@tea-agent/loop-agent 0.42.0-next.9 → 0.43.0-next.1

package/dist/workflows/dag/runner-exit-diagnostics.js

@@ -0,0 +1,125 @@
+import { appendFileSync, mkdirSync, unlinkSync } from "node:fs";
+import { hostname } from "node:os";
+import path from "node:path";
+/**
+ * Runner exit-time diagnostics (silent-death forensics).
+ *
+ * A DAG runner can disappear without a crash report and without stderr (five
+ * reproductions during frontend recovery/long-plan runs, 2026-09-06): when a
+ * supervisor hard-kills the process or the event loop is wedged, no JS runs,
+ * so nothing is persisted and the run is only discoverable later as an
+ * orphaned RUNNING state with a frozen heartbeat. That leaves no evidence of
+ * WHERE the runner was when it died or whether the exit was even observable
+ * by Node.
+ *
+ * This module gives every abnormal death a durable trace next to state.json:
+ *   - an `armed` line is written when the checkpoint starts executing;
+ *   - a `process-exit` line is appended from the process `exit` hook with the
+ *     exit code and a live state snapshot (status, terminalReason, RUNNING
+ *     nodes, heartbeat staleness);
+ *   - `uncaught-exception` / `unhandled-rejection` lines record the error
+ *     before the process is allowed to crash exactly as it would have
+ *     via uncaughtExceptionMonitor without changing the host's crash policy.
+ *
+ * On a clean terminal return the runner calls stop(), which removes every
+ * listener and deletes the journal, so completed runs carry no noise. A file
+ * left behind therefore means: diagnostics were armed, then the process went
+ * away through a path Node could not observe (`armed` line only → external
+ * SIGKILL/OOM/event-loop wedge) or through an observed abnormal exit (`armed`
+ * + one or more event lines → the reason is recorded in the file).
+ *
+ * Journal writes are strictly synchronous and best-effort: an append failure
+ * must never alter the runner's own crash/exit behavior.
+ */
+export const RUNNER_EXIT_DIAGNOSTICS_FILE = "runner-exit-diagnostics.jsonl";
+function describeError(error) {
+    if (error instanceof Error) {
+        return { name: error.name, message: error.message };
+    }
+    try {
+        return { message: String(error) };
+    }
+    catch {
+        return { message: "<unstringifiable error>" };
+    }
+}
+function appendJournalLineSync(journalPath, record) {
+    try {
+        mkdirSync(path.dirname(journalPath), { recursive: true });
+        appendFileSync(journalPath, `${JSON.stringify(record)}\n`, "utf8");
+    }
+    catch {
+        // Best-effort: journaling must never crash or alter exit behavior.
+    }
+}
+function removeJournalSync(journalPath) {
+    try {
+        unlinkSync(journalPath);
+    }
+    catch {
+        // Tolerate a missing journal (e.g. nothing was ever written).
+    }
+}
+export function installRunnerExitDiagnostics(options) {
+    const journalPath = path.join(options.runDir, RUNNER_EXIT_DIAGNOSTICS_FILE);
+    const target = options.target ?? process;
+    const armedAt = Date.now();
+    let stopped = false;
+    const base = {
+        runId: options.runId,
+        title: options.title,
+        pid: process.pid,
+        hostname: hostname(),
+    };
+    const safeSnapshot = () => {
+        try {
+            return options.snapshot();
+        }
+        catch {
+            return { status: "<snapshot-error>", running: [] };
+        }
+    };
+    const record = (kind, extra) => ({
+        ts: new Date().toISOString(),
+        kind,
+        ...base,
+        ...(extra ?? {}),
+        state: safeSnapshot(),
+    });
+    appendJournalLineSync(journalPath, {
+        ...record("armed"),
+        armedAt: new Date(armedAt).toISOString(),
+    });
+    const onProcessExit = (code) => {
+        if (stopped)
+            return;
+        appendJournalLineSync(journalPath, record("process-exit", {
+            code: typeof code === "number" ? code : process.exitCode ?? 0,
+            elapsedMs: Date.now() - armedAt,
+        }));
+    };
+    const onUncaughtException = (error, origin) => {
+        if (stopped)
+            return;
+        appendJournalLineSync(journalPath, record(origin === "unhandledRejection" ? "unhandled-rejection" : "uncaught-exception", {
+            error: describeError(error),
+            elapsedMs: Date.now() - armedAt,
+        }));
+        // Monitor listeners neither suppress fatal errors nor force a crash
+        // when the host has its own handlers or a nonfatal rejection policy.
+    };
+    target.on("exit", onProcessExit);
+    target.on("uncaughtExceptionMonitor", onUncaughtException);
+    return {
+        journalPath,
+        stop: () => {
+            if (stopped)
+                return;
+            stopped = true;
+            target.removeListener("exit", onProcessExit);
+            target.removeListener("uncaughtExceptionMonitor", onUncaughtException);
+            // Clean completion: leave completed runs free of diagnostics noise.
+            removeJournalSync(journalPath);
+        },
+    };
+}

package/dist/workflows/dag/runner.js

@@ -7,7 +7,7 @@ import { isHardBudgetBreached, resolveEffectiveMaxConcurrent, } from "../../appl
 import { readCandidateRecord } from "../../infrastructure/evaluation/candidate-store.js";
 import { CANONICAL_TASK_ID_PATTERN, formatLocalCompactDate, } from "../../task/runtime.js";
 import { assertFrozenBudget, initRunBudgetLedger, preflightBudgetOrBreach, recordFinishedNodeBudget, writeBudgetLedgerArtifacts, } from "./budget-enforcement.js";
-import { getDagRunDir, isTerminalDagRunStatus, locateDagRun, readHumanApprovalArtifact, requireActiveDagRun, } from "./lifecycle.js";
+import { getDagRunDir, isTerminalDagRunStatus, locateDagRun, readHumanApprovalArtifact, readDagRunState, requireActiveDagRun, } from "./lifecycle.js";
 import { markInterruptNeedsReconcile, mergeAbortSignals, readInterruptRequest, runnerIdentityFromState, settleDagInterrupt, startInterruptWatcher, } from "./interrupt-request.js";
 import { moveToCompletedRunDir, moveToPausedRunDir, prepareRunDir, writeRunSpec, writeRunState, } from "./run-store.js";
 import { evaluateNodeLiveness, resolveLivenessPolicy, } from "./liveness-policy.js";
@@ -31,11 +31,14 @@ import { bindFrontendShapeStateToRunTopology, commitFrontendShapeTransitionCas,
 import { assertFrontendTopologyBinding, buildFrontendTopologyBinding, computeFrontendShapeSourceDigest, } from "./frontend-shape.js";
 import { ensureFrontendShapeCapsuleRecord } from "./frontend-shape-capsule-store.js";
 import { parseDagSpec, resolveModelForTask, } from "./types.js";
-import { acquireDagRecoveryLease, bindDagRecoveryLeaseExecution, } from "./recovery-lease.js";
+import { computeActionPayloadHash, } from "../../infrastructure/console/operation-store.js";
+import { classifyFailureOwner, failureOwnerSchema } from "./frontend-recovery-capsule.js";
+import { acquireDagRecoveryLease, bindDagRecoveryLeaseExecution, claimDagRecoveryLease, } from "./recovery-lease.js";
 import { executeDynamicCondition } from "./dynamic-runtime/condition.js";
 import { executeDynamicLoopUntil } from "./dynamic-runtime/loop-until.js";
 import { executeDynamicMapExpansion } from "./dynamic-runtime/map.js";
 import { executeDynamicReduction } from "./dynamic-runtime/reduction.js";
+import { installRunnerExitDiagnostics } from "./runner-exit-diagnostics.js";
 export { buildNodePrompt, buildNodePromptWithResolvedSkillInstructions };
 export async function loadDagSpecFromFile(dagPath) {
     const raw = JSON.parse(await readFile(dagPath, "utf-8"));
@@ -601,6 +604,36 @@ async function executeDagCheckpoint(input) {
     const onSigInt = () => shutdownOnSignal("SIGINT");
     process.once("SIGTERM", onSigTerm);
     process.once("SIGINT", onSigInt);
+    // Exit-time diagnostics (silent-death forensics): write an `armed` line at
+    // checkpoint start and append process-exit / uncaught-exception /
+    // unhandled-rejection lines with a live state snapshot so an abnormal death
+    // (supervisor hard kill, wedged event loop, crash with lost stderr) leaves
+    // a durable trace next to state.json. Removed on clean terminal return.
+    const exitDiagnostics = installRunnerExitDiagnostics({
+        runDir,
+        runId: state.runId,
+        title: state.title,
+        snapshot: () => {
+            const heartbeatAt = state.runner?.heartbeatAt;
+            return {
+                status: state.status,
+                terminalReason: state.terminalReason,
+                failureCategory: state.failureCategory,
+                heartbeatAt,
+                heartbeatAgeMs: heartbeatAt === undefined
+                    ? undefined
+                    : Math.max(0, Date.now() - Date.parse(heartbeatAt)),
+                running: Object.values(state.nodes)
+                    .filter((node) => node.status === "RUNNING")
+                    .map((node) => ({
+                    id: node.id,
+                    attempt: node.currentAttempt,
+                    startedAt: node.startedAt,
+                    lastMeaningfulProgressAt: node.lastMeaningfulProgressAt,
+                })),
+            };
+        },
+    });
     try {
         const tasksById = new Map(spec.tasks.map((task) => [task.id, task]));
         const baseExecuteNode = input.executeNode ??
@@ -851,6 +884,7 @@ async function executeDagCheckpoint(input) {
                     const result = await runRecoveryOperationController({
                         operationId: created.operation.operationId,
                         parentRunId: state.runId,
+                        observeOnly: created.kind === "observed",
                         deps: {
                             ...input.recovery,
                             failureOwner: input.recovery.failureOwner ??
@@ -860,7 +894,40 @@ async function executeDagCheckpoint(input) {
                             recoveryMode: input.recovery.recoveryMode ?? recoveryTrigger.recoveryMode,
                         },
                     });
-                    state.frontendRecoveryResult = buildRecoveryResultForTrigger(state, recoveryTrigger, result.terminalReason === "succeeded"
+                    // The recovery CLI stages its child by writing a fresh
+                    // `frontendRecoveryState` into the parent run on disk. A successful
+                    // operation without that bound lineage is not a successful recovery:
+                    // fail closed instead of archiving a false-positive `recovered` result.
+                    let recoveryLineageError;
+                    if (result.terminalReason === "succeeded") {
+                        try {
+                            const persistedParentState = await readDagRunState(runDir);
+                            const persistedRecovery = persistedParentState.frontendRecoveryState;
+                            if (!persistedRecovery ||
+                                persistedRecovery.phase !== "child-running" ||
+                                persistedRecovery.parentRunId !== state.runId ||
+                                persistedRecovery.requestId !== recoveryTrigger.requestId ||
+                                !persistedRecovery.childRunId) {
+                                throw new Error("persisted recovery lineage is missing or unbound");
+                            }
+                            await assertRecoveredFrontendLineage({
+                                cwd,
+                                rootRunId: state.runId,
+                                rootRequestId: recoveryTrigger.requestId,
+                                recovery: persistedRecovery,
+                                maxContinuations: spec.frontendRecovery?.maxContinuations ?? 1,
+                            });
+                            state.frontendRecoveryState = structuredClone(persistedRecovery);
+                        }
+                        catch (error) {
+                            recoveryLineageError =
+                                error instanceof Error ? error.message : String(error);
+                            state.status = "failed";
+                            state.terminalReason =
+                                `frontend recovery lineage invalid: ${recoveryLineageError}`;
+                        }
+                    }
+                    state.frontendRecoveryResult = buildRecoveryResultForTrigger(state, recoveryTrigger, result.terminalReason === "succeeded" && !recoveryLineageError
                         ? "recovered"
                         : "auto-recovery-blocked");
                 }
@@ -903,10 +970,61 @@ async function executeDagCheckpoint(input) {
     finally {
         clearInterval(heartbeatTimer);
         interruptWatcher?.stop();
+        exitDiagnostics.stop();
         process.removeListener("SIGTERM", onSigTerm);
         process.removeListener("SIGINT", onSigInt);
     }
 }
+async function assertRecoveredFrontendLineage(input) {
+    const maxContinuations = Math.max(1, Math.min(5, input.maxContinuations));
+    let parentRunId = input.rootRunId;
+    let recovery = input.recovery;
+    const recoveryRootRunId = recovery.recoveryRootRunId;
+    const visited = new Set();
+    if (recoveryRootRunId !== input.rootRunId) {
+        throw new Error("recovery root lineage binding mismatch");
+    }
+    for (let depth = 0; depth < maxContinuations; depth += 1) {
+        // The persisted parent intent represents the edge about to be traversed,
+        // so its counters equal the number of already-completed continuation edges.
+        // Each completed child increments both counters exactly once; no edge may
+        // exceed the frozen DAG quota.
+        if (recovery.continuationCount !== depth ||
+            recovery.attemptIndex !== depth) {
+            throw new Error("recovery child lineage counters are not monotonic");
+        }
+        if (recovery.phase !== "child-running" ||
+            recovery.parentRunId !== parentRunId ||
+            recovery.recoveryRootRunId !== recoveryRootRunId ||
+            !recovery.childRunId ||
+            (depth === 0
+                ? recovery.requestId !== input.rootRequestId
+                : recovery.requestId !== parentRunId)) {
+            throw new Error("persisted recovery lineage is missing or unbound");
+        }
+        if (visited.has(recovery.childRunId)) {
+            throw new Error("recovery child lineage contains a cycle");
+        }
+        visited.add(recovery.childRunId);
+        const child = await locateDagRun(input.cwd, recovery.childRunId);
+        if (!child || child.lifecycle !== "completed") {
+            throw new Error("recovery child is not completed");
+        }
+        const childState = await readDagRunState(child.runDir);
+        if (childState.runId !== recovery.childRunId) {
+            throw new Error("recovery child state binding mismatch");
+        }
+        if (childState.status === "finished")
+            return;
+        if (childState.frontendRecoveryResult?.outcome !== "recovered" ||
+            !childState.frontendRecoveryState) {
+            throw new Error("recovery child terminal state is not successful");
+        }
+        parentRunId = childState.runId;
+        recovery = childState.frontendRecoveryState;
+    }
+    throw new Error("recovery child lineage exceeds the continuation quota");
+}
 async function finalizeRunOwnedInterrupt(input) {
     const request = await readInterruptRequest(input.runDir);
     if (!request)
@@ -1211,13 +1329,40 @@ export async function finalizeTerminalRunStatus(state, taskCount, runDir, cwd, f
         if (verifyFailed) {
             const continuationCount = state.frontendRecoveryState?.continuationCount ?? 0;
             if (continuationCount < frontendRecoveryQuota) {
-                recoveryTrigger = {
-                    requestId: state.runId,
-                    failureSource: "frontend-verify-shell",
-                    failureOwner: "implementation",
-                    protocolFailureReason: "frontend verification failure",
-                    recoveryMode: "continuation",
-                };
+                let recoveryOwner = classifyFailureOwner({
+                    nodeId: "frontend-verify-shell",
+                    rawFailureCategory: state.nodes["frontend-verify-shell"]?.failureCategory,
+                });
+                try {
+                    const verifyFailure = JSON.parse(await readFile(path.join(runDir, "contracts/frontend-verify-failure.json"), "utf8"));
+                    const owner = failureOwnerSchema.safeParse(verifyFailure.failureOwner);
+                    if (verifyFailure.schemaVersion === 1 &&
+                        verifyFailure.schemaId === "frontend-verify-failure-v1" &&
+                        verifyFailure.nodeId === "frontend-verify-shell" &&
+                        verifyFailure.failureCategory === state.nodes["frontend-verify-shell"]?.failureCategory &&
+                        owner.success) {
+                        recoveryOwner = owner.data;
+                    }
+                    else {
+                        recoveryOwner = "unknown";
+                    }
+                }
+                catch {
+                    // The node's classified category remains the fallback; never turn
+                    // unknown/environment/configuration failures into writer work.
+                }
+                if (recoveryOwner === "implementation")
+                    recoveryTrigger = {
+                        requestId: state.runId,
+                        failureSource: "frontend-verify-shell",
+                        failureOwner: recoveryOwner,
+                        protocolFailureReason: "frontend verification failure",
+                        recoveryMode: "continuation",
+                    };
+                else
+                    state.terminalReason = recoveryOwner === "environment"
+                        ? "frontend-verification-wait-external"
+                        : `frontend-verification-${recoveryOwner}-requires-contract-review`;
             }
         }
     }
@@ -1313,8 +1458,24 @@ async function createRecoveryOperation(input) {
         requestId: trigger.requestId,
         kind: "auto-frontend-recovery",
     });
+    let effectiveLease = recoveryLease;
+    let observeOnly = false;
     if (recoveryLease.kind === "held") {
-        return { kind: "lease-held", lease: recoveryLease.lease };
+        if (recoveryLease.lease.kind !== "auto-frontend-recovery" ||
+            recoveryLease.lease.requestId !== trigger.requestId) {
+            return { kind: "lease-held", lease: recoveryLease.lease };
+        }
+        const claimed = await claimDagRecoveryLease({
+            leasePath: recoveryLease.leasePath,
+            lease: recoveryLease.lease,
+        });
+        effectiveLease = claimed;
+        if (claimed.kind === "held") {
+            if (!claimed.lease.executionRef) {
+                return { kind: "lease-held", lease: claimed.lease };
+            }
+            observeOnly = true;
+        }
     }
     const { computeFrontendRecoveryPlanForSource } = await import("./frontend-recovery-plan.js");
     const plan = computeFrontendRecoveryPlanForSource({
@@ -1333,9 +1494,10 @@ async function createRecoveryOperation(input) {
         requestId: trigger.requestId,
         failureSource: trigger.failureSource,
         recoveryMode: trigger.recoveryMode,
+        planHash,
         plan,
     });
-    const created = await input.deps.store.create({
+    const operationInput = {
         clientRequestId: `dag-recovery-${state.runId}`,
         action: "dagRunTask",
         actionParams: {
@@ -1356,18 +1518,58 @@ async function createRecoveryOperation(input) {
             trigger.protocolFailureReason ?? "frontend automatic recovery",
             "--request-id",
             trigger.requestId,
+            "--frontend-recovery",
             "--json",
         ],
-    });
-    if (created.kind !== "conflict") {
+    };
+    let created;
+    if (effectiveLease.lease.executionRef) {
+        // Replay the exact operation bound by the durable lease. A missing record
+        // cannot be replaced with a new operation id without violating the fence.
+        const existing = await input.deps.store.get(effectiveLease.lease.executionRef);
+        if (!existing) {
+            throw new Error(`frontend recovery lease operation not found: ${effectiveLease.lease.executionRef}`);
+        }
+        if (existing.clientRequestId !== operationInput.clientRequestId ||
+            existing.action !== operationInput.action ||
+            existing.payloadHash !==
+                computeActionPayloadHash(operationInput.action, operationInput.actionParams)) {
+            throw new Error("frontend recovery lease execution identity drift: referenced operation payload does not match the recovery request");
+        }
+        created = { kind: "idempotent", operation: existing };
+    }
+    else {
+        created = await input.deps.store.create(operationInput);
+    }
+    if (created.kind !== "conflict" && !observeOnly) {
         // The durable lease must name the operation before controller execution.
-        // A crash in this narrow window leaves a safely blocked reservation rather
-        // than a second process that can launch another recovery DAG.
+        // This also repairs a lease left behind by a crash before the original bind.
         await bindDagRecoveryLeaseExecution({
-            leasePath: recoveryLease.leasePath,
-            lease: recoveryLease.lease,
+            leasePath: effectiveLease.leasePath,
+            lease: effectiveLease.lease,
             executionRef: created.operation.operationId,
         });
+        // Repair CLI args on both fresh and replayed operations. This closes the
+        // crash window after operation creation but before args were persisted.
+        await input.deps.store.update(created.operation.operationId, {
+            cliArgs: [
+                "dag",
+                "rerun-task",
+                "--run-id",
+                state.runId,
+                "--reason",
+                trigger.protocolFailureReason ?? "frontend automatic recovery",
+                "--request-id",
+                trigger.requestId,
+                "--frontend-recovery",
+                "--recovery-operation-id",
+                created.operation.operationId,
+                "--json",
+            ],
+        });
+    }
+    if (created.kind !== "conflict" && observeOnly) {
+        return { kind: "observed", operation: created.operation };
     }
     return created;
 }

package/dist/workflows/dag/structured-output-repair.js

@@ -112,7 +112,10 @@ export function isStructuredRepairableFailureCategory(category) {
     return (category === "invalid-output" ||
         category === "structured-output-truncated" ||
         category === "output-too-large" ||
-        category === "empty-output");
+        category === "empty-output" ||
+        // A length-truncated structured turn with a non-empty candidate artifact
+        // still repairs best through the frozen artifact repair prompt.
+        category === "output-limit");
 }
 export function formatStructuredArtifactPointer(input) {
     return [

package/dist/workflows/dag/types.js

@@ -1548,7 +1548,8 @@ export const frontendRecoveryPhaseSchema = z.enum([
  * the child carries a frozen lineage snapshot so the activation gate can prove
  * it is the reserved child of a child-running parent.
  *
- * Invariants: `attemptIndex ∈ {0,1}`; `continuationCount ∈ {0,1}`; a child's
+ * Invariants: `attemptIndex` and `continuationCount` are bounded by the frozen
+ * frontend recovery quota (currently 1-5); a child's
  * `recoveryRootRunId` always equals the root runId; `revision` is the CAS
  * pre-comparison counter. `revision` monotonicity is enforced at runtime by the
  * runner's `(existing?.revision ?? 0) + 1` CAS write (the schema only bounds it
@@ -1567,8 +1568,8 @@ export const frontendRecoveryStateSchema = z
     parentRunId: z.string().min(1),
     childRunId: z.string().min(1).optional(),
     attemptId: z.string().min(1),
-    attemptIndex: z.number().int().min(0).max(1),
-    continuationCount: z.number().int().min(0).max(1),
+    attemptIndex: z.number().int().min(0).max(5),
+    continuationCount: z.number().int().min(0).max(5),
     /** Node id of the reset-closure root: frontend-plan-pi /
      *  frontend-plan-revision-pi / frontend-prewrite-gate-shell /
      *  frontend-implement-pi (writer partial write). */

package/dist/workflows/dag/validate.js

@@ -3,7 +3,7 @@ import { resolveShellCommands } from "../../executors/shell-executor.js";
 import { pathMatchesPattern } from "../../shared/git-progress.js";
 import { resolveRepairTaskForGate } from "./repair-artifact.js";
 import { topoSortToRanks } from "./topo.js";
-import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, CONTEXT_OVERFLOW_RETRY_CATEGORY, } from "./retry-policy.js";
+import { isSafeReadOnlyPiRetryCandidate, isWriterEmptyDiffRetryCandidate, isWriterTransportRetryCandidate, INCOMPLETE_WRITE_SET_RETRY_CATEGORY, OUTPUT_LIMIT_RETRY_CATEGORY, WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY, WRITER_EMPTY_DIFF_RETRY_CATEGORY, CONTEXT_OVERFLOW_RETRY_CATEGORY, } from "./retry-policy.js";
 import { isBackendTestCompletenessRetryCandidate } from "./backend-test-writer-completeness.js";
 import { defaultFrontendTestLayout, frontendTestLayoutFromSpec, } from "./frontend-test-layout.js";
 const GOVERNANCE_WARNING_TYPES = new Set([
@@ -630,27 +630,28 @@ function validateRetryPolicyTaskConfig(task, issues) {
         const allowed = new Set([
             WRITER_EMPTY_DIFF_RETRY_CATEGORY,
             INCOMPLETE_WRITE_SET_RETRY_CATEGORY,
+            OUTPUT_LIMIT_RETRY_CATEGORY,
         ]);
         const unsupported = task.retryPolicy.retryCategories.filter((category) => !allowed.has(category));
         if (task.retryPolicy.maxAttempts < 2 ||
-            task.retryPolicy.maxAttempts > 3 ||
+            task.retryPolicy.maxAttempts > 5 ||
             unsupported.length > 0 ||
             !categories.has(WRITER_EMPTY_DIFF_RETRY_CATEGORY)) {
             issues.push({
                 type: "invalid-retry-policy",
-                message: `task ${task.id} backend-test writer retryPolicy must use 2..3 total attempts and only ${WRITER_EMPTY_DIFF_RETRY_CATEGORY} and/or ${INCOMPLETE_WRITE_SET_RETRY_CATEGORY}`,
+                message: `task ${task.id} backend-test writer retryPolicy must use 2..5 total attempts and only ${WRITER_EMPTY_DIFF_RETRY_CATEGORY}, ${INCOMPLETE_WRITE_SET_RETRY_CATEGORY}, and/or ${OUTPUT_LIMIT_RETRY_CATEGORY}`,
             });
         }
         return;
     }
     if (isWriterEmptyDiffCandidate &&
         (task.retryPolicy.maxAttempts !== 2 ||
-            task.retryPolicy.retryCategories.length !== 1 ||
-            task.retryPolicy.retryCategories[0] !==
-                WRITER_EMPTY_DIFF_RETRY_CATEGORY)) {
+            !task.retryPolicy.retryCategories.includes(WRITER_EMPTY_DIFF_RETRY_CATEGORY) ||
+            task.retryPolicy.retryCategories.some((category) => category !== WRITER_EMPTY_DIFF_RETRY_CATEGORY &&
+                category !== OUTPUT_LIMIT_RETRY_CATEGORY))) {
         issues.push({
             type: "invalid-retry-policy",
-            message: `task ${task.id} writer retryPolicy must use exactly two total attempts and only ${WRITER_EMPTY_DIFF_RETRY_CATEGORY}`,
+            message: `task ${task.id} writer retryPolicy must use exactly two total attempts and ${WRITER_EMPTY_DIFF_RETRY_CATEGORY}, with optional ${OUTPUT_LIMIT_RETRY_CATEGORY}`,
         });
         return;
     }
@@ -659,6 +660,7 @@ function validateRetryPolicyTaskConfig(task, issues) {
         const allowedWriterTransportCategories = new Set([
             WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY,
             CONTEXT_OVERFLOW_RETRY_CATEGORY,
+            OUTPUT_LIMIT_RETRY_CATEGORY,
         ]);
         const allAllowed = [...categories].every((category) => allowedWriterTransportCategories.has(category));
         if (task.retryPolicy.maxAttempts !== 2 ||
@@ -667,7 +669,7 @@ function validateRetryPolicyTaskConfig(task, issues) {
             !categories.has(WRITER_CLEAN_TIMEOUT_RETRY_CATEGORY)) {
             issues.push({
                 type: "invalid-retry-policy",
-                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only writer-clean-timeout (plus optional context-overflow)`,
+                message: `task ${task.id} writer transport retryPolicy must use exactly two total attempts and only writer-clean-timeout (plus optional context-overflow/output-limit)`,
             });
         }
     }

package/dist/workflows/dag/workspace-checkpoint.js

@@ -184,3 +184,69 @@ export function workspaceFingerprintsMatch(left, right) {
         return false;
     return left.fingerprint === right.fingerprint;
 }
+/**
+ * Path-level drift between two checkpoints: paths whose content hash,
+ * porcelain state, or presence differs (changed paths plus stable Task
+ * Contract governance inputs). The whole-tree fingerprint also moves on HEAD
+ * commits or porcelain churn that leaves every path's content untouched;
+ * only content-level path diffs are actionable for scoped rerun eligibility.
+ * Returns undefined when either checkpoint lacks a path inventory so callers
+ * fail closed to the strict whole-fingerprint comparison.
+ */
+export function workspaceDriftedPaths(parent, current) {
+    // changedPaths is only the porcelain inventory; it cannot explain files
+    // already committed between two different HEADs. Never localize that drift.
+    if (!parent.gitHeadSha ||
+        !current.gitHeadSha ||
+        parent.gitHeadSha !== current.gitHeadSha) {
+        return undefined;
+    }
+    if (!Array.isArray(parent.changedPaths) || !Array.isArray(current.changedPaths)) {
+        return undefined;
+    }
+    // Porcelain v1 records only the rename destination in this checkpoint
+    // schema, so the removed source path cannot be proven safe for imported
+    // readers. Keep scoped reuse fail-closed until both sides expose complete
+    // rename lineage.
+    if (parent.changedPaths.some((entry) => entry.state === "renamed") ||
+        current.changedPaths.some((entry) => entry.state === "renamed")) {
+        return undefined;
+    }
+    if ((parent.stableGovernanceInputs === undefined) !==
+        (current.stableGovernanceInputs === undefined)) {
+        return undefined;
+    }
+    const drifted = new Set();
+    const parentByPath = new Map(parent.changedPaths.map((entry) => [entry.path, entry]));
+    const currentByPath = new Map(current.changedPaths.map((entry) => [entry.path, entry]));
+    for (const [pathKey, parentEntry] of parentByPath) {
+        const currentEntry = currentByPath.get(pathKey);
+        if (!currentEntry) {
+            drifted.add(pathKey);
+            continue;
+        }
+        if (parentEntry.contentSha256 !== currentEntry.contentSha256 ||
+            parentEntry.state !== currentEntry.state ||
+            parentEntry.mode !== currentEntry.mode) {
+            drifted.add(pathKey);
+        }
+    }
+    for (const pathKey of currentByPath.keys()) {
+        if (!parentByPath.has(pathKey))
+            drifted.add(pathKey);
+    }
+    if (parent.stableGovernanceInputs && current.stableGovernanceInputs) {
+        const parentGov = new Map(parent.stableGovernanceInputs.map((entry) => [entry.path, entry.contentSha256]));
+        const currentGov = new Map(current.stableGovernanceInputs.map((entry) => [entry.path, entry.contentSha256]));
+        for (const [pathKey, hash] of parentGov) {
+            const other = currentGov.get(pathKey);
+            if (other === undefined || other !== hash)
+                drifted.add(pathKey);
+        }
+        for (const [pathKey, hash] of currentGov) {
+            if (parentGov.get(pathKey) !== hash)
+                drifted.add(pathKey);
+        }
+    }
+    return [...drifted];
+}

package/docs/operations/README.md

@@ -11,5 +11,6 @@
 - [`production-readiness.md`](production-readiness.md)：交付前的生产就绪判断。
 - [`agent-worker-production-readiness.md`](agent-worker-production-readiness.md)：agent-worker Feature/Task Pool 外层编排的 Production Readiness v1 操作合同。
 - [`backend-test-jacoco-coverage.md`](backend-test-jacoco-coverage.md)：Java 被测服务挂载 JaCoCo tcpserver agent 的 Maven、`java -jar` 与 Docker 操作手册。
+- [`console-chat-dogfood-playbook.md`](console-chat-dogfood-playbook.md)：Operator Chat（含 Explore 子 Agent）真实模型 dogfood 的 CLI 驱动步骤、mutation 双 token / SSE 超时 / question 应答等已知陷阱与验证方式。
 
 验证命令仍以 [`../governance/verification-matrix.md`](../governance/verification-matrix.md) 为准。

package/docs/templates/agent-dag.schema.json

@@ -466,9 +466,9 @@
         "retryCategories": {
           "type": "array",
           "items": {
-            "enum": ["timeout", "network", "rate-limit", "unavailable", "empty-output", "output-too-large", "protocol-invalid", "invalid-output", "writer-empty-diff", "incomplete-write-set", "writer-clean-timeout", "read-burst", "context-overflow"]
+            "enum": ["timeout", "network", "rate-limit", "unavailable", "empty-output", "output-limit", "output-too-large", "protocol-invalid", "invalid-output", "writer-empty-diff", "incomplete-write-set", "writer-clean-timeout", "read-burst", "context-overflow"]
           },
-          "default": ["timeout", "network", "rate-limit", "unavailable", "empty-output"],
+          "default": ["timeout", "network", "rate-limit", "unavailable", "empty-output", "output-limit"],
           "description": "Failure categories eligible for retry. quota/auth/write-guard are never eligible. invalid-output is allowed only on explicit structured/protocol policies; writer-empty-diff and incomplete-write-set are reserved for requireChangedFiles generation/completeness writers; writer-clean-timeout is reserved for standard bounded writers after explicit zero-write-tool-call and empty-diff evidence."
         }
       }