@tea-agent/loop-agent 0.42.0-next.8 → 0.42.0

package/dist/workflows/dag/node-execution.js

@@ -6,13 +6,14 @@ import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { redactSecrets, truncateUtf8Preview } from "../../shared/preview.js";
 import { recordDecisionEnvelopeForNode, shouldPauseOnHumanEscalation, writeHumanEscalationArtifacts, } from "./decision-envelope.js";
 import { FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT, FRONTEND_WRITER_NODE_IDS, isFrontendWriterAuthorized, readFrontendPrewriteResult, } from "./scheduler.js";
+import { collectVerificationCommandFiles, } from "./frontend-writer-admission.js";
 import { writeNodeRecord, writeNodeSkillArtifacts } from "./run-store.js";
 import { resolveContextPolicy } from "./context-policy.js";
 import { buildDagNodePromptEnvelope, formatConvergenceFeedbackBlock, } from "./prompt.js";
 import { persistLongNodeOutputArtifacts } from "./upstream-artifacts.js";
 import { materializeDeclaredArtifactFacts } from "./artifact-bindings.js";
 import { buildOutputLimitRecoverySection, loadBackendTestWriterProgressForRetry, } from "./backend-test-writer-completeness.js";
-import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
+import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, OUTPUT_LIMIT_RETRY_CATEGORY, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
 import { applyNodeActivity, evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
 import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, parseJsonReviewVerdict, validateOutputProtocol, } from "./output-protocol.js";
 import { getStructuredContractValidator } from "./contract-output-registry.js";
@@ -20,6 +21,7 @@ import "./contract-validator-registrations.js";
 import { computeNormalizedFailureFingerprint } from "./frontend-recovery-lineage.js";
 import { parseLedgerJson } from "../../task/source-prepare/ledger.js";
 import { readTypedEventStoreFromJsonl } from "./frontend-typed-event-store.js";
+import { collectCanonicalStateFlowNames, extractRequiredDeliverablePaths, resolveFrontendContractRequirements, } from "./frontend-contract-facts.js";
 import { allowedRepairReadPaths, auditRepairAttemptToolUse, buildStructuredOutputRepairPrompt, freezeStructuredOutputRepairContext, hasNonEmptyStructuredCandidate, isFrontendStructuredRepairSchemaId, isStructuredRepairableFailureCategory, persistStructuredAttemptRaw, sessionEventsByteLength, GOVERNANCE_BLOCKED_CATEGORY, STRUCTURED_REPAIR_EXHAUSTED_CATEGORY, } from "./structured-output-repair.js";
 import { readFrontendCanonicalCandidate } from "./frontend-implementation-contract.js";
 import { writeDagNodeJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
@@ -255,6 +257,9 @@ function frontendPlanValidationRetryGuidance(reason) {
     if (/verificationTargets.*uiStates|uiStates.*verificationTargets/i.test(reason)) {
         guidance.push("For this retry, provide verificationTargets[].uiStates as an array; use [] when the target has no named UI state.");
     }
+    if (/duplicate|already recorded/i.test(reason)) {
+        guidance.push("For this retry, re-commit the corrected entry with the same id and replace=true; the ledger compiles the latest submission as the full replacement. A duplicate receipt is a correction invitation, not a prohibition, and backfilling a cited fact's reverse reference in-node does not re-derive committed facts.");
+    }
     return guidance;
 }
 function compactRetryText(text, maxChars) {
@@ -324,6 +329,8 @@ const FRONTEND_CONTRACT_RECORD_TOOL_NAMES_LOCAL = new Set([
     "record_handoff_intent",
     "record_open_question",
     "record_split_proposal",
+    "record_ui_state",
+    "record_required_deliverables",
 ]);
 async function countContractRecordSubmissions(runDir, nodeId) {
     const eventsPath = path.join(runDir, nodeId, "session-events.jsonl");
@@ -552,8 +559,9 @@ export function renderFrontendPlanInputContext(input) {
         : []);
     const contractFacts = committedFacts(input.contractRecords);
     const scoutFacts = committedFacts(input.scoutRecords);
-    const requirements = contractFacts
-        .filter((fact) => fact.kind === "requirement" && fact.origin === "contract")
+    const requirementFacts = resolveFrontendContractRequirements(contractFacts);
+    const requiredDeliverables = extractRequiredDeliverablePaths(contractFacts);
+    const requirements = requirementFacts
         .map((fact) => ({
         id: planInputText(fact.id, 80),
         text: planInputText(fact.text),
@@ -579,19 +587,28 @@ export function renderFrontendPlanInputContext(input) {
         paths: fact.paths,
         conflicts: fact.conflicts,
     }));
+    // Authoritative UI states (contract-declared): the source's UI-state table
+    // extracted by the contract node. The planner binds these ids instead of
+    // inventing list-visibility variants.
+    const declaredUiStates = contractFacts
+        .filter((fact) => fact.kind === "ui-state-declaration" && fact.origin === "contract")
+        .map((fact) => ({
+        id: planInputText(fact.id, 80),
+        trigger: planInputText(fact.trigger),
+        observableOutcome: planInputText(fact.observableOutcome),
+    }))
+        .filter((state) => state.id !== undefined);
+    // Replay registry edits and state-flow removals/additions in commit order.
+    const committedUxNames = collectCanonicalStateFlowNames(input.planRecords ?? [], true);
+    const committedUiStateNames = [...committedUxNames.uiStateNames];
+    const committedInteractionNames = [...committedUxNames.interactionNames];
     // Reviewer-rubric scaffold: the design reviewer re-runs the design-policy
     // checks on the committed facts, so publish the checklist to the producer.
     // Requirements whose contract evidence expects behavioural verification are
     // enumerated explicitly — those are the slots the reviewer finds missing
     // when the plan models interactions ad hoc (r8/r9 findings).
-    const behaviorRequiredIds = requirements
-        .filter((requirement) => {
-        const fact = contractFacts.find((candidate) => candidate.kind === "requirement" &&
-            candidate.origin === "contract" &&
-            candidate.id === requirement.id);
-        const evidence = fact?.evidence;
-        return evidence?.behavior === "required";
-    })
+    const behaviorRequiredIds = requirementFacts
+        .filter((requirement) => requirement.evidence.behavior === "required")
         .map((requirement) => requirement.id);
     const serializeAtCap = (cap) => JSON.stringify({
         requirements: requirements.map((requirement) => ({
@@ -599,6 +616,7 @@ export function renderFrontendPlanInputContext(input) {
             text: planInputText(requirement.text, cap.text),
             sourceFragmentIds: planInputStrings(requirement.sourceFragmentIds).slice(0, cap.array),
         })),
+        requiredDeliverables,
         targetSurface: targetSurface.map((surface) => ({
             completeness: planInputText(surface.completeness, 32),
             entrypoint: planInputText(surface.entrypoint, cap.text),
@@ -614,6 +632,18 @@ export function renderFrontendPlanInputContext(input) {
             paths: planInputStrings(evidence.paths).slice(0, cap.array),
             conflicts: planInputStrings(evidence.conflicts).slice(0, cap.array),
         })),
+        declaredUiStates: declaredUiStates.map((state) => ({
+            id: state.id,
+            trigger: planInputText(state.trigger, cap.text),
+            observableOutcome: planInputText(state.observableOutcome, cap.text),
+        })),
+        committedUx: committedUiStateNames.length > 0 ||
+            committedInteractionNames.length > 0
+            ? {
+                uiStateNames: committedUiStateNames,
+                interactionNames: committedInteractionNames,
+            }
+            : undefined,
     });
     let serialized = serializeAtCap(FRONTEND_PLAN_INPUT_CAP_LADDER[0]);
     for (const cap of FRONTEND_PLAN_INPUT_CAP_LADDER.slice(1)) {
@@ -627,6 +657,7 @@ export function renderFrontendPlanInputContext(input) {
         // to the minimum, and declare the degradation instead of corrupting JSON.
         let fallback = {
             degraded: "requirement-texts-truncated",
+            requiredDeliverables,
             requirements: requirements.map((requirement) => ({
                 id: requirement.id,
                 text: "(truncated)",
@@ -651,20 +682,20 @@ export function renderFrontendPlanInputContext(input) {
         serialized = bounded;
     }
     const checklistLines = [
-        "1. Every interaction you record needs a uiComponentChoices entry whose purpose equals the interaction name, or one decision=reuse-existing choice covering behavioural interactions.",
-        "2. Every applicable UI state needs a purpose-matching component choice or a stylingStrategy.",
-        "3. Every requirement marked (behavior) below needs modelled interactions plus at least one verification target that references it.",
-        "4. targets.files must name the concrete deliverable files; never leave the scope broader than the frozen requirements state.",
+        "1. Record the GLOBAL UX vocabulary with record_state_registry BEFORE any record_state_flow: one stable behavior-domain name per state/interaction (e.g. planner-task-edit), never one name per AC number, and never a rename of an already-recorded concept. Coverage slices by AC; UX does not.",
+        "2. Every recorded interaction/uiState name must be in that registry, and uiState names must use the contract's declared authoritative ids (declaredUiStates below) when present.",
+        "3. Every interaction and every applicable UI state must be covered by a uiComponentChoices entry: its purpose equals the name, or the choice lists the name in covers (one choice may cover many ids). A reuse-existing decision without evidencePath is rejected; stylingStrategy alone covers nothing.",
+        "4. Every requirement marked (behavior) below needs modelled interactions plus at least one verification target that references it.",
         "5. Verification targets may only reference UI states and requirements you actually recorded (the record_* tools reject unknown references).",
         `Requirements requiring behavioural coverage: ${behaviorRequiredIds.length > 0 ? behaviorRequiredIds.join(", ") : "(none)"}`,
-        "6. A decision=new component must declare sourceRequirementIds and pass sourceFragmentId for the frozen PRD fragment whose section matches the component's purpose — the runtime validates that binding and derives specReference (path/section/line); the reviewer checks purpose↔citation consistency.",
+        "6. A decision=new component must declare sourceRequirementIds and pass sourceFragmentId for the frozen PRD fragment whose section matches the component's purpose — the runtime validates that binding and derives specReference (path/section/line); the reviewer checks purpose↔citation consistency. A decision=reuse-existing component must pass evidencePath pointing at the existing repo file that proves the reuse.",
         ...[...input.componentSourceCitations ?? []]
             .filter(([id]) => behaviorRequiredIds.includes(id))
             .flatMap(([id, citations]) => citations.map((citation) => `   ${id} + ${citation.fragmentId} → ${citation.section}${citation.line ? ` (line ${citation.line})` : ""}`)),
     ];
     return [
         "<frontend_plan_input>",
-        "Committed Contract/Scout facts, compiled by the runner. Treat them as the complete planning evidence.",
+        "Committed Contract/Scout facts, compiled by the runner. Treat them as the complete planning evidence. declaredUiStates are the authoritative UI states from the task source; committedUx (retry attempts) is the UX vocabulary already recorded — reuse those names, never re-invent them.",
         serialized,
         "Do not read upstream artifacts, task sources, or repository files. If this input cannot support a decision, record a genuine evidence gap.",
         "</frontend_plan_input>",
@@ -691,6 +722,16 @@ export async function buildFrontendPlanInputContext(runDir, componentSourceCitat
         // forbids reading anything.
         throw new Error(`frontend-plan-input-unavailable: cannot read committed typed facts (${error instanceof Error ? error.message : String(error)})`);
     }
+    // Retry-attempt continuity (UX slice visibility): the plan node's own
+    // committed facts are absent on the first attempt and present on retries;
+    // a missing file is normal there, not a broken pipeline.
+    let planRecords = [];
+    try {
+        planRecords = await readTypedEventStoreFromJsonl(path.join(runDir, "frontend-plan-pi", "plan-typed-facts.jsonl"));
+    }
+    catch {
+        planRecords = [];
+    }
     const committedCount = [...contractRecords, ...scoutRecords].filter((record) => record.phase === "committed").length;
     if (committedCount === 0) {
         throw new Error(`frontend-plan-input-unavailable: no committed Contract/Scout facts in ${contractFactsPath} / ${scoutFactsPath}`);
@@ -698,6 +739,7 @@ export async function buildFrontendPlanInputContext(runDir, componentSourceCitat
     return renderFrontendPlanInputContext({
         contractRecords,
         scoutRecords,
+        planRecords,
         componentSourceCitations,
     });
 }
@@ -720,77 +762,27 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
-    if (frontendPlanRetryStep === "compact-terminal-first") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: compact-terminal-first.",
-            "Do NOT rewrite the narrative. Only adopt already staged/quarantined fresh facts, fill the missing required facts, then call finalize_plan exactly once.",
-            "Keep the existing committed ledger intact; do not re-derive already committed facts.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (frontendPlanRetryStep === "bounded-tool-only") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: bounded-tool-only.",
-            "Reduce reasoning and wall-clock time. Use only read / fact / terminal tools and only for the necessary missing facts, then call finalize_plan exactly once.",
-            "Do not expand scope or re-derive already committed facts.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (frontendPlanRetryStep === "backup-model") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: backup-model.",
-            "A backup provider/model route was selected after repeated non-converging failures. Re-derive only the missing committed facts, then call finalize_plan exactly once; do not repeat the failed strategy.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "protocol-invalid" &&
-        task.outputProtocol &&
-        previousProtocolReason) {
-        return [
-            basePrompt,
-            "",
-            buildProtocolRetryInstruction(task.outputProtocol, previousProtocolReason),
-        ].join("\n");
-    }
-    if (previousFailureCategory === "review-terminal-missing") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "The review emitted a verdict in response text but never committed the authoritative typed terminal tool call (approve_review / request_review_changes). The response text is NOT the authority: no branch or gate reads it.",
-            "Call exactly one typed terminal tool to finish: approve_review (implementation passes, no Critical/Important findings) or request_review_changes (with typed issueCategory, at least one evidenceRef, and non-empty findings). Do not repeat the review analysis; commit the terminal tool once and stop.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "read-burst") {
-        if (task.id !== FRONTEND_PLAN_NODE_ID) {
-            return [
-                basePrompt,
-                "",
-                "<retry_instruction>",
-                "The previous attempt exceeded its read budget. Start a fresh, evidence-minimal pass: do not re-read task sources, upstream stdout, skills, or full diff artifacts already represented by a canonical context artifact.",
-                "Read the smallest relevant summary first, then only the specific source file or diff fragment needed for the required decision. Finish the required terminal/output protocol as soon as evidence is sufficient.",
-                "</retry_instruction>",
-            ].join("\n");
-        }
+    if (task.id === "generate-backend-md-plan-pi" &&
+        (previousFailureCategory === "output-too-large" ||
+            previousFailureCategory === "invalid-output")) {
         return [
             basePrompt,
             "",
             "<retry_instruction>",
-            "Previous plan attempt issued too many read-only tool calls (read/grep/ls/find) and blew up the context window. Trust the upstream frontend-contract-pi typed requirement facts and frontend-scout-pi target surface already provided — do NOT re-read contract/scout stdout, PRD/source files, or component sources you already inspected.",
-            "Minimize discovery reads: only read what you genuinely need, once. Commit record_plan_requirement / record_plan_verification_target / record_* facts directly from the facts already in context (one tool call per message), then call finalize_plan exactly once.",
+            "The previous backend-test plan attempt was truncated or failed its mandatory Markdown protocol.",
+            previousProtocolReason ?? "The previous plan artifact was incomplete.",
+            "Return the final Markdown artifact immediately. Do not output analysis, reasoning, source summaries, or planning narration.",
+            "Emit the complete section skeleton first, including exactly one ## Coverage Scope, exactly one ## Coverage Matrix, optional ## Scenario Partitions only when applicable, and exactly one ## Module Index with its required 8-column table and at least one module row.",
+            "After the complete skeleton exists, fill only concise table rows within the remaining output budget. Do not use code fences.",
             "</retry_instruction>",
         ].join("\n");
     }
+    // Repair-category guidance must outrank the retry ladder position: the
+    // ladder advances monotonically on transport failures (e.g. length →
+    // compact-terminal-first), and its "keep the committed ledger intact"
+    // instruction directly contradicts the repair action for invalid-output /
+    // truncated ledger facts (re-commit corrected record_* facts). When both
+    // apply, the model receives the repair instruction, not the rung script.
     if (previousFailureCategory === "invalid-output" &&
         task.structuredContractOutput &&
         previousProtocolReason) {
@@ -804,7 +796,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
                 ? [
                     "",
-                    "The writeSet is too large for one implement node. Do NOT delete implementation files to squeeze under the limit — that drops required work. Split the task via record_split_proposal (or narrow targets.files to a genuine subset) so each implement node stays bounded; the full file set must remain covered across the split.",
+                    "The writeSet is too large for one implement node. Preserve the complete requirement and file coverage. This needs a Contract-level task split, not a Plan formatting repair. Report the write-set-too-large finding and the affected paths for the controller to resume Contract/split orchestration. Plan cannot change protected targets.files or call Contract-only tools; do not invent a split tool or discard required files.",
                 ]
                 : [];
             return [
@@ -866,8 +858,96 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
+    if (frontendPlanRetryStep === "compact-terminal-first") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: compact-terminal-first.",
+            "Do NOT rewrite the narrative. Only adopt already staged/quarantined fresh facts, fill the missing required facts, then call finalize_plan exactly once.",
+            "Keep the existing committed ledger intact; do not re-derive already committed facts.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (frontendPlanRetryStep === "bounded-tool-only") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: bounded-tool-only.",
+            "Reduce reasoning and wall-clock time. Use only read / fact / terminal tools and only for the necessary missing facts, then call finalize_plan exactly once.",
+            "Do not expand scope or re-derive already committed facts.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (frontendPlanRetryStep === "backup-model") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: backup-model.",
+            "A backup provider/model route was selected after repeated non-converging failures. Re-derive only the missing committed facts, then call finalize_plan exactly once; do not repeat the failed strategy.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "protocol-invalid" &&
+        task.outputProtocol &&
+        previousProtocolReason) {
+        return [
+            basePrompt,
+            "",
+            buildProtocolRetryInstruction(task.outputProtocol, previousProtocolReason),
+        ].join("\n");
+    }
+    if (previousFailureCategory === "review-terminal-missing") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The review emitted a verdict in response text but never committed the authoritative typed terminal tool call (approve_review / request_review_changes). The response text is NOT the authority: no branch or gate reads it.",
+            "Call exactly one typed terminal tool to finish: approve_review (implementation passes, no Critical/Important findings) or request_review_changes (with typed issueCategory, at least one evidenceRef, and non-empty findings). Do not repeat the review analysis; commit the terminal tool once and stop.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "read-burst") {
+        if (task.id !== FRONTEND_PLAN_NODE_ID) {
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "The previous attempt exceeded its read budget. Start a fresh, evidence-minimal pass: do not re-read task sources, upstream stdout, skills, or full diff artifacts already represented by a canonical context artifact.",
+                "Read the smallest relevant summary first, then only the specific source file or diff fragment needed for the required decision. Finish the required terminal/output protocol as soon as evidence is sufficient.",
+                "</retry_instruction>",
+            ].join("\n");
+        }
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Previous plan attempt issued too many read-only tool calls (read/grep/ls/find) and blew up the context window. Trust the upstream frontend-contract-pi typed requirement facts and frontend-scout-pi target surface already provided — do NOT re-read contract/scout stdout, PRD/source files, or component sources you already inspected.",
+            "Minimize discovery reads: only read what you genuinely need, once. Commit record_plan_requirement / record_plan_verification_target / record_* facts directly from the facts already in context (one tool call per message), then call finalize_plan exactly once.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    // Generic output-limit fallback. Every branch above this one carries a
+    // more precise instruction for the same capacity signal (contract repair
+    // reasons, ladder rungs — compact-terminal-first is the reason-mandated
+    // rung for length-before-terminal —, protocol/review/read-burst repair),
+    // so output-limit must not shadow them.
+    if (previousFailureCategory === OUTPUT_LIMIT_RETRY_CATEGORY) {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The previous turn ended with stopReason=length before the required output was complete. This is output-capacity truncation, not empty output.",
+            "Continue incrementally from already committed typed facts and current in-scope workspace files. Do not repeat completed discovery, decisions, facts, or writes.",
+            "Generate the smallest unfinished unit next, validate its required format immediately, repair any format error in this node, and only then continue to the next unfinished unit or terminal tool.",
+            "Keep prose minimal and finish the required terminal/output protocol as soon as the remaining work is valid.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
     if (previousFailureCategory === "writer-empty-diff") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         // When a completeness progress exists for this writer, fold the concrete
         // target paths into the empty-diff retry so the model does not guess and
         // does not need to read a forbidden `.harness/**` evidence file.
@@ -895,7 +975,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
         ].join("\n");
     }
     if (previousFailureCategory === "incomplete-write-set") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         const bindingOnly = task.id?.startsWith("generate-backend-md-case-") === true &&
             (recoveryTargetPaths?.length ?? 0) === 1 &&
             Object.values(recoveryDiagnostics ?? {}).flat().some((detail) => /(?:unclassified Test Points|duplicate Test Point bindings)/i.test(detail));
@@ -1282,6 +1362,52 @@ export async function executeDagNode(input) {
             await skipFrontendWriter(record);
             return;
         }
+        // The admission artifact is the effective authorization boundary. Never
+        // leave the writer using the broad task glob after the shell has frozen a
+        // concrete set: doing so makes the receipt auditable but unenforceable.
+        // Files referenced by frozen verification commands are unioned in: the
+        // plan's verification targets do not always name verification
+        // infrastructure, yet verify-shell cannot run without it and the writer
+        // must be authorized to create it.
+        const admissionWriteSetEntries = admission.result.writeSet.map((entry) => entry.trim().replace(/\\/g, "/").replace(/^\.\//, ""));
+        const frozenVerificationBundle = spec.tasks.find((specTask) => specTask.shell?.frontendVerificationBundle)?.shell?.frontendVerificationBundle;
+        const verificationCommandFiles = frozenVerificationBundle
+            ? collectVerificationCommandFiles([
+                ...(frozenVerificationBundle.staticCommands ?? []),
+                ...(frozenVerificationBundle.behaviorCommands ?? []),
+                ...(frozenVerificationBundle.mockCommands ?? []),
+                ...(frozenVerificationBundle.lintCommands ?? []),
+            ])
+            : [];
+        const extraVerificationFiles = verificationCommandFiles.filter((file) => !admissionWriteSetEntries.includes(file) &&
+            file &&
+            !file.includes("*") &&
+            !file.includes("?") &&
+            !file.split("/").some((segment) => segment === "..") &&
+            task.allowedPaths.some((allowed) => pathMatchesPattern(file, allowed)) &&
+            !task.forbiddenPaths.some((forbidden) => pathMatchesPattern(file, forbidden)));
+        const admittedWriteSet = [
+            ...new Set([...admissionWriteSetEntries, ...extraVerificationFiles]),
+        ];
+        if (admittedWriteSet.length === 0 ||
+            new Set(admittedWriteSet).size !== admittedWriteSet.length ||
+            admittedWriteSet.some((entry) => !entry ||
+                entry.includes("*") ||
+                entry.includes("?") ||
+                entry.split("/").some((segment) => segment === "..") ||
+                !task.allowedPaths.some((allowed) => pathMatchesPattern(entry, allowed)) ||
+                task.forbiddenPaths.some((forbidden) => pathMatchesPattern(entry, forbidden)))) {
+            await failBeforePrompt(new Error("frontend writer admission contains an invalid effective writeSet"), "final-write-set-approval-invalid");
+            return;
+        }
+        task = { ...task, writeSet: admittedWriteSet };
+        node.runtimeWriteAuthorization = {
+            schemaVersion: 1,
+            status: "validated",
+            approvalSourceNodeId: FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT,
+            approvalDigest: admission.result.admissionDigest,
+            effectiveWriteSet: [...admittedWriteSet],
+        };
         node.frontendWriterAdmission = record;
     }
     let projectGovernanceContext;
@@ -1457,6 +1583,26 @@ export async function executeDagNode(input) {
             return;
         }
     }
+    if (FRONTEND_WRITER_NODE_IDS.includes(nodeId)) {
+        // Design-review findings are not reliable in the provider's prose output
+        // (typed terminal nodes commonly return an empty assistant message). Inject
+        // the bounded admission capsule explicitly so an authorized retry has the
+        // reviewer's concrete issue/evidence context.
+        try {
+            const admission = await readFrontendPrewriteResult(runDir);
+            const advisory = admission.ok ? admission.result.designReviewAdvisory : undefined;
+            if (advisory?.findings?.length || advisory?.evidenceRefs?.length) {
+                prompt = `${prompt}\n\n<design_review_findings>\n${JSON.stringify({
+                    verdict: advisory.verdict,
+                    findings: advisory.findings.slice(0, 16),
+                    evidenceRefs: advisory.evidenceRefs.slice(0, 16),
+                })}\n</design_review_findings>\nAddress every Critical/Important finding before writing.`;
+            }
+        }
+        catch {
+            // Admission is already enforced above; prompt enrichment is best effort.
+        }
+    }
     node.resolvedSkills = resolvedSkills;
     await writeNodeSkillArtifacts(runDir, nodeId, resolvedSkills);
     let model = resolveModelForTask(task, spec.executorModels);
@@ -1568,6 +1714,9 @@ export async function executeDagNode(input) {
                 return acc;
             }, {});
             let attemptPrompt = buildAttemptPrompt(task, prompt, attemptNumber, previousFailureCategory, previousProtocolReason, recoveryTargetPaths, recoveryDiagnostics, frontendPlanRetryStep);
+            if (task.id === "frontend-scout-pi" && attemptNumber > 1) {
+                attemptPrompt = `${attemptPrompt}\n\nSCOUT RETRY (reuse existing evidence): preserve all committed target-surface/design-evidence facts and do not re-read files already covered by the prior attempt. Inspect only unresolvedPaths or missing target-surface fields, then commit the minimal correction. If the existing facts are complete, commit the same canonical facts without broad rediscovery.`;
+            }
             if (attemptNumber > 1 &&
                 // The plan node (frontend-plan-pi) is a typed-facts ladder task:
                 // its retry is driven by the §5.1 ladder (compact-terminal-first
@@ -1642,6 +1791,43 @@ export async function executeDagNode(input) {
                 durationMs: 0,
             };
         }
+        // stopReason=length on top of a bare empty-output verdict is a provider
+        // capacity signal, not a true empty response: reroute it through the
+        // dedicated output-limit retry path while keeping the raw category for
+        // diagnostics. Bare empty-output and transport aliases (network,
+        // nonzero-exit, unknown) are rerouted — categories that already carry a
+        // precise repair instruction (output-too-large, invalid-output,
+        // protocol-invalid, structured-output-truncated via the validators below,
+        // writer categories) keep their classification so their exact retry
+        // guidance still reaches the model.
+        if (task.executor === "pi" &&
+            !result.ok &&
+            result.stopReason === "length" &&
+            (result.failureCategory === undefined ||
+                ["empty-output", "network", "nonzero-exit", "unknown"].includes(result.failureCategory))) {
+            result = {
+                ...result,
+                rawFailureCategory: result.rawFailureCategory ?? result.failureCategory,
+                failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
+                stderr: [
+                    result.stderr,
+                    "output-limit: stopReason=length; preserve completed work and retry only the unfinished output",
+                ]
+                    .filter(Boolean)
+                    .join("\n"),
+            };
+        }
+        if (task.id === "generate-backend-md-plan-pi" &&
+            !result.ok &&
+            (result.failureCategory === "output-too-large" ||
+                result.failureCategory === "invalid-output")) {
+            const marker = "backend-test Markdown plan";
+            const markerIndex = result.stderr?.lastIndexOf(marker) ?? -1;
+            previousProtocolReason =
+                markerIndex >= 0
+                    ? result.stderr.slice(markerIndex, markerIndex + 4_000).trim()
+                    : `backend-test Markdown plan attempt failed with ${result.failureCategory}`;
+        }
         if (isFrontendStructuredRepairSchemaId(task.structuredContractOutput?.schemaId)) {
             const rawText = canonicalNodeOutput(result);
             if (rawText.trim().length > 0) {
@@ -1764,7 +1950,7 @@ export async function executeDagNode(input) {
             !result.ok &&
             retryPolicy !== undefined) {
             const submissions = await countContractRecordSubmissions(runDir, nodeId);
-            if (submissions === 0) {
+            if (submissions === 0 && result.stopReason !== "length") {
                 result = {
                     ...result,
                     failureCategory: "empty-output",
@@ -1793,6 +1979,9 @@ export async function executeDagNode(input) {
             sdkAttempted: result.sdkAttempted,
             tokensUsed: result.tokensUsed,
             parsedEvents: result.parsedEvents,
+            stopReason: result.stopReason,
+            thinkingObserved: result.thinkingObserved,
+            writeToolCallCount: result.writeToolCallCount,
             artifactPath: `${nodeId}/attempt-${attemptNumber}.json`,
         };
         if (retryPolicy !== undefined) {
@@ -1874,6 +2063,9 @@ export async function executeDagNode(input) {
             retryPolicy === undefined
                 ? result.parsedEvents
                 : sumAttemptMetric(attempts, (attempt) => attempt.parsedEvents);
+        node.stopReason = result.stopReason;
+        node.thinkingObserved = result.thinkingObserved;
+        node.writeToolCallCount = result.writeToolCallCount;
         node.lastActivityAt = attemptFinishedAt;
         if (result.failureCategory === "termination-unconfirmed") {
             node.needsAttentionReason = "attempt-termination-unconfirmed";