@tea-agent/loop-agent 0.42.0-next.15 → 0.42.0-next.17

package/dist/workflows/dag/init-hybrid.js

@@ -2559,8 +2559,8 @@ function resolveFrontendMockContextBlock(sources) {
     if (mode === "not-required") {
         parts.push("Generation-time evidence does not require Mock. The assessment must still use contract/scout evidence: select not-needed when Mock is intentionally skipped, or select a safe Mock strategy if project evidence supports one.");
         if (frontendMockStrategyMustBeNotNeeded(sources)) {
-            parts.push('Auto mode has no confirmed project Mock capability or no deterministic Mock verification command. The structured contract must set mockApi.strategy to "not-needed". Do not add Mock files or dependencies; keep the real request path as default and record any unproved backend behavior as Real Integration Gap.');
-            parts.push('HARD CONSTRAINT (frozen at generation time): this DAG allows only mockApi.strategy "not-needed"; the prewrite gate rejects any other strategy. If project governance (openspec / ai_workspace / decision records, e.g. a DEC rule requiring native) demands Mock-backed verification, that is a generation-time contract gap, not a plan-revision defect: declare frontendMock.verifyCommands (or policy: "required") in task.json and regenerate the DAG. Do not emit any mockApi.strategy outside the allowlist and do not add Mock files or dependencies within this run.');
+            parts.push('Auto mode has no confirmed project Mock capability or no deterministic Mock verification command. The structured contract must set mockApi.strategy to "not-needed". Keep the real request path as the default, record any unproved backend behavior as Real Integration Gap, and do not add Mock files or dependencies within this run.');
+            parts.push('HARD CONSTRAINT (frozen at generation time): this DAG allows only mockApi.strategy "not-needed"; the prewrite gate rejects any other strategy. If project governance (openspec / ai_workspace / decision records, e.g. a DEC rule requiring native) demands Mock-backed verification, that is a generation-time contract gap, not a plan-revision defect: declare frontendMock.verifyCommands (or policy: "required") in task.json and regenerate the DAG.');
         }
     }
     if (mode === "blocked") {
@@ -3226,9 +3226,7 @@ async function buildFrontendHybridDagFromTask(sources) {
         "Reference frozen commands ONLY by commandId (record_plan_verification_target entry.commandId). The runtime resolves mode and label; never invent a mode or type.",
         ...frontendVerifyDirectory.map((entry) => `  - ${entry.commandId} [${entry.mode}]: ${JSON.stringify(entry.label)}`),
         `- Static command source: ${staticVerifyEvidence.commandSource}`,
-        ...staticVerifyEvidence.commandLabels.map((command) => `  - ${JSON.stringify(command)}`),
         `- Behavior command source: ${behaviorVerifyEvidence.commandSource}`,
-        ...behaviorVerifyEvidence.commandLabels.map((command) => `  - ${JSON.stringify(command)}`),
     ].join("\n");
     const advisories = [];
     if (!hasDeclaredFrontendVerification &&
@@ -3394,7 +3392,10 @@ async function buildFrontendHybridDagFromTask(sources) {
                 depends_on: ["frontend-contract-pi", "frontend-scout-pi"],
                 role: "planner",
                 executor: "pi",
-                complexity: "MED",
+                // Small topology has already proven a concentrated, no-remote scope;
+                // keep its bounded plan on the LOW model tier. Standard/High retain
+                // MED for broader contract-to-surface decisions.
+                complexity: frontendTaskShape.shape === "small" ? "LOW" : "MED",
                 writePolicy: "read-only",
                 retryPolicy: FRONTEND_PLAN_LADDER_RETRY_POLICY,
                 allowedPaths: readOnlyPaths,
@@ -3503,18 +3504,16 @@ async function buildFrontendHybridDagFromTask(sources) {
                     "Your authoritative terminal verdict is exactly one committed typed tool call: approve_design or request_design_changes. Call exactly one of them; after calling one, do not call the other.",
                     "request_design_changes must carry a typed issueCategory, at least one evidenceRef, and non-empty findings.",
                     "Your verdict is consumed as deterministic data input by frontend-writer-admission-shell. approve_design permits admission; request_design_changes blocks writer admission until a recovery plan incorporates every Critical/Important finding.",
-                    "Request design changes when the Mock strategy is MOCK_STRATEGY: blocked, missing, unsupported by repository evidence, inconsistent with the API contract, outside authorized paths/dependencies, unable to prove production-default-off behavior with the fixed production/default-real-path static check, or missing deterministic behavior verification for a declared behavior target or selected Mock strategy. Mock strategies require Mock-backed evidence. A static-only contract is allowed only when every verification target is static and maps to a declared static entrypoint. not-needed otherwise requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists; in that case the plan must preserve the real request path and record the Real Integration Gap.",
+                    "Request design changes when the Mock strategy is blocked, missing, unsupported by repository evidence, inconsistent with the API contract, outside authorized paths/dependencies, unable to prove production-default-off behavior with the fixed production/default-real-path static check, or missing deterministic behavior verification for a declared behavior target or selected Mock strategy. Mock strategies require Mock-backed evidence; a static-only contract is allowed only when every verification target is static and maps to a declared static entrypoint; not-needed requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists, in which case the plan must preserve the real request path and record the Real Integration Gap.",
                     "Also request design changes for missing applicable UI states, unsupported dependency additions, design-system drift without reason, weak interaction coverage, broad scope, inline fake data, schema drift, or missing deterministic verification commands.",
-                    "Component selection conformance is a hard blocking condition: request_design_changes when the frontend spec (component/theme/rule.components bucket) already defines a component for a purpose but the plan selects another or self-invents one without a declared deviation; when uiComponentChoices is missing/empty for UI-visible work while the frozen component/theme bucket is non-empty; when a decision=specified specReference.path is missing a ledger OpenSpec reference or successful read event; or when a decision=new component lacks a traceable task-source/PRD specReference. A PRD reference for decision=new is not an OpenSpec citation and must not be rejected merely for lacking an OpenSpec read event.",
-                    "For uiComponentChoices, purpose is the stable coverage key and must match interaction.name or uiState.name. Responsibility is expressed by the matched expectedBehavior plus rationale; you must not reject it merely for matching an interaction or component identifier.",
-                    "You must NOT make authoritative assertions about the execution result of frozen verification commands (typecheck/test/build/lint/etc.). Predicting that a command will necessarily pass or fail, or declaring an acceptance criterion unreachable on that basis, is out of your authority: command results are deterministically established by frontend-verify-shell. Any concern about verification feasibility must be recorded only as a non-blocking verification concern in findings (severity must not be Critical, and it must never be the sole fatal basis for request_design_changes). Only semantic design defects (component selection, state flow, interaction contract, or conflicts with the specification) may be Critical. A pure command-will-fail prediction must not be classified as contract-requirement-gap.",
+                    "Component selection conformance is a hard blocking condition: request_design_changes when the frontend spec (component/theme/rule.components bucket) already defines a component for a purpose but the plan selects another or self-invents one without a declared deviation; when uiComponentChoices is missing/empty for UI-visible work while the frozen component/theme bucket is non-empty; when a decision=specified specReference.path is missing a ledger OpenSpec reference or successful read event; or when a decision=new component lacks a traceable task-source/PRD specReference. A PRD reference for decision=new is not an OpenSpec citation and must not be rejected merely for lacking an OpenSpec read event. For uiComponentChoices, purpose is the stable coverage key and must match interaction.name or uiState.name; responsibility is expressed by the matched expectedBehavior plus rationale, and you must not reject it merely for matching an interaction or component identifier.",
+                    "You must NOT make authoritative assertions about the execution result of frozen verification commands: command results are deterministically established by frontend-verify-shell. Record a verification-feasibility concern only as a non-blocking finding (severity must not be Critical, and it must never be the sole fatal basis for request_design_changes). Only semantic design defects (component selection, state flow, interaction contract, or conflicts with the specification) may be Critical; a pure command-will-fail prediction must not be classified as contract-requirement-gap.",
                     "Read-only: do not modify repository files.",
                     "LARGE-FILE AUDIT (avoid full reads): style/theme audit files can be large (e.g. styles.css is often hundreds of KB). Prefer grep to locate the exact rules/variables you must verify (e.g. grep the oc- class, is-* modifier, or --oc- theme variables with their line numbers), then read only the narrow line range when surrounding context is needed. Do not read a large style/test file in full — a single full read can exhaust the read budget and fail the attempt.",
                     "Canonical contract reading: frontend-design-policy-shell prints absolute paths for Contract, Contract index, and the non-blocking Capacity diagnostic. Read the capacity diagnostic first. When it recommends full-contract, read the exact Contract path. When it recommends indexed-sections, read the Contract index and its hash-bound section files instead of opening the full contract. Never resolve a bare contracts/... path against the repository root or hunt for substitutes. Implementation target files inside the writeSet are created later by the implement node: do not read them and do not treat their absence as a design defect.",
                     fixedVerificationContext,
                     sourceContexts.designReview,
                     scopedOpenspecContext,
-                    frontendContractFieldSummary,
                     mockContextBlock,
                 ].join("\n\n"),
             },

package/dist/workflows/dag/node-execution.js

@@ -13,7 +13,7 @@ import { buildDagNodePromptEnvelope, formatConvergenceFeedbackBlock, } from "./p
 import { persistLongNodeOutputArtifacts } from "./upstream-artifacts.js";
 import { materializeDeclaredArtifactFacts } from "./artifact-bindings.js";
 import { buildOutputLimitRecoverySection, loadBackendTestWriterProgressForRetry, } from "./backend-test-writer-completeness.js";
-import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
+import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, OUTPUT_LIMIT_RETRY_CATEGORY, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
 import { applyNodeActivity, evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
 import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, parseJsonReviewVerdict, validateOutputProtocol, } from "./output-protocol.js";
 import { getStructuredContractValidator } from "./contract-output-registry.js";
@@ -257,6 +257,9 @@ function frontendPlanValidationRetryGuidance(reason) {
     if (/verificationTargets.*uiStates|uiStates.*verificationTargets/i.test(reason)) {
         guidance.push("For this retry, provide verificationTargets[].uiStates as an array; use [] when the target has no named UI state.");
     }
+    if (/duplicate|already recorded/i.test(reason)) {
+        guidance.push("For this retry, re-commit the corrected entry with the same id and replace=true; the ledger compiles the latest submission as the full replacement. A duplicate receipt is a correction invitation, not a prohibition, and backfilling a cited fact's reverse reference in-node does not re-derive committed facts.");
+    }
     return guidance;
 }
 function compactRetryText(text, maxChars) {
@@ -774,6 +777,87 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
+    // Repair-category guidance must outrank the retry ladder position: the
+    // ladder advances monotonically on transport failures (e.g. length →
+    // compact-terminal-first), and its "keep the committed ledger intact"
+    // instruction directly contradicts the repair action for invalid-output /
+    // truncated ledger facts (re-commit corrected record_* facts). When both
+    // apply, the model receives the repair instruction, not the rung script.
+    if (previousFailureCategory === "invalid-output" &&
+        task.structuredContractOutput &&
+        previousProtocolReason) {
+        // The frontend plan node's compile authority is the committed typed
+        // ledger, not a fenced JSON text artifact: its retry guidance must
+        // direct the model to re-commit corrected record_* facts and
+        // finalize_plan. The legacy full-contract JSON guidance below applies
+        // only to nodes whose authority is still a text contract artifact.
+        if (task.structuredContractOutput.schemaId ===
+            "frontend-implementation-contract-plan-patch-v1") {
+            const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
+                ? [
+                    "",
+                    "The writeSet is too large for one implement node. Preserve the complete requirement and file coverage. This needs a Contract-level task split, not a Plan formatting repair. Report the write-set-too-large finding and the affected paths for the controller to resume Contract/split orchestration. Plan cannot change protected targets.files or call Contract-only tools; do not invent a split tool or discard required files.",
+                ]
+                : [];
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "Previous plan ledger facts failed canonical contract validation:",
+                previousProtocolReason,
+                "Fix the reported violations by re-committing corrected record_* facts and calling finalize_plan exactly once. The committed typed ledger is the only compile authority.",
+                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
+                ...frontendPlanValidationRetryGuidance(previousProtocolReason),
+                ...splitGuidance,
+                "</retry_instruction>",
+            ].join("\n");
+        }
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Previous attempt produced an invalid frontend implementation contract:",
+            previousProtocolReason,
+            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
+            "Fix every reported field violation: do not emit null for optional fields, do not misspell field names, and match the required types exactly.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "invalid-output" &&
+        task.id === "frontend-scout-pi") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The previous Scout attempt did not commit a complete, runtime-evidenced target surface.",
+            "Search the repository only as needed to establish the real entrypoint, implementation ownership, and applicable test path. Commit record_target_surface with completeness=complete and unresolvedPaths=[] only after at least one named target has fresh runtime evidence, unless the task source explicitly declares a greenfield target: in that case every future path must be source-declared by the runtime-enriched fact. If ownership truly cannot be established, record completeness=blocked with each unresolved path; do not make Plan discover it.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "structured-output-truncated" &&
+        task.structuredContractOutput) {
+        if (task.structuredContractOutput.schemaId ===
+            "frontend-implementation-contract-plan-patch-v1") {
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "Previous attempt was truncated by the provider (stopReason=length) before the plan facts were fully committed.",
+                "Re-commit the missing record_* facts and call finalize_plan exactly once; the committed typed ledger is the only compile authority. Do NOT re-read contract/scout outputs or source files — use the facts already in context. Commit record_* facts one tool call per message, then finalize_plan immediately.",
+                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
+                "</retry_instruction>",
+            ].join("\n");
+        }
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Previous attempt was truncated by the provider (stopReason=length) before the JSON contract was completed.",
+            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
+            "The JSON artifact must be complete; omit evidence excerpts and duplicated upstream context.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
     if (frontendPlanRetryStep === "compact-terminal-first") {
         return [
             basePrompt,
@@ -845,83 +929,25 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
-    if (previousFailureCategory === "invalid-output" &&
-        task.structuredContractOutput &&
-        previousProtocolReason) {
-        // The frontend plan node's compile authority is the committed typed
-        // ledger, not a fenced JSON text artifact: its retry guidance must
-        // direct the model to re-commit corrected record_* facts and
-        // finalize_plan. The legacy full-contract JSON guidance below applies
-        // only to nodes whose authority is still a text contract artifact.
-        if (task.structuredContractOutput.schemaId ===
-            "frontend-implementation-contract-plan-patch-v1") {
-            const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
-                ? [
-                    "",
-                    "The writeSet is too large for one implement node. Do NOT delete implementation files to squeeze under the limit — that drops required work. Split the task via record_split_proposal (or narrow targets.files to a genuine subset) so each implement node stays bounded; the full file set must remain covered across the split.",
-                ]
-                : [];
-            return [
-                basePrompt,
-                "",
-                "<retry_instruction>",
-                "Previous plan ledger facts failed canonical contract validation:",
-                previousProtocolReason,
-                "Fix the reported violations by re-committing corrected record_* facts and calling finalize_plan exactly once. The committed typed ledger is the only compile authority.",
-                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
-                ...frontendPlanValidationRetryGuidance(previousProtocolReason),
-                ...splitGuidance,
-                "</retry_instruction>",
-            ].join("\n");
-        }
+    // Generic output-limit fallback. Every branch above this one carries a
+    // more precise instruction for the same capacity signal (contract repair
+    // reasons, ladder rungs — compact-terminal-first is the reason-mandated
+    // rung for length-before-terminal —, protocol/review/read-burst repair),
+    // so output-limit must not shadow them.
+    if (previousFailureCategory === OUTPUT_LIMIT_RETRY_CATEGORY) {
         return [
             basePrompt,
             "",
             "<retry_instruction>",
-            "Previous attempt produced an invalid frontend implementation contract:",
-            previousProtocolReason,
-            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
-            "Fix every reported field violation: do not emit null for optional fields, do not misspell field names, and match the required types exactly.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "invalid-output" &&
-        task.id === "frontend-scout-pi") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "The previous Scout attempt did not commit a complete, runtime-evidenced target surface.",
-            "Search the repository only as needed to establish the real entrypoint, implementation ownership, and applicable test path. Commit record_target_surface with completeness=complete and unresolvedPaths=[] only after at least one named target has fresh runtime evidence, unless the task source explicitly declares a greenfield target: in that case every future path must be source-declared by the runtime-enriched fact. If ownership truly cannot be established, record completeness=blocked with each unresolved path; do not make Plan discover it.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "structured-output-truncated" &&
-        task.structuredContractOutput) {
-        if (task.structuredContractOutput.schemaId ===
-            "frontend-implementation-contract-plan-patch-v1") {
-            return [
-                basePrompt,
-                "",
-                "<retry_instruction>",
-                "Previous attempt was truncated by the provider (stopReason=length) before the plan facts were fully committed.",
-                "Re-commit the missing record_* facts and call finalize_plan exactly once; the committed typed ledger is the only compile authority. Do NOT re-read contract/scout outputs or source files — use the facts already in context. Commit record_* facts one tool call per message, then finalize_plan immediately.",
-                "Do not emit a fenced JSON contract, protected skeleton fields, or an openspec-citations block; narrative JSON is not validated and wastes the output budget.",
-                "</retry_instruction>",
-            ].join("\n");
-        }
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Previous attempt was truncated by the provider (stopReason=length) before the JSON contract was completed.",
-            ...frontendStructuredArtifactRetryGuidance(task.structuredContractOutput.schemaId),
-            "The JSON artifact must be complete; omit evidence excerpts and duplicated upstream context.",
+            "The previous turn ended with stopReason=length before the required output was complete. This is output-capacity truncation, not empty output.",
+            "Continue incrementally from already committed typed facts and current in-scope workspace files. Do not repeat completed discovery, decisions, facts, or writes.",
+            "Generate the smallest unfinished unit next, validate its required format immediately, repair any format error in this node, and only then continue to the next unfinished unit or terminal tool.",
+            "Keep prose minimal and finish the required terminal/output protocol as soon as the remaining work is valid.",
             "</retry_instruction>",
         ].join("\n");
     }
     if (previousFailureCategory === "writer-empty-diff") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         // When a completeness progress exists for this writer, fold the concrete
         // target paths into the empty-diff retry so the model does not guess and
         // does not need to read a forbidden `.harness/**` evidence file.
@@ -949,7 +975,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
         ].join("\n");
     }
     if (previousFailureCategory === "incomplete-write-set") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         const bindingOnly = task.id?.startsWith("generate-backend-md-case-") === true &&
             (recoveryTargetPaths?.length ?? 0) === 1 &&
             Object.values(recoveryDiagnostics ?? {}).flat().some((detail) => /(?:unclassified Test Points|duplicate Test Point bindings)/i.test(detail));
@@ -1765,6 +1791,32 @@ export async function executeDagNode(input) {
                 durationMs: 0,
             };
         }
+        // stopReason=length on top of a bare empty-output verdict is a provider
+        // capacity signal, not a true empty response: reroute it through the
+        // dedicated output-limit retry path while keeping the raw category for
+        // diagnostics. Bare empty-output and transport aliases (network,
+        // nonzero-exit, unknown) are rerouted — categories that already carry a
+        // precise repair instruction (output-too-large, invalid-output,
+        // protocol-invalid, structured-output-truncated via the validators below,
+        // writer categories) keep their classification so their exact retry
+        // guidance still reaches the model.
+        if (task.executor === "pi" &&
+            !result.ok &&
+            result.stopReason === "length" &&
+            (result.failureCategory === undefined ||
+                ["empty-output", "network", "nonzero-exit", "unknown"].includes(result.failureCategory))) {
+            result = {
+                ...result,
+                rawFailureCategory: result.rawFailureCategory ?? result.failureCategory,
+                failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
+                stderr: [
+                    result.stderr,
+                    "output-limit: stopReason=length; preserve completed work and retry only the unfinished output",
+                ]
+                    .filter(Boolean)
+                    .join("\n"),
+            };
+        }
         if (task.id === "generate-backend-md-plan-pi" &&
             !result.ok &&
             (result.failureCategory === "output-too-large" ||
@@ -1898,7 +1950,7 @@ export async function executeDagNode(input) {
             !result.ok &&
             retryPolicy !== undefined) {
             const submissions = await countContractRecordSubmissions(runDir, nodeId);
-            if (submissions === 0) {
+            if (submissions === 0 && result.stopReason !== "length") {
                 result = {
                     ...result,
                     failureCategory: "empty-output",

package/dist/workflows/dag/rerun-feedback.js

@@ -408,6 +408,7 @@ export async function deriveDagRerunFeedback(input) {
             return (node?.status === "ERROR" &&
                 [
                     "empty-output",
+                    "output-limit",
                     "invalid-output",
                     "writer-thinking-exhausted",
                     "writer-budget-exhausted",

package/dist/workflows/dag/rerun-plan.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { z } from "zod";
 import { assertTaskContractBindingFresh } from "./task-contract-binding.js";
+import { workspaceDriftedPaths, } from "./workspace-checkpoint.js";
 import { isSafeReadOnlyPiRetryCandidate, isTransportCrashedExclusiveWriter } from "./retry-policy.js";
 import { resolveDagTaskSourcePath } from "../../task/dag-source-paths.js";
 import { composeDagPromptOverridePrompt, MAX_DAG_RERUN_PROMPT_OVERRIDE_CHARS, } from "../../shared/dag-prompt-override.js";
@@ -1110,6 +1111,46 @@ function deriveSuggestedAction(input) {
     }
     return "manual";
 }
+/**
+ * Gitignore-style-lite matcher for readSet/writeSet path patterns in scoped
+ * workspace-drift evaluation: literal paths match exactly; `**` spans path
+ * segments (a trailing `/**` also matches when nothing follows), `*` stays
+ * within one segment, `?` is one non-separator char.
+ */
+function pathMatchesWorkspacePattern(pathValue, pattern) {
+    const normalizedPath = pathValue.replace(/\\/g, "/").replace(/^\.\//, "");
+    const trimmed = pattern.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!trimmed || trimmed === "/")
+        return false;
+    if (trimmed === normalizedPath)
+        return true;
+    let source = "";
+    for (let index = 0; index < trimmed.length; index += 1) {
+        const char = trimmed[index];
+        if (char === "*") {
+            if (trimmed[index + 1] === "*") {
+                if (trimmed[index + 2] === "/") {
+                    source += "(?:.*/)?";
+                    index += 2;
+                }
+                else {
+                    source += ".*";
+                    index += 1;
+                }
+            }
+            else {
+                source += "[^/]*";
+            }
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`).test(normalizedPath);
+}
 function deriveRisk(reasonCodes, resetCount) {
     if (reasonCodes.includes("restart-subgraph-contains-writer") ||
         reasonCodes.includes("restart-subgraph-contains-unsafe-shell") ||
@@ -1213,7 +1254,14 @@ export async function evaluateDagRerunPlan(input) {
         blockedReasons.push("parent-lifecycle-ineligible");
     }
     else if (input.parentState.status !== "failed" &&
-        input.parentState.status !== "partial_failed") {
+        input.parentState.status !== "partial_failed" &&
+        // A superseded parent is a terminal operator judgment about the run as
+        // a whole, not about its deterministic read-only compute: its FINISHED
+        // upstream nodes are still valid fact donors for the imported set, and
+        // every unsafe case (writers in the reset subgraph, decision gates,
+        // stale checkpoints, unresolved ERROR nodes outside the closure) keeps
+        // its own dedicated block below.
+        input.parentState.status !== "superseded") {
         reasonCodes.push("parent-lifecycle-ineligible");
         blockedReasons.push("parent-lifecycle-ineligible");
     }
@@ -1241,8 +1289,36 @@ export async function evaluateDagRerunPlan(input) {
     else if (input.currentWorkspace?.fingerprint &&
         input.parentTerminalWorkspace.fingerprint !==
             input.currentWorkspace.fingerprint) {
-        reasonCodes.push("workspace-drift");
-        blockedReasons.push("workspace-drift");
+        // Whole-fingerprint drift is refined to content-level paths: the rerun
+        // re-derives (readSet) and rewrites (writeSet) the reset subgraph's own
+        // paths, so drift confined to those paths is recomputed by the rerun
+        // itself and must not force a full standalone rerun. Drift anywhere
+        // else — especially inputs of imported fact-reuse nodes — keeps the
+        // strict block. Indeterminate checkpoints fail closed.
+        const driftedPaths = workspaceDriftedPaths(input.parentTerminalWorkspace, input.currentWorkspace);
+        const importedReadPaths = importedNodeIds.flatMap((nodeId) => {
+            const task = tasksByIdForPlan.get(nodeId);
+            return task?.readSet ?? [];
+        });
+        const scopedDrift = driftedPaths !== undefined &&
+            driftedPaths.length > 0 &&
+            driftedPaths.every((driftPath) => !importedReadPaths.some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern)) &&
+                resetNodeIds.some((nodeId) => {
+                    const task = tasksByIdForPlan.get(nodeId);
+                    if (!task)
+                        return false;
+                    return [
+                        ...(task.writeSet ?? []),
+                        ...(task.readSet ?? []),
+                    ].some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern));
+                }));
+        if (scopedDrift) {
+            reasonCodes.push("workspace-drift-scoped");
+        }
+        else {
+            reasonCodes.push("workspace-drift");
+            blockedReasons.push("workspace-drift");
+        }
     }
     else if (!input.currentWorkspace?.fingerprint) {
         reasonCodes.push("workspace-checkpoint-missing");
@@ -1293,8 +1369,18 @@ export async function evaluateDagRerunPlan(input) {
     }
     for (const nodeId of importedNodeIds) {
         const record = input.parentState.nodes[nodeId];
-        if (!record)
+        if (!record) {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
             continue;
+        }
+        if (record.status === "PENDING" || record.status === "RUNNING") {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
+            continue;
+        }
         if (record.status === "ERROR") {
             reasonCodes.push("parent-facts-invalid");
             blockedReasons.push("parent-facts-invalid");

package/dist/workflows/dag/rerun-run.js

@@ -784,6 +784,13 @@ async function stageContinuationRun(input) {
         if (!parentRecord) {
             throw new Error(`parent node record missing for imported node: ${nodeId}`);
         }
+        if (parentRecord.status !== "FINISHED" &&
+            !(parentRecord.status === "SKIPPED" &&
+                (parentRecord.skippedReason?.includes("condition") ||
+                    parentRecord.skippedReason?.includes("runIf") ||
+                    parentRecord.skippedReason?.includes("run-if")))) {
+            throw new Error(`parent node is not a settled fact donor for imported node: ${nodeId}`);
+        }
         const { manifestNode, importedRecord } = await importNodeFacts({
             parentRunDir: input.parentRunDir,
             newRunDir: runDir,

package/dist/workflows/dag/retry-policy.js

@@ -7,8 +7,8 @@ import { TYPED_EVENT_FACT_KINDS } from "./frontend-typed-event-store.js";
  * is re-exported here unchanged so retry-policy stays the single import
  * surface for retry policies and helpers.
  */
-export { ALL_DAG_RETRY_CATEGORIES, CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, PROTOCOL_INVALID_RETRY_CATEGORY, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_OUTPUT_TRUNCATED_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, dagRetryBackoffSchema, dagRetryCategorySchema, dagRetryPolicySchema, } from "./dag-retry-schema.js";
-import { CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./dag-retry-schema.js";
+export { ALL_DAG_RETRY_CATEGORIES, CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, PROTOCOL_INVALID_RETRY_CATEGORY, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_OUTPUT_TRUNCATED_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, dagRetryBackoffSchema, dagRetryCategorySchema, dagRetryPolicySchema, } from "./dag-retry-schema.js";
+import { CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./dag-retry-schema.js";
 const RETRY_SAFE_PI_ROLES = new Set([
     "planner",
     "scout",
@@ -19,7 +19,7 @@ const RETRY_SAFE_PI_ROLES = new Set([
 ]);
 /**
  * The default retry policy applied to safe generated read-only Pi nodes.
- * Total attempts: 3, exponential backoff with cap.
+ * Total attempts: 5, exponential backoff with cap.
  *
  * Includes `context-overflow`: a read-only node that blew the context window
  * (400 request too large, e.g. a review node accumulating too many reads) is a
@@ -29,7 +29,7 @@ const RETRY_SAFE_PI_ROLES = new Set([
  * design-review/review fell straight to ERROR without a retry attempt.
  */
 export const DEFAULT_READ_ONLY_PI_RETRY_POLICY = {
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
@@ -125,7 +125,10 @@ export const WRITER_EMPTY_DIFF_RETRY_POLICY = {
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
-    retryCategories: [WRITER_EMPTY_DIFF_RETRY_CATEGORY],
+    retryCategories: [
+        WRITER_EMPTY_DIFF_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
+    ],
 };
 /**
  * Bounded transport retry for standard exclusive implementers when a provider
@@ -140,6 +143,7 @@ export const WRITER_TRANSPORT_RETRY_POLICY = {
     retryCategories: [
         WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
         CONTEXT_OVERFLOW_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /**
@@ -175,6 +179,7 @@ export const TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY = {
     retryCategories: [
         WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
         CONTEXT_OVERFLOW_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /**
@@ -182,13 +187,14 @@ export const TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY = {
  * recovery attempts driven by Completeness Gate (missing/broken target files).
  */
 export const BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY = {
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
     retryCategories: [
         WRITER_EMPTY_DIFF_RETRY_CATEGORY,
         INCOMPLETE_WRITE_SET_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /** Markdown shard writers use one full attempt plus at most one bounded binding repair. */
@@ -472,9 +478,9 @@ function reasonMandatedFrontendPlanRetryStep(reason) {
     }
 }
 /**
- * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=3
- * bounds plan retry cost: the four-rung ladder is only partially traversable
- * before the run fails non-converging (rungs: normal → bounded-tool-only →
+ * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=5
+ * lets the producer validate and repair each generated increment while still
+ * bounding the four-rung ladder (normal → bounded-tool-only →
  * compact-terminal-first → backup-model). `invalid-output` (typed-fact schema
  * violations, e.g. verification targets referencing undeclared UI states)
  * retries at the `normal` rung with the contractCheck reason injected via
@@ -485,7 +491,7 @@ export const FRONTEND_PLAN_LADDER_RETRY_POLICY = {
     // incremental record_* calls; dense call bursts hit provider rate limits
     // whose windows exceed the old 30s cap. Longer backoff gives the limit
     // window time to expire before the next attempt.
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 5000,
     maxDelayMs: 60000,