@tea-agent/loop-agent 0.42.0-next.8 → 0.42.0-next.9

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## [Unreleased]
 
+- 冒烟再暴露 writeSet 授权缺口：冻结验证命令引用的基建文件（如 `--config` 的 vitest 配置）不在 plan verification targets 内时，writer 被具体 writeSet 拦住无法创建、verify-shell 必然失败。现在 admission 生效边界确定性并入冻结命令引用的文件（机械提取、仍受 allowedPaths/forbiddenPaths 约束），writer 聚焦检查失败后可自行补齐基建文件。
+- 修复 /inspect/* 静态资源（operator-chrome.js/css、观测文档）缺少 Cache-Control 的问题：现在与 Console SPA 一律 `no-store`。此前浏览器启发式缓存会让 Console 更新/重启后继续挂旧版导航模块，表现为顶部导航「回退」到只有操作/观测、缺少对话入口的旧版布局。
+
+- 冻结验证命令引用的文件（如 `--config` 的 vitest 配置）现在必须在 plan 阶段就有 verification target 覆盖：缺失会作为缺失事实驱动 coverage/compact/finalize 会话当轮补记并进入 admission writeSet，无法补齐则在 plan 阶段确定性失败，不再等到 verify-shell 才以 missing config 失败。
+- 修复 writer 终态失败 run 无法重跑的问题：rerun 反馈的 writer 失败通道把 `attemptSummary.completedPasses` 硬编码为 0，被 `dagRerunFeedbackSchema` 的 positive 校验拒绝，导致 `dag rerun-task` 在解析父 run 反馈时崩溃；现与相邻通道一致取 1。
+- 冒烟再暴露并修复 planner 思考烧尽：compact Plan 首会话因 `stopReason=length` 只思考零提交时，先做一次 tool-first 同 scope 重试，仍失败则机械降级为按需求减半的 coverage 分批会话；耗尽后归类为 `planner-thinking-exhausted` 并给出 thinking=off/换模型建议，不再原样重放同一 prompt 烧完修复预算。
+- 继续加固前端恢复：生产 `runDag` 现在使用共享 Console operation store 执行带反馈的 `dag rerun-task`，避免恢复 descriptor 无法解析；compact Plan 仅在单 target surface 生效，finalize 提示与 concrete writeSet 路径统一规范化。
+- 修复前端冒烟暴露的 P0/P1 流程问题：设计评审 `request_design_changes` 现在 fail-closed 阻断 writer，自动恢复从 Plan 重启并携带 findings/evidence；admission 冻结的 concrete writeSet 同时成为 writer 的实际授权边界，legacy `admitted` 不再放行；长度耗尽且零写入的 provider 结果按 `writer-thinking-exhausted` 归类。生产小型 Plan（≤8 个需求且估算调用量受控）合并为两次 Pi session，并在 session 间刷新 typed ledger 上下文；Scout 重试仅补 unresolved 路径，减少重复侦查与上下文消耗。
+- 修复 backend-test 对 `payload = {...}` 经 `dict(payload)` 和 `**kwargs` wrapper 透传时漏观测请求字段的问题：保守传播 wrapper 参数别名与浅拷贝 payload，并按分支实际赋值观察 scenario 字段；继续保持 payload SAFE、EXACT_1_TO_1、scenario MATCH 与 fail-closed 门禁。计划生成提示词同时明确无有限分区域时省略整个 `## Scenario Partitions` 章节，避免生成 prose-only 空节触发 N3 阻断。
 - 修复 Operator Chat 打开已丢失会话时把孤儿 JSONL 升级成 503、以及删会话后残留 workspace 选择被误报为跨工作区冲突的问题：缺失会话文件现在自愈为 404 并清掉记录，前端恢复路径安静忘记该会话。
 - 修复前端 `--from-text` 任务缺少 source-fidelity ledger、DAG 生成后降级为 v1 并在 `frontend-contract-pi` 0ms 失败的问题：文本入口现在持久化可校验的 v2 绑定输入，init-hybrid 复用任务自有需求源；Console 默认模型与 Pi readiness 同时排除无凭据 provider，避免把不可执行模型误报为可用。
 - 常规回归 `npm test` 默认跳过约 6 分钟的 I/O-heavy 测试池（仍跑 fast + integration）；完整三池改为 `npm run test:full` / `LOOP_AGENT_FULL_TEST=1`。本地 `ci.sh`、GitHub PR 与 release/next 发布门禁仍跑全量，不降低交付验证。

package/dist/application/dag/run-dag.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { createDagEventObserver } from "../../workflows/dag/event-observer.js";
 import { composeDagRunObservers } from "../../workflows/dag/observer-compose.js";
 import { createDagCanvasObserver, resolveCanvasPath, } from "../../workflows/dag/canvas-observer.js";
@@ -28,6 +29,40 @@ function buildRunDagNextSteps(runId) {
         `loop-agent dag report --run-id ${runId} --markdown  # advanced forensic`,
     ];
 }
+async function buildDefaultFrontendRecoveryDeps(repoRoot) {
+    // Keep the application layer free of a static worker→application cycle. The
+    // recovery controller is only needed after a frontend terminal failure.
+    const [{ openConsoleAppData }, { OperationStore }, { createOperationEventStore }, { LoopAgentClient }, { resolveSiblingLoopAgentBin }] = await Promise.all([
+        import("../../infrastructure/console/app-data.js"),
+        import("../../infrastructure/console/operation-store.js"),
+        import("../../worker/console/operation-sse.js"),
+        import("../../worker/loop-agent/loop-agent-client.js"),
+        import("../../worker/console/sibling-controller.js"),
+    ]);
+    const appData = openConsoleAppData({ repoRoot });
+    const store = new OperationStore(appData);
+    const events = createOperationEventStore({
+        persistenceDir: path.join(appData.operations, "events"),
+    });
+    const client = new LoopAgentClient({
+        loopAgentBin: resolveSiblingLoopAgentBin(),
+        artifactRoot: path.join(appData.root, "client-artifacts", appData.fingerprint),
+        resolveIdentity: true,
+    });
+    return {
+        store,
+        operationRunnerDeps: {
+            store,
+            events,
+            client,
+            repoRoot,
+            env: {
+                ...process.env,
+                LOOP_CONSOLE_APP_DATA: appData.root,
+            },
+        },
+    };
+}
 export async function runDagUseCase(input) {
     const spec = await loadDagSpecFromFile(input.dagPath);
     assertValidDagSpec(spec);
@@ -80,6 +115,10 @@ export async function runDagUseCase(input) {
             ...(canvasError ? { canvasError } : {}),
         };
     }
+    const recovery = input.recovery ??
+        (!input.initOnly && spec.tasks.some((task) => task.id === "frontend-implement-pi")
+            ? await buildDefaultFrontendRecoveryDeps(input.cwd)
+            : undefined);
     const summary = await runDag(spec, {
         cwd: input.cwd,
         initOnly: input.initOnly,
@@ -90,6 +129,7 @@ export async function runDagUseCase(input) {
         ...(input.workerAssociation
             ? { workerAssociation: input.workerAssociation }
             : {}),
+        ...(recovery ? { recovery } : {}),
     });
     const canvasError = await flushCanvasSafely(canvas);
     if (resolvedCanvasPath) {

package/dist/build-stamp.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "version": "0.42.0-next.8",
-  "gitSha": "1d1ada8ede350e5778d753c04ed72bacd778e43d",
-  "builtAt": "2026-09-02T23:47:25.236Z"
+  "version": "0.42.0-next.9",
+  "gitSha": "13597aa31afc1faccb9a5eaca296d57d7ab93c2e",
+  "builtAt": "2026-09-03T05:18:16.410Z"
 }

package/dist/executors/dag-pi-executor.js

@@ -31,6 +31,34 @@ import { writeEffectiveContextReceipt } from "../workflows/dag/context-receipt.j
  * recoverable partial-write-set (incomplete-write-set) upgrade.
  */
 export const WRITER_THINKING_EXHAUSTED_CATEGORY = "writer-thinking-exhausted";
+/**
+ * Planner classification mirroring writer-thinking-exhausted: a read-only
+ * planning session stopped on length, observed thinking, and committed zero
+ * typed facts with no assistant text. By the time this survives the segmented
+ * ladder the scope has already been degraded, so the durable fix is a
+ * thinking-capped or non-thinking model for the tier — not another replay of
+ * the same full-scope prompt.
+ */
+export const PLANNER_THINKING_EXHAUSTED_CATEGORY = "planner-thinking-exhausted";
+export function isPlannerThinkingExhausted(result, committedAnyFacts) {
+    if (result.ok)
+        return false;
+    const evidence = readWriterThinkingExhaustionEvidence(result);
+    if (evidence.stopReason !== "length")
+        return false;
+    if (evidence.thinkingObserved !== true)
+        return false;
+    if (committedAnyFacts)
+        return false;
+    if ((result.assistantText ?? "").trim())
+        return false;
+    // Gateways sometimes relabel a length-stopped stream as `network` or
+    // `nonzero-exit`; provider evidence outweighs the transport label.
+    if (result.failureCategory &&
+        !["empty-output", "network", "nonzero-exit", "unknown"].includes(result.failureCategory))
+        return false;
+    return true;
+}
 /**
  * The writer session burned an excessive token budget (a read-edit-test loop
  * that never converged) and still failed. Distinct from empty-output so the
@@ -69,8 +97,6 @@ function readWriterThinkingExhaustionEvidence(result) {
 export function isWriterThinkingExhausted(result, mapped, changeManifestChangedFiles) {
     if (mapped.ok)
         return false;
-    if (mapped.failureCategory !== "empty-output")
-        return false;
     const evidence = readWriterThinkingExhaustionEvidence(result);
     if (evidence.stopReason !== "length")
         return false;
@@ -78,6 +104,13 @@ export function isWriterThinkingExhausted(result, mapped, changeManifestChangedF
         return false;
     if ((evidence.writeToolCallCount ?? 0) !== 0)
         return false;
+    // Gateways sometimes classify a length-stopped stream as `network` or
+    // `nonzero-exit` because the terminal event is carried in stderr. The
+    // provider evidence is stronger than that transport label when no write
+    // tool was called and the run produced no diff.
+    if (mapped.failureCategory &&
+        !["empty-output", "network", "nonzero-exit", "unknown"].includes(mapped.failureCategory))
+        return false;
     if (changeManifestChangedFiles === undefined)
         return false;
     if (changeManifestChangedFiles.length !== 0)
@@ -2904,6 +2937,8 @@ const FRONTEND_PLAN_UX_LOCAL_MAX_RECORD_CALLS = 6;
 // safety bound, but do not let the old 32-session ceiling skip finalize for a
 // legitimate large plan.
 const FRONTEND_PLAN_BATCH_MAX_SESSIONS = 128;
+const FRONTEND_PLAN_SMALL_MAX_REQUIREMENTS = 8;
+const FRONTEND_PLAN_SMALL_MAX_ESTIMATED_CALLS = 24;
 function compactPromptString(value, maxChars) {
     if (typeof value !== "string" || value.trim().length === 0)
         return undefined;
@@ -2920,6 +2955,45 @@ function compactPromptStringArray(value, maxEntries = 12, maxChars = 180) {
         .filter((item) => item !== undefined)
         .slice(0, maxEntries);
 }
+function countFrontendPlanTargetSurfaces(basePrompt) {
+    const match = /<frontend_plan_input>[\s\S]*?<\/frontend_plan_input>/.exec(basePrompt);
+    if (!match)
+        return undefined;
+    for (const line of match[0].split(/\r?\n/)) {
+        try {
+            const payload = JSON.parse(line);
+            if (Array.isArray(payload.targetSurface))
+                return payload.targetSurface.length;
+        }
+        catch {
+            // surrounding lines are prose
+        }
+    }
+    return undefined;
+}
+/**
+ * Deterministically extract repository file paths that frozen verification
+ * commands operate on (`--config <file>`, `node --check <file>`). A frozen
+ * command whose referenced file is outside the planner's verification targets
+ * can never run: the admission writeSet derives from those targets, so the
+ * writer is not authorized to create the file and verify-shell fails ~20
+ * minutes later. Surfacing the gap as plan missing-facts lets the coverage or
+ * compact session record the missing verification target inside the same
+ * attempt instead.
+ */
+export function collectFrontendVerificationCommandFiles(basePrompt) {
+    const files = new Set();
+    const configRe = /--config\s+([\w@./-]+\.(?:js|mjs|cjs|ts|json))/g;
+    const checkRe = /node\s+--check\s+([\w@./-]+\.(?:js|mjs|cjs))/g;
+    for (const re of [configRe, checkRe]) {
+        for (const match of basePrompt.matchAll(re)) {
+            const file = match[1];
+            if (file && file.includes("/"))
+                files.add(file);
+        }
+    }
+    return [...files].sort();
+}
 /**
  * Remove the repeated full planner input from a coverage batch. The normal
  * plan prompt already contains a bounded JSON handoff, but repeating all
@@ -3226,6 +3300,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
     const coverageSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "coverage");
     const uxSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "ux-local");
     const globalMockDataSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "global-mock-data");
+    const finalizeSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "finalize");
     const allRequirementIds = input.requirementIds ?? [];
     const buildPhasePrompt = (segment, missing = []) => {
         const compact = allRequirementIds.length > 0
@@ -3295,6 +3370,42 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 : []),
         ].filter(Boolean).join("\n\n");
     };
+    const buildCompactLocalPrompt = (missing = []) => {
+        const ledger = input.committedFacts
+            ? compactFrontendPlanLedgerContext({
+                committedFacts: input.committedFacts(),
+                requirementIds: allRequirementIds,
+                kinds: [
+                    "plan-requirement",
+                    "plan-verification-target",
+                    "component-choice",
+                    "state-flow",
+                ],
+            })
+            : "";
+        return [
+            compactFrontendPlanPromptForRequirementSlice(input.basePrompt, allRequirementIds),
+            "PLAN PHASE — compact local planning for a small frontend request.",
+            "For every listed requirement, record plan-requirement and verification-target facts, then record the component-choice and state-flow facts needed by the observable UX. Do not read the repository or task source; use only the committed input above. Do not call finalize_plan in this session.",
+            "TOOL-FIRST: your first assistant actions must be record_* tool calls, at most 2-3 facts per message. Do not draft the whole analysis before recording; if a fact is uncertain, record it with an evidence gap instead of reasoning longer.",
+            ledger,
+            ...(missing.length > 0
+                ? [
+                    "MISSING-FACT QUEUE: repair ONLY these items, then re-check the compact local phase:",
+                    ...missing.map((item) => `- ${item.kind}${item.id ? ` ${item.id}` : ""} for ${item.requirementIds.join(", ")}: ${item.reason}`),
+                ]
+                : []),
+        ].filter(Boolean).join("\n\n");
+    };
+    const compactFinalizeInstruction = "This is a small-request compact pass. Reconcile the committed local facts with route, data-flow, Mock/API, dependency and deviation policy, then call finalize_plan exactly once.";
+    const buildCompactFinalizePrompt = (missing = []) => [buildPhasePrompt(finalizeSegment, missing), compactFinalizeInstruction].join("\n\n");
+    const mapPlannerExhaustion = (r, committedAnyFacts) => isPlannerThinkingExhausted(r, committedAnyFacts)
+        ? {
+            ...r,
+            failureCategory: PLANNER_THINKING_EXHAUSTED_CATEGORY,
+            stderr: `${r.stderr}\n${PLANNER_THINKING_EXHAUSTED_CATEGORY}: stopReason=length, thinking observed, 0 typed facts committed; the batch ladder degraded the scope without converging — set thinking=off for this tier or switch to a non-thinking model`.trim(),
+        }
+        : r;
     // An empty list means "ledger unreadable / unknown" and falls back to one
     // unscoped coverage session; a non-empty list enables deterministic sharding.
     const requirementIdsProvided = input.requirementIds !== undefined && input.requirementIds.length > 0;
@@ -3307,7 +3418,42 @@ export async function runFrontendPlanSegmentedSessions(input) {
         : [];
     const incompleteRequirementIds = new Set(initialMissing.flatMap((item) => item.requirementIds));
     const coverageWorkIds = (input.requirementIds ?? []).filter((id) => pending.includes(id) || incompleteRequirementIds.has(id));
-    if (!requirementIdsProvided) {
+    const estimatedCalls = (input.requirementIds ?? []).reduce((total, id) => total + Math.max(1, input.requirementCosts?.get(id) ?? 2), 0);
+    const targetSurfaceCount = countFrontendPlanTargetSurfaces(input.basePrompt);
+    // Small, single-surface requests do not benefit from six isolated Pi
+    // sessions. Keep the typed ledger as the authority, but let one local
+    // session establish requirement/UX facts and one final session establish
+    // cross-cutting policy + finalize. The old sharded ladder remains available
+    // for larger plans and for the unscoped compatibility path.
+    const useCompactSmallPlan = requirementIdsProvided &&
+        input.compactSmallPlan === true &&
+        input.requirementCosts !== undefined &&
+        estimatedCalls > 12 &&
+        (input.requirementIds?.length ?? 0) <= FRONTEND_PLAN_SMALL_MAX_REQUIREMENTS &&
+        estimatedCalls <= FRONTEND_PLAN_SMALL_MAX_ESTIMATED_CALLS &&
+        targetSurfaceCount === 1;
+    if (useCompactSmallPlan) {
+        const compactLocalTools = new Set([
+            "record_plan_requirement",
+            "record_plan_verification_target",
+            "record_plan_evidence_gap",
+            "record_component_choice",
+            "record_state_flow",
+            "adopt_staged_fact",
+        ]);
+        queue.push({
+            id: "compact-local",
+            toolNames: compactLocalTools,
+            requirementSlice: [...allRequirementIds],
+            prompt: buildCompactLocalPrompt(),
+        });
+        queue.push({
+            id: "finalize",
+            toolNames: null,
+            prompt: buildCompactFinalizePrompt(),
+        });
+    }
+    else if (!requirementIdsProvided) {
         queue.push({
             id: "coverage",
             toolNames: coverageSegment.toolNames,
@@ -3329,41 +3475,45 @@ export async function runFrontendPlanSegmentedSessions(input) {
             prompt: buildCoveragePrompt(slice),
         }));
     }
-    const uxCosts = new Map((input.requirementIds ?? []).map((id) => [
-        id,
-        Math.max(2, Math.min(3, input.requirementCosts?.get(id) ?? 2)),
-    ]));
-    const uxSlices = requirementIdsProvided
-        ? batchFrontendPlanRequirements({
-            requirementIds: input.requirementIds,
-            maxEstimatedRecordCalls: FRONTEND_PLAN_UX_LOCAL_MAX_RECORD_CALLS,
-            maxRequirements: 3,
-            requirementCosts: uxCosts,
-        })
-        : [[]];
-    uxSlices.forEach((slice, batchIndex) => queue.push({
-        id: `ux-local-${batchIndex + 1}`,
-        toolNames: uxSegment.toolNames,
-        ...(slice.length > 0 ? { requirementSlice: slice } : {}),
-        prompt: slice.length > 0
-            ? buildUxPrompt(slice)
-            : buildPhasePrompt(uxSegment),
-    }));
-    for (const segment of FRONTEND_PLAN_SEGMENTS) {
-        if (["coverage", "ux-local", "finalize"].includes(segment.id))
-            continue;
+    if (useCompactSmallPlan) {
+        // Compact mode already queued both sessions above.
+    }
+    else {
+        const uxCosts = new Map((input.requirementIds ?? []).map((id) => [
+            id,
+            Math.max(2, Math.min(3, input.requirementCosts?.get(id) ?? 2)),
+        ]));
+        const uxSlices = requirementIdsProvided
+            ? batchFrontendPlanRequirements({
+                requirementIds: input.requirementIds,
+                maxEstimatedRecordCalls: FRONTEND_PLAN_UX_LOCAL_MAX_RECORD_CALLS,
+                maxRequirements: 3,
+                requirementCosts: uxCosts,
+            })
+            : [[]];
+        uxSlices.forEach((slice, batchIndex) => queue.push({
+            id: `ux-local-${batchIndex + 1}`,
+            toolNames: uxSegment.toolNames,
+            ...(slice.length > 0 ? { requirementSlice: slice } : {}),
+            prompt: slice.length > 0
+                ? buildUxPrompt(slice)
+                : buildPhasePrompt(uxSegment),
+        }));
+        for (const segment of FRONTEND_PLAN_SEGMENTS) {
+            if (["coverage", "ux-local", "finalize"].includes(segment.id))
+                continue;
+            queue.push({
+                id: segment.id,
+                toolNames: segment.toolNames,
+                prompt: buildPhasePrompt(segment),
+            });
+        }
         queue.push({
-            id: segment.id,
-            toolNames: segment.toolNames,
-            prompt: buildPhasePrompt(segment),
+            id: finalizeSegment.id,
+            toolNames: finalizeSegment.toolNames,
+            prompt: buildPhasePrompt(finalizeSegment),
         });
     }
-    const finalizeSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "finalize");
-    queue.push({
-        id: finalizeSegment.id,
-        toolNames: finalizeSegment.toolNames,
-        prompt: buildPhasePrompt(finalizeSegment),
-    });
     let last;
     let index = 0;
     let invocationCount = 0;
@@ -3389,6 +3539,9 @@ export async function runFrontendPlanSegmentedSessions(input) {
             const promptSlice = remaining.length > 0 ? remaining : session.coverageSlice;
             prompt = buildCoveragePrompt(promptSlice, session.missingFacts ?? preexistingMissing);
         }
+        else if (session.id === "compact-local") {
+            prompt = buildCompactLocalPrompt(session.missingFacts);
+        }
         else if (session.id.startsWith("ux-local-")) {
             // Build this at execution time: coverage facts are committed by the
             // preceding sessions and must be visible to the UX-local model.
@@ -3402,11 +3555,14 @@ export async function runFrontendPlanSegmentedSessions(input) {
             // stale queue entry from dropping facts written by earlier phases.
             const segment = FRONTEND_PLAN_SEGMENTS.find((candidate) => candidate.id === session.id);
             if (segment) {
-                prompt = buildPhasePrompt(segment, session.missingFacts);
+                prompt =
+                    session.id === "finalize" && useCompactSmallPlan
+                        ? buildCompactFinalizePrompt(session.missingFacts)
+                        : buildPhasePrompt(segment, session.missingFacts);
             }
         }
         const committedBefore = input.committedFactCount();
-        input.setActiveRequirementScope?.(session.id.startsWith("ux-local-")
+        input.setActiveRequirementScope?.(session.id === "compact-local" || session.id.startsWith("ux-local-")
             ? session.requirementSlice ?? []
             : []);
         if (invocationCount >= FRONTEND_PLAN_BATCH_MAX_SESSIONS)
@@ -3444,27 +3600,67 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 committedFacts: input.committedFacts(),
             })
             : [];
+        const isCompactLocalSession = session.id === "compact-local";
         const isUxLocalSession = session.id.startsWith("ux-local-");
-        const missingPhase = isUxLocalSession && session.requirementSlice && input.committedFacts
-            ? collectFrontendPlanPhaseMissingFacts({
-                phase: "ux-local",
-                requirementIds: session.requirementSlice,
-                committedFacts: input.committedFacts(),
-                behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds,
-            })
-            : session.id === "global-mock-data" && allRequirementIds.length > 0 && input.committedFacts
-                ? collectFrontendPlanPhaseMissingFacts({
-                    phase: "global-mock-data",
+        const missingPhase = isCompactLocalSession && input.committedFacts
+            ? [
+                ...collectFrontendPlanMissingFacts({
                     requirementIds: allRequirementIds,
                     committedFacts: input.committedFacts(),
+                }),
+                ...collectFrontendPlanPhaseMissingFacts({
+                    phase: "ux-local",
+                    requirementIds: allRequirementIds,
+                    committedFacts: input.committedFacts(),
+                    behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds,
+                }),
+            ]
+            : isUxLocalSession && session.requirementSlice && input.committedFacts
+                ? collectFrontendPlanPhaseMissingFacts({
+                    phase: "ux-local",
+                    requirementIds: session.requirementSlice,
+                    committedFacts: input.committedFacts(),
+                    behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds,
                 })
-                : [];
+                : session.id === "global-mock-data" && allRequirementIds.length > 0 && input.committedFacts
+                    ? collectFrontendPlanPhaseMissingFacts({
+                        phase: "global-mock-data",
+                        requirementIds: allRequirementIds,
+                        committedFacts: input.committedFacts(),
+                    })
+                    : [];
         const missingPhaseFacts = [...missingCoverage, ...missingPhase];
+        // Frozen verification commands must operate on files the planner has
+        // committed verification targets for; otherwise the admission writeSet
+        // cannot authorize the file and verify-shell deterministically fails.
+        const verificationCommandFiles = collectFrontendVerificationCommandFiles(input.basePrompt);
+        if (verificationCommandFiles.length > 0 && allRequirementIds.length > 0 && input.committedFacts) {
+            const coveredVerificationFiles = new Set(input
+                .committedFacts()
+                .map(committedFactFromPlanRecord)
+                .filter((fact) => Boolean(fact && fact.origin === "plan" && fact.kind === "plan-verification-target"))
+                .map((fact) => fact.entry?.file)
+                .filter((file) => typeof file === "string"));
+            for (const file of verificationCommandFiles) {
+                if (coveredVerificationFiles.has(file))
+                    continue;
+                missingPhaseFacts.push({
+                    kind: "plan-verification-target",
+                    id: file,
+                    requirementIds: allRequirementIds.slice(0, 1),
+                    reason: `frozen verification command references ${file} but no committed verification target covers it; record a static verification target for this file so it joins the writeSet`,
+                });
+            }
+        }
         const promptForMissingPhase = (missing) => session.coverageOnly
             ? buildCoveragePrompt(session.coverageSlice ?? [], missing)
-            : isUxLocalSession
-                ? buildUxPrompt(session.requirementSlice ?? [], missing)
-                : buildPhasePrompt(globalMockDataSegment, missing);
+            : isCompactLocalSession
+                ? buildCompactLocalPrompt(missing)
+                : session.id === "finalize" && useCompactSmallPlan
+                    ? buildCompactFinalizePrompt(missing)
+                    : isUxLocalSession
+                        ? buildUxPrompt(session.requirementSlice ?? [], missing)
+                        : buildPhasePrompt(globalMockDataSegment, missing);
         if (result.ok) {
             if (missingPhaseFacts.length === 0) {
                 index += 1;
@@ -3508,10 +3704,36 @@ export async function runFrontendPlanSegmentedSessions(input) {
             index += 1;
             continue;
         }
+        // A length-stopped, fact-less compact session is the planner variant of
+        // writer-thinking-exhausted. Give the same scope exactly one tool-first
+        // retry before the split below re-batches the requirements, because one
+        // reinforced full-scope pass is cheaper than re-planning split halves.
+        const plannerThinkingBurn = isCompactLocalSession &&
+            committedAfter === committedBefore &&
+            !(result.assistantText ?? "").trim() &&
+            !result.stderr.trim() &&
+            !result.timedOut &&
+            readWriterThinkingExhaustionEvidence(result).stopReason === "length";
+        if (plannerThinkingBurn && (session.retryCount ?? 0) < 1) {
+            queue[index] = {
+                ...session,
+                retryCount: (session.retryCount ?? 0) + 1,
+                prompt: buildCompactLocalPrompt(),
+            };
+            continue;
+        }
         // Option 5: a multi-requirement coverage batch that failed with ZERO
         // new facts and no provider stderr is the upfront-reasoning burn —
-        // halve the slice and retry instead of failing the attempt.
-        const coverageSlice = session.coverageOnly ? session.coverageSlice : undefined;
+        // halve the slice and retry instead of failing the attempt. The compact
+        // local session participates through its requirementSlice so a
+        // thinking-burned small plan degrades into smaller batched sessions
+        // instead of replaying one full-scope prompt until the repair budget
+        // runs out.
+        const coverageSlice = session.coverageOnly
+            ? session.coverageSlice
+            : isCompactLocalSession
+                ? session.requirementSlice
+                : undefined;
         const zeroProgressBurn = coverageSlice !== undefined &&
             coverageSlice.length > 1 &&
             committedAfter === committedBefore &&
@@ -3522,6 +3744,26 @@ export async function runFrontendPlanSegmentedSessions(input) {
             const half = Math.ceil(coverageSlice.length / 2);
             const firstSlice = coverageSlice.slice(0, half);
             const secondSlice = coverageSlice.slice(half);
+            if (isCompactLocalSession) {
+                // The split halves leave compact mode: continue them as ordinary
+                // coverage sessions so every downstream ladder branch applies.
+                queue.splice(index, 1, {
+                    ...session,
+                    id: `coverage-compact-split-1`,
+                    coverageOnly: true,
+                    coverageSlice: firstSlice,
+                    requirementSlice: firstSlice,
+                    prompt: buildCoveragePrompt(firstSlice),
+                }, {
+                    ...session,
+                    id: `coverage-compact-split-2`,
+                    coverageOnly: true,
+                    coverageSlice: secondSlice,
+                    requirementSlice: secondSlice,
+                    prompt: buildCoveragePrompt(secondSlice),
+                });
+                continue;
+            }
             queue.splice(index, 1, {
                 ...session,
                 coverageSlice: firstSlice,
@@ -3546,7 +3788,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
             };
             continue;
         }
-        return result;
+        return mapPlannerExhaustion(result, committedAfter > committedBefore);
     }
     if (index < queue.length) {
         return {
@@ -3571,13 +3813,13 @@ export async function runFrontendPlanSegmentedSessions(input) {
             failureCategory: "invalid-output",
         };
     }
-    return (last ?? {
+    return mapPlannerExhaustion(last ?? {
         ok: false,
         stdout: "",
         stderr: "frontend plan segmentation produced no session",
         failureCategory: "empty-output",
         durationMs: 0,
-    });
+    }, false);
 }
 export async function executeDagPiNode(input, meta, piStepFn = executePiStep, writeGuardDependencies = DEFAULT_DAG_PI_WRITE_GUARD_DEPENDENCIES) {
     const started = Date.now();
@@ -4060,6 +4302,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 committedFactCount: () => planLedgerTools.committedFactCount(),
                 requirementIds: planRequirementIds,
                 requirementCosts: planRequirementCosts,
+                compactSmallPlan: true,
                 committedRequirementIds: () => planLedgerTools.committedRequirementIds(),
                 committedFacts: () => planLedgerTools.committedFacts(),
                 behaviorRequiredRequirementIds,
@@ -4079,6 +4322,18 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 ...(writerToolPolicy ? { writerToolPolicy } : {}),
             });
         }
+        try {
+            const verificationCommandFiles = collectFrontendVerificationCommandFiles(input.prompt);
+            const debugPath = path.join(meta.runDir, input.task.id, "verification-command-coverage.json");
+            await import("node:fs/promises").then(({ writeFile, mkdir }) => mkdir(path.dirname(debugPath), { recursive: true }).then(() => writeFile(debugPath, `${JSON.stringify({
+                schemaVersion: 1,
+                basePromptChars: input.prompt.length,
+                verificationCommandFiles,
+            }, null, 2)}\n`)));
+        }
+        catch {
+            // best-effort diagnostic breadcrumb
+        }
     }
     catch (error) {
         if (playwrightToolContext) {
@@ -4860,6 +5115,8 @@ export function mapPiResultToDagNodeResult(result, firstProtocolLine) {
         tokensUsed: result.tokensUsed,
         parsedEvents: result.parsedEvents,
         stopReason: readWriterThinkingExhaustionEvidence(result).stopReason,
+        thinkingObserved: readWriterThinkingExhaustionEvidence(result).thinkingObserved,
+        writeToolCallCount: readWriterThinkingExhaustionEvidence(result).writeToolCallCount,
     };
 }
 function canonicalizeProtocolFirstLine(assistantText, firstProtocolLine) {