FE-1114: Add executor replanning guards

[kostandinang]

Why

Executor runs could be launched or retried from an old saved plan after the spec graph changed. This makes freshness explicit and gives the human a safe recovery path instead of mutating or deleting prior run evidence.

What

• Plan freshness: writes provenance beside generated executor plan.yaml files; blocks launch/run creation when the saved plan is stale, missing provenance, projection-blocked, or mismatched with the current graph projection.
• Run diagnosis: adds run freshness checks, retry/replan eligibility, and a read-only execute_replan_recommendation tool with diagnosis text plus allowed/recommended HITL actions.
• Replan actions: adds explicit tools to start a linked fresh run (supersedesRunId), retry exactly one safe current step, regenerate an early stale plan, and abandon an active run while preserving artifacts.
• Safety guards: prevents run-id overwrite, separates blocked projection from stale-plan replanning, and stops in-place regeneration after the run-local plan copy exists.
• Inspection: surfaces supersedesRunId, abandonedAt, and abandonReason in run list/detail projections and web run views.

How to test from the TUI

1. Start Brunch in TUI mode, switch to Execute mode, and create/write an executor plan with execute_plan_file.
2. Change the selected spec graph, then run execute_launch; it should refuse the old plan as stale instead of reporting ready.
3. Use execute_replan_recommendation on an existing run, then choose the suggested recovery tool (execute_replan_start_new_run, execute_replan_retry_current_step, execute_replan_regenerate_plan, or execute_replan_abandon_run).
4. Open the web sidecar /runs view and confirm linked/abandoned run metadata is visible.

Verification

• npm run verify

[cursor]

PR Summary

Medium Risk
Changes core executor launch, run creation, and orchestration paths with many new mutation tools; mistakes could allow stale-plan execution or unsafe replanning, though eligibility guards and extensive tests mitigate this.

Overview
Executor replanning (FE-1114) ties launch and run lifecycle to the current graph, and adds read-only diagnosis plus bounded HITL actions when a run’s plan is stale or unsafe to continue.

Plan freshness: execute_plan_file now writes sibling plan.provenance.json (graph LSN, mode, visibility). execute_launch and execute_run_create take a current projection and refuse ready/creation when the plan is missing, lacks provenance, is stale, or the projection is blocked—not merely when plan.yaml exists. Worktree populate copies provenance into the run-local plan path; run freshness checks that copy after population.

Replanning core: New helpers classify run freshness, retry eligibility, human recommendations, superseding run creation (supersedesRunId), and evidence-preserving abandon (abandoned status). Replan tools resolve graph context from the run’s spec via GraphReaders.forSpec, not only the session-selected spec.

Execute tools: execute_replan_recommendation (read-only), execute_replan_start_new_run, execute_replan_retry_current_step (one drive step), execute_replan_regenerate_plan (early stale runs only; blocked projection refuses write), and execute_replan_abandon_run. All are registered in active Execute mode and covered by registry tests.

Projection tweak: Non–requirement-to-requirement dependency edges no longer block plan readiness as “unprojected”; only requirement-to-requirement edges become slice depends_on.

Observability: Run list/detail (and related cards) expose supersedesRunId, abandonedAt, and abandonReason. Memory cards document the frontier slices; executor prompt/TOPOLOGY updated.

^{Reviewed by Cursor Bugbot for commit 28e2d4d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kostandinang]

• FE-1141: Add readable run evidence and graph traceability #303
• FE-1166: Add executor run policy #302
• FE-1114: Add executor replanning guards #300 👈 (View in Graphite)
• next

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8c44dc8. Configure here.}