project-autopilot 12.0.0 → 12.0.1

package/scripts/config-layout.mjs

@@ -749,6 +749,10 @@ export function toRuntimeConfig(layout = {}) {
   else if (has(legacyCapabilities.verification || {}, "browser")) verification.browser = legacyCapabilities.verification.browser;
   if (has(tests, "require_browser")) verification.require_browser = tests.require_browser;
   else if (has(legacyCapabilities.verification || {}, "require_browser")) verification.require_browser = legacyCapabilities.verification.require_browser;
+  if (has(tests, "e2e")) verification.e2e = tests.e2e;
+  else if (has(legacyCapabilities.verification || {}, "e2e")) verification.e2e = legacyCapabilities.verification.e2e;
+  if (has(tests, "e2e_setup_pending")) verification.e2e_setup_pending = tests.e2e_setup_pending;
+  else if (has(legacyCapabilities.verification || {}, "e2e_setup_pending")) verification.e2e_setup_pending = legacyCapabilities.verification.e2e_setup_pending;
   if (Object.keys(verification).length) capabilities.verification = verification;
   if (Object.keys(capabilities).length) out.capabilities = capabilities;
 
@@ -885,6 +889,8 @@ export function toNewLayoutConfig(runtimeConfig = {}, schemaRef = "./config.sche
   const verification = isObject(capabilities.verification) ? capabilities.verification : {};
   if (has(verification, "browser")) layout.tests.browser = verification.browser;
   if (has(verification, "require_browser")) layout.tests.require_browser = verification.require_browser;
+  if (has(verification, "e2e")) layout.tests.e2e = verification.e2e;
+  if (has(verification, "e2e_setup_pending")) layout.tests.e2e_setup_pending = verification.e2e_setup_pending;
   if (has(planning, "verify_denylist")) layout.tests.verify_denylist = planning.verify_denylist;
 
   // safety

package/scripts/config-migration.mjs

@@ -226,8 +226,8 @@ function migrateLegacyRuntime(input, existingMeta = {}) {
   // the policy invalid — a wrap-up at/above its cap, or a non-planner role cap
   // at/above the global ceiling. Degrade the offending value to its default so
   // migrateConfig never returns a config validatePolicyConfig rejects (the
-  // comparisons mirror validatePolicyConfig exactly, planner exempt from the
-  // global-ceiling check like it is there).
+  // comparisons mirror validatePolicyConfig exactly, planner and plan_reviewer
+  // exempt from the global-ceiling check like they are there).
   const effectiveCeiling = Number.isInteger(out.policy.per_task_max_tokens) && out.policy.per_task_max_tokens > 0
     ? out.policy.per_task_max_tokens
     : PER_TASK_MAX_TOKENS_DEFAULT;
@@ -239,7 +239,7 @@ function migrateLegacyRuntime(input, existingMeta = {}) {
   for (const role of reviewRoles) {
     const roleCaps = out.policy.caps?.[role];
     if (!roleCaps || typeof roleCaps !== "object" || Array.isArray(roleCaps)) continue;
-    if (role !== "planner") {
+    if (role !== "planner" && role !== "plan_reviewer") {
       const capTokens = Number(roleCaps.max_tokens);
       if (Number.isInteger(capTokens) && capTokens > 0 && capTokens >= effectiveCeiling) {
         roleCaps.max_tokens = PER_ROLE_CAPS_DEFAULT[role].maxTokens;

package/scripts/config-validation.mjs

@@ -260,7 +260,8 @@ export function validatePolicyConfig(policy = {}) {
     // Mission 031 Phase 1 task 1.4: validate policy.caps per-role entries.
     // Review roles: planner, plan_reviewer, code_reviewer, verifier.
     // Each entry requires positive integer max_turns, max_tokens, extra_sessions;
-    // max_tokens < effective token ceiling; extra_sessions >= 0;
+    // max_tokens < effective token ceiling (planner and plan_reviewer exempt);
+    // extra_sessions >= 0;
     // wrap_up_tokens_threshold optional, if present must be < max_tokens for review roles.
     const caps = policy.caps;
     if (caps !== undefined) {
@@ -288,12 +289,14 @@ export function validatePolicyConfig(policy = {}) {
           const maxTokens = roleCaps.max_tokens;
           if (maxTokens == null || !Number.isInteger(maxTokens) || maxTokens <= 0) {
             errors.push(`policy.caps.${roleName}.max_tokens must be a positive integer.`);
-          } else if (maxTokens >= globalCeiling && roleName !== "planner") {
+          } else if (maxTokens >= globalCeiling && roleName !== "planner" && roleName !== "plan_reviewer") {
             // Mission 039 task 1.4: planner is exempt from the sub-ceiling
             // check. Its code default (200K per-turn) intentionally exceeds the
             // ~180K implementer-oriented global default, and the relay enforces
             // planner caps via resolvePerRoleLimits, so the planner cap fires
-            // at its own max regardless of the global ceiling.
+            // at its own max regardless of the global ceiling. Backlog #8:
+            // plan_reviewer is exempt for the same reason — its code default is
+            // now 250K so a full plan re-check no longer splits at ~135K.
             errors.push(`policy.caps.${roleName}.max_tokens (${maxTokens}) must be strictly below the effective token ceiling (${globalCeiling}); otherwise the cap can never fire.`);
           }
           const extraSessions = roleCaps.extra_sessions;
@@ -564,7 +567,7 @@ const LEGACY_KEY_TARGETS = {
     role_requirements: "advanced.capabilities.role_requirements",
     safety_denied: "advanced.capabilities.safety_denied",
     legacy_text_inference: "advanced.capabilities.legacy_text_inference",
-    verification: "tests.browser, tests.require_browser",
+    verification: "tests.browser, tests.require_browser, tests.e2e",
   },
 };
 
@@ -640,6 +643,8 @@ const TESTS_KEYS = new Set([
   "require_reviewer",
   "browser",
   "require_browser",
+  "e2e",
+  "e2e_setup_pending",
   "verify_denylist",
 ]);
 
@@ -696,6 +701,7 @@ const FREE_MODELS_KEYS = new Set(["auto_fallback", "max_turns"]);
 // shipped config.schema.json cannot drift.
 const BROWSER_VALUES = new Set(SCHEMA_ENUMS["tests.browser"]);
 const REQUIRE_BROWSER_VALUES = new Set(SCHEMA_ENUMS["tests.require_browser"]);
+const E2E_VALUES = new Set(SCHEMA_ENUMS["tests.e2e"]);
 const PLANNING_FRAMEWORK_VALUES = SCHEMA_ENUMS["project.planning_framework"];
 
 function isObject(value) {
@@ -1002,6 +1008,8 @@ function validateTestsConfig(tests, path, errors, warnings) {
   if (tests.require_reviewer !== undefined) validateType(tests.require_reviewer, "boolean", `${path}.require_reviewer`, errors);
   if (tests.browser !== undefined) validateType(tests.browser, "string", `${path}.browser`, errors, Array.from(BROWSER_VALUES));
   if (tests.require_browser !== undefined) validateType(tests.require_browser, "string", `${path}.require_browser`, errors, Array.from(REQUIRE_BROWSER_VALUES));
+  if (tests.e2e !== undefined && tests.e2e !== null) validateType(tests.e2e, "string", `${path}.e2e`, errors, Array.from(E2E_VALUES));
+  if (tests.e2e_setup_pending !== undefined) validateType(tests.e2e_setup_pending, "boolean", `${path}.e2e_setup_pending`, errors);
   if (tests.verify_denylist !== undefined) {
     if (!Array.isArray(tests.verify_denylist)) {
       errors.push(`${path}.verify_denylist: must be an array.`);

package/scripts/e2e-detect.mjs

@@ -0,0 +1,30 @@
+// Detects whether a repo is a UI project and which e2e tool it already uses.
+// Reads BOTH dependencies and devDependencies of package.json.
+import fs from "node:fs";
+import path from "node:path";
+
+const UI_PACKAGES = ["react", "next", "vue", "svelte", "angular", "@angular/core"];
+const E2E_TOOLS = [
+  ["@playwright/test", "playwright"],
+  ["cypress", "cypress"],
+];
+
+function readDeps(repo) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(repo, "package.json"), "utf8"));
+    return { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+  } catch {
+    return {};
+  }
+}
+
+export function detectUiProject(repo) {
+  const deps = readDeps(repo);
+  return UI_PACKAGES.some((name) => Object.hasOwn(deps, name));
+}
+
+export function detectE2eTool(repo) {
+  const deps = readDeps(repo);
+  for (const [name, tool] of E2E_TOOLS) if (Object.hasOwn(deps, name)) return tool;
+  return null;
+}

package/scripts/escalation-naming.mjs

@@ -50,6 +50,25 @@ export function decideEscalationName({failureClass, retryable, used, limit, budg
         : "RATE_LIMITED is not retryable; resume with `ap run` after the limit lifts";
       return {step: "rate_limited_escalation", detail};
     }
+    // The CLI's own credentials are unusable. Same-adapter retry (and any
+    // same-adapter fallback) cannot fix it; the operator must log the CLI in
+    // again. The adapter/binary and the CLI's own reason travel on the auth
+    // observation's evidence.
+    if (failureClass === "AUTH_REQUIRED") {
+      let adapter = null;
+      let reason = null;
+      if (Array.isArray(evidence)) {
+        for (const entry of evidence) {
+          if (!entry || typeof entry !== "object") continue;
+          if (adapter == null && typeof entry.adapter === "string" && entry.adapter !== "") adapter = entry.adapter;
+          if (reason == null && typeof entry.reason === "string" && entry.reason !== "") reason = entry.reason;
+          if (adapter != null && reason != null) break;
+        }
+      }
+      const cli = adapter || "the CLI";
+      const why = reason ? ` (${reason})` : "";
+      return {step: "auth_required_escalation", detail: `${cli} is logged out${why} — run \`${cli}\` and log in, then \`ap run\``};
+    }
     return {step: "non_retryable_failure", detail: `${failureClass} is not retryable`};
   }
   if (budget == null) {

package/scripts/failure-contract.mjs

@@ -1,4 +1,4 @@
-import {renderFinding} from "./review-feedback.mjs";
+import {normalizeFindings, renderFinding} from "./review-feedback.mjs";
 
 export const FAILURE_SCHEMA = "autopilot-failure.v1";
 
@@ -11,7 +11,7 @@ export const FAILURE_CLASSES = Object.freeze([
   "PERMISSION_DENIED", "PATH_UNSUPPORTED", "INVOCATION_MISMATCH",
   "STRUCTURED_OUTPUT_MISSING", "STRUCTURED_OUTPUT_INVALID",
   "READ_ONLY_VIOLATION", "GIT_MUTATION_BLOCKED", "GIT_COMMIT_DETECTED",
-  "COMMAND_FAILED", "SERVER_UNAVAILABLE", "RATE_LIMITED", "PROVIDER_ERROR", "IDLE_HANG", "IMPLEMENTATION_REJECTED",
+  "COMMAND_FAILED", "SERVER_UNAVAILABLE", "RATE_LIMITED", "AUTH_REQUIRED", "PROVIDER_ERROR", "IDLE_HANG", "IMPLEMENTATION_REJECTED",
   "VERIFICATION_REJECTED", "PLANNING_REJECTED", "INTERNAL_CONTRACT_ERROR"
 ]);
 
@@ -107,6 +107,9 @@ export function parseReviewContract(output) {
         // Backlog #118: optional per-previous-finding fixed/not_fixed record
         // (code-review rounds 2+). Tolerant: absent/malformed -> [].
         previous: normalizePreviousStatuses(review.previous),
+        // Backlog #8: optional minor notes from a plan review. They never
+        // fail the review; strings only, bounded like findings.
+        notes: normalizeFindings(Array.isArray(review.notes) ? review.notes.filter(note => typeof note === "string") : []),
       },
       failure: null
     };
@@ -211,9 +214,20 @@ export function classifyObservedFailure(observation) {
   // 4. Structured terminal rate limit — a CLI-protocol status field, not
   // text scraped from prose, so it is authoritative regardless of exit code.
   if (eventTypes.has("rate_limited")) return failure("RATE_LIMITED", "infrastructure", false, evidence);
-  // 4b. Backlog #106: structured provider-side error (opencode UnknownError).
-  // Retryable (one same-model retry may be spent) but also a role-fallback
-  // trigger like RATE_LIMITED, so a configured fallback is tried first.
+  // 4a. The CLI itself is logged out (claude 401 / revoked or expired OAuth).
+  // Non-retryable and adapter-domain: retrying the same CLI cannot restore
+  // credentials. Placed beside RATE_LIMITED, before every generic adapter
+  // error, so it can never degrade to a retryable PROCESS_EXIT_NONZERO.
+  if (eventTypes.has("auth_required")) return failure("AUTH_REQUIRED", "adapter", false, evidence);
+  // 4b. OpenCode 2.x without --standalone cannot resolve the config-defined
+  // agent ("Agent not found: ..."). That is an invocation/config failure, not
+  // a provider limit and not an idle hang: name it explicitly and do not
+  // retry the same invocation.
+  if (eventTypes.has("agent_not_found")) return failure("INVOCATION_MISMATCH", "adapter", false, evidence);
+  // 4c. Backlog #106: structured provider-side error (opencode UnknownError,
+  // and 2.x provider.no-route / "Model unavailable"). Retryable (one
+  // same-model retry may be spent) but also a role-fallback trigger like
+  // RATE_LIMITED, so a configured fallback is tried first.
   if (eventTypes.has("provider_error")) return failure("PROVIDER_ERROR", "infrastructure", true, evidence);
   // 5. Structured failed permission/path/server evidence — trusted because
   // it comes from the adapter's own canonicalized tool-call outcome
@@ -259,7 +273,7 @@ export function classifyObservedFailure(observation) {
 // error line (which stays PROCESS_EXIT_NONZERO); only silence or explicit
 // limit text is reclassified, so the normal fallback path runs instead of
 // burning the adapter retry budget and stopping.
-const OPENCODE_LIMIT_TEXT = /(?:\b429\b|rate[_\s-]?limit|too many requests|insufficient[_\s-]?(?:quota|funds)|quota[_\s-]?(?:exceeded|exhausted))/i;
+const OPENCODE_LIMIT_TEXT = /(?:\b429\b|rate[_\s-]?limit|too many requests|insufficient[_\s-]?(?:quota|funds)|quota[_\s-]?(?:exceeded|exhausted)|free usage limit reached|usage limit reached|subscribe to [^\n]{0,80}to keep going)/i;
 export function reclassifySilentOpenCodeFailure(observed, { adapter, output, stderr } = {}) {
   if (!observed || observed.class !== "PROCESS_EXIT_NONZERO" || adapter !== "opencode") return observed;
   const answer = String(output || "").trim();
@@ -318,7 +332,7 @@ export function verdictFailure(roleName, verdict) {
 // deliberately absent here — so a warning-only observation set on a clean
 // exit classifies to null below and the relay mapping falls through to the
 // missing-sentinel STRUCTURED_OUTPUT_MISSING path.
-const TRUSTED_FAILURE_EVENT_TYPES = new Set(["rate_limited", "provider_error", "permission_denied", "path_unsupported", "server_unavailable"]);
+const TRUSTED_FAILURE_EVENT_TYPES = new Set(["rate_limited", "auth_required", "agent_not_found", "provider_error", "permission_denied", "path_unsupported", "server_unavailable"]);
 // Reviewer FAIL verdicts live in the failure class (their findings are plain
 // strings, not typed events), so they are exempt from the evidence check.
 const VERDICT_FAILURE_CLASSES = new Set(["IMPLEMENTATION_REJECTED", "VERIFICATION_REJECTED", "PLANNING_REJECTED"]);
@@ -630,8 +644,10 @@ export function recordFailureBudget(state, policy, observedFailure, scope) {
   const limit = positiveInteger(policy?.failure_budgets?.[name], defaultBudget(name));
   // RATE_LIMITED escalates immediately without consuming the budget: the
   // counter is never incremented, so the key stays unset and every such
-  // failure reports allowed:false.
-  if (observedFailure?.class === "RATE_LIMITED") return {allowed: false, budget: name, used: 0, limit, scope};
+  // failure reports allowed:false. AUTH_REQUIRED is the same shape — logging
+  // in again is an operator action, not a retry — so it must not burn the
+  // adapter budget either.
+  if (observedFailure?.class === "RATE_LIMITED" || observedFailure?.class === "AUTH_REQUIRED") return {allowed: false, budget: name, used: 0, limit, scope};
   const key = `${name}:${scope}`;
   state.failureBudgets = state.failureBudgets || {};
   state.failureBudgets[key] = (state.failureBudgets[key] || 0) + 1;

package/scripts/gen-config-schema.mjs

@@ -132,6 +132,8 @@ const DESCRIPTIONS = {
   "tests.require_reviewer": "Intended to require a reviewer verdict before a phase passes. Fixed in this version; changing it has no effect.",
   "tests.browser": "Browser capability used for verification: native (the agent's own browser), playwright or both.",
   "tests.require_browser": "How browser capabilities are required for the verifier: always adds them to every call; when-task-requires and never add them only when the task itself needs a browser.",
+  "tests.e2e": "End-to-end test tool for UI projects: playwright, cypress or none. Unset (null) = setup asks once; treated as none until answered.",
+  "tests.e2e_setup_pending": "True while an end-to-end tool setup is still pending for the project; unset or false means nothing is pending.",
   "tests.verify_denylist": "Commands or paths that a task or verification step may never run; empty adds no bans beyond the built-in full-suite ban.",
 
   safety: "What roles may do and which safety checks are enforced.",
@@ -227,6 +229,7 @@ export const ENUMS = {
   "runtime.mode": ["auto", "linux-strong", "wsl2-strong", "windows-compatibility"],
   "tests.browser": ["native", "playwright", "both"],
   "tests.require_browser": ["always", "when-task-requires", "never"],
+  "tests.e2e": ["playwright", "cypress", "none"],
   "roles.*.cli": CLI_VALUES,
   "roles.*.reasoning": REASONING_VALUES,
   "roles.*.fallbacks[].cli": CLI_VALUES,
@@ -426,6 +429,10 @@ export function buildConfigSchema() {
   for (const role of ESCALATION_MODEL_ROLES) {
     properties.roles.properties[role].properties.escalation_model = escalationModelSchema();
   }
+  // Schema-only keys: not in DEFAULTS, so they stay out of config.example.json.
+  // Unset (null) means never asked; setup/config asks the operator once.
+  properties.tests.properties.e2e = {type: ["string", "null"], description: descriptionFor("tests.e2e"), default: null, enum: [...enumFor("tests.e2e"), null]};
+  properties.tests.properties.e2e_setup_pending = {type: "boolean", description: descriptionFor("tests.e2e_setup_pending"), default: false};
   return {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     $id: "https://project-autopilot.dev/config.schema.json",

package/scripts/idle-hang-watchdog.mjs

@@ -76,6 +76,10 @@ export const RATE_LIMIT_CONFIRM_MATCHES = 1;
 export const RATE_LIMIT_CONFIRM_GAP_MS = 60_000;
 // Bounded log reads: only appended bytes are ever scanned, capped.
 export const RATE_LIMIT_LOG_TAIL_BYTES = 256 * 1024;
+// The reason value a free-tier quota/billing rejection records. Exported so
+// call sites (autopilot.mjs, adapter-drivers.mjs) never hand-build the
+// literal; it is a label on the unchanged RATE_LIMITED path, not a new class.
+export const FREE_QUOTA_REASON = "free_quota_exhausted";
 
 // opencode's OWN log (logfmt), not model prose: `AI_APICallError` and
 // `AI_RetryError` are engine-level error values. Observed live in
@@ -85,8 +89,26 @@ export const RATE_LIMIT_LOG_TAIL_BYTES = 256 * 1024;
 //   exceeded. Please retry after a brief wait."
 // Bare AI_RetryError ALSO fires for non-rate-limit errors ("Cannot connect
 // to API"), so the rate-limit marker is required in both branches.
-const RATE_LIMIT_MARKER = /rate[_\s]limit[_\s]exceeded|endpoint is unavailable|insufficient account funds|status_?code[=:"\s]+429\b/i;
+// Backlog #14: a free-tier quota rejection has no status code at all:
+//   error.error="AI_APICallError: Free usage limit reached. Free models work
+//   in OpenCode (https://opencode.ai); subscribe to OpenCode Go to keep
+//   going: https://opencode.ai/go"
+// It is the same operator-visible state as a 429 (stop, switch model), so
+// the marker covers quota/billing exhaustion too. The source check below
+// still requires an engine error token, so model prose never matches.
+const FREE_QUOTA_MARKER = /free usage limit reached|usage limit reached|insufficient[_\s-]?quota|quota[_\s-]?(?:exceeded|exhausted)|subscribe to [^\n]{0,80}to keep going/i;
+const RATE_LIMIT_MARKER = new RegExp(`rate[_\\s]limit[_\\s]exceeded|endpoint is unavailable|insufficient account funds|status_?code[=:"\\s]+429\\b|${FREE_QUOTA_MARKER.source}`, "i");
+// Backlog #107: the small title-generation model's stream errors
+// (small=true agent=title) say nothing about the role's own model. Shared
+// with adapter-drivers.mjs so both stderr scanners ignore the same lines.
+export const OPENCODE_TITLE_MODEL_LINE_RE = /\bsmall=true\b|\bagent=title\b/;
 const RATE_LIMIT_SOURCE = /AI_APICallError|AI_RetryError/;
+// 2.x logfmt ERROR lines do not name the 1.x AI SDK error class; they carry
+// server-role/cause structure instead (real 2.2.0 capture in
+// scripts/test-fixtures/opencode-2x-run-bad-model.stderr.txt). Accept those
+// too, but only as a logfmt line — the JSON-stdout and no-source guards in
+// rateLimitLineInfo() below still keep model prose/tool text out.
+const OPENCODE_2X_ENGINE_ERROR_LINE = /\blevel=ERROR\b[^\n]*(?:\brole=server\b|\bcause=)/;
 const PROVIDER_ID_RE = /providerID=([^\s]+)/;
 const MODEL_ID_RE = /modelID=([^\s]+)/;
 const LOG_TIMESTAMP_RE = /timestamp=([0-9T:.\-+Z]+)/;
@@ -131,11 +153,15 @@ export function rateLimitLineInfo(line) {
   const text = String(line ?? "");
   // Backlog #107: the small title-generation model's stream errors (small=true
   // agent=title) say nothing about the role's own model.
-  if (/\bsmall=true\b|\bagent=title\b/.test(text)) return null;
-  if (!RATE_LIMIT_SOURCE.test(text) || !RATE_LIMIT_MARKER.test(text)) return null;
+  if (OPENCODE_TITLE_MODEL_LINE_RE.test(text)) return null;
+  // Only opencode's own logfmt ERROR lines count. A JSON event is the model's
+  // stdout channel (tool text can quote a log line verbatim), never the
+  // engine log, so it must not be mistaken for a provider rejection.
+  if (/^\s*\{/.test(text)) return null;
+  if (!(RATE_LIMIT_SOURCE.test(text) || OPENCODE_2X_ENGINE_ERROR_LINE.test(text)) || !RATE_LIMIT_MARKER.test(text)) return null;
   const provider = text.match(PROVIDER_ID_RE)?.[1] ?? null;
   const model = text.match(MODEL_ID_RE)?.[1] ?? null;
-  return {provider, model};
+  return {provider, model, reason: FREE_QUOTA_MARKER.test(text) ? FREE_QUOTA_REASON : "rate_limit"};
 }
 
 // Newest *.log under <baseDir>/log/ (opencode rotates there). Null when the
@@ -590,11 +616,12 @@ export function formatIdleHangMessage({role, adapter, model, idleMs, maxSilence
   return `IDLE_HANG: ${who} produced no output, ran no command and wrote no file for ${formatIdleMinutes(idleMs)}`;
 }
 
-export function formatRateLimitedMessage({role, adapter, model, provider}) {
+export function formatRateLimitedMessage({role, adapter, model, provider, freeQuota = false}) {
   const modelLabel = model || adapter;
   const providerLabel = provider && provider !== adapter ? `${provider}/${modelLabel}` : modelLabel;
+  const quotaLabel = freeQuota ? " — free quota used up" : "";
   return (
-    `RATE_LIMITED: ${role} (${adapter}, ${model || "unknown model"}) hit a provider rate limit (${providerLabel}); ` +
+    `RATE_LIMITED: ${role} (${adapter}, ${model || "unknown model"}) hit a provider rate limit${quotaLabel} (${providerLabel}); ` +
     `opencode retried silently in its own log. The operator may need to wait or re-login ` +
     `(\`opencode auth login\` inside WSL — the WSL and Windows opencode accounts are separate).`
   );
@@ -854,7 +881,7 @@ export function evaluateIdleWatch(watch, {now = Date.now(), platform = process.p
       /* log tailing is best-effort; the idle watchdog still applies */
     }
     if (rateLimitConfirmed(watch, now)) {
-      return {status: "rate_limited", provider: watch.rateLimitDetail?.provider ?? null, model: watch.rateLimitDetail?.model ?? null};
+      return {status: "rate_limited", provider: watch.rateLimitDetail?.provider ?? null, model: watch.rateLimitDetail?.model ?? null, reason: watch.rateLimitDetail?.reason ?? null};
     }
   }
   const quietFor = now - watch.lastActivityAt;

package/scripts/implementation-baseline.mjs

@@ -223,6 +223,60 @@ function manifestPath(repo, key) {
   return path.join(baselineDir(repo, key), "manifest.json");
 }
 
+// The repo-relative path of the NEAREST ancestor of `rel` that is a symlink
+// in the working tree, or null. lstat only, so links are never followed.
+// A path under a symlink is not an independent working-tree entry: the
+// symlink itself is the only real thing on disk, and Git can still report
+// tracked paths beneath it (e.g. committed on Windows with
+// core.symlinks=false) as deleted/untracked. Capture and diff must therefore
+// represent the symlink once and skip its descendants, never read a file
+// "through" the link.
+function symlinkAncestor(repo, rel) {
+  const segments = String(rel).split("/").filter(Boolean);
+  let cur = repo;
+  let curRel = "";
+  for (let i = 0; i < segments.length - 1; i++) {
+    curRel = curRel ? `${curRel}/${segments[i]}` : segments[i];
+    cur = path.join(cur, segments[i]);
+    let st;
+    try {
+      st = fs.lstatSync(cur);
+    } catch (e) {
+      if (e.code === "ENOENT" || e.code === "ENOTDIR") return null;
+      throw new Error(`implementation-baseline: failed to inspect '${cur}': ${e.message}`);
+    }
+    if (st.isSymbolicLink()) return curRel;
+  }
+  return null;
+}
+
+// The kind of whatever already occupies a baseline snapshot path, or null if
+// nothing does. Defensive: a previous interrupted capture can leave stale
+// snapshot entries behind (the manifest is written last), and recreating a
+// symlink on top of an existing directory otherwise fails with a raw EEXIST.
+function existingSnapshotKind(snapshotPath) {
+  let st;
+  try {
+    st = fs.lstatSync(snapshotPath);
+  } catch (e) {
+    if (e.code === "ENOENT" || e.code === "ENOTDIR") return null;
+    throw new Error(`implementation-baseline: failed to inspect baseline snapshot '${snapshotPath}': ${e.message}`);
+  }
+  if (st.isSymbolicLink()) return "symlink";
+  if (st.isDirectory()) return "directory";
+  if (st.isFile()) return "file";
+  return "other";
+}
+
+function snapshotConflictError(rel, snapshotPath, existingKind) {
+  return new Error(
+    `implementation-baseline: refusing to overwrite existing baseline snapshot '${snapshotPath}' for repository path '${rel}' (found ${existingKind}). ` +
+    `This usually means the working tree has a symlink at or above '${rel}' while Git tracks regular file(s) beneath that path ` +
+    `(for example commits made on Windows with core.symlinks=false); the symlink must be recorded once as a symlink and its descendants skipped, ` +
+    `never captured as separate files through the link.`
+  );
+}
+
 // Symlink-safe classification of a filesystem path: NEVER follows a
 // symlink to inspect what it points to. Returns one of:
 //   {kind:"absent"}                 -- nothing at this path
@@ -247,8 +301,11 @@ function classifyEntry(abs) {
 // Captures the CURRENT dirty/untracked state as the baseline for `key`, but
 // only the first time it is called for that key — every later call
 // (a retry of the same phase, or a resumed process) is a no-op, so a
-// failed attempt's own changes are never folded into the baseline. Never
-// deletes or recreates an existing baseline.
+// failed attempt's own changes are never folded into the baseline. A
+// baseline directory WITHOUT manifest.json is an incomplete capture (the
+// manifest is written last), so its stale snapshot copies are discarded and
+// recaptured rather than layered on top of; a complete baseline is never
+// deleted or recreated.
 export function ensureBaseline(repo, key, opts={}) {
   const mission = opts.mission ?? null;
   const rawDeclared = Array.isArray(opts.declaredPaths) ? opts.declaredPaths : [];
@@ -267,6 +324,11 @@ export function ensureBaseline(repo, key, opts={}) {
   }
   const dir = baselineDir(repo, key);
   const filesDir = path.join(dir, "files");
+  // No manifest means an interrupted capture (manifest.json is written
+  // LAST). Its snapshot copies may include stale REAL directories where a
+  // symlink now belongs, which would otherwise collide on resume. Discard
+  // the incomplete snapshot and capture cleanly from the working tree.
+  fs.rmSync(filesDir, {recursive: true, force: true});
   const entries = {};
   for (const entry of statusEntries(repo)) {
     recordBaselineEntry(repo, filesDir, entries, entry.path);
@@ -398,6 +460,14 @@ function readManifest(file){
 
 function recordBaselineEntry(repo, filesDir, manifest, rel) {
   if (manifest[rel]) return;
+  // Deterministic regardless of the order paths arrive in: any path under a
+  // working-tree symlink collapses to that symlink (captured once); the
+  // descendant itself is never recorded as a separate file through the link.
+  const ancestor = symlinkAncestor(repo, rel);
+  if (ancestor) {
+    recordBaselineEntry(repo, filesDir, manifest, ancestor);
+    return;
+  }
   const abs = path.join(repo, rel);
   const classified = classifyEntry(abs);
   if (classified.kind === "absent") {
@@ -405,8 +475,12 @@ function recordBaselineEntry(repo, filesDir, manifest, rel) {
     return;
   }
   if (classified.kind === "file") {
-    manifest[rel] = {type: "file"};
     const snapshotPath = path.join(filesDir, rel);
+    const existing = existingSnapshotKind(snapshotPath);
+    if (existing && existing !== "file") {
+      throw snapshotConflictError(rel, snapshotPath, existing);
+    }
+    manifest[rel] = {type: "file"};
     fs.mkdirSync(path.dirname(snapshotPath), {recursive: true});
     fs.copyFileSync(abs, snapshotPath);
     return;
@@ -419,8 +493,18 @@ function recordBaselineEntry(repo, filesDir, manifest, rel) {
     // handing this snapshot symlink straight to `git diff --no-index`
     // later compares target strings safely, with no code in this module
     // ever opening the pointed-to file on either side.
-    manifest[rel] = {type: "symlink", target: classified.target};
     const snapshotPath = path.join(filesDir, rel);
+    const existing = existingSnapshotKind(snapshotPath);
+    if (existing) {
+      let existingTarget = null;
+      try { existingTarget = fs.readlinkSync(snapshotPath); } catch { /* not a link */ }
+      if (existing === "symlink" && existingTarget === classified.target) {
+        manifest[rel] = {type: "symlink", target: classified.target};
+        return;
+      }
+      throw snapshotConflictError(rel, snapshotPath, existing);
+    }
+    manifest[rel] = {type: "symlink", target: classified.target};
     fs.mkdirSync(path.dirname(snapshotPath), {recursive: true});
     fs.symlinkSync(classified.target, snapshotPath);
     return;
@@ -521,6 +605,13 @@ export function scopedDeltaChunks(repo, key, opts={}) {
   const allPaths = new Set([...Object.keys(manifestEntries), ...entries.map(e => e.path), ...declaredPaths]);
   const chunks = [];
   for (const rel of allPaths) {
+    // A path under a working-tree symlink is represented by that symlink
+    // alone (see recordBaselineEntry). Git status still lists the tracked
+    // files beneath such a path as deleted/untracked, and diffing them
+    // "through" the link would invent changes that are really just the
+    // pre-existing symlink-vs-tracked-files shape. The symlink's own entry
+    // (if any) is processed normally below.
+    if (symlinkAncestor(repo, rel)) continue;
     const baseEntry = manifestEntries[rel] || null;
     const currentAbs = path.join(repo, rel);