@tea-agent/loop-agent 0.42.0-next.15 → 0.42.0-next.16

package/dist/workflows/dag/node-execution.js

@@ -13,7 +13,7 @@ import { buildDagNodePromptEnvelope, formatConvergenceFeedbackBlock, } from "./p
 import { persistLongNodeOutputArtifacts } from "./upstream-artifacts.js";
 import { materializeDeclaredArtifactFacts } from "./artifact-bindings.js";
 import { buildOutputLimitRecoverySection, loadBackendTestWriterProgressForRetry, } from "./backend-test-writer-completeness.js";
-import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
+import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, OUTPUT_LIMIT_RETRY_CATEGORY, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
 import { applyNodeActivity, evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
 import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, parseJsonReviewVerdict, validateOutputProtocol, } from "./output-protocol.js";
 import { getStructuredContractValidator } from "./contract-output-registry.js";
@@ -257,6 +257,9 @@ function frontendPlanValidationRetryGuidance(reason) {
     if (/verificationTargets.*uiStates|uiStates.*verificationTargets/i.test(reason)) {
         guidance.push("For this retry, provide verificationTargets[].uiStates as an array; use [] when the target has no named UI state.");
     }
+    if (/duplicate|already recorded/i.test(reason)) {
+        guidance.push("For this retry, re-commit the corrected entry with the same id and replace=true; the ledger compiles the latest submission as the full replacement. A duplicate receipt is a correction invitation, not a prohibition, and backfilling a cited fact's reverse reference in-node does not re-derive committed facts.");
+    }
     return guidance;
 }
 function compactRetryText(text, maxChars) {
@@ -774,6 +777,87 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
+    // Repair-category guidance must outrank the retry ladder position: the
+    // ladder advances monotonically on transport failures (e.g. length →
+    // compact-terminal-first), and its "keep the committed ledger intact"
+    // instruction directly contradicts the repair action for invalid-output /
+    // truncated ledger facts (re-commit corrected record_* facts). When both
+    // apply, the model receives the repair instruction, not the rung script.
+    if (previousFailureCategory === "invalid-output" &&
+        task.structuredContractOutput &&
+        previousProtocolReason) {
+        // The frontend plan node's compile authority is the committed typed
+        // ledger, not a fenced JSON text artifact: its retry guidance must
+        // direct the model to re-commit corrected record_* facts and
+        // finalize_plan. The legacy full-contract JSON guidance below applies
+        // only to nodes whose authority is still a text contract artifact.
+        if (task.structuredContractOutput.schemaId ===
+            "frontend-implementation-contract-plan-patch-v1") {
+            const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
+                ? [
+                    "",
+                    "The writeSet is too large for one implement node. Preserve the complete requirement and file coverage. This needs a Contract-level task split, not a Plan formatting repair. Report the write-set-too-large finding and the affected paths for the controller to resume Contract/split orchestration. Plan cannot change protected targets.files or call Contract-only tools; do not invent a split tool or discard required files.",
+                ]
+                : [];
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "Previous plan ledger facts failed canonical contract validation:",
+                previousProtocolReason,
+                "Fix the reported violations by re-committing corrected record_* facts and calling finalize_plan exactly once. The committed typed ledger is the only compile authority.",
+                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
+                ...frontendPlanValidationRetryGuidance(previousProtocolReason),
+                ...splitGuidance,
+                "</retry_instruction>",
+            ].join("\n");
+        }
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Previous attempt produced an invalid frontend implementation contract:",
+            previousProtocolReason,
+            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
+            "Fix every reported field violation: do not emit null for optional fields, do not misspell field names, and match the required types exactly.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "invalid-output" &&
+        task.id === "frontend-scout-pi") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The previous Scout attempt did not commit a complete, runtime-evidenced target surface.",
+            "Search the repository only as needed to establish the real entrypoint, implementation ownership, and applicable test path. Commit record_target_surface with completeness=complete and unresolvedPaths=[] only after at least one named target has fresh runtime evidence, unless the task source explicitly declares a greenfield target: in that case every future path must be source-declared by the runtime-enriched fact. If ownership truly cannot be established, record completeness=blocked with each unresolved path; do not make Plan discover it.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "structured-output-truncated" &&
+        task.structuredContractOutput) {
+        if (task.structuredContractOutput.schemaId ===
+            "frontend-implementation-contract-plan-patch-v1") {
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "Previous attempt was truncated by the provider (stopReason=length) before the plan facts were fully committed.",
+                "Re-commit the missing record_* facts and call finalize_plan exactly once; the committed typed ledger is the only compile authority. Do NOT re-read contract/scout outputs or source files — use the facts already in context. Commit record_* facts one tool call per message, then finalize_plan immediately.",
+                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
+                "</retry_instruction>",
+            ].join("\n");
+        }
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Previous attempt was truncated by the provider (stopReason=length) before the JSON contract was completed.",
+            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
+            "The JSON artifact must be complete; omit evidence excerpts and duplicated upstream context.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
     if (frontendPlanRetryStep === "compact-terminal-first") {
         return [
             basePrompt,
@@ -845,83 +929,25 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
-    if (previousFailureCategory === "invalid-output" &&
-        task.structuredContractOutput &&
-        previousProtocolReason) {
-        // The frontend plan node's compile authority is the committed typed
-        // ledger, not a fenced JSON text artifact: its retry guidance must
-        // direct the model to re-commit corrected record_* facts and
-        // finalize_plan. The legacy full-contract JSON guidance below applies
-        // only to nodes whose authority is still a text contract artifact.
-        if (task.structuredContractOutput.schemaId ===
-            "frontend-implementation-contract-plan-patch-v1") {
-            const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
-                ? [
-                    "",
-                    "The writeSet is too large for one implement node. Do NOT delete implementation files to squeeze under the limit — that drops required work. Split the task via record_split_proposal (or narrow targets.files to a genuine subset) so each implement node stays bounded; the full file set must remain covered across the split.",
-                ]
-                : [];
-            return [
-                basePrompt,
-                "",
-                "<retry_instruction>",
-                "Previous plan ledger facts failed canonical contract validation:",
-                previousProtocolReason,
-                "Fix the reported violations by re-committing corrected record_* facts and calling finalize_plan exactly once. The committed typed ledger is the only compile authority.",
-                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
-                ...frontendPlanValidationRetryGuidance(previousProtocolReason),
-                ...splitGuidance,
-                "</retry_instruction>",
-            ].join("\n");
-        }
+    // Generic output-limit fallback. Every branch above this one carries a
+    // more precise instruction for the same capacity signal (contract repair
+    // reasons, ladder rungs — compact-terminal-first is the reason-mandated
+    // rung for length-before-terminal —, protocol/review/read-burst repair),
+    // so output-limit must not shadow them.
+    if (previousFailureCategory === OUTPUT_LIMIT_RETRY_CATEGORY) {
         return [
             basePrompt,
             "",
             "<retry_instruction>",
-            "Previous attempt produced an invalid frontend implementation contract:",
-            previousProtocolReason,
-            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
-            "Fix every reported field violation: do not emit null for optional fields, do not misspell field names, and match the required types exactly.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "invalid-output" &&
-        task.id === "frontend-scout-pi") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "The previous Scout attempt did not commit a complete, runtime-evidenced target surface.",
-            "Search the repository only as needed to establish the real entrypoint, implementation ownership, and applicable test path. Commit record_target_surface with completeness=complete and unresolvedPaths=[] only after at least one named target has fresh runtime evidence, unless the task source explicitly declares a greenfield target: in that case every future path must be source-declared by the runtime-enriched fact. If ownership truly cannot be established, record completeness=blocked with each unresolved path; do not make Plan discover it.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "structured-output-truncated" &&
-        task.structuredContractOutput) {
-        if (task.structuredContractOutput.schemaId ===
-            "frontend-implementation-contract-plan-patch-v1") {
-            return [
-                basePrompt,
-                "",
-                "<retry_instruction>",
-                "Previous attempt was truncated by the provider (stopReason=length) before the plan facts were fully committed.",
-                "Re-commit the missing record_* facts and call finalize_plan exactly once; the committed typed ledger is the only compile authority. Do NOT re-read contract/scout outputs or source files — use the facts already in context. Commit record_* facts one tool call per message, then finalize_plan immediately.",
-                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
-                "</retry_instruction>",
-            ].join("\n");
-        }
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Previous attempt was truncated by the provider (stopReason=length) before the JSON contract was completed.",
-            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
-            "The JSON artifact must be complete; omit evidence excerpts and duplicated upstream context.",
+            "The previous turn ended with stopReason=length before the required output was complete. This is output-capacity truncation, not empty output.",
+            "Continue incrementally from already committed typed facts and current in-scope workspace files. Do not repeat completed discovery, decisions, facts, or writes.",
+            "Generate the smallest unfinished unit next, validate its required format immediately, repair any format error in this node, and only then continue to the next unfinished unit or terminal tool.",
+            "Keep prose minimal and finish the required terminal/output protocol as soon as the remaining work is valid.",
             "</retry_instruction>",
         ].join("\n");
     }
     if (previousFailureCategory === "writer-empty-diff") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         // When a completeness progress exists for this writer, fold the concrete
         // target paths into the empty-diff retry so the model does not guess and
         // does not need to read a forbidden `.harness/**` evidence file.
@@ -949,7 +975,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
         ].join("\n");
     }
     if (previousFailureCategory === "incomplete-write-set") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         const bindingOnly = task.id?.startsWith("generate-backend-md-case-") === true &&
             (recoveryTargetPaths?.length ?? 0) === 1 &&
             Object.values(recoveryDiagnostics ?? {}).flat().some((detail) => /(?:unclassified Test Points|duplicate Test Point bindings)/i.test(detail));
@@ -1765,6 +1791,32 @@ export async function executeDagNode(input) {
                 durationMs: 0,
             };
         }
+        // stopReason=length on top of a bare empty-output verdict is a provider
+        // capacity signal, not a true empty response: reroute it through the
+        // dedicated output-limit retry path while keeping the raw category for
+        // diagnostics. Bare empty-output and transport aliases (network,
+        // nonzero-exit, unknown) are rerouted — categories that already carry a
+        // precise repair instruction (output-too-large, invalid-output,
+        // protocol-invalid, structured-output-truncated via the validators below,
+        // writer categories) keep their classification so their exact retry
+        // guidance still reaches the model.
+        if (task.executor === "pi" &&
+            !result.ok &&
+            result.stopReason === "length" &&
+            (result.failureCategory === undefined ||
+                ["empty-output", "network", "nonzero-exit", "unknown"].includes(result.failureCategory))) {
+            result = {
+                ...result,
+                rawFailureCategory: result.rawFailureCategory ?? result.failureCategory,
+                failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
+                stderr: [
+                    result.stderr,
+                    "output-limit: stopReason=length; preserve completed work and retry only the unfinished output",
+                ]
+                    .filter(Boolean)
+                    .join("\n"),
+            };
+        }
         if (task.id === "generate-backend-md-plan-pi" &&
             !result.ok &&
             (result.failureCategory === "output-too-large" ||
@@ -1898,7 +1950,7 @@ export async function executeDagNode(input) {
             !result.ok &&
             retryPolicy !== undefined) {
             const submissions = await countContractRecordSubmissions(runDir, nodeId);
-            if (submissions === 0) {
+            if (submissions === 0 && result.stopReason !== "length") {
                 result = {
                     ...result,
                     failureCategory: "empty-output",

package/dist/workflows/dag/rerun-feedback.js

@@ -408,6 +408,7 @@ export async function deriveDagRerunFeedback(input) {
             return (node?.status === "ERROR" &&
                 [
                     "empty-output",
+                    "output-limit",
                     "invalid-output",
                     "writer-thinking-exhausted",
                     "writer-budget-exhausted",

package/dist/workflows/dag/rerun-plan.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { z } from "zod";
 import { assertTaskContractBindingFresh } from "./task-contract-binding.js";
+import { workspaceDriftedPaths, } from "./workspace-checkpoint.js";
 import { isSafeReadOnlyPiRetryCandidate, isTransportCrashedExclusiveWriter } from "./retry-policy.js";
 import { resolveDagTaskSourcePath } from "../../task/dag-source-paths.js";
 import { composeDagPromptOverridePrompt, MAX_DAG_RERUN_PROMPT_OVERRIDE_CHARS, } from "../../shared/dag-prompt-override.js";
@@ -1110,6 +1111,46 @@ function deriveSuggestedAction(input) {
     }
     return "manual";
 }
+/**
+ * Gitignore-style-lite matcher for readSet/writeSet path patterns in scoped
+ * workspace-drift evaluation: literal paths match exactly; `**` spans path
+ * segments (a trailing `/**` also matches when nothing follows), `*` stays
+ * within one segment, `?` is one non-separator char.
+ */
+function pathMatchesWorkspacePattern(pathValue, pattern) {
+    const normalizedPath = pathValue.replace(/\\/g, "/").replace(/^\.\//, "");
+    const trimmed = pattern.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!trimmed || trimmed === "/")
+        return false;
+    if (trimmed === normalizedPath)
+        return true;
+    let source = "";
+    for (let index = 0; index < trimmed.length; index += 1) {
+        const char = trimmed[index];
+        if (char === "*") {
+            if (trimmed[index + 1] === "*") {
+                if (trimmed[index + 2] === "/") {
+                    source += "(?:.*/)?";
+                    index += 2;
+                }
+                else {
+                    source += ".*";
+                    index += 1;
+                }
+            }
+            else {
+                source += "[^/]*";
+            }
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`).test(normalizedPath);
+}
 function deriveRisk(reasonCodes, resetCount) {
     if (reasonCodes.includes("restart-subgraph-contains-writer") ||
         reasonCodes.includes("restart-subgraph-contains-unsafe-shell") ||
@@ -1213,7 +1254,14 @@ export async function evaluateDagRerunPlan(input) {
         blockedReasons.push("parent-lifecycle-ineligible");
     }
     else if (input.parentState.status !== "failed" &&
-        input.parentState.status !== "partial_failed") {
+        input.parentState.status !== "partial_failed" &&
+        // A superseded parent is a terminal operator judgment about the run as
+        // a whole, not about its deterministic read-only compute: its FINISHED
+        // upstream nodes are still valid fact donors for the imported set, and
+        // every unsafe case (writers in the reset subgraph, decision gates,
+        // stale checkpoints, unresolved ERROR nodes outside the closure) keeps
+        // its own dedicated block below.
+        input.parentState.status !== "superseded") {
         reasonCodes.push("parent-lifecycle-ineligible");
         blockedReasons.push("parent-lifecycle-ineligible");
     }
@@ -1241,8 +1289,36 @@ export async function evaluateDagRerunPlan(input) {
     else if (input.currentWorkspace?.fingerprint &&
         input.parentTerminalWorkspace.fingerprint !==
             input.currentWorkspace.fingerprint) {
-        reasonCodes.push("workspace-drift");
-        blockedReasons.push("workspace-drift");
+        // Whole-fingerprint drift is refined to content-level paths: the rerun
+        // re-derives (readSet) and rewrites (writeSet) the reset subgraph's own
+        // paths, so drift confined to those paths is recomputed by the rerun
+        // itself and must not force a full standalone rerun. Drift anywhere
+        // else — especially inputs of imported fact-reuse nodes — keeps the
+        // strict block. Indeterminate checkpoints fail closed.
+        const driftedPaths = workspaceDriftedPaths(input.parentTerminalWorkspace, input.currentWorkspace);
+        const importedReadPaths = importedNodeIds.flatMap((nodeId) => {
+            const task = tasksByIdForPlan.get(nodeId);
+            return task?.readSet ?? [];
+        });
+        const scopedDrift = driftedPaths !== undefined &&
+            driftedPaths.length > 0 &&
+            driftedPaths.every((driftPath) => !importedReadPaths.some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern)) &&
+                resetNodeIds.some((nodeId) => {
+                    const task = tasksByIdForPlan.get(nodeId);
+                    if (!task)
+                        return false;
+                    return [
+                        ...(task.writeSet ?? []),
+                        ...(task.readSet ?? []),
+                    ].some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern));
+                }));
+        if (scopedDrift) {
+            reasonCodes.push("workspace-drift-scoped");
+        }
+        else {
+            reasonCodes.push("workspace-drift");
+            blockedReasons.push("workspace-drift");
+        }
     }
     else if (!input.currentWorkspace?.fingerprint) {
         reasonCodes.push("workspace-checkpoint-missing");
@@ -1293,8 +1369,18 @@ export async function evaluateDagRerunPlan(input) {
     }
     for (const nodeId of importedNodeIds) {
         const record = input.parentState.nodes[nodeId];
-        if (!record)
+        if (!record) {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
             continue;
+        }
+        if (record.status === "PENDING" || record.status === "RUNNING") {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
+            continue;
+        }
         if (record.status === "ERROR") {
             reasonCodes.push("parent-facts-invalid");
             blockedReasons.push("parent-facts-invalid");

package/dist/workflows/dag/rerun-run.js

@@ -784,6 +784,13 @@ async function stageContinuationRun(input) {
         if (!parentRecord) {
             throw new Error(`parent node record missing for imported node: ${nodeId}`);
         }
+        if (parentRecord.status !== "FINISHED" &&
+            !(parentRecord.status === "SKIPPED" &&
+                (parentRecord.skippedReason?.includes("condition") ||
+                    parentRecord.skippedReason?.includes("runIf") ||
+                    parentRecord.skippedReason?.includes("run-if")))) {
+            throw new Error(`parent node is not a settled fact donor for imported node: ${nodeId}`);
+        }
         const { manifestNode, importedRecord } = await importNodeFacts({
             parentRunDir: input.parentRunDir,
             newRunDir: runDir,

package/dist/workflows/dag/retry-policy.js

@@ -7,8 +7,8 @@ import { TYPED_EVENT_FACT_KINDS } from "./frontend-typed-event-store.js";
  * is re-exported here unchanged so retry-policy stays the single import
  * surface for retry policies and helpers.
  */
-export { ALL_DAG_RETRY_CATEGORIES, CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, PROTOCOL_INVALID_RETRY_CATEGORY, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_OUTPUT_TRUNCATED_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, dagRetryBackoffSchema, dagRetryCategorySchema, dagRetryPolicySchema, } from "./dag-retry-schema.js";
-import { CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./dag-retry-schema.js";
+export { ALL_DAG_RETRY_CATEGORIES, CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, PROTOCOL_INVALID_RETRY_CATEGORY, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_OUTPUT_TRUNCATED_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, dagRetryBackoffSchema, dagRetryCategorySchema, dagRetryPolicySchema, } from "./dag-retry-schema.js";
+import { CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./dag-retry-schema.js";
 const RETRY_SAFE_PI_ROLES = new Set([
     "planner",
     "scout",
@@ -19,7 +19,7 @@ const RETRY_SAFE_PI_ROLES = new Set([
 ]);
 /**
  * The default retry policy applied to safe generated read-only Pi nodes.
- * Total attempts: 3, exponential backoff with cap.
+ * Total attempts: 5, exponential backoff with cap.
  *
  * Includes `context-overflow`: a read-only node that blew the context window
  * (400 request too large, e.g. a review node accumulating too many reads) is a
@@ -29,7 +29,7 @@ const RETRY_SAFE_PI_ROLES = new Set([
  * design-review/review fell straight to ERROR without a retry attempt.
  */
 export const DEFAULT_READ_ONLY_PI_RETRY_POLICY = {
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
@@ -125,7 +125,10 @@ export const WRITER_EMPTY_DIFF_RETRY_POLICY = {
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
-    retryCategories: [WRITER_EMPTY_DIFF_RETRY_CATEGORY],
+    retryCategories: [
+        WRITER_EMPTY_DIFF_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
+    ],
 };
 /**
  * Bounded transport retry for standard exclusive implementers when a provider
@@ -140,6 +143,7 @@ export const WRITER_TRANSPORT_RETRY_POLICY = {
     retryCategories: [
         WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
         CONTEXT_OVERFLOW_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /**
@@ -175,6 +179,7 @@ export const TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY = {
     retryCategories: [
         WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
         CONTEXT_OVERFLOW_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /**
@@ -182,13 +187,14 @@ export const TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY = {
  * recovery attempts driven by Completeness Gate (missing/broken target files).
  */
 export const BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY = {
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
     retryCategories: [
         WRITER_EMPTY_DIFF_RETRY_CATEGORY,
         INCOMPLETE_WRITE_SET_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /** Markdown shard writers use one full attempt plus at most one bounded binding repair. */
@@ -472,9 +478,9 @@ function reasonMandatedFrontendPlanRetryStep(reason) {
     }
 }
 /**
- * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=3
- * bounds plan retry cost: the four-rung ladder is only partially traversable
- * before the run fails non-converging (rungs: normal → bounded-tool-only →
+ * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=5
+ * lets the producer validate and repair each generated increment while still
+ * bounding the four-rung ladder (normal → bounded-tool-only →
  * compact-terminal-first → backup-model). `invalid-output` (typed-fact schema
  * violations, e.g. verification targets referencing undeclared UI states)
  * retries at the `normal` rung with the contractCheck reason injected via
@@ -485,7 +491,7 @@ export const FRONTEND_PLAN_LADDER_RETRY_POLICY = {
     // incremental record_* calls; dense call bursts hit provider rate limits
     // whose windows exceed the old 30s cap. Longer backoff gives the limit
     // window time to expire before the next attempt.
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 5000,
     maxDelayMs: 60000,

package/dist/workflows/dag/runner-exit-diagnostics.js

@@ -0,0 +1,125 @@
+import { appendFileSync, mkdirSync, unlinkSync } from "node:fs";
+import { hostname } from "node:os";
+import path from "node:path";
+/**
+ * Runner exit-time diagnostics (silent-death forensics).
+ *
+ * A DAG runner can disappear without a crash report and without stderr (five
+ * reproductions during frontend recovery/long-plan runs, 2026-09-06): when a
+ * supervisor hard-kills the process or the event loop is wedged, no JS runs,
+ * so nothing is persisted and the run is only discoverable later as an
+ * orphaned RUNNING state with a frozen heartbeat. That leaves no evidence of
+ * WHERE the runner was when it died or whether the exit was even observable
+ * by Node.
+ *
+ * This module gives every abnormal death a durable trace next to state.json:
+ *   - an `armed` line is written when the checkpoint starts executing;
+ *   - a `process-exit` line is appended from the process `exit` hook with the
+ *     exit code and a live state snapshot (status, terminalReason, RUNNING
+ *     nodes, heartbeat staleness);
+ *   - `uncaught-exception` / `unhandled-rejection` lines record the error
+ *     before the process is allowed to crash exactly as it would have
+ *     via uncaughtExceptionMonitor without changing the host's crash policy.
+ *
+ * On a clean terminal return the runner calls stop(), which removes every
+ * listener and deletes the journal, so completed runs carry no noise. A file
+ * left behind therefore means: diagnostics were armed, then the process went
+ * away through a path Node could not observe (`armed` line only → external
+ * SIGKILL/OOM/event-loop wedge) or through an observed abnormal exit (`armed`
+ * + one or more event lines → the reason is recorded in the file).
+ *
+ * Journal writes are strictly synchronous and best-effort: an append failure
+ * must never alter the runner's own crash/exit behavior.
+ */
+export const RUNNER_EXIT_DIAGNOSTICS_FILE = "runner-exit-diagnostics.jsonl";
+function describeError(error) {
+    if (error instanceof Error) {
+        return { name: error.name, message: error.message };
+    }
+    try {
+        return { message: String(error) };
+    }
+    catch {
+        return { message: "<unstringifiable error>" };
+    }
+}
+function appendJournalLineSync(journalPath, record) {
+    try {
+        mkdirSync(path.dirname(journalPath), { recursive: true });
+        appendFileSync(journalPath, `${JSON.stringify(record)}\n`, "utf8");
+    }
+    catch {
+        // Best-effort: journaling must never crash or alter exit behavior.
+    }
+}
+function removeJournalSync(journalPath) {
+    try {
+        unlinkSync(journalPath);
+    }
+    catch {
+        // Tolerate a missing journal (e.g. nothing was ever written).
+    }
+}
+export function installRunnerExitDiagnostics(options) {
+    const journalPath = path.join(options.runDir, RUNNER_EXIT_DIAGNOSTICS_FILE);
+    const target = options.target ?? process;
+    const armedAt = Date.now();
+    let stopped = false;
+    const base = {
+        runId: options.runId,
+        title: options.title,
+        pid: process.pid,
+        hostname: hostname(),
+    };
+    const safeSnapshot = () => {
+        try {
+            return options.snapshot();
+        }
+        catch {
+            return { status: "<snapshot-error>", running: [] };
+        }
+    };
+    const record = (kind, extra) => ({
+        ts: new Date().toISOString(),
+        kind,
+        ...base,
+        ...(extra ?? {}),
+        state: safeSnapshot(),
+    });
+    appendJournalLineSync(journalPath, {
+        ...record("armed"),
+        armedAt: new Date(armedAt).toISOString(),
+    });
+    const onProcessExit = (code) => {
+        if (stopped)
+            return;
+        appendJournalLineSync(journalPath, record("process-exit", {
+            code: typeof code === "number" ? code : process.exitCode ?? 0,
+            elapsedMs: Date.now() - armedAt,
+        }));
+    };
+    const onUncaughtException = (error, origin) => {
+        if (stopped)
+            return;
+        appendJournalLineSync(journalPath, record(origin === "unhandledRejection" ? "unhandled-rejection" : "uncaught-exception", {
+            error: describeError(error),
+            elapsedMs: Date.now() - armedAt,
+        }));
+        // Monitor listeners neither suppress fatal errors nor force a crash
+        // when the host has its own handlers or a nonfatal rejection policy.
+    };
+    target.on("exit", onProcessExit);
+    target.on("uncaughtExceptionMonitor", onUncaughtException);
+    return {
+        journalPath,
+        stop: () => {
+            if (stopped)
+                return;
+            stopped = true;
+            target.removeListener("exit", onProcessExit);
+            target.removeListener("uncaughtExceptionMonitor", onUncaughtException);
+            // Clean completion: leave completed runs free of diagnostics noise.
+            removeJournalSync(journalPath);
+        },
+    };
+}