@underactive/pi-topping-moa-fusion 0.1.0 → 0.2.0

package/src/moa/fanout.ts

@@ -7,8 +7,10 @@ import { getFinalOutput, isFailedResult } from "../runtime/results.ts";
 import type { ModelParallelAgentTask } from "../runtime/runner.ts";
 import { modelRefLabel, TRIGGER_TURN, type ModelRef, type ThinkingLevel } from "../shared/modelRefs.ts";
 import { activityLoopCount } from "../ui/agentStatus.ts";
+import { showModelThinkingPicker } from "../ui/moaModelPicker.ts";
 import type { MoaProgressWidget } from "../ui/moaProgressWidget.ts";
 import type { ObserveSession } from "../ui/observeOverlay.ts";
+import { duplicateModelSlotCount, proposerDiversityWarning } from "./panelDependence.ts";
 import { runWidgetFanout } from "./fanoutWiring.ts";
 import { buildProposerRetryTask, buildProposerTask, looksLikePlan } from "./planlessRetry.ts";
 import { modelExtensionOptions, resolveContextWindow } from "./modelRuntime.ts";
@@ -29,11 +31,12 @@ export interface FanoutPhaseOptions {
 	widget: MoaProgressWidget;
 	agents: AgentConfig[];
 	warnIfMutated(phase: string): Promise<void>;
+	maxConcurrency: number;
 }
 
 export async function runFanoutPhase(options: FanoutPhaseOptions): Promise<FanoutPhaseResult> {
-	const { host, runContext, ctx, prompt, proposers, proposerThinking, session, widget, agents, warnIfMutated } = options;
-	widget.startFanout(proposers, proposerThinking);
+	const { host, runContext, ctx, prompt, proposers, proposerThinking, session, widget, agents, warnIfMutated, maxConcurrency } = options;
+	widget.startFanout(proposers, proposerThinking, maxConcurrency);
 	const observe: ObserveSession = {
 		title: "MoA fan-out",
 		phase: "fanout",
@@ -64,7 +67,7 @@ export async function runFanoutPhase(options: FanoutPhaseOptions): Promise<Fanou
 		};
 	};
 	const runFanout = (tasks: ModelParallelAgentTask[], indexMap: (index: number) => number, currentRun: CancelRun) =>
-		runWidgetFanout({ ctx, agents, tasks, run: currentRun, session, widget, observe, models: proposers, indexMap });
+		runWidgetFanout({ ctx, agents, tasks, run: currentRun, session, widget, observe, models: proposers, indexMap, maxConcurrency });
 
 	// The planning contract travels inside the task text — the only channel
 	// guaranteed to survive a bridge's system-prompt override. The observer keeps
@@ -89,6 +92,114 @@ export async function runFanoutPhase(options: FanoutPhaseOptions): Promise<Fanou
 		return { status: "cancelled", observe, previousObserveSession };
 	}
 
+	// A proposer cancelled from the cancel overlay must not silently drop out of
+	// the run: the user who killed it decides what replaces it, mirroring the
+	// synthesizer-failure precedent. A slot dropped here stays `cancelled` in
+	// results, so it is already excluded from `succeeded` — "continue without"
+	// needs no other handling. This runs after the cancel-all check and before
+	// the planless-retry pass, so a replacement that returns no plan then gets
+	// that retry for free.
+	const cancelledSlots = results.flatMap((r, i) => r.cancelled ? [i] : []);
+	if (cancelledSlots.length > 0 && ctx.hasUI) {
+		// Stop the stacked overlays and the sticky widget before the modal so the
+		// select/picker are not fighting them. session.run is already undefined
+		// (cleared in runWidgetFanout's finally), so ESC reaches the modal, not a
+		// reopened cancel overlay.
+		session.closeOverlay?.();
+		widget.stopWidget();
+		for (const index of cancelledSlots) {
+			while (true) {
+				const label = modelRefLabel(proposers[index]);
+				const choice = await ctx.ui.select(
+					`Proposer ${index + 1} (${label}) was cancelled — what next?`,
+					["Select a different model", "Continue without this proposer"],
+				);
+				if (choice !== "Select a different model") break;
+				const picked = await showModelThinkingPicker(
+					ctx,
+					host.currentThinkingLevel(),
+					`Replacement for Proposer ${index + 1}`,
+					proposers[index],
+					proposerThinking[index],
+				);
+				if (!picked) continue;
+				// Rewrite the shared phase/synthesis/observe arrays in place: the
+				// same object is held by the widget band, the cost resolution,
+				// synthesis, and the persisted activeRunMoaInfo.
+				proposers[index] = picked.ref;
+				proposerThinking[index] = picked.thinking;
+				host.persistState();
+				if (duplicateModelSlotCount(proposers, picked.ref) >= 2) {
+					const warning = proposerDiversityWarning(proposers);
+					if (warning) ctx.ui.notify(warning, "warning");
+				}
+				widget.replaceProposerModel(index, picked.ref, picked.thinking);
+				// Rewrite the observe row's identity, not just its messages, so F3
+				// shows the replacement and not the cancelled agent's corpse.
+				const observed = observe.agents[index];
+				if (observed) {
+					observed.label = picked.ref.id;
+					observed.model = picked.ref.id;
+					observed.task = proposerTask;
+					observed.messages = [];
+					observed.partial = undefined;
+					observed.state = "working";
+				}
+				const replaceRun = new CancelRun();
+				session.title = "MoA fan-out (replacement)";
+				session.getExtras = () => {
+					const status = widget.getStatus(index);
+					if (!status) return undefined;
+					return {
+						contextTokens: status.contextTokens,
+						contextWindow: resolveContextWindow(ctx, status.ref),
+						activity: status.activity,
+						loopCount: activityLoopCount(status.activity, status.activityHistory),
+					};
+				};
+				// The slot was killed, not planless — rerun the fresh proposer task.
+				const [replacement] = await runFanout(
+					[
+						{
+							agent: "moa-proposer",
+							task: proposerTask,
+							model: modelRefLabel(picked.ref),
+							thinking: picked.thinking,
+							...modelExtensionOptions(ctx, picked.ref),
+							signal: replaceRun.add(modelRefLabel(picked.ref)).signal,
+						},
+					],
+					() => index,
+					replaceRun,
+				);
+				results[index] = replacement;
+				await warnIfMutated("MoA proposer replacement");
+				// Cancel ALL during a replacement ends the run, like the other exits.
+				if (replaceRun.cancelAllRequested) {
+					widget.stopWidget();
+					ctx.ui.notify("MoA run cancelled.");
+					return { status: "cancelled", observe, previousObserveSession };
+				}
+				// A cancelled or planless replacement re-asks the same two options
+				// until the user chooses to move on.
+				if (replacement.cancelled || isFailedResult(replacement)) {
+					session.closeOverlay?.();
+					widget.stopWidget();
+					ctx.ui.notify(
+						`Replacement proposer ${modelRefLabel(picked.ref)} did not produce a plan.`,
+						"warning",
+					);
+					continue;
+				}
+				break;
+			}
+		}
+		// A prompt stopped the widget; re-show the table so the planless-retry pass
+		// and synthesis render into a mounted table even when the user dropped
+		// every cancelled slot.
+		widget.resumeTable();
+	}
+
 	const retryIndices: number[] = [];
 	for (let index = 0; index < results.length; index++) {
 		const result = results[index];
@@ -112,7 +223,7 @@ export async function runFanoutPhase(options: FanoutPhaseOptions): Promise<Fanou
 			const ref = proposers[proposerIndex];
 			const label = modelRefLabel(ref);
 			const retryTask = buildProposerRetryTask(proposerTask, getFinalOutput(results[proposerIndex].messages));
-			widget.update(proposerIndex, "working", "retrying: no plan produced");
+			widget.update(proposerIndex, "queued", "retrying: no plan produced");
 			const observed = observe.agents[proposerIndex];
 			if (observed) {
 				observed.state = "working";

package/src/moa/fanoutWiring.ts

@@ -19,6 +19,7 @@ export interface WidgetFanoutOptions {
 	observe: ObserveSession;
 	models: ModelRef[];
 	indexMap: (index: number) => number;
+	maxConcurrency: number;
 }
 
 /**
@@ -27,7 +28,7 @@ export interface WidgetFanoutOptions {
  * settle/onProgress plumbing shared by every MoA fan-out variant.
  */
 export async function runWidgetFanout(options: WidgetFanoutOptions): Promise<SingleResult[]> {
-	const { ctx, agents, tasks, run, session, widget, observe, models, indexMap } = options;
+	const { ctx, agents, tasks, run, session, widget, observe, models, indexMap, maxConcurrency } = options;
 	const unsubscribe = run.onChange(() => {
 		run.agents.forEach((agent, index) => {
 			if (agent.state === "cancelling") widget.update(indexMap(index), "cancelling");
@@ -80,6 +81,15 @@ export async function runWidgetFanout(options: WidgetFanoutOptions): Promise<Sin
 					observed.partial = result.partialAssistant;
 				}
 			},
+			{
+				maxConcurrency,
+				onStart: (index) => {
+					const widgetIndex = indexMap(index);
+					widget.update(widgetIndex, "working");
+					const observed = observe.agents[widgetIndex];
+					if (observed) observed.state = "working";
+				},
+			},
 		);
 	} finally {
 		unsubscribe();

package/src/moa/implementationRetry.ts

@@ -234,7 +234,7 @@ export async function runImplementationRetryFlow(
 
 	if (selection.startsWith("Retry with")) {
 		host.markImplementationPending(ctx);
-		if (handoff.model) host.getActiveProgressWidget()?.switchToImplementing(handoff.model, "retrying implementation…", handoff.thinking);
+		if (handoff.model) host.getActiveProgressWidget()?.switchToImplementing(handoff.model, "retrying implementation", handoff.thinking);
 		const note = failureReason
 			? `The previous implementation attempt failed with: ${failureReason}. Review the current state of the code and continue implementing the approved plan.`
 			: "The previous implementation attempt failed. Review the current state of the code and continue implementing the approved plan.";
@@ -280,7 +280,7 @@ export async function runImplementationRetryFlow(
 				Implement: newSelection.ref,
 				Verify: updatedHandoff.verifier,
 			});
-			widget.switchToImplementing(newSelection.ref, "retrying implementation…", newSelection.thinking);
+			widget.switchToImplementing(newSelection.ref, "retrying implementation", newSelection.thinking);
 		}
 
 		const note = `Switched implementation model to ${modelRefLabel(newSelection.ref)}. Review the current state of the code and continue implementing the approved plan.`;

package/src/moa/orchestration.ts

@@ -1,6 +1,7 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 import { installShippedAgents, shippedAgentsDir, withAuthoritativeMoaAgents } from "../agents/authoritative.ts";
+import { loadMoaConfig } from "../config/settings.ts";
 import { discoverAgents } from "../agents/discovery.ts";
 import { cleanupProposalFiles, sweepStaleProposalFiles } from "../planning/planFile.ts";
 import type { CancelSession } from "../runtime/cancelRun.ts";
@@ -59,6 +60,7 @@ export async function runMoaOrchestration(
 	try {
 		installShippedAgents();
 		sweepStaleProposalFiles();
+		const maxConcurrency = loadMoaConfig().maxConcurrentAgents;
 		const discovery = discoverAgents(ctx.cwd, "user");
 		const agents = withAuthoritativeMoaAgents(discovery.agents, shippedAgentsDir());
 		const tripwire = new MutationTripwire();
@@ -78,6 +80,7 @@ export async function runMoaOrchestration(
 			widget,
 			agents,
 			warnIfMutated,
+			maxConcurrency,
 		});
 		if (fanout.status !== "continue") return fanout.status;
 		const synthesis = await runSynthesisPhase(runContext, {

package/src/moa/panelDependence.ts

@@ -0,0 +1,87 @@
+/**
+ * Dependence structure for the MoA proposer panel.
+ *
+ * Blinding invariant: nothing derived from a ModelRef (provider, id, label,
+ * family) may appear in synthesizer-facing output — only integers and
+ * proposerBlindedLabel slot numbers. Family-level clusters are excluded
+ * because they risk de-blinding a lopsided roster.
+ */
+
+import { modelRefLabel, proposerBlindedLabel, type ModelRef } from "../shared/modelRefs.ts";
+
+function pluralize(count: number, singular: string, plural = `${singular}s`): string {
+	return count === 1 ? singular : plural;
+}
+
+function formatClusterSentence(slots: number[]): string {
+	const numbers = slots.map((index) => proposerBlindedLabel(index).replace("Proposer ", ""));
+	if (numbers.length === 2) {
+		return `Proposers ${numbers[0]} and ${numbers[1]} share one model.`;
+	}
+	const last = numbers.pop();
+	return `Proposers ${numbers.join(", ")}, and ${last} share one model.`;
+}
+
+/** Blinded one-paragraph note describing panel dependence for the synthesizer. */
+export function buildPanelDependenceNote(fed: readonly { ref: ModelRef; originalIndex: number }[]): string {
+	const proposalCount = fed.length;
+	const clusters = new Map<string, number[]>();
+	const providers = new Set<string>();
+
+	for (const { ref, originalIndex } of fed) {
+		providers.add(ref.provider);
+		const key = modelRefLabel(ref);
+		const slots = clusters.get(key);
+		if (slots) slots.push(originalIndex);
+		else clusters.set(key, [originalIndex]);
+	}
+
+	const distinctModels = clusters.size;
+	const distinctProviders = providers.size;
+
+	const countsLine = [
+		`Panel dependence: ${proposalCount} ${pluralize(proposalCount, "proposal")}`,
+		`from ${distinctModels} distinct ${pluralize(distinctModels, "model")}`,
+		`across ${distinctProviders} ${pluralize(distinctProviders, "provider")}.`,
+	].join(" ");
+
+	const clusterSentences = [...clusters.values()]
+		.filter((slots) => slots.length >= 2)
+		.sort((a, b) => a[0] - b[0])
+		.map((slots) => formatClusterSentence([...slots].sort((a, b) => a - b)));
+
+	const caveat = "Every proposer ran from the same prompt template, so even distinct models are not fully independent; treat agreement inside a same-model cluster as one vote, not as separate confirmation.";
+
+	return [countsLine, ...clusterSentences, caveat].join(" ");
+}
+
+function duplicateModelSlotTotal(refs: readonly ModelRef[]): number {
+	const labelCounts = new Map<string, number>();
+	for (const ref of refs) {
+		const label = modelRefLabel(ref);
+		labelCounts.set(label, (labelCounts.get(label) ?? 0) + 1);
+	}
+	let total = 0;
+	for (const count of labelCounts.values()) {
+		if (count >= 2) total += count;
+	}
+	return total;
+}
+
+/** Non-blocking warning for the pre-flight picker or replacement notify. */
+export function proposerDiversityWarning(refs: readonly ModelRef[]): string | undefined {
+	const duplicateTotal = duplicateModelSlotTotal(refs);
+	if (duplicateTotal >= 2) {
+		return `${duplicateTotal} proposer slots share a model; agreement between them is not independent evidence.`;
+	}
+	if (refs.length >= 2 && new Set(refs.map((ref) => ref.provider)).size === 1) {
+		return `All ${refs.length} proposer slots share one provider; agreement between them is not independent evidence.`;
+	}
+	return undefined;
+}
+
+/** Slots in `refs` whose model matches `ref` (including `ref`'s own slot). */
+export function duplicateModelSlotCount(refs: readonly ModelRef[], ref: ModelRef): number {
+	const target = modelRefLabel(ref);
+	return refs.reduce((count, candidate) => count + (modelRefLabel(candidate) === target ? 1 : 0), 0);
+}

package/src/moa/reviewLoop.ts

@@ -73,7 +73,7 @@ export async function runReviewLoop(options: ReviewLoopOptions): Promise<"done">
 			chatRounds++;
 			synthConversation.push(`The user reviewed your synthesized plan and gave this feedback:\n${feedback.trim()}\n\nRevise the plan accordingly and re-emit the complete final plan. Drop any ## Conflicts or ## Open Question sections.`);
 			rebuildSynthTask();
-			widget.switchToSynthesizing(getSynthesizer(), "synthesizing plan…", getSynthesizerThinking());
+			widget.switchToSynthesizing(getSynthesizer(), "synthesizing plan", getSynthesizerThinking());
 			const synthRound = await runSynthWithRecovery(getSynthTask());
 			widget.stopWidget();
 			await warnIfMutated("MoA synthesis");
@@ -156,7 +156,7 @@ export async function runReviewLoop(options: ReviewLoopOptions): Promise<"done">
 					Implement: handoff.model,
 					Verify: roles?.verifier,
 				});
-				widget.switchToImplementing(handoff.model, "implementing plan…", handoff.thinking);
+				widget.switchToImplementing(handoff.model, "implementing plan", handoff.thinking);
 				host.adoptProgressWidget(widget);
 			}
 			host.markImplementationPending(ctx);

package/src/moa/synthesis.ts

@@ -18,6 +18,7 @@ import { buildContextRetryHeader, buildContextSubsectionsContract, missingContex
 import { modelExtensionOptions, resolveContextWindow, resolveModelCost } from "./modelRuntime.ts";
 import { runCriteriaGeneration } from "./verificationCriteria.ts";
 import type { MoaRunContext, ReviewLoopOptions, SucceededProposal } from "./runContext.ts";
+import { buildPanelDependenceNote } from "./panelDependence.ts";
 import { buildVerdictContract, buildVerdictRetryHeader, missingVerdictSlots, parseProposerVerdicts, stripSynthSections } from "./verdicts.ts";
 
 export interface SynthesisPhaseOptions {
@@ -40,7 +41,7 @@ export async function runSynthesisPhase(
 ): Promise<SynthesisPhaseResult> {
 	const { host, session, widget } = runContext;
 	const { ctx, prompt, proposers, succeeded, observe, agents, warnIfMutated } = options;
-	widget.switchToSynthesizing(runContext.synthesizer, "adjudicating proposed plans…", runContext.synthesizerThinking);
+	widget.switchToSynthesizing(runContext.synthesizer, "adjudicating proposed plans", runContext.synthesizerThinking);
 
 	// Proposals are both inlined and staged on disk. Inlining is what
 	// guarantees the synthesizer actually weighs every proposal — behind a
@@ -71,7 +72,10 @@ export async function runSynthesisPhase(
 	// reason: a bridged synthesizer that loses the agent prompt never learns
 	// the ## Conflicts markup and silently resolves every disagreement solo.
 	const fedLabels = succeeded.map(({ originalIndex }) => proposerBlindedLabel(originalIndex));
-	const baseSynthTask = `${SYNTHESIZER_TASK_PREAMBLE}\n\nOriginal user request:\n${prompt}\n\n---\n\nIndependent proposer plans:\n\n${proposals}\n\n---\n\n${buildVerdictContract(fedLabels)}\n\n---\n\n${buildContextSubsectionsContract()}\n\n---\n\n${buildConflictContract(fedLabels)}`;
+	// Correlated-judge guard: the note exposes dependence structure (counts and
+	// same-model clusters) without unblinding — only slot numbers and integers.
+	const dependenceNote = buildPanelDependenceNote(succeeded);
+	const baseSynthTask = `${SYNTHESIZER_TASK_PREAMBLE}\n\nOriginal user request:\n${prompt}\n\n---\n\n${dependenceNote}\n\nIndependent proposer plans:\n\n${proposals}\n\n---\n\n${buildVerdictContract(fedLabels)}\n\n---\n\n${buildContextSubsectionsContract()}\n\n---\n\n${buildConflictContract(fedLabels)}`;
 	const rebuildSynthTask = () => {
 		synthTask = [baseSynthTask, ...runContext.synthConversation.slice(-2)].join("\n\n---\n\n");
 	};
@@ -162,7 +166,7 @@ export async function runSynthesisPhase(
 			widget.stopWidget();
 			const action = await resolveSynthesizerFailure(getResultOutput(round.result));
 			if (action === "abandon") break;
-			widget.switchToSynthesizing(runContext.synthesizer, action === "switch" ? "retrying with a new model…" : "retrying…", runContext.synthesizerThinking);
+			widget.switchToSynthesizing(runContext.synthesizer, action === "switch" ? "retrying with a new model" : "retrying", runContext.synthesizerThinking);
 			round = await runSynthesizerRound(task);
 		}
 		return round;
@@ -237,7 +241,7 @@ export async function runSynthesisPhase(
 			}
 			runContext.synthConversation.push(`Synthesizer asked: ${question}\nUser answered: ${answer.trim()}\n\nNow produce the full plan.`);
 			rebuildSynthTask();
-			widget.switchToSynthesizing(runContext.synthesizer, "adjudicating proposed plans…", runContext.synthesizerThinking);
+			widget.switchToSynthesizing(runContext.synthesizer, "adjudicating proposed plans", runContext.synthesizerThinking);
 			continue;
 		}
 
@@ -251,7 +255,7 @@ export async function runSynthesisPhase(
 			const synthRetryCorr = buildRetryCorrection(SYNTHESIZER_RETRY_HEADER, synthOutput);
 			runContext.synthConversation.push(synthRetryCorr);
 			rebuildSynthTask();
-			widget.switchToSynthesizing(runContext.synthesizer, "retrying: no plan produced…", runContext.synthesizerThinking);
+			widget.switchToSynthesizing(runContext.synthesizer, "retrying: no plan produced", runContext.synthesizerThinking);
 			continue;
 		}
 
@@ -268,7 +272,7 @@ export async function runSynthesisPhase(
 			const verdictRetryCorr = buildRetryCorrection(buildVerdictRetryHeader(missingVerdicts), synthOutput);
 			runContext.synthConversation.push(verdictRetryCorr);
 			rebuildSynthTask();
-			widget.switchToSynthesizing(runContext.synthesizer, "retrying: missing proposer verdicts…", runContext.synthesizerThinking);
+			widget.switchToSynthesizing(runContext.synthesizer, "retrying: missing proposer verdicts", runContext.synthesizerThinking);
 			continue;
 		}
 
@@ -283,7 +287,7 @@ export async function runSynthesisPhase(
 			const contextRetryCorr = buildRetryCorrection(buildContextRetryHeader(missingContext), synthOutput);
 			runContext.synthConversation.push(contextRetryCorr);
 			rebuildSynthTask();
-			widget.switchToSynthesizing(runContext.synthesizer, "retrying: missing context sections…", runContext.synthesizerThinking);
+			widget.switchToSynthesizing(runContext.synthesizer, "retrying: missing context sections", runContext.synthesizerThinking);
 			continue;
 		}
 		if (!questionMatch && missingContext.length === 0) contextSubsectionsSeen = true;
@@ -341,7 +345,7 @@ export async function runSynthesisPhase(
 
 				runContext.synthConversation.push(feedback);
 				rebuildSynthTask();
-				widget.switchToSynthesizing(runContext.synthesizer, "synthesizing plan…", runContext.synthesizerThinking);
+				widget.switchToSynthesizing(runContext.synthesizer, "synthesizing plan", runContext.synthesizerThinking);
 				if (isLastRound) {
 					const finalRound = await runSynthWithRecovery(synthTask);
 					if (finalRound.cancelled) {

package/src/moa/verification.ts

@@ -11,11 +11,17 @@
  * evidence — the implementer's own report is treated as an untrusted claim.
  *
  * A `complete` verdict with a clean script gate ends the phase. Anything less
- * offers the user a bounded repair round (up to MAX_VERIFICATION_REPAIRS): the
- * verifier's gaps and failing checks are shown inline in the repair/accept
- * dialog and sent back to the same in-session implementer via the existing
- * kickoff machinery. The result is then verified again. "Accept implementation
- * as-is" is always available.
+ * offers the user a bounded repair round (up to the `maxVerificationRepairs`
+ * setting, default 2; 0 disables the offer): the verifier's gaps and failing
+ * checks are shown inline in the repair/accept dialog and sent back to the same
+ * in-session implementer via the existing kickoff machinery. The result is then
+ * verified again. "Accept implementation as-is" is always available.
+ *
+ * Once that budget is spent (or when it is zero, or no UI can offer the choice),
+ * the phase writes a `<slug>__verification-handoff.md` next to the plan holding
+ * every criterion's status plus the whole frozen checklist, and names that file
+ * in the exhaustion notification so the fix/verification loop can be continued
+ * by hand.
  */
 
 import { CONFIG_DIR_NAME, type ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -42,9 +48,6 @@ import { parseVerificationCriteria, sectionBullets, type VerificationCriterion }
 import type { MoaRunHost } from "./runContext.ts";
 import { captureImplementationDiff, discoverVerifyScripts, runVerifyScript, type VerifyResult } from "./verifyGate.ts";
 
-/** How many verifier-driven repair rounds a single implementation may consume. */
-export const MAX_VERIFICATION_REPAIRS = 2;
-
 export type VerificationVerdictValue = "complete" | "partial" | "incomplete" | "cannot-verify";
 
 export interface CriterionVerdict {
@@ -349,6 +352,58 @@ export function formatVerificationReport(parsed: VerificationVerdict, failedScri
 	return sections.join("\n\n");
 }
 
+/** Markdown handoff written when automatic verifier repairs are exhausted or disabled. */
+export function buildVerificationExhaustionHandoff(input: {
+	repairsUsed: number;
+	maxRepairs: number;
+	parsed: VerificationVerdict;
+	criteria: VerificationCriterion[];
+	failedScripts: VerifyResult[];
+	planFilePath: string;
+	verificationReportPath?: string;
+	/** Frozen checklist on disk, referenced alongside the inlined criteria. */
+	criteriaFilePath?: string;
+}): string {
+	const { repairsUsed, maxRepairs, parsed, criteria, failedScripts, planFilePath, verificationReportPath, criteriaFilePath } = input;
+	const sections: string[] = [
+		"# Verification repair handoff",
+		"",
+		maxRepairs === 0
+			? "Automatic verifier repair rounds are disabled in settings (`maxVerificationRepairs: 0`)."
+			: `Verifier repair rounds are exhausted (${repairsUsed} of ${maxRepairs} used).`,
+		"",
+		"Use this file to continue the fix/verification loop manually: send the criteria status and gaps below to the implementer, apply fixes, then re-run verification (for example via `/mf-plan-implement` or by approving a follow-up turn).",
+		"",
+		`Approved plan: ${planFilePath}`,
+	];
+	if (verificationReportPath) sections.push(`Full verifier report: ${verificationReportPath}`);
+	if (criteriaFilePath) sections.push(`Frozen verification criteria: ${criteriaFilePath}`);
+	sections.push(
+		"",
+		"## Verification result",
+		`**Verdict:** ${parsed.verdict ?? "unknown"}`,
+		parsed.summary ? `**Summary:** ${parsed.summary}` : "**Summary:** (none)",
+	);
+	if (criteria.length > 0) {
+		const byId = new Map(parsed.criteria.map((criterion) => [criterion.id, criterion]));
+		const statusLines = criteria.map((criterion) => {
+			const verdict = byId.get(criterion.id);
+			if (!verdict) return `- **${criterion.id}:** not judged — ${criterion.text}`;
+			return `- **${criterion.id}:** ${verdict.status} — ${verdict.evidence || criterion.text}`;
+		});
+		sections.push("", "## Criteria status", ...statusLines, "", "## Full verification criteria", ...criteria.map((criterion) => `- **${criterion.id}:** ${criterion.text}`));
+	} else if (parsed.steps.length > 0) {
+		sections.push("", "## Step verdicts", ...parsed.steps.map((step) => `- ${step}`));
+	}
+	if (parsed.gaps.length > 0) {
+		sections.push("", "## Gaps", ...parsed.gaps.map((gap) => `- ${gap}`));
+	}
+	if (failedScripts.length > 0) {
+		sections.push("", "## Failing project checks", ...failedScripts.map((result) => `- \`${result.command}\` failed (exit ${result.exitCode})`));
+	}
+	return sections.join("\n");
+}
+
 function buildRepairNote(parsed: VerificationVerdict, failedScripts: VerifyResult[]): string {
 	const parts: string[] = [
 		"The verifier reviewed your implementation against the approved plan and found it did not fully land.",
@@ -434,7 +489,7 @@ export async function runVerificationDecision(deps: {
 			// Reactivate the Implement row for the repair round and leave the table
 			// mounted; the next settled turn re-enters this verification flow.
 			widget?.settleRoleRow("Verify", "done");
-			if (handoff.model) widget?.switchToImplementing(handoff.model, "addressing verifier findings…", handoff.thinking);
+			if (handoff.model) widget?.switchToImplementing(handoff.model, "addressing verifier findings", handoff.thinking);
 			host.markImplementationPending(ctx);
 			const repairNote = buildRepairNote(parsed, failedScripts);
 			await host.pi.sendUserMessage(
@@ -492,7 +547,7 @@ export async function runImplementationVerification(
 	widget?.setActivePhase("Verify");
 	// `activeVerifierThinking` is not declared yet; the initial project-checks
 	// activation carries the handoff's verifier level, which it is seeded from.
-	widget?.switchToVerifying(verifier, "running project checks…", handoff.verifierThinking);
+	widget?.switchToVerifying(verifier, "running project checks", handoff.verifierThinking);
 
 	// Diff and script gate run in the parent, BEFORE the verifier's mutation
 	// tripwire is armed: `npm test` may legitimately write snapshots/coverage,
@@ -532,7 +587,7 @@ export async function runImplementationVerification(
 
 	const runVerifierPreflight = async (): Promise<VerifierRunOutcome> => {
 		const verifier = activeVerifier;
-		widget?.switchToVerifying(verifier, "checking verifier…", activeVerifierThinking);
+		widget?.switchToVerifying(verifier, "checking verifier", activeVerifierThinking);
 		const result = await runVerifier(
 			ctx.cwd, agents, "moa-verifier", "Reply with the single word ok", undefined, undefined, undefined,
 			modelRefLabel(verifier), activeVerifierThinking, {
@@ -548,7 +603,7 @@ export async function runImplementationVerification(
 		const tripwire = new MutationTripwire();
 		await tripwire.arm(ctx.cwd);
 
-		widget?.switchToVerifying(verifier, "verifying implementation…", activeVerifierThinking);
+		widget?.switchToVerifying(verifier, "verifying implementation", activeVerifierThinking);
 		widget?.updateRoleTranscript("Verify", []);
 
 		const session: CancelSession = { title: "MoA verification", run: undefined, overlayOpen: false };
@@ -756,15 +811,17 @@ export async function runImplementationVerification(
 	const failedScripts = scriptResults.filter((r) => r.status === "fail");
 	if (verificationPassed(parsed.verdict, scriptResults)) {
 		const checksNote = scriptResults.length > 0 ? " and all project checks passed" : "";
-		ctx.ui.notify(criteria.length > 0
+		const message = criteria.length > 0
 			? `Verification passed — all ${criteria.length} criteria met${checksNote}.`
-			: `Verification passed — the implementation matches the approved plan${checksNote}.`);
+			: `Verification passed — the implementation matches the approved plan${checksNote}.`;
+		ctx.ui.notify(ctx.ui.theme.bg("toolSuccessBg", ctx.ui.theme.fg("success", message)));
 		finish("done");
 		return;
 	}
 
 	const repairsUsed = activeHandoff.verificationRepairs ?? 0;
-	if (ctx.hasUI && repairsUsed < MAX_VERIFICATION_REPAIRS) {
+	const maxRepairs = config.maxVerificationRepairs;
+	if (ctx.hasUI && maxRepairs > 0 && repairsUsed < maxRepairs) {
 		await runVerificationDecision({
 			ctx,
 			host,
@@ -785,7 +842,47 @@ export async function runImplementationVerification(
 
 	const summary = buildVerificationSummary(parsed, scriptResults).join("\n");
 	const report = formatVerificationReport(parsed, failedScripts);
-	const exhaustedNote = repairsUsed >= MAX_VERIFICATION_REPAIRS ? "\n\nRepair rounds are exhausted." : "";
-	ctx.ui.notify(`${summary}\n\n${report}${exhaustedNote}`, "warning");
+	let handoffPath: string | undefined;
+	// The run's own slug is authoritative, but a resumed implementation may have
+	// verified without one (e.g. /mf-plan-implement after a restart); the handoff
+	// carries the slug its plan was saved under, so fall back to it.
+	const repoPlanSlug = host.getPlanRepoSlug() ?? activeHandoff.repoPlanSlug;
+	if (repoPlanSlug) {
+		try {
+			saveRepoPlanFile(
+				buildVerificationExhaustionHandoff({
+					repairsUsed,
+					maxRepairs,
+					parsed,
+					criteria,
+					failedScripts,
+					planFilePath: activeHandoff.planFilePath,
+					verificationReportPath,
+					// Only point at the checklist file when one is actually on disk;
+					// criteria can come from the handoff alone.
+					criteriaFilePath: readRepoPlanFile(ctx.cwd, repoPlanSlug, "criteria")
+						? `${CONFIG_DIR_NAME}/mf-plan/${repoPlanSlug}__criteria.md`
+						: undefined,
+				}),
+				ctx.cwd,
+				repoPlanSlug,
+				"verification-handoff",
+			);
+			handoffPath = `${CONFIG_DIR_NAME}/mf-plan/${repoPlanSlug}__verification-handoff.md`;
+		} catch {
+			// Persisting the handoff is best-effort; the exhaustion notification still fires.
+		}
+	}
+	// The notification is the only place the handoff is announced, so say plainly
+	// when it could not be written rather than silently dropping the location.
+	const handoffNote = handoffPath
+		? `\n\nContinue fix/verification using the handoff file:\n${handoffPath}`
+		: "\n\nThe verification handoff file could not be saved — the findings above are the only record.";
+	const exhaustedNote = maxRepairs === 0
+		? "\n\nAutomatic verifier repair rounds are disabled in settings."
+		: repairsUsed >= maxRepairs
+			? "\n\nRepair rounds are exhausted."
+			: "";
+	ctx.ui.notify(`${summary}\n\n${report}${exhaustedNote}${handoffNote}`, "warning");
 	finish("done");
 }

package/src/moa/verificationCriteria.ts

@@ -84,7 +84,7 @@ export async function runCriteriaGeneration(input: {
 	observe?: ObserveSession;
 }): Promise<{ criteria: VerificationCriterion[]; markdown: string } | undefined> {
 	const { ctx, agents, synthesizer, thinking, plan, session, widget } = input;
-	widget?.switchToSynthesizing(synthesizer, "writing verification criteria…", thinking);
+	widget?.switchToSynthesizing(synthesizer, "writing verification criteria", thinking);
 	const run = new CancelRun();
 	const slot = run.add(modelRefLabel(synthesizer));
 	if (session) {