@tea-agent/loop-agent 0.42.0-next.9 → 0.43.0-next.1

package/dist/workflows/dag/node-execution.js

@@ -13,7 +13,7 @@ import { buildDagNodePromptEnvelope, formatConvergenceFeedbackBlock, } from "./p
 import { persistLongNodeOutputArtifacts } from "./upstream-artifacts.js";
 import { materializeDeclaredArtifactFacts } from "./artifact-bindings.js";
 import { buildOutputLimitRecoverySection, loadBackendTestWriterProgressForRetry, } from "./backend-test-writer-completeness.js";
-import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
+import { computeBackoffDelayMs, isCanonicalFinalVerifyShellRetryCandidate, isRetryablePiFailureCategory, isSafeReadOnlyPiRetryCandidate, isTargetTemplateTransientRetryNode, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, OUTPUT_LIMIT_RETRY_CATEGORY, projectFrontendNodeProtocolFailureReason, resolveFrontendPlanBackupRoute, resolveFrontendPlanRetryStep, VERIFY_SHELL_RETRY_POLICY, } from "./retry-policy.js";
 import { applyNodeActivity, evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
 import { buildProtocolRetryInstruction, normalizeReviewVerdictAfterRetries, parseJsonReviewVerdict, validateOutputProtocol, } from "./output-protocol.js";
 import { getStructuredContractValidator } from "./contract-output-registry.js";
@@ -21,6 +21,7 @@ import "./contract-validator-registrations.js";
 import { computeNormalizedFailureFingerprint } from "./frontend-recovery-lineage.js";
 import { parseLedgerJson } from "../../task/source-prepare/ledger.js";
 import { readTypedEventStoreFromJsonl } from "./frontend-typed-event-store.js";
+import { collectCanonicalStateFlowNames, extractRequiredDeliverablePaths, resolveFrontendContractRequirements, } from "./frontend-contract-facts.js";
 import { allowedRepairReadPaths, auditRepairAttemptToolUse, buildStructuredOutputRepairPrompt, freezeStructuredOutputRepairContext, hasNonEmptyStructuredCandidate, isFrontendStructuredRepairSchemaId, isStructuredRepairableFailureCategory, persistStructuredAttemptRaw, sessionEventsByteLength, GOVERNANCE_BLOCKED_CATEGORY, STRUCTURED_REPAIR_EXHAUSTED_CATEGORY, } from "./structured-output-repair.js";
 import { readFrontendCanonicalCandidate } from "./frontend-implementation-contract.js";
 import { writeDagNodeJsonArtifact } from "../../infrastructure/harness/artifact-store.js";
@@ -256,6 +257,9 @@ function frontendPlanValidationRetryGuidance(reason) {
     if (/verificationTargets.*uiStates|uiStates.*verificationTargets/i.test(reason)) {
         guidance.push("For this retry, provide verificationTargets[].uiStates as an array; use [] when the target has no named UI state.");
     }
+    if (/duplicate|already recorded/i.test(reason)) {
+        guidance.push("For this retry, re-commit the corrected entry with the same id and replace=true; the ledger compiles the latest submission as the full replacement. A duplicate receipt is a correction invitation, not a prohibition, and backfilling a cited fact's reverse reference in-node does not re-derive committed facts.");
+    }
     return guidance;
 }
 function compactRetryText(text, maxChars) {
@@ -325,6 +329,8 @@ const FRONTEND_CONTRACT_RECORD_TOOL_NAMES_LOCAL = new Set([
     "record_handoff_intent",
     "record_open_question",
     "record_split_proposal",
+    "record_ui_state",
+    "record_required_deliverables",
 ]);
 async function countContractRecordSubmissions(runDir, nodeId) {
     const eventsPath = path.join(runDir, nodeId, "session-events.jsonl");
@@ -553,8 +559,9 @@ export function renderFrontendPlanInputContext(input) {
         : []);
     const contractFacts = committedFacts(input.contractRecords);
     const scoutFacts = committedFacts(input.scoutRecords);
-    const requirements = contractFacts
-        .filter((fact) => fact.kind === "requirement" && fact.origin === "contract")
+    const requirementFacts = resolveFrontendContractRequirements(contractFacts);
+    const requiredDeliverables = extractRequiredDeliverablePaths(contractFacts);
+    const requirements = requirementFacts
         .map((fact) => ({
         id: planInputText(fact.id, 80),
         text: planInputText(fact.text),
@@ -580,19 +587,28 @@ export function renderFrontendPlanInputContext(input) {
         paths: fact.paths,
         conflicts: fact.conflicts,
     }));
+    // Authoritative UI states (contract-declared): the source's UI-state table
+    // extracted by the contract node. The planner binds these ids instead of
+    // inventing list-visibility variants.
+    const declaredUiStates = contractFacts
+        .filter((fact) => fact.kind === "ui-state-declaration" && fact.origin === "contract")
+        .map((fact) => ({
+        id: planInputText(fact.id, 80),
+        trigger: planInputText(fact.trigger),
+        observableOutcome: planInputText(fact.observableOutcome),
+    }))
+        .filter((state) => state.id !== undefined);
+    // Replay registry edits and state-flow removals/additions in commit order.
+    const committedUxNames = collectCanonicalStateFlowNames(input.planRecords ?? [], true);
+    const committedUiStateNames = [...committedUxNames.uiStateNames];
+    const committedInteractionNames = [...committedUxNames.interactionNames];
     // Reviewer-rubric scaffold: the design reviewer re-runs the design-policy
     // checks on the committed facts, so publish the checklist to the producer.
     // Requirements whose contract evidence expects behavioural verification are
     // enumerated explicitly — those are the slots the reviewer finds missing
     // when the plan models interactions ad hoc (r8/r9 findings).
-    const behaviorRequiredIds = requirements
-        .filter((requirement) => {
-        const fact = contractFacts.find((candidate) => candidate.kind === "requirement" &&
-            candidate.origin === "contract" &&
-            candidate.id === requirement.id);
-        const evidence = fact?.evidence;
-        return evidence?.behavior === "required";
-    })
+    const behaviorRequiredIds = requirementFacts
+        .filter((requirement) => requirement.evidence.behavior === "required")
         .map((requirement) => requirement.id);
     const serializeAtCap = (cap) => JSON.stringify({
         requirements: requirements.map((requirement) => ({
@@ -600,6 +616,7 @@ export function renderFrontendPlanInputContext(input) {
             text: planInputText(requirement.text, cap.text),
             sourceFragmentIds: planInputStrings(requirement.sourceFragmentIds).slice(0, cap.array),
         })),
+        requiredDeliverables,
         targetSurface: targetSurface.map((surface) => ({
             completeness: planInputText(surface.completeness, 32),
             entrypoint: planInputText(surface.entrypoint, cap.text),
@@ -615,6 +632,18 @@ export function renderFrontendPlanInputContext(input) {
             paths: planInputStrings(evidence.paths).slice(0, cap.array),
             conflicts: planInputStrings(evidence.conflicts).slice(0, cap.array),
         })),
+        declaredUiStates: declaredUiStates.map((state) => ({
+            id: state.id,
+            trigger: planInputText(state.trigger, cap.text),
+            observableOutcome: planInputText(state.observableOutcome, cap.text),
+        })),
+        committedUx: committedUiStateNames.length > 0 ||
+            committedInteractionNames.length > 0
+            ? {
+                uiStateNames: committedUiStateNames,
+                interactionNames: committedInteractionNames,
+            }
+            : undefined,
     });
     let serialized = serializeAtCap(FRONTEND_PLAN_INPUT_CAP_LADDER[0]);
     for (const cap of FRONTEND_PLAN_INPUT_CAP_LADDER.slice(1)) {
@@ -628,6 +657,7 @@ export function renderFrontendPlanInputContext(input) {
         // to the minimum, and declare the degradation instead of corrupting JSON.
         let fallback = {
             degraded: "requirement-texts-truncated",
+            requiredDeliverables,
             requirements: requirements.map((requirement) => ({
                 id: requirement.id,
                 text: "(truncated)",
@@ -652,20 +682,20 @@ export function renderFrontendPlanInputContext(input) {
         serialized = bounded;
     }
     const checklistLines = [
-        "1. Every interaction you record needs a uiComponentChoices entry whose purpose equals the interaction name, or one decision=reuse-existing choice covering behavioural interactions.",
-        "2. Every applicable UI state needs a purpose-matching component choice or a stylingStrategy.",
-        "3. Every requirement marked (behavior) below needs modelled interactions plus at least one verification target that references it.",
-        "4. targets.files must name the concrete deliverable files; never leave the scope broader than the frozen requirements state.",
+        "1. Record the GLOBAL UX vocabulary with record_state_registry BEFORE any record_state_flow: one stable behavior-domain name per state/interaction (e.g. planner-task-edit), never one name per AC number, and never a rename of an already-recorded concept. Coverage slices by AC; UX does not.",
+        "2. Every recorded interaction/uiState name must be in that registry, and uiState names must use the contract's declared authoritative ids (declaredUiStates below) when present.",
+        "3. Every interaction and every applicable UI state must be covered by a uiComponentChoices entry: its purpose equals the name, or the choice lists the name in covers (one choice may cover many ids). A reuse-existing decision without evidencePath is rejected; stylingStrategy alone covers nothing.",
+        "4. Every requirement marked (behavior) below needs modelled interactions plus at least one verification target that references it.",
         "5. Verification targets may only reference UI states and requirements you actually recorded (the record_* tools reject unknown references).",
         `Requirements requiring behavioural coverage: ${behaviorRequiredIds.length > 0 ? behaviorRequiredIds.join(", ") : "(none)"}`,
-        "6. A decision=new component must declare sourceRequirementIds and pass sourceFragmentId for the frozen PRD fragment whose section matches the component's purpose — the runtime validates that binding and derives specReference (path/section/line); the reviewer checks purpose↔citation consistency.",
+        "6. A decision=new component must declare sourceRequirementIds and pass sourceFragmentId for the frozen PRD fragment whose section matches the component's purpose — the runtime validates that binding and derives specReference (path/section/line); the reviewer checks purpose↔citation consistency. A decision=reuse-existing component must pass evidencePath pointing at the existing repo file that proves the reuse.",
         ...[...input.componentSourceCitations ?? []]
             .filter(([id]) => behaviorRequiredIds.includes(id))
             .flatMap(([id, citations]) => citations.map((citation) => `   ${id} + ${citation.fragmentId} → ${citation.section}${citation.line ? ` (line ${citation.line})` : ""}`)),
     ];
     return [
         "<frontend_plan_input>",
-        "Committed Contract/Scout facts, compiled by the runner. Treat them as the complete planning evidence.",
+        "Committed Contract/Scout facts, compiled by the runner. Treat them as the complete planning evidence. declaredUiStates are the authoritative UI states from the task source; committedUx (retry attempts) is the UX vocabulary already recorded — reuse those names, never re-invent them.",
         serialized,
         "Do not read upstream artifacts, task sources, or repository files. If this input cannot support a decision, record a genuine evidence gap.",
         "</frontend_plan_input>",
@@ -692,6 +722,16 @@ export async function buildFrontendPlanInputContext(runDir, componentSourceCitat
         // forbids reading anything.
         throw new Error(`frontend-plan-input-unavailable: cannot read committed typed facts (${error instanceof Error ? error.message : String(error)})`);
     }
+    // Retry-attempt continuity (UX slice visibility): the plan node's own
+    // committed facts are absent on the first attempt and present on retries;
+    // a missing file is normal there, not a broken pipeline.
+    let planRecords = [];
+    try {
+        planRecords = await readTypedEventStoreFromJsonl(path.join(runDir, "frontend-plan-pi", "plan-typed-facts.jsonl"));
+    }
+    catch {
+        planRecords = [];
+    }
     const committedCount = [...contractRecords, ...scoutRecords].filter((record) => record.phase === "committed").length;
     if (committedCount === 0) {
         throw new Error(`frontend-plan-input-unavailable: no committed Contract/Scout facts in ${contractFactsPath} / ${scoutFactsPath}`);
@@ -699,6 +739,7 @@ export async function buildFrontendPlanInputContext(runDir, componentSourceCitat
     return renderFrontendPlanInputContext({
         contractRecords,
         scoutRecords,
+        planRecords,
         componentSourceCitations,
     });
 }
@@ -721,77 +762,27 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
-    if (frontendPlanRetryStep === "compact-terminal-first") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: compact-terminal-first.",
-            "Do NOT rewrite the narrative. Only adopt already staged/quarantined fresh facts, fill the missing required facts, then call finalize_plan exactly once.",
-            "Keep the existing committed ledger intact; do not re-derive already committed facts.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (frontendPlanRetryStep === "bounded-tool-only") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: bounded-tool-only.",
-            "Reduce reasoning and wall-clock time. Use only read / fact / terminal tools and only for the necessary missing facts, then call finalize_plan exactly once.",
-            "Do not expand scope or re-derive already committed facts.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (frontendPlanRetryStep === "backup-model") {
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Frontend plan retry ladder step: backup-model.",
-            "A backup provider/model route was selected after repeated non-converging failures. Re-derive only the missing committed facts, then call finalize_plan exactly once; do not repeat the failed strategy.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "protocol-invalid" &&
-        task.outputProtocol &&
-        previousProtocolReason) {
-        return [
-            basePrompt,
-            "",
-            buildProtocolRetryInstruction(task.outputProtocol, previousProtocolReason),
-        ].join("\n");
-    }
-    if (previousFailureCategory === "review-terminal-missing") {
+    if (task.id === "generate-backend-md-plan-pi" &&
+        (previousFailureCategory === "output-too-large" ||
+            previousFailureCategory === "invalid-output")) {
         return [
             basePrompt,
             "",
             "<retry_instruction>",
-            "The review emitted a verdict in response text but never committed the authoritative typed terminal tool call (approve_review / request_review_changes). The response text is NOT the authority: no branch or gate reads it.",
-            "Call exactly one typed terminal tool to finish: approve_review (implementation passes, no Critical/Important findings) or request_review_changes (with typed issueCategory, at least one evidenceRef, and non-empty findings). Do not repeat the review analysis; commit the terminal tool once and stop.",
-            "</retry_instruction>",
-        ].join("\n");
-    }
-    if (previousFailureCategory === "read-burst") {
-        if (task.id !== FRONTEND_PLAN_NODE_ID) {
-            return [
-                basePrompt,
-                "",
-                "<retry_instruction>",
-                "The previous attempt exceeded its read budget. Start a fresh, evidence-minimal pass: do not re-read task sources, upstream stdout, skills, or full diff artifacts already represented by a canonical context artifact.",
-                "Read the smallest relevant summary first, then only the specific source file or diff fragment needed for the required decision. Finish the required terminal/output protocol as soon as evidence is sufficient.",
-                "</retry_instruction>",
-            ].join("\n");
-        }
-        return [
-            basePrompt,
-            "",
-            "<retry_instruction>",
-            "Previous plan attempt issued too many read-only tool calls (read/grep/ls/find) and blew up the context window. Trust the upstream frontend-contract-pi typed requirement facts and frontend-scout-pi target surface already provided — do NOT re-read contract/scout stdout, PRD/source files, or component sources you already inspected.",
-            "Minimize discovery reads: only read what you genuinely need, once. Commit record_plan_requirement / record_plan_verification_target / record_* facts directly from the facts already in context (one tool call per message), then call finalize_plan exactly once.",
+            "The previous backend-test plan attempt was truncated or failed its mandatory Markdown protocol.",
+            previousProtocolReason ?? "The previous plan artifact was incomplete.",
+            "Return the final Markdown artifact immediately. Do not output analysis, reasoning, source summaries, or planning narration.",
+            "Emit the complete section skeleton first, including exactly one ## Coverage Scope, exactly one ## Coverage Matrix, optional ## Scenario Partitions only when applicable, and exactly one ## Module Index with its required 8-column table and at least one module row.",
+            "After the complete skeleton exists, fill only concise table rows within the remaining output budget. Do not use code fences.",
             "</retry_instruction>",
         ].join("\n");
     }
+    // Repair-category guidance must outrank the retry ladder position: the
+    // ladder advances monotonically on transport failures (e.g. length →
+    // compact-terminal-first), and its "keep the committed ledger intact"
+    // instruction directly contradicts the repair action for invalid-output /
+    // truncated ledger facts (re-commit corrected record_* facts). When both
+    // apply, the model receives the repair instruction, not the rung script.
     if (previousFailureCategory === "invalid-output" &&
         task.structuredContractOutput &&
         previousProtocolReason) {
@@ -805,7 +796,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             const splitGuidance = /write-set-too-large|split the task/.test(previousProtocolReason ?? "")
                 ? [
                     "",
-                    "The writeSet is too large for one implement node. Do NOT delete implementation files to squeeze under the limit — that drops required work. Split the task via record_split_proposal (or narrow targets.files to a genuine subset) so each implement node stays bounded; the full file set must remain covered across the split.",
+                    "The writeSet is too large for one implement node. Preserve the complete requirement and file coverage. This needs a Contract-level task split, not a Plan formatting repair. Report the write-set-too-large finding and the affected paths for the controller to resume Contract/split orchestration. Plan cannot change protected targets.files or call Contract-only tools; do not invent a split tool or discard required files.",
                 ]
                 : [];
             return [
@@ -867,8 +858,96 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
             "</retry_instruction>",
         ].join("\n");
     }
+    if (frontendPlanRetryStep === "compact-terminal-first") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: compact-terminal-first.",
+            "Do NOT rewrite the narrative. Only adopt already staged/quarantined fresh facts, fill the missing required facts, then call finalize_plan exactly once.",
+            "Keep the existing committed ledger intact; do not re-derive already committed facts.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (frontendPlanRetryStep === "bounded-tool-only") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: bounded-tool-only.",
+            "Reduce reasoning and wall-clock time. Use only read / fact / terminal tools and only for the necessary missing facts, then call finalize_plan exactly once.",
+            "Do not expand scope or re-derive already committed facts.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (frontendPlanRetryStep === "backup-model") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Frontend plan retry ladder step: backup-model.",
+            "A backup provider/model route was selected after repeated non-converging failures. Re-derive only the missing committed facts, then call finalize_plan exactly once; do not repeat the failed strategy.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "protocol-invalid" &&
+        task.outputProtocol &&
+        previousProtocolReason) {
+        return [
+            basePrompt,
+            "",
+            buildProtocolRetryInstruction(task.outputProtocol, previousProtocolReason),
+        ].join("\n");
+    }
+    if (previousFailureCategory === "review-terminal-missing") {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The review emitted a verdict in response text but never committed the authoritative typed terminal tool call (approve_review / request_review_changes). The response text is NOT the authority: no branch or gate reads it.",
+            "Call exactly one typed terminal tool to finish: approve_review (implementation passes, no Critical/Important findings) or request_review_changes (with typed issueCategory, at least one evidenceRef, and non-empty findings). Do not repeat the review analysis; commit the terminal tool once and stop.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    if (previousFailureCategory === "read-burst") {
+        if (task.id !== FRONTEND_PLAN_NODE_ID) {
+            return [
+                basePrompt,
+                "",
+                "<retry_instruction>",
+                "The previous attempt exceeded its read budget. Start a fresh, evidence-minimal pass: do not re-read task sources, upstream stdout, skills, or full diff artifacts already represented by a canonical context artifact.",
+                "Read the smallest relevant summary first, then only the specific source file or diff fragment needed for the required decision. Finish the required terminal/output protocol as soon as evidence is sufficient.",
+                "</retry_instruction>",
+            ].join("\n");
+        }
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "Previous plan attempt issued too many read-only tool calls (read/grep/ls/find) and blew up the context window. Trust the upstream frontend-contract-pi typed requirement facts and frontend-scout-pi target surface already provided — do NOT re-read contract/scout stdout, PRD/source files, or component sources you already inspected.",
+            "Minimize discovery reads: only read what you genuinely need, once. Commit record_plan_requirement / record_plan_verification_target / record_* facts directly from the facts already in context (one tool call per message), then call finalize_plan exactly once.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
+    // Generic output-limit fallback. Every branch above this one carries a
+    // more precise instruction for the same capacity signal (contract repair
+    // reasons, ladder rungs — compact-terminal-first is the reason-mandated
+    // rung for length-before-terminal —, protocol/review/read-burst repair),
+    // so output-limit must not shadow them.
+    if (previousFailureCategory === OUTPUT_LIMIT_RETRY_CATEGORY) {
+        return [
+            basePrompt,
+            "",
+            "<retry_instruction>",
+            "The previous turn ended with stopReason=length before the required output was complete. This is output-capacity truncation, not empty output.",
+            "Continue incrementally from already committed typed facts and current in-scope workspace files. Do not repeat completed discovery, decisions, facts, or writes.",
+            "Generate the smallest unfinished unit next, validate its required format immediately, repair any format error in this node, and only then continue to the next unfinished unit or terminal tool.",
+            "Keep prose minimal and finish the required terminal/output protocol as soon as the remaining work is valid.",
+            "</retry_instruction>",
+        ].join("\n");
+    }
     if (previousFailureCategory === "writer-empty-diff") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         // When a completeness progress exists for this writer, fold the concrete
         // target paths into the empty-diff retry so the model does not guess and
         // does not need to read a forbidden `.harness/**` evidence file.
@@ -896,7 +975,7 @@ export function buildAttemptPrompt(task, basePrompt, attemptNumber, previousFail
         ].join("\n");
     }
     if (previousFailureCategory === "incomplete-write-set") {
-        const maxAttempts = task.retryPolicy?.maxAttempts ?? 3;
+        const maxAttempts = task.retryPolicy?.maxAttempts ?? 5;
         const bindingOnly = task.id?.startsWith("generate-backend-md-case-") === true &&
             (recoveryTargetPaths?.length ?? 0) === 1 &&
             Object.values(recoveryDiagnostics ?? {}).flat().some((detail) => /(?:unclassified Test Points|duplicate Test Point bindings)/i.test(detail));
@@ -1712,6 +1791,43 @@ export async function executeDagNode(input) {
                 durationMs: 0,
             };
         }
+        // stopReason=length on top of a bare empty-output verdict is a provider
+        // capacity signal, not a true empty response: reroute it through the
+        // dedicated output-limit retry path while keeping the raw category for
+        // diagnostics. Bare empty-output and transport aliases (network,
+        // nonzero-exit, unknown) are rerouted — categories that already carry a
+        // precise repair instruction (output-too-large, invalid-output,
+        // protocol-invalid, structured-output-truncated via the validators below,
+        // writer categories) keep their classification so their exact retry
+        // guidance still reaches the model.
+        if (task.executor === "pi" &&
+            !result.ok &&
+            result.stopReason === "length" &&
+            (result.failureCategory === undefined ||
+                ["empty-output", "network", "nonzero-exit", "unknown"].includes(result.failureCategory))) {
+            result = {
+                ...result,
+                rawFailureCategory: result.rawFailureCategory ?? result.failureCategory,
+                failureCategory: OUTPUT_LIMIT_RETRY_CATEGORY,
+                stderr: [
+                    result.stderr,
+                    "output-limit: stopReason=length; preserve completed work and retry only the unfinished output",
+                ]
+                    .filter(Boolean)
+                    .join("\n"),
+            };
+        }
+        if (task.id === "generate-backend-md-plan-pi" &&
+            !result.ok &&
+            (result.failureCategory === "output-too-large" ||
+                result.failureCategory === "invalid-output")) {
+            const marker = "backend-test Markdown plan";
+            const markerIndex = result.stderr?.lastIndexOf(marker) ?? -1;
+            previousProtocolReason =
+                markerIndex >= 0
+                    ? result.stderr.slice(markerIndex, markerIndex + 4_000).trim()
+                    : `backend-test Markdown plan attempt failed with ${result.failureCategory}`;
+        }
         if (isFrontendStructuredRepairSchemaId(task.structuredContractOutput?.schemaId)) {
             const rawText = canonicalNodeOutput(result);
             if (rawText.trim().length > 0) {
@@ -1834,7 +1950,7 @@ export async function executeDagNode(input) {
             !result.ok &&
             retryPolicy !== undefined) {
             const submissions = await countContractRecordSubmissions(runDir, nodeId);
-            if (submissions === 0) {
+            if (submissions === 0 && result.stopReason !== "length") {
                 result = {
                     ...result,
                     failureCategory: "empty-output",

package/dist/workflows/dag/recovery-lease.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { hostname as localHostname } from "node:os";
 import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { DAG_RUNS_DIR } from "./lifecycle.js";
 function recoveryLeasePath(cwd, parentRunId) {
@@ -23,6 +25,11 @@ function parseLease(raw, parentRunId) {
             record.kind !== "standalone-task-rerun") ||
         typeof record.leaseToken !== "string" ||
         record.leaseToken.length === 0 ||
+        typeof record.ownerPid !== "number" ||
+        !Number.isInteger(record.ownerPid) ||
+        record.ownerPid <= 0 ||
+        typeof record.ownerHostname !== "string" ||
+        record.ownerHostname.length === 0 ||
         typeof record.acquiredAt !== "string" ||
         typeof record.executionRef !== "undefined" &&
             typeof record.executionRef !== "string") {
@@ -30,6 +37,60 @@ function parseLease(raw, parentRunId) {
     }
     return record;
 }
+const LEASE_MUTATION_LOCK_STALE_MS = 60_000;
+const LEASE_MUTATION_LOCK_RETRIES = 200;
+async function withLeaseMutationLock(leasePath, operation) {
+    const lockPath = `${leasePath}.mutation-lock`;
+    for (let attempt = 0; attempt < LEASE_MUTATION_LOCK_RETRIES; attempt += 1) {
+        try {
+            await mkdir(lockPath);
+        }
+        catch (error) {
+            if (!(error && typeof error === "object" && "code" in error && error.code === "EEXIST")) {
+                throw error;
+            }
+            try {
+                const lockStat = await stat(lockPath);
+                if (Date.now() - lockStat.mtimeMs >= LEASE_MUTATION_LOCK_STALE_MS) {
+                    await rm(lockPath, { recursive: true, force: true });
+                    continue;
+                }
+            }
+            catch (statError) {
+                if (statError &&
+                    typeof statError === "object" &&
+                    "code" in statError &&
+                    statError.code === "ENOENT") {
+                    continue;
+                }
+                throw statError;
+            }
+            await delay(10);
+            continue;
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            await rm(lockPath, { recursive: true, force: true });
+        }
+    }
+    throw new Error("dag recovery lease mutation lock is busy");
+}
+function defaultIsProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function leaseOwnerIsAlive(input) {
+    if (input.lease.ownerHostname !== input.hostname)
+        return true;
+    return input.isProcessAlive(input.lease.ownerPid);
+}
 export async function acquireDagRecoveryLease(input) {
     const leasePath = recoveryLeasePath(input.cwd, input.parentRunId);
     const lease = {
@@ -38,13 +99,15 @@ export async function acquireDagRecoveryLease(input) {
         requestId: input.requestId,
         kind: input.kind,
         leaseToken: randomBytes(16).toString("hex"),
+        ownerPid: process.pid,
+        ownerHostname: localHostname(),
         acquiredAt: (input.now ?? (() => new Date()))().toISOString(),
     };
     await mkdir(path.dirname(leasePath), { recursive: true });
     try {
         // `wx` is the cross-process compare-and-create primitive. The lease is
-        // deliberately immutable for a parent run: a later recovery must follow
-        // the committed child lineage rather than fork another DAG.
+        // parent-scoped for the full recovery lineage. Ownership may only be
+        // replaced by claimDagRecoveryLease after the recorded owner is proven dead.
         await writeFile(leasePath, `${JSON.stringify(lease, null, 2)}\n`, {
             encoding: "utf8",
             flag: "wx",
@@ -59,22 +122,49 @@ export async function acquireDagRecoveryLease(input) {
         return { kind: "held", leasePath, lease: existing };
     }
 }
+/**
+ * Reclaim a lease only after its recorded same-host owner is proven dead.
+ * The mutation lock serializes reclaim with execution binding, so a live owner
+ * can never race a stale-owner takeover and launch a second recovery.
+ */
+export async function claimDagRecoveryLease(input) {
+    const hostname = input.hostname ?? localHostname();
+    const isProcessAlive = input.isProcessAlive ?? defaultIsProcessAlive;
+    return withLeaseMutationLock(input.leasePath, async () => {
+        const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
+        if (existing.leaseToken !== input.lease.leaseToken ||
+            leaseOwnerIsAlive({ lease: existing, hostname, isProcessAlive })) {
+            return { kind: "held", leasePath: input.leasePath, lease: existing };
+        }
+        const claimed = {
+            ...existing,
+            leaseToken: randomBytes(16).toString("hex"),
+            ownerPid: process.pid,
+            ownerHostname: hostname,
+            acquiredAt: (input.now ?? (() => new Date()))().toISOString(),
+        };
+        await writeJsonAtomic(input.leasePath, claimed);
+        return { kind: "acquired", leasePath: input.leasePath, lease: claimed };
+    });
+}
 /** Persist the operation/run identity before the caller is allowed to execute it. */
 export async function bindDagRecoveryLeaseExecution(input) {
     if (!input.executionRef.trim()) {
         throw new Error("dag recovery lease executionRef is required");
     }
-    const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
-    if (existing.leaseToken !== input.lease.leaseToken) {
-        throw new Error("dag recovery lease ownership drift");
-    }
-    if (existing.executionRef && existing.executionRef !== input.executionRef) {
-        throw new Error("dag recovery lease execution identity drift");
-    }
-    const bound = {
-        ...existing,
-        executionRef: input.executionRef,
-    };
-    await writeJsonAtomic(input.leasePath, bound);
-    return bound;
+    return withLeaseMutationLock(input.leasePath, async () => {
+        const existing = parseLease(JSON.parse(await readFile(input.leasePath, "utf8")), input.lease.parentRunId);
+        if (existing.leaseToken !== input.lease.leaseToken) {
+            throw new Error("dag recovery lease ownership drift");
+        }
+        if (existing.executionRef && existing.executionRef !== input.executionRef) {
+            throw new Error("dag recovery lease execution identity drift");
+        }
+        const bound = {
+            ...existing,
+            executionRef: input.executionRef,
+        };
+        await writeJsonAtomic(input.leasePath, bound);
+        return bound;
+    });
 }

package/dist/workflows/dag/rerun-feedback.js

@@ -408,6 +408,7 @@ export async function deriveDagRerunFeedback(input) {
             return (node?.status === "ERROR" &&
                 [
                     "empty-output",
+                    "output-limit",
                     "invalid-output",
                     "writer-thinking-exhausted",
                     "writer-budget-exhausted",