@tea-agent/loop-agent 0.43.0-next.18 → 0.43.0-next.19

package/dist/workflows/dag/init-hybrid.js

@@ -30,6 +30,7 @@ import { extractRequirementFactsFromMarkdown } from "../../task/source-prepare/p
 import { computeLedgerInputDigest, parseLedgerJson, recoverLedgerInputContract, validateRequirementLedger, } from "../../task/source-prepare/ledger.js";
 import { REQUIREMENT_LEDGER_FILE_NAME } from "../../task/contract/constants.js";
 import { dagHasWriterExecution } from "./task-contract-binding.js";
+import { BACKEND_TEST_MODULE_INDEX_HEADER, BACKEND_TEST_MODULE_SPLIT_REASONS, backendTestModuleIndexHeaderMarkdown, canonicalBackendTestModuleMarkdownPath, } from "./backend-test-plan-protocol.js";
 import { DEFAULT_VERIFY_TIMEOUT_MS, resolveVerifyPreset, } from "../../executors/shell-verification.js";
 import { resolveExecutorModelMatrices } from "../../executors/model-routing.js";
 import { normalizeTaskRequirementText, resolveTaskDagTemplateSelection, } from "./task-demand-routing.js";
@@ -699,6 +700,7 @@ export function frontendSourceMentionsMock(sources) {
  */
 export function resolveFrontendMockMode(capability, taskConfig, hasApiDep) {
     const policy = taskConfig.frontendMock?.policy ?? "auto";
+    const hasDeterministicMockVerification = capability.verifyCommands.length > 0;
     if (capability.safetyViolation ||
         !frontendMockServiceRootAllowed(taskConfig)) {
         return "blocked";
@@ -714,7 +716,7 @@ export function resolveFrontendMockMode(capability, taskConfig, hasApiDep) {
     }
     // required policy
     if (policy === "required") {
-        if (capability.status === "present") {
+        if (capability.status === "present" && hasDeterministicMockVerification) {
             return "required";
         }
         return "blocked";
@@ -723,8 +725,13 @@ export function resolveFrontendMockMode(capability, taskConfig, hasApiDep) {
     if (!hasApiDep) {
         return "not-required";
     }
-    // Confirmed Mock capability permits implementation; tests are deferred.
-    return capability.status === "present"
+    // In auto mode, frontend Mock is optional. Only enter Mock-backed "required"
+    // mode when the project has a confirmed native Mock capability AND
+    // deterministic Mock verification commands. Without executable verification
+    // commands a non-not-needed strategy could never be verified, so auto falls
+    // back to not-required; the prewrite gate then forces not-needed and the
+    // plan records the Real Integration Gap instead of inventing commands.
+    return capability.status === "present" && hasDeterministicMockVerification
         ? "required"
         : "not-required";
 }
@@ -1020,127 +1027,6 @@ function extractFrontendVerifyCommandsFromMarkdown(input) {
     }
     return { staticCommands, behaviorCommands };
 }
-/**
- * Resolve the static verification commands the frontend DAG will freeze.
- *
- * The frontend contract is "the implementation must be statically verifiable -
- * never a no-op". It used to mean exactly `npm run build`, which made the whole
- * run fail at the verify node (8 of 11) for any project that legitimately has no
- * build step: a zero-dependency Node app, a static-site repo, a plain-ESM
- * browser module. The failure landed *after* `frontend-implement-pi` had already
- * delivered correct, test-passing work, so the run reported failure for a project
- * shape that was never going to pass. That is a meaningless failure and a
- * gratuitous loss of trust, not a safety property.
- *
- * Order, keeping every choice a real check:
- *   1. `npm run build` when the project defines it - unchanged for every project
- *      that already worked.
- *   2. static commands the task declared via `--verify`. These were already being
- *      classified onto the static lane and then discarded, so an operator who
- *      declared `--verify typecheck:npm run typecheck` was silently ignored.
- *   3. the project's own `typecheck` / `check` script.
- *   4. otherwise the historical `npm run build` is kept. That still fails at the
- *      verify node, exactly as before this change - it is deliberately NOT a new
- *      generation-time error. Introducing one would turn a late failure into an
- *      early one for projects that never declared static verification, which is
- *      more failure, not less; the operator can still declare one via `--verify`.
- *
- * Lint is deliberately never chosen: the frontend topology hard-codes
- * `lintShellCommands = []` so existing lint debt stays outside this workflow, and
- * auto-selecting a lint script would turn that debt into a fresh failure.
- */
-const FRONTEND_STATIC_SCRIPT_PREFERENCE = ["typecheck", "check"];
-async function resolveFrontendStaticCommands(input) {
-    let scripts = {};
-    try {
-        const manifest = JSON.parse(await readFile(path.join(input.repoRoot, "package.json"), "utf8"));
-        scripts = manifest.scripts ?? {};
-    }
-    catch (error) {
-        if (error.code !== "ENOENT")
-            throw error;
-    }
-    const hasScript = (name) => {
-        const script = scripts[name];
-        return typeof script === "string" && script.trim() !== "";
-    };
-    if (hasScript("build")) {
-        return [
-            {
-                label: "build",
-                args: ["bash", "-lc", "npm run build"],
-                cwd: input.repoRoot,
-            },
-        ];
-    }
-    if (input.explicitStatic.length > 0)
-        return input.explicitStatic;
-    for (const name of FRONTEND_STATIC_SCRIPT_PREFERENCE) {
-        if (!hasScript(name))
-            continue;
-        return [
-            {
-                label: name,
-                args: ["bash", "-lc", `npm run ${name}`],
-                cwd: input.repoRoot,
-            },
-        ];
-    }
-    // Nothing static is discoverable: keep the historical command rather than
-    // inventing a new failure. See the doc comment above for why.
-    return [
-        {
-            label: "build",
-            args: ["bash", "-lc", "npm run build"],
-            cwd: input.repoRoot,
-        },
-    ];
-}
-/** Reuse the project's test entrypoint; never install a runner for an untested project. */
-async function resolveFrontendExistingTests(sources) {
-    const repoRoot = sources.repoRoot ?? process.cwd();
-    const explicit = buildExplicitFrontendVerifyCommands(sources.taskConfig, repoRoot).behaviorCommands;
-    if (explicit.length > 0)
-        return explicit;
-    const declared = extractFrontendVerifyCommandsFromMarkdown({ ...sources, repoRoot }).behaviorCommands;
-    if (declared.length > 0)
-        return declared;
-    let manifest;
-    try {
-        manifest = JSON.parse(await readFile(path.join(repoRoot, "package.json"), "utf8"));
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return [];
-        throw error;
-    }
-    const script = manifest.scripts?.test;
-    if (!script || /no test specified/i.test(script))
-        return [];
-    // Focus concrete existing tests; unknown runners and broad scopes retain the
-    // project entrypoint instead of receiving guessed filtering flags.
-    const files = [];
-    for (const file of sources.taskConfig.allowedPaths) {
-        if (/[*?\[\]{}]/.test(file) || !/\.(?:test|spec)\.[cm]?[jt]sx?$/.test(file))
-            continue;
-        if (sources.taskConfig.forbiddenPaths.some((pattern) => pathMatchesPattern(file, pattern)))
-            continue;
-        if (existsSync(path.join(repoRoot, file)))
-            files.push(file);
-    }
-    const runner = /(?:^|[\s/])jest(?:[\s/.]|$)/.test(script) ? "jest"
-        : /(?:^|[\s/])vitest(?:[\s/.]|$)/.test(script) ? "vitest" : undefined;
-    const args = ["npm", "test"];
-    if (runner) {
-        args.push("--");
-        if (runner === "jest")
-            args.push("--runInBand");
-        else if (!/\b(?:run|--run)\b/.test(script))
-            args.push("--run");
-        args.push(...files);
-    }
-    return [{ label: "existing unit tests", args, cwd: repoRoot }];
-}
 function extractFrontendMockVerifyCommandsFromMarkdown(input) {
     const commands = [];
     const markdown = [
@@ -1597,7 +1483,6 @@ function deriveParallelScoutPaths(taskConfig) {
                 : allowed,
     };
 }
-const FRONTEND_NO_STATIC_VERIFICATION_MARKER = `node -e "console.log('${FRONTEND_NO_VERIFICATION_MARKER_TEXT}; static/behavior verification not-run')"`;
 /**
  * Resolve frontend verification fallbacks from the target project's own
  * package scripts. The DAG builder is also used by unit fixtures without a
@@ -1607,6 +1492,7 @@ const FRONTEND_NO_STATIC_VERIFICATION_MARKER = `node -e "console.log('${FRONTEND
  * at verify time, so such projects fall through to the tsc probe and may end
  * up with no fallback commands plus a generation-time advisory.
  */
+const FRONTEND_NO_STATIC_VERIFICATION_MARKER = `node -e "console.log('${FRONTEND_NO_VERIFICATION_MARKER_TEXT}; static/behavior verification not-run')"`;
 async function discoverFrontendFallbackVerifyCommands(repoRoot) {
     const genericFallback = {
         staticCommands: ["npm run typecheck", "npm run build"],
@@ -2659,7 +2545,7 @@ function resolveFrontendMockContextBlock(sources) {
         parts.push(`Evidence Paths: ${capability.evidencePaths.join(", ")}`);
     }
     if (capability.verifyCommands.length > 0) {
-        parts.push(`Deferred frontend-test Mock Commands: ${capability.verifyCommands
+        parts.push(`Frozen Mock Verify Commands: ${capability.verifyCommands
             .map((command) => command.label)
             .join(", ")}`);
     }
@@ -2670,7 +2556,7 @@ function resolveFrontendMockContextBlock(sources) {
         parts.push(`Reasons: ${capability.reasons.join("; ")}`);
     }
     if (mode === "required") {
-        parts.push("Implement the selected Mock strategy within authorized paths and keep production-default-off isolation. Mock behavior verification is deferred to frontend-test; it is not an implementation gate.");
+        parts.push("Mock-backed frontend verification is required. Prefer the detected native service; otherwise the assessment may select an existing browser interception harness or reversible request adapter. Any handler, fixture, adapter, and UI changes stay in the single frontend-implement-pi writeSet.");
     }
     if (mode === "not-required") {
         // The assessment sentence is deliberately split: every branch keeps the
@@ -2688,8 +2574,8 @@ function resolveFrontendMockContextBlock(sources) {
         const mockAssessment = "Generation-time evidence does not require Mock. The assessment must still use contract/scout evidence: select not-needed when Mock is intentionally skipped";
         if (frontendMockStrategyMustBeNotNeeded(sources)) {
             parts.push(`${mockAssessment}.`);
-            parts.push('Auto mode has no confirmed project Mock capability. The structured contract must set mockApi.strategy to "not-needed". Keep the real request path as the default, record any unproved backend behavior as Real Integration Gap, and do not add Mock files or dependencies within this run.');
-            parts.push('HARD CONSTRAINT (frozen at generation time): this DAG allows only mockApi.strategy "not-needed"; the prewrite gate rejects any other strategy. If project governance (openspec / ai_workspace / decision records, e.g. a DEC rule requiring native) demands Mock-backed verification, that is a generation-time contract gap, not a plan-revision defect: confirm the project Mock capability and policy: "required" in task.json and regenerate the DAG.');
+            parts.push('Auto mode has no confirmed project Mock capability or no deterministic Mock verification command. The structured contract must set mockApi.strategy to "not-needed". Keep the real request path as the default, record any unproved backend behavior as Real Integration Gap, and do not add Mock files or dependencies within this run.');
+            parts.push('HARD CONSTRAINT (frozen at generation time): this DAG allows only mockApi.strategy "not-needed"; the prewrite gate rejects any other strategy. If project governance (openspec / ai_workspace / decision records, e.g. a DEC rule requiring native) demands Mock-backed verification, that is a generation-time contract gap, not a plan-revision defect: declare frontendMock.verifyCommands (or policy: "required") in task.json and regenerate the DAG.');
         }
         else {
             parts.push(`${mockAssessment}, or select a safe Mock strategy if project evidence supports one.`);
@@ -2704,10 +2590,12 @@ function frontendMockStrategyMustBeNotNeeded(sources) {
     const policy = sources.taskConfig.frontendMock?.policy ?? "auto";
     const capability = sources.frontendMockCapability;
     const capabilityStatus = capability?.status;
+    const hasDeterministicMockVerification = (capability?.verifyCommands.length ?? 0) > 0;
     return (policy === "auto" &&
         (sources.frontendMockMode ?? "not-required") === "not-required" &&
         (capabilityStatus === "absent" ||
-            capabilityStatus === "ambiguous"));
+            capabilityStatus === "ambiguous" ||
+            !hasDeterministicMockVerification));
 }
 /**
  * 候选规范懒加载：prompt 只内联与任务相关的候选，不全部塞给模型。
@@ -2878,7 +2766,7 @@ async function resolveFrontendOpenspecGateConfig(sources) {
 const frontendComponentConformanceInstruction = [
     "## Component Selection conformance (uiComponentChoices; hard rule)",
     "每个 UI 用途必须在契约的 uiComponentChoices[] 中声明组件选型：{ purpose, component, decision, specReference, rationale }。",
-    "purpose is the stable coverage key：它应精确匹配 interaction.name 或 uiState.name；职责语义由对应 interaction.expectedBehavior / uiState.expectedBehavior 与 rationale 表达。不得仅因 purpose 与 interaction 或 component 标识符相同而判缺陷。",
+    "覆盖关系以 covers 列表为准：每个 applicable UI state 与 interaction 必须出现在某条 choice 的 purpose 或 covers 中，且运行时已在 plan finalize 阶段确定性预检——不要重复翻案。purpose 是描述用途的自由文本，不得仅因未精确匹配 interaction.name 或 uiState.name 而判缺陷；职责语义由被覆盖 id 的 expectedBehavior 与 rationale 表达。",
     "- decision=specified：前端规范（候选组件/主题桶 + 任务源显式引用）已定义该用途组件 → 必须使用该组件，并给精确 specReference { path, section, line }（path 必须是 openspec/ai_workspace 受支持规范路径）。",
     "- decision=reuse-existing：仅当该组件/惯例**确实已存在于仓库当前代码**（如复用现有 ActiveRunBadge 的 oc- class 惯例）→ specReference 可为 null，rationale 必须指明复用的具体现有组件/文件与依据。",
     "- decision=new：任务源/PRD 要求**新增**该组件（仓库当前不存在该组件文件）→ decision 必须为 new，不得标 reuse-existing；调用 record_component_choice 时传 sourceRequirementIds（关联的 frozen requirement ID）与 plan checklist 列出的 sourceFragmentId，runtime 校验其隶属关系并物化精确的任务源 PRD { path, section, line }。不要读取 PRD 或手填/猜测 specReference；rationale 说明新增纯展示组件、复用既有 CSS 命名与主题变量约定。",
@@ -3175,7 +3063,7 @@ async function buildFrontendHybridDagFromTask(sources) {
         "- interactions[]: name, trigger, expectedBehavior, implementationTargets, verificationTargetIds",
         "- targets: routes, publicApiChanges (files are runtime-owned)",
         "- mockApi: strategy, productionDefaultOff, activation, endpoints[]",
-        "- verificationTargets[]: id (contract entry identifier; not a required test-title marker), commandId (frozen directory key), mode + commandLabel (runtime-resolved), file, requirementIds, uiStates, scope? (display-only)",
+        "- verificationTargets[]: id (a stable id you choose, e.g. VT-001; it is not derived from test titles), commandId (frozen directory key), mode + commandLabel (runtime-resolved), file, requirementIds, uiStates, scope? (display-only)",
         "- designEvidence: source, paths, conflicts; evidenceGaps[] (optional)",
         "- optional: stylingStrategy, uiComponentChoices[], dependencyPolicy, residualRisks[], realIntegrationGap",
         "- uiComponentChoices[]: purpose, component, decision (specified|reuse-existing|new), specReference { path, section, line } | null, rationale",
@@ -3202,8 +3090,12 @@ async function buildFrontendHybridDagFromTask(sources) {
             includeReferenceDocuments: false,
         }),
     };
+    const hasMockVerifyCommands = (taskConfig.frontendMock?.verifyCommands.length ?? 0) > 0 ||
+        mockCapability.verifyCommands.length > 0;
     const requirementIds = frontendSourceBinding.requirementIds;
+    const strategy = resolveDagVerifyStrategy(taskConfig);
     const readOnlyPaths = taskConfig.allowedPaths.length > 0 ? taskConfig.allowedPaths : ["**"];
+    const behaviorPaths = deriveFrontendBehaviorPaths(taskConfig);
     const globalConstraints = [
         ...taskConfig.hardConstraints,
         ...(sources.constraintMarkdown
@@ -3217,7 +3109,7 @@ async function buildFrontendHybridDagFromTask(sources) {
         "Frontend planning must consume the read-only Mock assessment strategy produced after scouting; MOCK_STRATEGY: blocked must not pass the deterministic Mock contract gate.",
         "Mock implementations must preserve the real request path as the default, require explicit test/dev activation, and never rely on commenting out the real request.",
         "Mock-backed behavior evidence proves only the documented frontend contract, never real API integration.",
-        "frontend-implementation requires the frozen static verification command and existing affected unit tests. Update affected tests with the implementation; do not install a test framework when absent. Broader browser/visual testing may be deferred; static-verification success is never test success.",
+        "frontend-implementation DAGs must complete deterministic static verification before final review. Behavior verification is also required when the task declares a behavior entrypoint or the implementation contract contains a behavior-mode verification target; static-only contracts must map every target to the declared static entrypoint.",
         "Frontend closeout renders only from committed facts; a weak status (failed / not-run / baseline-debt / mock-backed / pending) can never be rewritten into a stronger one (passed / real-integrated).",
         `Frontend risk classification: ${frontendRisk.selectedRisk} — ${frontendRisk.reason}`,
         frontendRisk.forceFullGates
@@ -3229,36 +3121,111 @@ async function buildFrontendHybridDagFromTask(sources) {
         const blockedReason = mockCapability.safetyViolation
             ? `Mock contract blocked: ${mockCapability.safetyViolation}`
             : (taskConfig.frontendMock?.policy ?? "auto") === "required"
-                ? "Mock strategy is required, but no authorized Mock capability was found."
+                ? "Mock strategy is required, but no authorized Mock verification command was found."
                 : "Mock contract is blocked by deterministic generation-time Mock safety constraints.";
         return buildBlockedFrontendMockDag(frontendSources, readOnlyPaths, forbiddenPaths, globalConstraints, blockedReason);
     }
-    // Static verification is mandatory; existing or explicitly declared tests remain
-    // required. Never use a no-op - but never freeze a command the project cannot run
-    // either. See resolveFrontendStaticCommands for why `npm run build` is not the
-    // only acceptable answer.
-    const explicitFrontendCommands = buildExplicitFrontendVerifyCommands(sources.taskConfig, sources.repoRoot ?? process.cwd());
-    const buildCommands = await resolveFrontendStaticCommands({
-        repoRoot: sources.repoRoot ?? process.cwd(),
-        explicitStatic: explicitFrontendCommands.staticCommands,
+    const fallbackVerifyCommands = await discoverFrontendFallbackVerifyCommands(sources.repoRoot);
+    // The verification bundle schema requires at least one static command. When
+    // a real project exposes no usable verification command at all, run an
+    // explicit no-op marker instead of a command that is guaranteed to fail:
+    // the trace then records not-run honestly and the advisory asks the task
+    // to declare verification commands and regenerate.
+    const staticFallbackCommands = fallbackVerifyCommands.staticCommands.length > 0
+        ? fallbackVerifyCommands.staticCommands
+        : [FRONTEND_NO_STATIC_VERIFICATION_MARKER];
+    const behaviorFallbackCommands = fallbackVerifyCommands.behaviorCommands;
+    const parsedFrontendVerifyCommands = extractFrontendVerifyCommandsFromMarkdown({
+        repoRoot: sources.repoRoot,
+        requirementMarkdown: sources.requirementMarkdown,
+        constraintMarkdown: sources.constraintMarkdown,
+    });
+    const explicitFrontendVerifyCommands = buildExplicitFrontendVerifyCommands(taskConfig, sources.repoRoot);
+    const explicitCommandKeys = new Set([
+        ...explicitFrontendVerifyCommands.staticCommands,
+        ...explicitFrontendVerifyCommands.behaviorCommands,
+    ].map(verifyCommandKey));
+    const adapterVerifyCommands = (sources.verifyCommands?.final ?? []).filter((command) => !explicitCommandKeys.has(verifyCommandKey(command)));
+    const hasDeclaredFrontendVerification = explicitFrontendVerifyCommands.staticCommands.length > 0 ||
+        explicitFrontendVerifyCommands.behaviorCommands.length > 0 ||
+        parsedFrontendVerifyCommands.staticCommands.length > 0 ||
+        parsedFrontendVerifyCommands.behaviorCommands.length > 0;
+    const staticVerifyCommands = chooseFrontendVerifyCommands({
+        explicitCommands: explicitFrontendVerifyCommands.staticCommands,
+        parsedCommands: parsedFrontendVerifyCommands.staticCommands,
+        adapterCommands: adapterVerifyCommands,
+    });
+    const partitionedStaticVerifyCommands = partitionFrontendStaticVerifyCommands({
+        repoRoot: sources.repoRoot,
+        commands: staticVerifyCommands.commands,
+        commandSource: staticVerifyCommands.commandSource,
+    });
+    const behaviorVerifyCommands = chooseFrontendVerifyCommands({
+        explicitCommands: explicitFrontendVerifyCommands.behaviorCommands,
+        parsedCommands: parsedFrontendVerifyCommands.behaviorCommands,
+        adapterCommands: adapterVerifyCommands,
+        // A declared task verifier owns this task's verification boundary. A
+        // static-only task must not inherit unrelated root-level test commands.
+        allowAdapter: !hasDeclaredFrontendVerification,
     });
     const staticShellCommands = buildVerifyShellCommands({
-        repoRoot: sources.repoRoot ?? process.cwd(), commands: buildCommands, fallbackCommands: [],
+        repoRoot: sources.repoRoot,
+        commands: partitionedStaticVerifyCommands.static.commands,
+        fallbackCommands: staticFallbackCommands,
     });
+    const lintShellCommands = buildVerifyShellCommands({
+        repoRoot: sources.repoRoot,
+        commands: partitionedStaticVerifyCommands.lint.commands,
+        fallbackCommands: [],
+    });
+    const behaviorShellCommands = buildVerifyShellCommands({
+        repoRoot: sources.repoRoot,
+        commands: behaviorVerifyCommands.commands,
+        fallbackCommands: hasDeclaredFrontendVerification
+            ? []
+            : behaviorFallbackCommands,
+    });
+    const effectiveBehaviorFallbackCommands = hasDeclaredFrontendVerification
+        ? []
+        : behaviorFallbackCommands;
     const staticVerifyEvidence = buildVerifyEvidence({
-        phase: "final", quota: "full", commandSource: "inline",
-        commands: buildCommands, fallbackCommands: [], commandTexts: staticShellCommands,
-        finalFullRequired: true, commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+        phase: "intermediate",
+        quota: strategy.intermediateQuota ?? "full",
+        commandSource: partitionedStaticVerifyCommands.static.commandSource,
+        commands: partitionedStaticVerifyCommands.static.commands,
+        fallbackCommands: staticFallbackCommands,
+        commandTexts: staticShellCommands,
+        commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+        preflight: sources.verificationPreflight,
     });
-    const testCommands = await resolveFrontendExistingTests(sources);
-    const behaviorShellCommands = buildVerifyShellCommands({ repoRoot: sources.repoRoot ?? process.cwd(), commands: testCommands, fallbackCommands: [] });
-    const lintShellCommands = [];
-    const mockShellCommands = [];
+    const lintVerifyEvidence = lintShellCommands.length > 0
+        ? buildVerifyEvidence({
+            phase: "intermediate",
+            quota: strategy.intermediateQuota ?? "full",
+            commandSource: partitionedStaticVerifyCommands.lint.commandSource,
+            commands: partitionedStaticVerifyCommands.lint.commands,
+            fallbackCommands: [],
+            commandTexts: lintShellCommands,
+            commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+            preflight: sources.verificationPreflight,
+        })
+        : undefined;
     const behaviorVerifyEvidence = buildVerifyEvidence({
-        phase: "final", quota: "full", commandSource: "inline",
-        commands: testCommands, fallbackCommands: [], commandTexts: behaviorShellCommands,
+        phase: "final",
+        quota: "full",
+        commandSource: behaviorVerifyCommands.commandSource,
+        commands: behaviorVerifyCommands.commands,
+        fallbackCommands: effectiveBehaviorFallbackCommands,
+        commandTexts: behaviorShellCommands,
+        finalFullRequired: true,
         commandTimeoutMs: DEFAULT_VERIFY_TIMEOUT_MS,
+        preflight: sources.verificationPreflight,
     });
+    const mockVerifyTemplate = mockMode === "required" && hasMockVerifyCommands
+        ? buildFrontendMockVerifyNode(frontendSources, implementId, readOnlyPaths, forbiddenPaths)
+        : undefined;
+    const mockShellCommands = mockVerifyTemplate?.shell?.commands ?? [];
+    const mockVerifyEvidence = mockVerifyTemplate?.shell?.verifyEvidence;
     // Contract v2: the frozen command directory is the only command reference
     // the plan may use. Modes are assigned here once from the generation-time
     // lane split; downstream materialization resolves the same directory from
@@ -3266,23 +3233,28 @@ async function buildFrontendHybridDagFromTask(sources) {
     const frontendVerifyDirectory = buildFrontendVerifyCommandDirectory({
         staticLabels: staticVerifyEvidence.commandLabels,
         behaviorLabels: behaviorVerifyEvidence.commandLabels,
-        mockLabels: [],
+        mockLabels: mockVerifyEvidence?.commandLabels ?? [],
         staticCommandTexts: staticVerifyEvidence.commandTexts,
         behaviorCommandTexts: behaviorVerifyEvidence.commandTexts,
-        mockCommandTexts: [],
+        mockCommandTexts: mockVerifyEvidence?.commandTexts ?? [],
     });
     const fixedVerificationContext = [
         "## Fixed frontend verification entrypoints",
-        "Require npm run build. Map requirements to implementation files and the shared static build target. Include affected existing test files in implementation steps and maintain their assertions; run the frozen existing-test commands. No separate test plan, new framework, or per-AC test-title protocol is required. Browser/visual testing may be deferred to frontend-test. Missing test infrastructure alone is not a blocker; failing required commands are blockers.",
+        "These shell entrypoints are fixed at DAG generation and are the only commands the static and behavior shell nodes execute. A strategy or plan may add tests behind an existing entrypoint inside writeSet, but must not invent or replace commands or assume subtask_prompt executes a command.",
         "Reference frozen commands ONLY by commandId (record_plan_verification_target entry.commandId). The runtime resolves mode and label; never invent a mode or type.",
         ...frontendVerifyDirectory.map((entry) => `  - ${entry.commandId} [${entry.mode}]: ${JSON.stringify(entry.label)}`),
         `- Static command source: ${staticVerifyEvidence.commandSource}`,
         `- Behavior command source: ${behaviorVerifyEvidence.commandSource}`,
     ].join("\n");
     const advisories = [];
+    if (!hasDeclaredFrontendVerification &&
+        fallbackVerifyCommands.staticCommands.length === 0 &&
+        fallbackVerifyCommands.behaviorCommands.length === 0) {
+        advisories.push("未发现可用的前端验证命令：目标项目没有可读取的 package.json scripts，也未探测到本地 TypeScript，verify 节点将没有静态/行为命令可执行。请在 task.json --verify 或执行约束.md 的验证约束中显式声明命令（例如 node --check src/app.js），然后重新生成 DAG。");
+    }
     if (frontendSourceMentionsMock(frontendSources) &&
         frontendMockStrategyMustBeNotNeeded(frontendSources)) {
-        advisories.push("auto 模式已将 Mock 策略收窄为 not-needed：任务源提到接口/API/Mock 需求，但仓库无确认 Mock 能力。若项目规范要求 Mock，请确认项目 Mock 能力与 policy:required 后重新生成 DAG。");
+        advisories.push("auto 模式已将 Mock 策略收窄为 not-needed：任务源提到接口/API/Mock 需求，但仓库无确认 Mock 能力或无确定性 Mock 验证命令。若项目规范要求 Mock，请声明 frontendMock.verifyCommands 或 policy:required 后重新生成 DAG。");
     }
     const openspecGate = await resolveFrontendOpenspecGateConfig(sources);
     const requiresOpenspecClassification = openspecGate.openspecPolicy === "cited" &&
@@ -3388,13 +3360,13 @@ async function buildFrontendHybridDagFromTask(sources) {
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
                 skills: FRONTEND_CONTRACT_SKILLS,
-                outputContract: "Incremental typed requirement facts; narrative is display-only. Submit through the incremental typed tools record_requirement / record_constraint / record_evidence_expectation / record_handoff_intent / record_open_question / record_split_proposal / record_ui_state / record_required_deliverables / record_openspec_selection, then complete each input scope with complete_contract_scope, then call finalize_contract; correct rejected calls until one successful terminal. record_requirement takes the canonical ledger requirement id and optional execution:{groupId,kind,summary} — the runtime owns the authoritative text, source spans, fragment bindings, and disposition. UI-visible or interactive requirements register a non-blocking frontend-test handoff intent, and any source-declared UI-state table is extracted verbatim through record_ui_state. End finalize_contract with a single contract disposition of ready | ready-with-assumptions | blocked. Cover scope, non-goals, acceptance criteria, UI states, target runtime environment, risks, and verification expectations; do not fix target files, components, or implementation methods as requirements. When OpenSpec candidates exist, classify only the ones you actually use: call record_openspec_selection once per required/relevant path; never enumerate irrelevant candidates (unmentioned defaults to irrelevant) and never emit a fenced selection JSON. No file writes.",
+                outputContract: "Incremental typed requirement facts; narrative is display-only and should be omitted. Submit through the incremental typed tools record_requirement / record_constraint / record_evidence_expectation / record_handoff_intent / record_open_question / record_split_proposal / record_ui_state / record_required_deliverables / record_openspec_selection, then complete each input scope with complete_contract_scope, then call finalize_contract; correct rejected calls until one successful terminal. record_requirement takes the canonical ledger requirement id and optional execution:{groupId,kind,summary} — the runtime owns the authoritative text, source spans, fragment bindings, and disposition. UI-visible or interactive requirements register a non-blocking frontend-test handoff intent, and any source-declared UI-state table is extracted verbatim through record_ui_state. End finalize_contract with a single contract disposition of ready | ready-with-assumptions | blocked. Cover scope, non-goals, acceptance criteria, UI states, target runtime environment, risks, and verification expectations; do not fix target files, components, or implementation methods as requirements. When OpenSpec candidates exist, classify only the ones you actually use: call record_openspec_selection once per required/relevant path; never enumerate irrelevant candidates (unmentioned defaults to irrelevant) and never emit a fenced selection JSON. After a successful typed terminal, stop without a Markdown summary. No file writes.",
                 subtask_prompt: [
                     "OUTPUT BUDGET DISCIPLINE: provider capacity is discovered at runtime; use small records — NEVER attempt to emit the whole contract in one response; a single large JSON dump will be truncated and rejected. Incremental submission through the typed tools is the ONLY supported output mode. Start submitting with the FIRST tool call: after each read, call record_requirement for the requirements you have already confirmed, one or a few per call. Every tool-call round MUST make progress by submitting at least one record_* fact. Do not re-read the same source file that is already materialized in this session; read each file at most once.",
                     "Consume the complete injected input scope and produce a concise frontend implementation contract as typed requirement facts from complete injected scopes.",
                     "Confirm each requirement by the SAME id as the ledger canonical requirement it covers (sourceBinding.requirementIds, e.g. AC-001) — do NOT invent new REQ/BR prefixed ids for canonical requirements: the compiled contract must match the ledger canonical requirement ids exactly or schema validation rejects it (unknown requirement id). record_requirement takes the canonical id and optional execution:{groupId,kind,summary}; the runtime commits the authoritative text and sourceFragmentIds from the frozen ledger. Never pass text/statement/sourceFragmentIds yourself — model rewrites and JSON-stringified fragment arrays are rejected.",
                     "Requirement semantics, source spans, dispositions, and fragment bindings are ledger/runtime-owned. If a canonical requirement is genuinely blocked, say so in the Markdown contract narrative and finalize with the matching disposition instead of trying to encode it in the requirement fact.",
-                    "Preserve source verification requirements. This run requires build and existing affected unit tests, including maintaining their assertions. Do not require a new framework when absent. Register a non-blocking frontend-test handoff for additional browser, visual, Mock, and integration testing; no separate test plan is required.",
+                    "Register evidence expectations for each requirement across static, behavior, Mock, and real integration as required | optional | not-applicable; required must follow from user requirements, task risk, or project governance, never from model convenience. For UI-visible or interactive requirements, register a non-blocking frontend-test handoff intent.",
                     'Use record_evidence_expectation with {requirementId,evidence:{static,behavior,mock,"real-integration"}}; every lane is required | optional | not-applicable. Requirement text and provenance remain runtime-owned.',
                     'Before finalize_contract ready, call record_required_deliverables once with the complete {items:[{path,requirementId,sourceFragmentId}]} inventory, or {items:[]} when no file delivery is mandatory. Interpret the original source, including lists and tables: allowedPaths/only-allowed-to-modify is permission, not an obligation; do not promote prohibited files, examples or references into deliverables. Paths must occur exactly in a frozen source fragment bound to that canonical requirement. Correct the whole inventory before finalizing if needed.',
                     "Authoritative UI states: when the task source declares a UI-state table (state id / trigger / observable outcome), extract it VERBATIM through record_ui_state, one call per state, using the source's own state ids. The planner must bind these ids later — do not rename, merge, or invent states.",
@@ -3454,10 +3426,10 @@ async function buildFrontendHybridDagFromTask(sources) {
                 },
                 outputContract: "Typed decision patch only: map frozen requirements to implementation/verification targets and select the needed component, state, data/Mock, styling, and dependency decisions. Use only the record_* tools needed to express those decisions, then call finalize_plan; correct rejected facts until one successful terminal. Contract owns requirement semantics; Scout owns repository discovery; deterministic runtime owns schema, protected fields, path containment, and command validation. No Markdown narrative or file writes.",
                 subtask_prompt: [
-                    "List the implementation plan from frozen Contract requirements and Scout paths: what to change, where, and the needed component/state/data decisions. Submit those concrete actions in finalize_plan implementationSteps: [{requirementIds, action}]; cover every frozen requirement, sharing steps across related IDs when appropriate. Do not design tests, prescribe DOM harnesses, or require test evidence.",
+                    "Plan only the delta between the frozen frontend-contract-pi facts and frontend-scout-pi target surface. Do not reinterpret the task, repeat requirements, search the repository, or choose implementation order.",
                     "Record only: requirement-to-file/verification coverage; component/styling choices; applicable UI state and interaction behavior; data/Mock strategy; and a dependency policy or genuine evidence gap. Reuse Scout paths. If scope is missing, record a blocking gap instead of inventing a path.",
                     "Use the typed tool schemas as the field contract. Runtime owns schemaVersion, sourceBinding, riskLevel, targets.files, mockApi.productionDefaultOff, aliases, command allowlisting, path containment, and final validation; do not restate those rules or emit a full JSON contract.",
-                    `Cover each frozen requirement ID exactly once: ${requirementIds.join(", ") || "(none)"}. Bind every verification target to a frozen commandId from the directory above plus a Scout-confirmed file. Use the shared static build target for implementation files; do not create behavior test targets or test plans. Static commands are project-wide checks traced by file and command only.`,
+                    `Cover each frozen requirement ID exactly once: ${requirementIds.join(", ") || "(none)"}. Bind every verification target to a frozen commandId from the directory above plus a Scout-confirmed file. Behavior commands prove observable behavior: one target may cover multiple related requirementIds when one test behavior proves them together; do not mechanically create one target per requirement. A behavior target id is the stable identifier of that contract entry and its file must be a test file. Static commands are project-wide checks traced by file and command only.`,
                     "UX vocabulary protocol: record_state_registry FIRST with the full global vocabulary — one stable kebab-case behavior-domain name per UI state/interaction (e.g. planner-task-edit, focus-queue-move), never one name per AC number and never a rename of an already-recorded concept. Details consume complete execution-group scopes and reuse the same global names across scopes. Constraints/exclusions must not manufacture UI. Then record_state_flow entries whose names all come from that registry; uiState names must use the contract's declared authoritative ids (declaredUiStates in the plan input) when present. Retry attempts see committedUx in this input — reuse those exact names. Components: one choice may cover many state/interaction ids via covers; reuse-existing requires evidencePath naming an existing repo file (greenfield must be decision=new).",
                     ...(requiresOpenspecClassification ? ["When a component choice uses an OpenSpec selection, cite that selection; otherwise do not classify unrelated candidates."] : []),
                     "Call finalize_plan; correct rejected facts until one successful terminal after the necessary typed facts. Return no Markdown narrative.",
@@ -3502,11 +3474,20 @@ async function buildFrontendHybridDagFromTask(sources) {
                                     "request-adapter",
                                     "not-needed",
                                 ],
-                        mockCommandLabels: [],
+                        mockCommandLabels: mockVerifyEvidence?.commandLabels ?? [],
                         artifactName: "frontend-implementation-contract.json",
                         outputDir: "contracts",
                         requireSourceFreshness: true,
                         implementationWriteSet: implementPaths.writeSet,
+                        ...(taskConfig.requirementOwnership?.length
+                            ? { requirementOwnership: taskConfig.requirementOwnership }
+                            : {}),
+                        ...(taskConfig.capabilityBoundary
+                            ? { capabilityBoundary: taskConfig.capabilityBoundary }
+                            : {}),
+                        ...(taskConfig.interactionIds?.length
+                            ? { interactionIds: taskConfig.interactionIds }
+                            : {}),
                         openspecPolicy: openspecGate.openspecPolicy,
                         openspecSpecRoots: taskConfig.frontendOpenspec?.specRoots ?? [
                             ...DEFAULT_FRONTEND_SPEC_ROOTS,
@@ -3546,15 +3527,16 @@ async function buildFrontendHybridDagFromTask(sources) {
                 skills: FRONTEND_DESIGN_REVIEW_SKILLS,
                 outputContract: "Authoritative typed design terminal via approve_design / request_design_changes tools. No JSON verdict; the committed typed design fact is the only authority. No file writes.",
                 subtask_prompt: [
-                    "Submit findings individually with record_design_finding and stable IDs; terminal tools aggregate saved findings. Correct rejected calls, stop after a successful terminal. Check execution groups against every member source outcome, including permission, threshold and failure-path differences; each independent AC needs corresponding planned implementation; shared build evidence checks buildability only.",
+                    "Submit findings individually with record_design_finding and stable IDs; terminal tools aggregate saved findings. Correct rejected calls, stop after a successful terminal. Check execution groups against every member source outcome, including permission, threshold and failure-path differences; shared verification is valid only when it proves each independent AC.",
+                    "After the typed design terminal succeeds, stop immediately; do not emit a Markdown recap.",
                     "Audit the frontend plan before implementation. frontend-plan-pi is emitted to you as canonical full-contract JSON after the runtime applied and validated the planner's editable patch against its protected skeleton; there is no separate plan prose.",
                     "Your authoritative terminal verdict is exactly one committed typed tool call: approve_design or request_design_changes. Call exactly one of them; after calling one, do not call the other.",
                     "request_design_changes must carry a typed issueCategory, at least one evidenceRef, and non-empty findings.",
                     "Your verdict is consumed as deterministic data input by frontend-writer-admission-shell. approve_design permits admission; request_design_changes blocks writer admission until a recovery plan incorporates every Critical/Important finding.",
-                    "Request design changes only for missing requirement implementation coverage or unauthorized scope/dependencies. Preserve declared production-default-off Mock boundaries. Missing test methods, test cases, DOM/state-transition verification, Mock-backed evidence or behavior correctness evidence are not design blockers; defer them to frontend-test.",
-                    "Check whether every required feature/state has an implementation plan and whether paths and dependencies are authorized. Do not turn behavior correctness or regression concerns into implementation blockers; record them for frontend-test.",
-                    "Component selection conformance is a hard blocking condition: request_design_changes when the frontend spec (component/theme/rule.components bucket) already defines a component for a purpose but the plan selects another or self-invents one without a declared deviation; when uiComponentChoices is missing/empty for UI-visible work while the frozen component/theme bucket is non-empty; when a decision=specified specReference.path is missing a ledger OpenSpec reference or successful read event; or when a decision=new component lacks a traceable task-source/PRD specReference. A PRD reference for decision=new is not an OpenSpec citation and must not be rejected merely for lacking an OpenSpec read event. For uiComponentChoices, purpose is the stable coverage key and must match interaction.name or uiState.name; responsibility is expressed by the matched expectedBehavior plus rationale, and you must not reject it merely for matching an interaction or component identifier.",
-                    "The only executable verification in this workflow is npm run build. A missing test plan, missing behavior evidence, or prediction that tests will fail is non-blocking and belongs to frontend-test. Only requirement omissions, scope violations and a failed build block implementation completion.",
+                    "Request design changes when the Mock strategy is blocked, missing, unsupported by repository evidence, inconsistent with the API contract, outside authorized paths/dependencies, unable to prove production-default-off behavior with the fixed production/default-real-path static check, or missing deterministic behavior verification for a declared behavior target or selected Mock strategy. Mock strategies require Mock-backed evidence; a static-only contract is allowed only when every verification target is static and maps to a declared static entrypoint; not-needed requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists, in which case the plan must preserve the real request path and record the Real Integration Gap.",
+                    "Also request design changes for missing applicable UI states, unsupported dependency additions, design-system drift without reason, weak interaction coverage, broad scope, inline fake data, schema drift, or missing deterministic verification commands.",
+                    "Component selection conformance is a hard blocking condition: request_design_changes when the frontend spec (component/theme/rule.components bucket) already defines a component for a purpose but the plan selects another or self-invents one without a declared deviation; when uiComponentChoices is missing/empty for UI-visible work while the frozen component/theme bucket is non-empty; when a decision=specified specReference.path is missing a ledger OpenSpec reference or successful read event; or when a decision=new component lacks a traceable task-source/PRD specReference. A PRD reference for decision=new is not an OpenSpec citation and must not be rejected merely for lacking an OpenSpec read event. For uiComponentChoices, coverage is judged by the covers list: every applicable UI state and interaction must appear in some choice's purpose or covers, and the runtime already pre-checks this deterministically at plan finalize — do not re-litigate it. purpose is a human-readable description of what the choice is for and must NOT be rejected merely for not matching an interaction or uiState name; judge responsibility semantics from the covered ids' expectedBehavior plus the choice rationale.",
+                    "You must NOT make authoritative assertions about the execution result of frozen verification commands: command results are deterministically established by frontend-verify-shell. Record a verification-feasibility concern only as a non-blocking finding (severity must not be Critical, and it must never be the sole fatal basis for request_design_changes). Only semantic design defects (component selection, state flow, interaction contract, or conflicts with the specification) may be Critical; a pure command-will-fail prediction must not be classified as contract-requirement-gap.",
                     "Read-only: do not modify repository files.",
                     "LARGE-FILE AUDIT (avoid full reads): style/theme audit files can be large (e.g. styles.css is often hundreds of KB). Prefer grep to locate the exact rules/variables you must verify (e.g. grep the oc- class, is-* modifier, or --oc- theme variables with their line numbers), then read only the narrow line range when surrounding context is needed. Do not read a large style/test file in full — a single full read can exhaust the read budget and fail the attempt.",
                     "Canonical contract reading: frontend-design-policy-shell prints absolute paths for Contract, Contract index, and the non-blocking Capacity diagnostic. Read the capacity diagnostic first. When it recommends full-contract, read the exact Contract path. When it recommends indexed-sections, read the Contract index and its hash-bound section files instead of opening the full contract. Never resolve a bare contracts/... path against the repository root or hunt for substitutes. Implementation target files inside the writeSet are created later by the implement node: do not read them and do not treat their absence as a design defect.",
@@ -3580,7 +3562,11 @@ async function buildFrontendHybridDagFromTask(sources) {
                     frontendWriterAdmission: {
                         schemaVersion: 1,
                         designReviewFromNodeId: "frontend-design-review-pi",
-                        frozenCommandLabels: staticVerifyEvidence.commandLabels,
+                        frozenCommandLabels: [
+                            ...staticVerifyEvidence.commandLabels,
+                            ...behaviorVerifyEvidence.commandLabels,
+                            ...(mockVerifyEvidence?.commandLabels ?? []),
+                        ],
                         allowedMockStrategies: taskConfig.frontendMock?.policy === "disabled" ||
                             frontendMockStrategyMustBeNotNeeded(frontendSources)
                             ? ["not-needed"]
@@ -3596,6 +3582,12 @@ async function buildFrontendHybridDagFromTask(sources) {
                                     "request-adapter",
                                     "not-needed",
                                 ],
+                        ...(lintShellCommands.length > 0 && lintVerifyEvidence
+                            ? {
+                                lintCommands: lintShellCommands,
+                                lintEvidence: lintVerifyEvidence,
+                            }
+                            : {}),
                     },
                     cwd: ".",
                     timeoutMs: 60000,
@@ -3611,16 +3603,18 @@ async function buildFrontendHybridDagFromTask(sources) {
                     forbiddenPaths,
                     writerOutcomePolicyType: "frontend-facts-v1",
                 }),
-                outputContract: "The executor derives implementation status from write events, diff, write guard and build checks. Report changed files, requirement-to-code coverage, build result and pending frontend-test handoff; do not claim tested behavior correctness.",
+                outputContract: "The implementation status is derived by the executor from mechanical facts (write-tool events, run delta, write guard, requirement coverage, focused-check), not from any IMPLEMENTATION_OUTCOME first line. Deliver a Markdown summary with Contract Ref (path/schema/hash), Changed Files, Requirements Implemented, UI States, Tests Changed, Verification Attempts, Deviations, and Residual Risks. Follow fixed stages: contract confirm → tests → component/state → API/Mock → focused checks → diff cleanup.",
                 subtask_prompt: [
                     "Implement against the validated run-owned Frontend Implementation Contract materialized by frontend-design-policy-shell (path/schema/hash) and authorized by frontend-writer-admission-shell. Do not rebuild the contract from Markdown alone.",
                     "WRITER TOOL PROTOCOL (hard): the response text is not delivery. Never paste source code, test code, or full file contents into chat. After reading the canonical contract, make the first implementation change with the structured write/edit tool (one file per call); continue writing through those tools until the writeSet is complete. If a write/edit tool is unavailable, stop and report the blocked capability instead of drafting code in the response.",
                     "The canonical contract already contains the approved requirement, target-file, UI-state, verification, design, and Mock/API decisions. Do not re-open task sources, OpenSpec, AI workspace, plan/revision, or design-review prose, and do not repeat broad repository research. Inspect only contract target files and directly related local code needed to implement them.",
-                    "Implement the planned requirements and report where each is realized. Do not add a test-first stage or require tests for completion. The independent frontend-test workflow owns tests; the only frozen command here is npm run build.",
-                    "Map every requirement id, expectedOutcome, interaction and applicable UI state to concrete implementation files. The shared static build target is a buildability check, not proof of behavior correctness.",
+                    "Execute in fixed stages and report each in the delivery summary: (1) Contract confirm, (2) Tests sync, (3) Component/UI state implementation, (4) API/Mock wiring per contract.mockApi, (5) Focused checks behind frozen entrypoints only, (6) Diff cleanup.",
+                    "Map every requirement id, expectedOutcome, interaction trigger/expectedBehavior, and applicable UI state from the contract to concrete files. Do not invent shell verification commands; only frozen static/behavior entrypoints will run.",
+                    "A behavior verification target's target.id is only the contract's identifier for that entry; it does not need to appear in test titles. Never add tests, rename describe/it/test titles, or restructure files just to carry generated ids — reuse affected existing test files and their names. The requirement ↔ verification-target association lives in the contract (requirementIds / verificationTargetIds), not in title strings.",
+                    "Tests must genuinely prove the behavior each target maps to; a passing test-file execution does not by itself prove every mapped behavior is covered — keep assertions aligned with the contract's expectedBehavior, and state any residual gap honestly in Tests Changed.",
                     "Begin implementation after the contract and its target files are confirmed. Do not spend the turn collecting optional context. If the canonical contract lacks behavior needed to edit safely, stop and state the blocking reason in the summary instead of reopening broad discovery.",
                     "Your implementation status is derived by the executor from mechanical facts (persisted write-tool events, run delta, write guard, requirement coverage, focused-check failures), never from any IMPLEMENTATION_OUTCOME first line. Do not emit an IMPLEMENTATION_OUTCOME first line.",
-                    "The node uses bounded build checks and diff checkpoints. Repair local syntax/type/import/build errors within the writeSet; do not expand into behavior testing, regression testing or test repair.",
+                    "The node runs a bounded micro-loop: after each write attempt the executor re-runs frozen focused checks and records a per-round diff checkpoint; the write guard stays active every round. Only repair local issues attributable to the current diff (syntax/type/import/format/unit-assert/obvious omission). Never change requirements, design, writeSet, or verification strictness inside the loop.",
                     "Implement only the approved Mock strategy carried by the validated contract. Preserve the real request path as the default, require explicit test/dev activation, and never comment out or replace the real request with inline data.",
                     "frontend-design-policy-shell materialized and validated the canonical contract; frontend-writer-admission-shell authorized the writeSet. Stay within writeSet and preserve unrelated files.",
                     "For native, browser-intercept, or request-adapter, implement contract-aligned fixtures/states and a dev/test-only activation boundary in this same writer. For not-needed, do not add Mock files or a framework and state the positive reason.",
@@ -3628,7 +3622,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                     "Edit existing files with the structured edit/write tools. NEVER rewrite Markdown (or any file with quoting/backticks/indentation-sensitive content) via bash sed/awk/echo redirection: escaping mistakes silently corrupt the file and self-repair loops burn the run.",
                     ...(implementPaths.docIndexCompanions.length > 0
                         ? [
-                            `Doc index sync is MANDATORY: ${implementPaths.docIndexCompanions.join(", ")} are catalog index files for this writeSet. When you add, rename, or remove any indexed file, you MUST also update ${implementPaths.docIndexCompanions.join(" and ")} in the same run (append or fix the matching index entry following the existing line style). Keep these index updates within the authorized writeSet.`,
+                            `Doc index sync is MANDATORY: ${implementPaths.docIndexCompanions.join(", ")} are catalog index files for this writeSet. When you add, rename, or remove any indexed file, you MUST also update ${implementPaths.docIndexCompanions.join(" and ")} in the same run (append or fix the matching index entry following the existing line style). Verification runs check-doc-index and fails the run when a new file is missing from the index.`,
                         ]
                         : []),
                     writerDeliveryContract(taskConfig),
@@ -3645,7 +3639,7 @@ async function buildFrontendHybridDagFromTask(sources) {
                 writePolicy: "read-only",
                 allowedPaths: readOnlyPaths,
                 forbiddenPaths,
-                outputContract: "Run npm run build and preserve its exit status. No test, lint or separate typecheck commands; any build failure remains terminal and eligible for existing bounded recovery.",
+                outputContract: "Run frozen Mock/static/behavior commands and materialize the verification trace. Any failure is terminal: no same-run repair branch, failure ownership facts are materialized for recovery.",
                 subtask_prompt: "Execute the frontend verification bundle. Preserve per-command evidence; a failure fails this node (terminal) and routes to recovery.",
                 shell: {
                     commands: [],
@@ -3655,6 +3649,8 @@ async function buildFrontendHybridDagFromTask(sources) {
                         lintCommands: lintShellCommands,
                         staticCommands: staticShellCommands,
                         behaviorCommands: behaviorShellCommands,
+                        mockEvidence: mockVerifyEvidence,
+                        lintEvidence: lintVerifyEvidence,
                         staticEvidence: staticVerifyEvidence,
                         behaviorEvidence: behaviorVerifyEvidence,
                         lintBaselineNodeId: lintShellCommands.length > 0
@@ -3698,20 +3694,21 @@ async function buildFrontendHybridDagFromTask(sources) {
                 skills: FRONTEND_REVIEW_SKILLS,
                 outputContract: 'Authoritative typed review terminal via approve_review / request_review_changes tools. No JSON verdict is required in the response text; the typed terminal fact is the only authority. No file writes.',
                 subtask_prompt: [
-                    "Submit findings individually with record_review_finding and stable IDs; terminal tools aggregate saved findings. Correct rejected calls, stop after a successful terminal. Check execution groups against every member source outcome, including permission, threshold and failure-path differences; each independent AC needs corresponding planned implementation; shared build evidence checks buildability only.",
-                    "Check requirement-to-code coverage, authorized files/dependencies and the npm run build result. Behavior correctness, edge cases, regressions and test design/execution belong to frontend-test; their missing evidence is not a blocker here.",
+                    "Submit findings individually with record_review_finding and stable IDs; terminal tools aggregate saved findings. Correct rejected calls, stop after a successful terminal. Check execution groups against every member source outcome, including permission, threshold and failure-path differences; shared verification is valid only when it proves each independent AC.",
+                    "After the typed review terminal succeeds, stop immediately; do not emit a Markdown recap.",
+                    "Review the frontend implementation and verification evidence.",
                     "Your authoritative terminal verdict is exactly one committed typed tool call: approve_review or request_review_changes. Call it once and do not call the other afterwards.",
                     "approve_review means the implementation passes; it must not carry Critical or Important findings. request_review_changes must carry a typed issueCategory, at least one evidenceRef, and non-empty findings.",
                     "Do NOT emit an equivalent JSON verdict in the response text: the committed typed terminal fact is the only authority and no branch or gate reads response-text JSON verdicts.",
-                    "Read contracts/frontend-review-context.json from frontend-review-context-shell. It binds a hash-verified canonical contract reference, a field-to-section index, frontend lint assessment when configured, the effective verification trace, and the run-owned actual diff. Read contractRef.capacityDiagnosticPath first: use contractRef.path only when full-contract is recommended; otherwise read only the hash-bound contractRef.sections needed for the changed surface and verification claims. Then read diff.reviewSummaryPath. The full artifacts/diff_patch.patch is retained only as audit evidence: do NOT read it in full. For semantic review, read only the named per-file diff fragment in the summary/index (in part order when needed) and then the current source file when necessary. Do not claim actual diff is missing when those artifacts exist; do not invent a diff from the implementation summary alone. Trace proves command/file/stable-target-id binding only—not semantic correctness.",
-                    "This run requires only a successful npm run build exit. Other test/lint/typecheck evidence is not required. Do not claim absent evidence passed; report independent testing as not-run.",
+                    "Read contracts/frontend-review-context.json from frontend-review-context-shell. It binds a hash-verified canonical contract reference, a field-to-section index, frontend lint assessment when configured, the per-command verification evidence (verificationEvidence.commands: commandId/label/lane/exitCode/ok plus allPassed, and lintStatus with lintConfigured) , the effective verification trace, and the run-owned actual diff. Read contractRef.capacityDiagnosticPath first: use contractRef.path only when full-contract is recommended; otherwise read only the hash-bound contractRef.sections needed for the changed surface and verification claims. Then read diff.reviewSummaryPath. The full artifacts/diff_patch.patch is retained only as audit evidence: do NOT read it in full. For semantic review, read only the named per-file diff fragment in the summary/index (in part order when needed) and then the current source file when necessary. Do not claim actual diff is missing when those artifacts exist; do not invent a diff from the implementation summary alone. Trace proves command/file/stable-target-id binding only—not semantic correctness.",
+                    "Treat lint status exactly as passed | baseline-debt | failed | unavailable, and read lintConfigured: when it is false the task declares no lint commands, so lintStatus unavailable means it is not part of this task — report no lint finding either way. baseline-debt may continue only with intact evidence and zero diagnostics on writer-changed files; report the tolerated debt count and never rewrite it as lint passed. Typecheck, build, and test still require successful final exits, judged from verificationEvidence.commands exit codes rather than from the binding trace.",
                     "Flag .skip/.only, deleted or weakened tests, unauthorized config changes, Mock-only evidence claimed as real integration, and Browser/visual claims (always not-run in this workflow).",
                     "The contract referenced and hash-bound by frontend-review-context.json is the effective plan materialized by frontend-design-policy-shell. Do not re-open task sources, OpenSpec, AI workspace, design-review, writer summary, or verification node prose. Inspect only the canonical review context, its indexed contract sections, its bound diff, and diff-referenced files when semantic review requires source code.",
-                    "For uiComponentChoices, purpose is the stable coverage key and must match interaction.name or uiState.name. Responsibility is expressed by the matched expectedBehavior plus rationale; you must not reject it merely for matching an interaction or component identifier.",
-                    "Check implementation of source requirements and declared production Mock isolation in the diff. Missing Mock-backed or real API test evidence is a non-blocking frontend-test handoff, not an implementation rejection.",
+                    "For uiComponentChoices, coverage is judged by the covers list and is deterministically pre-checked at plan finalize; purpose is a human-readable description and must not be rejected merely for not matching an interaction or uiState name. Responsibility is expressed by the covered ids' expectedBehavior plus the choice rationale.",
+                    "Treat a commented-out real request, default-enabled Mock, production entrypoint importing test mocks, API/fixture contract drift, unauthorized Mock dependency/path, or missing behavior evidence for the selected strategy as at least Important. Mock strategies require Mock-backed evidence. not-needed requires applicable real/no-remote behavior evidence unless auto mode explicitly skipped Mock because no project Mock capability exists; in that case verify that the real request remains the default and the Real Integration Gap is preserved.",
                     "Inspect the frontend-verify-shell evidence in the review context directly, including the production/default-real-path static check, and require Mock activation to be off for that check.",
                     "Distinguish Mock-backed evidence from real API integration evidence and preserve the Real Integration Gap when the backend was not exercised.",
-                    "Review requirement implementation coverage and write authorization. Runtime behavior correctness and quality testing are deferred to frontend-test. Read-only: do not modify files.",
+                    "Review implementation quality, behavior/state coverage, verification evidence, and maintainability. Read-only: do not modify files.",
                 ].join("\n\n"),
             },
             {
@@ -4469,11 +4466,11 @@ const section=allLines.slice(start,end).join('\\n');
 const raw=[];
 const lines=section.split('\\n').filter(l=>l.includes('|'));
 const cells=line=>line.split('|').slice(1,-1).map(value=>stripBackticks(value).trim());
-const expectedHeader=['Module Stem','Business Resource','Owned Operations','Owned Rule Keys','Case IDs','Split Reason','Markdown Path','Pytest Path'];
+const expectedHeader=${JSON.stringify(BACKEND_TEST_MODULE_INDEX_HEADER)};
 const headerIndex=lines.findIndex(line=>{const row=cells(line);return expectedHeader.every((value,index)=>row[index]===value);});
 if(headerIndex<0){process.stderr.write('invalid-module-index-header: require exact business ownership and path columns\\n');process.exit(2);}
 const dataRows=lines.slice(headerIndex+2).map(cells).filter(row=>row.length>=8&&row[0]&&row[0]!=='Module Stem');
-const allowedSplit=new Set(['explicit-user-layout','primary-business-resource','independent-business-resource','output-budget']);
+const allowedSplit=new Set(${JSON.stringify(BACKEND_TEST_MODULE_SPLIT_REASONS)});
 const operationOwners=new Map();const canonicalSeen=new Set();const declaredModules=[];let planRepairApplied=headingRepair||partitionRepair;
 for(const row of dataRows){
   const rawStem=String(row[0]||'').trim(),resource=String(row[1]||'').trim(),operations=String(row[2]||'').split(';').map(value=>value.trim()).filter(Boolean),split=String(row[5]||'').trim();
@@ -5161,7 +5158,7 @@ async function buildBackendTestHybridDag(sources) {
                     `STRICT_BACKEND_TEST_MODULE_LAYOUT=${JSON.stringify(taskConfig.backendTest.moduleLayout)}`,
                 ]
                 : []),
-            "Include exactly one `## Module Index` table with this exact header: `| Module Stem | Business Resource | Owned Operations | Owned Rule Keys | Case IDs | Split Reason | Markdown Path | Pytest Path |`. Use canonical relative links `[label](./<stem>.md)` inside the Markdown Path cell followed by the resolved `${layout.markdownDir}/<stem>.md` path. Split Reason is exactly one of `explicit-user-layout`, `primary-business-resource`, `independent-business-resource`, or `output-budget`. Group by stable business resource/domain, not by CRUD operation, AC, parameter/field axis, scenario type or regression purpose: one resource's list/detail/create/update/delete and its filters/response assertions/regression floor belong in one module. Multiple modules owning the same exact `METHOD /path` are forbidden unless every such row is `explicit-user-layout` from primary-requirement path pairs or has a documented `output-budget` proof. Keep the total module count at the smallest safe value and never exceed 8 modules. Name model-derived modules with stable lowercase business stems such as `health` or `resource_notes`; explicit-user-layout preserves the primary requirement filename stem even when it is more specific. Do not use priority-only stems `p0`, `p1` or `p2`; Priority belongs only in the Coverage Matrix. Pure hexadecimal/hash-like opaque stems and test-purpose-only stems are forbidden. Do not use Case-ID-like module filenames. The relative link target, Markdown Path, Pytest Path and downstream automation mapping must be one-to-one and exact; for model-derived modules the default pair remains `testcase/md/<module>.md` and `testcase/test_<module>.py`, while explicit-user-layout preserves the primary requirement paths. Do not hand-write a conflicting module count in prose; the Module Index row count is the only count truth.",
+            `Include exactly one \`## Module Index\` table with this exact header: \`${backendTestModuleIndexHeaderMarkdown()}\`. The Markdown Path cell must contain exactly one resolved repository-relative path such as \`${canonicalBackendTestModuleMarkdownPath(layout.markdownDir, "health")}\`; do not emit a Markdown link or repeat the path. Split Reason is exactly one of \`${BACKEND_TEST_MODULE_SPLIT_REASONS.join("\`, \`")}\`. Group by stable business resource/domain, not by CRUD operation, AC, parameter/field axis, scenario type or regression purpose: one resource's list/detail/create/update/delete and its filters/response assertions/regression floor belong in one module. Multiple modules owning the same exact \`METHOD /path\` are forbidden unless every such row is \`explicit-user-layout\` from primary-requirement path pairs or has a documented \`output-budget\` proof. Keep the total module count at the smallest safe value and never exceed 8 modules. Name model-derived modules with stable lowercase business stems such as \`health\` or \`resource_notes\`; explicit-user-layout preserves the primary requirement filename stem even when it is more specific. Do not use priority-only stems \`p0\`, \`p1\` or \`p2\`; Priority belongs only in the Coverage Matrix. Pure hexadecimal/hash-like opaque stems and test-purpose-only stems are forbidden. Do not use Case-ID-like module filenames. Markdown Path, Pytest Path and downstream automation mapping must be one-to-one and exact; for model-derived modules the default pair remains \`${layout.markdownDir}/<module>.md\` and \`${layout.scriptDir}/test_<module>.py\`, while explicit-user-layout preserves the primary requirement paths. Do not hand-write a conflicting module count in prose; the Module Index row count is the only count truth.`,
             "Scenario Partitions (query/filter axes): inspect every affected GET/list operation for query/path parameters whose bound source documents a finite enum or classification domain. If at least one such axis exists, add exactly one machine-readable `## Scenario Partitions` section after the Coverage Matrix using exactly `| Partition ID | Operation | Axis | Domain | Required Slots | Expected by Slot | Bind Rule |` with the separator row and one row per eligible axis. If no affected axis has a source-backed finite domain, omit the entire `## Scenario Partitions` heading and section; do not emit an explanatory prose-only section. Partition ID is a stable `SP-<OPERATION>-<AXIS>` token; Domain must copy the legal values verbatim from the bound OpenAPI enum or requirement sentence (never guess), using bare semicolon-separated identifier values inside the single table cell (for example `ACTIVE; ARCHIVED`, with no Markdown backticks or prose); Required Slots must contain `each-value` and exactly one `not-in-set`, plus `omitted` only when the parameter is optional. Before returning, expand every declared partition into its complete deterministic exact slot ID set: one `TP-<Partition ID>-<VALUE-TOKEN>` per Domain value, `TP-<Partition ID>-OMITTED` only for an optional axis, and exactly one `TP-<Partition ID>-NOT-IN-SET`. Every expanded slot ID must appear verbatim in the binding Rule's `Required Test Points` cell and be assigned to concrete Case IDs in that same Coverage Matrix row; ordinary alias/family Test Points do not replace this inventory. Scheme A: Case count may be smaller than the enum count, but every exact slot still needs an independent variant Test Point and pytest.param id; never use SINGLE/MULTIPLE aliases as coverage. Expected by Slot states the documented expectation per slot kind (`domain-value`, `default-behavior`, `empty-result`/`excluded-result` when documented, or `GAP` when the source does not document the complement expectation — never invent 空列表/400). POST/PUT body field-validation enums stay in the Coverage Matrix as `TP-<FIELD>-ENUM-*` and MUST NOT get a Scenario Partition row. Do not create partitions for axes without a documented legal-value domain. Only GET/list query or path parameters whose bound source documents a finite enum or classification set may become a Scenario Partition. Do not create partitions for free-form strings, primary keys, required-or-optional-only parameters, or boundary/format-only axes. If an axis has no finite legal-value domain, do not declare a Partition row and do not invent NOT-IN-SET cases. Cross-axis combinations stay as ONE nominal Case; never declare a cross-axis cartesian partition.",
             "Before finalizing README, calculate the predicted collected-item count as `sum(max(1, number of variant Test Points in each Case))`. If the task declares an item budget, the prediction must not exceed it. Reduce excess only by removing duplicate execution and converting same-request checkpoints to assertions; never drop required rules, boundaries, enums, operation-specific inputs, or business states. Record the prediction in README. Use only environment-supported fixtures/targets/isolation, record evidence gaps in Chinese, and do not emit JSON, pytest, or execute commands.",
             ...(sharedSetupPrompt ? [sharedSetupPrompt] : []),
@@ -5401,7 +5398,7 @@ async function buildBackendTestHybridDag(sources) {
                     "Output budget protocol (hard, max output <=16K per turn): Write exactly the frozen `{{item.pytestPath}}`. Never paste full Python modules into assistant chat. Do not merge or split modules. Do not reduce params/assertions/skips to fit. If OUTPUT_LIMIT_RECOVERY is injected, continue only listed missing/broken scripts.",
                     "Align every variant pytest.param payload with the Markdown scenario intent (empty/missing/null/length/pattern/enum/wrong-type/nominal). Prefer literal payloads over Faker for intent-critical fields so pre-execution scenario-param checks can verify them. Hard contract: intent=enum-invalid MUST pass a concrete invalid value literal (string/number/boolean), never `_OMIT`/None/missing key; intent=missing/empty may use `_OMIT` or delete the key; intent=custom-literal:trim|whitespace-padded requires a leading/trailing whitespace string with non-empty trimmed content (all-whitespace belongs to empty/whitespace-only, not trim); intent=custom-literal:ACTIVE|ARCHIVED requires the exact enum string, never descriptive tokens like filter-active; intent=max/min/max+1 should pass a repeated-string length expression, a bare length number N, or a helper named _*_LEN{N} / _*_MAX_LENGTH / _*_OVER_LENGTH — never a bare 1 for oversize. Hard contract: request payload dicts may only contain DTO field keys from Payload Allowed Paths; never put expect/expected/echo_* helper keys inside the JSON body dict. Path/query/header identifiers and scenario-control metadata (including `id`, expected codes, and selector labels) must stay in separate pytest parameters and helper arguments; never merge them into a DTO patch or JSON body unless that exact path is allowed by the Markdown payload contract. Normalize the configured API base URL with `rstrip(\"/\")` (or equivalently join exactly one slash) before appending endpoint paths; generated requests must never contain a `//api/...` path. When the bound source documents a concrete non-secret local API URL, generated clients must use it as the fallback in `os.environ.get(\"API_BASE_URL\", \"<documented-url>\")`; do not require an otherwise-uninjected environment variable or fail setup solely because it is absent. Missing-field helpers must remove keys idempotently with `payload.pop(field, None)`, never `del payload[field]`, because optional fields may already be absent.",
                     "For every response contract that requires an object or pagination envelope, first assert that each envelope/data value is a dict and that required keys exist, then index fields and assert values. Never let an incidental KeyError or list/string TypeError stand in for the explicit response-shape contract failure.",
-                    'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. A Case with exactly one variant Test Point still needs one literal `pytest.param(..., id="TP-...")` row; never leave a single-variant Case as a bare function with the TP only in the docstring. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. The primary symbol docstring must contain exact metadata lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty). Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/list filters still declare query fields in those payload labels when the Case varies `params=`/`query=` keys. Python `True`/`False` may implement JSON/OpenAPI `true`/`false` query or body booleans. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
+                    'Ensure every automatable final Markdown Case ID in this module appears in exactly one primary pytest test function or pytest test class method region, using the exact `primary symbol` declared by Markdown. Skip evidence-only meta Cases that declare `脚本/primary symbol=无` with empty variants; do not invent a business pytest symbol for them. The symbol must start with `test_BE_<MODULE>_<NNN>_` so every parameterized collected item remains associated with its Case. Module-level functions and class-based pytest methods are both supported. Only `变体测试点` may use stable `pytest.param(..., id="TP-...")` IDs, and every atomic variant ID must appear exactly once with a genuine input/state/outcome change. A Case with exactly one variant Test Point still needs one literal `pytest.param(..., id="TP-...")` row; never leave a single-variant Case as a bare function with the TP only in the docstring. Use a literal direct `pytest.param(..., id=...)` expression for every row; never hide or wrap it behind `_post_case`, `_put_case`, row-factory functions, comprehensions, generators, or dynamically returned parameter lists; do not use decorator-level `ids=[...]`, generated suffixes, or IDs that extend/shorten the exact Markdown TP. Do not parameterize `场景断言测试点` or `横切证据测试点`; execute all assertion checkpoints within the same business journey/item and use shared helpers for cross-cutting evidence. Governance-only cross-cutting bindings such as writeSet compliance, execution count, report existence, or orchestration state are metadata-only in business pytest: preserve their IDs in `Cross-Cutting-Test-Points`, but never assert `__file__`, filesystem placement, pytest invocation count, Harness state, or report artifacts inside the business test. Harness-owned evidence verifies those bindings. The first statement inside every primary symbol must be a triple-quoted docstring containing exact lines `Case-ID: BE-...`, `Assertion-Test-Points: TP-...;TP-...` and `Cross-Cutting-Test-Points: TP-...;TP-...` (use `none` when empty), for example `def test_BE_X_001():\n    """\n    Case-ID: BE-X-001\n    Assertion-Test-Points: TP-X-ASSERT\n    Cross-Cutting-Test-Points: none\n    """`. Module/class docstrings, comments before `def`, and singular `Assertion-Test-Point:` comments never bind a Test Point. Implement request dictionaries so their direct and nested key paths and enum literals exactly satisfy the Case `Payload Required Paths`, `Payload Allowed Paths`, and `Payload Enum`; for `Payload Contract: none`, do not invent a JSON/body DTO. GET/list filters still declare query fields in those payload labels when the Case varies `params=`/`query=` keys. Python `True`/`False` may implement JSON/OpenAPI `true`/`false` query or body booleans. GET/DELETE setup journeys may create resources, but their setup DTO must not change the target operation\'s no-body payload contract. No Test Point may be invented, renamed, omitted or bound in two modes. The generated pytest collection shape must equal the Markdown prediction `sum(max(1, variant count per Case))`; keep it at or below the task\'s explicit budget by removing duplicate execution, never by collapsing multiple parameter rows under a coarse family TP. Assertions come only from 预期结果 and setup comes only from 前置条件/测试数据/自动化映射.',
                     "Name the generated pytest file so it corresponds one-to-one with its source Markdown module file: this module stem `{{item.stem}}` maps to exactly the frozen `{{item.pytestPath}}`. The <module> stem is the Markdown filename without the `.md` extension, lowercased and with non-alphanumeric characters replaced by underscores. For example, `resource_notes` → `testcase/test_resource_notes.py`, `health` → `testcase/test_health.py`. If Markdown automation mapping names a different path than this module stem path, still write the frozen manifest pytest path and do not invent prefixes. Never merge multiple Markdown modules into one pytest file, never split one module across several files, and never invent pytest filenames unrelated to the Markdown modules.",
                     "Scenario Partition slots: every `TP-<Partition ID>-...` variant Test Point declared by this module's Markdown MUST become exactly one literal direct `pytest.param(..., id=\"TP-<Partition ID>-...\")` row with the exact slot ID; the not-in-set slot passes a concrete literal absent from the documented Domain (e.g. `UNKNOWN_TYPE`) — never `_OMIT`, never a descriptive token. Never split one slot into multiple params or merge several slots under a family TP id. Slot filtering requests hit the documented list endpoint with the slot value as the query/path filter.",
                     "Keep this module self-contained: define module-local fixtures and helpers directly in `{{item.pytestPath}}`, so pytest discovers every fixture dependency without external plugin registration. The request log must include method, URL/path, and request parameters (query plus JSON/body/payload summary). The response log must include status code and response result (JSON/text/body summary), and both records must be visible in pytest stdout/stderr without changing assertions. Recursively redact sensitive values and apply bounded truncation before logging.",
@@ -5459,7 +5456,7 @@ async function buildBackendTestHybridDag(sources) {
         outputContract: "First non-empty line is IMPLEMENTATION_OUTCOME: changed|blocked, followed by a concise repair summary. This node runs only for REPAIRABLE initial facts, so already-satisfied is invalid and a successful outcome requires a non-empty bounded diff. Modify only generated pytest scripts/helpers/factories and preserve every Markdown Case, Test Point, primary symbol and assertion meaning.",
         subtask_prompt: [
             "Repair the generated backend pytest asset as one bounded program using the direct upstream collection assessment. This is the only repair attempt and happens before any business test body execution. The direct upstream JSON includes authoritative `repairPaths` and bounded `repairFindings`; treat both as the complete mandatory checklist without searching for a run directory or report file. Treat any upstream line such as `Repair paths: testcase/test_x.py` as equivalent authoritative repairPaths evidence. Directly read and edit that testcase path; do not search for separate root-level `contracts/**`, guess a DAG run directory, or require another report artifact. If the read tool successfully returns the testcase file, the path exists—continue the bounded repair and never later claim that file is absent.",
-            "Initial status REPAIRABLE means at least one listed finding remains: `already-satisfied` is forbidden, and you must produce a non-empty bounded diff on repairPaths before returning `IMPLEMENTATION_OUTCOME: changed`. Fix only readiness-proven generated testcase-local defects on initial facts repairPaths: create exact safe missing mapped test_*.py paths, repair syntax/import/symbol/decorator/parameterization, close generated fixture dependencies/plugin registration, and repair initial Markdown-to-pytest correspondence findings. Use this deterministic repair map instead of reading analyzer implementation: findings about `Case-ID`, `Assertion-Test-Points`, or `Cross-Cutting-Test-Points` are fixed by editing the declared primary symbol docstring metadata lines; variant binding findings are fixed in the literal direct `pytest.param(..., id=\"TP-...\")` row; primary-symbol cardinality/name findings are fixed in the function name or duplicate primary symbols; script mismatch is fixed only on the authoritative assessment repairPaths; payload findings are fixed in request payload construction. Do not read controller `src/**` or inspect JS/TS analyzer code. Do not search for `testcase/**/README.md`. Never invent a business pytest symbol for evidence-only Markdown Cases that declare `脚本/primary symbol=无` with empty variants. For fixture defects inspect both provider and importer listed by repairPaths; fix ScopeMismatch by aligning fixture scopes or inlining request-scoped values so module fixtures never depend on function fixtures; when a shared fixture depends on sibling fixtures, register the whole provider module through an exact pytest_plugins declaration rather than importing only the outer fixture. Do not create unrelated pytest scripts.",
+            "Initial status REPAIRABLE means at least one listed finding remains: `already-satisfied` is forbidden, and you must produce a non-empty bounded diff on repairPaths before returning `IMPLEMENTATION_OUTCOME: changed`. Fix only readiness-proven generated testcase-local defects on initial facts repairPaths: create exact safe missing mapped test_*.py paths, repair syntax/import/symbol/decorator/parameterization, close generated fixture dependencies/plugin registration, and repair initial Markdown-to-pytest correspondence findings. Use this deterministic repair map instead of reading analyzer implementation: findings about `Case-ID`, `Assertion-Test-Points`, or `Cross-Cutting-Test-Points` are fixed by making the first statement in the declared primary symbol a triple-quoted docstring with the exact plural metadata lines; these are the primary symbol docstring metadata lines. Module/class docstrings, comments before `def`, and singular `Assertion-Test-Point:` comments are invalid. Variant binding findings are fixed in the literal direct `pytest.param(..., id=\"TP-...\")` row; primary-symbol cardinality/name findings are fixed in the function name or duplicate primary symbols; script mismatch is fixed only on the authoritative assessment repairPaths; payload findings are fixed in request payload construction. Do not read controller `src/**` or inspect JS/TS analyzer code. Do not search for `testcase/**/README.md`. Never invent a business pytest symbol for evidence-only Markdown Cases that declare `脚本/primary symbol=无` with empty variants. For fixture defects inspect both provider and importer listed by repairPaths; fix ScopeMismatch by aligning fixture scopes or inlining request-scoped values so module fixtures never depend on function fixtures; when a shared fixture depends on sibling fixtures, register the whole provider module through an exact pytest_plugins declaration rather than importing only the outer fixture. Do not create unrelated pytest scripts.",
             "This is the single pytest incremental synchronization round. The `Findings` in `reports/backend-test-pytest-collection-initial.md` are the mandatory repair checklist: resolve every repairable listed finding on every authoritative `Repair paths` file before considering any other advisory evidence, and never substitute an unrelated scenario-param cleanup for a listed correspondence/collection defect. For every assessment-listed path, compare the effective Markdown Case/Test Points/test data and its `Payload Contract`/`Payload Required Paths`/`Payload Allowed Paths`/`Payload Enum` labels with the generated module. Incrementally add or repair only missing symbols, params, assertions and payload builders. Repair every assessment-listed missing nested path, unexpected key and enum mismatch; preserve exact DTO keys, nested shapes, enum/boundary literals, operation transport and business preconditions; remove guessed replacement keys only when the effective Markdown proves the exact contract. Keep path/query/header identifiers and scenario-control metadata separate from DTO patches and JSON bodies; an `id` used for a path target must be passed to the request path/helper, never inserted into a body patch unless `id` is explicitly listed in Payload Allowed Paths. Flatten every variant into a literal direct `pytest.param(..., id=\"TP-...\")` row; replace `_post_case`/`_put_case` or other parameter-row factories because correspondence and scenario readiness require the actual row values and IDs to be statically visible. Also repair helper call sites to match their defined return signatures; do not tuple-unpack a helper that returns one scalar value.",
             "Preserve final testcase/md/** semantics, every Case ID, Rule/Test Point binding, primary symbol, parameter ID, expected status/body/schema assertion, HTTP logging, redaction and truncation behavior.",
             "Use local edit only on assessment-listed paths; keep summaries short; never rewrite unrelated modules.",