@tea-agent/loop-agent 0.43.0-next.9 → 0.43.0

package/dist/executors/dag-pi-executor.js

@@ -1,5 +1,3 @@
-import { collectFrontendPlanMissingFacts, collectFrontendPlanPhaseMissingFacts, committedFactFromPlanRecord, planFactStringList, planFactScopeIntersects } from "../workflows/dag/frontend-plan-completeness.js";
-export { collectFrontendPlanMissingFacts, collectFrontendPlanPhaseMissingFacts } from "../workflows/dag/frontend-plan-completeness.js";
 import { classifyFrontendPlanRecovery } from "../workflows/dag/frontend-plan-recovery-policy.js";
 import { collectFrontendExecutionGroups, frontendExecutionSchema } from "../workflows/dag/frontend-execution-groups.js";
 import { FRONTEND_SCOPE_TARGET_BYTES, packFrontendInputUnits, parseFrontendInputBlock, projectFrontendContractPrompt, projectFrontendInputScope } from "../workflows/dag/frontend-input-projection.js";
@@ -282,7 +280,17 @@ export const WRITER_BUDGET_EXHAUSTED_CATEGORY = "writer-budget-exhausted";
 export const WRITER_TOKEN_BUDGET = 2_000_000;
 export function allowsMissingChangedWriterOutcomeRecovery(task) {
     return (isBackendTestCompletenessRetryCandidate(task) ||
-        isBackendTestPytestCollectionRepairOutcomeRecoveryCandidate(task));
+        isBackendTestPytestCollectionRepairOutcomeRecoveryCandidate(task) ||
+        // N5 can persist a valid incremental edit but omit the prose status line.
+        // Recover only the missing marker with a measured non-empty diff; the
+        // existing write guard and downstream backend validation still apply.
+        (task.id === "review-and-revise-backend-md-cases-pi" &&
+            task.executor === "pi" &&
+            task.role === "implementer" &&
+            task.toolProfile === "write" &&
+            task.writePolicy === "exclusive" &&
+            (task.writeSet?.length ?? 0) > 0 &&
+            task.writerOutcomePolicy?.type === "implementation-outcome-v1"));
 }
 function readWriterThinkingExhaustionEvidence(result) {
     const wider = result;
@@ -458,12 +466,16 @@ export function resolveDagPiStepName(task) {
 export const FRONTEND_CONTRACT_RECORD_TOOL_NAMES = [
     "record_requirement",
     "record_constraint",
+    // Model-owned execution grouping on already-confirmed canonical requirements.
+    "record_requirement_execution",
     "record_evidence_expectation",
     "record_handoff_intent",
     "record_open_question",
     "record_split_proposal",
     "record_ui_state",
     "record_required_deliverables",
+    // OpenSpec disposition selection when the task declares spec roots.
+    "record_openspec_selection",
     "complete_contract_scope",
 ];
 export const FRONTEND_CONTRACT_TERMINAL_TOOL_NAMES = [
@@ -492,6 +504,27 @@ export const FRONTEND_PLAN_RECORD_TOOL_NAMES = [
 ];
 export const FRONTEND_PLAN_TERMINAL_TOOL_NAMES = ["finalize_plan"];
 export const FRONTEND_PLAN_ADOPT_TOOL_NAMES = ["adopt_staged_fact"];
+/** Experimental decision-path Plan toolset (HARNESS_FRONTEND_PLAN_DECISION=1).
+ * These are the tool names `createFrontendPlanDecisionTools` registers as
+ * custom tools; the SDK activates a custom tool only when its name is in the
+ * session allowlist returned by `resolveDagPiToolNames`, so the decision path
+ * must return this exact set instead of the relationship-path plan tools.
+ * `finalize_decision` is finalize-loop-owned: the model calls it in-session
+ * after committing facts and repairs any pre-validation findings until it
+ * succeeds; the executor still invokes it after the session (an identical
+ * replay of a successful terminal) as the backstop. It is listed so durable
+ * activation/consistency checks see the full toolset. */
+export const FRONTEND_DECISION_PLAN_TOOL_NAMES = [
+    "record_module_placement",
+    "record_reuse_decision",
+    "record_state_ownership",
+    "record_data_flow",
+    "retract_data_flow",
+    "record_api_mock_boundary",
+    "record_verification_focus",
+    "record_dependency",
+    "finalize_decision",
+];
 /** M5: `frontend-review-pi` emits its authoritative terminal verdict through
  * committed typed tools instead of the legacy JSON verdict parse. */
 export function isFrontendReviewTypedTerminalNode(task) {
@@ -549,9 +582,28 @@ export async function acceptCommittedTypedTerminalFact(runDir, nodeId) {
     if (!binding)
         return false;
     try {
-        const { readCommittedOriginFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
-        const records = await readCommittedOriginFacts(runDir, nodeId, binding.file);
-        return records.some((record) => record.fact.kind === binding.kind);
+        const { readCommittedOriginFacts } = await import("../workflows/dag/frontend-committed-facts.js");
+        // The experimental decision Plan path commits its terminal into
+        // plan-decision-facts.jsonl (kind finalize_decision) instead of the
+        // relationship ledger plan-typed-facts.jsonl (kind finalize_plan). Accept
+        // either ledger for the plan node so a successful decision finalize with
+        // no trailing narrative text is not reclassified as empty-output.
+        const candidates = [binding];
+        if (nodeId === "frontend-plan-pi") {
+            candidates.push({ file: "plan-decision-facts.jsonl", kind: "finalize_decision" });
+        }
+        for (const candidate of candidates) {
+            try {
+                const records = await readCommittedOriginFacts(runDir, nodeId, candidate.file);
+                if (records.some((record) => record.fact.kind === candidate.kind)) {
+                    return true;
+                }
+            }
+            catch {
+                // Missing alternative ledger is expected on the relationship path.
+            }
+        }
+        return false;
     }
     catch {
         return false;
@@ -561,6 +613,10 @@ export function resolveDagPiToolNames(task) {
     if (isFrontendReviewTypedTerminalNode(task)) {
         return [
             ...DAG_PI_READONLY_TOOLS,
+            // complete_review_scope comes from createFrontendReviewScopeProtocol;
+            // the Pi SDK activates custom tools only when their name is in this
+            // allowlist, and omitting it silently drops the checkpoint tool the
+            // segmented runner instructs the model to call before any terminal.
             "complete_review_scope",
             "record_review_finding",
             "approve_review",
@@ -570,6 +626,7 @@ export function resolveDagPiToolNames(task) {
     if (isFrontendDesignTypedTerminalNode(task)) {
         return [
             ...DAG_PI_READONLY_TOOLS,
+            // Same scope-checkpoint activation rule as the review node above.
             "complete_review_scope",
             "record_design_finding",
             "approve_design",
@@ -590,6 +647,16 @@ export function resolveDagPiToolNames(task) {
         return [...DAG_PI_READONLY_TOOLS, ...FRONTEND_SCOUT_EVIDENCE_TOOL_NAMES];
     }
     if (isFrontendPlanLedgerNode(task)) {
+        if (process.env.HARNESS_FRONTEND_PLAN_DECISION === "1") {
+            // Experimental decision path: expose exactly the decision toolset that
+            // createFrontendPlanDecisionTools registers. Relationship-path plan
+            // tools (record_route_selection … finalize_plan/adopt_staged_fact) are
+            // not present in that toolset, so returning them here would leave the
+            // decision tools unactivated (Pi SDK activates custom tools only when
+            // their name is in this allowlist) — the planner then cannot record
+            // module placements and finalize always reports unplaced-requirement.
+            return [...FRONTEND_DECISION_PLAN_TOOL_NAMES];
+        }
         return [
             // Plan is a decision-only node. Contract/scout own source and repository
             // discovery; omitting read tools prevents a planner from spending its
@@ -1116,6 +1183,112 @@ async function loadContractRequirementInheritance(runDir) {
     }
     return byId;
 }
+export async function resolveFrontendDecisionAuthority(input) {
+    const inheritance = await loadContractRequirementInheritance(input.runDir);
+    if (inheritance.size === 0)
+        return undefined;
+    const requirements = [...inheritance].map(([id, record]) => ({ id, expectedOutcome: record.text ?? id }));
+    const executionGroups = collectFrontendExecutionGroups([...inheritance].map(([id, record]) => ({ id, execution: record.execution })));
+    const behaviorGroups = executionGroups
+        .filter(group => group.kind === "behavior")
+        .map(group => ({ id: group.id, requirementIds: group.requirementIds, minimumEvidenceLevel: "mounted" }));
+    // Contract `execution` is model-authored and optional (record_requirement
+    // accepts it only when the contract model decided to attach a group). The
+    // decision authority must be deterministic, so every requirement that did not
+    // receive a behavior execution group still gets its own fallback group —
+    // otherwise a contract run without execution metadata leaves all requirements
+    // unplaced (r3: every attempt failed unplaced-requirement because behavior
+    // groups were empty and the model's placement ids were unknown-behavior-group).
+    {
+        const groupedRequirementIds = new Set(behaviorGroups.flatMap(group => group.requirementIds));
+        for (const requirement of requirements) {
+            if (!groupedRequirementIds.has(requirement.id)) {
+                behaviorGroups.push({
+                    id: requirement.id,
+                    requirementIds: [requirement.id],
+                    minimumEvidenceLevel: "mounted",
+                });
+            }
+        }
+    }
+    // The frozen command directory (friendly ids like
+    // verify-repo-quick-verification-2) is the vocabulary both the model and the
+    // relationship plan reference. Freeze those ids here — never the opaque
+    // canonicalKeys of the verification bundle (they encode cwd+args and are not
+    // the ids `record_verification_focus` accepts; freezing them makes every
+    // finalize fail with unknown-command for a model that correctly follows the
+    // PRD/H-C vocabulary).
+    const { deriveFrontendVerifyCommandDirectoryFromRun, deriveRequirementOwnershipFromRun } = await import("../workflows/dag/frontend-implementation-contract.js");
+    const verifyDirectory = await deriveFrontendVerifyCommandDirectoryFromRun(input.runDir);
+    const requirementOwnership = await deriveRequirementOwnershipFromRun(input.runDir);
+    const { deriveFrontendInteractionIdsFromRun, deriveFrontendAllowedMockStrategiesFromRun } = await import("../workflows/dag/frontend-implementation-contract.js");
+    const interactionIds = await deriveFrontendInteractionIdsFromRun(input.runDir);
+    const allowedMockStrategies = await deriveFrontendAllowedMockStrategiesFromRun(input.runDir);
+    const commandIds = new Set();
+    for (const entry of verifyDirectory)
+        commandIds.add(entry.commandId);
+    const requirementSha256 = input.sourceBinding?.schemaVersion === 2
+        ? (input.sourceBinding.inputDigest ?? "")
+        : "";
+    if (!/^[a-f0-9]{64}$/.test(requirementSha256))
+        return undefined;
+    return {
+        sourceBinding: { requirementSha256 },
+        observedRequirementSha256: requirementSha256,
+        requirements,
+        behaviorGroups,
+        allowedPaths: input.task.allowedPaths ?? [],
+        forbiddenPaths: input.task.forbiddenPaths ?? [],
+        commands: [...commandIds].map(id => ({ id })),
+        requirementOwnership,
+        interactionIds: interactionIds.length > 0 ? interactionIds : undefined,
+        allowedMockStrategies: allowedMockStrategies.length > 0 ? allowedMockStrategies : undefined,
+    };
+}
+/** Decision-path Plan prompt. The relationship `subtask_prompt`
+ * (record_state_registry / record_plan_verification_target / finalize_plan) must
+ * NOT be reused: it names tools the decision toolset does not expose and never
+ * states the behavior-group ids the decision schema requires. This prompt
+ * injects the frozen authority so the model can fill `modulePlacements[].id` and
+ * `verificationFocus[].behaviorGroupId` correctly. */
+export function buildFrontendDecisionPlanPrompt(authority) {
+    return [
+        "DECISION PLAN (experimental): record semantic decisions only. The runtime expands behavior-group membership and derives the per-AC relationship table; do not write requirement-to-file coverage yourself.",
+        "Frozen requirements (cover each exactly once through its behavior group):",
+        JSON.stringify(authority.requirements),
+        "Behavior groups — use these exact ids for modulePlacements[].id and verificationFocus[].behaviorGroupId:",
+        JSON.stringify(authority.behaviorGroups),
+        "Frozen verification command ids — use one for verificationFocus[].commandId:",
+        JSON.stringify(authority.commands.map(command => command.id)),
+        [
+            "Record with these typed tools (each takes an `entry` field):",
+            '- record_module_placement: {"id": "<behavior group id>", "paths": ["<repo-relative file>"]}',
+            '- record_state_ownership: {"state": "<name>", "owner": "<behavior group id>", "applicable": true, "expectedBehavior": "<behavior>"} (use notApplicableReason for a non-applicable state)',
+            '- record_verification_focus: {"id": "VT-...", "behaviorGroupId": "<behavior group id>", "file": "<test file>", "commandId": "<frozen command id>", "evidenceLevel": "unit|mounted|real-integration"}',
+            '- record_reuse_decision: {"symbol": "<component>", "decision": "reuse-existing|new", "evidence": ["<path>"], "purpose": "<state or interaction name it covers>", "covers": ["<extra ids>"]} (set stylingStrategy once on the first row when the task mandates a style contract)',
+            '- record_api_mock_boundary: {"boundary": "<METHOD /path>", "mode": "real|mock|not-needed", "evidence": "<why>"} (boundary is the identity: same boundary + replace:true flips its mode; real/mock also carry fixture + consumer)',
+            '- record_data_flow: {"interaction": "<name>", "source": "<behavior group id>", "trigger": "<event>", "expectedBehavior": "<behavior>"}',
+            '- record_dependency: {"name": "<dependency or none>"}',
+        ].join("\n"),
+        "Every frozen requirement must belong to a behavior group, and every behavior group needs a module placement; a requirement with no placement fails finalize.",
+        ...(authority.interactionIds?.length ? [
+            `Frozen interaction id vocabulary — record_data_flow interaction names MUST be exactly these ids (renames are deterministic finalize rejects): [${authority.interactionIds.join(", ")}].`,
+        ] : []),
+        ...(authority.allowedMockStrategies?.length ? [
+            `Frozen Mock strategy allowance — the contract mockApi.strategy must be one of [${authority.allowedMockStrategies.join(", ")}] (mode real→native, mock→browser-intercept, all boundaries not-needed→not-needed).${authority.allowedMockStrategies.length === 1 && authority.allowedMockStrategies[0] === "not-needed" ? ` This run allows ONLY "not-needed": record every remote boundary with mode "not-needed" (the run has no deterministic Mock verification; preserve the real integration gap) — mode "mock" or "real" is a deterministic finalize reject.` : ""}`,
+        ] : []),
+        ...(authority.requirementOwnership?.length ? [
+            "Requirement-file ownership is machine-enforced at finalize (violations are deterministic rejects, not review opinions):",
+            ...authority.requirementOwnership.map(entry => [
+                `- ${entry.requirementIds.join(", ")}:`,
+                entry.implementationFiles?.length ? `  implementation files allowed: [${entry.implementationFiles.join(", ")}]` : "",
+                entry.verificationFiles?.length ? `  verification files allowed: [${entry.verificationFiles.join(", ")}]` : "",
+            ].filter(Boolean).join("\n")),
+        ] : []),
+        "The requirements, execution constraints and prohibited wordings in the supplied input are authoritative review criteria, not suggestions: a component the task mandates by name must be recorded as its own decision=new reuse decision (never merged into an existing component), implementationTargets must only reference requirement-authorized files, and stylingStrategy must restate the mandated style contract verbatim without promising anything the input forbids.",
+        "When all required facts are committed, call finalize_decision. On a failed finalize receipt, fix the listed record_* facts (resubmit a corrected row with the same identity and replace:true to replace it) and call finalize_decision again until it succeeds. Return no Markdown narrative.",
+    ].join("\n\n");
+}
 /**
  * Resolve task-source citations from the source-fidelity ledger before the
  * planner starts. The planner names a frozen requirement id and one of its
@@ -1273,7 +1446,7 @@ export async function createFrontendPlanLedgerTools(input) {
     ]);
     const { loadTypedEventStore, readCommittedEvents, writeTypedEventStoreJsonl, } = await import("../workflows/dag/frontend-typed-event-store.js");
     const { adoptStagedFact, adoptTypedEventFact, stageTypedEventFact } = await import("../workflows/dag/frontend-typed-event-transaction.js");
-    const { assemblePlanPatchFromCommittedFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+    const { assemblePlanPatchFromCommittedFacts } = await import("../workflows/dag/frontend-committed-facts.js");
     let store = input.store;
     const attemptId = input.attemptId;
     let activeRequirementScope = [];
@@ -1289,7 +1462,7 @@ export async function createFrontendPlanLedgerTools(input) {
             description: "Optional. When omitted, the runtime derives it from the contract requirement. Prefer omitting it to keep this tool call small.",
         })),
         implementationTargets: stringArray,
-        verificationTargetIds: stringArray,
+        verificationTargetIds: Type.Optional(stringArray),
         evidenceGap: Type.Optional(Type.Object({
             requirementId: optionalString,
             description: Type.String({}),
@@ -1403,7 +1576,7 @@ export async function createFrontendPlanLedgerTools(input) {
     });
     async function adoptPlanFact(kind, requestId, fact) {
         // A+B (AC-005): a provider-capability fact kind reaching the plan ledger
-        // is out of route — it belongs to the shadow provider capability channel,
+        // is out of route — it belongs to the provider capability channel,
         // not the plan decision ledger. Route it through the frozen seven-kind
         // matrix and fail closed to `unsupported-provider-capability` instead of
         // silently widening the plan catalog.
@@ -1953,7 +2126,7 @@ export async function createFrontendPlanLedgerTools(input) {
     const recordPlanRequirementTool = defineTool({
         name: "record_plan_requirement",
         label: "record_plan_requirement",
-        description: "Commit one plan requirement entry (origin=plan plan-requirement fact). Call once per requirement. For a correction, re-submit the same id with replace=true; the ledger compiles the latest replacement. Entry carries id, implementationTargets, verificationTargetIds, and optional expectedOutcome (omit it — the runtime derives the outcome text from the contract requirement). IMPORTANT: batch up to 4 record_* calls per assistant message; never batch more than 4 — a larger single message risks output truncation under a small output window. Example: {\"entry\": {\"id\": \"<AC-XXX>\", \"implementationTargets\": [\"<deliverable file>\"], \"verificationTargetIds\": [\"<VT-XXX>\"]}}",
+        description: "Commit one plan requirement entry (origin=plan plan-requirement fact). Call once per requirement. Verification targets are authoritative in record_plan_verification_target; omit verificationTargetIds here unless repairing legacy input. For a correction, re-submit the same id with replace=true; the ledger compiles the latest replacement. Entry carries id, implementationTargets, and optional expectedOutcome (omit it — the runtime derives the outcome text from the contract requirement). IMPORTANT: batch up to 4 record_* calls per assistant message; never batch more than 4 — a larger single message risks output truncation under a small output window. Example: {\"entry\": {\"id\": \"<AC-XXX>\", \"implementationTargets\": [\"<deliverable file>\"]}}",
         promptSnippet: "Commit 1-4 plan requirement entries (up to 4 per message).",
         parameters: Type.Object({
             entry: requirementSchema,
@@ -2047,7 +2220,7 @@ export async function createFrontendPlanLedgerTools(input) {
     const recordPlanGroupCoverageTool = defineTool({
         name: "record_plan_group_coverage", label: "record_plan_group_coverage",
         description: "Submit shared implementation/verification references for one declared execution group. Runtime expands to every canonical member and retains its full outcome and source bindings. A shared VT must actually verify each independent condition. Use per-requirement records for differences; never create UI for constraints or exclusions. replace:true explicitly revises the group.",
-        parameters: Type.Object({ id: Type.String({ minLength: 1 }), implementationTargets: stringArray, verificationTargetIds: stringArray, replace: Type.Optional(Type.Boolean()) }, { additionalProperties: false }),
+        parameters: Type.Object({ id: Type.String({ minLength: 1 }), implementationTargets: stringArray, verificationTargetIds: Type.Optional(stringArray), replace: Type.Optional(Type.Boolean()) }, { additionalProperties: false }),
         async execute(callId, params, signal, onUpdate, ctx) {
             const group = executionGroups.find(g => g.id === params.id && g.kind !== "unclassified");
             if (!group || (activeRequirementScope.length && group.requirementIds.some(id => !activeRequirementScope.includes(id))))
@@ -2056,11 +2229,11 @@ export async function createFrontendPlanLedgerTools(input) {
             for (const id of group.requirementIds) {
                 const existing = readCommittedEvents(store, attemptId).filter(r => r.fact.kind === "plan-requirement" && r.fact.entry?.id === id).at(-1)?.fact.entry;
                 if (existing && !params.replace) {
-                    if (JSON.stringify(existing.implementationTargets) !== JSON.stringify(params.implementationTargets) || JSON.stringify(existing.verificationTargetIds) !== JSON.stringify(params.verificationTargetIds))
+                    if (JSON.stringify(existing.implementationTargets) !== JSON.stringify(params.implementationTargets))
                         return planToolReceipt({ ok: false, kind: "plan-requirement", code: "FACT_IDENTITY_CONFLICT", error: `${id}: existing coverage differs; use replace:true to revise explicitly` });
                     continue;
                 }
-                last = await recordPlanRequirementTool.execute(`${callId}:${id}`, { entry: { id, implementationTargets: params.implementationTargets, verificationTargetIds: params.verificationTargetIds }, ...(params.replace ? { replace: true } : {}) }, signal, onUpdate, ctx);
+                last = await recordPlanRequirementTool.execute(`${callId}:${id}`, { entry: { id, implementationTargets: params.implementationTargets, ...(params.verificationTargetIds ? { verificationTargetIds: params.verificationTargetIds } : {}) }, ...(params.replace ? { replace: true } : {}) }, signal, onUpdate, ctx);
                 if (!last.details?.ok)
                     return last;
             }
@@ -2070,7 +2243,7 @@ export async function createFrontendPlanLedgerTools(input) {
     const recordPlanVerificationTargetTool = defineTool({
         name: "record_plan_verification_target",
         label: "record_plan_verification_target",
-        description: "Commit one plan verification target entry (origin=plan plan-verification-target fact). Reference a frozen verification command by commandId (see the frozen command directory in your prompt: static commands are project-wide checks traced by file and command only; behavior commands need a test file whose describe/it/test title contains the target id). For behavior targets, call once per distinct behavior, not mechanically once per requirement: one target may cover multiple related requirementIds. For a correction, re-submit the same id with replace=true; the ledger compiles the latest replacement. A behavior target id is the stable trace token that implementation must place in a real describe/it/test title. Entry carries id, commandId, file, requirementIds, and uiStates; optional scope (unit | component | integration) is display-only. Free-form symbol text is not accepted. IMPORTANT: batch up to 4 record_* calls per assistant message; never batch more than 4 — a larger single message risks output truncation under a small output window. Example: {\"entry\": {\"id\": \"VT-DASHBOARD-SHELL\", \"commandId\": \"<frozen behavior command id>\", \"file\": \"<test file>\", \"requirementIds\": [\"AC-001\", \"AC-002\"], \"uiStates\": []}}" +
+        description: "Commit one plan verification target entry (origin=plan plan-verification-target fact). Reference a frozen verification command by commandId (see the frozen command directory in your prompt: static commands are project-wide checks traced by file and command only; behavior commands bind an existing affected test file; preserve its test names). For behavior targets, call once per distinct behavior, not mechanically once per requirement: one target may cover multiple related requirementIds. For a correction, re-submit the same id with replace=true; the ledger compiles the latest replacement. A target id identifies a contract entry only; never require it in test names. Results bind by frozen command and test file. Entry carries id, commandId, file, requirementIds, and uiStates; optional scope (unit | component | integration) is display-only. Free-form symbol text is not accepted. IMPORTANT: batch up to 4 record_* calls per assistant message; never batch more than 4 — a larger single message risks output truncation under a small output window. Example: {\"entry\": {\"id\": \"VT-DASHBOARD-SHELL\", \"commandId\": \"<frozen behavior command id>\", \"file\": \"<test file>\", \"requirementIds\": [\"AC-001\", \"AC-002\"], \"uiStates\": []}}" +
             (input.canonicalVerificationTargetIds &&
                 input.canonicalVerificationTargetIds.length > 0
                 ? ` Frozen canonical behavior target ids (use exactly for behavior targets): ${input.canonicalVerificationTargetIds.join(", ")}.`
@@ -2549,6 +2722,9 @@ export async function createFrontendPlanLedgerTools(input) {
             finalizePlanTool,
         ],
     });
+    const durableFinalizePlanTool = durable.customTools.find((tool) => typeof tool === "object" && tool !== null && tool.name === "finalize_plan");
+    if (!durableFinalizePlanTool)
+        throw new Error("frontend plan durable finalize tool unavailable");
     return {
         customTools: [...durable.customTools, { ...readPlanFactsTool, execute: async (...args) => { await durable.flush(); return readPlanFactsTool.execute(...args); } }],
         adoptCommittedFacts: async (records) => durable.commitExternal(async () => {
@@ -2617,6 +2793,17 @@ export async function createFrontendPlanLedgerTools(input) {
             ];
         },
         flush: durable.flush,
+        finalizePlan: (params) => durableFinalizePlanTool.execute(`${attemptId}:auto-finalize-plan`, {
+            ...(params?.residualRisks
+                ? { residualRisks: [...params.residualRisks] }
+                : {}),
+            ...(params?.realIntegrationGap
+                ? { realIntegrationGap: params.realIntegrationGap }
+                : {}),
+        }, undefined, undefined, 
+        // The wrapper passes this through to the typed tool; finalize itself
+        // does not inspect the extension context.
+        {}),
         committedFactCount: () => readCommittedEvents(store, attemptId).length,
         committedRequirementIds: () => {
             const ids = new Set();
@@ -2633,6 +2820,674 @@ export async function createFrontendPlanLedgerTools(input) {
         committedFacts: () => readCommittedEvents(store, attemptId),
     };
 }
+/** Translate derived-patch validation findings into decision-channel
+ * vocabulary. Each zod issue path names a COMPILED patch array, but the model
+ * authored record_* facts — so quote the offending entry's identity and name
+ * the tool that owns it (r14: "uiComponentChoices.0.specReference.section:
+ * Required" is unactionable when the model has never heard of specReference). */
+export function translateDecisionPatchFindings(message, decision) {
+    const body = message.replace(/^invalid-output:\s*/, "");
+    return body
+        .split(/;\s*/)
+        .map(issue => {
+        const choice = issue.match(/uiComponentChoices\.(\d+)\.(.+)/);
+        if (choice) {
+            const row = decision.reuseDecisions[Number(choice[1])];
+            const base = row
+                ? `record_reuse_decision purpose "${row.purpose}" (component ${row.symbol}, decision ${row.decision}): ${issue}`
+                : `record_reuse_decision row ${choice[1]}: ${issue}`;
+            const field = choice[2];
+            return field?.startsWith("specReference")
+                ? `${base} — pass specSection (the AC id / task-source section it implements) on that entry, or use decision "reuse-existing"`
+                : base;
+        }
+        const focus = issue.match(/verificationTargets\.(\d+)\.(.+)/);
+        if (focus) {
+            const row = decision.verificationFocus[Number(focus[1])];
+            if (!row)
+                return `record_verification_focus row ${focus[1]}: ${issue}`;
+            return `record_verification_focus ${row.id}: ${issue} — behavior targets derive uiStates from record_state_ownership rows whose owner equals behaviorGroupId "${row.behaviorGroupId}"; record one for this group if missing`;
+        }
+        const state = issue.match(/uiStates\.(\d+)\.(.+)/);
+        if (state) {
+            const row = decision.stateOwnership[Number(state[1])];
+            return row
+                ? `record_state_ownership "${row.state}" (owner ${row.owner}): ${issue}`
+                : `record_state_ownership row ${state[1]}: ${issue}`;
+        }
+        const interaction = issue.match(/interactions\.(\d+)\.(.+)/);
+        if (interaction) {
+            const row = decision.dataFlows[Number(interaction[1])];
+            return row
+                ? `record_data_flow "${row.interaction}": ${issue}`
+                : `record_data_flow row ${interaction[1]}: ${issue}`;
+        }
+        const requirement = issue.match(/requirements\.(\d+)\.(.+)/);
+        if (requirement) {
+            return `record_module_placement row ${requirement[1]}: ${issue}`;
+        }
+        return issue;
+    })
+        .join("; ");
+}
+/** Read the recovery child's read-only parent decision snapshot (written by
+ * the recovery continuation). Absent file → undefined (fresh plan). */
+export async function readParentDecisionSnapshot(runDir, nodeId) {
+    const snapshotPath = path.join(runDir, nodeId, "parent-decision-snapshot.json");
+    let raw;
+    try {
+        raw = await readFile(snapshotPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed.facts))
+        throw new Error(`parent decision snapshot malformed: ${snapshotPath}`);
+    return parsed;
+}
+const decisionKindToToolName = (kind) => `record_${kind.replaceAll("-", "_")}`;
+/** D (local design repair): replay the parent's committed decision facts
+ * through the child's durable tools — the normal commit entry with the
+ * child's own binding; the finalize terminal is never inherited. Idempotent:
+ * stable per-fact callIds make retries replay receipts instead of duplicating. */
+export async function replayParentDecisionSnapshot(snapshot, tools) {
+    const byName = new Map(tools.map((tool) => [tool.name, tool]));
+    for (const [index, fact] of snapshot.facts.entries()) {
+        const toolName = decisionKindToToolName(fact.kind);
+        const tool = byName.get(toolName);
+        if (!tool) {
+            throw new Error(`parent decision replay: no tool for fact kind "${fact.kind}"`);
+        }
+        const receipt = await tool.execute(`parent-replay:${index}`, {
+            entry: fact.entry,
+        });
+        if (receipt.details?.ok !== true) {
+            throw new Error(`parent decision replay failed for ${toolName} (identity ${JSON.stringify(fact.entry.purpose ??
+                fact.entry.state ??
+                fact.entry.interaction ??
+                fact.entry.id ??
+                fact.entry.boundary ??
+                "?")}): ${receipt.details?.error ?? "unknown error"}`);
+        }
+    }
+}
+export async function createFrontendPlanDecisionTools(input) {
+    const [{ Type }, { defineTool }, { assembleDecisionContractFromFacts, assembleExperimentPlanContract, buildFrontendPlanRelationshipPatch }] = await Promise.all([
+        import("typebox"),
+        import("@earendil-works/pi-coding-agent"),
+        import("../workflows/dag/frontend-plan-decision-contract.js"),
+    ]);
+    const { readCommittedEvents } = await import("../workflows/dag/frontend-typed-event-store.js");
+    const { adoptTypedEventFact, stageTypedEventFact } = await import("../workflows/dag/frontend-typed-event-transaction.js");
+    const { createDurableFrontendTools } = await import("../workflows/dag/frontend-durable-tools.js");
+    let store = input.store;
+    const { attemptId, authority } = input;
+    const optionalStringArray = Type.Optional(Type.Array(Type.String({ minLength: 1 })));
+    const optionalString = Type.Optional(Type.String({ minLength: 1 }));
+    // In-session pre-validation of the derived relationship patch. The
+    // post-session bridge runs the identical analysis; running it first inside
+    // finalize_decision turns findings into a bounded in-session correction
+    // (fix facts, finalize again) instead of an attempt burn. Skipped when the
+    // caller does not supply the runtime skeleton/sourceBinding.
+    let requiredDeliverablesCache;
+    const prevalidateDerivedPatch = async () => {
+        if (!input.skeleton || !input.sourceBinding)
+            return { ok: true, canonicalSha256: "", canonical: {} };
+        const committed = readCommittedEvents(store, attemptId);
+        const decision = assembleDecisionContractFromFacts(committed.map(record => record.fact));
+        requiredDeliverablesCache ??= (async () => {
+            const map = new Map();
+            try {
+                const { readTypedEventStoreFromJsonl } = await import("../workflows/dag/frontend-typed-event-store.js");
+                const contractRecords = await readTypedEventStoreFromJsonl(path.join(input.runDir, "frontend-contract-pi", "contract-typed-facts.jsonl"));
+                for (const record of [...contractRecords].reverse()) {
+                    const fact = record.fact;
+                    if (!fact || fact.origin !== "contract" || fact.kind !== "required-deliverables")
+                        continue;
+                    for (const item of Array.isArray(fact.items) ? fact.items : []) {
+                        if (!item || typeof item !== "object" || Array.isArray(item))
+                            continue;
+                        const requirementId = item.requirementId;
+                        const file = item.path;
+                        if (typeof requirementId !== "string" || typeof file !== "string")
+                            continue;
+                        const paths = map.get(requirementId) ?? [];
+                        paths.push(file);
+                        map.set(requirementId, paths);
+                    }
+                    break;
+                }
+            }
+            catch {
+                // Missing/unreadable contract ledger → no deliverable obligations.
+            }
+            return map;
+        })();
+        const concreteWriteSet = [
+            ...new Set([
+                ...decision.modulePlacements.flatMap(item => item.paths),
+                ...decision.verificationFocus.map(item => item.file),
+            ]),
+        ];
+        const { applyFrontendContractMergePatch, analyzeFrontendPlanPatchCandidate, FrontendContractFailure, PlanPolicyPrecheckFailure, serializeDeterministicJson, } = await import("../workflows/dag/frontend-implementation-contract.js");
+        try {
+            const patch = buildFrontendPlanRelationshipPatch({
+                decision,
+                authority,
+                concreteWriteSet,
+                requiredDeliverables: await requiredDeliverablesCache,
+            });
+            const merged = applyFrontendContractMergePatch(input.skeleton, patch);
+            const analysis = await analyzeFrontendPlanPatchCandidate({
+                runDir: input.runDir,
+                rawContractText: serializeDeterministicJson(merged),
+                sourceBinding: input.sourceBinding,
+            });
+            return {
+                ok: true,
+                canonicalSha256: createHash("sha256")
+                    .update(serializeDeterministicJson(analysis.canonical))
+                    .digest("hex"),
+                canonical: analysis.canonical,
+            };
+        }
+        catch (error) {
+            if (error instanceof PlanPolicyPrecheckFailure) {
+                // Template the fix: every uncovered interaction/state maps to a
+                // fill-in record_reuse_decision row (the decision channel's
+                // component-choice tool).
+                const suggestions = error.findings
+                    .filter(finding => finding.code === "ui-design-coverage-missing" && finding.path)
+                    .map(finding => ({
+                    tool: "record_reuse_decision",
+                    args: {
+                        entry: {
+                            symbol: "<name the existing or new component>",
+                            decision: "reuse-existing",
+                            evidence: ["<existing repo file that proves this reuse>"],
+                            purpose: finding.path,
+                        },
+                    },
+                }));
+                const suggestionBlock = suggestions.length > 0
+                    ? ` Suggested record_* calls (copy, fill component, submit): ${JSON.stringify(suggestions)}`
+                    : "";
+                return {
+                    ok: false,
+                    error: `finalize_decision pre-validation failed (fix the listed plan facts, then call finalize_decision again): ${error.message}${suggestionBlock}`,
+                };
+            }
+            // FrontendContractFailure messages carry zod issue paths and are
+            // translated into record_* vocabulary; the bridge compiler throws
+            // decision-state-unbindable / decision-styling-strategy-conflict
+            // diagnostics that are already model-fixable as written.
+            const message = error instanceof Error ? error.message : String(error);
+            const translated = error instanceof FrontendContractFailure
+                ? translateDecisionPatchFindings(message, decision)
+                : message;
+            return {
+                ok: false,
+                error: `finalize_decision pre-validation failed (fix the listed facts with the named record_* tools — resubmit a corrected row with the same identity and replace:true to replace it — then call finalize_decision again): ${translated}`,
+            };
+        }
+    };
+    const planToolReceipt = (details) => ({
+        content: [{ type: "text", text: JSON.stringify(details) }],
+        details,
+    });
+    async function adoptDecisionFact(kind, requestId, fact) {
+        try {
+            const staged = stageTypedEventFact({
+                store,
+                requestId,
+                attemptId,
+                fact: fact,
+            });
+            const committed = await adoptTypedEventFact({
+                store,
+                requestId,
+                attemptId,
+                fact: fact,
+                eventId: staged.eventId,
+                expectedRevision: store.revision,
+            });
+            return { ok: true, kind, eventId: committed.eventId, revision: committed.revision, error: "" };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                kind,
+                code: error?.code,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    const record = (name, label, description, entrySchema, gate) => defineTool({
+        name,
+        label,
+        description,
+        promptSnippet: `Record ${label}.`,
+        parameters: Type.Object({ entry: entrySchema }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const entry = params?.entry;
+            const kind = name.replace("record_", "").replace(/_/g, "-");
+            if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+                return planToolReceipt({ ok: false, kind, error: `${name} requires a non-empty entry object` });
+            }
+            if (gate) {
+                const rejected = await gate(entry);
+                if (rejected)
+                    return rejected;
+            }
+            const result = await adoptDecisionFact(kind, `${attemptId}:${name}:${randomUUID()}`, { kind, origin: "plan", entry });
+            return planToolReceipt(result);
+        },
+    });
+    const recordModulePlacementTool = record("record_module_placement", "module placement", "Record one module placement: which behavior-group/module id maps to which concrete files. Example: {\"entry\": {\"id\": \"page\", \"paths\": [\"src/page.tsx\"]}}", Type.Object({ id: Type.String({ minLength: 1 }), paths: Type.Array(Type.String({ minLength: 1 }), { minItems: 1 }) }, { additionalProperties: false }));
+    const recordReuseDecisionTool = record("record_reuse_decision", "reuse decision", "Record one component decision: which component serves which UI state/interaction (purpose). decision \"reuse-existing\" = an existing repo component (evidence[0] = the repo file that proves it); \"specified\" = the frontend spec mandates it; \"new\" = the task source mandates a bounded addition — specified/new require specSection naming the spec/task-source declaration they implement (e.g. an AC id). Set stylingStrategy once (on the first call) when the task mandates a style contract. Resubmit the same purpose with replace:true to correct a row. Example: {\"entry\": {\"symbol\": \"Spinner\", \"decision\": \"reuse-existing\", \"evidence\": [\"src/ui/Spinner.tsx\"], \"purpose\": \"loading\"}} or {\"entry\": {\"symbol\": \"SmokeCounter\", \"decision\": \"new\", \"evidence\": [\"需求.md\"], \"purpose\": \"increment\", \"specSection\": \"AC-FE-002\", \"stylingStrategy\": \"compact, stable, animation-free single card\"}}", Type.Object({
+        symbol: Type.String({ minLength: 1 }),
+        decision: Type.Union([Type.Literal("specified"), Type.Literal("reuse-existing"), Type.Literal("new")]),
+        evidence: Type.Array(Type.String()),
+        specSection: Type.Optional(Type.String({ minLength: 1 })),
+        purpose: Type.String({ minLength: 1 }),
+        covers: optionalStringArray,
+        rationale: optionalString,
+        stylingStrategy: optionalString,
+    }, { additionalProperties: false }), async (entry) => {
+        // specified/new compile into a canonical specReference whose .section
+        // the contract schema mandates; without the section the row can only
+        // fail at finalize, so demand it here where the model can still act.
+        if (entry.decision === "specified") {
+            const evidenceList = Array.isArray(entry.evidence) ? entry.evidence : [];
+            const evidencePath = typeof evidenceList[0] === "string" ? evidenceList[0] : "";
+            const candidates = input.componentSpecCandidatePaths ?? [];
+            if (candidates.length === 0) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "reuse-decision",
+                    error: `record_reuse_decision specified-requires-spec-candidates: decision "specified" means a declared component spec mandates this choice, but this task declares no component spec candidates — use decision "new" (task-source-mandated addition, evidence[0] = the task-source file) or "reuse-existing"`,
+                });
+            }
+            if (evidencePath && !candidates.includes(evidencePath)) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "reuse-decision",
+                    error: `record_reuse_decision specified-spec-reference-outside-candidates: evidence[0] "${evidencePath}" is not a declared component spec candidate; declared candidates: [${candidates.join(", ")}]`,
+                });
+            }
+        }
+        if ((entry.decision === "specified" || entry.decision === "new") &&
+            !(typeof entry.specSection === "string" && entry.specSection.trim())) {
+            return planToolReceipt({
+                ok: false,
+                kind: "reuse-decision",
+                error: `record_reuse_decision spec-section-required: decision "${entry.decision}" must name the spec/task-source declaration it implements via specSection (e.g. an AC id); use decision "reuse-existing" for existing repo conventions. Example: {"entry": {"symbol": "SmokeCounter", "decision": "new", "evidence": ["src/components/SmokeCounter.tsx"], "purpose": "render the counter card", "specSection": "AC-FE-001"}}`,
+            });
+        }
+        return undefined;
+    });
+    const recordStateOwnershipTool = record("record_state_ownership", "state ownership", "Record one UI state and its owner, applicability and expected behavior. owner must equal the behaviorGroupId of the record_verification_focus entries it supports; every behavior group referenced by a verification focus needs at least one state row or finalize fails. Resubmit the same state name with replace:true to correct a row. Example: {\"entry\": {\"state\": \"loading\", \"owner\": \"page\", \"applicable\": true, \"expectedBehavior\": \"render loading\"}}", Type.Object({
+        state: Type.String({ minLength: 1 }),
+        owner: Type.String({ minLength: 1 }),
+        applicable: Type.Boolean(),
+        expectedBehavior: optionalString,
+        notApplicableReason: optionalString,
+    }, { additionalProperties: false }));
+    const frozenInteractionIds = authority.interactionIds ?? [];
+    const recordDataFlowTool = record("record_data_flow", "data flow", "Record one interaction data flow: source behavior group, trigger and expected behavior. One row per interaction name; resubmit the same interaction name to replace it. When a frozen interaction id vocabulary is declared, the interaction name MUST be one of the declared ids — wrong-named records are rejected at submission and stale ones are retracted via retract_data_flow. Example: {\"entry\": {\"interaction\": \"load\", \"source\": \"page\", \"trigger\": \"submit query\", \"expectedBehavior\": \"show loading then results\"}}", Type.Object({
+        interaction: Type.String({ minLength: 1 }),
+        source: Type.String({ minLength: 1 }),
+        trigger: Type.String({ minLength: 1 }),
+        expectedBehavior: Type.String({ minLength: 1 }),
+    }, { additionalProperties: false }), frozenInteractionIds.length > 0
+        ? async (entry) => {
+            const name = typeof entry.interaction === "string" ? entry.interaction : "";
+            if (name && !frozenInteractionIds.includes(name)) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "data-flow",
+                    code: "INTERACTION_ID_NOT_DECLARED",
+                    error: `interaction "${name}" is not in the frozen vocabulary; allowed: [${frozenInteractionIds.join(", ")}]. Submit the declared id. To remove an already-recorded wrong interaction, call retract_data_flow with {"interaction": "${name}"}.`,
+                });
+            }
+            return undefined;
+        }
+        : undefined);
+    const retractDataFlowTool = defineTool({
+        name: "retract_data_flow",
+        label: "retract data flow",
+        description: "Retract a previously recorded interaction data flow (e.g. one recorded under a wrong interaction id). The retracted record and every fact keyed to that interaction name stop participating in the compiled plan. Declared vocabulary ids cannot be retracted. Example: {\"interaction\": \"increment-counter\", \"reason\": \"recorded under a wrong id\"}",
+        promptSnippet: "Retract one interaction data flow by interaction name.",
+        parameters: Type.Object({
+            interaction: Type.String({ minLength: 1 }),
+            reason: Type.Optional(Type.String({ minLength: 1 })),
+        }, { additionalProperties: false }),
+        async execute(_toolCallId, params) {
+            const interaction = typeof params?.interaction === "string" ? params.interaction : "";
+            if (!interaction) {
+                return planToolReceipt({ ok: false, kind: "data-flow", error: "retract_data_flow requires a non-empty interaction" });
+            }
+            if (frozenInteractionIds.includes(interaction)) {
+                return planToolReceipt({ ok: false, kind: "data-flow", error: `interaction "${interaction}" is a declared vocabulary id and cannot be retracted` });
+            }
+            const result = await adoptDecisionFact("data-flow", `${attemptId}:retract_data_flow:${randomUUID()}`, { kind: "data-flow", origin: "plan", entry: { interaction, retracted: true, ...(typeof params?.reason === "string" ? { reason: params.reason } : {}) } });
+            return planToolReceipt(result);
+        },
+    });
+    const recordApiMockBoundaryTool = record("record_api_mock_boundary", "API/Mock boundary", "Record one API boundary and its mode (real/mock/not-needed) with evidence. The boundary is the stable identity: resubmit the same boundary with replace:true to change its mode (e.g. mock→real); the old decision is replaced, not appended. Real/mock endpoints require fixture (the test fixture path) and consumer (the implementation file that calls the API) — design policy rejects endpoints without them. Example: {\"entry\": {\"boundary\": \"GET /items\", \"mode\": \"mock\", \"evidence\": \"fixture only\", \"fixture\": \"test/fixtures/items.ts\", \"consumer\": \"src/page.tsx\"}}", Type.Object({
+        boundary: Type.String({ minLength: 1 }),
+        mode: Type.Union([Type.Literal("real"), Type.Literal("mock"), Type.Literal("not-needed")]),
+        evidence: Type.String({ minLength: 1 }),
+        fixture: optionalString,
+        consumer: optionalString,
+    }, { additionalProperties: false }), async (entry) => {
+        // Design policy hard-requires fixture + consumer on every derived
+        // endpoint (non-not-needed strategies); demand them here where the
+        // model can still act instead of failing the compile post-session.
+        if ((entry.mode === "real" || entry.mode === "mock") &&
+            (!(typeof entry.fixture === "string" && entry.fixture.trim()) ||
+                !(typeof entry.consumer === "string" && entry.consumer.trim()))) {
+            return planToolReceipt({
+                ok: false,
+                kind: "api-mock-boundary",
+                error: `record_api_mock_boundary fixture-and-consumer-required: ${entry.mode} boundary "${entry.boundary}" needs fixture (the test fixture path) and consumer (the implementation file that calls the API). Example: {"entry": {"boundary": "${entry.boundary}", "mode": "${entry.mode}", "evidence": "<why>", "fixture": "test/fixtures/items.ts", "consumer": "src/page.tsx"}}`,
+            });
+        }
+        return undefined;
+    });
+    const recordVerificationFocusTool = record("record_verification_focus", "verification focus", "Record one behavior-group verification focus: which test file/command proves which behavior group at what evidence level. Every behaviorGroupId must have at least one record_state_ownership row whose owner equals it — declare one UI state per behavior group before finalizing. Example: {\"entry\": {\"id\": \"VT-1\", \"behaviorGroupId\": \"page\", \"file\": \"test/page.test.tsx\", \"commandId\": \"test\", \"evidenceLevel\": \"mounted\"}}", Type.Object({
+        id: Type.String({ minLength: 1 }),
+        behaviorGroupId: Type.String({ minLength: 1 }),
+        file: Type.String({ minLength: 1 }),
+        commandId: Type.String({ minLength: 1 }),
+        evidenceLevel: Type.Union([Type.Literal("unit"), Type.Literal("mounted"), Type.Literal("real-integration")]),
+        boundary: optionalString,
+    }, { additionalProperties: false }), async (entry) => {
+        // Mirror the relationship record_plan_verification_target boundary so
+        // protocol errors surface in-node (bounded correction) instead of
+        // burning attempts on an immutable committed fact that finalize rejects.
+        // Duplicate/identity enforcement lives in the durable wrapper (FACT_IDENTITY_CONFLICT
+        // unless replace:true) and the compile collapses same-id records to the
+        // latest replacement, so no duplicate gate is needed here.
+        const verificationCommandId = typeof entry.commandId === "string" ? entry.commandId.trim() : "";
+        if (!verificationCommandId) {
+            return planToolReceipt({
+                ok: false,
+                kind: "verification-focus",
+                error: `record_verification_focus entry.commandId is required (received ${JSON.stringify(entry.commandId ?? null)}); pick one id from the frozen command directory in your prompt`,
+            });
+        }
+        const { deriveFrontendVerifyCommandDirectoryFromRun, isFrontendTestFilePath } = await import("../workflows/dag/frontend-implementation-contract.js");
+        const verifyDirectory = await deriveFrontendVerifyCommandDirectoryFromRun(input.runDir);
+        if (verifyDirectory.length > 0) {
+            const directoryEntry = verifyDirectory.find((candidate) => candidate.commandId === verificationCommandId);
+            if (!directoryEntry) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "verification-focus",
+                    error: `record_verification_focus verification-target-unknown-command: unknown commandId "${verificationCommandId}"; available frozen commands: [${verifyDirectory.map((candidate) => `${candidate.commandId} (${candidate.mode}: ${candidate.label})`).join(", ")}]`,
+                });
+            }
+            if (directoryEntry.mode === "behavior" &&
+                typeof entry.file === "string" &&
+                !isFrontendTestFilePath(entry.file)) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "verification-focus",
+                    error: `record_verification_focus verification-target-phase-mismatch: behavior command "${directoryEntry.label}" (${directoryEntry.commandId}) must bind a test file (__tests__/, tests?/, e2e/, cypress/, *.test.*, *.spec.*, *.cy.*); received file "${entry.file}"`,
+                });
+            }
+        }
+        // A behavior verification target derives its contract uiStates solely
+        // from the committed state-ownership rows whose owner equals its
+        // behaviorGroupId, and the relationship patch rejects a behavior
+        // target with empty uiStates whenever the plan declares any state or
+        // interaction. That rejection currently surfaces only in the
+        // post-session bridge and burns the whole attempt, so enforce the
+        // pairing here as a bounded in-session correction. A ledger with no
+        // ownership and no data-flow facts stays exempt (pure-logic plan),
+        // mirroring the contract-level exemption.
+        const committedLedger = readCommittedEvents(store, attemptId);
+        const ownershipRows = committedLedger.filter((event) => event.fact.kind === "state-ownership");
+        const hasInteractionFacts = committedLedger.some((event) => event.fact.kind === "data-flow");
+        if ((ownershipRows.length > 0 || hasInteractionFacts) &&
+            !ownershipRows.some((event) => event.fact.entry?.owner ===
+                entry.behaviorGroupId)) {
+            return planToolReceipt({
+                ok: false,
+                kind: "verification-focus",
+                error: `record_verification_focus undeclared-behavior-group-state: behavior group "${entry.behaviorGroupId}" (verification target ${entry.id}) has no record_state_ownership row; finalize derives each behavior target's UI states from ownership rows whose owner equals the behaviorGroupId, so record at least one for this group: {"state": "<name>", "owner": "${entry.behaviorGroupId}", "applicable": true, "expectedBehavior": "<what the state does>"}`,
+            });
+        }
+        return undefined;
+    });
+    const recordDependencyTool = record("record_dependency", "dependency", "Record one dependency name. Example: {\"entry\": {\"name\": \"none\"}}", Type.Object({ name: Type.String({ minLength: 1 }) }, { additionalProperties: false }));
+    const finalizeDecisionTool = defineTool({
+        name: "finalize_decision",
+        label: "finalize_decision",
+        description: "Compile the committed decision facts into a decision contract, pre-validate the derived canonical contract, and commit the terminal. Fails closed on any safety finding or validation finding; correct the reported record_* facts and call finalize_decision again.",
+        promptSnippet: "Compile and finalize the committed decision facts.",
+        parameters: Type.Object({}, { additionalProperties: false }),
+        async execute(_toolCallId) {
+            const committed = readCommittedEvents(store, attemptId);
+            const decision = assembleDecisionContractFromFacts(committed.map(record => record.fact));
+            const expectedWriteSet = [
+                ...decision.modulePlacements.flatMap(item => item.paths),
+                ...decision.verificationFocus.map(item => item.file),
+            ];
+            const derived = assembleExperimentPlanContract({
+                decision,
+                authority,
+                concreteWriteSet: expectedWriteSet,
+            });
+            if (derived.findings.length > 0) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "finalize_decision",
+                    code: "DECISION_SAFETY_FINDINGS",
+                    error: `decision safety projection failed: ${derived.findings.join("; ")}`,
+                });
+            }
+            const prevalidation = await prevalidateDerivedPatch();
+            if (!prevalidation.ok) {
+                return planToolReceipt({
+                    ok: false,
+                    kind: "finalize_decision",
+                    code: "DECISION_PREVALIDATION_FAILED",
+                    error: prevalidation.error,
+                });
+            }
+            // Recovery-mode guard: a repair child that finalizes a plan identical
+            // to its parent's has not performed the repair the findings demand —
+            // the identical plan is exactly what admission rejected. Both hashes
+            // use the same deterministic serializer over the canonical contract,
+            // so only a real semantic change passes.
+            // Recovery-mode guard: a repair child must demonstrably close the
+            // parent findings before the run re-enters design review.
+            if (input.parentDecisionSnapshot) {
+                const { readParentCanonical, parentCanonicalContentSha256 } = await import("../workflows/dag/frontend-implementation-contract.js");
+                const { extractRepairAssertions, evaluateRepairClosure, decisionIdentitySha256 } = await import("../workflows/dag/frontend-plan-decision-contract.js");
+                const parentRunDir = path.join(input.runDir, "..", input.parentDecisionSnapshot.parentRunId);
+                const parentCanonical = await readParentCanonical(parentRunDir);
+                // 1. identical-plan guard. Decisions, not prose: a rationale-only
+                // rewrite is not a repair (smoke r27 cleared a raw byte-hash guard
+                // by editing two rationale strings and changing nothing else). The
+                // byte hash stays as the fallback when the parent canonical cannot
+                // be read.
+                const parentSha = await parentCanonicalContentSha256(parentRunDir);
+                const parentDecisions = parentCanonical
+                    ? decisionIdentitySha256(parentCanonical)
+                    : undefined;
+                const childDecisions = decisionIdentitySha256(prevalidation.canonical);
+                if (parentDecisions
+                    ? parentDecisions === childDecisions
+                    : parentSha !== undefined && parentSha === prevalidation.canonicalSha256) {
+                    return planToolReceipt({
+                        ok: false,
+                        kind: "finalize_decision",
+                        code: "DECISION_REPAIR_NO_CHANGE",
+                        error: "recovery finalize blocked: every structured decision row is identical to the parent run's (rationale-only edits do not count as a repair), but the review findings require changes. Correct the flagged rows (same identity, replace:true), then call finalize_decision again.",
+                    });
+                }
+                // 2. per-finding closure: every deterministic assertion extracted
+                // from the parent findings must hold on the child canonical.
+                const findings = input.parentDecisionSnapshot.designFindings ?? [];
+                if (parentCanonical && findings.length > 0) {
+                    const assertions = extractRepairAssertions(findings, parentCanonical);
+                    const closure = evaluateRepairClosure(assertions, prevalidation.canonical, parentCanonical);
+                    if (!closure.closed) {
+                        return planToolReceipt({
+                            ok: false,
+                            kind: "finalize_decision",
+                            code: "DECISION_REPAIR_NOT_CLOSED",
+                            error: `recovery finalize blocked: ${closure.unmet.length} finding(s) are still not closed — ${closure.unmet.join("; ")}. Correct the flagged rows (same identity, replace:true), then call finalize_decision again.`,
+                        });
+                    }
+                }
+            }
+            const result = await adoptDecisionFact("finalize_decision", `${attemptId}:finalize_decision:${randomUUID()}`, { kind: "finalize_decision", origin: "plan", findings: [] });
+            return planToolReceipt(result);
+        },
+    });
+    const durable = await createDurableFrontendTools({
+        file: path.join(input.runDir, input.nodeId, "plan-decision-facts.jsonl"),
+        attemptId,
+        store: input.store,
+        setWorkingStore: next => { store = next; },
+        binding: { authority },
+        tools: [
+            recordModulePlacementTool,
+            recordReuseDecisionTool,
+            recordStateOwnershipTool,
+            recordDataFlowTool,
+            retractDataFlowTool,
+            recordApiMockBoundaryTool,
+            recordVerificationFocusTool,
+            recordDependencyTool,
+            finalizeDecisionTool,
+        ],
+    });
+    const durableFinalizeDecisionTool = durable.customTools.find((tool) => typeof tool === "object" && tool !== null && tool.name === "finalize_decision");
+    if (!durableFinalizeDecisionTool)
+        throw new Error("frontend plan decision durable finalize tool unavailable");
+    return {
+        customTools: durable.customTools,
+        flush: durable.flush,
+        committedFacts: () => readCommittedEvents(store, attemptId),
+        finalizeDecision: () => durableFinalizeDecisionTool.execute(`${attemptId}:auto-finalize-decision`, {}, undefined, undefined, {}),
+    };
+}
+/**
+ * Decision → relationship bridge: after a successful decision `finalize`
+ * (kind finalize_decision committed in plan-decision-facts.jsonl) the plan
+ * node ALSO publishes the relationship-shaped plan ledger
+ * (`<runDir>/<nodeId>/plan-typed-facts.jsonl`) carrying a committed
+ * `target-surface` patch fact + a `finalize_plan` terminal fact derived from
+ * the committed decision facts. The unchanged R1 self-check
+ * (`validateFrontendPlanPatchNodeOutput`) and every downstream shell
+ * (`buildContractFromCommittedFacts`) read ONLY that ledger, so without this
+ * bridge every decision run fails deterministically with "frontend plan
+ * ledger missing" → invalid-output on all attempts.
+ *
+ * The patch is compiled by `buildFrontendPlanRelationshipPatch` and front-loads
+ * the exact validation the relationship finalize receipt runs (merge onto the
+ * runtime skeleton + analyzeFrontendPlanPatchCandidate). When the derived
+ * canonical fails, this returns a fixable error and the executor turns it into
+ * an invalid-output so the node retry ladder restarts the session with the
+ * diagnostics instead of writing a ledger that R1 would reject.
+ */
+export async function bridgeFrontendPlanDecisionToRelationshipLedger(input) {
+    const { assembleDecisionContractFromFacts, buildFrontendPlanRelationshipPatch, } = await import("../workflows/dag/frontend-plan-decision-contract.js");
+    const committed = input.facts
+        .filter(record => record.phase === "committed")
+        .map(record => record.fact);
+    const decision = assembleDecisionContractFromFacts(committed);
+    const concreteWriteSet = [
+        ...new Set([
+            ...decision.modulePlacements.flatMap(item => item.paths),
+            ...decision.verificationFocus.map(item => item.file),
+        ]),
+    ];
+    // Contract-declared deliverable obligations (the same ledger the analyzer
+    // extracts `requiredDeliverables` from): bind each path to its requirement
+    // so the derived canonical contract plans every contract-mandated file.
+    const requiredDeliverables = new Map();
+    try {
+        const contractRecords = await readTypedEventStoreFromJsonl(path.join(input.runDir, "frontend-contract-pi", "contract-typed-facts.jsonl"));
+        for (const record of [...contractRecords].reverse()) {
+            const fact = record.fact;
+            if (!fact || fact.origin !== "contract" || fact.kind !== "required-deliverables")
+                continue;
+            for (const item of Array.isArray(fact.items) ? fact.items : []) {
+                if (!item || typeof item !== "object" || Array.isArray(item))
+                    continue;
+                const requirementId = item.requirementId;
+                const file = item.path;
+                if (typeof requirementId !== "string" || typeof file !== "string")
+                    continue;
+                const paths = requiredDeliverables.get(requirementId) ?? [];
+                paths.push(file);
+                requiredDeliverables.set(requirementId, paths);
+            }
+            break;
+        }
+    }
+    catch {
+        // Missing/unreadable contract ledger → no deliverable obligations to merge.
+    }
+    if (!input.skeleton || !input.sourceBinding) {
+        return { ok: false, error: "frontend decision bridge requires the runtime skeleton and sourceBinding" };
+    }
+    let patch;
+    try {
+        const { analyzeFrontendPlanPatchCandidate, applyFrontendContractMergePatch, serializeDeterministicJson, } = await import("../workflows/dag/frontend-implementation-contract.js");
+        patch = buildFrontendPlanRelationshipPatch({
+            decision,
+            authority: input.authority,
+            concreteWriteSet,
+            requiredDeliverables,
+        });
+        const merged = applyFrontendContractMergePatch(input.skeleton, patch);
+        await analyzeFrontendPlanPatchCandidate({
+            runDir: input.runDir,
+            rawContractText: serializeDeterministicJson(merged),
+            sourceBinding: input.sourceBinding,
+        });
+    }
+    catch (error) {
+        const raw = error instanceof Error ? error.message : String(error);
+        return {
+            ok: false,
+            // This path should be rare now that finalize_decision pre-validates
+            // the same patch in-session; keep the retry-prompt diagnostics in
+            // decision-channel vocabulary regardless.
+            error: `frontend decision → relationship patch failed pre-validation (correct the reported decision facts, then the retry ladder restarts the session): ${translateDecisionPatchFindings(raw, decision)}`,
+        };
+    }
+    const { createTypedEventStore, stageTypedEventRecord, commitTypedEventRecord, writeTypedEventStoreJsonl } = await import("../workflows/dag/frontend-typed-event-store.js");
+    const file = path.join(input.runDir, input.nodeId, "plan-typed-facts.jsonl");
+    const store = createTypedEventStore();
+    const adopt = (kind, patchValue, revision) => {
+        const eventId = `decision-bridge:${input.attemptId}:${kind}`;
+        const fact = { kind, origin: "plan", patch: patchValue };
+        stageTypedEventRecord(store, {
+            eventId,
+            requestId: eventId,
+            attemptId: input.attemptId,
+            fact,
+        });
+        return commitTypedEventRecord(store, eventId, revision);
+    };
+    adopt("target-surface", patch, 1);
+    adopt("finalize_plan", patch, 2);
+    // The ledger is derived wholesale from the committed decision facts, so a
+    // re-run rewrites it atomically (no incremental append semantics needed).
+    await writeTypedEventStoreJsonl(file, store.records.filter(record => record.phase === "committed"));
+    return { ok: true, patch };
+}
 function isRecordObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2846,6 +3701,52 @@ export async function createFrontendContractTools(input) {
             return receipt(result);
         },
     });
+    // Requirement identity/text/source are runtime-owned and seeded before the
+    // model starts. Execution grouping is still a model decision, so expose it
+    // as a small typed update instead of forcing the model to re-submit the same
+    // requirement just to attach execution metadata.
+    const recordRequirementExecutionTool = defineTool({
+        name: "record_requirement_execution",
+        label: "record_requirement_execution",
+        description: "Attach execution ownership to already-confirmed canonical requirements.",
+        promptSnippet: "Record execution group metadata for confirmed requirements.",
+        parameters: Type.Object({
+            requirementIds: Type.Array(Type.String({ minLength: 1 }), { minItems: 1, uniqueItems: true }),
+            execution: Type.Object({
+                groupId: Type.String({ minLength: 1 }),
+                kind: Type.Union([Type.Literal("behavior"), Type.Literal("constraint"), Type.Literal("exclusion")]),
+                summary: Type.String({ minLength: 1 }),
+            }, { additionalProperties: false }),
+        }, { additionalProperties: false }),
+        async execute(callId, params) {
+            const ids = params.requirementIds;
+            if (activeScope && ids.some((id) => !activeScope?.has(id)))
+                return receipt({ ok: false, code: "FRONTEND_INPUT_SCOPE_VIOLATION", error: "execution metadata references a requirement outside the active contract scope" });
+            const canonical = input.canonicalRequirements;
+            const unknown = ids.filter((id) => !canonical?.has(id));
+            if (unknown.length > 0)
+                return receipt({ ok: false, code: "CONTRACT_REFERENCE_UNKNOWN", error: `record_requirement_execution references unknown canonical requirements: ${unknown.join(", ")}` });
+            const execution = frontendExecutionSchema.parse(params.execution);
+            const existing = readCommittedEvents(store, attemptId)
+                .filter((record) => record.fact.kind === "requirement")
+                .map((record) => ({ id: String(record.fact.id), execution: record.fact.execution }))
+                .filter((unit) => !ids.includes(unit.id));
+            try {
+                collectFrontendExecutionGroups([...existing, ...ids.map((id) => ({ id, execution }))]);
+            }
+            catch (error) {
+                return receipt({ ok: false, code: "EXECUTION_GROUP_CONFLICT", error: error instanceof Error ? error.message : String(error) });
+            }
+            let result = { ok: true };
+            for (const id of ids) {
+                const requirement = canonical.get(id);
+                result = await adoptContractFact("requirement", { kind: "requirement", origin: "contract", disposition: "explicit", id, text: requirement.text, sourceFragmentIds: requirement.sourceFragmentIds, execution });
+                if (result.ok !== true)
+                    return receipt(result);
+            }
+            return receipt({ ...result, requestId: callId });
+        },
+    });
     // Authoritative UI state declarations: the contract node extracts the
     // PRD/reference UI-state table into structured facts so the planner binds
     // uiStates to declared ids instead of inventing names (dogfood
@@ -3059,6 +3960,7 @@ export async function createFrontendContractTools(input) {
         tools: [
             ...recordTools,
             recordRequirementTool,
+            recordRequirementExecutionTool,
             recordEvidenceExpectationTool,
             recordUiStateTool,
             recordRequiredDeliverablesTool,
@@ -3067,9 +3969,23 @@ export async function createFrontendContractTools(input) {
             finalizeContractTool,
         ],
     });
+    const durableRecordRequirementTool = durable.customTools.find((tool) => typeof tool === "object" && tool !== null && tool.name === "record_requirement");
+    if (!durableRecordRequirementTool)
+        throw new Error("frontend contract durable requirement tool unavailable");
     return {
         customTools: durable.customTools,
         inputRequirements: () => [...(input.canonicalRequirements ?? [])].map(([id, value]) => ({ id, text: value.text, sourceFragmentIds: [...value.sourceFragmentIds] })),
+        seedCanonicalRequirements: async () => {
+            for (const id of input.canonicalRequirements?.keys() ?? []) {
+                if (committedRequirementIds().has(id))
+                    continue;
+                const receipt = await durableRecordRequirementTool.execute(`${attemptId}:seed-requirement:${id}`, { id }, undefined, undefined, {});
+                if (receipt.details?.ok !== true) {
+                    throw new Error(`runtime requirement seed rejected for ${id}`);
+                }
+            }
+            await durable.flush();
+        },
         completedScopeRequirementIds,
         setActiveRequirementScope: ids => { activeScope = ids === null ? null : new Set(ids); },
         committedRequirementIds,
@@ -3251,6 +4167,7 @@ export async function createFrontendScoutEvidenceTools(input) {
             entrypoint: optionalString,
             routeOrMount: optionalString,
             implementationPaths: stringArray,
+            proposedPaths: Type.Optional(stringArray),
             testPaths: stringArray,
             dataSource: optionalString,
             allowedPathConflicts: stringArray,
@@ -3260,12 +4177,18 @@ export async function createFrontendScoutEvidenceTools(input) {
             if (input.requirementIds && (!activeScope?.length || params.scopeId !== scopeIdentity(activeScope)))
                 return receipt({ ok: false, code: "FRONTEND_INPUT_SCOPE_VIOLATION", error: "Use exactly the runtime Scout scopeId; discovery may complete only the supplied obligations" });
             const implementationPaths = params?.implementationPaths ?? [];
+            const proposedPaths = params?.proposedPaths ?? [];
             const testPaths = params?.testPaths ?? [];
             const pathEvidence = await enrichScoutPathEvidence([
                 ...(params?.entrypoint ? [params.entrypoint] : []),
                 ...implementationPaths,
                 ...testPaths,
             ]);
+            for (const proposedPath of proposedPaths) {
+                if (!pathEvidence.some((item) => item.path === proposedPath)) {
+                    pathEvidence.push({ path: proposedPath, sha256: "0".repeat(64), fresh: false, sourceDeclared: false, proposed: true });
+                }
+            }
             const surface = {
                 kind: "target-surface",
                 origin: "scout",
@@ -3273,6 +4196,7 @@ export async function createFrontendScoutEvidenceTools(input) {
                 entrypoint: params?.entrypoint ?? "",
                 routeOrMount: params?.routeOrMount ?? "",
                 implementationPaths,
+                ...(proposedPaths.length > 0 ? { proposedPaths } : {}),
                 testPaths,
                 dataSource: params?.dataSource ?? "",
                 allowedPathConflicts: params?.allowedPathConflicts ?? [],
@@ -3281,7 +4205,7 @@ export async function createFrontendScoutEvidenceTools(input) {
                 ...(pathEvidence.length > 0 ? { pathEvidence } : {}),
             };
             if (activeScope) {
-                const { readCompleteScoutTargetSurface } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+                const { readCompleteScoutTargetSurface } = await import("../workflows/dag/frontend-committed-facts.js");
                 if (surface.completeness === "complete") {
                     const check = readCompleteScoutTargetSurface([{ phase: "committed", fact: surface }]);
                     if (!check.ok)
@@ -3295,7 +4219,7 @@ export async function createFrontendScoutEvidenceTools(input) {
                     const surfaces = [...new Set(input.requirementIds.map(id => current.get(id)))].map(f => f.surface);
                     const union = (key) => [...new Set(surfaces.flatMap(s => Array.isArray(s[key]) ? s[key] : []))];
                     const entries = [...new Set(surfaces.map(s => String(s.entrypoint ?? "")).filter(Boolean))];
-                    return receipt(await adoptScoutFact("target-surface", { kind: "target-surface", origin: "scout", completeness: "complete", entrypoint: entries[0] ?? "", implementationPaths: [...new Set([...entries, ...union("implementationPaths")])], testPaths: union("testPaths"), allowedPathConflicts: union("allowedPathConflicts"), unresolvedPaths: union("unresolvedPaths"), routeOrMount: [...new Set(surfaces.map(s => s.routeOrMount).filter(Boolean))].join("\n"), dataSource: [...new Set(surfaces.map(s => s.dataSource).filter(Boolean))].join("\n"), pathEvidence: surfaces.flatMap(s => s.pathEvidence ?? []), ...(hasSourceDeclarations ? { sourceDeclaredPaths } : {}) }));
+                    return receipt(await adoptScoutFact("target-surface", { kind: "target-surface", origin: "scout", completeness: "complete", entrypoint: entries[0] ?? "", implementationPaths: [...new Set([...entries, ...union("implementationPaths")])], proposedPaths: union("proposedPaths"), testPaths: union("testPaths"), allowedPathConflicts: union("allowedPathConflicts"), unresolvedPaths: union("unresolvedPaths"), routeOrMount: [...new Set(surfaces.map(s => s.routeOrMount).filter(Boolean))].join("\n"), dataSource: [...new Set(surfaces.map(s => s.dataSource).filter(Boolean))].join("\n"), pathEvidence: surfaces.flatMap(s => s.pathEvidence ?? []), ...(hasSourceDeclarations ? { sourceDeclaredPaths } : {}) }));
                 }
                 return receipt(saved);
             }
@@ -3605,21 +4529,15 @@ const DEFAULT_DAG_PI_WRITE_GUARD_DEPENDENCIES = {
     readGitStatusPorcelain,
     recoverRootNulArtifact,
 };
-/**
- * M5 shadow pass for `frontend-review-pi`: extract the committed typed terminal
- * facts from session events, parse the legacy JSON verdict from the response
- * text, compare them (audit-only), and persist the audit artifact. Missing
- * typed terminal facts fail the node closed (AC-001); a shadow mismatch never
- * blocks the node.
+/** Validate the typed review terminal and complete review scopes. The typed
+ * terminal is authoritative; legacy JSON verdict parsing is intentionally gone.
  */
-async function runFrontendReviewTerminalShadow(input) {
+async function validateFrontendReviewTerminal(input) {
     // A provider/executor failure (in particular context-overflow) is already
     // authoritative. Do not rewrite it to review-terminal-missing merely
     // because no terminal tool could be submitted after the failed call.
     if (!input.mapped.ok)
         return input.mapped;
-    const { compareTypedReviewToLegacyJsonVerdict } = await import("../workflows/dag/frontend-review-context.js");
-    const { parseJsonReviewVerdict } = await import("../workflows/dag/output-protocol.js");
     let typedKinds = [];
     try {
         await input.tools?.flush();
@@ -3629,43 +4547,6 @@ async function runFrontendReviewTerminalShadow(input) {
     catch (error) {
         return { ...input.mapped, ok: false, failureCategory: "frontend-ledger-invalid", stderr: `FRONTEND_REVIEW_SCOPE_INCOMPLETE: ${error instanceof Error ? error.message : String(error)}` };
     }
-    let legacyVerdict;
-    try {
-        const parsed = parseJsonReviewVerdict(input.mapped.assistantText ?? input.mapped.stdout);
-        if (parsed.ok)
-            legacyVerdict = parsed.verdict;
-    }
-    catch {
-        legacyVerdict = undefined;
-    }
-    let comparison;
-    try {
-        comparison = compareTypedReviewToLegacyJsonVerdict({
-            typedKinds,
-            legacyVerdict,
-        });
-    }
-    catch (error) {
-        comparison = {
-            typedVerdict: undefined,
-            legacyVerdict: undefined,
-            match: false,
-            reason: `typed review equivalence comparison crashed: ${error instanceof Error ? error.message : String(error)}`,
-        };
-    }
-    // The durable ledger was validated above; this artifact is audit-only.
-    try {
-        await writeDagNodeJsonArtifact(input.meta.runDir, input.task.id, "fact-review-status.json", {
-            schemaVersion: 1,
-            nodeId: input.task.id,
-            typedKinds,
-            legacyVerdict,
-            comparison,
-        });
-    }
-    catch {
-        // best-effort audit artifact
-    }
     if (typedKinds.length === 0) {
         return {
             ...input.mapped,
@@ -3681,16 +4562,8 @@ async function runFrontendReviewTerminalShadow(input) {
     }
     return input.mapped;
 }
-/**
- * M8 shadow pass for `frontend-design-review-pi`: extract the committed typed
- * design terminal facts from session events, flush them, and persist the audit
- * artifact. The design review's legacy output was a first-line
- * `VERDICT: pass|request-revision` text protocol (not a JSON verdict), so
- * there is no JSON equivalence comparison here. Missing typed terminal facts
- * fail the node closed; writer admission later reads the committed
- * `design-typed-facts.jsonl` as the only authoritative verdict.
- */
-async function runFrontendDesignTerminalShadow(input) {
+/** Validate the typed design terminal and complete design scopes. */
+async function validateFrontendDesignTerminal(input) {
     // See the review counterpart above: a failed provider call cannot be
     // diagnosed as an omitted terminal tool call.
     if (!input.mapped.ok)
@@ -3704,17 +4577,6 @@ async function runFrontendDesignTerminalShadow(input) {
     catch (error) {
         return { ...input.mapped, ok: false, failureCategory: "frontend-ledger-invalid", stderr: `FRONTEND_REVIEW_SCOPE_INCOMPLETE: ${error instanceof Error ? error.message : String(error)}` };
     }
-    // The durable ledger was validated above; this artifact is audit-only.
-    try {
-        await writeDagNodeJsonArtifact(input.meta.runDir, input.task.id, "fact-design-status.json", {
-            schemaVersion: 1,
-            nodeId: input.task.id,
-            typedKinds,
-        });
-    }
-    catch {
-        // best-effort audit artifact
-    }
     if (typedKinds.length === 0) {
         return {
             ...input.mapped,
@@ -3744,7 +4606,7 @@ const FRONTEND_PLAN_SEGMENTS = [
         ]),
         instruction: [
             "PLAN PHASE — requirement coverage only.",
-            "Your ONLY job: for every frozen requirement, emit record_plan_requirement (requirement → implementation files) and record_plan_verification_target facts (verification target bound to requirement ids and files). Group related requirements under one non-static behavior target when one observable test behavior proves them together; do not mechanically create one target per requirement. A non-static target id is the stable machine trace token; never submit prose as a symbol. Do NOT record components, UI states, mock, dependency, or routes — a follow-up session owns those.",
+            "Your ONLY job: for every frozen requirement, emit record_plan_requirement (requirement → implementation files) and record_plan_verification_target facts (verification target bound to requirement ids and files). Group related requirements under one non-static behavior target when one observable test behavior proves them together; do not mechanically create one target per requirement. Target ids identify contract entries, not test-title markers. Reuse affected existing test files and their names; do not add tests or rename titles just to carry generated ids. Never submit prose as a symbol. Do NOT record components, UI states, mock, dependency, or routes — a follow-up session owns those.",
             "A coverage session is complete only when EVERY requirement assigned to this session (the full inventory, or the exact COVERAGE BATCH / shard list when present) has committed coverage facts: a record_plan_requirement entry plus verification targets, or a committed evidence gap. Keep committing in batches of up to 4 record_* calls per assistant message until then; do not write a concluding summary while any assigned requirement is still uncommitted — an early stop strands the remainder into a MISSING-FACT repair session and doubles the sessions needed.",
             "If a requirement genuinely cannot have a verification target, record a non-empty record_plan_evidence_gap. Do not call finalize_plan; it is not available in this phase.",
         ].join(" "),
@@ -3797,15 +4659,185 @@ const FRONTEND_PLAN_SEGMENTS = [
             "Record only dependency policy and design-evidence conflicts. Do not record route, Mock/data, or requirement-local UX facts. Do not call finalize_plan.",
         ].join(" "),
     },
-    {
-        id: "finalize",
-        toolNames: null,
-        instruction: [
-            "PLAN PHASE — finalize.",
-            "All record_* tools are available only for a narrowly named correction if the finalize receipt reports missing or invalid facts. Otherwise call finalize_plan exactly once with no extra fields.",
-        ].join(" "),
-    },
 ];
+function committedFactFromPlanRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const record = value;
+    if (record.phase !== undefined && record.phase !== "committed")
+        return undefined;
+    const fact = record.fact;
+    return fact && typeof fact === "object" && !Array.isArray(fact)
+        ? fact
+        : typeof record.kind === "string"
+            ? record
+            : undefined;
+}
+function planFactStringList(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((item) => typeof item === "string" && item.trim().length > 0);
+}
+function planFactScopeIntersects(fact, requirementIds) {
+    return planFactStringList(fact.scopeRequirementIds).some((id) => requirementIds.has(id));
+}
+/** Compute the authoritative coverage queue from the committed plan ledger. */
+export function collectFrontendPlanMissingFacts(input) {
+    const requirements = new Map();
+    const standaloneEvidenceGaps = new Set();
+    const verificationTargetIds = new Set();
+    const verificationTargetRequirements = new Map();
+    for (const value of input.committedFacts) {
+        const fact = committedFactFromPlanRecord(value);
+        if (!fact || fact.origin !== "plan")
+            continue;
+        if (fact.kind === "plan-requirement" && fact.entry && typeof fact.entry === "object") {
+            const entry = fact.entry;
+            if (typeof entry.id === "string" && entry.id.trim())
+                requirements.set(entry.id, entry);
+        }
+        if (fact.kind === "plan-verification-target" && fact.entry && typeof fact.entry === "object") {
+            const entry = fact.entry;
+            const id = entry.id;
+            if (typeof id === "string" && id.trim()) {
+                verificationTargetIds.add(id);
+                verificationTargetRequirements.set(id, new Set(Array.isArray(entry.requirementIds)
+                    ? entry.requirementIds.filter((value) => typeof value === "string")
+                    : []));
+            }
+        }
+        if (fact.kind === "plan-evidence-gap" && fact.entry && typeof fact.entry === "object") {
+            const entry = fact.entry;
+            const requirementId = entry.requirementId;
+            const description = entry.description;
+            if (typeof requirementId === "string" && requirementId.trim() && typeof description === "string" && description.trim()) {
+                standaloneEvidenceGaps.add(requirementId);
+            }
+        }
+    }
+    const missing = [];
+    for (const id of input.requirementIds) {
+        const entry = requirements.get(id);
+        if (!entry) {
+            missing.push({
+                kind: "plan-requirement",
+                id,
+                requirementIds: [id],
+                reason: `requirement ${id} has no committed plan-requirement fact`,
+            });
+            continue;
+        }
+        // Verification targets are the single authoritative direction. The
+        // legacy requirement-side list is accepted only as a fallback while
+        // resuming older ledgers; new plans derive it from target.requirementIds.
+        const derivedTargetIds = [...verificationTargetRequirements.entries()]
+            .filter(([, requirementIds]) => requirementIds.has(id))
+            .map(([targetId]) => targetId);
+        const legacyTargetIds = Array.isArray(entry.verificationTargetIds)
+            ? entry.verificationTargetIds.filter((value) => typeof value === "string" && value.trim().length > 0)
+            : [];
+        const targetIds = derivedTargetIds.length > 0 ? derivedTargetIds : legacyTargetIds;
+        const gap = entry.evidenceGap && typeof entry.evidenceGap === "object"
+            ? entry.evidenceGap
+            : undefined;
+        const hasEvidenceGap = (typeof gap?.description === "string" && gap.description.trim().length > 0) ||
+            standaloneEvidenceGaps.has(id);
+        if (targetIds.length === 0 && !hasEvidenceGap) {
+            missing.push({
+                kind: "plan-verification-target",
+                requirementIds: [id],
+                reason: `requirement ${id} declares neither a verification target nor a non-empty evidenceGap`,
+            });
+            continue;
+        }
+        for (const targetId of targetIds) {
+            if (!verificationTargetIds.has(targetId) ||
+                !verificationTargetRequirements.get(targetId)?.has(id)) {
+                missing.push({
+                    kind: "plan-verification-target",
+                    id: targetId,
+                    requirementIds: [id],
+                    reason: `requirement ${id} references verification target ${targetId}, but that target is not committed`,
+                });
+            }
+        }
+    }
+    return missing;
+}
+/** Completeness checks for phases whose facts are committed incrementally. */
+export function collectFrontendPlanPhaseMissingFacts(input) {
+    const facts = input.committedFacts
+        .map(committedFactFromPlanRecord)
+        .filter((fact) => Boolean(fact && fact.origin === "plan"));
+    if (input.phase === "ux-registry") {
+        return facts.some((fact) => fact.kind === "state-registry")
+            ? []
+            : [
+                {
+                    kind: "state-registry",
+                    requirementIds: [...input.requirementIds],
+                    reason: "global UX vocabulary phase has no committed state-registry fact",
+                },
+            ];
+    }
+    if (input.phase === "ux-local") {
+        const missing = [];
+        // Evaluate each behaviour requirement independently. A fact scoped to AC-1
+        // must not accidentally satisfy AC-2 merely because both ids share one
+        // UX session; shared facts remain valid when they explicitly list both ids.
+        for (const requirementId of input.requirementIds) {
+            if (!input.behaviorRequiredRequirementIds?.includes(requirementId))
+                continue;
+            const scopedFacts = facts.filter((fact) => planFactScopeIntersects(fact, new Set([requirementId])));
+            const hasChoice = scopedFacts.some((fact) => fact.kind === "component-choice" &&
+                Array.isArray(fact.uiComponentChoices) &&
+                fact.uiComponentChoices.length > 0);
+            const canonicalStateFlow = collectCanonicalStateFlowNames(scopedFacts);
+            const hasStateFlow = canonicalStateFlow.uiStateNames.size > 0 ||
+                canonicalStateFlow.interactionNames.size > 0;
+            if (!hasChoice) {
+                missing.push({
+                    kind: "component-choice",
+                    requirementIds: [requirementId],
+                    reason: "behaviour-required UX slice has no committed component-choice fact",
+                });
+            }
+            if (!hasStateFlow) {
+                missing.push({
+                    kind: "state-flow",
+                    requirementIds: [requirementId],
+                    reason: "behaviour-required UX slice has no committed state-flow fact",
+                });
+            }
+        }
+        return missing;
+    }
+    const hasMockApi = facts.some((fact) => fact.kind === "mock-api");
+    const allInteractions = collectCanonicalStateFlowNames(input.committedFacts).interactionNames;
+    const liveInteractions = new Set([...collectCanonicalStateFlowNames(facts.filter(f => !planFactStringList(f.scopeRequirementIds).length || planFactScopeIntersects(f, new Set(input.requirementIds)))).interactionNames].filter(name => allInteractions.has(name)));
+    const coveredInteractions = new Set(facts
+        .filter((fact) => fact.kind === "data-flow")
+        .flatMap((fact) => planFactStringList(fact.interactions)));
+    const missing = [];
+    if (!hasMockApi) {
+        missing.push({
+            kind: "mock-api",
+            requirementIds: [...input.requirementIds],
+            reason: "global Mock/data phase has no committed mock-api fact",
+        });
+    }
+    for (const interaction of liveInteractions) {
+        if (coveredInteractions.has(interaction))
+            continue;
+        missing.push({
+            kind: "data-flow",
+            id: interaction,
+            requirementIds: [...input.requirementIds],
+            reason: `interaction ${interaction} has no committed data-flow fact`,
+        });
+    }
+    return missing;
+}
 /** Estimate calls conservatively: requirement + one VT, with a second VT
  * reserved for behaviour-required requirements. Explicit declarations win. */
 export function estimateFrontendPlanRequirementRecordCalls(fact) {
@@ -4032,6 +5064,7 @@ export function compactFrontendPlanPromptForRequirementSlice(basePrompt, require
                         ? { routeOrMount: compactPromptString(surface.routeOrMount, 180) }
                         : {}),
                     implementationPaths: compactPromptStringArray(surface.implementationPaths),
+                    proposedPaths: compactPromptStringArray(surface.proposedPaths),
                     testPaths: compactPromptStringArray(surface.testPaths),
                     ...(compactPromptString(surface.dataSource, 180)
                         ? { dataSource: compactPromptString(surface.dataSource, 180) }
@@ -4263,7 +5296,7 @@ function compactFrontendPlanLedgerContext(input) {
             continue;
         }
         if (fact.kind === "target-surface") {
-            compactFacts.push({ kind: fact.kind, routes: compactPromptStringArray(fact.routes, 24, 180) });
+            compactFacts.push({ kind: fact.kind, routes: compactPromptStringArray(fact.routes, 24, 180), implementationPaths: compactPromptStringArray(fact.implementationPaths, 24, 180), proposedPaths: compactPromptStringArray(fact.proposedPaths, 24, 180), testPaths: compactPromptStringArray(fact.testPaths, 24, 180) });
         }
     }
     if (compactFacts.length === 0)
@@ -4311,19 +5344,21 @@ export async function runFrontendReviewSegmentedSessions(input) {
         protocol.setActiveScope(scopes.map(s => s.id));
         const finalScope = input.inventory.scopes.every(s => protocol.completedScopeIds().has(s.id) || scopes.some(current => current.id === s.id));
         const customTools = finalScope ? input.customTools : input.customTools.filter(t => !terminalKinds.includes(String(t.name)));
-        const prompt = `${input.basePrompt}\n<frontend_review_scope>\n${JSON.stringify({ semantics: "full", inventoryDigest: input.inventory.digest, scopes, previouslyCompleted: [...protocol.completedScopeIds()], savedFindings: protocol.committedFacts().filter(r => String(r.fact.kind).endsWith("-finding")).map(r => ({ id: r.fact.id, finding: r.fact.finding })) })}\n</frontend_review_scope>\nReview the complete supplied scopes, saving each finding immediately. Call complete_review_scope for each exact id only after all its independent permissions, thresholds, errors and evidence have been checked. ${finalScope ? "After every scope is complete, make one independent overall approve/request_changes decision; persisted findings cannot be omitted." : "More scopes remain. Do not finalize or reread already completed scopes unless resolving a cross-scope issue."}`;
+        const prompt = `${input.basePrompt}\n<frontend_review_authority>\nThe Contract acceptance criteria, constraints, required deliverables, UI-state declarations, and verification expectations in the supplied input are authoritative. Review the actual diff and evidence against those facts; do not replace them with a Plan-derived interpretation.\n</frontend_review_authority>\n<frontend_review_scope>\n${JSON.stringify({ semantics: "full", inventoryDigest: input.inventory.digest, scopes, previouslyCompleted: [...protocol.completedScopeIds()], savedFindings: protocol.committedFacts().filter(r => String(r.fact.kind).endsWith("-finding")).map(r => ({ id: r.fact.id, finding: r.fact.finding })) })}\n</frontend_review_scope>\nReview the complete supplied scopes, saving each finding immediately. Call complete_review_scope for each exact id only after all its independent permissions, thresholds, errors and evidence have been checked. ${finalScope ? "After every scope is complete, make one independent overall approve/request_changes decision; persisted findings cannot be omitted." : "More scopes remain. Do not finalize or reread already completed scopes unless resolving a cross-scope issue."}`;
         if (Buffer.byteLength(prompt) > targetBytes && scopes.length > 1) {
             const at = Math.ceil(scopes.length / 2);
             queue.splice(index, 1, { scopes: scopes.slice(0, at), repairs: 0 }, { scopes: scopes.slice(at), repairs: 0 });
             index--;
             continue;
         }
+        const completionInstruction = `${item.repairs ? "REPAIR: the prior session did not commit all required checkpoints/verdict. Do not repeat the review narrative. " : ""}Complete these exact runtime scope IDs using complete_review_scope: ${JSON.stringify(scopes.map(scope => scope.id))}. These are scope IDs, not node IDs. ${finalScope ? `After those checkpoints succeed, call exactly one terminal tool: ${terminalKinds.join(" or ")}. A prose conclusion is not a committed verdict.` : "More scopes remain; do not submit an overall verdict yet."}`;
+        const userMessage = `${input.sessionOptions.userMessage}\n\n${completionInstruction}`;
         if (++calls > 128)
             return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "FRONTEND_REVIEW_RECOVERY_EXHAUSTED: session quota reached" };
-        last = await observeFrontendSession({ ...input.observation, phase: `${input.phase}/scope`, scopeIds: scopes.map(s => s.id), prompt, userMessage: input.sessionOptions.userMessage, customTools,
+        last = await observeFrontendSession({ ...input.observation, phase: `${input.phase}/scope`, scopeIds: scopes.map(s => s.id), prompt, userMessage, customTools,
             artifactPath: input.observation?.artifactPath ? `${input.observation.artifactPath}-${calls}.json` : undefined,
             committedCount: () => protocol.committedFacts().length, durableCommittedCount: () => protocol.committedFacts().length,
-        }, observer => input.piStepFn({ ...input.sessionOptions, prompt, onAttemptObservation: observer, writerToolPolicy: { requireSdk: true, customTools } }));
+        }, observer => input.piStepFn({ ...input.sessionOptions, prompt, userMessage, onAttemptObservation: observer, writerToolPolicy: { requireSdk: true, customTools } }));
         await input.tools.flush();
         await input.inventory.validate();
         if (last.timedOut || /interrupt|termination-unconfirmed|budget_breach/.test(last.failureCategory))
@@ -4339,8 +5374,30 @@ export async function runFrontendReviewSegmentedSessions(input) {
             index--;
             continue;
         }
-        if (!last.ok && !capacity)
+        if (!last.ok && !capacity) {
+            // Terminal-only completion: this protocol finishes through durable
+            // tools (complete_review_scope -> approve_review/request_review_changes),
+            // so the model can end its turn with no closing prose and the step
+            // classifies as empty-output even though the review is complete
+            // (smoke r27/r31/r32 committed the terminal and still reported
+            // empty-output; the node then replayed the committed fact in an
+            // extra attempt). Accept the segment here instead, so a completed
+            // review neither spends a replay attempt nor depends on the retry
+            // ladder, and a misclassified category (smoke r28 read a finding id
+            // containing UNAUTHORIZED as an auth error, which is not retryable)
+            // can no longer turn a committed review into a node failure.
+            if (last.failureCategory === "empty-output" && terminal() && !missing.length) {
+                try {
+                    await input.tools.flush();
+                    protocol.assertComplete();
+                    return { ...last, ok: true, failureCategory: "success" };
+                }
+                catch {
+                    // Unfinished scope checkpoints still fail this segment.
+                }
+            }
             return last;
+        }
         if (missing.length || finalScope && !terminal()) {
             if (item.repairs >= 1)
                 return { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: "FRONTEND_REVIEW_SCOPE_INCOMPLETE: required checkpoint or verdict missing" };
@@ -4409,11 +5466,15 @@ export async function runFrontendScoutSegmentedSessions(input) {
         }
     }
     await input.tools.flush();
-    const { readCompleteScoutTargetSurface } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+    const { readCompleteScoutTargetSurface } = await import("../workflows/dag/frontend-committed-facts.js");
     const closure = readCompleteScoutTargetSurface(input.tools.committedFacts());
     return closure.ok ? { ...last, ok: true, failureCategory: "success" } : { ...last, ok: false, failureCategory: "frontend-input-exhausted", stderr: closure.reason };
 }
 export async function runFrontendContractSegmentedSessions(input) {
+    // Requirement identity, text, and source fragments are frozen in the
+    // runtime ledger. Seed those facts once; model sessions spend their budget
+    // on execution grouping, evidence expectations, and genuine decisions.
+    await input.tools.seedCanonicalRequirements();
     // Build from the frozen runtime inventory if the caller has not rendered it yet.
     const basePrompt = parseFrontendInputBlock(input.basePrompt, "contract") ? input.basePrompt : input.basePrompt +
         `\n<frontend_contract_input>\nFrozen complete source obligations.\n${JSON.stringify({ requirements: input.tools.inputRequirements() })}\n</frontend_contract_input>`;
@@ -4438,13 +5499,14 @@ export async function runFrontendContractSegmentedSessions(input) {
                 const groupIndex = collectFrontendExecutionGroups(input.tools.committedFacts().filter(r => r.fact.kind === "requirement").map(r => ({ id: String(r.fact.id), execution: r.fact.execution })));
                 const shared = input.tools.committedFacts().filter(r => !["requirement", "contract-finalized", "contract-scope-completed"].includes(String(r.fact.kind))).map(r => r.fact);
                 const prompt = projectFrontendContractPrompt(basePrompt, scopeIds) +
-                    `\nCONTRACT SCOPE: analyze only ${scopeIds.join(", ") || "(all scopes complete; verify global facts and terminal)"}. Each obligation is complete. Submit small records immediately, then call complete_contract_scope after ALL decisions for this scope. ` +
+                    `\nCONTRACT SCOPE: analyze only ${scopeIds.join(", ") || "(all scopes complete; verify global facts and terminal)"}. Requirement identity/text/source fragments are already committed by runtime; do not call record_requirement. Use record_requirement_execution for model-owned execution grouping, then submit decisions and evidence records. Call complete_contract_scope after ALL decisions for this scope. ` +
                     (finalScope ? "After complete scope coverage and source-bound deliverables, call finalize_contract. Correct rejected calls and retry." : "Do not finalize; subsequent complete scopes remain.") +
                     `\n<committed_contract_facts>\n${JSON.stringify({ facts: shared, executionGroups: groupIndex })}\n</committed_contract_facts>`;
                 const customTools = input.tools.customTools.filter(t => finalScope || t.name !== "finalize_contract");
                 invocation += 1;
                 if (invocation > maxSessions)
                     return { ...last, ok: false, failureCategory: "invalid-output", stderr: "CONTRACT_RECOVERY_EXHAUSTED: session quota exceeded" };
+                const committedBefore = input.tools.committedFacts().length;
                 last = await observeFrontendSession({
                     ...input.observation, phase: "contract/scope", scopeIds, prompt, userMessage: input.sessionOptions.userMessage, customTools,
                     artifactPath: input.observation?.artifactPath ? `${input.observation.artifactPath}-${invocation}.json` : undefined,
@@ -4476,8 +5538,17 @@ export async function runFrontendContractSegmentedSessions(input) {
                     index -= 1;
                     break;
                 }
-                if (!last.ok)
+                // A session that ends with blank assistant text but committed new
+                // facts is not a node failure: small-output models legitimately
+                // stop after their tool calls. Continue so the scope/repair checks
+                // below decide, instead of burning a full node retry.
+                const committedFactsOnlySuccess = !(last.assistantText ?? "").trim() &&
+                    !last.stderr.trim() &&
+                    input.tools.committedFacts().length > committedBefore;
+                if (!last.ok && !committedFactsOnlySuccess)
                     return last;
+                if (committedFactsOnlySuccess)
+                    last = { ...last, ok: true, failureCategory: "success" };
                 const missing = scopeIds.filter(id => !input.tools.completedScopeRequirementIds().has(id));
                 if (!missing.length && (!finalScope || terminal()))
                     break;
@@ -4512,16 +5583,18 @@ function buildFrontendPlanWorkload(input) {
     const workCost = (ids) => 1 + ids.reduce((total, id) => total + Math.max(1, (input.requirementCosts?.get(id) ?? 2) - 1), 0);
     const policy = input.sessionOptions.frontendExecutionPolicy;
     const targetBytes = policy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES;
-    const userMessageBytes = Buffer.byteLength(input.sessionOptions.userMessage ?? "");
     const buildWorkBatches = (ids) => {
         const work = workGroups.flatMap((g, index) => {
             const members = g.requirementIds.filter(id => ids.includes(id));
             return members.length ? [{ id: `${index}:${g.id}`, requirementIds: members,
                     requirements: members.map(id => fullUnits.get(id) ?? { id }), estimatedCalls: workCost(members) }] : [];
         });
-        const scaffoldBytes = Buffer.byteLength(input.basePrompt.replace(/<frontend_plan_input>[\s\S]*?<\/frontend_plan_input>/, JSON.stringify({ ...compiledInput, requirements: [] }))) + userMessageBytes + Buffer.byteLength(JSON.stringify(input.coverageTools));
+        // Pack complete work units, not the repeated request scaffold. Deducting
+        // fixed context/tools can leave a one-byte budget and force one AC per
+        // session without reducing that overhead. The SDK checks the actual
+        // request against model capacity; capacity recovery splits unfinished work.
         return packFrontendInputUnits(work, {
-            targetBytes: Math.max(1, targetBytes - scaffoldBytes),
+            targetBytes,
             maxUnits: policy?.maxScopeUnits ?? 4,
             maxCost: FRONTEND_PLAN_COVERAGE_MAX_RECORD_CALLS, cost: g => g.estimatedCalls,
         }).map(batch => batch.flatMap(g => g.requirementIds));
@@ -4533,11 +5606,31 @@ function buildFrontendPlanWorkload(input) {
         frozenInput, workGroups, buildWorkBatches,
         compactEligible: input.requirementCosts !== undefined &&
             workGroups.length <= FRONTEND_PLAN_SMALL_MAX_REQUIREMENTS &&
-            Buffer.byteLength(input.basePrompt) + userMessageBytes + Buffer.byteLength(JSON.stringify(input.allTools)) <= targetBytes * 2 &&
             workGroups.reduce((total, group) => total + workCost(group.requirementIds), 0) <= FRONTEND_PLAN_SMALL_MAX_ESTIMATED_CALLS &&
             countFrontendPlanTargetSurfaces(input.basePrompt) === 1,
     };
 }
+/**
+ * Requirement ids the plan coverage layout must own, in first-commit order.
+ *
+ * The contract ledger is append-only and `record_requirement` is incremental, so
+ * the same id can legitimately be committed more than once. Deduplicating here is
+ * load-bearing: `buildFrontendPlanWorkload` seeds one `unclassified` work group per
+ * list entry without re-checking membership, so a repeated id produced two groups,
+ * `buildWorkBatches` emitted the id twice, and the coverage-layout validator then
+ * rejected the layout the runtime had derived itself (members 8 !== owners 7) as
+ * FRONTEND_PLAN_LAYOUT_INVALID with failureCategory tool-policy - killing the run
+ * at the plan node over a completely ordinary ledger.
+ */
+export function collectFrontendPlanRequirementIds(contractFacts) {
+    return [
+        ...new Set(contractFacts
+            .filter((record) => record.fact?.kind ===
+            "requirement")
+            .map((record) => record.fact?.id)
+            .filter((id) => typeof id === "string")),
+    ];
+}
 const frontendPlanCoverageLayoutSchema = z.object({
     schemaVersion: z.literal(1),
     bindingSha256: z.string(),
@@ -4601,12 +5694,11 @@ export async function runFrontendPlanSegmentedSessions(input) {
     const uxRegistrySegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "ux-registry");
     const uxSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "ux-local");
     const globalMockDataSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "global-mock-data");
-    const finalizeSegment = FRONTEND_PLAN_SEGMENTS.find((segment) => segment.id === "finalize");
     const allRequirementIds = input.requirementIds ?? [];
     const buildPhasePrompt = (segment, missing = [], scopeIds = allRequirementIds) => {
         const compact = allRequirementIds.length > 0
             ? compactFrontendPlanPromptForRequirementSlice(input.basePrompt, scopeIds, {
-                includeRequirementText: segment.id === "global-mock-data",
+                includeRequirementText: segment.id === "global-mock-data" || segment.id === "finalize",
                 includeVerificationTargets: false,
                 includeDesignEvidence: segment.id === "global-dependency-deviation" || segment.id === "finalize",
                 includeChecklist: false,
@@ -4727,7 +5819,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
         return [
             compactFrontendPlanPromptForRequirementSlice(input.basePrompt, allRequirementIds),
             "PLAN PHASE — compact local planning for a small frontend request.",
-            "Review all listed requirements together and record_state_registry first with one global UX vocabulary. Then record every plan-requirement and verification-target fact, followed by the component-choice and state-flow facts needed by the observable UX. Do not read the repository or task source; use only the committed input above. Do not call finalize_plan in this session.",
+            "Review all listed requirements together and record_state_registry first with one global UX vocabulary. Then record every plan-requirement and verification-target fact, followed by component/state-flow facts and the minimal route, Mock/data, dependency, and design-deviation policy facts needed by the observable behavior. Do not read the repository or task source; use only the committed input above. Do not call finalize_plan in this session.",
             "TOOL-FIRST: your first assistant actions must be record_* tool calls, at most 2-3 facts per message. Do not draft the whole analysis before recording; if a fact is uncertain, record it with an evidence gap instead of reasoning longer.",
             ledger,
             ...(missing.length > 0
@@ -4738,8 +5830,6 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 : []),
         ].filter(Boolean).join("\n\n");
     };
-    const compactFinalizeInstruction = "This is a small-request compact pass. Reconcile the committed local facts with route, data-flow, Mock/API, dependency and deviation policy, then call finalize_plan; correct rejected facts and retry until exactly one successful terminal commit.";
-    const buildCompactFinalizePrompt = (missing = []) => [buildPhasePrompt(finalizeSegment, missing), compactFinalizeInstruction].join("\n\n");
     const mapPlannerExhaustion = (r, committedAnyFacts) => isPlannerThinkingExhausted(r, committedAnyFacts)
         ? {
             ...r,
@@ -4782,12 +5872,80 @@ export async function runFrontendPlanSegmentedSessions(input) {
             tokensUsed: 0,
         };
     }
+    const compiledInput = parseFrontendInputBlock(input.basePrompt, "plan")?.payload;
+    const fullUnits = new Map(compiledInput?.requirements.map(r => [r.id, r]) ?? []);
+    const workCost = (ids) => 1 + ids.reduce((total, id) => total + Math.max(1, (input.requirementCosts?.get(id) ?? 2) - 1), 0);
     const { workGroups, buildWorkBatches, compactEligible } = buildFrontendPlanWorkload({
         basePrompt: input.basePrompt, requirementIds: allRequirementIds,
         requirementCosts: input.requirementCosts, sessionOptions: input.sessionOptions,
-        coverageTools: input.segmentCustomTools(coverageSegment.toolNames),
-        allTools: input.segmentCustomTools(null),
     });
+    // Data decisions are grouped by observable data domain. Requirements that
+    // mention the same endpoint/resource or execution group share one session;
+    // unrelated domains remain isolated. This prevents the old requirement-by-
+    // requirement repetition while preserving the packer's size bound.
+    const buildDataBatches = (ids) => {
+        const selected = new Set(ids);
+        const domains = new Map();
+        for (const [index, group] of workGroups.entries()) {
+            const members = group.requirementIds.filter((id) => selected.has(id));
+            if (!members.length)
+                continue;
+            const texts = members.map((id) => String(fullUnits.get(id)?.text ?? ""));
+            const endpoint = texts
+                .map((text) => text.match(/\b(?:GET|POST|PUT|PATCH|DELETE)\s+(\/[^\s,;.)]+)/i)?.[1])
+                .find(Boolean);
+            const resource = endpoint
+                ? endpoint.split("/").filter(Boolean).slice(0, 2).join("/")
+                : undefined;
+            const domain = resource ? `endpoint:${resource}` : `group:${group.id}`;
+            const current = domains.get(domain);
+            if (current) {
+                current.requirementIds.push(...members);
+                current.requirements.push(...members.map((id) => fullUnits.get(id) ?? { id }));
+                current.estimatedCalls = workCost(current.requirementIds);
+            }
+            else {
+                domains.set(domain, {
+                    id: `${index}:${domain}`,
+                    requirementIds: [...members],
+                    requirements: members.map((id) => fullUnits.get(id) ?? { id }),
+                    estimatedCalls: workCost(members),
+                });
+            }
+        }
+        const work = [...domains.values()];
+        const scaffoldBytes = Buffer.byteLength(input.basePrompt.replace(/<frontend_plan_input>[\s\S]*?<\/frontend_plan_input>/, JSON.stringify({ ...compiledInput, requirements: [] }))) + Buffer.byteLength(JSON.stringify(input.segmentCustomTools(globalMockDataSegment.toolNames)));
+        return packFrontendInputUnits(work, {
+            targetBytes: Math.max(1, (input.sessionOptions.frontendExecutionPolicy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES) - scaffoldBytes),
+            maxUnits: input.sessionOptions.frontendExecutionPolicy?.maxScopeUnits ?? 4,
+            maxCost: FRONTEND_PLAN_COVERAGE_MAX_RECORD_CALLS,
+            cost: (group) => group.estimatedCalls,
+        }).map((batch) => batch.flatMap((group) => group.requirementIds));
+    };
+    // Dependency/deviation is optional policy. For a pure local UI request with
+    // no dependency, package, design-conflict, or OpenSpec signal, opening a
+    // dedicated model session only produces an empty policy fact. Keep the
+    // session when the prompt or ledger contains any such signal so this is a
+    // conservative skip, not a blanket removal of the gate.
+    const dependencyDeviationNeeded = /(?:dependenc|package\.json|npm\s+(?:install|i)|yarn\s+add|pnpm\s+add|openspec|design\s+conflict|规范冲突|依赖)/i.test(input.basePrompt) ||
+        Boolean(input.committedFacts?.().some((record) => {
+            const fact = committedFactFromPlanRecord(record);
+            return fact?.kind === "dependency" || fact?.kind === "design-deviation";
+        }));
+    const globalPolicyToolNames = new Set([
+        "record_route_selection",
+        "record_dependency",
+        "record_design_deviation",
+        "adopt_staged_fact",
+    ]);
+    const globalPolicyPrompt = [
+        "PLAN PHASE — global implementation policy.",
+        "Use the Scout target surface to record the selected route(s), then record dependency policy and design-evidence conflicts only when they are relevant. Do not record requirement-local UX or Mock/data facts. Do not call finalize_plan.",
+        dependencyDeviationNeeded
+            ? "Dependency/design policy signals are present; inspect them and commit the minimal policy facts needed."
+            : "No dependency/design-conflict signal was found; do not invent a policy fact.",
+    ].join(" ");
+    let globalPolicyQueued = false;
     // Small, single-surface requests do not benefit from six isolated Pi
     // sessions. Keep the typed ledger as the authority, but let one local
     // session establish requirement/UX facts and one final session establish
@@ -4805,6 +5963,12 @@ export async function runFrontendPlanSegmentedSessions(input) {
             "record_state_registry",
             "record_component_choice",
             "record_state_flow",
+            "record_route_selection",
+            "record_data_flow",
+            "record_mock_api",
+            "record_mock_endpoint",
+            "record_dependency",
+            "record_design_deviation",
             "adopt_staged_fact",
         ]);
         queue.push({
@@ -4813,11 +5977,6 @@ export async function runFrontendPlanSegmentedSessions(input) {
             requirementSlice: [...allRequirementIds],
             prompt: buildCompactLocalPrompt(),
         });
-        queue.push({
-            id: "finalize",
-            toolNames: null,
-            prompt: buildCompactFinalizePrompt(),
-        });
     }
     else if (!requirementIdsProvided) {
         queue.push({
@@ -4856,10 +6015,25 @@ export async function runFrontendPlanSegmentedSessions(input) {
             prompt: slice.length ? buildUxPrompt(slice) : buildPhasePrompt(uxSegment),
         }));
         for (const segment of FRONTEND_PLAN_SEGMENTS) {
-            if (["coverage", "ux-registry", "ux-local", "finalize"].includes(segment.id))
+            if (["coverage", "ux-registry", "ux-local"].includes(segment.id))
+                continue;
+            if (segment.id === "global-dependency-deviation" && !dependencyDeviationNeeded)
+                continue;
+            if (segment.id === "global-route") {
+                if (globalPolicyQueued)
+                    continue;
+                globalPolicyQueued = true;
+                queue.push({
+                    id: "global-policy",
+                    toolNames: globalPolicyToolNames,
+                    prompt: `${buildPhasePrompt(segment)}\n\n${globalPolicyPrompt}`,
+                });
+                continue;
+            }
+            if (segment.id === "global-dependency-deviation")
                 continue;
             if (segment.id === "global-mock-data" && requirementIdsProvided) {
-                buildWorkBatches(allRequirementIds).forEach((slice, i) => queue.push({ id: `global-mock-data-${i + 1}`, toolNames: segment.toolNames, requirementSlice: slice, prompt: buildPhasePrompt(segment, [], slice) }));
+                buildDataBatches(allRequirementIds).forEach((slice, i) => queue.push({ id: `global-mock-data-${i + 1}`, toolNames: segment.toolNames, requirementSlice: slice, prompt: buildPhasePrompt(segment, [], slice) }));
             }
             else {
                 queue.push({
@@ -4869,11 +6043,6 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 });
             }
         }
-        queue.push({
-            id: finalizeSegment.id,
-            toolNames: finalizeSegment.toolNames,
-            prompt: buildPhasePrompt(finalizeSegment),
-        });
     }
     let accumulated;
     let index = 0;
@@ -4881,6 +6050,8 @@ export async function runFrontendPlanSegmentedSessions(input) {
     let lastDurableCount = input.committedFactCount();
     while (index < queue.length) {
         const session = queue[index];
+        if (!session)
+            break;
         if (input.attempt > 1 && input.committedFacts && session.id === "ux-registry" &&
             collectFrontendPlanPhaseMissingFacts({ phase: "ux-registry", requirementIds: allRequirementIds, committedFacts: input.committedFacts() }).length === 0) {
             index += 1;
@@ -4917,6 +6088,32 @@ export async function runFrontendPlanSegmentedSessions(input) {
             index += 1;
             continue;
         }
+        // Resume only unfinished UX scopes. The registry and local decisions are
+        // durable facts; replaying a completed scope wastes a model session and
+        // can make a previously valid shared decision look like a duplicate.
+        if (session.id === "ux-registry" &&
+            input.committedFacts &&
+            !collectFrontendPlanPhaseMissingFacts({
+                phase: "ux-registry",
+                requirementIds: allRequirementIds,
+                committedFacts: input.committedFacts(),
+            }).length) {
+            index += 1;
+            continue;
+        }
+        if (session.id.startsWith("ux-local-") &&
+            session.requirementSlice &&
+            (input.behaviorRequiredRequirementIds?.length ?? 0) > 0 &&
+            input.committedFacts &&
+            !collectFrontendPlanPhaseMissingFacts({
+                phase: "ux-local",
+                requirementIds: session.requirementSlice,
+                committedFacts: input.committedFacts(),
+                behaviorRequiredRequirementIds: input.behaviorRequiredRequirementIds,
+            }).length) {
+            index += 1;
+            continue;
+        }
         let prompt = session.prompt;
         if (session.coverageOnly && session.coverageSlice) {
             const promptSlice = [...new Set([...remaining, ...preexistingMissing.flatMap(item => item.requirementIds)])];
@@ -4936,15 +6133,16 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 : buildPhasePrompt(uxSegment, session.missingFacts);
         }
         else {
-            // Global phases and finalize also consume the latest committed ledger;
+            // Global phases consume the latest committed ledger;
             // constructing their prompt only when the session starts prevents a
             // stale queue entry from dropping facts written by earlier phases.
             const segment = FRONTEND_PLAN_SEGMENTS.find((candidate) => candidate.id === session.id || (candidate.id === "global-mock-data" && session.id.startsWith("global-mock-data-")));
-            if (segment) {
-                prompt =
-                    session.id === "finalize" && useCompactSmallPlan
-                        ? buildCompactFinalizePrompt(session.missingFacts)
-                        : buildPhasePrompt(segment, session.missingFacts, session.requirementSlice ?? allRequirementIds);
+            if (session.id === "global-policy") {
+                const routePrompt = buildPhasePrompt(FRONTEND_PLAN_SEGMENTS.find((candidate) => candidate.id === "global-route"));
+                prompt = `${routePrompt}\n\n${globalPolicyPrompt}`;
+            }
+            else if (segment) {
+                prompt = buildPhasePrompt(segment, session.missingFacts, session.requirementSlice ?? allRequirementIds);
             }
         }
         const atomicFocus = session.atomicRecovery ? session.missingFacts?.[0] : undefined;
@@ -4971,17 +6169,6 @@ export async function runFrontendPlanSegmentedSessions(input) {
             "state-flow": "record_state_flow", "data-flow": "record_data_flow", "mock-api": "record_mock_api",
         };
         const customTools = input.segmentCustomTools(atomicFocus ? new Set([atomicTools[atomicFocus.kind]]) : session.toolNames);
-        const scopeForPacking = session.coverageSlice ?? session.requirementSlice;
-        const envelopeBytes = Buffer.byteLength(prompt) + Buffer.byteLength(input.sessionOptions.userMessage ?? "") + Buffer.byteLength(JSON.stringify(customTools));
-        if (envelopeBytes > (input.sessionOptions.frontendExecutionPolicy?.scopeTargetBytes ?? FRONTEND_SCOPE_TARGET_BYTES) && scopeForPacking && session.id !== "compact-local") {
-            const groups = workGroups.map(g => g.requirementIds.filter(id => scopeForPacking.includes(id))).filter(g => g.length);
-            if (groups.length > 1) {
-                const half = Math.ceil(groups.length / 2);
-                queue.splice(index, 1, ...[groups.slice(0, half).flat(), groups.slice(half).flat()].map(slice => ({ ...session, ...(session.coverageOnly ? { coverageSlice: slice } : { requirementSlice: slice }) })));
-                invocationCount -= 1;
-                continue;
-            }
-        }
         const result = await observeFrontendSession({
             ...input.observation, phase: `plan/${session.id}`, scopeIds: session.requirementSlice ?? session.coverageSlice ?? allRequirementIds,
             prompt, userMessage: input.sessionOptions.userMessage, customTools, committedCount: input.committedFactCount, durableCommittedCount: () => lastDurableCount,
@@ -5013,8 +6200,7 @@ export async function runFrontendPlanSegmentedSessions(input) {
             ? combineSequentialPiResults(accumulated, result)
             : result;
         const committedAfter = input.committedFactCount();
-        const committedFactsOnlySuccess = session.id !== "finalize" &&
-            !(result.assistantText ?? "").trim() &&
+        const committedFactsOnlySuccess = !(result.assistantText ?? "").trim() &&
             !result.stderr.trim() &&
             !result.timedOut &&
             committedAfter > committedBefore;
@@ -5094,16 +6280,14 @@ export async function runFrontendPlanSegmentedSessions(input) {
                 ? buildCompactLocalPrompt(missing)
                 : isUxRegistrySession
                     ? buildUxRegistryPrompt(missing)
-                    : session.id === "finalize" && useCompactSmallPlan
-                        ? buildCompactFinalizePrompt(missing)
-                        : isUxLocalSession
-                            ? buildUxPrompt(session.requirementSlice ?? [], missing)
-                            : buildPhasePrompt(globalMockDataSegment, missing, session.requirementSlice ?? allRequirementIds);
+                    : isUxLocalSession
+                        ? buildUxPrompt(session.requirementSlice ?? [], missing)
+                        : buildPhasePrompt(globalMockDataSegment, missing, session.requirementSlice ?? allRequirementIds);
         const recovery = classifyFrontendPlanRecovery({ ...result, stopReason: readWriterThinkingExhaustionEvidence(result).stopReason });
         if (recovery === "stop")
             return { ...result, ok: false };
         if ((recovery === "output" || (session.atomicRecovery && result.ok)) && input.committedFacts &&
-            !(missingPhaseFacts.length === 1 && missingPhaseFacts[0].kind === "plan-requirement") &&
+            !(missingPhaseFacts.length === 1 && missingPhaseFacts[0]?.kind === "plan-requirement") &&
             (session.coverageOnly || isUxRegistrySession || isUxLocalSession || session.id.startsWith("global-mock-data"))) {
             if (missingPhaseFacts.length === 0) {
                 // A complete validated slice does not need a successful prose turn.
@@ -5329,6 +6513,91 @@ export async function runFrontendPlanSegmentedSessions(input) {
             failureCategory: "invalid-output",
         };
     }
+    if (!input.parallelCoverageOnly && input.finalizePlan) {
+        // Preserve optional closeout context if an earlier correction or future
+        // ledger producer committed it. The old model-only finalize session was
+        // the only writer of these fields; runtime-owned finalization must not
+        // silently erase them when they are already available.
+        const optionalPlanFields = {};
+        for (const record of input.committedFacts?.() ?? []) {
+            const fact = committedFactFromPlanRecord(record);
+            if (!fact)
+                continue;
+            if (Array.isArray(fact.residualRisks)) {
+                optionalPlanFields.residualRisks = fact.residualRisks.filter((item) => typeof item === "string" && item.trim().length > 0);
+            }
+            if (typeof fact.realIntegrationGap === "string" && fact.realIntegrationGap.trim()) {
+                optionalPlanFields.realIntegrationGap = fact.realIntegrationGap;
+            }
+        }
+        let finalizeResult = await input.finalizePlan(optionalPlanFields);
+        const finalizeDetails = finalizeResult && typeof finalizeResult === "object"
+            ? (finalizeResult.details ?? finalizeResult)
+            : finalizeResult;
+        if (!finalizeDetails ||
+            typeof finalizeDetails !== "object" ||
+            finalizeDetails.ok !== true) {
+            // Normal plans never open a finalize model session. Keep the old
+            // correction/recovery semantic only for a rejected deterministic
+            // compile: give the planner one bounded repair pass, then retry the
+            // same runtime authority. The correction prompt explicitly forbids
+            // calling finalize_plan, so terminal ownership remains deterministic.
+            const correctionPrompt = [
+                input.basePrompt,
+                "PLAN FINALIZE CORRECTION — the runtime compile rejected the committed ledger.",
+                `Runtime error: ${String(finalizeDetails?.error ?? "plan finalize rejected")}`,
+                "Repair only the reported facts with the typed record_* tools. Do not call finalize_plan; the runtime will retry it after this correction.",
+                input.committedFacts ? compactFrontendPlanLedgerContext({ committedFacts: input.committedFacts(), requirementIds: input.requirementIds ?? [], kinds: ["plan-requirement", "plan-verification-target", "state-registry", "component-choice", "state-flow", "data-flow", "mock-api", "design-deviation", "dependency", "target-surface"] }) : "",
+            ].filter(Boolean).join("\n\n");
+            input.setActiveRequirementScope?.([]);
+            const correctionTools = input.segmentCustomTools(null);
+            const correction = await input.piStepFn({
+                ...input.sessionOptions,
+                prompt: correctionPrompt,
+                writerToolPolicy: { requireSdk: true, customTools: correctionTools },
+            });
+            try {
+                await input.flushLedger();
+            }
+            catch { /* node-level flush retries below */ }
+            accumulated = accumulated
+                ? combineSequentialPiResults(accumulated, correction)
+                : correction;
+            if (correction.ok) {
+                finalizeResult = await input.finalizePlan(optionalPlanFields);
+            }
+            const retriedDetails = finalizeResult && typeof finalizeResult === "object"
+                ? (finalizeResult.details ?? finalizeResult)
+                : finalizeResult;
+            if (retriedDetails && typeof retriedDetails === "object" && retriedDetails.ok === true) {
+                return mapPlannerExhaustion(accumulated ?? { ok: true, stdout: "", stderr: "", assistantText: "", command: [], durationMs: 0, exitCode: 0, failureCategory: "success", modelDisplay: "runtime-finalize", parsedEvents: 0, timedOut: false, attemptedModels: [], fallbackUsed: false, tokensUsed: 0 }, true);
+            }
+            const detail = retriedDetails && typeof retriedDetails === "object"
+                ? String(retriedDetails.error ?? "plan finalize rejected")
+                : "plan finalize rejected";
+            return {
+                ...(accumulated ?? {
+                    ok: false,
+                    stdout: "",
+                    stderr: "",
+                    assistantText: "",
+                    command: [],
+                    durationMs: 0,
+                    exitCode: null,
+                    failureCategory: "invalid-output",
+                    modelDisplay: "unknown",
+                    parsedEvents: 0,
+                    timedOut: false,
+                    attemptedModels: [],
+                    fallbackUsed: false,
+                    tokensUsed: 0,
+                }),
+                ok: false,
+                stderr: `${accumulated?.stderr ?? ""}\nfrontend plan deterministic finalize failed: ${detail}`.trim(),
+                failureCategory: "invalid-output",
+            };
+        }
+    }
     return mapPlannerExhaustion(accumulated ?? {
         ok: false,
         stdout: "",
@@ -5622,6 +6891,10 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     let reviewInventory;
     let designInventory;
     let planLedgerTools;
+    let decisionPlanTools;
+    let parentDecisionSnapshot;
+    let decisionPlanAuthority;
+    const useDecisionPlan = process.env.HARNESS_FRONTEND_PLAN_DECISION === "1";
     let contractTools;
     let scoutEvidenceTools;
     let scoutSourceDeclaredPaths;
@@ -5721,9 +6994,23 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 runDir: meta.runDir,
                 nodeId: input.task.id,
             });
+            // Pre-session protocol self-check: an absent index silently disables
+            // the scope-checkpoint protocol (inventory-less terminals approve
+            // vacuously), so a broken upstream must fail here, before any model
+            // call, instead of degrading the review.
+            if (!reviewInventory) {
+                return {
+                    ok: false,
+                    stdout: "",
+                    stderr: "pi review terminal tool policy unavailable before Pi execution: contracts/frontend-implementation-contract.index.json missing; the review-context gate must materialize the canonical contract index before this node starts",
+                    failureCategory: "tool-policy",
+                    durationMs: Date.now() - started,
+                };
+            }
             writerToolPolicy = {
                 requireSdk: true,
                 customTools: reviewTerminalTools.customTools,
+                requireAllowlistedCustomTools: true,
             };
         }
         catch (error) {
@@ -5748,9 +7035,22 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 runDir: meta.runDir,
                 nodeId: input.task.id,
             });
+            // Same pre-session self-check as the review terminal above: without
+            // the index the scope checkpoints disappear and the design verdict
+            // loses its binding to the reviewed slices.
+            if (!designInventory) {
+                return {
+                    ok: false,
+                    stdout: "",
+                    stderr: "pi design terminal tool policy unavailable before Pi execution: contracts/frontend-implementation-contract.index.json missing; the design-policy shell must materialize the canonical contract index before this node starts",
+                    failureCategory: "tool-policy",
+                    durationMs: Date.now() - started,
+                };
+            }
             writerToolPolicy = {
                 requireSdk: true,
                 customTools: designTerminalTools.customTools,
+                requireAllowlistedCustomTools: true,
             };
         }
         catch (error) {
@@ -5781,6 +7081,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             writerToolPolicy = {
                 requireSdk: true,
                 customTools: contractTools.customTools,
+                requireAllowlistedCustomTools: true,
             };
         }
         catch (error) {
@@ -5814,6 +7115,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             writerToolPolicy = {
                 requireSdk: true,
                 customTools: scoutEvidenceTools.customTools,
+                requireAllowlistedCustomTools: true,
             };
         }
         catch (error) {
@@ -5830,30 +7132,66 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         try {
             const { createTypedEventStore } = await import("../workflows/dag/frontend-typed-event-store.js");
             const store = createTypedEventStore();
-            planLedgerTools = await createFrontendPlanLedgerTools({
-                attemptId: `${meta.runId}:${input.task.id}`,
-                store,
-                runDir: meta.runDir,
-                nodeId: input.task.id,
-                skeleton: input.task.structuredContractOutput?.skeleton,
-                sourceBinding: meta.spec.sourceBinding,
-                writeSetPatterns: input.task.writeSet,
-                componentNewSourceReferences: await resolveFrontendPlanNewComponentSourceReferences({
-                    cwd: input.cwd,
+            if (useDecisionPlan) {
+                const authority = await resolveFrontendDecisionAuthority({
+                    runDir: meta.runDir,
                     sourceBinding: meta.spec.sourceBinding,
-                }),
-                declaredUiStateIds: await resolveFrontendDeclaredUiStateIds({
+                    task: input.task,
+                });
+                if (!authority)
+                    throw new Error("frontend decision authority unavailable (missing contract inheritance or source binding)");
+                decisionPlanAuthority = authority;
+                if (useDecisionPlan) {
+                    // Recovery child: read the parent snapshot before the tools so
+                    // the replay and the identical-plan finalize guard share it.
+                    parentDecisionSnapshot = await readParentDecisionSnapshot(meta.runDir, input.task.id);
+                }
+                decisionPlanTools = await createFrontendPlanDecisionTools({
+                    attemptId: `${meta.runId}:${input.task.id}`,
+                    store,
                     runDir: meta.runDir,
-                }),
-                canonicalVerificationTargetIds: await resolveFrontendCanonicalVerificationTargetIds({
+                    nodeId: input.task.id,
+                    authority,
+                    ...(useDecisionPlan && parentDecisionSnapshot
+                        ? { parentDecisionSnapshot }
+                        : {}),
+                    componentSpecCandidatePaths: meta.spec.tasks.find((task) => task.id === "frontend-design-policy-shell")?.shell?.frontendDesignPolicy?.componentSpecCandidatePaths ?? [],
+                    skeleton: input.task.structuredContractOutput?.skeleton,
+                    sourceBinding: meta.spec.sourceBinding,
+                });
+                writerToolPolicy = {
+                    requireSdk: true,
+                    customTools: decisionPlanTools.customTools,
+                    requireAllowlistedCustomTools: true,
+                };
+            }
+            else {
+                planLedgerTools = await createFrontendPlanLedgerTools({
+                    attemptId: `${meta.runId}:${input.task.id}`,
+                    store,
                     runDir: meta.runDir,
-                }),
-                workspaceRoot: input.cwd,
-            });
-            writerToolPolicy = {
-                requireSdk: true,
-                customTools: planLedgerTools.customTools,
-            };
+                    nodeId: input.task.id,
+                    skeleton: input.task.structuredContractOutput?.skeleton,
+                    sourceBinding: meta.spec.sourceBinding,
+                    writeSetPatterns: input.task.writeSet,
+                    componentNewSourceReferences: await resolveFrontendPlanNewComponentSourceReferences({
+                        cwd: input.cwd,
+                        sourceBinding: meta.spec.sourceBinding,
+                    }),
+                    declaredUiStateIds: await resolveFrontendDeclaredUiStateIds({
+                        runDir: meta.runDir,
+                    }),
+                    canonicalVerificationTargetIds: await resolveFrontendCanonicalVerificationTargetIds({
+                        runDir: meta.runDir,
+                    }),
+                    workspaceRoot: input.cwd,
+                });
+                writerToolPolicy = {
+                    requireSdk: true,
+                    customTools: planLedgerTools.customTools,
+                    requireAllowlistedCustomTools: true,
+                };
+            }
         }
         catch (error) {
             return {
@@ -5872,6 +7210,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 budget: input.task.readBudget,
             });
             writerToolPolicy = {
+                ...(writerToolPolicy ?? {}),
                 requireSdk: true,
                 customTools: [
                     ...(writerToolPolicy?.customTools ?? []),
@@ -6016,6 +7355,136 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 },
             });
         }
+        else if (isFrontendPlanLedgerNode(input.task) && decisionPlanTools) {
+            // Experimental decision path: one session records semantic decisions;
+            // the runtime finalizes and derives the safety projection afterwards.
+            // Use a decision-specific prompt: the relationship subtask_prompt names
+            // tools this toolset does not expose and never states behavior-group ids,
+            // so reusing it leaves every requirement unplaced.
+            // D (local design repair): a recovery child replays the parent run's
+            // committed decision facts through its own durable tools BEFORE the model
+            // session starts. The model then only corrects the rows the design review
+            // flagged (same identity + replace:true) instead of re-deriving the plan.
+            if (parentDecisionSnapshot && parentDecisionSnapshot.facts.length > 0) {
+                try {
+                    await replayParentDecisionSnapshot(parentDecisionSnapshot, decisionPlanTools.customTools);
+                }
+                catch (error) {
+                    return {
+                        ok: false,
+                        stdout: "",
+                        stderr: `parent decision replay failed before Pi execution: ${error instanceof Error ? error.message : String(error)}`,
+                        failureCategory: "invalid-output",
+                        durationMs: Date.now() - started,
+                    };
+                }
+            }
+            const decisionPrompt = decisionPlanAuthority
+                ? (() => {
+                    const base = buildFrontendDecisionPlanPrompt(decisionPlanAuthority);
+                    // Preserve node-execution's retry guidance (appended to
+                    // input.prompt as a <retry_instruction> tail) so a failed
+                    // decision attempt tells the next session exactly which
+                    // decision facts to repair instead of replaying the identical
+                    // under-declared plan. The relationship body of input.prompt is
+                    // deliberately dropped (its tools do not exist in this toolset).
+                    if ((input.attempt ?? 1) > 1) {
+                        const marker = input.prompt.indexOf("<retry_instruction>");
+                        if (marker >= 0) {
+                            const tail = input.prompt.slice(marker).trim();
+                            if (tail.length > 0) {
+                                return `${base}\n\n${tail}`;
+                            }
+                        }
+                    }
+                    if (parentDecisionSnapshot && parentDecisionSnapshot.facts.length > 0) {
+                        const identityOf = (entry) => String(entry.purpose ??
+                            entry.state ??
+                            entry.interaction ??
+                            entry.id ??
+                            entry.boundary ??
+                            "?");
+                        const ledger = parentDecisionSnapshot.facts
+                            .map((fact) => `- ${fact.kind}: ${identityOf(fact.entry)}`)
+                            .join("\n");
+                        return `${base}\n\n<parent_decision_repair>\nYour ledger is pre-loaded with the parent run's committed decision facts (replayed by the runtime before this session):\n${ledger}\nThe <rerun_feedback> findings name the rows that blocked admission. Correct ONLY those rows: resubmit the corrected entry with the SAME natural identity and replace:true. Do not restate unrelated rows and do not add rows the findings do not require. Then call finalize_decision.\n</parent_decision_repair>`;
+                    }
+                    return base;
+                })()
+                : input.prompt;
+            const decisionResult = await piStepFn({
+                ...piSessionOptions,
+                prompt: decisionPrompt,
+                writerToolPolicy: { requireSdk: true, customTools: decisionPlanTools.customTools },
+            });
+            try {
+                await decisionPlanTools.flush();
+            }
+            catch { /* node-level flush retries below */ }
+            const finalizeResult = await decisionPlanTools.finalizeDecision();
+            const finalizeDetails = finalizeResult && typeof finalizeResult === "object"
+                ? (finalizeResult.details ?? finalizeResult)
+                : finalizeResult;
+            if (finalizeDetails && typeof finalizeDetails === "object" && finalizeDetails.ok === true) {
+                // Bridge the finalized decisions into the relationship-shaped plan
+                // ledger. The node-level R1 self-check and all downstream shells
+                // compile ONLY plan-typed-facts.jsonl; without this write the whole
+                // decision run fails "frontend plan ledger missing" at R1 on every
+                // attempt. Validation failures surface as invalid-output so the
+                // retry ladder restarts the session with the diagnostics.
+                try {
+                    const bridge = await bridgeFrontendPlanDecisionToRelationshipLedger({
+                        runDir: meta.runDir,
+                        nodeId: input.task.id,
+                        attemptId: `${meta.runId}:${input.task.id}`,
+                        facts: decisionPlanTools.committedFacts(),
+                        authority: decisionPlanAuthority,
+                        skeleton: input.task.structuredContractOutput?.skeleton,
+                        sourceBinding: meta.spec.sourceBinding,
+                    });
+                    if (!bridge.ok) {
+                        throw new Error(bridge.error);
+                    }
+                    result = decisionResult;
+                }
+                catch (error) {
+                    result = {
+                        ok: false,
+                        stdout: decisionResult.stdout ?? "",
+                        stderr: `${decisionResult.stderr ?? ""}\n${error instanceof Error ? error.message : String(error)}`.trim(),
+                        failureCategory: "invalid-output",
+                        durationMs: Date.now() - started,
+                        modelDisplay: decisionResult.modelDisplay,
+                        parsedEvents: decisionResult.parsedEvents,
+                        timedOut: decisionResult.timedOut,
+                        attemptedModels: decisionResult.attemptedModels,
+                        fallbackUsed: decisionResult.fallbackUsed,
+                        tokensUsed: decisionResult.tokensUsed,
+                        assistantText: decisionResult.assistantText ?? "",
+                        command: decisionResult.command ?? [],
+                        exitCode: decisionResult.exitCode,
+                    };
+                }
+            }
+            else {
+                result = {
+                    ok: false,
+                    stdout: decisionResult.stdout ?? "",
+                    stderr: `${decisionResult.stderr ?? ""}\nfrontend decision finalize failed: ${String(finalizeDetails?.error ?? "decision finalize rejected")}`.trim(),
+                    failureCategory: "invalid-output",
+                    durationMs: Date.now() - started,
+                    modelDisplay: decisionResult.modelDisplay,
+                    parsedEvents: decisionResult.parsedEvents,
+                    timedOut: decisionResult.timedOut,
+                    attemptedModels: decisionResult.attemptedModels,
+                    fallbackUsed: decisionResult.fallbackUsed,
+                    tokensUsed: decisionResult.tokensUsed,
+                    assistantText: decisionResult.assistantText ?? "",
+                    command: decisionResult.command ?? [],
+                    exitCode: decisionResult.exitCode,
+                };
+            }
+        }
         else if (isFrontendPlanLedgerNode(input.task) && planLedgerTools) {
             // Frontend-only split: independent coverage map sessions feed a single
             // reducer (UX decisions -> global policy -> finalize), mirroring the
@@ -6025,7 +7494,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             const planRequirementCosts = new Map();
             const behaviorRequiredRequirementIds = [];
             try {
-                const { readCommittedOriginFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+                const { readCommittedOriginFacts } = await import("../workflows/dag/frontend-committed-facts.js");
                 const contractFacts = await readCommittedOriginFacts(meta.runDir, "frontend-contract-pi", "contract-typed-facts.jsonl");
                 // Only requirement facts: the contract ledger also carries
                 // constraints (CON-*), evidence expectations (EV-*), handoff
@@ -6033,11 +7502,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 // (SPLIT-*) that all have ids — feeding those into the coverage
                 // batches made the model record non-frozen plan-requirement ids
                 // that finalize's canonical-coverage gate then rejected (r-ext2).
-                planRequirementIds = contractFacts
-                    .filter((record) => record.fact
-                    ?.kind === "requirement")
-                    .map((record) => record.fact?.id)
-                    .filter((id) => typeof id === "string");
+                planRequirementIds = collectFrontendPlanRequirementIds(contractFacts);
                 for (const fact of resolveFrontendContractRequirements(contractFacts.map((record) => record.fact))) {
                     if (fact.evidence.behavior === "required")
                         behaviorRequiredRequirementIds.push(fact.id);
@@ -6078,6 +7543,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                     : {}),
                 committedRequirementIds: () => options.ledgerTools.committedRequirementIds(),
                 committedFacts: () => options.ledgerTools.committedFacts(),
+                finalizePlan: (params) => options.ledgerTools.finalizePlan(params),
                 behaviorRequiredRequirementIds,
                 setActiveRequirementScope: (requirementIds) => options.ledgerTools.setActiveRequirementScope(requirementIds),
                 segmentCustomTools: (toolNames) => toolNames === null
@@ -6088,12 +7554,9 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                 flushLedger: () => options.ledgerTools.flush(),
             });
             if (planRequirementIds.length > 1) {
-                const coverageTools = FRONTEND_PLAN_SEGMENTS.find(segment => segment.id === "coverage").toolNames;
                 const workload = buildFrontendPlanWorkload({
                     basePrompt: input.prompt, requirementIds: planRequirementIds,
                     requirementCosts: planRequirementCosts, sessionOptions: piSessionOptions,
-                    allTools: planLedgerTools.customTools,
-                    coverageTools: planLedgerTools.customTools.filter(tool => isRecordObject(tool) && coverageTools.has(String(tool.name))),
                 });
                 let coverageBatches;
                 try {
@@ -6383,12 +7846,12 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     if (readBudgetIssues.length > 0) {
         const hasTypedFrontendTerminal = isFrontendReviewTypedTerminalNode(input.task) ||
             isFrontendDesignTypedTerminalNode(input.task);
-        // A stale/generated DAG may still carry the legacy read budget. Once a
+        // A stale/generated DAG may still carry an older read budget. Once a
         // design/review node has a successful typed terminal, telemetry is
-        // diagnostic only; the terminal shadow below still fails closed when the
+        // diagnostic only; the typed terminal validation below still fails closed when the
         // fact is missing or conflicting.
         if (mapped.ok && hasTypedFrontendTerminal) {
-            // Continue to the typed terminal shadow validation below.
+            // Continue to the typed terminal validation below.
         }
         else {
             // Read-budget telemetry is diagnostic only when the provider/executor
@@ -6414,7 +7877,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         }
     }
     if (isFrontendReviewTypedTerminalNode(input.task)) {
-        return await runFrontendReviewTerminalShadow({
+        return await validateFrontendReviewTerminal({
             task: input.task,
             meta,
             mapped,
@@ -6422,7 +7885,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
         });
     }
     if (isFrontendDesignTypedTerminalNode(input.task)) {
-        return await runFrontendDesignTerminalShadow({
+        return await validateFrontendDesignTerminal({
             task: input.task,
             meta,
             mapped,
@@ -6445,7 +7908,7 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
             return { ...mapped, ok: false, failureCategory: mapped.ok ? "frontend-ledger-invalid" : mapped.failureCategory, stderr: `${mapped.stderr}\nFRONTEND_LEDGER_INTEGRITY_INVALID: ${error instanceof Error ? error.message : String(error)}` };
         }
         if (mapped.ok) {
-            const { checkCommittedOriginFacts, readCommittedOriginFacts } = await import("../workflows/dag/frontend-shadow-dual-write.js");
+            const { checkCommittedOriginFacts, readCommittedOriginFacts } = await import("../workflows/dag/frontend-committed-facts.js");
             const scoutFacts = await readCommittedOriginFacts(meta.runDir, input.task.id, "scout-typed-facts.jsonl");
             const completeness = checkCommittedOriginFacts({
                 records: scoutFacts,
@@ -6677,15 +8140,15 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
     let factDerivedStatus;
     if (mapped.ok && input.task.writerOutcomePolicy) {
         if (isFrontendFactsWriter(input.task)) {
-            // AC-001/AC-003: facts-derived status. The first line is never read;
-            // the legacy validator still runs for the shadow comparison only.
+            // AC-001/AC-003: facts-derived status. The response text is never
+            // consulted for frontend writer completion.
             try {
                 const [writerStatus, contractModule, traceModule] = await Promise.all([
                     import("../workflows/dag/frontend-writer-status.js"),
                     import("../workflows/dag/frontend-implementation-contract.js"),
                     import("../workflows/dag/frontend-verification-trace.js"),
                 ]);
-                const { collectFrontendWriterFacts, deriveFrontendWriterStatus, computeFailureFingerprint, compareFactStatusToLegacyOutcome, } = writerStatus;
+                const { collectFrontendWriterFacts, deriveFrontendWriterStatus, computeFailureFingerprint, } = writerStatus;
                 const contractPath = path.join(meta.runDir, "contracts", "frontend-implementation-contract.json");
                 const contractRaw = JSON.parse(await readFile(contractPath, "utf8"));
                 const parsedContract = contractModule.frontendImplementationContractSchema.safeParse(contractRaw);
@@ -6716,19 +8179,9 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                     wallTimeMs: Date.now() - started,
                     rounds: 1,
                     writeAttempts: attempt,
-                    firstLineText: mapped.assistantText,
                 });
                 const derived = deriveFrontendWriterStatus(facts);
                 factDerivedStatus = derived.status;
-                const legacyValidation = validateWriterImplementationOutcome(mapped.assistantText || mapped.stdout, changeManifestChangedFiles ?? [], {
-                    requireChangedFiles: false,
-                    allowMissingChangedOutcomeWhenDiffPresent: false,
-                });
-                const legacyOutcome = legacyValidation.ok
-                    ? legacyValidation.outcome
-                    : legacyValidation.reason.includes("blocked")
-                        ? "blocked"
-                        : "missing";
                 await writeDagNodeJsonArtifact(meta.runDir, input.task.id, "fact-implementation-status.json", {
                     schemaVersion: 1,
                     nodeId: input.task.id,
@@ -6745,7 +8198,6 @@ export async function executeDagPiNode(input, meta, piStepFn = executePiStep, wr
                     rounds: facts.rounds,
                     writeAttempts: facts.writeAttempts,
                     failureFingerprint: computeFailureFingerprint(facts),
-                    shadow: compareFactStatusToLegacyOutcome(derived.status, legacyOutcome),
                 });
                 if (derived.status !== "changed" &&
                     derived.status !== "already-satisfied") {