@fitlab-ai/agent-infra 0.9.15 → 0.11.0

package/lib/platform/task-comment-projection.ts

@@ -0,0 +1,79 @@
+import { createHash } from 'node:crypto';
+
+const SNAPSHOT_FRONTMATTER = new Set([
+  'id', 'type', 'branch', 'workflow', 'status', 'created_at', 'updated_at',
+  'priority', 'effort', 'start_date', 'target_date', 'current_step', 'assigned_to',
+  'platform_issue_identity', 'delivery_remote', 'delivery_base_ref', 'pr_delivery_fact'
+]);
+
+type TaskCommentProjection = {
+  content: string;
+  byteLength: number;
+  sha256: string;
+};
+
+const PROCESS_SECTION_ALIASES = new Set([
+  '活动日志', 'activity log',
+  '产物生命周期收据', 'artifact lifecycle receipts',
+  '审查分歧账本', 'review dispute ledger', 'review disagreement ledger',
+  '人工裁决', '人工裁决待办', 'human decisions', 'human decision pending', 'human decisions pending',
+  '实现输入', 'implementation input', 'implementation inputs',
+  '工作流告警', 'workflow warning', 'workflow warnings', 'warnings',
+  '返工意图', 'rework intent', 'rework intents',
+  '产物失效记录', 'artifact invalidation', 'artifact invalidation records',
+  '实现备注', 'implementation notes',
+  '审查反馈', 'review feedback'
+]);
+
+function normalize(content: string): string {
+  return content.replace(/\r\n/g, '\n').replace(/\n+$/, '\n');
+}
+
+function splitFrontmatter(content: string): { frontmatter: string; body: string } {
+  const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  if (!match) throw new Error('task comment projection requires task frontmatter');
+  return { frontmatter: match[1]!, body: content.slice(match[0].length) };
+}
+
+function projectFrontmatter(frontmatter: string): string {
+  const lines = frontmatter.replace(/\r\n/g, '\n').split('\n');
+  const selected = lines.filter((line) => {
+    if (!line.trim() || line.trimStart().startsWith('#')) return false;
+    const match = /^([^:\s][^:]*):/.exec(line);
+    return Boolean(match && SNAPSHOT_FRONTMATTER.has(match[1]!.trim()));
+  });
+  if (!selected.some((line) => /^id:/.test(line))) throw new Error('task comment projection requires frontmatter id');
+  return selected.join('\n');
+}
+
+function projectBody(body: string): string {
+  const lines = body.replace(/\r\n/g, '\n').split('\n');
+  const kept: string[] = [];
+  let excludedLevel: number | null = null;
+  for (const line of lines) {
+    const heading = /^(#{1,6})\s+(.+?)\s*$/.exec(line);
+    if (heading) {
+      const level = heading[1]!.length;
+      if (excludedLevel !== null && level <= excludedLevel) excludedLevel = null;
+      if (PROCESS_SECTION_ALIASES.has(heading[2]!.trim().toLowerCase())) {
+        excludedLevel = level;
+        continue;
+      }
+    }
+    if (excludedLevel === null) kept.push(line);
+  }
+  return kept.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd();
+}
+
+function projectTaskComment(content: string): TaskCommentProjection {
+  const split = splitFrontmatter(content);
+  const projected = normalize(`---\n${projectFrontmatter(split.frontmatter)}\n---\n\n${projectBody(split.body)}`);
+  return {
+    content: projected,
+    byteLength: Buffer.byteLength(projected, 'utf8'),
+    sha256: createHash('sha256').update(projected, 'utf8').digest('hex')
+  };
+}
+
+export { projectTaskComment };
+export type { TaskCommentProjection };

package/lib/platform/task-identities.ts

@@ -1,13 +1,8 @@
-import type { ProviderIdentityDeclaration, ResourceIdentity } from './resource-identity.ts';
+import type { ResourceIdentity } from './resource-identity.ts';
 import { parseResourceIdentity } from './resource-identity.ts';
-import { isLegacyCompatibilityEnabled, legacyCompatibilityError, VERSION } from '../version.ts';
 import { parse as parseYaml } from 'yaml';
 
-function taskIssueIdentity(
-  frontmatter: Record<string, string | number | boolean | null>,
-  _declaration?: ProviderIdentityDeclaration,
-  runtimeVersion = VERSION
-): ResourceIdentity | null {
+function taskIssueIdentity(frontmatter: Record<string, string | number | boolean | null>): ResourceIdentity | null {
   const serialized = frontmatter.platform_issue_identity;
   if (typeof serialized === 'string' && serialized.trim()) {
     try {
@@ -20,13 +15,7 @@ function taskIssueIdentity(
       return null;
     }
   }
-  const legacy = frontmatter.issue_number;
-  const number = typeof legacy === 'number' ? legacy : typeof legacy === 'string' && /^[1-9]\d*$/u.test(legacy) ? Number(legacy) : NaN;
-  // TODO(compat): Remove the numeric issue_number fallback before the first stable v1.0.0 release.
-  if (Number.isSafeInteger(number) && number > 0 && !isLegacyCompatibilityEnabled(runtimeVersion)) {
-    throw legacyCompatibilityError('issue_number', runtimeVersion);
-  }
-  return Number.isSafeInteger(number) && number > 0 ? { kind: 'number', value: number } : null;
+  return null;
 }
 
 function taskIssueIdentityError(error: unknown): { code: string; message: string } {

package/lib/platform/task-recovery.ts

@@ -0,0 +1,54 @@
+import { parseActivityRecoveryMetadata } from './activity-recovery.ts';
+
+type RecoveryRemoteComment = { body: string; user?: { login?: string } };
+
+function normalized(body: string): string {
+  return body.replace(/\r\n/g, '\n').replace(/\n+$/, '\n');
+}
+
+function decodeRenderedText(value: string): string {
+  return value
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&amp;/g, '&');
+}
+
+function taskSnapshot(taskId: string, body: string): string {
+  const marker = `<!-- sync-issue:${taskId}:task -->`;
+  if (normalized(body).split('\n', 1)[0] !== marker) throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot marker is invalid');
+  const frontmatter = body.match(/<details><summary>[^<]*<\/summary>\n\n```yaml\n---\n([\s\S]*?)\n---\n```\n\n<\/details>/);
+  if (!frontmatter) throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot frontmatter is invalid');
+  const afterDetails = (frontmatter.index ?? 0) + frontmatter[0].length;
+  const footer = body.lastIndexOf('\n\n---\n*由 ');
+  if (footer <= afterDetails) throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot envelope is invalid');
+  const projectedBody = body.slice(afterDetails, footer).replace(/^\n+|\n+$/g, '');
+  return `---\n${decodeRenderedText(frontmatter[1]!)}\n---\n\n${decodeRenderedText(projectedBody)}\n`;
+}
+
+function activityLine(entry: { time: string; step: string; agent: string; note: string }): string {
+  return `- ${entry.time} — **${entry.step}** by ${entry.agent} — ${entry.note}`;
+}
+
+function recoverTaskFromComments(input: { taskId: string; comments: readonly RecoveryRemoteComment[] }): string {
+  const marker = `<!-- sync-issue:${input.taskId}:task -->`;
+  const snapshots = input.comments.filter((comment) => normalized(comment.body).split('\n', 1)[0] === marker);
+  if (snapshots.length !== 1) throw new Error('RECOVERY_EVIDENCE_MISSING: exactly one task snapshot comment is required');
+  const author = snapshots[0]!.user?.login;
+  if (!author) throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot author is unavailable');
+  const content = taskSnapshot(input.taskId, normalized(snapshots[0]!.body));
+  const entries = new Map<string, { time: string; step: string; agent: string; note: string }>();
+  for (const comment of input.comments) {
+    if (comment.user?.login !== author) continue;
+    const record = parseActivityRecoveryMetadata(comment.body);
+    if (!record) continue;
+    if (record.taskId !== input.taskId) throw new Error('RECOVERY_EVIDENCE_MISSING: activity metadata task identity is invalid');
+    for (const entry of record.entries) entries.set(JSON.stringify(entry), entry);
+  }
+  const restored = [...entries.values()].sort((left, right) => left.time.localeCompare(right.time));
+  return `${content.replace(/\n+$/, '')}\n\n## 活动日志\n\n${restored.map(activityLine).join('\n')}\n`;
+}
+
+export { recoverTaskFromComments };
+export type { RecoveryRemoteComment };

package/lib/platform/verification-sync.ts

@@ -12,6 +12,7 @@ import { planInLabelUpdate, validateInLabelMapping } from "./in-label-sync.ts";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.ts";
 import { providerError, providerOperationContext, resourceIdentityNumber, unsupportedProviderOperation } from "./provider-bridge.ts";
 import { taskIssueIdentity } from "./task-identities.ts";
+import { renderTaskCommentResult } from "./issue-comments.ts";
 import {
   CONTROL_MARKER_PATTERN,
   canonicalizeCommentBody,
@@ -113,8 +114,8 @@ async function buildSyncContext({ taskDir, config, artifactFile }: any, shared:
   }
   const prIdentity = fact.status === "valid" && fact.fact.state === "bound" ? fact.fact.identity.resource : null;
   const prNumber = resourceIdentityNumber(prIdentity);
-  if (config.when === "issue_number_exists" && !issueIdentity) {
-    return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no issue_number") };
+  if (config.when === "platform_issue_identity_exists" && !issueIdentity) {
+    return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no platform_issue_identity") };
   }
   if (config.when === "pr_fact_bound" && !prIdentity) {
     return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no verified bound pull request") };
@@ -541,7 +542,6 @@ function checkTaskCommentContent(context: any, remoteData: any, shared: Verifica
   if (!context.config.verify_task_comment_content) {
     return null;
   }
-
   const taskMarker = `<!-- sync-issue:${context.task.metadata.id}:task -->`;
   const comment = findCommentByMarker(remoteData.comments, taskMarker);
   if (!comment) {
@@ -551,14 +551,20 @@ function checkTaskCommentContent(context: any, remoteData: any, shared: Verifica
     );
   }
 
-  const expectedTaskBody = buildExpectedTaskBody(context.task.content, shared);
-  if (expectedTaskBody === null) {
-    return shared.failResult(CHECK_TYPE,
-      "Task content cannot be rendered safely for comment verification",
-      "check_failed"
+  let renderedTask: { body: string; byteLength: number };
+  try {
+    renderedTask = renderTaskCommentResult(
+      context.task.content,
+      context.task.metadata.id,
+      loadProjectLanguage(shared)
     );
+  } catch {
+    return shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed");
   }
-  const expectedBody = shared.normalizeContent(expectedTaskBody);
+  if (renderedTask.byteLength > 60_000) {
+    return shared.failResult(CHECK_TYPE, "Task comment exceeds the platform byte limit", "check_failed");
+  }
+  const expectedBody = shared.normalizeContent(extractCommentBody(renderedTask.body));
   const commentBody = shared.normalizeContent(extractCommentBody(comment.body || ""));
 
   if (expectedBody === commentBody) {
@@ -829,7 +835,7 @@ function extractCommentBody(commentBody: any): any {
     start += 1;
   }
 
-  if (start < lines.length && /^> \*\*.+\*\* · .+$/.test(lines[start]!.trim())) {
+  if (start < lines.length && (/^> \*\*.+\*\* · .+$/.test(lines[start]!.trim()) || /^> 任务同步 · .+$/.test(lines[start]!.trim()))) {
     start += 1;
   }
 
@@ -837,6 +843,16 @@ function extractCommentBody(commentBody: any): any {
     start += 1;
   }
 
+  if (lines[start]?.trim() === "<details><summary>恢复元数据</summary>") {
+    const metadataEnd = lines.indexOf("</details>", start + 1);
+    if (metadataEnd >= 0) {
+      start = metadataEnd + 1;
+      while (start < lines.length && lines[start]!.trim() === "") {
+        start += 1;
+      }
+    }
+  }
+
   let end = lines.length;
   for (let index = lines.length - 1; index >= start; index -= 1) {
     const trimmed = lines[index]!.trim();
@@ -1038,7 +1054,9 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
   if (!baseRef) {
     return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
   }
-  const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], taskDir);
+  const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
+  const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+  const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
   if (!changedFilesResult.ok) {
     return { ...changedFilesResult, type: "network_error" };
   }
@@ -1065,6 +1083,25 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
   return { ok: true, labels: planned.target, mode: "mapped" };
 }
 
+function worktreeForBranch(repositoryRoot: string, branch: string): string | null {
+  try {
+    const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
+      cwd: repositoryRoot,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim().split(/\r?\n\r?\n/);
+    const expectedRef = `refs/heads/${branch}`;
+    for (const record of records) {
+      const worktree = /^worktree (.+)$/m.exec(record)?.[1];
+      const branchRef = /^branch (.+)$/m.exec(record)?.[1];
+      if (worktree && branchRef === expectedRef) return worktree;
+    }
+  } catch {
+    // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
+  }
+  return null;
+}
+
 function loadInLabelMapping(shared: VerificationShared): any {
   const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
   if (!fs.existsSync(configPath)) {

package/lib/pr-review/evidence-grading.ts

@@ -37,11 +37,6 @@ export class HostResolutionError extends Error {
   }
 }
 
-function toPositiveNumber(value: unknown): number | null {
-  const n = Number(value);
-  return Number.isInteger(n) && n > 0 ? n : null;
-}
-
 /**
  * Parse the PR body for closing-issue references. Handles the conventional
  * `Closes #1` / `Fixes: #2, #3` shapes (case-insensitive, comma/space
@@ -68,7 +63,7 @@ export function extractClosingIssueNumbers(body: string): number[] {
 /**
  * Scan `.agents/workspace/active/{task-id}/task.md` files for tasks bound to the
  * PR number or to one of the PR's closing issues. A task is emitted at most once;
- * a verified fact identity hit takes priority over the issue-number reverse lookup.
+ * a verified fact identity hit takes priority over the issue-identity reverse lookup.
  */
 export function collectHostCandidates(input: {
   prNumber?: number;
@@ -97,7 +92,7 @@ export function collectHostCandidates(input: {
     let frontmatter: ReturnType<typeof parseTypedTaskFrontmatter>;
     try { frontmatter = parseTypedTaskFrontmatter(content); } catch { continue; }
     const issueIdentity = taskIssueIdentity(frontmatter);
-    const issueNumber = resourceIdentityNumber(issueIdentity) ?? toPositiveNumber(frontmatter.issue_number);
+    const issueNumber = resourceIdentityNumber(issueIdentity);
     const fact = readPrDeliveryFact(frontmatter);
     const prIdentity = fact.status === 'valid' && fact.fact.state === 'bound' ? fact.fact.identity.resource : null;
     const prNumber = resourceIdentityNumber(prIdentity);
@@ -209,8 +204,8 @@ function isTrusted(head: HeadState): boolean {
 /**
  * Derive the S1(a) trust factor `taskIssueMatches` (PL-3) mechanically from
  * resolved data: a unique host is trusted on the issue dimension only when the
- * task's bound issue_number is among the PR's closing issues. Ambiguous/none
- * hosts and tasks without a positive issue_number cannot be confirmed -> false
+ * task's bound issue identity is among the PR's closing issues. Ambiguous/none
+ * hosts and tasks without a numeric issue identity cannot be confirmed -> false
  * (fail closed to S2/audit). `resolve-host` emits this value so the prompt layer
  * does not derive the trust factor ad hoc (CD-2).
  */

package/lib/sandbox/commands/rm.ts

@@ -2,12 +2,41 @@ import { parseArgs } from 'node:util';
 import { loadConfig } from '../config.ts';
 import { createSandboxCapabilityPlan } from '../agent-client-reconciler.ts';
 import { resolveSandboxCleanupTarget } from '../workspace-identity.ts';
+import { detectEngine } from '../engine.ts';
+import {
+  sandboxBranchLabel,
+  sandboxLabel,
+  sandboxTaskIdLabel,
+  sandboxWorkspaceModeLabel
+} from '../constants.ts';
+import { fetchSandboxRows } from './list-running.ts';
 import { rmOne, rmPurge, rmUnbound } from '../removal.ts';
 
 const USAGE = `Usage:
   ai sandbox rm <branch | TASK-id | short id> Remove one sandbox; use a full TASK-id for a task-bound sandbox and a branch for branch-only sandboxes
-  ai sandbox rm --unbound [--dry-run] [--yes] Remove completed task-bound and branch-only sandboxes and verified auxiliary state; active, blocked, and archive tasks are protected
+  ai sandbox rm --unbound [--dry-run] [--yes] Remove discovered task-bound and branch-only sandboxes
   ai sandbox rm --purge                     Tear down ALL sandboxes for the project (containers, worktrees, image, VM)`;
+
+function resolveMissingTaskSandboxBranch(taskId: string, config: ReturnType<typeof loadConfig>): string | null {
+  const engine = detectEngine(config);
+  const listed = fetchSandboxRows(
+    engine,
+    sandboxLabel(config),
+    sandboxBranchLabel(config),
+    { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) }
+  );
+  const branches = new Set(
+    [...listed.running, ...listed.nonRunning]
+      .filter((row) => row.workspaceMode === 'task-bound' && row.taskId === taskId && row.branch)
+      .map((row) => row.branch)
+  );
+  if (branches.size === 0) return null;
+  if (branches.size > 1) {
+    throw new Error(`SANDBOX_CLEANUP_TASK_ID_AMBIGUOUS: task ${taskId} matches multiple sandbox branches`);
+  }
+  return branches.values().next().value ?? null;
+}
+
 export async function rm(args: string[]): Promise<void> {
   const { values, positionals } = parseArgs({
     args,
@@ -64,6 +93,9 @@ export async function rm(args: string[]): Promise<void> {
     return;
   }
 
-  const cleanupTarget = resolveSandboxCleanupTarget(positionals[0] ?? '', config.repoRoot);
+  const cleanupTarget = resolveSandboxCleanupTarget(positionals[0] ?? '', config.repoRoot, {
+    allowProtected: true,
+    resolveMissingTask: (taskId) => resolveMissingTaskSandboxBranch(taskId, config)
+  });
   await rmOne(config, tools, cleanupTarget.branch, { cleanupTarget });
 }

package/lib/sandbox/control/executor.ts

@@ -188,7 +188,9 @@ export async function prepareSandboxControlExecution(params: {
         owner: gateOwner,
         requestId: params.request.id,
         operationId: authority?.operationId ?? params.request.id,
-        phase: authority?.phase ?? (params.request.family === 'task-workflow' ? 'artifact.finalize-local' : 'orchestration.prepare'),
+        phase: authority?.phase ?? (params.request.family === 'task-workflow'
+          && params.request.workflow?.operation === 'artifact-preflight' ? 'artifact.preflight'
+          : params.request.family === 'task-workflow' ? 'artifact.finalize-local' : 'orchestration.prepare'),
         authority
       } satisfies SandboxControlExecutorGateV2);
     },
@@ -235,7 +237,7 @@ function waitForGate(nonce: string, timeoutMs = 2_000): Promise<Readonly<{ owner
         return;
       }
       if (typeof value.requestId !== 'string' || typeof value.operationId !== 'string'
-        || !['orchestration.prepare', 'artifact.finalize-local', 'task-event.completed'].includes(value.phase as string)
+        || !['orchestration.prepare', 'artifact.preflight', 'artifact.finalize-local', 'task-event.completed'].includes(value.phase as string)
         || (value.authority !== null && value.authority !== undefined && (() => {
           try { validateLifecycleRecoveryAttestation(value.authority); return false; } catch { return true; }
         })())) {

package/lib/sandbox/control/protocol.ts

@@ -62,7 +62,7 @@ export type SandboxControlExecutorGateV2 = Readonly<{
   owner: SandboxControlBrokerOwner;
   requestId: string;
   operationId: string;
-  phase: 'orchestration.prepare' | 'artifact.finalize-local' | 'task-event.completed';
+  phase: 'orchestration.prepare' | 'artifact.preflight' | 'artifact.finalize-local' | 'task-event.completed';
   authority: LifecycleRecoveryAttestationV1 | null;
 }>;
 type RequestBase = Readonly<{
@@ -131,6 +131,11 @@ export type SandboxControlResponse = Readonly<{
   outputState?: 'available' | 'unavailable';
   payload?: SandboxControlPayloadReference | null;
 }>;
+export type SandboxControlRecoveryWarning = Readonly<{
+  code: string;
+  message: string;
+  action: string;
+}>;
 export type SandboxControlStatus = Readonly<{
   version: 3; generation: string; broker: ProcessIdentity & { brokerId: string };
   state: 'starting' | 'healthy' | 'busy' | 'parked'; reasonCode: string | null;

package/lib/sandbox/control/server.ts

@@ -12,6 +12,7 @@ import {
   SANDBOX_CONTROL_MAX_RESPONSE_BYTES,
   SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES,
   type SandboxControlManifest,
+  type SandboxControlRecoveryWarning,
   type SandboxControlRequest,
   type SandboxControlResponse,
   type SandboxControlTimingPolicy
@@ -62,6 +63,7 @@ import {
   SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES
 } from '../../task/control-recovery.ts';
 import { readRun } from '../../task/orchestration.ts';
+import { readLifecycleRecoveryDomainEvidence } from '../../task/lifecycle-recovery.ts';
 import { captureRepositorySnapshot } from '../../task/workspace-snapshot.ts';
 import { parseTypedTaskFrontmatter } from '../../task/frontmatter.ts';
 import { readLifecycleJournalEvidence } from '../../task/lifecycle.ts';
@@ -368,11 +370,12 @@ function outputMatchesEvidence(output: string, bytes: number, sha256: string): b
     && createHash('sha256').update(output, 'utf8').digest('hex') === sha256;
 }
 
-function genericRecoveryResponse(
+export function genericRecoveryResponse(
   request: SandboxControlRequest,
   exitCode: number,
   payload: ReturnType<typeof readSandboxControlPayload> | null,
-  cause: 'publish' | 'recovery' = 'recovery'
+  cause: 'publish' | 'recovery' = 'recovery',
+  warning: SandboxControlRecoveryWarning | null = null
 ): SandboxControlResponse {
   const outputUnavailable = request.family === 'task-create' && !payload;
   return {
@@ -381,9 +384,11 @@ function genericRecoveryResponse(
     phase: 'completed',
     exitCode,
     stdout: outputUnavailable ? `${JSON.stringify(taskCreateOutputUnavailableResult(request.id))}\n` : '',
-    stderr: payload ? '' : cause === 'publish'
-      ? 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: output payload was not retained\n'
-      : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: broker restarted after executor completion\n',
+    stderr: payload ? '' : warning
+      ? `${warning.code}: ${warning.message}\nAction: ${warning.action}\n`
+      : cause === 'publish'
+        ? 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: output payload was not retained\n'
+        : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: broker restarted after executor completion\n',
     error: null,
     outputState: payload ? 'available' : 'unavailable',
     payload: payload ? payloadReference(payload) : null
@@ -504,6 +509,21 @@ function readRecoveryDomain(
   }
 
   if (operation.family === 'task-lifecycle') {
+    if (operation.intent === 'recover-started') {
+      try {
+        if (!('args' in request)) return { domain: null };
+        const parsed = parseTaskControlOperation('task-lifecycle', request.args);
+        if (parsed.family !== 'task-lifecycle' || parsed.request.intent !== 'recover-started') {
+          return { domain: null };
+        }
+        return {
+          domain: readLifecycleRecoveryDomainEvidence(manifest.repoRoot, parsed.request, terminalResult),
+          journal: readLifecycleJournalEvidence(manifest.repoRoot, taskRef!)
+        };
+      } catch {
+        return { domain: null };
+      }
+    }
     if (!taskRef || !terminalResult.targetState) return { domain: null };
     const journal = readLifecycleJournalEvidence(manifest.repoRoot, taskRef);
     try {
@@ -577,7 +597,7 @@ function readCommittedCriticalPhases(manifest: SandboxControlManifest, requestId
   });
 }
 
-function recoveryResponse(
+export function recoveryResponse(
   manifest: SandboxControlManifest,
   manifestPath: string,
   request: SandboxControlRequest,
@@ -637,7 +657,7 @@ function recoveryResponse(
     if (finalization?.status !== 'matched') return null;
     return finalization.response ?? null;
   }
-  return genericRecoveryResponse(request, evidence.exitCode, payload);
+  return genericRecoveryResponse(request, evidence.exitCode, payload, 'recovery', terminalResult.warning ?? null);
 }
 
 function terminalMatchesEvidence(
@@ -681,7 +701,7 @@ function terminalMatchesEvidence(
   if (response.outputState === 'unavailable') {
     const causes = ['recovery', 'publish'] as const;
     const valid = causes.some((cause) => JSON.stringify(response)
-      === JSON.stringify(genericRecoveryResponse(request, evidence.exitCode, null, cause)));
+      === JSON.stringify(genericRecoveryResponse(request, evidence.exitCode, null, cause, terminalResult?.warning ?? null)));
     return { valid, payloadReferenced: false };
   }
   return {
@@ -700,7 +720,7 @@ function publishExecutionResult(
   brokerOwns: () => boolean
 ): boolean {
   const normalized = sanitizeSandboxControlResult(manifest, result);
-  writeSandboxControlTerminalResult(manifest, {
+  const terminalResult = writeSandboxControlTerminalResult(manifest, {
     id: request.id,
     family: request.family,
     operation: operationKey(request, normalized.stdout)
@@ -737,7 +757,7 @@ function publishExecutionResult(
       } catch {
         payload = null;
       }
-      terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
+      terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish', terminalResult.warning ?? null);
     }
   }
   if (!brokerOwns()) return false;

package/lib/sandbox/control/state.ts

@@ -1,5 +1,6 @@
 import { isCompletionEvidence, type CleanCompletionEvidence } from '../../task/orchestration.ts';
 import { parseControlOutput } from '../../task/control-recovery.ts';
+import { isRecoveryWarning } from '../../task/recovery-warning.ts';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -14,6 +15,7 @@ import type {
   SandboxControlPayload,
   SandboxControlReservation,
   SandboxControlResultEvidence,
+  SandboxControlRecoveryWarning,
   SandboxControlStatus
 } from './protocol.ts';
 import {
@@ -113,6 +115,7 @@ export type SandboxControlTerminalResult = Readonly<{
   status: string;
   changed: boolean | null;
   completionEvidence: CleanCompletionEvidence | null;
+  warning?: SandboxControlRecoveryWarning | null;
 }>;
 
 export function terminalResultPath(manifest: SandboxControlManifest, requestId: string): string {
@@ -130,6 +133,7 @@ export function createSandboxControlTerminalResult(
     ? nested.run as Record<string, unknown> : null;
   const rawCompletion = nested.completionEvidence ?? run?.completionEvidence;
   const operation = request.operation ?? (typeof nested.intent === 'string' ? nested.intent : null) ?? '';
+  const warning = isRecoveryWarning(nested.warning) ? nested.warning : null;
   return {
     version: 1,
     requestId: request.id,
@@ -139,7 +143,8 @@ export function createSandboxControlTerminalResult(
     targetState: typeof nested.targetState === 'string' ? nested.targetState : null,
     status: typeof nested.status === 'string' ? nested.status : 'completed',
     changed: typeof nested.changed === 'boolean' ? nested.changed : null,
-    completionEvidence: isCompletionEvidence(rawCompletion) ? rawCompletion : null
+    completionEvidence: isCompletionEvidence(rawCompletion) ? rawCompletion : null,
+    ...(warning ? { warning } : {})
   };
 }
 
@@ -173,6 +178,9 @@ export function readSandboxControlTerminalResult(filePath: string): SandboxContr
   if (value.completionEvidence !== null && !isCompletionEvidence(value.completionEvidence)) {
     throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
   }
+  if (value.warning !== undefined && value.warning !== null && !isRecoveryWarning(value.warning)) {
+    throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
+  }
   if (value.changed === undefined) {
     throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
   }

package/lib/sandbox/control/task-workflow.ts

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 
-import { readStableFile, SecureFileError, writeAtomicFile } from '../../host-control/secure-fs.ts';
+import { readStableFile, SecureFileError, writeAtomicFile } from '../../task/secure-fs.ts';
 
 import { TASK_WORKFLOW_COMMANDS, TASK_WORKFLOW_OPERATIONS, type TaskWorkflowOperation, type WorkflowCommand } from '../../task/workflow-command.ts';