fix(loop): resume legacy frozen briefs

[Ethandasw]

Summary

• Resume durable issue runs whose frozen implementation brief predates the implementation-contract marker.
• Bind current and legacy contract sentinels to the end of the frozen issue snapshot, so issue-controlled markers and headings cannot impersonate the trusted contract boundary.
• Require an explicit, non-empty nested legacy implementation contract for markerless runs.
• Preserve issue-body template tokens literally by inserting the authoritative issue body only after system template replacements.
• Add positive and adversarial regressions for legacy selection, injected markers and headings, empty contracts, and literal template tokens.

Review response

Round-one Traviinam COMMENT review:
#125 (review)

• RVW-1-1-1 P1: removed the content-truthiness fallback to issue-controlled top-level sections.
• RVW-1-1-2 P1: ignored issue-supplied contract markers and headings before the frozen issue-snapshot boundary.

Round-two fresh-context Traviinam COMMENT review:
#125 (review)

• RVW-1-2-1 P2: preserved {{BASE_SHA}}, {{UI_EVIDENCE_REQUIRED}}, {{ISSUE_BODY}}, and replacement-pattern literals inside the authoritative issue body through freeze and implementation recording.

Verification

• Targeted current, legacy, adversarial, and literal-token regressions: passed
• pnpm loop:issue-dev:test: passed (112/112)
• pnpm loop:issue-dev:validate: passed (68 files)
• pnpm lint: passed
• pnpm verify: passed (exit code 0)
• React 18/19, Tone browser, Tailwind 3/4, package, example, and bilingual Nextra documentation checks: passed
• Installed control-plane activation validation: passed (68 files)

Authorization

• Owner authorization: [Loop] issue-dev-loop state journal #105 (comment)
• Base: 9eb629c1b24ded82dc3b84c71906406cdc66ab5f
• Head: f9923385795ceca8c69da9cab462a2196e23ae5e
• Automation actor: Ethandasw

Safety

This PR must remain Draft. Only codeacme17 may mark it Ready, approve it, or merge it. The two-round automated review limit has been reached; no third automated review will be started.

[Traviinam]

Fresh-context review of base 9eb629c → head 4554b66.

COMMENT-only review; this is not an approval or change request.

Findings

RVW-1-1-1 — P1 · high confidence

loops/issue-dev-loop/scripts/lib/run-store.mjs:331

legacyContractSource is selected by content truthiness. If the explicit legacy ## Frozen implementation contract is missing or empty, lines 331–336 fall back to the whole document at H2 level. Issue-controlled top-level decoy sections can then satisfy recordImplementation, including their targeted checks.

Reproduction against this exact head with an empty nested legacy contract selected:

["pnpm test -- issue-controlled-decoy","pnpm verify"]

Require the explicit legacy heading independently of its contents, parse only its H3 contract sections, reject missing/empty legacy contracts, and add a negative regression.

RVW-1-1-2 — P1 · high confidence

loops/issue-dev-loop/scripts/lib/run-store.mjs:328

Issue-controlled text can include <!-- issue-dev-loop:implementation-contract -->. Because marker presence disables legacy parsing, recordImplementation can ignore the later owner-frozen nested legacy contract and validate marker-following decoy sections instead.

Reproduction against this exact head selected the issue-controlled decoy checks rather than the nested legacy checks.

Bind format selection to the trusted generated boundary, prefer the legitimate explicit legacy contract for pre-marker briefs, and add an adversarial-marker regression.

Verification

• Existing targeted tests: 2/2 passed.
• Full runtime suite: 59/59 passed.
• Review was read-only; worktree remained clean at the exact head.

[Ethandasw]

Ethandasw repair response for Traviinam review #125 (review)

Both P1 findings were accepted and fixed in commit 228a7bd.

• RVW-1-1-1: removed the truthiness-based fallback. Markerless compatibility now requires an explicit legacy contract after the frozen issue-snapshot boundary and rejects empty, missing, or issue-supplied contracts.
• RVW-1-1-2: contract markers and legacy headings are considered only after the exact frozen issueSnapshot.body boundary, so issue-controlled sentinels cannot select decoy checks.

Evidence:

• targeted current/legacy/adversarial contract tests: 4/4 passed
• pnpm loop:issue-dev:test: 111/111 passed
• pnpm test: 12 files / 30 tests passed
• pnpm verify: passed (exit code 0)
• activation validation: 68 files passed

PR remains Draft.

[Traviinam]

Second-round fresh-context review of Draft PR #125.

Base: 9eb629c1b24ded82dc3b84c71906406cdc66ab5f
Head: 228a7bd33023d4e3bf3ac280a2132ef406a30ae8

COMMENT-only review; this is not an approval or change request.

The worktree is clean and the immutable base/head pair is confirmed.

Prior P1 status:

• RVW-1-1-1 is closed. Compatibility parsing now distinguishes heading presence from section contents, requires an explicit trusted legacy contract, and rejects empty, missing, or issue-supplied contracts.
• RVW-1-1-2 is closed. Marker and legacy-heading selection are constrained to the boundary after the recorded issue snapshot, with adversarial-marker regression coverage.
• Current freezeBrief strictness remains intact: legacy H3 parsing is enabled only by recordImplementation, and the current-format path still rejects H3 section impersonation.

RVW-1-2-1 — P2 · high confidence

File: loops/issue-dev-loop/scripts/lib/run-store.mjs:309

issueSnapshotBoundary() requires the brief to contain run.issueSnapshot.body byte-for-byte, but startRun() inserts ISSUE_BODY before later template substitutions for BASE_SHA and UI_EVIDENCE_REQUIRED. Consequently, a valid issue body containing literal {{BASE_SHA}} or {{UI_EVIDENCE_REQUIRED}} is rewritten in the generated brief while remaining unchanged in run.json. The brief can be completed and frozen, but every subsequent recordImplementation() fails with cannot locate the frozen issue snapshot boundary.

Reproduction:

const body = 'Keep {{BASE_SHA}} and {{UI_EVIDENCE_REQUIRED}} literal.'
const rendered = replaceTemplate(template, {
  ISSUE_BODY: body,
  BASE_SHA: 'a'.repeat(40),
  UI_EVIDENCE_REQUIRED: 'UNSET',
  // remaining normal template values
})

rendered.includes(`## Issue snapshot\n\n${body}`) // false

Observed rendering replaces the tokens with the SHA and UNSET, so the new boundary lookup returns -1.

Expected resolution: prevent template replacement from rewriting tokens inside injected issue content—such as with one-pass substitution or by inserting the issue body last—or derive the trusted boundary from a deterministically preserved snapshot representation. Add a regression that starts, freezes, and records an implementation for an issue body containing both literal placeholders.

Verification completed:

• pnpm loop:issue-dev:test: 111 passed
• Focused runtime suite: 61 passed
• ESLint on both changed files: passed
• git diff --check: passed
• Worktree remained clean

[Ethandasw]

Ethandasw repair response — round two

Review: #125 (review)

• RVW-1-2-1 (P2): ACCEPTED and FIXED
• Fix head: f9923385795ceca8c69da9cab462a2196e23ae5e

The frozen brief previously inserted the issue body before later system-template substitutions, so issue-authored literals such as {{BASE_SHA}}, {{UI_EVIDENCE_REQUIRED}}, and {{ISSUE_BODY}} could diverge from the byte-preserved snapshot used by implementation recording. The renderer now completes system replacements first, then inserts the authoritative issue body with a function replacer so template and replacement-pattern literals remain unchanged.

Regression coverage: issue template tokens remain literal through freeze and implementation recording.

Verification passed:

• targeted current, legacy, adversarial, and literal-token regressions
• pnpm loop:issue-dev:test (112/112)
• pnpm loop:issue-dev:validate (68 files)
• pnpm lint
• full pnpm verify (exit code 0)
• installed control-plane activation validation (68 files)

PR #125 remains Draft. The two-round automated review limit has been reached, so no third automated review will be started.