/leading/trailing whitespace, tab/newline, unsupported punctuation, slash, emoji or control characters when the source contract supports that expectation.\n\nMandatory module index: include a `## Module Index` table in README that lists every planned module as a canonical relative link of the exact form `[label](./<stem>.md)` plus a `testcase/md/<stem>.md` path cell, so a downstream deterministic manifest can parse the module list. Group by stable business resource/domain, not by CRUD operation: one resource's list/detail/create/update/delete cases belong in one module such as `resource_notes`; split only when a single module would exceed the per-child 16K output protocol, keep the total module count at the smallest safe value, and never exceed 8 modules. Name each module file with a stable lowercase business stem such as `health` or `resource_notes`. Pure hexadecimal/hash-like opaque stems such as `a401606` or `deadbeef` are forbidden. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix and never defines module files. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. The relative link target MUST equal the on-disk filename stem the sharded writer will create. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.\n\nBefore finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and copy `path` exactly into Markdown Source References. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.\n\nRead only precise indexed references needed for AC/API/field/rule evidence; references remain authoritative over derived text."
+			"subtask_prompt": "This is a required file-generation node. After reading the bounded inputs, immediately use write tools to create testcase/md/README.md. Do not end after analysis or planning, and do not return before a non-empty bounded diff exists. Write ONLY testcase/md/README.md in this node; module case cards are written by downstream sharded nodes.\n\nOutput budget protocol (hard, max output <=16K per turn): Never paste full Matrix, case bodies, or source text into assistant chat. README holds only Scope+Matrix+module index; never inline full case bodies. If a Completeness Gate / OUTPUT_LIMIT_RECOVERY retry is injected, continue only listed target paths.\n\nThe first non-empty response line must be exactly IMPLEMENTATION_OUTCOME: changed after the README has been written, or IMPLEMENTATION_OUTCOME: blocked when precise missing evidence prevents safe generation. already-satisfied is not valid for this node.\n\nRead the upstream environment report. Generate the Markdown-first backend test README under testcase/md/README.md.\n\nWrite human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.\n\nCreate testcase/md/README.md as the concise entry page: test objective, target/environment, isolation/cleanup, module summary and a linked case index table with Case ID, Chinese case name, scenario type, endpoint and expected status/result. Avoid repeating every case body in README.\n\nBefore the Coverage Matrix, write a mandatory machine-readable `## Coverage Scope` section in README using exactly `| Field | Value |`, immediately followed by the separator row `|---|---|`, and these six unique rows: `Change Classification`, `Coverage Policy`, `Affected Operations`, `Affected Rule Keys`, `Regression Floor`, `Scope Evidence`. Always set `Change Classification` to `new-operation` and `Coverage Policy` to `full-contract`; do NOT reason about whether operations are new or existing. Cover all in-scope rules from the requirement document at full depth; treat the product requirement as the coverage baseline and use API contract evidence (fields/status/enum/boundary/format) to supplement scenario dimensions. Scope is limited to operations/rules the requirement document (or its referenced API contract) explicitly describes; do not expand to unrelated operations that the requirement does not mention. List affected operations exactly as `METHOD /path`, stable rule keys separated by semicolons, and precise source pointers as Scope Evidence.\n\nCoverage depth is full over the in-scope rules: fully cover every documented status, request/response field rule, requiredness, enum, boundary, format, auth and business state of each affected operation the requirement describes, but do not re-test unrelated operations the requirement does not mention. Inspect shared validator/helper/DTO/query builder evidence and expand Affected Operations when the same affected path can affect them; unresolved impact stays visible as GAP/CONFLICT.\n\nBefore writing cases, build the mandatory machine-readable Coverage Matrix inside `testcase/md/README.md` itself. Its section heading line must be exactly `## Coverage Matrix` with no numeric prefix/suffix; never place the canonical Matrix only in a module file. Use this exact header: `| Rule Key | Priority | Source | Endpoint/Field | Dimension | Rule | Required Test Points | Case IDs | Status |`. Every data row must contain exactly 9 pipe-delimited cells and must never omit `Dimension`; use concise dimensions such as requirement, operation, response-status, requiredness, enum, boundary, format, business-state or error. Use only P0/P1/P2 and COVERED/PARTIAL/GAP/CONFLICT. Use stable `TP-<UPPERCASE-HYPHENATED-ID>` test points separated by semicolons.\n\nEach Rule Key must appear in exactly one Matrix row. Preserve each AC/REQ/BR Rule Key as one row; if one product rule spans multiple dimensions, use a concise composite Dimension in that single row instead of duplicating the key. Derive OpenAPI Rule Keys exactly as the deterministic analyzer does: operation token is `<HTTP-METHOD>-<PATH>` with braces removed and every non-alphanumeric run replaced by a hyphen, uppercase (for example POST `/api/resource-notes` → `POST-API-RESOURCE-NOTES`); response statuses use `API-<OPERATION>-RESPONSE-STATUS`; body/parameter fields use `API-<OPERATION>-<FIELD>-REQUIRED|ENUM|MIN-LENGTH|MAX-LENGTH|MINIMUM|MAXIMUM|PATTERN|FORMAT`. Do not invent aliases such as API-CREATE-FIELDS when a deterministic key applies.\n\nCoverage priority is strict inside the declared scope: P0 product requirements/task hard constraints always remain in scope; P1 exhaustively supplements documented operations, fields, business rules, statuses and errors only for Affected Operations; P2 adds bounded protocol robustness only when it is relevant to the change and does not invent product behavior. Coverage percentages describe the declared affected scope, never whole-API completeness unless every operation is explicitly listed. Conflicts or undefined expectations must stay visible as GAP/CONFLICT with precise source pointers, never guessed.\n\nFor uniqueness/lifecycle rules cover absent, active-existing, deleted-existing, create-delete-recreate, restore-then-recreate and documented scope/case-normalization states. For every enum cover every valid value plus bounded invalid equivalence classes (unknown, case variant, whitespace, empty, null/missing and wrong types as applicable). For every length/number rule cover min-1, min, nominal, max and max+1. For format rules cover each allowed class separately plus a valid mixed value, and representative forbidden classes including uppercase, internal/leading/trailing whitespace, tab/newline, unsupported punctuation, slash, emoji or control characters when the source contract supports that expectation.\n\nMandatory module index: include a `## Module Index` table in README that lists every planned module as a canonical relative link of the exact form `[label](./<stem>.md)` plus a `testcase/md/<stem>.md` path cell, so a downstream deterministic manifest can parse the module list. Group by stable business resource/domain, not by CRUD operation: one resource's list/detail/create/update/delete cases belong in one module such as `resource_notes`; split only when a single module would exceed the per-child 16K output budget, and keep the total module count at the smallest safe value. Name each module file with a stable lowercase business stem such as `health` or `resource_notes`. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix and never defines module files. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. The relative link target MUST equal the on-disk filename stem the sharded writer will create. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.\n\nBefore finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and copy `path` exactly into Markdown Source References. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.\n\nRead only precise indexed references needed for AC/API/field/rule evidence; references remain authoritative over derived text."
 		},
 		{
 			"id": "materialize-backend-md-module-manifest-shell",
@@ -164,7 +164,7 @@
 			"subtask_prompt": "Parse testcase/md/README.md and emit exactly one trailing JSON line {modules:[{stem}]} listing every trusted module stem (table-row testcase/md/<stem>.md mentions and canonical [label](./<stem>.md) relative links only). No file writes.",
 			"shell": {
 				"commands": [
-					"node -e \"eval(Buffer.from('Y29uc3QgZnM9cmVxdWlyZSgnZnMnKTsKY29uc3QgcmVhZG1lPWZzLmV4aXN0c1N5bmMoJ3Rlc3RjYXNlL21kL1JFQURNRS5tZCcpP2ZzLnJlYWRGaWxlU3luYygndGVzdGNhc2UvbWQvUkVBRE1FLm1kJywndXRmOCcpOicnOwpjb25zdCBub3JtPXM9PlN0cmluZyhzKS50b0xvd2VyQ2FzZSgpLnJlcGxhY2UoL1teYS16MC05XSsvZywnXycpLnJlcGxhY2UoL15fK3xfKyQvZywnJykucmVwbGFjZSgvXysvZywnXycpOwpjb25zdCBidD1TdHJpbmcuZnJvbUNoYXJDb2RlKDk2KTsKY29uc3Qgc3RyaXBCYWNrdGlja3M9cz0+cy5zcGxpdChidCkuam9pbignJyk7CmNvbnN0IGludmFsaWRSZWFzb249cmF3PT57Y29uc3Qgc3Q9bm9ybShyYXcpO2lmKC9ecFswLTJdJC8udGVzdChzdCkpcmV0dXJuICdwcmlvcml0eS1vbmx5LW1vZHVsZS1zdGVtJztpZigvXlthLWZdW2EtZjAtOV17Niw2M30kLy50ZXN0KHN0KSlyZXR1cm4gJ29wYXF1ZS1oYXNoLW1vZHVsZS1zdGVtJztpZihzdD09PSdyZWFkbWUnKXJldHVybiAncmVzZXJ2ZWQtbW9kdWxlLXN0ZW0nO2lmKCEvXlthLXpdW2EtejAtOV9dKiQvLnRlc3Qoc3QpKXJldHVybiAnaW52YWxpZC1zeW50YXgnO2lmKC9eKD86YmV8dHB8YWN8cmVxfGJyKVtfLV0vaS50ZXN0KHN0KSlyZXR1cm4gJ2Nhc2UtbGlrZS1tb2R1bGUtc3RlbSc7cmV0dXJuIG51bGw7fTsKY29uc3QgdmFsaWQ9cmF3PT5pbnZhbGlkUmVhc29uKHJhdyk9PT1udWxsOwpjb25zdCByeE1kUGF0aD0vdGVzdGNhc2VcL21kXC8oW0EtWmEtejAtOV8uLV0rKVwubWQvZzsKY29uc3QgcnhUYWJsZVJvdz0vXHxccyooW0EtWmEtejAtOV8uLV0rKVxzKlx8XHMqdGVzdGNhc2VcL3Rlc3RfL2c7CmNvbnN0IHJ4UmVsTGluaz0vXFtbXlxdXStcXVwoXC5cLyhbQS1aYS16MC05Xy4tXSspXC5tZFwpL2c7CmNvbnN0IGFsbExpbmVzPXJlYWRtZS5yZXBsYWNlKC9cclxuL2csJ1xuJykucmVwbGFjZSgvXHIvZywnXG4nKS5zcGxpdCgnXG4nKTsKY29uc3QgaGVhZGluZ3M9W107Zm9yKGxldCBpPTA7aTxhbGxMaW5lcy5sZW5ndGg7aSsrKXtpZihhbGxMaW5lc1tpXS50cmltKCk9PT0nIyMgTW9kdWxlIEluZGV4JyloZWFkaW5ncy5wdXNoKGkpO30KaWYoaGVhZGluZ3MubGVuZ3RoIT09MSl7cHJvY2Vzcy5zdGRlcnIud3JpdGUoKGhlYWRpbmdzLmxlbmd0aD09PTA/J21pc3NpbmctbW9kdWxlLWluZGV4JzonZHVwbGljYXRlLW1vZHVsZS1pbmRleCcpKyc7IHJlcXVpcmUgZXhhY3RseSBvbmUgZXhhY3QgIyMgTW9kdWxlIEluZGV4IHNlY3Rpb25cbicpO3Byb2Nlc3MuZXhpdCgyKTt9CmNvbnN0IHN0YXJ0PWhlYWRpbmdzWzBdKzE7bGV0IGVuZD1hbGxMaW5lcy5sZW5ndGg7Zm9yKGxldCBpPXN0YXJ0O2k8YWxsTGluZXMubGVuZ3RoO2krKyl7aWYoL14jI1xzK1xTLy50ZXN0KGFsbExpbmVzW2ldLnRyaW0oKSkpe2VuZD1pO2JyZWFrO319CmNvbnN0IHNlY3Rpb249YWxsTGluZXMuc2xpY2Uoc3RhcnQsZW5kKS5qb2luKCdcbicpOwpjb25zdCByYXc9W107CmNvbnN0IGxpbmVzPXNlY3Rpb24uc3BsaXQoJ1xuJykuZmlsdGVyKGw9PmwuaW5jbHVkZXMoJ3wnKSk7CmZvcihjb25zdCBsaW5lIG9mIGxpbmVzKXsKICBjb25zdCBiYXJlPXN0cmlwQmFja3RpY2tzKGxpbmUpOwogIGZvcihjb25zdCBtIG9mIGJhcmUubWF0Y2hBbGwocnhNZFBhdGgpKXtyYXcucHVzaChtWzFdKTt9CiAgZm9yKGNvbnN0IG0gb2YgYmFyZS5tYXRjaEFsbChyeFRhYmxlUm93KSl7aWYodmFsaWQobVsxXSl8fGludmFsaWRSZWFzb24obVsxXSkhPT0naW52YWxpZC1zeW50YXgnKXJhdy5wdXNoKG1bMV0pO30KfQpmb3IoY29uc3QgbSBvZiBzZWN0aW9uLm1hdGNoQWxsKHJ4UmVsTGluaykpe3Jhdy5wdXNoKG1bMV0pO30KY29uc3QgaW52YWxpZD1bXTtmb3IoY29uc3QgciBvZiByYXcpe2NvbnN0IHJlYXNvbj1pbnZhbGlkUmVhc29uKHIpO2lmKHJlYXNvbilpbnZhbGlkLnB1c2goe3N0ZW06bm9ybShyKSxyZWFzb259KTt9CmlmKGludmFsaWQubGVuZ3RoKXtmb3IoY29uc3QgaXRlbSBvZiBpbnZhbGlkKXByb2Nlc3Muc3RkZXJyLndyaXRlKGl0ZW0ucmVhc29uKyc6ICcraXRlbS5zdGVtKyc7IHVzZSBhIHN0YWJsZSBidXNpbmVzcyByZXNvdXJjZS9kb21haW4gc3RlbVxuJyk7cHJvY2Vzcy5leGl0KDIpO30KY29uc3Qgc2Vlbj1uZXcgU2V0KCk7Y29uc3QgbW9kdWxlcz1bXTsKZm9yKGNvbnN0IHIgb2YgcmF3KXtjb25zdCBzdD1ub3JtKHIpO2lmKHZhbGlkKHIpJiYhc2Vlbi5oYXMoc3QpKXtzZWVuLmFkZChzdCk7bW9kdWxlcy5wdXNoKHtzdGVtOnN0fSk7fX0KaWYobW9kdWxlcy5sZW5ndGg+OCl7cHJvY2Vzcy5zdGRlcnIud3JpdGUoJ2V4Y2Vzc2l2ZS1tb2R1bGUtY291bnQ6ICcrbW9kdWxlcy5sZW5ndGgrJyA+IDg7IG1lcmdlIGJ5IHRoZSBzbWFsbGVzdCBzdGFibGUgYnVzaW5lc3MgcmVzb3VyY2UvZG9tYWluIHNldFxuJyk7cHJvY2Vzcy5leGl0KDIpO30KcHJvY2Vzcy5zdGRvdXQud3JpdGUoSlNPTi5zdHJpbmdpZnkoe21vZHVsZXN9KSk7Cg==','base64').toString('utf8'))\""
+					"node -e \"eval(Buffer.from('Y29uc3QgZnM9cmVxdWlyZSgnZnMnKTsKY29uc3QgcmVhZG1lPWZzLmV4aXN0c1N5bmMoJ3Rlc3RjYXNlL21kL1JFQURNRS5tZCcpP2ZzLnJlYWRGaWxlU3luYygndGVzdGNhc2UvbWQvUkVBRE1FLm1kJywndXRmOCcpOicnOwpjb25zdCBub3JtPXM9PlN0cmluZyhzKS50b0xvd2VyQ2FzZSgpLnJlcGxhY2UoL1teYS16MC05XSsvZywnXycpLnJlcGxhY2UoL15fK3xfKyQvZywnJykucmVwbGFjZSgvXysvZywnXycpOwpjb25zdCBidD1TdHJpbmcuZnJvbUNoYXJDb2RlKDk2KTsKY29uc3Qgc3RyaXBCYWNrdGlja3M9cz0+cy5zcGxpdChidCkuam9pbignJyk7CmNvbnN0IGludmFsaWRSZWFzb249cmF3PT57Y29uc3Qgc3Q9bm9ybShyYXcpO2lmKC9ecFswLTJdJC8udGVzdChzdCkpcmV0dXJuICdwcmlvcml0eS1vbmx5LW1vZHVsZS1zdGVtJztpZihzdD09PSdyZWFkbWUnKXJldHVybiAncmVzZXJ2ZWQtbW9kdWxlLXN0ZW0nO2lmKCEvXlthLXpdW2EtejAtOV9dKiQvLnRlc3Qoc3QpKXJldHVybiAnaW52YWxpZC1zeW50YXgnO2lmKC9eKD86YmV8dHB8YWN8cmVxfGJyKVtfLV0vaS50ZXN0KHN0KSlyZXR1cm4gJ2Nhc2UtbGlrZS1tb2R1bGUtc3RlbSc7cmV0dXJuIG51bGw7fTsKY29uc3QgdmFsaWQ9cmF3PT5pbnZhbGlkUmVhc29uKHJhdyk9PT1udWxsOwpjb25zdCByeE1kUGF0aD0vdGVzdGNhc2VcL21kXC8oW0EtWmEtejAtOV8uLV0rKVwubWQvZzsKY29uc3QgcnhUYWJsZVJvdz0vXHxccyooW0EtWmEtejAtOV8uLV0rKVxzKlx8XHMqdGVzdGNhc2VcL3Rlc3RfL2c7CmNvbnN0IHJ4UmVsTGluaz0vXFtbXlxdXStcXVwoXC5cLyhbQS1aYS16MC05Xy4tXSspXC5tZFwpL2c7CmNvbnN0IHJhdz1bXTsKY29uc3QgbGluZXM9cmVhZG1lLnJlcGxhY2UoL1xyXG4vZywnXG4nKS5yZXBsYWNlKC9cci9nLCdcbicpLnNwbGl0KCdcbicpLmZpbHRlcihsPT5sLmluY2x1ZGVzKCd8JykpOwpmb3IoY29uc3QgbGluZSBvZiBsaW5lcyl7CiAgY29uc3QgYmFyZT1zdHJpcEJhY2t0aWNrcyhsaW5lKTsKICBmb3IoY29uc3QgbSBvZiBiYXJlLm1hdGNoQWxsKHJ4TWRQYXRoKSl7cmF3LnB1c2gobVsxXSk7fQogIGZvcihjb25zdCBtIG9mIGJhcmUubWF0Y2hBbGwocnhUYWJsZVJvdykpe2lmKHZhbGlkKG1bMV0pfHxpbnZhbGlkUmVhc29uKG1bMV0pPT09J3ByaW9yaXR5LW9ubHktbW9kdWxlLXN0ZW0nKXJhdy5wdXNoKG1bMV0pO30KfQpmb3IoY29uc3QgbSBvZiByZWFkbWUubWF0Y2hBbGwocnhSZWxMaW5rKSl7cmF3LnB1c2gobVsxXSk7fQpjb25zdCBpbnZhbGlkPVtdO2Zvcihjb25zdCByIG9mIHJhdyl7Y29uc3QgcmVhc29uPWludmFsaWRSZWFzb24ocik7aWYocmVhc29uKWludmFsaWQucHVzaCh7c3RlbTpub3JtKHIpLHJlYXNvbn0pO30KaWYoaW52YWxpZC5sZW5ndGgpe2Zvcihjb25zdCBpdGVtIG9mIGludmFsaWQpcHJvY2Vzcy5zdGRlcnIud3JpdGUoaXRlbS5yZWFzb24rJzogJytpdGVtLnN0ZW0rJzsgdXNlIGEgc3RhYmxlIGJ1c2luZXNzIHJlc291cmNlL2RvbWFpbiBzdGVtXG4nKTtwcm9jZXNzLmV4aXQoMik7fQpjb25zdCBzZWVuPW5ldyBTZXQoKTtjb25zdCBtb2R1bGVzPVtdOwpmb3IoY29uc3QgciBvZiByYXcpe2NvbnN0IHN0PW5vcm0ocik7aWYodmFsaWQocikmJiFzZWVuLmhhcyhzdCkpe3NlZW4uYWRkKHN0KTttb2R1bGVzLnB1c2goe3N0ZW06c3R9KTt9fQpwcm9jZXNzLnN0ZG91dC53cml0ZShKU09OLnN0cmluZ2lmeSh7bW9kdWxlc30pKTsK','base64').toString('utf8'))\""
 				],
 				"cwd": ".",
 				"timeoutMs": 60000
@@ -195,13 +195,13 @@
 				"workflowNodeId": "generate-backend-md-cases-map",
 				"itemsFrom": "$.nodes['materialize-backend-md-module-manifest-shell'].output.modules",
 				"itemName": "item",
-				"maxItems": 8,
-				"maxExpandedNodes": 8,
+				"maxItems": 64,
+				"maxExpandedNodes": 64,
 				"childIdPrefix": "generate-backend-md-case",
 				"tokenBudget": {
+					"maxTokensPerCase": 16384,
 					"maxTotalTokens": 600000
 				},
-				"failOnTokenBudgetExhaustion": true,
 				"childTask": {
 					"executor": "pi",
 					"role": "implementer",
@@ -238,7 +238,7 @@
 						]
 					},
 					"outputContract": "Write exactly one Chinese module Markdown case-card file testcase/md/<stem>.md with BE-<MODULE>-<NNN> cases and the seven required h3 sections; keep machine IDs/literals exact and do not execute pytest or modify production code/config or the README.",
-					"subtaskPromptTemplate": "This is a required file-generation node for exactly one Markdown module. After reading testcase/md/README.md (Coverage Scope + Coverage Matrix + module index) and the bounded references, immediately use write tools to create the single file testcase/md/{{item.stem}}.md. Do not end after analysis or planning, and do not return before a non-empty bounded diff exists. Do not modify README.md or any other module file.\n\nOutput budget protocol (hard, max output <=16K per turn): Never paste full Matrix, other modules' case bodies, or source text into assistant chat. Each write/edit tool call touches at most one file (this module). Compact tables/lists are required; omitting required sections or in-scope variants is forbidden. If a Completeness Gate / OUTPUT_LIMIT_RECOVERY retry is injected, continue only listed target paths.\n\nThe first non-empty response line must be exactly IMPLEMENTATION_OUTCOME: changed after the module file has been written, or IMPLEMENTATION_OUTCOME: blocked when precise missing evidence prevents safe generation. already-satisfied is not valid for this node.\n\nWrite human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.\n\nWrite the module {{item.stem}} as readable case cards covering every in-scope rule/Test Point the README Coverage Matrix assigns to this module. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. `<NNN>` is exactly three zero-padded digits (`001`, `002`, ...), never two digits (`01`), a bare number, or an alphabetic suffix such as `011A`. Every case must include `### 覆盖规则`, `### 测试点`, `### 场景类型`, `### 前置条件`, `### 操作步骤`, `### 预期结果`, and `### 自动化映射` Do not group cases under \"## 测试类 ...\" (or any h2 grouping) headings that force Cases down to h3; each Case must be a direct h2 (`##`), and its seven sections must be h3 (`###`) children of that Case. If you need to convey a pytest class, state it inside the Case's `### 自动化映射` instead. Forbidden: `## 测试类 X` then `### BE-PD-001` and `### 覆盖规则` at the same h3 level. Required: `## BE-PD-001` then `### 覆盖规则`.; `覆盖规则` and `测试点` must reference exact Matrix Rule Keys/Test Points. Add `测试目的`, `验收标准`, `需求依据`, and `测试数据` for readable evidence. The `验收标准` section must list the exact applicable `AC-...` IDs, and every explicit task AC must appear in at least one Case. Every automatable case explicitly names its target pytest script and exactly one primary symbol so traceability scans only that script/symbol.\n\nName this module file with the stable lowercase business stem `{{item.stem}}` (filename `testcase/md/{{item.stem}}.md`). Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Pure hexadecimal/hash-like opaque stems such as `a401606` and `deadbeef` are also forbidden. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `testcase/test_{{item.stem}}.py`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.\n\nEvery Case must keep at least one numbered executable line under `### 操作步骤`; a compact variant/result table may follow but must not replace the numbered action anchor. Keep numbered/bulleted independently assertable results under `### 预期结果`. The exact `### 操作步骤` and `### 预期结果` headings must remain present for every Case, including compact/table-based Cases; never compress later Cases by dropping required headings. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.\n\nIn every `自动化映射`, use exactly these machine-readable list labels: `脚本`, `primary symbol`, `变体测试点`, `场景断言测试点`, `横切证据测试点`. Each Test Point from `### 测试点` must appear in exactly one binding list, and every Test Point named in any binding list must also be declared in that Case's `### 测试点`; write `无` for an empty list. A variant Test Point is atomic: one exact endpoint/input/precondition/outcome row equals one exact pytest item and one exact TP ID. If a parameter table has five rows, declare five distinct variant TP IDs in Markdown; never declare one family TP and append row suffixes only in pytest. Classify as `variant` only when endpoint, request input, precondition business state, or expected outcome genuinely changes and therefore needs an independent pytest parameter item. Classify CRUD checkpoints, status/body/header/schema assertions and multiple checks over the same response/journey as `assertion`; classify shared HTTP logging/redaction/truncation evidence as `cross-cutting`. Never create a Test Point merely to parameterize a checkpoint. Every non-cross-cutting TP ID is owned by exactly one Case; when the same response/schema/error assertion is needed in different Cases, use distinct Case-specific TP IDs instead of reusing one assertion TP across Cases. Keep the script path identical to the module one-to-one path and declare exactly one primary symbol named with the canonical Case prefix, for example `BE-RN-003` → `test_BE_RN_003_<description>`; non-Case-prefixed primary symbols are forbidden because parameterized item association must remain deterministic. For redaction scenarios, list sensitive header/field key names only. Never write any header-name-and-value pair, credential placeholder, fake token, anti-example, or other secret-shaped literal in Markdown; state only that a test-only value is supplied at runtime and omitted. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and copy `path` exactly into Markdown Source References. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.\n\nRead only precise indexed references needed for AC/API/field/rule evidence; references remain authoritative over derived text."
+					"subtaskPromptTemplate": "This is a required file-generation node for exactly one Markdown module. After reading testcase/md/README.md (Coverage Scope + Coverage Matrix + module index) and the bounded references, immediately use write tools to create the single file testcase/md/{{item.stem}}.md. Do not end after analysis or planning, and do not return before a non-empty bounded diff exists. Do not modify README.md or any other module file.\n\nOutput budget protocol (hard, max output <=16K per turn): Never paste full Matrix, other modules' case bodies, or source text into assistant chat. Each write/edit tool call touches at most one file (this module). Compact tables/lists are required; omitting required sections or in-scope variants is forbidden. If a Completeness Gate / OUTPUT_LIMIT_RECOVERY retry is injected, continue only listed target paths.\n\nThe first non-empty response line must be exactly IMPLEMENTATION_OUTCOME: changed after the module file has been written, or IMPLEMENTATION_OUTCOME: blocked when precise missing evidence prevents safe generation. already-satisfied is not valid for this node.\n\nWrite human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.\n\nWrite the module {{item.stem}} as readable case cards covering every in-scope rule/Test Point the README Coverage Matrix assigns to this module. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. `<NNN>` is exactly three zero-padded digits (`001`, `002`, ...), never two digits (`01`), a bare number, or an alphabetic suffix such as `011A`. Every case must include `### 覆盖规则`, `### 测试点`, `### 场景类型`, `### 前置条件`, `### 操作步骤`, `### 预期结果`, and `### 自动化映射` Do not group cases under \"## 测试类 ...\" (or any h2 grouping) headings that force Cases down to h3; each Case must be a direct h2 (`##`), and its seven sections must be h3 (`###`) children of that Case. If you need to convey a pytest class, state it inside the Case's `### 自动化映射` instead. Forbidden: `## 测试类 X` then `### BE-PD-001` and `### 覆盖规则` at the same h3 level. Required: `## BE-PD-001` then `### 覆盖规则`.; `覆盖规则` and `测试点` must reference exact Matrix Rule Keys/Test Points. Add `测试目的`, `验收标准`, `需求依据`, and `测试数据` for readable evidence. The `验收标准` section must list the exact applicable `AC-...` IDs, and every explicit task AC must appear in at least one Case. Every automatable case explicitly names its target pytest script and exactly one primary symbol so traceability scans only that script/symbol.\n\nName this module file with the stable lowercase business stem `{{item.stem}}` (filename `testcase/md/{{item.stem}}.md`). Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `testcase/test_{{item.stem}}.py`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.\n\nEvery Case must keep at least one numbered executable line under `### 操作步骤`; a compact variant/result table may follow but must not replace the numbered action anchor. Keep numbered/bulleted independently assertable results under `### 预期结果`. The exact `### 操作步骤` and `### 预期结果` headings must remain present for every Case, including compact/table-based Cases; never compress later Cases by dropping required headings. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.\n\nIn every `自动化映射`, use exactly these machine-readable list labels: `脚本`, `primary symbol`, `变体测试点`, `场景断言测试点`, `横切证据测试点`. Each Test Point from `### 测试点` must appear in exactly one binding list, and every Test Point named in any binding list must also be declared in that Case's `### 测试点`; write `无` for an empty list. A variant Test Point is atomic: one exact endpoint/input/precondition/outcome row equals one exact pytest item and one exact TP ID. If a parameter table has five rows, declare five distinct variant TP IDs in Markdown; never declare one family TP and append row suffixes only in pytest. Classify as `variant` only when endpoint, request input, precondition business state, or expected outcome genuinely changes and therefore needs an independent pytest parameter item. Classify CRUD checkpoints, status/body/header/schema assertions and multiple checks over the same response/journey as `assertion`; classify shared HTTP logging/redaction/truncation evidence as `cross-cutting`. Never create a Test Point merely to parameterize a checkpoint. Every non-cross-cutting TP ID is owned by exactly one Case; when the same response/schema/error assertion is needed in different Cases, use distinct Case-specific TP IDs instead of reusing one assertion TP across Cases. Keep the script path identical to the module one-to-one path and declare exactly one primary symbol named with the canonical Case prefix, for example `BE-RN-003` → `test_BE_RN_003_<description>`; non-Case-prefixed primary symbols are forbidden because parameterized item association must remain deterministic. For redaction scenarios, list sensitive header/field key names only. Never write any header-name-and-value pair, credential placeholder, fake token, anti-example, or other secret-shaped literal in Markdown; state only that a test-only value is supplied at runtime and omitted. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.\n\n## Derived task contract: 需求.md\n\n# Backend test\n- AC-001 proof\n\n## Authoritative reference index\n\n[]\n\nFor each index entry, use `readPath` for Pi read-tool calls and copy `path` exactly into Markdown Source References. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.\n\nRead only precise indexed references needed for AC/API/field/rule evidence; references remain authoritative over derived text."
 				}
 			}
 		},
@@ -338,7 +338,7 @@
 			"subtask_prompt": "Parse testcase/md/README.md and emit exactly one trailing JSON line {modules:[{stem}]} listing every trusted module stem (table-row testcase/md/<stem>.md mentions and canonical [label](./<stem>.md) relative links only). No file writes.",
 			"shell": {
 				"commands": [
-					"node -e \"eval(Buffer.from('Y29uc3QgZnM9cmVxdWlyZSgnZnMnKTsKY29uc3QgcmVhZG1lPWZzLmV4aXN0c1N5bmMoJ3Rlc3RjYXNlL21kL1JFQURNRS5tZCcpP2ZzLnJlYWRGaWxlU3luYygndGVzdGNhc2UvbWQvUkVBRE1FLm1kJywndXRmOCcpOicnOwpjb25zdCBub3JtPXM9PlN0cmluZyhzKS50b0xvd2VyQ2FzZSgpLnJlcGxhY2UoL1teYS16MC05XSsvZywnXycpLnJlcGxhY2UoL15fK3xfKyQvZywnJykucmVwbGFjZSgvXysvZywnXycpOwpjb25zdCBidD1TdHJpbmcuZnJvbUNoYXJDb2RlKDk2KTsKY29uc3Qgc3RyaXBCYWNrdGlja3M9cz0+cy5zcGxpdChidCkuam9pbignJyk7CmNvbnN0IGludmFsaWRSZWFzb249cmF3PT57Y29uc3Qgc3Q9bm9ybShyYXcpO2lmKC9ecFswLTJdJC8udGVzdChzdCkpcmV0dXJuICdwcmlvcml0eS1vbmx5LW1vZHVsZS1zdGVtJztpZigvXlthLWZdW2EtZjAtOV17Niw2M30kLy50ZXN0KHN0KSlyZXR1cm4gJ29wYXF1ZS1oYXNoLW1vZHVsZS1zdGVtJztpZihzdD09PSdyZWFkbWUnKXJldHVybiAncmVzZXJ2ZWQtbW9kdWxlLXN0ZW0nO2lmKCEvXlthLXpdW2EtejAtOV9dKiQvLnRlc3Qoc3QpKXJldHVybiAnaW52YWxpZC1zeW50YXgnO2lmKC9eKD86YmV8dHB8YWN8cmVxfGJyKVtfLV0vaS50ZXN0KHN0KSlyZXR1cm4gJ2Nhc2UtbGlrZS1tb2R1bGUtc3RlbSc7cmV0dXJuIG51bGw7fTsKY29uc3QgdmFsaWQ9cmF3PT5pbnZhbGlkUmVhc29uKHJhdyk9PT1udWxsOwpjb25zdCByeE1kUGF0aD0vdGVzdGNhc2VcL21kXC8oW0EtWmEtejAtOV8uLV0rKVwubWQvZzsKY29uc3QgcnhUYWJsZVJvdz0vXHxccyooW0EtWmEtejAtOV8uLV0rKVxzKlx8XHMqdGVzdGNhc2VcL3Rlc3RfL2c7CmNvbnN0IHJ4UmVsTGluaz0vXFtbXlxdXStcXVwoXC5cLyhbQS1aYS16MC05Xy4tXSspXC5tZFwpL2c7CmNvbnN0IGFsbExpbmVzPXJlYWRtZS5yZXBsYWNlKC9cclxuL2csJ1xuJykucmVwbGFjZSgvXHIvZywnXG4nKS5zcGxpdCgnXG4nKTsKY29uc3QgaGVhZGluZ3M9W107Zm9yKGxldCBpPTA7aTxhbGxMaW5lcy5sZW5ndGg7aSsrKXtpZihhbGxMaW5lc1tpXS50cmltKCk9PT0nIyMgTW9kdWxlIEluZGV4JyloZWFkaW5ncy5wdXNoKGkpO30KaWYoaGVhZGluZ3MubGVuZ3RoIT09MSl7cHJvY2Vzcy5zdGRlcnIud3JpdGUoKGhlYWRpbmdzLmxlbmd0aD09PTA/J21pc3NpbmctbW9kdWxlLWluZGV4JzonZHVwbGljYXRlLW1vZHVsZS1pbmRleCcpKyc7IHJlcXVpcmUgZXhhY3RseSBvbmUgZXhhY3QgIyMgTW9kdWxlIEluZGV4IHNlY3Rpb25cbicpO3Byb2Nlc3MuZXhpdCgyKTt9CmNvbnN0IHN0YXJ0PWhlYWRpbmdzWzBdKzE7bGV0IGVuZD1hbGxMaW5lcy5sZW5ndGg7Zm9yKGxldCBpPXN0YXJ0O2k8YWxsTGluZXMubGVuZ3RoO2krKyl7aWYoL14jI1xzK1xTLy50ZXN0KGFsbExpbmVzW2ldLnRyaW0oKSkpe2VuZD1pO2JyZWFrO319CmNvbnN0IHNlY3Rpb249YWxsTGluZXMuc2xpY2Uoc3RhcnQsZW5kKS5qb2luKCdcbicpOwpjb25zdCByYXc9W107CmNvbnN0IGxpbmVzPXNlY3Rpb24uc3BsaXQoJ1xuJykuZmlsdGVyKGw9PmwuaW5jbHVkZXMoJ3wnKSk7CmZvcihjb25zdCBsaW5lIG9mIGxpbmVzKXsKICBjb25zdCBiYXJlPXN0cmlwQmFja3RpY2tzKGxpbmUpOwogIGZvcihjb25zdCBtIG9mIGJhcmUubWF0Y2hBbGwocnhNZFBhdGgpKXtyYXcucHVzaChtWzFdKTt9CiAgZm9yKGNvbnN0IG0gb2YgYmFyZS5tYXRjaEFsbChyeFRhYmxlUm93KSl7aWYodmFsaWQobVsxXSl8fGludmFsaWRSZWFzb24obVsxXSkhPT0naW52YWxpZC1zeW50YXgnKXJhdy5wdXNoKG1bMV0pO30KfQpmb3IoY29uc3QgbSBvZiBzZWN0aW9uLm1hdGNoQWxsKHJ4UmVsTGluaykpe3Jhdy5wdXNoKG1bMV0pO30KY29uc3QgaW52YWxpZD1bXTtmb3IoY29uc3QgciBvZiByYXcpe2NvbnN0IHJlYXNvbj1pbnZhbGlkUmVhc29uKHIpO2lmKHJlYXNvbilpbnZhbGlkLnB1c2goe3N0ZW06bm9ybShyKSxyZWFzb259KTt9CmlmKGludmFsaWQubGVuZ3RoKXtmb3IoY29uc3QgaXRlbSBvZiBpbnZhbGlkKXByb2Nlc3Muc3RkZXJyLndyaXRlKGl0ZW0ucmVhc29uKyc6ICcraXRlbS5zdGVtKyc7IHVzZSBhIHN0YWJsZSBidXNpbmVzcyByZXNvdXJjZS9kb21haW4gc3RlbVxuJyk7cHJvY2Vzcy5leGl0KDIpO30KY29uc3Qgc2Vlbj1uZXcgU2V0KCk7Y29uc3QgbW9kdWxlcz1bXTsKZm9yKGNvbnN0IHIgb2YgcmF3KXtjb25zdCBzdD1ub3JtKHIpO2lmKHZhbGlkKHIpJiYhc2Vlbi5oYXMoc3QpKXtzZWVuLmFkZChzdCk7bW9kdWxlcy5wdXNoKHtzdGVtOnN0fSk7fX0KaWYobW9kdWxlcy5sZW5ndGg+OCl7cHJvY2Vzcy5zdGRlcnIud3JpdGUoJ2V4Y2Vzc2l2ZS1tb2R1bGUtY291bnQ6ICcrbW9kdWxlcy5sZW5ndGgrJyA+IDg7IG1lcmdlIGJ5IHRoZSBzbWFsbGVzdCBzdGFibGUgYnVzaW5lc3MgcmVzb3VyY2UvZG9tYWluIHNldFxuJyk7cHJvY2Vzcy5leGl0KDIpO30KcHJvY2Vzcy5zdGRvdXQud3JpdGUoSlNPTi5zdHJpbmdpZnkoe21vZHVsZXN9KSk7Cg==','base64').toString('utf8'))\""
+					"node -e \"eval(Buffer.from('Y29uc3QgZnM9cmVxdWlyZSgnZnMnKTsKY29uc3QgcmVhZG1lPWZzLmV4aXN0c1N5bmMoJ3Rlc3RjYXNlL21kL1JFQURNRS5tZCcpP2ZzLnJlYWRGaWxlU3luYygndGVzdGNhc2UvbWQvUkVBRE1FLm1kJywndXRmOCcpOicnOwpjb25zdCBub3JtPXM9PlN0cmluZyhzKS50b0xvd2VyQ2FzZSgpLnJlcGxhY2UoL1teYS16MC05XSsvZywnXycpLnJlcGxhY2UoL15fK3xfKyQvZywnJykucmVwbGFjZSgvXysvZywnXycpOwpjb25zdCBidD1TdHJpbmcuZnJvbUNoYXJDb2RlKDk2KTsKY29uc3Qgc3RyaXBCYWNrdGlja3M9cz0+cy5zcGxpdChidCkuam9pbignJyk7CmNvbnN0IHZhbGlkPXJhdz0+e2NvbnN0IHN0PW5vcm0ocmF3KTtpZihzdD09PSdyZWFkbWUnKXJldHVybiBmYWxzZTtpZighL15bYS16XVthLXowLTlfXSokLy50ZXN0KHN0KSlyZXR1cm4gZmFsc2U7aWYoL14oPzpiZXx0cHxhY3xyZXF8YnIpW18tXS9pLnRlc3Qoc3QpKXJldHVybiBmYWxzZTtyZXR1cm4gdHJ1ZTt9Owpjb25zdCByeE1kUGF0aD0vdGVzdGNhc2VcL21kXC8oW0EtWmEtejAtOV8uLV0rKVwubWQvZzsKY29uc3QgcnhUYWJsZVJvdz0vXHxccyooW0EtWmEtejAtOV8uLV0rKVxzKlx8XHMqdGVzdGNhc2VcL3Rlc3RfL2c7CmNvbnN0IHJ4UmVsTGluaz0vXFtbXlxdXStcXVwoXC5cLyhbQS1aYS16MC05Xy4tXSspXC5tZFwpL2c7CmNvbnN0IHJhdz1bXTsKY29uc3QgbGluZXM9cmVhZG1lLnJlcGxhY2UoL1xyXG4vZywnXG4nKS5yZXBsYWNlKC9cci9nLCdcbicpLnNwbGl0KCdcbicpLmZpbHRlcihsPT5sLmluY2x1ZGVzKCd8JykpOwpmb3IoY29uc3QgbGluZSBvZiBsaW5lcyl7CiAgY29uc3QgYmFyZT1zdHJpcEJhY2t0aWNrcyhsaW5lKTsKICBmb3IoY29uc3QgbSBvZiBiYXJlLm1hdGNoQWxsKHJ4TWRQYXRoKSl7aWYodmFsaWQobVsxXSkpcmF3LnB1c2gobVsxXSk7fQogIGZvcihjb25zdCBtIG9mIGJhcmUubWF0Y2hBbGwocnhUYWJsZVJvdykpe2lmKHZhbGlkKG1bMV0pKXJhdy5wdXNoKG1bMV0pO30KfQpmb3IoY29uc3QgbSBvZiByZWFkbWUubWF0Y2hBbGwocnhSZWxMaW5rKSl7aWYodmFsaWQobVsxXSkpcmF3LnB1c2gobVsxXSk7fQpjb25zdCBzZWVuPW5ldyBTZXQoKTtjb25zdCBtb2R1bGVzPVtdOwpmb3IoY29uc3QgciBvZiByYXcpe2NvbnN0IHN0PW5vcm0ocik7aWYoIXNlZW4uaGFzKHN0KSl7c2Vlbi5hZGQoc3QpO21vZHVsZXMucHVzaCh7c3RlbTpzdH0pO319CnByb2Nlc3Muc3Rkb3V0LndyaXRlKEpTT04uc3RyaW5naWZ5KHttb2R1bGVzfSkpOwo=','base64').toString('utf8'))\""
 				],
 				"cwd": ".",
 				"timeoutMs": 60000
@@ -369,13 +369,13 @@
 				"workflowNodeId": "generate-backend-pytest-cases-map",
 				"itemsFrom": "$.nodes['materialize-backend-pytest-module-manifest-shell'].output.modules",
 				"itemName": "item",
-				"maxItems": 8,
-				"maxExpandedNodes": 8,
+				"maxItems": 64,
+				"maxExpandedNodes": 64,
 				"childIdPrefix": "generate-backend-pytest-case",
 				"tokenBudget": {
+					"maxTokensPerCase": 16384,
 					"maxTotalTokens": 600000
 				},
-				"failOnTokenBudgetExhaustion": true,
 				"childTask": {
 					"executor": "pi",
 					"role": "implementer",

package/harness.json

@@ -81,7 +81,7 @@
     "pi": {
       "description": "Pi 负责规划、评审、诊断；当 DAG toolProfile=write 时也可做有界写入。模型按复杂度三档配置，格式为 provider/model 字符串（例：wizard-local/grok-4.5）；斜杠前为 Pi provider，后为 modelId，勿只写裸 modelId。",
       "LOW": "wizard-local/minimax-m3",
-      "MED": "wizard-local/gpt-5.6-sol",
+      "MED": "wizard-local/gpt-5.6-terra",
       "HIGH": "wizard-local/gpt-5.6-sol"
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tea-agent/loop-agent",
-  "version": "0.33.6-beta.0",
+  "version": "0.33.6",
   "type": "module",
   "bin": {
     "loop-agent": "bin/loop-agent.js",

package/skills/loop-agent/references/command-reference.md

@@ -224,7 +224,9 @@ loop-agent task advance <task-id> "标题" \
   --json
 ```
 
-默认无 LLM 写 source；工程边界用 flags 显式给出。不要让 AI 直接改写 `source/references/*`。高级用户仍可手工编辑后 `task advance --from-draft`。
+默认无 LLM 写 source；工程边界用 flags 显式给出。不要让 AI 直接改写 `source/references/*`。
+Product Requirement V3/V4（`product-requirement.md`）由确定性解析消费；`product-analysis` / `requirement-clarification` 不能单独作为可执行 PRD。
+intake 失败时不要在原 PRD 目录生成兼容 md/json；`--from-draft` **仅**人工 reviewed draft / managed 恢复 / 调试，不是 `EMPTY_ACCEPTANCE` 默认恢复路径。
 
 ### Feature-study workflow（参考代码 → 轻量实现）
 

package/skills/loop-agent/references/source-and-plan-practice.md

@@ -41,6 +41,19 @@ Task 目录布局：`task-workflow.md`。
 - 把用户 PRD **整篇改写**进 `需求.md` 后删掉原文路径。
 - AI 直接 edit `source/references/*`。
 - 只把 PRD 路径写在聊天里，不落盘到 task 容器。
+- 把 `product-analysis.md` 当可执行 PRD，或把 analysis/clarification 改写成假 AC 以通过 prepare。
+- intake 失败后在原 PRD 目录生成「兼容格式」Markdown / `reviewed-draft.json`，再用 `--from-draft` 绕过（默认禁止）。
+- 把 `--from-draft` 当作 `EMPTY_ACCEPTANCE` 的自动恢复手段。
+
+### Product Analysis 套件
+
+| 文件 | role | 用途 |
+|---|---|---|
+| `product-requirement.md` | `requirement` | **唯一**可执行需求事实源（complete 后才进 DAG） |
+| `product-analysis.md` | `analysis` | 分析证据；**不能**单独作为 requirement |
+| `requirement-clarification.md` | `clarification` | 决策追溯；**不能**单独作为 requirement |
+
+`task advance --prd` 可多次传入；未写 `--role` 时按路径/frontmatter 推断。intake 未完成时 lifecycle 为 `intake-incomplete`（PRD 已归档，DAG 未生成）。
 
 ### 推荐顺序（有 PRD 时）
 

package/skills/loop-agent/references/task-workflow.md

@@ -37,6 +37,10 @@ loop-agent task status <task-id> --json
 ```
 
 - 用户原始 PRD 用 `task advance --prd <prd>` 归档到 `source/references/`，禁止 AI 改写。**有文件就归档**。
+- Product Analysis 套件职责：`product-requirement.md` 是唯一可执行需求事实源；`product-analysis.md` / `requirement-clarification.md` 仅引用。未显式 `--role` 时按文件名/frontmatter 推断（analysis / clarification / requirement）。
+- 遇到 `PRODUCT_ANALYSIS_NOT_EXECUTABLE` / `PRODUCT_REQUIREMENT_PENDING` / `EMPTY_ACCEPTANCE`：**禁止**改写原始产物，**禁止**在原 PRD 目录生成兼容 Markdown 或 `reviewed-draft.json` 自救；应换正确 requirement 文档或补真实验收标准后重试。
+- `--from-draft` 仅用于人工 reviewed draft / managed 恢复 / 调试，不是 intake 失败的默认恢复路径。
+- 确定性解析失败且缺口为结构性时，`task advance` 可自动做**一次** Semantic Intake（只读 Pi → `artifacts/intake/semantic-draft.json` → prepare）；analysis/pending/真缺决策不会调用。可用 `LOOP_AGENT_SEMANTIC_INTAKE=0` 关闭。禁止在原 PRD 目录写 sidecar。
 - 默认用 `task advance`（带 `--allowed-path` / `--verify`）投影 `需求.md` / `执行约束.md` 与 managed paths；**不要**默认让 LLM/主会话手写两 source。
 - 无独立 PRD 的微小任务可用 `task advance --from-text ...` escape hatch（见 `source-and-plan-practice.md`）。
 - 若 `ai_workspace/loop-agent/` 已有权威 plan/spec/PRD，优先 `task advance --prd` 归档并派生薄契约；避免把长 PRD 直接改写成唯一 source。

package/dist/worker/console/chat/instruction-skills.js

@@ -1,217 +0,0 @@
-/**
- * Operator Chat — instruction skills whitelist (design §7.5 / plan D1).
- *
- * Hard rules (plan D1):
- * - skills are READ-ONLY text context injected into the Chat system prompt;
- * - skills are NEVER registered as executable tools;
- * - the whitelist is a COMPILE-TIME constant (no runtime dir scan, no env override);
- * - arbitrary pi extension / package tool / user-level ~/.pi/agent skill is
- *   never discovered or loaded (V12);
- * - project `.agents/skills/` (init projection) is NOT injected (prevents
- *   target-repo injecting write instructions).
- *
- * Only the loop-agent repo's own audited skills are eligible. Workflow-specific
- * skills are conditional on taskKind/workflow and loaded on demand (not in MVP
- * operator-context default set).
- */
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-/**
- * Operator-context instruction skills (plan D1, "operator-context 允许").
- * These are read-only methodology skills. Loaded as text context for every
- * Chat session by default.
- *
- * MUST stay a compile-time constant. Adding a skill requires an ADR / plan note.
- */
-export const OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS = Object.freeze([
-    "grill-me",
-    "systematic-debugging",
-    "code-review-core",
-    "codebase-scout",
-    "verification-before-completion",
-    "requesting-code-review",
-    "analyze-product-requirements",
-    "analyze-product-dependencies",
-    "using-git-worktrees",
-]);
-/**
- * Meta / governance skills that must NEVER be injected into Chat context
- * (plan D1 "元 / 治理 skill"). Injecting these would let Chat rewrite its own
- * governance. Listed explicitly so accidental allowlist edits are caught.
- */
-export const OPERATOR_CHAT_DENIED_INSTRUCTION_SKILLS = Object.freeze([
-    "loop-agent",
-    "agent-worker",
-    "init-capability-evolution",
-    "ai-engineering-context",
-    "grill-with-docs",
-]);
-/**
- * Workflow-specific skills (plan D1 "workflow-specific 允许（条件）").
- * Only injected when the corresponding taskKind / workflow is active.
- * NOT loaded by default in MVP Chat.
- */
-export const OPERATOR_CHAT_WORKFLOW_CONDITIONAL_SKILLS = Object.freeze([
-    "frontend-implementation",
-    "frontend-review",
-    "frontend-verification",
-    "frontend-design-review",
-    "test-driven-development",
-    "webapp-testing",
-    "playwright-cli",
-    "playwright-cli-case-generator",
-    "browser-tools",
-]);
-const ALLOWED = new Set(OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.map((s) => s.toLowerCase()));
-const DENIED = new Set(OPERATOR_CHAT_DENIED_INSTRUCTION_SKILLS.map((s) => s.toLowerCase()));
-const CONDITIONAL = new Set(OPERATOR_CHAT_WORKFLOW_CONDITIONAL_SKILLS.map((s) => s.toLowerCase()));
-export function isOperatorChatInstructionSkillAllowed(name) {
-    return ALLOWED.has(name.trim().toLowerCase());
-}
-export function isOperatorChatInstructionSkillDenied(name) {
-    return DENIED.has(name.trim().toLowerCase());
-}
-export function isOperatorChatInstructionSkillConditional(name) {
-    return CONDITIONAL.has(name.trim().toLowerCase());
-}
-export function classifyInstructionSkill(name, options) {
-    const n = name.trim().toLowerCase();
-    if (DENIED.has(n)) {
-        return { ok: false, reason: "denied-governance", name };
-    }
-    if (ALLOWED.has(n)) {
-        return { ok: true, kind: "operator-context", name };
-    }
-    if (CONDITIONAL.has(n)) {
-        const active = options?.activeWorkflowSkills ?? [];
-        const activeLower = new Set(active.map((s) => s.toLowerCase()));
-        if (activeLower.has(n)) {
-            // Conditional skill is allowed only when explicitly activated by workflow.
-            // For MVP, conditional skills are not auto-injected; callers must opt in.
-            return { ok: false, reason: "conditional-not-active", name };
-        }
-        return { ok: false, reason: "conditional-not-active", name };
-    }
-    return { ok: false, reason: "unknown", name };
-}
-/**
- * Parse a SKILL.md frontmatter description (first `description:` line) and
- * return the body text (frontmatter stripped). Tolerant of missing frontmatter.
- */
-export function parseSkillFrontmatter(raw) {
-    let description = "";
-    let bodyText = raw;
-    const hasFrontmatter = raw.trimStart().startsWith("---");
-    if (hasFrontmatter) {
-        const lines = raw.split(/\r?\n/);
-        // find closing ---
-        let closeIdx = -1;
-        for (let i = 1; i < lines.length; i++) {
-            if (lines[i].trim() === "---") {
-                closeIdx = i;
-                break;
-            }
-        }
-        if (closeIdx > 0) {
-            const fm = lines.slice(1, closeIdx).join("\n");
-            bodyText = lines.slice(closeIdx + 1).join("\n").trim();
-            const descMatch = fm.match(/^description:\s*(.+)$/m);
-            if (descMatch) {
-                description = descMatch[1].trim().replace(/^["']|["']$/g, "");
-            }
-        }
-    }
-    else {
-        bodyText = raw.trim();
-    }
-    return { description, bodyText };
-}
-/**
- * Load the operator-context instruction skills from the loop-agent repo's own
- * `skills/` directory and return their text bodies for system-prompt injection.
- *
- * Security: only names in OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS are read;
- * any other path is rejected before filesystem access (safe-side).
- *
- * @param skillsDir absolute path to the loop-agent repo `skills/` directory
- *                  (source repo / npm pack asset, NOT target project `.agents/skills/`).
- * @param names     override list (tests); defaults to the full allowlist.
- */
-export async function loadOperatorChatInstructionSkills(skillsDir, names) {
-    const selected = names ?? OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS;
-    const loaded = [];
-    const failures = [];
-    const skipped = [];
-    for (const rawName of selected) {
-        const name = rawName.trim();
-        if (!isOperatorChatInstructionSkillAllowed(name)) {
-            skipped.push(name);
-            continue;
-        }
-        // Defense in depth: reject path traversal / governance skills even if
-        // an attacker managed to mutate the allowlist at runtime.
-        if (isOperatorChatInstructionSkillDenied(name)) {
-            skipped.push(name);
-            continue;
-        }
-        const skillPath = path.join(skillsDir, name, "SKILL.md");
-        const resolved = path.resolve(skillPath);
-        const resolvedSkillsDir = path.resolve(skillsDir);
-        if (!resolved.startsWith(resolvedSkillsDir + path.sep)) {
-            failures.push({
-                name,
-                message: "path escapes skills directory",
-            });
-            continue;
-        }
-        try {
-            const raw = await readFile(resolved, "utf8");
-            const { description, bodyText } = parseSkillFrontmatter(raw);
-            loaded.push({
-                name,
-                description,
-                bodyText,
-                charCount: bodyText.length,
-            });
-        }
-        catch (error) {
-            failures.push({
-                name,
-                message: error instanceof Error ? error.message : String(error),
-            });
-        }
-    }
-    return { loaded, failures, skipped };
-}
-/** Hard cap on total injected instruction-skill chars (token budget guard). */
-export const OPERATOR_CHAT_INSTRUCTION_CHAR_BUDGET = 24_000;
-/**
- * Compose the system-prompt fragment listing loaded instruction skills.
- * Each skill is rendered as a bounded text block. If total chars exceed the
- * budget, later skills are truncated (operator-context set is small enough
- * that truncation should not trigger in practice, but the cap is enforced).
- */
-export function composeInstructionSkillsPrompt(skills, budget = OPERATOR_CHAT_INSTRUCTION_CHAR_BUDGET) {
-    if (skills.length === 0)
-        return "";
-    const lines = [
-        "## Operator methodology context (read-only instruction skills)",
-        "",
-        "These skills are READ-ONLY context. You may reference their methodology when reasoning, but you CANNOT execute them. All actions must go through the registered operator tools.",
-        "",
-    ];
-    let used = 0;
-    for (const skill of skills) {
-        const header = `\n### ${skill.name}${skill.description ? ` — ${skill.description}` : ""}\n`;
-        const remaining = budget - used - header.length;
-        if (remaining <= 0) {
-            lines.push(`_[${skill.name}: omitted, char budget exhausted]_`);
-            break;
-        }
-        const slice = skill.bodyText.slice(0, Math.max(0, remaining));
-        lines.push(header);
-        lines.push(slice);
-        used += header.length + slice.length;
-    }
-    return lines.join("\n");
-}