dsh-plugin-teamflow 0.1.4 → 0.1.6

package/lib/host.mjs

@@ -1,11 +1,11 @@
 import { TEAMFLOW_DESCRIPTORS } from "./descriptors.mjs";
 import { fileFor, journalFile, loadJournals, persistJournal, readJson, readJsonAny, slugPath, teamflowRoot, writeJson } from "./store.mjs";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { parameterSchemaSpecToJsonSchema } from "@deepseek-ai/dsh-tools";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { createUserMessage } from "@deepseek-ai/dsh-llm";
 //#region host/constants.ts
 /** 单阶段 token 熔断预算（官方口径总消耗：input+cacheRead+cacheWrite+output 累计）。 */
 const STAGE_TOKEN_BUDGET = 6e4;
@@ -21,6 +21,7 @@ const REFUSAL_PATTERN = /(无法完成|不能完成|无法继续|抱歉|对不
 const STAGE_MIN_LENGTH = {
 	prd: 400,
 	design: 250,
+	scaffold: 250,
 	arch: 250,
 	tech: 350,
 	dev: 60,
@@ -57,16 +58,30 @@ const STATUS = {
 		"needs-human"
 	]
 };
-/** 流水线阶段顺序与 key 映射（resume/pipeline 用）。 */
+/**
+* 流水线阶段（2026-09-06 英文化改造）：内部一律英文键（journal.stage.phase / 代码判断 / 状态机）。
+* 中文阶段名只作为展示 label（client UI 映射，未来 i18n 与 dsh 中英对齐）。
+*/
 const PHASE_ORDER = [
-	"PRD 产品需求",
-	"UI/UX 设计",
-	"架构规划",
-	"技术方案",
-	"开发",
-	"QA 测试",
-	"产品验收"
+	"prd",
+	"design",
+	"scaffold",
+	"tech",
+	"dev",
+	"qa",
+	"acceptance"
 ];
+/** 英文键 → 中文展示名（仅 UI/label/日志文案使用，不得用于代码判断）。 */
+const PHASE_KEY_OF = {
+	prd: "PRD 产品需求",
+	design: "UI/UX 设计",
+	scaffold: "架构规划",
+	tech: "技术方案",
+	dev: "开发",
+	qa: "QA 测试",
+	acceptance: "产品验收"
+};
+/** 中文阶段名 → 英文键（存量 journal/backlog 兼容映射；迁移脚本执行后仅防御性保留）。 */
 const PHASE_KEY_BY_NAME = {
 	"PRD 产品需求": "prd",
 	"UI/UX 设计": "design",
@@ -76,15 +91,22 @@ const PHASE_KEY_BY_NAME = {
 	"QA 测试": "qa",
 	"产品验收": "acceptance"
 };
-/** 阶段显示名 → 角色键（任务卡 byRole 累计用；未知阶段归 'other'）。 */
+/** phase 归一：中文（存量）或英文（新数据）输入 → 英文键；未知回退原值小写化。 */
+function phaseKeyOf(phase) {
+	const p = String(phase || "");
+	if (!p) return "";
+	if (PHASE_KEY_BY_NAME[p]) return PHASE_KEY_BY_NAME[p];
+	return p;
+}
+/** 阶段英文键 → 角色键（任务卡 byRole 累计用；未知阶段归 'other'）。 */
 const PHASE_ROLE = {
-	"PRD 产品需求": "pm",
-	"UI/UX 设计": "design",
-	"架构规划": "arch",
-	"技术方案": "tech",
-	"开发": "dev",
-	"QA 测试": "qa",
-	"产品验收": "acceptance"
+	prd: "pm",
+	design: "design",
+	scaffold: "arch",
+	tech: "tech",
+	dev: "dev",
+	qa: "qa",
+	acceptance: "acceptance"
 };
 const STAGE_POLICY = {
 	full: [
@@ -157,9 +179,7 @@ const STAGE_POLICY = {
 			key: "scaffold",
 			when: (o) => !!o.needScaffold
 		},
-		{ key: "tech" },
-		{ key: "dev" },
-		{ key: "acceptance" }
+		{ key: "dev" }
 	]
 };
 /** 按档位 + 条件展开实际执行阶段集（纯函数；未知档回退 full）。 */
@@ -187,6 +207,17 @@ function extractText(blocks) {
 	if (!Array.isArray(blocks)) return "";
 	return blocks.filter((b) => b && b.type === "text" && typeof b.text === "string").map((b) => b.text).join("\n");
 }
+/** 从 dev/qaFix 回复中提取「验证证据」块（`[Verification evidence]` 行起，到 state 块/结尾止）。
+* dev 阶段无独立对抗校验（QA 有 QA-REPORT.md 结构化证据，dev 只有自述）——证据块是「可审计的
+* 具体自述」：命令+退出码+断言计数+失败行引用，可对照 logs/teamflow/<runId>/ 命令输出日志核实；
+* 模型仍可伪造，但具体细节难编造一致（具体性压力）且伪造可发现（审计轨迹）。
+* 找不到块（契约未兑现）→ null，host 记 warn 不中断（policy 级）。 */
+function extractVerificationEvidence(text) {
+	const m = toText(text).match(/\[Verification evidence\]([\s\S]*?)(?=<!--\s*state|$)/);
+	if (!m || !m[1]) return null;
+	const ev = m[1].trim();
+	return ev.length > 0 ? ev : null;
+}
 /**
 * ADR-0008 任务夹命名：<yyyyMMdd>-r<N>[-<slug>]。
 * - date 用本地时区（用户在东八区晚上建的需求不能落到"明天"）
@@ -255,10 +286,11 @@ function sanitizeSnapOptions(o) {
 const SAFE_SIGNAL = {
 	aborted: false,
 	addEventListener: () => {},
-	removeEventListener: () => {}
+	removeEventListener: () => {},
+	throwIfAborted: () => {}
 };
 function normalizeSignal(s) {
-	return s && typeof s === "object" && typeof s.addEventListener === "function" && typeof s.aborted === "boolean" ? s : SAFE_SIGNAL;
+	return s && typeof s === "object" && typeof s.addEventListener === "function" && typeof s.aborted === "boolean" && typeof s.throwIfAborted === "function" ? s : SAFE_SIGNAL;
 }
 /** 分支 slug 派生（ADR-2026-08-27）：branchName > triageSlug > 需求中的英文标识词 > reqId 数字 > 'feature'。
 * 实锤 feat/feature：lite 显式时 triage 不跑（无 slug）+ 分支检查早于 reqId 生成 → fallback 'feature'。 */
@@ -266,7 +298,24 @@ function deriveBranchSlug(requirement, reqId, triageSlug, branchName) {
 	if (branchName && /^[a-z0-9][a-z0-9-_]*$/i.test(branchName)) return String(branchName).replace(/[^a-z0-9-]/gi, "-").toLowerCase().slice(0, 40);
 	if (triageSlug && /^[a-z0-9-]{3,24}$/i.test(triageSlug)) return triageSlug;
 	const en = String(requirement || "").match(/[a-zA-Z][a-zA-Z0-9-]{2,23}/g);
-	if (en && en.length) return en[0].toLowerCase().slice(0, 40);
+	if (en && en.length) {
+		const NOISE = /* @__PURE__ */ new Set([
+			"patch",
+			"lite",
+			"tech",
+			"full",
+			"medium",
+			"mode",
+			"the",
+			"and",
+			"for",
+			"with",
+			"use",
+			"using"
+		]);
+		const hit = en.find((w) => !NOISE.has(w.toLowerCase()));
+		if (hit) return hit.toLowerCase().slice(0, 40);
+	}
 	const num = String(reqId || "").match(/\d+/);
 	if (num) return `r${num[0]}`;
 	return "feature";
@@ -290,6 +339,33 @@ function handoffBrief(text) {
 	const m = String(text).match(/<!--\s*handoff\s*-->([\s\S]*?)(?:<!--\s*\/handoff\s*-->|$)/);
 	return clip((m && m[1] ? m[1] : String(text)).trim(), 2e3);
 }
+/** 拒绝词命中点：返回命中的具体短语 + 原文上下文片段（供重试诊断回灌，比事后从截断尾巴重算可靠）。 */
+function refusalHit(text) {
+	const s = String(text || "");
+	const m = REFUSAL_PATTERN.exec(s);
+	if (!m || m.index < 0) return null;
+	const start = Math.max(0, m.index - 40);
+	const end = Math.min(s.length, m.index + String(m[0]).length + 40);
+	return {
+		phrase: m[0],
+		context: s.slice(start, end).replace(/\s+/g, " ").trim()
+	};
+}
+/** 重试诊断包：上一轮失败详情回灌进重试 prompt（盲试 → 带因重试）。
+* 失败分类/详情/护栏原因取自 stage；产出尾部截断 1000 字符供自查修正。 */
+function buildRetryDiagnostic(attempt, stage) {
+	const lines = [];
+	lines.push(`[重试诊断 · 第 ${attempt} 次尝试] 上一轮尝试未成功。这不是新任务——请先阅读以下失败详情，再执行原任务并修正上一轮的问题。`);
+	lines.push(`- 失败分类：${stage.outcome || "unknown"}`);
+	if (stage.guardReason) lines.push(`- 护栏中止原因：${stage.guardReason}`);
+	if (stage.summary) lines.push(`- 详情：${stage.summary}`);
+	const out = String(stage.output || "");
+	if (out) {
+		const tail = out.length > 1e3 ? `…${out.slice(-1e3)}` : out;
+		lines.push(`- 上一轮产出末尾（节选，供自查修正）：\n${tail}`);
+	}
+	return `\n\n${lines.join("\n")}\n[/重试诊断结束]`;
+}
 /**
 * 验收结论解析：只以显式「验收结论 / 整体结论」行为准（acceptancePrompt 强制 4 档固定话术），
 * 不做正文散文朴素子串匹配。历史误报实锤（run tf-msytlok5）：验收报告 ✅ 通过，其记忆回写段一句
@@ -298,8 +374,11 @@ function handoffBrief(text) {
 *  - 「📝 需求不适用」是验收负责人专用的强结论词，允许全文命中；
 *  - 其余 reject 词（需求与实际不符/站不住/无效/无需改动等）仅在结论行且该行不含「通过/✅/⚠️」时才算；
 *  - rework 词仅认结论行（且不与「✅ 通过」同现）。
+* 反向护栏（漏报实锤 2026-09-03）：模型写「❌ 不通过」但漏写「验收结论：」前缀 → accLine 为空 →
+* 旧实现落回默认 accepted（最乐观默认值，质量门禁漏报=假交付）。现改为 **找不到结论行 → needs-human**
+* （宁严勿松：误拦截=人工看一眼，误放行=假交付；📝 全文命中与架构红词仍优先于该默认）。
 * @param {unknown} text 验收报告全文
-* @returns {'accepted'|'rework'|'reject'}
+* @returns {'accepted'|'rework'|'reject'|'needs-human'}
 */
 function parseAcceptanceVerdict(text) {
 	const acc = String(text || "");
@@ -307,9 +386,14 @@ function parseAcceptanceVerdict(text) {
 	const hasArchRedFlag = /重复实现|重复适配|偏离蓝图|未按蓝图|该拆未拆|该抽象未抽象|破坏既有结构|结构性.*问题|架构(打回|需重构)|需.*返工|返工.*项.*(存在|仍)|仍.*(返工|重构)/.test(acc);
 	const archNegated = /无返工|无.*返工|不返工|无架构打回|无.*打回|非漂移|无.*重复|无.*偏离|无.*抽象.*问题|无.*蓝图.*问题|架构一致性.*(PASS|良好|达标|通过|无问题)|M3.*(PASS|通过|达标)|架构.*(达标|无问题|良好)/.test(acc);
 	if (hasArchRedFlag && !archNegated) return "rework";
-	if (/❌\s*不通过|需返工|未通过/.test(accLine) && !/✅\s*通过/.test(accLine)) return "rework";
 	if (/📝\s*需求不适用/.test(acc)) return "reject";
+	if (/不通过|需返工|未通过/.test(accLine) && !/无\s*不通过|未发现不通过|未出现不通过/.test(accLine)) {
+		if (/✅\s*通过/.test(accLine)) return "accepted";
+		return "rework";
+	}
 	if (!/通过|✅|⚠️/.test(accLine) && /需求不适用|需求与实际不符|需求站不住|需求无效|无需改动|无需修改/.test(accLine)) return "reject";
+	if (!accLine) return "needs-human";
+	if (!/通过|✅|⚠️|❌|📝/.test(accLine)) return "needs-human";
 	return "accepted";
 }
 const bdOpen = "<!-- blueprint -->";
@@ -819,6 +903,20 @@ function createSubtask(journal, title, spec) {
 	const store = storeFor(journal.workspace || "default");
 	const mainTask = journal.taskId ? store.find("task", journal.taskId) : null;
 	if (!mainTask) return null;
+	const fullTitle = `开发 · ${title}`;
+	const existing = store.tasks.find((t) => t.reqId === journal.reqId && t.parentId === journal.taskId && (t.taskKey && t.taskKey === title || !t.taskKey && t.title === fullTitle));
+	if (existing) {
+		existing.status = "pending";
+		existing.failed = false;
+		existing.summary = null;
+		existing.endedAt = null;
+		existing.retries = (existing.retries || 0) + 1;
+		existing.taskKey = existing.taskKey || title;
+		existing.updatedAt = Date.now();
+		store.persist();
+		persistJournal(journal);
+		return existing;
+	}
 	const id = store.nextId("dev");
 	const sub = {
 		id,
@@ -826,7 +924,8 @@ function createSubtask(journal, title, spec) {
 		parentId: journal.taskId,
 		product: journal.workspace || "default",
 		type: "subtask",
-		title: `开发 · ${title}`,
+		title: fullTitle,
+		taskKey: title,
 		spec: spec || "",
 		status: "pending",
 		devAssign: mainTask && mainTask.devAssign || null,
@@ -1155,16 +1254,59 @@ function runSanityCheck(path) {
 //#endregion
 //#region host/core/metering.ts
 /**
+* 采集子代理会话事件（多源回退——2026-09-07 实锤 r38 usage 全空）：
+* 宿主新版 Session（session v2）已无 `events` 属性/getter（仅私有 eventsSnapshot 缓存 +
+* 官方 snapshotEvents()/ownEvents() 方法），旧实现读 session.events = undefined → usage 全 null。
+* 回退链（与 guard.eventsOf 同款语义）：events（老宿主快照，兼容）→ snapshotEvents()（官方完整日志）
+* → ownEvents()（fork 后本 agent 自己的事件）。取信息最多（含 usage 事件数最多）的源。
+*/
+function sessionEventsOf(run) {
+	try {
+		const local = run && run.localAgent;
+		const session = local && local.session;
+		if (!session) return [];
+		const candidates = [];
+		try {
+			const raw = session.events;
+			if (Array.isArray(raw)) candidates.push(raw);
+			else if (typeof raw === "function") candidates.push(raw());
+		} catch (e) {}
+		try {
+			if (typeof session.snapshotEvents === "function") candidates.push(session.snapshotEvents());
+		} catch (e) {}
+		try {
+			if (typeof session.ownEvents === "function") candidates.push(session.ownEvents());
+		} catch (e) {}
+		const valid = candidates.filter((c) => Array.isArray(c));
+		if (valid.length === 0) return [];
+		const countUsage = (arr) => arr.filter((ev) => {
+			const e = ev;
+			return e && e.type === "assistant/message" && e.data && typeof e.data.usage === "object" && e.data.usage !== null;
+		}).length;
+		valid.sort((a, b) => countUsage(b) - countUsage(a));
+		return valid[0];
+	} catch (e) {
+		return [];
+	}
+}
+/** 从单个 assistant/message 事件取 usage（宿主 usageOf 同款双路径：data.usage 优先，
+* 缺失时从 data.stream 的 usage chunk 取——v2 事件 usage 可能只在 stream 里）。 */
+function usageOfEvent(e) {
+	if (!e || e.type !== "assistant/message") return void 0;
+	const d = e.data || {};
+	if (d.usage && typeof d.usage === "object") return d.usage;
+	if (Array.isArray(d.stream)) for (const member of [...d.stream].reverse()) {
+		const chunk = member?.chunk;
+		if (chunk && chunk.type === "usage" && chunk.usage && typeof chunk.usage === "object") return chunk.usage;
+	}
+}
+/**
 * 累计子代理会话中所有 LLM 调用的真实 usage（官方三桶 + 调用数）。
 * 返回 null 表示拿不到 usage（会话未暴露 events / 无数据）。
 */
 function accumulateSessionUsage(run) {
-	const local = run && run.localAgent;
-	const session = local && local.session;
-	if (!session) return null;
-	const rawEvents = session.events;
-	const events = Array.isArray(rawEvents) ? rawEvents : typeof rawEvents === "function" ? rawEvents() : null;
-	if (!Array.isArray(events)) return null;
+	const events = sessionEventsOf(run);
+	if (events.length === 0) return null;
 	const buckets = {
 		input: 0,
 		cacheRead: 0,
@@ -1178,7 +1320,7 @@ function accumulateSessionUsage(run) {
 		if (!e || e.type !== "assistant/message") continue;
 		const d = e.data || {};
 		if (typeof d.turn === "number" && typeof d.step === "number") seen.add(`${d.turn}.${d.step}`);
-		const u = d.usage;
+		const u = usageOfEvent(e);
 		if (u) {
 			buckets.input += u.inputTokens || 0;
 			buckets.cacheRead += u.cacheReadTokens || 0;
@@ -1225,14 +1367,48 @@ function totalTokensOf(usage) {
 * 纯 read 循环（反复整读同一文件却无变更/无脚本执行）= 真退化。实锤 run tf-mte906e9：QA 重跑
 * 只读分析（不 edit）→ 旧判定「零变更进展」误杀，第 2 次 provider error 后 450k 熔断。 */
 const PROGRESS_TOOLS = /^(edit|write|create|apply_patch|patch|remove|delete|rm|mkdir|move|rename|append|bash|pwsh|shell|powershell)$/i;
-/** 与 metering 同款事件访问器（session.events 可能是数组或返回数组的函数）。 */
+/** Agent 活动守卫（2026-09-06 实锤 r1）：QA 子代理正常干活却被判「10 分钟无事件」——
+* 事件视图可能失明（session.events 缓存快照不增长）。若 agent 仍非 idle（phase 在跑）
+* 且本会话动过手（lastMutationAt>0）→ 不是挂死，跳过本次判定（不中止）。
+* 纯启动静默挂死（未动手）不受影响——照常 B 触发。 */
+function isAgentBusy(run) {
+	try {
+		const agent = run && run.localAgent;
+		const kind = agent && agent.phase && agent.phase.kind;
+		return !!kind && kind !== "idle";
+	} catch (e) {
+		return false;
+	}
+}
+/** 与 metering 同款事件访问器（session.events 可能是数组或返回数组的函数）。
+* 2026-09-06 多源回退（实锤 json-parse r1：QA 子代理正常干活 254 事件 43 step 却被判「10 分钟
+* 无任何新事件」——session.events 缓存快照视图对某些子代理不增长）。回退链：
+* events（快照 getter）→ snapshotEvents()（宿主官方 API）→ ownEvents()（fork 后事件）——
+* 取信息最多（最长）的源；全部失效返回 []（stalled 触发前会记录诊断，见 fire()）。 */
 function eventsOf(run) {
-	const local = run && run.localAgent;
-	const session = local && local.session;
-	if (!session) return [];
-	const raw = session.events;
-	const events = Array.isArray(raw) ? raw : typeof raw === "function" ? raw() : null;
-	return Array.isArray(events) ? events : [];
+	try {
+		const local = run && run.localAgent;
+		const session = local && local.session;
+		if (!session) return [];
+		const candidates = [];
+		try {
+			const raw = session.events;
+			if (Array.isArray(raw)) candidates.push(raw);
+			else if (typeof raw === "function") candidates.push(raw());
+		} catch (e) {}
+		try {
+			if (typeof session.snapshotEvents === "function") candidates.push(session.snapshotEvents());
+		} catch (e) {}
+		try {
+			if (typeof session.ownEvents === "function") candidates.push(session.ownEvents());
+		} catch (e) {}
+		const valid = candidates.filter((c) => Array.isArray(c));
+		if (valid.length === 0) return [];
+		valid.sort((a, b) => b.length - a.length);
+		return valid[0];
+	} catch (e) {
+		return [];
+	}
 }
 /** 规范化文本片段：小写 + 仅保留字母数字/CJK，供逐字重复比对。 */
 function normalizeFragment(s) {
@@ -1289,6 +1465,7 @@ function startStageGuard(opts) {
 	const warnedScripts = /* @__PURE__ */ new Set();
 	let lastMutationAt = 0;
 	let repeatWarned = false;
+	let busyWarned = false;
 	function warnOnce(key, set, message, hint) {
 		if (set.has(key)) return;
 		set.add(key);
@@ -1307,6 +1484,34 @@ function startStageGuard(opts) {
 		clearInterval(timer);
 		stage.guardReason = reason;
 		stage.guardOutcome = outcome;
+		if (outcome === "stalled") try {
+			const local = run.localAgent;
+			const session = local && local.session;
+			const lens = [];
+			if (session) {
+				try {
+					const r = session.events;
+					lens.push(`events=${Array.isArray(r) ? r.length : typeof r === "function" ? r().length : "?"}`);
+				} catch (e) {
+					lens.push("events=err");
+				}
+				try {
+					lens.push(`snap=${typeof session.snapshotEvents === "function" ? session.snapshotEvents().length : "-"}`);
+				} catch (e) {
+					lens.push("snap=err");
+				}
+				try {
+					lens.push(`own=${typeof session.ownEvents === "function" ? session.ownEvents().length : "-"}`);
+				} catch (e) {
+					lens.push("own=err");
+				}
+			}
+			journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: `${label} 挂死诊断：${lens.join(" / ") || "session 不可访问"}`
+			});
+		} catch (e) {}
 		try {
 			journal.logs.push({
 				t: Date.now(),
@@ -1380,8 +1585,22 @@ function startStageGuard(opts) {
 				lastEventCount = events.length;
 				lastGrowthAt = Date.now();
 			} else if (Date.now() - lastGrowthAt > 6e5) {
-				fire(`挂死（${Math.round(GUARD_SILENCE_MS / 6e4)} 分钟无任何新事件）`, "stalled");
-				return;
+				if (lastMutationAt > 0 && isAgentBusy(run)) {
+					if (!busyWarned) {
+						busyWarned = true;
+						try {
+							journal.logs.push({
+								t: Date.now(),
+								level: "warn",
+								message: `${label} 事件视图零增长但 agent 仍活动（会话已动手）——视为视图失明而非挂死，继续观察（护栏诊断见 stall 分支）`
+							});
+						} catch (e) {}
+					}
+					lastGrowthAt = Date.now();
+				} else {
+					fire(`挂死（${Math.round(GUARD_SILENCE_MS / 6e4)} 分钟无任何新事件）`, "stalled");
+					return;
+				}
 			}
 			if (seenToolCall && Date.now() - lastToolSignalAt > 9e5) {
 				fire(`空转（${Math.round(GUARD_NO_TOOL_MS / 6e4)} 分钟内无任何工具调用，但会话仍在产出）`, "stalled");
@@ -1483,7 +1702,7 @@ function resolveChildRoute(parent) {
 	return out;
 }
 /** 运行单个阶段子代理：执行 + 产出实质校验 + token 双口径计量 + stage 状态流转。 */
-async function runAgent(journal, parent, label, phase, prompt, signal) {
+async function runAgent(journal, parent, label, phase, prompt, signal, taskKey) {
 	const maxSeq = journal.stages.length ? Math.max(...journal.stages.map((s) => s.seq)) : 0;
 	let stageText = null;
 	const stage = {
@@ -1492,6 +1711,7 @@ async function runAgent(journal, parent, label, phase, prompt, signal) {
 		phase,
 		status: "running",
 		outcome: null,
+		taskKey: taskKey || null,
 		childId: null,
 		startedAt: Date.now(),
 		endedAt: null,
@@ -1560,6 +1780,7 @@ async function runAgent(journal, parent, label, phase, prompt, signal) {
 			stage.status = "failed";
 			stage.outcome = stage.guardOutcome || "degenerated";
 			stage.summary = `进行中护栏中止（${stage.guardReason}），本次尝试无有效产出`;
+			if (text) stage.output = clip(text, 4e3);
 			journal.logs.push({
 				t: Date.now(),
 				level: "warn",
@@ -1569,20 +1790,33 @@ async function runAgent(journal, parent, label, phase, prompt, signal) {
 		}
 		stage.status = "failed";
 		stage.outcome = stop === "completed" && text ? "insubstantial" : stop || "error";
+		const errDetail = result && result.error;
 		if (stage.outcome === "insubstantial") {
-			stage.summary = "产出未通过实质校验（含拒绝措辞或内容过短），视为未交付";
-			journal.logs.push({
-				t: Date.now(),
-				level: "warn",
-				message: `${label} 产出未通过实质校验（拒绝措辞/内容过短）`
-			});
+			const hit = refusalHit(text);
+			if (hit) {
+				stage.summary = `产出未通过实质校验：命中拒绝词「${hit.phrase}」（原文：${hit.context}），视为未交付`;
+				journal.logs.push({
+					t: Date.now(),
+					level: "warn",
+					message: `${label} 产出命中拒绝词「${hit.phrase}」`
+				});
+			} else {
+				stage.summary = `产出未通过实质校验：内容过短（${text.trim().length} 字符 < ${STAGE_MIN_LENGTH[phase] ?? 100} 下限），视为未交付`;
+				journal.logs.push({
+					t: Date.now(),
+					level: "warn",
+					message: `${label} 产出过短（${text.trim().length} 字符），未通过实质校验`
+				});
+			}
+			if (text) stage.output = clip(text, 4e3);
 		} else {
-			stage.summary = `未产出有效结果（stopReason=${stop || "unknown"}）`;
+			stage.summary = `未产出有效结果（stopReason=${stop || "unknown"}${errDetail ? `，error=${String(errDetail).slice(0, 200)}` : ""}）`;
 			journal.logs.push({
 				t: Date.now(),
 				level: "error",
-				message: `${label} 未产出有效结果（stopReason=${stop || "unknown"}）`
+				message: `${label} ${stage.summary}`
 			});
+			if (text) stage.output = clip(text, 4e3);
 		}
 		return null;
 	} catch (e) {
@@ -1612,23 +1846,29 @@ async function runAgent(journal, parent, label, phase, prompt, signal) {
 	}
 }
 /** 单阶段重试 + token 熔断（官方口径：input+cacheRead+cacheWrite+output 累计）。 */
-async function withRetry(journal, parent, label, phase, prompt, signal) {
+async function withRetry(journal, parent, label, phase, prompt, signal, taskKey) {
 	let attempts = 0;
 	let stageTokens = 0;
+	let lastStage = null;
 	for (let attempt = 1; attempt <= 2; attempt++) {
 		attempts = attempt;
-		const result = await runAgent(journal, parent, attempt > 1 ? `${label}（第 ${attempt} 次重试）` : label, phase, prompt, signal);
-		const lastStage = journal.stages[journal.stages.length - 1];
+		const labelNow = attempt > 1 ? `${label}（第 ${attempt} 次重试）` : label;
+		const promptNow = attempt > 1 && lastStage ? prompt + buildRetryDiagnostic(attempt, lastStage) : prompt;
+		const beforeLen = journal.stages.length;
+		const result = await runAgent(journal, parent, labelNow, phase, promptNow, signal, taskKey);
+		lastStage = journal.stages[beforeLen] || null;
 		if (lastStage && lastStage.phase === phase) stageTokens += totalTokensOf(lastStage.usage);
 		if (result) return {
 			text: result,
 			attempts,
-			stageTokens
+			stageTokens,
+			stage: lastStage
 		};
 		if (journal.cancelled) return {
 			text: null,
 			attempts,
-			stageTokens
+			stageTokens,
+			stage: lastStage
 		};
 		if (lastStage && isUnretryable(lastStage.outcome, lastStage.outcome)) {
 			journal.logs.push({
@@ -1640,7 +1880,22 @@ async function withRetry(journal, parent, label, phase, prompt, signal) {
 			return {
 				text: null,
 				attempts,
-				stageTokens
+				stageTokens,
+				stage: lastStage
+			};
+		}
+		if (lastStage && lastStage.outcome === "aborted") {
+			journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: `${label} 被外部中止（aborted），未正常产出——非预算问题；可 teamflow_resume 续跑（补跑失败任务，已完成任务复用）`
+			});
+			journal.humanIntervention = true;
+			return {
+				text: null,
+				attempts,
+				stageTokens,
+				stage: lastStage
 			};
 		}
 		if (lastStage && lastStage.outcome === "degenerated") {
@@ -1653,7 +1908,22 @@ async function withRetry(journal, parent, label, phase, prompt, signal) {
 			return {
 				text: null,
 				attempts,
-				stageTokens
+				stageTokens,
+				stage: lastStage
+			};
+		}
+		if (lastStage && lastStage.outcome === "stalled") {
+			journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: `${label} 进行中护栏中止（挂死/空转），不再自动重试（会话已无有效产出）；可 teamflow_resume 以全新会话续跑`
+			});
+			journal.humanIntervention = true;
+			return {
+				text: null,
+				attempts,
+				stageTokens,
+				stage: lastStage
 			};
 		}
 		if (stageTokens >= 6e4) {
@@ -1666,13 +1936,14 @@ async function withRetry(journal, parent, label, phase, prompt, signal) {
 			return {
 				text: null,
 				attempts,
-				stageTokens
+				stageTokens,
+				stage: lastStage
 			};
 		}
 		if (attempt < 2) journal.logs.push({
 			t: Date.now(),
 			level: "warn",
-			message: `${label} 第 ${attempt} 次尝试未成功，自动重试…`
+			message: `${label} 第 ${attempt} 次尝试未成功（${lastStage ? lastStage.outcome || "unknown" : "unknown"}），自动重试（重试 prompt 已附上一轮失败诊断）…`
 		});
 		else {
 			journal.logs.push({
@@ -1686,7 +1957,8 @@ async function withRetry(journal, parent, label, phase, prompt, signal) {
 	return {
 		text: null,
 		attempts,
-		stageTokens
+		stageTokens,
+		stage: lastStage
 	};
 }
 //#endregion
@@ -1868,6 +2140,17 @@ const STATE_BLOCK_INSTRUCTION = `\n\n[STATE BLOCK · mandatory at the end] Appen
 * - 回归基线：新 PRD 头部「基线依赖：<其他任务夹>」声明；跨代变更用「取代：<夹>#AC-n」；
 *   硬保障在项目 verify-* 可执行套件。
 * - 命令输出日志照旧收口 logs/teamflow/<runId>/。
+*
+* 【约束分级约定】（2026-09-03，防 high-signal 词脱敏）
+* - [HOST-ENFORCED]：host 有真实校验/解析/硬失败后果（如单轨产物文件缺失→needs-human 停线、
+*   验收结论行缺失→需人工确认）。标注后**必须**在同一句内描述真实后果（缺失=停线），
+*   不得只堆措辞。新增此类约束 = 先加 host 代码再标词。
+* - [policy]：无 host 强制，靠模型自律 + guard 观测注入（warn + 轻提醒，从不中断）。
+*   标注时描述真实机制（warn-only / cache 重放费），不声称「hard constraint」。
+* - 禁止：prompt 内自称 hard constraint——措辞层面「hard」与 enforcement 脱节会训练模型
+*   对 high-signal 词脱敏（实证：17 条 warn 零削减，guard 注入闭环后才见效）。
+* 【中英混排纪律】约束句/标签用英文（模型对英文指令注意力高）、被约束对象/内容用中文；
+* 列表分隔符随内容语言（文件路径等 ASCII 内容用英文逗号），不混用中文标点。
 */
 /** 产品层文档根（memory.md 等跨任务资产；任务产物在其中的任务夹内）。 */
 const TF_DOCS = "docs/teamflow";
@@ -1955,8 +2238,8 @@ function productCtx(root) {
 Before starting: read ${base}/AGENTS.md (team rules & doc index — read the summary first, then details on demand; no aimless full reads).
 [Task-folder docs · ADR-0008] Each requirement gets a self-contained task folder docs/teamflow/<yyyyMMdd-rN-slug>/ (folder path given per stage below); ALL artifacts of this requirement (PRD/DESIGN/TECHNICAL/QA-REPORT/ACCEPTANCE) live inside it. The folder is immutable after creation — **no archiving, no versioning** — retries/resumes write to the same folder. Cross-requirement product docs only: ${TF_DOCS}/memory.md (conventions/todos) and architecture/.
 [Baseline] New PRD declares "基线依赖：<prior task folder>" at top; cross-generation behavior changes are explicitly marked "取代：<folder>#AC-n" — historical folders are never modified.
-[Doc boundary · hard] TeamFlow contract docs are written ONLY under ${base}/${TF_DOCS}/ (create dirs if missing); **never write host docs/<role>/ and never scatter log files at project root**; command output logs go to logs/teamflow/<runId>/.
-[AGENTS.md boundary · hard] AGENTS.md is team property (injected unconditionally — consensus/index/managed zone only): **do NOT append changelog-style sections during iterations (product memory / todos / change log)** — such data belongs in ${TF_DOCS}/memory.md and task folders; besides the <!-- teamflow:begin/end --> managed zone, no stage may rewrite, reorder, or overwrite any other part of AGENTS.md.
+[Doc boundary · policy] TeamFlow contract docs are written ONLY under ${base}/${TF_DOCS}/ (create dirs if missing); **never write host docs/<role>/ and never scatter log files at project root**; command output logs go to logs/teamflow/<runId>/.
+[AGENTS.md boundary · policy] AGENTS.md is team property (injected unconditionally — consensus/index/managed zone only): **do NOT append changelog-style sections during iterations (product memory / todos / change log)** — such data belongs in ${TF_DOCS}/memory.md and task folders; besides the <!-- teamflow:begin/end --> managed zone, no stage may rewrite, reorder, or overwrite any other part of AGENTS.md.
 Backlog (req/task/bug) source of truth is the persisted mirror $DSH_HOME/teamflow/<workspace>/ under ${base}/backlog/: single rotating task card model (待办→开发中→待测试→测试中→待验收→已验收); devAssign/qaAssign live on the task card.
 `;
 }
@@ -1966,7 +2249,7 @@ function headTailClip(text, head, tail) {
 	if (s.length <= head + tail) return s;
 	return s.slice(0, head) + "\n...\n[CHANGED SECTION]\n" + s.slice(-tail);
 }
-const TOKEN_HYGIENE = (runId) => `[TOKEN HYGIENE · hard constraint] Context is expensive. Budget discipline below (violations only log a warning, never interrupt):
+const TOKEN_HYGIENE = (runId) => `[TOKEN HYGIENE · policy] Context is expensive. Budget discipline below — host enforcement is warn + live reminder only (never interrupts), follow it as self-discipline:
 - [File scope] Whole-file read is allowed ONLY for target files explicitly listed in the task spec. To understand other files' interfaces, use grep for keywords (do not read whole files). Never whole-file read source files outside the task scope.
 - [No duplicate reads] Same file: read ≤1 times. To verify a change, grep the change point instead of re-reading the whole file.
 - [grep first] Before writing code, locate with one comprehensive grep pass, then batch-read in segments; avoid repeated small read/grep passes on the same file.
@@ -1978,7 +2261,7 @@ const TOKEN_HYGIENE = (runId) => `[TOKEN HYGIENE · hard constraint] Context is
 - The contract/AC for this iteration is in the context/handoff below or in this task folder's PRD: do NOT whole-file re-read PRD.md / DESIGN.md / TECHNICAL.md from the task folder; grep/read only the code you need.
 `;
 /** 一次成型纪律：目标文档 write ≤1 次 + read ≤2 次，严禁 read→edit→read 循环。 */
-const ONCE_DISCIPLINE = `[ONE-SHOT WRITE · hard constraint] The most important efficiency rule; violating it burns tokens:
+const ONCE_DISCIPLINE = `[ONE-SHOT WRITE · policy] The most important efficiency rule; repeated write/read cycles pay cache replay fees (warn + reminder at 3rd read, never interrupt):
 - The target delivery doc (PRD/DESIGN/TECHNICAL/QA-REPORT/ACCEPTANCE/memory) allows only **1 write of the complete new version** + **at most 2 reads** (1 to confirm structure before writing, ≤1 to verify format after).
 - **No read→edit→read loops**: never reopen the same document to "tweak"; never re-read the whole file just to confirm a change.
 - Use grep + limited segments for details; never whole-file read big documents.
@@ -2081,7 +2364,7 @@ ${clip(prd, 12e3)}
 const devPrompt = (task, tech, prd, root, runId, state) => `You are a senior full-stack engineer (implementation executor). The current workspace IS the target project — actually implement the following task.
 ${productCtx(root)}${stateSliceFor(state, "dev")}${TOKEN_HYGIENE(runId)}[CONTEXT PACK]
 [TASK TITLE] ${task.title}
-${task.files && task.files.length ? `[TASK TARGET FILES] ${task.files.join("，")}` : ""}
+${task.files && task.files.length ? `[TASK TARGET FILES] ${task.files.join(", ")}` : ""}
 [TASK BRIEF] ${task.spec || "(see technical design)"}
 ${tech && String(tech).trim() ? `[TECH DESIGN SUMMARY (grep details on demand, don't full re-read)]
 ${clip(tech, 12e3)}` : ""}
@@ -2092,9 +2375,14 @@ ${clip(tech, 12e3)}` : ""}
 3. If spec contradicts reality, explain with evidence in the summary instead of claiming completion or expanding scope on your own.
 4. Actually write/modify code (grep + segmented reads to locate; no repeated whole-file reads), then run relevant build/verification to ensure green.
 5. [Engineering action execution] If task spec or PRD 工程约束 includes git actions (e.g. new branch): **execute the action BEFORE writing code** (e.g. git checkout -b <branch>); if the workspace carries unrelated uncommitted changes, do NOT commit/clean them — state the situation in the summary.
-5b. [Git discipline · hard (ADR-2026-08-27, 统一收口提交)] Work ONLY on the current branch: **never** git checkout main / merge / rebase / delete-branch / commit — main-branch actions and the final commit are performed by the host after acceptance (one commit per run: code + task-folder docs together). Just write/modify files; leave everything uncommitted. If a task asks for "merge back to main" or "commit", treat it as "prepare the delivery" (files ready + summary of what was done), do NOT commit or merge.
+5b. [Git discipline · policy (ADR-2026-08-27, 统一收口提交)] Work ONLY on the current branch: **never** git checkout main / merge / rebase / delete-branch / commit — main-branch actions and the final commit are performed by the host after acceptance (one commit per run: code + task-folder docs together). Just write/modify files; leave everything uncommitted. If a task asks for "merge back to main" or "commit", treat it as "prepare the delivery" (files ready + summary of what was done), do NOT commit or merge.
 6. [Log discipline] Redirect command output to logs/teamflow/${runId || "<runId>"}/.
-7. Output an implementation summary (≤40 lines): changed files, key implementation points, how verified, leftovers. No big code pastes.
+7. Output an implementation summary (≤40 lines): changed files, key implementation points, leftovers. No big code pastes.
+7b. [Verification evidence · policy] **Mandatory block at the end of the reply (before the state block)** — host stores it verbatim for audit, cross-checkable against your command output in logs/teamflow/${runId || "<runId>"}/; missing block = contract not honored (warn only, never interrupts):
+[Verification evidence]
+- cmd: <exact command> → exit <code>, <passed>/<failed> asserts (<file>:<line> for failures)
+- ...（one line per verification run）
+- N/A: <explicit reason>（when nothing runnable — pure config/docs change, no test suite, etc.）
 8. [State] End with a state block (phase="dev"), touched = array of changed files, summary = implementation conclusion.${STATE_BLOCK_INSTRUCTION}`;
 /** 视觉验证能力条款（ADR-2026-08-27，解锁 browser-use 视觉验证）：
 * 按当前模型多模态能力动态生成——vision=true 允许截图看图（人眼类项），精确值仍走 DOM 计算断言；
@@ -2124,11 +2412,11 @@ ${clip(devSummary, 15e3)}
 2. [人工补测清单] Items that cannot be auto-verified (audio output / real-device: 100dvh dynamic toolbar, safe-area, multi-touch / FPS performance / screen-reader): do NOT fail them — instead list each in the report's「人工补测清单」section (acceptance criteria + method + tool), note「环境限制，非交付缺陷」, for human review.
 3. Read AGENTS.md §4 engineering conventions (verify commands) and the code changes first, then actually run those sandbox-legal verifications.
 4. [Log discipline] Redirect command output to logs/teamflow/${runId || "<runId>"}/ (e.g. qa-out.log); no scatter at project root.
-5. Output the test report (body ≤150 lines, verdict first): scope & environment, cases & results (pass/fail/blocked), conclusion (whether acceptance-ready).
-6. [Defect format] Report found defects as the structured table below (for direct import by the defect tracker):
+5. [Reply = brief summary only · HOST-ENFORCED] Output a short reply (≤12 lines, Chinese): verdict one-liner (whether acceptance-ready) + the QA report path docs/teamflow/.../QA-REPORT.md. **Do NOT repeat the report body in the reply** — the host imports QA-REPORT.md as the single source of truth; missing file = hard failure (needs-human, pipeline stops).
+6. [Defect format · HOST-ENFORCED] Report found defects as the structured table below (for direct import by the defect tracker) — the table must be in QA-REPORT.md:
    | 编号 | 严重级(P0/P1/P2/P3) | 功能模块 | 复现步骤 | 期望行为 | 实际行为 | 关联验收项 |
    If no defects: explicitly output 「未发现缺陷」.
-7. Chinese Markdown, concrete & executable; write the report to ${RUN(state)}/QA-REPORT.md (write once, tight body). [Boundary] only under ${TF_DOCS}/.
+7. Chinese Markdown, concrete & executable; write the **complete** report to ${RUN(state)}/QA-REPORT.md (write once, tight body) — **this file IS the deliverable**: scope & environment, cases & results (pass/fail/blocked), 人工补测清单, defect table (if any), conclusion (whether acceptance-ready). [Boundary] only under ${TF_DOCS}/.
 8. [State] End with a state block (phase="qa"), summary = test conclusion / blocked items, extra = { "verifyScripts": [...] }.${STATE_BLOCK_INSTRUCTION}`;
 /** QA 打回后的开发修复 prompt：确认缺陷是否属实 → 修复 → 复验交接（QA→dev 打回闭环用）。 */
 const qaFixPrompt = (defects, qa, tech, prd, root, runId, state) => `You are a senior full-stack engineer. The QA report points out several defects — **confirm each one** and fix them, then hand back for QA re-verification.
@@ -2145,7 +2433,12 @@ ${tech && String(tech).trim() ? clip(tech, 12e3) : ""}
    — confirmed → fix it directly; QA false positive / contradicts reality → state evidence explicit in the summary (no fabricated changes, and no ignoring real defects either).
 2. Touch ONLY defect-related files (grep to locate; no whole-file reads of irrelevant big files); respect existing architecture & code style.
 3. After fixing, run relevant verification to ensure green (regression floor: existing verify suites pass untouched); redirect output to logs/teamflow/${runId || "<runId>"}/.
-4. Output a fix summary (≤40 lines, Chinese): per defect —「truth judgment + fix」or「false-positive evidence」, changed files, how verified, leftovers. No big code pastes.
+4. Output a fix summary (≤40 lines, Chinese): per defect —「truth judgment + fix」or「false-positive evidence」, changed files, leftovers. No big code pastes.
+4b. [Verification evidence · policy] **Mandatory block at the end of the reply (before the state block)** — host stores it verbatim for audit, cross-checkable against your command output in logs/teamflow/${runId || "<runId>"}/; missing block = contract not honored (warn only, never interrupts):
+[Verification evidence]
+- cmd: <exact command> → exit <code>, <passed>/<failed> asserts (<file>:<line> for failures)
+- ...（one line per verification run; the re-verified defect cases must be listed）
+- N/A: <explicit reason>（when nothing runnable — pure config/docs change, no test suite, etc.）
 5. [State] End with a state block (phase="dev"), touched = changed files array, summary = fix conclusion.${STATE_BLOCK_INSTRUCTION}`;
 const acceptancePrompt = (prd, qa, devSummary, root, runId, state, vision) => `You are the product manager (acceptance lead). Do a final acceptance of this delivery against the PRD acceptance criteria.
 ${productCtx(root)}${stateSliceFor(state, "acceptance")}${TOKEN_HYGIENE(runId)}
@@ -2162,14 +2455,14 @@ ${vision ? "[Visual re-check] If QA saved screenshots under the task folder, spo
    - Any obvious **duplicated implementation / adapter drift / broken existing structure** (this is a code-quality floor, not optional).
    - **Verdict impact**: only functionally green but with 「deviates from blueprint / duplicated impl / should-have-extracted」 → verdict should be **⚠️ 有条件通过** (architecture rework items listed, re-accept after rework); **significant deviation / broken structure → ❌ 不通过**. Never treat "verify all green" as the sole evidence of "no rework needed".
 1. Verify each PRD acceptance criterion one by one.
-2. Output the acceptance verdict (body ≤80 lines): ✅ 通过 / ⚠️ 有条件通过 / ❌ 不通过 / 📝 需求不适用, with a per-criterion check table, opinions & leftovers.
+2. [Reply = brief summary only · HOST-ENFORCED] Output a short reply (≤10 lines, Chinese): **verdict line — verbatim: 验收结论：✅ 通过 ／ ⚠️ 有条件通过 ／ ❌ 不通过 ／ 📝 需求不适用**（pick one）+ the acceptance report path docs/teamflow/.../ACCEPTANCE.md. **Do NOT repeat the report body in the reply** — the host imports ACCEPTANCE.md as the single source of truth.
 3. [Not-applicable judgment] If the PRD/tech-change/confirm doc already states「需求与现状不符」, or the dev result is explicitly「无需改动」, the verdict must be **「📝 需求不适用」** with reasons — do NOT mark ✅ 通过 just for "no defects".
-4. [Acceptance report] Write to ${RUN(state)}/ACCEPTANCE.md (write once, matching the body). [Memory write-back · convention changes ONLY] Update docs/teamflow/memory.md only if this requirement introduces new conventions/tech-stack decisions, or the 已知待办 list changes (same-topic line replace, idempotent, no changelog appending); otherwise don't touch memory. [Boundary] only under ${TF_DOCS}/; never modify AGENTS.md beyond the <!-- teamflow --> managed zone.
+4. [Acceptance report · HOST-ENFORCED] Write the **complete** report to ${RUN(state)}/ACCEPTANCE.md (write once) — **this file IS the deliverable**: verdict line, per-criterion check table, opinions & leftovers. **The verdict line MUST be the LAST line of the file, verbatim one of: 验收结论：✅ 通过 / 验收结论：⚠️ 有条件通过 / 验收结论：❌ 不通过 / 验收结论：📝 需求不适用** — the host parses ONLY this line; missing it = contract violation → the run stops for human review; missing file = hard failure (needs-human, pipeline stops). [Memory write-back · convention changes ONLY] Update docs/teamflow/memory.md only if this requirement introduces new conventions/tech-stack decisions, or the 已知待办 list changes (same-topic line replace, idempotent, no changelog appending); otherwise don't touch memory. [Boundary] only under ${TF_DOCS}/; never modify AGENTS.md beyond the <!-- teamflow --> managed zone.
 5. Chinese Markdown.
 6. [State] End with a state block (phase="acceptance"), summary = acceptance conclusion, verdict = "accepted/rework/reject/needs-human", extra.done = confirmation of this delivery.${STATE_BLOCK_INSTRUCTION}`;
 /** 需求分诊模型 prompt（模型驱动 triage；供 core/triage.runTriage 使用）。 */
-const TRIAGE_PROMPT = (requirement, opts, pre) => `You are a senior research-dev triage analyst. Do ONE thing: analyze which pipeline mode this dev requirement fits, then give the conclusion. No code, no scope speculation.
-[RAW REQUIREMENT]
+const TRIAGE_PROMPT = (requirement, opts, pre, retryHint) => `You are a senior research-dev triage analyst. Do ONE thing: analyze which pipeline mode this dev requirement fits, then give the conclusion. No code, no scope speculation.
+${retryHint ? `[RETRY — YOUR LAST REPLY FAILED]\n${retryHint}\n` : ""}[RAW REQUIREMENT]
 ${requirement}
 ${pre.rationale.length ? `\n[REGEX PRE-FILTER SIGNALS (reference only; judge semantically, don't blindly follow)]\n${pre.rationale.join("\n")}` : ""}
 \n[OPTIONAL SIGNAL] UI work needed: ${opts && opts.needDesign ? "yes" : "not flagged"}
@@ -2183,12 +2476,12 @@ ${pre.rationale.length ? `\n[REGEX PRE-FILTER SIGNALS (reference only; judge sem
 
 [JUDGMENT POINTS]
 1. Distinguish "user-visible functional change" vs "internal tech change": refactors/optimizations, even large code volume, usually go tech, not full.
-2. UI/visual/interaction/buttons/pages involved → at least medium (excludes patch/tech).
+2. **UI feature work** (new screens/components/interactions/pages) → at least medium (excludes patch/tech). **UI micro-adjustments** — moving a button, relocating a control, changing copy/labels, spacing/padding, color tweaks, "move the button", "switch the button position" — are patch-or-lite material, NOT medium: no new interaction logic, no design phase worth the token cost. The line: does it change behavior/interaction logic (medium) or just placement/appearance of existing elements (patch/lite)?
 3. hotfix/single-point/pure numeric/pure docs → patch; clear "add feature X" → pick lite/medium/full by size.
 4. Focused change (even with tests/regression) → lite/tech by nature; not necessarily full.
 5. [M1 ARCHITECTURE CRITERION (important)] **Architecture-level changes** — persistence/localStorage/database/standalone module/abstraction/cross-many-files without an existing reusable wrapper (like a localStorage wrapper, storage layer, state management) — even if they look like "small features", go **at least medium** (must pass the architecture stage and produce a blueprint, avoiding scattered local implementations by dev); such changes collapse under a light "micro feature" tier. Tech-driven rework (refactor/optimize/arch upgrade) is itself tech (tech also runs the lightweight blueprint now).
 
-[OUTPUT] one JSON object only (no other text):
+[OUTPUT] JSON object ONLY — no commentary, no preface, no closing text. The FIRST character of your reply must be '{'. Do NOT say anything like "here is the JSON" or "Let me output the JSON" — output the object itself:
 { "mode": "patch|lite|tech|medium|full", "slug": "<topic words> (3-24 lowercase letters/digits/hyphens, e.g. wallkick-toggle, 7bag-random; used to name the task folder)", "kind": "one-word nature", "needDesign": true|false, "complexity": "small|medium|large", "rationale": ["key argument 1","key argument 2"], "confidence": "high|medium|low" }`;
 /** tech 档 PRD：技术变更单（无功能 AC，重范围/目标/改动面/回归）。 */
 const techChangePrompt = (requirement, root, runId, state) => `You are the senior tech lead. The current workspace IS the target project. This is a **tech-driven rework** requirement (refactor/optimize/upgrade/architecture/dependencies/tech debt) — the product doesn't need a full feature PRD, but needs a **技术变更单** (tech change sheet) as the contract for dev/QA/acceptance and memory write-back.
@@ -2268,140 +2561,72 @@ const MODE_REGISTRY = {
 		desc: "单行/常量/版本号/hotfix：单 agent 直改+自测即交付（无独立 QA）"
 	}
 };
-/** 关键词信号集（命中 → 加重某档倾向）。 */
-const SIGNALS = [
-	{
-		mode: "patch",
-		words: [
-			"hotfix",
-			"热修",
-			"修复 bug",
-			"修 bug",
-			"改个 bug",
-			"版本号",
-			"常量",
-			"一行",
-			"bump",
-			"回滚",
-			"卫生",
-			"笔误",
-			"拼写"
-		]
-	},
-	{
-		mode: "tech",
-		words: [
-			"重构",
-			"优化",
-			"升级",
-			"架构",
-			"性能",
-			"依赖",
-			"脚手架",
-			"缓存",
-			"清理",
-			"遗留债",
-			"工程",
-			"内部改造",
-			"技术债"
-		]
-	},
-	{
-		mode: "lite",
-		words: [
-			"微功能",
-			"小功能",
-			"小增强",
-			"加个",
-			"补一个",
-			"轻微",
-			"顺手"
-		]
-	},
-	{
-		mode: "medium",
-		words: [
-			"界面",
-			"UI",
-			"视觉",
-			"页面",
-			"按钮",
-			"样式",
-			"交互",
-			"布局",
-			"组件",
-			"持久化",
-			"localStorage",
-			"本地存储",
-			"存储",
-			"保存",
-			"恢复",
-			"存档",
-			"独立模块",
-			"抽象",
-			"存储层",
-			"sessionStorage",
-			"IndexedDB",
-			"跨模块",
-			"数据层"
-		]
-	},
-	{
-		mode: "full",
-		words: [
-			"跨模块",
-			"完整",
-			"大型",
-			"对接",
-			"集成",
-			"模块化",
-			"重构为",
-			"二期",
-			"平台"
-		]
-	}
+/** 确定性护栏关键词（双语，仅 fallback 兜底用；主路由是模型——TRIAGE_PROMPT 语义判断）。
+* 架构信号：持久化/存储/独立模块/抽象/跨模块——防「轻档位局部实现塌方」（M1 架构护栏）。
+* UI 信号：UI 相关需求不得落 patch/tech（无设计/QA 的档位）——最低 lite。 */
+const ARCH_SIGNALS = [
+	"持久化",
+	"存储",
+	"保存",
+	"恢复",
+	"存档",
+	"独立模块",
+	"抽象",
+	"存储层",
+	"localStorage",
+	"sessionStorage",
+	"IndexedDB",
+	"跨模块",
+	"数据层",
+	"persistence",
+	"storage",
+	"database",
+	"数据库",
+	"standalone module",
+	"abstraction"
+];
+const UI_SIGNALS = [
+	"界面",
+	"UI",
+	"视觉",
+	"页面",
+	"按钮",
+	"样式",
+	"交互",
+	"布局",
+	"组件",
+	"page",
+	"button",
+	"style",
+	"layout",
+	"component",
+	"visual",
+	"interaction"
 ];
-/** 对原始需求做启发式分诊。返回建议 mode + 判定理由 + 置信。 */
+/** 对原始需求做启发式分诊（兜底路径专用）。返回建议 mode + 判定理由 + 置信。
+* 只做确定性护栏（架构强升/UI 禁轻档/needDesign 升档）——不再逐词匹配五档信号：
+* 主路由是模型（TRIAGE_PROMPT 语义判断，天然双语），正则兜底在模型不可用时宁重勿漏（默认 full）。 */
 function suggestMode(requirement, opts) {
 	const text = String(requirement || "");
-	const hits = [];
-	for (const sig of SIGNALS) for (const w of sig.words) if (text.includes(w)) hits.push({
-		mode: sig.mode,
-		word: w
-	});
-	const rationale = hits.map((h) => `命中「${h.word}」→ ${h.mode}`);
-	const countOf = (m) => hits.filter((h) => h.mode === m).length;
+	const rationale = [];
 	let mode = "full";
-	if (countOf("patch") > 0) mode = "patch";
-	else if (countOf("tech") > 0 && countOf("medium") === 0 && countOf("full") === 0) mode = "tech";
-	else if (countOf("lite") > 0 && countOf("medium") === 0) mode = "lite";
-	else if (countOf("medium") > 0 || opts && opts.needDesign) mode = "medium";
-	else if (hits.length === 0) mode = "full";
-	if ((mode === "patch" || mode === "tech") && opts && opts.needDesign) mode = "medium";
-	if (mode === "patch" && (countOf("tech") > 0 || text.includes("新增") || text.includes("功能"))) mode = "lite";
-	const architectureSignals = [
-		"持久化",
-		"localStorage",
-		"本地存储",
-		"存储",
-		"保存",
-		"恢复",
-		"存档",
-		"独立模块",
-		"抽象",
-		"存储层",
-		"sessionStorage",
-		"IndexedDB",
-		"跨模块",
-		"数据层"
-	];
-	if ((mode === "lite" || mode === "tech" || mode === "patch") && architectureSignals.some((w) => text.includes(w))) {
+	const archHit = ARCH_SIGNALS.find((w) => text.includes(w));
+	if (archHit) {
+		mode = "medium";
+		rationale.push(`架构护栏：需求含「${archHit}」→ 强升 medium（需架构阶段产蓝图，防塌）`);
+	}
+	const uiHit = !archHit ? UI_SIGNALS.find((w) => text.includes(w)) : void 0;
+	if (uiHit) {
+		mode = mode === "full" ? "lite" : mode;
+		rationale.push(`UI 护栏：需求含「${uiHit}」→ 不低于 lite（UI 改动需 QA/验收）`);
+	}
+	if (opts && opts.needDesign && mode !== "medium") {
 		mode = "medium";
-		rationale.push(`架构护栏：需求含「${architectureSignals.find((w) => text.includes(w))}」→ 强升 medium（需架构阶段）`);
+		rationale.push("needDesign=true → 强升 medium（显式要求设计阶段）");
 	}
-	const kind = mode === "patch" ? "热修/单点" : mode === "tech" ? "技术驱动改造" : mode === "lite" ? "微功能" : mode === "medium" ? "标准功能(含UI)" : "完整需求";
-	const confidence = mode === "patch" ? "high" : hits.length >= 2 ? "medium" : "low";
-	if (rationale.length === 0) rationale.push("无强信号，默认 full（护栏优先）");
+	if (rationale.length === 0) rationale.push("无强护栏信号，默认 full（模型不可用时宁重勿漏）");
+	const kind = mode === "medium" ? "标准功能(含UI)" : mode === "lite" ? "微功能" : "完整需求";
+	const confidence = mode === "medium" && !opts?.needDesign ? "medium" : "low";
 	return {
 		mode,
 		kind,
@@ -2459,29 +2684,36 @@ function fallbackVerdict(requirement, opts) {
 		source: "fallback"
 	};
 }
-/** 模型驱动分诊：spawn「分诊分析师」子代理思考一轮；子代理不可用/超时/解析失败 → 正则兜底。 */
+/** 模型驱动分诊：spawn「分诊分析师」子代理思考一轮；子代理不可用/超时/解析失败 → 正则兜底。
+* 解析失败先带纠错提示重试一次（实锤 run tf-mtfo8exi：模型输出「Let me output the JSON.」开场白
+* 后无 JSON——首轮输出预算被思考耗尽/模型停早；重试提示直接输出 JSON 对象本身）。 */
 async function runTriage(requirement, opts, parent, signal) {
 	const subagents = runtime.subagents;
 	if (!subagents || typeof subagents.start !== "function") return fallbackVerdict(requirement, opts);
 	const pre = suggestMode(requirement, opts);
-	let run = null;
-	try {
-		run = await subagents.start(providerName(), {
-			label: "需求分诊",
-			prompt: [{
-				type: "text",
-				text: TRIAGE_PROMPT(requirement, opts, pre)
-			}],
-			parent,
-			signal
-		});
-		const result = await Promise.race([run.result, new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("triage 超时（90s）")), 9e4))]);
-		const parsed = parseVerdictText(extractText(result && result.output));
-		if (parsed) return parsed;
-	} catch (e) {} finally {
-		if (run && run.dispose) try {
-			await run.dispose();
-		} catch (e) {}
+	for (let attempt = 1; attempt <= 2; attempt++) {
+		let run = null;
+		try {
+			const hint = attempt > 1 ? "Your previous reply contained only a preface (e.g. \"Let me output the JSON.\") with NO JSON object — that is a failed reply. Reply now with the JSON object ITSELF as the first and only content, starting with {." : "";
+			run = await subagents.start(providerName(), {
+				label: "需求分诊",
+				prompt: [{
+					type: "text",
+					text: TRIAGE_PROMPT(requirement, opts, pre, hint)
+				}],
+				parent,
+				signal
+			});
+			const result = await Promise.race([run.result, new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error("triage 超时（90s）")), 9e4))]);
+			const parsed = parseVerdictText(extractText(result && result.output));
+			if (parsed) return parsed;
+		} catch (e) {
+			if (attempt === 2) {}
+		} finally {
+			if (run && run.dispose) try {
+				await run.dispose();
+			} catch (e) {}
+		}
 	}
 	return fallbackVerdict(requirement, opts);
 }
@@ -2612,10 +2844,10 @@ function buildResumeProducts(journal) {
 	const products = {};
 	for (const s of journal.stages) {
 		if (s.status !== "done" || !s.output) continue;
-		const key = PHASE_KEY_BY_NAME[s.phase];
+		const key = phaseKeyOf(s.phase);
 		if (!key) continue;
-		if (key === "dev") products.dev = journal.stages.filter((x) => x.phase === "开发" && x.status === "done" && x.output).map((x) => ({
-			title: x.label.replace(/^开发 · /, ""),
+		if (key === "dev") products.dev = journal.stages.filter((x) => phaseKeyOf(x.phase) === "dev" && x.status === "done" && x.output).map((x) => ({
+			title: x.taskKey || x.label.replace(/^开发 · /, ""),
 			failed: false,
 			output: x.output
 		}));
@@ -2623,6 +2855,19 @@ function buildResumeProducts(journal) {
 	}
 	return products;
 }
+/** 任务夹产物读取（单轨契约：文件即产物——QA/验收 host 只读文件，回复仅摘要）。
+* 缺失/空/读取异常返回 null（调用方决定硬失败或 journal 兜底）。 */
+function artifactText(journal, fileName) {
+	const path = journal && journal.workspacePath && journal.runDocs ? `${journal.workspacePath}/${journal.runDocs}/${fileName}` : null;
+	if (!path) return null;
+	try {
+		if (!existsSync(path)) return null;
+		const t = readFileSync(path, "utf8").trim();
+		return t ? t : null;
+	} catch (e) {
+		return null;
+	}
+}
 /**
 * 断点续跑起点：第一个「没有任意 done 尝试」的阶段。
 * ⚠️ 按阶段而非尝试判断（实锤 tf-mtcomxpq）：PRD 第 1 次尝试 failed（护栏退化）但第 2 次重试 done——
@@ -2630,13 +2875,37 @@ function buildResumeProducts(journal) {
 * 全部完成仍被中断（理论极端）→ 从产品验收继续。
 */
 function interruptedPhaseOf(journal) {
-	if (hasOpenBlockingBugs(journal)) return "QA 测试";
+	if (hasOpenBlockingBugs(journal)) return "qa";
 	for (const phase of PHASE_ORDER) {
-		const phaseStages = (journal.stages || []).filter((s) => s.phase === phase);
+		const phaseStages = (journal.stages || []).filter((s) => phaseKeyOf(s.phase) === phase);
 		if (phaseStages.length === 0) continue;
-		if (!phaseStages.some((s) => s.status === "done")) return phase;
+		if (phase === "dev") {
+			if ([...devTaskStatuses(phaseStages).values()].some((st) => !st.done)) return phase;
+		} else if (!phaseStages.some((s) => s.status === "done")) return phase;
 	}
-	return "产品验收";
+	return "acceptance";
+}
+/** 任务级聚合（journal 驱动，2026-09-06 状态机化）：按 stage.taskKey（旧数据 label 兜底）分组——
+* 有 done stage = 任务已成功（历史失败尝试不算失败）。
+* resume 补跑判定/阶段完成判定共用；不读 backlog（两块业务线解耦——残留失败卡污染判定实锤 json-parse r1）。 */
+function devTaskStatuses(stages) {
+	const m = /* @__PURE__ */ new Map();
+	for (const s of stages || []) {
+		const title = String(s.taskKey || String(s.label || "").replace(/^开发 · /, "").replace(/（(?:第 \d+ 次重试|补跑)）$/, "").trim());
+		if (!title) continue;
+		const cur = m.get(title) || {
+			done: false,
+			lastStatus: null,
+			lastSeq: -1
+		};
+		if ((s.seq || 0) > cur.lastSeq) {
+			cur.lastSeq = s.seq || 0;
+			cur.lastStatus = s.status || null;
+		}
+		if (s.status === "done") cur.done = true;
+		m.set(title, cur);
+	}
+	return m;
 }
 /** 开发任务定义（单一来源）：架构蓝图自动拆 > 调用方显式 tasks > 整体开发兜底。
 * resume 补跑与正常执行共用（defByTitle 按 title 匹配失败子卡）。 */
@@ -2730,18 +2999,18 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 	});
 	/** 阶段失败错误：带真实尝试次数/末次结果/累计消耗与熔断语义（取代千篇一律的「重试 N 次后仍无产出」）。 */
 	const stageFailError = (label, r) => {
-		const last = [...journal.stages || []].reverse().find((s) => s.phase === label);
+		const last = [...journal.stages || []].reverse().find((s) => phaseKeyOf(s.phase) === label);
 		const attempts = r && r.attempts ? r.attempts : 2;
 		const burnt = Math.round((r && r.stageTokens || 0) / 1e3);
 		const breaker = (r && r.stageTokens || 0) >= 6e4 ? "，超出阶段预算熔断" : "";
 		const detail = last ? `末次 ${last.outcome || "unknown"}${last.summary ? `（${last.summary}）` : ""}` : "无阶段记录";
-		return /* @__PURE__ */ new Error(`${label} 阶段失败：${attempts} 次尝试未交付，${detail}，累计消耗 ${burnt}k token${breaker}，需人工介入`);
+		return /* @__PURE__ */ new Error(`${PHASE_KEY_OF[label] || label} 阶段失败：${attempts} 次尝试未交付，${detail}，累计消耗 ${burnt}k token${breaker}，需人工介入`);
 	};
 	try {
 		if (resume) journal.logs.push({
 			t: Date.now(),
 			level: "info",
-			message: `断点续跑：复用 backlog（req=${journal.reqId}），从「${resume.phase}」继续`
+			message: `断点续跑：复用 backlog（req=${journal.reqId}），从「${PHASE_KEY_OF[resume.phase] || resume.phase}」继续`
 		});
 		else {
 			const init = initPipelineBacklog(journal, requirement, options);
@@ -2904,11 +3173,25 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			const block = extractStateBlock(output);
 			if (block) mergeStateBlock(journal.workspace || "default", block, phaseKey);
 		};
+		const noteVerifyEvidence = (stage, output) => {
+			try {
+				const ev = extractVerificationEvidence(output);
+				if (!ev) {
+					journal.logs.push({
+						t: Date.now(),
+						level: "warn",
+						message: `${stage ? PHASE_KEY_OF[phaseKeyOf(stage.phase)] || stage.phase : "开发"} 回复缺少 [Verification evidence] 块（契约未兑现，已记录不中断）`
+					});
+					return;
+				}
+				if (stage) stage.verifyEvidence = ev;
+			} catch (e) {}
+		};
 		let prd = null;
-		if (resumed("PRD 产品需求")) {
+		if (resumed("prd")) {
 			prd = resume.products.prd;
 			timeline.prd = prd;
-			logSkip("PRD 产品需求");
+			logSkip(PHASE_KEY_OF.prd);
 		} else {
 			journal.logs.push({
 				t: Date.now(),
@@ -2925,8 +3208,8 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				label: "产品经理 · 梳理 PRD",
 				fn: prdPrompt
 			};
-			const prdR = await withRetry(journal, parent, pForm.label, "PRD 产品需求", pForm.fn(requirement, root, journal.id, state), signal);
-			if (!prdR.text) throw stageFailError("PRD 产品需求", prdR);
+			const prdR = await withRetry(journal, parent, pForm.label, "prd", pForm.fn(requirement, root, journal.id, state), signal);
+			if (!prdR.text) throw stageFailError("prd", prdR);
 			prd = prdR.text;
 			timeline.prd = prd;
 			mergeStageState("prd", prd);
@@ -2935,18 +3218,18 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 		}
 		let design = null;
 		if (enabled("design")) {
-			if (resumed("UI/UX 设计")) {
+			if (resumed("design")) {
 				design = resume.products.design;
 				timeline.design = design;
-				logSkip("UI/UX 设计");
+				logSkip(PHASE_KEY_OF.design);
 			} else {
 				journal.logs.push({
 					t: Date.now(),
 					level: "phase",
 					message: "进入阶段：UI/UX 设计"
 				});
-				const designR = await withRetry(journal, parent, "UI/UX 设计师 · 设计说明", "UI/UX 设计", designPrompt(prd, root, journal.id, state), signal);
-				if (!designR.text) throw stageFailError("UI/UX 设计", designR);
+				const designR = await withRetry(journal, parent, "UI/UX 设计师 · 设计说明", "design", designPrompt(prd, root, journal.id, state), signal);
+				if (!designR.text) throw stageFailError("design", designR);
 				design = designR.text;
 				timeline.design = design;
 				mergeStageState("design", design);
@@ -2956,18 +3239,18 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 		}
 		let scaffold = null;
 		if (enabled("scaffold")) {
-			if (resumed("架构规划")) {
+			if (resumed("scaffold")) {
 				scaffold = resume.products.scaffold;
 				timeline.scaffold = scaffold;
-				logSkip("架构规划");
+				logSkip(PHASE_KEY_OF.scaffold);
 			} else {
 				journal.logs.push({
 					t: Date.now(),
 					level: "phase",
 					message: "进入阶段：架构规划"
 				});
-				const scR = await withRetry(journal, parent, "架构师 · 脚手架规划与落地", "架构规划", scaffoldPrompt(requirement, design, root, journal.id, state), signal);
-				if (!scR.text) throw stageFailError("架构规划", scR);
+				const scR = await withRetry(journal, parent, "架构师 · 脚手架规划与落地", "scaffold", scaffoldPrompt(requirement, design, root, journal.id, state), signal);
+				if (!scR.text) throw stageFailError("scaffold", scR);
 				scaffold = scR.text;
 				timeline.scaffold = scaffold;
 				mergeStageState("scaffold", scaffold);
@@ -2976,72 +3259,74 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			}
 		}
 		let tech = null;
-		if (resumed("技术方案")) {
-			tech = resume.products.tech;
-			timeline.tech = tech;
-			logSkip("技术方案");
-		} else {
-			const isHeavy = !options.lite && options.mode !== "tech" && options.mode !== "patch";
-			journal.logs.push({
-				t: Date.now(),
-				level: "phase",
-				message: isHeavy ? "进入阶段：技术方案" : "进入阶段：架构蓝图"
-			});
-			const label = isHeavy ? "高级全栈工程师 · 技术方案" : "架构师 · 架构蓝图";
-			const techR = await withRetry(journal, parent, label, "技术方案", isHeavy ? techPrompt(prd, design, scaffold, tasks, root, journal.id, state) : architectPrompt(prd, root, journal.id, state), signal);
-			if (!techR.text) throw stageFailError(label, techR);
-			tech = techR.text;
-			timeline.tech = tech;
-			mergeStageState("tech", tech);
-			let bd = extractBlueprint(tech);
-			if (!bd || bd.summary === void 0) try {
-				const techFile = journal.runDocs && journal.workspacePath ? `${journal.workspacePath}/${journal.runDocs}/TECHNICAL.md` : null;
-				if (techFile && existsSync(techFile)) bd = extractBlueprint(readFileSync(techFile, "utf8"));
-				if (bd) journal.logs.push({
+		if (enabled("tech")) {
+			if (resumed("tech")) {
+				tech = resume.products.tech;
+				timeline.tech = tech;
+				logSkip(PHASE_KEY_OF.tech);
+			} else {
+				const isHeavy = !options.lite && options.mode !== "tech" && options.mode !== "patch";
+				journal.logs.push({
 					t: Date.now(),
-					level: "info",
-					message: "蓝图从任务夹 TECHNICAL.md 提取（模型把蓝图写进了文档而非回复输出）"
+					level: "phase",
+					message: isHeavy ? "进入阶段：技术方案" : "进入阶段：架构蓝图"
 				});
-			} catch (e) {}
-			if (bd && bd.summary !== void 0) try {
-				state.__runCtx = state.__runCtx || {};
-				state.__runCtx.blueprint = bd.render;
-				journal.blueprint = {
-					modules: bd.modules,
-					tasks: bd.tasks
-				};
-			} catch (e) {}
-			else if (/<!-- blueprint -->/.test(String(tech))) journal.logs.push({
-				t: Date.now(),
-				level: "warn",
-				message: "技术方案蓝图块解析失败（JSON 畸形），开发任务将回退整体开发——TECHNICAL.md 蓝图块需人工检查"
-			});
-			noteTaskStageUsage(journal);
-			if (journal.cancelled) return;
+				const label = isHeavy ? "高级全栈工程师 · 技术方案" : "架构师 · 架构蓝图";
+				const techR = await withRetry(journal, parent, label, "tech", isHeavy ? techPrompt(prd, design, scaffold, tasks, root, journal.id, state) : architectPrompt(prd, root, journal.id, state), signal);
+				if (!techR.text) throw stageFailError(label, techR);
+				tech = techR.text;
+				timeline.tech = tech;
+				mergeStageState("tech", tech);
+				let bd = extractBlueprint(tech);
+				if (!bd || bd.summary === void 0) try {
+					const techFile = journal.runDocs && journal.workspacePath ? `${journal.workspacePath}/${journal.runDocs}/TECHNICAL.md` : null;
+					if (techFile && existsSync(techFile)) bd = extractBlueprint(readFileSync(techFile, "utf8"));
+					if (bd) journal.logs.push({
+						t: Date.now(),
+						level: "info",
+						message: "蓝图从任务夹 TECHNICAL.md 提取（模型把蓝图写进了文档而非回复输出）"
+					});
+				} catch (e) {}
+				if (bd && bd.summary !== void 0) try {
+					state.__runCtx = state.__runCtx || {};
+					state.__runCtx.blueprint = bd.render;
+					journal.blueprint = {
+						modules: bd.modules,
+						tasks: bd.tasks
+					};
+				} catch (e) {}
+				else if (/<!-- blueprint -->/.test(String(tech))) journal.logs.push({
+					t: Date.now(),
+					level: "warn",
+					message: "技术方案蓝图块解析失败（JSON 畸形），开发任务将回退整体开发——TECHNICAL.md 蓝图块需人工检查"
+				});
+				noteTaskStageUsage(journal);
+				if (journal.cancelled) return;
+			}
 		}
 		let devResults = null;
-		if (resumed("开发")) {
+		if (resume) {
 			devResults = resume.products.dev || [];
-			const failedSubs = (storeFor(scopeKey).tasks || []).filter((t) => t.reqId === journal.reqId && t.parentId === journal.taskId && (t.status === "failed" || t.failed === true));
-			if (failedSubs.length > 0) {
-				const defs = buildDevTaskDefs(journal, tasks);
-				const defByTitle = new Map(defs.map((d) => [d.title, d]));
-				const rerunDefs = failedSubs.map((s) => {
-					const key = String(s.title || "").replace(/^开发 · /, "");
-					return defByTitle.get(key) || {
-						title: key,
-						spec: s.spec || "按技术方案实现该任务改动",
-						files: []
-					};
-				}).filter(Boolean);
-				const reused = devResults.filter((r) => r && !rerunDefs.some((d) => d.title === r.title));
+			const taskStatuses = devTaskStatuses(journal.stages || []);
+			const todo = buildDevTaskDefs(journal, tasks).filter((d) => {
+				const st = taskStatuses.get(String(d.title || "").trim());
+				return !st || !st.done;
+			});
+			if (todo.length === 0) {
+				timeline.dev = devResults;
+				logSkip("开发");
+			} else {
+				const reused = devResults.filter((r) => r && !todo.some((d) => d.title === r.title));
 				journal.logs.push({
 					t: Date.now(),
 					level: "warn",
-					message: `断点续跑开发：复用 ${reused.length} 个已完成任务，补跑 ${rerunDefs.length} 个失败任务`
+					message: `断点续跑开发：复用 ${reused.length} 个已完成任务，补跑 ${todo.length} 个失败任务`
 				});
-				const rerun = await runPool(rerunDefs, maxConcurrency, async (task) => {
-					const devR = await withRetry(journal, parent, `开发 · ${task.title}（补跑）`, "开发", devPrompt(task, tech, prd, root, journal.id, state), signal);
+				const rerun = await runPool(todo, maxConcurrency, async (task) => {
+					const prevStage = [...journal.stages].reverse().find((s) => phaseKeyOf(s.phase) === "dev" && s.status !== "done" && (s.taskKey && s.taskKey === String(task.title || "") || !s.taskKey && (s.label || "").includes(String(task.title || ""))));
+					const resumePrompt = devPrompt(task, tech, prd, root, journal.id, state) + (prevStage ? buildRetryDiagnostic(2, prevStage) : "");
+					const devR = await withRetry(journal, parent, `开发 · ${task.title}（补跑）`, "dev", resumePrompt, signal, task.title);
+					noteVerifyEvidence(devR.stage, devR.text);
 					const ok = !!devR.text;
 					return {
 						title: task.title,
@@ -3050,14 +3335,11 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					};
 				});
 				for (const t of rerun) {
-					const sub = failedSubs.find((s) => String(s.title || "").replace(/^开发 · /, "") === t.title);
+					const sub = createSubtask(journal, t.title, t.spec || "");
 					if (sub) completeSubtask(journal, sub.id, t.failed, t.output ? snippet(t.output, 1e3) : null, null);
 				}
 				devResults = [...reused, ...rerun];
 				timeline.dev = devResults;
-			} else {
-				timeline.dev = devResults;
-				logSkip("开发");
 			}
 		} else {
 			journal.logs.push({
@@ -3099,12 +3381,12 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 						persistJournal(journal);
 					}
 				}
-				const devR = await withRetry(journal, parent, `开发 · ${task.title}`, "开发", devPrompt(task, tech, prd, root, journal.id, state), signal);
+				const devR = await withRetry(journal, parent, `开发 · ${task.title}`, "dev", devPrompt(task, tech, prd, root, journal.id, state), signal, task.title);
+				noteVerifyEvidence(devR.stage, devR.text);
 				const ok = !!devR.text;
 				if (sub) {
 					completeSubtask(journal, sub.id, !ok, devR.text ? snippet(devR.text, 1e3) : null, null);
-					const devStage = journal.stages.filter((s) => s.phase === "开发").pop();
-					if (devStage) noteSubtaskUsage(journal, sub.id, devStage);
+					if (devR.stage) noteSubtaskUsage(journal, sub.id, devR.stage);
 				}
 				return {
 					title: task.title,
@@ -3115,7 +3397,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			timeline.dev = devResults;
 			for (const r of devResults) if (r && r.output) mergeStageState("dev", r.output);
 			noteTaskStageUsage(journal);
-			noteTaskAssign(journal, "dev", journal.stages.filter((s) => s.phase === "开发").map((s) => (s.childId || "").slice(0, 8)).filter(Boolean).join(",") || "开发组");
+			noteTaskAssign(journal, "dev", journal.stages.filter((s) => phaseKeyOf(s.phase) === "dev").map((s) => (s.childId || "").slice(0, 8)).filter(Boolean).join(",") || "开发组");
 			const failedCount = devResults.filter((r) => r && r.failed).length;
 			if (failedCount > 0) {
 				advanceTask(journal, "needs-human", null, "开发失败，需人工介入", { by: "dev" });
@@ -3150,10 +3432,10 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				message: "当前档位阶段集不含独立 QA：跳过（单点修复，开发自测兜底）"
 			});
 			qa = "（独立 QA 跳过：当前档位由开发自测兜底）";
-		} else if (resumed("QA 测试") && !hasOpenBlockingBugs(journal)) {
-			qa = resume.products.qa;
+		} else if (resumed("qa") && !hasOpenBlockingBugs(journal)) {
+			qa = artifactText(journal, "QA-REPORT.md") || resume.products.qa;
 			timeline.qa = qa;
-			logSkip("QA 测试");
+			logSkip(PHASE_KEY_OF.qa);
 		} else {
 			journal.logs.push({
 				t: Date.now(),
@@ -3162,7 +3444,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			});
 			advanceTask(journal, "testing", null, "QA 开始（待测试 → 测试中）", { by: "qa" });
 			const store = storeFor(scopeKey);
-			const qaStageChildren = () => journal.stages.filter((s) => s.phase === "QA 测试").map((s) => (s.childId || "").slice(0, 8)).filter(Boolean).join(",") || "测试组";
+			const qaStageChildren = () => journal.stages.filter((s) => phaseKeyOf(s.phase) === "qa").map((s) => (s.childId || "").slice(0, 8)).filter(Boolean).join(",") || "测试组";
 			let round = 0;
 			let qaClean = false;
 			const devFixRounds = [];
@@ -3174,14 +3456,26 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			do {
 				round += 1;
 				const isReverify = round > 1;
-				const qaR = await withRetry(journal, parent, isReverify ? `QA 复验 · 第${round - 1}轮修复后` : "QA 测试工程师 · 功能测试", "QA 测试", qaPrompt(prd, qaDevSummary(), root, journal.id, state, await currentModelSupportsVision(resolveChildRoute(parent).provider, resolveChildRoute(parent).model)), signal);
+				const qaR = await withRetry(journal, parent, isReverify ? `QA 复验 · 第${round - 1}轮修复后` : "QA 测试工程师 · 功能测试", "qa", qaPrompt(prd, qaDevSummary(), root, journal.id, state, await currentModelSupportsVision(resolveChildRoute(parent).provider, resolveChildRoute(parent).model)), signal);
 				if (!qaR.text) {
 					advanceTask(journal, "needs-human", null, isReverify ? `QA 复验失败（第 ${round - 1} 轮修复后）` : "QA 失败", { by: "qa" });
-					throw stageFailError(isReverify ? "QA 测试（复验）" : "QA 测试", qaR);
+					throw stageFailError("qa", qaR);
+				}
+				mergeStageState("qa", qaR.text);
+				qa = artifactText(journal, "QA-REPORT.md");
+				if (!qa) {
+					journal.logs.push({
+						t: Date.now(),
+						level: "error",
+						message: `QA 子代理回复成功但 ${journal.runDocs ? journal.runDocs + "/" : ""}QA-REPORT.md 未落盘/为空——单轨契约（文件即产物）未兑现，需人工介入`
+					});
+					advanceTask(journal, "needs-human", null, "QA-REPORT.md 未落盘（单轨契约未兑现）", { by: "qa" });
+					throw stageFailError("qa", {
+						attempts: qaR.attempts,
+						stageTokens: qaR.stageTokens
+					});
 				}
-				qa = qaR.text;
 				timeline.qa = qa;
-				mergeStageState("qa", qa);
 				noteTaskStageUsage(journal);
 				noteTaskAssign(journal, "qa", qaStageChildren());
 				defects = parseDefects(qa);
@@ -3219,7 +3513,8 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					message: `QA 发现 ${blocking.length} 个阻断缺陷（第 ${round} 轮），打回开发确认修复后复验`
 				});
 				advanceTask(journal, "rework", snippet(qa, 3e3), `QA 打回开发修复（第 ${round}/3 轮）`, { by: "qa" });
-				const fixR = await withRetry(journal, parent, `开发 · QA 缺陷修复（第 ${round} 轮）`, "开发", qaFixPrompt(blocking, qa, tech, prd, root, journal.id, state), signal);
+				const fixR = await withRetry(journal, parent, `开发 · QA 缺陷修复（第 ${round} 轮）`, "dev", qaFixPrompt(blocking, qa, tech, prd, root, journal.id, state), signal, null);
+				noteVerifyEvidence(fixR.stage, fixR.text);
 				if (!fixR.text) {
 					advanceTask(journal, "needs-human", null, "QA 打回后开发修复失败", { by: "qa" });
 					throw stageFailError("开发（QA 打回修复）", fixR);
@@ -3244,7 +3539,22 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			if (journal.cancelled) return;
 		}
 		persistJournal(journal);
-		if (!qaBlocked) {
+		if (!enabled("acceptance")) {
+			journal.logs.push({
+				t: Date.now(),
+				level: "info",
+				message: "patch 档交付完成：单 agent 直改 + 自测即收口（无独立 QA/验收）"
+			});
+			advanceTask(journal, "accepted", null, "patch 直改交付（自测通过）", { by: "dev" });
+			const store = storeFor(scopeKey);
+			const req = store.find("req", journal.reqId);
+			if (req && req.status !== "accepted") {
+				store.pushEvent(req, req.status, "accepted", "patch 交付通过（自测）");
+				req.status = "accepted";
+				store.persist();
+			}
+			journal.status = "completed";
+		} else if (!qaBlocked) {
 			journal.logs.push({
 				t: Date.now(),
 				level: "phase",
@@ -3254,18 +3564,47 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				const curTask = storeFor(scopeKey).find("task", journal.taskId);
 				if (curTask && curTask.status !== "pending-acceptance" && curTask.status !== "needs-human" && curTask.status !== "rework") advanceTask(journal, "pending-acceptance", null, "进入验收（待验收）", { by: "pm" });
 			}
-			const accR = await withRetry(journal, parent, "产品经理 · 最终验收", "产品验收", acceptancePrompt(prd, qa, JSON.stringify(timeline.dev), root, journal.id, state, await currentModelSupportsVision(resolveChildRoute(parent).provider, resolveChildRoute(parent).model)), signal);
+			const accR = await withRetry(journal, parent, "产品经理 · 最终验收", "acceptance", acceptancePrompt(prd, qa, JSON.stringify(timeline.dev), root, journal.id, state, await currentModelSupportsVision(resolveChildRoute(parent).provider, resolveChildRoute(parent).model)), signal);
 			if (!accR.text) {
 				advanceTask(journal, "needs-human", null, "验收失败", { by: "pm" });
-				throw stageFailError("产品验收", accR);
+				throw stageFailError("acceptance", accR);
+			}
+			mergeStageState("acceptance", accR.text);
+			const acceptance = artifactText(journal, "ACCEPTANCE.md");
+			if (!acceptance) {
+				journal.logs.push({
+					t: Date.now(),
+					level: "error",
+					message: `验收子代理回复成功但 ${journal.runDocs ? journal.runDocs + "/" : ""}ACCEPTANCE.md 未落盘/为空——单轨契约（文件即产物）未兑现，需人工介入`
+				});
+				advanceTask(journal, "needs-human", null, "ACCEPTANCE.md 未落盘（单轨契约未兑现）", { by: "pm" });
+				throw stageFailError("acceptance", {
+					attempts: accR.attempts,
+					stageTokens: accR.stageTokens
+				});
 			}
-			const acceptance = accR.text;
 			timeline.acceptance = acceptance;
 			noteTaskStageUsage(journal);
-			const accStage = journal.stages.find((s) => s.phase === "产品验收" && s.childId);
+			const accStage = journal.stages.find((s) => phaseKeyOf(s.phase) === "acceptance" && s.childId);
 			noteTaskAssign(journal, "accept", accStage ? String(accStage.childId).slice(0, 8) : "验收组");
-			mergeStageState("acceptance", acceptance);
 			const accVerdict = parseAcceptanceVerdict(acceptance);
+			if (accVerdict === "needs-human") {
+				journal.logs.push({
+					t: Date.now(),
+					level: "error",
+					message: "ACCEPTANCE.md 缺少「验收结论：」行（字面量模板未兑现）——不自动判通过，需人工确认结论"
+				});
+				advanceTask(journal, "needs-human", snippet(acceptance, 3e3), "ACCEPTANCE.md 缺少验收结论行（契约未兑现），需人工确认", { by: "pm" });
+				const store = storeFor(scopeKey);
+				const req = store.find("req", journal.reqId);
+				if (req) {
+					req.humanIntervention = true;
+					store.pushEvent(req, req.status, "needs-human", "验收结论行缺失，需人工确认");
+				}
+				journal.humanIntervention = true;
+				persistJournal(journal);
+				throw new Error("ACCEPTANCE.md 缺少验收结论行，需人工确认结论");
+			}
 			if (accVerdict === "reject") {
 				advanceTask(journal, "needs-human", snippet(acceptance, 3e3), "需求与现状不符（无需改动），需人工决定调整或取消需求", { by: "pm" });
 				const store = storeFor(scopeKey);
@@ -4310,8 +4649,7 @@ function tryFlushPendingInjections(sessionId) {
 	const agent = runtime.agents ? runtime.agents.get(sessionId) : void 0;
 	if (!agent || typeof agent.inject !== "function") return;
 	try {
-		agent.inject({
-			type: "user",
+		agent.inject(createUserMessage({
 			content: [{
 				type: "text",
 				text: teamflowContextText(pending.teamIcon, pending.teamName, pending.teamId)
@@ -4319,9 +4657,9 @@ function tryFlushPendingInjections(sessionId) {
 			source: {
 				kind: "plugin",
 				plugin: "dsh-plugin-teamflow",
-				form: "context"
+				form: "instructions"
 			}
-		});
+		}));
 		pendingInjections.delete(sessionId);
 	} catch (e) {}
 }
@@ -4394,7 +4732,9 @@ var TeamflowService = class extends TypertRemoteService {
 		const j = runs.get(latest.id);
 		return j ? snapshotOf(j) : null;
 	}
-	/** 阶段详情：卡片点击查看 —— 状态/耗时/官方 usage + 产物全文（超 24k 截断）。 */
+	/** 阶段详情：卡片点击查看 —— 状态/耗时/官方 usage + 产物全文（超 24k 截断）。
+	* 2026-09-06 状态机化：返回同任务全部尝试（attempts 聚合——按 stage.taskKey（旧数据 label 兜底），
+	* 按 seq 排序）——client 弹窗单次渲染现状、多次渲染时间线。 */
 	stageDetail(runId, seq, sessionId) {
 		if (typeof runId !== "string" || !runId || seq === void 0 || seq === null) return null;
 		const sc = sessionScope(sessionId);
@@ -4403,6 +4743,21 @@ var TeamflowService = class extends TypertRemoteService {
 		if (j.workspace && sc.projectKey && j.workspace !== sc.projectKey && sc.projectKey !== "default") return null;
 		const s = (j.stages || []).find((st) => Number(st.seq) === Number(seq));
 		if (!s) return null;
+		const taskKeyOf = (x) => String(x.taskKey || String(x.label || "").replace(/^开发 · /, "").replace(/（(?:第 \d+ 次重试|补跑)）$/, "").trim());
+		const taskKey = taskKeyOf(s);
+		const attempts = taskKey ? (j.stages || []).filter((x) => phaseKeyOf(x.phase) === phaseKeyOf(s.phase) && taskKeyOf(x) === taskKey).sort((a, b) => Number(a.seq) - Number(b.seq)).map((x) => ({
+			seq: x.seq,
+			label: x.label,
+			status: x.status,
+			outcome: x.outcome || null,
+			summary: clip(x.summary || "", 1500),
+			output: clip(toText(x.output) || toText(x.handoff) || "", 12e3),
+			usage: x.usage || null,
+			verifyEvidence: x.verifyEvidence || null,
+			childId: x.childId || null,
+			startedAt: x.startedAt,
+			endedAt: x.endedAt
+		})) : null;
 		return {
 			seq: s.seq,
 			label: s.label,
@@ -4414,8 +4769,10 @@ var TeamflowService = class extends TypertRemoteService {
 			endedAt: s.endedAt,
 			ownerSession: j.ownerSession || null,
 			usage: s.usage || null,
+			verifyEvidence: s.verifyEvidence || null,
 			summary: clip(s.summary || "", 3e3),
-			output: clip(toText(s.output) || toText(s.handoff) || "", 24e3)
+			output: clip(toText(s.output) || toText(s.handoff) || "", 24e3),
+			attempts
 		};
 	}
 	/** Backlog 条目详情：卡片点击查看 —— 完整字段 + 流转时间线 + 关联（子卡/缺陷）+ 任务夹路径。 */
@@ -4640,8 +4997,7 @@ var TeamflowService = class extends TypertRemoteService {
 		activeTeams.set(sid, tid);
 		saveActiveTeams();
 		const agent = runtime.agents && runtime.agents.get(sid);
-		const injectPayload = {
-			type: "user",
+		const injectPayload = createUserMessage({
 			content: [{
 				type: "text",
 				text: teamflowContextText(team.icon, team.name, tid)
@@ -4649,9 +5005,9 @@ var TeamflowService = class extends TypertRemoteService {
 			source: {
 				kind: "plugin",
 				plugin: "dsh-plugin-teamflow",
-				form: "context"
+				form: "instructions"
 			}
-		};
+		});
 		if (agent && typeof agent.inject === "function") try {
 			agent.inject(injectPayload);
 		} catch (e) {}