@tea-agent/loop-agent 0.39.0-beta.7 → 0.39.0-beta.9

package/dist/workflows/dag/interrupt-request.js

@@ -410,6 +410,13 @@ export function startInterruptWatcher(input) {
     let watcher;
     try {
         watcher = watch(path.join(input.runDir, ".runtime"), () => tick());
+        // fs.watch can report EMFILE/ENOSPC asynchronously after watch() returns.
+        // Polling below is the reliable path, so watcher errors must never escape
+        // as an unhandled EventEmitter error and orphan the DAG runner.
+        watcher.on("error", () => {
+            watcher?.close();
+            watcher = undefined;
+        });
         watcher.unref?.();
     }
     catch {

package/dist/workflows/dag/node-execution.js

@@ -3,6 +3,7 @@ import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
+import { redactSecrets, truncateUtf8Preview } from "../../shared/preview.js";
 import { recordDecisionEnvelopeForNode, shouldPauseOnHumanEscalation, writeHumanEscalationArtifacts, } from "./decision-envelope.js";
 import { FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT, FRONTEND_WRITER_NODE_IDS, isFrontendWriterAuthorized, readFrontendPrewriteResult, } from "./scheduler.js";
 import { writeNodeRecord, writeNodeSkillArtifacts } from "./run-store.js";
@@ -164,6 +165,45 @@ function frontendStructuredArtifactRetryGuidance(schemaId) {
     ];
 }
 const FRONTEND_PLAN_NODE_ID = "frontend-plan-pi";
+const COMPACT_RETRY_SECTION_MAX_CHARS = 1_200;
+const COMPACT_RETRY_TASK_MAX_CHARS = 4_800;
+function compactRetryText(text, maxChars) {
+    if (text.length <= maxChars)
+        return text;
+    const headChars = Math.floor(maxChars * 0.78);
+    const tailChars = Math.max(0, maxChars - headChars - 52);
+    return `${text.slice(0, headChars)}\n… [omitted after context-overflow] …\n${text.slice(-tailChars)}`;
+}
+function compactRetrySection(prompt, name, maxChars) {
+    const match = prompt.match(new RegExp(`<${name}>([\\s\\S]*?)</${name}>`));
+    return compactRetryText(match?.[1]?.trim() ?? "(not available)", maxChars);
+}
+/**
+ * A context-overflow retry must not resend the full resolved skills, governance
+ * payload, repeated source excerpts, and upstream previews that caused the
+ * previous session to overflow. Keep the immutable node contract plus bounded
+ * objective/criteria/task excerpts; canonical artifacts remain readable by
+ * pointer from the retained task instructions.
+ */
+export function buildContextOverflowRetryPrompt(task, basePrompt) {
+    return [
+        "<compact_retry_context>",
+        "This is a fresh, compact retry after provider context-overflow. The original full prompt remains audit evidence but is intentionally not resent.",
+        "Do not re-read task sources, upstream stdout, skills, or full diff artifacts that are already represented by canonical artifacts. Start from the smallest retained artifact and expand only the exact file or diff fragment needed.",
+        "</compact_retry_context>",
+        `<dag_objective>\n${compactRetrySection(basePrompt, "dag_objective", COMPACT_RETRY_SECTION_MAX_CHARS)}\n</dag_objective>`,
+        `<success_criteria>\n${compactRetrySection(basePrompt, "success_criteria", COMPACT_RETRY_SECTION_MAX_CHARS)}\n</success_criteria>`,
+        `<global_constraints>\n${compactRetrySection(basePrompt, "global_constraints", COMPACT_RETRY_SECTION_MAX_CHARS)}\n</global_constraints>`,
+        `<node_contract>\n${compactRetrySection(basePrompt, "node_contract", COMPACT_RETRY_SECTION_MAX_CHARS)}\n</node_contract>`,
+        `<upstream_context>\n${compactRetrySection(basePrompt, "upstream_context", COMPACT_RETRY_SECTION_MAX_CHARS)}\n</upstream_context>`,
+        [
+            "<task>",
+            `Original task id: ${task.id}`,
+            compactRetrySection(basePrompt, "task", COMPACT_RETRY_TASK_MAX_CHARS),
+            "</task>",
+        ].join("\n"),
+    ].join("\n\n");
+}
 function isFrontendPlanLadderTask(task) {
     return task.id === FRONTEND_PLAN_NODE_ID;
 }
@@ -184,9 +224,25 @@ async function readFrontendPlanCommittedSnapshot(runDir, nodeId) {
     const hasTerminalFact = committed.some((record) => record.fact.kind === "finalize_plan");
     return { digest, hasTerminalFact };
 }
-function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFailureCategory, previousProtocolReason, recoveryTargetPaths, recoveryDiagnostics, frontendPlanRetryStep) {
+export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFailureCategory, previousProtocolReason, recoveryTargetPaths, recoveryDiagnostics, frontendPlanRetryStep) {
     if (attemptNumber <= 1)
         return basePrompt;
+    // Context overflow is a transport/session failure, not a plan-protocol
+    // failure. It must take precedence over the plan retry ladder so every
+    // retry, including a repeated plan overflow, starts from the compact
+    // envelope rather than re-sending the original prompt.
+    if (previousFailureCategory === "context-overflow") {
+        return [
+            buildContextOverflowRetryPrompt(task, basePrompt),
+            "",
+            "<retry_instruction>",
+            "The previous attempt exceeded the provider context window. This retry starts a fresh session: keep the evidence surface narrow.",
+            "Do not re-read task sources, upstream stdout, skills, or full diff artifacts that are already represented by the canonical contract/review context. Read the smallest relevant artifact first, then only the specific source file or diff fragment needed to decide a finding.",
+            "Do not read artifacts/diff_patch.patch in full. For frontend review, read the bounded diff summary and then at most the specific per-file diff fragments it identifies, in part order.",
+            "Use concise tool calls and finish the required terminal/output protocol as soon as the evidence is sufficient.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
     if (frontendPlanRetryStep === "compact-terminal-first") {
         return [
             basePrompt,
@@ -239,6 +295,16 @@ function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFailureCate
         ].join("\n");
     }
     if (previousFailureCategory === "read-burst") {
+        if (task.id !== FRONTEND_PLAN_NODE_ID) {
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "The previous attempt exceeded its read budget. Start a fresh, evidence-minimal pass: do not re-read task sources, upstream stdout, skills, or full diff artifacts already represented by a canonical context artifact.",
+                "Read the smallest relevant summary first, then only the specific source file or diff fragment needed for the required decision. Finish the required terminal/output protocol as soon as evidence is sufficient.",
+                "</retry_instruction>",
+            ].join("\n");
+        }
         return [
             basePrompt,
             "",
@@ -430,6 +496,35 @@ function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFailureCate
         "</retry_instruction>",
     ].join("\n");
 }
+const PROMPT_RESTART_CANDIDATE_MAX_BYTES = 64 * 1024;
+function promptRestartCandidateForAttempt(input) {
+    if (input.attemptPrompt === input.baseRuntimePrompt) {
+        return input.taskPrompt;
+    }
+    const appendedPrefix = `${input.baseRuntimePrompt}\n\n`;
+    if (input.attemptPrompt.startsWith(appendedPrefix)) {
+        return [
+            input.taskPrompt,
+            input.attemptPrompt.slice(appendedPrefix.length),
+        ]
+            .filter(Boolean)
+            .join("\n\n");
+    }
+    return input.attemptPrompt;
+}
+async function persistFailedPromptRestartCandidate(input) {
+    const redacted = redactSecrets(input.prompt);
+    const preview = truncateUtf8Preview(redacted, PROMPT_RESTART_CANDIDATE_MAX_BYTES);
+    await writeDagNodeJsonArtifact(input.runDir, input.nodeId, `prompt-candidate-attempt-${input.attempt}.json`, {
+        schemaVersion: 1,
+        attempt: input.attempt,
+        failureCategory: input.failureCategory ?? "unknown",
+        prompt: preview,
+        truncated: preview !== redacted,
+        maxBytes: PROMPT_RESTART_CANDIDATE_MAX_BYTES,
+        sha256: createHash("sha256").update(redacted).digest("hex"),
+    });
+}
 export async function buildNodePromptWithResolvedSkillInstructions(spec, task, upstream, cwd, options) {
     const policy = resolveContextPolicy(spec);
     const skillNames = policy.resolveSkills(spec, task);
@@ -904,6 +999,7 @@ export async function executeDagNode(input) {
         // exactly this attempt's segment (B1: earlier attempts legitimately use
         // ls/find and must not be attributed to the repair attempt).
         const attemptSessionEventsOffset = await sessionEventsByteLength(runDir, nodeId);
+        let promptRestartCandidate = task.subtask_prompt;
         let result;
         try {
             validateRepairArtifactGateBeforeShell({
@@ -974,6 +1070,11 @@ export async function executeDagNode(input) {
                     previousReason: previousProtocolReason,
                 });
             }
+            promptRestartCandidate = promptRestartCandidateForAttempt({
+                taskPrompt: task.subtask_prompt,
+                baseRuntimePrompt: prompt,
+                attemptPrompt,
+            });
             result = await executeNode({
                 task,
                 cwd,
@@ -1101,6 +1202,15 @@ export async function executeDagNode(input) {
         const attemptWallDurationMs = durationBetween(attemptStartedAt, attemptFinishedAt);
         totalAttemptWallDurationMs += attemptWallDurationMs;
         const rawFailureCategory = result.rawFailureCategory ?? result.failureCategory;
+        if (task.executor === "pi" && !result.ok) {
+            await persistFailedPromptRestartCandidate({
+                runDir,
+                nodeId,
+                attempt: attemptNumber,
+                failureCategory: result.failureCategory,
+                prompt: promptRestartCandidate,
+            });
+        }
         const attemptRecord = {
             attempt: attemptNumber,
             startedAt: attemptStartedAt,

package/dist/workflows/dag/prompt.js

@@ -45,9 +45,42 @@ function formatResolvedSkillInstructions(instructions) {
     if (!instructions || instructions.length === 0)
         return "(none)";
     return instructions
-        .map((instruction) => instruction.promptText)
+        .map((instruction) => formatSkillChecklist(instruction))
         .join("\n\n---\n\n");
 }
+/** Keep skill provenance, but turn bounded inline manuals into a small action list. */
+function formatSkillChecklist(instruction) {
+    const metadata = [
+        `Skill: ${instruction.name}`,
+        `Resolution: ${instruction.resolution}`,
+        ...(instruction.path ? [`Path: ${instruction.path}`] : []),
+        ...(instruction.sha256 ? [`Sha256: ${instruction.sha256}`] : []),
+        "Injection mode: checklist",
+    ];
+    if (instruction.resolution !== "resolved")
+        return [...metadata, instruction.promptText].join("\n");
+    const source = instruction.promptText.split("Instructions:\n")[1] ?? "";
+    const candidates = source
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => /^(?:#{1,3}\s+|[-*]\s+|\d+[.)]\s+)/.test(line) || line.length > 0)
+        .map((line) => line.replace(/^#{1,3}\s+/, "").replace(/^[-*]\s+/, "").replace(/^\d+[.)]\s+/, ""))
+        .filter((line) => line.length > 0);
+    const checklist = [];
+    let chars = 0;
+    for (const item of candidates) {
+        const bounded = item.slice(0, 240);
+        if (checklist.length >= 10 || chars + bounded.length > 1_600)
+            break;
+        checklist.push(`- ${bounded}`);
+        chars += bounded.length;
+    }
+    return [
+        ...metadata,
+        "Checklist (apply these actions; consult the immutable resolved file only when a listed action requires detail):",
+        ...(checklist.length > 0 ? checklist : ["- Follow the resolved skill's declared workflow."]),
+    ].join("\n");
+}
 export function formatOutputLanguageBlock(language = DEFAULT_DAG_OUTPUT_LANGUAGE) {
     if (language === "en") {
         return [

package/dist/workflows/dag/recovery-lease.js

@@ -0,0 +1,80 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
+import { DAG_RUNS_DIR } from "./lifecycle.js";
+function recoveryLeasePath(cwd, parentRunId) {
+    // Never derive a filesystem name directly from an externally supplied legacy
+    // run id. The content remains auditable while the filename is traversal-safe.
+    const key = createHash("sha256").update(parentRunId).digest("hex");
+    return path.join(cwd, DAG_RUNS_DIR, ".recovery-leases", `${key}.json`);
+}
+function parseLease(raw, parentRunId) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error("invalid dag recovery lease: expected object");
+    }
+    const record = raw;
+    if (record.schemaVersion !== 1 ||
+        record.parentRunId !== parentRunId ||
+        typeof record.requestId !== "string" ||
+        record.requestId.length === 0 ||
+        (record.kind !== "auto-frontend-recovery" &&
+            record.kind !== "rerun-from-node" &&
+            record.kind !== "standalone-task-rerun") ||
+        typeof record.leaseToken !== "string" ||
+        record.leaseToken.length === 0 ||
+        typeof record.acquiredAt !== "string" ||
+        typeof record.executionRef !== "undefined" &&
+            typeof record.executionRef !== "string") {
+        throw new Error("invalid dag recovery lease: schema mismatch");
+    }
+    return record;
+}
+export async function acquireDagRecoveryLease(input) {
+    const leasePath = recoveryLeasePath(input.cwd, input.parentRunId);
+    const lease = {
+        schemaVersion: 1,
+        parentRunId: input.parentRunId,
+        requestId: input.requestId,
+        kind: input.kind,
+        leaseToken: randomBytes(16).toString("hex"),
+        acquiredAt: (input.now ?? (() => new Date()))().toISOString(),
+    };
+    await mkdir(path.dirname(leasePath), { recursive: true });
+    try {
+        // `wx` is the cross-process compare-and-create primitive. The lease is
+        // deliberately immutable for a parent run: a later recovery must follow
+        // the committed child lineage rather than fork another DAG.
+        await writeFile(leasePath, `${JSON.stringify(lease, null, 2)}\n`, {
+            encoding: "utf8",
+            flag: "wx",
+        });
+        return { kind: "acquired", leasePath, lease };
+    }
+    catch (error) {
+        if (!(error && typeof error === "object" && "code" in error && error.code === "EEXIST")) {
+            throw error;
+        }
+        const existing = parseLease(JSON.parse(await readFile(leasePath, "utf8")), input.parentRunId);
+        return { kind: "held", leasePath, lease: existing };
+    }
+}
+/** Persist the operation/run identity before the caller is allowed to execute it. */
+export async function bindDagRecoveryLeaseExecution(input) {
+    if (!input.executionRef.trim()) {
+        throw new Error("dag recovery lease executionRef is required");
+    }
+    const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
+    if (existing.leaseToken !== input.lease.leaseToken) {
+        throw new Error("dag recovery lease ownership drift");
+    }
+    if (existing.executionRef && existing.executionRef !== input.executionRef) {
+        throw new Error("dag recovery lease execution identity drift");
+    }
+    const bound = {
+        ...existing,
+        executionRef: input.executionRef,
+    };
+    await writeJsonAtomic(input.leasePath, bound);
+    return bound;
+}

package/dist/workflows/dag/rerun-feedback.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { parseJsonReviewVerdict } from "./output-protocol.js";
-import { FRONTEND_REVIEW_NODE_ID, readCommittedReviewRequestFact, } from "./frontend-review-findings.js";
+import { FRONTEND_DESIGN_REVIEW_NODE_ID, FRONTEND_REVIEW_NODE_ID, readCommittedDesignRequestFact, readCommittedReviewRequestFact, } from "./frontend-review-findings.js";
 export const MAX_RERUN_FEEDBACK_CHARS = 12_000;
 const RERUN_FEEDBACK_TRUNCATION_MARKER = "\n\n...[上一轮反馈已按长度上限截断]...\n\n";
 const MAX_EVIDENCE_REFS = 8;
@@ -183,6 +183,24 @@ async function readTypedReviewRequestFact(runDir) {
         },
     };
 }
+/**
+ * Read the committed frontend design request fact (typed terminal channel).
+ * Returns { nodeId, fact } when the design review node committed
+ * `request_design_changes` — the design analog of request_review_changes.
+ */
+async function readTypedDesignRequestFact(runDir) {
+    const fact = await readCommittedDesignRequestFact({ runDir });
+    if (!fact)
+        return undefined;
+    return {
+        nodeId: FRONTEND_DESIGN_REVIEW_NODE_ID,
+        fact: {
+            issueCategory: fact.issueCategory,
+            evidenceRefs: fact.evidenceRefs,
+            findings: fact.findings,
+        },
+    };
+}
 /**
  * Derive only the latest unresolved verify/review feedback from canonical
  * parent-run facts. Provider-only failures intentionally return undefined.
@@ -201,12 +219,15 @@ export async function deriveDagRerunFeedback(input) {
         }
     }
     if (!sourceNodeId || !sourceNode) {
-        // Typed terminal channel: the frontend review commits its verdict as a
-        // typed fact (request_review_changes) instead of VERDICT text, and the
-        // frontend DAG has no convergence passHistory. Fall back to reading the
-        // review node's typed event store so findings still flow into the next
-        // round as unresolved feedback.
-        const typedFact = await readTypedReviewRequestFact(input.runDir);
+        // Typed terminal channel: the frontend review/design review commit their
+        // verdicts as typed facts (request_review_changes / request_design_changes)
+        // instead of VERDICT text, and the frontend DAG has no convergence
+        // passHistory. Fall back to reading the typed event stores so findings
+        // still flow into the next round as unresolved feedback. Prefer review;
+        // if absent, fall through to the design review (a design rejection also
+        // carries actionable findings the next plan round must consume).
+        const typedFact = (await readTypedReviewRequestFact(input.runDir)) ??
+            (await readTypedDesignRequestFact(input.runDir));
         if (typedFact) {
             const parentSourceBindingHash = sourceBindingHash(input.spec);
             return withDigest({
@@ -216,7 +237,9 @@ export async function deriveDagRerunFeedback(input) {
                 taskId: input.taskId,
                 sourceNodeId: typedFact.nodeId,
                 verdict: "request-revision",
-                failureCategory: "review-request-changes",
+                failureCategory: typedFact.nodeId === FRONTEND_REVIEW_NODE_ID
+                    ? "review-request-changes"
+                    : "design-request-changes",
                 feedbackText: scrubAndBoundFeedbackText(formatTypedReviewRequestFeedback(typedFact.fact), input.runDir, input.state.cwd),
                 evidenceRefs: [
                     {

package/dist/workflows/dag/rerun-run.js

@@ -12,6 +12,7 @@ import { prepareActiveRunDir, writeNodeRecord, writeRunSpec, writeRunState, } fr
 import { cloneParentSkillSnapshotForContinuation, readSkillSnapshot, } from "./skill-snapshot.js";
 import { topoSortToRanks } from "./topo.js";
 import { captureWorkspaceCheckpoint, readWorkspaceCheckpoint, WORKSPACE_CHECKPOINT_START_REL, WORKSPACE_CHECKPOINT_TERMINAL_REL, writeWorkspaceCheckpoint, } from "./workspace-checkpoint.js";
+import { acquireDagRecoveryLease, bindDagRecoveryLeaseExecution, } from "./recovery-lease.js";
 export const RERUN_PLAN_REL_PATH = ".runtime/rerun-plan.json";
 export const IMPORT_MANIFEST_REL_PATH = ".runtime/import-manifest.json";
 export const WORKER_ASSOCIATION_REL_PATH = ".runtime/worker-association.json";
@@ -572,6 +573,20 @@ export async function executeDagRerun(input) {
     }
     const parentSpec = await readDagRunSpec(located.runDir);
     const parentState = await readDagRunState(located.runDir);
+    const recoveryLease = await acquireDagRecoveryLease({
+        cwd: input.cwd,
+        parentRunId: input.parentRunId,
+        requestId: input.requestId,
+        kind: "rerun-from-node",
+    });
+    if (recoveryLease.kind === "held") {
+        return {
+            ok: false,
+            plan,
+            errorCode: "RECOVERY_LEASE_HELD",
+            message: `parent run recovery is already claimed by ${recoveryLease.lease.kind} request ${recoveryLease.lease.requestId}`,
+        };
+    }
     const staged = await stageContinuationRun({
         cwd: input.cwd,
         parentRunDir: located.runDir,
@@ -583,6 +598,14 @@ export async function executeDagRerun(input) {
         requestId: input.requestId,
         promptOverrides: input.promptOverrides,
     });
+    // Stage is non-executing; bind the child identity immediately before handing
+    // it to the runner so no recovery DAG can start without durable parent
+    // lineage ownership.
+    await bindDagRecoveryLeaseExecution({
+        leasePath: recoveryLease.leasePath,
+        lease: recoveryLease.lease,
+        executionRef: staged.state.runId,
+    });
     const continuationOptions = {
         cwd: input.cwd,
         spec: staged.spec,

package/dist/workflows/dag/rerun-task.js

@@ -4,6 +4,7 @@ import { generateTaskDagUseCase } from "../../application/dag/generate-task-dag.
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { DAG_RUNS_DIR, isTerminalDagRunStatus, locateDagRun, readDagRunSpec, readDagRunState, } from "./lifecycle.js";
 import { deriveDagRerunFeedback } from "./rerun-feedback.js";
+import { acquireDagRecoveryLease, bindDagRecoveryLeaseExecution, } from "./recovery-lease.js";
 import { parseDagSpec, } from "./types.js";
 export const RERUN_TASK_LINEAGE_REL_PATH = ".runtime/rerun-task-lineage.json";
 export function parseDagRerunTaskArgs(args) {
@@ -369,6 +370,34 @@ export async function rerunStandaloneTask(input) {
             }
         }
     }
+    const recoveryLease = execute
+        ? await acquireDagRecoveryLease({
+            cwd: input.cwd,
+            parentRunId: input.parentRunId,
+            requestId: input.requestId,
+            kind: "standalone-task-rerun",
+        })
+        : undefined;
+    if (recoveryLease?.kind === "held") {
+        return blockedResult({
+            parentRunId: input.parentRunId,
+            reason: input.reason,
+            requestId: input.requestId,
+            blockedReason: "recovery-lease-held",
+            note: `parent run recovery is already claimed by ${recoveryLease.lease.kind} request ${recoveryLease.lease.requestId}`,
+            taskId: taskResolution.taskId,
+        });
+    }
+    if (recoveryLease?.kind === "acquired") {
+        // Persist a non-empty execution identity before generateTaskDagUseCase can
+        // execute its new DAG. The generated run id is not available yet, so the
+        // request id is the stable lineage handle for this entry point.
+        await bindDagRecoveryLeaseExecution({
+            leasePath: recoveryLease.leasePath,
+            lease: recoveryLease.lease,
+            executionRef: `standalone-task-rerun:${input.requestId}`,
+        });
+    }
     const generateResult = await generateTaskDagUseCase({
         repoRoot: input.cwd,
         taskId: taskResolution.taskId,

package/dist/workflows/dag/retry-policy.js

@@ -132,13 +132,24 @@ export const dagRetryPolicySchema = z
 /**
  * The default retry policy applied to safe generated read-only Pi nodes.
  * Total attempts: 3, exponential backoff with cap.
+ *
+ * Includes `context-overflow`: a read-only node that blew the context window
+ * (400 request too large, e.g. a review node accumulating too many reads) is a
+ * transient, safe-to-retry failure — the retry re-runs the node with a
+ * compact-context instruction instead of failing the whole run. Previously
+ * only writer transport policies had context-overflow; contract/scout/
+ * design-review/review fell straight to ERROR without a retry attempt.
  */
 export const DEFAULT_READ_ONLY_PI_RETRY_POLICY = {
     maxAttempts: 3,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
-    retryCategories: [...DEFAULT_DAG_RETRY_CATEGORIES],
+    retryCategories: [
+        ...DEFAULT_DAG_RETRY_CATEGORIES,
+        READ_BURST_RETRY_CATEGORY,
+        CONTEXT_OVERFLOW_RETRY_CATEGORY,
+    ],
 };
 /**
  * Structured planner nodes may retry with a compact-output instruction
@@ -148,7 +159,11 @@ export const DEFAULT_READ_ONLY_PI_RETRY_POLICY = {
  */
 export const STRUCTURED_REQUIRED_PI_RETRY_POLICY = {
     ...DEFAULT_READ_ONLY_PI_RETRY_POLICY,
-    retryCategories: [...STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES],
+    retryCategories: [
+        ...STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES,
+        READ_BURST_RETRY_CATEGORY,
+        CONTEXT_OVERFLOW_RETRY_CATEGORY,
+    ],
 };
 /**
  * Planner read-only nodes (standard DAG contract-pi / plan-pi) may retry with
@@ -159,7 +174,12 @@ export const STRUCTURED_REQUIRED_PI_RETRY_POLICY = {
  */
 export const PLANNER_OUTPUT_LIMIT_RETRY_POLICY = {
     ...DEFAULT_READ_ONLY_PI_RETRY_POLICY,
-    retryCategories: [...DEFAULT_DAG_RETRY_CATEGORIES, STRUCTURED_OUTPUT_RETRY_CATEGORY],
+    retryCategories: [
+        ...DEFAULT_DAG_RETRY_CATEGORIES,
+        STRUCTURED_OUTPUT_RETRY_CATEGORY,
+        READ_BURST_RETRY_CATEGORY,
+        CONTEXT_OVERFLOW_RETRY_CATEGORY,
+    ],
 };
 /**
  * Default retry for reviewer / recovery nodes that declare outputProtocol.
@@ -180,6 +200,8 @@ export const FRONTEND_REVIEW_TERMINAL_RETRY_POLICY = {
     ...DEFAULT_READ_ONLY_PI_RETRY_POLICY,
     retryCategories: [
         ...DEFAULT_DAG_RETRY_CATEGORIES,
+        READ_BURST_RETRY_CATEGORY,
+        CONTEXT_OVERFLOW_RETRY_CATEGORY,
         REVIEW_TERMINAL_MISSING_RETRY_CATEGORY,
     ],
 };
@@ -536,14 +558,16 @@ function reasonMandatedFrontendPlanRetryStep(reason) {
     }
 }
 /**
- * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=5 is
- * the schema cap, matching the four-rung ladder plus one non-converging stop.
- * `invalid-output` (typed-fact schema violations, e.g. verification targets
- * referencing undeclared UI states) retries at the `normal` rung with the
- * contractCheck reason injected via `<retry_instruction>` (§5.1 ladder).
+ * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=3
+ * bounds plan retry cost: the four-rung ladder is only partially traversable
+ * before the run fails non-converging (rungs: normal → bounded-tool-only →
+ * compact-terminal-first → backup-model). `invalid-output` (typed-fact schema
+ * violations, e.g. verification targets referencing undeclared UI states)
+ * retries at the `normal` rung with the contractCheck reason injected via
+ * `<retry_instruction>` (§5.1 ladder).
  */
 export const FRONTEND_PLAN_LADDER_RETRY_POLICY = {
-    maxAttempts: 5,
+    maxAttempts: 3,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
@@ -551,5 +575,6 @@ export const FRONTEND_PLAN_LADDER_RETRY_POLICY = {
         ...DEFAULT_DAG_RETRY_CATEGORIES,
         STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY,
         READ_BURST_RETRY_CATEGORY,
+        CONTEXT_OVERFLOW_RETRY_CATEGORY,
     ],
 };