@tea-agent/loop-agent 0.44.0-next.1 → 0.44.0-next.11

package/dist/workflows/dag/runner.js

@@ -1,44 +1,32 @@
+import { assertFrontendPairExecution } from "../../application/evaluation/frontend-pair-registration.js";
+import { sourceBudgetContractIdentity } from "../../application/evaluation/budget.js";
+import { summarizeFrozenSourceUsage } from "../../task/source-prepare/source-provider-budget.js";
+import { sha256OfCanonicalJson } from "../../task/contract/hash.js";
 import { readdir, readFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
 import { writeJsonAtomic } from "../../infrastructure/harness/atomic-write.js";
 import { hostname } from "node:os";
 import path from "node:path";
-import { isHardBudgetBreached, resolveEffectiveMaxConcurrent, } from "../../application/evaluation/budget.js";
+import { resolveEffectiveMaxConcurrent, } from "../../application/evaluation/budget.js";
 import { readCandidateRecord } from "../../infrastructure/evaluation/candidate-store.js";
 import { CANONICAL_TASK_ID_PATTERN, formatLocalCompactDate, } from "../../task/runtime.js";
-import { assertFrozenBudget, initRunBudgetLedger, preflightBudgetOrBreach, recordFinishedNodeBudget, validateCumulativeBudgetSuccessor, writeBudgetLedgerArtifacts, } from "./budget-enforcement.js";
-import { getDagRunDir, isTerminalDagRunStatus, locateDagRun, readHumanApprovalArtifact, readDagRunState, requireActiveDagRun, } from "./lifecycle.js";
-import { markInterruptNeedsReconcile, mergeAbortSignals, readInterruptRequest, runnerIdentityFromState, settleDagInterrupt, startInterruptWatcher, } from "./interrupt-request.js";
-import { moveToCompletedRunDir, moveToPausedRunDir, prepareRunDir, writeRunSpec, writeRunState, } from "./run-store.js";
-import { evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
-import { createDagNodeExecutor } from "./executor-registry.js";
-import { executeDagPiNode } from "../../executors/dag-pi-executor.js";
+import { assertFrozenBudget, initRunBudgetLedger, } from "./budget-enforcement.js";
+import { getDagRunDir, isTerminalDagRunStatus, locateDagRun, readHumanApprovalArtifact, requireActiveDagRun, } from "./lifecycle.js";
+import { prepareRunDir, writeRunSpec, writeRunState, } from "./run-store.js";
 import { assertValidDagSpec } from "./validate.js";
 import { assertRuntimeContractCompatible, DAG_CONTROLLER_CAPABILITIES, } from "./runtime-contract.js";
 import { captureControllerIdentity, verifyControllerIdentityForResume, } from "./controller-identity.js";
 import { resolveRunningControllerIdentity } from "../../shared/package-metadata.js";
 import { normalizeDagPromptSources } from "./prompt-source.js";
-import { relocateConvergenceArtifactPaths, relocateRunArtifactPaths, } from "./upstream-artifacts.js";
 import { createSkillSnapshot, prepareSkillSnapshotForContinuation, writeSkillSnapshot, } from "./skill-snapshot.js";
-import { captureWorkspaceCheckpoint, WORKSPACE_CHECKPOINT_START_REL, WORKSPACE_CHECKPOINT_TERMINAL_REL, writeWorkspaceCheckpoint, } from "./workspace-checkpoint.js";
-import { buildNodePrompt, buildNodePromptWithResolvedSkillInstructions, executeDagNode, } from "./node-execution.js";
-import { runConvergencePassController, } from "./convergence/controller.js";
-import { executeDagRanksOnce, FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT, FRONTEND_WRITER_NODE_IDS, isConditionSkippedReason, readFrontendPrewriteResult, } from "./scheduler.js";
+import { captureWorkspaceCheckpoint, WORKSPACE_CHECKPOINT_START_REL, writeWorkspaceCheckpoint, } from "./workspace-checkpoint.js";
+import { buildNodePrompt, buildNodePromptWithResolvedSkillInstructions, } from "./node-execution.js";
 import { topoSortToRanks } from "./topo.js";
-import { isFrontendWriterTransientPartialWrite } from "./frontend-writer-recovery.js";
-import { classifyReviewIssueCategoryFailureOwner, readCommittedDesignRequestFact, readCommittedReviewRequestFact, writeFrontendReviewFindingsPrd, } from "./frontend-review-findings.js";
-import { bindFrontendShapeStateToRunTopology, commitFrontendShapeTransitionCas, commitRuntimeFrontendShapeFact, isCanonicalFrontendShapeDag, } from "./frontend-shape-facts.js";
-import { assertFrontendTopologyBinding, buildFrontendTopologyBinding, computeFrontendShapeSourceDigest, } from "./frontend-shape.js";
-import { ensureFrontendShapeCapsuleRecord } from "./frontend-shape-capsule-store.js";
+import { isCanonicalFrontendShapeDag, } from "./frontend-shape-facts.js";
+import { assertFrontendTopologyBinding, buildFrontendTopologyBinding, } from "./frontend-shape.js";
 import { parseDagSpec, resolveModelForTask, } from "./types.js";
-import { computeActionPayloadHash, } from "../../infrastructure/console/operation-store.js";
-import { classifyFailureOwner, failureOwnerSchema } from "./frontend-recovery-capsule.js";
-import { acquireDagRecoveryLease, bindDagRecoveryLeaseExecution, claimDagRecoveryLease, } from "./recovery-lease.js";
-import { executeDynamicCondition } from "./dynamic-runtime/condition.js";
-import { executeDynamicLoopUntil } from "./dynamic-runtime/loop-until.js";
-import { executeDynamicMapExpansion } from "./dynamic-runtime/map.js";
-import { executeDynamicReduction } from "./dynamic-runtime/reduction.js";
-import { installRunnerExitDiagnostics } from "./runner-exit-diagnostics.js";
+import { executeDagCheckpoint, notifyRunObserver, } from "./checkpoint.js";
+export { buildCandidateContractInvalidResult, buildWriterPartialWriteBlockedResult, buildRecoveryResultForTrigger, collectSupersededIntermediateFailures, finalizeTerminalRunStatus, isSuccessfulConvergenceTerminal, createRecoveryOperation, SUCCESSFUL_CONVERGENCE_TERMINAL_REASONS } from "./terminal-status.js";
+export { assertRecoveredFrontendLineage, finalizeRunOwnedInterrupt, buildRankAwareExecuteNode, executeDagCheckpoint, concurrentSiblingWriteSetsForNode, ensureFreshFrontendShapeCapsuleRecord, loadCanonicalFrontendTaskSourceBinding, notifyRunObserver } from "./checkpoint.js";
 export { buildNodePrompt, buildNodePromptWithResolvedSkillInstructions };
 export async function loadDagSpecFromFile(dagPath) {
     const raw = JSON.parse(await readFile(dagPath, "utf-8"));
@@ -54,51 +42,6 @@ export function toKebabSlug(text, maxLen = 40) {
         .replace(/^-|-$/g, "")
         .slice(0, maxLen) || "dag");
 }
-export async function loadCanonicalFrontendTaskSourceBinding(cwd, spec) {
-    const binding = spec.sourceBinding;
-    if (!binding?.taskId)
-        throw new Error("canonical frontend DAG requires sourceBinding.taskId");
-    const requirement = binding.sources.find((source) => source.kind === "requirement");
-    if (!requirement)
-        throw new Error("canonical frontend DAG requires a bound requirement source");
-    const constraint = binding.sources.find((source) => source.kind === "constraint");
-    const readFreshSource = async (source) => {
-        let bytes;
-        try {
-            bytes = await readFile(path.resolve(cwd, source.path));
-        }
-        catch (error) {
-            throw new Error(`canonical frontend ${source.kind} source freshness read failed: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        const actualSha256 = createHash("sha256").update(bytes).digest("hex");
-        if (actualSha256 !== source.sha256) {
-            throw new Error(`canonical frontend ${source.kind} source sha256 drifted: expected ${source.sha256}, received ${actualSha256}`);
-        }
-        return bytes.toString("utf8");
-    };
-    const requirementMarkdown = await readFreshSource(requirement);
-    const constraintMarkdown = constraint ? await readFreshSource(constraint) : "";
-    return {
-        taskId: binding.taskId,
-        requirementMarkdown,
-        constraintMarkdown,
-        sourceDigest: computeFrontendShapeSourceDigest({ requirementMarkdown, constraintMarkdown }),
-    };
-}
-export async function ensureFreshFrontendShapeCapsuleRecord(input) {
-    const freshSource = await loadCanonicalFrontendTaskSourceBinding(input.cwd, input.spec);
-    if (freshSource.taskId !== input.canonicalSource.taskId ||
-        freshSource.sourceDigest !== input.canonicalSource.sourceDigest) {
-        throw new Error("canonical frontend task source freshness binding drifted before transition commit");
-    }
-    await (input.ensureRecord ?? ensureFrontendShapeCapsuleRecord)({
-        repoRoot: input.cwd,
-        taskId: input.canonicalSource.taskId,
-        parentRunId: input.parentRunId,
-        terminalOutcome: input.terminalOutcome,
-        capsule: input.capsule,
-    });
-}
 export function extractTaskIdFromDagSpec(spec) {
     if (spec.objective) {
         const match = spec.objective.match(TASK_ID_IN_TEXT_PATTERN);
@@ -244,6 +187,17 @@ export function createInitialRunState(spec, opts, ranks, runId = opts.runId ?? "
             : {}),
     };
     initRunBudgetLedger(state, spec.budget);
+    if (spec.sourceProviderBudget) {
+        if (sha256OfCanonicalJson(spec.sourceProviderBudget.contract ?? null) !== sha256OfCanonicalJson(sourceBudgetContractIdentity(spec.taskContractBinding) ?? null) || !state.budgetLedger || spec.sourceProviderBudget.ledger.taskId !== spec.sourceBinding?.taskId || spec.sourceProviderBudget.ledger.maxProviderRequests !== state.budgetLedger.limits.maxProviderRequests || spec.sourceProviderBudget.sourceBindingSha256 !== sha256OfCanonicalJson(spec.sourceBinding))
+            throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: source snapshot does not match DAG");
+        state.sourceProviderBudget = structuredClone(spec.sourceProviderBudget);
+        state.budgetLedger.consumed.providerRequests = spec.sourceProviderBudget.ledger.reservedRequests;
+        const sourceUsage = summarizeFrozenSourceUsage(spec.sourceProviderBudget);
+        if (sourceUsage.complete)
+            state.budgetLedger.consumed.tokens = sourceUsage.totalTokens;
+        else if (spec.sourceProviderBudget.ledger.reservedRequests > 0)
+            state.budgetLedger.consumed.missingTokenNodeIds.push(`task-budget:${spec.sourceProviderBudget.ledger.budgetId}`);
+    }
     return state;
 }
 export function assertFrozenEvaluationBinding(spec, state) {
@@ -280,6 +234,12 @@ export async function runDag(spec, opts) {
     if (!runningIdentity) {
         throw new Error("running controller identity could not be resolved; refuse to create an unpinned DAG run");
     }
+    if (spec.evaluation?.frontendPair)
+        await assertFrontendPairExecution({
+            repoRoot: opts.cwd, binding: spec.evaluation,
+            controllerFingerprint: runningIdentity.packageFingerprint.value,
+            startedAt: new Date().toISOString(),
+        });
     assertRuntimeContractCompatible(spec, {
         ...DAG_CONTROLLER_CAPABILITIES,
         controllerVersion: runningIdentity.packageVersion,
@@ -453,6 +413,12 @@ export async function resumeDagRun(opts) {
     if (!runningIdentity) {
         throw new Error("running controller identity could not be resolved; refuse to resume an unpinned DAG run");
     }
+    if (spec.evaluation?.frontendPair)
+        await assertFrontendPairExecution({
+            repoRoot: opts.cwd, binding: spec.evaluation,
+            controllerFingerprint: runningIdentity.packageFingerprint.value,
+            startedAt: state.startedAt,
+        });
     assertRuntimeContractCompatible(spec, {
         ...DAG_CONTROLLER_CAPABILITIES,
         controllerVersion: runningIdentity.packageVersion,
@@ -521,947 +487,12 @@ export async function resumeDagRun(opts) {
     finally {
     }
 }
-async function executeDagCheckpoint(input) {
-    const { spec, state, ranks, runDir: initialRunDir, cwd, maxConcurrent, completedRunDir, pausedRunDir, } = input;
-    bindFrontendShapeStateToRunTopology(state);
-    let runDir = initialRunDir;
-    let stateWriteQueue = Promise.resolve();
-    let shapeTransitionBarrier;
-    const persistState = async (options) => {
-        if (shapeTransitionBarrier)
-            await shapeTransitionBarrier;
-        stateWriteQueue = stateWriteQueue.then(() => writeRunState(runDir, state, options));
-        await stateWriteQueue;
-    };
-    const runnerLivenessPolicy = resolveLivenessPolicy(spec.defaults?.livenessPolicy);
-    const heartbeatTimer = setInterval(() => {
-        if (!state.runner)
-            return;
-        // Runner lease only — never counts as meaningful Pi progress.
-        state.runner.heartbeatAt = new Date().toISOString();
-        const tasksByIdForPolicy = new Map(spec.tasks.map((task) => [task.id, task]));
-        for (const node of Object.values(state.nodes)) {
-            if (node.status !== "RUNNING")
-                continue;
-            // Lease clock is separate from meaningful activity.
-            node.lastLeaseAt = state.runner.heartbeatAt;
-            const task = tasksByIdForPolicy.get(node.id);
-            const policy = resolveLivenessPolicy(spec.defaults?.livenessPolicy, task?.livenessPolicy);
-            const evaluation = evaluateNodeLiveness({
-                node,
-                policy,
-                runnerHeartbeatAt: state.runner.heartbeatAt,
-            });
-            node.livenessStatus = evaluation.status;
-            // Intentionally do NOT refresh lastActivityAt / lastMeaningfulProgressAt
-            // from the runner lease timer.
-        }
-        void persistState().catch(() => { });
-    }, runnerLivenessPolicy.heartbeatIntervalMs);
-    heartbeatTimer.unref();
-    await persistState();
-    const interruptController = new AbortController();
-    const expectedRunnerIdentity = runnerIdentityFromState(state);
-    const interruptWatcher = expectedRunnerIdentity
-        ? startInterruptWatcher({
-            runDir,
-            runId: state.runId,
-            expectedRunnerIdentity,
-            controller: interruptController,
-        })
-        : undefined;
-    const abortSignal = mergeAbortSignals(input.abortSignal, interruptController.signal);
-    // Graceful terminal persistence: an outer SIGTERM/SIGINT (operator hard
-    // timeout, supervision layer, or shell wall-clock) must not leave the run
-    // orphaned in RUNNING with a dead heartbeat. Persist a terminal failed
-    // state with an explicit terminalReason before exiting so downstream
-    // liveness/doctor tooling sees a diagnosable terminal instead of an orphan.
-    let terminalSignal;
-    const shutdownOnSignal = (signal) => {
-        if (terminalSignal)
-            return;
-        terminalSignal = signal;
-        clearInterval(heartbeatTimer);
-        if (state.runner)
-            state.runner.heartbeatAt = new Date().toISOString();
-        state.status = "failed";
-        state.finishedAt = new Date().toISOString();
-        state.terminalReason = `runner terminated by ${signal} before run completion`;
-        console.warn(`[run-dag] received ${signal}; persisting terminal state and exiting`);
-        const exit = () => process.exit(signal === "SIGINT" ? 130 : 143);
-        // Best-effort atomic persist with a hard exit deadline so a stuck write
-        // queue cannot keep the process alive past the supervisor's kill window.
-        const hardExit = setTimeout(exit, 5000);
-        hardExit.unref();
-        void persistState()
-            .catch(() => { })
-            .finally(() => {
-            clearTimeout(hardExit);
-            exit();
-        });
-    };
-    const onSigTerm = () => shutdownOnSignal("SIGTERM");
-    const onSigInt = () => shutdownOnSignal("SIGINT");
-    process.once("SIGTERM", onSigTerm);
-    process.once("SIGINT", onSigInt);
-    // Exit-time diagnostics (silent-death forensics): write an `armed` line at
-    // checkpoint start and append process-exit / uncaught-exception /
-    // unhandled-rejection lines with a live state snapshot so an abnormal death
-    // (supervisor hard kill, wedged event loop, crash with lost stderr) leaves
-    // a durable trace next to state.json. Removed on clean terminal return.
-    const exitDiagnostics = installRunnerExitDiagnostics({
-        runDir,
-        runId: state.runId,
-        title: state.title,
-        snapshot: () => {
-            const heartbeatAt = state.runner?.heartbeatAt;
-            return {
-                status: state.status,
-                terminalReason: state.terminalReason,
-                failureCategory: state.failureCategory,
-                heartbeatAt,
-                heartbeatAgeMs: heartbeatAt === undefined
-                    ? undefined
-                    : Math.max(0, Date.now() - Date.parse(heartbeatAt)),
-                running: Object.values(state.nodes)
-                    .filter((node) => node.status === "RUNNING")
-                    .map((node) => ({
-                    id: node.id,
-                    attempt: node.currentAttempt,
-                    startedAt: node.startedAt,
-                    lastMeaningfulProgressAt: node.lastMeaningfulProgressAt,
-                })),
-            };
-        },
-    });
-    try {
-        const tasksById = new Map(spec.tasks.map((task) => [task.id, task]));
-        const baseExecuteNode = input.executeNode ??
-            createDagNodeExecutor({
-                runDir,
-                runId: state.runId,
-                spec,
-            });
-        const executeDynamicNode = async (dynamicInput) => {
-            const { task } = dynamicInput;
-            if (task.dynamicExpansion) {
-                return executeDynamicMapExpansion({
-                    ...dynamicInput,
-                    expansion: task.dynamicExpansion,
-                    executeDynamicNode,
-                });
-            }
-            if (task.dynamicCondition) {
-                return executeDynamicCondition({
-                    task,
-                    condition: task.dynamicCondition,
-                    tasksById: dynamicInput.tasksById,
-                    state: dynamicInput.state,
-                });
-            }
-            if (task.dynamicLoopUntil) {
-                return executeDynamicLoopUntil({
-                    ...dynamicInput,
-                    loop: task.dynamicLoopUntil,
-                    executeDynamicNode,
-                });
-            }
-            return executeDynamicReduction({
-                task,
-                reduction: task.dynamicReduction,
-                state: dynamicInput.state,
-                runDir: dynamicInput.runDir,
-            });
-        };
-        const deferTerminalCloseout = state.convergence !== undefined && tasksById.has("closeout-pi");
-        const convergenceRanks = deferTerminalCloseout
-            ? ranks
-                .map((rank) => rank.filter((nodeId) => nodeId !== "closeout-pi"))
-                .filter((rank) => rank.length > 0)
-            : ranks;
-        const terminalCloseoutRanks = deferTerminalCloseout
-            ? ranks
-                .map((rank) => rank.filter((nodeId) => nodeId === "closeout-pi"))
-                .filter((rank) => rank.length > 0)
-            : [];
-        const canonicalFrontendSource = isCanonicalFrontendShapeDag(tasksById)
-            ? await loadCanonicalFrontendTaskSourceBinding(cwd, spec)
-            : undefined;
-        const executeRanks = (selectedRanks) => executeDagRanksOnce({
-            state,
-            ranks: selectedRanks,
-            tasksById,
-            maxConcurrent,
-            persistState,
-            commitFrontendShapeTransition: async (request) => {
-                let releaseBarrier;
-                shapeTransitionBarrier = new Promise((resolve) => {
-                    releaseBarrier = resolve;
-                });
-                try {
-                    if (!canonicalFrontendSource) {
-                        throw new Error("frontend shape transition requires canonical task source binding");
-                    }
-                    return await commitFrontendShapeTransitionCas({
-                        state,
-                        tasksById,
-                        request,
-                        taskSourceDigest: canonicalFrontendSource.sourceDigest,
-                        ensureRecord: async (capsule, terminalOutcome) => {
-                            await ensureFreshFrontendShapeCapsuleRecord({
-                                cwd,
-                                spec,
-                                canonicalSource: canonicalFrontendSource,
-                                parentRunId: state.runId,
-                                terminalOutcome,
-                                capsule,
-                            });
-                        },
-                        persist: async (nextState) => {
-                            stateWriteQueue = stateWriteQueue.then(() => writeRunState(runDir, nextState));
-                            await stateWriteQueue;
-                        },
-                    });
-                }
-                finally {
-                    releaseBarrier();
-                    shapeTransitionBarrier = undefined;
-                }
-            },
-            runDir,
-            abortSignal: input.abortSignal,
-            createExecuteNodeForRank: (rankWriterNodeIds) => buildRankAwareExecuteNode({
-                baseExecuteNode,
-                customExecuteNode: input.executeNode,
-                rankWriterNodeIds,
-                tasksById,
-                meta: { runDir, runId: state.runId, spec },
-            }),
-            executeScheduledNode: async (nodeId, executeNode, onPause) => {
-                if (abortSignal?.aborted)
-                    return;
-                if (isHardBudgetBreached(state.budgetLedger))
-                    return;
-                const preBreach = preflightBudgetOrBreach(state);
-                if (preBreach && isHardBudgetBreached(state.budgetLedger)) {
-                    await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
-                    await persistState();
-                    return;
-                }
-                await executeDagNode({
-                    nodeId,
-                    tasksById,
-                    state,
-                    spec,
-                    cwd,
-                    runDir,
-                    executeNode,
-                    executeDynamicNode,
-                    observer: input.observer,
-                    persistState,
-                    onPause,
-                });
-                const node = state.nodes[nodeId];
-                if (node && (node.status === "FINISHED" || node.status === "ERROR")) {
-                    if (node.status === "FINISHED") {
-                        if (canonicalFrontendSource) {
-                            await commitRuntimeFrontendShapeFact({
-                                state,
-                                tasksById,
-                                sourceNodeId: nodeId,
-                                taskId: canonicalFrontendSource.taskId,
-                                requirementMarkdown: canonicalFrontendSource.requirementMarkdown,
-                                constraintMarkdown: canonicalFrontendSource.constraintMarkdown,
-                            });
-                        }
-                    }
-                    recordFinishedNodeBudget(state, node);
-                    await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
-                    await persistState();
-                }
-            },
-        });
-        let pausedByNodeId;
-        while (true) {
-            pausedByNodeId = await executeRanks(convergenceRanks);
-            if (state.frontendShapeState?.terminalOutcome) {
-                break;
-            }
-            if (pausedByNodeId) {
-                break;
-            }
-            if (isHardBudgetBreached(state.budgetLedger)) {
-                break;
-            }
-            const convergenceDecision = await runConvergencePassController({
-                spec,
-                state,
-                tasksById,
-                runDir,
-                cwd,
-                persistState,
-            });
-            if (convergenceDecision.pausedByNodeId) {
-                pausedByNodeId = convergenceDecision.pausedByNodeId;
-                break;
-            }
-            if (convergenceDecision.retry) {
-                continue;
-            }
-            break;
-        }
-        if (!pausedByNodeId &&
-            terminalCloseoutRanks.length > 0 &&
-            state.convergence?.terminalReason &&
-            !isHardBudgetBreached(state.budgetLedger)) {
-            // Convergence closeout is a terminal phase, not an ordinary descendant
-            // rank. Running it only after the controller records terminalReason avoids
-            // stale success handoffs on intermediate request-revision passes while
-            // still producing a truthful failure handoff for max-passes/non-retry.
-            pausedByNodeId = await executeRanks(terminalCloseoutRanks);
-        }
-        interruptWatcher?.stop();
-        // Stop heartbeats before terminal archive. A late heartbeat writing
-        // state.json under completed/ trips the completed-facts write guard and
-        // makes run-dag exit non-zero after every node already finished.
-        clearInterval(heartbeatTimer);
-        await stateWriteQueue;
-        state.finishedAt = new Date().toISOString();
-        const runDirBeforeTransfer = runDir;
-        await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
-        if (pausedByNodeId) {
-            state.status = "paused";
-            await finalizeRunOwnedInterrupt({
-                runDir,
-                state,
-                paused: true,
-                interruptAborted: interruptController.signal.aborted,
-            });
-            await persistState();
-            await notifyRunObserver(input.observer, "onRunFinish", state);
-            runDir = await moveToPausedRunDir(runDir, pausedRunDir);
-        }
-        else {
-            const { recoveryPending, recovery: recoveryTrigger } = await finalizeTerminalRunStatus(state, spec.tasks.length, runDir, cwd, spec.frontendRecovery?.maxContinuations ?? 1);
-            await finalizeRunOwnedInterrupt({
-                runDir,
-                state,
-                paused: false,
-                interruptAborted: interruptController.signal.aborted,
-            });
-            await persistState();
-            if (recoveryPending && input.recovery && recoveryTrigger) {
-                // M6 recovery operation controller path: construct/reuse one recovery
-                // operation keyed by a deterministic clientRequestId and supervise it
-                // to terminal, instead of staging an in-process child run.
-                const created = await createRecoveryOperation({
-                    cwd,
-                    runDir,
-                    spec,
-                    state,
-                    trigger: recoveryTrigger,
-                    deps: input.recovery,
-                });
-                if (created.kind === "conflict") {
-                    // Same clientRequestId with a different payload → fail closed; never
-                    // create a second recovery operation (AC-004).
-                    state.status = "failed";
-                    state.terminalReason =
-                        "frontend recovery request-id reuse conflict";
-                    state.frontendRecoveryResult = buildRecoveryResultForTrigger(state, recoveryTrigger, "auto-recovery-blocked");
-                }
-                else if (created.kind === "lease-held") {
-                    // A different recovery entrance has already durably claimed this
-                    // parent. Do not "help" by running its operation: that would reopen
-                    // the exact two-child-DAG race the lease prevents.
-                    state.status = "failed";
-                    state.terminalReason =
-                        "frontend recovery parent lease already held";
-                    state.frontendRecoveryResult = buildRecoveryResultForTrigger(state, recoveryTrigger, "auto-recovery-blocked");
-                }
-                else {
-                    const { runRecoveryOperationController } = await import("./frontend-recovery-controller.js");
-                    const result = await runRecoveryOperationController({
-                        operationId: created.operation.operationId,
-                        parentRunId: state.runId,
-                        observeOnly: created.kind === "observed",
-                        deps: {
-                            ...input.recovery,
-                            budget: input.recovery.budget ?? state.budget,
-                            readLedgers: input.recovery.readLedgers ?? (async () => {
-                                if (!state.budget)
-                                    return [];
-                                const location = await locateDagRun(cwd, state.runId);
-                                let current = await readDagRunState(location?.runDir ?? runDir);
-                                const visited = new Set([current.runId]);
-                                while (current.frontendRecoveryState?.parentRunId === current.runId && current.frontendRecoveryState.childRunId && current.frontendRecoveryState.childRunId !== current.runId) {
-                                    if (["child-staging", "child-activating"].includes(current.frontendRecoveryState.phase))
-                                        break;
-                                    const childId = current.frontendRecoveryState.childRunId;
-                                    if (visited.has(childId))
-                                        throw Error("FRONTEND_PROVIDER_BUDGET_LINEAGE_INVALID: cyclic recovery");
-                                    visited.add(childId);
-                                    const childLocation = await locateDagRun(cwd, childId);
-                                    if (!childLocation)
-                                        throw Error("FRONTEND_PROVIDER_BUDGET_LINEAGE_INVALID: missing recovery child");
-                                    const child = await readDagRunState(childLocation.runDir);
-                                    validateCumulativeBudgetSuccessor(current, child);
-                                    current = child;
-                                }
-                                if (!current.budgetLedger)
-                                    throw Error("FRONTEND_PROVIDER_BUDGET_INVALID: recovery ledger missing");
-                                return [current.budgetLedger];
-                            }),
-                            failureOwner: input.recovery.failureOwner ??
-                                recoveryTrigger.failureOwner,
-                            protocolFailureReason: input.recovery.protocolFailureReason ??
-                                recoveryTrigger.protocolFailureReason,
-                            recoveryMode: input.recovery.recoveryMode ?? recoveryTrigger.recoveryMode,
-                        },
-                    });
-                    // The recovery CLI stages its child by writing a fresh
-                    // `frontendRecoveryState` into the parent run on disk. A successful
-                    // operation without that bound lineage is not a successful recovery:
-                    // fail closed instead of archiving a false-positive `recovered` result.
-                    let recoveryLineageError;
-                    if (result.terminalReason === "succeeded") {
-                        try {
-                            const persistedParentState = await readDagRunState(runDir);
-                            const persistedRecovery = persistedParentState.frontendRecoveryState;
-                            if (!persistedRecovery ||
-                                persistedRecovery.phase !== "child-running" ||
-                                persistedRecovery.parentRunId !== state.runId ||
-                                persistedRecovery.requestId !== recoveryTrigger.requestId ||
-                                !persistedRecovery.childRunId) {
-                                throw new Error("persisted recovery lineage is missing or unbound");
-                            }
-                            await assertRecoveredFrontendLineage({
-                                cwd,
-                                rootRunId: state.runId,
-                                rootRequestId: recoveryTrigger.requestId,
-                                recovery: persistedRecovery,
-                                maxContinuations: spec.frontendRecovery?.maxContinuations ?? 1,
-                            });
-                            state.frontendRecoveryState = structuredClone(persistedRecovery);
-                        }
-                        catch (error) {
-                            recoveryLineageError =
-                                error instanceof Error ? error.message : String(error);
-                            state.status = "failed";
-                            state.terminalReason =
-                                `frontend recovery lineage invalid: ${recoveryLineageError}`;
-                        }
-                    }
-                    state.frontendRecoveryResult = buildRecoveryResultForTrigger(state, recoveryTrigger, result.terminalReason === "succeeded" && !recoveryLineageError
-                        ? "recovered"
-                        : "auto-recovery-blocked");
-                }
-            }
-            await notifyRunObserver(input.observer, "onRunFinish", state);
-            if (input.beforeTerminalArchive) {
-                await input.beforeTerminalArchive({ runDir, state });
-                await persistState();
-            }
-            // Parent is always archived to completed/ — no active/ retention for an
-            // in-process child CAS anymore (recovery runs as a separate operation).
-            try {
-                const terminalCheckpoint = await captureWorkspaceCheckpoint(cwd);
-                await writeWorkspaceCheckpoint(runDir, WORKSPACE_CHECKPOINT_TERMINAL_REL, terminalCheckpoint);
-            }
-            catch (error) {
-                console.warn(`[run-dag] warning: failed to write workspace terminal checkpoint: ${error instanceof Error ? error.message : String(error)}`);
-            }
-            runDir = await moveToCompletedRunDir(runDir, completedRunDir);
-        }
-        await relocateRunArtifactPaths({
-            runDir,
-            oldRunDir: runDirBeforeTransfer,
-            nodes: state.nodes,
-        });
-        if (state.convergence) {
-            relocateConvergenceArtifactPaths(state.convergence, runDirBeforeTransfer, runDir);
-        }
-        await writeBudgetLedgerArtifacts(runDir, state.budgetLedger);
-        await persistState({ allowCompletedFactsWrite: true });
-        return {
-            title: state.title,
-            runId: state.runId,
-            status: state.status,
-            ranks,
-            nodes: state.nodes,
-            runDir,
-        };
-    }
-    finally {
-        clearInterval(heartbeatTimer);
-        interruptWatcher?.stop();
-        exitDiagnostics.stop();
-        process.removeListener("SIGTERM", onSigTerm);
-        process.removeListener("SIGINT", onSigInt);
-    }
-}
-async function assertRecoveredFrontendLineage(input) {
-    const maxContinuations = Math.max(1, Math.min(5, input.maxContinuations));
-    let parentRunId = input.rootRunId;
-    let recovery = input.recovery;
-    const recoveryRootRunId = recovery.recoveryRootRunId;
-    const visited = new Set();
-    if (recoveryRootRunId !== input.rootRunId) {
-        throw new Error("recovery root lineage binding mismatch");
-    }
-    for (let depth = 0; depth < maxContinuations; depth += 1) {
-        // The persisted parent intent represents the edge about to be traversed,
-        // so its counters equal the number of already-completed continuation edges.
-        // Each completed child increments both counters exactly once; no edge may
-        // exceed the frozen DAG quota.
-        if (recovery.continuationCount !== depth ||
-            recovery.attemptIndex !== depth) {
-            throw new Error("recovery child lineage counters are not monotonic");
-        }
-        if (recovery.phase !== "child-running" ||
-            recovery.parentRunId !== parentRunId ||
-            recovery.recoveryRootRunId !== recoveryRootRunId ||
-            !recovery.childRunId ||
-            (depth === 0
-                ? recovery.requestId !== input.rootRequestId
-                : recovery.requestId !== parentRunId)) {
-            throw new Error("persisted recovery lineage is missing or unbound");
-        }
-        if (visited.has(recovery.childRunId)) {
-            throw new Error("recovery child lineage contains a cycle");
-        }
-        visited.add(recovery.childRunId);
-        const child = await locateDagRun(input.cwd, recovery.childRunId);
-        if (!child || child.lifecycle !== "completed") {
-            throw new Error("recovery child is not completed");
-        }
-        const childState = await readDagRunState(child.runDir);
-        if (childState.runId !== recovery.childRunId) {
-            throw new Error("recovery child state binding mismatch");
-        }
-        if (childState.status === "finished")
-            return;
-        if (childState.frontendRecoveryResult?.outcome !== "recovered" ||
-            !childState.frontendRecoveryState) {
-            throw new Error("recovery child terminal state is not successful");
-        }
-        parentRunId = childState.runId;
-        recovery = childState.frontendRecoveryState;
-    }
-    throw new Error("recovery child lineage exceeds the continuation quota");
-}
-async function finalizeRunOwnedInterrupt(input) {
-    const request = await readInterruptRequest(input.runDir);
-    if (!request)
-        return;
-    if (request.status === "settled" || request.status === "needs-reconcile") {
-        return;
-    }
-    const hasUnconfirmed = Object.values(input.state.nodes).some((node) => node.failureCategory === "termination-unconfirmed");
-    if (hasUnconfirmed || input.paused) {
-        await markInterruptNeedsReconcile({
-            runDir: input.runDir,
-            outcome: hasUnconfirmed
-                ? "termination-unconfirmed"
-                : "paused-before-settle",
-        });
-        return;
-    }
-    if (input.interruptAborted &&
-        request.status === "acknowledged" &&
-        (input.state.status === "failed" ||
-            input.state.status === "partial_failed" ||
-            input.state.failureCategory === "controller-interrupted")) {
-        await settleDagInterrupt({
-            runDir: input.runDir,
-            outcome: "controller-interrupted",
-        });
-        return;
-    }
-    if (request.status === "requested") {
-        await markInterruptNeedsReconcile({
-            runDir: input.runDir,
-            outcome: "runner-did-not-acknowledge",
-        });
-        return;
-    }
-    await markInterruptNeedsReconcile({
-        runDir: input.runDir,
-        outcome: "run-exited-before-interrupt-settled",
-    });
-}
-async function notifyRunObserver(observer, event, state) {
-    try {
-        await observer?.[event]?.(state);
-    }
-    catch {
-        // Observers are derived views; they must not affect canonical DAG execution.
-    }
-}
-const SUCCESSFUL_CONVERGENCE_TERMINAL_REASONS = new Set([
-    "review-pass",
-    "hard-verify-pass",
-]);
 /**
  * Intermediate soft-verify failures may be excluded from terminal error
  * aggregation only when repair + final hard verify succeeded and, when a review
  * gate is present, convergence ended in review-pass. Historical node status is
  * never rewritten.
  */
-function collectSupersededIntermediateFailures(state) {
-    const supersededIds = new Set();
-    const supersededFailures = [];
-    const soft = state.nodes["soft-verify-shell"];
-    if (!soft || soft.status !== "ERROR") {
-        return { supersededIds, supersededFailures };
-    }
-    const repair = state.nodes["repair-pi"];
-    const hard = state.nodes["hard-verify-shell"];
-    if (repair?.status !== "FINISHED" || hard?.status !== "FINISHED") {
-        return { supersededIds, supersededFailures };
-    }
-    const observesReview = Boolean(state.nodes["review-gate-shell"]);
-    const terminalReason = state.convergence?.terminalReason;
-    if (observesReview) {
-        if (terminalReason !== "review-pass") {
-            return { supersededIds, supersededFailures };
-        }
-    }
-    else if (terminalReason && terminalReason !== "hard-verify-pass") {
-        return { supersededIds, supersededFailures };
-    }
-    // Evidence: at least one successful repair pass after soft failure, with hard verify finished in terminal state.
-    const hasRepairEvidence = !state.convergence?.enabled ||
-        state.convergence.passHistory.some((pass) => pass.reason === "hard-verify-failed" ||
-            pass.reason === "review-request-revision" ||
-            pass.status === "retrying") ||
-        repair.status === "FINISHED";
-    if (!hasRepairEvidence) {
-        return { supersededIds, supersededFailures };
-    }
-    supersededIds.add("soft-verify-shell");
-    supersededFailures.push({
-        nodeId: "soft-verify-shell",
-        preservedStatus: "ERROR",
-        supersededBy: ["repair-pi", "hard-verify-shell"],
-        pass: state.convergence?.currentPass,
-        reason: "intermediate-soft-verify-covered-by-repair-and-final-hard",
-    });
-    return { supersededIds, supersededFailures };
-}
-function isSuccessfulConvergenceTerminal(state) {
-    const reason = state.convergence?.terminalReason;
-    if (!reason)
-        return true;
-    return SUCCESSFUL_CONVERGENCE_TERMINAL_REASONS.has(reason);
-}
-function buildCandidateContractInvalidResult(state, result, artifactHash) {
-    return {
-        schemaVersion: 1,
-        outcome: "candidate-contract-invalid",
-        origin: {
-            kind: "frontend-prewrite-gate",
-            parentRunId: state.runId,
-            requestId: state.runId,
-            failedNodeId: result.failureSource ?? "frontend-plan-pi",
-        },
-        failureClass: {
-            code: "candidate-contract-invalid",
-            classification: result.classification,
-            reason: result.findings.map((finding) => `${finding.code}: ${finding.message}`).join("; ") ??
-                "candidate contract invalid",
-        },
-        evidenceRefs: [
-            {
-                runId: state.runId,
-                relativePath: FRONTEND_PREWRITE_RESULT_SOURCE_ARTIFACT,
-                sha256: artifactHash,
-            },
-        ],
-    };
-}
-function buildWriterPartialWriteBlockedResult(state, failedNodeId, reason) {
-    return {
-        schemaVersion: 1,
-        outcome: "auto-recovery-blocked",
-        origin: {
-            kind: "frontend-writer",
-            parentRunId: state.runId,
-            requestId: state.runId,
-            failedNodeId,
-        },
-        failureClass: {
-            code: "writer-transient-partial-write",
-            classification: "transient",
-            reason,
-        },
-        evidenceRefs: [],
-    };
-}
-function buildRecoveryResultForTrigger(state, trigger, outcome) {
-    return {
-        schemaVersion: 1,
-        outcome,
-        origin: {
-            kind: trigger.failureSource === "frontend-implement-pi"
-                ? "frontend-writer"
-                : "frontend-prewrite-gate",
-            parentRunId: state.runId,
-            requestId: trigger.requestId,
-            failedNodeId: trigger.failureSource,
-        },
-        evidenceRefs: [],
-    };
-}
-export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd, frontendRecoveryQuota = 1) {
-    const repoRoot = cwd ?? path.resolve(runDir, "..", "..", "..", "..");
-    if (state.frontendShapeState?.terminalOutcome &&
-        state.frontendShapeState.transitionCapsule) {
-        state.status = "failed";
-        return { recoveryPending: false };
-    }
-    // Terminal override: a denied frontend writer must never surface as a
-    // mechanical partial_failed just because prewrite FINISHED while the writer
-    // was SKIPPED. Fail closed on blocked before aggregation.
-    let recoveryTrigger;
-    const skipFrontendRecovery = state.failureCategory === "controller-interrupted" ||
-        state.continuation?.writerTransaction !== undefined;
-    const hasFrontendWriter = Object.keys(state.nodes).some((id) => FRONTEND_WRITER_NODE_IDS.includes(id));
-    if (hasFrontendWriter && !skipFrontendRecovery) {
-        const admission = await readFrontendPrewriteResult(runDir);
-        if (admission.ok) {
-            // M8: admission uses the accepted/blocked state machine. A blocked admission whose
-            // failureSource is frontend-plan-pi is the contract-invalid analog of
-            // the old retryable-invalid path (candidate continuation may re-plan);
-            // every other blocked admission is terminal.
-            const planContractInvalid = admission.result.classification === "blocked" &&
-                admission.result.failureSource === "frontend-plan-pi";
-            // A blocked admission caused by the design review committing
-            // `request_design_changes` is a definite finding (not a protocol or
-            // environment error): the design was reviewed and rejected. It is the
-            // design-review analog of review-request-changes — not terminal, but
-            // re-enters the next plan round with the committed design findings.
-            // The failureSource may be frontend-writer-admission-shell or
-            // frontend-design-policy-shell; the committed design fact is the
-            // authoritative signal.
-            const designRequestFact = await readCommittedDesignRequestFact({
-                runDir,
-            });
-            const designRejected = admission.result.classification === "blocked" &&
-                designRequestFact !== undefined;
-            const terminalAdmissionDenial = (admission.result.classification === "blocked" ||
-                admission.result.classification === "stale") &&
-                !planContractInvalid &&
-                !designRejected;
-            if (terminalAdmissionDenial) {
-                state.status = "failed";
-                return { recoveryPending: false };
-            }
-            if (designRejected && designRequestFact) {
-                state.terminalReason = "design-request-changes";
-                try {
-                    await writeFrontendReviewFindingsPrd({
-                        runDir,
-                        parentRunId: state.runId,
-                        fact: designRequestFact,
-                    });
-                }
-                catch (error) {
-                    console.warn(`[run-dag] warning: failed to write frontend design findings PRD: ${error instanceof Error ? error.message : String(error)}`);
-                }
-                const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-                if (continuationCount < frontendRecoveryQuota) {
-                    recoveryTrigger = {
-                        requestId: state.runId,
-                        // The rejected design is a plan input defect. Reset from the
-                        // planner so the next child can incorporate the committed
-                        // findings before design review runs again.
-                        failureSource: "frontend-plan-pi",
-                        failureOwner: classifyReviewIssueCategoryFailureOwner(designRequestFact.issueCategory),
-                        protocolFailureReason: `frontend design review request_design_changes (issueCategory=${designRequestFact.issueCategory})`,
-                        recoveryMode: "new-dag",
-                    };
-                }
-            }
-            if (planContractInvalid) {
-                const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-                if (continuationCount >= frontendRecoveryQuota) {
-                    // Continuation quota exhausted: a second contract-invalid candidate
-                    // is authoritative candidate-contract-invalid → forced failed.
-                    state.frontendRecoveryResult = buildCandidateContractInvalidResult(state, admission.result, admission.artifactHash);
-                    state.status = "failed";
-                    return { recoveryPending: false };
-                }
-                // Root continuation still available: emit a recovery trigger for the
-                // M6 operation controller. The parent no longer writes
-                // frontendRecoveryState or stays in active/ for a child CAS.
-                recoveryTrigger = {
-                    requestId: state.runId,
-                    failureSource: admission.result.failureSource ?? "frontend-plan-pi",
-                    failureOwner: "plan",
-                    protocolFailureReason: "frontend candidate contract invalid",
-                    recoveryMode: "new-dag",
-                };
-            }
-        }
-    }
-    // Phase 5: writer transient partial write → rollback + recovery trigger.
-    // Only for frontend-implementation writers with a remaining root
-    // continuation, and only when the rollback journal (captured before the
-    // provider call) restores cleanly; otherwise the run stays failed with
-    // auto-recovery-blocked.
-    if (hasFrontendWriter && !recoveryTrigger && !skipFrontendRecovery) {
-        const writerNodeId = FRONTEND_WRITER_NODE_IDS.find((id) => {
-            const node = state.nodes[id];
-            return (node &&
-                node.status === "ERROR" &&
-                isFrontendWriterTransientPartialWrite({
-                    failureCategory: node.failureCategory,
-                }));
-        });
-        if (writerNodeId) {
-            const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-            if (continuationCount < frontendRecoveryQuota) {
-                const { rollbackFrontendWriter } = await import("./frontend-writer-recovery.js");
-                const rollback = await rollbackFrontendWriter({
-                    cwd: repoRoot,
-                    parentRunId: state.runId,
-                });
-                if (rollback.ok) {
-                    recoveryTrigger = {
-                        requestId: state.runId,
-                        failureSource: "frontend-implement-pi",
-                        failureOwner: "implementation",
-                        protocolFailureReason: "frontend writer transient partial write",
-                        recoveryMode: "continuation",
-                    };
-                }
-                else {
-                    state.frontendRecoveryResult = buildWriterPartialWriteBlockedResult(state, writerNodeId, rollback.reason);
-                    state.status = "failed";
-                    return { recoveryPending: false };
-                }
-            }
-        }
-    }
-    // Phase 6: verification failure → automatic recovery (re-implement +
-    // re-verify). The verify shell is terminal by design so the failed run's
-    // evidence stays clean; the M6 recovery operation re-runs implement and
-    // verify in a fresh continuation, guarded by the same continuation quota,
-    // budget fold and failure fingerprint as the other recovery paths.
-    if (hasFrontendWriter && !recoveryTrigger && !skipFrontendRecovery) {
-        const verifyFailed = state.nodes["frontend-verify-shell"]?.status === "ERROR";
-        if (verifyFailed) {
-            const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-            if (continuationCount < frontendRecoveryQuota) {
-                let recoveryOwner = classifyFailureOwner({
-                    nodeId: "frontend-verify-shell",
-                    rawFailureCategory: state.nodes["frontend-verify-shell"]?.failureCategory,
-                });
-                try {
-                    const verifyFailure = JSON.parse(await readFile(path.join(runDir, "contracts/frontend-verify-failure.json"), "utf8"));
-                    const owner = failureOwnerSchema.safeParse(verifyFailure.failureOwner);
-                    if (verifyFailure.schemaVersion === 1 &&
-                        verifyFailure.schemaId === "frontend-verify-failure-v1" &&
-                        verifyFailure.nodeId === "frontend-verify-shell" &&
-                        verifyFailure.failureCategory === state.nodes["frontend-verify-shell"]?.failureCategory &&
-                        owner.success) {
-                        recoveryOwner = owner.data;
-                    }
-                    else {
-                        recoveryOwner = "unknown";
-                    }
-                }
-                catch {
-                    // The node's classified category remains the fallback; never turn
-                    // unknown/environment/configuration failures into writer work.
-                }
-                if (recoveryOwner === "implementation")
-                    recoveryTrigger = {
-                        requestId: state.runId,
-                        failureSource: "frontend-verify-shell",
-                        failureOwner: recoveryOwner,
-                        protocolFailureReason: "frontend verification failure",
-                        recoveryMode: "continuation",
-                    };
-                else
-                    state.terminalReason = recoveryOwner === "environment"
-                        ? "frontend-verification-wait-external"
-                        : `frontend-verification-${recoveryOwner}-requires-contract-review`;
-            }
-        }
-    }
-    // Phase 7: frontend review "request changes" → not passed. When the review
-    // node FINISHED but committed `request_review_changes` (typed terminal
-    // verdict), the implementation was reviewed and rejected. The run must not
-    // surface as finished: terminal aggregation below stays partial_failed, a
-    // terminal reason is recorded, the committed findings are rendered into a
-    // downstream-task PRD draft (run-owned), and a recovery trigger carries the
-    // issueCategory-derived owner so a later DAG round consumes the findings
-    // instead of repeating the previous flow.
-    const reviewRequestFact = await readCommittedReviewRequestFact({
-        runDir,
-    });
-    if (reviewRequestFact) {
-        state.terminalReason = "review-request-changes";
-        try {
-            await writeFrontendReviewFindingsPrd({
-                runDir,
-                parentRunId: state.runId,
-                fact: reviewRequestFact,
-            });
-        }
-        catch (error) {
-            // The PRD draft is additive; a write failure must not mask the
-            // not-passed verdict. The terminal aggregation below still applies.
-            console.warn(`[run-dag] warning: failed to write frontend review findings PRD: ${error instanceof Error ? error.message : String(error)}`);
-        }
-        if (!recoveryTrigger && !skipFrontendRecovery) {
-            const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
-            if (continuationCount < frontendRecoveryQuota) {
-                recoveryTrigger = {
-                    requestId: state.runId,
-                    failureSource: "frontend-review-pi",
-                    failureOwner: classifyReviewIssueCategoryFailureOwner(reviewRequestFact.issueCategory),
-                    protocolFailureReason: `frontend review request_review_changes (issueCategory=${reviewRequestFact.issueCategory})`,
-                    recoveryMode: "new-dag",
-                };
-            }
-        }
-    }
-    const finishedCount = Object.values(state.nodes).filter((n) => n.status === "FINISHED").length;
-    const { supersededIds, supersededFailures } = collectSupersededIntermediateFailures(state);
-    if (state.convergence && supersededFailures.length > 0) {
-        state.convergence.supersededFailures = supersededFailures;
-    }
-    // Prefer map keys: DagNodeRecord may not always mirror the map key on `.id`.
-    const effectiveErrorCount = Object.entries(state.nodes).filter(([nodeId, n]) => n.status === "ERROR" && !supersededIds.has(nodeId)).length;
-    const supersededErrorCount = Object.entries(state.nodes).filter(([nodeId, n]) => n.status === "ERROR" && supersededIds.has(nodeId)).length;
-    const conditionSkippedCount = Object.values(state.nodes).filter((n) => n.status === "SKIPPED" && isConditionSkippedReason(n.skippedReason)).length;
-    const successTerminal = isSuccessfulConvergenceTerminal(state);
-    // Superseded intermediate ERRORs remain ERROR in history but count as settled
-    // for terminal aggregation only (they do not inflate effectiveErrorCount).
-    if (effectiveErrorCount === 0 &&
-        successTerminal &&
-        finishedCount + conditionSkippedCount + supersededErrorCount === taskCount) {
-        // Phase 7 guard: a committed `request_review_changes` means the review
-        // rejected the implementation; the run must never surface as finished
-        // even though every node technically FINISHED.
-        state.status =
-            state.terminalReason === "review-request-changes"
-                ? "partial_failed"
-                : "finished";
-    }
-    else if (finishedCount > 0) {
-        state.status = "partial_failed";
-    }
-    else {
-        state.status = "failed";
-    }
-    return recoveryTrigger
-        ? { recoveryPending: true, recovery: recoveryTrigger }
-        : { recoveryPending: false };
-}
 /**
  * Construct (or reuse) the recovery operation for a failed frontend run.
  *
@@ -1475,155 +506,3 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd, f
  * parent feedback through the managed rerun path. `planHash` is the second
  * idempotency dimension of `actionParams`.
  */
-async function createRecoveryOperation(input) {
-    const { cwd, runDir, spec, state, trigger } = input;
-    const recoveryLease = await acquireDagRecoveryLease({
-        cwd,
-        parentRunId: state.runId,
-        requestId: trigger.requestId,
-        kind: "auto-frontend-recovery",
-    });
-    let effectiveLease = recoveryLease;
-    let observeOnly = false;
-    if (recoveryLease.kind === "held") {
-        if (recoveryLease.lease.kind !== "auto-frontend-recovery" ||
-            recoveryLease.lease.requestId !== trigger.requestId) {
-            return { kind: "lease-held", lease: recoveryLease.lease };
-        }
-        const claimed = await claimDagRecoveryLease({
-            leasePath: recoveryLease.leasePath,
-            lease: recoveryLease.lease,
-        });
-        effectiveLease = claimed;
-        if (claimed.kind === "held") {
-            if (!claimed.lease.executionRef) {
-                return { kind: "lease-held", lease: claimed.lease };
-            }
-            observeOnly = true;
-        }
-    }
-    const { computeFrontendRecoveryPlanForSource } = await import("./frontend-recovery-plan.js");
-    const plan = computeFrontendRecoveryPlanForSource({
-        spec,
-        parentRunId: state.runId,
-        requestId: trigger.requestId,
-        failureSource: trigger.failureSource,
-    });
-    const planHash = createHash("sha256")
-        .update(JSON.stringify(plan))
-        .digest("hex");
-    const continuationPath = path.join(runDir, ".runtime", "frontend-recovery", `${trigger.requestId}.json`);
-    await writeJsonAtomic(continuationPath, {
-        schemaVersion: 1,
-        parentRunId: state.runId,
-        requestId: trigger.requestId,
-        failureSource: trigger.failureSource,
-        recoveryMode: trigger.recoveryMode,
-        planHash,
-        plan,
-    });
-    const operationInput = {
-        clientRequestId: `dag-recovery-${state.runId}`,
-        action: "dagRunTask",
-        actionParams: {
-            parentRunId: state.runId,
-            requestId: trigger.requestId,
-            failureSource: trigger.failureSource,
-            failureOwner: trigger.failureOwner,
-            protocolFailureReason: trigger.protocolFailureReason,
-            recoveryMode: trigger.recoveryMode,
-            planHash,
-        },
-        cliArgs: [
-            "dag",
-            "rerun-task",
-            "--run-id",
-            state.runId,
-            "--reason",
-            trigger.protocolFailureReason ?? "frontend automatic recovery",
-            "--request-id",
-            trigger.requestId,
-            "--frontend-recovery",
-            "--json",
-        ],
-    };
-    let created;
-    if (effectiveLease.lease.executionRef) {
-        // Replay the exact operation bound by the durable lease. A missing record
-        // cannot be replaced with a new operation id without violating the fence.
-        const existing = await input.deps.store.get(effectiveLease.lease.executionRef);
-        if (!existing) {
-            throw new Error(`frontend recovery lease operation not found: ${effectiveLease.lease.executionRef}`);
-        }
-        if (existing.clientRequestId !== operationInput.clientRequestId ||
-            existing.action !== operationInput.action ||
-            existing.payloadHash !==
-                computeActionPayloadHash(operationInput.action, operationInput.actionParams)) {
-            throw new Error("frontend recovery lease execution identity drift: referenced operation payload does not match the recovery request");
-        }
-        created = { kind: "idempotent", operation: existing };
-    }
-    else {
-        created = await input.deps.store.create(operationInput);
-    }
-    if (created.kind !== "conflict" && !observeOnly) {
-        // The durable lease must name the operation before controller execution.
-        // This also repairs a lease left behind by a crash before the original bind.
-        await bindDagRecoveryLeaseExecution({
-            leasePath: effectiveLease.leasePath,
-            lease: effectiveLease.lease,
-            executionRef: created.operation.operationId,
-        });
-        // Repair CLI args on both fresh and replayed operations. This closes the
-        // crash window after operation creation but before args were persisted.
-        await input.deps.store.update(created.operation.operationId, {
-            cliArgs: [
-                "dag",
-                "rerun-task",
-                "--run-id",
-                state.runId,
-                "--reason",
-                trigger.protocolFailureReason ?? "frontend automatic recovery",
-                "--request-id",
-                trigger.requestId,
-                "--frontend-recovery",
-                "--recovery-operation-id",
-                created.operation.operationId,
-                "--json",
-            ],
-        });
-    }
-    if (created.kind !== "conflict" && observeOnly) {
-        return { kind: "observed", operation: created.operation };
-    }
-    return created;
-}
-function concurrentSiblingWriteSetsForNode(rankWriterNodeIds, nodeId, tasksById) {
-    if (rankWriterNodeIds.length <= 1)
-        return [];
-    return rankWriterNodeIds
-        .filter((id) => id !== nodeId)
-        .map((id) => tasksById.get(id)?.writeSet ?? [])
-        .filter((writeSet) => writeSet.length > 0);
-}
-function buildRankAwareExecuteNode(input) {
-    if (input.customExecuteNode) {
-        return input.baseExecuteNode;
-    }
-    return async (nodeInput) => {
-        const isPiWriter = nodeInput.task.executor === "pi" &&
-            nodeInput.task.toolProfile === "write" &&
-            Boolean(nodeInput.model);
-        if (!isPiWriter) {
-            return input.baseExecuteNode(nodeInput);
-        }
-        const siblingWriteSets = nodeInput.task.writePolicy === "exclusive"
-            ? concurrentSiblingWriteSetsForNode(input.rankWriterNodeIds, nodeInput.task.id, input.tasksById)
-            : [];
-        return executeDagPiNode({ ...nodeInput, model: nodeInput.model }, {
-            ...input.meta,
-            concurrentSiblingWriteSets: siblingWriteSets.length > 0 ? siblingWriteSets : undefined,
-            writeGuardAttribution: siblingWriteSets.length > 0 ? "best-effort" : "per-node",
-        });
-    };
-}