dsh-plugin-teamflow 0.1.7 → 0.1.8

package/lib/host.mjs

@@ -8,8 +8,20 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from
 import { fileAddressFor } from "@deepseek-ai/dsh-util-workspace-path";
 import { execFileSync } from "node:child_process";
 //#region host/constants.ts
-/** 单阶段 token 熔断预算（官方口径总消耗：input+cacheRead+cacheWrite+output 累计）。 */
-const STAGE_TOKEN_BUDGET = 6e4;
+/**
+* 单次 withRetry 调用的**新增** token 熔断预算（2026-09-11 口径修正）。
+*
+* 口径 = `freshTokensOf`（input + cacheWrite + output），**排除 cacheRead**：
+* 缓存命中是上下文复用的廉价重放，把它计入「烧钱」会得出荒谬结论——实锤 assetd
+* tf-mtwvwpxa-p3vw08 的 T5：熔断日志报「累计 token 1886k 超出阶段预算 60k」，
+* 而其中 1830k 是 cacheRead，真实新增只有 55k。旧口径的后果不是数字难看，而是
+* **任何 dev 任务只要失败一次就必然熔断**（正常 dev 单次新增实测 45–80k，而缓存命中
+* 恒在 1M 量级）→ RETRY_LIMIT=2 形同虚设，一次失败直接转人工停线。
+*
+* 量级依据（实测单次尝试新增 token）：T5 55.4k / T8 49.3k / T9 79.6k / T11 45.9k
+* → 200k ≈ 允许 RETRY_LIMIT 的两轮尝试各留余量，只在该量级的 3 倍以上（真跑飞）才熔断。
+*/
+const FRESH_TOKEN_BUDGET = 2e5;
 /** 任务夹产物展示顺序（ADR-0008）：工作台只列其中**真实存在**的文件，按此顺序出「一键右侧栏预览」按钮。 */
 const TEAMFLOW_ARTIFACT_ORDER = [
 	"PRD.md",
@@ -25,8 +37,23 @@ const GUARD_POLL_MS = 15e3;
 const GUARD_SILENCE_MS = 6e5;
 /** 空转判定：会话仍在产出事件但连续这么久没有任何工具调用（纯推理打转/改写式循环）→ stalled。要求已见过至少一次工具调用。 */
 const GUARD_NO_TOOL_MS = 9e5;
-/** 假阳性完成检测：明确拒绝/放弃模式的输出视为未产出。 */
+/**
+* 拒绝/放弃措辞词表（诊断信号 + 兜底判据，**不再是唯一的交付门禁**）。
+*
+* 2026-09-11 信号换轨：旧实现把它当交付门禁全文扫描，实锤 assetd tf-mtwvwpxa-p3vw08 的 T5
+* ——子代理 `stopReason=completed`、41 次工具调用、证据块与 state 块齐全、代码已落盘，
+* 只因**如实汇报环境限制**（「7 条 runCli 用例与 spec/verify.mjs 全部 26 例无法执行」）
+* 命中「无法执行」→ 判 insubstantial「视为未交付」→ 提测门禁停线 + 人工 resume。
+* 模型汇报环境限制是本分，不是拒绝——措辞不能当交付判据。
+* 现用法见 `judgeDeliverable`：仅在**无验证证据块**时才作为否决依据；命中即回传供留痕。
+*/
 const REFUSAL_PATTERN = /(无法完成|不能完成|无法继续|抱歉|对不起|我(无法|不能)|无法执行|cannot complete|unable to)/i;
+/**
+* 真交付信号（结构件，非措辞）：prompt 强制的 `[Verification evidence]` 块——「命令 + 退出码 +
+* 断言计数」的具体自述。拒绝/放弃类产出给不出具体命令细节，故它出现即判交付，与措辞无关。
+* 这是「防假完成（光说不做）」的客观判据，取代此前对散文措辞的依赖。
+*/
+const DELIVERY_EVIDENCE_PATTERN = /\[Verification evidence\]/i;
 /** 各阶段最小产出长度（防"假完成"：空话/一句话冒充交付）。 */
 const STAGE_MIN_LENGTH = {
 	prd: 400,
@@ -302,6 +329,41 @@ const SAFE_SIGNAL = {
 function normalizeSignal(s) {
 	return s && typeof s === "object" && typeof s.addEventListener === "function" && typeof s.aborted === "boolean" && typeof s.throwIfAborted === "function" ? s : SAFE_SIGNAL;
 }
+/**
+* 幂等合并 .gitignore 条目（纯函数，便于回归测试）。
+*
+* 场景（实锤 assetd `tf-mtwvwpxa-p3vw08`）：插件强制把命令日志/临时脚本写进 `logs/teamflow/`，
+* 目标仓库没忽略它时，收口提交的 227 个文件里 208 个是这批噪音（92%）——本函数负责「补规则」这一半，
+* 另一半（提交面强制排除）在 `sanity.tfAddArgs()`。
+*
+* 覆盖判定不只看字面相等：已有 `logs/`、`logs/**` 这类**更宽的目录规则**同样算已忽略
+* （否则会往一个已经生效的仓库里塞冗余规则）。返回 `changed=false` 时调用方**不要写文件**。
+*/
+function mergeGitignore(existing, entries) {
+	const src = existing === null || existing === void 0 ? "" : String(existing);
+	const lines = src.split(/\r?\n/).map((l) => l.trim());
+	/** 归一：去首尾斜杠与尾部 glob（`logs/`、`logs/**` → `logs`）。 */
+	const norm = (s) => s.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\/\*\*?$/, "");
+	const coveredBy = (entry) => {
+		const e = norm(entry);
+		return lines.some((l) => {
+			if (!l || l.startsWith("#")) return false;
+			const n = norm(l);
+			return !!n && (n === e || e.startsWith(`${n}/`));
+		});
+	};
+	const added = entries.filter((e) => e && !coveredBy(e));
+	if (added.length === 0) return {
+		text: src,
+		changed: false,
+		added: []
+	};
+	return {
+		text: (src ? `${src}${src.endsWith("\n") ? "" : "\n"}` : "") + `${src ? "\n" : ""}# TeamFlow 运行日志（插件自有产物，非交付物；host 提交时另有 pathspec 强制排除）\n${added.join("\n")}\n`,
+		changed: true,
+		added
+	};
+}
 /** 分支 slug 派生（ADR-2026-08-27）：branchName > triageSlug > 需求中的英文标识词 > reqId 数字 > 'feature'。
 * 实锤 feat/feature：lite 显式时 triage 不跑（无 slug）+ 分支检查早于 reqId 生成 → fallback 'feature'。 */
 function deriveBranchSlug(requirement, reqId, triageSlug, branchName) {
@@ -330,12 +392,66 @@ function deriveBranchSlug(requirement, reqId, triageSlug, branchName) {
 	if (num) return `r${num[0]}`;
 	return "feature";
 }
-/** 产出物实质校验：非空 + 无拒绝词 + 达到阶段长度下限。 */
-function hasSubstance(phase, text) {
-	if (!text || !text.trim()) return false;
-	if (REFUSAL_PATTERN.test(text)) return false;
+/**
+* 交付判定（信号分级；2026-09-11 信号换轨，原 `hasSubstance`）。
+*
+* 旧判据 = 非空 + **全文拒绝词** + 长度下限——把「措辞」当交付门禁。实锤 assetd
+* tf-mtwvwpxa-p3vw08 的 T5：子代理 `stopReason=completed`、41 次工具调用、证据块与
+* state 块齐全、`src/query.mjs` 已落盘，只因如实汇报「7 条 runCli 用例与 spec/verify.mjs
+* 全部 26 例无法执行（沙箱禁止子进程管道）」命中「无法执行」→ 判 insubstantial
+* 「视为未交付」→ 提测门禁停整条线 + 人工 resume（16 分钟 + 一轮重跑）。
+* 教训不是「词表少了一个词」，而是**措辞不能用来判定是否交付**：模型如实汇报环境限制
+* 是本分，换一种说法（跑不通/环境不允许/需在无限制 shell 复跑）旧判据照样误杀。
+*
+* 现判据按「客观优先、措辞退为兜底」分级：
+*  1. 客观形态：非空 + 达阶段长度下限（不读语义）；
+*  2. 真交付信号：含 `[Verification evidence]` 块 → 判交付（拒绝/放弃类产出给不出具体
+*     命令+退出码细节）；命中拒绝词只记诊断、不否决；
+*  3. 兜底：无证据块且命中拒绝词 → 判未交付（这才是「光说不做 / 自称做不到」的形态）。
+*
+* 因此「如实汇报环境限制」这类假阳性在**结构上**消失，而「没干活就说完成」仍被抓：
+* 无证据块的假交付照旧落到第 3 级或长度级。
+*/
+function judgeDeliverable(phase, text) {
+	const s = toText(text);
 	const min = STAGE_MIN_LENGTH[phase] ?? 100;
-	return text.trim().length >= min;
+	const length = s.trim().length;
+	if (length === 0) return {
+		ok: false,
+		reason: "empty",
+		refusal: null,
+		min,
+		length
+	};
+	if (length < min) return {
+		ok: false,
+		reason: "too-short",
+		refusal: null,
+		min,
+		length
+	};
+	const refusal = refusalHit(s);
+	if (!refusal) return {
+		ok: true,
+		reason: "ok",
+		refusal: null,
+		min,
+		length
+	};
+	if (DELIVERY_EVIDENCE_PATTERN.test(s)) return {
+		ok: true,
+		reason: "ok",
+		refusal,
+		min,
+		length
+	};
+	return {
+		ok: false,
+		reason: "refusal",
+		refusal,
+		min,
+		length
+	};
 }
 /** 不可重试的失败原因（上下文耗尽/超长/provider 客户端拒绝等——重试同一 prompt 大概率复现）。
 * 实锤 tf-mtcnejqj：opencode-go 400 invalid_request_error（tool 消息序列非法）被当作可重试 → 烧 1.98M 熔断。 */
@@ -1102,6 +1218,288 @@ function hasOpenBlockingBugs(journal) {
 		return false;
 	}
 }
+//#endregion
+//#region host/core/state.ts
+/**
+* dsh-plugin-teamflow core — state.json 预编译上下文索引。
+*
+* 目标：解决「每个新 run 都要从小代理全量读历史文档（PRD/TECH/QA）来重建认知」的 token 爆炸。
+* state.json 是跨 run 累积的结构化索引：每次 run 结束后由各阶段把「精简结论」沉淀进来，
+* 下一个 run 的子代理只读注入的 state slice，不再重复读全套历史文档。
+*
+* 设计原则：
+* - memory.md 保持权威记忆（人读）；state.json 是预编译索引（机器喂给子代理）。
+* - 子代理不直接读 state.json 文件，由 host 在开工时按角色注入相关 slice 到 prompt。
+* - state.json 只存「结论/指针」，不存全文；具体内容仍指向 docs/teamflow/ 下的活文档。
+*/
+/** 空态 state。 */
+function emptyState() {
+	return {
+		version: 1,
+		projectName: null,
+		updatedAt: null,
+		product: {
+			summary: null,
+			techStack: null
+		},
+		lastRunFolder: null,
+		modules: {},
+		verifyScripts: [],
+		acIndex: {},
+		stages: {},
+		lastRun: null
+	};
+}
+/** state.json 路径：$DSH_HOME/teamflow/<projectKey>/state.json */
+function stateFile(projectKey) {
+	return join(teamflowRoot(), projectKey, "state.json");
+}
+/** 读取（不存在返回空态）。 */
+function loadState(projectKey) {
+	const file = stateFile(projectKey);
+	try {
+		if (existsSync(file)) {
+			const raw = JSON.parse(readFileSync(file, "utf8"));
+			const base = emptyState();
+			if (raw && typeof raw === "object") {
+				base.projectName = raw.projectName ?? null;
+				base.updatedAt = raw.updatedAt ?? null;
+				base.product = {
+					...base.product,
+					...raw.product || {}
+				};
+				base.lastRunFolder = raw.lastRunFolder ?? null;
+				base.modules = raw.modules || {};
+				base.verifyScripts = Array.isArray(raw.verifyScripts) ? raw.verifyScripts : [];
+				base.acIndex = raw.acIndex || {};
+				base.stages = raw.stages || {};
+				base.lastRun = raw.lastRun ?? null;
+				return base;
+			}
+		}
+	} catch (e) {}
+	return emptyState();
+}
+/** 保存。 */
+function saveState(projectKey, state) {
+	const file = stateFile(projectKey);
+	try {
+		mkdirSync(join(teamflowRoot(), projectKey), { recursive: true });
+		state.updatedAt = Date.now();
+		writeFileSync(file, JSON.stringify(state, null, 2), "utf8");
+		return true;
+	} catch (e) {
+		console.error("[teamflow] saveState failed", e?.message);
+		return false;
+	}
+}
+/** 从阶段产出文本中提取 `<!-- state -->{...}<!-- /state -->` 块（找不到返回 null）。 */
+function extractStateBlock(text) {
+	const m = (text === null || text === void 0 ? "" : String(text)).match(/<!--\s*state\s*-->([\s\S]*?)(?:<!--\s*\/state\s*-->|$)/);
+	if (!m || !m[1]) return null;
+	try {
+		const raw = JSON.parse(m[1].trim());
+		if (raw && typeof raw === "object") return raw;
+	} catch (e) {}
+	return null;
+}
+/** 把阶段产出的 state 块合并进 state.json。 */
+function mergeStateBlock(projectKey, block, phase) {
+	const state = loadState(projectKey);
+	const key = block && block.phase || phase || "other";
+	if (block) {
+		if (typeof block.summary === "string" && block.summary.trim()) state.stages[key] = block.summary.trim();
+		if (Array.isArray(block.touched)) {
+			for (const f of block.touched) if (typeof f === "string" && f) state.modules[f] = state.modules[f] || "touched";
+		}
+		if (typeof block.verdict === "string" && block.verdict) {
+			state.lastRun = state.lastRun || {};
+			state.lastRun.verdict = block.verdict;
+		}
+		if (block.extra && typeof block.extra === "object") {
+			if (Array.isArray(block.extra.verifyScripts)) {
+				for (const s of block.extra.verifyScripts) if (typeof s === "string" && s && state.verifyScripts.indexOf(s) === -1) state.verifyScripts.push(s);
+			}
+			if (block.extra.acIndex && typeof block.extra.acIndex === "object") state.acIndex = {
+				...state.acIndex,
+				...block.extra.acIndex
+			};
+			if (typeof block.extra.techStack === "string" && block.extra.techStack) state.product.techStack = block.extra.techStack;
+			if (typeof block.extra.moduleContracts === "object" && block.extra.moduleContracts) state.modules = {
+				...state.modules,
+				...block.extra.moduleContracts
+			};
+		}
+	}
+	saveState(projectKey, state);
+	return state;
+}
+/** 按 run 更新 lastRun / lastRunFolder（finally 时调用）。 */
+function noteRun(projectKey, run) {
+	const state = loadState(projectKey);
+	if (run.runDocs) state.lastRunFolder = run.runDocs;
+	state.lastRun = {
+		runId: run.id || null,
+		requirement: run.requirement ? String(run.requirement).slice(0, 200) : null,
+		verdict: run.verdict || null,
+		folder: run.runDocs || null,
+		endedAt: run.endedAt ?? Date.now()
+	};
+	saveState(projectKey, state);
+}
+/** 按角色渲染 state slice（注入到子代理 prompt）。角色 → 只拿相关片段。 */
+function stateSliceFor(state, role) {
+	const lines = [];
+	if (state.__runCtx) {
+		if (state.__runCtx.runDocs) lines.push(`【本次任务产物夹】${state.__runCtx.runDocs}/（host 已创建；本需求的 PRD/TECHNICAL/QA-REPORT/ACCEPTANCE 全部写这里，夹建后不可变、不归档不升版）`);
+		if (state.__runCtx.sanity) lines.push(state.__runCtx.sanity);
+		if (state.__runCtx.blueprint && (role === "arch" || role === "tech" || role === "dev")) lines.push(state.__runCtx.blueprint);
+	}
+	lines.push("【预编译产品状态（state.json · 权威记忆在 docs/teamflow/memory.md，本块已是够用的索引，勿再全量读历史文档）】");
+	if (state.product.summary) lines.push(`- 产品概要：${state.product.summary}`);
+	if (state.product.techStack && (role === "tech" || role === "dev" || role === "arch")) lines.push(`- 技术栈：${state.product.techStack}`);
+	if (Object.keys(state.acIndex).length && (role === "pm" || role === "qa" || role === "acceptance" || role === "tech")) {
+		const acs = Object.entries(state.acIndex).slice(0, 40);
+		lines.push(`- AC 索引（${acs.length} 条）：${acs.map(([k, v]) => `${k} ${v}`).join("；")}`);
+	}
+	if (Object.keys(state.modules).length && (role === "tech" || role === "dev" || role === "arch" || role === "qa")) lines.push(`- 模块（${Object.keys(state.modules).length}）：${Object.entries(state.modules).map(([f, c]) => `${f}${c ? "→" + c : ""}`).join("，")}`);
+	if (state.verifyScripts.length && (role === "qa" || role === "tech" || role === "dev")) lines.push(`- 验证脚本：${state.verifyScripts.join("，")}`);
+	if (role === "pm" || role === "acceptance") {
+		if (state.stages.prd) lines.push(`- PRD 摘要：${state.stages.prd}`);
+		if (state.stages.tech) lines.push(`- 技术方案摘要：${state.stages.tech}`);
+		if (state.stages.qa) lines.push(`- QA 摘要：${state.stages.qa}`);
+	} else if (role === "dev" || role === "tech") {
+		if (state.stages.tech) lines.push(`- 技术方案摘要：${state.stages.tech}`);
+		if (state.stages.prd) lines.push(`- PRD 摘要：${state.stages.prd}`);
+	} else if (role === "qa") {
+		if (state.stages.qa) lines.push(`- 上轮 QA 摘要：${state.stages.qa}`);
+	}
+	if (state.lastRun) {
+		const r = state.lastRun;
+		lines.push(`- 上轮：${r.requirement ? r.requirement : ""}${r.verdict ? " → " + r.verdict : ""}${r.folder ? `（${r.folder}）` : ""}`);
+	}
+	return lines.join("\n");
+}
+/** 让每个阶段产出末尾附带 state 块（将并入 stage output，由 host 提取）。 */
+const STATE_BLOCK_INSTRUCTION = `\n\n[STATE BLOCK · mandatory at the end] Append one section at the END of your answer (same output as the body; the host indexes it):
+<!-- state -->{"phase":"<stage-key>","summary":"<≤500 chars: this stage's conclusion, useful for the next run>","memory":["<memory points>"]}<!-- /state -->`;
+//#endregion
+//#region host/core/products.ts
+/**
+* dsh-plugin-teamflow core — 产品线（product line）装配。
+*
+* 全局面板（侧边栏图标 + root `main` 面板）没有会话上下文：宿主据产品线 key
+* （`$DSH_HOME/teamflow/<key>/`）装配「产品线清单 / 产品线视图 / run 摘要」，
+* 与按 sessionId 寻址的路由**共用同一批 journal 与 state.json**（同源、不新增数据模型）。
+*
+* 依赖方向：types/constants/util → store → core/*；本文件只依赖 store、core/context、core/state。
+*/
+/** 按产品线 key 过滤运行（未落 workspace 的旧运行只见于 default）。 */
+function runsFor(ws) {
+	const arr = [];
+	for (const j of runs.values()) {
+		const rec = j;
+		if (ws) {
+			if ((rec.workspace || (ws === "default" ? "default" : null)) !== ws) continue;
+		}
+		arr.push(rec);
+	}
+	arr.sort((a, b) => (b.startedAt || 0) - (a.startedAt || 0));
+	return arr;
+}
+/** run 详情地址（host 生成，client 直接交给右侧栏 openResource——与产物地址同一条原则：
+*  地址里的产品线 + runId 由 host 决定，client 不拼地址、不引宿主包）。 */
+function runAddress(product, runId) {
+	return `dsh-resource://teamflow/run/${encodeURIComponent(String(product || "default"))}/${encodeURIComponent(String(runId))}`;
+}
+/** 产品线 key 归一化：复用工具层白名单（拒绝盘符/穿越/空白），非法 → null。 */
+function productKeyOf(product) {
+	return normalizeRoot(product);
+}
+/** 该 run 是否属于该产品线（无 workspace 的旧 run 只在 default 兜底可见）。 */
+function runVisibleIn(j, key) {
+	return !j.workspace || j.workspace === key || key === "default";
+}
+/** 单 run 官方口径 usage 汇总（run 列表展示；stage 级明细仍走 snapshot）。 */
+function runUsageSum(j) {
+	const t = {
+		input: 0,
+		cacheRead: 0,
+		cacheWrite: 0,
+		output: 0,
+		calls: 0
+	};
+	for (const s of j.stages || []) {
+		const u = s && s.usage;
+		if (!u) continue;
+		t.input += u.input || 0;
+		t.cacheRead += u.cacheRead || 0;
+		t.cacheWrite += u.cacheWrite || 0;
+		t.output += u.output || 0;
+		t.calls += u.calls || 0;
+	}
+	return t;
+}
+/** run 摘要（list() 与 productView() 共用同一形状）。 */
+function runBrief(j) {
+	const stages = j.stages || [];
+	return {
+		id: j.id,
+		status: j.status,
+		mode: j.options && j.options.mode || null,
+		startedAt: j.startedAt,
+		endedAt: j.endedAt,
+		agentsStarted: j.agentsStarted,
+		stageCount: stages.length,
+		doneStages: stages.filter((x) => x.status === "done").length,
+		incompleteStages: stages.some((x) => x.status !== "done"),
+		requirement: clip(j.requirement, 60),
+		usage: runUsageSum(j),
+		address: runAddress(j.workspace || "default", j.id),
+		ownerSession: j.ownerSession || null
+	};
+}
+/** 单产品线元信息（产品线清单与产品线视图共用）。 */
+function productMetaOf(key) {
+	const js = runsFor(key);
+	const st = loadState(key);
+	const path = (js.find((j) => j.workspacePath) || {}).workspacePath || null;
+	const lastRun = st.lastRun || null;
+	return {
+		key,
+		title: st.projectName || (path ? String(path).replace(/\\/g, "/").split("/").filter(Boolean).pop() : key),
+		path,
+		updatedAt: st.updatedAt || (js[0] ? js[0].endedAt || js[0].startedAt || null : null),
+		totalRuns: js.length,
+		activeRuns: js.filter((j) => j.status === "running" || j.status === "pending").length,
+		lastRequirement: lastRun && lastRun.requirement ? clip(lastRun.requirement, 80) : js[0] ? clip(js[0].requirement, 80) : null,
+		lastVerdict: lastRun && lastRun.verdict || null
+	};
+}
+/** 产品线清单：`$DSH_HOME/teamflow` 下带 `backlog/` 或 `runs/` 的目录（无会话上下文也能用）。 */
+function listProducts() {
+	const out = [];
+	const root = teamflowRoot();
+	let entries = [];
+	try {
+		entries = readdirSync(root, { withFileTypes: true });
+	} catch (e) {
+		return out;
+	}
+	for (const ent of entries) {
+		if (!ent.isDirectory() || ent.name === "runs") continue;
+		let sub = [];
+		try {
+			sub = readdirSync(join(root, ent.name));
+		} catch (e) {
+			continue;
+		}
+		if (!sub.includes("backlog") && !sub.includes("runs")) continue;
+		out.push(productMetaOf(ent.name));
+	}
+	out.sort((a, b) => (b.updatedAt || 0) - (a.updatedAt || 0));
+	return out;
+}
 /** 默认团队配置文件内容。 */
 const DEFAULT_TEAMS_FILE = {
 	version: 1,
@@ -1227,6 +1625,32 @@ function gitCmd(cwd, args, timeoutMs = 8e3) {
 	}
 }
 /**
+* TeamFlow 自有日志命名空间（工作区相对路径）。
+*
+* 为什么单独拎出来：prompts 强制子代理把命令输出与临时验证脚本写进这里（Log discipline / TOKEN_HYGIENE），
+* 而 prompts 的资源表同时把它定性为**非交付物**（「运行日志 … 日常不读」）。也就是说这批文件是插件
+* 自己必然生产、且自己声明不该交付的东西——绝不能靠目标仓库的 .gitignore 兜底。
+* 实锤 assetd `tf-mtwvwpxa-p3vw08`：收口提交 227 个文件里 **208 个（92%）** 是这里的内容
+* （100 log / 52 json / 44 临时 .mjs / 5 .cjs，623.8 KB），真交付只有 19 个文件。
+*/
+const TF_LOG_DIR = "logs/teamflow";
+/**
+* 插件发起的提交统一走这里（**禁止裸 `git add -A`**）。
+*
+* 用 git magic pathspec 强制排除自有日志：不依赖目标仓库有没有配 .gitignore、也不怕用户改回去。
+* `-- .` 把提交面收敛到工作区（workspace = 项目根）——与旧 `add -A` 在根目录等价，
+* 但不再把工作区之外/无关路径一并卷入。
+*/
+function tfAddArgs() {
+	return [
+		"add",
+		"-A",
+		"--",
+		".",
+		`:(exclude)${TF_LOG_DIR}`
+	];
+}
+/**
 * 跑一次状态核对。
 * @param path - 工作区绝对路径（workspaceScopeOf(agent).path）。
 */
@@ -1416,11 +1840,24 @@ function scannedUsageOf(run) {
 	buckets.calls = seen.size || 1;
 	return buckets;
 }
-/** 官方口径总消耗（billed input + output，含 cacheRead/cacheWrite）。 */
+/** 官方口径总消耗（billed input + output，含 cacheRead/cacheWrite）——**汇报/展示**口径。 */
 function totalTokensOf(usage) {
 	if (!usage) return 0;
 	return (usage.input || 0) + (usage.cacheRead || 0) + (usage.cacheWrite || 0) + (usage.output || 0);
 }
+/**
+* 熔断口径「新增消耗」= input + cacheWrite + output（**排除 cacheRead**）。
+*
+* 为什么与汇报口径分家（2026-09-11）：cacheRead 是上下文复用的缓存重放，单价低且是
+* **复用证据**而非烧钱信号；把它计入熔断，会让预算被「每步 1M 量级的命中」瞬间打爆——
+* 实锤 assetd tf-mtwvwpxa-p3vw08 的 T5：报「累计 token 1886k 超出阶段预算 60k」，
+* 其中 1830k 是 cacheRead，真实新增仅 55k；后果是任何 dev 任务一失败就熔断，
+* RETRY_LIMIT 永不生效。汇报仍用 `totalTokensOf`（官方口径，AGENTS §4 不变）。
+*/
+function freshTokensOf(usage) {
+	if (!usage) return 0;
+	return (usage.input || 0) + (usage.cacheWrite || 0) + (usage.output || 0);
+}
 //#endregion
 //#region host/core/guard.ts
 /**
@@ -1949,15 +2386,21 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 		const stop = result && result.stopReason;
 		const text = extractText(result && result.output);
 		stageText = text;
+		const verdict = judgeDeliverable(phase, text);
 		if (journal.cancelled) {
 			stage.status = "cancelled";
 			stage.outcome = "cancelled";
 			return null;
 		}
-		if (stop === "completed" && text && hasSubstance(phase, text)) {
+		if (stop === "completed" && text && verdict.ok) {
 			stage.status = "done";
 			stage.outcome = "completed";
 			stage.output = clip(text, 5e4);
+			if (verdict.refusal) journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: `${label} 产出含疑似拒绝措辞「${verdict.refusal.phrase}」（原文：${verdict.refusal.context}）——但已带 [Verification evidence] 块，判为交付；措辞仅作诊断不再否决`
+			});
 			return text;
 		}
 		if (stage.guardReason) {
@@ -1976,20 +2419,19 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 		stage.outcome = stop === "completed" && text ? "insubstantial" : stop || "error";
 		const errDetail = result && result.error;
 		if (stage.outcome === "insubstantial") {
-			const hit = refusalHit(text);
-			if (hit) {
-				stage.summary = `产出未通过实质校验：命中拒绝词「${hit.phrase}」（原文：${hit.context}），视为未交付`;
+			if (verdict.reason === "refusal" && verdict.refusal) {
+				stage.summary = `产出未通过实质校验：无验证证据块且命中拒绝词「${verdict.refusal.phrase}」（原文：${verdict.refusal.context}），视为未交付`;
 				journal.logs.push({
 					t: Date.now(),
 					level: "warn",
-					message: `${label} 产出命中拒绝词「${hit.phrase}」`
+					message: `${label} 产出命中拒绝词「${verdict.refusal.phrase}」且无 [Verification evidence] 块`
 				});
 			} else {
-				stage.summary = `产出未通过实质校验：内容过短（${text.trim().length} 字符 < ${STAGE_MIN_LENGTH[phase] ?? 100} 下限），视为未交付`;
+				stage.summary = `产出未通过实质校验：内容过短（${verdict.length} 字符 < ${verdict.min} 下限），视为未交付`;
 				journal.logs.push({
 					t: Date.now(),
 					level: "warn",
-					message: `${label} 产出过短（${text.trim().length} 字符），未通过实质校验`
+					message: `${label} 产出过短（${verdict.length} 字符），未通过实质校验`
 				});
 			}
 			if (text) stage.output = clip(text, 4e3);
@@ -2029,11 +2471,14 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 		} catch (e2) {}
 	}
 }
-/** 单阶段重试 + token 熔断（官方口径：input+cacheRead+cacheWrite+output 累计）。
+/**
+* 单阶段重试 + token 熔断（**新增口径**：input+cacheWrite+output，排除 cacheRead——见
+* `FRESH_TOKEN_BUDGET` 与 metering.freshTokensOf；汇报仍走官方 totalTokensOf 口径）。
+* 顺序：不可重试/外部中止/护栏中止 → 预算门 → 自动重试（预算合理时重试优先于熔断，2026-09-11 修正）。
 * `effortHint`：机械阶段的推理强度降档提示（第 1 次尝试生效，重试自动回升 high，见 resolveStageEffort）。 */
 async function withRetry(journal, parent, label, phase, prompt, signal, taskKey, effortHint) {
 	let attempts = 0;
-	let stageTokens = 0;
+	let freshTokens = 0;
 	let lastStage = null;
 	for (let attempt = 1; attempt <= 2; attempt++) {
 		attempts = attempt;
@@ -2042,17 +2487,17 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 		const beforeLen = journal.stages.length;
 		const result = await runAgent(journal, parent, labelNow, phase, promptNow, signal, taskKey, attempt, effortHint);
 		lastStage = journal.stages[beforeLen] || null;
-		if (lastStage && lastStage.phase === phase) stageTokens += totalTokensOf(lastStage.usage);
+		if (lastStage && lastStage.phase === phase) freshTokens += freshTokensOf(lastStage.usage);
 		if (result) return {
 			text: result,
 			attempts,
-			stageTokens,
+			freshTokens,
 			stage: lastStage
 		};
 		if (journal.cancelled) return {
 			text: null,
 			attempts,
-			stageTokens,
+			freshTokens,
 			stage: lastStage
 		};
 		if (lastStage && isUnretryable(lastStage.outcome, lastStage.outcome)) {
@@ -2065,7 +2510,7 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 			return {
 				text: null,
 				attempts,
-				stageTokens,
+				freshTokens,
 				stage: lastStage
 			};
 		}
@@ -2079,7 +2524,7 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 			return {
 				text: null,
 				attempts,
-				stageTokens,
+				freshTokens,
 				stage: lastStage
 			};
 		}
@@ -2093,7 +2538,7 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 			return {
 				text: null,
 				attempts,
-				stageTokens,
+				freshTokens,
 				stage: lastStage
 			};
 		}
@@ -2107,21 +2552,21 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 			return {
 				text: null,
 				attempts,
-				stageTokens,
+				freshTokens,
 				stage: lastStage
 			};
 		}
-		if (stageTokens >= 6e4) {
+		if (freshTokens >= 2e5) {
 			journal.logs.push({
 				t: Date.now(),
 				level: "error",
-				message: `${label} 累计 token ${Math.round(stageTokens / 1e3)}k 超出阶段预算 ${Math.round(STAGE_TOKEN_BUDGET / 1e3)}k，熔断，需人工介入`
+				message: `${label} 累计新增 token ${Math.round(freshTokens / 1e3)}k（input+cacheWrite+output，不含缓存命中）超出预算 ${Math.round(FRESH_TOKEN_BUDGET / 1e3)}k，熔断，需人工介入`
 			});
 			journal.humanIntervention = true;
 			return {
 				text: null,
 				attempts,
-				stageTokens,
+				freshTokens,
 				stage: lastStage
 			};
 		}
@@ -2142,176 +2587,11 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 	return {
 		text: null,
 		attempts,
-		stageTokens,
+		freshTokens,
 		stage: lastStage
 	};
 }
 //#endregion
-//#region host/core/state.ts
-/**
-* dsh-plugin-teamflow core — state.json 预编译上下文索引。
-*
-* 目标：解决「每个新 run 都要从小代理全量读历史文档（PRD/TECH/QA）来重建认知」的 token 爆炸。
-* state.json 是跨 run 累积的结构化索引：每次 run 结束后由各阶段把「精简结论」沉淀进来，
-* 下一个 run 的子代理只读注入的 state slice，不再重复读全套历史文档。
-*
-* 设计原则：
-* - memory.md 保持权威记忆（人读）；state.json 是预编译索引（机器喂给子代理）。
-* - 子代理不直接读 state.json 文件，由 host 在开工时按角色注入相关 slice 到 prompt。
-* - state.json 只存「结论/指针」，不存全文；具体内容仍指向 docs/teamflow/ 下的活文档。
-*/
-/** 空态 state。 */
-function emptyState() {
-	return {
-		version: 1,
-		projectName: null,
-		updatedAt: null,
-		product: {
-			summary: null,
-			techStack: null
-		},
-		lastRunFolder: null,
-		modules: {},
-		verifyScripts: [],
-		acIndex: {},
-		stages: {},
-		lastRun: null
-	};
-}
-/** state.json 路径：$DSH_HOME/teamflow/<projectKey>/state.json */
-function stateFile(projectKey) {
-	return join(teamflowRoot(), projectKey, "state.json");
-}
-/** 读取（不存在返回空态）。 */
-function loadState(projectKey) {
-	const file = stateFile(projectKey);
-	try {
-		if (existsSync(file)) {
-			const raw = JSON.parse(readFileSync(file, "utf8"));
-			const base = emptyState();
-			if (raw && typeof raw === "object") {
-				base.projectName = raw.projectName ?? null;
-				base.updatedAt = raw.updatedAt ?? null;
-				base.product = {
-					...base.product,
-					...raw.product || {}
-				};
-				base.lastRunFolder = raw.lastRunFolder ?? null;
-				base.modules = raw.modules || {};
-				base.verifyScripts = Array.isArray(raw.verifyScripts) ? raw.verifyScripts : [];
-				base.acIndex = raw.acIndex || {};
-				base.stages = raw.stages || {};
-				base.lastRun = raw.lastRun ?? null;
-				return base;
-			}
-		}
-	} catch (e) {}
-	return emptyState();
-}
-/** 保存。 */
-function saveState(projectKey, state) {
-	const file = stateFile(projectKey);
-	try {
-		mkdirSync(join(teamflowRoot(), projectKey), { recursive: true });
-		state.updatedAt = Date.now();
-		writeFileSync(file, JSON.stringify(state, null, 2), "utf8");
-		return true;
-	} catch (e) {
-		console.error("[teamflow] saveState failed", e?.message);
-		return false;
-	}
-}
-/** 从阶段产出文本中提取 `<!-- state -->{...}<!-- /state -->` 块（找不到返回 null）。 */
-function extractStateBlock(text) {
-	const m = (text === null || text === void 0 ? "" : String(text)).match(/<!--\s*state\s*-->([\s\S]*?)(?:<!--\s*\/state\s*-->|$)/);
-	if (!m || !m[1]) return null;
-	try {
-		const raw = JSON.parse(m[1].trim());
-		if (raw && typeof raw === "object") return raw;
-	} catch (e) {}
-	return null;
-}
-/** 把阶段产出的 state 块合并进 state.json。 */
-function mergeStateBlock(projectKey, block, phase) {
-	const state = loadState(projectKey);
-	const key = block && block.phase || phase || "other";
-	if (block) {
-		if (typeof block.summary === "string" && block.summary.trim()) state.stages[key] = block.summary.trim();
-		if (Array.isArray(block.touched)) {
-			for (const f of block.touched) if (typeof f === "string" && f) state.modules[f] = state.modules[f] || "touched";
-		}
-		if (typeof block.verdict === "string" && block.verdict) {
-			state.lastRun = state.lastRun || {};
-			state.lastRun.verdict = block.verdict;
-		}
-		if (block.extra && typeof block.extra === "object") {
-			if (Array.isArray(block.extra.verifyScripts)) {
-				for (const s of block.extra.verifyScripts) if (typeof s === "string" && s && state.verifyScripts.indexOf(s) === -1) state.verifyScripts.push(s);
-			}
-			if (block.extra.acIndex && typeof block.extra.acIndex === "object") state.acIndex = {
-				...state.acIndex,
-				...block.extra.acIndex
-			};
-			if (typeof block.extra.techStack === "string" && block.extra.techStack) state.product.techStack = block.extra.techStack;
-			if (typeof block.extra.moduleContracts === "object" && block.extra.moduleContracts) state.modules = {
-				...state.modules,
-				...block.extra.moduleContracts
-			};
-		}
-	}
-	saveState(projectKey, state);
-	return state;
-}
-/** 按 run 更新 lastRun / lastRunFolder（finally 时调用）。 */
-function noteRun(projectKey, run) {
-	const state = loadState(projectKey);
-	if (run.runDocs) state.lastRunFolder = run.runDocs;
-	state.lastRun = {
-		runId: run.id || null,
-		requirement: run.requirement ? String(run.requirement).slice(0, 200) : null,
-		verdict: run.verdict || null,
-		folder: run.runDocs || null,
-		endedAt: run.endedAt ?? Date.now()
-	};
-	saveState(projectKey, state);
-}
-/** 按角色渲染 state slice（注入到子代理 prompt）。角色 → 只拿相关片段。 */
-function stateSliceFor(state, role) {
-	const lines = [];
-	if (state.__runCtx) {
-		if (state.__runCtx.runDocs) lines.push(`【本次任务产物夹】${state.__runCtx.runDocs}/（host 已创建；本需求的 PRD/TECHNICAL/QA-REPORT/ACCEPTANCE 全部写这里，夹建后不可变、不归档不升版）`);
-		if (state.__runCtx.sanity) lines.push(state.__runCtx.sanity);
-		if (state.__runCtx.blueprint && (role === "arch" || role === "tech" || role === "dev")) lines.push(state.__runCtx.blueprint);
-	}
-	lines.push("【预编译产品状态（state.json · 权威记忆在 docs/teamflow/memory.md，本块已是够用的索引，勿再全量读历史文档）】");
-	if (state.product.summary) lines.push(`- 产品概要：${state.product.summary}`);
-	if (state.product.techStack && (role === "tech" || role === "dev" || role === "arch")) lines.push(`- 技术栈：${state.product.techStack}`);
-	if (Object.keys(state.acIndex).length && (role === "pm" || role === "qa" || role === "acceptance" || role === "tech")) {
-		const acs = Object.entries(state.acIndex).slice(0, 40);
-		lines.push(`- AC 索引（${acs.length} 条）：${acs.map(([k, v]) => `${k} ${v}`).join("；")}`);
-	}
-	if (Object.keys(state.modules).length && (role === "tech" || role === "dev" || role === "arch" || role === "qa")) lines.push(`- 模块（${Object.keys(state.modules).length}）：${Object.entries(state.modules).map(([f, c]) => `${f}${c ? "→" + c : ""}`).join("，")}`);
-	if (state.verifyScripts.length && (role === "qa" || role === "tech" || role === "dev")) lines.push(`- 验证脚本：${state.verifyScripts.join("，")}`);
-	if (role === "pm" || role === "acceptance") {
-		if (state.stages.prd) lines.push(`- PRD 摘要：${state.stages.prd}`);
-		if (state.stages.tech) lines.push(`- 技术方案摘要：${state.stages.tech}`);
-		if (state.stages.qa) lines.push(`- QA 摘要：${state.stages.qa}`);
-	} else if (role === "dev" || role === "tech") {
-		if (state.stages.tech) lines.push(`- 技术方案摘要：${state.stages.tech}`);
-		if (state.stages.prd) lines.push(`- PRD 摘要：${state.stages.prd}`);
-	} else if (role === "qa") {
-		if (state.stages.qa) lines.push(`- 上轮 QA 摘要：${state.stages.qa}`);
-	}
-	if (state.lastRun) {
-		const r = state.lastRun;
-		lines.push(`- 上轮：${r.requirement ? r.requirement : ""}${r.verdict ? " → " + r.verdict : ""}${r.folder ? `（${r.folder}）` : ""}`);
-	}
-	return lines.join("\n");
-}
-/** 让每个阶段产出末尾附带 state 块（将并入 stage output，由 host 提取）。 */
-const STATE_BLOCK_INSTRUCTION = `\n\n[STATE BLOCK · mandatory at the end] Append one section at the END of your answer (same output as the body; the host indexes it):
-<!-- state -->{"phase":"<stage-key>","summary":"<≤500 chars: this stage's conclusion, useful for the next run>","memory":["<memory points>"]}<!-- /state -->`;
-//#endregion
 //#region host/prompts/index.ts
 /**
 * dsh-plugin-teamflow — Prompt 模板（阶段提示词 + 团队模板）。
@@ -2369,7 +2649,7 @@ const AGENTS_TEMPLATE = `# AGENTS.md — 团队协作守则与文档索引（{{P
 | 任务产物 | ${TF_DOCS}/<yyyyMMdd-rN-slug>/ | 每个需求一个自包含任务夹：PRD/设计/技术方案/QA 报告/验收报告（按日期倒序即迭代史） |
 | 架构总览 | ${TF_DOCS}/architecture/ARCHITECTURE.md | 工程方案与脚手架说明（产品级长期文档） |
 | 产品记忆 | ${TF_DOCS}/memory.md | 团队约定/技术栈/已知待办（低频更新） |
-| 运行日志 | logs/teamflow/<runId>/ | TeamFlow 流水线各阶段命令日志（日常不读） |
+| 运行日志 | logs/teamflow/<runId>/ | TeamFlow 流水线各阶段命令日志（日常不读）；**布局约定**（全部在该目录内，项目根不得出现 scripts/ probe/）：regression-<phase>.log（套件输出，重跑追加）/ scripts/（一次性校验脚本）/ captures.json（命令载荷汇总）/ probe/（探针）——每用途一个文件，不新增同名变体 |
 
 ## 3. 团队角色与标准流程
 
@@ -2451,6 +2731,13 @@ const TOKEN_HYGIENE = (runId) => `[TOKEN HYGIENE · policy] Context is expensive
 - [Batch fixes] When verification fails: read ALL failing cases at once → fix them ALL in one edit → run verification once more. Never "fix one → run → fix one → run". At most 3 fix-verify rounds; beyond that, output a diagnostic summary and stop.
 - Never whole-file read a file over 200 lines (use grep + limit segments for the rest); whole-file read targets ≤2 files; everything else: grep + limited segments.
 - Redirect command output to a file (under logs/teamflow/${runId || "<runId>"}/) and read the tail summary; never echo hundreds of lines inline.
+- [Log layout · policy] Reuse one file per purpose — never multiply variants of the same run. **Every path below is INSIDE logs/teamflow/${runId || "<runId>"}/ — never create scripts/ or probe/ at the project root** (they land in the delivery commit as pollution; the Doc boundary already forbids scattering there). Observed cost of ignoring this: one run left 51 full-suite dumps (78% of all log bytes) + 49 loose scripts, and a later run still leaked 6 root-level scratch files into its commit.
+  - Full suite output → logs/teamflow/${runId || "<runId>"}/regression-<phase>.log, APPENDED on re-run with a "--- <timestamp> <task> ---" header (no -run2 / -nopipe / -shim variants of the same run).
+  - Your own one-off checkers → logs/teamflow/${runId || "<runId>"}/scripts/ (name each for what it checks).
+  - Captured command payloads → logs/teamflow/${runId || "<runId>"}/captures.json, not one file per invocation.
+  - Probes / scratch fixtures → logs/teamflow/${runId || "<runId>"}/probe/.
+  - Optional bash/zsh helpers → logs/teamflow/${runId || "<runId>"}/helpers/ (same rule: inside the run dir).
+  - Anything else scattered in the run root is noise that the next agent — and the human auditing your [Verification evidence] — has to wade through.
 - Keep reports/summaries tight (QA ≤150 lines, acceptance ≤80 lines, dev ≤40 lines); put details in files.
 - AGENTS.md and the memory index are already injected above — no call needed to read them in full; grep keywords if you need a particular rule.
 - The contract/AC for this iteration is in the context/handoff below or in this task folder's PRD: do NOT whole-file re-read PRD.md / DESIGN.md / TECHNICAL.md from the task folder; grep/read only the code you need.
@@ -2573,7 +2860,7 @@ ${clip(tech, 12e3)}` : ""}
 4. Actually write/modify code (grep + segmented reads to locate; no repeated whole-file reads), then run relevant build/verification to ensure green.
 5. [Engineering action execution] If task spec or PRD 工程约束 includes git actions (e.g. new branch): **execute the action BEFORE writing code** (e.g. git checkout -b <branch>); if the workspace carries unrelated uncommitted changes, do NOT commit/clean them — state the situation in the summary.
 5b. [Git discipline · policy (ADR-2026-08-27, 统一收口提交)] Work ONLY on the current branch: **never** git checkout main / merge / rebase / delete-branch / commit — main-branch actions and the final commit are performed by the host after acceptance (one commit per run: code + task-folder docs together). Just write/modify files; leave everything uncommitted. If a task asks for "merge back to main" or "commit", treat it as "prepare the delivery" (files ready + summary of what was done), do NOT commit or merge.
-6. [Log discipline] Redirect command output to logs/teamflow/${runId || "<runId>"}/.
+6. [Log discipline] Redirect command output to logs/teamflow/${runId || "<runId>"}/ following the log layout above — INSIDE that dir: logs/teamflow/${runId || "<runId>"}/regression-dev.log (append on re-run), .../scripts/, .../captures.json. Never create scripts/ or probe/ at the project root (they would be committed as pollution).
 7. Output an implementation summary (≤40 lines): changed files, key implementation points, leftovers. No big code pastes.
 7b. [Verification evidence · policy] **Mandatory block at the end of the reply (before the state block)** — host stores it verbatim for audit, cross-checkable against your command output in logs/teamflow/${runId || "<runId>"}/; missing block = contract not honored (warn only, never interrupts):
 [Verification evidence]
@@ -2608,7 +2895,7 @@ ${clip(devSummary, 15e3)}
    - Always-available sandbox-legal paths: build/assembly checks, unit tests, DOM-level E2E (jsdom or equivalent), static audit, adversarial spot-checks.
 2. [人工补测清单] Items that cannot be auto-verified (audio output / real-device: 100dvh dynamic toolbar, safe-area, multi-touch / FPS performance / screen-reader): do NOT fail them — instead list each in the report's「人工补测清单」section (acceptance criteria + method + tool), note「环境限制，非交付缺陷」, for human review.
 3. Read AGENTS.md §4 engineering conventions (verify commands) and the code changes first, then actually run those sandbox-legal verifications.
-4. [Log discipline] Redirect command output to logs/teamflow/${runId || "<runId>"}/ (e.g. qa-out.log); no scatter at project root.
+4. [Log discipline] Redirect command output to logs/teamflow/${runId || "<runId>"}/ following the log layout above — INSIDE that dir: .../regression-qa.log (append on re-run), .../scripts/, .../captures.json. Never create scripts/ or probe/ at the project root; no scatter at project root.
 5. [Reply = brief summary only · HOST-ENFORCED] Output a short reply (≤12 lines, Chinese): verdict one-liner (whether acceptance-ready) + the QA report path docs/teamflow/.../QA-REPORT.md. **Do NOT repeat the report body in the reply** — the host imports QA-REPORT.md as the single source of truth; missing file = hard failure (needs-human, pipeline stops).
 6. [Defect format · HOST-ENFORCED] Report found defects as the structured table below (for direct import by the defect tracker) — the table must be in QA-REPORT.md:
    | 编号 | 严重级(P0/P1/P2/P3) | 功能模块 | 复现步骤 | 期望行为 | 实际行为 | 关联验收项 |
@@ -2630,7 +2917,7 @@ ${tech && String(tech).trim() ? clip(tech, 12e3) : ""}
 1. [Confirm first, then fix] For each defect, verify one by one whether it truly holds (read code / reproduce / compare actual vs expected):
    — confirmed → fix it directly; QA false positive / contradicts reality → state evidence explicit in the summary (no fabricated changes, and no ignoring real defects either).
 2. Touch ONLY defect-related files (grep to locate; no whole-file reads of irrelevant big files); respect existing architecture & code style.
-3. After fixing, run relevant verification to ensure green (regression floor: existing verify suites pass untouched); redirect output to logs/teamflow/${runId || "<runId>"}/.
+3. After fixing, run relevant verification to ensure green (regression floor: existing verify suites pass untouched); redirect output to logs/teamflow/${runId || "<runId>"}/ following the log layout above — INSIDE that dir: .../regression-devfix.log (append on re-run, no -run2 variants). Never create scripts/ or probe/ at the project root.
 4. Output a fix summary (≤40 lines, Chinese): per defect —「truth judgment + fix」or「false-positive evidence」, changed files, leftovers. No big code pastes.
 4b. [Verification evidence · policy] **Mandatory block at the end of the reply (before the state block)** — host stores it verbatim for audit, cross-checkable against your command output in logs/teamflow/${runId || "<runId>"}/; missing block = contract not honored (warn only, never interrupts):
 [Verification evidence]
@@ -3054,6 +3341,42 @@ function buildResumeProducts(journal) {
 	}
 	return products;
 }
+/**
+* 让工作区的 .gitignore 忽略插件自有日志目录（幂等；返回是否真的写了）。
+*
+* 为什么需要（实锤 assetd `tf-mtwvwpxa-p3vw08`）：插件强制子代理把命令日志与临时验证脚本写进
+* `logs/teamflow/`（Log discipline / TOKEN_HYGIENE），而收口提交用裸 `add -A`——目标仓库没配
+* .gitignore 时，一次提交 227 个文件里 208 个（92%）是这批日志（100 log / 52 json / 44 临时 .mjs），
+* 真交付只有 19 个。注意当时子代理的交付报告写的是「docs/ and logs/ remain untracked as required」
+* ——交付前完全属实，是 host 在最后一刻扫进去的：**契约在 host 这一侧破的**。
+*
+* 两道防线缺一不可：
+*  ① 本函数写 .gitignore → IDE / `git status` / 用户自己的 CI 也不再看到这批文件（卫生）；
+*  ② `tfAddArgs()` 的 pathspec 强制排除 → 目标仓库只读、非 git、或用户把规则删回去时仍然兜得住（保证）。
+* 只在**即将提交**时写入：跑失败/取消的 run 不留下一份未提交的 .gitignore 改动。
+*/
+function ensureLogGitignore(cwd, journal) {
+	if (!cwd) return false;
+	try {
+		const file = `${cwd}/.gitignore`;
+		const merged = mergeGitignore(existsSync(file) ? readFileSync(file, "utf8") : null, [`${TF_LOG_DIR}/`]);
+		if (!merged.changed) return false;
+		writeFileSync(file, merged.text, "utf8");
+		journal.logs.push({
+			t: Date.now(),
+			level: "info",
+			message: `工作区 .gitignore 已补忽略 ${TF_LOG_DIR}/（插件自有运行日志，非交付物；随本次提交可见）`
+		});
+		return true;
+	} catch (e) {
+		journal.logs.push({
+			t: Date.now(),
+			level: "warn",
+			message: `补写 .gitignore 失败（不影响提交面排除）：${String(e && e.message || e)}`
+		});
+		return false;
+	}
+}
 /** 任务夹产物读取（单轨契约：文件即产物——QA/验收 host 只读文件，回复仅摘要）。
 * 缺失/空/读取异常返回 null（调用方决定硬失败或 journal 兜底）。 */
 function artifactText(journal, fileName) {
@@ -3200,10 +3523,10 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 	const stageFailError = (label, r) => {
 		const last = [...journal.stages || []].reverse().find((s) => phaseKeyOf(s.phase) === label);
 		const attempts = r && r.attempts ? r.attempts : 2;
-		const burnt = Math.round((r && r.stageTokens || 0) / 1e3);
-		const breaker = (r && r.stageTokens || 0) >= 6e4 ? "，超出阶段预算熔断" : "";
+		const burnt = Math.round((r && r.freshTokens || 0) / 1e3);
+		const breaker = (r && r.freshTokens || 0) >= 2e5 ? "，超出新增 token 预算熔断" : "";
 		const detail = last ? `末次 ${last.outcome || "unknown"}${last.summary ? `（${last.summary}）` : ""}` : "无阶段记录";
-		return /* @__PURE__ */ new Error(`${PHASE_KEY_OF[label] || label} 阶段失败：${attempts} 次尝试未交付，${detail}，累计消耗 ${burnt}k token${breaker}，需人工介入`);
+		return /* @__PURE__ */ new Error(`${PHASE_KEY_OF[label] || label} 阶段失败：${attempts} 次尝试未交付，${detail}，累计新增消耗 ${burnt}k token（不含缓存命中）${breaker}，需人工介入`);
 	};
 	try {
 		if (resume) journal.logs.push({
@@ -3315,7 +3638,8 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 		}
 		else if (!resume && journal.workspacePath && options.preAction === "commit") try {
 			const msg = typeof options.commitMessage === "string" && options.commitMessage.trim() ? options.commitMessage.trim() : `chore(teamflow): 流水线启动前提交现有改动（${journal.id}）`;
-			const add = gitCmd(journal.workspacePath, ["add", "-A"]);
+			ensureLogGitignore(journal.workspacePath, journal);
+			const add = gitCmd(journal.workspacePath, tfAddArgs());
 			const cm = gitCmd(journal.workspacePath, [
 				"commit",
 				"-m",
@@ -3386,6 +3710,15 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				if (stage) stage.verifyEvidence = ev;
 			} catch (e) {}
 		};
+		/**
+		* 失败尝试的真实产出取用（2026-09-11 修「文本凭空丢失」）：
+		* runAgent 失败路径已把产出截断落盘到 `stage.output`（供重试诊断/详情浮层），
+		* 但 withRetry 的 `text` 为 null → 证据存证 / state 回写 / 子卡产物全部拿不到文本，
+		* 还会派生一条**误导性 warn**「回复缺少 [Verification evidence] 块」（实锤 assetd
+		* tf-mtwvwpxa-p3vw08 的 T5：块明明在，只因该轮被判失败就报「契约未兑现」）。
+		* 展示/存证/诊断一律用真实文本，成功与否仍只由 `text` 决定。
+		*/
+		const stageTextOf = (r) => r.text || r.stage && r.stage.output || null;
 		let prd = null;
 		if (resumed("prd")) {
 			prd = resume.products.prd;
@@ -3525,12 +3858,13 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					const prevStage = [...journal.stages].reverse().find((s) => phaseKeyOf(s.phase) === "dev" && s.status !== "done" && (s.taskKey && s.taskKey === String(task.title || "") || !s.taskKey && (s.label || "").includes(String(task.title || ""))));
 					const resumePrompt = devPrompt(task, tech, prd, root, journal.id, state) + (prevStage ? buildRetryDiagnostic(2, prevStage) : "");
 					const devR = await withRetry(journal, parent, `开发 · ${task.title}（补跑）`, "dev", resumePrompt, signal, task.title);
-					noteVerifyEvidence(devR.stage, devR.text);
+					const rerunText = stageTextOf(devR);
+					noteVerifyEvidence(devR.stage, rerunText);
 					const ok = !!devR.text;
 					return {
 						title: task.title,
 						failed: !ok,
-						output: devR.text || "开发失败（Agent 未产出结果）"
+						output: rerunText || "开发失败（Agent 未产出结果）"
 					};
 				});
 				for (const t of rerun) {
@@ -3581,16 +3915,17 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					}
 				}
 				const devR = await withRetry(journal, parent, `开发 · ${task.title}`, "dev", devPrompt(task, tech, prd, root, journal.id, state), signal, task.title);
-				noteVerifyEvidence(devR.stage, devR.text);
+				const devText = stageTextOf(devR);
+				noteVerifyEvidence(devR.stage, devText);
 				const ok = !!devR.text;
 				if (sub) {
-					completeSubtask(journal, sub.id, !ok, devR.text ? snippet(devR.text, 1e3) : null, null);
+					completeSubtask(journal, sub.id, !ok, devText ? snippet(devText, 1e3) : null, null);
 					if (devR.stage) noteSubtaskUsage(journal, sub.id, devR.stage);
 				}
 				return {
 					title: task.title,
 					failed: !ok,
-					output: devR.text || "开发失败（Agent 未产出结果）"
+					output: devText || "开发失败（Agent 未产出结果）"
 				};
 			});
 			timeline.dev = devResults;
@@ -3671,7 +4006,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					advanceTask(journal, "needs-human", null, "QA-REPORT.md 未落盘（单轨契约未兑现）", { by: "qa" });
 					throw stageFailError("qa", {
 						attempts: qaR.attempts,
-						stageTokens: qaR.stageTokens
+						freshTokens: qaR.freshTokens
 					});
 				}
 				timeline.qa = qa;
@@ -3713,7 +4048,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				});
 				advanceTask(journal, "rework", snippet(qa, 3e3), `QA 打回开发修复（第 ${round}/3 轮）`, { by: "qa" });
 				const fixR = await withRetry(journal, parent, `开发 · QA 缺陷修复（第 ${round} 轮）`, "dev", qaFixPrompt(blocking, qa, tech, prd, root, journal.id, state), signal, null);
-				noteVerifyEvidence(fixR.stage, fixR.text);
+				noteVerifyEvidence(fixR.stage, stageTextOf(fixR));
 				if (!fixR.text) {
 					advanceTask(journal, "needs-human", null, "QA 打回后开发修复失败", { by: "qa" });
 					throw stageFailError("开发（QA 打回修复）", fixR);
@@ -3779,7 +4114,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				advanceTask(journal, "needs-human", null, "ACCEPTANCE.md 未落盘（单轨契约未兑现）", { by: "pm" });
 				throw stageFailError("acceptance", {
 					attempts: accR.attempts,
-					stageTokens: accR.stageTokens
+					freshTokens: accR.freshTokens
 				});
 			}
 			timeline.acceptance = acceptance;
@@ -3863,7 +4198,8 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 		activeProducts.delete(scopeKey);
 		if (journal.workspacePath && journal.status === "completed" && !journal.humanIntervention) try {
 			const reqHead = String(journal.requirement || "").replace(/\s+/g, " ").trim().slice(0, 80);
-			const add = gitCmd(journal.workspacePath, ["add", "-A"]);
+			ensureLogGitignore(journal.workspacePath, journal);
+			const add = gitCmd(journal.workspacePath, tfAddArgs());
 			if ((add === null ? null : gitCmd(journal.workspacePath, [
 				"commit",
 				"-m",
@@ -4108,18 +4444,7 @@ function resumeRun(runId, sessionId) {
 * 运行环境：宿主组合（web profile）的真实 Node 进程。
 */
 /** 阶段顺序/key 映射见 constants.ts（PHASE_ORDER/PHASE_KEY_OF/PHASE_KEY_BY_NAME）。 */
-/** 按工作区作用域过滤运行（sessionId 推导出 workspace slug；未落 workspace 的旧运行只见于 default）。 */
-function runsFor(ws) {
-	const arr = [];
-	for (const j of runs.values()) {
-		if (ws) {
-			if ((j.workspace || (ws === "default" ? "default" : null)) !== ws) continue;
-		}
-		arr.push(j);
-	}
-	arr.sort((a, b) => (b.startedAt || 0) - (a.startedAt || 0));
-	return arr;
-}
+/** 按工作区作用域过滤运行见 core/products.ts（runsFor；全局面板与远程面共用）。 */
 /** 由 sessionId 推导会话所属 workspace（项目）作用域。 */
 function sessionScope(sessionId) {
 	const sid = typeof sessionId === "string" && sessionId ? sessionId : null;
@@ -4132,6 +4457,8 @@ function snapshotOf(j) {
 		status: j.status,
 		startedAt: j.startedAt,
 		endedAt: j.endedAt,
+		address: runAddress(j.workspace || "default", j.id),
+		ownerSession: j.ownerSession || null,
 		requirement: clip(j.requirement, 2e3),
 		options: sanitizeSnapOptions(j.options),
 		agentsStarted: j.agentsStarted,
@@ -4907,28 +5234,21 @@ var TeamflowService = class extends TypertRemoteService {
 	list(sessionId) {
 		const sc = sessionScope(sessionId);
 		return {
-			runs: runsFor(sc.projectKey).slice(0, 30).map((j) => ({
-				id: j.id,
-				status: j.status,
-				startedAt: j.startedAt,
-				endedAt: j.endedAt,
-				agentsStarted: j.agentsStarted,
-				stageCount: j.stages.length,
-				incompleteStages: (j.stages || []).some((x) => x.status !== "done"),
-				requirement: clip(j.requirement, 60)
-			})),
+			runs: runsFor(sc.projectKey).slice(0, 30).map(runBrief),
 			workspace: sc
 		};
 	}
-	snapshot(runId, sessionId) {
-		const sc = sessionScope(sessionId);
+	/** run 详情（快照）。productOverride：全局面板按产品线 key 寻址时传入（跳过会话推导）。 */
+	snapshot(runId, sessionId, productOverride) {
+		const key = productOverride ? productKeyOf(productOverride) : sessionScope(sessionId).projectKey;
+		if (!key) return null;
 		if (runId && typeof runId === "string") {
 			const j = runs.get(runId);
 			if (!j) return null;
-			if (j.workspace && sc.projectKey && j.workspace !== sc.projectKey && sc.projectKey !== "default") return null;
+			if (!runVisibleIn(j, key)) return null;
 			return snapshotOf(j);
 		}
-		const latest = runsFor(sc.projectKey)[0];
+		const latest = runsFor(key)[0];
 		if (!latest) return null;
 		const j = runs.get(latest.id);
 		return j ? snapshotOf(j) : null;
@@ -4936,12 +5256,13 @@ var TeamflowService = class extends TypertRemoteService {
 	/** 阶段详情：卡片点击查看 —— 状态/耗时/官方 usage + 产物全文（超 24k 截断）。
 	* 2026-09-06 状态机化：返回同任务全部尝试（attempts 聚合——按 stage.taskKey（旧数据 label 兜底），
 	* 按 seq 排序）——client 弹窗单次渲染现状、多次渲染时间线。 */
-	stageDetail(runId, seq, sessionId) {
+	stageDetail(runId, seq, sessionId, productOverride) {
 		if (typeof runId !== "string" || !runId || seq === void 0 || seq === null) return null;
-		const sc = sessionScope(sessionId);
+		const key = productOverride ? productKeyOf(productOverride) : sessionScope(sessionId).projectKey;
+		if (!key) return null;
 		const j = runs.get(runId);
 		if (!j) return null;
-		if (j.workspace && sc.projectKey && j.workspace !== sc.projectKey && sc.projectKey !== "default") return null;
+		if (!runVisibleIn(j, key)) return null;
 		const s = (j.stages || []).find((st) => Number(st.seq) === Number(seq));
 		if (!s) return null;
 		const taskKeyOf = (x) => String(x.taskKey || String(x.label || "").replace(/^开发 · /, "").replace(/（(?:第 \d+ 次重试|补跑)）$/, "").trim());
@@ -4977,22 +5298,23 @@ var TeamflowService = class extends TypertRemoteService {
 		};
 	}
 	/** Backlog 条目详情：卡片点击查看 —— 完整字段 + 流转时间线 + 关联（子卡/缺陷）+ 任务夹路径。 */
-	itemDetail(kind, id, sessionId) {
+	itemDetail(kind, id, sessionId, productOverride) {
 		const k = typeof kind === "string" && [
 			"req",
 			"task",
 			"bug"
 		].indexOf(kind) !== -1 ? kind : null;
 		if (!k || typeof id !== "string" || !id) return null;
-		const sc = sessionScope(sessionId);
-		const store = storeFor(sc.projectKey);
+		const key = productOverride ? productKeyOf(productOverride) : sessionScope(sessionId).projectKey;
+		if (!key) return null;
+		const store = storeFor(key);
 		const item = store.find(k, id);
 		if (!item) return null;
 		const reqId = k === "req" ? item.id : item.reqId || null;
 		let runDocs = null;
 		let runDocsRoot = null;
 		let runInfo = null;
-		for (const j of runsFor(sc.projectKey)) {
+		for (const j of runsFor(key)) {
 			if (j.reqId !== reqId) continue;
 			if (j.runDocs && !runDocs) {
 				runDocs = j.runDocs;
@@ -5003,17 +5325,19 @@ var TeamflowService = class extends TypertRemoteService {
 				status: j.status,
 				requirement: String(j.requirement || ""),
 				startedAt: j.startedAt || null,
-				endedAt: j.endedAt || null
+				endedAt: j.endedAt || null,
+				ownerSession: j.ownerSession || null
 			};
 		}
+		const artifactSession = runInfo && runInfo.ownerSession || sessionId;
 		const runArtifacts = [];
-		if (runDocs && runDocsRoot && typeof sessionId === "string" && sessionId) try {
+		if (runDocs && runDocsRoot && typeof artifactSession === "string" && artifactSession) try {
 			const present = new Set(readdirSync(join(runDocsRoot, runDocs)));
 			for (const name of TEAMFLOW_ARTIFACT_ORDER) {
 				if (!present.has(name)) continue;
 				runArtifacts.push({
 					name,
-					address: fileAddressFor(sessionId, void 0, `${runDocs}/${name}`)
+					address: fileAddressFor(artifactSession, void 0, `${runDocs}/${name}`)
 				});
 			}
 		} catch (e) {}
@@ -5092,6 +5416,41 @@ var TeamflowService = class extends TypertRemoteService {
 			bugs
 		};
 	}
+	/** 产品线清单 + 当前会话所属产品线（client 用它做默认选中）。 */
+	products(sessionId) {
+		return {
+			current: sessionScope(sessionId).projectKey || null,
+			products: listProducts()
+		};
+	}
+	/** 产品线视图：元信息 + backlog + run 列表（全局面板一次取全，少往返）。 */
+	productView(product) {
+		const key = productKeyOf(product);
+		if (!key) return null;
+		return {
+			product: productMetaOf(key),
+			backlog: this.backlog(null, key),
+			runs: runsFor(key).slice(0, 50).map(runBrief)
+		};
+	}
+	/** 产品线级 run 详情（右栏 tab 与面板内联共用同一形状）。 */
+	productRunDetail(product, runId) {
+		const key = productKeyOf(product);
+		if (!key) return null;
+		return this.snapshot(runId, null, key);
+	}
+	/** 产品线级阶段详情（同 stageDetail 形状：attempts 聚合 + 验证证据）。 */
+	productStageDetail(product, runId, seq) {
+		const key = productKeyOf(product);
+		if (!key) return null;
+		return this.stageDetail(runId, seq, null, key);
+	}
+	/** 产品线级 backlog 条目详情（sessionId 可选：仅用于把任务夹产物地址绑到某个会话）。 */
+	productItemDetail(product, kind, id, sessionId) {
+		const key = productKeyOf(product);
+		if (!key) return null;
+		return this.itemDetail(kind, id, sessionId, key);
+	}
 	start(sessionId, requirement, options) {
 		const sid = typeof sessionId === "string" ? sessionId : null;
 		const req = typeof requirement === "string" && requirement.trim() ? requirement.trim() : null;
@@ -5128,11 +5487,12 @@ var TeamflowService = class extends TypertRemoteService {
 		};
 		return { ok: cancelRun(id) };
 	}
-	/** 工作区级 backlog 视图（自动按当前会话 workspace 隔离）。 */
-	backlog(sessionId) {
-		const sc = sessionScope(sessionId);
-		const sum = backlogSummary(sc.projectKey);
-		const js = runsFor(sc.projectKey);
+	/** 工作区级 backlog 视图（自动按当前会话 workspace 隔离）。productOverride：全局面板按产品线 key 寻址。 */
+	backlog(sessionId, productOverride) {
+		const key = productOverride ? productKeyOf(productOverride) : sessionScope(sessionId).projectKey;
+		if (!key) return null;
+		const sum = backlogSummary(key);
+		const js = runsFor(key);
 		const runOf = (reqId) => {
 			if (!reqId) return null;
 			let last = null;