@tea-agent/loop-agent 0.42.0-next.9 → 0.42.1

package/dist/executors/dag-pi-executor.js

@@ -1,3 +1,13 @@
+import { collectFrontendPlanMissingFacts, collectFrontendPlanPhaseMissingFacts, committedFactFromPlanRecord, planFactStringList, planFactScopeIntersects } from "../workflows/dag/frontend-plan-completeness.js";
+export { collectFrontendPlanMissingFacts, collectFrontendPlanPhaseMissingFacts } from "../workflows/dag/frontend-plan-completeness.js";
+import { classifyFrontendPlanRecovery } from "../workflows/dag/frontend-plan-recovery-policy.js";
+import { collectFrontendExecutionGroups, frontendExecutionSchema } from "../workflows/dag/frontend-execution-groups.js";
+import { FRONTEND_SCOPE_TARGET_BYTES, packFrontendInputUnits, parseFrontendInputBlock, projectFrontendContractPrompt, projectFrontendInputScope } from "../workflows/dag/frontend-input-projection.js";
+import { createDurableFrontendTools } from "../workflows/dag/frontend-durable-tools.js";
+import { sha256OfCanonicalJson } from "../task/contract/hash.js";
+import { z } from "zod";
+import { createFrontendReviewScopeProtocol, loadFrontendReviewScopes } from "../workflows/dag/frontend-review-scopes.js";
+import { observeFrontendSession } from "../workflows/dag/frontend-session-budget.js";
 import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { readFile, stat } from "node:fs/promises";
@@ -12,34 +22,236 @@ import { createPiReadBudgetCustomTools, } from "./pi-read-budget-policy.js";
 import { cleanupPlaywrightCliDefaultSession, createPlaywrightCliTool, PI_COMMAND_CAPABILITY_REGISTRY, resolveCaseIdFromWriteSet, resolveEvidenceDirFromWriteSet, } from "./pi-playwright-cli-tool.js";
 import { dagCommandPolicyAllows, resolveDagCommandPolicy, } from "../workflows/dag/types.js";
 import { parseLedgerJson } from "../task/source-prepare/ledger.js";
+import { splitDocumentIntoFragments, sha256Text, } from "../task/source-prepare/fragment-inventory.js";
 import { redactPromptForLog, truncateOutput, } from "../shared/output-truncation.js";
 import { GitStatusUnavailableError, pathsChangedDuringRun, readGitStatusPorcelain, recoverRootNulArtifact, snapshotGitStatusPathFingerprints, snapshotGitStatusPorcelain, validateShellWriteGuard, } from "./shell-write-guard.js";
 import { captureWorkspaceWriteSnapshot, diffWorkspaceWriteSnapshots, } from "./workspace-write-snapshot.js";
 import { pathMatchesPattern } from "../shared/git-progress.js";
-import { isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "../workflows/dag/retry-policy.js";
+import { readTypedEventStoreFromJsonl, typedEventPayloadSha256, } from "../workflows/dag/frontend-typed-event-store.js";
+import { collectCanonicalStateFlowNames, frontendEvidenceExpectationSchema, resolveFrontendContractRequirements, validateFrontendRequiredDeliverables, } from "../workflows/dag/frontend-contract-facts.js";
+import { isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "../workflows/dag/retry-policy.js";
 import { assessBackendTestMdPlanCompleteness, assessBackendTestMdWriterCompleteness, assessBackendTestPytestPlanCompleteness, assessBackendTestPytestWriterCompleteness, assessBackendTestShardChildCompleteness, backendTestWriterProgressRoleForTask, classifyBackendTestWriterCompletenessFailure, isBackendTestCompletenessRetryCandidate, isBackendTestMdPlanTask, isBackendTestPytestCollectionRepairOutcomeRecoveryCandidate, isBackendTestPytestPlanTask, isBackendTestShardChildTask, writeBackendTestWriterProgressArtifacts, } from "../workflows/dag/backend-test-writer-completeness.js";
 import { resolveBackendTestLayout } from "../workflows/dag/backend-test-layout.js";
+import { assessBackendTestPlanProtocol } from "../workflows/dag/backend-test-plan-protocol.js";
 import { frontendTestLayoutFromSpec } from "../workflows/dag/frontend-test-layout.js";
 import { redactSecrets, truncateUtf8Preview } from "../shared/preview.js";
 import { writeEffectiveContextReceipt } from "../workflows/dag/context-receipt.js";
 /**
- * Writer classification for a length-stopped thinking-only attempt: the model
- * exhausted its output budget thinking but never issued a write/edit tool call
- * and produced zero attributed diff. This is a terminal, non-retryable
- * diagnosis (the same prompt + model will hit the same budget wall); the
- * recommendation is a model switch plus a fresh run. It must NOT mask a
- * recoverable partial-write-set (incomplete-write-set) upgrade.
+ * Legacy diagnostic label retained for artifact compatibility. New executions
+ * classify this signal as output-limit so the node can retry incrementally.
  */
 export const WRITER_THINKING_EXHAUSTED_CATEGORY = "writer-thinking-exhausted";
 /**
- * Planner classification mirroring writer-thinking-exhausted: a read-only
- * planning session stopped on length, observed thinking, and committed zero
- * typed facts with no assistant text. By the time this survives the segmented
- * ladder the scope has already been degraded, so the durable fix is a
- * thinking-capped or non-thinking model for the tier — not another replay of
- * the same full-scope prompt.
+ * Legacy diagnostic label retained for artifact compatibility. New executions
+ * classify this signal as output-limit and preserve committed typed facts.
  */
 export const PLANNER_THINKING_EXHAUSTED_CATEGORY = "planner-thinking-exhausted";
+/**
+ * Parallel coverage shards namespace their verification target ids with
+ * `VT-SHARD-<shard>-` so the reducer can detect cross-shard conflicts. Once
+ * every shard's facts are known the namespace must be restored: the canonical
+ * contract has to carry the exact ids the task source froze (a surviving
+ * `VT-SHARD-N-…` id is a contract-requirement gap that design review
+ * rejects). Stripping happens per shard before adoption — after the strip,
+ * the existing identity-conflict check catches genuine cross-shard
+ * duplicate base ids and fails the merge closed.
+ */
+/**
+ * Deterministic pre-reduce for parallel coverage shard facts. Shards partition
+ * requirements, but a frozen verification target can legitimately be derived
+ * by several shards (one VT covers multiple ACs across shard boundaries), so
+ * same-id verification targets are MERGED: requirementIds and uiStates union,
+ * while divergent file/commandId is a real conflict. Everything else passes
+ * through unchanged.
+ */
+export function reduceParallelCoverageShardRecords(records) {
+    // Resolve replacements inside each source shard before comparing shards.
+    // A correction is an event-log operation, not a second independent target;
+    // retaining both records makes a valid same-shard correction look like a
+    // cross-shard conflict during the later reduction.
+    const byShard = new Map();
+    for (const record of records) {
+        const shard = byShard.get(record.attemptId) ?? [];
+        shard.push(record);
+        byShard.set(record.attemptId, shard);
+    }
+    const effectiveRecords = [];
+    for (const shardRecords of byShard.values()) {
+        const effective = [];
+        for (const record of shardRecords) {
+            const fact = record.fact;
+            const entry = fact?.entry;
+            const kind = typeof fact?.kind === "string" ? fact.kind : "";
+            const identity = (kind === "plan-requirement" || kind === "plan-verification-target") &&
+                typeof entry?.id === "string"
+                ? `${kind}:${entry.id}`
+                : undefined;
+            if (!identity) {
+                effective.push(record);
+                continue;
+            }
+            const replaces = typeof fact?.replaces === "string" ? `${kind}:${fact.replaces}` : undefined;
+            if (replaces) {
+                for (let index = effective.length - 1; index >= 0; index -= 1) {
+                    const prior = effective[index];
+                    const priorFact = prior.fact;
+                    const priorEntry = priorFact?.entry;
+                    const priorIdentity = typeof priorFact?.kind === "string" &&
+                        typeof priorEntry?.id === "string"
+                        ? `${priorFact.kind}:${priorEntry.id}`
+                        : undefined;
+                    if (priorIdentity === replaces)
+                        effective.splice(index, 1);
+                }
+            }
+            // Keep the source record immutable. The replacement is represented by
+            // the latest event and its own payload hash.
+            effective.push(record);
+        }
+        effectiveRecords.push(...effective);
+    }
+    const verificationTargets = new Map();
+    const merged = [];
+    for (const record of effectiveRecords) {
+        const fact = record.fact;
+        if (!fact || typeof fact !== "object")
+            continue;
+        if (fact.kind !== "plan-verification-target") {
+            merged.push(record);
+            continue;
+        }
+        const entry = fact.entry;
+        if (!entry || typeof entry.id !== "string")
+            continue;
+        const existing = verificationTargets.get(entry.id);
+        if (!existing) {
+            verificationTargets.set(entry.id, {
+                record, entry: { ...entry },
+                sources: [`${record.attemptId}:${record.eventId}:${record.payloadSha256}`],
+            });
+            continue;
+        }
+        // Never mutate the entry held by the source record. The reducer creates
+        // a new merged entry and recomputes the payload hash for that derived
+        // fact, leaving source-event replay integrity intact.
+        const baseEntry = { ...existing.entry };
+        for (const field of ["commandId", "commandLabel", "file", "scope"]) {
+            if (entry[field] !== baseEntry[field]) {
+                throw new Error(`frontend plan coverage shard reduce conflict: verification target ${entry.id} has divergent ${field} "${String(entry[field])}" vs "${String(baseEntry[field])}"`);
+            }
+        }
+        const unionSorted = (a, b) => {
+            const left = Array.isArray(a) ? a : [];
+            const right = Array.isArray(b) ? b : [];
+            return [...new Set([...left, ...right])].sort();
+        };
+        baseEntry.requirementIds = unionSorted(baseEntry.requirementIds, entry.requirementIds);
+        baseEntry.uiStates = unionSorted(baseEntry.uiStates, entry.uiStates);
+        const mergedFact = { ...fact, entry: { ...baseEntry } };
+        existing.entry = baseEntry;
+        existing.sources.push(`${record.attemptId}:${record.eventId}:${record.payloadSha256}`);
+        existing.record = {
+            ...existing.record,
+            fact: mergedFact,
+            payloadSha256: typedEventPayloadSha256(mergedFact),
+        };
+    }
+    merged.push(...[...verificationTargets.values()].map((item) => {
+        // The reducer owns every VT revision, including a one-shard partial
+        // result. Content-addressed revisions replay idempotently, while an
+        // expanded/replaced source set appends an explicit replacement rather
+        // than masquerading as a changed source event or deleting audit facts.
+        const fact = {
+            ...item.record.fact,
+            replaces: item.entry.id,
+            entry: {
+                ...item.entry,
+                requirementIds: [...new Set(planFactStringList(item.entry.requirementIds))].sort(),
+                uiStates: [...new Set(planFactStringList(item.entry.uiStates))].sort(),
+            },
+        };
+        const payloadSha256 = typedEventPayloadSha256(fact);
+        const revisionId = createHash("sha256")
+            .update(JSON.stringify({ sources: [...new Set(item.sources)].sort(), payloadSha256 }))
+            .digest("hex");
+        return {
+            ...item.record,
+            attemptId: "frontend-plan-coverage-reducer",
+            eventId: `coverage-reduced:${revisionId}`,
+            requestId: `coverage-reduced:${revisionId}`,
+            fact, payloadSha256,
+        };
+    }));
+    return merged;
+}
+export function normalizeParallelCoverageShardRecords(records, shardNumber) {
+    const prefix = `VT-SHARD-${shardNumber}-`;
+    // Models sometimes drop the `VT-` stem when applying the shard namespace
+    // (observed: frozen `VT-X` became `VT-SHARD-2-X`), so restoring the
+    // canonical id requires re-adding the stem after the strip.
+    const stripId = (id) => {
+        if (typeof id !== "string" || !id.startsWith(prefix))
+            return id;
+        const base = id.slice(prefix.length);
+        return base.startsWith("VT-") ? base : `VT-${base}`;
+    };
+    const stripIdList = (ids) => Array.isArray(ids) ? ids.map((id) => stripId(id)) : ids;
+    return records.map((record) => {
+        const fact = record.fact;
+        if (!fact || typeof fact !== "object")
+            return record;
+        const kind = fact.kind;
+        const entry = fact.entry;
+        if (!entry || typeof entry !== "object")
+            return record;
+        let rewritten;
+        const replaces = kind === "plan-verification-target" ? stripId(fact.replaces) : fact.replaces;
+        if (kind === "plan-verification-target") {
+            const id = stripId(entry.id);
+            if (id !== entry.id || replaces !== fact.replaces)
+                rewritten = { ...entry, id };
+        }
+        else if (kind === "plan-requirement") {
+            const verificationTargetIds = stripIdList(entry.verificationTargetIds);
+            if (verificationTargetIds !== entry.verificationTargetIds) {
+                rewritten = { ...entry, verificationTargetIds };
+            }
+        }
+        else if (kind === "state-flow") {
+            const rewriteBoundTargets = (item) => {
+                if (!item || typeof item !== "object")
+                    return item;
+                return {
+                    ...item,
+                    verificationTargetIds: stripIdList(item.verificationTargetIds),
+                };
+            };
+            const uiStates = Array.isArray(entry.uiStates)
+                ? entry.uiStates.map(rewriteBoundTargets)
+                : entry.uiStates;
+            const interactions = Array.isArray(entry.interactions)
+                ? entry.interactions.map(rewriteBoundTargets)
+                : entry.interactions;
+            if (uiStates !== entry.uiStates || interactions !== entry.interactions) {
+                rewritten = { ...entry, uiStates, interactions };
+            }
+        }
+        return rewritten
+            ? {
+                ...record,
+                fact: { ...fact, ...(replaces !== undefined ? { replaces } : {}), entry: rewritten },
+                // Keep the integrity hash consistent with the rewritten
+                // payload, or the adoption replay check reports the
+                // normalized record as a tampered source event.
+                payloadSha256: typedEventPayloadSha256({
+                    ...fact,
+                    ...(replaces !== undefined ? { replaces } : {}),
+                    entry: rewritten,
+                }),
+            }
+            : record;
+    });
+}
 export function isPlannerThinkingExhausted(result, committedAnyFacts) {
     if (result.ok)
         return false;
@@ -250,6 +462,9 @@ export const FRONTEND_CONTRACT_RECORD_TOOL_NAMES = [
     "record_handoff_intent",
     "record_open_question",
     "record_split_proposal",
+    "record_ui_state",
+    "record_required_deliverables",
+    "complete_contract_scope",
 ];
 export const FRONTEND_CONTRACT_TERMINAL_TOOL_NAMES = [
     "finalize_contract",
@@ -263,12 +478,15 @@ export const FRONTEND_SCOUT_EVIDENCE_TOOL_NAMES = [
 export const FRONTEND_PLAN_RECORD_TOOL_NAMES = [
     "record_route_selection",
     "record_component_choice",
+    "record_state_registry",
     "record_state_flow",
     "record_data_flow",
     "record_mock_api",
+    "record_mock_endpoint",
     "record_design_deviation",
     "record_dependency",
     "record_plan_requirement",
+    "record_plan_group_coverage",
     "record_plan_verification_target",
     "record_plan_evidence_gap",
 ];
@@ -343,6 +561,8 @@ export function resolveDagPiToolNames(task) {
     if (isFrontendReviewTypedTerminalNode(task)) {
         return [
             ...DAG_PI_READONLY_TOOLS,
+            "complete_review_scope",
+            "record_review_finding",
             "approve_review",
             "request_review_changes",
         ];
@@ -350,6 +570,8 @@ export function resolveDagPiToolNames(task) {
     if (isFrontendDesignTypedTerminalNode(task)) {
         return [
             ...DAG_PI_READONLY_TOOLS,
+            "complete_review_scope",
+            "record_design_finding",
             "approve_design",
             "request_design_changes",
         ];
@@ -375,6 +597,7 @@ export function resolveDagPiToolNames(task) {
             ...FRONTEND_PLAN_RECORD_TOOL_NAMES,
             ...FRONTEND_PLAN_TERMINAL_TOOL_NAMES,
             ...FRONTEND_PLAN_ADOPT_TOOL_NAMES,
+            "read_plan_facts",
         ];
     }
     if ((task.readSet?.length ?? 0) > 0) {
@@ -554,21 +777,35 @@ export async function createFrontendReviewTerminalTools(input) {
     ]);
     const { approveReviewFactSchema, readCommittedEvents, requestReviewChangesFactSchema, writeTypedEventStoreJsonl, } = await import("../workflows/dag/frontend-typed-event-store.js");
     const { adoptTypedEventFact, stageTypedEventFact } = await import("../workflows/dag/frontend-typed-event-transaction.js");
-    const store = input.store;
+    let store = input.store;
     const attemptId = input.attemptId;
     const findingSchema = Type.Object({
-        severity: Type.String({
-            description: "Critical | Important | Minor | Info",
-        }),
-        file: Type.Optional(Type.String({})),
-        line: Type.Optional(Type.Number({})),
-        issue: Type.String({}),
-        requiredChange: Type.Optional(Type.String({})),
+        severity: Type.Enum({ Critical: "Critical", Important: "Important", Minor: "Minor", Info: "Info" }),
+        file: Type.Optional(Type.String({ minLength: 1 })),
+        line: Type.Optional(Type.Integer({ minimum: 1 })),
+        issue: Type.String({ minLength: 1 }),
+        requiredChange: Type.Optional(Type.String({ minLength: 1 })),
     }, { additionalProperties: false });
+    const scopeProtocol = createFrontendReviewScopeProtocol({ phase: "review", inventory: input.inventory, getStore: () => store, attemptId });
+    const savedFindings = () => [...new Map(readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "review-finding").map(r => [r.fact.id, r.fact.finding])).values()];
+    const allFindings = (direct) => [...new Map([...savedFindings(), ...(Array.isArray(direct) ? direct : [])].map(finding => [JSON.stringify(finding), finding])).values()];
+    const recordFindingTool = defineTool({
+        name: "record_review_finding", label: "record_review_finding",
+        description: "Save one finding with a stable id. Submit findings incrementally, then finalize without repeating the findings array. Saved blocking findings cannot be omitted from approval; correct a finding explicitly with replace:true.",
+        parameters: Type.Object({ id: Type.String({ minLength: 1 }), finding: findingSchema }, { additionalProperties: false }),
+        async execute(_callId, params) {
+            const fact = { kind: "review-finding", id: params.id, finding: params.finding };
+            const requestId = `${attemptId}:finding:${randomUUID()}`;
+            const staged = stageTypedEventFact({ store, requestId, attemptId, fact });
+            const adopted = await adoptTypedEventFact({ store, requestId, attemptId, fact, eventId: staged.eventId, expectedRevision: store.revision });
+            const details = { ok: true, eventId: adopted.eventId, revision: adopted.revision };
+            return { content: [{ type: "text", text: JSON.stringify(details) }], details };
+        },
+    });
     const approveParameters = Type.Object({
-        findings: Type.Array(findingSchema, {
+        findings: Type.Optional(Type.Array(findingSchema, {
             description: "Optional informational findings (Minor/Info only; no Critical/Important on approval)",
-        }),
+        })),
     }, { additionalProperties: false });
     const requestParameters = Type.Object({
         issueCategory: Type.Enum({
@@ -578,16 +815,17 @@ export async function createFrontendReviewTerminalTools(input) {
             "contract-requirement-gap": "contract-requirement-gap",
             "unknown": "unknown",
         }, { description: "Typed issue category (five-value enum)" }),
-        evidenceRefs: Type.Array(Type.String({}), {
-            description: "Evidence refs (paths or artifact ids); at least one",
-        }),
-        findings: Type.Array(findingSchema, {
-            description: "At least one finding",
+        evidenceRefs: Type.Array(Type.String({ minLength: 1 }), {
+            description: "Evidence refs (paths or artifact ids); at least one", minItems: 1,
         }),
+        findings: Type.Optional(Type.Array(findingSchema, {
+            description: "At least one finding", minItems: 1,
+        })),
     }, { additionalProperties: false });
     async function adoptReviewFact(kind, fact) {
         const requestId = randomUUID();
         try {
+            scopeProtocol.assertComplete();
             const parsed = kind === "approve_review"
                 ? approveReviewFactSchema.parse(fact)
                 : requestReviewChangesFactSchema.parse(fact);
@@ -649,7 +887,7 @@ export async function createFrontendReviewTerminalTools(input) {
             return adoptReviewFact("approve_review", {
                 kind: "approve_review",
                 verdict: "approve_review",
-                findings: params?.findings ?? [],
+                findings: allFindings(params?.findings),
             });
         },
     });
@@ -665,17 +903,15 @@ export async function createFrontendReviewTerminalTools(input) {
                 verdict: "request_review_changes",
                 issueCategory: params?.issueCategory,
                 evidenceRefs: params?.evidenceRefs,
-                findings: params?.findings,
+                findings: allFindings(params?.findings),
             });
         },
     });
-    return {
-        customTools: [approveReviewTool, requestReviewChangesTool],
-        flush: async () => {
-            const committed = readCommittedEvents(store, attemptId);
-            await writeTypedEventStoreJsonl(path.join(input.runDir, input.nodeId, "review-typed-facts.jsonl"), committed);
-        },
-    };
+    const durable = await createDurableFrontendTools({
+        file: path.join(input.runDir, input.nodeId, "review-typed-facts.jsonl"), attemptId, store: input.store,
+        binding: { inputDigest: input.inputDigest, scopeDigest: input.inventory?.digest }, setWorkingStore: next => { store = next; }, tools: [...scopeProtocol.customTools, recordFindingTool, approveReviewTool, requestReviewChangesTool], validateRestored: async () => { await input.inventory?.validate(); },
+    });
+    return { ...durable, scopeProtocol };
 }
 /**
  * M8: build the two committed typed design terminal tools (approve_design /
@@ -692,21 +928,35 @@ export async function createFrontendDesignTerminalTools(input) {
     ]);
     const { approveDesignFactSchema, readCommittedEvents, requestDesignChangesFactSchema, writeTypedEventStoreJsonl, } = await import("../workflows/dag/frontend-typed-event-store.js");
     const { adoptTypedEventFact, stageTypedEventFact } = await import("../workflows/dag/frontend-typed-event-transaction.js");
-    const store = input.store;
+    let store = input.store;
     const attemptId = input.attemptId;
     const findingSchema = Type.Object({
-        severity: Type.String({
-            description: "Critical | Important | Minor | Info",
-        }),
-        file: Type.Optional(Type.String({})),
-        line: Type.Optional(Type.Number({})),
-        issue: Type.String({}),
-        requiredChange: Type.Optional(Type.String({})),
+        severity: Type.Enum({ Critical: "Critical", Important: "Important", Minor: "Minor", Info: "Info" }),
+        file: Type.Optional(Type.String({ minLength: 1 })),
+        line: Type.Optional(Type.Integer({ minimum: 1 })),
+        issue: Type.String({ minLength: 1 }),
+        requiredChange: Type.Optional(Type.String({ minLength: 1 })),
     }, { additionalProperties: false });
+    const scopeProtocol = createFrontendReviewScopeProtocol({ phase: "design", inventory: input.inventory, getStore: () => store, attemptId });
+    const savedFindings = () => [...new Map(readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "design-finding").map(r => [r.fact.id, r.fact.finding])).values()];
+    const allFindings = (direct) => [...new Map([...savedFindings(), ...(Array.isArray(direct) ? direct : [])].map(finding => [JSON.stringify(finding), finding])).values()];
+    const recordFindingTool = defineTool({
+        name: "record_design_finding", label: "record_design_finding",
+        description: "Save one finding with a stable id. Submit findings incrementally, then finalize without repeating the findings array. Saved blocking findings cannot be omitted from approval; correct a finding explicitly with replace:true.",
+        parameters: Type.Object({ id: Type.String({ minLength: 1 }), finding: findingSchema }, { additionalProperties: false }),
+        async execute(_callId, params) {
+            const fact = { kind: "design-finding", id: params.id, finding: params.finding };
+            const requestId = `${attemptId}:finding:${randomUUID()}`;
+            const staged = stageTypedEventFact({ store, requestId, attemptId, fact });
+            const adopted = await adoptTypedEventFact({ store, requestId, attemptId, fact, eventId: staged.eventId, expectedRevision: store.revision });
+            const details = { ok: true, eventId: adopted.eventId, revision: adopted.revision };
+            return { content: [{ type: "text", text: JSON.stringify(details) }], details };
+        },
+    });
     const approveParameters = Type.Object({
-        findings: Type.Array(findingSchema, {
+        findings: Type.Optional(Type.Array(findingSchema, {
             description: "Optional informational findings (Minor/Info only; no Critical/Important on approval)",
-        }),
+        })),
     }, { additionalProperties: false });
     const requestParameters = Type.Object({
         issueCategory: Type.Enum({
@@ -716,16 +966,17 @@ export async function createFrontendDesignTerminalTools(input) {
             "contract-requirement-gap": "contract-requirement-gap",
             "unknown": "unknown",
         }, { description: "Typed issue category (five-value enum)" }),
-        evidenceRefs: Type.Array(Type.String({}), {
-            description: "Evidence refs (paths or artifact ids); at least one",
-        }),
-        findings: Type.Array(findingSchema, {
-            description: "At least one finding",
+        evidenceRefs: Type.Array(Type.String({ minLength: 1 }), {
+            description: "Evidence refs (paths or artifact ids); at least one", minItems: 1,
         }),
+        findings: Type.Optional(Type.Array(findingSchema, {
+            description: "At least one finding", minItems: 1,
+        })),
     }, { additionalProperties: false });
     async function adoptDesignFact(kind, fact) {
         const requestId = randomUUID();
         try {
+            scopeProtocol.assertComplete();
             const parsed = kind === "approve_design"
                 ? approveDesignFactSchema.parse(fact)
                 : requestDesignChangesFactSchema.parse(fact);
@@ -787,7 +1038,7 @@ export async function createFrontendDesignTerminalTools(input) {
             return adoptDesignFact("approve_design", {
                 kind: "approve_design",
                 verdict: "approve_design",
-                findings: params?.findings ?? [],
+                findings: allFindings(params?.findings),
             });
         },
     });
@@ -803,17 +1054,15 @@ export async function createFrontendDesignTerminalTools(input) {
                 verdict: "request_design_changes",
                 issueCategory: params?.issueCategory,
                 evidenceRefs: params?.evidenceRefs,
-                findings: params?.findings,
+                findings: allFindings(params?.findings),
             });
         },
     });
-    return {
-        customTools: [approveDesignTool, requestDesignChangesTool],
-        flush: async () => {
-            const committed = readCommittedEvents(store, attemptId);
-            await writeTypedEventStoreJsonl(path.join(input.runDir, input.nodeId, "design-typed-facts.jsonl"), committed);
-        },
-    };
+    const durable = await createDurableFrontendTools({
+        file: path.join(input.runDir, input.nodeId, "design-typed-facts.jsonl"), attemptId, store: input.store,
+        binding: { inputDigest: input.inputDigest, scopeDigest: input.inventory?.digest }, setWorkingStore: next => { store = next; }, tools: [...scopeProtocol.customTools, recordFindingTool, approveDesignTool, requestDesignChangesTool], validateRestored: async () => { await input.inventory?.validate(); },
+    });
+    return { ...durable, scopeProtocol };
 }
 /**
  * Source fidelity ledger (AC-005/AC-006): load the contract node's committed
@@ -858,6 +1107,8 @@ async function loadContractRequirementInheritance(runDir) {
             : undefined;
         if (sourceFragmentIds || sourceRefs) {
             byId.set(id, {
+                ...(typeof recordFact.text === "string" ? { text: recordFact.text } : {}),
+                ...(recordFact.execution !== undefined ? { execution: frontendExecutionSchema.parse(recordFact.execution) } : {}),
                 ...(sourceFragmentIds ? { sourceFragmentIds } : {}),
                 ...(sourceRefs ? { sourceRefs } : {}),
             });
@@ -906,8 +1157,111 @@ async function resolveFrontendPlanNewComponentSourceReferences(input) {
     }
 }
 /**
- * A+B: `frontend-plan-pi` now records its decision ledger through seven
- * incremental `record_*` tools (origin=plan) and closes with exactly one
+ * Frozen canonical requirements keyed by id, resolved from the source-fidelity
+ * ledger before the contract node starts. record_requirement commits these
+ * runtime-owned values so the model can never rewrite authoritative requirement
+ * text or stringify the fragment bindings.
+ */
+async function resolveFrontendCanonicalRequirements(input) {
+    const binding = input.sourceBinding;
+    if (!binding || binding.schemaVersion !== 2 || !binding.ledgerPath) {
+        return new Map();
+    }
+    const absolutePath = path.resolve(input.cwd, binding.ledgerPath);
+    const workspaceRoot = path.resolve(input.cwd);
+    if (absolutePath !== workspaceRoot &&
+        !absolutePath.startsWith(`${workspaceRoot}${path.sep}`)) {
+        throw new Error("canonical requirement ledger escapes workspace");
+    }
+    try {
+        const raw = await readFile(absolutePath, "utf8");
+        if (sha256Text(raw) !== binding.ledgerSha256) {
+            throw new Error("source ledger is stale");
+        }
+        const ledger = parseLedgerJson(raw);
+        const sourceFragments = new Map();
+        const boundFragments = new Map(ledger.fragments.map((fragment) => [fragment.id, fragment]));
+        for (const sourcePath of new Set(ledger.fragments.map((fragment) => fragment.path))) {
+            const sourceAbsolute = path.resolve(workspaceRoot, sourcePath);
+            if (!sourceAbsolute.startsWith(`${workspaceRoot}${path.sep}`)) {
+                throw new Error("source fragment escapes workspace");
+            }
+            const content = await readFile(sourceAbsolute, "utf8");
+            for (const fragment of splitDocumentIntoFragments({ path: sourcePath, content })) {
+                const frozen = boundFragments.get(fragment.id);
+                if (frozen && frozen.sha256 === sha256Text(fragment.text)) {
+                    sourceFragments.set(fragment.id, fragment.text);
+                }
+            }
+        }
+        return new Map(ledger.canonicalRequirements.map((requirement) => [
+            requirement.id,
+            {
+                text: requirement.text,
+                sourceFragmentIds: [...(requirement.sourceFragmentIds ?? [])],
+                sourceFragments,
+            },
+        ]));
+    }
+    catch (error) {
+        throw new Error(`canonical requirement sources unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+/**
+ * Authoritative UI state ids declared by the contract node
+ * (ui-state-declaration facts). Empty when the source declares no UI-state
+ * table, in which case the plan's state vocabulary is registry-only.
+ */
+async function resolveFrontendDeclaredUiStateIds(input) {
+    try {
+        const records = await readTypedEventStoreFromJsonl(path.join(input.runDir, "frontend-contract-pi", "contract-typed-facts.jsonl"));
+        return records.flatMap((record) => {
+            const fact = record.fact;
+            return record.phase === "committed" &&
+                fact.kind === "ui-state-declaration" &&
+                typeof fact.id === "string"
+                ? [fact.id]
+                : [];
+        });
+    }
+    catch {
+        // No contract facts (or no declared states): registry-only vocabulary.
+        return [];
+    }
+}
+/**
+ * Resolve the frozen canonical behavior verification-target ids the PRD
+ * declares. The requirement text is the same authority the design review reads
+ * when it rejects `VT-SHARD-N-…` / variant ids as a contract-requirement gap,
+ * so extracting `VT-…` tokens from the frozen contract requirement facts makes
+ * that authority deterministic instead of prose-only. An empty result (no PRD
+ * declared any behavior target id) disables the canonical check and keeps the
+ * historical free-form path.
+ */
+export async function resolveFrontendCanonicalVerificationTargetIds(input) {
+    try {
+        const records = await readTypedEventStoreFromJsonl(path.join(input.runDir, "frontend-contract-pi", "contract-typed-facts.jsonl"));
+        const ids = new Set();
+        for (const record of records) {
+            const fact = record.fact;
+            if (record.phase !== "committed" || fact.kind !== "requirement") {
+                continue;
+            }
+            const text = typeof fact.text === "string" ? fact.text : "";
+            for (const match of text.matchAll(/\bVT-[A-Z0-9][A-Z0-9_-]*\b/g)) {
+                ids.add(match[0]);
+            }
+        }
+        return [...ids].sort();
+    }
+    catch {
+        // No contract facts (or unreadable): fall back to no canonical set.
+        return [];
+    }
+}
+/**
+ * A+B: `frontend-plan-pi` records its decision ledger through incremental
+ * `record_*` tools (origin=plan) and closes with exactly one
  * `finalize_plan` terminal. A later attempt may explicitly adopt a quarantined
  * fact via `adopt_staged_fact`. Flush writes `plan-typed-facts.jsonl` for the
  * node validator / compile authority.
@@ -920,26 +1274,12 @@ export async function createFrontendPlanLedgerTools(input) {
     const { loadTypedEventStore, readCommittedEvents, writeTypedEventStoreJsonl, } = await import("../workflows/dag/frontend-typed-event-store.js");
     const { adoptStagedFact, adoptTypedEventFact, stageTypedEventFact } = await import("../workflows/dag/frontend-typed-event-transaction.js");
     const { assemblePlanPatchFromCommittedFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
-    const store = input.store;
+    let store = input.store;
     const attemptId = input.attemptId;
     let activeRequirementScope = [];
     const scopedRequirementIds = () => [...activeRequirementScope];
-    // A retry creates a fresh executor-local store, but the plan ledger is the
-    // cross-attempt authority. Restore the committed prefix before registering
-    // tools; otherwise the first flush of a retry can overwrite facts that the
-    // previous attempt had already committed. The on-disk file contains only
-    // committed records, so loading it is also fail-closed with respect to
-    // staged/quarantined facts.
-    const persisted = await loadTypedEventStore(path.join(input.runDir, input.nodeId, "plan-typed-facts.jsonl"));
-    if (persisted.records.length > 0) {
-        const existingEventIds = new Set(store.records.map((record) => record.eventId));
-        for (const record of persisted.records) {
-            if (!existingEventIds.has(record.eventId)) {
-                store.records.push(record);
-            }
-        }
-        store.revision = Math.max(store.revision, persisted.revision);
-    }
+    const contractInheritance = await loadContractRequirementInheritance(input.runDir);
+    const executionGroups = collectFrontendExecutionGroups([...contractInheritance].map(([id, r]) => ({ id, ...r })));
     const stringArray = Type.Array(Type.String({}));
     const optionalString = Type.Optional(Type.String({}));
     const optionalStringArray = Type.Optional(stringArray);
@@ -974,9 +1314,7 @@ export async function createFrontendPlanLedgerTools(input) {
         verificationTargetIds: stringArray,
     }, { additionalProperties: false });
     const mockEndpointSchema = Type.Object({
-        method: Type.String({
-            description: "GET | POST | PUT | PATCH | DELETE | HEAD | OPTIONS",
-        }),
+        method: Type.Enum({ GET: "GET", POST: "POST", PUT: "PUT", PATCH: "PATCH", DELETE: "DELETE", HEAD: "HEAD", OPTIONS: "OPTIONS" }),
         path: Type.String({}),
         fixture: optionalString,
         consumer: optionalString,
@@ -998,23 +1336,24 @@ export async function createFrontendPlanLedgerTools(input) {
         paths: stringArray,
         conflicts: stringArray,
     }, { additionalProperties: false });
-    // Enum fields use literal unions, not advisory strings: a soft Type.String
-    // lets the model commit values like type="behavior" that pass the tool
-    // boundary, flush into the ledger, and only fail the compile-time zod enum
-    // — a deterministic attempt failure the model could have fixed in-node.
-    const verificationTargetTypeSchema = Type.Union([
-        Type.Literal("static"),
+    // Verification mode is runtime-owned (contract v2): the plan submits a
+    // commandId referencing the frozen command directory, never a type. A
+    // soft Type.String would let the model commit values that only fail at
+    // compile time — keep the reference a required string and validate it
+    // against the directory at the tool boundary below.
+    const verificationTargetScopeSchema = Type.Union([
         Type.Literal("unit"),
         Type.Literal("component"),
         Type.Literal("integration"),
-        Type.Literal("mock"),
     ]);
     const verificationTargetSchema = Type.Object({
         id: Type.String({}),
-        type: verificationTargetTypeSchema,
-        commandLabel: Type.String({}),
+        commandId: Type.String({
+            description: "Frozen command directory key (e.g. verify-npm-run-build); the runtime resolves mode and label from it.",
+        }),
         file: Type.String({}),
         requirementIds: stringArray,
+        scope: Type.Optional(verificationTargetScopeSchema),
         uiStates: Type.Optional(Type.Array(Type.String({}), {
             description: "Optional only at this tool boundary. An omitted value is deterministically recorded as []. Pass an explicit array for new calls.",
         })),
@@ -1037,9 +1376,15 @@ export async function createFrontendPlanLedgerTools(input) {
         specReference: Type.Optional(Type.Object({
             path: Type.String({}),
             section: Type.String({}),
-            line: Type.Optional(Type.Number({})),
+            line: Type.Optional(Type.Integer({ minimum: 1 })),
         }, { additionalProperties: false })),
-        rationale: Type.String({}),
+        rationale: Type.Optional(Type.String({ minLength: 1 })),
+        covers: Type.Optional(Type.Array(Type.String({}), {
+            description: "UI state and/or interaction names this single component choice covers (one choice may cover many ids).",
+        })),
+        evidencePath: Type.Optional(Type.String({
+            description: "REQUIRED for decision=reuse-existing: repo-relative path whose existing file is the reuse evidence. Greenfield paths must use decision=new.",
+        })),
     }, { additionalProperties: false });
     const stringList = (value) => Array.isArray(value)
         ? value.filter((item) => typeof item === "string")
@@ -1118,7 +1463,7 @@ export async function createFrontendPlanLedgerTools(input) {
     const recordComponentChoiceTool = defineTool({
         name: "record_component_choice",
         label: "record_component_choice",
-        description: "Record ONE component choice (origin=plan component-choice fact). Declare every UI purpose's component selection. For decision=new, pass sourceRequirementIds containing the frozen requirement ID(s) that mandate the component and sourceFragmentId selecting one frozen citation listed in the plan checklist; the runtime validates the relation and derives the exact PRD specReference. Do not read the PRD or invent a path/line. decision=reuse-existing is only for components that already exist in the repo (e.g. reusing ActiveRunBadge's styling convention). Omit rationale for reuse-existing; it is optional. Call up to 5 component choices per assistant message (batching reduces API round trips and rate-limit risk); never more than 5 per message. Optionally include stylingStrategy (set it once, on the first call). Example: {\"choice\": {\"purpose\": \"<interaction or UI state name>\", \"component\": \"<component name>\", \"decision\": \"new\"}, \"sourceRequirementIds\": [\"<AC-XXX mandating this component>\"], \"sourceFragmentId\": \"<REQ-SRC-...>\"}",
+        description: "Record ONE component choice (origin=plan component-choice fact). One choice may cover MULTIPLE UI states/interactions via covers: [\"<state-or-interaction name>\", ...]; do not emit one row per interaction. For decision=new, pass sourceRequirementIds containing the frozen requirement ID(s) that mandate the component and sourceFragmentId selecting one frozen citation listed in the plan checklist; the runtime validates the relation and derives the exact PRD specReference. Do not read the PRD or invent a path/line. decision=reuse-existing is only for components that already exist in the repo and REQUIRES evidencePath: a repo-relative path to the existing file that proves the reuse — the runtime verifies the file exists (fresh evidence); a path with no existing file is greenfield and must use decision=new instead. Call up to 5 component choices per assistant message; never more than 5 per message. Optionally include stylingStrategy (set it once, on the first call). Example: {\"choice\": {\"purpose\": \"<interaction or UI state name>\", \"component\": \"<component name>\", \"decision\": \"new\", \"covers\": [\"<other interaction names this component also serves>\"]}, \"sourceRequirementIds\": [\"<AC-XXX mandating this component>\"], \"sourceFragmentId\": \"<REQ-SRC-...>\"} or {\"choice\": {\"purpose\": \"FocusQueuePanel\", \"component\": \"FocusQueuePanel\", \"decision\": \"reuse-existing\", \"evidencePath\": \"src/journal.ts\"}}",
         promptSnippet: "Record 1-5 component choices (up to 5 per message).",
         parameters: Type.Object({
             choice: uiComponentChoiceSchema,
@@ -1169,6 +1514,46 @@ export async function createFrontendPlanLedgerTools(input) {
                     ...(citation.line !== undefined ? { line: citation.line } : {}),
                 };
             }
+            if (choice.decision === "reuse-existing") {
+                // reuse-existing must cite a file that actually exists NOW (fresh
+                // existence evidence, same semantics as Scout pathEvidence.fresh).
+                // A path with no file on disk is greenfield: decision=new is the
+                // only honest choice (dogfood run dag-1788504923861-0f7b17a9
+                // claimed 18 reuse-existing conventions in a not-yet-written
+                // src/planner.ts and every gate let it through).
+                const evidencePath = typeof choice.evidencePath === "string"
+                    ? choice.evidencePath.trim()
+                    : "";
+                if (!evidencePath) {
+                    return planToolReceipt({
+                        ok: false,
+                        kind: "component-choice",
+                        error: "decision=reuse-existing requires evidencePath naming the existing repo file that proves the reuse; if the file does not exist yet, use decision=new",
+                    });
+                }
+                if (input.workspaceRoot) {
+                    const absolute = path.resolve(input.workspaceRoot, evidencePath);
+                    const workspaceRoot = path.resolve(input.workspaceRoot);
+                    const contained = absolute === workspaceRoot ||
+                        absolute.startsWith(`${workspaceRoot}${path.sep}`);
+                    let exists = false;
+                    if (contained) {
+                        try {
+                            exists = (await stat(absolute)).isFile();
+                        }
+                        catch {
+                            exists = false;
+                        }
+                    }
+                    if (!exists) {
+                        return planToolReceipt({
+                            ok: false,
+                            kind: "component-choice",
+                            error: `decision=reuse-existing evidencePath "${evidencePath}" has no fresh existence evidence (file not found in the workspace); reuse requires an existing file — use decision=new for greenfield paths`,
+                        });
+                    }
+                }
+            }
             const components = typeof choice.component === "string" ? [choice.component] : [];
             const result = await adoptPlanFact("component-choice", `${attemptId}:record_component_choice:${randomUUID()}`, {
                 kind: "component-choice",
@@ -1192,10 +1577,86 @@ export async function createFrontendPlanLedgerTools(input) {
             return planToolReceipt(echo);
         },
     });
+    // Global UX vocabulary: one compact registry committed BEFORE any state
+    // flow details. Coverage may slice by AC; UX must not — the registry is
+    // the anti-duplication anchor that keeps every later slice on the same
+    // named concepts instead of re-inventing them per AC chunk.
+    const recordStateRegistryTool = defineTool({
+        name: "record_state_registry",
+        label: "record_state_registry",
+        description: "Commit the GLOBAL UX vocabulary (origin=plan state-registry fact) BEFORE any record_state_flow call: uiStateNames (use the contract's declared authoritative state ids when provided) and interactionNames (stable behavior-domain kebab-case names, e.g. planner-task-edit / focus-queue-move — one name per behavior domain, never one per AC). Empty arrays explicitly mean the request has no UI state or interaction vocabulary. Re-record the full vocabulary to correct it; the latest commit wins, but it may not remove names still referenced by committed state-flow facts. Example: {\"uiStateNames\": [\"planner-empty\"], \"interactionNames\": [\"planner-task-create\", \"focus-queue-move\"]}",
+        promptSnippet: "Record the global UI-state/interaction vocabulary once, before any state flow.",
+        parameters: Type.Object({
+            uiStateNames: stringArray,
+            interactionNames: stringArray,
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const uiStateNames = [...new Set(stringList(params?.uiStateNames).map((name) => name.trim()))];
+            const interactionNames = [
+                ...new Set(stringList(params?.interactionNames).map((name) => name.trim())),
+            ];
+            if (uiStateNames.some((name) => name.length === 0) || interactionNames.some((name) => name.length === 0)) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "state-registry",
+                    error: "record_state_registry names must be non-empty strings",
+                });
+            }
+            const invalidInteractionNames = interactionNames.filter((name) => !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name));
+            if (invalidInteractionNames.length > 0) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "state-registry",
+                    error: `record_state_registry interactionNames must be stable kebab-case behavior-domain names: ${invalidInteractionNames.join(", ")}`,
+                });
+            }
+            if (input.declaredUiStateIds &&
+                input.declaredUiStateIds.length > 0) {
+                const declared = new Set(input.declaredUiStateIds);
+                const undeclared = uiStateNames.filter((name) => !declared.has(name));
+                if (undeclared.length > 0) {
+                    return planToolReceipt({
+                        ok: false,
+                        kind: "state-registry",
+                        error: `record_state_registry uiStateNames are not declared by the contract's authoritative UI-state table: ${undeclared.join(", ")}; use the declared ids (${input.declaredUiStateIds.join(", ")})`,
+                    });
+                }
+                const missing = input.declaredUiStateIds.filter((name) => !uiStateNames.includes(name));
+                if (missing.length > 0) {
+                    return planToolReceipt({
+                        ok: false,
+                        kind: "state-registry",
+                        error: `record_state_registry must include every state from the contract's authoritative UI-state table; missing: ${missing.join(", ")}`,
+                    });
+                }
+            }
+            // A correction is deterministic only when the new last-wins registry
+            // still contains every live name already committed by state-flow facts.
+            // This permits adding a missed concept, while preventing a registry edit
+            // from retroactively orphaning earlier slices.
+            const liveNames = collectCanonicalStateFlowNames(readCommittedEvents(store, attemptId));
+            const orphanedUiStates = [...liveNames.uiStateNames].filter((name) => !uiStateNames.includes(name));
+            const orphanedInteractions = [...liveNames.interactionNames].filter((name) => !interactionNames.includes(name));
+            if (orphanedUiStates.length > 0 || orphanedInteractions.length > 0) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "state-registry",
+                    error: `record_state_registry cannot remove names still referenced by committed state-flow facts (uiStates: ${orphanedUiStates.join(", ") || "none"}; interactions: ${orphanedInteractions.join(", ") || "none"}); first correct/remove those state-flow entries, then re-record the full registry`,
+                });
+            }
+            const result = await adoptPlanFact("state-registry", `${attemptId}:record_state_registry:${randomUUID()}`, {
+                kind: "state-registry",
+                origin: "plan",
+                uiStateNames,
+                interactionNames,
+            });
+            return planToolReceipt(result);
+        },
+    });
     const recordStateFlowTool = defineTool({
         name: "record_state_flow",
         label: "record_state_flow",
-        description: "Record UI states and interactions as an origin=plan state-flow fact. To correct stale named entries from an earlier UX batch, include removeUiStateNames and/or removeInteractionNames. Example: {\"uiStates\": [{\"name\": \"<state>\", \"applicable\": true, \"expectedBehavior\": \"<behavior>\", \"implementationTargets\": [\"<file>\"], \"verificationTargetIds\": [\"<VT-XXX>\"]}], \"interactions\": [{\"name\": \"<interaction>\", \"trigger\": \"<user event>\", \"expectedBehavior\": \"<behavior>\", \"implementationTargets\": [\"<file>\"], \"verificationTargetIds\": [\"<VT-XXX>\"]}]}",
+        description: "Record UI states and interactions as an origin=plan state-flow fact. REQUIRES a committed record_state_registry vocabulary first, and every name here must be in that registry; uiState names must also be contract-declared authoritative ids when the contract declares them. To correct stale named entries from an earlier UX batch, include removeUiStateNames and/or removeInteractionNames. Example: {\"uiStates\": [{\"name\": \"<state>\", \"applicable\": true, \"expectedBehavior\": \"<behavior>\", \"implementationTargets\": [\"<file>\"], \"verificationTargetIds\": [\"<VT-XXX>\"]}], \"interactions\": [{\"name\": \"<interaction>\", \"trigger\": \"<user event>\", \"expectedBehavior\": \"<behavior>\", \"implementationTargets\": [\"<file>\"], \"verificationTargetIds\": [\"<VT-XXX>\"]}]}",
         promptSnippet: "Record the plan state-flow fact.",
         parameters: Type.Object({
             uiStates: Type.Array(uiStateSchema),
@@ -1299,9 +1760,101 @@ export async function createFrontendPlanLedgerTools(input) {
                 }
                 interactions.push({ ...interaction, name: resolvedName });
             }
+            // UX vocabulary gate: every recorded state/interaction name must be
+            // declared in the committed global registry first. This keeps UX out
+            // of AC-number slicing — the model commits one compact vocabulary
+            // (record_state_registry), then fills behavior-domain details, and a
+            // later slice cannot silently rename an earlier concept (dogfood
+            // dag-1788504923861-0f7b17a9: 5 renames of "prioritize" + 7 of
+            // "focus queue" across AC chunks).
             const states = uiStates
                 .map((state) => (typeof state?.name === "string" ? state.name : ""))
                 .filter(Boolean);
+            const committedRegistry = readCommittedEvents(store, attemptId)
+                .map((event) => event.fact)
+                .filter((fact) => isRecordObject(fact) && fact.kind === "state-registry")
+                .at(-1);
+            if (!committedRegistry) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "state-flow",
+                    error: "record_state_flow requires a committed UX registry first: call record_state_registry with the full uiStateNames/interactionNames vocabulary, then record state flows against it",
+                });
+            }
+            const registryUiStateNames = new Set(stringList(committedRegistry.uiStateNames));
+            const registryInteractionNames = new Set(stringList(committedRegistry.interactionNames));
+            const unknownStates = states.filter((name) => !registryUiStateNames.has(name));
+            if (unknownStates.length > 0) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "state-flow",
+                    error: `record_state_flow uiState names not in the committed registry: ${unknownStates.join(", ")}; re-record record_state_registry with the complete vocabulary first (registered: ${[...registryUiStateNames].join(", ") || "(none)"})`,
+                });
+            }
+            const unknownInteractions = interactions
+                .map((interaction) => typeof interaction?.name === "string" ? interaction.name : "")
+                .filter((name) => name && !registryInteractionNames.has(name));
+            if (unknownInteractions.length > 0) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "state-flow",
+                    error: `record_state_flow interaction names not in the committed registry: ${unknownInteractions.join(", ")}; re-record record_state_registry with the complete vocabulary first (registered: ${[...registryInteractionNames].join(", ") || "(none)"})`,
+                });
+            }
+            // Authoritative UI states: when the contract node declared the
+            // source's UI-state table, planner states must bind those ids — no
+            // invented variants (planner-empty/create-invalid/no-results/
+            // editing/focus-full/storage-unavailable, not "planner-list").
+            if (input.declaredUiStateIds &&
+                input.declaredUiStateIds.length > 0) {
+                const declared = new Set(input.declaredUiStateIds);
+                const undeclaredStates = states.filter((name) => !declared.has(name));
+                if (undeclaredStates.length > 0) {
+                    return planToolReceipt({
+                        ok: false,
+                        kind: "state-flow",
+                        error: `record_state_flow uiState names are not declared by the contract's authoritative UI-state table: ${undeclaredStates.join(", ")}; use the declared ids (${input.declaredUiStateIds.join(", ")}), or record a design deviation if the source table is genuinely incomplete`,
+                    });
+                }
+            }
+            // Named entries are last-wins at assembly. A scoped correction may
+            // replace its own bindings, but must retain other scopes' coverage.
+            const scope = new Set(scopedRequirementIds());
+            const committed = readCommittedEvents(store, attemptId).map(event => event.fact);
+            const targetOwners = new Map();
+            for (const fact of committed) {
+                if (fact.kind === "plan-verification-target" && isRecordObject(fact.entry) && typeof fact.entry.id === "string") {
+                    targetOwners.set(fact.entry.id, stringList(fact.entry.requirementIds));
+                }
+            }
+            for (const [field, removals] of [["uiStates", removeUiStateNames], ["interactions", removeInteractionNames]]) {
+                const live = new Map();
+                for (const fact of committed) {
+                    if (fact.kind !== "state-flow")
+                        continue;
+                    for (const name of stringList(fact[field === "uiStates" ? "removeUiStateNames" : "removeInteractionNames"]))
+                        live.delete(name);
+                    for (const entry of Array.isArray(fact[field]) ? fact[field] : []) {
+                        if (isRecordObject(entry) && typeof entry.name === "string")
+                            live.set(entry.name, entry);
+                    }
+                }
+                const foreignBindings = (entry) => scope.size === 0 ? [] : stringList(entry.verificationTargetIds).filter(id => {
+                    const owners = targetOwners.get(id);
+                    return !owners?.length || owners.some(owner => !scope.has(owner));
+                });
+                for (const name of removals) {
+                    const previous = live.get(name);
+                    if (previous && foreignBindings(previous).length)
+                        return planToolReceipt({ ok: false, kind: "state-flow",
+                            error: `Cannot remove shared ${name} from this requirement scope; retain it and update its scoped bindings instead` });
+                }
+                for (const entry of field === "uiStates" ? uiStates : interactions) {
+                    const previous = live.get(String(entry.name));
+                    if (previous)
+                        entry.verificationTargetIds = [...new Set([...foreignBindings(previous), ...stringList(entry.verificationTargetIds)])];
+                }
+            }
             const result = await adoptPlanFact("state-flow", `${attemptId}:record_state_flow:${randomUUID()}`, {
                 kind: "state-flow",
                 origin: "plan",
@@ -1320,13 +1873,14 @@ export async function createFrontendPlanLedgerTools(input) {
         label: "record_data_flow",
         description: "Record interaction/endpoint data flow as an origin=plan data-flow fact. Example: {\"interactions\": [\"<interaction name>\"], \"endpoints\": [\"GET <path>\"]}",
         promptSnippet: "Record the plan data-flow fact.",
-        parameters: Type.Object({ interactions: stringArray, endpoints: stringArray }, { additionalProperties: false }),
+        parameters: Type.Object({ interactions: stringArray, endpoints: stringArray, replace: Type.Optional(Type.Boolean()) }, { additionalProperties: false }),
         async execute(_toolCallId, params) {
+            const previous = params.replace ? undefined : readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "data-flow").at(-1)?.fact;
             const result = await adoptPlanFact("data-flow", `${attemptId}:record_data_flow:${randomUUID()}`, {
                 kind: "data-flow",
                 origin: "plan",
-                interactions: stringList(params?.interactions),
-                endpoints: stringList(params?.endpoints),
+                interactions: [...new Set([...stringList(previous?.interactions), ...stringList(params?.interactions)])],
+                endpoints: [...new Set([...stringList(previous?.endpoints), ...stringList(params?.endpoints)])],
             });
             return planToolReceipt(result);
         },
@@ -1354,6 +1908,16 @@ export async function createFrontendPlanLedgerTools(input) {
             return planToolReceipt(result);
         },
     });
+    const recordMockEndpointTool = defineTool({
+        name: "record_mock_endpoint", label: "record_mock_endpoint",
+        description: "Record one Mock/API endpoint. First record_mock_api with the policy and endpoints: []; then submit each endpoint separately. Never regenerate the whole endpoint collection. Use replace:true to revise an existing method/path, or replace:true plus remove:true to withdraw it.",
+        parameters: Type.Object({ endpoint: mockEndpointSchema, remove: Type.Optional(Type.Boolean()) }, { additionalProperties: false }),
+        async execute(_callId, params) {
+            if (!readCommittedEvents(store, attemptId).some(r => r.fact.kind === "mock-api"))
+                return planToolReceipt({ ok: false, kind: "mock-endpoint", code: "MOCK_POLICY_MISSING", error: "Record the mock policy before its endpoints" });
+            return planToolReceipt(await adoptPlanFact("mock-endpoint", `${attemptId}:endpoint:${randomUUID()}`, { kind: "mock-endpoint", origin: "plan", endpoint: params.endpoint, ...(params.remove ? { removed: true } : {}) }));
+        },
+    });
     const recordDesignDeviationTool = defineTool({
         name: "record_design_deviation",
         label: "record_design_deviation",
@@ -1429,6 +1993,8 @@ export async function createFrontendPlanLedgerTools(input) {
             // canonical-coverage gate rejects with no in-node cure. Reject here
             // and name the allowed ids.
             const id = typeof entry.id === "string" ? entry.id : "";
+            if (activeRequirementScope.length && !activeRequirementScope.includes(id))
+                return planToolReceipt({ ok: false, kind: "plan-requirement", code: "FRONTEND_INPUT_SCOPE_VIOLATION", error: `Requirement ${id} is outside this session` });
             if (id &&
                 input.requirementIds &&
                 input.requirementIds.length > 0 &&
@@ -1460,6 +2026,15 @@ export async function createFrontendPlanLedgerTools(input) {
                     });
                 }
             }
+            if (id &&
+                activeRequirementScope.length > 0 &&
+                !activeRequirementScope.includes(id)) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "plan-requirement",
+                    error: `record_plan_requirement id "${id}" is outside this session's requirement scope [${activeRequirementScope.join(", ")}]`,
+                });
+            }
             const result = await adoptPlanFact("plan-requirement", `${attemptId}:record_plan_requirement:${randomUUID()}`, {
                 kind: "plan-requirement",
                 origin: "plan",
@@ -1469,10 +2044,37 @@ export async function createFrontendPlanLedgerTools(input) {
             return planToolReceipt(result);
         },
     });
+    const recordPlanGroupCoverageTool = defineTool({
+        name: "record_plan_group_coverage", label: "record_plan_group_coverage",
+        description: "Submit shared implementation/verification references for one declared execution group. Runtime expands to every canonical member and retains its full outcome and source bindings. A shared VT must actually verify each independent condition. Use per-requirement records for differences; never create UI for constraints or exclusions. replace:true explicitly revises the group.",
+        parameters: Type.Object({ id: Type.String({ minLength: 1 }), implementationTargets: stringArray, verificationTargetIds: stringArray, replace: Type.Optional(Type.Boolean()) }, { additionalProperties: false }),
+        async execute(callId, params, signal, onUpdate, ctx) {
+            const group = executionGroups.find(g => g.id === params.id && g.kind !== "unclassified");
+            if (!group || (activeRequirementScope.length && group.requirementIds.some(id => !activeRequirementScope.includes(id))))
+                return planToolReceipt({ ok: false, kind: "plan-requirement", code: "EXECUTION_GROUP_SCOPE_INVALID", error: "A known complete group must be present in this session; submit individual member records when the group spans scopes" });
+            let last;
+            for (const id of group.requirementIds) {
+                const existing = readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "plan-requirement" && r.fact.entry?.id === id).at(-1)?.fact.entry;
+                if (existing && !params.replace) {
+                    if (JSON.stringify(existing.implementationTargets) !== JSON.stringify(params.implementationTargets) || JSON.stringify(existing.verificationTargetIds) !== JSON.stringify(params.verificationTargetIds))
+                        return planToolReceipt({ ok: false, kind: "plan-requirement", code: "FACT_IDENTITY_CONFLICT", error: `${id}: existing coverage differs; use replace:true to revise explicitly` });
+                    continue;
+                }
+                last = await recordPlanRequirementTool.execute(`${callId}:${id}`, { entry: { id, implementationTargets: params.implementationTargets, verificationTargetIds: params.verificationTargetIds }, ...(params.replace ? { replace: true } : {}) }, signal, onUpdate, ctx);
+                if (!last.details?.ok)
+                    return last;
+            }
+            return planToolReceipt(await adoptPlanFact("plan-group-coverage", `${attemptId}:group:${randomUUID()}`, { kind: "plan-group-coverage", origin: "plan", id: group.id, requirementIds: group.requirementIds }));
+        },
+    });
     const recordPlanVerificationTargetTool = defineTool({
         name: "record_plan_verification_target",
         label: "record_plan_verification_target",
-        description: "Commit one plan verification target entry (origin=plan plan-verification-target fact). For non-static targets, call once per distinct behavior, not mechanically once per requirement: one target may cover multiple related requirementIds. For a correction, re-submit the same id with replace=true; the ledger compiles the latest replacement. A non-static target id is the stable trace token that implementation must place in a real describe/it/test title; static targets are traced by file and command only. Entry carries id, type, commandLabel, file, requirementIds, and uiStates; free-form symbol text is not accepted. IMPORTANT: batch up to 4 record_* calls per assistant message; never batch more than 4 — a larger single message risks output truncation under a small output window. Example: {\"entry\": {\"id\": \"VT-DASHBOARD-SHELL\", \"type\": \"unit\", \"commandLabel\": \"<frozen command label>\", \"file\": \"<test file>\", \"requirementIds\": [\"AC-001\", \"AC-002\"], \"uiStates\": []}}",
+        description: "Commit one plan verification target entry (origin=plan plan-verification-target fact). Reference a frozen verification command by commandId (see the frozen command directory in your prompt: static commands are project-wide checks traced by file and command only; behavior commands need a test file whose describe/it/test title contains the target id). For behavior targets, call once per distinct behavior, not mechanically once per requirement: one target may cover multiple related requirementIds. For a correction, re-submit the same id with replace=true; the ledger compiles the latest replacement. A behavior target id is the stable trace token that implementation must place in a real describe/it/test title. Entry carries id, commandId, file, requirementIds, and uiStates; optional scope (unit | component | integration) is display-only. Free-form symbol text is not accepted. IMPORTANT: batch up to 4 record_* calls per assistant message; never batch more than 4 — a larger single message risks output truncation under a small output window. Example: {\"entry\": {\"id\": \"VT-DASHBOARD-SHELL\", \"commandId\": \"<frozen behavior command id>\", \"file\": \"<test file>\", \"requirementIds\": [\"AC-001\", \"AC-002\"], \"uiStates\": []}}" +
+            (input.canonicalVerificationTargetIds &&
+                input.canonicalVerificationTargetIds.length > 0
+                ? ` Frozen canonical behavior target ids (use exactly for behavior targets): ${input.canonicalVerificationTargetIds.join(", ")}.`
+                : ""),
         promptSnippet: "Commit 1-4 plan verification target entries (up to 4 per message).",
         parameters: Type.Object({
             entry: verificationTargetSchema,
@@ -1487,19 +2089,61 @@ export async function createFrontendPlanLedgerTools(input) {
                     error: "record_plan_verification_target requires a non-empty entry object",
                 });
             }
-            // Belt-and-braces for providers that do not strictly enforce the
-            // tool-schema enum: reject an invalid type here with the allowed
-            // values so the model can re-record in-node instead of the whole
-            // attempt dying at compile time on the strict zod enum.
-            const verificationTargetType = rawEntry.type;
-            if (typeof verificationTargetType !== "string" ||
-                !["static", "unit", "component", "integration", "mock"].includes(verificationTargetType)) {
+            // Contract v2: the plan references a frozen command by commandId;
+            // mode and label are resolved by the runtime from the frozen
+            // command directory (run.json frontend-verify-shell bundle lanes).
+            // Reject unknown ids and behavior commands bound to non-test
+            // files here so the model fixes them in-node instead of the
+            // attempt dying at materialization or at the writer focused-check.
+            const verificationCommandId = typeof rawEntry.commandId === "string"
+                ? rawEntry.commandId.trim()
+                : "";
+            if (!verificationCommandId) {
                 return planToolReceipt({
                     ok: false,
                     kind: "plan-verification-target",
-                    error: `record_plan_verification_target entry.type must be one of static | unit | component | integration | mock (received ${JSON.stringify(verificationTargetType ?? null)}); for a runtime behavior check use type=mock or type=integration`,
+                    error: `record_plan_verification_target entry.commandId is required (received ${JSON.stringify(rawEntry.commandId ?? null)}); pick one id from the frozen command directory in your prompt`,
                 });
             }
+            const { deriveFrontendVerifyCommandDirectoryFromRun, isFrontendTestFilePath, } = await import("../workflows/dag/frontend-implementation-contract.js");
+            const verifyDirectory = await deriveFrontendVerifyCommandDirectoryFromRun(input.runDir);
+            if (verifyDirectory.length > 0) {
+                const directoryEntry = verifyDirectory.find((entry) => entry.commandId === verificationCommandId);
+                if (!directoryEntry) {
+                    return planToolReceipt({
+                        ok: false,
+                        kind: "plan-verification-target",
+                        error: `record_plan_verification_target verification-target-unknown-command: unknown commandId "${verificationCommandId}"; available frozen commands: [${verifyDirectory.map((entry) => `${entry.commandId} (${entry.mode}: ${entry.label})`).join(", ")}]`,
+                    });
+                }
+                if (directoryEntry.mode === "behavior" &&
+                    typeof rawEntry.file === "string" &&
+                    !isFrontendTestFilePath(rawEntry.file)) {
+                    return planToolReceipt({
+                        ok: false,
+                        kind: "plan-verification-target",
+                        error: `record_plan_verification_target verification-target-phase-mismatch: behavior command "${directoryEntry.label}" (${directoryEntry.commandId}) must bind a test file (__tests__/, tests?/, e2e/, cypress/, *.test.*, *.spec.*, *.cy.*); received file "${rawEntry.file}"`,
+                    });
+                }
+                // Canonical-identity check for behavior targets: the PRD freezes
+                // the exact behavior verification-target ids (e.g.
+                // VT-SMOKE-COUNTER-BEHAVIOR). A committed non-canonical id is
+                // immutable and design review rejects it as a
+                // contract-requirement gap, so reject invented ids here.
+                if (directoryEntry.mode === "behavior" &&
+                    input.canonicalVerificationTargetIds &&
+                    input.canonicalVerificationTargetIds.length > 0) {
+                    const canonicalTargetId = typeof rawEntry.id === "string" ? rawEntry.id.trim() : "";
+                    if (canonicalTargetId &&
+                        !input.canonicalVerificationTargetIds.includes(canonicalTargetId)) {
+                        return planToolReceipt({
+                            ok: false,
+                            kind: "plan-verification-target",
+                            error: `record_plan_verification_target id "${canonicalTargetId}" is not a frozen canonical behavior verification target; canonical ids are: ${input.canonicalVerificationTargetIds.join(", ")}`,
+                        });
+                    }
+                }
+            }
             // Duplicate-id rejection: committed typed facts are immutable, so
             // re-recording the same VT id would deadlock the compile by default.
             // replace=true is the explicit in-node correction path.
@@ -1568,6 +2212,15 @@ export async function createFrontendPlanLedgerTools(input) {
                     : [];
             }));
             const unknownRequirementIds = stringList(rawEntry.requirementIds).filter((id) => !declaredRequirementIds.has(id));
+            const outOfScopeRequirementIds = stringList(rawEntry.requirementIds).filter((id) => activeRequirementScope.length > 0 &&
+                !activeRequirementScope.includes(id));
+            if (outOfScopeRequirementIds.length > 0) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "plan-verification-target",
+                    error: `record_plan_verification_target references requirements outside this session's scope [${activeRequirementScope.join(", ")}]: ${outOfScopeRequirementIds.join(", ")}`,
+                });
+            }
             if (unknownRequirementIds.length > 0) {
                 return planToolReceipt({
                     ok: false,
@@ -1614,6 +2267,18 @@ export async function createFrontendPlanLedgerTools(input) {
                     error: "record_plan_evidence_gap requires a non-empty description describing the gap",
                 });
             }
+            const requirementId = typeof entry.requirementId === "string"
+                ? entry.requirementId
+                : undefined;
+            if (requirementId &&
+                activeRequirementScope.length > 0 &&
+                !activeRequirementScope.includes(requirementId)) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "plan-evidence-gap",
+                    error: `record_plan_evidence_gap requirementId "${requirementId}" is outside this session's requirement scope [${activeRequirementScope.join(", ")}]`,
+                });
+            }
             const result = await adoptPlanFact("plan-evidence-gap", `${attemptId}:record_plan_evidence_gap:${randomUUID()}`, { kind: "plan-evidence-gap", origin: "plan", entry });
             return planToolReceipt(result);
         },
@@ -1621,7 +2286,7 @@ export async function createFrontendPlanLedgerTools(input) {
     const finalizePlanTool = defineTool({
         name: "finalize_plan",
         label: "finalize_plan",
-        description: "Commit the finalize_plan terminal. Requirements, verification targets, and evidence gaps (optional) were already committed incrementally through record_plan_requirement / record_plan_verification_target / record_plan_evidence_gap; finalize_plan assembles them from the ledger together with these optional remaining fields, publishes the canonical editable patch on a target-surface fact, and commits the terminal. Call exactly once.",
+        description: "Commit the finalize_plan terminal. Requirements, verification targets, and evidence gaps (optional) were already committed incrementally through record_plan_requirement / record_plan_verification_target / record_plan_evidence_gap; finalize_plan assembles them from the ledger together with these optional remaining fields, publishes the canonical editable patch on a target-surface fact, and commits the terminal. A successful terminal commit occurs exactly once. If validation fails, correct only the reported facts and retry finalize.",
         promptSnippet: "Commit the finalize_plan terminal (ledger fields + optional residualRisks / realIntegrationGap).",
         parameters: Type.Object({
             residualRisks: optionalStringArray,
@@ -1636,6 +2301,9 @@ export async function createFrontendPlanLedgerTools(input) {
                 // when the plan did not re-declare them. The contract node is the
                 // sole synthesis point; the plan inherits by requirement id.
                 const contractInheritance = await loadContractRequirementInheritance(input.runDir);
+                const missingData = collectFrontendPlanPhaseMissingFacts({ phase: "global-mock-data", requirementIds: input.requirementIds ?? [...contractInheritance.keys()], committedFacts: committed }).filter(f => f.kind === "data-flow");
+                if (missingData.length)
+                    return planToolReceipt({ ok: false, kind: "finalize_plan", code: "PLAN_DATA_FLOW_INCOMPLETE", error: missingData.map(f => f.reason).join("; ") });
                 const fragment = assemblePlanPatchFromCommittedFacts(committed, contractInheritance) ?? {};
                 const patch = {
                     ...fragment,
@@ -1646,6 +2314,29 @@ export async function createFrontendPlanLedgerTools(input) {
                         ? { realIntegrationGap: params.realIntegrationGap }
                         : {}),
                 };
+                const latestRegistry = [...committed]
+                    .reverse()
+                    .map((record) => record.fact)
+                    .find((fact) => isRecordObject(fact) && fact.kind === "state-registry");
+                if (latestRegistry) {
+                    const registryUiStates = new Set(stringList(latestRegistry.uiStateNames));
+                    const registryInteractions = new Set(stringList(latestRegistry.interactionNames));
+                    const live = collectCanonicalStateFlowNames(committed);
+                    const missingUiStates = [...registryUiStates].filter((name) => !live.uiStateNames.has(name));
+                    const missingInteractions = [...registryInteractions].filter((name) => !live.interactionNames.has(name));
+                    const undeclaredUiStates = [...live.uiStateNames].filter((name) => !registryUiStates.has(name));
+                    const undeclaredInteractions = [...live.interactionNames].filter((name) => !registryInteractions.has(name));
+                    if (missingUiStates.length > 0 ||
+                        missingInteractions.length > 0 ||
+                        undeclaredUiStates.length > 0 ||
+                        undeclaredInteractions.length > 0) {
+                        return planToolReceipt({
+                            ok: false,
+                            kind: "finalize_plan",
+                            error: `finalize_plan UX registry mismatch: every registered name must have one live state-flow entry and every live entry must be registered (missing uiStates: ${missingUiStates.join(", ") || "none"}; missing interactions: ${missingInteractions.join(", ") || "none"}; undeclared uiStates: ${undeclaredUiStates.join(", ") || "none"}; undeclared interactions: ${undeclaredInteractions.join(", ") || "none"})`,
+                        });
+                    }
+                }
                 // Front-load the node's compile + policy gates into the finalize
                 // receipt (same pipeline the design-policy shell and the node
                 // self-check run: merge the patch onto the runtime skeleton,
@@ -1672,9 +2363,10 @@ export async function createFrontendPlanLedgerTools(input) {
                     catch (error) {
                         if (error instanceof PlanPolicyPrecheckFailure) {
                             // Template the fix: every uncovered interaction / state
-                            // maps to a ready-to-submit record_component_choice
-                            // call. One reuse-existing choice covers all
-                            // behavioural interactions.
+                            // maps to a record_component_choice skeleton. Reuse is
+                            // never implied: the operator/model must fill an existing
+                            // evidencePath or switch the choice to decision=new with
+                            // the required frozen source citation.
                             const suggestions = error.findings
                                 .filter((finding) => finding.code === "ui-design-coverage-missing" &&
                                 finding.path)
@@ -1685,6 +2377,7 @@ export async function createFrontendPlanLedgerTools(input) {
                                         purpose: finding.path,
                                         component: "<name the existing or new component>",
                                         decision: "reuse-existing",
+                                        evidencePath: "<existing repo file that proves this reuse>",
                                     },
                                 },
                             }));
@@ -1766,30 +2459,164 @@ export async function createFrontendPlanLedgerTools(input) {
             }
         },
     });
-    return {
-        customTools: [
+    const readPlanFactsTool = defineTool({
+        name: "read_plan_facts",
+        label: "read_plan_facts",
+        description: "Read the LIVE committed plan ledger without repository access. Filter by kind and optional entryId or eventId. Use field (dot path, e.g. entry.requirementIds or uiStates) to page large arrays/strings. offset/limit paginate results; follow nextOffset until null before replacing any full-array fact. expectedRevision pins all pages to one ledger revision; restart if it changes. No writes.",
+        parameters: Type.Object({
+            kind: Type.String(), entryId: Type.Optional(Type.String()), eventId: Type.Optional(Type.String()),
+            field: Type.Optional(Type.String()), offset: Type.Optional(Type.Integer({ minimum: 0 })),
+            limit: Type.Optional(Type.Integer({ minimum: 1, maximum: 50 })),
+            stringOffset: Type.Optional(Type.Integer({ minimum: 0 })),
+            expectedRevision: Type.Optional(Type.Integer({ minimum: 0 })),
+        }, { additionalProperties: false }),
+        async execute(_id, params) {
+            const reply = (details) => ({ content: [{ type: "text", text: JSON.stringify(details) }], details });
+            if (params.expectedRevision !== undefined && params.expectedRevision !== store.revision) {
+                return reply({ ok: false, revision: store.revision, error: "ledger revision changed; restart pagination" });
+            }
+            let records = readCommittedEvents(store, attemptId).filter(record => {
+                const fact = record.fact;
+                return fact.kind === params.kind && (!params.eventId || record.eventId === params.eventId) &&
+                    (!params.entryId || fact.entry?.id === params.entryId);
+            });
+            // Full-entry corrections and registries are last-wins. Other kinds
+            // remain an ordered event log (state removals must remain visible).
+            if (params.entryId || params.kind === "state-registry")
+                records = records.slice(-1);
+            let values = records.map(record => ({ eventId: record.eventId, ...record.fact }));
+            if (params.field) {
+                values = records.flatMap(record => {
+                    let value = record.fact;
+                    for (const key of params.field.split(".")) {
+                        if (!value || typeof value !== "object" || !Object.hasOwn(value, key))
+                            return [];
+                        value = value[key];
+                    }
+                    return Array.isArray(value) ? value : [value];
+                });
+            }
+            const offset = params.offset ?? 0;
+            if (params.stringOffset !== undefined) {
+                const value = values[offset];
+                if (typeof value !== "string")
+                    return reply({ ok: false, error: "stringOffset requires a string field item" });
+                // Unicode code points prevent a page boundary splitting a surrogate pair.
+                const characters = Array.from(value);
+                const chunk = characters.slice(params.stringOffset, params.stringOffset + 1000).join("");
+                const next = params.stringOffset + Array.from(chunk).length;
+                return reply({ ok: true, revision: store.revision, offset, stringOffset: params.stringOffset,
+                    chunk, totalCharacters: characters.length, nextStringOffset: next < characters.length ? next : null });
+            }
+            const items = [];
+            let bytes = 0;
+            for (const value of values.slice(offset, offset + (params.limit ?? 10))) {
+                const size = Buffer.byteLength(JSON.stringify(value));
+                if (bytes + size > 12_000)
+                    break;
+                bytes += size;
+                items.push(value);
+            }
+            if (!items.length && offset < values.length)
+                return reply({
+                    ok: false, revision: store.revision, total: values.length, offset,
+                    error: "item exceeds the page budget; select an eventId/entryId and a narrower field path; for a string item set stringOffset: 0 and follow nextStringOffset",
+                    fields: typeof values[offset] === "object" && values[offset] !== null ? Object.keys(values[offset]) : [],
+                });
+            return reply({ ok: true, revision: store.revision, total: values.length, offset, items,
+                nextOffset: offset + items.length < values.length ? offset + items.length : null });
+        },
+    });
+    const durable = await createDurableFrontendTools({
+        file: path.join(input.runDir, input.nodeId, "plan-typed-facts.jsonl"), attemptId, store: input.store,
+        setWorkingStore: next => { store = next; },
+        binding: { sourceBinding: input.sourceBinding, skeleton: input.skeleton, requirementIds: input.requirementIds, writeSet: input.writeSetPatterns, declaredUiStateIds: input.declaredUiStateIds, citations: input.componentNewSourceReferences, contractInheritance },
+        tools: [
             recordRouteSelectionTool,
             recordComponentChoiceTool,
+            recordStateRegistryTool,
             recordStateFlowTool,
             recordDataFlowTool,
             recordMockApiTool,
+            recordMockEndpointTool,
             recordDesignDeviationTool,
             recordDependencyTool,
             recordPlanRequirementTool,
+            recordPlanGroupCoverageTool,
             recordPlanVerificationTargetTool,
             recordPlanEvidenceGapTool,
             adoptStagedFactTool,
             finalizePlanTool,
         ],
-        setActiveRequirementScope: (requirementIds) => {
-            activeRequirementScope = [
-                ...new Set(requirementIds.filter((id) => id.trim().length > 0)),
-            ];
-        },
-        flush: async () => {
-            const committed = readCommittedEvents(store, attemptId);
-            await writeTypedEventStoreJsonl(path.join(input.runDir, input.nodeId, "plan-typed-facts.jsonl"), committed);
+    });
+    return {
+        customTools: [...durable.customTools, { ...readPlanFactsTool, execute: async (...args) => { await durable.flush(); return readPlanFactsTool.execute(...args); } }],
+        adoptCommittedFacts: async (records) => durable.commitExternal(async () => {
+            for (const record of records) {
+                if (record.phase !== "committed")
+                    continue;
+                const fact = record.fact;
+                if (!fact || typeof fact !== "object" || Array.isArray(fact))
+                    continue;
+                const kind = typeof fact.kind === "string"
+                    ? fact.kind
+                    : "plan-fact";
+                const entry = fact.entry;
+                const identity = (kind === "plan-requirement" || kind === "plan-verification-target") &&
+                    typeof entry?.id === "string"
+                    ? `${kind}:${entry.id}`
+                    : undefined;
+                const sourceShardPrefix = `${attemptId}:parallel-merge:${record.attemptId}:`;
+                const requestId = `${sourceShardPrefix}${record.eventId}`;
+                const committed = readCommittedEvents(store, attemptId);
+                const replay = committed.find((candidate) => candidate.requestId === requestId);
+                if (replay) {
+                    if (replay.payloadSha256 !== record.payloadSha256) {
+                        throw new Error(`frontend plan shard fact merge replay conflict: source event ${record.eventId} changed payload`);
+                    }
+                    continue;
+                }
+                const explicitReplacement = typeof fact.replaces === "string" &&
+                    fact.replaces === entry?.id;
+                const conflicting = committed.find((candidate) => {
+                    const candidateFact = candidate.fact;
+                    const candidateEntry = candidateFact.entry;
+                    const sameSourceShard = candidate.requestId.startsWith(sourceShardPrefix);
+                    return (candidateFact.kind === kind &&
+                        typeof candidateEntry?.id === "string" &&
+                        `${kind}:${candidateEntry.id}` === identity &&
+                        !(sameSourceShard && explicitReplacement));
+                });
+                if (conflicting) {
+                    // Two shards may honestly emit the same fact (e.g. both
+                    // derive the same frozen verification target). Identical
+                    // payloads are duplicates to skip; divergent payloads are
+                    // a real conflict the ladder must resolve.
+                    if (conflicting.payloadSha256 === record.payloadSha256) {
+                        continue;
+                    }
+                    const fromSameSourceShard = conflicting.requestId.startsWith(sourceShardPrefix);
+                    if (fromSameSourceShard) {
+                        throw new Error(`frontend plan shard fact merge conflict: ${identity} was already committed by another shard with a different payload`);
+                    }
+                    // Divergent payload from a different source attempt means a
+                    // ladder retry re-derived the coverage phase: the fresh
+                    // derivation supersedes the stored record.
+                    const storeWithRecords = store;
+                    storeWithRecords.records = storeWithRecords.records.filter((candidate) => candidate.eventId !== conflicting.eventId);
+                }
+                const result = await adoptPlanFact(kind, requestId, fact);
+                if (!result.ok) {
+                    throw new Error(`frontend plan shard fact merge failed: ${result.error}`);
+                }
+            }
+        }),
+        setActiveRequirementScope: (requirementIds) => {
+            activeRequirementScope = [
+                ...new Set(requirementIds.filter((id) => id.trim().length > 0)),
+            ];
         },
+        flush: durable.flush,
         committedFactCount: () => readCommittedEvents(store, attemptId).length,
         committedRequirementIds: () => {
             const ids = new Set();
@@ -1819,6 +2646,10 @@ function contractFactSourceSpan(fact) {
     if (Array.isArray(fact.sourceRefs) && fact.sourceRefs.length > 0) {
         return fact.sourceRefs;
     }
+    if (Array.isArray(fact.sourceFragmentIds) &&
+        fact.sourceFragmentIds.some((value) => typeof value === "string" && value.trim().length > 0)) {
+        return fact.sourceFragmentIds;
+    }
     if (typeof fact.source === "string" && fact.source.trim().length > 0) {
         return fact.source;
     }
@@ -1868,6 +2699,7 @@ export function buildFrontendTaskContractVNext(records) {
         requirements,
         constraints: byKind("constraint"),
         evidenceExpectations: byKind("evidence-expectation"),
+        deliverableDeclarations: byKind("required-deliverables").at(-1)?.items ?? [],
         handoffIntents: byKind("handoff-intent"),
         openQuestions: byKind("open-question"),
         splitProposals: byKind("split-proposal"),
@@ -1875,7 +2707,7 @@ export function buildFrontendTaskContractVNext(records) {
     };
 }
 /**
- * A+B: `frontend-contract-pi` incremental contract tools. Six `record_*` tools
+ * A+B: `frontend-contract-pi` incremental contract tools. The `record_*` tools
  * commit origin=contract facts and `finalize_contract` commits the terminal
  * disposition (ready | ready-with-assumptions | blocked + blockingOwner).
  */
@@ -1886,8 +2718,11 @@ export async function createFrontendContractTools(input) {
     ]);
     const { readCommittedEvents, writeTypedEventStoreJsonl } = await import("../workflows/dag/frontend-typed-event-store.js");
     const { adoptTypedEventFact, stageTypedEventFact } = await import("../workflows/dag/frontend-typed-event-transaction.js");
-    const store = input.store;
+    let store = input.store;
     const attemptId = input.attemptId;
+    let activeScope = null;
+    const committedRequirementIds = () => new Set(readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "requirement").map(r => String(r.fact.id)));
+    const completedScopeRequirementIds = () => new Set(readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "contract-scope-completed").flatMap(r => Array.isArray(r.fact.requirementIds) ? r.fact.requirementIds.filter((id) => typeof id === "string") : []));
     const receipt = (details) => ({
         content: [{ type: "text", text: JSON.stringify(details) }],
         details,
@@ -1927,9 +2762,7 @@ export async function createFrontendContractTools(input) {
         }
     }
     const recordKinds = {
-        record_requirement: "requirement",
         record_constraint: "constraint",
-        record_evidence_expectation: "evidence-expectation",
         record_handoff_intent: "handoff-intent",
         record_open_question: "open-question",
         record_split_proposal: "split-proposal",
@@ -1939,16 +2772,176 @@ export async function createFrontendContractTools(input) {
         label: name,
         description: `Commit an origin=contract ${kind} fact. IMPORTANT: submit incrementally — batch up to 5 record_* calls per message, starting from the FIRST message; never attempt to emit the whole contract in one response (a single large dump will be truncated and rejected). Every message must make progress by committing at least one record_* fact.`,
         promptSnippet: `Commit 1-5 origin=contract ${kind} facts (up to 5 per message).`,
-        parameters: Type.Object({}, { additionalProperties: true }),
+        parameters: Type.Object({
+            text: Type.String({ minLength: 1 }),
+            requirementIds: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+            sourceFragmentIds: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+            ...(kind === "constraint" ? { category: Type.Optional(Type.Enum({ constraint: "constraint", "non-goal": "non-goal", risk: "risk" })) } : {}),
+            ...(kind === "handoff-intent" ? { taskKind: Type.Literal("frontend-test"), blocking: Type.Optional(Type.Boolean()) } : {}),
+        }, { additionalProperties: false }),
         async execute(_toolCallId, params) {
+            const data = params;
+            if (!data.text?.trim())
+                return receipt({ ok: false, code: "TOOL_SCHEMA_INVALID", error: `${name}: text must be non-empty` });
+            const knownFragments = new Set([...(input.canonicalRequirements?.values() ?? [])].flatMap(r => r.sourceFragmentIds));
+            if (data.requirementIds?.some(id => !input.canonicalRequirements?.has(id)) || data.sourceFragmentIds?.some(id => !knownFragments.has(id)))
+                return receipt({ ok: false, code: "CONTRACT_REFERENCE_UNKNOWN", error: `${name}: reference is outside the frozen source inventory` });
             const result = await adoptContractFact(kind, {
+                ...(params ?? {}),
                 kind,
                 origin: "contract",
-                ...(params ?? {}),
             });
             return receipt(result);
         },
     }));
+    // record_requirement is runtime-owned by design: the requirement TEXT and
+    // sourceFragmentIds come from the frozen source-fidelity ledger, never from
+    // model-authored prose. The model only names the canonical id it confirms.
+    // This closes the free-shape hole (additionalProperties:true accepted
+    // `statement` rewrites and JSON-stringified `sourceFragmentIds` arrays,
+    // which then reached the planner as empty text + dead fragment bindings).
+    const recordRequirementTool = defineTool({
+        name: "record_requirement",
+        label: "record_requirement",
+        description: 'Confirm one canonical ledger requirement (origin=contract requirement fact). Pass the canonical id and optional execution:{groupId,kind,summary} only. Reuse a group only when its behavior and all permission/threshold/error conditions agree; retain separate groups for differences. Constraints/exclusions do not require invented UI. The canonical id is listed in the <frontend_contract_input> inventory, e.g. {"id": "AC-001"} — the runtime commits the authoritative text and sourceFragmentIds from the frozen ledger. Never pass text/statement/sourceFragmentIds yourself: free-form rewrites and JSON-stringified fragment arrays are rejected. IMPORTANT: batch up to 5 record_* calls per message, starting from the FIRST message.',
+        promptSnippet: "Confirm 1-5 canonical requirements by id (up to 5 per message).",
+        parameters: Type.Object({ id: Type.String({ description: "Canonical ledger requirement id (e.g. AC-001)" }), execution: Type.Optional(Type.Object({ groupId: Type.String({ minLength: 1 }), kind: Type.Union([Type.Literal("behavior"), Type.Literal("constraint"), Type.Literal("exclusion")]), summary: Type.String({ minLength: 1 }) }, { additionalProperties: false })) }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const id = typeof params?.id === "string" ? params.id.trim() : "";
+            if (!id) {
+                return receipt({
+                    ok: false,
+                    kind: "requirement",
+                    error: "record_requirement requires the canonical requirement id",
+                });
+            }
+            if (activeScope && !activeScope.has(id))
+                return receipt({ ok: false, code: "FRONTEND_INPUT_SCOPE_VIOLATION", error: `requirement ${id} is outside the complete input scope of this session` });
+            const canonical = input.canonicalRequirements?.get(id);
+            if (!canonical) {
+                const known = [...(input.canonicalRequirements?.keys() ?? [])];
+                return receipt({
+                    ok: false,
+                    kind: "requirement",
+                    error: `record_requirement id "${id}" is not a canonical ledger requirement; canonical ids are: ${known.join(", ") || "(none)"}`,
+                });
+            }
+            if (params.execution) {
+                try {
+                    collectFrontendExecutionGroups([...readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "requirement" && r.fact.id !== id).map(r => ({ id: String(r.fact.id), execution: r.fact.execution })), { id, execution: params.execution }]);
+                }
+                catch (error) {
+                    return receipt({ ok: false, code: "EXECUTION_GROUP_CONFLICT", error: String(error) });
+                }
+            }
+            const result = await adoptContractFact("requirement", {
+                kind: "requirement",
+                origin: "contract",
+                disposition: "explicit",
+                id,
+                text: canonical.text,
+                sourceFragmentIds: canonical.sourceFragmentIds,
+                ...(params.execution ? { execution: params.execution } : {}),
+            });
+            return receipt(result);
+        },
+    });
+    // Authoritative UI state declarations: the contract node extracts the
+    // PRD/reference UI-state table into structured facts so the planner binds
+    // uiStates to declared ids instead of inventing names (dogfood
+    // dag-1788504923861-0f7b17a9: 10 invented list-visibility variants, 0 of
+    // the 7 PRD states).
+    const recordUiStateTool = defineTool({
+        name: "record_ui_state",
+        label: "record_ui_state",
+        description: 'Declare ONE authoritative UI state extracted from the task source\'s UI-state table (origin=contract ui-state-declaration fact). Call once per declared state, exactly as the source names it: {"id": "<state id from the source table>", "trigger": "<when this state applies>", "observableOutcome": "<what the user can observe>"}. The planner must bind these ids later; do not rename or invent states.',
+        promptSnippet: "Declare 1-5 authoritative UI states (up to 5 per message).",
+        parameters: Type.Object({
+            id: Type.String({ description: "UI state id exactly as the source table declares it" }),
+            trigger: Type.String({ description: "When this state applies" }),
+            observableOutcome: Type.String({ description: "Observable result for the user" }),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const id = typeof params?.id === "string" ? params.id.trim() : "";
+            const trigger = typeof params?.trigger === "string" ? params.trigger.trim() : "";
+            const observableOutcome = typeof params?.observableOutcome === "string"
+                ? params.observableOutcome.trim()
+                : "";
+            if (!id || !trigger || !observableOutcome) {
+                return receipt({
+                    ok: false,
+                    kind: "ui-state-declaration",
+                    error: "record_ui_state requires non-empty id, trigger, and observableOutcome",
+                });
+            }
+            const result = await adoptContractFact("ui-state-declaration", {
+                kind: "ui-state-declaration",
+                origin: "contract",
+                id,
+                trigger,
+                observableOutcome,
+            });
+            return receipt(result);
+        },
+    });
+    const evidenceStatus = Type.Enum({
+        required: "required", optional: "optional", "not-applicable": "not-applicable",
+    });
+    const recordEvidenceExpectationTool = defineTool({
+        name: "record_evidence_expectation",
+        label: "record_evidence_expectation",
+        description: 'Record evidence requirements as {requirementId:"<canonical id>",evidence:{static:"required|optional|not-applicable",behavior:"required|optional|not-applicable",mock:"required|optional|not-applicable","real-integration":"required|optional|not-applicable"}}. Declare at least one lane; later calls replace only the lanes they name.',
+        parameters: Type.Object({
+            requirementId: Type.String(),
+            evidence: Type.Object({
+                static: Type.Optional(evidenceStatus),
+                behavior: Type.Optional(evidenceStatus),
+                mock: Type.Optional(evidenceStatus),
+                "real-integration": Type.Optional(evidenceStatus),
+            }, { additionalProperties: false }),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            try {
+                const fact = frontendEvidenceExpectationSchema.parse(params);
+                if (!input.canonicalRequirements?.has(fact.requirementId)) {
+                    throw new Error(`unknown canonical requirement ${fact.requirementId}`);
+                }
+                return receipt(await adoptContractFact("evidence-expectation", {
+                    kind: "evidence-expectation", origin: "contract", ...fact,
+                }));
+            }
+            catch (error) {
+                return receipt({
+                    ok: false, kind: "evidence-expectation",
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        },
+    });
+    const recordRequiredDeliverablesTool = defineTool({
+        name: "record_required_deliverables",
+        label: "record_required_deliverables",
+        description: 'Declare the complete source-required file deliverables as {items:[{path,requirementId,sourceFragmentId}]}. Interpret obligations from the original source, including lists/tables: permissions (allowedPaths/only allowed to modify), prohibitions, examples and read-only references are NOT delivery obligations. Each path must appear exactly in its frozen requirement-bound source fragment. Submit {items:[]} explicitly if no files are mandatory. Each call appends complete source-bound items; replace:true explicitly replaces the inventory. Required before finalize_contract ready.',
+        parameters: Type.Object({ replace: Type.Optional(Type.Boolean()), items: Type.Array(Type.Object({
+                path: Type.String(), requirementId: Type.String(), sourceFragmentId: Type.String(),
+            }, { additionalProperties: false })) }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            try {
+                const declaration = validateFrontendRequiredDeliverables({ items: params.items }, input.canonicalRequirements ?? new Map());
+                const previous = params.replace ? [] : readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "required-deliverables").at(-1)?.fact.items;
+                const items = [...new Map([...(Array.isArray(previous) ? previous : []), ...declaration.items].map(item => [JSON.stringify(item), item])).values()];
+                return receipt(await adoptContractFact("required-deliverables", {
+                    kind: "required-deliverables", origin: "contract", items,
+                }));
+            }
+            catch (error) {
+                return receipt({
+                    ok: false, kind: "required-deliverables",
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        },
+    });
     // OpenSpec selection committed as individual typed facts (one path per
     // call) so a large candidate set never exceeds a single model output
     // budget: each tool call carries exactly one {path, disposition,
@@ -1994,7 +2987,7 @@ export async function createFrontendContractTools(input) {
     const finalizeContractTool = defineTool({
         name: "finalize_contract",
         label: "finalize_contract",
-        description: "Commit the contract-finalized terminal fact with a disposition of ready | ready-with-assumptions | blocked (blocked requires blockingOwner). Call exactly once.",
+        description: "Commit the contract-finalized terminal fact with a disposition of ready | ready-with-assumptions | blocked (blocked requires blockingOwner). A successful terminal commit occurs exactly once. If validation fails, correct only the reported facts and retry finalize.",
         promptSnippet: "Commit the contract-finalized terminal (disposition + optional blockingOwner).",
         parameters: Type.Object({
             disposition: Type.Enum({
@@ -2019,6 +3012,16 @@ export async function createFrontendContractTools(input) {
                     error: "blocked disposition requires blockingOwner (blocked-human | blocked-external)",
                 });
             }
+            if (disposition !== "blocked" && input.canonicalRequirements?.size &&
+                !readCommittedEvents(store, attemptId).some((record) => record.fact.kind === "required-deliverables")) {
+                return receipt({
+                    ok: false, kind: "finalize_contract",
+                    error: "call record_required_deliverables with the complete source-bound inventory (or items:[] when none) before finalizing",
+                });
+            }
+            const missing = [...(input.canonicalRequirements?.keys() ?? [])].filter(id => !committedRequirementIds().has(id) || (activeScope !== null && !completedScopeRequirementIds().has(id)));
+            if (disposition !== "blocked" && missing.length)
+                return receipt({ ok: false, code: "CONTRACT_REQUIREMENT_COVERAGE_MISSING", error: `Confirm all complete source obligations before finalizing: ${missing.join(", ")}` });
             const blockedOwner = mapContractBlockedOwner({
                 disposition: disposition ?? "",
                 blockingOwner,
@@ -2039,15 +3042,41 @@ export async function createFrontendContractTools(input) {
             return receipt(result);
         },
     });
-    return {
-        customTools: [
+    const completeScopeTool = defineTool({
+        name: "complete_contract_scope", label: "complete_contract_scope",
+        description: "After recording all requirements AND their evidence, constraints, questions and deliverables for this session, mark the scope complete. Confirming an ID alone does not complete its analysis. Do this before finalize_contract.",
+        parameters: Type.Object({ requirementIds: Type.Array(Type.String({ minLength: 1 }), { uniqueItems: true }) }, { additionalProperties: false }),
+        async execute(_id, params) {
+            const ids = params.requirementIds;
+            if (activeScope === null || ids.length !== activeScope.size || ids.some(id => !activeScope?.has(id) || !committedRequirementIds().has(id)))
+                return receipt({ ok: false, code: "CONTRACT_SCOPE_INCOMPLETE", error: "Complete exactly the active scope after confirming all its obligations" });
+            return receipt(await adoptContractFact("contract-scope-completed", { kind: "contract-scope-completed", origin: "contract", requirementIds: ids }));
+        },
+    });
+    const durable = await createDurableFrontendTools({
+        file: path.join(input.runDir, input.nodeId, "contract-typed-facts.jsonl"), attemptId, store: input.store,
+        setWorkingStore: next => { store = next; }, binding: { canonicalRequirements: input.canonicalRequirements, sourceDigest: input.sourceDigest },
+        tools: [
             ...recordTools,
+            recordRequirementTool,
+            recordEvidenceExpectationTool,
+            recordUiStateTool,
+            recordRequiredDeliverablesTool,
             recordOpenspecSelectionTool,
+            completeScopeTool,
             finalizeContractTool,
         ],
+    });
+    return {
+        customTools: durable.customTools,
+        inputRequirements: () => [...(input.canonicalRequirements ?? [])].map(([id, value]) => ({ id, text: value.text, sourceFragmentIds: [...value.sourceFragmentIds] })),
+        completedScopeRequirementIds,
+        setActiveRequirementScope: ids => { activeScope = ids === null ? null : new Set(ids); },
+        committedRequirementIds,
+        committedFacts: () => readCommittedEvents(input.store, attemptId),
         flush: async () => {
-            const committed = readCommittedEvents(store, attemptId);
-            await writeTypedEventStoreJsonl(path.join(input.runDir, input.nodeId, "contract-typed-facts.jsonl"), committed);
+            await durable.flush();
+            const committed = readCommittedEvents(input.store, attemptId);
             await writeJsonAtomic(path.join(input.runDir, input.nodeId, "frontend-task-contract-vNext.json"), buildFrontendTaskContractVNext(committed));
         },
     };
@@ -2099,7 +3128,7 @@ export async function createFrontendScoutEvidenceTools(input) {
     ]);
     const { readCommittedEvents, writeTypedEventStoreJsonl } = await import("../workflows/dag/frontend-typed-event-store.js");
     const { adoptTypedEventFact, stageTypedEventFact } = await import("../workflows/dag/frontend-typed-event-transaction.js");
-    const store = input.store;
+    let store = input.store;
     const attemptId = input.attemptId;
     const stringArray = Type.Array(Type.String({}));
     const optionalString = Type.Optional(Type.String({}));
@@ -2113,6 +3142,18 @@ export async function createFrontendScoutEvidenceTools(input) {
     });
     const sourceDeclaredPaths = (input.sourceDeclaredPaths ?? []).map((value) => value.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, ""));
     const hasSourceDeclarations = input.sourceDeclaredPaths !== undefined;
+    let activeScope;
+    const scopeIdentity = (ids) => createHash("sha256").update(JSON.stringify([...ids].sort())).digest("hex");
+    const latestScopes = () => {
+        const byRequirement = new Map();
+        for (const record of readCommittedEvents(store, attemptId))
+            if (record.fact.kind === "scout-scope" && Array.isArray(record.fact.requirementIds)) {
+                for (const id of record.fact.requirementIds)
+                    if (typeof id === "string")
+                        byRequirement.set(id, record.fact);
+            }
+        return byRequirement;
+    };
     const isSourceDeclared = (candidate) => {
         const normalized = candidate.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, "");
         return sourceDeclaredPaths.some((declared) => declared === normalized || declared.startsWith(`${normalized}/`));
@@ -2205,6 +3246,7 @@ export async function createFrontendScoutEvidenceTools(input) {
         description: "Commit an origin=scout target-surface fact with complete/blocked discovery status. A complete surface needs a proven target path and no unresolved paths; blocked surfaces name the unresolved paths instead of guessing. Example: {\"completeness\": \"complete\", \"entrypoint\": \"<file>\", \"implementationPaths\": [\"<dir or file>\"], \"testPaths\": [\"<file>\"], \"allowedPathConflicts\": [], \"unresolvedPaths\": []}",
         promptSnippet: "Commit an origin=scout target-surface fact.",
         parameters: Type.Object({
+            scopeId: Type.Optional(Type.String({ minLength: 1 })),
             completeness: scoutCompleteness,
             entrypoint: optionalString,
             routeOrMount: optionalString,
@@ -2215,6 +3257,8 @@ export async function createFrontendScoutEvidenceTools(input) {
             unresolvedPaths: stringArray,
         }, { additionalProperties: false }),
         async execute(_toolCallId, params) {
+            if (input.requirementIds && (!activeScope?.length || params.scopeId !== scopeIdentity(activeScope)))
+                return receipt({ ok: false, code: "FRONTEND_INPUT_SCOPE_VIOLATION", error: "Use exactly the runtime Scout scopeId; discovery may complete only the supplied obligations" });
             const implementationPaths = params?.implementationPaths ?? [];
             const testPaths = params?.testPaths ?? [];
             const pathEvidence = await enrichScoutPathEvidence([
@@ -2222,7 +3266,7 @@ export async function createFrontendScoutEvidenceTools(input) {
                 ...implementationPaths,
                 ...testPaths,
             ]);
-            const result = await adoptScoutFact("target-surface", {
+            const surface = {
                 kind: "target-surface",
                 origin: "scout",
                 completeness: params?.completeness ?? "blocked",
@@ -2235,7 +3279,27 @@ export async function createFrontendScoutEvidenceTools(input) {
                 unresolvedPaths: params?.unresolvedPaths ?? [],
                 ...(hasSourceDeclarations ? { sourceDeclaredPaths } : {}),
                 ...(pathEvidence.length > 0 ? { pathEvidence } : {}),
-            });
+            };
+            if (activeScope) {
+                const { readCompleteScoutTargetSurface } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+                if (surface.completeness === "complete") {
+                    const check = readCompleteScoutTargetSurface([{ phase: "committed", fact: surface }]);
+                    if (!check.ok)
+                        return receipt({ ok: false, code: "SCOUT_SCOPE_INCOMPLETE", error: check.reason });
+                }
+                const saved = await adoptScoutFact("scout-scope", { kind: "scout-scope", origin: "scout", id: params.scopeId, requirementIds: activeScope, surface });
+                if (!saved.ok)
+                    return receipt(saved);
+                const current = latestScopes();
+                if (input.requirementIds?.every(id => current.get(id)?.surface?.completeness === "complete")) {
+                    const surfaces = [...new Set(input.requirementIds.map(id => current.get(id)))].map(f => f.surface);
+                    const union = (key) => [...new Set(surfaces.flatMap(s => Array.isArray(s[key]) ? s[key] : []))];
+                    const entries = [...new Set(surfaces.map(s => String(s.entrypoint ?? "")).filter(Boolean))];
+                    return receipt(await adoptScoutFact("target-surface", { kind: "target-surface", origin: "scout", completeness: "complete", entrypoint: entries[0] ?? "", implementationPaths: [...new Set([...entries, ...union("implementationPaths")])], testPaths: union("testPaths"), allowedPathConflicts: union("allowedPathConflicts"), unresolvedPaths: union("unresolvedPaths"), routeOrMount: [...new Set(surfaces.map(s => s.routeOrMount).filter(Boolean))].join("\n"), dataSource: [...new Set(surfaces.map(s => s.dataSource).filter(Boolean))].join("\n"), pathEvidence: surfaces.flatMap(s => s.pathEvidence ?? []), ...(hasSourceDeclarations ? { sourceDeclaredPaths } : {}) }));
+                }
+                return receipt(saved);
+            }
+            const result = await adoptScoutFact("target-surface", surface);
             return receipt(result);
         },
     });
@@ -2259,12 +3323,53 @@ export async function createFrontendScoutEvidenceTools(input) {
             return receipt(result);
         },
     });
+    const durable = await createDurableFrontendTools({
+        file: path.join(input.runDir, input.nodeId, "scout-typed-facts.jsonl"), attemptId, store: input.store,
+        setWorkingStore: next => { store = next; }, binding: { requirementIds: input.requirementIds, sourceDeclaredPaths: input.sourceDeclaredPaths, sourceDigest: input.sourceDigest, workspaceRoot: input.workspaceRoot },
+        tools: [recordTargetSurfaceTool, recordDesignEvidenceTool],
+        validateRestored: async (records) => {
+            if (!input.workspaceRoot)
+                return;
+            for (const record of records) {
+                const evidence = record.fact.kind === "scout-scope" ? record.fact.surface?.pathEvidence : record.fact.pathEvidence;
+                if (!Array.isArray(evidence))
+                    continue;
+                for (const previous of evidence) {
+                    if (!isRecordObject(previous) || typeof previous.path !== "string")
+                        throw Error("scout path evidence is malformed");
+                    const current = (await enrichScoutPathEvidence([previous.path]))[0];
+                    if (!current || current.sha256 !== previous.sha256 || current.fresh !== previous.fresh)
+                        throw Error(`scout evidence drift: ${previous.path}; refresh Scout before reusing facts`);
+                }
+            }
+        },
+    });
     return {
-        customTools: [recordTargetSurfaceTool, recordDesignEvidenceTool],
-        flush: async () => {
-            const committed = readCommittedEvents(store, attemptId);
-            await writeTypedEventStoreJsonl(path.join(input.runDir, input.nodeId, "scout-typed-facts.jsonl"), committed);
+        ...durable,
+        adoptCommittedFacts: async (records) => durable.commitExternal(async () => {
+            for (const record of records) {
+                if (record.phase !== "committed")
+                    continue;
+                const fact = record.fact;
+                if (!fact || typeof fact !== "object" || Array.isArray(fact))
+                    continue;
+                const result = await adoptScoutFact(typeof fact.kind === "string"
+                    ? fact.kind
+                    : "scout-fact", fact);
+                if (!result.ok) {
+                    throw new Error(`frontend scout shard fact merge failed: ${result.error}`);
+                }
+            }
+        }),
+        setActiveScope: ids => {
+            if (!ids.length || ids.some(id => !input.requirementIds?.includes(id)))
+                throw Error("FRONTEND_INPUT_SCOPE_VIOLATION");
+            activeScope = [...new Set(ids)];
+            return scopeIdentity(activeScope);
         },
+        completedRequirementIds: () => new Set([...latestScopes()].filter(([, fact]) => fact.surface?.completeness === "complete").map(([id]) => id)),
+        completedScopeFacts: () => [...new Set(latestScopes().values())].filter(f => f.surface?.completeness === "complete"),
+        committedFacts: () => readCommittedEvents(store, attemptId),
     };
 }
 export function buildDagPiUserMessage(task, persona, step) {
@@ -2515,15 +3620,14 @@ async function runFrontendReviewTerminalShadow(input) {
         return input.mapped;
     const { compareTypedReviewToLegacyJsonVerdict } = await import("../workflows/dag/frontend-review-context.js");
     const { parseJsonReviewVerdict } = await import("../workflows/dag/output-protocol.js");
-    const sessionEventsPath = path.join(input.meta.runDir, input.task.id, "session-events.jsonl");
     let typedKinds = [];
     try {
-        const content = await readFile(sessionEventsPath, "utf8");
-        typedKinds = scanReviewTerminalKindsFromSessionEvents(content);
+        await input.tools?.flush();
+        input.tools?.scopeProtocol?.assertComplete();
+        typedKinds = input.tools?.scopeProtocol?.committedFacts().filter(r => ["approve_review", "request_review_changes"].includes(String(r.fact.kind))).map(r => String(r.fact.kind)) ?? [];
     }
-    catch {
-        // Missing/unreadable session log → fail-closed at zero terminal facts.
-        typedKinds = [];
+    catch (error) {
+        return { ...input.mapped, ok: false, failureCategory: "frontend-ledger-invalid", stderr: `FRONTEND_REVIEW_SCOPE_INCOMPLETE: ${error instanceof Error ? error.message : String(error)}` };
     }
     let legacyVerdict;
     try {
@@ -2549,13 +3653,7 @@ async function runFrontendReviewTerminalShadow(input) {
             reason: `typed review equivalence comparison crashed: ${error instanceof Error ? error.message : String(error)}`,
         };
     }
-    // Audit-only flush + artifact. Neither blocks the node.
-    try {
-        await input.tools?.flush?.();
-    }
-    catch {
-        // best-effort
-    }
+    // The durable ledger was validated above; this artifact is audit-only.
     try {
         await writeDagNodeJsonArtifact(input.meta.runDir, input.task.id, "fact-review-status.json", {
             schemaVersion: 1,
@@ -2597,23 +3695,16 @@ async function runFrontendDesignTerminalShadow(input) {
     // diagnosed as an omitted terminal tool call.
     if (!input.mapped.ok)
         return input.mapped;
-    const sessionEventsPath = path.join(input.meta.runDir, input.task.id, "session-events.jsonl");
     let typedKinds = [];
     try {
-        const content = await readFile(sessionEventsPath, "utf8");
-        typedKinds = scanDesignTerminalKindsFromSessionEvents(content);
-    }
-    catch {
-        // Missing/unreadable session log → fail-closed at zero terminal facts.
-        typedKinds = [];
-    }
-    // Audit-only flush + artifact. Neither blocks the node.
-    try {
-        await input.tools?.flush?.();
+        await input.tools?.flush();
+        input.tools?.scopeProtocol?.assertComplete();
+        typedKinds = input.tools?.scopeProtocol?.committedFacts().filter(r => ["approve_design", "request_design_changes"].includes(String(r.fact.kind))).map(r => String(r.fact.kind)) ?? [];
     }
-    catch {
-        // best-effort
+    catch (error) {
+        return { ...input.mapped, ok: false, failureCategory: "frontend-ledger-invalid", stderr: `FRONTEND_REVIEW_SCOPE_INCOMPLETE: ${error instanceof Error ? error.message : String(error)}` };
     }
+    // The durable ledger was validated above; this artifact is audit-only.
     try {
         await writeDagNodeJsonArtifact(input.meta.runDir, input.task.id, "fact-design-status.json", {
             schemaVersion: 1,
@@ -2646,6 +3737,7 @@ const FRONTEND_PLAN_SEGMENTS = [
         id: "coverage",
         toolNames: new Set([
             "record_plan_requirement",
+            "record_plan_group_coverage",
             "record_plan_verification_target",
             "record_plan_evidence_gap",
             "adopt_staged_fact",
@@ -2653,19 +3745,31 @@ const FRONTEND_PLAN_SEGMENTS = [
         instruction: [
             "PLAN PHASE — requirement coverage only.",
             "Your ONLY job: for every frozen requirement, emit record_plan_requirement (requirement → implementation files) and record_plan_verification_target facts (verification target bound to requirement ids and files). Group related requirements under one non-static behavior target when one observable test behavior proves them together; do not mechanically create one target per requirement. A non-static target id is the stable machine trace token; never submit prose as a symbol. Do NOT record components, UI states, mock, dependency, or routes — a follow-up session owns those.",
+            "A coverage session is complete only when EVERY requirement assigned to this session (the full inventory, or the exact COVERAGE BATCH / shard list when present) has committed coverage facts: a record_plan_requirement entry plus verification targets, or a committed evidence gap. Keep committing in batches of up to 4 record_* calls per assistant message until then; do not write a concluding summary while any assigned requirement is still uncommitted — an early stop strands the remainder into a MISSING-FACT repair session and doubles the sessions needed.",
             "If a requirement genuinely cannot have a verification target, record a non-empty record_plan_evidence_gap. Do not call finalize_plan; it is not available in this phase.",
         ].join(" "),
     },
+    {
+        id: "ux-registry",
+        toolNames: new Set(["record_state_registry", "adopt_staged_fact"]),
+        instruction: [
+            "PLAN PHASE — global UX vocabulary.",
+            "Bootstrap the global UX vocabulary from the execution-group index and authoritative declared states. This is navigation, not permission to decide unseen behavior. Detailed complete scopes may extend the registry with replace:true while preserving live names. UI states use declaredUiStates ids when present. Interaction names are stable kebab-case behavior domains; merge requirements that describe the same behavior instead of renaming it per AC slice. Empty arrays explicitly declare that no UX vocabulary applies. Do not record component choices or state-flow details in this phase.",
+            "Do not call finalize_plan; it is not available in this phase.",
+        ].join(" "),
+    },
     {
         id: "ux-local",
         toolNames: new Set([
+            "record_state_registry",
             "record_component_choice",
             "record_state_flow",
+            "record_plan_verification_target",
             "adopt_staged_fact",
         ]),
         instruction: [
-            "PLAN PHASE — requirement-local UX decisions.",
-            "Requirements and verification targets are already committed in the ledger (do NOT re-record them; duplicates are rejected). For ONLY this requirement slice, record component choices and UI state flow. Keep these facts for this slice together. Cross-cutting data flow belongs to the global Mock/data phase. Do not record routes, Mock/API policy, dependencies, or design deviations here.",
+            "PLAN PHASE — global UX decisions.",
+            "Requirements and verification targets are already committed in the ledger; do not re-record unchanged facts. Review the current complete execution-group scope and the committed global UX registry together, then record each component choice, UI state and interaction exactly once. Bind each applicable state to its verificationTargetIds; the runtime derives the reverse VT.uiStates relation. If a VT requires correction, record_plan_verification_target with replace:true is available after declaring its states; preserve its requirement coverage. Multiple requirements describing one behavior share one registry name and state-flow entry; never repeat or rename it per AC. Cross-cutting data flow belongs to the global Mock/data phase. Do not record routes, Mock/API policy, dependencies, or design deviations here.",
             "Do not call finalize_plan; it is not available in this phase.",
         ].join(" "),
     },
@@ -2679,7 +3783,7 @@ const FRONTEND_PLAN_SEGMENTS = [
     },
     {
         id: "global-mock-data",
-        toolNames: new Set(["record_data_flow", "record_mock_api", "adopt_staged_fact"]),
+        toolNames: new Set(["record_data_flow", "record_mock_api", "record_mock_endpoint", "adopt_staged_fact"]),
         instruction: [
             "PLAN PHASE — global Mock/API and data policy.",
             "Record the cross-cutting interaction-to-endpoint data flow and Mock/API strategy only. Keep this decision set separate from route, component, state, dependency, and deviation facts. Do not call finalize_plan.",
@@ -2702,196 +3806,6 @@ const FRONTEND_PLAN_SEGMENTS = [
         ].join(" "),
     },
 ];
-function committedFactFromPlanRecord(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return undefined;
-    const record = value;
-    if (record.phase !== undefined && record.phase !== "committed")
-        return undefined;
-    const fact = record.fact;
-    return fact && typeof fact === "object" && !Array.isArray(fact)
-        ? fact
-        : typeof record.kind === "string"
-            ? record
-            : undefined;
-}
-function planFactStringList(value) {
-    if (!Array.isArray(value))
-        return [];
-    return value.filter((item) => typeof item === "string" && item.trim().length > 0);
-}
-function planFactScopeIntersects(fact, requirementIds) {
-    return planFactStringList(fact.scopeRequirementIds).some((id) => requirementIds.has(id));
-}
-/** Apply state-flow replacement/removal semantics exactly as the plan compiler does. */
-function collectCanonicalStateFlowNames(committedFacts) {
-    const uiStateNames = new Set();
-    const interactionNames = new Set();
-    for (const value of committedFacts) {
-        const fact = committedFactFromPlanRecord(value);
-        if (!fact || fact.origin !== "plan" || fact.kind !== "state-flow")
-            continue;
-        for (const name of planFactStringList(fact.removeUiStateNames)) {
-            uiStateNames.delete(name);
-        }
-        for (const name of planFactStringList(fact.removeInteractionNames)) {
-            interactionNames.delete(name);
-        }
-        for (const state of Array.isArray(fact.uiStates) ? fact.uiStates : []) {
-            if (!state || typeof state !== "object" || Array.isArray(state))
-                continue;
-            const name = state.name;
-            if (typeof name === "string" && name.trim())
-                uiStateNames.add(name);
-        }
-        for (const interaction of Array.isArray(fact.interactions)
-            ? fact.interactions
-            : []) {
-            if (!interaction || typeof interaction !== "object" || Array.isArray(interaction)) {
-                continue;
-            }
-            const name = interaction.name;
-            if (typeof name === "string" && name.trim())
-                interactionNames.add(name);
-        }
-    }
-    return { uiStateNames, interactionNames };
-}
-/** Compute the authoritative coverage queue from the committed plan ledger. */
-export function collectFrontendPlanMissingFacts(input) {
-    const requirements = new Map();
-    const standaloneEvidenceGaps = new Set();
-    const verificationTargetIds = new Set();
-    const verificationTargetRequirements = new Map();
-    for (const value of input.committedFacts) {
-        const fact = committedFactFromPlanRecord(value);
-        if (!fact || fact.origin !== "plan")
-            continue;
-        if (fact.kind === "plan-requirement" && fact.entry && typeof fact.entry === "object") {
-            const entry = fact.entry;
-            if (typeof entry.id === "string" && entry.id.trim())
-                requirements.set(entry.id, entry);
-        }
-        if (fact.kind === "plan-verification-target" && fact.entry && typeof fact.entry === "object") {
-            const entry = fact.entry;
-            const id = entry.id;
-            if (typeof id === "string" && id.trim()) {
-                verificationTargetIds.add(id);
-                verificationTargetRequirements.set(id, new Set(Array.isArray(entry.requirementIds)
-                    ? entry.requirementIds.filter((value) => typeof value === "string")
-                    : []));
-            }
-        }
-        if (fact.kind === "plan-evidence-gap" && fact.entry && typeof fact.entry === "object") {
-            const entry = fact.entry;
-            const requirementId = entry.requirementId;
-            const description = entry.description;
-            if (typeof requirementId === "string" && requirementId.trim() && typeof description === "string" && description.trim()) {
-                standaloneEvidenceGaps.add(requirementId);
-            }
-        }
-    }
-    const missing = [];
-    for (const id of input.requirementIds) {
-        const entry = requirements.get(id);
-        if (!entry) {
-            missing.push({
-                kind: "plan-requirement",
-                id,
-                requirementIds: [id],
-                reason: `requirement ${id} has no committed plan-requirement fact`,
-            });
-            continue;
-        }
-        const targetIds = Array.isArray(entry.verificationTargetIds)
-            ? entry.verificationTargetIds.filter((value) => typeof value === "string" && value.trim().length > 0)
-            : [];
-        const gap = entry.evidenceGap && typeof entry.evidenceGap === "object"
-            ? entry.evidenceGap
-            : undefined;
-        const hasEvidenceGap = (typeof gap?.description === "string" && gap.description.trim().length > 0) ||
-            standaloneEvidenceGaps.has(id);
-        if (targetIds.length === 0 && !hasEvidenceGap) {
-            missing.push({
-                kind: "plan-verification-target",
-                requirementIds: [id],
-                reason: `requirement ${id} declares neither a verification target nor a non-empty evidenceGap`,
-            });
-            continue;
-        }
-        for (const targetId of targetIds) {
-            if (!verificationTargetIds.has(targetId) ||
-                !verificationTargetRequirements.get(targetId)?.has(id)) {
-                missing.push({
-                    kind: "plan-verification-target",
-                    id: targetId,
-                    requirementIds: [id],
-                    reason: `requirement ${id} references verification target ${targetId}, but that target is not committed`,
-                });
-            }
-        }
-    }
-    return missing;
-}
-/** Completeness checks for phases whose facts are committed incrementally. */
-export function collectFrontendPlanPhaseMissingFacts(input) {
-    const facts = input.committedFacts
-        .map(committedFactFromPlanRecord)
-        .filter((fact) => Boolean(fact && fact.origin === "plan"));
-    if (input.phase === "ux-local") {
-        const needsUx = input.requirementIds.some((id) => input.behaviorRequiredRequirementIds?.includes(id));
-        if (!needsUx)
-            return [];
-        const requirementSlice = new Set(input.requirementIds);
-        const scopedFacts = facts.filter((fact) => planFactScopeIntersects(fact, requirementSlice));
-        const hasChoice = scopedFacts.some((fact) => fact.kind === "component-choice" &&
-            Array.isArray(fact.uiComponentChoices) &&
-            fact.uiComponentChoices.length > 0);
-        const canonicalStateFlow = collectCanonicalStateFlowNames(scopedFacts);
-        const hasStateFlow = canonicalStateFlow.uiStateNames.size > 0 ||
-            canonicalStateFlow.interactionNames.size > 0;
-        const missing = [];
-        if (!hasChoice) {
-            missing.push({
-                kind: "component-choice",
-                requirementIds: [...input.requirementIds],
-                reason: "behaviour-required UX slice has no committed component-choice fact",
-            });
-        }
-        if (!hasStateFlow) {
-            missing.push({
-                kind: "state-flow",
-                requirementIds: [...input.requirementIds],
-                reason: "behaviour-required UX slice has no committed state-flow fact",
-            });
-        }
-        return missing;
-    }
-    const hasMockApi = facts.some((fact) => fact.kind === "mock-api");
-    const liveInteractions = collectCanonicalStateFlowNames(input.committedFacts).interactionNames;
-    const coveredInteractions = new Set(facts
-        .filter((fact) => fact.kind === "data-flow")
-        .flatMap((fact) => planFactStringList(fact.interactions)));
-    const missing = [];
-    if (!hasMockApi) {
-        missing.push({
-            kind: "mock-api",
-            requirementIds: [...input.requirementIds],
-            reason: "global Mock/data phase has no committed mock-api fact",
-        });
-    }
-    for (const interaction of liveInteractions) {
-        if (coveredInteractions.has(interaction))
-            continue;
-        missing.push({
-            kind: "data-flow",
-            id: interaction,
-            requirementIds: [...input.requirementIds],
-            reason: `interaction ${interaction} has no committed data-flow fact`,
-        });
-    }
-    return missing;
-}
 /** Estimate calls conservatively: requirement + one VT, with a second VT
  * reserved for behaviour-required requirements. Explicit declarations win. */
 export function estimateFrontendPlanRequirementRecordCalls(fact) {
@@ -2932,28 +3846,48 @@ export function batchFrontendPlanRequirements(input) {
     return batches;
 }
 const FRONTEND_PLAN_COVERAGE_MAX_RECORD_CALLS = 10;
-const FRONTEND_PLAN_UX_LOCAL_MAX_RECORD_CALLS = 6;
-// A large requirement set creates both coverage and UX-local shards. Keep a
-// safety bound, but do not let the old 32-session ceiling skip finalize for a
-// legitimate large plan.
+const FRONTEND_PLAN_COVERAGE_MAX_CONCURRENCY = 4;
+// A single registry owns global names; large UX work uses bounded serial
+// scopes against that registry. Keep a safety bound for adaptive retries
+// without letting the old 32-session ceiling skip finalize.
 const FRONTEND_PLAN_BATCH_MAX_SESSIONS = 128;
 const FRONTEND_PLAN_SMALL_MAX_REQUIREMENTS = 8;
 const FRONTEND_PLAN_SMALL_MAX_ESTIMATED_CALLS = 24;
-function compactPromptString(value, maxChars) {
-    if (typeof value !== "string" || value.trim().length === 0)
-        return undefined;
-    const normalized = value.trim();
-    return normalized.length <= maxChars
-        ? normalized
-        : `${normalized.slice(0, maxChars - 1)}…`;
+async function mapWithConcurrency(items, limit, worker, shouldReduceConcurrency) {
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    let concurrency = Math.max(1, limit);
+    const running = new Map();
+    try {
+        while (nextIndex < items.length || running.size > 0) {
+            while (nextIndex < items.length && running.size < concurrency) {
+                const index = nextIndex++;
+                running.set(index, worker(items[index], index).then(result => ({ index, result })));
+            }
+            const { index, result } = await Promise.race(running.values());
+            running.delete(index);
+            results[index] = result;
+            // Drain existing work; only pending shards use the reduced cap.
+            // Failed shards remain failed and receive no extra retry allowance.
+            if (shouldReduceConcurrency(result))
+                concurrency = Math.max(1, Math.floor(concurrency / 2));
+        }
+    }
+    catch (error) {
+        await Promise.allSettled(running.values());
+        throw error;
+    }
+    return results;
 }
-function compactPromptStringArray(value, maxEntries = 12, maxChars = 180) {
+function compactPromptString(value, _maxChars) {
+    return typeof value === "string" && value.trim().length ? value.trim() : undefined;
+}
+function compactPromptStringArray(value, _maxEntries = 12, maxChars = 180) {
     if (!Array.isArray(value))
         return [];
     return value
         .map((item) => compactPromptString(item, maxChars))
-        .filter((item) => item !== undefined)
-        .slice(0, maxEntries);
+        .filter((item) => item !== undefined);
 }
 function countFrontendPlanTargetSurfaces(basePrompt) {
     const match = /<frontend_plan_input>[\s\S]*?<\/frontend_plan_input>/.exec(basePrompt);
@@ -3026,7 +3960,7 @@ export function compactFrontendPlanPromptForRequirementSlice(basePrompt, require
         }
     }
     if (!payload || !Array.isArray(payload.requirements))
-        return basePrompt;
+        throw Error("FRONTEND_INPUT_INVALID: plan inventory is not parseable");
     const requirementsById = new Map();
     for (const value of payload.requirements) {
         if (!value || typeof value !== "object" || Array.isArray(value))
@@ -3038,7 +3972,7 @@ export function compactFrontendPlanPromptForRequirementSlice(basePrompt, require
     }
     const requirements = slice.map((id) => requirementsById.get(id));
     if (requirements.some((requirement) => requirement === undefined)) {
-        return basePrompt;
+        throw Error(`FRONTEND_INPUT_SCOPE_MISSING: ${slice.filter(id => !requirementsById.has(id)).join(", ")}`);
     }
     const compactRequirements = requirements.map((requirement) => ({
         id: compactPromptString(requirement.id, 80),
@@ -3055,26 +3989,28 @@ export function compactFrontendPlanPromptForRequirementSlice(basePrompt, require
                 if (!value || typeof value !== "object" || Array.isArray(value))
                     return [];
                 const target = value;
-                const targetRequirementIds = compactPromptStringArray(target.requirementIds, 20, 80);
+                if (options.verificationTargetIds && !options.verificationTargetIds.includes(String(target.id)))
+                    return [];
+                const targetRequirementIds = planFactStringList(target.requirementIds);
                 const relatedRequirementIds = targetRequirementIds.filter((id) => sliceSet.has(id));
                 if (relatedRequirementIds.length === 0)
                     return [];
                 return [
                     {
-                        ...(compactPromptString(target.id, 80)
-                            ? { id: compactPromptString(target.id, 80) }
+                        ...(typeof target.id === "string"
+                            ? { id: target.id }
                             : {}),
-                        ...(compactPromptString(target.type, 40)
-                            ? { type: compactPromptString(target.type, 40) }
+                        ...(typeof target.commandId === "string"
+                            ? { commandId: target.commandId }
                             : {}),
                         ...(compactPromptString(target.commandLabel, 180)
                             ? { commandLabel: compactPromptString(target.commandLabel, 180) }
                             : {}),
-                        ...(compactPromptString(target.file, 180)
-                            ? { file: compactPromptString(target.file, 180) }
+                        ...(typeof target.file === "string"
+                            ? { file: target.file }
                             : {}),
                         requirementIds: relatedRequirementIds,
-                        uiStates: compactPromptStringArray(target.uiStates, 12, 100),
+                        uiStates: planFactStringList(target.uiStates),
                     },
                 ];
             })
@@ -3121,8 +4057,36 @@ export function compactFrontendPlanPromptForRequirementSlice(basePrompt, require
                 }];
         })
         : [];
+    const compactDeclaredUiStates = Array.isArray(payload.declaredUiStates)
+        ? payload.declaredUiStates.flatMap((value) => {
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                return [];
+            const state = value;
+            const id = typeof state.id === "string" ? state.id : undefined;
+            if (!id)
+                return [];
+            return [{
+                    id,
+                    ...(compactPromptString(state.trigger, 180)
+                        ? { trigger: compactPromptString(state.trigger, 180) }
+                        : {}),
+                    ...(compactPromptString(state.observableOutcome, 240)
+                        ? { observableOutcome: compactPromptString(state.observableOutcome, 240) }
+                        : {}),
+                }];
+        })
+        : [];
+    const committedUx = payload.committedUx &&
+        typeof payload.committedUx === "object" &&
+        !Array.isArray(payload.committedUx)
+        ? payload.committedUx
+        : undefined;
     const compactPayload = {
+        inputManifest: { ...projectFrontendInputScope({ ...payload, requirements: [...requirementsById.values()] }, slice).inputManifest, semantics: options.includeRequirementText === false ? "navigation-only" : "full" },
+        constraints: payload.constraints,
+        executionGroups: Array.isArray(payload.executionGroups) ? payload.executionGroups.filter(g => isRecordObject(g) && Array.isArray(g.requirementIds) && g.requirementIds.some(id => slice.includes(String(id)))) : [],
         requirements: compactRequirements,
+        requiredDeliverables: Array.isArray(payload.requiredDeliverables) ? payload.requiredDeliverables : [],
         ...(compactTargetSurface.length > 0
             ? { targetSurface: compactTargetSurface }
             : {}),
@@ -3132,6 +4096,17 @@ export function compactFrontendPlanPromptForRequirementSlice(basePrompt, require
         ...(compactDesignEvidence.length > 0
             ? { designEvidence: compactDesignEvidence }
             : {}),
+        ...(compactDeclaredUiStates.length > 0
+            ? { declaredUiStates: compactDeclaredUiStates }
+            : {}),
+        ...(committedUx
+            ? {
+                committedUx: {
+                    uiStateNames: compactPromptStringArray(committedUx.uiStateNames, 40, 100),
+                    interactionNames: compactPromptStringArray(committedUx.interactionNames, 60, 120),
+                },
+            }
+            : {}),
     };
     const compactBlock = [
         "<frontend_plan_input>",
@@ -3187,9 +4162,9 @@ function compactFrontendPlanLedgerContext(input) {
             compactFacts.push({
                 kind: fact.kind,
                 entry: {
-                    id: compactPromptString(entry.id, 80),
-                    implementationTargets: compactPromptStringArray(entry.implementationTargets, 12, 180),
-                    verificationTargetIds: compactPromptStringArray(entry.verificationTargetIds, 12, 80),
+                    id: entry.id,
+                    implementationTargets: planFactStringList(entry.implementationTargets).slice(0, 12),
+                    verificationTargetIds: planFactStringList(entry.verificationTargetIds).slice(0, 12),
                     ...(compactPromptString(entry.expectedOutcome, 240)
                         ? { expectedOutcome: compactPromptString(entry.expectedOutcome, 240) }
                         : {}),
@@ -3203,18 +4178,19 @@ function compactFrontendPlanLedgerContext(input) {
         if (fact.kind === "plan-verification-target") {
             if (!entry)
                 continue;
-            const requirementIds = compactPromptStringArray(entry.requirementIds, 20, 80);
-            if (!requirementIds.some((id) => slice.has(id)))
+            // Scope against the complete canonical binding before compacting.
+            // A shared target may bind a late requirement beyond the preview cap.
+            const requirementIds = planFactStringList(entry.requirementIds).filter((id) => slice.has(id));
+            if (requirementIds.length === 0)
                 continue;
             compactFacts.push({
                 kind: fact.kind,
                 entry: {
-                    id: compactPromptString(entry.id, 80),
-                    type: compactPromptString(entry.type, 40),
-                    commandLabel: compactPromptString(entry.commandLabel, 180),
-                    file: compactPromptString(entry.file, 180),
+                    id: entry.id,
+                    commandId: entry.commandId,
+                    file: entry.file,
                     requirementIds,
-                    uiStates: compactPromptStringArray(entry.uiStates, 12, 100),
+                    uiStates: planFactStringList(entry.uiStates).slice(0, 12),
                 },
             });
             continue;
@@ -3229,18 +4205,28 @@ function compactFrontendPlanLedgerContext(input) {
                             purpose: compactPromptString(item.purpose, 120),
                             component: compactPromptString(item.component, 120),
                             decision: compactPromptString(item.decision, 40),
+                            covers: compactPromptStringArray(item.covers, 40, 120),
+                            evidencePath: compactPromptString(item.evidencePath, 180),
                         }];
-                }).slice(0, 24)
+                })
                 : [];
             if (choices.length > 0)
                 compactFacts.push({ kind: fact.kind, uiComponentChoices: choices });
             continue;
         }
+        if (fact.kind === "state-registry") {
+            compactFacts.push({
+                kind: fact.kind,
+                uiStateNames: planFactStringList(fact.uiStateNames).slice(0, 40),
+                interactionNames: planFactStringList(fact.interactionNames).slice(0, 60),
+            });
+            continue;
+        }
         if (fact.kind === "state-flow") {
             compactFacts.push({
                 kind: fact.kind,
-                uiStates: Array.isArray(fact.uiStates) ? fact.uiStates.slice(0, 24) : [],
-                interactions: Array.isArray(fact.interactions) ? fact.interactions.slice(0, 24) : [],
+                uiStates: Array.isArray(fact.uiStates) ? fact.uiStates : [],
+                interactions: Array.isArray(fact.interactions) ? fact.interactions : [],
                 removeUiStateNames: compactPromptStringArray(fact.removeUiStateNames, 24, 100),
                 removeInteractionNames: compactPromptStringArray(fact.removeInteractionNames, 24, 100),
             });
@@ -3263,7 +4249,7 @@ function compactFrontendPlanLedgerContext(input) {
                 mockApi: {
                     strategy: compactPromptString(mockApi.strategy, 40),
                     activation: compactPromptString(mockApi.activation, 180),
-                    endpoints: Array.isArray(mockApi.endpoints) ? mockApi.endpoints.slice(0, 24) : [],
+                    endpoints: Array.isArray(mockApi.endpoints) ? mockApi.endpoints : [],
                 },
             });
             continue;
@@ -3284,63 +4270,379 @@ function compactFrontendPlanLedgerContext(input) {
         return "";
     const priorityFacts = compactFacts.filter((fact) => fact.kind === "plan-requirement" || fact.kind === "plan-verification-target");
     const otherFacts = compactFacts.filter((fact) => fact.kind !== "plan-requirement" && fact.kind !== "plan-verification-target");
+    let previewBytes = 0;
     const boundedFacts = [
         ...priorityFacts.slice(0, 64),
         ...otherFacts.slice(-32),
-    ].slice(0, 96);
+    ].slice(0, 96).filter(fact => {
+        const bytes = Buffer.byteLength(JSON.stringify(fact));
+        if (previewBytes + bytes > 24_000)
+            return false;
+        previewBytes += bytes;
+        return true;
+    });
     return [
         "<frontend_plan_ledger>",
-        "Committed plan facts from earlier sessions. Treat these as authoritative; correct them only with the allowed replacement/removal fields.",
+        "Preview of committed plan facts; not a replacement payload. Fields and lists may be omitted or shortened. Use read_plan_facts with kind, entryId/eventId and optional field to retrieve complete values in bounded pages before corrections; preserve all other bindings. Absence from this preview is not absence from the ledger.",
+        JSON.stringify({ complete: false, matchingFacts: compactFacts.length, omittedFacts: compactFacts.length - boundedFacts.length }),
         JSON.stringify(boundedFacts),
         "</frontend_plan_ledger>",
     ].join("\n");
 }
-export async function runFrontendPlanSegmentedSessions(input) {
-    const queue = [];
-    const coverageSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "coverage");
-    const uxSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "ux-local");
-    const globalMockDataSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "global-mock-data");
-    const finalizeSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "finalize");
-    const allRequirementIds = input.requirementIds ?? [];
-    const buildPhasePrompt = (segment, missing = []) => {
-        const compact = allRequirementIds.length > 0
-            ? compactFrontendPlanPromptForRequirementSlice(input.basePrompt, allRequirementIds, {
-                includeRequirementText: segment.id === "global-mock-data" || segment.id === "global-dependency-deviation",
-                includeVerificationTargets: false,
-                includeDesignEvidence: segment.id === "global-dependency-deviation" || segment.id === "finalize",
-                includeChecklist: false,
-            })
-            : input.basePrompt;
-        const kinds = segment.id === "global-route"
-            ? ["target-surface"]
-            : segment.id === "global-mock-data"
-                ? ["plan-requirement", "plan-verification-target", "state-flow", "data-flow", "mock-api"]
-                : segment.id === "global-dependency-deviation"
-                    ? ["dependency", "design-deviation"]
-                    : ["plan-requirement", "plan-verification-target", "component-choice", "state-flow", "data-flow", "mock-api", "design-deviation", "dependency", "target-surface"];
-        const ledger = input.committedFacts
-            ? compactFrontendPlanLedgerContext({
-                committedFacts: input.committedFacts(),
-                requirementIds: allRequirementIds,
-                kinds,
-            })
-            : "";
-        return [
-            compact,
-            segment.instruction,
-            ledger,
-            ...(missing.length > 0
-                ? [
-                    "MISSING-FACT QUEUE: repair ONLY these items, then re-check the phase:",
-                    ...missing.map((item) => `- ${item.kind}${item.id ? ` ${item.id}` : ""} for ${item.requirementIds.join(", ")}: ${item.reason}`),
-                ]
-                : []),
-        ].filter(Boolean).join("\n\n");
+export async function runFrontendReviewSegmentedSessions(input) {
+    const protocol = input.tools.scopeProtocol;
+    const terminalKinds = input.phase === "review" ? ["approve_review", "request_review_changes"] : ["approve_design", "request_design_changes"];
+    const terminal = () => protocol.committedFacts().some(r => terminalKinds.includes(String(r.fact.kind)));
+    const targetBytes = input.sessionOptions.frontendExecutionPolicy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES;
+    const queue = packFrontendInputUnits(input.inventory.scopes.filter(s => !protocol.completedScopeIds().has(s.id)), { targetBytes, maxUnits: input.sessionOptions.frontendExecutionPolicy?.maxScopeUnits }).map(scopes => ({ scopes, repairs: 0 }));
+    if (!queue.length)
+        queue.push({ scopes: [], repairs: 0 });
+    let calls = 0;
+    let last = { ok: true, assistantText: "", command: [], durationMs: 0, exitCode: 0, failureCategory: "success", modelDisplay: "unknown", parsedEvents: 0, stderr: "", stdout: "", timedOut: false, attemptedModels: [], fallbackUsed: false, tokensUsed: 0 };
+    for (let index = 0; index < queue.length; index++) {
+        await input.tools.flush();
+        await input.inventory.validate();
+        if (terminal()) {
+            protocol.assertComplete();
+            return last;
+        }
+        const item = queue[index];
+        const scopes = item.scopes.filter(s => !protocol.completedScopeIds().has(s.id));
+        protocol.setActiveScope(scopes.map(s => s.id));
+        const finalScope = input.inventory.scopes.every(s => protocol.completedScopeIds().has(s.id) || scopes.some(current => current.id === s.id));
+        const customTools = finalScope ? input.customTools : input.customTools.filter(t => !terminalKinds.includes(String(t.name)));
+        const prompt = `${input.basePrompt}\n<frontend_review_scope>\n${JSON.stringify({ semantics: "full", inventoryDigest: input.inventory.digest, scopes, previouslyCompleted: [...protocol.completedScopeIds()], savedFindings: protocol.committedFacts().filter(r => String(r.fact.kind).endsWith("-finding")).map(r => ({ id: r.fact.id, finding: r.fact.finding })) })}\n</frontend_review_scope>\nReview the complete supplied scopes, saving each finding immediately. Call complete_review_scope for each exact id only after all its independent permissions, thresholds, errors and evidence have been checked. ${finalScope ? "After every scope is complete, make one independent overall approve/request_changes decision; persisted findings cannot be omitted." : "More scopes remain. Do not finalize or reread already completed scopes unless resolving a cross-scope issue."}`;
+        if (Buffer.byteLength(prompt) > targetBytes && scopes.length > 1) {
+            const at = Math.ceil(scopes.length / 2);
+            queue.splice(index, 1, { scopes: scopes.slice(0, at), repairs: 0 }, { scopes: scopes.slice(at), repairs: 0 });
+            index--;
+            continue;
+        }
+        if (++calls > 128)
+            return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "FRONTEND_REVIEW_RECOVERY_EXHAUSTED: session quota reached" };
+        last = await observeFrontendSession({ ...input.observation, phase: `${input.phase}/scope`, scopeIds: scopes.map(s => s.id), prompt, userMessage: input.sessionOptions.userMessage, customTools,
+            artifactPath: input.observation?.artifactPath ? `${input.observation.artifactPath}-${calls}.json` : undefined,
+            committedCount: () => protocol.committedFacts().length, durableCommittedCount: () => protocol.committedFacts().length,
+        }, observer => input.piStepFn({ ...input.sessionOptions, prompt, onAttemptObservation: observer, writerToolPolicy: { requireSdk: true, customTools } }));
+        await input.tools.flush();
+        await input.inventory.validate();
+        if (last.timedOut || /interrupt|termination-unconfirmed|budget_breach/.test(last.failureCategory))
+            return { ...last, ok: false };
+        const capacity = readWriterThinkingExhaustionEvidence(last).stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(last.failureCategory);
+        const missing = scopes.filter(s => !protocol.completedScopeIds().has(s.id));
+        if (capacity && (missing.length || !terminal() && finalScope)) {
+            if (missing.length === 1 && scopes.length === 1 || !missing.length && !scopes.length)
+                return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "FRONTEND_INPUT_UNIT_TOO_LARGE: complete review unit or terminal exhausted" };
+            const at = Math.ceil(missing.length / 2);
+            const smaller = missing.length ? [missing.slice(0, at), missing.slice(at)].filter(s => s.length) : [[]];
+            queue.splice(index, 1, ...smaller.map(scopes => ({ scopes, repairs: 0 })));
+            index--;
+            continue;
+        }
+        if (!last.ok && !capacity)
+            return last;
+        if (missing.length || finalScope && !terminal()) {
+            if (item.repairs >= 1)
+                return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "FRONTEND_REVIEW_SCOPE_INCOMPLETE: required checkpoint or verdict missing" };
+            queue.splice(index, 1, { scopes: missing, repairs: item.repairs + 1 });
+            index--;
+        }
+    }
+    protocol.assertComplete();
+    return terminal() ? { ...last, ok: true, failureCategory: "success" } : { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "FRONTEND_REVIEW_SCOPE_INCOMPLETE: missing independent verdict" };
+}
+export async function runFrontendScoutSegmentedSessions(input) {
+    const inventory = parseFrontendInputBlock(input.basePrompt, "scout");
+    if (!inventory)
+        throw Error("FRONTEND_INPUT_MISSING: Scout compiled inventory unavailable");
+    const units = collectFrontendExecutionGroups(inventory.payload.requirements).map(group => ({ ...group, id: `${group.kind === "unclassified" ? "requirement" : "group"}:${group.id}`, requirements: inventory.payload.requirements.filter(r => group.requirementIds.includes(r.id)) }));
+    const targetBytes = input.sessionOptions.frontendExecutionPolicy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES;
+    const queue = packFrontendInputUnits(units, { targetBytes, maxUnits: input.sessionOptions.frontendExecutionPolicy?.maxScopeUnits }).map(batch => ({ groups: batch, repairs: 0 }));
+    let last = { ok: true, assistantText: "", command: [], durationMs: 0, exitCode: 0, failureCategory: "success", modelDisplay: input.sessionOptions.modelConfig?.model ?? "unknown", parsedEvents: 0, stderr: "", stdout: "", timedOut: false, attemptedModels: [], fallbackUsed: false, tokensUsed: 0 };
+    let calls = 0;
+    for (let index = 0; index < queue.length; index++) {
+        await input.tools.flush();
+        const item = queue[index];
+        const completed = input.tools.completedRequirementIds();
+        const groups = item.groups.filter(g => g.requirementIds.some(id => !completed.has(id)));
+        if (!groups.length)
+            continue;
+        const ids = groups.flatMap(g => g.requirementIds);
+        const scopeId = input.tools.setActiveScope(ids);
+        const prompt = input.basePrompt.replace(inventory.block, `<frontend_scout_input>\n${JSON.stringify(projectFrontendInputScope(inventory.payload, ids))}\n</frontend_scout_input>`) +
+            `\nSCOUT SCOPE ${scopeId}: discover the related surfaces for exactly these complete obligations: ${ids.join(", ")}. Reuse proven paths from completed scope navigation; do not reread their content unless relevant new evidence is needed. Submit record_target_surface with scopeId="${scopeId}" after all discovery/design evidence for this scope. completeness=complete closes only this scope; runtime merges all scopes.\n` +
+            JSON.stringify({ completedScopePaths: input.tools.completedScopeFacts().map(f => ({ id: f.id, requirementIds: f.requirementIds, paths: f.surface?.implementationPaths })) });
+        const envelopeBytes = Buffer.byteLength(prompt + input.sessionOptions.userMessage + JSON.stringify(input.customTools.map(t => { const tool = t; return { name: tool.name, description: tool.description, parameters: tool.parameters }; })));
+        if (envelopeBytes > targetBytes && groups.length > 1) {
+            const at = Math.ceil(groups.length / 2);
+            queue.splice(index, 1, { groups: groups.slice(0, at), repairs: 0 }, { groups: groups.slice(at), repairs: 0 });
+            index--;
+            continue;
+        }
+        if (++calls > 128)
+            return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "SCOUT_RECOVERY_EXHAUSTED: shared session quota reached" };
+        last = await observeFrontendSession({ ...input.observation, phase: "scout/scope", scopeIds: ids, prompt, userMessage: input.sessionOptions.userMessage, customTools: input.customTools,
+            artifactPath: input.observation?.artifactPath ? `${input.observation.artifactPath}-${calls}.json` : undefined,
+            committedCount: () => input.tools.committedFacts().length, durableCommittedCount: () => input.tools.committedFacts().length,
+        }, observer => input.piStepFn({ ...input.sessionOptions, prompt, onAttemptObservation: observer, writerToolPolicy: { requireSdk: true, customTools: input.customTools } }));
+        await input.tools.flush();
+        const missing = groups.filter(g => g.requirementIds.some(id => !input.tools.completedRequirementIds().has(id)));
+        if (last.timedOut || /interrupt|termination-unconfirmed|budget_breach/.test(last.failureCategory))
+            return { ...last, ok: false };
+        const capacity = readWriterThinkingExhaustionEvidence(last).stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(last.failureCategory);
+        if (capacity && missing.length) {
+            if (missing.length === 1 && groups.length === 1)
+                return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: `${last.stderr}\nFRONTEND_INPUT_UNIT_TOO_LARGE: Scout ${missing[0].id}; refine the complete source unit; unchanged retries disabled` };
+            const at = Math.ceil(missing.length / 2);
+            queue.splice(index, 1, ...[missing.slice(0, at), missing.slice(at)].filter(batch => batch.length).map(batch => ({ groups: batch, repairs: 0 })));
+            index--;
+            continue;
+        }
+        if (!last.ok && !capacity)
+            return last;
+        if (missing.length) {
+            if (item.repairs >= 1)
+                return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "SCOUT_SCOPE_INCOMPLETE: unresolved discovery remains after local correction" };
+            queue.splice(index, 1, { groups: missing, repairs: item.repairs + 1 });
+            index--;
+            continue;
+        }
+    }
+    await input.tools.flush();
+    const { readCompleteScoutTargetSurface } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+    const closure = readCompleteScoutTargetSurface(input.tools.committedFacts());
+    return closure.ok ? { ...last, ok: true, failureCategory: "success" } : { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: closure.reason };
+}
+export async function runFrontendContractSegmentedSessions(input) {
+    // Build from the frozen runtime inventory if the caller has not rendered it yet.
+    const basePrompt = parseFrontendInputBlock(input.basePrompt, "contract") ? input.basePrompt : input.basePrompt +
+        `\n<frontend_contract_input>\nFrozen complete source obligations.\n${JSON.stringify({ requirements: input.tools.inputRequirements() })}\n</frontend_contract_input>`;
+    const inventory = parseFrontendInputBlock(basePrompt, "contract");
+    const pending = inventory.payload.requirements.filter(r => !input.tools.completedScopeRequirementIds().has(r.id));
+    const batches = packFrontendInputUnits(pending, { targetBytes: input.sessionOptions.frontendExecutionPolicy?.scopeTargetBytes, maxUnits: input.sessionOptions.frontendExecutionPolicy?.maxScopeUnits });
+    if (!batches.length)
+        batches.push([]);
+    let last;
+    let invocation = 0;
+    const maxSessions = batches.length * 3 + 2;
+    const terminal = () => input.tools.committedFacts().some(r => r.fact.kind === "contract-finalized");
+    try {
+        for (let index = 0; index < batches.length; index += 1) {
+            let scopeIds = batches[index].map(r => r.id);
+            const finalScope = index === batches.length - 1;
+            for (let repair = 0; repair < 2; repair += 1) {
+                // Confirmed IDs remain visible until the model commits a scope checkpoint.
+                const completed = input.tools.completedScopeRequirementIds();
+                scopeIds = scopeIds.filter(id => !completed.has(id));
+                input.tools.setActiveRequirementScope(scopeIds);
+                const groupIndex = collectFrontendExecutionGroups(input.tools.committedFacts().filter(r => r.fact.kind === "requirement").map(r => ({ id: String(r.fact.id), execution: r.fact.execution })));
+                const shared = input.tools.committedFacts().filter(r => !["requirement", "contract-finalized", "contract-scope-completed"].includes(String(r.fact.kind))).map(r => r.fact);
+                const prompt = projectFrontendContractPrompt(basePrompt, scopeIds) +
+                    `\nCONTRACT SCOPE: analyze only ${scopeIds.join(", ") || "(all scopes complete; verify global facts and terminal)"}. Each obligation is complete. Submit small records immediately, then call complete_contract_scope after ALL decisions for this scope. ` +
+                    (finalScope ? "After complete scope coverage and source-bound deliverables, call finalize_contract. Correct rejected calls and retry." : "Do not finalize; subsequent complete scopes remain.") +
+                    `\n<committed_contract_facts>\n${JSON.stringify({ facts: shared, executionGroups: groupIndex })}\n</committed_contract_facts>`;
+                const customTools = input.tools.customTools.filter(t => finalScope || t.name !== "finalize_contract");
+                invocation += 1;
+                if (invocation > maxSessions)
+                    return { ...last, ok: false, failureCategory: "invalid-output", stderr: "CONTRACT_RECOVERY_EXHAUSTED: session quota exceeded" };
+                last = await observeFrontendSession({
+                    ...input.observation, phase: "contract/scope", scopeIds, prompt, userMessage: input.sessionOptions.userMessage, customTools,
+                    artifactPath: input.observation?.artifactPath ? `${input.observation.artifactPath}-${invocation}.json` : undefined,
+                    committedCount: () => input.tools.committedFacts().length, durableCommittedCount: () => input.tools.committedFacts().length,
+                }, observer => input.piStepFn({ ...input.sessionOptions, prompt, onAttemptObservation: observer, writerToolPolicy: { requireSdk: true, customTools } }));
+                await input.tools.flush();
+                if (last.timedOut || /interrupt|termination-unconfirmed|budget_breach/.test(last.failureCategory))
+                    return { ...last, ok: false };
+                const capacityExhausted = readWriterThinkingExhaustionEvidence(last).stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(last.failureCategory);
+                if (capacityExhausted && !last.timedOut) {
+                    const missing = scopeIds.filter(id => !input.tools.completedScopeRequirementIds().has(id));
+                    if (!missing.length) {
+                        if (finalScope && !terminal()) {
+                            if (!scopeIds.length)
+                                return { ...last, ok: false, failureCategory: "invalid-output", stderr: `${last.stderr}\nFRONTEND_INPUT_UNIT_TOO_LARGE: contract terminal exhausted; unchanged retry disabled` };
+                            batches.push([]);
+                        }
+                        break;
+                    }
+                    if (missing.length === 1 && scopeIds.length > 1) {
+                        batches.splice(index, 1, inventory.payload.requirements.filter(r => missing.includes(r.id)));
+                        index -= 1;
+                        break;
+                    }
+                    if (missing.length <= 1)
+                        return { ...last, ok: false, stderr: `${last.stderr}\nFRONTEND_INPUT_UNIT_TOO_LARGE: ${missing[0] ?? "contract terminal"}; atom could not complete; refine the source without dropping conditions` };
+                    const smaller = packFrontendInputUnits(inventory.payload.requirements.filter(r => missing.includes(r.id)), { maxUnits: Math.ceil(missing.length / 2) });
+                    batches.splice(index, 1, ...smaller);
+                    index -= 1;
+                    break;
+                }
+                if (!last.ok)
+                    return last;
+                const missing = scopeIds.filter(id => !input.tools.completedScopeRequirementIds().has(id));
+                if (!missing.length && (!finalScope || terminal()))
+                    break;
+                if (repair === 1)
+                    return { ...last, ok: false, failureCategory: "invalid-output", stderr: `CONTRACT_SCOPE_INCOMPLETE: ${missing.join(", ") || "missing finalize_contract"}` };
+            }
+        }
+        return last;
+    }
+    finally {
+        input.tools.setActiveRequirementScope(null);
+    }
+}
+/** One workload view for both the outer parallel map and inner session queue.
+ * A declared execution group is an indivisible unit during initial packing. */
+function buildFrontendPlanWorkload(input) {
+    const allRequirementIds = input.requirementIds;
+    const compiledInput = parseFrontendInputBlock(input.basePrompt, "plan")?.payload;
+    const fullUnits = new Map(compiledInput?.requirements.map(r => [r.id, r]) ?? []);
+    const declaredGroups = Array.isArray(compiledInput?.executionGroups)
+        ? compiledInput.executionGroups.filter(isRecordObject) : [];
+    const workGroups = declaredGroups.map(g => ({
+        id: String(g.id), kind: String(g.kind),
+        requirementIds: Array.isArray(g.requirementIds)
+            ? g.requirementIds.filter((id) => typeof id === "string" && allRequirementIds.includes(id)) : [],
+    })).filter(g => g.requirementIds.length);
+    const groupedIds = new Set(workGroups.flatMap(g => g.requirementIds));
+    for (const id of allRequirementIds) {
+        if (!groupedIds.has(id))
+            workGroups.push({ id, kind: "unclassified", requirementIds: [id] });
+    }
+    const workCost = (ids) => 1 + ids.reduce((total, id) => total + Math.max(1, (input.requirementCosts?.get(id) ?? 2) - 1), 0);
+    const policy = input.sessionOptions.frontendExecutionPolicy;
+    const targetBytes = policy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES;
+    const userMessageBytes = Buffer.byteLength(input.sessionOptions.userMessage ?? "");
+    const buildWorkBatches = (ids) => {
+        const work = workGroups.flatMap((g, index) => {
+            const members = g.requirementIds.filter(id => ids.includes(id));
+            return members.length ? [{ id: `${index}:${g.id}`, requirementIds: members,
+                    requirements: members.map(id => fullUnits.get(id) ?? { id }), estimatedCalls: workCost(members) }] : [];
+        });
+        const scaffoldBytes = Buffer.byteLength(input.basePrompt.replace(/<frontend_plan_input>[\s\S]*?<\/frontend_plan_input>/, JSON.stringify({ ...compiledInput, requirements: [] }))) + userMessageBytes + Buffer.byteLength(JSON.stringify(input.coverageTools));
+        return packFrontendInputUnits(work, {
+            targetBytes: Math.max(1, targetBytes - scaffoldBytes),
+            maxUnits: policy?.maxScopeUnits ?? 4,
+            maxCost: FRONTEND_PLAN_COVERAGE_MAX_RECORD_CALLS, cost: g => g.estimatedCalls,
+        }).map(batch => batch.flatMap(g => g.requirementIds));
+    };
+    // This renderer also carries the Plan's evolving UX checkpoint on resume.
+    // Only the Contract/Scout-derived input participates in ownership binding.
+    const { committedUx: _committedUx, ...frozenInput } = compiledInput ?? {};
+    return {
+        frozenInput, workGroups, buildWorkBatches,
+        compactEligible: input.requirementCosts !== undefined &&
+            workGroups.length <= FRONTEND_PLAN_SMALL_MAX_REQUIREMENTS &&
+            Buffer.byteLength(input.basePrompt) + userMessageBytes + Buffer.byteLength(JSON.stringify(input.allTools)) <= targetBytes * 2 &&
+            workGroups.reduce((total, group) => total + workCost(group.requirementIds), 0) <= FRONTEND_PLAN_SMALL_MAX_ESTIMATED_CALLS &&
+            countFrontendPlanTargetSurfaces(input.basePrompt) === 1,
+    };
+}
+const frontendPlanCoverageLayoutSchema = z.object({
+    schemaVersion: z.literal(1),
+    bindingSha256: z.string(),
+    coverageBatches: z.array(z.array(z.string().min(1)).min(1)).min(1),
+    layoutSha256: z.string(),
+}).strict();
+/** Freeze ledger ownership before any provider call. Session packing remains
+ * adaptive inside each owner, but retry instructions cannot rename its scope. */
+async function loadOrCreateFrontendPlanCoverageLayout(input) {
+    const fileName = "coverage-layout.json";
+    const file = path.join(input.runDir, input.nodeId, fileName);
+    const bindingSha256 = sha256OfCanonicalJson(input.binding);
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    let layout;
+    if (raw !== undefined) {
+        layout = frontendPlanCoverageLayoutSchema.parse(JSON.parse(raw));
+    }
+    else {
+        // Losing the ownership receipt must never repartition acknowledged facts.
+        for (const relative of ["plan-typed-facts.jsonl", "parallel"]) {
+            const existing = await stat(path.join(input.runDir, input.nodeId, relative)).catch(error => {
+                if (error.code !== "ENOENT")
+                    throw error;
+                return undefined;
+            });
+            if (existing && (existing.isDirectory() || existing.size > 0)) {
+                throw Error("FRONTEND_PLAN_LAYOUT_MISSING: preserve the existing ledger and restart its owning phase");
+            }
+        }
+        const descriptor = {
+            schemaVersion: 1, bindingSha256,
+            coverageBatches: input.workload.compactEligible ? [input.requirementIds] : input.workload.buildWorkBatches(input.requirementIds),
+        };
+        layout = { ...descriptor, layoutSha256: sha256OfCanonicalJson(descriptor) };
+    }
+    const { layoutSha256, ...descriptor } = layout;
+    if (layout.bindingSha256 !== bindingSha256 || layoutSha256 !== sha256OfCanonicalJson(descriptor)) {
+        throw Error("FRONTEND_PLAN_LAYOUT_MISMATCH: frozen coverage ownership or input binding changed");
+    }
+    const members = layout.coverageBatches.flat();
+    const owners = new Map(layout.coverageBatches.flatMap((batch, index) => batch.map(id => [id, index])));
+    if (members.length !== owners.size || members.length !== input.requirementIds.length ||
+        input.requirementIds.some(id => !owners.has(id)) ||
+        input.workload.workGroups.some(group => new Set(group.requirementIds.map(id => owners.get(id))).size !== 1)) {
+        throw Error("FRONTEND_PLAN_LAYOUT_INVALID: coverage must partition complete execution groups exactly once");
+    }
+    if (raw === undefined)
+        await writeDagNodeJsonArtifact(input.runDir, input.nodeId, fileName, layout);
+    return layout.coverageBatches;
+}
+export async function runFrontendPlanSegmentedSessions(input) {
+    const queue = [];
+    const coverageSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "coverage");
+    const uxRegistrySegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "ux-registry");
+    const uxSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "ux-local");
+    const globalMockDataSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "global-mock-data");
+    const finalizeSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "finalize");
+    const allRequirementIds = input.requirementIds ?? [];
+    const buildPhasePrompt = (segment, missing = [], scopeIds = allRequirementIds) => {
+        const compact = allRequirementIds.length > 0
+            ? compactFrontendPlanPromptForRequirementSlice(input.basePrompt, scopeIds, {
+                includeRequirementText: segment.id === "global-mock-data",
+                includeVerificationTargets: false,
+                includeDesignEvidence: segment.id === "global-dependency-deviation" || segment.id === "finalize",
+                includeChecklist: false,
+            })
+            : input.basePrompt;
+        const kinds = segment.id === "global-route"
+            ? ["target-surface"]
+            : segment.id === "global-mock-data"
+                ? ["plan-requirement", "plan-verification-target", "state-flow", "data-flow", "mock-api"]
+                : segment.id === "global-dependency-deviation"
+                    ? ["dependency", "design-deviation"]
+                    : ["plan-requirement", "plan-verification-target", "state-registry", "component-choice", "state-flow", "data-flow", "mock-api", "design-deviation", "dependency", "target-surface"];
+        const ledger = input.committedFacts
+            ? compactFrontendPlanLedgerContext({
+                committedFacts: input.committedFacts(),
+                requirementIds: scopeIds,
+                kinds,
+                ...(segment.id === "global-mock-data" ? { scopedKinds: ["state-flow"] } : {}),
+            })
+            : "";
+        return [
+            compact,
+            segment.instruction,
+            ledger,
+            ...(missing.length > 0
+                ? [
+                    "MISSING-FACT QUEUE: repair ONLY these items, then re-check the phase:",
+                    ...missing.map((item) => `- ${item.kind}${item.id ? ` ${item.id}` : ""} for ${item.requirementIds.join(", ")}: ${item.reason}`),
+                ]
+                : []),
+        ].filter(Boolean).join("\n\n");
     };
     const buildCoveragePrompt = (slice, missing = []) => [
         compactFrontendPlanPromptForRequirementSlice(input.basePrompt, slice),
         coverageSegment.instruction,
-        `COVERAGE BATCH: process ONLY these requirements in this session: ${slice.join(", ")}. Other requirements are handled by separate sessions; do not record them.`,
+        `COVERAGE BATCH: process ONLY these requirements in this session: ${slice.join(", ")}. Other requirements are handled by separate sessions; do not record them. Finish the whole list before concluding: commit every listed requirement's coverage facts (verification targets or an evidence gap), batching up to 4 record_* calls per message; an early stop re-queues the remainder as a MISSING-FACT repair session.`,
         ...(missing.length > 0
             ? [
                 "MISSING-FACT QUEUE: the previous session did not establish complete coverage. Repair ONLY these items, then re-check the slice:",
@@ -3353,14 +4655,20 @@ export async function runFrontendPlanSegmentedSessions(input) {
             ? compactFrontendPlanLedgerContext({
                 committedFacts: input.committedFacts(),
                 requirementIds: slice,
-                kinds: ["plan-requirement", "plan-verification-target", "component-choice", "state-flow"],
-                scopedKinds: ["component-choice", "state-flow"],
+                kinds: [
+                    "plan-requirement",
+                    "plan-verification-target",
+                    "state-registry",
+                    "component-choice",
+                    "state-flow",
+                ],
+                // Include shared state bindings from other scopes; page full values before correcting.
             })
             : "";
         return [
             compactFrontendPlanPromptForRequirementSlice(input.basePrompt, slice),
             uxSegment.instruction,
-            `UX LOCAL BATCH: process ONLY these requirements: ${slice.join(", ")}.`,
+            `UX SCOPE: process these complete behavior groups together: ${slice.join(", ")}. Reuse shared registry/component ownership; do not rename a behavior by requirement id. Constraint/exclusion groups do not create UI; preserve genuine verification gaps.`,
             ledger,
             ...(missing.length > 0
                 ? [
@@ -3370,6 +4678,38 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 : []),
         ].filter(Boolean).join("\n\n");
     };
+    const buildUxRegistryPrompt = (missing = []) => {
+        const ledger = input.committedFacts
+            ? compactFrontendPlanLedgerContext({
+                committedFacts: input.committedFacts(),
+                requirementIds: allRequirementIds,
+                kinds: [
+                    "plan-requirement",
+                    "plan-verification-target",
+                    "state-registry",
+                ],
+            })
+            : "";
+        const compact = allRequirementIds.length > 0
+            ? compactFrontendPlanPromptForRequirementSlice(input.basePrompt, allRequirementIds, {
+                includeRequirementText: false,
+                includeVerificationTargets: false,
+                includeDesignEvidence: false,
+                includeChecklist: false,
+            })
+            : input.basePrompt;
+        return [
+            compact,
+            uxRegistrySegment.instruction,
+            ledger,
+            ...(missing.length > 0
+                ? [
+                    "MISSING-FACT QUEUE: commit the global UX registry, then re-check this phase:",
+                    ...missing.map((item) => `- ${item.reason}`),
+                ]
+                : []),
+        ].filter(Boolean).join("\n\n");
+    };
     const buildCompactLocalPrompt = (missing = []) => {
         const ledger = input.committedFacts
             ? compactFrontendPlanLedgerContext({
@@ -3378,6 +4718,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 kinds: [
                     "plan-requirement",
                     "plan-verification-target",
+                    "state-registry",
                     "component-choice",
                     "state-flow",
                 ],
@@ -3386,7 +4727,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
         return [
             compactFrontendPlanPromptForRequirementSlice(input.basePrompt, allRequirementIds),
             "PLAN PHASE — compact local planning for a small frontend request.",
-            "For every listed requirement, record plan-requirement and verification-target facts, then record the component-choice and state-flow facts needed by the observable UX. Do not read the repository or task source; use only the committed input above. Do not call finalize_plan in this session.",
+            "Review all listed requirements together and record_state_registry first with one global UX vocabulary. Then record every plan-requirement and verification-target fact, followed by the component-choice and state-flow facts needed by the observable UX. Do not read the repository or task source; use only the committed input above. Do not call finalize_plan in this session.",
             "TOOL-FIRST: your first assistant actions must be record_* tool calls, at most 2-3 facts per message. Do not draft the whole analysis before recording; if a fact is uncertain, record it with an evidence gap instead of reasoning longer.",
             ledger,
             ...(missing.length > 0
@@ -3397,13 +4738,13 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 : []),
         ].filter(Boolean).join("\n\n");
     };
-    const compactFinalizeInstruction = "This is a small-request compact pass. Reconcile the committed local facts with route, data-flow, Mock/API, dependency and deviation policy, then call finalize_plan exactly once.";
+    const compactFinalizeInstruction = "This is a small-request compact pass. Reconcile the committed local facts with route, data-flow, Mock/API, dependency and deviation policy, then call finalize_plan; correct rejected facts and retry until exactly one successful terminal commit.";
     const buildCompactFinalizePrompt = (missing = []) => [buildPhasePrompt(finalizeSegment, missing), compactFinalizeInstruction].join("\n\n");
     const mapPlannerExhaustion = (r, committedAnyFacts) => isPlannerThinkingExhausted(r, committedAnyFacts)
         ? {
             ...r,
-            failureCategory: PLANNER_THINKING_EXHAUSTED_CATEGORY,
-            stderr: `${r.stderr}\n${PLANNER_THINKING_EXHAUSTED_CATEGORY}: stopReason=length, thinking observed, 0 typed facts committed; the batch ladder degraded the scope without converging — set thinking=off for this tier or switch to a non-thinking model`.trim(),
+            failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
+            stderr: `${r.stderr}\n${OUTPUT_LIMIT_RETRY_CATEGORY}: stopReason=length ended the turn before the next typed fact; preserve committed facts and retry only the unfinished phase`.trim(),
         }
         : r;
     // An empty list means "ledger unreadable / unknown" and falls back to one
@@ -3418,8 +4759,35 @@ export async function runFrontendPlanSegmentedSessions(input) {
         : [];
     const incompleteRequirementIds = new Set(initialMissing.flatMap((item) => item.requirementIds));
     const coverageWorkIds = (input.requirementIds ?? []).filter((id) => pending.includes(id) || incompleteRequirementIds.has(id));
-    const estimatedCalls = (input.requirementIds ?? []).reduce((total, id) => total + Math.max(1, input.requirementCosts?.get(id) ?? 2), 0);
-    const targetSurfaceCount = countFrontendPlanTargetSurfaces(input.basePrompt);
+    if (input.parallelCoverageOnly === true &&
+        requirementIdsProvided &&
+        coverageWorkIds.length === 0) {
+        // A retry may reopen a shard whose committed facts are already complete.
+        // Treat that shard as an idempotent no-op; returning the normal empty
+        // session failure would make a partially failed map impossible to resume.
+        return {
+            ok: true,
+            assistantText: "",
+            command: [],
+            durationMs: 0,
+            exitCode: 0,
+            failureCategory: "success",
+            modelDisplay: "reused-coverage-facts",
+            parsedEvents: 0,
+            stderr: "",
+            stdout: "",
+            timedOut: false,
+            attemptedModels: [],
+            fallbackUsed: false,
+            tokensUsed: 0,
+        };
+    }
+    const { workGroups, buildWorkBatches, compactEligible } = buildFrontendPlanWorkload({
+        basePrompt: input.basePrompt, requirementIds: allRequirementIds,
+        requirementCosts: input.requirementCosts, sessionOptions: input.sessionOptions,
+        coverageTools: input.segmentCustomTools(coverageSegment.toolNames),
+        allTools: input.segmentCustomTools(null),
+    });
     // Small, single-surface requests do not benefit from six isolated Pi
     // sessions. Keep the typed ledger as the authority, but let one local
     // session establish requirement/UX facts and one final session establish
@@ -3427,16 +4795,14 @@ export async function runFrontendPlanSegmentedSessions(input) {
     // for larger plans and for the unscoped compatibility path.
     const useCompactSmallPlan = requirementIdsProvided &&
         input.compactSmallPlan === true &&
-        input.requirementCosts !== undefined &&
-        estimatedCalls > 12 &&
-        (input.requirementIds?.length ?? 0) <= FRONTEND_PLAN_SMALL_MAX_REQUIREMENTS &&
-        estimatedCalls <= FRONTEND_PLAN_SMALL_MAX_ESTIMATED_CALLS &&
-        targetSurfaceCount === 1;
+        compactEligible;
     if (useCompactSmallPlan) {
         const compactLocalTools = new Set([
             "record_plan_requirement",
+            "record_plan_group_coverage",
             "record_plan_verification_target",
             "record_plan_evidence_gap",
+            "record_state_registry",
             "record_component_choice",
             "record_state_flow",
             "adopt_staged_fact",
@@ -3461,13 +4827,8 @@ export async function runFrontendPlanSegmentedSessions(input) {
         });
     }
     else if (coverageWorkIds.length > 0) {
-        const coverageBatches = batchFrontendPlanRequirements({
-            requirementIds: coverageWorkIds,
-            maxEstimatedRecordCalls: FRONTEND_PLAN_COVERAGE_MAX_RECORD_CALLS,
-            maxRequirements: 4,
-            requirementCosts: input.requirementCosts,
-        });
-        coverageBatches.forEach((slice, batchIndex) => queue.push({
+        const completeBatches = buildWorkBatches(coverageWorkIds);
+        completeBatches.forEach((slice, batchIndex) => queue.push({
             id: `coverage-batch-${batchIndex + 1}`,
             toolNames: coverageSegment.toolNames,
             coverageSlice: slice,
@@ -3478,35 +4839,35 @@ export async function runFrontendPlanSegmentedSessions(input) {
     if (useCompactSmallPlan) {
         // Compact mode already queued both sessions above.
     }
-    else {
-        const uxCosts = new Map((input.requirementIds ?? []).map((id) => [
-            id,
-            Math.max(2, Math.min(3, input.requirementCosts?.get(id) ?? 2)),
-        ]));
-        const uxSlices = requirementIdsProvided
-            ? batchFrontendPlanRequirements({
-                requirementIds: input.requirementIds,
-                maxEstimatedRecordCalls: FRONTEND_PLAN_UX_LOCAL_MAX_RECORD_CALLS,
-                maxRequirements: 3,
-                requirementCosts: uxCosts,
-            })
-            : [[]];
-        uxSlices.forEach((slice, batchIndex) => queue.push({
+    else if (!input.parallelCoverageOnly) {
+        if (requirementIdsProvided) {
+            queue.push({
+                id: uxRegistrySegment.id,
+                toolNames: uxRegistrySegment.toolNames,
+                prompt: buildUxRegistryPrompt(),
+            });
+        }
+        const uxWorkIds = workGroups.filter(g => !["constraint", "exclusion"].includes(g.kind) || g.requirementIds.some(id => input.behaviorRequiredRequirementIds?.includes(id))).flatMap(g => g.requirementIds);
+        const uxBatches = requirementIdsProvided ? buildWorkBatches(uxWorkIds) : [[]];
+        uxBatches.forEach((slice, batchIndex) => queue.push({
             id: `ux-local-${batchIndex + 1}`,
-            toolNames: uxSegment.toolNames,
-            ...(slice.length > 0 ? { requirementSlice: slice } : {}),
-            prompt: slice.length > 0
-                ? buildUxPrompt(slice)
-                : buildPhasePrompt(uxSegment),
+            toolNames: requirementIdsProvided ? uxSegment.toolNames : new Set([...(uxSegment.toolNames ?? []), "record_state_registry"]),
+            ...(slice.length ? { requirementSlice: slice } : {}),
+            prompt: slice.length ? buildUxPrompt(slice) : buildPhasePrompt(uxSegment),
         }));
         for (const segment of FRONTEND_PLAN_SEGMENTS) {
-            if (["coverage", "ux-local", "finalize"].includes(segment.id))
+            if (["coverage", "ux-registry", "ux-local", "finalize"].includes(segment.id))
                 continue;
-            queue.push({
-                id: segment.id,
-                toolNames: segment.toolNames,
-                prompt: buildPhasePrompt(segment),
-            });
+            if (segment.id === "global-mock-data" && requirementIdsProvided) {
+                buildWorkBatches(allRequirementIds).forEach((slice, i) => queue.push({ id: `global-mock-data-${i + 1}`, toolNames: segment.toolNames, requirementSlice: slice, prompt: buildPhasePrompt(segment, [], slice) }));
+            }
+            else {
+                queue.push({
+                    id: segment.id,
+                    toolNames: segment.toolNames,
+                    prompt: buildPhasePrompt(segment),
+                });
+            }
         }
         queue.push({
             id: finalizeSegment.id,
@@ -3514,11 +4875,33 @@ export async function runFrontendPlanSegmentedSessions(input) {
             prompt: buildPhasePrompt(finalizeSegment),
         });
     }
-    let last;
+    let accumulated;
     let index = 0;
     let invocationCount = 0;
+    let lastDurableCount = input.committedFactCount();
     while (index < queue.length) {
         const session = queue[index];
+        if (input.attempt > 1 && input.committedFacts && session.id === "ux-registry" &&
+            collectFrontendPlanPhaseMissingFacts({ phase: "ux-registry", requirementIds: allRequirementIds, committedFacts: input.committedFacts() }).length === 0) {
+            index += 1;
+            continue;
+        }
+        // Reuse complete UX scopes on node retry. Require explicit per-requirement
+        // ownership; an unrelated/global fact must not prove a slice complete.
+        if (input.attempt > 1 && input.committedFacts && session.id.startsWith("ux-local-") && session.requirementSlice?.length) {
+            const facts = input.committedFacts();
+            const ownedIds = new Set(facts.flatMap(value => {
+                const fact = committedFactFromPlanRecord(value);
+                return fact ? planFactStringList(fact.scopeRequirementIds) : [];
+            }));
+            const complete = session.requirementSlice.every(id => ownedIds.has(id)) &&
+                collectFrontendPlanPhaseMissingFacts({ phase: "ux-local", requirementIds: session.requirementSlice,
+                    committedFacts: facts, behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds }).length === 0;
+            if (complete) {
+                index += 1;
+                continue;
+            }
+        }
         const remaining = (session.coverageOnly ? session.coverageSlice ?? [] : []).filter((id) => !input.committedRequirementIds?.().has(id));
         const preexistingMissing = session.coverageOnly && session.coverageSlice && input.committedFacts
             ? collectFrontendPlanMissingFacts({
@@ -3536,12 +4919,15 @@ export async function runFrontendPlanSegmentedSessions(input) {
         }
         let prompt = session.prompt;
         if (session.coverageOnly && session.coverageSlice) {
-            const promptSlice = remaining.length > 0 ? remaining : session.coverageSlice;
+            const promptSlice = [...new Set([...remaining, ...preexistingMissing.flatMap(item => item.requirementIds)])];
             prompt = buildCoveragePrompt(promptSlice, session.missingFacts ?? preexistingMissing);
         }
         else if (session.id === "compact-local") {
             prompt = buildCompactLocalPrompt(session.missingFacts);
         }
+        else if (session.id === "ux-registry") {
+            prompt = buildUxRegistryPrompt(session.missingFacts);
+        }
         else if (session.id.startsWith("ux-local-")) {
             // Build this at execution time: coverage facts are committed by the
             // preceding sessions and must be visible to the UX-local model.
@@ -3553,41 +4939,79 @@ export async function runFrontendPlanSegmentedSessions(input) {
             // Global phases and finalize also consume the latest committed ledger;
             // constructing their prompt only when the session starts prevents a
             // stale queue entry from dropping facts written by earlier phases.
-            const segment = FRONTEND_PLAN_SEGMENTS.find((candidate) => candidate.id === session.id);
+            const segment = FRONTEND_PLAN_SEGMENTS.find((candidate) => candidate.id === session.id || (candidate.id === "global-mock-data" && session.id.startsWith("global-mock-data-")));
             if (segment) {
                 prompt =
                     session.id === "finalize" && useCompactSmallPlan
                         ? buildCompactFinalizePrompt(session.missingFacts)
-                        : buildPhasePrompt(segment, session.missingFacts);
+                        : buildPhasePrompt(segment, session.missingFacts, session.requirementSlice ?? allRequirementIds);
             }
         }
+        const atomicFocus = session.atomicRecovery ? session.missingFacts?.[0] : undefined;
+        if (atomicFocus) {
+            prompt = [
+                compactFrontendPlanPromptForRequirementSlice(input.basePrompt, atomicFocus.requirementIds, {
+                    includeChecklist: false,
+                    ...(atomicFocus.kind === "plan-verification-target" && atomicFocus.id
+                        ? { verificationTargetIds: [atomicFocus.id] } : {}),
+                }),
+                `ATOMIC FACT: ${atomicFocus.kind}${atomicFocus.id ? ` ${atomicFocus.id}` : ""}`,
+                atomicFocus.reason,
+                "Commit ONLY this missing fact with one record_* call, then end this session. Other facts are queued separately. Preserve canonical IDs and shared bindings; use read_plan_facts for existing values. Do not summarize or plan the entire requirement. Capacity exhaustion is not evidence of a requirement gap.",
+            ].join("\n\n");
+        }
         const committedBefore = input.committedFactCount();
-        input.setActiveRequirementScope?.(session.id === "compact-local" || session.id.startsWith("ux-local-")
-            ? session.requirementSlice ?? []
-            : []);
+        input.setActiveRequirementScope?.(session.coverageOnly ? session.coverageSlice ?? [] : session.requirementSlice ?? []);
         if (invocationCount >= FRONTEND_PLAN_BATCH_MAX_SESSIONS)
             break;
         invocationCount += 1;
-        const customTools = input.segmentCustomTools(session.toolNames);
-        const result = await input.piStepFn({
-            ...input.sessionOptions,
-            prompt,
-            ...(customTools.length > 0
-                ? {
-                    writerToolPolicy: {
-                        requireSdk: true,
-                        customTools,
-                    },
-                }
-                : {}),
-        });
-        last = result;
-        try {
-            await input.flushLedger();
-        }
-        catch {
-            // best-effort: the node-level flush runs again after the attempt
+        const atomicTools = {
+            "plan-requirement": "record_plan_requirement", "plan-verification-target": "record_plan_verification_target",
+            "state-registry": "record_state_registry", "component-choice": "record_component_choice",
+            "state-flow": "record_state_flow", "data-flow": "record_data_flow", "mock-api": "record_mock_api",
+        };
+        const customTools = input.segmentCustomTools(atomicFocus ? new Set([atomicTools[atomicFocus.kind]]) : session.toolNames);
+        const scopeForPacking = session.coverageSlice ?? session.requirementSlice;
+        const envelopeBytes = Buffer.byteLength(prompt) + Buffer.byteLength(input.sessionOptions.userMessage ?? "") + Buffer.byteLength(JSON.stringify(customTools));
+        if (envelopeBytes > (input.sessionOptions.frontendExecutionPolicy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES) && scopeForPacking && session.id !== "compact-local") {
+            const groups = workGroups.map(g => g.requirementIds.filter(id => scopeForPacking.includes(id))).filter(g => g.length);
+            if (groups.length > 1) {
+                const half = Math.ceil(groups.length / 2);
+                queue.splice(index, 1, ...[groups.slice(0, half).flat(), groups.slice(half).flat()].map(slice => ({ ...session, ...(session.coverageOnly ? { coverageSlice: slice } : { requirementSlice: slice }) })));
+                invocationCount -= 1;
+                continue;
+            }
         }
+        const result = await observeFrontendSession({
+            ...input.observation, phase: `plan/${session.id}`, scopeIds: session.requirementSlice ?? session.coverageSlice ?? allRequirementIds,
+            prompt, userMessage: input.sessionOptions.userMessage, customTools, committedCount: input.committedFactCount, durableCommittedCount: () => lastDurableCount,
+            artifactPath: input.observation?.artifactPath ? `${input.observation.artifactPath}-${invocationCount}.json` : undefined,
+        }, async (observer) => {
+            const result = await input.piStepFn({
+                ...input.sessionOptions,
+                onAttemptObservation: observer,
+                prompt,
+                ...(customTools.length > 0
+                    ? {
+                        writerToolPolicy: {
+                            requireSdk: true,
+                            customTools,
+                        },
+                    }
+                    : {}),
+            });
+            try {
+                await input.flushLedger();
+                lastDurableCount = input.committedFactCount();
+            }
+            catch {
+                // best-effort: the node-level flush runs again after the attempt
+            }
+            return result;
+        });
+        accumulated = accumulated
+            ? combineSequentialPiResults(accumulated, result)
+            : result;
         const committedAfter = input.committedFactCount();
         const committedFactsOnlySuccess = session.id !== "finalize" &&
             !(result.assistantText ?? "").trim() &&
@@ -3601,6 +5025,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
             })
             : [];
         const isCompactLocalSession = session.id === "compact-local";
+        const isUxRegistrySession = session.id === "ux-registry";
         const isUxLocalSession = session.id.startsWith("ux-local-");
         const missingPhase = isCompactLocalSession && input.committedFacts
             ? [
@@ -3608,6 +5033,11 @@ export async function runFrontendPlanSegmentedSessions(input) {
                     requirementIds: allRequirementIds,
                     committedFacts: input.committedFacts(),
                 }),
+                ...collectFrontendPlanPhaseMissingFacts({
+                    phase: "ux-registry",
+                    requirementIds: allRequirementIds,
+                    committedFacts: input.committedFacts(),
+                }),
                 ...collectFrontendPlanPhaseMissingFacts({
                     phase: "ux-local",
                     requirementIds: allRequirementIds,
@@ -3615,20 +5045,26 @@ export async function runFrontendPlanSegmentedSessions(input) {
                     behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds,
                 }),
             ]
-            : isUxLocalSession && session.requirementSlice && input.committedFacts
+            : isUxRegistrySession && input.committedFacts
                 ? collectFrontendPlanPhaseMissingFacts({
-                    phase: "ux-local",
-                    requirementIds: session.requirementSlice,
+                    phase: "ux-registry",
+                    requirementIds: allRequirementIds,
                     committedFacts: input.committedFacts(),
-                    behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds,
                 })
-                : session.id === "global-mock-data" && allRequirementIds.length > 0 && input.committedFacts
+                : isUxLocalSession && session.requirementSlice && input.committedFacts
                     ? collectFrontendPlanPhaseMissingFacts({
-                        phase: "global-mock-data",
-                        requirementIds: allRequirementIds,
+                        phase: "ux-local",
+                        requirementIds: session.requirementSlice,
                         committedFacts: input.committedFacts(),
+                        behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds,
                     })
-                    : [];
+                    : session.id.startsWith("global-mock-data") && allRequirementIds.length > 0 && input.committedFacts
+                        ? collectFrontendPlanPhaseMissingFacts({
+                            phase: "global-mock-data",
+                            requirementIds: session.requirementSlice ?? allRequirementIds,
+                            committedFacts: input.committedFacts(),
+                        })
+                        : [];
         const missingPhaseFacts = [...missingCoverage, ...missingPhase];
         // Frozen verification commands must operate on files the planner has
         // committed verification targets for; otherwise the admission writeSet
@@ -3656,11 +5092,102 @@ export async function runFrontendPlanSegmentedSessions(input) {
             ? buildCoveragePrompt(session.coverageSlice ?? [], missing)
             : isCompactLocalSession
                 ? buildCompactLocalPrompt(missing)
-                : session.id === "finalize" && useCompactSmallPlan
-                    ? buildCompactFinalizePrompt(missing)
-                    : isUxLocalSession
-                        ? buildUxPrompt(session.requirementSlice ?? [], missing)
-                        : buildPhasePrompt(globalMockDataSegment, missing);
+                : isUxRegistrySession
+                    ? buildUxRegistryPrompt(missing)
+                    : session.id === "finalize" && useCompactSmallPlan
+                        ? buildCompactFinalizePrompt(missing)
+                        : isUxLocalSession
+                            ? buildUxPrompt(session.requirementSlice ?? [], missing)
+                            : buildPhasePrompt(globalMockDataSegment, missing, session.requirementSlice ?? allRequirementIds);
+        const recovery = classifyFrontendPlanRecovery({ ...result, stopReason: readWriterThinkingExhaustionEvidence(result).stopReason });
+        if (recovery === "stop")
+            return { ...result, ok: false };
+        if ((recovery === "output" || (session.atomicRecovery && result.ok)) && input.committedFacts &&
+            !(missingPhaseFacts.length === 1 && missingPhaseFacts[0].kind === "plan-requirement") &&
+            (session.coverageOnly || isUxRegistrySession || isUxLocalSession || session.id.startsWith("global-mock-data"))) {
+            if (missingPhaseFacts.length === 0) {
+                // A complete validated slice does not need a successful prose turn.
+                // This never accepts finalize or bypasses the final contract validator.
+                accumulated = { ...accumulated, ok: true, failureCategory: "success" };
+                index += 1;
+                continue;
+            }
+            const missingIds = [...new Set(missingPhaseFacts.flatMap(item => item.requirementIds))];
+            const scope = session.coverageSlice ?? session.requirementSlice;
+            if (scope && missingIds.length < scope.length) {
+                queue[index] = { ...session, missingFacts: missingPhaseFacts,
+                    ...(session.coverageOnly ? { coverageSlice: missingIds } : { requirementSlice: missingIds }),
+                    retryCount: 0 };
+                continue;
+            }
+            if (scope && missingIds.length > 1 && (session.coverageOnly || isUxLocalSession)) {
+                const half = Math.ceil(missingIds.length / 2);
+                queue.splice(index, 1, ...[missingIds.slice(0, half), missingIds.slice(half)].map(ids => ({
+                    ...session, retryCount: 0,
+                    ...(session.coverageOnly ? { coverageSlice: ids } : { requirementSlice: ids }),
+                    missingFacts: missingPhaseFacts.filter(item => item.requirementIds.some(id => ids.includes(id))),
+                })));
+                continue;
+            }
+            const focusStillMissing = atomicFocus && missingPhaseFacts.some(item => item.kind === atomicFocus.kind && item.id === atomicFocus.id &&
+                item.requirementIds.join("\0") === atomicFocus.requirementIds.join("\0"));
+            const retries = focusStillMissing ? (session.retryCount ?? 0) + 1 : 0;
+            if (retries < 2) {
+                queue[index] = { ...session, atomicRecovery: true, missingFacts: missingPhaseFacts, retryCount: retries };
+                continue;
+            }
+            return { ...accumulated, ok: false, failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
+                stderr: `${accumulated.stderr}\nfrontend plan capacity recovery exhausted: preserve committed facts; phase=${session.id}; scope=${missingIds.join(",")}; strategy=atomic-fact; missing=${JSON.stringify(missingPhaseFacts)}`.trim() };
+        }
+        const capacityExhausted = recovery === "output" || recovery === "context";
+        if (capacityExhausted && !result.timedOut) {
+            const failure = () => mapPlannerExhaustion({ ...result, ok: false, stderr: `${result.stderr}\nFRONTEND_INPUT_UNIT_TOO_LARGE: ${session.id}; no smaller complete scope can finish; unchanged retries are disabled` }, committedAfter > committedBefore);
+            const missingCoverageIds = input.committedFacts ? [...new Set(collectFrontendPlanMissingFacts({ requirementIds: session.coverageSlice ?? session.requirementSlice ?? allRequirementIds, committedFacts: input.committedFacts() }).flatMap(f => f.requirementIds))] : [...(session.coverageSlice ?? session.requirementSlice ?? allRequirementIds)];
+            const splitScope = (ids, allowMemberSplit) => {
+                const groups = workGroups.map(g => g.requirementIds.filter(id => ids.includes(id))).filter(g => g.length);
+                if (groups.length > 1) {
+                    const half = Math.ceil(groups.length / 2);
+                    return [groups.slice(0, half).flat(), groups.slice(half).flat()];
+                }
+                if (allowMemberSplit && ids.length > 1) {
+                    const half = Math.ceil(ids.length / 2);
+                    return [ids.slice(0, half), ids.slice(half)];
+                }
+                return [];
+            };
+            if (isCompactLocalSession) {
+                let scopes = splitScope(missingCoverageIds, true);
+                if (!scopes.length && missingCoverageIds.length) {
+                    if (missingCoverageIds.length === allRequirementIds.length && committedAfter === committedBefore)
+                        return failure();
+                    scopes = [missingCoverageIds];
+                }
+                // UX ownership is independent of coverage completion. Preserve all groups.
+                const recovery = scopes.map((slice, i) => ({ id: `coverage-capacity-${invocationCount}-${i}`, coverageOnly: true, coverageSlice: slice, toolNames: coverageSegment.toolNames, prompt: buildCoveragePrompt(slice) }));
+                recovery.push({ id: "ux-registry", toolNames: uxRegistrySegment.toolNames, prompt: buildUxRegistryPrompt() });
+                recovery.push(...buildWorkBatches([...allRequirementIds]).map((slice, i) => ({ id: `ux-local-capacity-${invocationCount}-${i}`, requirementSlice: slice, toolNames: uxSegment.toolNames, prompt: buildUxPrompt(slice) })));
+                queue.splice(index, 1, ...recovery);
+                continue;
+            }
+            if (session.coverageOnly || isUxLocalSession) {
+                const missingIds = session.coverageOnly ? missingCoverageIds : [...new Set(missingPhase.flatMap(f => f.requirementIds))];
+                if (!missingIds.length) {
+                    index += 1;
+                    continue;
+                }
+                const scopes = splitScope(missingIds, Boolean(session.coverageOnly));
+                if (scopes.length) {
+                    queue.splice(index, 1, ...scopes.map(slice => ({ ...session, ...(session.coverageOnly ? { coverageSlice: slice } : { requirementSlice: slice }), missingFacts: missingPhaseFacts.filter(f => f.requirementIds.some(id => slice.includes(id))), retryCount: 0 })));
+                    continue;
+                }
+                const originalIds = session.coverageSlice ?? session.requirementSlice ?? [];
+                if ((missingIds.length < originalIds.length || committedAfter > committedBefore) && (session.retryCount ?? 0) < 2) {
+                    queue[index] = { ...session, ...(session.coverageOnly ? { coverageSlice: missingIds } : { requirementSlice: missingIds }), missingFacts: missingPhaseFacts, retryCount: (session.retryCount ?? 0) + 1 };
+                    continue;
+                }
+            }
+            return failure();
+        }
         if (result.ok) {
             if (missingPhaseFacts.length === 0) {
                 index += 1;
@@ -3676,9 +5203,9 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 continue;
             }
             return {
-                ...result,
+                ...accumulated,
                 ok: false,
-                stderr: `${result.stderr}\nfrontend plan completeness check failed: ${missingPhaseFacts.map((item) => item.reason).join("; ")}`.trim(),
+                stderr: `${accumulated.stderr}\nfrontend plan completeness check failed: ${missingPhaseFacts.map((item) => item.reason).join("; ")}`.trim(),
                 failureCategory: "invalid-output",
             };
         }
@@ -3695,33 +5222,15 @@ export async function runFrontendPlanSegmentedSessions(input) {
             }
             if (missingPhaseFacts.length > 0) {
                 return {
-                    ...result,
+                    ...accumulated,
                     ok: false,
-                    stderr: `frontend plan completeness check failed: ${missingPhaseFacts.map((item) => item.reason).join("; ")}`,
+                    stderr: `${accumulated.stderr}\nfrontend plan completeness check failed: ${missingPhaseFacts.map((item) => item.reason).join("; ")}`.trim(),
                     failureCategory: "invalid-output",
                 };
             }
             index += 1;
             continue;
         }
-        // A length-stopped, fact-less compact session is the planner variant of
-        // writer-thinking-exhausted. Give the same scope exactly one tool-first
-        // retry before the split below re-batches the requirements, because one
-        // reinforced full-scope pass is cheaper than re-planning split halves.
-        const plannerThinkingBurn = isCompactLocalSession &&
-            committedAfter === committedBefore &&
-            !(result.assistantText ?? "").trim() &&
-            !result.stderr.trim() &&
-            !result.timedOut &&
-            readWriterThinkingExhaustionEvidence(result).stopReason === "length";
-        if (plannerThinkingBurn && (session.retryCount ?? 0) < 1) {
-            queue[index] = {
-                ...session,
-                retryCount: (session.retryCount ?? 0) + 1,
-                prompt: buildCompactLocalPrompt(),
-            };
-            continue;
-        }
         // Option 5: a multi-requirement coverage batch that failed with ZERO
         // new facts and no provider stderr is the upfront-reasoning burn —
         // halve the slice and retry instead of failing the attempt. The compact
@@ -3736,20 +5245,24 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 : undefined;
         const zeroProgressBurn = coverageSlice !== undefined &&
             coverageSlice.length > 1 &&
-            committedAfter === committedBefore &&
-            !(result.assistantText ?? "").trim() &&
-            !result.stderr.trim() &&
+            (capacityExhausted || (["empty-output", "unknown"].includes(result.failureCategory) && committedAfter === committedBefore && !(result.assistantText ?? "").trim() && !result.stderr.trim())) &&
             !result.timedOut;
         if (zeroProgressBurn && coverageSlice) {
-            const half = Math.ceil(coverageSlice.length / 2);
-            const firstSlice = coverageSlice.slice(0, half);
-            const secondSlice = coverageSlice.slice(half);
+            const missingIds = input.committedFacts ? new Set(collectFrontendPlanMissingFacts({ requirementIds: coverageSlice, committedFacts: input.committedFacts() }).flatMap(f => f.requirementIds)) : undefined;
+            const unfinished = coverageSlice.filter(id => !missingIds || missingIds.has(id));
+            if (unfinished.length <= 1)
+                return mapPlannerExhaustion({ ...result, ok: false, stderr: `${result.stderr}\nFRONTEND_INPUT_UNIT_TOO_LARGE: ${unfinished[0] ?? session.id}; no smaller complete scope can finish` }, committedAfter > committedBefore);
+            const half = Math.ceil(unfinished.length / 2);
+            const firstSlice = unfinished.slice(0, half);
+            const secondSlice = unfinished.slice(half);
             if (isCompactLocalSession) {
+                queue.splice(index + 1, 0, { id: "ux-registry", toolNames: uxRegistrySegment.toolNames, prompt: buildUxRegistryPrompt() }, ...buildWorkBatches([...firstSlice, ...secondSlice]).map((slice, i) => ({ id: `ux-local-recovery-${i}`, toolNames: uxSegment.toolNames, requirementSlice: slice, prompt: buildUxPrompt(slice) })));
                 // The split halves leave compact mode: continue them as ordinary
                 // coverage sessions so every downstream ladder branch applies.
                 queue.splice(index, 1, {
                     ...session,
                     id: `coverage-compact-split-1`,
+                    toolNames: coverageSegment.toolNames, retryCount: 0,
                     coverageOnly: true,
                     coverageSlice: firstSlice,
                     requirementSlice: firstSlice,
@@ -3757,6 +5270,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 }, {
                     ...session,
                     id: `coverage-compact-split-2`,
+                    toolNames: coverageSegment.toolNames, retryCount: 0,
                     coverageOnly: true,
                     coverageSlice: secondSlice,
                     requirementSlice: secondSlice,
@@ -3775,7 +5289,9 @@ export async function runFrontendPlanSegmentedSessions(input) {
             });
             continue;
         }
-        if ((session.coverageOnly || isUxLocalSession || session.id === "global-mock-data") &&
+        if (readWriterThinkingExhaustionEvidence(result).stopReason === "length" || ["context-overflow", "context-budget-exhausted"].includes(result.failureCategory))
+            return mapPlannerExhaustion({ ...result, ok: false, stderr: `${result.stderr}\nFRONTEND_INPUT_UNIT_TOO_LARGE: ${session.id}; refine the remaining complete scope; unchanged retries are disabled` }, committedAfter > committedBefore);
+        if ((session.coverageOnly || isUxRegistrySession || isUxLocalSession || session.id.startsWith("global-mock-data")) &&
             missingPhaseFacts.length > 0 &&
             !result.stderr.trim() &&
             !result.timedOut &&
@@ -3788,11 +5304,11 @@ export async function runFrontendPlanSegmentedSessions(input) {
             };
             continue;
         }
-        return mapPlannerExhaustion(result, committedAfter > committedBefore);
+        return mapPlannerExhaustion(accumulated, committedAfter > committedBefore);
     }
     if (index < queue.length) {
         return {
-            ...(last ?? {
+            ...(accumulated ?? {
                 ok: false,
                 stdout: "",
                 stderr: "",
@@ -3809,11 +5325,11 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 tokensUsed: 0,
             }),
             ok: false,
-            stderr: `${last?.stderr ?? ""}\nfrontend plan segmentation exceeded the ${FRONTEND_PLAN_BATCH_MAX_SESSIONS}-session safety limit before finalize`.trim(),
+            stderr: `${accumulated?.stderr ?? ""}\nfrontend plan segmentation exceeded the ${FRONTEND_PLAN_BATCH_MAX_SESSIONS}-session safety limit before finalize`.trim(),
             failureCategory: "invalid-output",
         };
     }
-    return mapPlannerExhaustion(last ?? {
+    return mapPlannerExhaustion(accumulated ?? {
         ok: false,
         stdout: "",
         stderr: "frontend plan segmentation produced no session",
@@ -3821,6 +5337,197 @@ export async function runFrontendPlanSegmentedSessions(input) {
         durationMs: 0,
     }, false);
 }
+/**
+ * Run the two independent Scout evidence surfaces concurrently while keeping
+ * their typed-event stores isolated. The main Scout store is the only store
+ * visible to Plan; shard facts are merged in completion-order-independent
+ * order after both sessions settle. This gives discovery real parallelism
+ * without allowing sibling models to race a shared revision counter.
+ */
+function aggregateParallelPiResults(results) {
+    const first = results[0];
+    const failed = results.find((result) => !result.ok);
+    const representative = failed ?? first;
+    return {
+        ...representative,
+        ok: failed === undefined,
+        failureCategory: failed?.failureCategory ?? "success",
+        durationMs: Math.max(...results.map((result) => result.durationMs), 0),
+        exitCode: failed ? failed.exitCode : 0,
+        stderr: results.map((result) => result.stderr).filter(Boolean).join("\n"),
+        tokensUsed: results.reduce((total, result) => total + result.tokensUsed, 0),
+        parsedEvents: results.reduce((total, result) => total + result.parsedEvents, 0),
+        attemptedModels: [
+            ...new Set(results.flatMap((result) => result.attemptedModels)),
+        ],
+        fallbackUsed: results.some((result) => result.fallbackUsed),
+        timedOut: results.some((result) => result.timedOut),
+    };
+}
+function combineSequentialPiResults(first, second) {
+    return {
+        ...second,
+        durationMs: first.durationMs + second.durationMs,
+        stderr: [first.stderr, second.stderr].filter(Boolean).join("\n"),
+        tokensUsed: first.tokensUsed + second.tokensUsed,
+        parsedEvents: first.parsedEvents + second.parsedEvents,
+        attemptedModels: [
+            ...new Set([...first.attemptedModels, ...second.attemptedModels]),
+        ],
+        fallbackUsed: first.fallbackUsed || second.fallbackUsed,
+        timedOut: first.timedOut || second.timedOut,
+    };
+}
+async function runFrontendScoutParallelSessions(input) {
+    const [{ createTypedEventStore }] = await Promise.all([
+        import("../workflows/dag/frontend-typed-event-store.js"),
+    ]);
+    const shards = [
+        {
+            id: "surface",
+            toolName: "record_target_surface",
+            instruction: [
+                "PARALLEL SCOUT SHARD — target surface only.",
+                "Inspect routes, entrypoints, implementation ownership, data source, and applicable test paths.",
+                "Call record_target_surface exactly once with the complete runtime-evidenced surface. Do not call record_design_evidence.",
+            ].join(" "),
+        },
+        {
+            id: "design",
+            toolName: "record_design_evidence",
+            instruction: [
+                "PARALLEL SCOUT SHARD — design evidence only.",
+                "Inspect the frontend framework, styling/theme conventions, reusable components, and relevant design/spec files.",
+                "Call record_design_evidence for the evidence you actually read. Do not call record_target_surface.",
+            ].join(" "),
+        },
+    ];
+    const outcomes = await Promise.all(shards.map(async (shard) => {
+        let shardTools;
+        let shardResult;
+        try {
+            const store = createTypedEventStore();
+            const shardNodeId = `${input.nodeId}/parallel/${shard.id}`;
+            shardTools = await createFrontendScoutEvidenceTools({
+                attemptId: `${input.attemptId}:parallel:${shard.id}`,
+                store,
+                runDir: input.runDir,
+                nodeId: shardNodeId,
+                workspaceRoot: input.workspaceRoot,
+                sourceDeclaredPaths: input.sourceDeclaredPaths,
+            });
+            const customTools = shardTools.customTools.filter((tool) => typeof tool === "object" &&
+                tool !== null &&
+                tool.name === shard.toolName);
+            const sessionOptions = {
+                ...input.sessionOptions,
+                sessionEventsPath: path.join(input.runDir, shardNodeId, "session-events.jsonl"),
+            };
+            const prompt = `${input.basePrompt}\n\n${shard.instruction}`;
+            const tools = [...customTools, ...(input.readBudgetTools ?? [])];
+            shardResult = await observeFrontendSession({
+                ...input.observation,
+                phase: `scout/parallel/${shard.id}`,
+                scopeIds: [shard.id],
+                prompt,
+                userMessage: sessionOptions.userMessage,
+                customTools: tools,
+                artifactPath: input.observation?.artifactPath ? `${input.observation.artifactPath}-${shard.id}.json` : undefined,
+                committedCount: () => shardTools?.committedFacts().length ?? 0,
+                durableCommittedCount: () => shardTools?.committedFacts().length ?? 0,
+            }, observer => input.piStepFn({
+                ...sessionOptions,
+                onAttemptObservation: observer,
+                prompt,
+                writerToolPolicy: {
+                    requireSdk: true,
+                    customTools: tools,
+                },
+            }));
+            await shardTools.flush();
+            return { shard, result: shardResult, tools: shardTools };
+        }
+        catch (error) {
+            const crashMessage = `frontend scout parallel shard ${shard.id} crashed: ${error instanceof Error ? error.message : String(error)}`;
+            return {
+                shard,
+                tools: shardTools,
+                result: shardResult
+                    ? {
+                        ...shardResult,
+                        ok: false,
+                        failureCategory: shardResult.ok
+                            ? "invalid-output"
+                            : shardResult.failureCategory,
+                        stderr: [shardResult.stderr, crashMessage]
+                            .filter(Boolean)
+                            .join("\n"),
+                    }
+                    : {
+                        ok: false,
+                        assistantText: "",
+                        command: [],
+                        durationMs: 0,
+                        exitCode: null,
+                        failureCategory: "tool-policy",
+                        modelDisplay: "unknown",
+                        parsedEvents: 0,
+                        stderr: crashMessage,
+                        stdout: "",
+                        timedOut: false,
+                        attemptedModels: [],
+                        fallbackUsed: false,
+                        tokensUsed: 0,
+                    },
+            };
+        }
+    }));
+    const ordered = [...outcomes].sort((left, right) => left.shard.id.localeCompare(right.shard.id));
+    try {
+        for (const outcome of ordered) {
+            if (outcome.result.ok && outcome.tools) {
+                await input.mainTools.adoptCommittedFacts(outcome.tools.committedFacts());
+            }
+        }
+    }
+    catch (error) {
+        const aggregate = aggregateParallelPiResults(ordered.map((outcome) => outcome.result));
+        return {
+            ...aggregate,
+            ok: false,
+            failureCategory: "invalid-output",
+            stderr: [
+                aggregate.stderr,
+                `frontend scout parallel fact merge failed: ${error instanceof Error ? error.message : String(error)}`,
+            ]
+                .filter(Boolean)
+                .join("\n"),
+        };
+    }
+    const failed = ordered.find((outcome) => !outcome.result.ok);
+    if (failed) {
+        const aggregate = aggregateParallelPiResults(ordered.map((outcome) => outcome.result));
+        return {
+            ...aggregate,
+            ok: false,
+            stderr: `${aggregate.stderr}\nfrontend scout parallel shard failed: ${failed.shard.id}`.trim(),
+        };
+    }
+    const committedKinds = new Set(ordered.flatMap((outcome) => (outcome.tools?.committedFacts() ?? [])
+        .map((record) => record.fact?.kind)
+        .filter((kind) => typeof kind === "string")));
+    const missing = ["target-surface", "design-evidence"].filter((kind) => !committedKinds.has(kind));
+    if (missing.length > 0) {
+        const fallback = aggregateParallelPiResults(ordered.map((outcome) => outcome.result));
+        return {
+            ...fallback,
+            ok: false,
+            failureCategory: "invalid-output",
+            stderr: `${fallback.stderr}\nfrontend scout parallel shards committed no ${missing.join(" or ")} fact`.trim(),
+        };
+    }
+    return aggregateParallelPiResults(ordered.map((outcome) => outcome.result));
+}
 export async function executeDagPiNode(input, meta, piStepFn = executePiStep, writeGuardDependencies = DEFAULT_DAG_PI_WRITE_GUARD_DEPENDENCIES) {
     const started = Date.now();
     const persona = resolveDagPiPersona(input.task);
@@ -3912,9 +5619,12 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     let writerToolPolicy;
     let reviewTerminalTools;
     let designTerminalTools;
+    let reviewInventory;
+    let designInventory;
     let planLedgerTools;
     let contractTools;
     let scoutEvidenceTools;
+    let scoutSourceDeclaredPaths;
     let readBudgetTools;
     const commandPolicy = resolveDagCommandPolicy(input.task.commandPolicy);
     const allowsPlaywrightCli = dagCommandPolicyAllows(input.task.commandPolicy, "playwright-cli");
@@ -4004,6 +5714,8 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             const { createTypedEventStore } = await import("../workflows/dag/frontend-typed-event-store.js");
             const store = createTypedEventStore();
             reviewTerminalTools = await createFrontendReviewTerminalTools({
+                inventory: reviewInventory = await loadFrontendReviewScopes(meta.runDir, "review", meta.spec?.frontendExecutionPolicy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES),
+                inputDigest: reviewInventory?.digest ?? createHash("sha256").update(input.prompt).digest("hex"),
                 attemptId: `${meta.runId}:${input.task.id}`,
                 store,
                 runDir: meta.runDir,
@@ -4029,6 +5741,8 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             const { createTypedEventStore } = await import("../workflows/dag/frontend-typed-event-store.js");
             const store = createTypedEventStore();
             designTerminalTools = await createFrontendDesignTerminalTools({
+                inventory: designInventory = await loadFrontendReviewScopes(meta.runDir, "design", meta.spec?.frontendExecutionPolicy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES),
+                inputDigest: designInventory?.digest ?? createHash("sha256").update(input.prompt).digest("hex"),
                 attemptId: `${meta.runId}:${input.task.id}`,
                 store,
                 runDir: meta.runDir,
@@ -4054,10 +5768,15 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             const { createTypedEventStore } = await import("../workflows/dag/frontend-typed-event-store.js");
             const store = createTypedEventStore();
             contractTools = await createFrontendContractTools({
+                sourceDigest: (meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined),
                 attemptId: `${meta.runId}:${input.task.id}`,
                 store,
                 runDir: meta.runDir,
                 nodeId: input.task.id,
+                canonicalRequirements: await resolveFrontendCanonicalRequirements({
+                    cwd: input.cwd,
+                    sourceBinding: meta.spec.sourceBinding,
+                }),
             });
             writerToolPolicy = {
                 requireSdk: true,
@@ -4078,16 +5797,19 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         try {
             const { createTypedEventStore } = await import("../workflows/dag/frontend-typed-event-store.js");
             const store = createTypedEventStore();
+            scoutSourceDeclaredPaths = await resolveFrontendScoutSourceDeclaredPaths({
+                cwd: input.cwd,
+                spec: meta.spec,
+            });
             scoutEvidenceTools = await createFrontendScoutEvidenceTools({
+                requirementIds: parseFrontendInputBlock(input.prompt, "scout")?.payload.requirements.map(r => r.id),
+                sourceDigest: (meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined),
                 attemptId: `${meta.runId}:${input.task.id}`,
                 store,
                 runDir: meta.runDir,
                 nodeId: input.task.id,
                 workspaceRoot: input.cwd,
-                sourceDeclaredPaths: await resolveFrontendScoutSourceDeclaredPaths({
-                    cwd: input.cwd,
-                    spec: meta.spec,
-                }),
+                sourceDeclaredPaths: scoutSourceDeclaredPaths,
             });
             writerToolPolicy = {
                 requireSdk: true,
@@ -4120,6 +5842,13 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                     cwd: input.cwd,
                     sourceBinding: meta.spec.sourceBinding,
                 }),
+                declaredUiStateIds: await resolveFrontendDeclaredUiStateIds({
+                    runDir: meta.runDir,
+                }),
+                canonicalVerificationTargetIds: await resolveFrontendCanonicalVerificationTargetIds({
+                    runDir: meta.runDir,
+                }),
+                workspaceRoot: input.cwd,
             });
             writerToolPolicy = {
                 requireSdk: true,
@@ -4232,8 +5961,11 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             activeTools: toolNames,
         });
         const piSessionOptions = {
+            reserveProviderRequest: input.reserveProviderRequest,
+            frontendExecutionPolicy: meta.spec?.frontendExecutionPolicy,
             attachedFiles: [],
             modelConfig,
+            outputLimitRecovery: { terminalToolNames: ["finalize_plan", "finalize_contract", "approve_design", "request_design_changes", "approve_review", "request_review_changes"] },
             repoRoot: input.cwd,
             step,
             toolNames,
@@ -4259,11 +5991,36 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 }
                 : undefined,
         };
-        if (isFrontendPlanLedgerNode(input.task) && planLedgerTools) {
-            // Frontend-only split: sequential sessions with independent
-            // output budgets (coverage -> UX decisions -> finalize), mirroring the
-            // backend-test template's module sharding. Every other template keeps
-            // the single-session path below.
+        if (isFrontendScoutEvidenceNode(input.task) &&
+            scoutEvidenceTools &&
+            input.task.complexity !== "LOW") {
+            result = await runFrontendScoutParallelSessions({
+                piStepFn,
+                sessionOptions: piSessionOptions,
+                basePrompt: input.prompt,
+                mainTools: scoutEvidenceTools,
+                runDir: meta.runDir,
+                nodeId: input.task.id,
+                attemptId: `${meta.runId}:${input.task.id}`,
+                workspaceRoot: input.cwd,
+                sourceDeclaredPaths: scoutSourceDeclaredPaths,
+                readBudgetTools: readBudgetTools?.customTools,
+                observation: {
+                    artifactPath: path.join(meta.runDir, input.task.id, "session-budget", `attempt-${input.attempt ?? 1}`),
+                    runId: meta.runId,
+                    nodeId: input.task.id,
+                    taskId: meta.spec?.sourceBinding?.taskId,
+                    attempt: input.attempt ?? 1,
+                    model: input.model,
+                    sourceDigest: meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined,
+                },
+            });
+        }
+        else if (isFrontendPlanLedgerNode(input.task) && planLedgerTools) {
+            // Frontend-only split: independent coverage map sessions feed a single
+            // reducer (UX decisions -> global policy -> finalize), mirroring the
+            // backend-test template's module sharding. Small plans normally have one
+            // coverage batch and retain the compact path below.
             let planRequirementIds = [];
             const planRequirementCosts = new Map();
             const behaviorRequiredRequirementIds = [];
@@ -4281,12 +6038,8 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                     ?.kind === "requirement")
                     .map((record) => record.fact?.id)
                     .filter((id) => typeof id === "string");
-                for (const record of contractFacts) {
-                    const fact = record.fact;
-                    if (fact?.kind !== "requirement" || typeof fact.id !== "string")
-                        continue;
-                    const evidence = fact.evidence;
-                    if (evidence?.behavior === "required")
+                for (const fact of resolveFrontendContractRequirements(contractFacts.map((record) => record.fact))) {
+                    if (fact.evidence.behavior === "required")
                         behaviorRequiredRequirementIds.push(fact.id);
                     planRequirementCosts.set(fact.id, estimateFrontendPlanRequirementRecordCalls(fact));
                 }
@@ -4294,33 +6047,236 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             catch {
                 // Unreadable ledger falls back to a single coverage session.
             }
-            result = await runFrontendPlanSegmentedSessions({
+            // Independent requirement-coverage batches are map workers. Each worker
+            // owns an isolated typed-event store; only after all workers settle do we
+            // merge facts into the main Plan ledger and run the single UX/global/
+            // finalize reducer. This avoids revision races while shortening the
+            // longest coverage phase for large plans.
+            const runPlanSessions = (options) => runFrontendPlanSegmentedSessions({
+                observation: options.observation ?? {
+                    artifactPath: path.join(meta.runDir, input.task.id, "session-budget", `attempt-${input.attempt ?? 1}`),
+                    runId: meta.runId,
+                    nodeId: input.task.id,
+                    taskId: meta.spec?.sourceBinding?.taskId,
+                    attempt: input.attempt ?? 1,
+                    model: input.model,
+                    sourceDigest: meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined,
+                    contractDigest: meta.spec?.taskContractBinding?.canonicalHash,
+                },
                 piStepFn,
-                sessionOptions: piSessionOptions,
-                basePrompt: input.prompt,
+                sessionOptions: options.sessionOptions,
+                basePrompt: options.basePrompt ?? input.prompt,
                 attempt: input.attempt ?? 1,
-                committedFactCount: () => planLedgerTools.committedFactCount(),
-                requirementIds: planRequirementIds,
+                committedFactCount: () => options.ledgerTools.committedFactCount(),
+                requirementIds: options.requirementIds ?? planRequirementIds,
                 requirementCosts: planRequirementCosts,
-                compactSmallPlan: true,
-                committedRequirementIds: () => planLedgerTools.committedRequirementIds(),
-                committedFacts: () => planLedgerTools.committedFacts(),
+                ...(options.parallelCoverageOnly !== undefined
+                    ? { parallelCoverageOnly: options.parallelCoverageOnly }
+                    : {}),
+                ...(options.compactSmallPlan !== undefined
+                    ? { compactSmallPlan: options.compactSmallPlan }
+                    : {}),
+                committedRequirementIds: () => options.ledgerTools.committedRequirementIds(),
+                committedFacts: () => options.ledgerTools.committedFacts(),
                 behaviorRequiredRequirementIds,
-                setActiveRequirementScope: (requirementIds) => planLedgerTools.setActiveRequirementScope(requirementIds),
+                setActiveRequirementScope: (requirementIds) => options.ledgerTools.setActiveRequirementScope(requirementIds),
                 segmentCustomTools: (toolNames) => toolNames === null
-                    ? planLedgerTools.customTools
-                    : planLedgerTools.customTools.filter((tool) => typeof tool === "object" &&
+                    ? options.ledgerTools.customTools
+                    : options.ledgerTools.customTools.filter((tool) => typeof tool === "object" &&
                         tool !== null &&
-                        toolNames.has(tool.name)),
-                flushLedger: () => planLedgerTools.flush(),
+                        (toolNames.has(tool.name) || tool.name === "read_plan_facts")),
+                flushLedger: () => options.ledgerTools.flush(),
             });
+            if (planRequirementIds.length > 1) {
+                const coverageTools = FRONTEND_PLAN_SEGMENTS.find(segment => segment.id === "coverage").toolNames;
+                const workload = buildFrontendPlanWorkload({
+                    basePrompt: input.prompt, requirementIds: planRequirementIds,
+                    requirementCosts: planRequirementCosts, sessionOptions: piSessionOptions,
+                    allTools: planLedgerTools.customTools,
+                    coverageTools: planLedgerTools.customTools.filter(tool => isRecordObject(tool) && coverageTools.has(String(tool.name))),
+                });
+                let coverageBatches;
+                try {
+                    coverageBatches = await loadOrCreateFrontendPlanCoverageLayout({
+                        runDir: meta.runDir, nodeId: input.task.id, workload, requirementIds: planRequirementIds,
+                        binding: {
+                            runId: meta.runId, nodeId: input.task.id, sourceBinding: meta.spec.sourceBinding,
+                            skeleton: input.task.structuredContractOutput?.skeleton, writeSet: input.task.writeSet,
+                            policy: meta.spec.frontendExecutionPolicy, requirements: [...planRequirementCosts],
+                            compiledInput: workload.frozenInput, workGroups: workload.workGroups,
+                        },
+                    });
+                }
+                catch (error) {
+                    return { ok: false, stdout: "", durationMs: Date.now() - started, failureCategory: "tool-policy",
+                        stderr: `frontend plan coverage layout unavailable: ${error instanceof Error ? error.message : String(error)}` };
+                }
+                if (coverageBatches.length > 1) {
+                    const shardResults = await mapWithConcurrency(coverageBatches, piSessionOptions.frontendExecutionPolicy?.maxCoverageConcurrency ?? FRONTEND_PLAN_COVERAGE_MAX_CONCURRENCY, async (slice, index) => {
+                        let shardTools;
+                        let shardResult;
+                        try {
+                            const { createTypedEventStore } = await import("../workflows/dag/frontend-typed-event-store.js");
+                            shardTools = await createFrontendPlanLedgerTools({
+                                attemptId: `${meta.runId}:${input.task.id}:parallel:${index + 1}`,
+                                store: createTypedEventStore(),
+                                runDir: meta.runDir,
+                                nodeId: `${input.task.id}/parallel/coverage-${index + 1}`,
+                                skeleton: input.task.structuredContractOutput?.skeleton,
+                                sourceBinding: meta.spec.sourceBinding,
+                                requirementIds: slice,
+                                writeSetPatterns: input.task.writeSet,
+                                canonicalVerificationTargetIds: await resolveFrontendCanonicalVerificationTargetIds({
+                                    runDir: meta.runDir,
+                                }),
+                                componentNewSourceReferences: await resolveFrontendPlanNewComponentSourceReferences({
+                                    cwd: input.cwd,
+                                    sourceBinding: meta.spec.sourceBinding,
+                                }),
+                            });
+                            const shardSessionOptions = {
+                                ...piSessionOptions,
+                                sessionEventsPath: path.join(meta.runDir, input.task.id, "parallel", `coverage-${index + 1}`, "session-events.jsonl"),
+                            };
+                            shardResult = await runPlanSessions({
+                                ledgerTools: shardTools,
+                                sessionOptions: shardSessionOptions,
+                                requirementIds: slice,
+                                basePrompt: `${input.prompt}\n\nPARALLEL COVERAGE SHARD ${index + 1}: use the frozen canonical behavior verification-target ids listed in the record_plan_verification_target tool description — do not prefix ids with a shard namespace or invent variant ids; identical cross-shard targets are deduped, divergent ones fail the merge.`,
+                                parallelCoverageOnly: true,
+                                observation: {
+                                    artifactPath: path.join(meta.runDir, input.task.id, "parallel", `coverage-${index + 1}`, "session-budget", `attempt-${input.attempt ?? 1}`),
+                                    runId: meta.runId,
+                                    nodeId: `${input.task.id}/parallel/coverage-${index + 1}`,
+                                    taskId: meta.spec?.sourceBinding?.taskId,
+                                    attempt: input.attempt ?? 1,
+                                    model: input.model,
+                                    sourceDigest: meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined,
+                                    contractDigest: meta.spec?.taskContractBinding?.canonicalHash,
+                                },
+                            });
+                            await shardTools.flush();
+                            return { index, result: shardResult, tools: shardTools };
+                        }
+                        catch (error) {
+                            const crashMessage = `frontend plan coverage shard ${index + 1} crashed: ${error instanceof Error ? error.message : String(error)}`;
+                            return {
+                                index,
+                                tools: shardTools,
+                                result: shardResult
+                                    ? {
+                                        ...shardResult,
+                                        ok: false,
+                                        failureCategory: shardResult.ok
+                                            ? "invalid-output"
+                                            : shardResult.failureCategory,
+                                        stderr: [shardResult.stderr, crashMessage]
+                                            .filter(Boolean)
+                                            .join("\n"),
+                                    }
+                                    : {
+                                        ok: false,
+                                        assistantText: "",
+                                        command: [],
+                                        durationMs: 0,
+                                        exitCode: null,
+                                        failureCategory: "tool-policy",
+                                        modelDisplay: "unknown",
+                                        parsedEvents: 0,
+                                        stderr: crashMessage,
+                                        stdout: "",
+                                        timedOut: false,
+                                        attemptedModels: [],
+                                        fallbackUsed: false,
+                                        tokensUsed: 0,
+                                    },
+                            };
+                        }
+                    }, shard => shard.result.failureCategory === "rate-limit");
+                    const coverageResult = aggregateParallelPiResults(shardResults.map((shard) => shard.result));
+                    let mergeFailure;
+                    try {
+                        // Flatten every shard's facts FIRST, then pre-reduce: shards
+                        // partition requirements but a frozen verification target can
+                        // span shards, so same-id targets must merge across shards
+                        // before adoption, not per shard.
+                        await planLedgerTools.adoptCommittedFacts(reduceParallelCoverageShardRecords(shardResults
+                            .filter((item) => item.result.ok && item.tools)
+                            .flatMap((shard) => normalizeParallelCoverageShardRecords(shard.tools.committedFacts(), shard.index + 1))));
+                    }
+                    catch (error) {
+                        mergeFailure = error;
+                    }
+                    const failedShard = shardResults.find((shard) => !shard.result.ok);
+                    if (mergeFailure) {
+                        result = {
+                            ...coverageResult,
+                            ok: false,
+                            failureCategory: "invalid-output",
+                            stderr: [
+                                coverageResult.stderr,
+                                `frontend plan coverage shard merge failed: ${mergeFailure instanceof Error ? mergeFailure.message : String(mergeFailure)}`,
+                            ]
+                                .filter(Boolean)
+                                .join("\n"),
+                        };
+                    }
+                    else if (failedShard) {
+                        result = {
+                            ...coverageResult,
+                            ok: false,
+                            stderr: `${coverageResult.stderr}\nfrontend plan coverage shard ${failedShard.index + 1} failed before reduce`.trim(),
+                        };
+                    }
+                    else {
+                        const reducerResult = await runPlanSessions({
+                            ledgerTools: planLedgerTools,
+                            sessionOptions: piSessionOptions,
+                        });
+                        result = combineSequentialPiResults(coverageResult, reducerResult);
+                    }
+                }
+                else {
+                    result = await runPlanSessions({
+                        ledgerTools: planLedgerTools,
+                        sessionOptions: piSessionOptions,
+                        compactSmallPlan: true,
+                    });
+                }
+            }
+            else {
+                result = await runPlanSessions({
+                    ledgerTools: planLedgerTools,
+                    sessionOptions: piSessionOptions,
+                    compactSmallPlan: true,
+                });
+            }
+        }
+        else if (contractTools) {
+            result = await runFrontendContractSegmentedSessions({
+                piStepFn, sessionOptions: piSessionOptions, basePrompt: input.prompt, tools: contractTools,
+                observation: { artifactPath: path.join(meta.runDir, input.task.id, "session-budget", `attempt-${input.attempt ?? 1}`), runId: meta.runId, nodeId: input.task.id, taskId: meta.spec?.sourceBinding?.taskId, attempt: input.attempt ?? 1, model: input.model, sourceDigest: meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined },
+            });
+        }
+        else if ((reviewInventory && reviewTerminalTools) || (designInventory && designTerminalTools)) {
+            result = await runFrontendReviewSegmentedSessions({ piStepFn, sessionOptions: piSessionOptions, basePrompt: input.prompt, inventory: (reviewInventory ?? designInventory), tools: (reviewTerminalTools ?? designTerminalTools), customTools: writerToolPolicy.customTools, phase: reviewInventory ? "review" : "design",
+                observation: { artifactPath: path.join(meta.runDir, input.task.id, "session-budget", `attempt-${input.attempt ?? 1}`), runId: meta.runId, nodeId: input.task.id, taskId: meta.spec?.sourceBinding?.taskId, attempt: input.attempt ?? 1, model: input.model, contractDigest: (reviewInventory ?? designInventory).digest } });
+        }
+        else if (scoutEvidenceTools && parseFrontendInputBlock(input.prompt, "scout")) {
+            result = await runFrontendScoutSegmentedSessions({ piStepFn, sessionOptions: piSessionOptions, basePrompt: input.prompt, tools: scoutEvidenceTools, customTools: writerToolPolicy.customTools,
+                observation: { artifactPath: path.join(meta.runDir, input.task.id, "session-budget", `attempt-${input.attempt ?? 1}`), runId: meta.runId, nodeId: input.task.id, taskId: meta.spec?.sourceBinding?.taskId, attempt: input.attempt ?? 1, model: input.model, sourceDigest: meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined } });
         }
         else {
-            result = await piStepFn({
+            result = await observeFrontendSession({
+                artifactPath: input.task.id.startsWith("frontend-") ? path.join(meta.runDir, input.task.id, "session-budget", `attempt-${input.attempt ?? 1}.json`) : undefined,
+                phase: input.task.id, prompt: input.prompt, userMessage: piSessionOptions.userMessage, customTools: writerToolPolicy?.customTools,
+                runId: meta.runId, nodeId: input.task.id, taskId: meta.spec?.sourceBinding?.taskId, attempt: input.attempt ?? 1, model: input.model, sourceDigest: (meta.spec?.sourceBinding?.schemaVersion === 2 ? meta.spec.sourceBinding.inputDigest : undefined), contractDigest: meta.spec?.taskContractBinding?.canonicalHash,
+            }, observer => piStepFn({
                 ...piSessionOptions,
+                onAttemptObservation: observer,
                 prompt: input.prompt,
                 ...(writerToolPolicy ? { writerToolPolicy } : {}),
-            });
+            }));
         }
         try {
             const verificationCommandFiles = collectFrontendVerificationCommandFiles(input.prompt);
@@ -4376,6 +6332,37 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         : input.task.writerOutcomePolicy
             ? WRITER_OUTCOME_PROTOCOL_LINE
             : input.task.firstProtocolLine);
+    if (input.task.id === "generate-backend-md-plan-pi") {
+        if (mapped.stopReason === "length") {
+            return {
+                ...mapped,
+                ok: false,
+                failureCategory: STRUCTURED_OUTPUT_RETRY_CATEGORY,
+                stderr: [
+                    mapped.stderr,
+                    "backend-test Markdown plan was truncated before its required protocol could be trusted: stopReason=length; retry with the final artifact first",
+                ]
+                    .filter(Boolean)
+                    .join("\n"),
+            };
+        }
+        if (mapped.ok) {
+            const protocol = assessBackendTestPlanProtocol(mapped.assistantText || mapped.stdout);
+            if (!protocol.ok) {
+                return {
+                    ...mapped,
+                    ok: false,
+                    failureCategory: "invalid-output",
+                    stderr: [
+                        mapped.stderr,
+                        `backend-test Markdown plan protocol invalid: ${protocol.issues.map((issue) => `${issue.code}: ${issue.detail}`).join("; ")}`,
+                    ]
+                        .filter(Boolean)
+                        .join("\n"),
+                };
+            }
+        }
+    }
     // A node-specific budget is enforced for every frontend reader that opts in,
     // including design/final review. Earlier code only checked contract, scout,
     // and plan nodes, leaving the two largest review sessions unbounded.
@@ -4454,8 +6441,8 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         try {
             await scoutEvidenceTools?.flush?.();
         }
-        catch {
-            // best-effort flush
+        catch (error) {
+            return { ...mapped, ok: false, failureCategory: mapped.ok ? "frontend-ledger-invalid" : mapped.failureCategory, stderr: `${mapped.stderr}\nFRONTEND_LEDGER_INTEGRITY_INVALID: ${error instanceof Error ? error.message : String(error)}` };
         }
         if (mapped.ok) {
             const { checkCommittedOriginFacts, readCommittedOriginFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
@@ -4829,7 +6816,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 runDir: meta.runDir,
                 progress,
                 attempt: input.attempt ?? 1,
-                maxAttempts: input.task.retryPolicy?.maxAttempts ?? 3,
+                maxAttempts: input.task.retryPolicy?.maxAttempts ?? 5,
             });
             if (progress.status !== "PASS") {
                 const classified = classifyBackendTestWriterCompletenessFailure(progress);
@@ -4879,7 +6866,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         stderrParts.push(completenessFailure.detail);
     }
     if (writerThinkingExhausted) {
-        stderrParts.push(`${WRITER_THINKING_EXHAUSTED_CATEGORY}: stopReason=length, thinking observed, 0 write tool calls, 0 attributed diff; recommend a model switch and a new run`);
+        stderrParts.push(`${OUTPUT_LIMIT_RETRY_CATEGORY}: stopReason=length ended the turn before any write tool call; retry from the existing workspace and complete only unfinished targets`);
     }
     if (meta.writeGuardAttribution === "best-effort") {
         stderrParts.push("write guard note: concurrent rank writers use best-effort per-node attribution; keep same-rank writeSet entries disjoint");
@@ -4952,14 +6939,11 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                         rawFailureCategory === "context-overflow" &&
                             (changeManifestChangedFiles?.length ?? 0) > 0
                             ? "partial-success-with-context-overflow"
-                            : // writer-thinking-exhausted: a length-stopped thinking-only attempt with
-                                // zero write tool calls and zero attributed diff is terminal and
-                                // non-retryable; recommend a model switch + fresh run. Only applies on
-                                // the empty-output base category so provider/transport failures keep
-                                // their original category, and only when the completeness gate did not
-                                // upgrade to incomplete-write-set above.
+                            : // output-limit: a length-stopped attempt is capacity truncation, not
+                                // empty output. Preserve the raw category for diagnostics and let the
+                                // node retry from committed facts/current workspace state.
                                 writerThinkingExhausted
-                                    ? WRITER_THINKING_EXHAUSTED_CATEGORY
+                                    ? OUTPUT_LIMIT_RETRY_CATEGORY
                                     : writerCleanTimeout
                                         ? WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY
                                         : // writer-budget-exhausted: the provider session consumed an