@tea-agent/loop-agent 0.42.0-next.14 → 0.42.0-next.16

package/dist/workflows/dag/rerun-plan.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { z } from "zod";
 import { assertTaskContractBindingFresh } from "./task-contract-binding.js";
+import { workspaceDriftedPaths, } from "./workspace-checkpoint.js";
 import { isSafeReadOnlyPiRetryCandidate, isTransportCrashedExclusiveWriter } from "./retry-policy.js";
 import { resolveDagTaskSourcePath } from "../../task/dag-source-paths.js";
 import { composeDagPromptOverridePrompt, MAX_DAG_RERUN_PROMPT_OVERRIDE_CHARS, } from "../../shared/dag-prompt-override.js";
@@ -1110,6 +1111,46 @@ function deriveSuggestedAction(input) {
     }
     return "manual";
 }
+/**
+ * Gitignore-style-lite matcher for readSet/writeSet path patterns in scoped
+ * workspace-drift evaluation: literal paths match exactly; `**` spans path
+ * segments (a trailing `/**` also matches when nothing follows), `*` stays
+ * within one segment, `?` is one non-separator char.
+ */
+function pathMatchesWorkspacePattern(pathValue, pattern) {
+    const normalizedPath = pathValue.replace(/\\/g, "/").replace(/^\.\//, "");
+    const trimmed = pattern.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!trimmed || trimmed === "/")
+        return false;
+    if (trimmed === normalizedPath)
+        return true;
+    let source = "";
+    for (let index = 0; index < trimmed.length; index += 1) {
+        const char = trimmed[index];
+        if (char === "*") {
+            if (trimmed[index + 1] === "*") {
+                if (trimmed[index + 2] === "/") {
+                    source += "(?:.*/)?";
+                    index += 2;
+                }
+                else {
+                    source += ".*";
+                    index += 1;
+                }
+            }
+            else {
+                source += "[^/]*";
+            }
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`).test(normalizedPath);
+}
 function deriveRisk(reasonCodes, resetCount) {
     if (reasonCodes.includes("restart-subgraph-contains-writer") ||
         reasonCodes.includes("restart-subgraph-contains-unsafe-shell") ||
@@ -1213,7 +1254,14 @@ export async function evaluateDagRerunPlan(input) {
         blockedReasons.push("parent-lifecycle-ineligible");
     }
     else if (input.parentState.status !== "failed" &&
-        input.parentState.status !== "partial_failed") {
+        input.parentState.status !== "partial_failed" &&
+        // A superseded parent is a terminal operator judgment about the run as
+        // a whole, not about its deterministic read-only compute: its FINISHED
+        // upstream nodes are still valid fact donors for the imported set, and
+        // every unsafe case (writers in the reset subgraph, decision gates,
+        // stale checkpoints, unresolved ERROR nodes outside the closure) keeps
+        // its own dedicated block below.
+        input.parentState.status !== "superseded") {
         reasonCodes.push("parent-lifecycle-ineligible");
         blockedReasons.push("parent-lifecycle-ineligible");
     }
@@ -1241,8 +1289,36 @@ export async function evaluateDagRerunPlan(input) {
     else if (input.currentWorkspace?.fingerprint &&
         input.parentTerminalWorkspace.fingerprint !==
             input.currentWorkspace.fingerprint) {
-        reasonCodes.push("workspace-drift");
-        blockedReasons.push("workspace-drift");
+        // Whole-fingerprint drift is refined to content-level paths: the rerun
+        // re-derives (readSet) and rewrites (writeSet) the reset subgraph's own
+        // paths, so drift confined to those paths is recomputed by the rerun
+        // itself and must not force a full standalone rerun. Drift anywhere
+        // else — especially inputs of imported fact-reuse nodes — keeps the
+        // strict block. Indeterminate checkpoints fail closed.
+        const driftedPaths = workspaceDriftedPaths(input.parentTerminalWorkspace, input.currentWorkspace);
+        const importedReadPaths = importedNodeIds.flatMap((nodeId) => {
+            const task = tasksByIdForPlan.get(nodeId);
+            return task?.readSet ?? [];
+        });
+        const scopedDrift = driftedPaths !== undefined &&
+            driftedPaths.length > 0 &&
+            driftedPaths.every((driftPath) => !importedReadPaths.some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern)) &&
+                resetNodeIds.some((nodeId) => {
+                    const task = tasksByIdForPlan.get(nodeId);
+                    if (!task)
+                        return false;
+                    return [
+                        ...(task.writeSet ?? []),
+                        ...(task.readSet ?? []),
+                    ].some((pattern) => pathMatchesWorkspacePattern(driftPath, pattern));
+                }));
+        if (scopedDrift) {
+            reasonCodes.push("workspace-drift-scoped");
+        }
+        else {
+            reasonCodes.push("workspace-drift");
+            blockedReasons.push("workspace-drift");
+        }
     }
     else if (!input.currentWorkspace?.fingerprint) {
         reasonCodes.push("workspace-checkpoint-missing");
@@ -1293,8 +1369,18 @@ export async function evaluateDagRerunPlan(input) {
     }
     for (const nodeId of importedNodeIds) {
         const record = input.parentState.nodes[nodeId];
-        if (!record)
+        if (!record) {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
             continue;
+        }
+        if (record.status === "PENDING" || record.status === "RUNNING") {
+            reasonCodes.push("parent-facts-invalid");
+            blockedReasons.push("parent-facts-invalid");
+            blockingNodes.push({ nodeId, reasonCode: "parent-facts-invalid" });
+            continue;
+        }
         if (record.status === "ERROR") {
             reasonCodes.push("parent-facts-invalid");
             blockedReasons.push("parent-facts-invalid");

package/dist/workflows/dag/rerun-run.js

@@ -784,6 +784,13 @@ async function stageContinuationRun(input) {
         if (!parentRecord) {
             throw new Error(`parent node record missing for imported node: ${nodeId}`);
         }
+        if (parentRecord.status !== "FINISHED" &&
+            !(parentRecord.status === "SKIPPED" &&
+                (parentRecord.skippedReason?.includes("condition") ||
+                    parentRecord.skippedReason?.includes("runIf") ||
+                    parentRecord.skippedReason?.includes("run-if")))) {
+            throw new Error(`parent node is not a settled fact donor for imported node: ${nodeId}`);
+        }
         const { manifestNode, importedRecord } = await importNodeFacts({
             parentRunDir: input.parentRunDir,
             newRunDir: runDir,

package/dist/workflows/dag/retry-policy.js

@@ -7,8 +7,8 @@ import { TYPED_EVENT_FACT_KINDS } from "./frontend-typed-event-store.js";
  * is re-exported here unchanged so retry-policy stays the single import
  * surface for retry policies and helpers.
  */
-export { ALL_DAG_RETRY_CATEGORIES, CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, PROTOCOL_INVALID_RETRY_CATEGORY, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_OUTPUT_TRUNCATED_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, dagRetryBackoffSchema, dagRetryCategorySchema, dagRetryPolicySchema, } from "./dag-retry-schema.js";
-import { CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./dag-retry-schema.js";
+export { ALL_DAG_RETRY_CATEGORIES, CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, PROTOCOL_INVALID_RETRY_CATEGORY, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_OUTPUT_TRUNCATED_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, dagRetryBackoffSchema, dagRetryCategorySchema, dagRetryPolicySchema, } from "./dag-retry-schema.js";
+import { CONTEXT_OVERFLOW_RETRY_CATEGORY, DEFAULT_DAG_RETRY_CATEGORIES, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, PROTOCOL_AWARE_DAG_RETRY_CATEGORIES, READ_BURST_RETRY_CATEGORY, REVIEW_TERMINAL_MISSING_RETRY_CATEGORY, STRUCTURED_ARTIFACT_INVALID_RETRY_CATEGORY, STRUCTURED_OUTPUT_RETRY_CATEGORY, STRUCTURED_REQUIRED_DAG_RETRY_CATEGORIES, TARGET_TEMPLATE_TRANSIENT_RETRY_PROFILE, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, } from "./dag-retry-schema.js";
 const RETRY_SAFE_PI_ROLES = new Set([
     "planner",
     "scout",
@@ -19,7 +19,7 @@ const RETRY_SAFE_PI_ROLES = new Set([
 ]);
 /**
  * The default retry policy applied to safe generated read-only Pi nodes.
- * Total attempts: 3, exponential backoff with cap.
+ * Total attempts: 5, exponential backoff with cap.
  *
  * Includes `context-overflow`: a read-only node that blew the context window
  * (400 request too large, e.g. a review node accumulating too many reads) is a
@@ -29,7 +29,7 @@ const RETRY_SAFE_PI_ROLES = new Set([
  * design-review/review fell straight to ERROR without a retry attempt.
  */
 export const DEFAULT_READ_ONLY_PI_RETRY_POLICY = {
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
@@ -125,7 +125,10 @@ export const WRITER_EMPTY_DIFF_RETRY_POLICY = {
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
-    retryCategories: [WRITER_EMPTY_DIFF_RETRY_CATEGORY],
+    retryCategories: [
+        WRITER_EMPTY_DIFF_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
+    ],
 };
 /**
  * Bounded transport retry for standard exclusive implementers when a provider
@@ -140,6 +143,7 @@ export const WRITER_TRANSPORT_RETRY_POLICY = {
     retryCategories: [
         WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
         CONTEXT_OVERFLOW_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /**
@@ -175,6 +179,7 @@ export const TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY = {
     retryCategories: [
         WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
         CONTEXT_OVERFLOW_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /**
@@ -182,13 +187,14 @@ export const TARGET_TEMPLATE_WRITER_TRANSPORT_RETRY_POLICY = {
  * recovery attempts driven by Completeness Gate (missing/broken target files).
  */
 export const BACKEND_TEST_WRITER_COMPLETENESS_RETRY_POLICY = {
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 2000,
     maxDelayMs: 30000,
     retryCategories: [
         WRITER_EMPTY_DIFF_RETRY_CATEGORY,
         INCOMPLETE_WRITE_SET_RETRY_CATEGORY,
+        OUTPUT_LIMIT_RETRY_CATEGORY,
     ],
 };
 /** Markdown shard writers use one full attempt plus at most one bounded binding repair. */
@@ -472,9 +478,9 @@ function reasonMandatedFrontendPlanRetryStep(reason) {
     }
 }
 /**
- * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=3
- * bounds plan retry cost: the four-rung ladder is only partially traversable
- * before the run fails non-converging (rungs: normal → bounded-tool-only →
+ * Opt-in retry policy mounted on the frontend-plan-pi node. maxAttempts=5
+ * lets the producer validate and repair each generated increment while still
+ * bounding the four-rung ladder (normal → bounded-tool-only →
  * compact-terminal-first → backup-model). `invalid-output` (typed-fact schema
  * violations, e.g. verification targets referencing undeclared UI states)
  * retries at the `normal` rung with the contractCheck reason injected via
@@ -485,7 +491,7 @@ export const FRONTEND_PLAN_LADDER_RETRY_POLICY = {
     // incremental record_* calls; dense call bursts hit provider rate limits
     // whose windows exceed the old 30s cap. Longer backoff gives the limit
     // window time to expire before the next attempt.
-    maxAttempts: 3,
+    maxAttempts: 5,
     backoff: "exponential",
     initialDelayMs: 5000,
     maxDelayMs: 60000,

package/dist/workflows/dag/runner-exit-diagnostics.js

@@ -0,0 +1,125 @@
+import { appendFileSync, mkdirSync, unlinkSync } from "node:fs";
+import { hostname } from "node:os";
+import path from "node:path";
+/**
+ * Runner exit-time diagnostics (silent-death forensics).
+ *
+ * A DAG runner can disappear without a crash report and without stderr (five
+ * reproductions during frontend recovery/long-plan runs, 2026-09-06): when a
+ * supervisor hard-kills the process or the event loop is wedged, no JS runs,
+ * so nothing is persisted and the run is only discoverable later as an
+ * orphaned RUNNING state with a frozen heartbeat. That leaves no evidence of
+ * WHERE the runner was when it died or whether the exit was even observable
+ * by Node.
+ *
+ * This module gives every abnormal death a durable trace next to state.json:
+ *   - an `armed` line is written when the checkpoint starts executing;
+ *   - a `process-exit` line is appended from the process `exit` hook with the
+ *     exit code and a live state snapshot (status, terminalReason, RUNNING
+ *     nodes, heartbeat staleness);
+ *   - `uncaught-exception` / `unhandled-rejection` lines record the error
+ *     before the process is allowed to crash exactly as it would have
+ *     via uncaughtExceptionMonitor without changing the host's crash policy.
+ *
+ * On a clean terminal return the runner calls stop(), which removes every
+ * listener and deletes the journal, so completed runs carry no noise. A file
+ * left behind therefore means: diagnostics were armed, then the process went
+ * away through a path Node could not observe (`armed` line only → external
+ * SIGKILL/OOM/event-loop wedge) or through an observed abnormal exit (`armed`
+ * + one or more event lines → the reason is recorded in the file).
+ *
+ * Journal writes are strictly synchronous and best-effort: an append failure
+ * must never alter the runner's own crash/exit behavior.
+ */
+export const RUNNER_EXIT_DIAGNOSTICS_FILE = "runner-exit-diagnostics.jsonl";
+function describeError(error) {
+    if (error instanceof Error) {
+        return { name: error.name, message: error.message };
+    }
+    try {
+        return { message: String(error) };
+    }
+    catch {
+        return { message: "<unstringifiable error>" };
+    }
+}
+function appendJournalLineSync(journalPath, record) {
+    try {
+        mkdirSync(path.dirname(journalPath), { recursive: true });
+        appendFileSync(journalPath, `${JSON.stringify(record)}\n`, "utf8");
+    }
+    catch {
+        // Best-effort: journaling must never crash or alter exit behavior.
+    }
+}
+function removeJournalSync(journalPath) {
+    try {
+        unlinkSync(journalPath);
+    }
+    catch {
+        // Tolerate a missing journal (e.g. nothing was ever written).
+    }
+}
+export function installRunnerExitDiagnostics(options) {
+    const journalPath = path.join(options.runDir, RUNNER_EXIT_DIAGNOSTICS_FILE);
+    const target = options.target ?? process;
+    const armedAt = Date.now();
+    let stopped = false;
+    const base = {
+        runId: options.runId,
+        title: options.title,
+        pid: process.pid,
+        hostname: hostname(),
+    };
+    const safeSnapshot = () => {
+        try {
+            return options.snapshot();
+        }
+        catch {
+            return { status: "<snapshot-error>", running: [] };
+        }
+    };
+    const record = (kind, extra) => ({
+        ts: new Date().toISOString(),
+        kind,
+        ...base,
+        ...(extra ?? {}),
+        state: safeSnapshot(),
+    });
+    appendJournalLineSync(journalPath, {
+        ...record("armed"),
+        armedAt: new Date(armedAt).toISOString(),
+    });
+    const onProcessExit = (code) => {
+        if (stopped)
+            return;
+        appendJournalLineSync(journalPath, record("process-exit", {
+            code: typeof code === "number" ? code : process.exitCode ?? 0,
+            elapsedMs: Date.now() - armedAt,
+        }));
+    };
+    const onUncaughtException = (error, origin) => {
+        if (stopped)
+            return;
+        appendJournalLineSync(journalPath, record(origin === "unhandledRejection" ? "unhandled-rejection" : "uncaught-exception", {
+            error: describeError(error),
+            elapsedMs: Date.now() - armedAt,
+        }));
+        // Monitor listeners neither suppress fatal errors nor force a crash
+        // when the host has its own handlers or a nonfatal rejection policy.
+    };
+    target.on("exit", onProcessExit);
+    target.on("uncaughtExceptionMonitor", onUncaughtException);
+    return {
+        journalPath,
+        stop: () => {
+            if (stopped)
+                return;
+            stopped = true;
+            target.removeListener("exit", onProcessExit);
+            target.removeListener("uncaughtExceptionMonitor", onUncaughtException);
+            // Clean completion: leave completed runs free of diagnostics noise.
+            removeJournalSync(journalPath);
+        },
+    };
+}

package/dist/workflows/dag/runner.js

@@ -32,11 +32,13 @@ import { assertFrontendTopologyBinding, buildFrontendTopologyBinding, computeFro
 import { ensureFrontendShapeCapsuleRecord } from "./frontend-shape-capsule-store.js";
 import { parseDagSpec, resolveModelForTask, } from "./types.js";
 import { computeActionPayloadHash, } from "../../infrastructure/console/operation-store.js";
+import { classifyFailureOwner, failureOwnerSchema } from "./frontend-recovery-capsule.js";
 import { acquireDagRecoveryLease, bindDagRecoveryLeaseExecution, claimDagRecoveryLease, } from "./recovery-lease.js";
 import { executeDynamicCondition } from "./dynamic-runtime/condition.js";
 import { executeDynamicLoopUntil } from "./dynamic-runtime/loop-until.js";
 import { executeDynamicMapExpansion } from "./dynamic-runtime/map.js";
 import { executeDynamicReduction } from "./dynamic-runtime/reduction.js";
+import { installRunnerExitDiagnostics } from "./runner-exit-diagnostics.js";
 export { buildNodePrompt, buildNodePromptWithResolvedSkillInstructions };
 export async function loadDagSpecFromFile(dagPath) {
     const raw = JSON.parse(await readFile(dagPath, "utf-8"));
@@ -602,6 +604,36 @@ async function executeDagCheckpoint(input) {
     const onSigInt = () => shutdownOnSignal("SIGINT");
     process.once("SIGTERM", onSigTerm);
     process.once("SIGINT", onSigInt);
+    // Exit-time diagnostics (silent-death forensics): write an `armed` line at
+    // checkpoint start and append process-exit / uncaught-exception /
+    // unhandled-rejection lines with a live state snapshot so an abnormal death
+    // (supervisor hard kill, wedged event loop, crash with lost stderr) leaves
+    // a durable trace next to state.json. Removed on clean terminal return.
+    const exitDiagnostics = installRunnerExitDiagnostics({
+        runDir,
+        runId: state.runId,
+        title: state.title,
+        snapshot: () => {
+            const heartbeatAt = state.runner?.heartbeatAt;
+            return {
+                status: state.status,
+                terminalReason: state.terminalReason,
+                failureCategory: state.failureCategory,
+                heartbeatAt,
+                heartbeatAgeMs: heartbeatAt === undefined
+                    ? undefined
+                    : Math.max(0, Date.now() - Date.parse(heartbeatAt)),
+                running: Object.values(state.nodes)
+                    .filter((node) => node.status === "RUNNING")
+                    .map((node) => ({
+                    id: node.id,
+                    attempt: node.currentAttempt,
+                    startedAt: node.startedAt,
+                    lastMeaningfulProgressAt: node.lastMeaningfulProgressAt,
+                })),
+            };
+        },
+    });
     try {
         const tasksById = new Map(spec.tasks.map((task) => [task.id, task]));
         const baseExecuteNode = input.executeNode ??
@@ -938,6 +970,7 @@ async function executeDagCheckpoint(input) {
     finally {
         clearInterval(heartbeatTimer);
         interruptWatcher?.stop();
+        exitDiagnostics.stop();
         process.removeListener("SIGTERM", onSigTerm);
         process.removeListener("SIGINT", onSigInt);
     }
@@ -1296,13 +1329,40 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd, f
         if (verifyFailed) {
             const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
             if (continuationCount < frontendRecoveryQuota) {
-                recoveryTrigger = {
-                    requestId: state.runId,
-                    failureSource: "frontend-verify-shell",
-                    failureOwner: "implementation",
-                    protocolFailureReason: "frontend verification failure",
-                    recoveryMode: "continuation",
-                };
+                let recoveryOwner = classifyFailureOwner({
+                    nodeId: "frontend-verify-shell",
+                    rawFailureCategory: state.nodes["frontend-verify-shell"]?.failureCategory,
+                });
+                try {
+                    const verifyFailure = JSON.parse(await readFile(path.join(runDir, "contracts/frontend-verify-failure.json"), "utf8"));
+                    const owner = failureOwnerSchema.safeParse(verifyFailure.failureOwner);
+                    if (verifyFailure.schemaVersion === 1 &&
+                        verifyFailure.schemaId === "frontend-verify-failure-v1" &&
+                        verifyFailure.nodeId === "frontend-verify-shell" &&
+                        verifyFailure.failureCategory === state.nodes["frontend-verify-shell"]?.failureCategory &&
+                        owner.success) {
+                        recoveryOwner = owner.data;
+                    }
+                    else {
+                        recoveryOwner = "unknown";
+                    }
+                }
+                catch {
+                    // The node's classified category remains the fallback; never turn
+                    // unknown/environment/configuration failures into writer work.
+                }
+                if (recoveryOwner === "implementation")
+                    recoveryTrigger = {
+                        requestId: state.runId,
+                        failureSource: "frontend-verify-shell",
+                        failureOwner: recoveryOwner,
+                        protocolFailureReason: "frontend verification failure",
+                        recoveryMode: "continuation",
+                    };
+                else
+                    state.terminalReason = recoveryOwner === "environment"
+                        ? "frontend-verification-wait-external"
+                        : `frontend-verification-${recoveryOwner}-requires-contract-review`;
             }
         }
     }

package/dist/workflows/dag/structured-output-repair.js

@@ -112,7 +112,10 @@ export function isStructuredRepairableFailureCategory(category) {
     return (category === "invalid-output" ||
         category === "structured-output-truncated" ||
         category === "output-too-large" ||
-        category === "empty-output");
+        category === "empty-output" ||
+        // A length-truncated structured turn with a non-empty candidate artifact
+        // still repairs best through the frozen artifact repair prompt.
+        category === "output-limit");
 }
 export function formatStructuredArtifactPointer(input) {
     return [

package/dist/workflows/dag/validate.js

@@ -3,7 +3,7 @@ import { resolveShellCommands } from "../../executors/shell-executor.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { resolveRepairTaskForGate } from "./repair-artifact.js";
 import { topoSortToRanks } from "./topo.js";
-import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, CONTEXT_OVERFLOW_RETRY_CATEGORY, } from "./retry-policy.js";
+import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, CONTEXT_OVERFLOW_RETRY_CATEGORY, } from "./retry-policy.js";
 import { isBackendTestCompletenessRetryCandidate } from "./backend-test-writer-completeness.js";
 import { defaultFrontendTestLayout, frontendTestLayoutFromSpec, } from "./frontend-test-layout.js";
 const GOVERNANCE_WARNING_TYPES = new Set([
@@ -630,27 +630,28 @@ function validateRetryPolicyTaskConfig(task, issues) {
         const allowed = new Set([
             WRITER_EMPTY_DIFF_RETRY_CATEGORY,
             INCOMPLETE_WRITE_SET_RETRY_CATEGORY,
+            OUTPUT_LIMIT_RETRY_CATEGORY,
         ]);
         const unsupported = task.retryPolicy.retryCategories.filter((category) => !allowed.has(category));
         if (task.retryPolicy.maxAttempts < 2 ||
-            task.retryPolicy.maxAttempts > 3 ||
+            task.retryPolicy.maxAttempts > 5 ||
             unsupported.length > 0 ||
             !categories.has(WRITER_EMPTY_DIFF_RETRY_CATEGORY)) {
             issues.push({
                 type: "invalid-retry-policy",
-                message: `task ${task.id} backend-test writer retryPolicy must use 2..3 total attempts and only ${WRITER_EMPTY_DIFF_RETRY_CATEGORY} and/or ${INCOMPLETE_WRITE_SET_RETRY_CATEGORY}`,
+                message: `task ${task.id} backend-test writer retryPolicy must use 2..5 total attempts and only ${WRITER_EMPTY_DIFF_RETRY_CATEGORY}, ${INCOMPLETE_WRITE_SET_RETRY_CATEGORY}, and/or ${OUTPUT_LIMIT_RETRY_CATEGORY}`,
             });
         }
         return;
     }
     if (isWriterEmptyDiffCandidate &&
         (task.retryPolicy.maxAttempts !== 2 ||
-            task.retryPolicy.retryCategories.length !== 1 ||
-            task.retryPolicy.retryCategories[0] !==
-                WRITER_EMPTY_DIFF_RETRY_CATEGORY)) {
+            !task.retryPolicy.retryCategories.includes(WRITER_EMPTY_DIFF_RETRY_CATEGORY) ||
+            task.retryPolicy.retryCategories.some((category) => category !== WRITER_EMPTY_DIFF_RETRY_CATEGORY &&
+                category !== OUTPUT_LIMIT_RETRY_CATEGORY))) {
         issues.push({
             type: "invalid-retry-policy",
-            message: `task ${task.id} writer retryPolicy must use exactly two total attempts and only ${WRITER_EMPTY_DIFF_RETRY_CATEGORY}`,
+            message: `task ${task.id} writer retryPolicy must use exactly two total attempts and ${WRITER_EMPTY_DIFF_RETRY_CATEGORY}, with optional ${OUTPUT_LIMIT_RETRY_CATEGORY}`,
         });
         return;
     }
@@ -659,6 +660,7 @@ function validateRetryPolicyTaskConfig(task, issues) {
         const allowedWriterTransportCategories = new Set([
             WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
             CONTEXT_OVERFLOW_RETRY_CATEGORY,
+            OUTPUT_LIMIT_RETRY_CATEGORY,
         ]);
         const allAllowed = [...categories].every((category) => allowedWriterTransportCategories.has(category));
         if (task.retryPolicy.maxAttempts !== 2 ||
@@ -667,7 +669,7 @@ function validateRetryPolicyTaskConfig(task, issues) {
             !categories.has(WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY)) {
             issues.push({
                 type: "invalid-retry-policy",
-                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only writer-clean-timeout (plus optional context-overflow)`,
+                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only writer-clean-timeout (plus optional context-overflow/output-limit)`,
             });
         }
     }

package/dist/workflows/dag/workspace-checkpoint.js

@@ -184,3 +184,69 @@ export function workspaceFingerprintsMatch(left, right) {
         return false;
     return left.fingerprint === right.fingerprint;
 }
+/**
+ * Path-level drift between two checkpoints: paths whose content hash,
+ * porcelain state, or presence differs (changed paths plus stable Task
+ * Contract governance inputs). The whole-tree fingerprint also moves on HEAD
+ * commits or porcelain churn that leaves every path's content untouched;
+ * only content-level path diffs are actionable for scoped rerun eligibility.
+ * Returns undefined when either checkpoint lacks a path inventory so callers
+ * fail closed to the strict whole-fingerprint comparison.
+ */
+export function workspaceDriftedPaths(parent, current) {
+    // changedPaths is only the porcelain inventory; it cannot explain files
+    // already committed between two different HEADs. Never localize that drift.
+    if (!parent.gitHeadSha ||
+        !current.gitHeadSha ||
+        parent.gitHeadSha !== current.gitHeadSha) {
+        return undefined;
+    }
+    if (!Array.isArray(parent.changedPaths) || !Array.isArray(current.changedPaths)) {
+        return undefined;
+    }
+    // Porcelain v1 records only the rename destination in this checkpoint
+    // schema, so the removed source path cannot be proven safe for imported
+    // readers. Keep scoped reuse fail-closed until both sides expose complete
+    // rename lineage.
+    if (parent.changedPaths.some((entry) => entry.state === "renamed") ||
+        current.changedPaths.some((entry) => entry.state === "renamed")) {
+        return undefined;
+    }
+    if ((parent.stableGovernanceInputs === undefined) !==
+        (current.stableGovernanceInputs === undefined)) {
+        return undefined;
+    }
+    const drifted = new Set();
+    const parentByPath = new Map(parent.changedPaths.map((entry) => [entry.path, entry]));
+    const currentByPath = new Map(current.changedPaths.map((entry) => [entry.path, entry]));
+    for (const [pathKey, parentEntry] of parentByPath) {
+        const currentEntry = currentByPath.get(pathKey);
+        if (!currentEntry) {
+            drifted.add(pathKey);
+            continue;
+        }
+        if (parentEntry.contentSha256 !== currentEntry.contentSha256 ||
+            parentEntry.state !== currentEntry.state ||
+            parentEntry.mode !== currentEntry.mode) {
+            drifted.add(pathKey);
+        }
+    }
+    for (const pathKey of currentByPath.keys()) {
+        if (!parentByPath.has(pathKey))
+            drifted.add(pathKey);
+    }
+    if (parent.stableGovernanceInputs && current.stableGovernanceInputs) {
+        const parentGov = new Map(parent.stableGovernanceInputs.map((entry) => [entry.path, entry.contentSha256]));
+        const currentGov = new Map(current.stableGovernanceInputs.map((entry) => [entry.path, entry.contentSha256]));
+        for (const [pathKey, hash] of parentGov) {
+            const other = currentGov.get(pathKey);
+            if (other === undefined || other !== hash)
+                drifted.add(pathKey);
+        }
+        for (const [pathKey, hash] of currentGov) {
+            if (parentGov.get(pathKey) !== hash)
+                drifted.add(pathKey);
+        }
+    }
+    return [...drifted];
+}

package/docs/operations/README.md

@@ -11,5 +11,6 @@
 - [`production-readiness.md`](production-readiness.md)：交付前的生产就绪判断。
 - [`agent-worker-production-readiness.md`](agent-worker-production-readiness.md)：agent-worker Feature/Task Pool 外层编排的 Production Readiness v1 操作合同。
 - [`backend-test-jacoco-coverage.md`](backend-test-jacoco-coverage.md)：Java 被测服务挂载 JaCoCo tcpserver agent 的 Maven、`java -jar` 与 Docker 操作手册。
+- [`console-chat-dogfood-playbook.md`](console-chat-dogfood-playbook.md)：Operator Chat（含 Explore 子 Agent）真实模型 dogfood 的 CLI 驱动步骤、mutation 双 token / SSE 超时 / question 应答等已知陷阱与验证方式。
 
 验证命令仍以 [`../governance/verification-matrix.md`](../governance/verification-matrix.md) 为准。

package/docs/templates/agent-dag.schema.json

@@ -466,9 +466,9 @@
         "retryCategories": {
           "type": "array",
           "items": {
-            "enum": ["timeout", "network", "rate-limit", "unavailable", "empty-output", "output-too-large", "protocol-invalid", "invalid-output", "writer-empty-diff", "incomplete-write-set", "writer-clean-timeout", "read-burst", "context-overflow"]
+            "enum": ["timeout", "network", "rate-limit", "unavailable", "empty-output", "output-limit", "output-too-large", "protocol-invalid", "invalid-output", "writer-empty-diff", "incomplete-write-set", "writer-clean-timeout", "read-burst", "context-overflow"]
           },
-          "default": ["timeout", "network", "rate-limit", "unavailable", "empty-output"],
+          "default": ["timeout", "network", "rate-limit", "unavailable", "empty-output", "output-limit"],
           "description": "Failure categories eligible for retry. quota/auth/write-guard are never eligible. invalid-output is allowed only on explicit structured/protocol policies; writer-empty-diff and incomplete-write-set are reserved for requireChangedFiles generation/completeness writers; writer-clean-timeout is reserved for standard bounded writers after explicit zero-write-tool-call and empty-diff evidence."
         }
       }