@agent-compose/sdk 0.8.3 → 0.8.5

package/src/runtimes/_cli-agent.ts

@@ -109,6 +109,67 @@ export function runnerBusySentinelFragment(busyPath: string, tasksPath: string):
  *  `date +%s%3N` in the same exec, so host clock skew is irrelevant) is
  *  stale: three missed writes. */
 export const RUNNER_HEARTBEAT_STALE_MS = RUNNER_HEARTBEAT_INTERVAL_SECONDS * 1000 * 3;
+
+// ── The tool-run pulse (child-telemetry contract, 2026-08-29) ───────────────
+// The "no signal 4m" report: a long foreground tool (`bun install`) emits
+// NOTHING on the stream — the CLI only speaks at tool boundaries — so the
+// transcript decayed to "no signal" over a provably-working machine. The
+// heartbeat subshell already beats every 10s; this fragment rides the same
+// beat and samples the RUNNER'S OWN SESSION (every process the setsid tree
+// holds): aggregate CPU jiffies + written bytes + live process count. The
+// durable-trio probe carries the newest sample as its trailing field; the
+// executor compares successive samples — counters ADVANCING is proof the
+// foreground tool is working, fanned to the client as a cheap live
+// `tool_pulse` frame (~one per activity tick, no output content). Absence
+// of advancing pulses while a tool is nominally running is then the REAL
+// no-signal. Cost: one `ps` + a few bounded /proc reads per beat; every
+// read degrades quiet (a guest without procps/proc writes nothing, and
+// the field parses absent — evidence-absent, never an error).
+
+/** The sh fragment the heartbeat subshell runs each beat to rewrite the
+ *  pulse file: `<guest epoch ms>,<cpu jiffies>,<written bytes>,<procs>`
+ *  for every process in the runner's own session (the setsid tree — the
+ *  CLI, its foreground tool, their children). Comma-separated so the
+ *  probe can carry it as ONE whitespace-delimited field. Exported for
+ *  tests. */
+export function toolPulseFragment(pulsePath: string): string {
+  return `ac_sid=$(ps -o sess= -p $$ 2>/dev/null | tr -cd 0-9); `
+    // sid "0" would match every process on a platform without real session
+    // ids — no sample beats a wrong one.
+    + `if [ -n "$ac_sid" ] && [ "$ac_sid" != "0" ]; then `
+    + `ac_pp=$(ps -eo pid=,sess= 2>/dev/null | awk -v s="$ac_sid" '$2==s{print $1}'); `
+    + `ac_cpu=$(for ac_p in $ac_pp; do sed 's/^.*) //' "/proc/$ac_p/stat" 2>/dev/null; done | awk '{s+=$12+$13} END{printf "%d", s}'); `
+    + `ac_io=$(for ac_p in $ac_pp; do cat "/proc/$ac_p/io" 2>/dev/null; done | awk '/^wchar:/{s+=$2} END{printf "%d", s}'); `
+    + `ac_np=$(printf '%s\\n' "$ac_pp" | grep -c .); `
+    + `printf '%s,%s,%s,%s' "$(date +%s%3N)" "\${ac_cpu:-0}" "\${ac_io:-0}" "\${ac_np:-0}" > ${shellQuote(pulsePath)} 2>/dev/null; `
+    + `fi`;
+}
+
+/** One tool-run pulse sample, parsed off the probe's trailing field. */
+export interface TurnToolPulse {
+  /** Guest epoch ms when the sample was written. */
+  atMs: number;
+  /** Aggregate utime+stime jiffies across the runner's session. */
+  cpuJiffies: number;
+  /** Aggregate written bytes (wchar) across the runner's session. */
+  ioBytes: number;
+  /** Live processes in the session. */
+  procs: number;
+}
+
+/** Parse the pulse token (`at,cpu,io,procs`). Null on anything malformed —
+ *  evidence-absent, never an error. Exported for tests. */
+export function parseToolPulseToken(token: string): TurnToolPulse | null {
+  const fields = token.split(",");
+  if (fields.length !== 4) return null;
+  const [atMs, cpuJiffies, ioBytes, procs] = fields.map((f) => Number.parseInt(f, 10));
+  if (!Number.isFinite(atMs) || atMs <= 0 || !Number.isFinite(cpuJiffies)
+    || !Number.isFinite(ioBytes) || !Number.isFinite(procs)) return null;
+  return { atMs: atMs!, cpuJiffies: cpuJiffies!, ioBytes: ioBytes!, procs: procs! };
+}
+
+/** Bound on the pulse token read (4 numeric fields + commas). */
+export const TOOL_PULSE_TOKEN_MAX_CHARS = 96;
 /** Watchdog cadence while a tail stream is attached. Each tick is one fresh
  *  short exec; a healthy stream makes every tick a no-op. */
 export const TAIL_WATCHDOG_INTERVAL_MS = 15_000;
@@ -124,6 +185,62 @@ export const TAIL_ABANDON_AFTER_STREAM_DEATHS = 3;
  *  (envd HTTP, ~65ms RTT), consumed from the byte offset. Latency-tuned:
  *  this is the degraded path, correctness never depends on it being fast. */
 export const DURABLE_POLL_INTERVAL_MS = 1_000;
+// ── Durable-poll death door (chaos S13 run 3, 2026-08-31) ───────────────────
+// The poll loop's `kill -0` probe answers "pid gone" ONLY through a
+// SUCCESSFUL exec; a DEAD sandbox's exec THROWS, which used to leave the
+// verdict at "unknown" forever — the transport polled a corpse until
+// something outside the SDK killed the turn. These bounds are the honest
+// exit. The K8s-Unknown philosophy still holds: a transport blip is never a
+// death verdict — the generic streak is deliberately generous (a count AND a
+// time window must BOTH be met, and any successful probe or durable read
+// resets everything), while provider-attested not-found evidence
+// (SandboxNotFoundError / "sandbox … not found") is trusted on a much
+// shorter streak because it names the sandbox, not the wire.
+
+/** Consecutive provider-attested "sandbox gone" probe failures ⇒ dead. */
+export const PROBE_DEATH_GONE_STREAK = 3;
+/** Not-found evidence must also persist this long (guards a momentary
+ *  control-plane 404 blip from killing a live turn). */
+export const PROBE_DEATH_GONE_WINDOW_MS = 15_000;
+/** Consecutive GENERIC probe-transport failures (timeouts, connection
+ *  faults) ⇒ dead — only together with the window below. */
+export const PROBE_DEATH_FAIL_STREAK = 20;
+/** …and the failure run must span at least this long with zero durable
+ *  evidence of any kind. */
+export const PROBE_DEATH_FAIL_WINDOW_MS = 120_000;
+
+/** Provider evidence that the SANDBOX itself is gone — E2B's
+ *  SandboxNotFoundError / NotFoundError classes (matched by name so no
+ *  provider import rides in the runtime layer), or their messages after any
+ *  wrapping ("Paused sandbox X not found" was run 3's exact shape). */
+export function isSandboxGoneError(err: unknown): boolean {
+  const name = (err as { name?: unknown } | null)?.name;
+  if (name === "SandboxNotFoundError" || name === "NotFoundError") return true;
+  const msg = err instanceof Error ? err.message : typeof err === "string" ? err : "";
+  return /sandbox[^\n]{0,120}not found|not found[^\n]{0,120}sandbox/i.test(msg);
+}
+
+/** One probe-failure run's bookkeeping (reset to zeros on ANY evidence). */
+export interface ProbeDeathState {
+  /** Consecutive probe execs that THREW (no verdict at all). */
+  failStreak: number;
+  /** Consecutive throws that were provider "sandbox gone" evidence. */
+  goneStreak: number;
+  /** Wall-clock start of the current failure run (0 = no run). */
+  firstFailAtMs: number;
+}
+
+/** The death-door decision, pure for tests. Null = keep polling. */
+export function probeDeathVerdict(
+  s: ProbeDeathState, nowMs: number,
+): "dead-gone" | "dead-silent" | null {
+  if (s.firstFailAtMs <= 0) return null;
+  const windowMs = nowMs - s.firstFailAtMs;
+  if (s.goneStreak >= PROBE_DEATH_GONE_STREAK && windowMs >= PROBE_DEATH_GONE_WINDOW_MS) return "dead-gone";
+  if (s.failStreak >= PROBE_DEATH_FAIL_STREAK && windowMs >= PROBE_DEATH_FAIL_WINDOW_MS) return "dead-silent";
+  return null;
+}
+
 /** The claude CLI's stderr complaint when `--resume <id>` names a thread
  *  that does not exist on this machine (the 2026-08-18 split-brain
  *  forensic). When a nonzero exit's stderr carries it, the transport
@@ -149,6 +266,10 @@ export interface TurnProbeReading {
    *  sample yet, or a garbled token — evidence-absent, never an error.
    *  Telemetry-only: no liveness verdict may ever read it. */
   perf?: GuestPerfSample;
+  /** Latest tool-run pulse (the `.pulse` token field, 2026-08-29), when the
+   *  guest wrote one AND it parsed clean. Telemetry-only, same rule as
+   *  `perf`: no liveness verdict may ever read it. */
+  pulse?: TurnToolPulse;
 }
 
 /** The probe exec: one line, six fields, always exit 0 — faults surface as
@@ -158,15 +279,23 @@ export interface TurnProbeReading {
  *  whitelist (`tr -cd`) collapses any garbled write to at most one token —
  *  it can never add whitespace and desync the field positions. */
 export function turnLivenessProbeCommand(
-  paths: { outPath: string; hbPath: string; perfPath: string; pid: number; sentinel: string },
+  paths: { outPath: string; hbPath: string; perfPath: string; pid: number; sentinel: string;
+    pulsePath?: string },
 ): string {
+  // The 7th field is the tool-run pulse token (`.pulse`, 2026-08-29), `-`
+  // when absent — same optional-trailing-field contract as perf; the char
+  // whitelist collapses garbled writes to at most one token.
+  const pulseRead = paths.pulsePath
+    ? `pu=$(head -c ${TOOL_PULSE_TOKEN_MAX_CHARS} ${shellQuote(paths.pulsePath)} 2>/dev/null | tr -cd '0-9,'); `
+    : `pu=; `;
   return `sz=$(wc -c < ${shellQuote(paths.outPath)} 2>/dev/null || echo -1); `
     + `alive=0; kill -0 ${paths.pid} 2>/dev/null && alive=1; `
     + `hb=$(cat ${shellQuote(paths.hbPath)} 2>/dev/null || echo 0); `
     + `now=$(date +%s%3N); `
     + `sent=$(grep -c -F ${shellQuote(paths.sentinel)} ${shellQuote(paths.outPath)} 2>/dev/null || echo 0); `
     + `pf=$(head -c ${PERF_TOKEN_MAX_CHARS} ${shellQuote(paths.perfPath)} 2>/dev/null | tr -cd 'A-Za-z0-9=,.-'); `
-    + `printf '%s %s %s %s %s %s\\n' "$sz" "$alive" "$hb" "$now" "$sent" "\${pf:--}"`;
+    + pulseRead
+    + `printf '%s %s %s %s %s %s %s\\n' "$sz" "$alive" "$hb" "$now" "$sent" "\${pf:--}" "\${pu:--}"`;
 }
 
 /** Parse the probe's line. Null = unusable output (a wedged or faulted exec)
@@ -186,9 +315,12 @@ export function parseTurnProbeOutput(raw: string): TurnProbeReading | null {
     || !Number.isFinite(nowMs) || !Number.isFinite(sentinelCount)) return null;
   const perfTok = fields[5];
   const perf = perfTok !== undefined && perfTok !== "-" ? parsePerfToken(perfTok) : null;
+  const pulseTok = fields[6];
+  const pulse = pulseTok !== undefined && pulseTok !== "-" ? parseToolPulseToken(pulseTok) : null;
   return {
     size, alive, hbMs, nowMs, sentinelSeen: sentinelCount > 0,
     ...(perf ? { perf } : {}),
+    ...(pulse ? { pulse } : {}),
   };
 }
 
@@ -252,6 +384,23 @@ export function streamInputFeederFragment(paths: {
     + `sleep ${INJECT_FEEDER_POLL_SECONDS}; done ) > ${q(paths.fifoPath)} 2>/dev/null </dev/null & `;
 }
 
+/** The instructional envelope around a user message delivered INTO a
+ *  running turn. Claude Code's own interactive harness wraps queued
+ *  mid-turn input with an explicit "address this as you continue"
+ *  instruction; a bare `--input-format stream-json` line carries no such
+ *  framing, so an injected message reads like any other transcript text
+ *  and the model tends to continue its work narration without
+ *  acknowledging it. Every mid-turn inject producer (the runner's
+ *  `injectUserMessage` and the workflow lane's `deliverInjectedMessage`
+ *  activity) MUST wrap through here — the wrapper rides only the wire to
+ *  the model; the stored conversation row keeps the user's raw text.
+ *  The text is pinned by tests: change it deliberately or not at all. */
+export function wrapMidTurnUserMessage(text: string): string {
+  return "The user sent a new message while you were working:\n\n"
+    + text
+    + "\n\nAddress the message above as you continue this turn.";
+}
+
 /** The one delivery-ack exec `injectUserMessage` runs: append the message
  *  line to the durable inbox, then wait for the feeder's delivered counter
  *  to cover it. Exit 0 = delivered into the CLI's stdin pre-result; 4 = the
@@ -729,9 +878,26 @@ export interface CliAgentSpec {
     /** Serialise one mid-turn user message into ONE stdin line. No
      *  trailing newline. */
     messageLine(text: string): string;
+    /** Serialise ONE in-band interrupt control line (claude: a stream-json
+     *  `control_request` with subtype "interrupt") — the ESC equivalent.
+     *  The CLI's control layer handles these immediately, MID-STEP
+     *  included: the running tool call aborts (its tool_result records the
+     *  harness's own rejection text), the run ends with an
+     *  `error_during_execution` result within ~100ms, and the session file
+     *  stays `--resume`-able with the whole turn context. Verified live
+     *  against claude 2.1.236. Absent → the runtime has no in-band
+     *  interrupt; callers fall back to kill semantics. */
+    interruptLine?(requestId: string): string;
   };
 }
 
+/** The CURRENT turn's mid-turn injection state (durable stream-input
+ *  transport only) — see the `turnInject` field. */
+interface TurnInjectState {
+  inboxPath: string; deliveredPath: string; pid: number;
+  appended: number; chain: Promise<unknown>;
+}
+
 /** A spawned ACP-mode CLI: the read side of its stdout and a delivery for its
  *  stdin, wrapped as byte web-streams for `ndJsonStream`. Producing this is a
  *  below-ACP transport concern (the duplex command primitive) — see
@@ -806,10 +972,31 @@ export class CliAgentRunner implements ModelExecutionContract {
    *  transport only). Null = no live stream-input turn — `injectUserMessage`
    *  answers "unsupported" and the caller leaves the message owed. `chain`
    *  serializes appends so each delivery targets a deterministic line count. */
-  private turnInject: {
-    inboxPath: string; deliveredPath: string; pid: number;
-    appended: number; chain: Promise<unknown>;
-  } | null = null;
+  private turnInject: TurnInjectState | null = null;
+
+  /** The CURRENT turn's detached-runner wrapper pid (the setsid group
+   *  leader echoed by the launch / recovered from the durable pidfile) —
+   *  durable-transport turns only. Null between turns and on transports
+   *  without a detached guest. See the contract doc (types/runtime.ts). */
+  private turnPid: number | null = null;
+
+  /** Advisory guest-pid identity for the live turn's runner tree — see the
+   *  contract doc (types/runtime.ts). Never a liveness verdict. */
+  currentRunnerPid(): number | null {
+    return this.turnPid;
+  }
+
+  /** Safe-to-persist durable byte offset — end of the last line whose
+   *  messages have ALL been yielded (boot-time turn adoption; contract in
+   *  types/runtime.ts). One line behind the parse cursor by design. */
+  private turnConsumedOffset: number | null = null;
+  /** End offset of the line currently being yielded from — promoted to
+   *  `turnConsumedOffset` when the NEXT line is pulled (or at stream end). */
+  private turnPendingLineEnd: number | null = null;
+
+  currentTurnDurableOffset(): number | null {
+    return this.turnConsumedOffset;
+  }
 
   /** Deliver one user message INTO the live turn — see the contract doc
    *  (types/runtime.ts). Appends a stream-input line to the turn's durable
@@ -823,7 +1010,35 @@ export class CliAgentRunner implements ModelExecutionContract {
     const inject = this.turnInject;
     const streamInput = this.spec.streamInput;
     if (!inject || !streamInput || this.guestDetached) return "unsupported";
-    const line = streamInput.messageLine(text);
+    // The address-this envelope (wrapMidTurnUserMessage): a raw injected
+    // line carries no framing, and the model continues its narration
+    // without acknowledging the message.
+    return this.appendTurnStreamLine(inject, streamInput.messageLine(wrapMidTurnUserMessage(text)));
+  }
+
+  /** Request an in-band step interrupt of the LIVE turn — the ESC
+   *  equivalent; see the contract doc (types/runtime.ts). Appends the
+   *  spec's interrupt control line to the turn's durable inbox; the guest
+   *  feeder forwards it into the CLI's stdin, whose control layer handles
+   *  it immediately — MID-STEP included, unlike queued user messages (the
+   *  inject "pending" wall applies to turn-loop consumption, not the
+   *  control layer). Only "delivered" means the control line reached the
+   *  CLI's stdin; callers escalate anything else to kill semantics. Never
+   *  throws. */
+  async interruptTurn(): Promise<"delivered" | "pending" | "closed" | "unsupported"> {
+    const inject = this.turnInject;
+    const interruptLine = this.spec.streamInput?.interruptLine;
+    if (!inject || !interruptLine || this.guestDetached) return "unsupported";
+    return this.appendTurnStreamLine(inject, interruptLine(`itr-${Date.now().toString(36)}`));
+  }
+
+  /** The one durable append+ack path both mid-turn producers share
+   *  (`injectUserMessage`'s enveloped message line, `interruptTurn`'s raw
+   *  control line). Serialized on the inject chain so every append targets
+   *  a deterministic inbox line count. */
+  private appendTurnStreamLine(
+    inject: TurnInjectState, line: string,
+  ): Promise<"delivered" | "pending" | "closed"> {
     const attempt = inject.chain.then(async (): Promise<"delivered" | "pending" | "closed"> => {
       if (this.turnInject !== inject) return "closed";
       // The append lands whether or not the ack times out, so the target
@@ -849,13 +1064,29 @@ export class CliAgentRunner implements ModelExecutionContract {
     return attempt;
   }
 
+  /** The most recent probe reading's tool-run pulse (2026-08-29), plus the
+   *  guest clock it was read against — telemetry only, refreshed by each
+   *  `probeTurnLiveness` call. Null between turns / before any probe. */
+  private lastTurnPulse: (TurnToolPulse & { guestNowMs: number }) | null = null;
+
+  /** Peek the newest tool-run pulse the durable probe carried — the
+   *  executor's evidence ticker reads it AFTER its liveness check to fan
+   *  the tool-progress fact to clients. Never probes on its own. */
+  peekTurnPulse(): (TurnToolPulse & { guestNowMs: number }) | null {
+    return this.lastTurnPulse;
+  }
+
   /** Durable three-valued liveness for the current turn — see the contract
    *  doc (types/runtime.ts). Never throws; never blocks past the probe's
    *  explicit exec timeout. */
   async probeTurnLiveness(): Promise<RunnerLivenessVerdict | null> {
     const probe = this.turnProbe;
     if (!probe) return null;
-    return livenessVerdictFromReading(await probe());
+    const reading = await probe();
+    if (reading?.pulse) {
+      this.lastTurnPulse = { ...reading.pulse, guestNowMs: reading.nowMs };
+    }
+    return livenessVerdictFromReading(reading);
   }
 
   /** Wakes the CURRENT tail-watchdog interval early. Armed only while the
@@ -1271,6 +1502,9 @@ export class CliAgentRunner implements ModelExecutionContract {
       // previous turn's push.
       this.turnProbe = null;
       this.turnInject = null;
+      this.turnPid = null;
+      this.turnConsumedOffset = null;
+      this.turnPendingLineEnd = null;
       this.nudgePending = false;
       this.wakeTailWatchdog = null;
       // Mid-turn stream input engages only where BOTH halves exist: a spec
@@ -1342,12 +1576,20 @@ export class CliAgentRunner implements ModelExecutionContract {
       //   - SINGLE-EXEC STREAMING (everything else: local child_process,
       //     Vercel): the pre-incident shape — one exec, stdout streamed,
       //     exit code from the exec result.
-      const lines = new AsyncQueue<string>();
+      const lines = new AsyncQueue<{ line: string; end: number | null }>();
       // How the turn ended: the CLI's exit code once known (null while
       // running), plus a best-effort stderr tail for the error message.
       let exitCode: number | null = null;
       let exitStderr = "";
       let transportError: unknown = null;
+      /** True when the death door closed on PROVIDER-ATTESTED "sandbox
+       *  gone" evidence (dead-gone) — the machine itself died, not the CLI.
+       *  The error detail then says so in the classifier's sandbox_gone
+       *  vocabulary (turn-failure-class.ts), which routes the settle to the
+       *  unconditional machine-loss auto-continue lane; an answered
+       *  "pid gone" on a LIVE machine (a CLI that crashed on its own) stays
+       *  the evidence-gated runner_exit family. */
+      let sandboxGoneDeath = false;
       let consumerStopped = false;
       let reap: () => void = () => { /* set per transport */ };
       // The reap's kill-and-confirm exec, latched on first fire (reap runs
@@ -1413,11 +1655,16 @@ export class CliAgentRunner implements ModelExecutionContract {
         // subshell burst-reads /proc and rewrites the `.perf` token the
         // durable-trio probe carries as its trailing field (perf-sampler.ts).
         const perfPath = `${promptPath}.perf`;
+        // The tool-run pulse (2026-08-29, child-telemetry contract): the
+        // same beat samples the session's own process tree so a long
+        // foreground tool proves it is working — see toolPulseFragment.
+        const pulsePath = `${promptPath}.pulse`;
         const detachedScript =
           feeder
           + `( ${perfSamplerFunctionFragment({ perfPath })}while kill -0 "$$" 2>/dev/null; do `
           + `date +%s%3N > ${shellQuote(hbPath)}; `
           + `${runnerBusySentinelFragment(busyPath, tasksPath)}; `
+          + `${toolPulseFragment(pulsePath)}; `
           + `ac_perf_tick; `
           + `sleep ${RUNNER_HEARTBEAT_INTERVAL_SECONDS}; done ) >/dev/null 2>&1 </dev/null & `
           + sessionEnvSourceFragment(this.options.sessionEnvFile)
@@ -1482,7 +1729,7 @@ export class CliAgentRunner implements ModelExecutionContract {
         // executor's evidence ticker (`probeTurnLiveness`) both read through
         // it — one fresh short exec per call, explicit timeout, faults map to
         // null ("probe-failed"), never to a verdict.
-        const probeCmd = turnLivenessProbeCommand({ outPath, hbPath, perfPath, pid, sentinel });
+        const probeCmd = turnLivenessProbeCommand({ outPath, hbPath, perfPath, pid, sentinel, pulsePath });
         const runTurnProbe = async (): Promise<TurnProbeReading | null> => {
           try {
             const res = await this.sandbox.commands.run(probeCmd, { timeoutMs: TURN_PROBE_TIMEOUT_MS });
@@ -1490,6 +1737,15 @@ export class CliAgentRunner implements ModelExecutionContract {
           } catch { return null; }
         };
         this.turnProbe = runTurnProbe;
+        // Advisory pid identity for the platform's background-work declare
+        // (in-harness Workflow tasks) — armed with the probe, cleared at the
+        // next turn's start (the tree may legitimately outlive this turn).
+        this.turnPid = pid;
+        // Durable launch report (boot-time turn adoption): hand the caller
+        // the guest prompt path + sentinel + pid so it can stamp them on
+        // the turn row — a successor process can then find the runner's
+        // durable files without this process's memory.
+        this.options.onDetachedLaunch?.({ promptPath, sentinel, pid });
         // Arm mid-turn injection now that the detached runner (and its
         // feeder) exist; cleared with the turn in the finally below.
         if (streamInput) {
@@ -1509,7 +1765,7 @@ export class CliAgentRunner implements ModelExecutionContract {
             exitCode = Number.isFinite(code) ? code : 0;
             return;
           }
-          lines.push(line);
+          lines.push({ line, end: offset });
         };
 
         reap = () => {
@@ -1538,6 +1794,13 @@ export class CliAgentRunner implements ModelExecutionContract {
           // re-attaching tails and finishes on durable polling alone (a wire
           // that killed three streams will kill the fourth).
           let streamDeaths = 0;
+          // Death-door bookkeeping (see probeDeathVerdict): the current
+          // run of consecutive probe failures. ANY evidence — a probe exec
+          // that answered, a durable read that succeeded — resets it.
+          const probeDeath: ProbeDeathState = { failStreak: 0, goneStreak: 0, firstFailAtMs: 0 };
+          const resetProbeDeath = (): void => {
+            probeDeath.failStreak = 0; probeDeath.goneStreak = 0; probeDeath.firstFailAtMs = 0;
+          };
           while (exitCode === null && !consumerStopped && !opts.signal?.aborted) {
             let buf = "";
             let handle: SandboxBackgroundProcess | null = null;
@@ -1652,6 +1915,9 @@ export class CliAgentRunner implements ModelExecutionContract {
             if (durableRead) {
               try {
                 const bytes = Buffer.from(await durableRead(outPath), "utf8");
+                // The file plane answered — the sandbox is reachable, so no
+                // probe-failure run may accumulate toward the death door.
+                resetProbeDeath();
                 let rest = bytes.subarray(offset).toString("utf8");
                 let nl: number;
                 while (exitCode === null && (nl = rest.indexOf("\n")) >= 0) {
@@ -1661,18 +1927,43 @@ export class CliAgentRunner implements ModelExecutionContract {
               } catch { /* file plane briefly unreachable — retried below */ }
             }
             if (exitCode !== null) break;
-            // Runner still alive? A FRESH exec answers; unknown (wire fault)
-            // keeps retrying — the executor's evidence machinery bounds a
-            // truly dead sandbox, not this loop.
+            // Runner still alive? A FRESH exec answers; a wire-fault throw
+            // is no verdict and keeps retrying — but never FOREVER (chaos
+            // S13 run 3, 2026-08-31: a DEAD sandbox's probe exec THROWS, so
+            // `alive` stayed null and this loop polled the corpse blind
+            // until the executor closed the turn from outside). The death
+            // door: provider-attested "sandbox gone" evidence on a short
+            // streak, or a long generous window of nothing-but-failures
+            // (probeDeathVerdict) ⇒ the same honest abnormal-death terminal
+            // as an answered "pid gone" — never a clean done, never an
+            // eternal poll. Any evidence (an answered probe, a durable
+            // read) resets the run, so a live sandbox behind a flaky wire
+            // is never killed (the K8s-Unknown rule).
             let alive: boolean | null = null;
             try {
               const probe = await this.sandbox.commands.run(
-                `kill -0 ${pid} 2>/dev/null`, { timeoutMs: 10_000 });
+                `kill -0 ${pid} 2>/dev/null`, { timeoutMs: TURN_PROBE_TIMEOUT_MS });
               alive = probe.exitCode === 0;
-            } catch { alive = null; }
-            if (alive === false) {
+              resetProbeDeath();
+            } catch (probeErr) {
+              alive = null;
+              probeDeath.failStreak += 1;
+              if (probeDeath.firstFailAtMs === 0) probeDeath.firstFailAtMs = Date.now();
+              probeDeath.goneStreak = isSandboxGoneError(probeErr) ? probeDeath.goneStreak + 1 : 0;
+            }
+            const deathVerdict = probeDeathVerdict(probeDeath, Date.now());
+            if (deathVerdict !== null) {
+              console.warn(`[cli-agent] ${this.spec.kind} durable-poll death door: ${deathVerdict === "dead-gone"
+                ? `the provider reports the sandbox gone (${probeDeath.goneStreak} consecutive not-found probes over ${Math.round((Date.now() - probeDeath.firstFailAtMs) / 1000)}s)`
+                : `${probeDeath.failStreak} consecutive probe-transport failures over ${Math.round((Date.now() - probeDeath.firstFailAtMs) / 1000)}s with no durable evidence`
+              } — treating the runner as dead`);
+            }
+            if (alive === false || deathVerdict !== null) {
               // Dead with no exit line even in the durable file: abnormal
-              // death — surfaces as an error, never a clean done.
+              // death — surfaces as an error, never a clean done. A
+              // provider-attested gone verdict marks the death as the
+              // MACHINE's (sandbox_gone), not the CLI's.
+              if (deathVerdict === "dead-gone") sandboxGoneDeath = true;
               exitCode = JSONL_GUARD_NO_SENTINEL_EXIT;
               break;
             }
@@ -1702,7 +1993,7 @@ export class CliAgentRunner implements ModelExecutionContract {
           while ((nl = buf.indexOf("\n")) >= 0) {
             const line = buf.slice(0, nl).trim();
             buf = buf.slice(nl + 1);
-            if (line) lines.push(line);
+            if (line) lines.push({ line, end: null });
           }
         };
         const runOpts = {
@@ -1714,7 +2005,7 @@ export class CliAgentRunner implements ModelExecutionContract {
           credEnvSourceFragment(this.options.credEnvFile) + guardedCmd, runOpts).then(
           (res) => {
             const tail = buf.trim();
-            if (tail) lines.push(tail);
+            if (tail) lines.push({ line: tail, end: null });
             exitCode = res.exitCode;
             exitStderr = (res.stderr ?? "").slice(-2000);
           },
@@ -1741,7 +2032,16 @@ export class CliAgentRunner implements ModelExecutionContract {
         // when the turn never reaches its `done` (a reaped/superseded turn
         // must still be resumable by its redispatch).
         let announcedSessionId = opts.sessionId ?? "";
-        for await (const line of lines) {
+        for await (const item of lines) {
+          // Consumed-offset bookkeeping (boot-time turn adoption): pulling
+          // line N proves lines 1..N-1 are FULLY yielded, so the byte
+          // offset just past line N-1 is the safe harvest watermark — see
+          // `currentTurnDurableOffset` in types/runtime.ts.
+          if (item.end !== null) {
+            this.turnConsumedOffset = this.turnPendingLineEnd;
+            this.turnPendingLineEnd = item.end;
+          }
+          const line = item.line;
           let parsed: Record<string, unknown>;
           try {
             parsed = JSON.parse(line) as Record<string, unknown>;
@@ -1761,6 +2061,9 @@ export class CliAgentRunner implements ModelExecutionContract {
         }
 
         await transport;
+        // Stream fully consumed — the final line's messages are all
+        // yielded, so its end offset graduates to the safe watermark.
+        this.turnConsumedOffset = this.turnPendingLineEnd;
         if (transportError) throw transportError;
         if (exitCode === null) {
           // Aborted/reaped before an exit line existed — honest terminal,
@@ -1772,7 +2075,15 @@ export class CliAgentRunner implements ModelExecutionContract {
         }
         if (exitCode !== 0 && !sawError) {
           const detail = exitCode === JSONL_GUARD_NO_SENTINEL_EXIT
-            ? " (the runner died without reporting an exit code)" : "";
+            ? sandboxGoneDeath
+              // The classifier's sandbox_gone vocabulary, verbatim on
+              // purpose (turn-failure-class.ts:"machine went away" /
+              // "sandbox gone") — this is what routes the settle to the
+              // machine-loss auto-continue lane instead of the
+              // evidence-gated runner_exit family.
+              ? " (the machine went away mid-turn — the provider reports the sandbox gone)"
+              : " (the runner died without reporting an exit code)"
+            : "";
           yield { type: "error", text: `${this.spec.kind} exited with code ${exitCode}${detail}${exitStderr ? `: ${exitStderr}` : ""}`, timestamp: now() };
           return;
         }