@tea-agent/loop-agent 0.41.1-beta.0 → 0.42.0-next.2

package/dist/workflows/dag/init-hybrid.js

@@ -1,20 +1,18 @@
 import { createHash } from "node:crypto";
 import { access, readdir, readFile, realpath } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
+import { deflateRawSync } from "node:zlib";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { assertValidDagSpec } from "./validate.js";
 import { DAG_AGENT_RUNTIME_PI_ONLY, DAG_REPAIR_WRITER_PROTOCOL_EXPLICIT_NODE_V1, DAG_RUNTIME_CONTRACT_SCHEMA_VERSION, DEFAULT_DAG_OUTPUT_LANGUAGE, DEFAULT_DAG_EXECUTOR_MODELS, parseDagSpec, } from "./types.js";
 import { bindDagRerunFeedback } from "./rerun-feedback.js";
 import { planMavenVerification, } from "../../verification/maven/index.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
-import { DEFAULT_OPENSPEC_GOVERNANCE_ROOT, DEFAULT_FRONTEND_SPEC_ROOTS, extractTaskSourceFrontendSpecPaths, } from "../../shared/openspec-spec.js";
-import { readFrontendSpecRegistry, scoreFrontendSpecCandidate, } from "../../task/frontend-project-capability.js";
+import { extractTaskSourceOpenspecPaths } from "../../shared/openspec-spec.js";
 import { BASELINE_FORBIDDEN_PATHS } from "./governance-constants.js";
-import { FRONTEND_READ_BUDGETS } from "./frontend-read-budgets.js";
 import { buildDecisionEnvelopePromptContract } from "./decision-envelope.js";
-import { DEFAULT_READ_ONLY_PI_RETRY_POLICY, FRONTEND_SCOUT_COMPLETENESS_RETRY_POLICY, PLANNER_OUTPUT_LIMIT_RETRY_POLICY, PROTOCOL_AWARE_PI_RETRY_POLICY, BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY, WRITER_TRANSPORT_RETRY_POLICY, FRONTEND_PLAN_LADDER_RETRY_POLICY, FRONTEND_REVIEW_TERMINAL_RETRY_POLICY, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY, isCanonicalFinalVerifyShellRetryCandidate, isSafeReadOnlyPiRetryCandidate, isTargetTemplateImplementPi, isWriterTransportRetryCandidate, } from "./retry-policy.js";
+import { DEFAULT_READ_ONLY_PI_RETRY_POLICY, PLANNER_OUTPUT_LIMIT_RETRY_POLICY, PROTOCOL_AWARE_PI_RETRY_POLICY, STRUCTURED_REQUIRED_PI_RETRY_POLICY, BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY, BACKEND_TEST_MARKDOWN_BINDING_RETRY_POLICY, WRITER_TRANSPORT_RETRY_POLICY, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY, isCanonicalFinalVerifyShellRetryCandidate, isSafeReadOnlyPiRetryCandidate, isTargetTemplateImplementPi, isWriterTransportRetryCandidate, } from "./retry-policy.js";
 import { REVIEW_JSON_VERDICT_OUTPUT_PROTOCOL, REVIEW_VERDICT_OUTPUT_PROTOCOL, } from "./output-protocol.js";
 import { resolveAdapter } from "../../adapters/index.js";
 import { loadHarnessManifest } from "../../governance/harness.js";
@@ -22,7 +20,7 @@ import { mergeDocumentIndexCompanions } from "../../governance/document-index-cl
 import { buildAuthoritySurfaceAuditNode, buildAuthoritySurfaceGateNode, resolveAuthoritySurfaceAudit, } from "./authority-surface.js";
 import { applySddEmbeddedEnhancements, probeRepoLocalSddSkills, } from "./sdd-embedded.js";
 import { discoverProjectGovernancePresence } from "./project-governance-context.js";
-import { CANONICAL_TASK_ID_PATTERN, getTaskPaths, loadTaskConfig } from "../../task/runtime.js";
+import { getTaskPaths, loadTaskConfig } from "../../task/runtime.js";
 import { materializeTaskReferenceDocs } from "../../task/source-references.js";
 import { observeTaskContract } from "../../task/contract/observe.js";
 import { extractRequirementFactsFromMarkdown } from "../../task/source-prepare/parse-intent.js";
@@ -39,10 +37,8 @@ import { buildBackendTestOutcomeGateShellSnippet } from "./backend-test-result-c
 import { buildBackendTestIntakeContext } from "./backend-test-intake-context.js";
 import { buildFrontendTestOutcomeGateShellSnippet } from "./frontend-test-result-contract.js";
 import { classifyFrontendRisk, } from "./frontend-risk.js";
-import { discoverFrontendProjectCapability, resolveFrontendSpecRootAliases, } from "./frontend-project-capability.js";
-import { buildFrontendImplementationContractSkeleton, } from "./frontend-implementation-contract.js";
-import { computeFrontendShapeSourceDigest, parseFrontendShapeTransitionCapsule, resolveFrontendTaskShape, } from "./frontend-shape.js";
-import { discoverLatestCommittedFrontendShapeCapsule } from "./frontend-shape-capsule-store.js";
+import { discoverFrontendProjectCapability, } from "./frontend-project-capability.js";
+import { buildFrontendImplementationContractSkeleton, FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID, FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID, loadFrontendImplementationContractJsonSchema, } from "./frontend-implementation-contract.js";
 import { FRONTEND_NO_VERIFICATION_MARKER_TEXT } from "./frontend-verification-trace.js";
 import { serializeDagTaskSourcePath } from "../../task/dag-source-paths.js";
 const REQUIREMENT_FILE = "需求.md";
@@ -50,6 +46,60 @@ const CONSTRAINT_FILE = "执行约束.md";
 const REFERENCE_DIRECTORY = "references";
 const MAX_SOURCE_EXCERPT_CHARS = 2000;
 const MAX_INLINE_SOURCE_REFERENCE_DOCUMENTS = 8;
+/**
+ * Generation-time compiler for machine-declared structured artifacts. The
+ * frozen spec remains the sole runtime authority: this compiler never reads
+ * prompt/outputContract prose or workspace filenames, and historical specs
+ * loaded outside init-hybrid are left untouched.
+ */
+function stampGeneratedArtifactBindings(spec) {
+    const producedByNode = new Map();
+    for (const task of spec.tasks) {
+        if ((task.producesArtifacts?.length ?? 0) > 0) {
+            for (const artifact of task.producesArtifacts ?? []) {
+                producedByNode.set(task.id, artifact.artifactId);
+            }
+            continue;
+        }
+        const gate = task.shell?.jsonArtifactGate;
+        const structured = task.structuredContractOutput;
+        if (!gate && !structured)
+            continue;
+        const artifactId = `${task.id}.structured-output`;
+        const path = gate
+            ? `${gate.outputDir}/${gate.artifactName}`
+            : `contracts/candidates/${task.id}/canonical-contract.json`;
+        task.producesArtifacts = [
+            {
+                artifactId,
+                kind: "structured",
+                path,
+                mediaType: "application/json",
+                schemaId: gate?.schemaId ?? FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID,
+                revisionPolicy: "replace-file",
+            },
+        ];
+        producedByNode.set(task.id, artifactId);
+    }
+    for (const task of spec.tasks) {
+        const existing = new Set((task.consumesArtifacts ?? []).map((binding) => binding.artifactId));
+        const generated = task.depends_on.flatMap((parentNodeId) => {
+            const artifactId = producedByNode.get(parentNodeId);
+            if (!artifactId || existing.has(artifactId))
+                return [];
+            existing.add(artifactId);
+            return [
+                {
+                    artifactId,
+                    required: task.dependsPolicy !== "all-or-condition-skip",
+                },
+            ];
+        });
+        if (generated.length > 0) {
+            task.consumesArtifacts = [...(task.consumesArtifacts ?? []), ...generated];
+        }
+    }
+}
 const INTERACTIVE_UI_DELIVERY_CONTRACT = [
     "[INTERACTIVE_UI_DELIVERY_CONTRACT]",
     "This is an interactive UI delivery task.",
@@ -104,9 +154,7 @@ const FRONTEND_SKILLS_BY_ROLE = {
     verifier: [],
     closeout: [],
 };
-const FRONTEND_CONTRACT_SKILLS = ["frontend-contract"];
-const FRONTEND_SCOUT_SKILLS = ["frontend-scout"];
-const FRONTEND_PLAN_SKILLS = ["frontend-plan"];
+const FRONTEND_IMPLEMENTATION_SKILLS = ["frontend-implementation"];
 const FRONTEND_BOUNDED_IMPLEMENT_SKILLS = ["frontend-bounded-implement"];
 const FRONTEND_DESIGN_REVIEW_SKILLS = ["frontend-design-review"];
 const FRONTEND_REVIEW_SKILLS = ["frontend-review"];
@@ -227,28 +275,6 @@ async function hasDirectDependency(repoRoot, depName) {
         return false;
     }
 }
-/**
- * Collect the project's declared direct dependencies (dependencies +
- * devDependencies names) from package.json. Used to freeze the frontend
- * design-policy allowedDependencies set: the model's dependency policy must
- * not be rejected for mentioning an already-declared dependency, and a
- * dependency not present in the manifest is a genuine unauthorized addition.
- * Returns [] when package.json is unreadable (no allowlist → the dependency
- * check is skipped rather than rejecting prose tokens).
- */
-async function collectDeclaredDependencies(repoRoot) {
-    try {
-        const raw = await readFile(path.join(repoRoot, "package.json"), "utf-8");
-        const pkg = JSON.parse(raw);
-        return [
-            ...Object.keys(pkg.dependencies ?? {}),
-            ...Object.keys(pkg.devDependencies ?? {}),
-        ];
-    }
-    catch {
-        return [];
-    }
-}
 /** Check whether handler/fixture/bootstrap files exist for known mock frameworks. */
 async function discoverMockHandlerFiles(repoRoot, serviceRoot) {
     const exactCandidates = [
@@ -1678,10 +1704,7 @@ function buildBackendTestAnalysisSourceBindingContract(sources) {
         requirementIds: binding.requirementIds,
     };
 }
-function buildSourceContextBlock(sources, options = {}) {
-    const includeRequirementExcerpt = options.includeRequirementExcerpt ?? true;
-    const includeConstraintExcerpt = options.includeConstraintExcerpt ?? true;
-    const includeReferenceDocuments = options.includeReferenceDocuments ?? true;
+function buildSourceContextBlock(sources) {
     const requirementRef = toDagSourcePath(sources, sources.requirementPath);
     const requirementExcerpt = excerptMarkdown(sources.requirementMarkdown, {
         sourceRef: requirementRef,
@@ -1690,7 +1713,7 @@ function buildSourceContextBlock(sources, options = {}) {
     const parts = [
         `## Task source: 需求.md`,
         `Bound readPath (use for Pi read-tool calls): ${requirementRef}`,
-        ...(includeRequirementExcerpt ? [requirementExcerpt.text] : []),
+        requirementExcerpt.text,
     ];
     if (sources.constraintMarkdown) {
         const constraintRef = toDagSourcePath(sources, sources.constraintPath);
@@ -1698,11 +1721,9 @@ function buildSourceContextBlock(sources, options = {}) {
             sourceRef: constraintRef,
         });
         boundReadPaths.push(`- constraints: ${constraintRef}`);
-        parts.push("## Task source: 执行约束.md", `Bound readPath (use for Pi read-tool calls): ${constraintRef}`, ...(includeConstraintExcerpt ? [constraintExcerpt.text] : []));
+        parts.push("## Task source: 执行约束.md", `Bound readPath (use for Pi read-tool calls): ${constraintRef}`, constraintExcerpt.text);
     }
-    for (const reference of (includeReferenceDocuments
-        ? sources.referenceDocuments ?? []
-        : []).slice(0, MAX_INLINE_SOURCE_REFERENCE_DOCUMENTS)) {
+    for (const reference of (sources.referenceDocuments ?? []).slice(0, MAX_INLINE_SOURCE_REFERENCE_DOCUMENTS)) {
         const relativePath = path
             .relative(path.join(sources.taskDir, "source"), reference.path)
             .replaceAll(path.sep, "/");
@@ -1833,16 +1854,6 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
     catch (error) {
         throw new Error(`failed to load verification commands for task "${taskId}": ${error instanceof Error ? error.message : String(error)}`);
     }
-    const frontendShapeTransitionCapsule = taskConfig.taskKind === "frontend-implementation" && CANONICAL_TASK_ID_PATTERN.test(taskId)
-        ? await discoverLatestCommittedFrontendShapeCapsule({
-            repoRoot,
-            taskId,
-            sourceDigest: computeFrontendShapeSourceDigest({
-                requirementMarkdown,
-                constraintMarkdown: constraintMarkdown ?? "",
-            }),
-        })
-        : undefined;
     const sources = {
         taskId,
         repoRoot,
@@ -1859,7 +1870,6 @@ export async function loadTaskHybridSources(repoRoot, taskId) {
         verifyCommands,
         sddEmbeddedSkills: await probeRepoLocalSddSkills(repoRoot),
         projectGovernancePresent: await discoverProjectGovernancePresence(repoRoot),
-        ...(frontendShapeTransitionCapsule ? { autoloadedFrontendShapeTransitionCapsule: frontendShapeTransitionCapsule } : {}),
     };
     return sources;
 }
@@ -1877,9 +1887,7 @@ async function prepareFrontendMockSources(sources, discoveredProjectCapability)
         }
     }
     const projectCapability = discoveredProjectCapability ??
-        (await discoverFrontendProjectCapability(repoRoot, {
-            specRoots: sources.taskConfig.frontendOpenspec?.specRoots,
-        }));
+        (await discoverFrontendProjectCapability(repoRoot));
     const frontendRisk = classifyFrontendRisk({
         title: sources.taskConfig.title,
         requirementMarkdown: sources.requirementMarkdown,
@@ -1990,7 +1998,6 @@ export function buildStandardHybridDagFromTask(sources) {
                 executor: "pi",
                 complexity: "MED",
                 writePolicy: "read-only",
-                readBudget: FRONTEND_READ_BUDGETS.contract,
                 allowedPaths: taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"],
                 forbiddenPaths,
                 outputContract: "Plain Markdown implementation contract (10 lines or fewer); no file writes.",
@@ -2007,7 +2014,6 @@ export function buildStandardHybridDagFromTask(sources) {
                 executor: "pi",
                 complexity: scoutComplexity,
                 writePolicy: "read-only",
-                readBudget: FRONTEND_READ_BUDGETS.scout,
                 allowedPaths: scoutPaths.srcPaths,
                 forbiddenPaths,
                 outputContract: "Plain Markdown source reconnaissance summary; no file writes.",
@@ -2024,7 +2030,6 @@ export function buildStandardHybridDagFromTask(sources) {
                 executor: "pi",
                 complexity: scoutComplexity,
                 writePolicy: "read-only",
-                readBudget: FRONTEND_READ_BUDGETS.plan,
                 allowedPaths: scoutPaths.testPaths,
                 forbiddenPaths,
                 outputContract: "Plain Markdown test coverage reconnaissance summary; no file writes.",
@@ -2124,6 +2129,7 @@ export function buildStandardHybridDagFromTask(sources) {
     applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
     stampTargetTemplateTransientRetryProfile(spec);
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -2144,7 +2150,7 @@ function buildFrontendMockAssessNode(sources, sourceContext, mockContextBlock, f
         writePolicy: "read-only",
         allowedPaths: readOnlyPaths,
         forbiddenPaths,
-        skills: FRONTEND_PLAN_SKILLS,
+        skills: FRONTEND_IMPLEMENTATION_SKILLS,
         firstProtocolLine: "MOCK_STRATEGY:",
         outputContract: "Plain Markdown whose first line is MOCK_STRATEGY: native|browser-intercept|request-adapter|not-needed|blocked, followed by Mock Decision, API Contract Evidence, Specification Evidence, Service Evidence, Backend Readiness, Selection Evidence, Endpoint / Fixture Matrix, Activation, Target Files, Production Safety, Verification Plan, Real Integration Gap, and Blocking Issues. No file writes.",
         subtask_prompt: [
@@ -2329,6 +2335,7 @@ function buildBlockedFrontendMockDag(sources, readOnlyPaths, forbiddenPaths, glo
         ],
     };
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -2391,181 +2398,40 @@ function frontendMockStrategyMustBeNotNeeded(sources) {
             capabilityStatus === "ambiguous" ||
             !hasDeterministicMockVerification));
 }
-/**
- * 候选规范懒加载：prompt 只内联与任务相关的候选，不全部塞给模型。
- *
- * - mandatory（任务源显式声明/引用）始终保留——模型必须知道它们存在。
- * - scan-strict 候选按「路径段是否命中任务源关键词」过滤：列表页任务只
- *   带出列表相关组件/页面规范，创建页规范不进 prompt。
- * - runtime 的选型/read 门禁仍消费完整 openspecCandidatePaths（prewrite
- *   gate 用全量）；这里只缩小 prompt 体积，不改变门禁语义。未提及的候选
- *   由 runtime 默认 irrelevant，模型无需枚举。
- * - 真正读取发生在 plan 侧：模型对 required 选型调用 read 工具，prewrite
- *   门禁验证 read 事件——按需读取，不预加载正文。
- */
-export function filterRelevantOpenspecCandidates(input) {
-    const mandatory = new Set(input.mandatoryPaths);
-    const relevant = [];
-    for (const candidate of input.candidates) {
-        if (mandatory.has(candidate)) {
-            relevant.push(candidate);
-            continue;
-        }
-        if (openspecCandidateMatchesSource(candidate, input.sourceMarkdown)) {
-            relevant.push(candidate);
-        }
-    }
-    // 保持候选发现顺序（确定性）；mandatory 与相关候选都按原始顺序出现。
-    const maxCandidates = input.maxCandidates ?? 24;
-    if (relevant.length <= maxCandidates)
-        return relevant;
-    const mandatoryRelevant = relevant.filter((candidate) => mandatory.has(candidate));
-    const optionalRelevant = relevant.filter((candidate) => !mandatory.has(candidate));
-    return [
-        ...mandatoryRelevant,
-        ...optionalRelevant.slice(0, Math.max(0, maxCandidates - mandatoryRelevant.length)),
-    ];
-}
-function buildFrontendSpecCandidateSummaries(input) {
-    const mandatory = new Set(input.mandatoryPaths);
-    return input.paths
-        .map((candidate) => scoreFrontendSpecCandidate(candidate, "", {
-        registryMode: input.registryModes.get(candidate),
-        taskRelated: mandatory.has(candidate) || openspecCandidateMatchesSource(candidate, input.sourceMarkdown),
-    }))
-        .sort((a, b) => b.score - a.score || a.path.localeCompare(b.path));
-}
-/**
- * 候选路径是否与任务源相关：从任务源提取文件名/路径 token（去扩展名、
- * 去连字符/下划线），若候选的路径段包含任一 token 即视为相关。纯字符串
- * 判定，无 IO；找不到 token 时保守保留（避免漏掉模型可能需要的规范）。
- */
-function openspecCandidateMatchesSource(candidate, sourceMarkdown) {
-    const sourceTokens = extractOpenspecSourceTokens(sourceMarkdown);
-    if (sourceTokens.size === 0)
-        return true;
-    const candidateLower = candidate.toLowerCase().replace(/\\/g, "/");
-    const candidateSegments = candidateLower.split("/");
-    const candidateBasename = candidateSegments[candidateSegments.length - 1] ?? "";
-    for (const token of sourceTokens) {
-        if (candidateBasename.includes(token) ||
-            candidateLower.includes(`/${token}/`) ||
-            candidateLower.includes(`${token}.`)) {
-            return true;
-        }
-    }
-    return false;
-}
-/** 从任务源 markdown 提取显著 token：反引号代码段、路径、组件/页面名。 */
-function extractOpenspecSourceTokens(markdown) {
-    const tokens = new Set();
-    const push = (raw) => {
-        const cleaned = raw
-            .trim()
-            .replace(/[.*+?^${}()|[\]\\]/g, "")
-            .toLowerCase();
-        if (cleaned.length >= 2 && cleaned.length <= 40)
-            tokens.add(cleaned);
-    };
-    // 反引号内联代码（文件名/组件名）
-    for (const match of markdown.matchAll(/`([^`\n]+)`/g)) {
-        push(match[1] ?? "");
-    }
-    // markdown 链接文本
-    for (const match of markdown.matchAll(/\[([^\]]+)\]\([^)]+\)/g)) {
-        push(match[1] ?? "");
-    }
-    // 路径 token（openspec/ 或 xxx/xxx.md）
-    for (const match of markdown.matchAll(/(?:[A-Za-z0-9_-]+\/)+[A-Za-z0-9_.-]+/g)) {
-        const segments = (match[0] ?? "").split("/");
-        const basename = segments[segments.length - 1] ?? "";
-        push(basename.replace(/\.[a-z0-9]+$/i, ""));
-        for (const segment of segments)
-            push(segment);
-    }
-    return tokens;
-}
-async function resolveFrontendOpenspecGateConfig(sources) {
+function resolveFrontendOpenspecGateConfig(sources) {
     const taskConfig = sources.taskConfig;
     const policy = taskConfig.frontendOpenspec?.policy ?? "cited";
     const declared = taskConfig.frontendOpenspec?.requiredReadPaths ?? [];
-    const governanceRoot = sources.frontendProjectCapability?.openspecDiscovery?.governanceRoot ??
-        DEFAULT_OPENSPEC_GOVERNANCE_ROOT;
-    const specRoots = taskConfig.frontendOpenspec?.specRoots ?? DEFAULT_FRONTEND_SPEC_ROOTS;
-    const rootAliases = sources.repoRoot
-        ? await resolveFrontendSpecRootAliases(sources.repoRoot, [...specRoots])
-        : [];
-    const remappedSourceMarkdown = rootAliases.reduce((markdown, { alias, logicalRoot }) => markdown.replace(new RegExp(`(^|[^A-Za-z0-9_.-])${alias.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/`, "g"), `$1${logicalRoot}/`), [sources.requirementMarkdown, sources.constraintMarkdown ?? ""].join("\n"));
-    const taskSourceCited = extractTaskSourceFrontendSpecPaths(remappedSourceMarkdown, specRoots, governanceRoot);
+    const taskSourceCited = extractTaskSourceOpenspecPaths([sources.requirementMarkdown, sources.constraintMarkdown ?? ""].join("\n"));
     const scanStrict = sources.frontendProjectCapability?.designEvidence.normativePaths ?? [];
-    const registry = sources.repoRoot
-        ? await readFrontendSpecRegistry(sources.repoRoot)
-        : null;
-    const registryModes = new Map();
-    for (const root of registry?.roots ?? []) {
-        if (root.scope && !root.scope.includes("frontend"))
-            continue;
-        if (!root.mode)
-            continue;
-        for (const candidate of scanStrict) {
-            if (candidate === root.path || candidate.startsWith(`${root.path}/`)) {
-                registryModes.set(candidate, root.mode);
-            }
-        }
-    }
     const dedupeSorted = (paths) => [...new Set(paths)].sort();
     const openspecCandidateSources = {
         declared: dedupeSorted(declared),
         taskSourceCited: dedupeSorted(taskSourceCited),
         scanStrict: dedupeSorted(scanStrict),
     };
-    // Candidate discovery is frozen independently from the eventual must-read
-    // set. The selector may mark candidates irrelevant, while explicit task
-    // declarations/source citations are never allowed to be downgraded.
-    const openspecMandatoryPaths = dedupeSorted([
-        ...declared,
-        ...taskSourceCited,
-    ]);
-    // `cited` must stay demand-driven: a normative registry makes a path
-    // discoverable, not implicitly task-mandatory. Only scan-strict may offer
-    // the global discovery set to the bounded task-relevance selector.
     const openspecCandidatePaths = policy === "cited"
-        ? openspecMandatoryPaths
-        : dedupeSorted([
-            ...openspecCandidateSources.scanStrict,
-            ...openspecMandatoryPaths,
-        ]);
-    const result = {
+        ? dedupeSorted([...declared, ...taskSourceCited])
+        : openspecCandidateSources.scanStrict;
+    return {
         openspecPolicy: policy,
         openspecCandidatePaths,
         openspecCandidateSources,
-        openspecMandatoryPaths,
-        openspecCandidateSummaries: buildFrontendSpecCandidateSummaries({
-            paths: openspecCandidatePaths,
-            mandatoryPaths: openspecMandatoryPaths,
-            registryModes,
-            sourceMarkdown: [sources.requirementMarkdown, sources.constraintMarkdown ?? ""].join("\n"),
-        }),
     };
-    if (sources.repoRoot && openspecCandidatePaths.length > 0) {
-        result.openspecCandidateSnapshots = await Promise.all(openspecCandidatePaths.map(async (candidate) => ({
-            path: candidate,
-            sha256: createHash("sha256")
-                .update(await readFile(path.join(sources.repoRoot, candidate)))
-                .digest("hex"),
-        })));
-    }
-    return result;
 }
+const openspecCitationInstruction = [
+    "OpenSpec 引用块（citation block）：在 fenced json 契约块之后，追加**恰好一个** ```openspec-citations 围栏代码块（三反引号 + openspec-citations）。",
+    '该块内每行一个 JSON 对象 {"path":"<repo 相对 openspec 路径>","section":"<命中章节或空串>","line":<int 或 null>}，必须逐条列出你在本计划中实际读取并应用的每个 openspec 规范文件。',
+    "prewrite gate 会用真实 read 事件核验每条引用：引用存在但无成功 read 事件 → openspec-citation-not-read；契约冻结的必读候选未被引用 → openspec-not-cited；两者都 fail-closed。不要引用未读取的路径。",
+].join("\n");
 const frontendComponentConformanceInstruction = [
     "## Component Selection conformance (uiComponentChoices; hard rule)",
     "每个 UI 用途必须在契约的 uiComponentChoices[] 中声明组件选型：{ purpose, component, decision, specReference, rationale }。",
-    "purpose is the stable coverage key：它应精确匹配 interaction.name 或 uiState.name；职责语义由对应 interaction.expectedBehavior / uiState.expectedBehavior 与 rationale 表达。不得仅因 purpose 与 interaction 或 component 标识符相同而判缺陷。",
     "- decision=specified：前端规范（候选组件/主题桶 + 任务源显式引用）已定义该用途组件 → 必须使用该组件，并给精确 specReference { path, section, line }（path 必须是 openspec/ai_workspace 受支持规范路径）。",
-    "- decision=reuse-existing：仅当该组件/惯例**确实已存在于仓库当前代码**（如复用现有 ActiveRunBadge 的 oc- class 惯例）→ specReference 可为 null，rationale 必须指明复用的具体现有组件/文件与依据。",
-    "- decision=new：任务源/PRD 要求**新增**该组件（仓库当前不存在该组件文件）→ decision 必须为 new，不得标 reuse-existing；调用 record_component_choice 时传 sourceRequirementIds（关联的 frozen requirement ID）与 plan checklist 列出的 sourceFragmentId，runtime 校验其隶属关系并物化精确的任务源 PRD { path, section, line }。不要读取 PRD 或手填/猜测 specReference；rationale 说明新增纯展示组件、复用既有 CSS 命名与主题变量约定。",
+    "- decision=reuse-existing：复用仓库既有组件/惯例（规范未点名）→ specReference 可为 null，rationale 说明复用的现有组件与依据。",
+    "- decision=new：规范与既有代码均无合适组件 → specReference 必须为 null，rationale 必须说明偏差理由（design-review 审，最终 review 复核）。",
     "不得静默替换规范组件或自创组件而无偏差声明；spec 已定义该用途组件时不得改选其它组件。",
-    "prewrite gate 确定性交叉校验：仅 decision=specified 的 specReference 必须是候选 OpenSpec 路径、在 typed decision ledger 中声明且有成功 read 事件；decision=new 的 PRD 引用走任务源可追溯性审查，不得按 OpenSpec 候选拒绝。候选桶非空且契约有 UI 可见工作而 uiComponentChoices 缺失/空 → component-choices-missing。",
+    "prewrite gate 确定性交叉校验：specReference.path 非法 → component-spec-reference-invalid；未在 openspec-citations 引用块中引用或未真实读取 → component-spec-not-cited；候选桶非空且契约有 UI 可见工作而 uiComponentChoices 缺失/空 → component-choices-missing。",
 ].join("\n");
 function resolveFrontendCapabilityContextBlock(sources) {
     const risk = sources.frontendRisk;
@@ -2579,7 +2445,34 @@ function resolveFrontendCapabilityContextBlock(sources) {
     }
     if (capability) {
         parts.push("", capability.adapterGuidance);
-        parts.push("Task-relevant OpenSpec candidates are injected separately as a bounded Top-K index. The deterministic prewrite gate retains the complete frozen candidate set; unlisted candidates are neither silently required nor evidence of a missing specification.");
+        const classified = capability.designEvidence.classified;
+        const bucketLines = [];
+        const pushBucket = (label, paths) => {
+            if (paths.length > 0)
+                bucketLines.push(`${label}: ${paths.join(", ")}`);
+        };
+        pushBucket("schemas", classified.schemas);
+        pushBucket("code-template", classified.codeTemplate);
+        pushBucket("rule.api", classified.rule.api);
+        pushBucket("rule.mock", classified.rule.mock);
+        pushBucket("rule.router", classified.rule.router);
+        pushBucket("rule.hooks", classified.rule.hooks);
+        pushBucket("rule.utils", classified.rule.utils);
+        pushBucket("rule.components", classified.rule.components);
+        pushBucket("rule.other", classified.rule.other);
+        pushBucket("theme", classified.theme);
+        pushBucket("component", classified.component);
+        pushBucket("ui-other", classified.uiOther);
+        pushBucket("advisory-other", classified.advisoryOther);
+        parts.push("## Classified openspec specification paths (role semantics)");
+        if (bucketLines.length > 0) {
+            parts.push(...bucketLines);
+        }
+        else {
+            parts.push("(no openspec specification paths discovered — greenfield)");
+        }
+        parts.push("component / theme / rule.components 是「组件/主题规范」必读语义桶：规范已定义某用途组件时必须使用它（uiComponentChoices 用 decision=specified + 精确 path/section/line），不得静默替换为自认更合适的组件；无规范定义时才允许 reuse-existing 或 new（new 必须声明偏差 rationale）。这些路径在生成期冻结为 prewrite gate 的 componentSpecCandidatePaths。");
+        parts.push("Each consuming node MUST report in its output: applicable rules, the hit path/section/line number for every applied specification, and any conflicts or missing specifications. Missing or conflicting required specifications must fail closed rather than silently substituting nearby repository conventions.");
         parts.push(`A11y capability: ${capability.a11y.status}` +
             (capability.a11y.tools.length
                 ? ` (${capability.a11y.tools.join(", ")})`
@@ -2588,102 +2481,17 @@ function resolveFrontendCapabilityContextBlock(sources) {
     }
     return parts.join("\n");
 }
-function pruneFrontendTasksForMicro(tasks) {
-    // Micro topology (7 nodes): contract-import-shell → writer-admission →
-    // implement → verify → review-context → review → closeout. Drops scout/plan/
-    // design-policy/design-review and replaces the model contract node with a
-    // deterministic contract-import shell (§7.3: no model, no requirement
-    // rewrites — micro consumes a pre-validated managed Contract).
-    const drop = new Set([
-        "frontend-contract-pi",
-        "frontend-scout-pi",
-        "frontend-plan-pi",
-        "frontend-design-policy-shell",
-        "frontend-design-review-pi",
-    ]);
-    const contractPi = tasks.find((task) => task.id === "frontend-contract-pi");
-    const contractImportShell = contractPi
-        ? {
-            id: "frontend-contract-import-shell",
-            role: "verifier",
-            executor: "shell",
-            complexity: "LOW",
-            writePolicy: "read-only",
-            depends_on: [],
-            allowedPaths: contractPi.allowedPaths,
-            forbiddenPaths: contractPi.forbiddenPaths,
-            subtask_prompt: "Deterministic managed-Contract import + source/binding/schema freshness re-validation; no model, no requirement rewrite.",
-            shell: {
-                commands: [],
-                frontendContractImport: {
-                    schemaVersion: 1,
-                    artifactName: "frontend-task-contract.json",
-                    outputDir: "contracts",
-                    requireSourceFreshness: true,
-                },
-                cwd: ".",
-                timeoutMs: 60000,
-            },
-        }
-        : undefined;
-    const filtered = [
-        ...(contractImportShell ? [contractImportShell] : []),
-        ...tasks.filter((task) => !drop.has(task.id)),
-    ];
-    const byId = new Map(filtered.map((task) => [task.id, task]));
-    const remap = (deps) => {
-        if (!deps)
-            return [];
-        const next = [];
-        for (const dep of deps) {
-            if (drop.has(dep))
-                continue;
-            if (byId.has(dep))
-                next.push(dep);
-        }
-        return [...new Set(next)];
-    };
-    return filtered.map((task) => {
-        const depends_on = remap(task.depends_on);
-        if (task.id === "frontend-writer-admission-shell") {
-            const admission = task.shell?.frontendWriterAdmission;
-            return {
-                ...task,
-                depends_on: ["frontend-contract-import-shell"],
-                shell: admission
-                    ? {
-                        ...task.shell,
-                        commands: task.shell?.commands ?? [],
-                        frontendWriterAdmission: {
-                            ...admission,
-                            designReviewFromNodeId: undefined,
-                        },
-                    }
-                    : task.shell,
-            };
-        }
-        return { ...task, depends_on };
-    });
-}
-function pruneFrontendTasksForSplitRequired(tasks) {
-    const writerChain = new Set([
-        "frontend-writer-admission-shell",
-        "frontend-implement-pi",
-        "frontend-verify-shell",
-        "frontend-review-context-shell",
-        "frontend-review-pi",
-        "frontend-closeout-shell",
-    ]);
-    return tasks.filter((task) => !writerChain.has(task.id));
-}
 function pruneFrontendTasksForRisk(tasks, risk) {
     if (risk.forceFullGates || risk.selectedRisk !== "small") {
         return tasks;
     }
-    // Small topology keeps one design review and removes only the redundant
-    // design-review node; the deterministic design-policy and writer-admission
-    // shells consume the surviving plan directly.
-    const drop = new Set(["frontend-design-review-pi"]);
+    // Small topology keeps one design review and removes only the conditional
+    // revision/final-review branch. The deterministic prewrite gate consumes the
+    // surviving plan and design review directly.
+    const drop = new Set([
+        "frontend-plan-revision-pi",
+        "frontend-final-design-review-pi",
+    ]);
     const filtered = tasks.filter((task) => !drop.has(task.id));
     const byId = new Map(filtered.map((task) => [task.id, task]));
     const remap = (deps) => {
@@ -2691,8 +2499,11 @@ function pruneFrontendTasksForRisk(tasks, risk) {
             return [];
         const next = [];
         for (const dep of deps) {
-            if (dep === "frontend-design-review-pi")
+            if (dep === "frontend-plan-revision-pi") {
+                if (byId.has("frontend-plan-pi"))
+                    next.push("frontend-plan-pi");
                 continue;
+            }
             if (byId.has(dep) || dep === "frontend-implement-pi")
                 next.push(dep);
         }
@@ -2700,27 +2511,30 @@ function pruneFrontendTasksForRisk(tasks, risk) {
     };
     return filtered.map((task) => {
         const depends_on = remap(task.depends_on);
-        if (task.id === "frontend-writer-admission-shell") {
-            // Small topology: no design review node, so the admission shell drops
-            // the design-review dependency and the verdict requirement.
-            const admission = task.shell?.frontendWriterAdmission;
+        if (task.id === "frontend-prewrite-gate-shell") {
+            const gate = task.shell?.frontendPrewriteGate;
             return {
                 ...task,
-                depends_on: ["frontend-design-policy-shell"],
-                shell: admission
+                depends_on: ["frontend-plan-pi", "frontend-design-review-pi"],
+                dependsPolicy: "all",
+                shell: gate
                     ? {
                         ...task.shell,
                         commands: task.shell?.commands ?? [],
-                        frontendWriterAdmission: {
-                            ...admission,
-                            designReviewFromNodeId: undefined,
+                        frontendPrewriteGate: {
+                            ...gate,
+                            planFromNodeId: "frontend-plan-pi",
+                            planFallbackFromNodeIds: [],
+                            reviewFromNodeId: "frontend-design-review-pi",
+                            reviewFallbackFromNodeIds: [],
+                            revisionPatch: false,
                         },
                     }
                     : task.shell,
             };
         }
         if (task.id === "frontend-implement-pi") {
-            for (const need of ["frontend-writer-admission-shell"]) {
+            for (const need of ["frontend-prewrite-gate-shell"]) {
                 if (byId.has(need) && !depends_on.includes(need))
                     depends_on.push(need);
             }
@@ -2745,54 +2559,9 @@ function buildFrontendWriterNodeDefaults(input) {
         allowedPaths: input.allowedPaths,
         forbiddenPaths: input.forbiddenPaths,
         skills: FRONTEND_BOUNDED_IMPLEMENT_SKILLS,
-        writerOutcomePolicy: {
-            type: input.writerOutcomePolicyType ?? "implementation-outcome-v1",
-        },
+        writerOutcomePolicy: { type: "implementation-outcome-v1" },
     };
 }
-function resolveFrontendShapeCapsuleGenerationInput(sources) {
-    const explicit = sources.frontendShapeTransitionCapsule == null
-        ? undefined
-        : parseFrontendShapeTransitionCapsule(sources.frontendShapeTransitionCapsule);
-    const autoloaded = sources.autoloadedFrontendShapeTransitionCapsule == null
-        ? undefined
-        : parseFrontendShapeTransitionCapsule(sources.autoloadedFrontendShapeTransitionCapsule);
-    if (explicit && autoloaded && explicit.capsuleDigest !== autoloaded.capsuleDigest) {
-        throw new Error("explicit frontend shape transition capsule conflicts with runtime autoload");
-    }
-    return explicit ?? autoloaded;
-}
-/** Standard frontend DAG template (docs/templates/frontend-implementation-dag.json).
- * It is the topology source of truth: node set, execution order, and depends_on
- * come from the template; the runtime generator assembles each node's full
- * configuration (budgets, retry, skeleton, skills, dynamic prompt sections).
- * Resolution order: repoRoot copy (dev workspace) → bundled package copy. */
-export async function loadFrontendDagTemplate(repoRoot) {
-    const candidates = [];
-    if (repoRoot) {
-        candidates.push(path.join(repoRoot, "docs", "templates", "frontend-implementation-dag.json"));
-    }
-    candidates.push(fileURLToPath(new URL("../../../docs/templates/frontend-implementation-dag.json", import.meta.url)));
-    for (const candidate of candidates) {
-        try {
-            const parsed = JSON.parse(await readFile(candidate, "utf8"));
-            if (!Array.isArray(parsed.tasks))
-                continue;
-            const tasks = parsed.tasks.filter((item) => typeof item === "object" &&
-                item !== null &&
-                typeof item.id === "string" &&
-                Array.isArray(item.depends_on) &&
-                typeof item.executor === "string");
-            if (tasks.length === 0)
-                continue;
-            return { tasks };
-        }
-        catch {
-            // try next candidate
-        }
-    }
-    return null;
-}
 async function buildFrontendHybridDagFromTask(sources) {
     const { taskConfig } = sources;
     const mockCapability = sources.frontendMockCapability ?? {
@@ -2817,11 +2586,6 @@ async function buildFrontendHybridDagFromTask(sources) {
     const implementId = frontendImplementationNodeId();
     const mockContextBlock = resolveFrontendMockContextBlock(frontendSources);
     const capabilityContextBlock = resolveFrontendCapabilityContextBlock(frontendSources);
-    // Freeze the design-policy dependency allowlist from the project manifest:
-    // already-declared deps are authorized; anything else in the model's
-    // dependency policy that looks like a package name is an unauthorized new
-    // dependency (fail-closed at the policy shell and the plan pre-check).
-    const declaredDependencies = await collectDeclaredDependencies(sources.repoRoot ?? process.cwd());
     const frontendRisk = frontendSources.frontendRisk ??
         classifyFrontendRisk({
             title: taskConfig.title,
@@ -2830,63 +2594,138 @@ async function buildFrontendHybridDagFromTask(sources) {
             allowedPaths: taskConfig.allowedPaths,
             complexity: taskConfig.complexity,
         });
-    const frontendTaskShape = resolveFrontendTaskShape({
-        complexity: taskConfig.complexity,
-        allowedPaths: taskConfig.allowedPaths,
-        requirementMarkdown: sources.requirementMarkdown,
-        constraintMarkdown: sources.constraintMarkdown ?? undefined,
-        splitSignal: { splitRequired: false, runtimeSupportsSplit: true },
-        taskId: sources.taskId,
-        sourceDigest: computeFrontendShapeSourceDigest({
-            requirementMarkdown: sources.requirementMarkdown,
-            constraintMarkdown: sources.constraintMarkdown ?? "",
-        }),
-        shapeTransitionCapsule: resolveFrontendShapeCapsuleGenerationInput(sources),
-    });
     const frontendSourceBinding = buildDagSourceBinding(sources, taskConfig.taskKind);
     const frontendContractSkeleton = buildFrontendImplementationContractSkeleton({
         sourceBinding: frontendSourceBinding,
         riskLevel: frontendRisk.selectedRisk,
         targetFiles: implementPaths.writeSet,
     });
+    const frontendContractSchemaBlock = (() => {
+        const schema = loadFrontendImplementationContractJsonSchema();
+        return [
+            `## Final ${FRONTEND_IMPLEMENTATION_CONTRACT_SCHEMA_ID} JSON Schema (authoritative after runtime merge)`,
+            schema,
+            "",
+            "## Runtime contract skeleton (deterministic and protected)",
+            JSON.stringify(frontendContractSkeleton),
+            "",
+            "The initial planner emits an editable RFC 7386 patch against this skeleton. It MUST omit schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff. The runtime merges and validates the final contract, then writes a hash-bound canonical JSON artifact; downstream review and prewrite consume that artifact path, not planner stdout.",
+            "",
+            "## Forbidden fields (these are NOT in the schema; do not emit)",
+            "- schemaId",
+            "- targetFiles",
+            "- requirementCoverage",
+            "",
+            "## Critical rules",
+            "- verificationTargets is a TOP-LEVEL required array",
+            "- uiStates items use name/applicable/expectedBehavior/implementationTargets/verificationTargetIds/notApplicableReason",
+            "- Use uiStates: [] for frontend logic changes with no user-visible UI state. Do not invent UI states.",
+            "- For applicable=true, provide non-empty expectedBehavior plus non-empty implementationTargets and verificationTargetIds. For applicable=false, provide non-empty notApplicableReason and omit expectedBehavior instead of emitting an empty string.",
+            "- mockApi.productionDefaultOff must always be true (including strategy: not-needed)",
+            "- All implementation files, verification files, symbols, and commands must be discovered from the current target workspace and current task. Never copy paths, symbols, or commands from the loop-agent repository, an example task, or prior run output.",
+            "- Use relative POSIX paths rooted at the target workspace. Do not assume a particular src/test directory layout; preserve the target project's actual app/, packages/, spec/, __tests__, or other layout.",
+            "",
+            "## Bad / Good contract field examples",
+            "",
+            "### verificationTargets - BAD (invented commandLabel, missing file):",
+            '{"id":"vt-1","type":"static","commandLabel":"lint","file":"","requirementIds":["AC-001"],"uiStates":[]}  <-- REJECTED: commandLabel not in frozen command set; empty file path',
+            "",
+            '### verificationTargets - GOOD (real frozen label, real file):',
+            '{"id":"vt-1","type":"static","commandLabel":"npm run typecheck","file":"tsconfig.json","requirementIds":["AC-001"],"uiStates":[]}  <-- Matches frozen command set; real file path',
+            "",
+            "### requirements - BAD (missing expectedOutcome):",
+            '{"id":"AC-001","expectedOutcome":"","implementationTargets":["src/app.tsx"],"verificationTargetIds":["vt-1"]}  <-- REJECTED: empty expectedOutcome',
+            "",
+            "### requirements - GOOD (concrete expectedOutcome):",
+            '{"id":"AC-001","expectedOutcome":"TypeScript compilation exits with code 0 and produces no errors in dist/","implementationTargets":["src/app.tsx"],"verificationTargetIds":["vt-1"]}',
+            "",
+            "### interactions - BAD (empty trigger/expectedBehavior):",
+            '{"name":"save-click","trigger":"","expectedBehavior":"","implementationTargets":["src/button.tsx"],"verificationTargetIds":["vt-3"]}  <-- REJECTED: empty trigger and expectedBehavior',
+            "",
+            "### interactions - GOOD:",
+            '{"name":"save-click","trigger":"User clicks the Save button in the editor toolbar","expectedBehavior":"POST /api/save is called with editor content; success toast appears; button enters disabled+spinner state until response","implementationTargets":["src/editor/save-button.tsx"],"verificationTargetIds":["vt-3"]}',
+            "",
+            "### uiStates - BAD (applicable=true but missing expectedBehavior):",
+            '{"name":"loading","applicable":true,"expectedBehavior":"","implementationTargets":[],"verificationTargetIds":[]}  <-- REJECTED: applicable UI state requires non-empty expectedBehavior, implementationTargets, and verificationTargetIds',
+            "",
+            "### uiStates - GOOD (applicable=true with complete fields):",
+            '{"name":"loading","applicable":true,"expectedBehavior":"Skeleton placeholder visible while data fetches; aria-busy=true on the list container","implementationTargets":["src/dashboard/list-view.tsx"],"verificationTargetIds":["vt-3"]}',
+            "",
+            "### uiStates - BAD (applicable=false without notApplicableReason):",
+            '{"name":"dark-mode","applicable":false}  <-- REJECTED: non-applicable UI state requires notApplicableReason',
+            "",
+            "### uiStates - GOOD (applicable=false with reason):",
+            '{"name":"dark-mode","applicable":false,"notApplicableReason":"Dark mode toggle is out of scope for this task; only light theme is targeted"}',
+            "",
+            "### mockApi.endpoints - BAD (strategy=native but empty endpoints):",
+            '{"strategy":"native","productionDefaultOff":true,"activation":"env flag","endpoints":[]}  <-- REJECTED: native strategy requires at least one endpoint with method, path, fixture, and consumer',
+            "",
+            "### mockApi.endpoints - GOOD (strategy=native with complete endpoint):",
+            '{"strategy":"native","productionDefaultOff":true,"activation":"VITE_ENABLE_MOCK=true","endpoints":[{"method":"GET","path":"/api/users","fixture":"mocks/fixtures/users.json","consumer":"src/api/users.ts"}]}',
+            "",
+            "### optional plan fields - GOOD (all optional; omit when absent):",
+            '{"implementationSteps":["confirm contract","sync tests"],"stylingStrategy":"reuse existing design tokens","dependencyPolicy":"no new runtime deps","residualRisks":["browser a11y not-run"],"realIntegrationGap":"FE-TEST owns live HTTP"}',
+            "",
+            "### optional plan fields - BAD (present-but-empty strings are rejected):",
+            '{"stylingStrategy":"","dependencyPolicy":""}  <-- REJECTED: optional string fields must be non-empty when present; omit them instead',
+            "",
+            "### uiComponentChoices - GOOD (specified with precise spec hit):",
+            '{"purpose":"primary action button","component":"Button","decision":"specified","specReference":{"path":"openspec/schemas/button.md","section":"Variants","line":12},"rationale":"spec mandates Button for primary actions"}',
+            "",
+            "### uiComponentChoices - GOOD (new with deviation rationale; specReference null):",
+            '{"purpose":"loading skeleton","component":"SkeletonCard","decision":"new","specReference":null,"rationale":"no spec or existing component covers skeleton; deviation pending design-review approval"}',
+            "",
+            "### uiComponentChoices - BAD (specified without specReference, or new with specReference):",
+            '{"purpose":"primary action","component":"MyButton","decision":"specified","specReference":null,"rationale":"..."}  <-- REJECTED: specified requires specReference',
+            '{"purpose":"primary action","component":"MyButton","decision":"new","specReference":{"path":"openspec/schemas/button.md","section":"","line":null},"rationale":"..."}  <-- REJECTED: new must not carry specReference',
+        ].join("\n");
+    })();
     const frontendContractFieldSummary = [
         "## Contract field summary (authoritative JSON; no plan prose)",
-        "frontend-plan-pi records typed facts; frontend-design-policy-shell applies the runtime skeleton, validates, and materializes the canonical full contract JSON supplied here. There is no separate plan prose authority. Review these fields:",
+        "The plan/revision node emits only a fenced json contract — there is no Markdown plan explanation to read. Review these fields:",
         "- requirements[]: id, expectedOutcome, implementationTargets, verificationTargetIds, evidenceGap",
         "- uiStates[]: name, applicable, expectedBehavior, implementationTargets, verificationTargetIds, notApplicableReason",
         "- interactions[]: name, trigger, expectedBehavior, implementationTargets, verificationTargetIds",
-        "- targets: routes, publicApiChanges (files are runtime-owned)",
+        "- targets: files, routes, publicApiChanges",
         "- mockApi: strategy, productionDefaultOff, activation, endpoints[]",
-        "- verificationTargets[]: id (stable test-title trace token for non-static targets), type, commandLabel, file, requirementIds, uiStates",
-        "- designEvidence: source, paths, conflicts; evidenceGaps[] (optional)",
-        "- optional: stylingStrategy, uiComponentChoices[], dependencyPolicy, residualRisks[], realIntegrationGap",
+        "- verificationTargets[]: id, type, commandLabel, file, symbol, requirementIds, uiStates",
+        "- designEvidence: source, paths, conflicts; evidenceGaps[]",
+        "- optional: implementationSteps[], stylingStrategy, uiComponentChoices[], dependencyPolicy, residualRisks[], realIntegrationGap",
         "- uiComponentChoices[]: purpose, component, decision (specified|reuse-existing|new), specReference { path, section, line } | null, rationale",
         "Do not require or read a separate plan prose section; the contract JSON is the only plan surface.",
     ].join("\n");
-    // Do not carry every attachment through the whole frontend pipeline. The
-    // contract node is the sole requirements/materials synthesis point; scout
-    // and plan only need the canonical request plus constraints, while design
-    // review consumes the materialized contract and only needs source provenance.
-    // This prevents attachment content from accumulating on later review calls.
-    const sourceContexts = {
-        contract: [buildSourceContextBlock(sources), capabilityContextBlock]
-            .filter(Boolean)
-            .join("\n\n"),
-        scout: [
-            buildSourceContextBlock(sources, { includeReferenceDocuments: false }),
-            capabilityContextBlock,
-        ]
-            .filter(Boolean)
-            .join("\n\n"),
-        designReview: buildSourceContextBlock(sources, {
-            includeRequirementExcerpt: false,
-            includeConstraintExcerpt: false,
-            includeReferenceDocuments: false,
-        }),
-    };
+    const sourceContext = [
+        buildSourceContextBlock(sources),
+        capabilityContextBlock,
+    ]
+        .filter(Boolean)
+        .join("\n\n");
     const hasMockVerifyCommands = (taskConfig.frontendMock?.verifyCommands.length ?? 0) > 0 ||
         mockCapability.verifyCommands.length > 0;
     const requirementIds = frontendSourceBinding.requirementIds;
+    const requirementCoverageInstruction = requirementIds.length > 0
+        ? [
+            `## Requirement Coverage (per-AC echo with bad/good examples)`,
+            `For each requirement ID below, echo the ID verbatim and confirm: expectedOutcome (user-observable or logic-observable), implementation targets (files), and verification targets (commandLabel + file).`,
+            `Do not skip any ID. Use the bad/good patterns below as reference for each field.`,
+            ``,
+            `Bad example (empty expectedOutcome, empty targets -- REJECTED at contract materialization):`,
+            `- AC-001: expectedOutcome="" implementationTargets=[] verificationTargets=[]`,
+            ``,
+            `Good example (concrete expectedOutcome, real files, real verification targets):`,
+            `- AC-001: expectedOutcome="TypeScript compilation exits with code 0 and produces no errors in dist/" implementationTargets=["src/app.tsx"] verificationTargets=["vt-typecheck":"npm run typecheck","tsconfig.json"]`,
+            ``,
+            ...requirementIds.map((id) => `- ${id}: [expectedOutcome] [implementation files] [verification targets]`),
+            ``,
+            `Every requirement MUST have a non-empty expectedOutcome. Every interaction MUST have non-empty trigger and expectedBehavior. UI states with applicable=true MUST have non-empty expectedBehavior. Empty strings or omitted fields for these will cause contract rejection.`,
+        ].join("\n")
+        : "";
+    const verificationTargetFileInstruction = [
+        `## Verification target file semantics`,
+        `verificationTargets[].file is the code file that the target verifies (the file the writer changes), NOT where the command is defined.`,
+        `Non-static targets (type unit/component/integration/mock) MUST set file to a concrete code file inside the implementation writeSet (task allowedPaths); the prewrite gate rejects any non-static target whose file falls outside the writeSet.`,
+        `Command-level checks that run project-wide (all tests, typecheck, build, governance) MUST use type "static" and must NOT be bound as non-static targets with file=package.json/tsconfig.json/vite.config.ts/scripts/*. Static targets are exempt from the writeSet containment check.`,
+    ].join("\n");
     const strategy = resolveDagVerifyStrategy(taskConfig);
     const readOnlyPaths = taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"];
     const behaviorPaths = deriveFrontendBehaviorPaths(taskConfig);
@@ -2896,15 +2735,15 @@ async function buildFrontendHybridDagFromTask(sources) {
             ? [`See 执行约束.md in task source (${sources.taskId})`]
             : []),
         ...STANDARD_GLOBAL_CONSTRAINTS,
-        "Frontend design policy (frontend-design-policy-shell) and writer admission (frontend-writer-admission-shell) are the only write authorization; the writer runs only after both materialized the canonical contract and admitted a concrete writeSet.",
-        "Design review verdict is consumed only as admission data input; it never drives branch selection.",
-        "Verification failure is terminal for the run: frontend-verify-shell fails closed, routes to recovery, and never selects a same-run repair branch.",
-        "Frontend review is decided exclusively by the committed typed terminal tools (approve_review / request_review_changes); response-text JSON verdicts and first-line VERDICT markers carry no control-flow weight.",
+        "Frontend implementation DAGs must pass the effective final design verdict gate before any write node executes; an initial pass uses the original plan, while request-revision selects the read-only revision and final-review branch.",
+        "Final design gate pass is the only authorization for frontend implementation writes.",
+        "Plan revision remains read-only and never edits business code.",
+        "Design revision failures route to replan-and-rerun, never dev-fix.",
         "Frontend planning must consume the read-only Mock assessment strategy produced after scouting; MOCK_STRATEGY: blocked must not pass the deterministic Mock contract gate.",
         "Mock implementations must preserve the real request path as the default, require explicit test/dev activation, and never rely on commenting out the real request.",
         "Mock-backed behavior evidence proves only the documented frontend contract, never real API integration.",
         "frontend-implementation DAGs must complete deterministic static verification before final review. Behavior verification is also required when the task declares a behavior entrypoint or the implementation contract contains a non-static verification target; static-only contracts must map every target to the declared static entrypoint.",
-        "Frontend closeout renders only from committed facts; a weak status (failed / not-run / baseline-debt / mock-backed / pending) can never be rewritten into a stronger one (passed / real-integrated).",
+        "frontend review must block closeout unless review verdict is exactly VERDICT: pass.",
         `Frontend risk classification: ${frontendRisk.selectedRisk} — ${frontendRisk.reason}`,
         frontendRisk.forceFullGates
             ? "High-risk or supervised: keep full design gates; do not weaken write boundaries."
@@ -3035,56 +2874,7 @@ async function buildFrontendHybridDagFromTask(sources) {
         frontendMockStrategyMustBeNotNeeded(frontendSources)) {
         advisories.push("auto 模式已将 Mock 策略收窄为 not-needed：任务源提到接口/API/Mock 需求，但仓库无确认 Mock 能力或无确定性 Mock 验证命令。若项目规范要求 Mock，请声明 frontendMock.verifyCommands 或 policy:required 后重新生成 DAG。");
     }
-    const openspecGate = await resolveFrontendOpenspecGateConfig(sources);
-    const requiresOpenspecClassification = openspecGate.openspecPolicy === "cited" &&
-        openspecGate.openspecCandidatePaths.length > 0;
-    // Prompt 内联的候选只保留与任务相关的子集：mandatory（任务显式声明/
-    // 引用）始终保留；scan-strict 候选按路径段是否命中任务源关键词过滤。
-    // runtime 的选型/read 门禁仍消费完整 openspecCandidatePaths——这里只
-    // 减小 prompt 体积，不改变门禁语义；未提及的候选 runtime 默认 irrelevant。
-    const promptCandidatePaths = filterRelevantOpenspecCandidates({
-        candidates: openspecGate.openspecCandidateSummaries.map((candidate) => candidate.path),
-        mandatoryPaths: openspecGate.openspecMandatoryPaths,
-        sourceMarkdown: [
-            sources.requirementMarkdown,
-            sources.constraintMarkdown ?? "",
-        ].join("\n"),
-        maxCandidates: 24,
-    });
-    const candidateByPath = new Map(openspecGate.openspecCandidateSummaries.map((candidate) => [
-        candidate.path,
-        candidate,
-    ]));
-    // Preserve the filter's mandatory/relevance order. Sorting then slicing here
-    // used to be able to drop a mandatory path after it passed the Top-K filter.
-    const promptCandidates = promptCandidatePaths.flatMap((candidatePath) => {
-        const candidate = candidateByPath.get(candidatePath);
-        return candidate
-            ? [
-                {
-                    path: candidate.path,
-                    kind: candidate.kind,
-                    score: candidate.score,
-                    reasons: candidate.reasons,
-                    source: candidate.source,
-                },
-            ]
-            : [];
-    });
-    const openspecSelectionContext = JSON.stringify({
-        schemaVersion: 1,
-        schemaId: "frontend-openspec-selection-v1",
-        candidates: promptCandidates,
-        mandatoryPaths: openspecGate.openspecMandatoryPaths,
-    });
-    const scopedOpenspecContext = promptCandidates.length > 0
-        ? [
-            "## Task-relevant OpenSpec Top-K (generation frozen)",
-            `Policy: ${openspecGate.openspecPolicy}. This is the bounded prompt index; the deterministic gate retains ${openspecGate.openspecCandidatePaths.length} frozen candidates.`,
-            ...promptCandidates.map((candidate) => `- ${openspecGate.openspecMandatoryPaths.includes(candidate.path) ? "mandatory" : "candidate"}: ${candidate.path} (${candidate.kind}; ${candidate.source})`),
-            "Apply or cite only paths relevant to the concrete contract. Report applied rules with path/section/line and surface conflicts or missing specifications; unlisted candidates default to irrelevant unless the deterministic gate requires them.",
-        ].join("\n")
-        : "";
+    const openspecGate = resolveFrontendOpenspecGateConfig(sources);
     // Generation-frozen component/theme specification bucket (ADR 0016). Derived
     // from the classified component/theme/rule.components buckets; the prewrite
     // gate consumes it to enforce uiComponentChoices presence and specReference
@@ -3101,7 +2891,7 @@ async function buildFrontendHybridDagFromTask(sources) {
             advisories.push("openspec 策略 cited：契约声明的 requiredReadPaths 与任务源引用均为空，prewrite gate 不强制读取 openspec；如需增强规范门禁，请在 task.json.frontendOpenspec.requiredReadPaths 声明必读路径或在任务源中显式引用 openspec 文件。");
         }
         else {
-            advisories.push(`openspec 策略 cited：候选 ${openspecGate.openspecCandidatePaths.length} 个（declared ${openspecGate.openspecCandidateSources.declared.length} / task-source-cited ${openspecGate.openspecCandidateSources.taskSourceCited.length}），plan 必须在 typed decision ledger 的 uiComponentChoices.specReference 中声明并通过真实 read 事件佐证。`);
+            advisories.push(`openspec 策略 cited：候选 ${openspecGate.openspecCandidatePaths.length} 个（declared ${openspecGate.openspecCandidateSources.declared.length} / task-source-cited ${openspecGate.openspecCandidateSources.taskSourceCited.length}），plan/review 必须在 openspec-citations 引用块中逐条引用并真实读取。`);
         }
     }
     else {
@@ -3138,25 +2928,13 @@ async function buildFrontendHybridDagFromTask(sources) {
                 writePolicy: "read-only",
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                skills: FRONTEND_CONTRACT_SKILLS,
-                outputContract: "Typed requirement facts plus a concise Markdown contract. Submit through the incremental typed tools record_requirement / record_constraint / record_evidence_expectation / record_handoff_intent / record_open_question / record_split_proposal / record_openspec_selection, then call finalize_contract exactly once. Requirements use stable REQ/BR/AC identifiers with source spans and a disposition (explicit | repository-resolvable | assumption | blocking); each requirement registers evidence expectations across static/behavior/Mock/real-integration (required | optional | not-applicable), and UI-visible or interactive requirements register a non-blocking frontend-test handoff intent. End finalize_contract with a single contract disposition of ready | ready-with-assumptions | blocked. Cover scope, non-goals, acceptance criteria, UI states, target runtime environment, risks, and verification expectations; do not fix target files, components, or implementation methods as requirements. When OpenSpec candidates exist, classify only the ones you actually use: call record_openspec_selection once per required/relevant path; never enumerate irrelevant candidates (unmentioned defaults to irrelevant) and never emit a fenced selection JSON. No file writes.",
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "Markdown contract with Scope, Non-goals, Acceptance Criteria, UI States, Target Runtime Environment, Risks, and Verification Expectations. No file writes.",
                 subtask_prompt: [
-                    "OUTPUT BUDGET DISCIPLINE (hard requirement, extreme-environment safe): the provider output window is small — NEVER attempt to emit the whole contract in one response; a single large JSON dump will be truncated and rejected. Incremental submission through the typed tools is the ONLY supported output mode. Start submitting with the FIRST tool call: after each read, call record_requirement for the requirements you have already confirmed, one or a few per call. Every tool-call round MUST make progress by submitting at least one record_* fact. Do not re-read the same source file that is already materialized in this session; read each file at most once.",
-                    "Read task source and produce a concise frontend implementation contract as typed requirement facts plus narrative Markdown.",
-                    "Assign each requirement the SAME id as the ledger canonical requirement it covers (sourceBinding.requirementIds, e.g. AC-001) — do NOT invent new REQ/BR prefixed ids for canonical requirements: the compiled contract must match the ledger canonical requirement ids exactly or schema validation rejects it (unknown requirement id). Requirements use the canonical id with a source span (task-source section or repository file:line). Label each requirement's disposition as explicit | repository-resolvable | assumption | blocking; a blocking requirement must name its owner (human-decision or external-state) and evidence refs.",
-                    "Source fidelity ledger: when the DAG sourceBinding carries a requirement→fragment mapping (requirementToFragments, e.g. REQ-SRC-* ids from the managed ledger), each record_requirement MUST declare the fragments that requirement is bound to: set sourceFragmentIds to the mapped fragment ids (the authoritative provenance evidence the design policy verifies). sourceRefs (fragment→path display refs) are optional — declare them only when you have the exact path from the materialized source; otherwise omit them rather than inventing paths. Declare exactly what the ledger binds — do not invent ids, do not omit them, and do not re-derive them from prose. A requirement that the ledger binds but the contract omits (or fabricates) fails writer admission.",
-                    "Register evidence expectations for each requirement across static, behavior, Mock, and real integration as required | optional | not-applicable; required must follow from user requirements, task risk, or project governance, never from model convenience. For UI-visible or interactive requirements, register a non-blocking frontend-test handoff intent.",
-                    "Cover scope, non-goals, acceptance criteria, UI states, target runtime environment, risks, and verification expectations. Do not fix target files, components, styling, or implementation methods as requirements; leave those to Scout and Plan.",
-                    "If the task is too large for one bounded writer, record a task split proposal instead of silently widening scope.",
-                    "End the contract with a single disposition: ready, ready-with-assumptions (bounded assumptions that do not change product behavior), or blocked.",
-                    scopedOpenspecContext,
-                    ...(requiresOpenspecClassification ? [
-                        "Classify OpenSpec candidates incrementally while contracting — only the ones you actually use. Call record_openspec_selection once per path with disposition required (must be read and cited by the plan) or relevant (may inform planning). Never call it for irrelevant candidates and never list them: candidates you do not mention are treated as irrelevant by the runtime. Explicit task declarations / source citations are already required and must-read regardless; you never need to re-declare them.",
-                        "Mandatory paths are enforced by the runtime from the frozen task configuration — do not enumerate them, do not downgrade them.",
-                        openspecSelectionContext,
-                    ] : []),
+                    "Read task source and produce a concise frontend implementation contract.",
+                    "Cover scope, non-goals, acceptance criteria, UI states, target runtime environment, risks, and verification expectations.",
                     "Read-only: do not modify code, docs, artifacts, or repository files.",
-                    sourceContexts.contract,
+                    sourceContext,
                 ].join("\n\n"),
             },
             {
@@ -3166,19 +2944,17 @@ async function buildFrontendHybridDagFromTask(sources) {
                 executor: "pi",
                 complexity: mapTaskComplexity(taskConfig.complexity),
                 writePolicy: "read-only",
-                retryPolicy: FRONTEND_SCOUT_COMPLETENESS_RETRY_POLICY,
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                skills: FRONTEND_SCOUT_SKILLS,
-                outputContract: "Markdown scout report covering target surface and design evidence (frontend stack, routes, components, styling system, existing design conventions, state/data flow, test entry points, reuse opportunities, risks). Submit through the incremental evidence tools record_target_surface / record_design_evidence. A complete target surface is mandatory before Plan; if it cannot be proven, commit blocked with unresolved paths so this Scout node retries rather than shifting discovery to Plan. No fixed TARGET_SURFACE section title is required — target surface and design evidence are reported as committed typed facts. No file writes.",
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "Markdown scout report with a required TARGET_SURFACE section covering frontend stack, routes, components, styling system, existing design conventions, state/data flow, test entry points, reuse opportunities, and risks. No file writes.",
                 subtask_prompt: [
                     "Inspect frontend code, routing, components, styles, package scripts, and tests.",
                     "Return code and design observations, existing reuse opportunities, and verification entry points.",
-                    "Report target surface and design evidence as facts (no fixed section title required): completeness, entrypoint, routeOrMount, implementationPaths, testPaths, dataSource, allowedPathConflicts, unresolvedPaths. Use repository-relative POSIX paths. A complete surface must name at least one proven entrypoint, implementation path, or test path and set unresolvedPaths to []; if any target ownership remains unknown, commit completeness=blocked with every unresolved path instead of guessing. implementationPaths and testPaths must name the existing files/directories that actually own the requested behavior; allowedPathConflicts must list every discovered path not covered by task allowedPaths, or [] when none exists.",
+                    "Begin with a TARGET_SURFACE section containing exactly these labels: entrypoint, routeOrMount, implementationPaths, testPaths, dataSource, allowedPathConflicts. Use repository-relative POSIX paths. implementationPaths and testPaths must name the existing files/directories that actually own the requested behavior; allowedPathConflicts must list every discovered path not covered by task allowedPaths, or [] when none exists.",
                     "Derive all file paths from this target workspace. Do not assume the project uses src/, test/, React, or the loop-agent repository layout.",
                     "Read-only: do not modify repository files.",
-                    sourceContexts.scout,
-                    scopedOpenspecContext,
+                    sourceContext,
                 ].join("\n\n"),
             },
             {
@@ -3188,197 +2964,239 @@ async function buildFrontendHybridDagFromTask(sources) {
                 executor: "pi",
                 complexity: "MED",
                 writePolicy: "read-only",
-                retryPolicy: FRONTEND_PLAN_LADDER_RETRY_POLICY,
-                allowedPaths: readOnlyPaths,
-                forbiddenPaths,
-                skills: FRONTEND_PLAN_SKILLS,
+                outputMode: "structured-required",
+                retryPolicy: STRUCTURED_REQUIRED_PI_RETRY_POLICY,
                 structuredContractOutput: {
-                    schemaId: "frontend-implementation-contract-plan-patch-v1",
+                    schemaId: FRONTEND_IMPLEMENTATION_CONTRACT_PLAN_PATCH_SCHEMA_ID,
                     retryOnInvalid: true,
                     skeleton: frontendContractSkeleton,
                 },
-                outputContract: "Typed decision patch only: map frozen requirements to implementation/verification targets and select the needed component, state, data/Mock, styling, and dependency decisions. Use only the record_* tools needed to express those decisions, then call finalize_plan exactly once. Contract owns requirement semantics; Scout owns repository discovery; deterministic runtime owns schema, protected fields, path containment, and command validation. No Markdown narrative or file writes.",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "JSON-only patch output: one-line lead-in, then exactly ONE fenced json object (```json ... ```) containing only the editable RFC 7386 plan patch for the runtime contract skeleton. Omit protected fields: schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff. Immediately after it, append exactly one ```openspec-citations``` fenced citation block. The runtime applies the patch, validates it, and writes a hash-bound canonical JSON artifact for downstream review. Do NOT emit a full contract, Markdown plan explanation, raw JSON, or any other fenced block. No file writes.",
                 subtask_prompt: [
-                    "Plan only the delta between the frozen frontend-contract-pi facts and frontend-scout-pi target surface. Do not reinterpret the task, repeat requirements, search the repository, or choose implementation order.",
-                    "Record only: requirement-to-file/verification coverage; component/styling choices; applicable UI state and interaction behavior; data/Mock strategy; and a dependency policy or genuine evidence gap. Reuse Scout paths. If scope is missing, record a blocking gap instead of inventing a path.",
-                    "Use the typed tool schemas as the field contract. Runtime owns schemaVersion, sourceBinding, riskLevel, targets.files, mockApi.productionDefaultOff, aliases, command allowlisting, path containment, and final validation; do not restate those rules or emit a full JSON contract.",
-                    `Cover each frozen requirement ID exactly once: ${requirementIds.join(", ") || "(none)"}. Bind every verification target to a listed frozen command and a Scout-confirmed file. Define behavior-level non-static targets: one target may cover multiple related requirementIds when one observable test behavior proves them together; do not mechanically create one target per requirement. A non-static target id is the stable machine trace token. Use static targets for project-wide commands. Static targets are traced by file and command only.`,
-                    ...(requiresOpenspecClassification ? ["When a component choice uses an OpenSpec selection, cite that selection; otherwise do not classify unrelated candidates."] : []),
-                    "Call finalize_plan exactly once after the necessary typed facts. Return no Markdown narrative.",
-                    "TOOL-ONLY PLAN: Do not read Contract/Scout stdout, task sources, or Scout-confirmed target files. Contract and Scout already own evidence discovery; use the injected upstream facts, record a genuine evidence gap when those facts are insufficient, and start committing record_* facts immediately. For decision=new, pass sourceRequirementIds to record_component_choice; runtime derives the exact PRD citation from the frozen ledger.",
-                    "Output budget protocol (hard, max output <=16K per turn): never enumerate-reason the whole requirement list before your first record_* call — that reasoning burns the entire output budget and the attempt dies with zero committed facts. Process requirements in order: think about ONE requirement briefly, immediately emit its record calls (up to 5 per message), then move to the next. If your budget runs low, stop recording and call finalize_plan with what is committed — the retry ladder continues the remainder in a fresh session.",
+                    "Use frontend-contract-pi, frontend-scout-pi, task sources, and the generation-time Mock capability evidence to fill the runtime-owned frontend contract skeleton. Return JSON-only output containing only an editable RFC 7386 plan patch. The runtime already owns schemaVersion, sourceBinding, riskLevel, targets.files, and mockApi.productionDefaultOff; omit those protected paths even when their values look obvious.",
+                    "The patch fields become the complete implementation plan after deterministic merge. Do not produce a separate plan document, prose mirror, or full contract.",
+                    "Select the Mock / API strategy only in the patch. Encode endpoint/fixture mapping, explicit activation, verification commands, and Real Integration Gap in schema-defined editable fields; productionDefaultOff comes from the protected skeleton and there is no second plan output.",
+                    "Encode ordered steps (implementationSteps), target files, UI state handling, styling/component strategy (stylingStrategy), interaction notes, Mock/API strategy, dependency policy (dependencyPolicy), deterministic verification entrypoints, Real Integration Gap (realIntegrationGap), and residual risks (residualRisks) into the contract JSON fields. Use only the fixed entrypoints below; implementation may add tests behind them but cannot replace them.",
+                    "Every target file and verification target must be selected from the current target workspace and task scope. Do not reuse paths or symbols from examples, prior tasks, or loop-agent itself; if the project uses app/, packages/, spec/, __tests__, or another layout, preserve that layout.",
+                    "Consume the Scout TARGET_SURFACE evidence before selecting files. Preserve the discovered existing entrypoint and data source. If implementationPaths or testPaths are outside task allowedPaths, record a blocking scope conflict; do not substitute a new page or silently broaden the writeSet.",
+                    "Output in this exact order: (1) exactly one fenced json object containing the editable plan patch; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit protected skeleton fields, a full contract, Markdown plan explanation, raw JSON, or any other fenced block.",
+                    "Each requirement must state its user-observable or logic-observable expectedOutcome. Each interaction must state its trigger and expectedBehavior. IDs plus file paths are not sufficient behavior semantics.",
+                    requirementCoverageInstruction,
+                    "verificationTargets[].commandLabel MUST be one of the frozen command labels listed above. Any other value will be rejected at contract materialization.",
+                    verificationTargetFileInstruction,
+                    "Read-only: do not modify code, docs, artifacts, or repository files.",
                     fixedVerificationContext,
-                    scopedOpenspecContext,
+                    sourceContext,
                     mockContextBlock,
-                    frontendContractFieldSummary,
+                    frontendContractSchemaBlock,
                     frontendComponentConformanceInstruction,
+                    openspecCitationInstruction,
                 ].join("\n\n"),
             },
             {
-                id: "frontend-design-policy-shell",
+                id: "frontend-design-review-pi",
                 depends_on: ["frontend-plan-pi"],
-                role: "verifier",
-                executor: "shell",
-                complexity: "LOW",
+                role: "reviewer",
+                executor: "pi",
+                complexity: "MED",
                 writePolicy: "read-only",
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                outputContract: "Deterministic design policy: materialize the canonical frontend implementation contract from the plan patch, enforce requirement-id retention, Mock strategy/frozen-command binding, writeSet containment, source freshness, and openspec invariants, then evaluate the design policy (write policy result).",
-                subtask_prompt: "Materialize the canonical contract and fail closed unless the deterministic design policy approves. The design verdict is not available at this stage; the writer admission shell enforces it.",
-                shell: {
-                    commands: [],
-                    frontendDesignPolicy: {
-                        schemaVersion: 1,
-                        planFromNodeId: "frontend-plan-pi",
-                        requiredRequirementIds: requirementIds,
-                        allowedMockStrategies: taskConfig.frontendMock?.policy === "disabled" ||
-                            frontendMockStrategyMustBeNotNeeded(frontendSources)
-                            ? ["not-needed"]
-                            : taskConfig.frontendMock?.policy === "required"
-                                ? [
-                                    "native",
-                                    "browser-intercept",
-                                    "request-adapter",
-                                ]
-                                : [
-                                    "native",
-                                    "browser-intercept",
-                                    "request-adapter",
-                                    "not-needed",
-                                ],
-                        mockCommandLabels: mockVerifyEvidence?.commandLabels ?? [],
-                        artifactName: "frontend-implementation-contract.json",
-                        outputDir: "contracts",
-                        requireSourceFreshness: true,
-                        implementationWriteSet: implementPaths.writeSet,
-                        openspecPolicy: openspecGate.openspecPolicy,
-                        openspecSpecRoots: taskConfig.frontendOpenspec?.specRoots ?? [
-                            ...DEFAULT_FRONTEND_SPEC_ROOTS,
-                        ],
-                        ...(requiresOpenspecClassification
-                            ? { openspecSelectionNodeId: "frontend-contract-pi" }
-                            : {}),
-                        openspecMandatoryPaths: openspecGate.openspecMandatoryPaths,
-                        openspecCandidateSources: {
-                            declared: openspecGate.openspecCandidateSources.declared,
-                            taskSourceCited: openspecGate.openspecCandidateSources.taskSourceCited,
-                            scanStrict: openspecGate.openspecCandidateSources.scanStrict,
-                        },
-                        openspecCandidatePaths: openspecGate.openspecCandidatePaths,
-                        ...(openspecGate.openspecCandidateSnapshots
-                            ? {
-                                openspecCandidateSnapshots: openspecGate.openspecCandidateSnapshots,
-                            }
-                            : {}),
-                        componentSpecCandidatePaths,
-                        allowedDependencies: declaredDependencies,
-                    },
-                    cwd: ".",
-                    timeoutMs: 60000,
+                skills: FRONTEND_DESIGN_REVIEW_SKILLS,
+                outputProtocol: REVIEW_VERDICT_OUTPUT_PROTOCOL,
+                outputContract: "Plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision, followed by Findings, Required Plan Corrections, and Checked Items. No file writes.",
+                subtask_prompt: [
+                    "Audit the frontend plan before implementation. frontend-plan-pi is emitted as a hash-bound canonical JSON artifact after the runtime applied and validated the planner's editable patch against its protected skeleton; read that artifact with the read tool and do not infer the contract from stdout. There is no separate plan prose.",
+                    "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+                    "Request revision when the Mock strategy is MOCK_STRATEGY: blocked, missing, unsupported by repository evidence, inconsistent with the API contract, outside authorized paths/dependencies, unable to prove production-default-off behavior with the fixed production/default-real-path static check, or missing deterministic behavior verification for a declared behavior target or selected Mock strategy. Mock strategies require Mock-backed evidence. A static-only contract is allowed only when every verification target is static and maps to a declared static entrypoint. not-needed otherwise requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists; in that case the plan must preserve the real request path and record the Real Integration Gap.",
+                    "Also request revision for missing applicable UI states, unsupported dependency additions, design-system drift without reason, weak interaction coverage, broad scope, inline fake data, schema drift, or missing deterministic verification commands.",
+                    "Component selection conformance is a hard blocking condition: VERDICT: request-revision when the frontend spec (component/theme/rule.components bucket) already defines a component for a purpose but the plan selects another or self-invents one without a declared deviation; when uiComponentChoices is missing/empty for UI-visible work while the frozen component/theme bucket is non-empty; or when any uiComponentChoices specReference.path is not cited in the openspec-citations block or has no successful read event.",
+                    "Read-only: do not modify repository files.",
+                    fixedVerificationContext,
+                    sourceContext,
+                    frontendContractFieldSummary,
+                    mockContextBlock,
+                ].join("\n\n"),
+            },
+            {
+                id: "frontend-plan-revision-pi",
+                depends_on: ["frontend-plan-pi", "frontend-design-review-pi"],
+                runIf: "$.nodes['frontend-design-review-pi'].firstVerdictLine == 'VERDICT: request-revision'",
+                role: "planner",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                outputMode: "structured-required",
+                retryPolicy: STRUCTURED_REQUIRED_PI_RETRY_POLICY,
+                structuredContractOutput: {
+                    schemaId: "frontend-implementation-contract-revision-patch-v1",
+                    retryOnInvalid: true,
                 },
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                skills: FRONTEND_IMPLEMENTATION_SKILLS,
+                outputContract: "When the initial design review requests revision, return a one-line lead-in followed by exactly ONE fenced json object (```json ... ```) containing an RFC 7386 merge-patch delta against the original frontend-implementation-contract-v1 (only the fields you change; null deletes a key; arrays and scalars replace; plain objects merge recursively). Immediately after it, append exactly one ```openspec-citations``` fenced citation block. Do NOT emit a full contract, Markdown explanation, or prose — the output is JSON-only; this node compiles the patch onto the original canonical artifact and writes a hash-bound revised contract. Apart from the patch JSON fenced block and the openspec-citations block, do not emit any other fenced block or raw JSON. No file writes.",
+                subtask_prompt: [
+                    "Consume frontend-plan-pi (original contract JSON) and frontend-design-review-pi (first design review findings).",
+                    "This node runs only when frontend-design-review-pi emitted VERDICT: request-revision. Produce an RFC 7386 merge-patch delta against the original contract JSON that addresses every Required Plan Correction from the design findings.",
+                    "The patch delta may update editable contract fields such as requirements, implementationSteps, targets.routes/publicApiChanges, uiStates, interactions, mockApi.strategy/activation/endpoints, dependencyPolicy, stylingStrategy, uiComponentChoices, verificationTargets, evidenceGaps, residualRisks, and realIntegrationGap. It must not modify protected schemaVersion, sourceBinding, riskLevel, targets.files, or mockApi.productionDefaultOff. Only include fields you change; omit unchanged fields (this node applies the patch on the original canonical artifact). null deletes a key; arrays and scalars replace; plain objects merge recursively.",
+                    requirementCoverageInstruction,
+                    "Do not turn MOCK_STRATEGY: blocked into an implementable strategy without new repository or contract evidence that resolves every blocker.",
+                    "Read-only: do not modify code, docs, artifacts, or repository files. This node revises the plan only.",
+                    "Output in this exact order: (1) exactly one fenced json object containing the merge-patch delta — this node compiles it onto the original canonical artifact; (2) exactly one openspec-citations citation fenced block appended immediately after it. Do NOT emit a full contract, Markdown explanation, or prose — the output is JSON-only. Do not emit any raw JSON or JSON objects in prose. Apart from the patch JSON fenced block and the openspec-citations block, do not emit any other fenced block. Do not include secrets or unsafe paths.",
+                    "Preserve each requirement expectedOutcome and each interaction trigger/expectedBehavior in the effective (merged) contract; do not reduce behavior semantics to IDs and paths.",
+                    "verificationTargets[].commandLabel MUST be one of the frozen command labels listed above. Any other value will be rejected at contract materialization.",
+                    verificationTargetFileInstruction,
+                    fixedVerificationContext,
+                    sourceContext,
+                    frontendContractSchemaBlock,
+                    mockContextBlock,
+                    frontendComponentConformanceInstruction,
+                    openspecCitationInstruction,
+                ].join("\n\n"),
             },
             {
-                id: "frontend-design-review-pi",
-                depends_on: ["frontend-design-policy-shell"],
+                id: "frontend-final-design-review-pi",
+                depends_on: [
+                    "frontend-plan-revision-pi",
+                    "frontend-plan-pi",
+                    "frontend-design-review-pi",
+                ],
+                dependsPolicy: "all-or-condition-skip",
+                runIf: "$.nodes['frontend-design-review-pi'].firstVerdictLine == 'VERDICT: request-revision'",
                 role: "reviewer",
                 executor: "pi",
                 complexity: "MED",
                 writePolicy: "read-only",
-                readBudget: FRONTEND_READ_BUDGETS.designReview,
-                retryPolicy: DEFAULT_READ_ONLY_PI_RETRY_POLICY,
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
                 skills: FRONTEND_DESIGN_REVIEW_SKILLS,
-                outputContract: "Authoritative typed design terminal via approve_design / request_design_changes tools. No JSON verdict; the committed typed design fact is the only authority. No file writes.",
+                outputProtocol: REVIEW_VERDICT_OUTPUT_PROTOCOL,
+                outputContract: "For the effective frontend plan, return plain Markdown whose first non-empty line is VERDICT: pass or VERDICT: request-revision, followed by Findings and Checked Items. No file writes.",
                 subtask_prompt: [
-                    "Audit the frontend plan before implementation. frontend-plan-pi is emitted to you as canonical full-contract JSON after the runtime applied and validated the planner's editable patch against its protected skeleton; there is no separate plan prose.",
-                    "Your authoritative terminal verdict is exactly one committed typed tool call: approve_design or request_design_changes. Call exactly one of them; after calling one, do not call the other.",
-                    "request_design_changes must carry a typed issueCategory, at least one evidenceRef, and non-empty findings.",
-                    "Your verdict is consumed only as deterministic data input by frontend-writer-admission-shell; it no longer drives any branch or gate. request_design_changes blocks writer admission (terminal).",
-                    "Request design changes when the Mock strategy is MOCK_STRATEGY: blocked, missing, unsupported by repository evidence, inconsistent with the API contract, outside authorized paths/dependencies, unable to prove production-default-off behavior with the fixed production/default-real-path static check, or missing deterministic behavior verification for a declared behavior target or selected Mock strategy. Mock strategies require Mock-backed evidence. A static-only contract is allowed only when every verification target is static and maps to a declared static entrypoint. not-needed otherwise requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists; in that case the plan must preserve the real request path and record the Real Integration Gap.",
-                    "Also request design changes for missing applicable UI states, unsupported dependency additions, design-system drift without reason, weak interaction coverage, broad scope, inline fake data, schema drift, or missing deterministic verification commands.",
-                    "Component selection conformance is a hard blocking condition: request_design_changes when the frontend spec (component/theme/rule.components bucket) already defines a component for a purpose but the plan selects another or self-invents one without a declared deviation; when uiComponentChoices is missing/empty for UI-visible work while the frozen component/theme bucket is non-empty; when a decision=specified specReference.path is missing a ledger OpenSpec reference or successful read event; or when a decision=new component lacks a traceable task-source/PRD specReference. A PRD reference for decision=new is not an OpenSpec citation and must not be rejected merely for lacking an OpenSpec read event.",
-                    "For uiComponentChoices, purpose is the stable coverage key and must match interaction.name or uiState.name. Responsibility is expressed by the matched expectedBehavior plus rationale; you must not reject it merely for matching an interaction or component identifier.",
-                    "You must NOT make authoritative assertions about the execution result of frozen verification commands (typecheck/test/build/lint/etc.). Predicting that a command will necessarily pass or fail, or declaring an acceptance criterion unreachable on that basis, is out of your authority: command results are deterministically established by frontend-verify-shell. Any concern about verification feasibility must be recorded only as a non-blocking verification concern in findings (severity must not be Critical, and it must never be the sole fatal basis for request_design_changes). Only semantic design defects (component selection, state flow, interaction contract, or conflicts with the specification) may be Critical. A pure command-will-fail prediction must not be classified as contract-requirement-gap.",
+                    "Audit the revised frontend plan before implementation. This node runs only after request-revision and consumes the merge-patch delta from frontend-plan-revision-pi applied on the original frontend-plan-pi contract JSON — there is no separate plan prose.",
+                    "First non-empty line must be exactly VERDICT: pass or VERDICT: request-revision.",
+                    "Verify that every Required Plan Correction from the initial design review has been fully addressed.",
+                    "Recheck the selected Mock / API strategy, contract-to-fixture mapping, authorized paths/dependencies, explicit activation, production-default-off behavior, behavior verification, and Real Integration Gap. MOCK_STRATEGY: blocked cannot receive VERDICT: pass.",
+                    "Review every explicit REQ-/BR-/AC- mapping; the downstream prewrite gate also checks identifier retention deterministically.",
+                    "Request revision if any design gap remains, if corrections are incomplete, or if the revised plan introduces new unaddressed issues.",
+                    "Also request revision for component selection non-conformance: spec-defined components silently replaced or self-invented without a declared deviation, uiComponentChoices missing for UI-visible work, or a uiComponentChoices specReference.path not cited in the openspec-citations block / not actually read.",
                     "Read-only: do not modify repository files.",
-                    "LARGE-FILE AUDIT (avoid full reads): style/theme audit files can be large (e.g. styles.css is often hundreds of KB). Prefer grep to locate the exact rules/variables you must verify (e.g. grep the oc- class, is-* modifier, or --oc- theme variables with their line numbers), then read only the narrow line range when surrounding context is needed. Do not read a large style/test file in full — a single full read can exhaust the read budget and fail the attempt.",
-                    "Canonical contract reading: frontend-design-policy-shell prints absolute paths for Contract, Contract index, and the non-blocking Capacity diagnostic. Read the capacity diagnostic first. When it recommends full-contract, read the exact Contract path. When it recommends indexed-sections, read the Contract index and its hash-bound section files instead of opening the full contract. Never resolve a bare contracts/... path against the repository root or hunt for substitutes. Implementation target files inside the writeSet are created later by the implement node: do not read them and do not treat their absence as a design defect.",
                     fixedVerificationContext,
-                    sourceContexts.designReview,
-                    scopedOpenspecContext,
+                    sourceContext,
                     frontendContractFieldSummary,
                     mockContextBlock,
                 ].join("\n\n"),
             },
             {
-                id: "frontend-writer-admission-shell",
-                depends_on: ["frontend-design-policy-shell", "frontend-design-review-pi"],
+                id: "frontend-prewrite-gate-shell",
+                depends_on: [
+                    "frontend-final-design-review-pi",
+                    "frontend-design-review-pi",
+                    "frontend-plan-revision-pi",
+                    "frontend-plan-pi",
+                ],
+                dependsPolicy: "all-or-condition-skip",
                 role: "verifier",
                 executor: "shell",
                 complexity: "LOW",
                 writePolicy: "read-only",
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                outputContract: "Deterministic writer admission: require design review verdict pass, freeze the pre-writer worktree/lint baselines, derive the concrete writeSet + admission digest, and write contracts/frontend-writer-admission-result.json (schemaId frontend-writer-admission-shell-v1).",
-                subtask_prompt: "Fail closed unless the design review approved and the deterministic admission derived a concrete, non-empty writeSet. The admission result is the only write authorization.",
+                outputContract: "Deterministic prewrite authorization: resolve effective plan/review, require VERDICT: pass, retain every requirement id, validate Mock policy, and materialize the canonical implementation contract.",
+                subtask_prompt: "Fail closed unless the effective reviewed plan is source-bound, requirement-complete, Mock-policy compliant, schema-valid, and approved.",
                 shell: {
                     commands: [],
-                    frontendWriterAdmission: {
+                    frontendPrewriteGate: {
                         schemaVersion: 1,
-                        designReviewFromNodeId: "frontend-design-review-pi",
-                        frozenCommandLabels: [
-                            ...staticVerifyEvidence.commandLabels,
-                            ...behaviorVerifyEvidence.commandLabels,
-                            ...(mockVerifyEvidence?.commandLabels ?? []),
-                        ],
+                        planFromNodeId: "frontend-plan-revision-pi",
+                        planFallbackFromNodeIds: ["frontend-plan-pi"],
+                        reviewFromNodeId: "frontend-final-design-review-pi",
+                        reviewFallbackFromNodeIds: ["frontend-design-review-pi"],
+                        requiredRequirementIds: requirementIds,
+                        mockCommandLabels: mockVerifyEvidence?.commandLabels ?? [],
                         allowedMockStrategies: taskConfig.frontendMock?.policy === "disabled" ||
                             frontendMockStrategyMustBeNotNeeded(frontendSources)
                             ? ["not-needed"]
                             : taskConfig.frontendMock?.policy === "required"
-                                ? [
-                                    "native",
-                                    "browser-intercept",
-                                    "request-adapter",
-                                ]
+                                ? ["native", "browser-intercept", "request-adapter"]
                                 : [
                                     "native",
                                     "browser-intercept",
                                     "request-adapter",
                                     "not-needed",
                                 ],
-                        ...(lintShellCommands.length > 0 && lintVerifyEvidence
-                            ? {
-                                lintCommands: lintShellCommands,
-                                lintEvidence: lintVerifyEvidence,
-                            }
-                            : {}),
+                        artifactName: "frontend-implementation-contract.json",
+                        outputDir: "contracts",
+                        revisionPatch: true,
+                        planMdArtifactName: "frontend-plan.md",
+                        requireSourceFreshness: true,
+                        implementationWriteSet: implementPaths.writeSet,
+                        openspecPolicy: openspecGate.openspecPolicy,
+                        openspecCandidateSources: {
+                            declared: openspecGate.openspecCandidateSources.declared,
+                            taskSourceCited: openspecGate.openspecCandidateSources.taskSourceCited,
+                            scanStrict: openspecGate.openspecCandidateSources.scanStrict,
+                        },
+                        openspecCandidatePaths: openspecGate.openspecCandidatePaths,
+                        componentSpecCandidatePaths,
                     },
                     cwd: ".",
                     timeoutMs: 60000,
                 },
             },
+            ...(lintShellCommands.length > 0 && lintVerifyEvidence
+                ? [
+                    {
+                        id: "frontend-lint-baseline-shell",
+                        depends_on: ["frontend-prewrite-gate-shell"],
+                        role: "verifier",
+                        executor: "shell",
+                        complexity: "LOW",
+                        writePolicy: "read-only",
+                        allowedPaths: readOnlyPaths,
+                        forbiddenPaths,
+                        outputContract: "Capture writer-preceding lint output as frontend-lint-baseline-v1 without treating existing lint diagnostics as writer failure.",
+                        subtask_prompt: "Run the frozen lint commands read-only. Preserve raw output and mark the baseline unavailable on timeout, execution failure, unparseable output, or worktree mutation.",
+                        shell: {
+                            commands: lintShellCommands,
+                            frontendLintBaseline: {
+                                schemaVersion: 1,
+                                lintCommands: lintShellCommands,
+                                lintEvidence: lintVerifyEvidence,
+                            },
+                            cwd: ".",
+                            timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+                        },
+                    },
+                ]
+                : []),
             {
                 id: implementId,
-                depends_on: ["frontend-writer-admission-shell"],
+                depends_on: [
+                    "frontend-prewrite-gate-shell",
+                    ...(lintShellCommands.length > 0
+                        ? ["frontend-lint-baseline-shell"]
+                        : []),
+                ],
                 ...buildFrontendWriterNodeDefaults({
                     complexity: resolveWriterComplexity(taskConfig),
                     writeSet: implementPaths.writeSet,
                     allowedPaths: implementPaths.allowedPaths,
                     forbiddenPaths,
-                    writerOutcomePolicyType: "frontend-facts-v1",
                 }),
-                outputContract: "The implementation status is derived by the executor from mechanical facts (write-tool events, run delta, write guard, requirement coverage, focused-check), not from any IMPLEMENTATION_OUTCOME first line. Deliver a Markdown summary with Contract Ref (path/schema/hash), Changed Files, Requirements Implemented, UI States, Tests Changed, Verification Attempts, Deviations, and Residual Risks. Follow fixed stages: contract confirm → tests → component/state → API/Mock → focused checks → diff cleanup.",
+                outputContract: "First non-empty line must be exactly one of: IMPLEMENTATION_OUTCOME: changed; IMPLEMENTATION_OUTCOME: already-satisfied; IMPLEMENTATION_OUTCOME: blocked. Then a Markdown delivery summary with Contract Ref (path/schema/hash), Changed Files, Requirements Implemented, UI States, Tests Changed, Verification Attempts, Deviations, and Residual Risks. Follow fixed stages: contract confirm → tests → component/state → API/Mock → focused checks → diff cleanup.",
                 subtask_prompt: [
-                    "Implement against the validated run-owned Frontend Implementation Contract materialized by frontend-design-policy-shell (path/schema/hash) and authorized by frontend-writer-admission-shell. Do not rebuild the contract from Markdown alone.",
+                    "Implement against the validated run-owned Frontend Implementation Contract from frontend-prewrite-gate-shell (path/schema/hash). Do not rebuild the contract from Markdown alone.",
                     "The canonical contract already contains the approved requirement, target-file, UI-state, verification, design, and Mock/API decisions. Do not re-open task sources, OpenSpec, AI workspace, plan/revision, or design-review prose, and do not repeat broad repository research. Inspect only contract target files and directly related local code needed to implement them.",
                     "Execute in fixed stages and report each in the delivery summary: (1) Contract confirm, (2) Tests sync, (3) Component/UI state implementation, (4) API/Mock wiring per contract.mockApi, (5) Focused checks behind frozen entrypoints only, (6) Diff cleanup.",
                     "Map every requirement id, expectedOutcome, interaction trigger/expectedBehavior, and applicable UI state from the contract to concrete files. Do not invent shell verification commands; only frozen static/behavior entrypoints will run.",
-                    "For every non-static verification target, treat target.id as a stable trace token and include that exact token in a real describe/it/test literal title (for example, it('[VT-DASHBOARD-SHELL] renders the dashboard', ...)). One test title may carry multiple target ids when it proves multiple grouped behaviors; comments and ordinary strings do not count as trace evidence.",
-                    "Begin implementation after the contract and its target files are confirmed. Do not spend the turn collecting optional context. If the canonical contract lacks behavior needed to edit safely, stop and state the blocking reason in the summary instead of reopening broad discovery.",
-                    "Your implementation status is derived by the executor from mechanical facts (persisted write-tool events, run delta, write guard, requirement coverage, focused-check failures), never from any IMPLEMENTATION_OUTCOME first line. Do not emit an IMPLEMENTATION_OUTCOME first line.",
-                    "The node runs a bounded micro-loop: after each write attempt the executor re-runs frozen focused checks and records a per-round diff checkpoint; the write guard stays active every round. Only repair local issues attributable to the current diff (syntax/type/import/format/unit-assert/obvious omission). Never change requirements, design, writeSet, or verification strictness inside the loop.",
+                    "Begin implementation after the contract and its target files are confirmed. Do not spend the turn collecting optional context. If the canonical contract lacks behavior needed to edit safely, return IMPLEMENTATION_OUTCOME: blocked instead of reopening broad discovery.",
                     "Implement only the approved Mock strategy carried by the validated contract. Preserve the real request path as the default, require explicit test/dev activation, and never comment out or replace the real request with inline data.",
-                    "frontend-design-policy-shell materialized and validated the canonical contract; frontend-writer-admission-shell authorized the writeSet. Stay within writeSet and preserve unrelated files.",
+                    "frontend-prewrite-gate-shell confirmed the effective plan/review, requirement coverage, Mock policy, and contract. Stay within writeSet and preserve unrelated files.",
                     "For native, browser-intercept, or request-adapter, implement contract-aligned fixtures/states and a dev/test-only activation boundary in this same writer. For not-needed, do not add Mock files or a framework and state the positive reason.",
                     "Do not write root artifacts/** unless explicitly included in writeSet. Do not claim Browser/visual verification.",
                     "Edit existing files with the structured edit/write tools. NEVER rewrite Markdown (or any file with quoting/backticks/indentation-sensitive content) via bash sed/awk/echo redirection: escaping mistakes silently corrupt the file and self-repair loops burn the run.",
@@ -3393,7 +3211,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                     .join("\n\n"),
             },
             {
-                id: "frontend-verify-shell",
+                id: "frontend-verify-assess-shell",
                 depends_on: [implementId],
                 role: "verifier",
                 executor: "shell",
@@ -3401,8 +3219,8 @@ async function buildFrontendHybridDagFromTask(sources) {
                 writePolicy: "read-only",
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                outputContract: "Run frozen Mock/static/behavior commands and materialize the verification trace. Any failure is terminal: no same-run repair branch, failure ownership facts are materialized for recovery.",
-                subtask_prompt: "Execute the frontend verification bundle. Preserve per-command evidence; a failure fails this node (terminal) and routes to recovery.",
+                outputContract: "Run frozen Mock/static/behavior commands, materialize verification trace and repair assessment, and fail closed for non-repairable failures.",
+                subtask_prompt: "Execute the frontend verification bundle. Preserve per-command evidence; eligible repairable failures select the bounded repair branch.",
                 shell: {
                     commands: [],
                     frontendVerificationBundle: {
@@ -3416,7 +3234,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                         staticEvidence: staticVerifyEvidence,
                         behaviorEvidence: behaviorVerifyEvidence,
                         lintBaselineNodeId: lintShellCommands.length > 0
-                            ? "frontend-writer-admission-shell"
+                            ? "frontend-lint-baseline-shell"
                             : undefined,
                         writerNodeIds: lintShellCommands.length > 0 ? [implementId] : [],
                         mode: "initial",
@@ -3425,17 +3243,85 @@ async function buildFrontendHybridDagFromTask(sources) {
                     timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
                 },
             },
+            {
+                id: "frontend-repair-pi",
+                depends_on: ["frontend-verify-assess-shell", implementId],
+                runIf: "$.nodes['frontend-verify-assess-shell'].json.eligible == true",
+                ...buildFrontendWriterNodeDefaults({
+                    complexity: resolveWriterComplexity(taskConfig),
+                    writeSet: implementPaths.writeSet,
+                    allowedPaths: implementPaths.allowedPaths,
+                    forbiddenPaths,
+                }),
+                outputContract: "First non-empty line must be exactly one of: IMPLEMENTATION_OUTCOME: changed; IMPLEMENTATION_OUTCOME: already-satisfied; IMPLEMENTATION_OUTCOME: blocked. Then a repair summary for an eligible repairable assessment. Must not expand writeSet, re-interpret requirements, skip tests, or enable Mock by default.",
+                subtask_prompt: [
+                    "Read contracts/frontend-repair-assessment.json and the validated frontend implementation contract.",
+                    "This node runs only for eligible=true. Apply the smallest fix for the classified repairable failure inside the original implement writeSet only.",
+                    "The repair assessment and canonical implementation contract are complete inputs for this phase. Do not re-open task sources, OpenSpec, AI workspace, plan/revision, or design-review prose, and do not repeat repository-wide discovery.",
+                    "Do not change lint/type/test config, do not add .skip/.only, do not comment out real requests, do not default-enable Mock, do not add dependencies.",
+                    "Do not re-plan requirements or expand allowed paths. Browser/visual remain not-run.",
+                    ...(implementPaths.docIndexCompanions.length > 0
+                        ? [
+                            `Doc index sync is MANDATORY: ${implementPaths.docIndexCompanions.join(", ")} are catalog index files for this writeSet. When your repair adds, renames, or removes any indexed file, update ${implementPaths.docIndexCompanions.join(" and ")} in the same run; verification runs check-doc-index and fails the run on a missing index entry.`,
+                        ]
+                        : []),
+                    writerDeliveryContract(taskConfig),
+                ]
+                    .filter((value) => Boolean(value))
+                    .join("\n\n"),
+            },
+            {
+                id: "frontend-reverify-shell",
+                depends_on: ["frontend-repair-pi"],
+                role: "verifier",
+                executor: "shell",
+                complexity: "LOW",
+                writePolicy: "read-only",
+                allowedPaths: readOnlyPaths,
+                forbiddenPaths,
+                outputContract: "Post-repair Mock/static/behavior re-verification plus refreshed canonical trace; any failure blocks review.",
+                subtask_prompt: "Re-run the frozen frontend verification bundle after bounded repair and fail on any command or trace failure.",
+                shell: {
+                    commands: [],
+                    frontendVerificationBundle: {
+                        schemaVersion: 1,
+                        mockCommands: mockShellCommands,
+                        lintCommands: lintShellCommands,
+                        staticCommands: staticShellCommands,
+                        behaviorCommands: behaviorShellCommands,
+                        mockEvidence: mockVerifyEvidence,
+                        lintEvidence: lintVerifyEvidence,
+                        staticEvidence: staticVerifyEvidence,
+                        behaviorEvidence: behaviorVerifyEvidence,
+                        lintBaselineNodeId: lintShellCommands.length > 0
+                            ? "frontend-lint-baseline-shell"
+                            : undefined,
+                        writerNodeIds: lintShellCommands.length > 0
+                            ? [implementId, "frontend-repair-pi"]
+                            : [],
+                        mode: "repair",
+                    },
+                    cwd: ".",
+                    timeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+                },
+            },
             {
                 id: "frontend-review-context-shell",
-                depends_on: ["frontend-verify-shell", implementId],
+                depends_on: [
+                    "frontend-reverify-shell",
+                    "frontend-repair-pi",
+                    "frontend-verify-assess-shell",
+                    implementId,
+                ],
+                dependsPolicy: "all-or-condition-skip",
                 role: "verifier",
                 executor: "shell",
                 complexity: "LOW",
                 writePolicy: "read-only",
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                outputContract: "Canonical frontend review context containing a hash-bound contract reference and field index, lint assessment when configured, effective verification trace, optional verify-failure facts, and actual worktree diff.",
-                subtask_prompt: "Capture the actual diff and bind it to the effective verification evidence for final review.",
+                outputContract: "Canonical frontend review context containing validated contract, lint assessment when configured, effective verification trace, repair assessment, and actual worktree diff.",
+                subtask_prompt: "Capture the actual diff and bind it to the effective initial-or-post-repair verification evidence for final review.",
                 shell: {
                     commands: [],
                     frontendReviewContext: { schemaVersion: 1, requireBaseline: true },
@@ -3450,100 +3336,81 @@ async function buildFrontendHybridDagFromTask(sources) {
                 executor: "pi",
                 complexity: "HIGH",
                 writePolicy: "read-only",
-                readBudget: FRONTEND_READ_BUDGETS.finalReview,
-                retryPolicy: FRONTEND_REVIEW_TERMINAL_RETRY_POLICY,
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
                 skills: FRONTEND_REVIEW_SKILLS,
-                outputContract: 'Authoritative typed review terminal via approve_review / request_review_changes tools. No JSON verdict is required in the response text; the typed terminal fact is the only authority. No file writes.',
+                outputContract: 'Structured JSON review verdict only: {"schemaVersion":1,"verdict":"pass|request-revision","findings":[...],"verificationAssessment":"...","uxAssessment":"...","residualRisks":[...]}. No file writes.',
+                outputProtocol: REVIEW_JSON_VERDICT_OUTPUT_PROTOCOL,
                 subtask_prompt: [
                     "Review the frontend implementation and verification evidence.",
-                    "Your authoritative terminal verdict is exactly one committed typed tool call: approve_review or request_review_changes. Call it once and do not call the other afterwards.",
-                    "approve_review means the implementation passes; it must not carry Critical or Important findings. request_review_changes must carry a typed issueCategory, at least one evidenceRef, and non-empty findings.",
-                    "Do NOT emit an equivalent JSON verdict in the response text: the committed typed terminal fact is the only authority and no branch or gate reads response-text JSON verdicts.",
-                    "Read contracts/frontend-review-context.json from frontend-review-context-shell. It binds a hash-verified canonical contract reference, a field-to-section index, frontend lint assessment when configured, the effective verification trace, and the run-owned actual diff. Read contractRef.capacityDiagnosticPath first: use contractRef.path only when full-contract is recommended; otherwise read only the hash-bound contractRef.sections needed for the changed surface and verification claims. Then read diff.reviewSummaryPath. The full artifacts/diff_patch.patch is retained only as audit evidence: do NOT read it in full. For semantic review, read only the named per-file diff fragment in the summary/index (in part order when needed) and then the current source file when necessary. Do not claim actual diff is missing when those artifacts exist; do not invent a diff from the implementation summary alone. Trace proves command/file/stable-target-id binding only—not semantic correctness.",
+                    "Return exactly one final JSON object in this response. Do not repeat it, do not emit a second revision, do not wrap it in Markdown, and do not include prose outside the JSON.",
+                    'Required fields: schemaVersion: 1; verdict: "pass" or "request-revision"; findings: array of objects with severity ("Critical" | "Important" | "Minor" | "Info"), optional file, optional positive integer line, issue, and optional requiredChange.',
+                    'verdict "request-revision" requires at least one finding. verdict "pass" is invalid if any finding severity is Critical or Important.',
+                    'Any Critical or Important finding must force verdict "request-revision".',
+                    "Read contracts/frontend-review-context.json from frontend-review-context-shell. It binds the validated implementation contract, frontend lint assessment when lint is configured, effective initial-or-post-repair verification trace, repair assessment, and the run-owned actual diff (contracts/frontend-worktree-diff.json + artifacts/diff_patch.patch). Do not claim actual diff is missing when those artifacts exist; do not invent a diff from the implementation summary alone. Trace proves command/file/symbol binding only—not semantic correctness.",
                     "Treat lint status exactly as passed | baseline-debt | failed | unavailable. baseline-debt may continue only with intact evidence and zero diagnostics on writer-changed files; report the tolerated debt count and never rewrite it as lint passed. Typecheck, build, and test still require successful final exits.",
                     "Flag .skip/.only, deleted or weakened tests, unauthorized config changes, Mock-only evidence claimed as real integration, and Browser/visual claims (always not-run in this workflow).",
-                    "The contract referenced and hash-bound by frontend-review-context.json is the effective plan materialized by frontend-design-policy-shell. Do not re-open task sources, OpenSpec, AI workspace, design-review, writer summary, or verification node prose. Inspect only the canonical review context, its indexed contract sections, its bound diff, and diff-referenced files when semantic review requires source code.",
-                    "For uiComponentChoices, purpose is the stable coverage key and must match interaction.name or uiState.name. Responsibility is expressed by the matched expectedBehavior plus rationale; you must not reject it merely for matching an interaction or component identifier.",
+                    "The contract embedded in frontend-review-context.json is the effective reviewed plan materialized by the prewrite gate. Do not re-open task sources, OpenSpec, AI workspace, plan/revision, design-review, writer summary, or verification node prose. Inspect only the canonical review context, its bound diff, and diff-referenced files when semantic review requires source code.",
                     "Treat a commented-out real request, default-enabled Mock, production entrypoint importing test mocks, API/fixture contract drift, unauthorized Mock dependency/path, or missing behavior evidence for the selected strategy as at least Important. Mock strategies require Mock-backed evidence. not-needed requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists; in that case verify that the real request remains the default and the Real Integration Gap is preserved.",
-                    "Inspect the frontend-verify-shell evidence in the review context directly, including the production/default-real-path static check, and require Mock activation to be off for that check.",
+                    "Inspect the frontend-verify-assess-shell or selected frontend-reverify-shell evidence in the review context directly, including the production/default-real-path static check, and require Mock activation to be off for that check.",
                     "Distinguish Mock-backed evidence from real API integration evidence and preserve the Real Integration Gap when the backend was not exercised.",
                     "Review implementation quality, behavior/state coverage, verification evidence, and maintainability. Read-only: do not modify files.",
                 ].join("\n\n"),
             },
             {
-                id: "frontend-closeout-shell",
-                depends_on: ["frontend-review-context-shell", "frontend-review-pi"],
-                role: "closeout",
+                id: "frontend-review-gate-shell",
+                depends_on: ["frontend-review-pi"],
+                role: "verifier",
                 executor: "shell",
                 complexity: "LOW",
                 writePolicy: "read-only",
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                outputContract: "Deterministic closeout rendered from committed facts only: coverage matrix, lint status, integration facts, typed review verdict, cumulative diff, browser/visual not-run, risks, and follow-up. No model summaries are re-interpreted.",
-                subtask_prompt: "Render the closeout deterministically from frontend-review-context.json, the verification trace, and the committed typed review terminal fact.",
+                outputContract: 'Deterministic frontend review verdict gate: exit 0 only when frontend-review-pi emits JSON verdict "pass".',
+                subtask_prompt: 'Deterministic gate: block downstream closeout unless frontend-review-pi emitted JSON verdict "pass".',
                 shell: {
                     commands: [],
-                    frontendCloseout: {
-                        schemaVersion: 1,
-                        reviewFromNodeId: "frontend-review-pi",
+                    verdictGate: {
+                        fromNodeId: "frontend-review-pi",
+                        accept: ["pass"],
+                        routingAccept: ["request-revision"],
+                        label: "frontend review",
+                        source: "json-review-verdict",
                     },
                     cwd: ".",
                     timeoutMs: 60000,
                 },
             },
+            {
+                id: "frontend-closeout-pi",
+                depends_on: [
+                    "frontend-review-context-shell",
+                    "frontend-review-gate-shell",
+                ],
+                role: "closeout",
+                executor: "pi",
+                complexity: "MED",
+                writePolicy: "read-only",
+                allowedPaths: taskConfig.allowedPaths.length > 0
+                    ? [...taskConfig.allowedPaths, "docs/**"]
+                    : ["**", "docs/**"],
+                forbiddenPaths,
+                skills: FRONTEND_VERIFICATION_SKILLS,
+                outputContract: "Markdown closeout summary with Changes, Mock Decision / Strategy / Files / Verification / Production Boundary, Verification Evidence, Review Result, Frontend Status, Real Integration Status, Known Risks, and Follow-up. No file writes.",
+                subtask_prompt: [
+                    "Return a frontend closeout summary covering Mock decision/strategy/files/verification/production boundary, changes, verification evidence, review result, known risks, and follow-up.",
+                    "Use only the canonical frontend-review-context.json plus the final frontend review gate verdict. Do not re-open task sources, OpenSpec, AI workspace, plan/revision, design-review, writer, repair, or verification prose, and do not perform new repository research during closeout.",
+                    "Include a coverage matrix for each requirement id, applicable UI state, and verification target/check with status passed|failed|not-run|blocked|unavailable. Report lint separately as passed|baseline-debt|failed|unavailable; baseline-debt is explicit debt, not passed. Always state Browser accessibility verification: not-run and Visual regression: not-run. Use contracts/frontend-review-context.json and the effective frontend-verify-assess-shell or frontend-reverify-shell facts; do not invent Browser evidence from component tests.",
+                    `When only Mock-backed evidence passed, state exactly Frontend status: mock-validated and Real integration: pending, summarize the Real Integration Gap, and name ${taskConfig.taskId}-real-api-integration-verify as the explicit follow-up task to create/run after backend readiness. This follow-up is not auto-created or auto-executed. Never describe Mock evidence as real API integration.`,
+                    `When Mock was skipped in auto mode and no real API evidence passed, state exactly Frontend status: locally-validated and Real integration: pending, summarize the Real Integration Gap, and name ${taskConfig.taskId}-real-api-integration-verify as the explicit follow-up task when backend readiness matters.`,
+                    "Read-only: do not modify code, docs, artifacts, or .harness/dag-runs/.",
+                ].join("\n\n"),
+            },
         ],
     };
-    // The static DAG template is the topology source of truth: the generated
-    // chain must match the template's node set and order, and the template's
-    // depends_on must be a subset of the generated one (the runtime may add
-    // dependencies, e.g. Mock-required planning depending on the contract
-    // node's Mock facts). The template's own tasks carry simplified placeholder
-    // configs; the generated node definitions (budgets, retry, skeleton,
-    // skills, prompts) and any runtime-added dependencies win.
-    const frontendTemplate = await loadFrontendDagTemplate(sources.repoRoot);
-    if (frontendTemplate) {
-        const byId = new Map(spec.tasks.map((task) => [task.id, task]));
-        const templateIds = frontendTemplate.tasks.map((task) => task.id);
-        const missing = templateIds.filter((id) => !byId.has(id));
-        if (missing.length > 0) {
-            throw new Error(`frontend DAG template topology drift: generated chain is missing template node(s): ${missing.join(", ")}`);
-        }
-        for (const templateTask of frontendTemplate.tasks) {
-            const generated = byId.get(templateTask.id);
-            const generatedDeps = new Set(generated.depends_on);
-            const templateOnly = templateTask.depends_on.filter((dep) => !generatedDeps.has(dep));
-            if (templateOnly.length > 0) {
-                throw new Error(`frontend DAG template topology drift: generated node ${templateTask.id} is missing template dependency ${templateOnly.join(", ")}`);
-            }
-        }
-        const templateSet = new Set(templateIds);
-        const ordered = templateIds.map((id) => byId.get(id));
-        const extra = spec.tasks.filter((task) => !templateSet.has(task.id));
-        spec.tasks = [...ordered, ...extra];
-    }
-    if (frontendTaskShape.shape === "split-required") {
-        spec.tasks = pruneFrontendTasksForSplitRequired(spec.tasks);
-    }
-    else {
-        const reshapeRaisedTopology = frontendTaskShape.signals.includes("shape-transition-reshape");
-        if (!reshapeRaisedTopology) {
-            spec.tasks = pruneFrontendTasksForRisk(spec.tasks, frontendRisk);
-        }
-        if (frontendTaskShape.shape === "micro") {
-            spec.tasks = pruneFrontendTasksForMicro(spec.tasks);
-        }
-    }
-    spec.advisories = [
-        ...(spec.advisories ?? []),
-        `frontend-task-shape: ${frontendTaskShape.shape} (${frontendTaskShape.reason})`,
-    ];
-    // Freeze the frontend recovery continuation quota from task.json so the
-    // runner can bound M6 auto-recovery without re-reading the task config.
-    const frontendMaxContinuations = sources.taskConfig.frontendRecovery?.maxContinuations ?? 1;
-    spec.frontendRecovery = { maxContinuations: frontendMaxContinuations };
+    spec.tasks = pruneFrontendTasksForRisk(spec.tasks, frontendRisk);
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -4151,7 +4018,7 @@ export function applyBackendTestLayoutToText(text, layout) {
  * normalization. Output is exactly one trailing JSON line `{modules:[{stem}]}`
  * that `parseJsonFromText` accepts after shell command echoes.
  */
-function buildBackendTestModuleManifestShellCommand(layout) {
+function buildBackendTestModuleManifestShellCommand(layout, moduleLayout) {
     // The extractor is base64-encoded so the shell command is fully opaque to
     // bash: no backticks (command substitution), no regex \/ escaping, no
     // backslash-counting through TS-string -> JSON.stringify -> bash -c -> node -e.
@@ -4160,18 +4027,31 @@ function buildBackendTestModuleManifestShellCommand(layout) {
     // mdDir/testPrefix are injected as JSON literals so the same extractor
     // works for any configured backendTest layout (plan A).
     const mdDirLiteral = JSON.stringify(layout.markdownDir);
+    const scriptDirLiteral = JSON.stringify(layout.scriptDir);
+    const strictLayoutCompressed = moduleLayout
+        ? deflateRawSync(Buffer.from(JSON.stringify(moduleLayout), "utf8")).toString("base64")
+        : null;
+    const strictLayoutExpression = strictLayoutCompressed
+        ? `JSON.parse(zlib.inflateRawSync(Buffer.from(${JSON.stringify(strictLayoutCompressed)},'base64')).toString('utf8'))`
+        : "null";
+    const strictLayoutShaLiteral = JSON.stringify(moduleLayout
+        ? createHash("sha256").update(JSON.stringify(moduleLayout)).digest("hex")
+        : null);
     const escOpen = String.fromCharCode(92, 91); // \[
     const escClose = String.fromCharCode(92, 93); // \]
     const escBslash = String.fromCharCode(92, 92); // \\
-    const script = `const fs=require('fs'),path=require('path'),crypto=require('crypto');
+    const script = `const fs=require('fs'),path=require('path'),crypto=require('crypto'),zlib=require('zlib');
 const mdDir=${mdDirLiteral};
+const scriptDir=${scriptDirLiteral};
+const strictLayout=${strictLayoutExpression};
+const strictLayoutSha256=${strictLayoutShaLiteral};
 const esc=s=>s.replace(/[${escOpen}${escClose}{}()*+?^$|${escBslash}]/g,'${escBslash}$&');
 const rxMdPath=new RegExp(esc(mdDir)+'${escBslash}/([A-Za-z0-9_.-]+)${escBslash}.md','g');
 const runDir=process.env.HARNESS_DAG_RUN_DIR||'';
 if(!runDir){process.stderr.write('missing HARNESS_DAG_RUN_DIR for backend-test Markdown plan artifact\\n');process.exit(2);}
 const planPath=path.join(runDir,'generate-backend-md-plan-pi','plan.md');
 if(!fs.existsSync(planPath)){process.stderr.write('missing backend-test Markdown plan artifact: '+planPath+'\\n');process.exit(2);}
-const readme=fs.readFileSync(planPath,'utf8');
+let readme=fs.readFileSync(planPath,'utf8');
 const norm=s=>String(s).toLowerCase().replace(/[^a-z0-9]+/g,'_').replace(/^_+|_+$/g,'').replace(/_+/g,'_');
 const bt=String.fromCharCode(96);
 const stripBackticks=s=>s.split(bt).join('');
@@ -4185,23 +4065,68 @@ const start=headings[0]+1;let end=allLines.length;for(let i=start;i<allLines.len
 const section=allLines.slice(start,end).join('\\n');
 const raw=[];
 const lines=section.split('\\n').filter(l=>l.includes('|'));
-for(const line of lines){
-  const bare=stripBackticks(line);
-  for(const m of bare.matchAll(rxMdPath)){raw.push(m[1]);}
+const cells=line=>line.split('|').slice(1,-1).map(value=>stripBackticks(value).trim());
+const expectedHeader=['Module Stem','Business Resource','Owned Operations','Owned Rule Keys','Case IDs','Split Reason','Markdown Path','Pytest Path'];
+const headerIndex=lines.findIndex(line=>{const row=cells(line);return expectedHeader.every((value,index)=>row[index]===value);});
+if(headerIndex<0){process.stderr.write('invalid-module-index-header: require exact business ownership and path columns\\n');process.exit(2);}
+const dataRows=lines.slice(headerIndex+2).map(cells).filter(row=>row.length>=8&&row[0]&&row[0]!=='Module Stem');
+const allowedSplit=new Set(['explicit-user-layout','primary-business-resource','independent-business-resource','output-budget']);
+const strictExpectedStems=new Set((strictLayout&&strictLayout.modules||[]).map(item=>item.stem));
+const operationOwners=new Map();const declaredModules=[];let planRepairApplied=false;
+for(const row of dataRows){
+  const stem=norm(row[0]),resource=String(row[1]||'').trim(),operations=String(row[2]||'').split(';').map(value=>value.trim()).filter(Boolean),split=String(row[5]||'').trim();
+  if(strictLayout&&!strictExpectedStems.has(stem)){planRepairApplied=true;continue;}
+  if(!resource){process.stderr.write('missing-business-resource: '+stem+'\\n');process.exit(2);}
+  if(/^(?:response|resp|regression|positive|negative|boundary|error|combo|filter)(?:[_ -]|$)/i.test(resource)){process.stderr.write('test-purpose-business-resource: '+stem+' -> '+resource+'\\n');process.exit(2);}
+  if(!allowedSplit.has(split)){process.stderr.write('invalid-module-split-reason: '+stem+' -> '+split+'\\n');process.exit(2);}
+  if(operations.length===0){process.stderr.write('missing-owned-operation: '+stem+'\\n');process.exit(2);}
+  const mdMatches=[...String(row[6]||'').matchAll(rxMdPath)];let markdownPath=mdMatches[0]&&mdMatches[0][0];
+  let pytestPath=String(row[7]||'').replace(/^\\.\\//,'').replace(/\\\\/g,'/');
+  if(mdMatches.length!==1||norm(mdMatches[0][1])!==stem){process.stderr.write('module-markdown-path-mismatch: '+stem+'\\n');process.exit(2);}
+  if(!/^[A-Za-z0-9_./-]+\\.py$/.test(pytestPath)||pytestPath.includes('..')){process.stderr.write('invalid-module-pytest-path: '+stem+' -> '+pytestPath+'\\n');process.exit(2);}
+  const required=strictLayout&&strictLayout.modules.find(item=>item.stem===stem);
+  if(required){
+    if(!required.markdownPath.startsWith(mdDir+'/')||!required.pytestPath.startsWith(scriptDir+'/')||required.markdownPath.includes('..')||required.pytestPath.includes('..')){process.stderr.write('MODULE_LAYOUT_CONFLICT: strict paths outside frozen roots for '+stem+'\\n');process.exit(2);}
+    if(markdownPath!==required.markdownPath||pytestPath!==required.pytestPath||resource!==required.businessResource||JSON.stringify(operations)!==JSON.stringify(required.ownedOperations)||split!==required.splitReason){planRepairApplied=true;}
+    markdownPath=required.markdownPath;pytestPath=required.pytestPath;
+    if(required.splitReason==='output-budget'){
+      const proof=required.budgetProof;const peers=strictLayout.modules.filter(item=>item.budgetProof&&item.budgetProof.groupId===proof.groupId);
+      if(!proof||proof.estimatedOutputChars<=proof.maxOutputCharsPerWriter||Math.ceil(proof.estimatedOutputChars/Math.max(1,peers.length))>proof.maxOutputCharsPerWriter||peers.some(item=>item.budgetProof.inputSha256!==proof.inputSha256||item.budgetProof.estimatorVersion!==proof.estimatorVersion)){process.stderr.write('INVALID_OUTPUT_BUDGET_PROOF: '+stem+'\\n');process.exit(2);}
+    }
+  }
+  const item={stem,markdownPath,pytestPath,businessResource:required?required.businessResource:resource,ownedOperations:required?required.ownedOperations:operations,ownedRuleKeys:String(row[3]||'').split(';').map(value=>value.trim()).filter(Boolean),caseIds:String(row[4]||'').split(';').map(value=>value.trim()).filter(Boolean),splitReason:required?required.splitReason:split,...(required&&required.budgetProof?{budgetProof:required.budgetProof}:{})};
+  declaredModules.push(item);
+  for(const operation of item.ownedOperations){const owners=operationOwners.get(operation)||[];owners.push({stem,split:item.splitReason});operationOwners.set(operation,owners);}
+}
+if(strictLayout){
+  const missing=strictLayout.modules.filter(item=>!declaredModules.some(actual=>actual.stem===item.stem));
+  if(missing.length){process.stderr.write('MODULE_LAYOUT_CONFLICT: plan missing required modules '+missing.map(item=>item.stem).join(',')+'; deterministic Plan-only repair cannot invent Rule/Case ownership\\n');process.exit(2);}
+  if(planRepairApplied){
+    const table=['| '+expectedHeader.join(' | ')+' |','|'+expectedHeader.map(()=>'---').join('|')+'|',...declaredModules.map(item=>'| '+[item.stem,item.businessResource,item.ownedOperations.join('; '),item.ownedRuleKeys.join('; '),item.caseIds.join('; '),item.splitReason,'['+item.stem+'](./'+item.stem+'.md) '+item.markdownPath,item.pytestPath].join(' | ')+' |')].join('\\n');
+    readme=[...allLines.slice(0,headings[0]+1),table,...allLines.slice(end)].join('\\n');
+    fs.writeFileSync(planPath,readme,'utf8');
+  }
+}
+for(const [operation,owners] of operationOwners){if(owners.length>1&&!owners.every(owner=>owner.split==='explicit-user-layout'||owner.split==='output-budget')){process.stderr.write('overlapping-operation-modules: '+operation+' -> '+owners.map(owner=>owner.stem).join(',')+'; merge by business resource or use an authoritative explicit-user-layout\\n');process.exit(2);}}
+if(!strictLayout){
+  for(const line of lines){
+    const bare=stripBackticks(line);
+    for(const m of bare.matchAll(rxMdPath)){raw.push(m[1]);}
+  }
+  for(const m of section.matchAll(rxRelLink)){raw.push(m[1]);}
 }
-for(const m of section.matchAll(rxRelLink)){raw.push(m[1]);}
 const invalid=[];for(const r of raw){const reason=invalidReason(r);if(reason)invalid.push({stem:norm(r),reason});}
 if(invalid.length){for(const item of invalid)process.stderr.write(item.reason+': '+item.stem+'; use a stable business resource/domain stem\\n');process.exit(2);}
 const seen=new Set();const modules=[];
-for(const r of raw){const st=norm(r);if(valid(r)&&!seen.has(st)){seen.add(st);modules.push({stem:st});}}
+for(const item of declaredModules){if(valid(item.stem)&&!seen.has(item.stem)){seen.add(item.stem);modules.push(item);}}
 if(modules.length===0){process.stderr.write('empty-module-index: require at least one stable business module\\n');process.exit(2);}
 if(modules.length>8){process.stderr.write('excessive-module-count: '+modules.length+' > 8; merge by the smallest stable business resource/domain set\\n');process.exit(2);}
 const planReadPath=path.relative(process.cwd(),planPath).split(path.sep).join('/');
 const planSha256=crypto.createHash('sha256').update(readme).digest('hex');
-process.stdout.write(JSON.stringify({modules:modules.map(item=>({...item,planReadPath})),planReadPath,planSha256}));
+process.stdout.write(JSON.stringify({modules:modules.map(item=>({...item,planReadPath})),planReadPath,planSha256,moduleLayout:{schemaId:'backend-test-module-layout-facts-v1',source:strictLayout?'task-contract':'plan-derived',contractSha256:strictLayoutSha256,mode:strictLayout&&strictLayout.mode||'business-resource-layout',planRepairAttemptCount:planRepairApplied?1:0,planRepairOutcome:planRepairApplied?'changed':'not-required'}}));
 `;
-    const encoded = Buffer.from(script, "utf8").toString("base64");
-    return `node -e "eval(Buffer.from('${encoded}','base64').toString('utf8'))"`;
+    const encoded = deflateRawSync(Buffer.from(script, "utf8")).toString("base64");
+    return `node -e "eval(require('zlib').inflateRawSync(Buffer.from('${encoded}','base64')).toString('utf8'))"`;
 }
 const BACKEND_TEST_SKILLS_BY_ROLE = {
     planner: ["loop-agent"],
@@ -4211,6 +4136,84 @@ const BACKEND_TEST_SKILLS_BY_ROLE = {
     verifier: ["verification-before-completion", "systematic-debugging"],
     closeout: ["loop-agent", "verification-before-completion"],
 };
+/**
+ * Read-only Worker workflow for producing a revision-eligible Backend Test
+ * Analysis v2 contract without crossing into test generation or execution.
+ * The explicit consumer keeps artifact lineage meaningful for safe
+ * continuation: replacing the contract reruns review + deterministic closeout
+ * only.
+ */
+function buildBackendTestAnalysisHybridDag(sources) {
+    const analysis = buildAnalyzeInputsNode(sources);
+    const contract = buildBackendTestAnalysisContractGateNode(sources);
+    const review = {
+        id: "review-backend-test-analysis-pi",
+        depends_on: [contract.id],
+        role: "reviewer",
+        executor: "pi",
+        complexity: "LOW",
+        writePolicy: "read-only",
+        allowedPaths: commonReadOnlyPaths(sources),
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Concise Markdown review of the validated Backend Test Analysis v2 contract, covering source binding, explicit requirement coverage, evidence gaps, risks, and downstream readiness. No file writes.",
+        subtask_prompt: [
+            "Review the validated run-owned `contracts/backend-test-analysis.json` artifact.",
+            "Treat that structured artifact as the authoritative analysis contract; do not substitute the producer's assistant prose.",
+            "Check that every explicit AC/REQ/BR is represented by acceptanceCriteria or an evidenceGap, source references are precise, and unknown behavior remains an evidence gap rather than an invented requirement.",
+            "Summarize source-binding integrity, coverage, risks, evidence gaps, and whether the contract is ready for a later backend-test generation workflow.",
+            "Read-only: do not modify code, docs, artifacts, or repository files.",
+        ].join("\n\n"),
+    };
+    const closeout = {
+        id: "backend-test-analysis-closeout-static",
+        depends_on: [review.id],
+        role: "closeout",
+        executor: "static",
+        complexity: "LOW",
+        writePolicy: "none",
+        allowedPaths: [],
+        forbiddenPaths: commonForbiddenPaths(sources),
+        outputContract: "Deterministic handoff pointing to the validated analysis contract and its independent read-only review.",
+        subtask_prompt: "Close the read-only analysis workflow after the structured contract and review both succeed.",
+        static: {
+            resultMarkdown: [
+                "# Backend-test analysis closeout",
+                "",
+                "Validated contract: `contracts/backend-test-analysis.json`.",
+                "Independent review: `review-backend-test-analysis-pi`.",
+            ].join("\n"),
+        },
+    };
+    const spec = {
+        version: 3,
+        title: `Backend test analysis DAG: ${sources.taskConfig.title}`,
+        runtimeContract: GENERATED_DAG_RUNTIME_CONTRACT,
+        outputLanguage: sources.outputLanguage ?? DEFAULT_DAG_OUTPUT_LANGUAGE,
+        objective: extractObjective(sources.requirementMarkdown, sources.taskConfig.title),
+        successCriteria: [
+            "A strict Backend Test Analysis v2 contract is materialized with immutable source binding",
+            "Every explicit requirement is covered or preserved as an evidence gap",
+            "An independent read-only review consumes the validated structured artifact",
+        ],
+        globalConstraints: [
+            ...sources.taskConfig.hardConstraints,
+            "This workflow is analysis-only: no repository writer, dynamic expansion, test generation, or test execution is allowed.",
+        ],
+        defaults: {
+            ...BACKEND_TEST_DEFAULTS,
+            contextProfile: sources.taskConfig.contextProfile,
+        },
+        skillsByRole: BACKEND_TEST_SKILLS_BY_ROLE,
+        executorModels: sources.executorModelMatrix ?? DEFAULT_DAG_EXECUTOR_MODELS,
+        verifyStrategy: resolveDagVerifyStrategy(sources.taskConfig),
+        tasks: [analysis, contract, review, closeout],
+    };
+    applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
+    parseDagSpec(spec);
+    assertValidDagSpec(spec);
+    return spec;
+}
 /**
  * Plan D: gap-fill incremental DAG (mode=gap-fill).
  *
@@ -4548,7 +4551,7 @@ async function buildBackendTestGapFillDag(sources) {
             commands: [],
             backendTestPipeline: "markdown-execute-html",
             cwd: ".",
-            timeoutMs: 300000,
+            timeoutMs: taskConfig.backendTest?.executeTimeoutMs ?? 300000,
             envAllowlist,
         },
     };
@@ -4612,6 +4615,7 @@ async function buildBackendTestGapFillDag(sources) {
         spec.backendTestSharedSetup = { ...sharedSetup };
     }
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -4710,7 +4714,14 @@ async function buildBackendTestHybridDag(sources) {
             "Each Rule Key must appear in exactly one Matrix row. Preserve each AC/REQ/BR Rule Key as one row; if one product rule spans multiple dimensions, use a concise composite Dimension in that single row instead of duplicating the key. Derive OpenAPI Rule Keys exactly as the deterministic analyzer does: operation token is `<HTTP-METHOD>-<PATH>` with braces removed and every non-alphanumeric run replaced by a hyphen, uppercase (for example POST `/api/resource-notes` → `POST-API-RESOURCE-NOTES`); response statuses use `API-<OPERATION>-RESPONSE-STATUS`; body/parameter fields use `API-<OPERATION>-<FIELD>-REQUIRED|ENUM|MIN-LENGTH|MAX-LENGTH|MINIMUM|MAXIMUM|PATTERN|FORMAT`. Do not invent aliases such as API-CREATE-FIELDS when a deterministic key applies.",
             "Coverage priority is strict inside the declared scope: P0 product requirements/task hard constraints always remain in scope; P1 exhaustively supplements documented operations, fields, business rules, statuses and errors only for Affected Operations; P2 adds bounded protocol robustness only when it is relevant to the change and does not invent product behavior. Coverage percentages describe the declared affected scope, never whole-API completeness unless every operation is explicitly listed. Conflicts or undefined expectations must stay visible as GAP/CONFLICT with precise source pointers, never guessed.",
             "For uniqueness/lifecycle rules cover absent, active-existing, deleted-existing, create-delete-recreate, restore-then-recreate and documented scope/case-normalization states. For every enum cover every valid value plus bounded invalid equivalence classes (unknown, case variant, whitespace, empty, null/missing and wrong types as applicable). For every length/number rule cover min-1, min, nominal, max and max+1. For format rules cover each allowed class separately plus a valid mixed value, and representative forbidden classes including uppercase, internal/leading/trailing whitespace, tab/newline, unsupported punctuation, slash, emoji or control characters when the source contract supports that expectation.",
-            "Mandatory module index: include a `## Module Index` table in the plan artifact that lists every planned module as a canonical relative link of the exact form `[label](./<stem>.md)` plus a `testcase/md/<stem>.md` path cell, so a downstream deterministic manifest can parse the module list. Group by stable business resource/domain, not by CRUD operation: one resource's list/detail/create/update/delete cases belong in one module such as `resource_notes`; split only when a single module would exceed the per-child 16K output protocol, keep the total module count at the smallest safe value, and never exceed 8 modules. Name each module file with a stable lowercase business stem such as `health` or `resource_notes`. Pure hexadecimal/hash-like opaque stems such as `a401606` or `deadbeef` are forbidden. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix and never defines module files. Do not use Case-ID-like module filenames such as `BE-HEALTH.md` or `BE-NOTES.md`. The relative link target MUST equal the on-disk filename stem the sharded writer will create. For every automatable case, `自动化映射` must name exactly `testcase/test_<module>.py`, where <module> is that Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `testcase/md/health.md` → `testcase/test_health.py`; `testcase/md/resource_notes.md` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+            "Mandatory module layout contract: first inspect the PRIMARY requirement for an explicit list of required Markdown/Python output path pairs. When explicit paths are present, they are authoritative `explicit-user-layout`: reproduce their exact filenames, count and one-to-one pairs in Module Index; do not rename, merge, split, omit or add a module from reference/example scripts. Only when the primary requirement has no explicit file layout may you derive the smallest `business-resource-layout`. Existing examples, historical regression functions and shared setup may add evidence/assertions to an existing required module, but never create an extra physical module by themselves. A reference-only `resp_regression`, positive/negative/boundary/error/response module is forbidden.",
+            ...(taskConfig.backendTest?.moduleLayout
+                ? [
+                    "A strict task-contract `backendTest.moduleLayout` is bound and is authoritative over model-derived layout. Reproduce every stem, businessResource, ownedOperations, splitReason, markdownPath and pytestPath exactly; do not add, omit, rename or reorder physical modules. The downstream preflight compares exact path sets and may perform at most one deterministic Plan-only pruning/path normalization; it cannot invent missing Rule/Case ownership.",
+                    `STRICT_BACKEND_TEST_MODULE_LAYOUT=${JSON.stringify(taskConfig.backendTest.moduleLayout)}`,
+                ]
+                : []),
+            "Include exactly one `## Module Index` table with this exact header: `| Module Stem | Business Resource | Owned Operations | Owned Rule Keys | Case IDs | Split Reason | Markdown Path | Pytest Path |`. Use canonical relative links `[label](./<stem>.md)` inside the Markdown Path cell followed by the resolved `${layout.markdownDir}/<stem>.md` path. Split Reason is exactly one of `explicit-user-layout`, `primary-business-resource`, `independent-business-resource`, or `output-budget`. Group by stable business resource/domain, not by CRUD operation, AC, parameter/field axis, scenario type or regression purpose: one resource's list/detail/create/update/delete and its filters/response assertions/regression floor belong in one module. Multiple modules owning the same exact `METHOD /path` are forbidden unless every such row is `explicit-user-layout` from primary-requirement path pairs or has a documented `output-budget` proof. Keep the total module count at the smallest safe value and never exceed 8 modules. Name model-derived modules with stable lowercase business stems such as `health` or `resource_notes`; explicit-user-layout preserves the primary requirement filename stem even when it is more specific. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix. Pure hexadecimal/hash-like opaque stems and test-purpose-only stems are forbidden. Do not use Case-ID-like module filenames. The relative link target, Markdown Path, Pytest Path and downstream automation mapping must be one-to-one and exact; for model-derived modules the default pair remains `testcase/md/<module>.md` and `testcase/test_<module>.py`, while explicit-user-layout preserves the primary requirement paths. Do not hand-write a conflicting module count in prose; the Module Index row count is the only count truth.",
             "Scenario Partitions (query/filter axes): for every affected GET/list operation, declare one row per enum or classification axis used for filtering (query/path parameters such as type/status/category). Add a mandatory machine-readable `## Scenario Partitions` section after the Coverage Matrix using exactly `| Partition ID | Operation | Axis | Domain | Required Slots | Expected by Slot | Bind Rule |` with the separator row. Partition ID is a stable `SP-<OPERATION>-<AXIS>` token; Domain must copy the legal values verbatim from the bound OpenAPI enum or requirement sentence (never guess), using bare semicolon-separated identifier values inside the single table cell (for example `ACTIVE; ARCHIVED`, with no Markdown backticks or prose); Required Slots must contain `each-value` and exactly one `not-in-set`, plus `omitted` only when the parameter is optional. Before returning, expand every declared partition into its complete deterministic exact slot ID set: one `TP-<Partition ID>-<VALUE-TOKEN>` per Domain value, `TP-<Partition ID>-OMITTED` only for an optional axis, and exactly one `TP-<Partition ID>-NOT-IN-SET`. Every expanded slot ID must appear verbatim in the binding Rule's `Required Test Points` cell and be assigned to concrete Case IDs in that same Coverage Matrix row; ordinary alias/family Test Points do not replace this inventory. Expected by Slot states the documented expectation per slot kind (`domain-value`, `default-behavior`, `empty-result`/`excluded-result` when documented, or `GAP` when the source does not document the complement expectation — never invent 空列表/400). POST/PUT body field-validation enums stay in the Coverage Matrix as `TP-<FIELD>-ENUM-*` and MUST NOT get a Scenario Partition row. Do not create partitions for axes without a documented legal-value domain. Only GET/list query or path parameters whose bound source documents a finite enum or classification set may become a Scenario Partition. Do not create partitions for free-form strings, primary keys, required-or-optional-only parameters, or boundary/format-only axes. If an axis has no finite legal-value domain, do not declare a Partition row and do not invent NOT-IN-SET cases. Cross-axis combinations stay as ONE nominal Case; never declare a cross-axis cartesian partition.",
             "Before finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
             ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
@@ -4730,10 +4741,10 @@ async function buildBackendTestHybridDag(sources) {
         writePolicy: "read-only",
         allowedPaths: ro,
         forbiddenPaths: forbidden,
-        outputContract: "Stdout JSON {modules:[{stem,planReadPath}],planReadPath,planSha256} parsed from the run-owned generate-backend-md-plan-pi/plan.md artifact using the same module-stem extractor as the Completeness Gate.",
-        subtask_prompt: "Parse only $HARNESS_DAG_RUN_DIR/generate-backend-md-plan-pi/plan.md and emit exactly one trailing JSON line {modules:[{stem,planReadPath}],planReadPath,planSha256}. No file writes and no testcase/md/README.md fallback.",
+        outputContract: "Stdout JSON {modules:[{stem,planReadPath}],planReadPath,planSha256,moduleLayout} parsed from the run-owned generate-backend-md-plan-pi/plan.md artifact after strict-layout validation and at most one deterministic Plan-only repair.",
+        subtask_prompt: "Parse only $HARNESS_DAG_RUN_DIR/generate-backend-md-plan-pi/plan.md, validate the optional strict module layout and output-budget proof, apply at most one deterministic Plan-only Module Index repair without project writes, then emit one JSON line. No testcase/md/README.md fallback.",
         shell: {
-            commands: [buildBackendTestModuleManifestShellCommand(layout)],
+            commands: [buildBackendTestModuleManifestShellCommand(layout, taskConfig.backendTest?.moduleLayout)],
             cwd: ".",
             timeoutMs: 60000,
         },
@@ -4769,9 +4780,9 @@ async function buildBackendTestHybridDag(sources) {
                 toolProfile: "write",
                 complexity: "MED",
                 writePolicy: "exclusive",
-                allowedPaths: ["testcase/md/{{item.stem}}.md"],
+                allowedPaths: ["{{item.markdownPath}}"],
                 forbiddenPaths: forbidden,
-                writeSet: ["testcase/md/{{item.stem}}.md"],
+                writeSet: ["{{item.markdownPath}}"],
                 readSet: [
                     "{{item.planReadPath}}",
                     toDagSourcePath(sources, sources.requirementPath),
@@ -4779,21 +4790,22 @@ async function buildBackendTestHybridDag(sources) {
                         ? [toDagSourcePath(sources, sources.constraintPath)]
                         : []),
                     ...intake.referenceIndex.map((entry) => entry.readPath),
-                    `${layout.markdownDir}/{{item.stem}}.md`,
+                    "{{item.markdownPath}}",
                 ],
                 writerOutcomePolicy: {
                     type: "implementation-outcome-v1",
                     requireChangedFiles: true,
                 },
-                retryPolicy: BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY,
-                outputContract: "Write exactly one Chinese module Markdown case-card file testcase/md/<stem>.md with BE-<MODULE>-<NNN> cases and the seven required h3 sections; keep machine IDs/literals exact and do not execute pytest or modify production code/config or the README.",
+                retryPolicy: BACKEND_TEST_MARKDOWN_BINDING_RETRY_POLICY,
+                outputContract: "Write exactly the frozen `{{item.markdownPath}}` Chinese module Markdown case-card file with BE-<MODULE>-<NNN> cases and the seven required h3 sections; keep machine IDs/literals exact and do not execute pytest or modify production code/config or the README.",
                 subtaskPromptTemplate: [
-                    "This is a required file-generation node for exactly one Markdown module. Read the upstream run-owned Markdown plan artifact at `{{item.planReadPath}}` (Coverage Scope + Coverage Matrix + Module Index) and the bounded references, then immediately use write tools to create the single file testcase/md/{{item.stem}}.md. Do not read or recreate testcase/md/README.md. Do not end after analysis or planning, and do not return before a non-empty bounded diff exists. Do not modify any other module file.",
+                    "This is a required file-generation node for exactly one Markdown module. Read the upstream run-owned Markdown plan artifact at `{{item.planReadPath}}` (Coverage Scope + Coverage Matrix + Module Index) and the bounded references, then immediately use write tools to create the single frozen file `{{item.markdownPath}}`. Do not read or recreate testcase/md/README.md. Do not end after analysis or planning, and do not return before a non-empty bounded diff exists. Do not modify any other module file.",
                     "Output budget protocol (hard, max output <=16K per turn): Never paste full Matrix, other modules' case bodies, or source text into assistant chat. Each write/edit tool call touches at most one file (this module). Compact tables/lists are required; omitting required sections or in-scope variants is forbidden. If a Completeness Gate / OUTPUT_LIMIT_RECOVERY retry is injected, continue only listed target paths.",
                     "The first non-empty response line must be exactly IMPLEMENTATION_OUTCOME: changed after the module file has been written, or IMPLEMENTATION_OUTCOME: blocked when precise missing evidence prevents safe generation. already-satisfied is not valid for this node.",
                     "Write human-readable content in Simplified Chinese by default. Keep English only for machine-readable IDs and technical literals such as Case/AC/REQ/BR IDs, HTTP methods, paths, field names, enum values, commands, filenames, code symbols and exact source citations.",
                     'Write the module {{item.stem}} as readable case cards covering every in-scope rule/Test Point the README Coverage Matrix assigns to this module. Every case starts with `## BE-<MODULE>-<NNN>｜<中文用例名称>`. `<NNN>` is exactly three zero-padded digits (`001`, `002`, ...), never two digits (`01`), a bare number, or an alphabetic suffix such as `011A`. Every case must include `### 覆盖规则`, `### 测试点`, `### 场景类型`, `### 前置条件`, `### 操作步骤`, `### 预期结果`, and `### 自动化映射` Do not group cases under "## 测试类 ..." (or any h2 grouping) headings that force Cases down to h3; each Case must be a direct h2 (`##`), and its seven sections must be h3 (`###`) children of that Case. If you need to convey a pytest class, state it inside the Case\'s `### 自动化映射` instead. Forbidden: `## 测试类 X` then `### BE-PD-001` and `### 覆盖规则` at the same h3 level. Required: `## BE-PD-001` then `### 覆盖规则`.; `覆盖规则` and `测试点` must reference exact Matrix Rule Keys/Test Points. Add `测试目的`, `验收标准`, `需求依据`, and `测试数据` for readable evidence. The `验收标准` section must list the exact applicable `AC-...` IDs, and every explicit task AC must appear in at least one Case. Every automatable case explicitly names its target pytest script and exactly one primary symbol so traceability scans only that script/symbol. Evidence-only meta cases that exist solely for non-executable assertion/cross-cutting process evidence may declare `脚本：无` and `primary symbol：无` with empty `变体测试点`, and must not invent a business pytest item.',
-                    "Name this module file with the stable lowercase business stem `{{item.stem}}` (filename `testcase/md/{{item.stem}}.md`). Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Pure hexadecimal/hash-like opaque stems such as `a401606` and `deadbeef` are also forbidden. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `testcase/test_{{item.stem}}.py`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+                    "Name this module file with the exact frozen Module Index stem `{{item.stem}}` (filename `{{item.markdownPath}}`). Never reinterpret or rename an explicit-user-layout stem. Priority-only stems `p0`, `p1` and `p2` are forbidden and must never produce `p0.md` or `test_p0.py`. Pure hexadecimal/hash-like opaque stems such as `a401606` and `deadbeef` are also forbidden. Do not use Case-ID-like module filenames. For every automatable case, `自动化映射` must name exactly `{{item.pytestPath}}`, where the module stem is this Markdown filename without `.md`, lowercased, with non-alphanumeric characters replaced by underscores. Example: `health` → `testcase/test_health.py`; `resource_notes` → `testcase/test_resource_notes.py`. Never invent a different pytest path in Markdown than the module stem implies.",
+                    "AUTOMATION_BINDING_FORMAT_V1 is a literal machine contract. Under every Case's `### 自动化映射`, write these independent lines exactly: `- 脚本：<path|无>`, `- primary symbol：<symbol|无>`, `- 变体测试点：<semicolon-separated TP IDs|无>`, `- 场景断言测试点：<semicolon-separated TP IDs|无>`, `- 横切证据测试点：<semicolon-separated TP IDs|无>`. TP IDs must be on the same line after the colon. Forbidden classification forms include `TP-X（变体测试点）`, `[变体测试点] TP-X`, `【变体测试点】：TP-X`, pipe-delimited annotations, tables, or nested TP lists. Before returning, verify that the Case `### 测试点` exact set equals the pairwise-disjoint union of the three canonical binding lines; do not add, remove, rename or duplicate a TP to make the format pass.",
                     "Scenario Partition slots: when README declares `## Scenario Partitions`, every slot of each declared partition MUST appear in this module's Cases as exactly one variant Test Point with the deterministic ID `TP-<Partition ID>-<VALUE-TOKEN>` (each-value), `TP-<Partition ID>-OMITTED` (optional axis only) and exactly one `TP-<Partition ID>-NOT-IN-SET` complement slot with `intent=enum-invalid`. Example: Partition ID `SP-GET-API-RESOURCE-NOTES-STATUS` → `TP-SP-GET-API-RESOURCE-NOTES-STATUS-ACTIVE`. Slot IDs copy the declared Partition ID exactly; never drop the HTTP method, invent, merge, renumber or split slot IDs. Before returning, derive the complete exact slot set from every applicable Scenario Partitions row and verify that the module Cases declare and bind every slot assigned by the Coverage Matrix; ordinary alias Test Points do not satisfy a partition slot, and aggregate aliases such as `SINGLE`/`MULTIPLE` are forbidden. Prefer ONE Case per partition with a parameter table over duplicated Cases per value. The not-in-set slot value must be a concrete literal absent from the Domain (e.g. `UNKNOWN_TYPE`) and its expected result must come from the bound source — when Expected by Slot is GAP, the Case states the expectation as GAP evidence, never a guessed 空列表/400. Never create cross-axis combination variants beyond the single documented nominal.",
                     "For every variant Test Point, write its machine-checkable `场景意图: <TP-ID>; operation=...; target=...; intent=...` line inside that same Case body/自动化映射. Never collect Scenario Intent lines in a file-level appendix, implementation-details block, or another Case; local TP ownership is mandatory.",
                     "Every Case must keep at least one numbered executable line under `### 操作步骤`; a compact variant/result table may follow but must not replace the numbered action anchor. Keep numbered/bulleted independently assertable results under `### 预期结果`. The exact `### 操作步骤` and `### 预期结果` headings must remain present for every Case, including compact/table-based Cases; never compress later Cases by dropping required headings. Every result must name the observable HTTP status, response field/value, state transition or membership condition, never vague wording such as ‘符合预期’.",
@@ -4836,7 +4848,7 @@ async function buildBackendTestHybridDag(sources) {
             "For every variant Test Point, ensure the Markdown scenario intent is machine-checkable and located inside that same Case body/自动化映射, never in a file-level appendix, implementation-details block, or another Case. Use an exact transport target: `场景意图: <TP-ID>; operation=<METHOD /path>; target=<body.field|query.field|path.field|header.field|request>; intent=<empty|missing|null|min-1|min|max|max+1|pattern-invalid|enum-invalid|wrong-type|nominal-operation|custom-literal:V>; bound=<n optional>; example=<optional>; expectedCode=<optional>`. Never use vague targets such as field=resource/health. Keep pytest params aligned to the exact target. For intent=missing/empty/default-omit, pytest may use `_OMIT` or delete the key; for intent=enum-invalid use a concrete invalid enum literal (for example `UNKNOWN_STATUS`), never `_OMIT`/missing-key; for trim/padded samples use `custom-literal:trim` or a real padded string, not a bare token like `filter-active` when the intent is `custom-literal:ACTIVE`.",
             "Treat the requirement document as the coverage baseline; scope is limited to operations/rules it (or its referenced API contract) describes, and API contract evidence supplements scenario dimensions. For every in-scope operation, check applicable lifecycle/uniqueness states (including deleted-existing when in scope), valid enum values, bounded invalid classes, min-1/min/nominal/max/max+1, allowed/forbidden format classes, required/null/missing/wrong-type semantics, status/error codes, auth and state transitions. Inspect shared validator/helper/DTO/query builder evidence and expand Affected Operations when the same affected path can affect them; unresolved impact stays visible as GAP/CONFLICT. Directly add in-scope omissions; reject scope expansion to operations absent from the requirement document; undefined impact remains GAP/CONFLICT rather than invented behavior.",
             "Check AC completeness/meaning, endpoint, fields/shape, status/error codes, rules, states, documented boundaries/auth, positive/negative coverage, executable steps and assertable results. Require the exact `## Coverage Scope` Field/Value table with the `|---|---|` separator row, a valid classification-policy pair, non-empty Affected Operations/Rule Keys/Scope Evidence, and the classification-specific Regression Floor. Require the exact unnumbered `## Coverage Matrix` heading in the immutable run-owned plan artifact, exact headers, exactly 9 cells in every data row (including a non-empty Dimension), deterministic OpenAPI Rule Keys for every in-scope affected operation, exactly one Matrix row per Rule Key (merge multi-dimension product rows), and bidirectional Matrix Rule/Test Point ↔ Case bindings. Never describe affected-scope coverage as whole-API completeness. Every explicit AC ID must appear in at least one Case `验收标准`; every explicit in-scope AC/REQ/BR Rule Key cited by a Case must have exactly one Coverage Matrix row, and no Case may cite a source Rule Key omitted from the Matrix. Every Matrix Case ID must share at least one of that row's Required Test Points and the Case must cite that Rule Key. Perform an explicit execution-redundancy review: merge checkpoint-only parameter rows, repeated default/read-back assertions, DELETE status/body/follow-up-read checks, response schema/Content-Type checks, PUT full-update/timestamp checks, repeated list setup and identical null/empty inputs when endpoint, input partition, precondition state and expected outcome are the same. Preserve separate POST/PUT, boundary, enum, wrong-type, role/tenant and distinct business-state variants. Directly repair malformed headings/rows/keys and binding modes rather than merely commenting on them. Reject avoidable English prose, duplicated bilingual wording, repeated boilerplate, oversized unstructured sections, a `### 操作步骤` section that contains only a table without any numbered executable line, vague results such as ‘符合预期’, Case-ID-like module filenames (for example `BE-HEALTH.md`), dropped exact `### 操作步骤`/`### 预期结果` headings, and missing or drifted script/function mapping where it can be derived.",
-            "Correct testcase/md/** directly: add documented omissions, remove unsupported cases, rename module files to stable lowercase stems when needed, normalize every Case ID to hyphen-separated module segments plus exactly three zero-padded digits (`BE-RESOURCE_NOTES-01` → `BE-RESOURCE-NOTES-001`; `BE-RN-011A` must be renumbered or merged) consistently across headings/index/mappings, fix automation mappings so each automatable case points at `testcase/test_<module>.py` derived from that module filename and declares exactly one primary symbol (evidence-only meta cases may keep `脚本/primary symbol=无` with empty variants), assign every Test Point exactly one of `变体测试点`/`场景断言测试点`/`横切证据测试点`, then perform an exact-set check: each Case's `### 测试点` set must equal (not merely contain) the union of those three binding lists; delete stale/legacy aliases and ensure every binding-list Test Point is present, expand every variant parameter row into its own atomic TP ID, make every non-cross-cutting TP Case-specific and owned by exactly one Case, require every primary symbol to start with the canonical Case prefix, ensure every explicit AC ID appears in an applicable Case `验收标准`, merge execution duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Remove every credential/header value, placeholder, fake token and anti-example from Markdown. Sensitive key names may remain only as a plain list; values must be described as runtime-only and omitted, with no colon/value pair or literal example anywhere, including details blocks and explanatory text. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations as exact machine-readable identifiers; only normalize Case ID separator/sequence formatting as specified above. Recalculate predicted collected items as `sum(max(1, variant count per Case))`; when the task declares a budget, directly merge redundant journeys/reclassify same-request checkpoints until the prediction is within budget, while preserving all required coverage. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.",
+            "Correct testcase/md/** directly: add documented omissions, remove unsupported cases, preserve every frozen Module Index filename exactly (never rename an explicit-user-layout module; model-derived invalid stems must have been rejected before map expansion), normalize every Case ID to hyphen-separated module segments plus exactly three zero-padded digits (`BE-RESOURCE_NOTES-01` → `BE-RESOURCE-NOTES-001`; `BE-RN-011A` must be renumbered or merged) consistently across headings/index/mappings, fix automation mappings so each automatable case points at `testcase/test_<module>.py` derived from that module filename and declares exactly one primary symbol (evidence-only meta cases may keep `脚本/primary symbol=无` with empty variants), assign every Test Point exactly one of `变体测试点`/`场景断言测试点`/`横切证据测试点`, then perform an exact-set check: each Case's `### 测试点` set must equal (not merely contain) the union of those three binding lists; delete stale/legacy aliases and ensure every binding-list Test Point is present, expand every variant parameter row into its own atomic TP ID, make every non-cross-cutting TP Case-specific and owned by exactly one Case, require every primary symbol to start with the canonical Case prefix, ensure every explicit AC ID appears in an applicable Case `验收标准`, merge execution duplicates, improve navigation/tables/Chinese wording, or record gaps in Chinese. Remove every credential/header value, placeholder, fake token and anti-example from Markdown. Sensitive key names may remain only as a plain list; values must be described as runtime-only and omitted, with no colon/value pair or literal example anywhere, including details blocks and explanatory text. Keep Case IDs, AC/REQ/BR IDs, HTTP methods, paths, fields, enum values, filenames, code symbols and source citations as exact machine-readable identifiers; only normalize Case ID separator/sequence formatting as specified above. Recalculate predicted collected items as `sum(max(1, variant count per Case))`; when the task declares a budget, directly merge redundant journeys/reclassify same-request checkpoints until the prediction is within budget, while preserving all required coverage. The validator accepts Chinese and legacy English section aliases; retain or converge to the Chinese human-readable headings without losing structure.",
             "This is the single Markdown incremental synchronization round. Read every authoritative reference index entry whose role hints include acceptance-criteria, api-contract, data-contract or business-rule; do not rely on the derived PRD as a complete inventory. Preserve every explicit AC/REQ/BR ID, every documented HTTP/business error code, every DTO/JSON field, enum value, boundary, format, nested shape, transaction/state/idempotency/uniqueness/auth/tenant/cross-field rule. For each natural-language normative business rule preserved as required scope, include its exact source sentence without paraphrase together with source path and line/heading anchor so the deterministic ledger can verify quote/hash provenance. Ensure every Case declares exactly `Payload Contract: none` or the three labels `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; every label must occupy its own machine-readable list line, and a Case must never concatenate target/setup operations or multiple `Payload Contract` tokens onto one line, and explanatory prose/details must not repeat any `Payload Contract:` token; never infer missing keys or enum values. A target GET/DELETE operation with no request body must remain `Payload Contract: none` even when its setup journey performs POST/PUT with a DTO; setup payloads never redefine the target Case payload contract. Add only missing Matrix rows/Test Points/Cases/assertions or repair exact drift; do not rewrite already-valid unrelated modules. Work gap-targeted: inspect source anchors and affected modules first, leave unrelated valid modules byte-stable, and return `already-satisfied` without restating the full suite when no gap exists.",
             "For affected API fields, use one valid nominal payload plus atomic required/missing/null/empty/wrong-type, every documented enum value plus bounded invalid classes, documented min-1/min/nominal/max/max+1, formats and nested object/array constraints. Do not generate a Cartesian product or invent undocumented constraints. Do not invent a concrete identifier type when the source only requires presence; for a missing-resource 404 path with unspecified identifier syntax/type, synchronize the Case to a create-delete-derived valid identifier journey rather than an arbitrary UUID/text placeholder.",
             "Scenario Partitions synchronization: when the run-owned plan declares `## Scenario Partitions`, verify each declared partition's slots are fully materialized as variant Test Points with exact `TP-<Partition ID>-...` IDs (each-value per Domain value, OMITTED only for optional axes, exactly one NOT-IN-SET with intent=enum-invalid). Before returning, derive the complete exact slot set from every legal Scenario Partitions row and compare it with both the binding Coverage Matrix Rule's Required Test Points and the final Case `### 测试点`/`变体测试点` sets; directly add every missing exact slot to the already-assigned Case IDs; ordinary alias Test Points do not satisfy a partition slot, and aggregate aliases such as `SINGLE`/`MULTIPLE` are forbidden. Directly add missing slot rows/Cases. Record an illegal plan Partition row that has no source-backed finite domain as GAP/CONFLICT and remove only its derived `TP-SP-*` slots/Cases from target modules; never modify the immutable plan artifact. Never delete a legal source-backed partition or drop its complement slot to force coverage green. When the bound source does not document the complement expectation, keep the slot with GAP expected instead of guessing. Body-field validation enums (`TP-<FIELD>-ENUM-*`) are NOT partitions — do not add partition rows for them.",
@@ -4889,10 +4901,10 @@ async function buildBackendTestHybridDag(sources) {
         writePolicy: "read-only",
         allowedPaths: ro,
         forbiddenPaths: forbidden,
-        outputContract: "Stdout JSON {modules:[{stem,planReadPath}],planReadPath,planSha256} parsed from the run-owned Markdown plan artifact, so the pytest map shard set and every child planReadPath deterministically match the Markdown map manifest.",
-        subtask_prompt: "Parse only the run-owned generate-backend-md-plan-pi/plan.md artifact and emit exactly one trailing JSON line {modules:[{stem,planReadPath}],planReadPath,planSha256}. Reuse the same plan-derived Module Index contract as the Markdown manifest; do not search for or fall back to testcase/**/README.md. No file writes.",
+        outputContract: "Stdout JSON {modules:[{stem,planReadPath}],planReadPath,planSha256,moduleLayout} parsed from the final strict-layout-validated run-owned Markdown plan artifact, matching the Markdown map manifest.",
+        subtask_prompt: "Parse only the final run-owned generate-backend-md-plan-pi/plan.md artifact with the same strict module-layout and output-budget contract; do not search for or fall back to testcase/**/README.md. No project file writes.",
         shell: {
-            commands: [buildBackendTestModuleManifestShellCommand(layout)],
+            commands: [buildBackendTestModuleManifestShellCommand(layout, taskConfig.backendTest?.moduleLayout)],
             cwd: ".",
             timeoutMs: 60000,
         },
@@ -4928,7 +4940,7 @@ async function buildBackendTestHybridDag(sources) {
                 toolProfile: "write",
                 complexity: "MED",
                 writePolicy: "exclusive",
-                allowedPaths: ["testcase/test_{{item.stem}}.py"],
+                allowedPaths: ["{{item.pytestPath}}"],
                 forbiddenPaths: Array.from(new Set([
                     ...forbidden,
                     "testcase/md/**",
@@ -4937,22 +4949,22 @@ async function buildBackendTestHybridDag(sources) {
                     "pyproject.toml",
                     "setup.cfg",
                 ])),
-                writeSet: ["testcase/test_{{item.stem}}.py"],
+                writeSet: ["{{item.pytestPath}}"],
                 writerOutcomePolicy: {
                     type: "implementation-outcome-v1",
                     requireChangedFiles: true,
                 },
                 retryPolicy: BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY,
-                outputContract: "Write exactly one pytest module file testcase/test_<stem>.py whose actual test function region contains the exact Case ID, preferably in the function name or docstring. testcase/md/<module>.md (excluding README.md) maps one-to-one to testcase/test_<module>.py; never merge or split modules. No JSON and no pytest execution.",
+                outputContract: "Write exactly the frozen pytest module file `{{item.pytestPath}}` whose actual test function region contains the exact Case ID, preferably in the function name or docstring. the frozen `{{item.markdownPath}}` maps one-to-one to `{{item.pytestPath}}`; never merge or split modules. No JSON and no pytest execution.",
                 subtaskPromptTemplate: [
-                    "Convert the single Markdown module testcase/md/{{item.stem}}.md into one self-contained pytest module. Before writing, also read the run-owned Markdown plan artifact at `{{item.planReadPath}}` and use its explicit API target/environment table as the authoritative fallback base URL for every module. A task/Markdown `API_BASE_URL` target takes precedence over project README dev-server URLs; never infer a backend API fallback from a frontend/Vite port such as localhost:3000. After reading the module Markdown, the run-owned plan artifact, and the bounded pytest config/conftest, immediately use write tools to create the single file testcase/test_{{item.stem}}.py. Define any bounded HTTP client fixture, request logging/redaction/truncation helper and payload builders needed by this module inside that same file; do not import generated testcase/**/helpers/** or testcase/**/factories/** assets. Do not end after analysis or planning. Do not modify Markdown, conftest, helpers/factories, or any other module's pytest script.",
-                    "Output budget protocol (hard, max output <=16K per turn): Write exactly one test_{{item.stem}}.py. Never paste full Python modules into assistant chat. Do not merge or split modules. Do not reduce params/assertions/skips to fit. If OUTPUT_LIMIT_RECOVERY is injected, continue only listed missing/broken scripts.",
+                    "Convert the single frozen Markdown module `{{item.markdownPath}}` into one self-contained pytest module. Before writing, also read the run-owned Markdown plan artifact at `{{item.planReadPath}}` and use its explicit API target/environment table as the authoritative fallback base URL for every module. A task/Markdown `API_BASE_URL` target takes precedence over project README dev-server URLs; never infer a backend API fallback from a frontend/Vite port such as localhost:3000. After reading the module Markdown, the run-owned plan artifact, and the bounded pytest config/conftest, immediately use write tools to create the single frozen file `{{item.pytestPath}}`. Define any bounded HTTP client fixture, request logging/redaction/truncation helper and payload builders needed by this module inside that same file; do not import generated testcase/**/helpers/** or testcase/**/factories/** assets. Do not end after analysis or planning. Do not modify Markdown, conftest, helpers/factories, or any other module's pytest script.",
+                    "Output budget protocol (hard, max output <=16K per turn): Write exactly the frozen `{{item.pytestPath}}`. Never paste full Python modules into assistant chat. Do not merge or split modules. Do not reduce params/assertions/skips to fit. If OUTPUT_LIMIT_RECOVERY is injected, continue only listed missing/broken scripts.",
                     "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them. Hard contract: intent=enum-invalid MUST pass a concrete invalid value literal (string/number/boolean), never `_OMIT`/None/missing key; intent=missing/empty may use `_OMIT` or delete the key; intent=custom-literal:trim|whitespace-padded requires a leading/trailing whitespace string with non-empty trimmed content (all-whitespace belongs to empty/whitespace-only, not trim); intent=custom-literal:ACTIVE|ARCHIVED requires the exact enum string, never descriptive tokens like filter-active; intent=max/min/max+1 should pass a repeated-string length expression, a bare length number N, or a helper named _*_LEN{N} / _*_MAX_LENGTH / _*_OVER_LENGTH — never a bare 1 for oversize. Hard contract: request payload dicts may only contain DTO field keys from Payload Allowed Paths; never put expect/expected/echo_* helper keys inside the JSON body dict. Path/query/header identifiers and scenario-control metadata (including `id`, expected codes, and selector labels) must stay in separate pytest parameters and helper arguments; never merge them into a DTO patch or JSON body unless that exact path is allowed by the Markdown payload contract. Normalize the configured API base URL with `rstrip(\"/\")` (or equivalently join exactly one slash) before appending endpoint paths; generated requests must never contain a `//api/...` path. When the bound source documents a concrete non-secret local API URL, generated clients must use it as the fallback in `os.environ.get(\"API_BASE_URL\", \"<documented-url>\")`; do not require an otherwise-uninjected environment variable or fail setup solely because it is absent. Missing-field helpers must remove keys idempotently with `payload.pop(field, None)`, never `del payload[field]`, because optional fields may already be absent.",
                     "For every response contract that requires an object or pagination envelope, first assert that each envelope/data value is a dict and that required keys exist, then index fields and assert values. Never let an incidental KeyError or list/string TypeError stand in for the explicit response-shape contract failure.",
                     'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
-                    "Name the generated pytest file so it corresponds one-to-one with its source Markdown module file: this module stem `{{item.stem}}` maps to exactly one `testcase/test_{{item.stem}}.py`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `resource_notes` → `testcase/test_resource_notes.py`, `health` → `testcase/test_health.py`. If Markdown automation mapping names a different path than this module stem path, still write the module stem path and do not invent prefixes. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
+                    "Name the generated pytest file so it corresponds one-to-one with its source Markdown module file: this module stem `{{item.stem}}` maps to exactly the frozen `{{item.pytestPath}}`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `resource_notes` → `testcase/test_resource_notes.py`, `health` → `testcase/test_health.py`. If Markdown automation mapping names a different path than this module stem path, still write the frozen manifest pytest path and do not invent prefixes. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
                     "Scenario Partition slots: every `TP-<Partition ID>-...` variant Test Point declared by this module's Markdown MUST become exactly one literal direct `pytest.param(..., id=\"TP-<Partition ID>-...\")` row with the exact slot ID; the not-in-set slot passes a concrete literal absent from the documented Domain (e.g. `UNKNOWN_TYPE`) — never `_OMIT`, never a descriptive token. Never split one slot into multiple params or merge several slots under a family TP id. Slot filtering requests hit the documented list endpoint with the slot value as the query/path filter.",
-                    "Keep this module self-contained: define module-local fixtures and helpers directly in testcase/test_{{item.stem}}.py, so pytest discovers every fixture dependency without external plugin registration. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions. Recursively redact sensitive values and apply bounded truncation before logging.",
+                    "Keep this module self-contained: define module-local fixtures and helpers directly in `{{item.pytestPath}}`, so pytest discovers every fixture dependency without external plugin registration. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions. Recursively redact sensitive values and apply bounded truncation before logging.",
                     "Materialize every automatable Markdown Case exactly once as one canonical primary pytest symbol. Preserve every explicit variant Test Point as a stable pytest.param id and every assertion/cross-cutting binding as declared. Build request payloads from the effective Markdown test data literally: keep all declared DTO keys, nested shapes, enum values, missing/null/boundary variants and business-state preconditions; never substitute guessed convenience fields or rename contract fields. Never assert an identifier's concrete Python/JSON type unless the Markdown or bound contract explicitly declares that type; when only presence is required, accept any non-null scalar identifier and serialize it safely into the path. For a nonexistent-resource 404 Case whose identifier syntax/type is not declared, obtain a syntactically valid identifier from a live create response and delete it before the 404 request; never invent an arbitrary UUID/text identifier that may fail path conversion with 400. Respect every local helper's actual return signature: never tuple-unpack a scalar status/id/helper result, and never treat a tuple response as a scalar.",
                     "Do not read source/**, add cases, reassign ACs, modify conftest/config/production code, use skip/xfail, swallow assertions, execute pytest, or emit JSON. For best-effort cleanup, catch only the narrow transport exception actually raised by the selected HTTP client (for example `requests.RequestException` or `urllib.error.URLError`); never use bare `except`, `Exception`, or `BaseException` with `pass`.",
                     ...(sharedSetupPytestPrompt ? [sharedSetupPytestPrompt] : []),
@@ -5024,7 +5036,7 @@ async function buildBackendTestHybridDag(sources) {
         'mkdir -p "${HARNESS_DAG_RUN_DIR}/reports"',
         'echo "pytest targets are resolved at runtime from execution-readiness v2 eligibleItemIds"',
     ].join("; ");
-    const execute = shellNode("execute-backend-pytest-and-html-report-shell", [manifest.id], "markdown-execute-html", "Read canonical contracts/backend-test-execution-readiness.json v2, verify final asset and eligibility-input hashes, then execute exactly its `eligibleItemIds` pytest node IDs once. Never execute `excludedItems`; retain each exclusion reason as residual TestBug/automation evidence rather than ProductBug. Prefer the deterministic module one-to-one path when a mapped script is missing but the module stem file exists. Generate a native pytest-html self-contained report, then render the primary self-contained Chinese HTML report from the same pytest-html plus final Markdown case metadata without rerun. Keep 测试结论 and quality status; make node 6 Markdown validation + case coverage and node 13 traceability + Markdown-to-pytest correspondence expandable to their full escaped details; show each failure overview item with its original pytest message plus deterministic evidence-based reason analysis; list failure/error case cards before the remaining cases while preserving stable order. Each polished per-case result card includes concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.", "One scoped pytest execution over readiness-authorized eligible pytest items producing a valid pytest-html report with per-case captured output, self-contained reports/backend-test.html, reports/backend-test.md, reports/backend-test-facts.md, a deterministic self-contained reports/backend-test-l5-dashboard.html (machine-computed L-5 metrics, no JSON), and an optional contracts/code-coverage-v1.json when jacocoCoverage is configured (JaCoCo TCP dump → jacoco.xml → parsed; failure-safe); exit 0/1 with valid evidence continues.", [pytestCommand], 300000);
+    const execute = shellNode("execute-backend-pytest-and-html-report-shell", [manifest.id], "markdown-execute-html", "Read canonical contracts/backend-test-execution-readiness.json v2, verify final asset and eligibility-input hashes, then execute exactly its `eligibleItemIds` pytest node IDs once. Never execute `excludedItems`; retain each exclusion reason as residual TestBug/automation evidence rather than ProductBug. Prefer the deterministic module one-to-one path when a mapped script is missing but the module stem file exists. Generate a native pytest-html self-contained report, then render the primary self-contained Chinese HTML report from the same pytest-html plus final Markdown case metadata without rerun. Keep 测试结论 and quality status; make node 6 Markdown validation + case coverage and node 13 traceability + Markdown-to-pytest correspondence expandable to their full escaped details; show each failure overview item with its original pytest message plus deterministic evidence-based reason analysis; list failure/error case cards before the remaining cases while preserving stable order. Each polished per-case result card includes concise scenario, automation test name, result, duration, and redacted bounded HTTP request parameters/response results for both passed and failed cases. Do not render a technical/execution evidence section in HTML; retain auditable paths and hashes in facts.", "One scoped pytest execution over readiness-authorized eligible pytest items producing a valid pytest-html report with per-case captured output, self-contained reports/backend-test.html, reports/backend-test.md, reports/backend-test-facts.md, a deterministic self-contained reports/backend-test-l5-dashboard.html (machine-computed L-5 metrics, no JSON), and an optional contracts/code-coverage-v1.json when jacocoCoverage is configured (JaCoCo TCP dump → jacoco.xml → parsed; failure-safe); exit 0/1 with valid evidence continues.", [pytestCommand], taskConfig.backendTest?.executeTimeoutMs ?? 300000);
     if (execute.shell) {
         execute.shell.envAllowlist = collectBackendTestShellEnvAllowlist(sources);
     }
@@ -5114,6 +5126,7 @@ async function buildBackendTestHybridDag(sources) {
         spec.backendTestSharedSetup = { ...intake.sharedSetup };
     }
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -5868,6 +5881,7 @@ function buildFrontendTestHybridDag(sources) {
     };
     applyFrontendTestLayoutToDagSpec(spec, layout);
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -6370,6 +6384,7 @@ function buildKnowledgeSyncHybridDag(sources) {
             buildKnowledgeSyncPointerNode(sources, featureId),
         ],
     };
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -6816,6 +6831,7 @@ function buildKnowledgeGraphBootstrapHybridDag(sources) {
             buildKgBootstrapMaterializeNode(sources),
         ],
     };
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -6913,6 +6929,8 @@ async function buildHybridDagForTemplate(sources, template, options = {}) {
     }
     else if (template === "frontend-test-dag")
         spec = buildFrontendTestHybridDag(sources);
+    else if (template === "backend-test-analysis-dag")
+        spec = buildBackendTestAnalysisHybridDag(sources);
     else if (template === "backend-test-dag")
         spec = await buildBackendTestHybridDag(sources);
     else if (template === "knowledge-sync-dag")
@@ -6949,6 +6967,7 @@ async function buildHybridDagForTemplate(sources, template, options = {}) {
         template === "supervised-implementation") {
         stampTargetTemplateTransientRetryProfile(spec);
     }
+    stampGeneratedArtifactBindings(spec);
     spec = parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -6956,6 +6975,7 @@ async function buildHybridDagForTemplate(sources, template, options = {}) {
 const GOVERNANCE_DISALLOWED_TEMPLATES = new Set([
     "frontend-implementation",
     "frontend-test-dag",
+    "backend-test-analysis-dag",
     "backend-test-dag",
     "knowledge-sync-dag",
     "knowledge-graph-bootstrap-dag",
@@ -7316,6 +7336,7 @@ function buildReviewGatedHybridDag(standard, sources) {
     applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
     stampTargetTemplateTransientRetryProfile(spec);
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;
@@ -7821,6 +7842,7 @@ async function buildSupervisedHybridDag(standard, sources) {
     applySddEmbeddedEnhancements(spec, sources.sddEmbeddedSkills ?? new Set());
     stampTargetTemplateTransientRetryProfile(spec);
     applyDefaultReadOnlyRetryPolicy(spec);
+    stampGeneratedArtifactBindings(spec);
     parseDagSpec(spec);
     assertValidDagSpec(spec);
     return spec;