muonroi-cli 1.8.4 → 1.9.0

package/dist/src/product-loop/sprint-runner.js

@@ -21,38 +21,334 @@
  *     projection check, not a retroactive one.
  *   - CB-2 (oscillation) is checked AFTER this sprint's score is known.
  */
+import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
 import * as path from "node:path";
 import { prependDecisionsLock, readDecisionsLock } from "../council/decisions-lock.js";
 import { runCouncil } from "../council/index.js";
+import { resolveLeaderModel } from "../council/leader.js";
 import { phaseDone, phaseError, phaseStart } from "../council/phase-events.js";
+import { fireAndForgetWorkflowEvent } from "../ee/workflow-event.js";
 import { readArtifact, writeArtifact } from "../flow/artifact-io.js";
+import { renderResumeDigest, writeSprintOutcome, writeSprintVerify } from "../flow/run-artifacts.js";
+import { isContextRailEnabled } from "../gsd/flags.js";
+import { SPRINT_EXECUTION_MARKER } from "../pil/layer6-output.js";
 import { detectProviderForModel } from "../providers/runtime.js";
-import { logUIInteraction } from "../storage/index.js";
+import { logInteraction, logUIInteraction } from "../storage/index.js";
 import { commitToProduct, release } from "../usage/ledger.js";
 import { CapBreachError } from "../usage/types.js";
+import { getIsolatedTaskDeadlineMs, withDeadlineRace } from "../utils/llm-deadline.js";
 import { runVerifyOrchestration } from "../verify/orchestrator.js";
 import { appendIteration, readCriteria } from "./artifact-io.js";
 import { formatUnverifiedForSprintContext, readLedger } from "./assumption-ledger.js";
 import { readBacklog } from "./backlog-store.js";
 import { CB1_costProjection, CB2_oscillation, CB3_verifyBlank } from "./circuit-breakers.js";
 import { reserveForProduct } from "./cost-scoper.js";
+import { extractAcceptanceCriteria, judgeCriteriaAgainstVerify, planQualityIssues, seedCriteriaFromPlan, } from "./criteria-seed.js";
 import { formatProjectContextForPrompt } from "./discovery-context-format.js";
 import { readProjectContext } from "./discovery-persistence.js";
 import { evaluateDoneGate } from "./done-gate.js";
 import { buildContinueFeedback } from "./feedback-routing.js";
+import { idealTrace } from "./ideal-trace.js";
 import { postSprintBoundary } from "./phase-tracker-bridge.js";
+import { runPlanAdherenceReview } from "./plan-adherence-review.js";
 import { computeProgressSnapshot, renderSnapshotMarkdown } from "./progress-snapshot.js";
 import { appendRoleMemory } from "./role-memory.js";
 import { loadVerifyFailureSignatures, recordVerifyFailureAndMaybePush } from "./verify-failure-tracking.js";
-import { parseVerifyResult } from "./verify-result.js";
+import { parseVerifyResult, VERIFY_PASS_MARKER } from "./verify-result.js";
 // P3.7: track one-shot CB-2 retry bonus per run (keyed by runId).
 // The Map is module-scoped so multiple sprints within the same run share state
 // without touching DriverContext / IterationState shapes.
 const _cb2RetryUsed = new Map();
+/** Watchdog ceiling for the verify stage (ms). Override with MUONROI_SPRINT_VERIFY_TIMEOUT_MS. */
+function getVerifyWatchdogTimeoutMs() {
+    const raw = process.env.MUONROI_SPRINT_VERIFY_TIMEOUT_MS;
+    const n = raw ? Number.parseInt(raw, 10) : Number.NaN;
+    if (Number.isFinite(n) && n > 0)
+        return n;
+    return 10 * 60 * 1000; // 10 min default
+}
+/**
+ * Bound the verify stage with a watchdog timeout.
+ *
+ * `runVerifyOrchestration` can hang indefinitely with no visible signal:
+ * `prepareVerifyRun` → `ensureVerifyCheckpoint` spawns the `shuru` sandbox
+ * (`spawnWithProgress("shuru", …)`) which stalls on hosts where shuru is
+ * unavailable/misconfigured (e.g. Windows), and the verify sub-agent itself has
+ * no TTFB timeout. Because sprint-runner previously called it as a bare
+ * `await runVerifyOrchestration(agent)` with NO abortSignal and NO timeout, a
+ * single hung verify BRICKED the whole /ideal run silently — no error, no
+ * recovery card — observed live as a 30+ min dead stall right after
+ * "Committed: N sprints planned" (the impl turn finished, verify never returned).
+ *
+ * On timeout we abort the sub-agent, log with context (No-Silent-Catch), and
+ * return an ERROR ToolResult so the sprint loop treats it as a failed verify
+ * (Step 5 → verifyVerdict FAIL/ERROR → feedback-routing) instead of hanging
+ * forever. The hung sandbox op may leak in the background, but the run recovers
+ * and the failure is surfaced + resumable. `onProgress` is forwarded to console
+ * so a future hang is diagnosable (e.g. "Creating checkpoint: <name>").
+ */
+async function runVerifyWithWatchdog(verifyAgent, runId, sprintN) {
+    const timeoutMs = getVerifyWatchdogTimeoutMs();
+    const controller = new AbortController();
+    let timer;
+    const onProgress = (detail) => {
+        if (process.env.MUONROI_DEBUG_VERIFY === "1")
+            console.error(`[verify:sprint-${sprintN}] ${detail}`);
+    };
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            const msg = `verify stage exceeded ${Math.round(timeoutMs / 1000)}s watchdog and was aborted ` +
+                `(sprint ${sprintN}, run ${runId}) — likely a hung sandbox checkpoint (shuru) or a ` +
+                `verify sub-agent LLM call with no TTFB timeout`;
+            console.error(`[sprint-runner] ${msg}`);
+            resolve({ success: false, output: "", error: `verify-timeout: ${msg}` });
+        }, timeoutMs);
+    });
+    try {
+        return await Promise.race([
+            runVerifyOrchestration(verifyAgent, { abortSignal: controller.signal, onProgress }),
+            timeout,
+        ]);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`[sprint-runner] verify stage threw (sprint ${sprintN}, run ${runId}): ${message}`);
+        return { success: false, output: "", error: `verify-error: ${message}` };
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 /** @internal Test-only: reset CB-2 retry state for a given runId. */
 export function _resetCb2RetryUsed(runId) {
     _cb2RetryUsed.delete(runId);
 }
+/**
+ * Idle-chunk ceiling for the implementation stage (ms). Override with
+ * MUONROI_SPRINT_IMPL_IDLE_MS. This is a TIME-SINCE-LAST-CHUNK budget, not a
+ * total-turn cap — a legitimately long implementation streams progress the
+ * whole way, so it may run for many minutes, but it must never go completely
+ * silent (no chunk at all) for this long.
+ */
+export function getImplIdleTimeoutMs() {
+    const raw = process.env.MUONROI_SPRINT_IMPL_IDLE_MS;
+    const n = raw ? Number.parseInt(raw, 10) : Number.NaN;
+    if (Number.isFinite(n) && n > 0)
+        return n;
+    return 4 * 60 * 1000; // 4 min of total silence → treat the impl turn as stalled
+}
+/**
+ * Hard total-elapsed ceiling for the implementation stage (ms). Override with
+ * MUONROI_SPRINT_IMPL_TOTAL_MS. Unlike the idle budget this is armed once and is
+ * NOT reset by chunks, so it catches a hang that keeps the idle guard alive with
+ * heartbeat/status chunks. Generous by default so a legitimately large sprint is
+ * not cut short; a genuine hang still terminates within this ceiling.
+ */
+export function getImplTotalTimeoutMs() {
+    const raw = process.env.MUONROI_SPRINT_IMPL_TOTAL_MS;
+    const n = raw ? Number.parseInt(raw, 10) : Number.NaN;
+    if (Number.isFinite(n) && n > 0)
+        return n;
+    return 15 * 60 * 1000; // 15 min hard ceiling on a single impl turn
+}
+/**
+ * Whether the implement stage runs in an ISOLATED bounded sub-agent context
+ * (ctx.runIsolatedTask) instead of the shared top-level turn (processMessageFn).
+ * Default ON. Disable with MUONROI_SPRINT_ISOLATED_IMPL=0.
+ *
+ * The isolated path is the fix for the live ctx-overflow wedge: the flat
+ * processMessageFn turn inherited the full council-debate history (~5.9M tokens
+ * observed), started implementation already at ~94% context, then wedged after a
+ * mid-turn compaction. A fresh child context (getSubAgentBudgetChars cap +
+ * independent in-loop compaction) never inherits the debate, so it starts near
+ * empty and its clutter is absorbed as one compact ToolResult.
+ */
+export function getSprintIsolatedImplEnabled() {
+    return process.env.MUONROI_SPRINT_ISOLATED_IMPL !== "0";
+}
+/**
+ * Pure decision: use the isolated sub-agent path for the implement stage?
+ * True only when the flag is on AND the driver actually provides the bridge
+ * (legacy/test drivers omit runIsolatedTask → fall back to processMessageFn).
+ * Extracted for unit testing without spinning up a full runSprint.
+ */
+export function shouldUseIsolatedImpl(hasBridge, enabled = getSprintIsolatedImplEnabled()) {
+    return enabled && hasBridge;
+}
+/**
+ * Imperative execution directive prepended to the sprint plan before it is
+ * handed to the orchestrator. The raw plan synthesis is a declarative design
+ * document; without this prefix the impl turn narrates it back instead of
+ * applying edits. Exported for test assertion. @internal
+ */
+export const IMPL_EXECUTION_DIRECTIVE = `${SPRINT_EXECUTION_MARKER}\n\n` +
+    "You are the sprint IMPLEMENTER. EXECUTE the sprint plan below as an implementation task. Make the " +
+    "actual code changes NOW using your file-edit tools — read the target files, then edit/write them to " +
+    "apply every action item. Do NOT merely restate, summarize, or re-plan the design; apply the edits to " +
+    "the repository. Run the plan's own verification commands where given. Before you finish, self-verify " +
+    "as a reviewer would: confirm every target file named in the plan actually exists on disk with the " +
+    "intended change — do not stop with action items unaddressed. Stop only when the action items are " +
+    "implemented.\n\n" +
+    "--- SPRINT PLAN TO IMPLEMENT ---\n\n";
+/**
+ * Wrap the implementation `processMessageFn` stream with an idle-chunk watchdog.
+ *
+ * Root cause it addresses (observed live 2026-07-08, /ideal resume of the
+ * gsd-core migration): the implementation stage delegates to the host
+ * orchestrator turn via `ctx.processMessageFn(implPrompt)` and consumes it with
+ * `for await (const chunk of implGen)`. The orchestrator turn finished its final
+ * LLM response cleanly (finishReason "stop", text-only) but the generator then
+ * suspended post-finish and never completed — the `for await` blocked for 17+
+ * minutes with NO chunk, NO phaseDone, NO advance to Verify, NO error. Because
+ * the LLM STREAM had already finished, the orchestrator's mid-stream
+ * time-to-next-chunk stall-watchdog does not fire — the hang is on the JS side
+ * after the stream terminator.
+ *
+ * TWO complementary guards (a single idle guard was observed live to be
+ * defeated: the impl created 2 files then emitted only non-progress heartbeat
+ * chunks for 9+ min, resetting a per-chunk idle timer without ever completing):
+ *   - `idleMs` — resets on every yielded chunk; catches a TOTALLY silent stall
+ *     (the post-finish hang above, zero chunks) quickly.
+ *   - `totalMs` — armed ONCE at entry, NOT reset by chunks; a hard ceiling that
+ *     fires even when heartbeat/status chunks keep the idle guard alive while no
+ *     real progress is made.
+ * Either firing throws so the caller's existing try/catch converts the wedge
+ * into a visible phaseError (the sprint then surfaces + can recover), exactly
+ * like `runVerifyWithWatchdog` does for the verify stage. The suspended
+ * orchestrator promise may leak in the background, but the run recovers.
+ */
+export async function* withImplIdleWatchdog(gen, idleMs, sprintN, totalMs = getImplTotalTimeoutMs()) {
+    const it = gen[Symbol.asyncIterator]();
+    let totalTimer;
+    const total = new Promise((_, reject) => {
+        totalTimer = setTimeout(() => {
+            reject(new Error(`implementation stage exceeded ${Math.round(totalMs / 1000)}s total watchdog and was ` +
+                `treated as stalled (sprint ${sprintN}) — the orchestrator turn never completed ` +
+                `(likely hung after its final response while emitting only heartbeat chunks)`));
+        }, totalMs);
+    });
+    try {
+        while (true) {
+            let idleTimer;
+            const idle = new Promise((_, reject) => {
+                idleTimer = setTimeout(() => {
+                    reject(new Error(`implementation stage produced no output for ${Math.round(idleMs / 1000)}s and was ` +
+                        `treated as stalled (sprint ${sprintN}) — the orchestrator turn hung post-finish ` +
+                        `(finished its LLM response but the generator never completed)`));
+                }, idleMs);
+            });
+            let res;
+            try {
+                res = await Promise.race([it.next(), idle, total]);
+            }
+            finally {
+                if (idleTimer)
+                    clearTimeout(idleTimer);
+            }
+            if (res.done)
+                return;
+            yield res.value;
+        }
+    }
+    finally {
+        if (totalTimer)
+            clearTimeout(totalTimer);
+    }
+}
+/**
+ * Wall-clock deadline for the ISOLATED implementation path.
+ *
+ * The isolated path (`ctx.runIsolatedTask`) returns a single Promise, not a
+ * stream, so `withImplIdleWatchdog` (which guards the streamed non-isolated
+ * path) cannot wrap it. Its only protection was the sub-agent's INTERNAL
+ * per-chunk stall-watchdog — which does NOT fire once the sub-agent's LLM stream
+ * has finished but its orchestrator turn hangs on the JS side afterwards (the
+ * exact "wrote N files then went silent" wedge documented on
+ * `withImplIdleWatchdog`). Observed live 2026-07-12 (run mrhc43f0fb9b): the
+ * isolated impl wrote 2 files, emitted its final `llm-done`, then wedged for 30+
+ * min with zero events and an idle process — because this `await` had no outer
+ * ceiling.
+ *
+ * This races the isolated task against a hard total-elapsed deadline. On
+ * timeout it rejects so the caller's existing try/catch converts the wedge into
+ * a visible phaseError (the sprint surfaces + can recover), mirroring what
+ * `withImplIdleWatchdog` / `runVerifyWithWatchdog` do for the other stages. The
+ * suspended sub-agent promise may leak in the background, but the run recovers.
+ * `totalMs <= 0` disables the guard (returns the task unchanged).
+ */
+/**
+ * Extract why an isolated implementation task failed, from its ToolResult.
+ *
+ * `output` is checked because StreamRunner reports EVERY sub-agent failure
+ * there — "Task failed: …" (stream-runner.ts:1061), "[Cancelled]" (:982), a
+ * provider stall (:988), an unknown-agent message (:265) — and never assigns
+ * `error`; grep stream-runner.ts for `error:` and there are no hits. Reading
+ * `error` alone made `result.error?.trim()` permanently undefined, so every
+ * distinct failure collapsed into the contentless fallback and two /ideal runs
+ * halted 1s into implementation with the cause already erased.
+ *
+ * `error` still wins when a caller does populate it — ToolResult declares the
+ * field, so a future non-StreamRunner producer may be more specific.
+ */
+export function resolveImplFailureReason(result) {
+    return result.error?.trim() || result.output?.trim() || "isolated implementation task failed";
+}
+/**
+ * Persist an implementation-stage failure to `interaction_logs`.
+ *
+ * The implementation stage is where /ideal either ships code or does not, so its
+ * exception is the single most valuable line in a post-mortem — yet run
+ * mrn9yfle9801 halted with only `halt_card_open {trigger:"loop_throw"}` on
+ * record and the message itself unrecoverable: stderr belongs to the TUI child
+ * (the harness never captures it) and the council path writes no `messages`
+ * rows. `elapsedMs` is what separates the two indistinguishable causes — an
+ * immediate `!result.success` from a `withIsolatedImplDeadline` watchdog trip.
+ *
+ * Never throws: a broken audit trail must not take down the sprint it is
+ * describing.
+ */
+export function logSprintImplError(ctx, info) {
+    try {
+        logInteraction(ctx.sessionId ?? ctx.runId, "council", {
+            eventSubtype: "sprint_impl_error",
+            ...(info.implModelId ? { model: info.implModelId } : {}),
+            durationMs: info.elapsedMs,
+            data: {
+                runId: ctx.runId,
+                sprintN: info.sprintN,
+                isolated: info.isolated,
+                message: info.message.slice(0, 2000),
+                stack: info.stack,
+            },
+        });
+    }
+    catch (err) {
+        console.error(`[sprint-runner] failed to persist implementation error (sprint ${info.sprintN}): ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export async function withIsolatedImplDeadline(task, totalMs, sprintN) {
+    if (!(Number.isFinite(totalMs) && totalMs > 0))
+        return task;
+    let timer;
+    const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            reject(new Error(`isolated implementation stage exceeded ${Math.round(totalMs / 1000)}s total watchdog and was ` +
+                `treated as stalled (sprint ${sprintN}) — the isolated sub-agent turn never completed ` +
+                `(hung on the JS side after its final response; the isolated path has no per-chunk stall guard)`));
+        }, totalMs);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([task, deadline]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 export { computeFailureSignature, loadVerifyFailureSignatures, pushFailureToEE, recordVerifyFailureAndMaybePush, saveVerifyFailureSignatures, } from "./verify-failure-tracking.js";
 /**
  * Run a single sprint. Yields StreamChunk events for the UI and returns the
@@ -61,6 +357,104 @@ export { computeFailureSignature, loadVerifyFailureSignatures, pushFailureToEE,
  * Throws on circuit-breaker halt — caller (loop driver) catches and writes
  * the appropriate halt state to manifest/state.
  */
+/** Path to the persisted per-sprint plan synthesis (Wave 2). @internal */
+export function sprintPlanPath(runDir, sprintN) {
+    return path.join(runDir, `sprint-${sprintN}-plan.md`);
+}
+/**
+ * Wave 2: read a persisted sprint plan if present. Returns "" when absent or on
+ * read error (caller then runs the planning council). Never throws.
+ *
+ * The planning council is non-deterministic — re-running it on a resumed/retried
+ * sprint produces a different design AND a different target folder, which is why
+ * the impl turn was observed re-scaffolding in a new location each run. Reusing
+ * the persisted plan makes per-sprint planning idempotent so the same target
+ * files are continued across resume.
+ */
+export async function readPersistedSprintPlan(planPath) {
+    try {
+        if (!existsSync(planPath))
+            return "";
+        return (await readFile(planPath, "utf8")).trim();
+    }
+    catch (err) {
+        console.error(`[sprint-runner] readPersistedSprintPlan failed for ${planPath}: ${err.message}`);
+        return "";
+    }
+}
+/** Wave 2: persist a sprint plan synthesis for idempotent resume. Never throws. */
+export async function persistSprintPlan(planPath, synthesis) {
+    if (!synthesis.trim())
+        return;
+    try {
+        await writeFile(planPath, synthesis, "utf8");
+    }
+    catch (err) {
+        console.error(`[sprint-runner] persistSprintPlan failed for ${planPath}: ${err.message}`);
+    }
+}
+/**
+ * Extract repo-relative target file paths a sprint plan names (src/…, packages/…,
+ * tests/…). Deduped, capped. Used by Wave 3 (existing targets → continue) and 4A
+ * (missing targets → completeness re-check). Never throws.
+ */
+export function extractPlanTargetPaths(planSynthesis, cap = 40) {
+    try {
+        const tokens = new Set();
+        const re = /\b((?:src|packages|tests|scripts|lib|app|apps)\/[\w./@-]+\.[a-z]{1,5})\b/gi;
+        let m = re.exec(planSynthesis);
+        while (m !== null) {
+            tokens.add(m[1].replace(/\\/g, "/"));
+            if (tokens.size >= cap)
+                break;
+            m = re.exec(planSynthesis);
+        }
+        return [...tokens];
+    }
+    catch (err) {
+        console.error(`[sprint-runner] extractPlanTargetPaths failed: ${err.message}`);
+        return [];
+    }
+}
+/**
+ * Wave 3: plan-named target file paths that ALREADY EXIST on disk, so the impl
+ * turn continues them rather than re-scaffolding in a new location. Empty on a
+ * greenfield sprint (files don't exist yet) → no injection.
+ */
+export async function detectExistingPlanTargets(planSynthesis, cwd, cap = 20) {
+    const existing = [];
+    for (const t of extractPlanTargetPaths(planSynthesis)) {
+        if (existsSync(path.resolve(cwd, t)))
+            existing.push(t);
+        if (existing.length >= cap)
+            break;
+    }
+    return existing;
+}
+/**
+ * 4A: plan-named target file paths that STILL DO NOT EXIST after the impl turn —
+ * i.e. action items the implementer left unaddressed. Drives the post-impl
+ * completeness re-check (spend an extra turn ONLY when there is proven-incomplete
+ * work, unlike an unconditional reviewer pass). Empty ⇒ every named target landed.
+ */
+export async function computeMissingPlanTargets(planSynthesis, cwd, cap = 20) {
+    const missing = [];
+    for (const t of extractPlanTargetPaths(planSynthesis)) {
+        if (!existsSync(path.resolve(cwd, t)))
+            missing.push(t);
+        if (missing.length >= cap)
+            break;
+    }
+    return missing;
+}
+/**
+ * 4A completeness re-check toggle. Default ON; disable with
+ * MUONROI_SPRINT_IMPL_RECHECK=0. When on, and the impl turn left plan-named
+ * target files missing, ONE focused follow-up turn is spent to finish them.
+ */
+export function getImplRecheckEnabled() {
+    return process.env.MUONROI_SPRINT_IMPL_RECHECK !== "0";
+}
 export async function* runSprint(args) {
     const { sprintN, ctx, productSpec, roleAssignments, history, carryOver, phaseScope } = args;
     const runDir = path.join(ctx.flowDir, "runs", ctx.runId);
@@ -76,9 +470,54 @@ export async function* runSprint(args) {
     // ── Step 2: Detect verify recipe BEFORE the planner spends any token ──────
     // CB-3 fires deterministically on sprint 1 if recipe is null or coverage === 0.
     const verifyAgent = buildVerifyAgent(ctx, cwd);
-    const verifyRecipe = await verifyAgent.detectVerifyRecipe(verifyAgent.getSandboxSettings());
+    // Wall-clock backstop: `detectVerifyRecipe` runs a `verify-detect` LLM
+    // sub-agent turn (orchestrator.detectVerifyRecipe → runTaskRequest). Like the
+    // impl/verify stages, that turn can finish its stream then wedge on the JS side
+    // afterward — and this call site had NO deadline, so a single hung verify-detect
+    // turn bricked the entire /ideal run silently, right after "Committed: N sprints
+    // planned" and BEFORE the "Sprint N — Planning" yield (observed live 2026-07-13:
+    // 8+ min frozen frame, no forward progress). Race it against the shared isolated-
+    // task deadline; a timeout falls through to `null` → CB-3 emits the actionable
+    // recovery card instead of hanging. (The bridge signature does not thread an
+    // abortSignal, so this caller-side race is the guarantee.)
+    let verifyRecipe;
+    try {
+        verifyRecipe = await withDeadlineRace(() => verifyAgent.detectVerifyRecipe(verifyAgent.getSandboxSettings()), getIsolatedTaskDeadlineMs(), `sprint-${sprintN}-detect-verify`);
+    }
+    catch (err) {
+        console.error(`[sprint-runner] detectVerifyRecipe timed out/failed (sprint ${sprintN}, run ${ctx.runId}): ${err instanceof Error ? err.message : String(err)}`);
+        verifyRecipe = null;
+    }
     const cb3 = CB3_verifyBlank(sprintN, verifyRecipe);
-    if (cb3.halt) {
+    // Greenfield build-first (Task #8): on a fresh greenfield /ideal run the first
+    // sprint has nothing to verify yet — detectVerifyRecipe legitimately returns
+    // null / zero-coverage because the code and tests do not exist until THIS sprint
+    // builds them. Halting here (CB-3) would trap every greenfield idea before a
+    // single line is written. So for sprint 1 of a greenfield run, bypass the halt
+    // and let the implement stage scaffold the first increment; the verify stage
+    // re-detects the recipe from the code it creates (Step 5 reads
+    // verifyResult.verifyRecipe, not this one). The halt is preserved for EXISTING
+    // projects, where a missing recipe is a real "I can't tell how to test this"
+    // signal that warrants the recovery card. Opt out with
+    // MUONROI_IDEAL_GREENFIELD_BUILD_FIRST=0.
+    let greenfieldBuildFirst = false;
+    if (cb3.halt && sprintN === 1 && process.env.MUONROI_IDEAL_GREENFIELD_BUILD_FIRST !== "0") {
+        try {
+            const pc = await readProjectContext(ctx.flowDir, ctx.runId);
+            greenfieldBuildFirst = pc?.detection?.classification === "greenfield";
+        }
+        catch {
+            greenfieldBuildFirst = false;
+        }
+    }
+    if (greenfieldBuildFirst) {
+        yield {
+            type: "content",
+            content: `\n> Greenfield: no verify recipe exists yet (nothing is built). Proceeding to build the ` +
+                `first increment — it will be verified against the code and tests this sprint creates.\n`,
+        };
+    }
+    if (cb3.halt && !greenfieldBuildFirst) {
         // Yield a structured halt chunk so the TUI can render an actionable recovery
         // card (Task 5.2). Do NOT throw — callers must discriminate on chunk.type.
         const haltChunk = {
@@ -216,15 +655,82 @@ export async function* runSprint(args) {
     const noopProcess = async function* () {
         /* no host orchestrator wired during planning */
     };
-    const planGen = runCouncil(councilTopic, sessionModelId, [], ctx.runId, productLlm, ctx.respondToQuestion, ctx.respondToPreflight, ctx.processMessageFn ?? noopProcess, { skipClarification: true, cwd, runDir });
-    let planSynthesis = "";
-    while (true) {
-        const step = await planGen.next();
-        if (step.done) {
-            planSynthesis = step.value ?? "";
-            break;
+    // Wave 2 (2026-07-08): reuse a persisted per-sprint plan if one exists, making
+    // per-sprint planning idempotent across resume/retry. Without this the
+    // non-deterministic planning council re-ran on every runSprint call and emitted
+    // a different design → a different target folder each time (run1 src/council/,
+    // run4 src/engine/), so the impl turn re-scaffolded instead of continuing.
+    const planPath = sprintPlanPath(runDir, sprintN);
+    let planSynthesis = await readPersistedSprintPlan(planPath);
+    if (planSynthesis) {
+        idealTrace("sprint.planCouncil.reused", { runId: ctx.runId, sprintN, planSynthesisLen: planSynthesis.length });
+        yield {
+            type: "content",
+            content: `\n> [sprint-plan] Reusing persisted plan for sprint ${sprintN} (${planSynthesis.length} chars) — re-planning skipped so the same target files are continued.\n`,
+        };
+    }
+    else {
+        idealTrace("sprint.planCouncil.before", { runId: ctx.runId, sprintN });
+        const planGen = runCouncil(councilTopic, sessionModelId, [], ctx.runId, productLlm, ctx.respondToQuestion, ctx.respondToPreflight, ctx.processMessageFn ?? noopProcess, {
+            skipClarification: true,
+            cwd,
+            runDir,
+            suppressInlineMeta: isContextRailEnabled(),
+            // The product plan + spec were already debated (CB-1) and approved at the
+            // `/ideal` preflight. Re-gating and re-researching each sprint's internal
+            // plan strands the loop before implementation is ever reached (the exact
+            // "debate great, never implements" symptom). Auto-approve the per-sprint
+            // plan and reuse CB-1 research; the post-sprint customer verdict still lets
+            // the user review each sprint's OUTPUT.
+            autoApprovePreflight: true,
+            skipResearch: true,
+            // Automated per-sprint planning: suppress the interactive post-debate menu
+            // (it stranded the sprint before implementation — blocker 4/5) and skip the
+            // session-scoped persistence that FK-fails on the product-run id. The plan
+            // is auto-locked and control returns here for the Implementation stage.
+            sprintPlanningMode: true,
+        });
+        while (true) {
+            const step = await planGen.next();
+            if (step.done) {
+                planSynthesis = step.value ?? "";
+                break;
+            }
+            yield step.value;
+        }
+        idealTrace("sprint.planCouncil.after", { runId: ctx.runId, sprintN, planSynthesisLen: planSynthesis.length });
+        // Persist so a resumed/retried sprint reuses this exact plan (and target folder).
+        await persistSprintPlan(planPath, planSynthesis);
+    }
+    // Plan-fidelity fix: seed the plan's acceptance_criteria into the criteria store
+    // so the done-gate scores against REAL criteria (previously readCriteria returned
+    // [] → score always 0.00 → no gate on plan divergence). Idempotent + non-clobbering.
+    // Also run a NON-BLOCKING plan-quality check (per-sprint plans are auto-approved
+    // with no gate) and fold any issues into a corrective note for the impl prompt.
+    let planQualityNote = "";
+    try {
+        const planCriteria = extractAcceptanceCriteria(planSynthesis ?? "");
+        const seeded = await seedCriteriaFromPlan(ctx.flowDir, ctx.runId, planCriteria, sprintN);
+        if (seeded > 0) {
+            yield {
+                type: "content",
+                content: `\n> [criteria] Seeded ${seeded} acceptance criteria from the sprint plan (done-gate now scores against them).\n`,
+            };
         }
-        yield step.value;
+        const issues = planQualityIssues(planSynthesis ?? "", seeded);
+        if (issues.length > 0) {
+            planQualityNote =
+                `\n\n--- PLAN QUALITY WARNINGS (address these while implementing) ---\n` +
+                    issues.map((i) => `- ${i}`).join("\n") +
+                    `\nImplement to satisfy the phase goal and every acceptance criterion; do not stop at scaffolding.\n`;
+            yield {
+                type: "content",
+                content: `\n> [plan-check] ${issues.length} plan-quality warning(s): ${issues.join("; ")}\n`,
+            };
+        }
+    }
+    catch {
+        /* non-critical — a missing criteria seed degrades to the prior empty-criteria behavior */
     }
     // P4-C: close the planning phase row before opening implementation.
     yield phaseDone({
@@ -234,6 +740,7 @@ export async function* runSprint(args) {
         startedAt: planStartedAt,
     });
     // ── Step 4: Implement stage — pipe plan through host process loop ─────────
+    idealTrace("sprint.implementation.enter", { runId: ctx.runId, sprintN, planSynthesisLen: planSynthesis.length });
     yield { type: "content", content: `\n## Sprint ${sprintN} — Implementation\n` };
     const implPhaseId = `sprint-${sprintN}-implementation`;
     const implStartedAt = Date.now();
@@ -262,13 +769,28 @@ export async function* runSprint(args) {
         subtype: "sprint_stage",
         data: { sprintIndex: sprintN, stage: "implementation", runId: ctx.runId },
     });
+    // Defect fix (2026-07-08): the raw plan synthesis is a DECLARATIVE design
+    // document ("## Agreed Architecture / Function Signatures / Acceptance
+    // Criteria"). Passed verbatim as the orchestrator message it reads as
+    // something to discuss, so the impl turn narrated the plan back as markdown
+    // (finishReason "stop", zero edits) instead of applying it — observed live on
+    // the gsd-core migration. Prepend an explicit execution directive (module-level
+    // IMPL_EXECUTION_DIRECTIVE) so the PIL classifier routes it to the
+    // implement/edit path, not the respond path.
     // C2: Pre-impl gate — read decisions.lock.md and prepend to implementation prompt.
     // When lock file is missing (greenfield / no council with runDir), pass-through unchanged.
-    let implPrompt = planSynthesis;
+    let implPrompt = planSynthesis.trim() ? IMPL_EXECUTION_DIRECTIVE + planSynthesis + planQualityNote : planSynthesis;
     try {
         const lockContent = await readDecisionsLock(runDir);
         if (lockContent) {
-            implPrompt = prependDecisionsLock(planSynthesis, lockContent);
+            // Prepend the lock to the DIRECTIVE-carrying implPrompt, NOT the bare
+            // planSynthesis. Passing planSynthesis here (the original 2026-07-08 C2
+            // gate bug) silently dropped IMPL_EXECUTION_DIRECTIVE + its
+            // SPRINT_EXECUTION_MARKER, so every council-backed sprint (a lock always
+            // exists once the council ran) reached the orchestrator as a bare design
+            // doc: the impl turn narrated the plan instead of executing it, classified
+            // taskType=null (4_096 output cap), then wedged on finishReason:"length".
+            implPrompt = prependDecisionsLock(implPrompt, lockContent);
             yield {
                 type: "content",
                 content: "\n> [decisions.lock.md] Locked decisions prepended to implementation prompt.\n",
@@ -278,16 +800,85 @@ export async function* runSprint(args) {
     catch {
         /* fail-open — lock read failure must not block implementation */
     }
+    // Wave 3 (2026-07-08): the impl turn was blind to files a prior sprint/run had
+    // already created, so it re-created them from scratch. Tell it which of the
+    // plan's OWN named target files already exist on disk so it reads + continues
+    // them instead of re-scaffolding. Empty on greenfield (nothing exists yet).
+    if (planSynthesis.trim()) {
+        const existingTargets = await detectExistingPlanTargets(planSynthesis, cwd);
+        if (existingTargets.length > 0) {
+            implPrompt = `${implPrompt}\n\n--- FILES ALREADY PRESENT ON DISK (prior-sprint work — READ and CONTINUE these; do NOT recreate them from scratch) ---\n${existingTargets
+                .map((f) => `- ${f}`)
+                .join("\n")}\n`;
+            yield {
+                type: "content",
+                content: `\n> [continuation] ${existingTargets.length} plan target file(s) already exist — instructed to continue, not recreate.\n`,
+            };
+        }
+    }
     let implError = null;
+    let implErrorStack;
     if (ctx.processMessageFn && implPrompt.trim()) {
+        const useIsolated = shouldUseIsolatedImpl(!!ctx.runIsolatedTask);
         try {
-            const implGen = ctx.processMessageFn(implPrompt);
-            for await (const chunk of implGen) {
-                yield chunk;
+            if (useIsolated && ctx.runIsolatedTask) {
+                // ISOLATED path — run the sprint plan in a fresh, budget-capped child
+                // context that does NOT inherit the council-debate history. This is the
+                // fix for the ctx-overflow wedge: the sub-agent starts near-empty, has
+                // full tool access (edit/bash), compacts independently in-loop, and
+                // returns a compact ToolResult (its tool clutter is absorbed, not piped
+                // into the parent). No stream to watchdog — the sub-agent has its own
+                // stall + no-forward-progress guards (stall-watchdog.ts).
+                yield {
+                    type: "content",
+                    content: "\n> [isolated impl] Executing the sprint in a fresh sub-agent context " +
+                        "(anti-overflow: does not inherit the debate history).\n",
+                };
+                // Plan-fidelity fix: allow the implementation turn to run on a stronger
+                // model than the cheap session tier (which failed to faithfully follow a
+                // rich plan). Opt-in via MUONROI_IDEAL_IMPL_MODEL; defaults to the session
+                // model so the cheap-model philosophy stays the default.
+                const implModelId = process.env.MUONROI_IDEAL_IMPL_MODEL?.trim() || ctx.sessionModelId;
+                if (implModelId !== ctx.sessionModelId) {
+                    yield {
+                        type: "content",
+                        content: `\n> [impl-model] Running implementation on ${implModelId} (override of session model ${ctx.sessionModelId}).\n`,
+                    };
+                }
+                // Wall-clock deadline: the isolated path has no per-chunk stall guard,
+                // so a post-finish JS-side hang would wedge this await forever (observed
+                // live, run mrhc43f0fb9b). Racing the total-elapsed ceiling turns a wedge
+                // into a phaseError via the try/catch below. See withIsolatedImplDeadline.
+                const result = await withIsolatedImplDeadline(ctx.runIsolatedTask({
+                    agent: "general",
+                    description: `Sprint ${sprintN} implementation`,
+                    prompt: implPrompt,
+                    modelId: implModelId,
+                }), getImplTotalTimeoutMs(), sprintN);
+                if (!result.success) {
+                    implError = resolveImplFailureReason(result);
+                }
+                else if (result.output?.trim()) {
+                    yield { type: "content", content: `\n${result.output.trim()}\n` };
+                }
+            }
+            else {
+                const implGen = ctx.processMessageFn(implPrompt);
+                // Guard the impl turn with an idle-chunk watchdog so a post-finish
+                // orchestrator hang surfaces as a phaseError instead of a silent wedge.
+                for await (const chunk of withImplIdleWatchdog(implGen, getImplIdleTimeoutMs(), sprintN)) {
+                    yield chunk;
+                }
             }
         }
         catch (e) {
             implError = e instanceof Error ? e.message : String(e);
+            implErrorStack = e instanceof Error ? e.stack?.split("\n").slice(0, 4).join(" | ") : undefined;
+            // No-Silent-Catch: the finally below surfaces a phaseError chunk, but log
+            // here too so the hang/failure is diagnosable from stderr / MUONROI logs.
+            // Persisting happens at the single convergence point below — a thrown
+            // error and a `!result.success` return must not log differently.
+            console.error(`[sprint-runner] implementation stage failed (sprint ${sprintN}, run ${ctx.runId}): ${implError}`);
         }
         finally {
             // A3 FIX: phaseDone for implementation MUST always fire, even when
@@ -326,8 +917,145 @@ export async function* runSprint(args) {
         });
     }
     if (implError) {
+        // The ONE place both failure shapes converge. The catch above handles a
+        // thrown error; a `!result.success` return never reaches it and instead
+        // falls through to here — which is why persisting from inside the catch
+        // recorded nothing for the two runs that actually failed. This throw
+        // escapes to the UI's loop-level catch (use-app-logic.tsx), which renders
+        // the message but persists only {reason, trigger, sprintN} — no text. So
+        // this is the last point at which the reason still exists.
+        logSprintImplError(ctx, {
+            sprintN,
+            message: implError,
+            stack: implErrorStack,
+            implModelId: process.env.MUONROI_IDEAL_IMPL_MODEL?.trim() || ctx.sessionModelId,
+            elapsedMs: Date.now() - implStartedAt,
+            isolated: shouldUseIsolatedImpl(!!ctx.runIsolatedTask),
+        });
         throw new Error(implError);
     }
+    // ── Step 4b: 4A completeness re-check ─────────────────────────────────────
+    // The impl turn can "finish" (finishReason stop) with plan action items
+    // unaddressed — narrated but not applied. Rather than an unconditional
+    // (2-3x cost) reviewer pass, spend ONE focused follow-up turn ONLY when
+    // plan-named target files are provably still missing on disk. No missing
+    // targets ⇒ no extra turn (the resume/migration case where the targets already
+    // exist is a no-op). A re-check failure never fails the sprint — the primary
+    // impl already succeeded and verify/tests are the real gate.
+    if (ctx.processMessageFn && getImplRecheckEnabled() && planSynthesis.trim()) {
+        const missing = await computeMissingPlanTargets(planSynthesis, cwd);
+        if (missing.length > 0) {
+            idealTrace("sprint.implementation.recheck", { runId: ctx.runId, sprintN, missing: missing.length });
+            const recheckPhaseId = `sprint-${sprintN}-impl-recheck`;
+            const recheckStartedAt = Date.now();
+            yield phaseStart({
+                phaseId: recheckPhaseId,
+                kind: "sprint_stage",
+                label: `Sprint ${sprintN} — Completeness re-check`,
+                detail: `${missing.length} plan target(s) still missing — finishing`,
+                startedAt: recheckStartedAt,
+            });
+            const recheckPrompt = "The sprint plan named these target files but they DO NOT exist on disk yet — the sprint is NOT " +
+                "finished. Create/complete each one NOW using your file-edit tools. Do NOT explain or re-plan; " +
+                "make the edits.\n" +
+                missing.map((f) => `- ${f}`).join("\n") +
+                "\n";
+            let recheckErr = null;
+            try {
+                const recheckGen = ctx.processMessageFn(recheckPrompt);
+                for await (const chunk of withImplIdleWatchdog(recheckGen, getImplIdleTimeoutMs(), sprintN)) {
+                    yield chunk;
+                }
+            }
+            catch (e) {
+                recheckErr = e instanceof Error ? e.message : String(e);
+                console.error(`[sprint-runner] impl completeness re-check failed (sprint ${sprintN}, run ${ctx.runId}): ${recheckErr}`);
+            }
+            finally {
+                if (recheckErr) {
+                    yield phaseError({
+                        phaseId: recheckPhaseId,
+                        kind: "sprint_stage",
+                        label: `Sprint ${sprintN} — Completeness re-check`,
+                        startedAt: recheckStartedAt,
+                        errorMessage: recheckErr,
+                    });
+                }
+                else {
+                    yield phaseDone({
+                        phaseId: recheckPhaseId,
+                        kind: "sprint_stage",
+                        label: `Sprint ${sprintN} — Completeness re-check`,
+                        startedAt: recheckStartedAt,
+                    });
+                }
+            }
+            const stillMissing = await computeMissingPlanTargets(planSynthesis, cwd);
+            idealTrace("sprint.implementation.recheck.after", {
+                runId: ctx.runId,
+                sprintN,
+                stillMissing: stillMissing.length,
+            });
+            if (stillMissing.length > 0) {
+                yield {
+                    type: "content",
+                    content: `\n> [completeness] ${stillMissing.length} plan target(s) still missing after re-check — deferring to verify.\n`,
+                };
+            }
+        }
+    }
+    // ── Step 4c: Plan-adherence review gate (strong reviewer → cheap fixer) ────
+    // A high-tier reviewer checks the diff against the approved plan; deviations are
+    // handed to a lower-tier fixer and re-reviewed (bounded). Opt out with
+    // MUONROI_IDEAL_ADHERENCE_REVIEW=0. Never halts — verify + the criteria done-gate
+    // remain the hard gates; this tightens plan fidelity before verification so a
+    // cheap implementer's divergence is caught and corrected, not shipped.
+    // Plan deviations that survive the bounded fixer rounds — carried into the next
+    // sprint's focus (Step 9) so "chưa tuân thủ" work continues rather than being
+    // silently dropped after the review.
+    let residualPlanDeviations = [];
+    if (ctx.runIsolatedTask && planSynthesis.trim() && process.env.MUONROI_IDEAL_ADHERENCE_REVIEW !== "0") {
+        const adhPhaseId = `sprint-${sprintN}-adherence`;
+        const adhStartedAt = Date.now();
+        yield phaseStart({
+            phaseId: adhPhaseId,
+            kind: "sprint_stage",
+            label: `Sprint ${sprintN} — Plan-adherence review`,
+            startedAt: adhStartedAt,
+        });
+        try {
+            const reviewModelId = process.env.MUONROI_IDEAL_REVIEW_MODEL?.trim() || resolveLeaderModel(ctx.sessionModelId);
+            const verdict = yield* runPlanAdherenceReview({
+                sprintN,
+                planSynthesis,
+                cwd,
+                reviewModelId,
+                fixModelId: ctx.sessionModelId,
+                runIsolatedTask: ctx.runIsolatedTask,
+                maxRounds: Number.parseInt(process.env.MUONROI_IDEAL_ADHERENCE_ROUNDS ?? "2", 10) || 2,
+            });
+            idealTrace("sprint.adherence.after", {
+                runId: ctx.runId,
+                sprintN,
+                rounds: verdict.rounds,
+                adherent: verdict.adherent,
+                deviations: verdict.deviations.length,
+            });
+            if (!verdict.adherent)
+                residualPlanDeviations = verdict.deviations;
+        }
+        catch (err) {
+            console.error(`[sprint-runner] plan-adherence review failed (sprint ${sprintN}): ${err.message}`);
+        }
+        finally {
+            yield phaseDone({
+                phaseId: adhPhaseId,
+                kind: "sprint_stage",
+                label: `Sprint ${sprintN} — Plan-adherence review`,
+                startedAt: adhStartedAt,
+            });
+        }
+    }
     // ── Step 5: Verify stage ──────────────────────────────────────────────────
     yield { type: "content", content: `\n## Sprint ${sprintN} — Verification\n` };
     const verifyPhaseId = `sprint-${sprintN}-verification`;
@@ -351,7 +1079,30 @@ export async function* runSprint(args) {
         subtype: "sprint_stage",
         data: { sprintIndex: sprintN, stage: "verification", runId: ctx.runId },
     });
-    const verifyResult = await runVerifyOrchestration(verifyAgent);
+    // A — "Skip verify" recovery option: the user chose to bypass a broken verify
+    // stage (e.g. shuru sandbox unavailable on Windows that hangs the watchdog
+    // every sprint). Treat verify as a PASS with an explicit synthetic output so
+    // the done-gate is not blocked, and log loudly so the bypass is auditable.
+    // The env var is set by the recovery-card handler and reset on the next fresh
+    // `/ideal "<idea>"` start, so a new run re-enables verification.
+    const skipVerify = process.env.MUONROI_SPRINT_SKIP_VERIFY === "1";
+    let verifyResult;
+    if (skipVerify) {
+        console.error(`[sprint-runner] MUONROI_SPRINT_SKIP_VERIFY=1 — verify stage bypassed (sprint ${sprintN}, run ${ctx.runId})`);
+        verifyResult = {
+            success: true,
+            // Include the canonical PASS marker so parseVerifyResult → PASS (the user
+            // explicitly opted to treat verify as satisfied for this recovery).
+            output: `${VERIFY_PASS_MARKER}\nverify skipped by user recovery choice (MUONROI_SPRINT_SKIP_VERIFY=1)`,
+        };
+        yield {
+            type: "content",
+            content: `\n> [skip-verify] Verify stage bypassed for sprint ${sprintN} (user recovery choice).\n`,
+        };
+    }
+    else {
+        verifyResult = await runVerifyWithWatchdog(verifyAgent, ctx.runId, sprintN);
+    }
     yield phaseDone({
         phaseId: verifyPhaseId,
         kind: "sprint_stage",
@@ -433,6 +1184,42 @@ export async function* runSprint(args) {
         subtype: "sprint_stage",
         data: { sprintIndex: sprintN, stage: "judgment", runId: ctx.runId },
     });
+    // Plan-fidelity fix: judge the seeded acceptance criteria against what was
+    // actually built (verify output + diff) BEFORE the done-gate reads them.
+    // Without this the criteria stay "unmet" forever → score 0.00 and the gate can
+    // never distinguish an on-plan sprint from a divergent one. Only upgrades on a
+    // PASSing verify with concrete evidence (see judgeCriteriaAgainstVerify).
+    try {
+        const judgeModelId = roleAssignments.get("Reviewer")?.modelId ?? roleAssignments.get("PO")?.modelId ?? ctx.sessionModelId;
+        let diffSummary = "";
+        try {
+            const { spawnSync } = await import("node:child_process");
+            const stat = spawnSync("git", ["diff", "--stat", "HEAD"], { cwd, encoding: "utf8", timeout: 15000 });
+            diffSummary = (stat.stdout ?? "").slice(0, 4000) || "(no diff detected)";
+        }
+        catch {
+            diffSummary = "(diff unavailable)";
+        }
+        const verifyOutputForJudge = (verifyResult.error?.trim() ? verifyResult.error : (verifyResult.output ?? "")).trim();
+        const { judged, total } = await judgeCriteriaAgainstVerify({
+            flowDir: ctx.flowDir,
+            runId: ctx.runId,
+            llm: productLlm,
+            modelId: judgeModelId,
+            verifyVerdict,
+            verifyOutput: verifyOutputForJudge,
+            diffSummary,
+        });
+        if (total > 0) {
+            yield {
+                type: "content",
+                content: `\n> [criteria] Judged ${judged}/${total} acceptance criteria as met/partial against verify+diff.\n`,
+            };
+        }
+    }
+    catch {
+        /* non-critical — judging failure leaves criteria unmet (conservative) */
+    }
     const currentCriteria = await readCriteria(ctx.flowDir, ctx.runId);
     // When a phaseScope is provided (subsystem E), evaluate the done-gate only
     // against criteria belonging to this phase. Full criteria are kept for
@@ -516,6 +1303,7 @@ export async function* runSprint(args) {
         criteriaMet: currentCriteria.filter((c) => c.status === "met").length,
         criteriaPartial: currentCriteria.filter((c) => c.status === "partial").length,
         criteriaUnmet: currentCriteria.filter((c) => c.status === "unmet").length,
+        totalCriteria: currentCriteria.length,
         costUsd: 0, // Per-sprint cost is observed via the per-product ledger; field kept for compat.
         actualCost: 0,
         score: verdict.score,
@@ -524,8 +1312,39 @@ export async function* runSprint(args) {
     await appendIteration(ctx.flowDir, ctx.runId, iter);
     // Update Resume Digest in state.md so PIL Layer 5 + future resume can pick it up
     const stateMap = (await readArtifact(runDir, "state.md")) ?? { preamble: "", sections: new Map() };
-    stateMap.sections.set("Resume Digest", `Sprint: ${sprintN} | Stage: ${iter.stage} | Score: ${verdict.score.toFixed(2)} | Verify: ${verifyVerdict}`);
+    stateMap.sections.set("Resume Digest", renderResumeDigest({
+        stage: `sprint-${sprintN}`,
+        lastCompleted: `sprint-${sprintN} ${iter.stage}`,
+        nextAction: verdict.pass
+            ? "Definition-of-Done met — advance to the next phase or ship"
+            : `Retry sprint ${sprintN}: ${verdict.failedCondition ?? "continue toward Definition-of-Done"}`,
+        sprintN,
+        score: verdict.score,
+        verify: verifyVerdict,
+        updatedAt: new Date().toISOString(),
+    }));
     await writeArtifact(runDir, "state.md", stateMap);
+    // Part A — persist a first-class per-sprint outcome record + verify report so
+    // `/ideal review` and cross-run memory render real sprint history (not just
+    // the fire-and-forget EE boundary event, which leaves nothing on disk).
+    try {
+        await writeSprintOutcome(ctx.flowDir, ctx.runId, {
+            sprintN,
+            pass: verdict.pass,
+            score: verdict.score,
+            verify: verifyVerdict,
+            failedCondition: verdict.failedCondition ?? undefined,
+            criteriaMet: iter.criteriaMet,
+            criteriaPartial: iter.criteriaPartial,
+            criteriaUnmet: iter.criteriaUnmet,
+            finishedAt: new Date().toISOString(),
+        });
+        const verifyReport = (verifyResult.error?.trim() ? verifyResult.error : (verifyResult.output ?? "")).trim() || "(no verify output)";
+        await writeSprintVerify(ctx.flowDir, ctx.runId, sprintN, `# Sprint ${sprintN} verify — ${verifyVerdict} (score ${verdict.score.toFixed(2)})\n\n\`\`\`\n${verifyReport.slice(0, 8000)}\n\`\`\`\n`);
+    }
+    catch {
+        /* non-critical — sprint artifacts are a review surface, never derail the loop */
+    }
     // Emit ProgressSnapshot on sprint boundary so the user sees rolling progress.
     // Wrapped in try/catch — never crash sprint-runner because the snapshot failed.
     try {
@@ -557,9 +1376,34 @@ export async function* runSprint(args) {
     }).catch(() => {
         /* EE failures must not derail the loop */
     });
+    // Part C — write-during-execution: persist this sprint's outcome as a NEW
+    // workflow_sprint experience (not just reinforcement) so a later sprint in the
+    // SAME run — or a future run — can recall "how this kind of sprint went".
+    // gate-on-outcome (Kill #4): fired here, AFTER verify+judge produced a verdict.
+    fireAndForgetWorkflowEvent({
+        kind: "sprint-execution",
+        phaseRef: `runs/${ctx.runId}#sprint-${sprintN}`,
+        sessionId: ctx.runId,
+        text: `Sprint ${sprintN} ${verdict.pass ? "passed" : "failed"} (score ${verdict.score.toFixed(2)}, verify ${verifyVerdict})${verdict.failedCondition ? ` — ${verdict.failedCondition}` : ""}`,
+        payload: {
+            sprintN,
+            pass: verdict.pass,
+            score: verdict.score,
+            verify: verifyVerdict,
+            failedCondition: verdict.failedCondition ?? null,
+        },
+    });
     // ── Step 9: If not done, surface continue-feedback to the user ───────────
     if (!verdict.pass) {
         const fb = buildContinueFeedback(verdict, verifyResult, currentCriteria);
+        // Fold any residual plan deviations (surviving the adherence fixer) into the
+        // carry-over focus so the next sprint continues the non-adherent/risky parts.
+        const deviationNote = residualPlanDeviations.length > 0
+            ? `\n\nPlan deviations still open (address these next):\n${residualPlanDeviations
+                .map((d) => `- ${d}`)
+                .join("\n")}`
+            : "";
+        iter.nextFocus = `${fb.focus}${deviationNote}`;
         yield {
             type: "content",
             content: `\n> Sprint ${sprintN} did not satisfy Definition-of-Done (${verdict.failedCondition ?? "unknown"}). Next focus: ${fb.focus}\n`,