The contamination check at executor.ts was reusing task.baseCommitSha as
its reference SHA. That field is intentionally preserved across resumed
sessions for stable diff math, which means it can lag behind main by
many commits. Passing it to assertCleanBranchAtBase caused every
legitimately-merged commit on main since the stale SHA to be reported
as a foreign task-attributed contamination commit, pausing the task
with pausedReason=branch-cross-contamination.
FN-4403 was the trigger case: a pooled worktree was force-reset to
current main by WorktreePool.prepareForTask (correctly), then the
executor immediately ran assertCleanBranchAtBase(rootDir, branch,
staleBaseCommitSha, taskId) and flagged 157 commits across ~39
unrelated FN-* tasks as contamination. FN-4417 itself then hit the
same bug when it tried to start, blocking the board.
Two fixes, both in packages/engine/src/executor.ts:
1. New resolveContaminationBaseRef(worktreePath) computes a fresh
merge-base against origin/main or main and is used in place of
resolveDiffBaseRef for the contamination check. It never reads
task.baseCommitSha and never falls back to HEAD~1 (which on a
force-reset pooled branch would be a main commit and re-introduce
the same false positive at smaller scale). Returns undefined on
git failure so the caller treats it as check skipped.
2. captureBaseCommitSha gains an explicit { isResume: boolean }
parameter and only preserves an existing baseCommitSha when
isResume is true. On fresh/pool acquisitions the branch was just
force-reset to current main, so the stored value is stale by
definition. Always recapture in that case. Diff-base stability
across resumed sessions (FN-4309/FN-4383) is preserved by passing
isResume: true on resume; the existing executor call site is
already gated on non-resume and passes false.
Tests:
- executor-base-commit-capture.test.ts: updated to thread isResume
through assertions and added a FN-4417 regression case that verifies
a stale-but-ancestor baseCommitSha is recaptured (not preserved) on
non-resume.
- executor-base-commit-capture.real-git.test.ts: FN-4309/FN-4383
multi-session test now explicitly passes isResume: true on the
second capture, matching the real resume code path.
- executor-contamination-base.test.ts (new): three focused tests for
resolveContaminationBaseRef covering fresh-merge-base resolution,
graceful failure when neither origin/main nor main resolves, and a
structural guard that the function arity is 1 (no baseCommitSha
parameter, so the bug cannot regress through that surface).
Verified: 4265 engine tests pass; tsc clean.
Fusion-Task-Id: FN-4417
- Add FN-4404 investigation notes under docs/
- Record the missing agent and heartbeat evidence gathered during preflight
- Document why the absent runtime state blocks Case A/B/C classification
- List the runtime data needed to unblock the remaining investigation steps
Fusion-Task-Id: FN-4404
Merged: Validates file scope tokens during prompt parsing and write operations in the task store, adding ~160 lines of logic to `packages/core/src/store.ts` with corresponding test coverage in `store-parsing.test.ts`. Also updated AGENTS.md documentation and created a changeset for the `@runfusion/f
Fusion-Task-Id: FN-4402
