@tea-agent/loop-agent 0.42.0-next.9 → 0.42.1

package/dist/workflows/dag/node-execution.js

@@ -1,3 +1,5 @@
+import { collectFrontendExecutionGroups } from "./frontend-execution-groups.js";
+import { reserveDagProviderRequest } from "./budget-enforcement.js";
 import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -13,7 +15,7 @@ import { buildDagNodePromptEnvelope, formatConvergenceFeedbackBlock, } from "./p
 import { persistLongNodeOutputArtifacts } from "./upstream-artifacts.js";
 import { materializeDeclaredArtifactFacts } from "./artifact-bindings.js";
 import { buildOutputLimitRecoverySection, loadBackendTestWriterProgressForRetry, } from "./backend-test-writer-completeness.js";
-import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
+import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, OUTPUT_LIMIT_RETRY_CATEGORY, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
 import { applyNodeActivity, evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
 import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, parseJsonReviewVerdict, validateOutputProtocol, } from "./output-protocol.js";
 import { getStructuredContractValidator } from "./contract-output-registry.js";
@@ -21,6 +23,7 @@ import "./contract-validator-registrations.js";
 import { computeNormalizedFailureFingerprint } from "./frontend-recovery-lineage.js";
 import { parseLedgerJson } from "../../task/source-prepare/ledger.js";
 import { readTypedEventStoreFromJsonl } from "./frontend-typed-event-store.js";
+import { collectCanonicalStateFlowNames, extractRequiredDeliverablePaths, resolveFrontendContractRequirements, } from "./frontend-contract-facts.js";
 import { allowedRepairReadPaths, auditRepairAttemptToolUse, buildStructuredOutputRepairPrompt, freezeStructuredOutputRepairContext, hasNonEmptyStructuredCandidate, isFrontendStructuredRepairSchemaId, isStructuredRepairableFailureCategory, persistStructuredAttemptRaw, sessionEventsByteLength, GOVERNANCE_BLOCKED_CATEGORY, STRUCTURED_REPAIR_EXHAUSTED_CATEGORY, } from "./structured-output-repair.js";
 import { readFrontendCanonicalCandidate } from "./frontend-implementation-contract.js";
 import { writeDagNodeJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
@@ -256,6 +259,9 @@ function frontendPlanValidationRetryGuidance(reason) {
     if (/verificationTargets.*uiStates|uiStates.*verificationTargets/i.test(reason)) {
         guidance.push("For this retry, provide verificationTargets[].uiStates as an array; use [] when the target has no named UI state.");
     }
+    if (/duplicate|already recorded/i.test(reason)) {
+        guidance.push("For this retry, re-commit the corrected entry with the same id and replace=true; the ledger compiles the latest submission as the full replacement. A duplicate receipt is a correction invitation, not a prohibition, and backfilling a cited fact's reverse reference in-node does not re-derive committed facts.");
+    }
     return guidance;
 }
 function compactRetryText(text, maxChars) {
@@ -293,6 +299,12 @@ export function buildContextOverflowRetryPrompt(task, basePrompt) {
             compactRetrySection(basePrompt, "task", COMPACT_RETRY_TASK_MAX_CHARS),
             "</task>",
         ].join("\n"),
+        // Plan still needs the complete frozen obligations for ledger ownership
+        // and scoped projection. Its executor packs this block before dispatch;
+        // dropping or character-truncating it prevents safe progress recovery.
+        ...(isFrontendPlanLadderTask(task)
+            ? [basePrompt.match(/<frontend_plan_input>[\s\S]*?<\/frontend_plan_input>/)?.[0] ?? ""]
+            : []),
     ].join("\n\n");
 }
 function isFrontendPlanLadderTask(task) {
@@ -325,6 +337,8 @@ const FRONTEND_CONTRACT_RECORD_TOOL_NAMES_LOCAL = new Set([
     "record_handoff_intent",
     "record_open_question",
     "record_split_proposal",
+    "record_ui_state",
+    "record_required_deliverables",
 ]);
 async function countContractRecordSubmissions(runDir, nodeId) {
     const eventsPath = path.join(runDir, nodeId, "session-events.jsonl");
@@ -374,27 +388,14 @@ async function readFrontendPlanCommittedSnapshot(runDir, nodeId) {
 function planInputRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function planInputText(value, maxChars = 240) {
-    if (typeof value !== "string" || value.trim().length === 0)
-        return undefined;
-    const normalized = value.trim();
-    return normalized.length <= maxChars
-        ? normalized
-        : `${normalized.slice(0, maxChars - 1)}…`;
+function planInputText(value, _maxChars) {
+    return typeof value === "string" && value.trim().length ? value.trim() : undefined;
 }
 function planInputStrings(value) {
     return Array.isArray(value)
         ? value.filter((item) => typeof item === "string")
         : [];
 }
-/** Input bound for the planner evidence block; protects the model input budget. */
-const FRONTEND_PLAN_INPUT_MAX_CHARS = 12_000;
-const FRONTEND_PLAN_INPUT_CAP_LADDER = [
-    { text: 240, array: 40 },
-    { text: 120, array: 20 },
-    { text: 60, array: 10 },
-    { text: 24, array: 4 },
-];
 /**
  * Frozen requirement→PRD citation map for the plan review checklist: lets the
  * model declare sourceRequirementIds whose section/line match the component
@@ -440,78 +441,19 @@ async function resolveComponentSourceCitations(spec, cwd) {
         return new Map();
     }
 }
-/** Input bound for the contract node's compiled ledger block. */
-const FRONTEND_CONTRACT_INPUT_MAX_CHARS = 12_000;
 /**
- * Render the contract node's complete-but-bounded ledger handoff. The
+ * Render the contract node's complete semantic ledger handoff. The
  * source-fidelity ledger already extracted canonical requirements with source
  * spans; the contract node confirms and commits them incrementally through
  * record_requirement instead of re-reading the raw source (extreme-environment:
  * a small output window cannot absorb a full source re-read).
  *
- * Same shape guarantees as the plan input block: always valid JSON under the
- * char bound, ids never drop, texts degrade through the cap ladder.
+ * Whole obligations are retained here; the executor selects complete scopes
+ * before dispatch. References and conditions are never clipped.
  */
 export function renderFrontendContractInputContext(input) {
-    // Fragment bindings are ids, not prose: they are the one thing the contract
-    // must never lose. r6 regression — the last-resort degradation dropped
-    // sourceFragmentIds entirely, the model (correctly refusing to invent ids)
-    // committed empty bindings, and the plan compile failed the ledger-binding
-    // gate for every requirement. Bindings therefore bypass the cap ladder and
-    // every degradation level; only requirement TEXTS and fragment CONTEXT
-    // (path/headingPath) may degrade. Fragment context is rendered only for
-    // fragments actually referenced by a requirement and shrinks first.
-    const referencedFragmentIds = new Set(input.canonicalRequirements.flatMap((requirement) => planInputStrings(requirement.sourceFragmentIds)));
-    const referencedFragments = input.fragments.filter((fragment) => referencedFragmentIds.has(fragment.id));
-    const serializeAtCap = (cap) => JSON.stringify({
-        requirements: input.canonicalRequirements.map((requirement) => ({
-            id: requirement.id,
-            text: planInputText(requirement.text, cap.text),
-            sourceFragmentIds: planInputStrings(requirement.sourceFragmentIds),
-        })),
-        fragments: referencedFragments.map((fragment) => ({
-            id: fragment.id,
-            path: planInputText(fragment.path, 200),
-            headingPath: planInputText(fragment.headingPath, 120),
-            lineRange: fragment.lineRange,
-        })),
-    });
-    let serialized = serializeAtCap(FRONTEND_PLAN_INPUT_CAP_LADDER[0]);
-    for (const cap of FRONTEND_PLAN_INPUT_CAP_LADDER.slice(1)) {
-        if (serialized.length <= FRONTEND_CONTRACT_INPUT_MAX_CHARS)
-            break;
-        serialized = serializeAtCap(cap);
-    }
-    if (serialized.length > FRONTEND_CONTRACT_INPUT_MAX_CHARS) {
-        // Last resort: keep every requirement id AND its fragment bindings,
-        // degrade texts, and shrink referenced fragment context first (halve,
-        // then drop context fields, then drop the fragment list entirely).
-        // Requirement ids and sourceFragmentIds are never dropped.
-        let fragments = referencedFragments.map((fragment) => ({
-            id: fragment.id,
-            path: planInputText(fragment.path, 120),
-        }));
-        let requirements = input.canonicalRequirements.map((requirement) => {
-            const sourceFragmentIds = planInputStrings(requirement.sourceFragmentIds);
-            return {
-                id: requirement.id,
-                text: "(truncated)",
-                // Empty bindings carry no information; omit them so the payload
-                // stays inside the char bound when no requirement is bound.
-                ...(sourceFragmentIds.length > 0 ? { sourceFragmentIds } : {}),
-            };
-        });
-        let bounded = JSON.stringify({ degraded: "requirement-texts-truncated", requirements, fragments });
-        while (bounded.length > FRONTEND_CONTRACT_INPUT_MAX_CHARS && fragments.length > 0) {
-            fragments = fragments.slice(0, Math.floor(fragments.length / 2));
-            bounded = JSON.stringify({
-                degraded: "requirement-texts-truncated",
-                requirements,
-                fragments,
-            });
-        }
-        serialized = bounded;
-    }
+    const referenced = new Set(input.canonicalRequirements.flatMap(r => r.sourceFragmentIds));
+    const serialized = JSON.stringify({ requirements: input.canonicalRequirements, fragments: input.fragments.filter(f => referenced.has(f.id)) });
     return [
         "<frontend_contract_input>",
         "Canonical requirements extracted by the source-fidelity ledger, compiled by the runner. Treat them as the authoritative requirement inventory: confirm and commit each requirement through record_requirement (one per tool call); the ledger already binds source fragments, so do NOT re-read the raw source files.",
@@ -536,16 +478,13 @@ export async function buildFrontendContractInputContext(input) {
     });
 }
 /**
- * Render the planner's complete-but-bounded evidence handoff from committed
+ * Render the planner's complete semantic evidence handoff from committed
  * typed facts. It deliberately excludes upstream response prose and artifact
  * paths: Contract and Scout have already established these facts, so Plan
  * should decide and commit rather than spend another model turn reading them.
  *
- * The block is always valid JSON under the char bound: field texts shrink
- * through a cap ladder before any fact is dropped, and the last-resort
- * fallback keeps every requirement id (with `text: "(truncated)"`) while
- * declaring the degradation, so the planner records targeted evidence gaps
- * instead of receiving a silently corrupted tail.
+ * Whole obligations are retained. Session packing and scoped projection happen
+ * in the executor before dispatch, without dropping text or source identities.
  */
 export function renderFrontendPlanInputContext(input) {
     const committedFacts = (records) => records.flatMap((record) => record.phase === "committed" && planInputRecord(record.fact)
@@ -553,8 +492,9 @@ export function renderFrontendPlanInputContext(input) {
         : []);
     const contractFacts = committedFacts(input.contractRecords);
     const scoutFacts = committedFacts(input.scoutRecords);
-    const requirements = contractFacts
-        .filter((fact) => fact.kind === "requirement" && fact.origin === "contract")
+    const requirementFacts = resolveFrontendContractRequirements(contractFacts);
+    const requiredDeliverables = extractRequiredDeliverablePaths(contractFacts);
+    const requirements = requirementFacts
         .map((fact) => ({
         id: planInputText(fact.id, 80),
         text: planInputText(fact.text),
@@ -580,92 +520,50 @@ export function renderFrontendPlanInputContext(input) {
         paths: fact.paths,
         conflicts: fact.conflicts,
     }));
+    // Authoritative UI states (contract-declared): the source's UI-state table
+    // extracted by the contract node. The planner binds these ids instead of
+    // inventing list-visibility variants.
+    const declaredUiStates = contractFacts
+        .filter((fact) => fact.kind === "ui-state-declaration" && fact.origin === "contract")
+        .map((fact) => ({
+        id: planInputText(fact.id, 80),
+        trigger: planInputText(fact.trigger),
+        observableOutcome: planInputText(fact.observableOutcome),
+    }))
+        .filter((state) => state.id !== undefined);
+    // Replay registry edits and state-flow removals/additions in commit order.
+    const committedUxNames = collectCanonicalStateFlowNames(input.planRecords ?? [], true);
+    const committedUiStateNames = [...committedUxNames.uiStateNames];
+    const committedInteractionNames = [...committedUxNames.interactionNames];
     // Reviewer-rubric scaffold: the design reviewer re-runs the design-policy
     // checks on the committed facts, so publish the checklist to the producer.
     // Requirements whose contract evidence expects behavioural verification are
     // enumerated explicitly — those are the slots the reviewer finds missing
     // when the plan models interactions ad hoc (r8/r9 findings).
-    const behaviorRequiredIds = requirements
-        .filter((requirement) => {
-        const fact = contractFacts.find((candidate) => candidate.kind === "requirement" &&
-            candidate.origin === "contract" &&
-            candidate.id === requirement.id);
-        const evidence = fact?.evidence;
-        return evidence?.behavior === "required";
-    })
+    const behaviorRequiredIds = requirementFacts
+        .filter((requirement) => requirement.evidence.behavior === "required")
         .map((requirement) => requirement.id);
-    const serializeAtCap = (cap) => JSON.stringify({
-        requirements: requirements.map((requirement) => ({
-            id: requirement.id,
-            text: planInputText(requirement.text, cap.text),
-            sourceFragmentIds: planInputStrings(requirement.sourceFragmentIds).slice(0, cap.array),
-        })),
-        targetSurface: targetSurface.map((surface) => ({
-            completeness: planInputText(surface.completeness, 32),
-            entrypoint: planInputText(surface.entrypoint, cap.text),
-            routeOrMount: planInputText(surface.routeOrMount, cap.text),
-            implementationPaths: planInputStrings(surface.implementationPaths).slice(0, cap.array),
-            testPaths: planInputStrings(surface.testPaths).slice(0, cap.array),
-            dataSource: planInputText(surface.dataSource, cap.text),
-            allowedPathConflicts: planInputStrings(surface.allowedPathConflicts).slice(0, cap.array),
-            unresolvedPaths: planInputStrings(surface.unresolvedPaths).slice(0, cap.array),
-        })),
-        designEvidence: designEvidence.map((evidence) => ({
-            source: planInputText(evidence.source, cap.text),
-            paths: planInputStrings(evidence.paths).slice(0, cap.array),
-            conflicts: planInputStrings(evidence.conflicts).slice(0, cap.array),
-        })),
+    const serialized = JSON.stringify({
+        requirements, requiredDeliverables, targetSurface, designEvidence, declaredUiStates,
+        executionGroups: collectFrontendExecutionGroups(contractFacts.filter(f => f.kind === "requirement").map(f => ({ id: String(f.id), execution: f.execution }))),
+        constraints: contractFacts.filter(f => ["constraint", "open-question", "split-proposal", "handoff-intent"].includes(String(f.kind))),
+        committedUx: committedUiStateNames.length || committedInteractionNames.length ? { uiStateNames: committedUiStateNames, interactionNames: committedInteractionNames } : undefined,
     });
-    let serialized = serializeAtCap(FRONTEND_PLAN_INPUT_CAP_LADDER[0]);
-    for (const cap of FRONTEND_PLAN_INPUT_CAP_LADDER.slice(1)) {
-        if (serialized.length <= FRONTEND_PLAN_INPUT_MAX_CHARS)
-            break;
-        serialized = serializeAtCap(cap);
-    }
-    if (serialized.length > FRONTEND_PLAN_INPUT_MAX_CHARS) {
-        // Last resort: keep every requirement id (ids are short and the plan
-        // prompt separately lists them) but drop their texts, shrink scout facts
-        // to the minimum, and declare the degradation instead of corrupting JSON.
-        let fallback = {
-            degraded: "requirement-texts-truncated",
-            requirements: requirements.map((requirement) => ({
-                id: requirement.id,
-                text: "(truncated)",
-            })),
-            targetSurface: targetSurface.map((surface) => ({
-                completeness: planInputText(surface.completeness, 32),
-                implementationPaths: planInputStrings(surface.implementationPaths).slice(0, FRONTEND_PLAN_INPUT_CAP_LADDER[3].array),
-            })),
-            designEvidence: [],
-        };
-        let bounded = JSON.stringify(fallback);
-        let keep = fallback.requirements.length;
-        while (bounded.length > FRONTEND_PLAN_INPUT_MAX_CHARS &&
-            keep > 0) {
-            keep = Math.max(0, Math.floor(keep / 2));
-            fallback = { ...fallback, requirements: fallback.requirements.slice(0, keep) };
-            bounded = JSON.stringify({
-                ...fallback,
-                requirementIdsTruncated: keep < requirements.length,
-            });
-        }
-        serialized = bounded;
-    }
     const checklistLines = [
-        "1. Every interaction you record needs a uiComponentChoices entry whose purpose equals the interaction name, or one decision=reuse-existing choice covering behavioural interactions.",
-        "2. Every applicable UI state needs a purpose-matching component choice or a stylingStrategy.",
-        "3. Every requirement marked (behavior) below needs modelled interactions plus at least one verification target that references it.",
-        "4. targets.files must name the concrete deliverable files; never leave the scope broader than the frozen requirements state.",
+        "1. Record the GLOBAL UX vocabulary with record_state_registry BEFORE any record_state_flow: one stable behavior-domain name per state/interaction (e.g. planner-task-edit), never one name per AC number, and never a rename of an already-recorded concept. Coverage slices by AC; UX does not.",
+        "2. Every recorded interaction/uiState name must be in that registry, and uiState names must use the contract's declared authoritative ids (declaredUiStates below) when present.",
+        "3. Every interaction and every applicable UI state must be covered by a uiComponentChoices entry: its purpose equals the name, or the choice lists the name in covers (one choice may cover many ids). A reuse-existing decision without evidencePath is rejected; stylingStrategy alone covers nothing.",
+        "4. Every requirement marked (behavior) below needs modelled interactions plus at least one verification target that references it.",
         "5. Verification targets may only reference UI states and requirements you actually recorded (the record_* tools reject unknown references).",
         `Requirements requiring behavioural coverage: ${behaviorRequiredIds.length > 0 ? behaviorRequiredIds.join(", ") : "(none)"}`,
-        "6. A decision=new component must declare sourceRequirementIds and pass sourceFragmentId for the frozen PRD fragment whose section matches the component's purpose — the runtime validates that binding and derives specReference (path/section/line); the reviewer checks purpose↔citation consistency.",
+        "6. A decision=new component must declare sourceRequirementIds and pass sourceFragmentId for the frozen PRD fragment whose section matches the component's purpose — the runtime validates that binding and derives specReference (path/section/line); the reviewer checks purpose↔citation consistency. A decision=reuse-existing component must pass evidencePath pointing at the existing repo file that proves the reuse.",
         ...[...input.componentSourceCitations ?? []]
             .filter(([id]) => behaviorRequiredIds.includes(id))
             .flatMap(([id, citations]) => citations.map((citation) => `   ${id} + ${citation.fragmentId} → ${citation.section}${citation.line ? ` (line ${citation.line})` : ""}`)),
     ];
     return [
         "<frontend_plan_input>",
-        "Committed Contract/Scout facts, compiled by the runner. Treat them as the complete planning evidence.",
+        "Committed Contract/Scout facts, compiled by the runner. Treat them as the complete planning evidence. declaredUiStates are the authoritative UI states from the task source; committedUx (retry attempts) is the UX vocabulary already recorded — reuse those names, never re-invent them.",
         serialized,
         "Do not read upstream artifacts, task sources, or repository files. If this input cannot support a decision, record a genuine evidence gap.",
         "</frontend_plan_input>",
@@ -692,6 +590,16 @@ export async function buildFrontendPlanInputContext(runDir, componentSourceCitat
         // forbids reading anything.
         throw new Error(`frontend-plan-input-unavailable: cannot read committed typed facts (${error instanceof Error ? error.message : String(error)})`);
     }
+    // Retry-attempt continuity (UX slice visibility): the plan node's own
+    // committed facts are absent on the first attempt and present on retries;
+    // a missing file is normal there, not a broken pipeline.
+    let planRecords = [];
+    try {
+        planRecords = await readTypedEventStoreFromJsonl(path.join(runDir, "frontend-plan-pi", "plan-typed-facts.jsonl"));
+    }
+    catch {
+        planRecords = [];
+    }
     const committedCount = [...contractRecords, ...scoutRecords].filter((record) => record.phase === "committed").length;
     if (committedCount === 0) {
         throw new Error(`frontend-plan-input-unavailable: no committed Contract/Scout facts in ${contractFactsPath} / ${scoutFactsPath}`);
@@ -699,6 +607,7 @@ export async function buildFrontendPlanInputContext(runDir, componentSourceCitat
     return renderFrontendPlanInputContext({
         contractRecords,
         scoutRecords,
+        planRecords,
         componentSourceCitations,
     });
 }
@@ -721,77 +630,27 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
-    if (frontendPlanRetryStep === "compact-terminal-first") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: compact-terminal-first.",
-            "Do NOT rewrite the narrative. Only adopt already staged/quarantined fresh facts, fill the missing required facts, then call finalize_plan exactly once.",
-            "Keep the existing committed ledger intact; do not re-derive already committed facts.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (frontendPlanRetryStep === "bounded-tool-only") {
+    if (task.id === "generate-backend-md-plan-pi" &&
+        (previousFailureCategory === "output-too-large" ||
+            previousFailureCategory === "invalid-output")) {
         return [
             basePrompt,
             "",
             "<retry_instruction>",
-            "Frontend plan retry ladder step: bounded-tool-only.",
-            "Reduce reasoning and wall-clock time. Use only read / fact / terminal tools and only for the necessary missing facts, then call finalize_plan exactly once.",
-            "Do not expand scope or re-derive already committed facts.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (frontendPlanRetryStep === "backup-model") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: backup-model.",
-            "A backup provider/model route was selected after repeated non-converging failures. Re-derive only the missing committed facts, then call finalize_plan exactly once; do not repeat the failed strategy.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "protocol-invalid" &&
-        task.outputProtocol &&
-        previousProtocolReason) {
-        return [
-            basePrompt,
-            "",
-            buildProtocolRetryInstruction(task.outputProtocol, previousProtocolReason),
-        ].join("\n");
-    }
-    if (previousFailureCategory === "review-terminal-missing") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "The review emitted a verdict in response text but never committed the authoritative typed terminal tool call (approve_review / request_review_changes). The response text is NOT the authority: no branch or gate reads it.",
-            "Call exactly one typed terminal tool to finish: approve_review (implementation passes, no Critical/Important findings) or request_review_changes (with typed issueCategory, at least one evidenceRef, and non-empty findings). Do not repeat the review analysis; commit the terminal tool once and stop.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "read-burst") {
-        if (task.id !== FRONTEND_PLAN_NODE_ID) {
-            return [
-                basePrompt,
-                "",
-                "<retry_instruction>",
-                "The previous attempt exceeded its read budget. Start a fresh, evidence-minimal pass: do not re-read task sources, upstream stdout, skills, or full diff artifacts already represented by a canonical context artifact.",
-                "Read the smallest relevant summary first, then only the specific source file or diff fragment needed for the required decision. Finish the required terminal/output protocol as soon as evidence is sufficient.",
-                "</retry_instruction>",
-            ].join("\n");
-        }
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Previous plan attempt issued too many read-only tool calls (read/grep/ls/find) and blew up the context window. Trust the upstream frontend-contract-pi typed requirement facts and frontend-scout-pi target surface already provided — do NOT re-read contract/scout stdout, PRD/source files, or component sources you already inspected.",
-            "Minimize discovery reads: only read what you genuinely need, once. Commit record_plan_requirement / record_plan_verification_target / record_* facts directly from the facts already in context (one tool call per message), then call finalize_plan exactly once.",
+            "The previous backend-test plan attempt was truncated or failed its mandatory Markdown protocol.",
+            previousProtocolReason ?? "The previous plan artifact was incomplete.",
+            "Return the final Markdown artifact immediately. Do not output analysis, reasoning, source summaries, or planning narration.",
+            "Emit the complete section skeleton first, including exactly one ## Coverage Scope, exactly one ## Coverage Matrix, optional ## Scenario Partitions only when applicable, and exactly one ## Module Index with its required 8-column table and at least one module row.",
+            "After the complete skeleton exists, fill only concise table rows within the remaining output budget. Do not use code fences.",
             "</retry_instruction>",
         ].join("\n");
     }
+    // Repair-category guidance must outrank the retry ladder position: the
+    // ladder advances monotonically on transport failures (e.g. length →
+    // compact-terminal-first), and its "keep the committed ledger intact"
+    // instruction directly contradicts the repair action for invalid-output /
+    // truncated ledger facts (re-commit corrected record_* facts). When both
+    // apply, the model receives the repair instruction, not the rung script.
     if (previousFailureCategory === "invalid-output" &&
         task.structuredContractOutput &&
         previousProtocolReason) {
@@ -805,7 +664,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
                 ? [
                     "",
-                    "The writeSet is too large for one implement node. Do NOT delete implementation files to squeeze under the limit — that drops required work. Split the task via record_split_proposal (or narrow targets.files to a genuine subset) so each implement node stays bounded; the full file set must remain covered across the split.",
+                    "The writeSet is too large for one implement node. Preserve the complete requirement and file coverage. This needs a Contract-level task split, not a Plan formatting repair. Report the write-set-too-large finding and the affected paths for the controller to resume Contract/split orchestration. Plan cannot change protected targets.files or call Contract-only tools; do not invent a split tool or discard required files.",
                 ]
                 : [];
             return [
@@ -867,8 +726,96 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
+    if (frontendPlanRetryStep === "compact-terminal-first") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: compact-terminal-first.",
+            "Do NOT rewrite the narrative. Only adopt already staged/quarantined fresh facts, fill the missing required facts, then call finalize_plan exactly once.",
+            "Keep the existing committed ledger intact; do not re-derive already committed facts.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (frontendPlanRetryStep === "bounded-tool-only") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: bounded-tool-only.",
+            "Reduce reasoning and wall-clock time. Use only read / fact / terminal tools and only for the necessary missing facts, then call finalize_plan exactly once.",
+            "Do not expand scope or re-derive already committed facts.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (frontendPlanRetryStep === "backup-model") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: backup-model.",
+            "A backup provider/model route was selected after repeated non-converging failures. Re-derive only the missing committed facts, then call finalize_plan exactly once; do not repeat the failed strategy.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "protocol-invalid" &&
+        task.outputProtocol &&
+        previousProtocolReason) {
+        return [
+            basePrompt,
+            "",
+            buildProtocolRetryInstruction(task.outputProtocol, previousProtocolReason),
+        ].join("\n");
+    }
+    if (previousFailureCategory === "review-terminal-missing") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The review emitted a verdict in response text but never committed the authoritative typed terminal tool call (approve_review / request_review_changes). The response text is NOT the authority: no branch or gate reads it.",
+            "Call exactly one typed terminal tool to finish: approve_review (implementation passes, no Critical/Important findings) or request_review_changes (with typed issueCategory, at least one evidenceRef, and non-empty findings). Do not repeat the review analysis; commit the terminal tool once and stop.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "read-burst") {
+        if (task.id !== FRONTEND_PLAN_NODE_ID) {
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "The previous attempt exceeded its read budget. Start a fresh, evidence-minimal pass: do not re-read task sources, upstream stdout, skills, or full diff artifacts already represented by a canonical context artifact.",
+                "Read the smallest relevant summary first, then only the specific source file or diff fragment needed for the required decision. Finish the required terminal/output protocol as soon as evidence is sufficient.",
+                "</retry_instruction>",
+            ].join("\n");
+        }
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Previous plan attempt issued too many read-only tool calls (read/grep/ls/find) and blew up the context window. Trust the upstream frontend-contract-pi typed requirement facts and frontend-scout-pi target surface already provided — do NOT re-read contract/scout stdout, PRD/source files, or component sources you already inspected.",
+            "Minimize discovery reads: only read what you genuinely need, once. Commit record_plan_requirement / record_plan_verification_target / record_* facts directly from the facts already in context (one tool call per message), then call finalize_plan exactly once.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    // Generic output-limit fallback. Every branch above this one carries a
+    // more precise instruction for the same capacity signal (contract repair
+    // reasons, ladder rungs — compact-terminal-first is the reason-mandated
+    // rung for length-before-terminal —, protocol/review/read-burst repair),
+    // so output-limit must not shadow them.
+    if (previousFailureCategory === OUTPUT_LIMIT_RETRY_CATEGORY) {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The previous turn ended with stopReason=length before the required output was complete. This is output-capacity truncation, not empty output.",
+            "Continue incrementally from already committed typed facts and current in-scope workspace files. Do not repeat completed discovery, decisions, facts, or writes.",
+            "Generate the smallest unfinished unit next, validate its required format immediately, repair any format error in this node, and only then continue to the next unfinished unit or terminal tool.",
+            "Keep prose minimal and finish the required terminal/output protocol as soon as the remaining work is valid.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
     if (previousFailureCategory === "writer-empty-diff") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         // When a completeness progress exists for this writer, fold the concrete
         // target paths into the empty-diff retry so the model does not guess and
         // does not need to read a forbidden `.harness/**` evidence file.
@@ -896,7 +843,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
         ].join("\n");
     }
     if (previousFailureCategory === "incomplete-write-set") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         const bindingOnly = task.id?.startsWith("generate-backend-md-case-") === true &&
             (recoveryTargetPaths?.length ?? 0) === 1 &&
             Object.values(recoveryDiagnostics ?? {}).flat().some((detail) => /(?:unclassified Test Points|duplicate Test Point bindings)/i.test(detail));
@@ -1504,6 +1451,20 @@ export async function executeDagNode(input) {
             return;
         }
     }
+    if (task.id === "frontend-scout-pi") {
+        try {
+            const { readTypedEventStoreFromJsonl } = await import("./frontend-typed-event-store.js");
+            const facts = (await readTypedEventStoreFromJsonl(path.join(runDir, "frontend-contract-pi", "contract-typed-facts.jsonl"))).filter(r => r.phase === "committed").map(r => r.fact);
+            const requirements = [...new Map(facts.filter(f => f.kind === "requirement").map(f => [String(f.id), f])).values()];
+            if (!requirements.length)
+                throw Error("FRONTEND_INPUT_MISSING: Scout needs committed Contract obligations");
+            prompt += `\n<frontend_scout_input>\n${JSON.stringify({ requirements, sharedFacts: facts.filter(f => !["requirement", "contract-scope-completed", "contract-finalized"].includes(String(f.kind))) })}\n</frontend_scout_input>`;
+        }
+        catch (error) {
+            await failBeforePrompt(error, "frontend-scout-input-unavailable");
+            return;
+        }
+    }
     if (FRONTEND_WRITER_NODE_IDS.includes(nodeId)) {
         // Design-review findings are not reliable in the provider's prose output
         // (typed terminal nodes commonly return an empty assistant message). Inject
@@ -1691,6 +1652,7 @@ export async function executeDagNode(input) {
                 attemptPrompt,
             });
             result = await executeNode({
+                ...(state.budgetLedger?.mode === "hard" && state.budgetLedger.limits.maxProviderRequests !== undefined ? { reserveProviderRequest: () => reserveDagProviderRequest({ state, nodeId, attempt: attemptNumber, persist: input.persistState }) } : {}),
                 task,
                 cwd,
                 model,
@@ -1712,6 +1674,43 @@ export async function executeDagNode(input) {
                 durationMs: 0,
             };
         }
+        // stopReason=length on top of a bare empty-output verdict is a provider
+        // capacity signal, not a true empty response: reroute it through the
+        // dedicated output-limit retry path while keeping the raw category for
+        // diagnostics. Bare empty-output and transport aliases (network,
+        // nonzero-exit, unknown) are rerouted — categories that already carry a
+        // precise repair instruction (output-too-large, invalid-output,
+        // protocol-invalid, structured-output-truncated via the validators below,
+        // writer categories) keep their classification so their exact retry
+        // guidance still reaches the model.
+        if (task.executor === "pi" &&
+            !result.ok &&
+            result.stopReason === "length" &&
+            (result.failureCategory === undefined ||
+                ["empty-output", "network", "nonzero-exit", "unknown"].includes(result.failureCategory))) {
+            result = {
+                ...result,
+                rawFailureCategory: result.rawFailureCategory ?? result.failureCategory,
+                failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
+                stderr: [
+                    result.stderr,
+                    "output-limit: stopReason=length; preserve completed work and retry only the unfinished output",
+                ]
+                    .filter(Boolean)
+                    .join("\n"),
+            };
+        }
+        if (task.id === "generate-backend-md-plan-pi" &&
+            !result.ok &&
+            (result.failureCategory === "output-too-large" ||
+                result.failureCategory === "invalid-output")) {
+            const marker = "backend-test Markdown plan";
+            const markerIndex = result.stderr?.lastIndexOf(marker) ?? -1;
+            previousProtocolReason =
+                markerIndex >= 0
+                    ? result.stderr.slice(markerIndex, markerIndex + 4_000).trim()
+                    : `backend-test Markdown plan attempt failed with ${result.failureCategory}`;
+        }
         if (isFrontendStructuredRepairSchemaId(task.structuredContractOutput?.schemaId)) {
             const rawText = canonicalNodeOutput(result);
             if (rawText.trim().length > 0) {
@@ -1834,7 +1833,7 @@ export async function executeDagNode(input) {
             !result.ok &&
             retryPolicy !== undefined) {
             const submissions = await countContractRecordSubmissions(runDir, nodeId);
-            if (submissions === 0) {
+            if (submissions === 0 && result.stopReason !== "length") {
                 result = {
                     ...result,
                     failureCategory: "empty-output",