@tea-agent/loop-agent 0.39.0-next.9 → 0.39.0

package/dist/workflows/dag/init-hybrid.js

@@ -5,12 +5,13 @@ import path from "node:path";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { assertValidDagSpec } from "./validate.js";
 import { DAG_AGENT_RUNTIME_PI_ONLY, DAG_REPAIR_WRITER_PROTOCOL_EXPLICIT_NODE_V1, DAG_RUNTIME_CONTRACT_SCHEMA_VERSION, DEFAULT_DAG_OUTPUT_LANGUAGE, DEFAULT_DAG_EXECUTOR_MODELS, parseDagSpec, } from "./types.js";
+import { bindDagRerunFeedback } from "./rerun-feedback.js";
 import { planMavenVerification, } from "../../verification/maven/index.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { extractTaskSourceOpenspecPaths } from "../../shared/openspec-spec.js";
 import { BASELINE_FORBIDDEN_PATHS } from "./governance-constants.js";
 import { buildDecisionEnvelopePromptContract } from "./decision-envelope.js";
-import { DEFAULT_READ_ONLY_PI_RETRY_POLICY, PLANNER_OUTPUT_LIMIT_RETRY_POLICY, PROTOCOL_AWARE_PI_RETRY_POLICY, STRUCTURED_REQUIRED_PI_RETRY_POLICY, BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY, WRITER_TRANSPORT_RETRY_POLICY, isSafeReadOnlyPiRetryCandidate, isWriterTransportRetryCandidate, } from "./retry-policy.js";
+import { DEFAULT_READ_ONLY_PI_RETRY_POLICY, PLANNER_OUTPUT_LIMIT_RETRY_POLICY, PROTOCOL_AWARE_PI_RETRY_POLICY, STRUCTURED_REQUIRED_PI_RETRY_POLICY, BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY, WRITER_TRANSPORT_RETRY_POLICY, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY, isCanonicalFinalVerifyShellRetryCandidate, isSafeReadOnlyPiRetryCandidate, isTargetTemplateImplementPi, isWriterTransportRetryCandidate, } from "./retry-policy.js";
 import { REVIEW_JSON_VERDICT_OUTPUT_PROTOCOL, REVIEW_VERDICT_OUTPUT_PROTOCOL, } from "./output-protocol.js";
 import { resolveAdapter } from "../../adapters/index.js";
 import { loadHarnessManifest } from "../../governance/harness.js";
@@ -20,19 +21,21 @@ import { applySddEmbeddedEnhancements, probeRepoLocalSddSkills, } from "./sdd-em
 import { discoverProjectGovernancePresence } from "./project-governance-context.js";
 import { getTaskPaths, loadTaskConfig } from "../../task/runtime.js";
 import { materializeTaskReferenceDocs } from "../../task/source-references.js";
-import { REQUIREMENT_FACT_ROLES } from "../../task/source-prepare/artifact-meta.js";
 import { observeTaskContract } from "../../task/contract/observe.js";
 import { dagHasWriterExecution } from "./task-contract-binding.js";
 import { DEFAULT_VERIFY_TIMEOUT_MS, resolveVerifyPreset, } from "../../executors/shell-verification.js";
 import { resolveExecutorModelMatrices } from "../../executors/model-routing.js";
 import { normalizeTaskRequirementText, resolveTaskDagTemplateSelection, } from "./task-demand-routing.js";
 import { BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT, buildBackendTestExecutionPreflightShellSnippet, } from "./backend-test-execution-contract.js";
+import { resolveBackendTestLayout, } from "./backend-test-layout.js";
+import { applyFrontendTestLayoutToText, resolveFrontendTestLayout, } from "./frontend-test-layout.js";
 import { buildBackendTestOutcomeGateShellSnippet } from "./backend-test-result-contract.js";
 import { buildBackendTestIntakeContext } from "./backend-test-intake-context.js";
 import { buildFrontendTestOutcomeGateShellSnippet } from "./frontend-test-result-contract.js";
 import { classifyFrontendRisk, } from "./frontend-risk.js";
 import { discoverFrontendProjectCapability, } from "./frontend-project-capability.js";
-import { FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, loadFrontendImplementationContractJsonSchema, } from "./frontend-implementation-contract.js";
+import { buildFrontendImplementationContractSkeleton, FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID, loadFrontendImplementationContractJsonSchema, } from "./frontend-implementation-contract.js";
+import { FRONTEND_NO_VERIFICATION_MARKER_TEXT } from "./frontend-verification-trace.js";
 import { serializeDagTaskSourcePath } from "../../task/dag-source-paths.js";
 const REQUIREMENT_FILE = "需求.md";
 const CONSTRAINT_FILE = "执行约束.md";
@@ -1280,11 +1283,15 @@ function deriveParallelScoutPaths(taskConfig) {
                 : allowed,
     };
 }
+const FRONTEND_NO_STATIC_VERIFICATION_MARKER = `node -e "console.log('${FRONTEND_NO_VERIFICATION_MARKER_TEXT}; static/behavior verification not-run')"`;
 /**
  * Resolve frontend verification fallbacks from the target project's own
  * package scripts. The DAG builder is also used by unit fixtures without a
- * package.json, so those fixtures retain the historical generic fallback.
- * Real projects never inherit loop-agent's commands when package.json exists.
+ * repoRoot, so those fixtures retain the historical generic fallback. A real
+ * project (repoRoot set) without a readable package.json has no scripts to
+ * invoke; the generic fallback would only inject commands guaranteed to fail
+ * at verify time, so such projects fall through to the tsc probe and may end
+ * up with no fallback commands plus a generation-time advisory.
  */
 async function discoverFrontendFallbackVerifyCommands(repoRoot) {
     const genericFallback = {
@@ -1301,10 +1308,8 @@ async function discoverFrontendFallbackVerifyCommands(repoRoot) {
         }
     }
     catch {
-        return genericFallback;
+        // No readable manifest: leave scripts unset and keep probing.
     }
-    if (!scripts)
-        return genericFallback;
     let packageManager = "npm";
     for (const [lockfile, manager] of [
         ["pnpm-lock.yaml", "pnpm"],
@@ -1381,19 +1386,66 @@ function toDagSourcePath(sources, absolutePath) {
         absolutePath,
     });
 }
-function extractExplicitRequirementIds(...markdownInputs) {
+/**
+ * Declaration-line shapes that assert a requirement id: list items
+ * ("- AC-1: ..."), numbered/ordered acceptance entries ("1. AC-1 ...",
+ * "1、AC-1"), table rows ("| AC-1 | ..."), and explicit key/value or
+ * heading declarations ("AC-1：...", "id: AC-1"). Ids that merely appear
+ * inside narrative prose (e.g. a fixture run id mentioned in background:
+ * "夹具 run 2026-08-23-req-f03535aa 已存在") are incidental mentions, not
+ * declared requirements, and must not pollute sourceBinding.requirementIds.
+ */
+const REQUIREMENT_ID_DECLARATION_LINE = /^\s*(?:[-+*]\s+|\d+[.、)）]\s*|\|\s*)?(?:[-A-Z0-9]+\s*[::]\s*)?(?:\*\*)?(?:REQ|BR|AC)-/i;
+function isRequirementIdDeclarationLine(line) {
+    return REQUIREMENT_ID_DECLARATION_LINE.test(line);
+}
+function extractExplicitRequirementIds(requirementMarkdown, ...fallbackMarkdown) {
     const ids = [];
     const seen = new Set();
-    for (const markdown of markdownInputs) {
+    const collect = (markdown, declarationsOnly) => {
         if (!markdown)
-            continue;
-        for (const match of markdown.matchAll(/\b(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi)) {
+            return;
+        const source = declarationsOnly
+            ? markdown
+                .split(/\r?\n/)
+                .filter((line) => isRequirementIdDeclarationLine(line))
+                .join("\n")
+            : markdown;
+        for (const match of source.matchAll(/\b(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi)) {
             const id = match[0].toUpperCase();
             if (!seen.has(id)) {
                 seen.add(id);
                 ids.push(id);
             }
         }
+    };
+    // The requirement document itself is human-authored acceptance prose:
+    // only declaration lines declare requirements there. If the document has
+    // no declaration-shaped lines at all (minimal free-form tasks like
+    // "covers AC-001"), fall back to its full text so bindings never go
+    // missing for unstructured input. References and constraints are bound
+    // documents (acceptance yaml, analysis docs) whose ids are authoritative
+    // wherever they appear — keep full scan for them.
+    const declarationLines = requirementMarkdown
+        .split(/\r?\n/)
+        .filter((line) => isRequirementIdDeclarationLine(line));
+    collect(requirementMarkdown, declarationLines.length > 0);
+    for (const markdown of fallbackMarkdown) {
+        if (markdown)
+            collect(markdown, false);
+    }
+    return ids;
+}
+/** Extract ids from an explicit authoritative section (full scan inside it). */
+function extractSectionRequirementIds(sectionMarkdown) {
+    const ids = [];
+    const seen = new Set();
+    for (const match of sectionMarkdown.matchAll(/\b(?:REQ|BR|AC)-[A-Z0-9]+(?:-[A-Z0-9]+)*\b/gi)) {
+        const id = match[0].toUpperCase();
+        if (!seen.has(id)) {
+            seen.add(id);
+            ids.push(id);
+        }
     }
     return ids;
 }
@@ -1407,7 +1459,7 @@ export function extractTaskScopedRequirementIds(requirementMarkdown, ...fallback
     // Without it, preserve legacy full-scan behavior (requirement + references).
     const sectionMatch = requirementMarkdown.match(/(?:^|\n)##\s*Acceptance References\s*\n([\s\S]*?)(?=\n##\s+|\n#\s+|$)/i);
     if (sectionMatch?.[1]) {
-        const fromSection = extractExplicitRequirementIds(sectionMatch[1]);
+        const fromSection = extractSectionRequirementIds(sectionMatch[1]);
         if (fromSection.length > 0)
             return fromSection;
     }
@@ -1500,27 +1552,11 @@ function buildSourceContextBlock(sources) {
             .relative(path.join(sources.taskDir, "source"), reference.path)
             .replaceAll(path.sep, "/");
         const referenceRef = toDagSourcePath(sources, reference.path);
-        // Fact-source roles (requirement/acceptance) carry the fields contracts
-        // depend on (AC/scope/columns). Inject them in full so a fixed excerpt
-        // cannot silently drop definitions; archival roles stay excerpted.
-        const isFactRole = reference.role !== undefined &&
-            REQUIREMENT_FACT_ROLES.has(reference.role);
-        const referenceExcerpt = isFactRole
-            ? {
-                text: reference.markdown.trim(),
-                truncated: false,
-                originalChars: reference.markdown.trim().length,
-                maxChars: Number.POSITIVE_INFINITY,
-            }
-            : excerptMarkdown(reference.markdown, {
-                sourceRef: referenceRef,
-            });
-        boundReadPaths.push(`- reference ${relativePath}${isFactRole ? " (full source)" : ""}: ${referenceRef}`);
-        parts.push(`## Task source reference: ${relativePath}`, `Bound readPath (use for Pi read-tool calls): ${referenceRef}`, ...(isFactRole
-            ? [
-                `Full source injected (role: ${reference.role}) — complete and authoritative; no excerpt truncation applied.`,
-            ]
-            : []), referenceExcerpt.text);
+        const referenceExcerpt = excerptMarkdown(reference.markdown, {
+            sourceRef: referenceRef,
+        });
+        boundReadPaths.push(`- reference ${relativePath}: ${referenceRef}`);
+        parts.push(`## Task source reference: ${relativePath}`, `Bound readPath (use for Pi read-tool calls): ${referenceRef}`, referenceExcerpt.text);
     }
     parts.push("## Bound source read paths", ...boundReadPaths, "Use these repository-readable paths for any Pi read-tool calls. Bound files under `.harness/tasks/<taskId>/source/**` are read-only inputs: reading them is allowed even though writing `.harness/**` is forbidden.", "Never resolve task-relative citations such as `source/需求.md` or `source/references/*` against the repository root, invent `source/<taskId>/...`, search for substitutes, or fall back to `docs/**` when a bound read fails.", "## Task config summary", `- taskId: ${sources.taskConfig.taskId}`, `- flow: ${sources.taskConfig.flow}`, `- complexity: ${sources.taskConfig.complexity}`, `- contextProfile: ${sources.taskConfig.contextProfile}`, `- allowedPaths: ${sources.taskConfig.allowedPaths.join(", ") || "(none — review before execute)"}`, `- forbiddenPaths: ${sources.taskConfig.forbiddenPaths.join(", ") || "(none)"}`, '- Pi DAG nodes are read-only unless toolProfile="write" is explicitly selected for a bounded writer node.', "- Agent DAG read-only nodes must not write root artifacts/**; root artifacts/ is not a per-node scratchpad.", `- Derived execution contract and immutable references live under the Bound source read paths above (not as repo-root \`source/...\`).`);
     if (sources.taskConfig.hardConstraints.length > 0) {
@@ -1558,49 +1594,10 @@ async function loadMaterializedSourceReferences(sourceDir) {
     }
     await collect(referenceDir);
     referencePaths.sort((left, right) => left.localeCompare(right));
-    const roleByPath = await loadReferenceRoles(sourceDir);
-    return Promise.all(referencePaths.map(async (filePath) => {
-        const relative = path
-            .relative(sourceDir, filePath)
-            .replaceAll(path.sep, "/");
-        const role = roleByPath.get(relative);
-        return {
-            path: filePath,
-            markdown: await readFile(filePath, "utf-8"),
-            ...(role !== undefined ? { role } : {}),
-        };
-    }));
-}
-/**
- * Reads `source-manifest.json` into a materializedPath → role map so the DAG
- * generator can tell fact-source references (requirement/acceptance) apart
- * from archival ones (analysis/clarification/design). A missing or malformed
- * manifest yields an empty map; such references keep the bounded-excerpt
- * treatment instead of being injected in full.
- */
-async function loadReferenceRoles(sourceDir) {
-    const roleByPath = new Map();
-    const manifestPath = path.join(sourceDir, "source-manifest.json");
-    let raw;
-    try {
-        raw = await readFile(manifestPath, "utf-8");
-    }
-    catch {
-        return roleByPath;
-    }
-    try {
-        const manifest = JSON.parse(raw);
-        for (const document of manifest.documents ?? []) {
-            if (typeof document.materializedPath === "string" &&
-                typeof document.role === "string") {
-                roleByPath.set(document.materializedPath.replaceAll(path.sep, "/"), document.role);
-            }
-        }
-    }
-    catch {
-        // A malformed manifest must never break reference injection.
-    }
-    return roleByPath;
+    return Promise.all(referencePaths.map(async (filePath) => ({
+        path: filePath,
+        markdown: await readFile(filePath, "utf-8"),
+    })));
 }
 export async function loadTaskHybridSources(repoRoot, taskId) {
     const paths = getTaskPaths(repoRoot, taskId);
@@ -1773,6 +1770,7 @@ export function buildStandardHybridDagFromTask(sources) {
                 forbiddenPaths,
                 outputContract: "Archived final shell verification stdout/stderr with exit codes; no worktree writes.",
                 subtask_prompt: "Run the adapter-resolved final verification commands before read-only verification review.",
+                transientRetryProfile: TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE,
                 shell: {
                     commands: verifyShellCommands,
                     verifyEvidence: buildVerifyEvidence({
@@ -1893,6 +1891,7 @@ export function buildStandardHybridDagFromTask(sources) {
                 allowedPaths: implementPaths.allowedPaths,
                 forbiddenPaths,
                 writerOutcomePolicy: { type: "implementation-outcome-v1" },
+                transientRetryProfile: TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE,
                 subtask_prompt: [
                     "Implement the approved plan with minimal focused changes.",
                     "Stay within writeSet. Do not write root artifacts/** unless artifacts paths are explicitly declared in writeSet.",
@@ -1952,6 +1951,7 @@ export function buildStandardHybridDagFromTask(sources) {
         ],
     };
     applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
+    stampTargetTemplateTransientRetryProfile(spec);
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
@@ -2417,33 +2417,21 @@ async function buildFrontendHybridDagFromTask(sources) {
             complexity: taskConfig.complexity,
         });
     const frontendSourceBinding = buildDagSourceBinding(sources);
+    const frontendContractSkeleton = buildFrontendImplementationContractSkeleton({
+        sourceBinding: frontendSourceBinding,
+        riskLevel: frontendRisk.selectedRisk,
+        targetFiles: implementPaths.writeSet,
+    });
     const frontendContractSchemaBlock = (() => {
         const schema = loadFrontendImplementationContractJsonSchema();
-        const requirement = frontendSourceBinding.sources.find((source) => source.kind === "requirement");
-        if (!requirement) {
-            throw new Error("frontend implementation contract context requires a bound requirement source");
-        }
-        const referencePaths = frontendSourceBinding.sources
-            .filter((s) => s.kind === "reference")
-            .map((s) => s.path);
-        const fixedFields = {
-            schemaVersion: 1,
-            sourceBinding: {
-                taskId: frontendSourceBinding.taskId,
-                requirementPath: requirement.path,
-                requirementSha256: requirement.sha256,
-                referencePaths,
-                requirementIds: frontendSourceBinding.requirementIds,
-            },
-            riskLevel: frontendRisk.selectedRisk,
-            targets: { files: implementPaths.writeSet },
-        };
         return [
-            `## ${FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID} JSON Schema (authoritative; do not guess fields)`,
+            `## Final ${FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID} JSON Schema (authoritative after runtime merge)`,
             schema,
             "",
-            "## Fixed contract fields (deterministic; copy exactly and do not modify)",
-            JSON.stringify(fixedFields),
+            "## Runtime contract skeleton (deterministic and protected)",
+            JSON.stringify(frontendContractSkeleton),
+            "",
+            "The initial planner emits an editable RFC 7386 patch against this skeleton. It MUST omit schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff. The runtime merges and validates the final contract, then writes a hash-bound canonical JSON artifact; downstream review and prewrite consume that artifact path, not planner stdout.",
             "",
             "## Forbidden fields (these are NOT in the schema; do not emit)",
             "- schemaId",
@@ -2560,11 +2548,6 @@ async function buildFrontendHybridDagFromTask(sources) {
         `Non-static targets (type unit/component/integration/mock) MUST set file to a concrete code file inside the implementation writeSet (task allowedPaths); the prewrite gate rejects any non-static target whose file falls outside the writeSet.`,
         `Command-level checks that run project-wide (all tests, typecheck, build, governance) MUST use type "static" and must NOT be bound as non-static targets with file=package.json/tsconfig.json/vite.config.ts/scripts/*. Static targets are exempt from the writeSet containment check.`,
     ].join("\n");
-    const mandatorySourceReadInstruction = [
-        "## Mandatory full source read before contracting",
-        "Before producing this contract/plan, use the Pi read tool to read the FULL bound source files (需求.md, 执行约束.md, and every `references/*` Bound readPath listed above) — the inline copies above may be truncated excerpts, and requirement/acceptance references are authoritative only in their full form.",
-        "Do not drop scope fields, acceptance criteria, non-goals, UI states, or column/field definitions that exist in the full sources but are absent from the inline excerpts; if a field appears in the full source, it belongs in the contract.",
-    ].join("\n");
     const strategy = resolveDagVerifyStrategy(taskConfig);
     const readOnlyPaths = taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"];
     const behaviorPaths = deriveFrontendBehaviorPaths(taskConfig);
@@ -2598,7 +2581,14 @@ async function buildFrontendHybridDagFromTask(sources) {
         return buildBlockedFrontendMockDag(frontendSources, readOnlyPaths, forbiddenPaths, globalConstraints, blockedReason);
     }
     const fallbackVerifyCommands = await discoverFrontendFallbackVerifyCommands(sources.repoRoot);
-    const staticFallbackCommands = fallbackVerifyCommands.staticCommands;
+    // The verification bundle schema requires at least one static command. When
+    // a real project exposes no usable verification command at all, run an
+    // explicit no-op marker instead of a command that is guaranteed to fail:
+    // the trace then records not-run honestly and the advisory asks the task
+    // to declare verification commands and regenerate.
+    const staticFallbackCommands = fallbackVerifyCommands.staticCommands.length > 0
+        ? fallbackVerifyCommands.staticCommands
+        : [FRONTEND_NO_STATIC_VERIFICATION_MARKER];
     const behaviorFallbackCommands = fallbackVerifyCommands.behaviorCommands;
     const parsedFrontendVerifyCommands = extractFrontendVerifyCommandsFromMarkdown({
         repoRoot: sources.repoRoot,
@@ -2697,6 +2687,11 @@ async function buildFrontendHybridDagFromTask(sources) {
         ...behaviorVerifyEvidence.commandLabels.map((command) => `  - ${JSON.stringify(command)}`),
     ].join("\n");
     const advisories = [];
+    if (!hasDeclaredFrontendVerification &&
+        fallbackVerifyCommands.staticCommands.length === 0 &&
+        fallbackVerifyCommands.behaviorCommands.length === 0) {
+        advisories.push("未发现可用的前端验证命令：目标项目没有可读取的 package.json scripts，也未探测到本地 TypeScript，verify 节点将没有静态/行为命令可执行。请在 task.json --verify 或执行约束.md 的验证约束中显式声明命令（例如 node --check src/app.js），然后重新生成 DAG。");
+    }
     if (frontendSourceMentionsMock(frontendSources) &&
         frontendMockStrategyMustBeNotNeeded(frontendSources)) {
         advisories.push("auto 模式已将 Mock 策略收窄为 not-needed：任务源提到接口/API/Mock 需求，但仓库无确认 Mock 能力或无确定性 Mock 验证命令。若项目规范要求 Mock，请声明 frontendMock.verifyCommands 或 policy:required 后重新生成 DAG。");
@@ -2761,7 +2756,6 @@ async function buildFrontendHybridDagFromTask(sources) {
                     "Read task source and produce a concise frontend implementation contract.",
                     "Cover scope, non-goals, acceptance criteria, UI states, target runtime environment, risks, and verification expectations.",
                     "Read-only: do not modify code, docs, artifacts, or repository files.",
-                    mandatorySourceReadInstruction,
                     sourceContext,
                 ].join("\n\n"),
             },
@@ -2795,26 +2789,27 @@ async function buildFrontendHybridDagFromTask(sources) {
                 outputMode: "structured-required",
                 retryPolicy: STRUCTURED_REQUIRED_PI_RETRY_POLICY,
                 structuredContractOutput: {
-                    schemaId: "frontend-implementation-contract-v1",
+                    schemaId: FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID,
                     retryOnInvalid: true,
+                    skeleton: frontendContractSkeleton,
                 },
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
                 skills: FRONTEND_IMPLEMENTATION_SKILLS,
-                outputContract: "One-line lead-in, then exactly ONE fenced json object (```json ... ```) conforming to frontend-implementation-contract-v1. This fenced block is the single authoritative implementation contract the prewrite gate materializes; it must appear exactly once. Immediately after it, append exactly one ```openspec-citations``` fenced citation block. Do NOT emit a Markdown plan explanation or any prose after the contract JSON — the output is JSON-only (the gate renders plan.md deterministically). Apart from the contract JSON fenced block and the openspec-citations block, do not emit any other fenced block or raw JSON. No file writes.",
+                outputContract: "JSON-only patch output: one-line lead-in, then exactly ONE fenced json object (```json ... ```) containing only the editable RFC 7386 plan patch for the runtime contract skeleton. Omit protected fields: schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff. Immediately after it, append exactly one ```openspec-citations``` fenced citation block. The runtime applies the patch, validates it, and writes a hash-bound canonical JSON artifact for downstream review. Do NOT emit a full contract, Markdown plan explanation, raw JSON, or any other fenced block. No file writes.",
                 subtask_prompt: [
-                    "Based on frontend-contract-pi, frontend-scout-pi, task sources, and the generation-time Mock capability evidence, return a minimal frontend implementation plan.",
-                    "Select the Mock / API strategy inside the plan and structured contract. Carry endpoint/fixture mapping, explicit activation, production-default-off rule, verification commands, and Real Integration Gap into both outputs.",
+                    "Use frontend-contract-pi, frontend-scout-pi, task sources, and the generation-time Mock capability evidence to fill the runtime-owned frontend contract skeleton. Return JSON-only output containing only an editable RFC 7386 plan patch. The runtime already owns schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff; omit those protected paths even when their values look obvious.",
+                    "The patch fields become the complete implementation plan after deterministic merge. Do not produce a separate plan document, prose mirror, or full contract.",
+                    "Select the Mock / API strategy only in the patch. Encode endpoint/fixture mapping, explicit activation, verification commands, and Real Integration Gap in schema-defined editable fields; productionDefaultOff comes from the protected skeleton and there is no second plan output.",
                     "Encode ordered steps (implementationSteps), target files, UI state handling, styling/component strategy (stylingStrategy), interaction notes, Mock/API strategy, dependency policy (dependencyPolicy), deterministic verification entrypoints, Real Integration Gap (realIntegrationGap), and residual risks (residualRisks) into the contract JSON fields. Use only the fixed entrypoints below; implementation may add tests behind them but cannot replace them.",
                     "Every target file and verification target must be selected from the current target workspace and task scope. Do not reuse paths or symbols from examples, prior tasks, or loop-agent itself; if the project uses app/, packages/, spec/, __tests__, or another layout, preserve that layout.",
                     "Consume the Scout TARGET_SURFACE evidence before selecting files. Preserve the discovered existing entrypoint and data source. If implementationPaths or testPaths are outside task allowedPaths, record a blocking scope conflict; do not substitute a new page or silently broaden the writeSet.",
-                    "Output in this exact order: (1) exactly one fenced json object conforming to frontend-implementation-contract-v1 — this fenced block is the single authoritative contract the prewrite gate materializes; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit a Markdown plan explanation or any prose after the contract JSON — the output is JSON-only. Do not emit any raw JSON or JSON objects in prose. Apart from the single contract JSON fenced block and the openspec-citations block, do not emit any other fenced block.",
+                    "Output in this exact order: (1) exactly one fenced json object containing the editable plan patch; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit protected skeleton fields, a full contract, Markdown plan explanation, raw JSON, or any other fenced block.",
                     "Each requirement must state its user-observable or logic-observable expectedOutcome. Each interaction must state its trigger and expectedBehavior. IDs plus file paths are not sufficient behavior semantics.",
                     requirementCoverageInstruction,
                     "verificationTargets[].commandLabel MUST be one of the frozen command labels listed above. Any other value will be rejected at contract materialization.",
                     verificationTargetFileInstruction,
                     "Read-only: do not modify code, docs, artifacts, or repository files.",
-                    mandatorySourceReadInstruction,
                     fixedVerificationContext,
                     sourceContext,
                     mockContextBlock,
@@ -2836,7 +2831,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                 outputProtocol: REVIEW_VERDICT_OUTPUT_PROTOCOL,
                 outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision, followed by Findings, Required Plan Corrections, and Checked Items. No file writes.",
                 subtask_prompt: [
-                    "Audit the frontend plan before implementation. Consume the contract JSON (the single fenced json block from frontend-plan-pi); there is no separate plan prose.",
+                    "Audit the frontend plan before implementation. frontend-plan-pi is emitted as a hash-bound canonical JSON artifact after the runtime applied and validated the planner's editable patch against its protected skeleton; read that artifact with the read tool and do not infer the contract from stdout. There is no separate plan prose.",
                     "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
                     "Request revision when the Mock strategy is MOCK_STRATEGY: blocked, missing, unsupported by repository evidence, inconsistent with the API contract, outside authorized paths/dependencies, unable to prove production-default-off behavior with the fixed production/default-real-path static check, or missing deterministic behavior verification for a declared behavior target or selected Mock strategy. Mock strategies require Mock-backed evidence. A static-only contract is allowed only when every verification target is static and maps to a declared static entrypoint. not-needed otherwise requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists; in that case the plan must preserve the real request path and record the Real Integration Gap.",
                     "Also request revision for missing applicable UI states, unsupported dependency additions, design-system drift without reason, weak interaction coverage, broad scope, inline fake data, schema drift, or missing deterministic verification commands.",
@@ -2859,21 +2854,21 @@ async function buildFrontendHybridDagFromTask(sources) {
                 outputMode: "structured-required",
                 retryPolicy: STRUCTURED_REQUIRED_PI_RETRY_POLICY,
                 structuredContractOutput: {
-                    schemaId: "frontend-implementation-contract-v1",
+                    schemaId: "frontend-implementation-contract-revision-patch-v1",
                     retryOnInvalid: true,
                 },
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
                 skills: FRONTEND_IMPLEMENTATION_SKILLS,
-                outputContract: "When the initial design review requests revision, return a one-line lead-in followed by exactly ONE fenced json object (```json ... ```) containing an RFC 7386 merge-patch delta against the original frontend-implementation-contract-v1 (only the fields you change; null deletes a key; arrays and scalars replace; plain objects merge recursively). Immediately after it, append exactly one ```openspec-citations``` fenced citation block. Do NOT emit a full contract, Markdown explanation, or prose — the output is JSON-only; the gate applies the patch on the original contract and renders plan.md deterministically. Apart from the patch JSON fenced block and the openspec-citations block, do not emit any other fenced block or raw JSON. No file writes.",
+                outputContract: "When the initial design review requests revision, return a one-line lead-in followed by exactly ONE fenced json object (```json ... ```) containing an RFC 7386 merge-patch delta against the original frontend-implementation-contract-v1 (only the fields you change; null deletes a key; arrays and scalars replace; plain objects merge recursively). Immediately after it, append exactly one ```openspec-citations``` fenced citation block. Do NOT emit a full contract, Markdown explanation, or prose — the output is JSON-only; this node compiles the patch onto the original canonical artifact and writes a hash-bound revised contract. Apart from the patch JSON fenced block and the openspec-citations block, do not emit any other fenced block or raw JSON. No file writes.",
                 subtask_prompt: [
                     "Consume frontend-plan-pi (original contract JSON) and frontend-design-review-pi (first design review findings).",
                     "This node runs only when frontend-design-review-pi emitted VERDICT: request-revision. Produce an RFC 7386 merge-patch delta against the original contract JSON that addresses every Required Plan Correction from the design findings.",
-                    "The patch delta may update any of these contract fields: requirements, implementationSteps, targets, uiStates, interactions, mockApi, dependencyPolicy, stylingStrategy, uiComponentChoices, verificationTargets, evidenceGaps, residualRisks, realIntegrationGap. Only include fields you change; omit unchanged fields (the gate applies the patch on the original contract). null deletes a key; arrays and scalars replace; plain objects merge recursively.",
+                    "The patch delta may update editable contract fields such as requirements, implementationSteps, targets.routes/publicApiChanges, uiStates, interactions, mockApi.strategy/activation/endpoints, dependencyPolicy, stylingStrategy, uiComponentChoices, verificationTargets, evidenceGaps, residualRisks, and realIntegrationGap. It must not modify protected schemaVersion, sourceBinding, riskLevel, targets.files, or mockApi.productionDefaultOff. Only include fields you change; omit unchanged fields (this node applies the patch on the original canonical artifact). null deletes a key; arrays and scalars replace; plain objects merge recursively.",
                     requirementCoverageInstruction,
                     "Do not turn MOCK_STRATEGY: blocked into an implementable strategy without new repository or contract evidence that resolves every blocker.",
                     "Read-only: do not modify code, docs, artifacts, or repository files. This node revises the plan only.",
-                    "Output in this exact order: (1) exactly one fenced json object containing the merge-patch delta — this is the only plan output the prewrite gate applies on the original contract; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit a full contract, Markdown explanation, or prose — the output is JSON-only. Do not emit any raw JSON or JSON objects in prose. Apart from the patch JSON fenced block and the openspec-citations block, do not emit any other fenced block. Do not include secrets or unsafe paths.",
+                    "Output in this exact order: (1) exactly one fenced json object containing the merge-patch delta — this node compiles it onto the original canonical artifact; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit a full contract, Markdown explanation, or prose — the output is JSON-only. Do not emit any raw JSON or JSON objects in prose. Apart from the patch JSON fenced block and the openspec-citations block, do not emit any other fenced block. Do not include secrets or unsafe paths.",
                     "Preserve each requirement expectedOutcome and each interaction trigger/expectedBehavior in the effective (merged) contract; do not reduce behavior semantics to IDs and paths.",
                     "verificationTargets[].commandLabel MUST be one of the frozen command labels listed above. Any other value will be rejected at contract materialization.",
                     verificationTargetFileInstruction,
@@ -3592,7 +3587,7 @@ function buildExecuteBackendPytestNode(sources, options = {}) {
     // the current DAG run and moves with active → completed/paused lifecycle.
     // Adapter default testRoot is frozen at DAG generation time (auditable) and
     // cross-checked against the materialized execution contract in preflight.
-    const frozenTestRoot = BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT;
+    const frozenTestRoot = options.testRoot ?? BACKEND_TEST_EXECUTION_DEFAULT_TEST_ROOT;
     const preflightCommand = buildBackendTestExecutionPreflightShellSnippet({
         expectedTestRoot: frozenTestRoot,
     });
@@ -3794,6 +3789,45 @@ const BACKEND_TEST_DEFAULTS = {
     ...HYBRID_DEFAULTS,
     writePolicy: "read-only",
 };
+/**
+ * Runtime layout rewriter for backend-test node prompts and contracts (plan A).
+ *
+ * Node prompts and output contracts historically hardcode the default
+ * `testcase/` layout. Instead of duplicating every prompt string as a
+ * template, builders keep the historical literal text and this helper
+ * rewrites it against the resolved layout at DAG compile time. The default
+ * layout maps every token to itself, so the packaged template stays
+ * byte-identical with the historical contract.
+ */
+export function applyBackendTestLayoutToText(text, layout) {
+    if (layout.isDefault)
+        return text;
+    const replacements = [
+        ["testcase/test_", `${layout.scriptDir}/test_`],
+        ["testcase/md/", `${layout.markdownDir}/`],
+        ["testcase/**", `${layout.testRoot}/**`],
+        ["testcase/", `${layout.testRoot}/`],
+    ];
+    replacements.sort((a, b) => b[0].length - a[0].length);
+    let output = "";
+    const resolvedPrefix = `${layout.testRoot}/`;
+    for (let i = 0; i < text.length;) {
+        if (text.startsWith(resolvedPrefix, i)) {
+            output += resolvedPrefix;
+            i += resolvedPrefix.length;
+            continue;
+        }
+        const hit = replacements.find(([token]) => text.startsWith(token, i));
+        if (hit) {
+            output += hit[1];
+            i += hit[0].length;
+            continue;
+        }
+        output += text[i];
+        i += 1;
+    }
+    return output;
+}
 /**
  * Builds the `node -e` command for the backend-test module manifest shell.
  * The inline JS mirrors `extractModuleStemsFromReadme` so the map_agent
@@ -3804,34 +3838,50 @@ const BACKEND_TEST_DEFAULTS = {
  * normalization. Output is exactly one trailing JSON line `{modules:[{stem}]}`
  * that `parseJsonFromText` accepts after shell command echoes.
  */
-function buildBackendTestModuleManifestShellCommand() {
+function buildBackendTestModuleManifestShellCommand(layout) {
     // The extractor is base64-encoded so the shell command is fully opaque to
     // bash: no backticks (command substitution), no regex \/ escaping, no
     // backslash-counting through TS-string -> JSON.stringify -> bash -c -> node -e.
     // Backticks in the README body are stripped at runtime via
     // String.fromCharCode(96), so the extractor source contains no backtick.
+    // mdDir/testPrefix are injected as JSON literals so the same extractor
+    // works for any configured backendTest layout (plan A).
+    const mdDirLiteral = JSON.stringify(layout.markdownDir);
+    const testPrefixLiteral = JSON.stringify(`${layout.scriptDir}/test_`);
+    const escOpen = String.fromCharCode(92, 91); // \[
+    const escClose = String.fromCharCode(92, 93); // \]
+    const escBslash = String.fromCharCode(92, 92); // \\
     const script = `const fs=require('fs');
-const readme=fs.existsSync('testcase/md/README.md')?fs.readFileSync('testcase/md/README.md','utf8'):'';
+const mdDir=${mdDirLiteral};
+const testPrefix=${testPrefixLiteral};
+const esc=s=>s.replace(/[${escOpen}${escClose}{}()*+?^$|${escBslash}]/g,'${escBslash}$&');
+const rxMdPath=new RegExp(esc(mdDir)+'${escBslash}/([A-Za-z0-9_.-]+)${escBslash}.md','g');
+const rxTableRow=new RegExp('${escBslash}|${escBslash}s*([A-Za-z0-9_.-]+)${escBslash}s*${escBslash}|${escBslash}s*'+esc(testPrefix),'g');
+const readme=fs.existsSync(mdDir+'/README.md')?fs.readFileSync(mdDir+'/README.md','utf8'):'';
 const norm=s=>String(s).toLowerCase().replace(/[^a-z0-9]+/g,'_').replace(/^_+|_+$/g,'').replace(/_+/g,'_');
 const bt=String.fromCharCode(96);
 const stripBackticks=s=>s.split(bt).join('');
-const invalidReason=raw=>{const st=norm(raw);if(/^p[0-2]$/.test(st))return 'priority-only-module-stem';if(st==='readme')return 'reserved-module-stem';if(!/^[a-z][a-z0-9_]*$/.test(st))return 'invalid-syntax';if(/^(?:be|tp|ac|req|br)[_-]/i.test(st))return 'case-like-module-stem';return null;};
+const invalidReason=raw=>{const st=norm(raw);if(/^p[0-2]$/.test(st))return 'priority-only-module-stem';if(/^[a-f][a-f0-9]{6,63}$/.test(st))return 'opaque-hash-module-stem';if(st==='readme')return 'reserved-module-stem';if(!/^[a-z][a-z0-9_]*$/.test(st))return 'invalid-syntax';if(/^(?:be|tp|ac|req|br)[_-]/i.test(st))return 'case-like-module-stem';return null;};
 const valid=raw=>invalidReason(raw)===null;
-const rxMdPath=/testcase\\/md\\/([A-Za-z0-9_.-]+)\\.md/g;
-const rxTableRow=/\\|\\s*([A-Za-z0-9_.-]+)\\s*\\|\\s*testcase\\/test_/g;
 const rxRelLink=/\\[[^\\]]+\\]\\(\\.\\/([A-Za-z0-9_.-]+)\\.md\\)/g;
+const allLines=readme.replace(/\\r\\n/g,'\\n').replace(/\\r/g,'\\n').split('\\n');
+const headings=[];for(let i=0;i<allLines.length;i++){if(allLines[i].trim()==='## Module Index')headings.push(i);}
+if(headings.length!==1){process.stderr.write((headings.length===0?'missing-module-index':'duplicate-module-index')+'; require exactly one exact ## Module Index section\\n');process.exit(2);}
+const start=headings[0]+1;let end=allLines.length;for(let i=start;i<allLines.length;i++){if(/^##\\s+\\S/.test(allLines[i].trim())){end=i;break;}}
+const section=allLines.slice(start,end).join('\\n');
 const raw=[];
-const lines=readme.replace(/\\r\\n/g,'\\n').replace(/\\r/g,'\\n').split('\\n').filter(l=>l.includes('|'));
+const lines=section.split('\\n').filter(l=>l.includes('|'));
 for(const line of lines){
   const bare=stripBackticks(line);
   for(const m of bare.matchAll(rxMdPath)){raw.push(m[1]);}
-  for(const m of bare.matchAll(rxTableRow)){if(valid(m[1])||invalidReason(m[1])==='priority-only-module-stem')raw.push(m[1]);}
+  for(const m of bare.matchAll(rxTableRow)){if(valid(m[1])||invalidReason(m[1])!=='invalid-syntax')raw.push(m[1]);}
 }
-for(const m of readme.matchAll(rxRelLink)){raw.push(m[1]);}
+for(const m of section.matchAll(rxRelLink)){raw.push(m[1]);}
 const invalid=[];for(const r of raw){const reason=invalidReason(r);if(reason)invalid.push({stem:norm(r),reason});}
 if(invalid.length){for(const item of invalid)process.stderr.write(item.reason+': '+item.stem+'; use a stable business resource/domain stem\\n');process.exit(2);}
 const seen=new Set();const modules=[];
 for(const r of raw){const st=norm(r);if(valid(r)&&!seen.has(st)){seen.add(st);modules.push({stem:st});}}
+if(modules.length>8){process.stderr.write('excessive-module-count: '+modules.length+' > 8; merge by the smallest stable business resource/domain set\\n');process.exit(2);}
 process.stdout.write(JSON.stringify({modules}));
 `;
     const encoded = Buffer.from(script, "utf8").toString("base64");
@@ -3845,11 +3895,443 @@ const BACKEND_TEST_SKILLS_BY_ROLE = {
     verifier: ["verification-before-completion", "systematic-debugging"],
     closeout: ["loop-agent", "verification-before-completion"],
 };
+/**
+ * Plan D: gap-fill incremental DAG (mode=gap-fill).
+ *
+ * Re-runs the SAME requirement against a `backend-test-gap-v1` document and
+ * the previous N6 coverage facts. Deterministic ingest plans exact
+ * targetPaths; writers only patch planned files, never renumber Case IDs,
+ * and a satisfied plan short-circuits writers with already-satisfied. The
+ * heavy full-chain nodes (README rewrite, full-source N5 sync, helpers)
+ * are replaced by patch writers whose writeSet equals the planned files.
+ */
+async function buildBackendTestGapFillDag(sources) {
+    const { taskConfig } = sources;
+    const ro = commonReadOnlyPaths(sources);
+    const forbidden = commonForbiddenPaths(sources);
+    const intake = await buildBackendTestIntakeContext(sources);
+    const layout = resolveBackendTestLayout(taskConfig.backendTest);
+    const sharedSetup = intake.sharedSetup;
+    const gapDocPath = taskConfig.backendTest?.gapDoc?.trim();
+    if (!gapDocPath) {
+        throw new Error("backendTest.mode=gap-fill requires backendTest.gapDoc pointing at the user missing-scenario document");
+    }
+    const envAllowlist = collectBackendTestShellEnvAllowlist(sources);
+    // N1: reuse the full-chain environment validation unchanged.
+    const environment = {
+        id: "validate-backend-test-environment-shell",
+        depends_on: [],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned reports/backend-test-environment.md with PASS/FAIL runtime, bounded project discovery, fixture and HTML-renderer facts; no secret values.",
+        subtask_prompt: "Fail fast before model work when Python/pytest cannot run in the clean shell. Inspect only bounded common config, conftest, test-root and server-entry candidates; never read .env values or credentials.",
+        shell: {
+            commands: ["python --version", "python -m pytest --version", "python -m pytest --help"],
+            backendTestPipeline: "markdown-environment",
+            cwd: ".",
+            timeoutMs: 60000,
+            envAllowlist,
+        },
+    };
+    // N2': deterministic gap ingest (shell pipeline owns parsing + planning).
+    const ingestGap = {
+        id: "ingest-backend-test-gap-shell",
+        depends_on: [environment.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned contracts/backend-test-gap-plan-v1.json with targetModules, newTestPoints, reuseSetupRefs, conflicts, alreadyPresent and exact targetPaths; identity mismatch (taskId/requirement hash) fails closed before any writer runs.",
+        subtask_prompt: "Parse the bound gap document (backend-test-gap-v1) and union it with previous coverage facts missingSlots; emit the deterministic gap plan. No file writes to testcase assets.",
+        shell: {
+            commands: [],
+            backendTestPipeline: "ingest-backend-test-gap",
+            cwd: ".",
+            timeoutMs: 60000,
+            envAllowlist,
+        },
+    };
+    // N3': patch README Matrix/Partitions for planned slots only.
+    const patchReadme = {
+        id: "patch-backend-readme-matrix-pi",
+        depends_on: [ingestGap.id],
+        role: "implementer",
+        executor: "pi",
+        toolProfile: "write",
+        complexity: "LOW",
+        writePolicy: "exclusive",
+        writeSet: [layout.readmePath],
+        allowedPaths: [layout.readmePath],
+        forbiddenPaths: forbidden,
+        writerOutcomePolicy: {
+            type: "implementation-outcome-v1",
+            requireChangedFiles: false,
+        },
+        retryPolicy: BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY,
+        outputContract: "First non-empty line is IMPLEMENTATION_OUTCOME: changed|already-satisfied|blocked. Patch ONLY the Coverage Matrix rows and Scenario Partitions table entries named by contracts/backend-test-gap-plan-v1.json newTestPoints; never rewrite unrelated README sections, never renumber Cases, never add Module Index modules.",
+        subtask_prompt: [
+            "Read contracts/backend-test-gap-plan-v1.json. For each planned slot in newTestPoints, patch the owning Coverage Matrix row (Required Test Points/Case IDs) and, for TP-SP slots, the Scenario Partitions table so the slot is declared. already-satisfied is valid when every planned slot is already present; changed requires a bounded diff limited to the slot rows.",
+            "When every planned slot is already declared, return already-satisfied without editing. Never expand scope beyond newTestPoints; never touch module Markdown or pytest files here.",
+            intake.boundedSourceContext,
+        ].join("\n\n"),
+    };
+    // N4': patch only the planned module Markdown files (map over targetModules).
+    const patchMdCases = {
+        id: "patch-backend-md-cases-map",
+        depends_on: [patchReadme.id],
+        role: "verifier",
+        executor: "static",
+        complexity: "LOW",
+        writePolicy: "none",
+        allowedPaths: [],
+        forbiddenPaths: forbidden,
+        outputContract: "Serial aggregate of per-module Markdown patch writers; each child writes exactly one planned testcase module file with a bounded append/patch diff.",
+        subtask_prompt: "Expand the gap plan targetModules into one sharded Markdown patch writer child per module and run them serially. Child failures fail-close the map barrier.",
+        static: {
+            resultMarkdown: "Backend-test gap-fill Markdown patch map expansion barrier.",
+        },
+        dynamicExpansion: {
+            type: "map_agent",
+            workflowNodeId: "patch-backend-md-cases-map",
+            itemsFrom: "$.nodes['ingest-backend-test-gap-shell'].json.plan.targetModules",
+            itemName: "item",
+            maxItems: 8,
+            maxExpandedNodes: 8,
+            childIdPrefix: "patch-backend-md-case",
+            tokenBudget: { maxTotalTokens: 1000000 },
+            failOnTokenBudgetExhaustion: true,
+            childTask: {
+                executor: "pi",
+                role: "implementer",
+                skills: BACKEND_TEST_SKILLS_BY_ROLE.implementer,
+                toolProfile: "write",
+                complexity: "LOW",
+                writePolicy: "exclusive",
+                allowedPaths: [`${layout.markdownDir}/{{item.stem}}.md`],
+                forbiddenPaths: forbidden,
+                writeSet: [`${layout.markdownDir}/{{item.stem}}.md`],
+                writerOutcomePolicy: {
+                    type: "implementation-outcome-v1",
+                    requireChangedFiles: false,
+                },
+                retryPolicy: BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY,
+                outputContract: "Patch exactly one planned module Markdown file: add missing slot Test Points (existing Case variant lists first; new BE-<MODULE>-<max+1> Case only when no Case can own the slot). Case IDs are never renumbered; sections follow the full-chain contract.",
+                subtaskPromptTemplate: [
+                    "Read contracts/backend-test-gap-plan-v1.json and patch exactly testcase/md/{{item.stem}}.md. For every planned slot owned by this module: prefer appending the variant to the Case named by the plan (or the most related existing Case); create a new Case only when no existing Case can own it, numbering BE-<MODULE>-<NNN> from the module's current maximum +1. Keep every required h3 section; cite Matrix Rule Keys exactly; TP-SP slots use the exact deterministic slot IDs from the plan.",
+                    sharedSetup
+                        ? `When the slot needs shared pre-steps defined by the bound user document, reference them with 引用前置: ${sharedSetup.path}#<SS-ID|SS-DEFAULT> instead of duplicating steps.`
+                        : "Prepare any needed state locally inside this Case (本地准备); no shared setup document is bound.",
+                    "already-satisfied is valid when every planned slot of this module is already covered. Never modify other modules, README, or pytest files.",
+                    intake.boundedSourceContext,
+                ].join("\n\n"),
+            },
+        },
+    };
+    // N5': validate patched Markdown with the same N6 pipeline (partition slots fail-closed).
+    const validateMd = {
+        id: "validate-backend-md-cases-shell",
+        depends_on: [patchMdCases.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned reports/backend-md-case-validation.md, coverage analysis and facts v4 with scenarioPartitions; planned slots must be covered (missingSlots for planned entries fail closed).",
+        subtask_prompt: "Record advisory findings for Markdown structure and deterministically analyze the final README Coverage Scope, Coverage Matrix and Scenario Partitions against final Case rule/test-point bindings. Planned gap slots that remain uncovered fail this node closed.",
+        shell: {
+            commands: [],
+            backendTestPipeline: "markdown-cases",
+            cwd: ".",
+            timeoutMs: 60000,
+            envAllowlist,
+        },
+    };
+    // N6': patch only the planned pytest modules (append params/functions).
+    const patchPytest = {
+        id: "patch-backend-pytest-cases-map",
+        depends_on: [validateMd.id],
+        role: "verifier",
+        executor: "static",
+        complexity: "LOW",
+        writePolicy: "none",
+        allowedPaths: [],
+        forbiddenPaths: forbidden,
+        outputContract: "Serial aggregate of per-module pytest patch writers; each child appends to exactly one planned testcase/test_<stem>.py without rewriting the file.",
+        subtask_prompt: "Expand the gap plan targetModules into one sharded pytest patch writer child per module and run them serially. Child failures fail-close the map barrier.",
+        static: {
+            resultMarkdown: "Backend-test gap-fill pytest patch map expansion barrier.",
+        },
+        dynamicExpansion: {
+            type: "map_agent",
+            workflowNodeId: "patch-backend-pytest-cases-map",
+            itemsFrom: "$.nodes['ingest-backend-test-gap-shell'].json.plan.targetModules",
+            itemName: "item",
+            maxItems: 8,
+            maxExpandedNodes: 8,
+            childIdPrefix: "patch-backend-pytest-case",
+            tokenBudget: { maxTotalTokens: 1000000 },
+            failOnTokenBudgetExhaustion: true,
+            childTask: {
+                executor: "pi",
+                role: "implementer",
+                skills: BACKEND_TEST_SKILLS_BY_ROLE.implementer,
+                toolProfile: "write",
+                complexity: "LOW",
+                writePolicy: "exclusive",
+                allowedPaths: [`${layout.scriptDir}/test_{{item.stem}}.py`],
+                forbiddenPaths: Array.from(new Set([
+                    ...forbidden,
+                    `${layout.markdownDir}/**`,
+                    "conftest.py",
+                    "pytest.ini",
+                    "pyproject.toml",
+                    "setup.cfg",
+                ])),
+                writeSet: [`${layout.scriptDir}/test_{{item.stem}}.py`],
+                writerOutcomePolicy: {
+                    type: "implementation-outcome-v1",
+                    requireChangedFiles: false,
+                },
+                retryPolicy: BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY,
+                outputContract: "Append-only patch of exactly one planned pytest module: add pytest.param rows / test functions for planned slots with exact TP ids; never rewrite or delete existing functions.",
+                subtaskPromptTemplate: [
+                    "Read contracts/backend-test-gap-plan-v1.json and the patched module Markdown, then patch only testcase/test_{{item.stem}}.py. For each planned slot owned by this module: append an exact literal pytest.param(..., id=\"<slot-id>\") row to the owning Case's primary symbol, or append a new test function test_BE_<MODULE>_<NNN>_<desc> when a new Case was created. Existing functions, params and assertions must remain byte-stable; append-only edits.",
+                    sharedSetup
+                        ? "Reuse the module-top user_shared_setup fixture for shared pre-steps; never re-create documented setup steps inside test bodies, and never create or modify conftest.py."
+                        : "Keep any needed setup local to the new function; never create or modify conftest.py.",
+                    "already-satisfied is valid when every planned slot already has its exact pytest.param id collected. Do not modify Markdown or other modules.",
+                ].join("\n\n"),
+            },
+        },
+    };
+    // N7'-N13': reuse the deterministic collection/repair/gate/trace/manifest chain.
+    const collectionAssess = {
+        id: "assess-backend-pytest-collection-shell",
+        depends_on: [patchPytest.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned collection-v3 facts with repairPaths limited to the gap plan target pytest files.",
+        subtask_prompt: "Resolve final Markdown-mapped scripts; scenario-param assess, pytest --collect-only and no-business-body fixture preflight. Repair eligibility is limited to planned pytest files.",
+        shell: {
+            commands: [],
+            backendTestPipeline: "markdown-collection-assess",
+            cwd: ".",
+            timeoutMs: 120000,
+            envAllowlist,
+        },
+    };
+    const repairPytest = {
+        id: "repair-backend-pytest-collection-pi",
+        depends_on: [collectionAssess.id],
+        runIf: "$.nodes['assess-backend-pytest-collection-shell'].json.repairEligible == true",
+        role: "implementer",
+        executor: "pi",
+        toolProfile: "write",
+        complexity: "MED",
+        writePolicy: "exclusive",
+        writeSet: [`${layout.scriptDir}/test_*.py`],
+        allowedPaths: Array.from(new Set([...ro, layout.scriptDir])),
+        forbiddenPaths: Array.from(new Set([
+            ...forbidden,
+            `${layout.markdownDir}/**`,
+            "conftest.py",
+            "pytest.ini",
+            "pyproject.toml",
+            "setup.cfg",
+        ])),
+        writerOutcomePolicy: { type: "implementation-outcome-v1", requireChangedFiles: true },
+        outputContract: "First non-empty line is IMPLEMENTATION_OUTCOME: changed|blocked. Repair only generated pytest defects on initial facts repairPaths; preserve every Markdown Case, Test Point, primary symbol and assertion meaning.",
+        subtask_prompt: [
+            "Repair the generated backend pytest asset as one bounded program using the direct upstream collection assessment. Treat any upstream `Repair paths:` line as complete authoritative repairPaths evidence. Only planned testcase test_*.py files may change.",
+            "Do not modify Markdown, conftest, pytest config, production code or dependencies. Do not add skip/xfail, remove tests, loosen assertions or replace the real API with mocks.",
+        ].join("\n\n"),
+    };
+    const collectionEffective = {
+        id: "effective-backend-pytest-collection-gate-shell",
+        depends_on: [collectionAssess.id, repairPytest.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Canonical backend-test-execution-readiness.json v2 bound to final asset hashes.",
+        subtask_prompt: "Materialize effective collection facts; eligibility excludes non-exact mappings and unsafe payloads as in the full chain.",
+        shell: {
+            commands: [],
+            backendTestPipeline: "markdown-collection-effective",
+            cwd: ".",
+            timeoutMs: 120000,
+            envAllowlist,
+        },
+    };
+    collectionEffective.dependsPolicy = "all-or-condition-skip";
+    const traceability = {
+        id: "backend-test-traceability-gate-shell",
+        depends_on: [collectionEffective.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned traceability and correspondence facts bound after effective collection.",
+        subtask_prompt: "Deterministically scan final readiness-authorized Markdown-mapped pytest scripts; correspondence findings stay advisory.",
+        shell: {
+            commands: [],
+            backendTestPipeline: "markdown-traceability",
+            cwd: ".",
+            timeoutMs: 60000,
+            envAllowlist,
+        },
+    };
+    const manifest = {
+        id: "backend-test-case-manifest-shell",
+        depends_on: [traceability.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned contracts/backend-test-case-manifest.json materialized only from facts; the single machine input for L-5 and closeout.",
+        subtask_prompt: "Materialize the canonical Backend Test Case Manifest only from coverage and correspondence facts; never re-analyze sources.",
+        shell: {
+            commands: [],
+            backendTestPipeline: "markdown-manifest",
+            cwd: ".",
+            timeoutMs: 60000,
+            envAllowlist,
+        },
+    };
+    const execute = {
+        id: "execute-backend-pytest-and-html-report-shell",
+        depends_on: [manifest.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "One scoped pytest execution over readiness-authorized eligible items producing pytest-html plus the Chinese HTML report and L-5 dashboard; exit 0/1 with valid evidence continues.",
+        subtask_prompt: `Execute readiness-authorized eligible pytest items once${taskConfig.backendTest?.executeScope === "all"
+            ? " (executeScope=all: every eligible item)"
+            : " (executeScope=affected: prefer newly added planned items when readiness marks them; otherwise every eligible item)"}, render the report, and keep evidence run-owned.`,
+        shell: {
+            commands: [],
+            backendTestPipeline: "markdown-execute-html",
+            cwd: ".",
+            timeoutMs: 300000,
+            envAllowlist,
+        },
+    };
+    const report = {
+        id: "backend-test-report-shell",
+        depends_on: [execute.id],
+        role: "verifier",
+        executor: "shell",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: ro,
+        forbiddenPaths: forbidden,
+        outputContract: "Run-owned backend test Result v1 with pytestExitCode, junit and evidence hashes; failure categories keep product/automation semantics.",
+        subtask_prompt: "Materialize the backend-test Result v1 from the execution evidence; never fabricate metrics.",
+        shell: {
+            commands: [],
+            backendTestPipeline: "markdown-report",
+            cwd: ".",
+            timeoutMs: 60000,
+            envAllowlist,
+        },
+    };
+    const spec = {
+        version: 3,
+        title: `Backend test gap-fill: ${sources.taskId}`,
+        runtimeContract: GENERATED_DAG_RUNTIME_CONTRACT,
+        outputLanguage: sources.outputLanguage ?? DEFAULT_DAG_OUTPUT_LANGUAGE,
+        objective: `Incrementally fill backend-test gap scenarios for task ${sources.taskId} from the bound gap document without renumbering existing Cases.`,
+        successCriteria: [
+            "Every planned gap slot is declared in README (Matrix/Scenario Partitions), covered by a Case test point, and collected as an exact pytest.param id",
+            "Existing Case IDs and unrelated modules remain byte-stable; no conftest.py is created or modified",
+            "A second run over a satisfied plan returns already-satisfied with no asset diff",
+        ],
+        globalConstraints: [
+            ...sources.taskConfig.hardConstraints.filter(Boolean),
+            `backendTestGapDoc=${gapDocPath}`,
+            `backendTestExecuteScope=${taskConfig.backendTest?.executeScope ?? "affected"}`,
+        ],
+        skillsByRole: BACKEND_TEST_SKILLS_BY_ROLE,
+        executorModels: sources.executorModelMatrix ?? DEFAULT_DAG_EXECUTOR_MODELS,
+        verifyStrategy: resolveDagVerifyStrategy(taskConfig),
+        tasks: [
+            environment,
+            ingestGap,
+            patchReadme,
+            patchMdCases,
+            validateMd,
+            patchPytest,
+            collectionAssess,
+            repairPytest,
+            collectionEffective,
+            traceability,
+            manifest,
+            execute,
+            report,
+        ],
+    };
+    spec.backendTestLayout = layout;
+    if (sharedSetup) {
+        spec.backendTestSharedSetup = { ...sharedSetup };
+    }
+    applyDefaultReadOnlyRetryPolicy(spec);
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
 async function buildBackendTestHybridDag(sources) {
     const { taskConfig } = sources;
+    if (taskConfig.backendTest?.mode === "gap-fill") {
+        return buildBackendTestGapFillDag(sources);
+    }
     const ro = commonReadOnlyPaths(sources);
     const forbidden = commonForbiddenPaths(sources);
     const intake = await buildBackendTestIntakeContext(sources);
+    // Plan A: resolve the frozen artifact layout once; every generated path
+    // (README, module Markdown, pytest script, pytest target) derives from it.
+    // Default config resolves to the historical testcase/ layout.
+    const layout = resolveBackendTestLayout(taskConfig.backendTest);
+    const applyLayout = (text) => applyBackendTestLayoutToText(text, layout);
+    // Plan B: when the user binds exactly one shared-setup document, generated
+    // Markdown references it (引用前置/SS-*) and each pytest module hoists the
+    // documented steps into a module-top `user_shared_setup` fixture. Absent the
+    // binding, every prompt below stays byte-identical to the pre-B baseline.
+    const sharedSetup = intake.sharedSetup;
+    const sharedSetupPrompt = sharedSetup
+        ? [
+            "## User shared setup document (bound, read-only)",
+            `A user-provided shared pre-step document is bound at \`${sharedSetup.path}\` (readPath \`${sharedSetup.readPath}\`, sha256 ${sharedSetup.sha256}). Treat it as an authoritative read-only source: never rewrite, split or renumber it, and never invent steps absent from it.`,
+            "When a Case needs a pre-step that this document already defines, the Case MUST reference it instead of duplicating the steps: in `### 前置条件` write `引用前置: <bound-path>#<SS-ID or heading>` lines (plus a `Shared Setup Refs` list of the referenced SS IDs). Extract stable step IDs only from explicit machine IDs (e.g. `SS-1`, `SS-REGISTER-01`); when the document is prose without stable IDs, reference the whole document as `引用前置: <bound-path>#SS-DEFAULT` and do not guess splits. Preparation unique to a Case stays inline but must be labeled `本地准备:`.",
+            "Payload Contract still describes ONLY the target request; setup POST/PUT steps defined by the shared document never redefine the target Case payload contract.",
+        ].join("\n\n")
+        : null;
+    const sharedSetupPytestPrompt = sharedSetup
+        ? [
+            "## User shared setup hoisting (module top)",
+            `The user shared setup document \`${sharedSetup.path}\` (readPath \`${sharedSetup.readPath}\`) defines the common pre-steps. At the TOP of this module file (before any test function), generate exactly one module-scoped fixture named \`user_shared_setup\` implemented by a private helper \`_user_shared_setup()\` that performs the documented shared steps in document order, using the exact resource names/fields from the document. Cases reference these steps via their \`引用前置\` lines; each \`test_BE_*\` body then performs ONLY its target operation and must not repeat documented shared create/setup steps. Generate teardown code only when the user document explicitly documents a cleanup step; never invent a DELETE.`,
+            "Duplication of this prefix across module files is accepted by design: do not extract it into conftest.py, a shared helper module, pytest_plugins, or a `_shared_setup.py`; the module file stays self-contained. NEVER create or modify conftest.py.",
+        ].join("\n\n")
+        : null;
     const shellNode = (id, depends_on, pipeline, prompt, outputContract, commands = [], timeoutMs = 60000) => ({
         id,
         depends_on,
@@ -3909,8 +4391,10 @@ async function buildBackendTestHybridDag(sources) {
             "Each Rule Key must appear in exactly one Matrix row. Preserve each AC/REQ/BR Rule Key as one row; if one product rule spans multiple dimensions, use a concise composite Dimension in that single row instead of duplicating the key. Derive OpenAPI Rule Keys exactly as the deterministic analyzer does: operation token is `<HTTP-METHOD>-<PATH>` with braces removed and every non-alphanumeric run replaced by a hyphen, uppercase (for example POST `/api/resource-notes` → `POST-API-RESOURCE-NOTES`); response statuses use `API-<OPERATION>-RESPONSE-STATUS`; body/parameter fields use `API-<OPERATION>-<FIELD>-REQUIRED|ENUM|MIN-LENGTH|MAX-LENGTH|MINIMUM|MAXIMUM|PATTERN|FORMAT`. Do not invent aliases such as API-CREATE-FIELDS when a deterministic key applies.",
             "Coverage priority is strict inside the declared scope: P0 product requirements/task hard constraints always remain in scope; P1 exhaustively supplements documented operations, fields, business rules, statuses and errors only for Affected Operations; P2 adds bounded protocol robustness only when it is relevant to the change and does not invent product behavior. Coverage percentages describe the declared affected scope, never whole-API completeness unless every operation is explicitly listed. Conflicts or undefined expectations must stay visible as GAP/CONFLICT with precise source pointers, never guessed.",
             "For uniqueness/lifecycle rules cover absent, active-existing, deleted-existing, create-delete-recreate, restore-then-recreate and documented scope/case-normalization states. For every enum cover every valid value plus bounded invalid equivalence classes (unknown, case variant, whitespace, empty, null/missing and wrong types as applicable). For every length/number rule cover min-1, min, nominal, max and max+1. For format rules cover each allowed class separately plus a valid mixed value, and representative forbidden classes including uppercase, internal/leading/trailing whitespace, tab/newline, unsupported punctuation, slash, emoji or control characters when the source contract supports that expectation.",
-            "Mandatory module index: include a `## Module Index` table in README that lists every planned module as a canonical relative link of the exact form `[label](./<stem>.md)` plus a `testcase/md/<stem>.md` path cell, so a downstream deterministic manifest can parse the module list. Group by stable business resource/domain, not by CRUD operation: one resource's list/detail/create/update/delete cases belong in one module such as `resource_notes`; split only when a single module would exceed the per-child 16K output budget, and keep the total module count at the smallest safe value. Name each module file with a stable lowercase business stem such as `health` or `resource_notes`. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix and never defines module files. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. The relative link target MUST equal the on-disk filename stem the sharded writer will create. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+            "Mandatory module index: include a `## Module Index` table in README that lists every planned module as a canonical relative link of the exact form `[label](./<stem>.md)` plus a `testcase/md/<stem>.md` path cell, so a downstream deterministic manifest can parse the module list. Group by stable business resource/domain, not by CRUD operation: one resource's list/detail/create/update/delete cases belong in one module such as `resource_notes`; split only when a single module would exceed the per-child 16K output protocol, keep the total module count at the smallest safe value, and never exceed 8 modules. Name each module file with a stable lowercase business stem such as `health` or `resource_notes`. Pure hexadecimal/hash-like opaque stems such as `a401606` or `deadbeef` are forbidden. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix and never defines module files. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. The relative link target MUST equal the on-disk filename stem the sharded writer will create. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+            "Scenario Partitions (query/filter axes): for every affected GET/list operation, declare one row per enum or classification axis used for filtering (query/path parameters such as type/status/category). Add a mandatory machine-readable `## Scenario Partitions` section after the Coverage Matrix using exactly `| Partition ID | Operation | Axis | Domain | Required Slots | Expected by Slot | Bind Rule |` with the separator row. Partition ID is a stable `SP-<OPERATION>-<AXIS>` token; Domain must copy the legal values verbatim from the bound OpenAPI enum or requirement sentence (never guess); Required Slots writes `each-value` plus `omitted` only when the parameter is optional; Expected by Slot states the documented expectation per slot kind (`domain-value`, `default-behavior`, `empty-result`/`excluded-result` when documented, or `GAP` when the source does not document the complement expectation — never invent 空列表/400). POST/PUT body field-validation enums stay in the Coverage Matrix as `TP-<FIELD>-ENUM-*` and MUST NOT get a Scenario Partition row. Do not create partitions for axes without a documented legal-value domain. Only GET/list query or path parameters whose bound source documents a finite enum or classification set may become a Scenario Partition. Do not create partitions for free-form strings, primary keys, required-or-optional-only parameters, or boundary/format-only axes. If an axis has no finite legal-value domain, do not declare a Partition row and do not invent NOT-IN-SET cases. Cross-axis combinations stay as ONE nominal Case; never declare a cross-axis cartesian partition.",
             "Before finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
+            ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
             intake.boundedSourceContext,
             "## Authoritative reference index",
             JSON.stringify(intake.referenceIndex, null, 2),
@@ -3930,7 +4414,7 @@ async function buildBackendTestHybridDag(sources) {
         outputContract: "Stdout JSON {modules:[{stem}]} parsed from testcase/md/README.md using the same module-stem extractor as the Completeness Gate, so the map_agent shard set deterministically matches the README module index.",
         subtask_prompt: "Parse testcase/md/README.md and emit exactly one trailing JSON line {modules:[{stem}]} listing every trusted module stem (table-row testcase/md/<stem>.md mentions and canonical [label](./<stem>.md) relative links only). No file writes.",
         shell: {
-            commands: [buildBackendTestModuleManifestShellCommand()],
+            commands: [buildBackendTestModuleManifestShellCommand(layout)],
             cwd: ".",
             timeoutMs: 60000,
         },
@@ -3954,10 +4438,11 @@ async function buildBackendTestHybridDag(sources) {
             workflowNodeId: "generate-backend-md-cases-map",
             itemsFrom: "$.nodes['materialize-backend-md-module-manifest-shell'].output.modules",
             itemName: "item",
-            maxItems: 64,
-            maxExpandedNodes: 64,
+            maxItems: 8,
+            maxExpandedNodes: 8,
             childIdPrefix: "generate-backend-md-case",
-            tokenBudget: { maxTokensPerCase: 16384, maxTotalTokens: 600000 },
+            tokenBudget: { maxTotalTokens: 3000000 },
+            failOnTokenBudgetExhaustion: true,
             childTask: {
                 executor: "pi",
                 role: "implementer",
@@ -3979,10 +4464,13 @@ async function buildBackendTestHybridDag(sources) {
                     "Output budget protocol (hard, max output <=16K per turn): Never paste full Matrix, other modules' case bodies, or source text into assistant chat. Each write/edit tool call touches at most one file (this module). Compact tables/lists are required; omitting required sections or in-scope variants is forbidden. If a Completeness Gate / OUTPUT_LIMIT_RECOVERY retry is injected, continue only listed target paths.",
                     "The first non-empty response line must be exactly IMPLEMENTATION_OUTCOME: changed after the module file has been written, or IMPLEMENTATION_OUTCOME: blocked when precise missing evidence prevents safe generation. already-satisfied is not valid for this node.",
                     "Write human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.",
-                    'Write the module {{item.stem}} as readable case cards covering every in-scope rule/Test Point the README Coverage Matrix assigns to this module. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. `<NNN>` is exactly three zero-padded digits (`001`, `002`, ...), never two digits (`01`), a bare number, or an alphabetic suffix such as `011A`. Every case must include `### 覆盖规则`, `### 测试点`, `### 场景类型`, `### 前置条件`, `### 操作步骤`, `### 预期结果`, and `### 自动化映射` Do not group cases under "## 测试类 ..." (or any h2 grouping) headings that force Cases down to h3; each Case must be a direct h2 (`##`), and its seven sections must be h3 (`###`) children of that Case. If you need to convey a pytest class, state it inside the Case\'s `### 自动化映射` instead. Forbidden: `## 测试类 X` then `### BE-PD-001` and `### 覆盖规则` at the same h3 level. Required: `## BE-PD-001` then `### 覆盖规则`.; `覆盖规则` and `测试点` must reference exact Matrix Rule Keys/Test Points. Add `测试目的`, `验收标准`, `需求依据`, and `测试数据` for readable evidence. The `验收标准` section must list the exact applicable `AC-...` IDs, and every explicit task AC must appear in at least one Case. Every automatable case explicitly names its target pytest script and exactly one primary symbol so traceability scans only that script/symbol.',
-                    "Name this module file with the stable lowercase business stem `{{item.stem}}` (filename `testcase/md/{{item.stem}}.md`). Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `testcase/test_{{item.stem}}.py`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+                    'Write the module {{item.stem}} as readable case cards covering every in-scope rule/Test Point the README Coverage Matrix assigns to this module. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. `<NNN>` is exactly three zero-padded digits (`001`, `002`, ...), never two digits (`01`), a bare number, or an alphabetic suffix such as `011A`. Every case must include `### 覆盖规则`, `### 测试点`, `### 场景类型`, `### 前置条件`, `### 操作步骤`, `### 预期结果`, and `### 自动化映射` Do not group cases under "## 测试类 ..." (or any h2 grouping) headings that force Cases down to h3; each Case must be a direct h2 (`##`), and its seven sections must be h3 (`###`) children of that Case. If you need to convey a pytest class, state it inside the Case\'s `### 自动化映射` instead. Forbidden: `## 测试类 X` then `### BE-PD-001` and `### 覆盖规则` at the same h3 level. Required: `## BE-PD-001` then `### 覆盖规则`.; `覆盖规则` and `测试点` must reference exact Matrix Rule Keys/Test Points. Add `测试目的`, `验收标准`, `需求依据`, and `测试数据` for readable evidence. The `验收标准` section must list the exact applicable `AC-...` IDs, and every explicit task AC must appear in at least one Case. Every automatable case explicitly names its target pytest script and exactly one primary symbol so traceability scans only that script/symbol. Evidence-only meta cases that exist solely for non-executable assertion/cross-cutting process evidence may declare `脚本：无` and `primary symbol：无` with empty `变体测试点`, and must not invent a business pytest item.',
+                    "Name this module file with the stable lowercase business stem `{{item.stem}}` (filename `testcase/md/{{item.stem}}.md`). Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Pure hexadecimal/hash-like opaque stems such as `a401606` and `deadbeef` are also forbidden. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `testcase/test_{{item.stem}}.py`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+                    "Scenario Partition slots: when README declares `## Scenario Partitions`, every slot of each declared partition MUST appear in this module's Cases as exactly one variant Test Point with the deterministic ID `TP-<Partition ID>-<VALUE-TOKEN>` (each-value), `TP-<Partition ID>-OMITTED` (optional axis only) and exactly one `TP-<Partition ID>-NOT-IN-SET` complement slot with `intent=enum-invalid`. Example: Partition ID `SP-GET-API-RESOURCE-NOTES-STATUS` → `TP-SP-GET-API-RESOURCE-NOTES-STATUS-ACTIVE`. Slot IDs copy the declared Partition ID exactly; never drop the HTTP method, invent, merge, renumber or split slot IDs. Prefer ONE Case per partition with a parameter table over duplicated Cases per value. The not-in-set slot value must be a concrete literal absent from the Domain (e.g. `UNKNOWN_TYPE`) and its expected result must come from the bound source — when Expected by Slot is GAP, the Case states the expectation as GAP evidence, never a guessed 空列表/400. Never create cross-axis combination variants beyond the single documented nominal.",
+                    "For every variant Test Point, write its machine-checkable `场景意图: <TP-ID>; operation=...; target=...; intent=...` line inside that same Case body/自动化映射. Never collect Scenario Intent lines in a file-level appendix, implementation-details block, or another Case; local TP ownership is mandatory.",
                     "Every Case must keep at least one numbered executable line under `### 操作步骤`; a compact variant/result table may follow but must not replace the numbered action anchor. Keep numbered/bulleted independently assertable results under `### 预期结果`. The exact `### 操作步骤` and `### 预期结果` headings must remain present for every Case, including compact/table-based Cases; never compress later Cases by dropping required headings. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.",
-                    "In every `自动化映射`, use exactly these machine-readable list labels: `脚本`, `primary symbol`, `变体测试点`, `场景断言测试点`, `横切证据测试点`. Each Test Point from `### 测试点` must appear in exactly one binding list, and every Test Point named in any binding list must also be declared in that Case's `### 测试点`; write `无` for an empty list. A variant Test Point is atomic: one exact endpoint/input/precondition/outcome row equals one exact pytest item and one exact TP ID. If a parameter table has five rows, declare five distinct variant TP IDs in Markdown; never declare one family TP and append row suffixes only in pytest. Classify as `variant` only when endpoint, request input, precondition business state, or expected outcome genuinely changes and therefore needs an independent pytest parameter item. Classify CRUD checkpoints, status/body/header/schema assertions and multiple checks over the same response/journey as `assertion`; classify shared HTTP logging/redaction/truncation evidence as `cross-cutting`. Never create a Test Point merely to parameterize a checkpoint. Every non-cross-cutting TP ID is owned by exactly one Case; when the same response/schema/error assertion is needed in different Cases, use distinct Case-specific TP IDs instead of reusing one assertion TP across Cases. Keep the script path identical to the module one-to-one path and declare exactly one primary symbol named with the canonical Case prefix, for example `BE-RN-003` → `test_BE_RN_003_<description>`; non-Case-prefixed primary symbols are forbidden because parameterized item association must remain deterministic. For redaction scenarios, list sensitive header/field key names only. Never write any header-name-and-value pair, credential placeholder, fake token, anti-example, or other secret-shaped literal in Markdown; state only that a test-only value is supplied at runtime and omitted. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
+                    "In every `自动化映射`, use exactly these machine-readable list labels: `脚本`, `primary symbol`, `变体测试点`, `场景断言测试点`, `横切证据测试点`, plus a deterministic payload contract. For operations without a request body write `Payload Contract: none`. Otherwise write `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum` (write `none` when there is no enum); nested fields use dot paths such as `approver.name`. Each Case describes exactly one target request payload contract: put every payload label on its own list line, never concatenate multiple operations or setup POST/PUT contracts into one label line, and never repeat a `Payload Contract:` token inside explanatory prose/details after the machine-readable line. Values must come only from bound API/DTO evidence, never guesses. Each Test Point from `### 测试点` must appear in exactly one binding list, and every Test Point named in any binding list must also be declared in that Case's `### 测试点`; write `无` for an empty list. A variant Test Point is atomic: one exact endpoint/input/precondition/outcome row equals one exact pytest item and one exact TP ID. If a parameter table has five rows, declare five distinct variant TP IDs in Markdown; never declare one family TP and append row suffixes only in pytest. Classify as `variant` only when endpoint, request input, precondition business state, or expected outcome genuinely changes and therefore needs an independent pytest parameter item. Classify CRUD checkpoints, status/body/header/schema assertions and multiple checks over the same response/journey as `assertion`; classify shared HTTP logging/redaction/truncation evidence as `cross-cutting`. Never create a Test Point merely to parameterize a checkpoint. Every non-cross-cutting TP ID is owned by exactly one Case; when the same response/schema/error assertion is needed in different Cases, use distinct Case-specific TP IDs instead of reusing one assertion TP across Cases. Keep the script path identical to the module one-to-one path and declare exactly one primary symbol named with the canonical Case prefix, for example `BE-RN-003` → `test_BE_RN_003_<description>`; non-Case-prefixed primary symbols are forbidden because parameterized item association must remain deterministic. For evidence-only meta Cases with no executable business journey, write `脚本：无` and `primary symbol：无`, keep `变体测试点：无`, and place process evidence only in assertion/cross-cutting lists. If the bound contract only says an identifier is returned/present, do not declare a concrete identifier type. If a 404 Case needs a nonexistent path identifier but its syntax/type is unspecified, define a create-delete-derived valid identifier journey instead of an arbitrary UUID/text placeholder. For redaction scenarios, list sensitive header/field key names only. Never write any header-name-and-value pair, credential placeholder, fake token, anti-example, or other secret-shaped literal in Markdown; state only that a test-only value is supplied at runtime and omitted. Put implementation-only restrictions in a concise `<details>` block rather than dominating the main case flow. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
+                    ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
                     intake.boundedSourceContext,
                     "## Authoritative reference index",
                     JSON.stringify(intake.referenceIndex, null, 2),
@@ -3995,32 +4483,39 @@ async function buildBackendTestHybridDag(sources) {
     const reviewCases = {
         id: "review-and-revise-backend-md-cases-pi",
         depends_on: [generateMdCasesMap.id],
-        role: "reviewer",
-        executor: "static",
-        complexity: "LOW",
+        role: "implementer",
+        executor: "pi",
+        toolProfile: "write",
+        complexity: "MED",
         writePolicy: "exclusive",
         writeSet: ["testcase/md/**"],
-        allowedPaths: ["testcase/md/**"],
+        allowedPaths: Array.from(new Set([...ro, "testcase/md/**"])),
         forbiddenPaths: forbidden,
-        outputContract: "Deterministic advisory handoff that reserves testcase/md/** in the approved DAG write set for upstream map children; no model invocation or writes.",
+        writerOutcomePolicy: { type: "implementation-outcome-v1" },
+        outputContract: "First non-empty line is IMPLEMENTATION_OUTCOME: changed|already-satisfied|blocked. Perform exactly one bounded incremental synchronization of testcase/md/** against all bound source references; preserve valid Cases and report a concise summary.",
         subtask_prompt: [
-            "Independently review generated Markdown cases against the task requirements and environment evidence. Treat the files as human-facing test documentation: require clear preconditions, executable steps and assertable expected results; improve names, purpose, metadata and automation mapping where useful while preserving exact machine IDs and technical literals.",
-            "Output budget protocol: default to local edit per file; never dump full Matrix/case bodies into assistant chat. Review order is README (Scope/Matrix) then one module file per turn. When adding omitted in-scope cases, write one file per tool call and keep every required section. Do not bulk-delete in-scope cases to save tokens.",
-            "For every variant Test Point, ensure the Markdown scenario intent is machine-checkable with an exact transport target: `场景意图: <TP-ID>; operation=<METHOD /path>; target=<body.field|query.field|path.field|header.field|request>; intent=<empty|missing|null|min-1|min|max|max+1|pattern-invalid|enum-invalid|wrong-type|nominal-operation|custom-literal:V>; bound=<n optional>; example=<optional>; expectedCode=<optional>`. Never use vague targets such as field=resource/health. Keep pytest params aligned to the exact target.",
+            "Perform one gap-targeted synchronization, not a full-suite rewrite or stylistic review. Start from explicit bound source IDs/error codes/DTO fields/normative quoted rules and the README Matrix; open and edit only modules that own a missing or conflicting rule. Preserve unrelated valid modules byte-for-byte and avoid optional wording cleanup.",
+            "Output budget protocol: never dump full Matrix/case bodies into assistant chat. Inspect README first, build a concise target list, then read/write only target modules one file per tool call. Do not traverse every module when the Matrix and source token inventory show no gap; return `already-satisfied`. When adding omitted in-scope cases, keep every required section. Do not bulk-delete in-scope cases to save tokens.",
+            "For every variant Test Point, ensure the Markdown scenario intent is machine-checkable and located inside that same Case body/自动化映射, never in a file-level appendix, implementation-details block, or another Case. Use an exact transport target: `场景意图: <TP-ID>; operation=<METHOD /path>; target=<body.field|query.field|path.field|header.field|request>; intent=<empty|missing|null|min-1|min|max|max+1|pattern-invalid|enum-invalid|wrong-type|nominal-operation|custom-literal:V>; bound=<n optional>; example=<optional>; expectedCode=<optional>`. Never use vague targets such as field=resource/health. Keep pytest params aligned to the exact target. For intent=missing/empty/default-omit, pytest may use `_OMIT` or delete the key; for intent=enum-invalid use a concrete invalid enum literal (for example `UNKNOWN_STATUS`), never `_OMIT`/missing-key; for trim/padded samples use `custom-literal:trim` or a real padded string, not a bare token like `filter-active` when the intent is `custom-literal:ACTIVE`.",
             "Treat the requirement document as the coverage baseline; scope is limited to operations/rules it (or its referenced API contract) describes, and API contract evidence supplements scenario dimensions. For every in-scope operation, check applicable lifecycle/uniqueness states (including deleted-existing when in scope), valid enum values, bounded invalid classes, min-1/min/nominal/max/max+1, allowed/forbidden format classes, required/null/missing/wrong-type semantics, status/error codes, auth and state transitions. Inspect shared validator/helper/DTO/query builder evidence and expand Affected Operations when the same affected path can affect them; unresolved impact stays visible as GAP/CONFLICT. Directly add in-scope omissions; reject scope expansion to operations absent from the requirement document; undefined impact remains GAP/CONFLICT rather than invented behavior.",
             "Check AC completeness/meaning, endpoint, fields/shape, status/error codes, rules, states, documented boundaries/auth, positive/negative coverage, executable steps and assertable results. Require the exact `## Coverage Scope` Field/Value table with the `|---|---|` separator row, a valid classification-policy pair, non-empty Affected Operations/Rule Keys/Scope Evidence, and the classification-specific Regression Floor. Require the exact unnumbered `## Coverage Matrix` heading in `testcase/md/README.md`, exact headers, exactly 9 cells in every data row (including a non-empty Dimension), deterministic OpenAPI Rule Keys for every in-scope affected operation, exactly one Matrix row per Rule Key (merge multi-dimension product rows), and bidirectional Matrix Rule/Test Point ↔ Case bindings. Never describe affected-scope coverage as whole-API completeness. Every explicit AC ID must appear in at least one Case `验收标准`; every explicit in-scope AC/REQ/BR Rule Key cited by a Case must have exactly one Coverage Matrix row, and no Case may cite a source Rule Key omitted from the Matrix. Every Matrix Case ID must share at least one of that row's Required Test Points and the Case must cite that Rule Key. Perform an explicit execution-redundancy review: merge checkpoint-only parameter rows, repeated default/read-back assertions, DELETE status/body/follow-up-read checks, response schema/Content-Type checks, PUT full-update/timestamp checks, repeated list setup and identical null/empty inputs when endpoint, input partition, precondition state and expected outcome are the same. Preserve separate POST/PUT, boundary, enum, wrong-type, role/tenant and distinct business-state variants. Directly repair malformed headings/rows/keys and binding modes rather than merely commenting on them. Reject avoidable English prose, duplicated bilingual wording, repeated boilerplate, oversized unstructured sections, a `### 操作步骤` section that contains only a table without any numbered executable line, vague results such as ‘符合预期’, Case-ID-like module filenames (for example `BE-HEALTH.md`), dropped exact `### 操作步骤`/`### 预期结果` headings, and missing or drifted script/function mapping where it can be derived.",
-            "Correct testcase/md/** directly: add documented omissions, remove unsupported cases, rename module files to stable lowercase stems when needed, normalize every Case ID to hyphen-separated module segments plus exactly three zero-padded digits (`BE-RESOURCE_NOTES-01` → `BE-RESOURCE-NOTES-001`; `BE-RN-011A` must be renumbered or merged) consistently across headings/index/mappings, fix automation mappings so each case points at `testcase/test_<module>.py` derived from that module filename and declares exactly one primary symbol, assign every Test Point exactly one of `变体测试点`/`场景断言测试点`/`横切证据测试点`, ensure every binding-list Test Point is also present in that Case's `### 测试点`, expand every variant parameter row into its own atomic TP ID, make every non-cross-cutting TP Case-specific and owned by exactly one Case, require every primary symbol to start with the canonical Case prefix, ensure every explicit AC ID appears in an applicable Case `验收标准`, merge execution duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Remove every credential/header value, placeholder, fake token and anti-example from Markdown. Sensitive key names may remain only as a plain list; values must be described as runtime-only and omitted, with no colon/value pair or literal example anywhere, including details blocks and explanatory text. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations as exact machine-readable identifiers; only normalize Case ID separator/sequence formatting as specified above. Recalculate predicted collected items as `sum(max(1, variant count per Case))`; when the task declares a budget, directly merge redundant journeys/reclassify same-request checkpoints until the prediction is within budget, while preserving all required coverage. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.",
-            "Read only precise referenced source paths plus requirement sections needed for uncovered ACs. Do not scan the repository, modify source/**, generate pytest, execute tests, or emit JSON.",
+            "Correct testcase/md/** directly: add documented omissions, remove unsupported cases, rename module files to stable lowercase stems when needed, normalize every Case ID to hyphen-separated module segments plus exactly three zero-padded digits (`BE-RESOURCE_NOTES-01` → `BE-RESOURCE-NOTES-001`; `BE-RN-011A` must be renumbered or merged) consistently across headings/index/mappings, fix automation mappings so each automatable case points at `testcase/test_<module>.py` derived from that module filename and declares exactly one primary symbol (evidence-only meta cases may keep `脚本/primary symbol=无` with empty variants), assign every Test Point exactly one of `变体测试点`/`场景断言测试点`/`横切证据测试点`, then perform an exact-set check: each Case's `### 测试点` set must equal (not merely contain) the union of those three binding lists; delete stale/legacy aliases and ensure every binding-list Test Point is present, expand every variant parameter row into its own atomic TP ID, make every non-cross-cutting TP Case-specific and owned by exactly one Case, require every primary symbol to start with the canonical Case prefix, ensure every explicit AC ID appears in an applicable Case `验收标准`, merge execution duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Remove every credential/header value, placeholder, fake token and anti-example from Markdown. Sensitive key names may remain only as a plain list; values must be described as runtime-only and omitted, with no colon/value pair or literal example anywhere, including details blocks and explanatory text. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations as exact machine-readable identifiers; only normalize Case ID separator/sequence formatting as specified above. Recalculate predicted collected items as `sum(max(1, variant count per Case))`; when the task declares a budget, directly merge redundant journeys/reclassify same-request checkpoints until the prediction is within budget, while preserving all required coverage. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.",
+            "This is the single Markdown incremental synchronization round. Read every authoritative reference index entry whose role hints include acceptance-criteria, api-contract, data-contract or business-rule; do not rely on the derived PRD as a complete inventory. Preserve every explicit AC/REQ/BR ID, every documented HTTP/business error code, every DTO/JSON field, enum value, boundary, format, nested shape, transaction/state/idempotency/uniqueness/auth/tenant/cross-field rule. For each natural-language normative business rule preserved as required scope, include its exact source sentence without paraphrase together with source path and line/heading anchor so the deterministic ledger can verify quote/hash provenance. Ensure every Case declares exactly `Payload Contract: none` or the three labels `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; every label must occupy its own machine-readable list line, and a Case must never concatenate target/setup operations or multiple `Payload Contract` tokens onto one line, and explanatory prose/details must not repeat any `Payload Contract:` token; never infer missing keys or enum values. A target GET/DELETE operation with no request body must remain `Payload Contract: none` even when its setup journey performs POST/PUT with a DTO; setup payloads never redefine the target Case payload contract. Add only missing Matrix rows/Test Points/Cases/assertions or repair exact drift; do not rewrite already-valid unrelated modules. Work gap-targeted: inspect source anchors and affected modules first, leave unrelated valid modules byte-stable, and return `already-satisfied` without restating the full suite when no gap exists.",
+            "For affected API fields, use one valid nominal payload plus atomic required/missing/null/empty/wrong-type, every documented enum value plus bounded invalid classes, documented min-1/min/nominal/max/max+1, formats and nested object/array constraints. Do not generate a Cartesian product or invent undocumented constraints. Do not invent a concrete identifier type when the source only requires presence; for a missing-resource 404 path with unspecified identifier syntax/type, synchronize the Case to a create-delete-derived valid identifier journey rather than an arbitrary UUID/text placeholder.",
+            "Scenario Partitions synchronization: when README declares `## Scenario Partitions`, verify each declared partition's slots are fully materialized as variant Test Points with exact `TP-<Partition ID>-...` IDs (each-value per Domain value, OMITTED only for optional axes, exactly one NOT-IN-SET with intent=enum-invalid). Directly add missing slot rows/Cases. You may delete an illegal Partition row that has no source-backed finite domain, together with its derived `TP-SP-*` slots/Cases. Never delete a legal source-backed partition or drop its complement slot to force coverage green. When the bound source does not document the complement expectation, keep the slot with GAP expected instead of guessing. Body-field validation enums (`TP-<FIELD>-ENUM-*`) are NOT partitions — do not add partition rows for them.",
+            "Before returning, verify that every explicit source AC/REQ/BR, error code and strong DTO field token appears in README or an applicable module Case. If a fact cannot be safely automated, retain it as GAP/CONFLICT with its exact source pointer instead of dropping it. Return already-satisfied only when no target file needs an incremental edit.",
+            "Read only indexed source paths. Do not scan the repository, modify source/**, generate pytest, execute tests, or emit JSON.",
+            ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
             intake.boundedSourceContext,
             "## Authoritative reference index",
             JSON.stringify(intake.referenceIndex, null, 2),
             "For each index entry, use `readPath` for Pi read-tool calls and keep `path` as the exact Markdown Source References citation. Bound files under .harness/tasks/<taskId>/source/** are read-only inputs: reading them is allowed even though writing .harness/** is forbidden. Never resolve `path` relative to the repository root, search for substitutes, or fall back to docs/** when a bound read fails.",
         ].join("\n\n"),
-        static: {
-            resultMarkdown: "Markdown module writers completed. Deterministic node 6 validation owns advisory structure/coverage findings; no model review or rewrite was invoked.",
-        },
     };
-    const validateCases = shellNode("validate-backend-md-cases-shell", [reviewCases.id], "markdown-cases", "Record advisory findings for Markdown structure and deterministically analyze the final README Coverage Scope and Coverage Matrix against final Case rule/test-point bindings. Validate the classification-policy pair, affected operations/rules, scope evidence and regression floor; require documented OpenAPI completeness only for declared affected operations, while all explicit AC/REQ/BR remain in scope. Detect missing in-scope product/API rules, enum values, invalid equivalence classes, boundaries, format classes, business lifecycle states, GAP/CONFLICT, bidirectional Matrix/Case drift, non-canonical Case IDs, unclassified Test Points, duplicate binding modes and non-cross-cutting Test Points bound by multiple Cases. Do not validate source-reference existence. Write human and machine evidence from the same facts. Keep quality findings advisory, but fail closed after writing the report when secret-shaped values are detected. Coverage FAIL stays advisory.", "Run-owned reports/backend-md-case-validation.md, reports/backend-test-case-coverage-analysis.md and contracts/backend-test-case-coverage-facts.json v3 with Coverage Scope plus PASS/FAIL/UNAVAILABLE advisory facts; downstream execution continues.");
+    const validateCases = shellNode("validate-backend-md-cases-shell", [reviewCases.id], "markdown-cases", "Record advisory findings for Markdown structure and deterministically analyze the final README Coverage Scope and Coverage Matrix against final Case rule/test-point bindings. Validate the classification-policy pair, affected operations/rules, scope evidence and regression floor; require documented OpenAPI completeness only for declared affected operations, while all explicit AC/REQ/BR remain in scope. Detect missing in-scope product/API rules, enum values, invalid equivalence classes, boundaries, format classes, business lifecycle states, GAP/CONFLICT, bidirectional Matrix/Case drift, non-canonical Case IDs, unclassified Test Points, duplicate binding modes and non-cross-cutting Test Points bound by multiple Cases. Do not validate source-reference existence. Write human and machine evidence from the same facts. Keep quality findings advisory, but fail closed after writing the report when secret-shaped values are detected. Coverage FAIL stays advisory.", "Run-owned reports/backend-md-case-validation.md, reports/backend-test-case-coverage-analysis.md and contracts/backend-test-case-coverage-facts.json v4 with Coverage Scope plus PASS/FAIL/UNAVAILABLE advisory facts; downstream execution continues.");
+    if (sharedSetup) {
+        validateCases.subtask_prompt += ` Deterministically verify shared setup references: every 引用前置 line must cite exactly the bound path ${sharedSetup.path} with a stable SS anchor (or SS-DEFAULT); any other citation, unbound path, invented step ID or 引用前置 line without a bound document is a FAIL finding. Never rewrite the user document.`;
+    }
     // N5 line (sharded): pytest shared-asset plan → manifest shell → map_agent barrier.
     // Shared helpers/factories are written once by the plan node; each module's
     // test_<stem>.py is written by an independent Pi child (own 16K budget).
@@ -4035,9 +4530,9 @@ async function buildBackendTestHybridDag(sources) {
         forbiddenPaths: forbidden,
         outputContract: "Deterministic pytest generation handoff. Per-module map children write self-contained test_<module>.py files with bounded local fixtures, HTTP logging/redaction and payload builders; no model invocation, JSON, shared-asset writes or pytest execution.",
         subtask_prompt: [
-            "Convert testcase/md/** into pytest using upstream environment and advisory validation evidence plus only bounded pytest config/conftest. This node writes ONLY the shared pytest support assets (HTTP logging/redaction helper, request factories, shared fixtures); each module's test_<module>.py is written by a downstream sharded node that imports these helpers. A FAIL advisory report does not authorize inventing missing behavior; use the final Markdown facts that are present.",
-            "Output budget protocol (hard, max output <=16K per turn): Write helpers/factories one file per write/edit tool call. Never paste full Python modules into assistant chat. Do not reduce params/assertions/skips semantics to fit. If OUTPUT_LIMIT_RECOVERY is injected, continue only listed missing/broken shared files.",
-            "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them.",
+            "Convert testcase/md/** into pytest using upstream environment and advisory validation evidence plus only bounded pytest config/conftest. This node is a deterministic handoff: NO shared helper/factory/fixture files are generated anywhere in the pipeline; each module's self-contained test_<module>.py (module-local fixtures, HTTP logging/redaction, payload builders) is written by a downstream sharded node. A FAIL advisory report does not authorize inventing missing behavior; use the final Markdown facts that are present.",
+            "Output budget protocol (hard, max output <=16K per turn): downstream module writers write exactly one test_<module>.py per write/edit tool call. Never paste full Python modules into assistant chat. Do not reduce params/assertions/skips semantics to fit.",
+            "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them. Hard contract: intent=enum-invalid MUST pass a concrete invalid value literal (string/number/boolean), never `_OMIT`/None/missing key; intent=missing/empty may use `_OMIT` or delete the key; intent=custom-literal:trim|whitespace-padded requires a leading/trailing whitespace string with non-empty trimmed content (all-whitespace belongs to empty/whitespace-only, not trim); intent=custom-literal:ACTIVE|ARCHIVED requires the exact enum string, never descriptive tokens like filter-active; intent=max/min/max+1 should pass a repeated-string length expression, a bare length number N, or a helper named _*_LEN{N} / _*_MAX_LENGTH / _*_OVER_LENGTH — never a bare 1 for oversize. Hard contract: request payload dicts may only contain DTO field keys from Payload Allowed Paths; never put expect/expected/echo_* helper keys inside the JSON body dict. Path/query/header identifiers and scenario-control metadata (including `id`, expected codes, and selector labels) must stay in separate pytest parameters and helper arguments; never merge them into a DTO patch or JSON body unless that exact path is allowed by the Markdown payload contract. Normalize the configured API base URL with `rstrip(\"/\")` (or equivalently join exactly one slash) before appending endpoint paths; generated requests must never contain a `//api/...` path. When the bound source documents a concrete non-secret local API URL, generated clients must use it as the fallback in `os.environ.get(\"API_BASE_URL\", \"<documented-url>\")`; do not require an otherwise-uninjected environment variable or fail setup solely because it is absent. Missing-field helpers must remove keys idempotently with `payload.pop(field, None)`, never `del payload[field]`, because optional fields may already be absent.",
             "Generate a reusable HTTP logging helper (or equivalent client wrapper) and call it for every interface request. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions. If shared pytest fixtures are generated, keep their dependency graph in one provider module and require each downstream test module to register that provider with an exact pytest_plugins tuple; importing only the outer fixture is insufficient and will be rejected by fixture-resolution preflight.",
             "HTTP response header names are case-insensitive. If the helper stores a lower-case normalized header map, every Content-Type or other header assertion must query the lower-case key (for example `content-type`) or use an explicitly case-insensitive accessor; never call a case-sensitive plain dict with `Content-Type` when the stored key is lower-case. Preserve the actual media-type assertion rather than dropping it.",
             "Compare timestamps and other semantically equivalent protocol values by parsed meaning, not byte-for-byte serialization. In particular, normalize valid ISO-8601 instants before equality/order assertions so differences such as omitted trailing fractional seconds do not create TestBug failures; preserve exact-string assertions only when the Markdown explicitly requires representation equality.",
@@ -4060,7 +4555,7 @@ async function buildBackendTestHybridDag(sources) {
         outputContract: "Stdout JSON {modules:[{stem}]} parsed from testcase/md/README.md using the same module-stem extractor as the Completeness Gate, so the map_agent shard set deterministically matches the Markdown module index.",
         subtask_prompt: "Parse testcase/md/README.md and emit exactly one trailing JSON line {modules:[{stem}]} listing every trusted module stem (table-row testcase/md/<stem>.md mentions and canonical [label](./<stem>.md) relative links only). No file writes.",
         shell: {
-            commands: [buildBackendTestModuleManifestShellCommand()],
+            commands: [buildBackendTestModuleManifestShellCommand(layout)],
             cwd: ".",
             timeoutMs: 60000,
         },
@@ -4084,10 +4579,11 @@ async function buildBackendTestHybridDag(sources) {
             workflowNodeId: "generate-backend-pytest-cases-map",
             itemsFrom: "$.nodes['materialize-backend-pytest-module-manifest-shell'].output.modules",
             itemName: "item",
-            maxItems: 64,
-            maxExpandedNodes: 64,
+            maxItems: 8,
+            maxExpandedNodes: 8,
             childIdPrefix: "generate-backend-pytest-case",
-            tokenBudget: { maxTokensPerCase: 16384, maxTotalTokens: 600000 },
+            tokenBudget: { maxTotalTokens: 3000000 },
+            failOnTokenBudgetExhaustion: true,
             childTask: {
                 executor: "pi",
                 role: "implementer",
@@ -4112,13 +4608,17 @@ async function buildBackendTestHybridDag(sources) {
                 retryPolicy: BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY,
                 outputContract: "Write exactly one pytest module file testcase/test_<stem>.py whose actual test function region contains the exact Case ID, preferably in the function name or docstring. testcase/md/<module>.md (excluding README.md) maps one-to-one to testcase/test_<module>.py; never merge or split modules. No JSON and no pytest execution.",
                 subtaskPromptTemplate: [
-                    "Convert the single Markdown module testcase/md/{{item.stem}}.md into one self-contained pytest module. After reading the module Markdown and the bounded pytest config/conftest, immediately use write tools to create the single file testcase/test_{{item.stem}}.py. Define any bounded HTTP client fixture, request logging/redaction/truncation helper and payload builders needed by this module inside that same file; do not import generated testcase/**/helpers/** or testcase/**/factories/** assets. Do not end after analysis or planning. Do not modify Markdown, conftest, helpers/factories, or any other module's pytest script.",
+                    "Convert the single Markdown module testcase/md/{{item.stem}}.md into one self-contained pytest module. Before writing, also read testcase/md/README.md and use its explicit API target/environment table as the authoritative fallback base URL for every module. A task/Markdown `API_BASE_URL` target takes precedence over project README dev-server URLs; never infer a backend API fallback from a frontend/Vite port such as localhost:3000. After reading the module Markdown, testcase/md/README.md, and the bounded pytest config/conftest, immediately use write tools to create the single file testcase/test_{{item.stem}}.py. Define any bounded HTTP client fixture, request logging/redaction/truncation helper and payload builders needed by this module inside that same file; do not import generated testcase/**/helpers/** or testcase/**/factories/** assets. Do not end after analysis or planning. Do not modify Markdown, conftest, helpers/factories, or any other module's pytest script.",
                     "Output budget protocol (hard, max output <=16K per turn): Write exactly one test_{{item.stem}}.py. Never paste full Python modules into assistant chat. Do not merge or split modules. Do not reduce params/assertions/skips to fit. If OUTPUT_LIMIT_RECOVERY is injected, continue only listed missing/broken scripts.",
-                    "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them.",
-                    'Ensure every final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. Use `pytest.param(..., id=...)` for every row; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
+                    "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them. Hard contract: intent=enum-invalid MUST pass a concrete invalid value literal (string/number/boolean), never `_OMIT`/None/missing key; intent=missing/empty may use `_OMIT` or delete the key; intent=custom-literal:trim|whitespace-padded requires a leading/trailing whitespace string with non-empty trimmed content (all-whitespace belongs to empty/whitespace-only, not trim); intent=custom-literal:ACTIVE|ARCHIVED requires the exact enum string, never descriptive tokens like filter-active; intent=max/min/max+1 should pass a repeated-string length expression, a bare length number N, or a helper named _*_LEN{N} / _*_MAX_LENGTH / _*_OVER_LENGTH — never a bare 1 for oversize. Hard contract: request payload dicts may only contain DTO field keys from Payload Allowed Paths; never put expect/expected/echo_* helper keys inside the JSON body dict. Path/query/header identifiers and scenario-control metadata (including `id`, expected codes, and selector labels) must stay in separate pytest parameters and helper arguments; never merge them into a DTO patch or JSON body unless that exact path is allowed by the Markdown payload contract. Normalize the configured API base URL with `rstrip(\"/\")` (or equivalently join exactly one slash) before appending endpoint paths; generated requests must never contain a `//api/...` path. When the bound source documents a concrete non-secret local API URL, generated clients must use it as the fallback in `os.environ.get(\"API_BASE_URL\", \"<documented-url>\")`; do not require an otherwise-uninjected environment variable or fail setup solely because it is absent. Missing-field helpers must remove keys idempotently with `payload.pop(field, None)`, never `del payload[field]`, because optional fields may already be absent.",
+                    "For every response contract that requires an object or pagination envelope, first assert that each envelope/data value is a dict and that required keys exist, then index fields and assert values. Never let an incidental KeyError or list/string TypeError stand in for the explicit response-shape contract failure.",
+                    'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
                     "Name the generated pytest file so it corresponds one-to-one with its source Markdown module file: this module stem `{{item.stem}}` maps to exactly one `testcase/test_{{item.stem}}.py`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `resource_notes` → `testcase/test_resource_notes.py`, `health` → `testcase/test_health.py`. If Markdown automation mapping names a different path than this module stem path, still write the module stem path and do not invent prefixes. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
+                    "Scenario Partition slots: every `TP-<Partition ID>-...` variant Test Point declared by this module's Markdown MUST become exactly one literal direct `pytest.param(..., id=\"TP-<Partition ID>-...\")` row with the exact slot ID; the not-in-set slot passes a concrete literal absent from the documented Domain (e.g. `UNKNOWN_TYPE`) — never `_OMIT`, never a descriptive token. Never split one slot into multiple params or merge several slots under a family TP id. Slot filtering requests hit the documented list endpoint with the slot value as the query/path filter.",
                     "Keep this module self-contained: define module-local fixtures and helpers directly in testcase/test_{{item.stem}}.py, so pytest discovers every fixture dependency without external plugin registration. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions. Recursively redact sensitive values and apply bounded truncation before logging.",
+                    "Materialize every automatable Markdown Case exactly once as one canonical primary pytest symbol. Preserve every explicit variant Test Point as a stable pytest.param id and every assertion/cross-cutting binding as declared. Build request payloads from the effective Markdown test data literally: keep all declared DTO keys, nested shapes, enum values, missing/null/boundary variants and business-state preconditions; never substitute guessed convenience fields or rename contract fields. Never assert an identifier's concrete Python/JSON type unless the Markdown or bound contract explicitly declares that type; when only presence is required, accept any non-null scalar identifier and serialize it safely into the path. For a nonexistent-resource 404 Case whose identifier syntax/type is not declared, obtain a syntactically valid identifier from a live create response and delete it before the 404 request; never invent an arbitrary UUID/text identifier that may fail path conversion with 400. Respect every local helper's actual return signature: never tuple-unpack a scalar status/id/helper result, and never treat a tuple response as a scalar.",
                     "Do not read source/**, add cases, reassign ACs, modify conftest/config/production code, use skip/xfail, swallow assertions, execute pytest, or emit JSON. For best-effort cleanup, catch only the narrow transport exception actually raised by the selected HTTP client (for example `requests.RequestException` or `urllib.error.URLError`); never use bare `except`, `Exception`, or `BaseException` with `pass`.",
+                    ...(sharedSetupPytestPrompt ? [sharedSetupPytestPrompt] : []),
                 ].join("\n\n"),
             },
         },
@@ -4131,13 +4631,9 @@ async function buildBackendTestHybridDag(sources) {
         role: "implementer",
         executor: "pi",
         toolProfile: "write",
-        complexity: "HIGH",
+        complexity: "MED",
         writePolicy: "exclusive",
-        writeSet: [
-            "testcase/**/test_*.py",
-            "testcase/**/helpers/**",
-            "testcase/**/factories/**",
-        ],
+        writeSet: ["testcase/**/test_*.py"],
         allowedPaths: Array.from(new Set([...ro, "testcase/**"])),
         forbiddenPaths: Array.from(new Set([
             ...forbidden,
@@ -4147,27 +4643,28 @@ async function buildBackendTestHybridDag(sources) {
             "pyproject.toml",
             "setup.cfg",
         ])),
-        writerOutcomePolicy: { type: "implementation-outcome-v1" },
-        outputContract: "First non-empty line is IMPLEMENTATION_OUTCOME: changed|already-satisfied|blocked, followed by a concise repair summary. Modify only generated pytest scripts/helpers/factories and preserve every Markdown Case, Test Point, primary symbol and assertion meaning.",
+        writerOutcomePolicy: { type: "implementation-outcome-v1", requireChangedFiles: true },
+        outputContract: "First non-empty line is IMPLEMENTATION_OUTCOME: changed|blocked, followed by a concise repair summary. This node runs only for REPAIRABLE initial facts, so already-satisfied is invalid and a successful outcome requires a non-empty bounded diff. Modify only generated pytest scripts/helpers/factories and preserve every Markdown Case, Test Point, primary symbol and assertion meaning.",
         subtask_prompt: [
-            "Repair the generated backend pytest asset as one bounded program using the direct upstream collection assessment. This is the only repair attempt and happens before any business test body execution.",
-            "Fix only readiness-proven generated testcase-local defects on initial facts repairPaths: create exact safe missing mapped test_*.py paths, repair syntax/import/symbol/decorator/parameterization, or close generated fixture dependencies and plugin registration. For fixture defects inspect both provider and importer; when a shared fixture depends on sibling fixtures, register the whole provider module through an exact pytest_plugins declaration rather than importing only the outer fixture. Do not create unrelated pytest scripts.",
+            "Repair the generated backend pytest asset as one bounded program using the direct upstream collection assessment. This is the only repair attempt and happens before any business test body execution. Treat any upstream line such as `Repair paths: testcase/test_x.py` as complete authoritative repairPaths evidence. Directly read and edit that testcase path; do not search for separate root-level `contracts/**`, guess a DAG run directory, or require another report artifact. If the read tool successfully returns the testcase file, the path exists—continue the bounded repair and never later claim that file is absent.",
+            "Initial status REPAIRABLE means at least one listed finding remains: `already-satisfied` is forbidden, and you must produce a non-empty bounded diff on repairPaths before returning `IMPLEMENTATION_OUTCOME: changed`. Fix only readiness-proven generated testcase-local defects on initial facts repairPaths: create exact safe missing mapped test_*.py paths, repair syntax/import/symbol/decorator/parameterization, close generated fixture dependencies/plugin registration, and repair initial Markdown-to-pytest correspondence findings (missing/multiple primary symbol, script mismatch, parameter ID or assertion binding). Never invent a business pytest symbol for evidence-only Markdown Cases that declare `脚本/primary symbol=无` with empty variants. For fixture defects inspect both provider and importer; fix ScopeMismatch by aligning fixture scopes or inlining request-scoped values so module fixtures never depend on function fixtures; when a shared fixture depends on sibling fixtures, register the whole provider module through an exact pytest_plugins declaration rather than importing only the outer fixture. Do not create unrelated pytest scripts.",
+            "This is the single pytest incremental synchronization round. The `Findings` in `reports/backend-test-pytest-collection-initial.md` are the mandatory repair checklist: resolve every repairable listed finding on every authoritative `Repair paths` file before considering any other advisory evidence, and never substitute an unrelated scenario-param cleanup for a listed correspondence/collection defect. For every assessment-listed path, compare the effective Markdown Case/Test Points/test data and its `Payload Contract`/`Payload Required Paths`/`Payload Allowed Paths`/`Payload Enum` labels with the generated module. Incrementally add or repair only missing symbols, params, assertions and payload builders. Repair every assessment-listed missing nested path, unexpected key and enum mismatch; preserve exact DTO keys, nested shapes, enum/boundary literals, operation transport and business preconditions; remove guessed replacement keys only when the effective Markdown proves the exact contract. Keep path/query/header identifiers and scenario-control metadata separate from DTO patches and JSON bodies; an `id` used for a path target must be passed to the request path/helper, never inserted into a body patch unless `id` is explicitly listed in Payload Allowed Paths. Flatten every variant into a literal direct `pytest.param(..., id=\"TP-...\")` row; replace `_post_case`/`_put_case` or other parameter-row factories because correspondence and scenario readiness require the actual row values and IDs to be statically visible. Also repair helper call sites to match their defined return signatures; do not tuple-unpack a helper that returns one scalar value.",
             "Preserve final testcase/md/** semantics, every Case ID, Rule/Test Point binding, primary symbol, parameter ID, expected status/body/schema assertion, HTTP logging, redaction and truncation behavior.",
             "Use local edit only on assessment-listed paths; keep summaries short; never rewrite unrelated modules.",
-            "Do not read task source/** or reinterpret requirements. Do not modify Markdown, conftest, pytest config, production code or dependencies.",
+            "Do not reinterpret requirements beyond the effective Markdown and bounded assessment diagnostics. Do not modify Markdown, conftest, pytest config, production code or dependencies.",
             "Do not add skip/skipif/xfail, remove tests, reduce collected items, loosen assertions, swallow exceptions, use try/except ImportError fallback, mutate sys.path/PYTHONPATH, or replace the real API with mocks.",
             "Do not execute pytest; the deterministic effective collection gate owns the final collection attempt.",
         ].join("\n\n"),
     };
-    const collectionEffective = shellNode("effective-backend-pytest-collection-gate-shell", [collectionAssess.id, repairPytest.id], "markdown-collection-effective", "If initial collection+fixture readiness passed, verify unchanged asset hashes and reuse it. If the single repair ran, rerun scenario-param preflight, final collection and no-business-body fixture resolution once. BLOCKED facts, repair failure, residual fixture failure or hash drift prevent business pytest execution. Materialize canonical backend-test-execution-readiness.json.", "Run-owned effective collection-v3 facts plus contracts/backend-test-execution-readiness.json proving exact final assets are collectable, fixture-resolvable and hash-bound; initial PASS is reused, repair path records attempt=1.", [], 120000);
+    const collectionEffective = shellNode("effective-backend-pytest-collection-gate-shell", [collectionAssess.id, repairPytest.id], "markdown-collection-effective", "If initial collection+fixture readiness passed, verify unchanged asset hashes and reuse it. If the single repair ran, rerun scenario-param preflight, final collection and no-business-body fixture resolution once. Recompute effective correspondence/payload shape and materialize Case/symbol/item `ELIGIBLE|NOT_ELIGIBLE` facts; Payload-contract-bound field-target MISMATCH/UNDETERMINED scenario items, non-exact mappings and payload UNSAFE/UNAVAILABLE items are excluded. Generic request-level nominal/health observations remain advisory when payload shape is SAFE and correspondence exact. BLOCKED facts, repair failure, residual fixture failure, zero eligible items or hash drift prevent business pytest execution. Materialize canonical backend-test-execution-readiness.json v2.", "Run-owned effective collection-v3 facts, reports/backend-test-execution-eligibility.md, contracts/backend-test-execution-eligibility.json and contracts/backend-test-execution-readiness.json v2 proving exact final assets are collectable, fixture-resolvable, payload-safe at item level and hash-bound; initial PASS is reused, repair path records attempt=1.", [], 120000);
     collectionEffective.dependsPolicy = "all-or-condition-skip";
-    const traceability = shellNode("backend-test-traceability-gate-shell", [collectionEffective.id], "markdown-traceability", "Deterministically scan only final readiness-authorized Markdown-mapped pytest scripts. Produce bidirectional Markdown module/Case/Test Point ↔ pytest file/primary symbol correspondence and logging findings. scenario-param assessment/repair already ran before collection; consume and display its final PASS/PARTIAL/FAIL/UNAVAILABLE facts without modifying pytest assets after readiness was frozen. Correspondence findings remain advisory; Never block pytest solely on correspondence FAIL.", "Run-owned reports/backend-test-traceability.md, reports/backend-test-markdown-pytest-correspondence.md, contracts/backend-test-markdown-pytest-correspondence-facts.json, reports/backend-test-scenario-param-consistency.md and contracts/backend-test-scenario-param-consistency-facts.json (initial+final) with optional repair audit; PASS/FAIL/UNAVAILABLE correspondence facts bound after effective collection.");
+    const traceability = shellNode("backend-test-traceability-gate-shell", [collectionEffective.id], "markdown-traceability", "Deterministically scan only final readiness-authorized Markdown-mapped pytest scripts. Produce bidirectional Markdown module/Case/Test Point ↔ pytest file/primary symbol correspondence, payload-shape safety, per-item execution eligibility and logging findings. scenario-param assessment/repair already ran before collection; consume and display its final PASS/PARTIAL/FAIL/UNAVAILABLE facts without modifying pytest assets after readiness was frozen. Correspondence findings remain advisory; Never block pytest solely on correspondence FAIL.", "Run-owned reports/backend-test-traceability.md, reports/backend-test-markdown-pytest-correspondence.md, contracts/backend-test-markdown-pytest-correspondence-facts.json, reports/backend-test-scenario-param-consistency.md and contracts/backend-test-scenario-param-consistency-facts.json (initial+final) with optional repair audit; PASS/FAIL/UNAVAILABLE correspondence facts bound after effective collection.");
     const manifest = shellNode("backend-test-case-manifest-shell", [traceability.id], "markdown-manifest", "Materialize the canonical Backend Test Case Manifest only from contracts/backend-test-case-coverage-facts.json and contracts/backend-test-markdown-pytest-correspondence-facts.json. Validate schema, task binding, input hashes and freshness; never re-read source semantics, re-analyze Coverage Matrix, rescan pytest symbols or recompute a second set of metrics. Missing/stale/conflicting facts produce partial/unavailable diagnostics rather than fabricated zeros.", "Run-owned contracts/backend-test-case-manifest.json with materializationStatus, sourceFactsIssues, validated coverageScope, coverageSummary, ruleCoverageSummary and correspondenceSummary; this is the single machine input for L-5 and closeout.");
     const pytestCommand = [
         'mkdir -p "${HARNESS_DAG_RUN_DIR}/reports"',
-        'echo "pytest targets are resolved at runtime from final Markdown 自动化映射"',
+        'echo "pytest targets are resolved at runtime from execution-readiness v2 eligibleItemIds"',
     ].join("; ");
-    const execute = shellNode("execute-backend-pytest-and-html-report-shell", [manifest.id], "markdown-execute-html", "Read canonical contracts/backend-test-execution-readiness.json, verify final asset hashes, then resolve the final Markdown Automation Notes/自动化映射 to a unique, safe set of testcase/**/test_*.py targets and execute only those scripts exactly once. Prefer the deterministic module one-to-one path when a mapped script is missing but the module stem file exists. Generate a native pytest-html self-contained report, then render the primary self-contained Chinese HTML report from the same pytest-html plus final Markdown case metadata without rerun. Keep 测试结论 and quality status; make node 6 Markdown validation + case coverage and node 13 traceability + Markdown-to-pytest correspondence expandable to their full escaped details; show each failure overview item with its original pytest message plus deterministic evidence-based reason analysis; list failure/error case cards before the remaining cases while preserving stable order. Each polished per-case result card includes concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.", "One scoped pytest execution over Markdown-mapped scripts producing a valid pytest-html report with per-case captured output, self-contained reports/backend-test.html, reports/backend-test.md, reports/backend-test-facts.md, a deterministic self-contained reports/backend-test-l5-dashboard.html (machine-computed L-5 metrics, no JSON), and an optional contracts/code-coverage-v1.json when jacocoCoverage is configured (JaCoCo TCP dump → jacoco.xml → parsed; failure-safe); exit 0/1 with valid evidence continues.", [pytestCommand], 300000);
+    const execute = shellNode("execute-backend-pytest-and-html-report-shell", [manifest.id], "markdown-execute-html", "Read canonical contracts/backend-test-execution-readiness.json v2, verify final asset and eligibility-input hashes, then execute exactly its `eligibleItemIds` pytest node IDs once. Never execute `excludedItems`; retain each exclusion reason as residual TestBug/automation evidence rather than ProductBug. Prefer the deterministic module one-to-one path when a mapped script is missing but the module stem file exists. Generate a native pytest-html self-contained report, then render the primary self-contained Chinese HTML report from the same pytest-html plus final Markdown case metadata without rerun. Keep 测试结论 and quality status; make node 6 Markdown validation + case coverage and node 13 traceability + Markdown-to-pytest correspondence expandable to their full escaped details; show each failure overview item with its original pytest message plus deterministic evidence-based reason analysis; list failure/error case cards before the remaining cases while preserving stable order. Each polished per-case result card includes concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.", "One scoped pytest execution over readiness-authorized eligible pytest items producing a valid pytest-html report with per-case captured output, self-contained reports/backend-test.html, reports/backend-test.md, reports/backend-test-facts.md, a deterministic self-contained reports/backend-test-l5-dashboard.html (machine-computed L-5 metrics, no JSON), and an optional contracts/code-coverage-v1.json when jacocoCoverage is configured (JaCoCo TCP dump → jacoco.xml → parsed; failure-safe); exit 0/1 with valid evidence continues.", [pytestCommand], 300000);
     if (execute.shell) {
         execute.shell.envAllowlist = collectBackendTestShellEnvAllowlist(sources);
     }
@@ -4245,16 +4742,114 @@ async function buildBackendTestHybridDag(sources) {
             report,
         ],
     };
+    // Plan A: rewrite every backend-test node's layout-dependent strings
+    // (prompts, output contracts, writeSet/allowedPaths, shell commands)
+    // against the resolved layout. The default layout is identity, so the
+    // packaged template stays byte-identical with the historical contract.
+    applyBackendTestLayoutToDagSpec(spec, layout);
+    // Plan B: carry the bound shared-setup document on the spec so runtime
+    // validators (N6 markdown case validation) see the same binding as prompts.
+    if (intake.sharedSetup) {
+        spec.backendTestSharedSetup = { ...intake.sharedSetup };
+    }
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
 }
+/** Rewrite layout-dependent strings across a compiled backend-test DAG spec (plan A). */
+function applyBackendTestLayoutToDagSpec(spec, layout) {
+    if (layout.isDefault) {
+        spec.backendTestLayout = layout;
+        return;
+    }
+    const rewrite = (value) => applyBackendTestLayoutToText(value, layout);
+    for (const task of spec.tasks) {
+        task.subtask_prompt = rewrite(task.subtask_prompt);
+        if (task.outputContract)
+            task.outputContract = rewrite(task.outputContract);
+        task.writeSet = task.writeSet?.map(rewrite);
+        task.allowedPaths = task.allowedPaths?.map(rewrite);
+        task.forbiddenPaths = task.forbiddenPaths?.map(rewrite);
+        if (task.dynamicExpansion?.childTask) {
+            const child = task.dynamicExpansion.childTask;
+            if (typeof child.subtaskPromptTemplate === "string") {
+                child.subtaskPromptTemplate = rewrite(child.subtaskPromptTemplate);
+            }
+            if (typeof child.outputContract === "string") {
+                child.outputContract = rewrite(child.outputContract);
+            }
+            if (Array.isArray(child.allowedPaths)) {
+                child.allowedPaths = child.allowedPaths.map(rewrite);
+            }
+            if (Array.isArray(child.writeSet)) {
+                child.writeSet = child.writeSet.map(rewrite);
+            }
+            if (Array.isArray(child.forbiddenPaths)) {
+                child.forbiddenPaths = child.forbiddenPaths.map(rewrite);
+            }
+        }
+        if (task.shell?.commands) {
+            task.shell.commands = task.shell.commands.map(rewrite);
+        }
+    }
+    // Rewrite remaining prose-level constraints and success criteria that
+    // reference the generated asset tree.
+    spec.globalConstraints = spec.globalConstraints?.map(rewrite);
+    spec.successCriteria = spec.successCriteria?.map(rewrite);
+    spec.backendTestLayout = layout;
+}
+/** Rewrite layout-dependent strings across a compiled frontend-test DAG spec. */
+function applyFrontendTestLayoutToDagSpec(spec, layout) {
+    if (layout.isDefault) {
+        spec.frontendTestLayout = layout;
+        return;
+    }
+    const rewrite = (value) => applyFrontendTestLayoutToText(value, layout);
+    for (const task of spec.tasks) {
+        task.subtask_prompt = rewrite(task.subtask_prompt);
+        if (task.outputContract)
+            task.outputContract = rewrite(task.outputContract);
+        task.writeSet = task.writeSet?.map(rewrite);
+        task.allowedPaths = task.allowedPaths?.map(rewrite);
+        task.forbiddenPaths = task.forbiddenPaths?.map(rewrite);
+        if (task.dynamicExpansion?.childTask) {
+            const child = task.dynamicExpansion.childTask;
+            if (typeof child.subtaskPromptTemplate === "string") {
+                child.subtaskPromptTemplate = rewrite(child.subtaskPromptTemplate);
+            }
+            if (typeof child.outputContract === "string") {
+                child.outputContract = rewrite(child.outputContract);
+            }
+            if (Array.isArray(child.allowedPaths)) {
+                child.allowedPaths = child.allowedPaths.map((entry) => typeof entry === "string" ? rewrite(entry) : entry);
+            }
+            if (Array.isArray(child.writeSet)) {
+                child.writeSet = child.writeSet.map((entry) => typeof entry === "string" ? rewrite(entry) : entry);
+            }
+            if (Array.isArray(child.forbiddenPaths)) {
+                child.forbiddenPaths = child.forbiddenPaths.map((entry) => typeof entry === "string" ? rewrite(entry) : entry);
+            }
+        }
+        if (task.shell?.commands) {
+            task.shell.commands = task.shell.commands.map(rewrite);
+        }
+    }
+    spec.globalConstraints = spec.globalConstraints?.map(rewrite);
+    spec.successCriteria = spec.successCriteria?.map(rewrite);
+    spec.frontendTestLayout = layout;
+}
+function allowedPathsCoverFrontendTestRoot(allowedPaths, testRoot) {
+    const probe = `${testRoot}/_layout_probe_`;
+    return allowedPaths.some((pattern) => pathMatchesPattern(testRoot, pattern) ||
+        pathMatchesPattern(probe, pattern));
+}
 // ---------------------------------------------------------------------------
 // Frontend browser-test RAG DAG template
 // ---------------------------------------------------------------------------
 function buildFrontendTestHybridDag(sources) {
     const rawFrontendTest = sources.taskConfig.frontendTest;
+    const layout = resolveFrontendTestLayout(rawFrontendTest);
     const config = {
         // Default 32: common FE suites cover ~24 AC with multi-dimension cases; 20 caused map maxExpandedNodes failures.
         maxCasesPerBatch: rawFrontendTest?.maxCasesPerBatch ?? 32,
@@ -4276,28 +4871,32 @@ function buildFrontendTestHybridDag(sources) {
     };
     const declaredRequirementIds = buildDagSourceBinding(sources).requirementIds;
     const declaredAcIds = declaredRequirementIds.filter((id) => /^AC(?:-[A-Z0-9]+)+$/i.test(id));
+    // Optional project-local UI anchor ledger: only mention it in prompts when it
+    // exists so ledger-less projects keep generating without noise.
+    const hasUiAnchorsLedger = Boolean(sources.repoRoot &&
+        existsSync(path.join(sources.repoRoot, layout.ragDir, "ui-anchors.md")));
+    const uiAnchorsLedgerInstruction = hasUiAnchorsLedger
+        ? `Also read ${layout.ragDir}/ui-anchors.md (UI anchor ledger). Every passing find assertion in generated cases must quote a ledger row whose 状态 is 有效 for the matching page x state section; rows marked 不可断言/失效 must not be used as passing assertions. When an AC names a control absent from the ledger section for that state, emit a blocked case note (blockedReason unique-control-unavailable) instead of exploratory find steps, and follow ledger 备注 alternatives (split-node short literals) exactly.`
+        : "";
     const reviewMode = config.reviewMode;
     const blockingReview = reviewMode === "blocking";
     const strictOutcomeGate = config.strictOutcomeGate;
     const maxRerunAttempts = config.maxRerunAttempts;
     const enableRetrospect = config.reports?.retrospect === true;
     const enableL5Report = config.reports?.l5 !== false;
-    const hasFrontendTestWriteScope = sources.taskConfig.allowedPaths.some((pattern) => pattern === "testcase/frontend/**" ||
-        pattern === "testcase/**" ||
-        pattern === "**");
-    if (!hasFrontendTestWriteScope) {
-        throw new Error('frontend-test requires task.json allowedPaths to include "testcase/frontend/**" (or an explicit containing glob).');
+    if (!allowedPathsCoverFrontendTestRoot(sources.taskConfig.allowedPaths, layout.testRoot)) {
+        throw new Error(`frontend-test requires task.json allowedPaths to cover "${layout.testRoot}/**" (or an explicit containing glob).`);
     }
     const forbidden = commonForbiddenPaths(sources);
-    const ragWriteSet = ["testcase/frontend/rag/**"];
+    const ragWriteSet = [`${layout.ragDir}/**`];
     const caseDraftWriteSet = [
-        "testcase/frontend/cases/FE-*.md",
-        "testcase/frontend/cases/index.md",
-        "testcase/frontend/cases/manifest.draft.json",
+        `${layout.casesDir}/FE-*.md`,
+        `${layout.casesDir}/index.md`,
+        `${layout.casesDir}/manifest.draft.json`,
     ];
     // The shell materializer alone owns the final manifest boundary.
-    const casesWriteSet = ["testcase/frontend/cases/**"];
-    const evidenceRoot = "testcase/frontend/evidence";
+    const casesWriteSet = [`${layout.casesDir}/**`];
+    const evidenceRoot = layout.evidenceDir;
     const declaredAcIdsLiteral = JSON.stringify(declaredAcIds);
     const maxCasesPerBatchLiteral = String(config.maxCasesPerBatch);
     const checklistScript = [
@@ -4316,6 +4915,8 @@ function buildFrontendTestHybridDag(sources) {
         "const caseIdRe=/^FE-[A-Za-z0-9][A-Za-z0-9-]*$/;",
         ,
         "const acIdRe=/^AC(?:-[A-Z0-9]+)+$/i;",
+        "const truncatedAcRe=/^AC-FE-[A-Z]+$/i;",
+        "const truncatedUndeclaredAcRe=/^(?:AC-\\d{3}|AC-FE-[A-Z]+)$/i;",
         "for(const c of manifest.cases){",
         " const id=c&&c.caseId||'?';",
         " if(typeof c.caseId!=='string'||!caseIdRe.test(c.caseId))issues.push({ruleId:'case-id-shape',caseId:id,detail:'caseId must be FE-<FEATURE>-<NNN>-<dimension>, never AC-FE-*'});",
@@ -4334,6 +4935,7 @@ function buildFrontendTestHybridDag(sources) {
         "   if(typeof ac!=='string'){issues.push({ruleId:'ac-id-shape',caseId:id,detail:String(ac)+' must look like AC-FE-001'});continue;}",
         "   if(/^FE-/i.test(ac)){issues.push({ruleId:'ac-id-is-case',caseId:id,detail:ac+' looks like caseId; acIds must be AC-*'});continue;}",
         "   if(!acIdRe.test(ac)){issues.push({ruleId:'ac-id-shape',caseId:id,detail:ac+' must look like AC-FE-001'});continue;}",
+        "   if(truncatedAcRe.test(ac)||(declaredAc.size===0&&truncatedUndeclaredAcRe.test(ac))){issues.push({ruleId:'ac-id-truncated',caseId:id,detail:ac+' is a truncated acceptance id (missing feature prefix or sequence number)'});continue;}",
         "   if(declaredAc.size>0&&!declaredAc.has(ac))issues.push({ruleId:'unknown-ac',caseId:id,detail:ac+' not in task sourceBinding.requirementIds'});",
         "  }",
         " }",
@@ -4365,6 +4967,8 @@ function buildFrontendTestHybridDag(sources) {
             `const declaredAc=new Set(${declaredAcIdsLiteral});`,
             "const seen=new Set(); const seenCasePath=new Set(); const seenEvidenceDir=new Set();",
             "const acIdRe=/^AC(?:-[A-Z0-9]+)+$/i;",
+            "const truncatedAcRe=/^AC-FE-[A-Z]+$/i;",
+            "const truncatedUndeclaredAcRe=/^(?:AC-\\d{3}|AC-FE-[A-Z]+)$/i;",
             "for(const c of manifest.cases){",
             " if(!c||typeof c.caseId!=='string'||!/^FE-[A-Za-z0-9][A-Za-z0-9-]*$/.test(c.caseId)) fail('case-id-shape','caseId must be FE-*, never AC-FE-*: '+String(c&&c.caseId));",
             " if(/^AC-/i.test(c.caseId)) fail('case-id-is-ac','caseId must not be an acceptance id: '+c.caseId);",
@@ -4372,7 +4976,7 @@ function buildFrontendTestHybridDag(sources) {
             " seen.add(c.caseId);",
             " if(typeof c.dimension!=='string'||!dims.has(c.dimension)) fail('invalid-dimension',String(c.dimension));",
             " if(!Array.isArray(c.acIds)||c.acIds.length===0||c.acIds.some(a=>typeof a!=='string'||!a.trim())) fail('ac-mapping','invalid acIds for '+c.caseId);",
-            " for(const ac of c.acIds){ if(!acIdRe.test(ac)) fail('ac-id-shape','acIds entry must be AC-* acceptance id, not caseId: '+ac); if(declaredAc.size>0&&!declaredAc.has(ac)) fail('unknown-ac',ac+' not in sourceBinding; repair generator input or AC list'); }",
+            " for(const ac of c.acIds){ if(!acIdRe.test(ac)) fail('ac-id-shape','acIds entry must be AC-* acceptance id, not caseId: '+ac); if(truncatedAcRe.test(ac)||(declaredAc.size===0&&truncatedUndeclaredAcRe.test(ac))) fail('ac-id-truncated','acIds entry is a truncated acceptance id (missing feature prefix or sequence number): '+ac); if(declaredAc.size>0&&!declaredAc.has(ac)) fail('unknown-ac',ac+' not in sourceBinding; repair generator input or AC list'); }",
             " c.casePath='testcase/frontend/cases/'+c.caseId+'.md';",
             " c.evidenceDir='testcase/frontend/evidence/'+c.caseId+'/';",
             " for(const k of ['casePath','evidenceDir']){ const v=c[k]; if(typeof v!=='string'||path.isAbsolute(v)||v.includes('..')) fail('unsafe-path',k+': '+String(v)); }",
@@ -4432,15 +5036,11 @@ function buildFrontendTestHybridDag(sources) {
             writeSet: ragWriteSet,
             allowedPaths: [...ragWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Write testcase/frontend/rag/standard-scenarios.v1.json for generate-time standard scenario coverage.",
-            subtask_prompt: "Prepare frontend-test package: materialize standard-scenarios.v1.json into the RAG package.",
+            outputContract: "Write testcase/frontend/rag/standard-scenarios.v1.json for generate-time standard scenario coverage. Copy docs/templates or harness.json governanceRoot templates (including ai_workspace/loop-agent/templates) when present; otherwise write the minimal STD-FE-SMOKE-ENTRY fallback.",
+            subtask_prompt: "Prepare frontend-test package: materialize standard-scenarios.v1.json into the RAG package from docs/templates, governanceRoot/templates, or the init-projected ai_workspace/loop-agent/templates path.",
             shell: {
-                commands: [
-                    [
-                        "node -e",
-                        JSON.stringify("const fs=require('fs'),path=require('path');const dest='testcase/frontend/rag/standard-scenarios.v1.json';const candidates=[path.join('docs','templates','frontend-test-standard-scenarios.v1.json')];let src=null;for(const c of candidates){if(fs.existsSync(c)){src=c;break;}}fs.mkdirSync(path.dirname(dest),{recursive:true});if(src){fs.copyFileSync(src,dest);process.stdout.write(JSON.stringify({status:'copied',from:src,to:dest}));}else{const minimal={schemaVersion:1,id:'frontend-test-standard-scenarios-v1',scenarios:[{id:'STD-FE-SMOKE-ENTRY',title:'入口可打开',category:'smoke',priority:'must',testPoints:['open'],minCases:1}]};fs.writeFileSync(dest,JSON.stringify(minimal,null,2)+'\n');process.stdout.write(JSON.stringify({status:'fallback',to:dest}));}"),
-                    ].join(" "),
-                ],
+                commands: [],
+                frontendTestStandardScenarios: {},
                 cwd: ".",
                 timeoutMs: 60_000,
             },
@@ -4476,15 +5076,11 @@ function buildFrontendTestHybridDag(sources) {
             writeSet: ragWriteSet,
             allowedPaths: [...ragWriteSet],
             forbiddenPaths: forbidden,
-            outputContract: "Fail-closed environment preflight: absolute non-production baseUrl + curl HTTP reachability; writes environmentProbe facts; unreachable => blockedReason frontend-base-url-unreachable (node ERROR so generate/map do not run).",
-            subtask_prompt: "Parse the resolved absolute baseUrl from testcase/frontend/rag/context.md, reject production/non-http(s)/credential/query/fragment URLs, then probe it with curl HEAD and GET fallback (connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. 4xx/5xx/DNS/timeout/connection refused/TLS => blockedReason frontend-base-url-unreachable. Missing curl => blockedReason curl-unavailable. Do not start the app. Fixture/reset remain soft guidance.",
+            outputContract: "Fail-closed environment preflight: absolute non-production baseUrl + curl HTTP reachability; writes environmentProbe facts; unreachable => blockedReason frontend-base-url-unreachable with errorClass (connection-refused / dns-unresolved / connect-timeout / http-N / curl-exit-N). Node ERROR so generate/map do not run. Does not start the app.",
+            subtask_prompt: "Parse the resolved absolute baseUrl from testcase/frontend/rag/context.md, reject production/non-http(s)/credential/query/fragment URLs, then probe it with curl HEAD and GET fallback (connect/max-time; no auth/cookie). 2xx/3xx => reachable and continue. Connection refused (curl 7) records errorClass=connection-refused and tells the operator to start the local app (scripts/serve.sh or npm start) then rerun from this node. 4xx/5xx/DNS/timeout/TLS => blockedReason frontend-base-url-unreachable with a distinct errorClass. Missing curl => blockedReason curl-unavailable. Do not start the app. Fixture/reset remain soft guidance.",
             shell: {
-                commands: [
-                    [
-                        "node -e",
-                        JSON.stringify(`const fs=require('fs');const {spawnSync}=require('child_process');const p='testcase/frontend/rag/context.md';const probePath='testcase/frontend/rag/environment-probe.json';function writeProbe(obj){try{fs.mkdirSync('testcase/frontend/rag',{recursive:true});fs.writeFileSync(probePath,JSON.stringify(obj,null,2)+'\\n');let ctx=fs.existsSync(p)?fs.readFileSync(p,'utf8'):'';const line='environmentProbe: '+obj.status+(obj.blockedReason?(' ('+obj.blockedReason+')'):'');if(/environmentProbe\\s*[:=]/i.test(ctx)){ctx=ctx.replace(/environmentProbe\\s*[:=]\\s*.*/i,line);}else{ctx=ctx.trimEnd()+'\\n\\n'+line+'\\n';}fs.writeFileSync(p,ctx);}catch(e){console.error('probe-write-failed',e&&e.message||e);}}function redactUrl(u){try{const x=new URL(u);x.username='';x.password='';if(x.search){x.search='';}return x.toString();}catch(_){return String(u).replace(/\\/\\/[^@\\s]+@/g,'//');}}function failBlocked(reason,extra){const payload=Object.assign({status:'unreachable',blockedReason:reason,baseUrlRedacted:extra&&extra.baseUrlRedacted||null,httpStatus:extra&&extra.httpStatus||null,method:extra&&extra.method||null,curlExit:extra&&extra.curlExit||null,errorClass:extra&&extra.errorClass||null},extra||{});writeProbe(payload);console.error('frontend-test preflight blocked: '+JSON.stringify({blockedReason:reason,baseUrl:payload.baseUrlRedacted,httpStatus:payload.httpStatus,errorClass:payload.errorClass}));throw new Error('frontend-test preflight blocked: '+reason);}if(!fs.existsSync(p))throw new Error('missing '+p);const s=fs.readFileSync(p,'utf8');const patterns=[/baseUrl\\s*[:=]\\s*["'\\x60]?((?:https?):\\/\\/[^\\s"'\\x60<>]+)/i,/base[-_ ]url\\s*[:=]\\s*["'\\x60]?((?:https?):\\/\\/[^\\s"'\\x60<>]+)/i,/playwright-cli open --browser=chrome\\s+((?:https?):\\/\\/[^\\s"'\\x60<>]+)/i,/(https?:\\/\\/(?:localhost|127\\.0\\.0\\.1)[^\\s)\\}\\],"']*)/i];let baseUrl=null;for(const re of patterns){const m=s.match(re);if(m){baseUrl=m[1];break;}}if(!baseUrl)throw new Error('frontend-test preflight missing absolute baseUrl from context.md');baseUrl=baseUrl.replace(/[)\\}\\],."'\\x60]+$/,'');const sourceMatch=s.match(/baseUrlSource\\s*[:=]\\s*([^\\r\\n]+)/i);const baseUrlSource=sourceMatch?sourceMatch[1].trim():'context.md';let parsed;try{parsed=new URL(baseUrl);}catch(_){throw new Error('baseUrl must be absolute http(s): '+baseUrl);}if((parsed.protocol!=='http:'&&parsed.protocol!=='https:')||parsed.username||parsed.password||parsed.search||parsed.hash)throw new Error('unsafe baseUrl from context.md: '+redactUrl(baseUrl));if(/(?:^|\\.)(?:www\\.)?[^.]*(?:prod|production)/i.test(parsed.hostname))throw new Error('production URL forbidden: '+redactUrl(baseUrl));baseUrl=parsed.toString();const safe=redactUrl(baseUrl);const curlCheck=spawnSync('curl',['--version'],{encoding:'utf8'});if(curlCheck.error||curlCheck.status!==0){failBlocked('curl-unavailable',{baseUrlRedacted:safe,errorClass:'curl-missing'});}function probe(method){const args=['-sS','-o','/dev/null','-w','%{http_code}','--connect-timeout','3','--max-time','8','-X',method,'-L','--max-redirs','3','--http1.1','--proto-redir','=http,https',safe];const r=spawnSync('curl',args,{encoding:'utf8'});return r;}let used='HEAD';let r=probe('HEAD');let code=String(r.stdout||'').trim();let statusNum=parseInt(code,10);const headRejected=r.status!==0||!statusNum||statusNum===405||statusNum===501;if(headRejected){used='GET';r=probe('GET');code=String(r.stdout||'').trim();statusNum=parseInt(code,10);}const ok=statusNum>=200&&statusNum<400;if(!ok){const errClass=r.error?'spawn-error':(r.status!==0?'curl-exit-'+r.status:('http-'+statusNum));failBlocked('frontend-base-url-unreachable',{baseUrlRedacted:safe,httpStatus:statusNum||null,method:used,curlExit:r.status,errorClass:errClass});}writeProbe({status:'reachable',blockedReason:null,baseUrl:safe,baseUrlRedacted:safe,baseUrlSource,httpStatus:statusNum,method:used,curlExit:r.status});console.log('frontend-test-execution-v1 validated contextBaseUrl='+safe+' source='+baseUrlSource+' probe=reachable method='+used+' httpStatus='+statusNum);`),
-                    ].join(" "),
-                ],
+                commands: [],
+                frontendTestEnvironmentProbe: {},
                 cwd: ".",
                 timeoutMs: 60000,
             },
@@ -4505,6 +5101,7 @@ function buildFrontendTestHybridDag(sources) {
             subtask_prompt: [
                 "Use skill playwright-cli-case-generator.",
                 "Read testcase/frontend/rag/standard-scenarios.v1.json and cover priority=must scenarios (or record GAP in coverage-map). Include ## 测试点 and ## 测试步骤 in each case.",
+                ...(uiAnchorsLedgerInstruction ? [uiAnchorsLedgerInstruction] : []),
                 "Read only testcase/frontend/rag/context.md, testcase/frontend/rag/coverage-map.md, and the draft case paths testcase/frontend/cases/FE-*.md, testcase/frontend/cases/index.md, and testcase/frontend/cases/manifest.draft.json. Write only those same draft paths. Do not write testcase/frontend/cases/manifest.json.",
                 "Generate Markdown cases, index.md and manifest.draft.json (schemaVersion 1; cases[] with caseId, casePath, dimension, acIds, evidenceDir).",
                 "HARD ID CONTRACT (do not confuse these):",
@@ -4664,7 +5261,7 @@ function buildFrontendTestHybridDag(sources) {
                 subtaskPromptTemplate: [
                     "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session; do not use /new). playwright-cli-only: never bare Playwright CLI/API/test runner; no fallback.",
                     "Use the structured playwright_cli tool for every browser action. Do not request or search for bash. Do not execute raw shell commands. Translate each playwright-cli line in the case Markdown into one playwright_cli tool call ({command, args?, timeoutSeconds?}).",
-                    "1) Read the concrete baseUrl from testcase/frontend/rag/context.md; it has already passed the environment shell safety/reachability gate. Start browser ONLY via playwright_cli command=open with args [--browser=chrome, <that-concrete-baseUrl>] (default session only; no -s=). 2) Dynamic refs: eX/eY in case Markdown are documentation placeholders, never tool args. Immediately before every structured playwright_cli call that references an element, parse the current real eNN from the immediately preceding latest snapshot and pass only that real eNN; never send literal `eX`/`eY`. A new snapshot invalidates prior refs, so never reuse stale refs. File outputs are canonical: screenshot args [--filename, final.png] (or [e5, --filename, final.png] for a real target), PDF args [--filename, final.pdf], and snapshot writes a file only with [--filename, snapshot.txt]; snapshot without filename is response-only. Never use --path, --output, --file, or any output path as a positional target. Follow case steps with snapshot before element refs using only playwright_cli. A passed case requires this same child receipt order: successful open → successful find → controller post-execution cleanup. Only successful find is a meaningful assertion; snapshot, goto, screenshot, request/console, click/fill and other ordinary interactions cannot establish passed authority. 3) Only when preflight or playwright_cli tool explicitly fails may you write blocked evidence (blockedReason playwright-cli-unavailable | frontend-base-url-unreachable); never invent CLI-unavailable solely because bash is absent. 4) For U/D: enforce current-user ownership / create-or-mock-or-blocked; never mutate other users' data.",
+                    "1) Read the concrete baseUrl from testcase/frontend/rag/context.md; it has already passed the environment shell safety/reachability gate. Start browser ONLY via playwright_cli command=open with args [--browser=chrome, <that-concrete-baseUrl>] (default session only; no -s=). 2) Dynamic refs: eX/eY in case Markdown are documentation placeholders, never tool args. Immediately before every structured playwright_cli call that references an element, parse the current real eNN from the immediately preceding latest snapshot and pass only that real eNN; never send literal `eX`/`eY`. A new snapshot invalidates prior refs, so never reuse stale refs. File outputs are canonical: screenshot args [--filename, final.png] (or [e5, --filename, final.png] for a real target), PDF args [--filename, final.pdf], and snapshot writes a file only with [--filename, snapshot.txt]; snapshot without filename is response-only. Never use --path, --output, --file, or any output path as a positional target. Follow case steps with snapshot before element refs using only playwright_cli. A passed case requires this same child receipt order: successful open → successful find → controller post-execution cleanup. Only successful find is a meaningful assertion; snapshot, goto, screenshot, request/console, click/fill and other ordinary interactions cannot establish passed authority. 3) Only when preflight or playwright_cli tool explicitly fails may you write blocked evidence (blockedReason playwright-cli-unavailable | frontend-base-url-unreachable); never invent CLI-unavailable solely because bash is absent. Unique-control early stop: when an AC names a specific control that is absent from the first post-navigation snapshot after reaching the required state (and no setup-required gate appeared), do ONE find with the case's literal as evidence; if it returns 0 matches, record status=blocked with blockedReason unique-control-unavailable citing that single find - do NOT re-explore with alternative literals, repeated snapshots, navigation detours, or rerun loops. 4) For U/D: enforce current-user ownership / create-or-mock-or-blocked; never mutate other users' data.",
                     "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId={{case.caseId}}, status passed|failed|blocked, evidencePaths (relative under evidenceDir). blocked needs non-empty blockedReason. After writing, self-check the same contract; if self-check fails, rewrite both files as status=blocked blockedReason=invalid-evidence-shape (never leave missing/malformed evidence).",
                     "Business failed/blocked is a recorded result, not a node failure. Close browser via playwright_cli command=close. Return compact JSON (<=1200 chars): {caseId,status,evidencePaths,errorSummary,tokens}.",
                 ].join("\n\n"),
@@ -4687,7 +5284,7 @@ function buildFrontendTestHybridDag(sources) {
             "const manifestPath='testcase/frontend/cases/manifest.json';",
             "if(!fs.existsSync(manifestPath)){process.stdout.write(JSON.stringify({cases:[]}));process.exit(0);}",
             "const manifest=JSON.parse(fs.readFileSync(manifestPath,'utf8'));const cases=[];",
-            "for(const c of (manifest.cases||[])){const evidenceDir=(c.evidenceDir||('testcase/frontend/evidence/'+c.caseId+'/')).replace(/\\/+$/,'')+'/';const resultPath=path.join(evidenceDir,'case-result.json');const execPath=path.join(evidenceDir,'execution.md');let reason=null;let attempt=0;let missing=false;if(!fs.existsSync(resultPath)){missing=true;reason='missing-result-files';}else{try{const r=JSON.parse(fs.readFileSync(resultPath,'utf8'));attempt=Number(r.rerunAttempt||0)||0;if(r.status==='blocked')reason='blocked';if(!r.status){missing=true;reason='missing-result-files';}}catch(_){missing=true;reason='missing-result-files';}}if(!fs.existsSync(execPath)&&reason!=='blocked'){missing=true;reason=reason||'missing-result-files';}const should=(reason==='blocked'||missing)&&attempt<" + String(round) + ";if(should){cases.push({caseId:c.caseId,casePath:c.casePath||('testcase/frontend/cases/'+c.caseId+'.md'),evidenceDir,dimension:c.dimension||'core',acIds:c.acIds||[],rerunAttempt:attempt+1,reason:reason||'blocked'});}}",
+            "for(const c of (manifest.cases||[])){const evidenceDir=(c.evidenceDir||('testcase/frontend/evidence/'+c.caseId+'/')).replace(/\\/+$/,'')+'/';const resultPath=path.join(evidenceDir,'case-result.json');const execPath=path.join(evidenceDir,'execution.md');let reason=null;let attempt=0;let missing=false;if(!fs.existsSync(resultPath)){missing=true;reason='missing-result-files';}else{try{const r=JSON.parse(fs.readFileSync(resultPath,'utf8'));attempt=Number(r.rerunAttempt||0)||0;if(r.status==='blocked')reason='blocked';if(r.status==='failed')reason='failed-retry';if(!r.status){missing=true;reason='missing-result-files';}}catch(_){missing=true;reason='missing-result-files';}}if(!fs.existsSync(execPath)&&reason!=='blocked'){missing=true;reason=reason||'missing-result-files';}const should=(reason==='blocked'||reason==='failed-retry'||missing)&&attempt<" + String(round) + ";if(should){cases.push({caseId:c.caseId,casePath:c.casePath||('testcase/frontend/cases/'+c.caseId+'.md'),evidenceDir,dimension:c.dimension||'core',acIds:c.acIds||[],rerunAttempt:attempt+1,reason:reason||'blocked'});}}",
             `fs.mkdirSync('testcase/frontend/evidence',{recursive:true});fs.writeFileSync('testcase/frontend/evidence/${candidateArtifact}',JSON.stringify({schemaVersion:1,cases},null,2)+'\\n');process.stdout.write(JSON.stringify({cases}));`,
         ].join("");
         tasks.push({
@@ -4755,6 +5352,7 @@ function buildFrontendTestHybridDag(sources) {
                         "RERUN attempt {{case.rerunAttempt}} for {{case.caseId}} (reason={{case.reason}}). Rewrite the authoritative execution.md and case-result.json; its final status replaces the earlier case result.",
                         "Primary job: EXECUTE case {{case.caseId}} from {{case.casePath}} with skill playwright-cli (fresh Pi session). Use structured playwright_cli only; headless open.",
                         "Read the concrete baseUrl from testcase/frontend/rag/context.md and start via playwright_cli command=open with args [--browser=chrome, <that-concrete-baseUrl>]. Passed requires open → find → cleanup receipts.",
+                        "Unique-control early stop: if the first post-navigation snapshot lacks the control an AC names (and no setup-required gate appeared), one find returning 0 matches is sufficient evidence - write status=blocked blockedReason unique-control-unavailable instead of exploratory retries.",
                         "Always write {{case.evidenceDir}}execution.md and {{case.evidenceDir}}case-result.json with caseId, status, evidencePaths, rerunAttempt={{case.rerunAttempt}}. Write fixed sections `### 执行摘要` and `### 实际执行步骤` to execution.md when available.",
                     ].join("\n\n"),
                 },
@@ -4890,6 +5488,7 @@ function buildFrontendTestHybridDag(sources) {
         verifyStrategy: resolveDagVerifyStrategy(sources.taskConfig),
         tasks,
     };
+    applyFrontendTestLayoutToDagSpec(spec, layout);
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
@@ -5928,7 +6527,7 @@ async function resolveTaskContractBindingForGenerate(sources) {
     }
     return synthesizeInMemoryTaskContractBinding(sources);
 }
-async function buildHybridDagForTemplate(sources, template) {
+async function buildHybridDagForTemplate(sources, template, options = {}) {
     const taskContractBinding = await resolveTaskContractBindingForGenerate(sources);
     let spec;
     if (template === "frontend-implementation") {
@@ -5952,6 +6551,13 @@ async function buildHybridDagForTemplate(sources, template) {
             spec = await buildSupervisedHybridDag(standard, sources);
     }
     applyProjectGovernanceReview(spec, template, sources);
+    // Backend implementation templates only (D1 outer gate): assign the two
+    // Pi extension buckets after all template-specific nodes exist.
+    if (template === "standard-dag" ||
+        template === "review-gated-dag" ||
+        template === "supervised-implementation") {
+        applyBackendPiExtensionBuckets(spec);
+    }
     // New generate path always emits DagSpec v4 + bindings.
     spec.version = 4;
     if (!spec.runtimeContract) {
@@ -5960,7 +6566,12 @@ async function buildHybridDagForTemplate(sources, template) {
     spec.sourceBinding = buildDagSourceBinding(sources);
     spec.taskContractBinding = taskContractBinding;
     assertNoGovernanceFlagOnDisallowedTemplate(spec, template);
-    parseDagSpec(spec);
+    if (template === "standard-dag" ||
+        template === "review-gated-dag" ||
+        template === "supervised-implementation") {
+        stampTargetTemplateTransientRetryProfile(spec);
+    }
+    spec = parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
 }
@@ -6011,6 +6622,36 @@ export async function buildHybridDagFromTask(sources, options = {}) {
 function cloneTask(task, patch = {}) {
     return { ...task, ...patch };
 }
+/**
+ * Backend-implementation Pi extension buckets (plan 2026-08-21 D3):
+ * - read side: every non-writer, non-closeout Pi node gets navigation
+ *   extensions (pi-codegraph + pi-lens);
+ * - write side: bounded writers get only pi-codegraph (pi-lens registers
+ *   ast_grep_replace, which can bypass the writeSet — not loading it is
+ *   simpler and safer than filtering after load);
+ * - everything else (closeout, shell, static, other templates) stays closed.
+ * Idempotent: never overwrites an explicit piExtensions a task declares.
+ */
+function applyBackendPiExtensionBuckets(spec) {
+    for (const task of spec.tasks) {
+        if (task.piExtensions !== undefined)
+            continue;
+        if (task.executor !== "pi")
+            continue;
+        if (task.id === "closeout-pi")
+            continue;
+        task.piExtensions =
+            task.toolProfile === "write" ? ["pi-codegraph"] : ["pi-codegraph", "pi-lens"];
+    }
+}
+function stampTargetTemplateTransientRetryProfile(spec) {
+    for (const task of spec.tasks) {
+        if (isTargetTemplateImplementPi(task) ||
+            isCanonicalFinalVerifyShellRetryCandidate(task)) {
+            task.transientRetryProfile = TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE;
+        }
+    }
+}
 /**
  * Apply default Pi retry policies to generated DAG nodes:
  * - safe read-only planner/scout/reviewer/verifier/supervisor/closeout
@@ -6031,6 +6672,10 @@ function applyDefaultReadOnlyRetryPolicy(spec) {
                     : DEFAULT_READ_ONLY_PI_RETRY_POLICY;
             continue;
         }
+        if (isTargetTemplateImplementPi(task)) {
+            task.retryPolicy = TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY;
+            continue;
+        }
         if (isWriterTransportRetryCandidate(task)) {
             task.retryPolicy = WRITER_TRANSPORT_RETRY_POLICY;
         }
@@ -6214,6 +6859,12 @@ function buildGovernanceStandardGateNode(sources) {
             verdictGate: {
                 fromNodeId: "verify-pi",
                 accept: ["VERDICT: pass"],
+                // A legitimate request-revision is a convergence routing result only
+                // when the task actually has a bounded fix loop. Without that loop the
+                // gate must fail closed instead of letting closeout run.
+                ...((sources.taskConfig.maxFixLoops ?? 0) > 0
+                    ? { routingAccept: ["VERDICT: request-revision"] }
+                    : {}),
                 label: "governance-standard",
                 lineMode: "first-verdict-line",
             },
@@ -6239,6 +6890,33 @@ function insertGovernanceStandardGate(spec, sources) {
     spec.tasks.splice(closeoutIndex, 0, gate);
     closeout.depends_on = ["governance-standard-gate-shell"];
     closeout.failureAwareDependsOn = ["governance-standard-gate-shell"];
+    // Governance verify convergence: when the task's bounded-repair budget
+    // allows it, a legitimate verify-pi `request-revision` re-enters a bounded
+    // implement-repair loop (see convergence controller) instead of terminating
+    // the run at the gate. The gate routes `request-revision` as a non-error
+    // result so closeout stays failure-aware rather than cascade-skipped.
+    const maxFixLoops = sources.taskConfig.maxFixLoops ?? 0;
+    if (maxFixLoops > 0) {
+        // verify-shell exists only when the task planned final verify commands;
+        // build the chain from nodes this spec actually contains so
+        // hasConvergenceChain never rejects the governance shape.
+        const governanceChainIds = [
+            "implement-pi",
+            ...(spec.tasks.some((task) => task.id === "verify-shell")
+                ? ["verify-shell"]
+                : []),
+            "verify-pi",
+            "governance-standard-gate-shell",
+        ];
+        spec.convergence = {
+            enabled: true,
+            maxPasses: maxFixLoops + 1,
+            stopOnVerdictPass: true,
+            stopOnHardVerifyPass: true,
+            pauseOnRegression: sources.taskConfig.convergence?.pauseOnRegression ?? true,
+            chainNodeIds: governanceChainIds,
+        };
+    }
 }
 function buildReviewGatedHybridDag(standard, sources) {
     const spec = {
@@ -6258,6 +6936,7 @@ function buildReviewGatedHybridDag(standard, sources) {
     }));
     spec.tasks.splice(spec.tasks.length - 1, 0, buildReviewNode(sources), buildReviewVerdictRecoveryNode(sources), buildReviewGateNode(sources));
     applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
+    stampTargetTemplateTransientRetryProfile(spec);
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
@@ -6589,6 +7268,9 @@ async function buildHardVerifyNode(sources) {
         forbiddenPaths: commonForbiddenPaths(sources),
         outputContract: "Archived hard verification stdout/stderr with exit codes; no worktree writes.",
         subtask_prompt: "Run hard verification after repair round.",
+        transientRetryProfile: sources.verifyCommands && commands.length > 0
+            ? TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE
+            : undefined,
         shell: {
             commands,
             verifyEvidence: buildVerifyEvidence({
@@ -6759,6 +7441,7 @@ async function buildSupervisedHybridDag(standard, sources) {
         ],
     };
     applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
+    stampTargetTemplateTransientRetryProfile(spec);
     applyDefaultReadOnlyRetryPolicy(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
@@ -6789,6 +7472,11 @@ export async function writeHybridDagDraft(sources, outputPath, options = {}) {
         ? await prepareFrontendMockSources(sources, routingProjectCapability)
         : sources;
     const spec = await buildHybridDagForTemplate(preparedSources, template);
+    if (options.rerunFeedback) {
+        spec.rerunFeedback = bindDagRerunFeedback(options.rerunFeedback, spec);
+        parseDagSpec(spec);
+        assertValidDagSpec(spec);
+    }
     if (preparedSources.repoRoot && dagHasWriterExecution(spec)) {
         await requireManagedTaskContractBinding({
             repoRoot: preparedSources.repoRoot,
@@ -6816,5 +7504,6 @@ export async function initHybridDagFromTask(repoRoot, taskId, options = {}) {
     const outputPath = options.outputPath ?? getTaskPaths(repoRoot, taskId).dagDraftPath;
     return writeHybridDagDraft(sources, outputPath, {
         template: options.template,
+        rerunFeedback: options.rerunFeedback,
     });
 }