[SDK/breakpoint] Rejection-recovery loop — don't hard-abort on breakpoint rejection

[rogelsm]

Summary

When an owner rejects a breakpoint, the run should branch into a re-scope/re-prompt task seeded with the rejection text and re-enter the iterate loop, rather than treating rejection as an immediate hard-abort.

Motivation / Evidence

cookbook native-apps-bugfix-jun-06 (run 01KTF43QXQBJ816D9TRXFXX50R) abandoned at BP-1 after the owner correctly rejected a wrong-scope spec (C1 'hide hands-free' baked in from an unresolved 'cloud-STT vs disable' product fork). The process hard-coded if(!bp1.approved) return {aborted:true} (process.js:238); ~3 days of re-scoped cloud-STT + H7 auth work then shipped via untracked direct commits (851407b, d1e09a9) and ~38 orphaned bf-build logs.

Proposal

On !approved, capture bp.response and branch into a re-scope / re-prompt task seeded with the rejection text, then re-enter the iterate loop. Abandonment should require an explicit owner Hold/abort choice, never be the default rejection path. Pairs with the documented retry/refine pattern.

Alternatives considered

• Leave hard-abort as default and rely on process authors to hand-roll recovery branches — this is exactly what failed here, since the boilerplate return {aborted:true} is the path of least resistance.
• Auto-retry without seeding the rejection text — wastes a loop because the agent re-proposes the same rejected scope.
• Document the pattern only — insufficient; the unsafe default needs to change, not just the docs.

Related

• [Processes] Breakpoint rejection silently ignored — ctx.breakpoint() return value unchecked #87 — breakpoint rejection return value going unchecked is the same class of silent-rejection-handling gap.
• Journal sequence collision when --non-interactive auto-approves multiple breakpoints; spurious RUN_FAILED follows #191 — non-interactive auto-approve / rejection sequencing context.
• Add 'babysitter run:halt' command for sealing divergent runs #880 (run:halt) covers explicit sealing; R1 instead keeps the run alive and recoverable after a rejection.

Reported from a cookbook babysitter retrospective (retro-jun-09) via /babysitter:contrib.