dsh-plugin-teamflow 0.1.9 → 0.2.0

package/lib/host.mjs

@@ -1,12 +1,14 @@
 import { TEAMFLOW_DESCRIPTORS } from "./descriptors.mjs";
-import { fileFor, journalFile, loadJournals, logsArchiveRoot, persistJournal, readJson, readJsonAny, runLogArchiveDir, runLogStagingDir, slugPath, teamflowRoot, writeJson } from "./store.mjs";
+import { dshHome, fileFor, journalFile, loadJournals, logsArchiveRoot, persistJournal, readJson, readJsonAny, runLogArchiveDir, runLogStagingDir, slugPath, teamflowRoot, writeJson } from "./store.mjs";
 import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
 import { parameterSchemaSpecToJsonSchema } from "@deepseek-ai/dsh-tools";
 import { dirname, join } from "node:path";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { fileAddressFor } from "@deepseek-ai/dsh-util-workspace-path";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 //#region host/constants.ts
 /**
 * 单次 withRetry 调用的**新增** token 熔断预算（2026-09-11 口径修正）。
@@ -304,6 +306,7 @@ const PIPELINE_DICT = {
 		"dev.qaFixStage": "开发（QA 打回修复）",
 		"log.enterStage": "进入阶段：{phase}",
 		"log.triage": "自动分诊：{kind} → {mode}（source={source}）",
+		"log.triageFallbackReason": "分诊退化兜底原因：{msg}（分诊子代理失败/超时——若为超时，考虑模型思考时长与 TRIAGE_TIMEOUT_MS）",
 		"log.triageFail": "自动分诊失败，按默认完整流程：{msg}",
 		"log.team": "团队「{name}」：阶段 {list}",
 		"log.stageSet": "档位阶段集：mode={mode} → {list}",
@@ -359,8 +362,21 @@ const PIPELINE_DICT = {
 		"log.commitDone": "统一收口提交完成（代码 + 任务夹产物，验收通过后一个 commit）",
 		"log.commitSkip": "统一收口提交：无待提交改动（跳过）",
 		"log.commitFail": "统一收口提交失败（忽略）：{msg}",
+		"log.gitInitDone": "「改动存档」已开启（git init 完成；{baseline}）",
+		"log.gitBaselineDone": "现有内容已记录为初始状态（基线提交）",
+		"log.gitBaselineSkip": "现有内容未记录为初始状态：{msg}",
+		"log.gitBaselineLarge": "该文件夹内容较多，未把现有内容记录为初始状态（不影响本次改动单独存档）",
+		"log.baselineExcludes": "基线提交按索引层排除了 {list}（不写入你的 .gitignore——\"该忽略什么\"由项目自己决定）",
+		"log.engine": "引擎：{provider}/{model}（run 起始模型路由；逐阶段真实路由见各阶段记录——子代理可被改道）",
+		"log.gitInitFail": "「改动存档」开启失败（git init 不可用）：{path} → 本次按\"未开启存档\"继续",
+		"log.gitInitRefused": "「改动存档」被拒绝：该位置（{path}）太靠近磁盘根目录/系统目录，开启会波及大量无关文件 → 本次按\"未开启存档\"继续",
+		"log.noVcsByChoice": "本工作区未开启「改动存档」（用户选择）：本次改动不会提交，也无法一键撤销；需要的话可让 agent 把该文件夹变成可存档的",
+		"log.noVcsDangerous": "该位置（{path}）不适合开启「改动存档」（盘根/系统目录）：已跳过自动提交——请把项目放进一个单独的文件夹",
+		"commit.baseline": "chore: baseline before teamflow run",
+		"report.vcsArchived": "📦 本次改动**已存档**（1 次提交）：不满意可整体撤销，也能随时查看这次改了什么。",
 		"log.logsUnstaged": "自有日志曾被扫进索引，已摘出 {n} 个（说明工作区 .gitignore 规则失效：被删掉或写不进去）——{list}",
 		"log.logsUnstageFail": "自有日志的索引兜底失败（提交面可能被污染）：{msg}",
+		"log.devIdsBackfilled": "已为 {n} 个历史开发阶段补算任务编号（dt-N）——升级前的产物按标题回溯到任务，避免把它们当成\"没做过\"重新补跑",
 		"run.resumeBacklog": "断点续跑：复用 backlog（req={reqId}），从「{phase}」继续",
 		"run.resume": "断点续跑：从「{phase}」继续（已完成阶段复用产物）",
 		"run.resumeDev": "断点续跑开发：复用 {reused} 个已完成任务，补跑 {todo} 个失败任务",
@@ -404,8 +420,14 @@ const PIPELINE_DICT = {
 		"diag.degenerated": "{label} 进行中护栏中止（退化/推理复读），不再自动重试（污染会话内重试大概率复现且烧钱）；可 teamflow_resume 以全新会话续跑",
 		"diag.stalled": "{label} 进行中护栏中止（挂死/空转），不再自动重试（会话已无有效产出）；可 teamflow_resume 以全新会话续跑",
 		"diag.breaker": "{label} 累计新增 token {fresh}k（input+cacheWrite+output，不含缓存命中）超出预算 {budget}k，熔断，需人工介入",
+		"diag.breakerUncached": "{label} 累计新增 token {fresh}k 超出预算 {budget}k（**该 provider 无 prompt 缓存**：命中率 {ratio}%、{calls} 次调用——每轮调用都要重付 system+工具定义，预算已按 {budget}k 计），熔断，需人工介入",
+		"diag.docDelivered": "{label} 回复过短（{length} 字符 < {min} 下限），但任务夹产物 {name} 已落盘（{docLen} 字符）→ 判交付（doc 类阶段的产物是文件，回复只是摘要）",
 		"diag.retry": "{label} 第 {n} 次尝试未成功（{outcome}），自动重试（重试 prompt 已附上一轮失败诊断）…",
 		"diag.retryExhausted": "{label} 连续 {n} 次尝试失败，超出重试阈值，需人工介入",
+		"diag.externalBackoff": "{label} 疑似外部供应商不可用（限流/额度/上游故障）→ 第 {n} 次退避 {sec}s 后重试（等待不计 token；命中原文：{detail}）",
+		"diag.externalExhausted": "{label} 外部供应商持续不可用，退避 {n} 次仍失败 → 本条 run 落「可续跑中断态」（非交付缺陷；窗口恢复后 resume 只补跑这一段）",
+		"diag.triageCacheHit": "分诊结果命中缓存（同需求 + 同澄清答复，10 分钟内）——复用上次裁决、不重复起子代理（决策返回路径会重调 teamflow_start，实测会白跑一次分诊）",
+		"report.externalFailure": "⚠️ **本次失败疑似外部供应商不可用**（限流 / 无额度 / 上游故障 / 超时），**不是交付缺陷**：run 已停在可续跑的中断态，供应商窗口恢复后 `teamflow_resume` 只补跑未完成阶段（已完成阶段与产物全部复用）。",
 		"guard.observeTag": "[token 观测]",
 		"guard.repeatRead": "同一文件重复 read {n} 次：{file}（TOKEN_HYGIENE 上限 1 次，多余读取在为后续每一步付 cache 重放费）",
 		"guard.repeatScript": "验证脚本重复执行 {n} 次：{file}（批量修复纪律：一次修完所有失败再跑，≤3 轮）",
@@ -425,6 +447,11 @@ const PIPELINE_DICT = {
 		"guard.noticeSummary": "护栏轻提醒",
 		"guard.reminderRead": "你已整读 {file} 第 3 次（TOKEN_HYGIENE 上限 1 次）。停止整读：需要确认细节时用 grep 定位行号 + 限量片段读取。",
 		"guard.reminderScript": "验证脚本 {file} 已重复执行 3 次。遵守批量修复纪律：一次读完所有失败用例 → 一次全修 → 再跑一次；超出 3 轮请输出诊断摘要并停止。",
+		"guard.toolFail": "{label} 命令/工具以同一错误持续失败（{tool}，已 {n} 次）：{detail}",
+		"guard.reasonToolFail": "环境不可用（{tool} 连续 {n} 次以同一错误失败：{detail}）",
+		"guard.reminderToolFail": "命令工具不可用：{tool} 已连续 {n} 次以同一错误失败（原文：{detail}）。立即停止——不要重试、不要换命令绕过、不要用推理代替执行。请在回复里写明：工具名 + 原文错误 + 已完成/未完成，然后结束。",
+		"diag.envUnavailable": "{label} 环境不可用（命令工具持续以同一错误失败）→ 不再自动重试：这不是模型问题，请先修复工作区，再 teamflow_resume 续跑（已完成阶段与产物全部复用）",
+		"diag.envUnavailableStage": "{label} 环境不可用（命令工具持续以同一错误失败）：{detail}",
 		"report.header": "【团队研发流水线汇报】runId={id}",
 		"report.statusLine": "状态：{status}{error}",
 		"report.error": "（{error}）",
@@ -441,13 +468,41 @@ const PIPELINE_DICT = {
 		"report.listSep": "，",
 		"report.product": "产品：{product}",
 		"report.mode": "模式：{mode}",
+		"report.engine": "引擎（模型路由）：{engine}",
 		"report.backlog": "backlog：需求 {reqId}（$DSH_HOME/teamflow/ 持久化）",
+		"report.installPending": "🧩 **安装待办（需主 agent 执行，子代理权限固定写不了 profile）**：profile 目录 `{dir}`——{how}；装完重启宿主，确认插件被加载。安装前先记好回滚（`pnpm remove <包名>` 并确认它已从 `dsh.profile.bundles` 摘除）。",
+		"report.installHowCli": "执行 `dsh plugin --profile {profile} add \"<本插件路径或包名>\"`",
+		"report.installHowManual": "`dsh` 不在 PATH（源码运行）→ 在该目录执行 `pnpm add \"<本插件路径或包名>\"`，包声明了 `dsh.bundle.patch` 时会自动进 `dsh.profile.bundles`",
+		"report.installAskUser": "🧩 **安装待办**：未能探测到 profile 目录 → 请先**问用户**他的 profile 在哪，再给安装步骤（不要编路径）。子代理写不了 profile，这一步归主 agent。",
 		"report.mergeHint": "🧩 合回决策：验收已通过，当前在特性分支 {branch}（领先 main {ahead} 个提交）。请**询问用户**是否合回，并按用户选择调用 teamflow_merge：\n   ① host 代为合回 → action=\"merge\"\n   ② 给出命令用户自行合回 → action=\"command\"\n   ③ 暂不合回 → action=\"keep\"\n（选项之外用户自定义输入亦可，如实转述）",
 		"report.needsHumanNoAcceptance": "⚠ **本轮未完成产品验收**（流程因需人工介入提前结束，验收阶段未运行）——请先处理人工介入项，不要据此合回 main。",
 		"report.knownIssuesNoMerge": "⚠ **本轮验收是「已知问题」只读模式**（QA 打回超限后补跑的交付级视图）：ACCEPTANCE.md 与未闭环清单已产出，结论被**强制为需人工裁定**——先人工裁定未闭环阻断缺陷，**不要据此合回 main**；裁定后可 `teamflow_resume` 修复或另起需求。",
 		"report.stashHint": "🧩 启动前 stash 的改动仍在暂存区：流水线完成后请执行 git stash pop 恢复你的改动",
 		"report.tabHint": "用户可打开「🏭 团队工作台」tab 查看阶段泳道、拖拽看板与 token 明细。",
 		"report.next": "如需继续处理：可认领缺陷（teamflow_claim）、人工流转（teamflow_update）、断点重跑（teamflow_resume）。",
+		"report.nextCancelled": "本 run 已停在取消点，**不会自动续跑**（host 无自动续跑机制）。如需继续，请让**用户**在工作台点「↻ 从断点重跑」——取消是人的决定，不要自行调用 teamflow_resume。",
+		"report.cancelSource": "中断来源：{source}",
+		"report.assumptions": "⚠️ **本次基于以下假设启动**（agent 替你做的判断；如与预期不符，指出后可从 PRD 重跑）：\n{list}",
+		"log.triageBlockersDropped": "分诊提了 {n} 条不合格「待澄清项」（缺互斥读法/影响面/返工面）→ 已丢弃（合格线见 host）",
+		"log.prdAssumptions": "PRD 的「假设 / 待澄清」段已记录（{n} 行）——随完成汇报显式回给用户",
+		"log.prdAssumptionsMissing": "PRD 未给出「假设 / 待澄清」段（契约未兑现：无从判断这份 PRD 是否是用户想要的；已记录不中断）",
+		"log.modeUpgraded": "架构护栏：调用方自选档位「{from}」，但分诊判定为「{to}」→ 已升档（ADR-0006：架构型需求不得走轻档位）",
+		"log.triagePreflightFail": "预检分诊失败（{msg}）→ 已交给 pipeline 内部再判（不静默降级）",
+		"log.clarifyAbort": "需求澄清闸门（pipeline 兜底）：意图「{intent}」/ must-know 缺口 {n} 条 → **未进入任何阶段**，等用户答复",
+		"log.clarifyBlocker": "待澄清：{q}（影响面：{changes}；猜错的代价：{rework}）",
+		"run.needsClarification": "需求尚未对齐（意图：{intent}，must-know 缺口 {n} 条）——本 run 未进入任何阶段，可续跑。请主线程先向用户澄清，再把答复带（requirementSupplement）重新启动。",
+		"log.clarifyProceedWithAssumptions": "已澄清一轮但仍有 {n} 条 must-know 缺口 → 按假设开工（收敛规则：不再无限追问，假设写进 PRD「假设与待澄清」段并在汇报高亮）",
+		"log.triageResumed": "断点续跑：档位沿用「{mode}」（续跑不重跑分诊，避免白花调用与档位漂移）",
+		"log.artifactContract": "交付形态契约：判定形态「{kind}」→ 已向 PRD 下发 {n} 条必填 AC（形态契约，防\"看着完整却装不上\"）",
+		"log.hostResearch": "目标宿主非本仓宿主（形态「{kind}」× 宿主「{host}」）→ **不下发本仓宿主契约**，改为要求 PRD 产出「宿主契约调研」段（硬门禁）",
+		"log.hostResearchOk": "宿主契约调研已产出（{n} 条）→ 已落 journal.hostContract，后续阶段按该宿主自己的契约推进",
+		"log.hostResearchMissing": "PRD 缺少「宿主契约调研」段（本 run 目标是别的宿主框架，不先搞清它的加载契约就是在赌）→ 阶段失败，走重试",
+		"log.installEnv": "本机安装环境（运行时探测）：profile「{profile}」· 目录 {dir} · dsh 在 PATH：{cli}（路径不写死，随用户环境变化）",
+		"log.installEnvUnknown": "本机安装环境**探测失败**（profile「{profile}」· 目录 {dir}）→ PRD 将要求主 agent 先问用户 profile 位置，不编路径",
+		"cancelSource.ui": "工作台界面按钮（人工点击）",
+		"cancelSource.tool": "模型工具 teamflow_cancel",
+		"cancelSource.unknown": "未记录（历史 run）",
+		"log.cancelRequested": "收到中断请求（来源：{source}）——在下一个阶段边界生效，随后收尾为「已取消」",
 		"report.relay": "若用户在场请简明转述以上要点；若无人值守仅记录即可，不必长篇回复。",
 		"report.notice": "团队研发流水线 {status}（runId={id}）",
 		"report.status.completed": "✅ 已完成",
@@ -477,6 +532,7 @@ const PIPELINE_DICT = {
 		"state.acIndex": "- AC 索引（{n} 条）：{list}",
 		"state.modules": "- 模块（{n}）：{list}",
 		"state.verifyScripts": "- 验证脚本：{list}",
+		"state.artifactContracts": "- 交付形态契约（形态判定：{kind}，共 {n} 条）——每条都是**可执行判据**，QA/验收必须逐条验证并把命令+结果写进产物；环境做不到的（如需重启宿主）必须写进人工补测清单，不得沉默：\n{list}",
 		"state.prdSummary": "- PRD 摘要：{summary}",
 		"state.techSummary": "- 技术方案摘要：{summary}",
 		"state.qaSummary": "- QA 摘要：{summary}",
@@ -542,6 +598,7 @@ const PIPELINE_DICT = {
 		"doc.archDeviationQ": "「deviates from blueprint / duplicated impl / should-have-extracted」",
 		"doc.engConstraints": "工程约束",
 		"doc.finalCommit": "统一收口提交",
+		"doc.assumptionsQ": "假设与待澄清",
 		"doc.noRevisionTable": "**No revision table, no version fields like「版本：vX.Y / 状态：进行中」**",
 		"qa.fixSummaryQ": "「truth judgment + fix」or「false-positive evidence」",
 		"doc.statusChain": "待办→开发中→待测试→测试中→待验收→已验收",
@@ -590,6 +647,7 @@ const PIPELINE_DICT = {
 		"dev.qaFixStage": "Dev (QA rework fix)",
 		"log.enterStage": "Entering stage: {phase}",
 		"log.triage": "Auto triage: {kind} → {mode} (source={source})",
+		"log.triageFallbackReason": "Triage fell back because: {msg} (triage subagent failed/timed out — if a timeout, consider model thinking time vs TRIAGE_TIMEOUT_MS)",
 		"log.triageFail": "Auto triage failed, falling back to the default full flow: {msg}",
 		"log.team": "Team \"{name}\": stages {list}",
 		"log.stageSet": "Stage set for mode: mode={mode} → {list}",
@@ -645,8 +703,21 @@ const PIPELINE_DICT = {
 		"log.commitDone": "Unified closing commit done (code + task-folder artifacts, one commit after acceptance)",
 		"log.commitSkip": "Unified closing commit: nothing to commit (skipped)",
 		"log.commitFail": "Unified closing commit failed (ignored): {msg}",
+		"log.gitInitDone": "\"Change archiving\" is now on (git init done; {baseline})",
+		"log.gitBaselineDone": "existing content recorded as the initial state (baseline commit)",
+		"log.gitBaselineSkip": "existing content NOT recorded as the initial state: {msg}",
+		"log.gitBaselineLarge": "this folder has many files, so existing content was not recorded as the initial state (this run's changes are still archived on their own)",
+		"log.baselineExcludes": "baseline commit excluded {list} at the index level only (your .gitignore is untouched — what to ignore is the project's own decision)",
+		"log.engine": "Engine: {provider}/{model} (model route at run start; each stage records its own effective route — subagents can be re-routed)",
+		"log.gitInitFail": "\"Change archiving\" could not be enabled (git init unavailable): {path} → continuing without archiving",
+		"log.gitInitRefused": "\"Change archiving\" refused: this location ({path}) is too close to the disk root / a system directory — enabling it would sweep in many unrelated files → continuing without archiving",
+		"log.noVcsByChoice": "This workspace has NO change archiving (user's choice): this run's changes will not be committed and cannot be undone in one step; ask the agent to make this folder archivable if wanted",
+		"log.noVcsDangerous": "This location ({path}) is not suitable for change archiving (disk root / system directory): the closing commit was skipped — put the project in its own folder instead",
+		"commit.baseline": "chore: baseline before teamflow run",
+		"report.vcsArchived": "📦 This run's changes are **archived** (1 commit): you can undo them as a whole and see exactly what changed at any time.",
 		"log.logsUnstaged": "Own log files had been staged and were unstaged: {n} ({list}) — the workspace .gitignore rule is not effective (removed or unwritable)",
 		"log.logsUnstageFail": "Unstaging own log files from the index failed (the commit surface may be polluted): {msg}",
+		"log.devIdsBackfilled": "Backfilled task ids (dt-N) for {n} historical dev stage(s) — pre-upgrade output is traced back to its task by title, so it is not treated as \"never done\" and re-run",
 		"run.resumeBacklog": "Resuming: reusing backlog (req={reqId}), continuing from \"{phase}\"",
 		"run.resume": "Resuming: continuing from \"{phase}\" (completed stages reuse their artifacts)",
 		"run.resumeDev": "Resuming development: reusing {reused} completed task(s), rerunning {todo} failed task(s)",
@@ -690,8 +761,14 @@ const PIPELINE_DICT = {
 		"diag.degenerated": "{label} aborted by the in-flight guard (degeneration/reasoning loop); no automatic retry (retrying in a polluted session usually reproduces and burns tokens); teamflow_resume can continue in a fresh session",
 		"diag.stalled": "{label} aborted by the in-flight guard (stall/spin); no automatic retry (the session produces nothing useful); teamflow_resume can continue in a fresh session",
 		"diag.breaker": "{label} cumulative fresh tokens {fresh}k (input+cacheWrite+output, excluding cache hits) exceed the {budget}k budget; circuit broken, human intervention required",
+		"diag.breakerUncached": "{label} cumulative fresh tokens {fresh}k exceed the {budget}k budget (**this provider has no prompt cache**: {ratio}% hit rate over {calls} calls — every call re-pays the system prompt + tool definitions, so the budget was scaled to {budget}k); circuit broken, human intervention required",
+		"diag.docDelivered": "{label} reply was too short ({length} chars < {min} minimum), but the task-folder artifact {name} is on disk ({docLen} chars) → judged delivered (for doc stages the artifact IS the file; the reply is only a summary)",
 		"diag.retry": "{label} attempt {n} did not succeed ({outcome}); retrying automatically (the retry prompt carries the previous failure diagnosis)…",
 		"diag.retryExhausted": "{label} failed {n} consecutive attempts, exceeding the retry threshold; human intervention required",
+		"diag.externalBackoff": "{label} looks like an external provider outage (rate limit / quota / upstream failure) → backoff #{n} for {sec}s before retrying (waiting costs no tokens; matched text: {detail})",
+		"diag.externalExhausted": "{label} external provider stayed unavailable after {n} backoffs → this run is parked as a resumable interruption (not a delivery defect; once the window recovers, resume re-runs only this segment)",
+		"diag.triageCacheHit": "triage result served from cache (same requirement + same clarification supplement, within 10 minutes) — reusing the previous verdict instead of spawning another subagent (the decision return path re-calls teamflow_start, which measurably wasted one triage run)",
+		"report.externalFailure": "⚠️ **This failure looks like an external provider outage** (rate limit / quota exhausted / upstream failure / timeout) — **not a delivery defect**: the run is parked at a resumable interruption; once the provider recovers, `teamflow_resume` re-runs only the unfinished stages (completed stages and artifacts are all reused).",
 		"guard.observeTag": "[token observation]",
 		"guard.repeatRead": "the same file was read {n} times: {file} (TOKEN_HYGIENE allows 1; extra reads pay cache replay on every later step)",
 		"guard.repeatScript": "verification script executed {n} times: {file} (batch-fix discipline: read all failures, fix once, run once; at most 3 rounds)",
@@ -711,6 +788,11 @@ const PIPELINE_DICT = {
 		"guard.noticeSummary": "Guard reminder",
 		"guard.reminderRead": "You have fully read {file} for the 3rd time (TOKEN_HYGIENE allows 1). Stop full reads: to confirm details, locate line numbers with grep and read a limited segment.",
 		"guard.reminderScript": "Verification script {file} has been executed 3 times. Follow the batch-fix discipline: read all failing cases once → fix them all in one pass → run once more; beyond 3 rounds, output a diagnostic summary and stop.",
+		"guard.toolFail": "{label} a command/tool keeps failing with the same error ({tool}, {n} times so far): {detail}",
+		"guard.reasonToolFail": "environment unavailable ({tool} failed {n} times with the same error: {detail})",
+		"guard.reminderToolFail": "The command tool is unavailable: {tool} has now failed {n} times with the same error (raw: {detail}). STOP now — do not retry, do not switch commands to work around it, do not replace execution with reasoning. Reply with the tool name, the raw error, what you finished and what is left undone, then end.",
+		"diag.envUnavailable": "{label} environment unavailable (a command tool kept failing with the same error) → no automatic retry: this is not a model problem; repair the workspace first, then teamflow_resume to continue (finished stages and artifacts are all reused)",
+		"diag.envUnavailableStage": "{label} environment unavailable (a command tool kept failing with the same error): {detail}",
 		"report.header": "[Team R&D pipeline report] runId={id}",
 		"report.statusLine": "Status: {status}{error}",
 		"report.error": " ({error})",
@@ -727,13 +809,41 @@ const PIPELINE_DICT = {
 		"report.listSep": ", ",
 		"report.product": "Product: {product}",
 		"report.mode": "Mode: {mode}",
+		"report.engine": "Engine (model route): {engine}",
 		"report.backlog": "backlog: requirement {reqId} (persisted under $DSH_HOME/teamflow/)",
+		"report.installPending": "🧩 **Install pending (for the MAIN agent — subagents cannot write the profile; their permission scope is fixed)**: profile dir `{dir}` — {how}; then restart the host and confirm the plugin loads. Note the rollback first (`pnpm remove <name>` and confirm it is gone from `dsh.profile.bundles`).",
+		"report.installHowCli": "run `dsh plugin --profile {profile} add \"<path-or-package>\"`",
+		"report.installHowManual": "`dsh` is not on PATH (source-run) → in that dir run `pnpm add \"<path-or-package>\"`; the package joins `dsh.profile.bundles` automatically when it declares `dsh.bundle.patch`",
+		"report.installAskUser": "🧩 **Install pending**: the profile dir could not be probed → **ASK THE USER** where their profile lives, then give the install steps (never invent a path). Subagents cannot write the profile; this step belongs to the main agent.",
 		"report.mergeHint": "🧩 Merge decision: acceptance passed and the current feature branch {branch} is {ahead} commit(s) ahead of main. **Ask the user** whether to merge and call teamflow_merge with their choice:\n   ① host merges for them → action=\"merge\"\n   ② print the command for them to merge manually → action=\"command\"\n   ③ do not merge for now → action=\"keep\"\n(custom user input beyond these options is fine too — relay it faithfully)",
 		"report.needsHumanNoAcceptance": "⚠ **Product acceptance did NOT complete this run** (the pipeline stopped early for human intervention; the acceptance stage never ran) — resolve the human-intervention items first and do NOT merge main on this basis.",
 		"report.knownIssuesNoMerge": "⚠ **This run's acceptance was the read-only \"known issues\" mode** (a delivery-level view produced after the QA rework limit was hit): ACCEPTANCE.md and the open-item list exist, but the outcome is **forced to needs-human** — decide on the open blocking defects first and do **NOT** merge main on this basis; afterwards you can `teamflow_resume` to fix them or start a new requirement.",
 		"report.stashHint": "🧩 Changes stashed before the run are still in the stash: run git stash pop after the pipeline finishes to restore them",
 		"report.tabHint": "The user can open the \"🏭 Team workbench\" tab to see stage lanes, the drag-and-drop board and token details.",
 		"report.next": "To continue: claim defects (teamflow_claim), move items manually (teamflow_update), or resume from a checkpoint (teamflow_resume).",
+		"report.nextCancelled": "This run stopped at the cancellation point and will **not** auto-resume (the host has no auto-resume mechanism). To continue, ask the **user** to click \"↻ Resume from checkpoint\" in the workbench — stopping was a human decision, so do not call teamflow_resume on your own.",
+		"report.cancelSource": "Stop requested by: {source}",
+		"report.assumptions": "⚠️ **This run started on the following assumptions** (decisions the agent made for you; if any is wrong, say so and the PRD can be rerun from the checkpoint):\n{list}",
+		"log.triageBlockersDropped": "Triage proposed {n} unqualified \"open question(s)\" (missing competing readings / impact / rework) — dropped (the qualifying bar lives in the host)",
+		"log.prdAssumptions": "PRD assumptions/open-questions section recorded ({n} line(s)) — surfaced to the user in the completion report",
+		"log.prdAssumptionsMissing": "PRD did not provide an assumptions/open-questions section (contract not honored: nobody can tell whether this PRD is what the user wanted; logged, not blocking)",
+		"log.modeUpgraded": "Architecture guardrail: the caller picked tier \"{from}\" but triage judged \"{to}\" → upgraded (ADR-0006: architectural requirements must not run on a lightweight tier)",
+		"log.triagePreflightFail": "Pre-flight triage failed ({msg}) → handed to the pipeline to decide again (not silently degraded)",
+		"log.clarifyAbort": "Clarification gate (pipeline fallback): intent \"{intent}\" / {n} must-know gap(s) → **no stage was started**, waiting for the user",
+		"log.clarifyBlocker": "Needs clarification: {q} (changes: {changes}; cost if guessed wrong: {rework})",
+		"run.needsClarification": "The requirement is not settled yet (intent: {intent}, {n} must-know gap(s)) — this run started no stage and can be resumed. The main thread should clarify with the user first, then start again with the answers in requirementSupplement.",
+		"log.clarifyProceedWithAssumptions": "Already clarified once but {n} must-know gap(s) remain → starting anyway (convergence rule: stop re-asking; the assumptions go into the PRD \"Assumptions & open questions\" section and are highlighted in the report)",
+		"log.triageResumed": "Resumed from checkpoint: keeping tier \"{mode}\" (resume does not re-run triage — no wasted call, no tier drift)",
+		"log.artifactContract": "Deliverable-shape contracts: judged shape \"{kind}\" → {n} mandatory AC(s) handed to the PRD (shape contracts, to prevent \"looks complete but cannot be installed\")",
+		"log.hostResearch": "Target host is not this repo's host (shape \"{kind}\" × host \"{host}\") → this host's contracts are NOT applied; the PRD must instead carry a \"Host contract research\" section (hard gate)",
+		"log.hostResearchOk": "Host contract research produced ({n} item(s)) → stored in journal.hostContract; later stages follow that host's own contract",
+		"log.hostResearchMissing": "PRD is missing the \"Host contract research\" section (this run targets another host framework — not researching its loading contract first is a gamble) → stage failed, retrying",
+		"log.installEnv": "This machine's install environment (probed at run start): profile \"{profile}\" · dir {dir} · dsh on PATH: {cli} (no hardcoded paths — varies per user environment)",
+		"log.installEnvUnknown": "Install environment probe FAILED (profile \"{profile}\" · dir {dir}) → the PRD will require the main agent to ASK THE USER for the profile location; never invent a path",
+		"cancelSource.ui": "workbench button (human click)",
+		"cancelSource.tool": "model tool teamflow_cancel",
+		"cancelSource.unknown": "not recorded (legacy run)",
+		"log.cancelRequested": "Stop request received (source: {source}) — takes effect at the next stage boundary, then finalizes as cancelled",
 		"report.relay": "If the user is present, relay the key points above briefly; if unattended, just record them — no long reply needed.",
 		"report.notice": "Team R&D pipeline {status} (runId={id})",
 		"report.status.completed": "✅ Completed",
@@ -763,6 +873,7 @@ const PIPELINE_DICT = {
 		"state.acIndex": "- AC index ({n}): {list}",
 		"state.modules": "- Modules ({n}): {list}",
 		"state.verifyScripts": "- Verify scripts: {list}",
+		"state.artifactContracts": "- Deliverable-shape contracts (shape: {kind}, {n} item(s)) — each is an **executable criterion**; QA/acceptance must verify every one and record command+result in the artifact. Anything impossible in this environment (e.g. requires a host restart) MUST go into the manual-test checklist — never silently skip:\n{list}",
 		"state.prdSummary": "- PRD summary: {summary}",
 		"state.techSummary": "- Technical design summary: {summary}",
 		"state.qaSummary": "- QA summary: {summary}",
@@ -828,6 +939,7 @@ const PIPELINE_DICT = {
 		"doc.archDeviationQ": "\"deviates from blueprint / duplicated impl / should-have-extracted\"",
 		"doc.engConstraints": "Engineering constraints",
 		"doc.finalCommit": "one consolidated commit",
+		"doc.assumptionsQ": "Assumptions & open questions",
 		"doc.noRevisionTable": "**No revision table, no version fields like \"Version: vX.Y / Status: in progress\"**",
 		"qa.fixSummaryQ": "\"truth judgment + fix\" or \"false-positive evidence\"",
 		"doc.statusChain": "todo -> in progress -> testable -> testing -> pending acceptance -> accepted",
@@ -855,7 +967,14 @@ const TOOLS_DICT = {
 	zh: {
 		"tool.replyLang": "【回复语言】用中文回复用户（本会话的界面语言是中文）。",
 		"tool.start.decision": "【分支决策】{question}\n{options}\n（也可自定义输入）——请询问用户选择，确认后把所选选项的 value 作为 branchPolicy 重新调用 teamflow_start（如 'new'/'keep'；脏工作区选项可拆为 branchPolicy + preAction 组合），自定义分支名则传 branchName。",
-		"tool.start.needsConfirm": "【需求确认】{question}\n{note}——请按此询问用户后再决定。",
+		"tool.start.gitDecision": "【改动存档决策】{question}\n{options}\n——**建议用 ask_user_question 呈现**（把选项转成点选项，另加\"其他\"兜底），问句用自然语言（开启=这次运行的改动会单独存档、可撤销、能看清改了什么；不开启=改动直接写入文件夹，之后无法一键撤销）。确认后把所选 value 重新调用 teamflow_start（init → branchPolicy=\"new\" + preAction=\"init\"；keep → branchPolicy=\"keep\" + preAction=\"keep-nogit\"）。",
+		"tool.start.gitDecisionNote": "{question}\n{options}\n{note}",
+		"tool.start.gitDecisionDanger": "【改动存档决策】{question}\n{options}\n——**建议用 ask_user_question 呈现**（点选项 + \"其他\"兜底）。请向用户说明原因（这个位置太靠根/太特殊，开启存档会波及大量无关文件，已被系统禁止），并建议把项目放进一个单独的文件夹后重新运行。确认后把所选 value（keep → branchPolicy=\"keep\" + preAction=\"keep-nogit\"）重新调用 teamflow_start。",
+		"tool.start.needsConfirm": "【需求确认】{question}\n{note}——**建议用 ask_user_question 呈现**（点选项 + \"其他\"兜底），请按此询问用户后再决定。",
+		"tool.start.needsClarification": "【需求澄清】这条消息还不足以开工（意图：{intent}）——**没有启动流水线**，也没有创建任何 run。请把每个 blocker 作为**一题 ask_user_question** 问用户（题干=question，选项=readings 里的互斥读法 + \"其他\"兜底），拿到全部答复后**保留原始 requirement 不变**、把答复放进 requirementSupplement 重新调用 teamflow_start。不要自行替用户假设后直接重调（这正是要拦的行为）。",
+		"tool.start.blockerReadings": "两种读法",
+		"tool.start.blockerChanges": "影响面",
+		"tool.start.blockerRework": "猜错的代价",
 		"tool.start.started": "团队研发流水线已启动（runId={runId}，{status}），正在后台执行。【重要】你现在停手：不要自行读取/修改代码实现该需求，不要重复跑测试验证——实现、QA、汇报由流水线各阶段完成。你只需告知用户流水线已启动，等待流水线完成后的官方完成汇报，再向用户转述结果。可用 teamflow_status 查询进度/阶段 token；backlog 已持久化到 $DSH_HOME/teamflow。\n【回复语言】用中文回复用户。",
 		"tool.start.paused": "当前会话已暂停 teamflow。如需恢复，调用 teamflow_resume_session；或直接写代码。",
 		"tool.start.noTeam": "请先通过输入框旁的 🏭 按钮选择团队，再发送需求消息。未选团队时不走 teamflow。",
@@ -877,6 +996,13 @@ const TOOLS_DICT = {
 		"branch.opt.stashNewChild": "stash 现有改动后新建子分支开发",
 		"branch.opt.commitNewChild": "提交现有改动后新建子分支开发",
 		"branch.decisionNote": "选项之外可自定义输入（如指定分支名）。确认选择后，请以 teamflow_start 的 branchPolicy（回传所选选项 value，如 new/keep）与 branchName/preAction/commitMessage 参数重新调用本工具。",
+		"git.q.noRepo": "这个文件夹（{path}）还没有开启「改动存档」。开启后：本次运行的改动会单独存成一档，随时可以整体撤销，也能清楚看到这次改了什么；不开启：改动会直接写入文件夹，之后无法一键撤销。要开启吗？",
+		"git.opt.init": "开启改动存档（推荐）——将初始化版本档案{baseline}，然后开始运行",
+		"git.opt.initBaseline": "，并把文件夹里现有的 {n} 个文件记录为初始状态",
+		"git.opt.initNoBaseline": "（该文件夹内容较多，只开启存档、不记录现有内容为初始状态）",
+		"git.opt.keep": "不开启，直接修改（本次运行的改动将无法一键撤销，也不会记录改了什么）",
+		"git.q.danger": "这个位置（{path}）不适合开启「改动存档」——它太靠近磁盘根目录或系统目录，开启会波及大量与本项目无关的文件，已被系统禁止。",
+		"git.opt.keepOnly": "不开启，直接修改（建议：把项目放进一个单独的文件夹后重新运行，即可开启存档）",
 		"tool.status.reminder": "流水线仍在后台执行：不要自行改代码实现该需求或重复跑验证，等待完成汇报。",
 		"tool.merge.command": "请用户在项目目录执行以下命令完成合回（合回后可 git branch -d {branch} 清理特性分支）：\ngit checkout main && git merge --no-ff {branch}",
 		"tool.merge.kept": "已标记暂不合回：特性分支 {branch} 保留，后续可随时调用 teamflow_merge 合回",
@@ -893,7 +1019,7 @@ const TOOLS_DICT = {
 		"tool.cancel.fail": "取消失败",
 		"tool.resume.ok": "流水线 {runId} 已从断点「{phase}」续跑",
 		"tool.resume.fail": "续跑失败：{error}",
-		"tool.ctx.team": "[TeamFlow 上下文] 用户已选择「{icon} {name}」团队。只有收到明确的开发需求（新功能/迭代/重构/bug修复/代码改动请求）时才调用 teamflow_start 并指定 teamId=\"{teamId}\"，requirement 参数忠实转写用户原话即可（不要自行扩写、不要臆造文件路径或技术细节）。收到反馈、讨论、闲聊、UI 意见等非开发请求时，不要调用 teamflow_start，直接正常回复。调用 teamflow_start 之后：流水线在后台执行，你不要再自行读取/修改代码实现该需求，也不要重复跑测试验证——只需告知用户流水线已启动，等待流水线的完成汇报后再答复用户。【回复语言】用中文回复用户（本会话界面语言为中文）。",
+		"tool.ctx.team": "[TeamFlow 上下文] 用户已选择「{icon} {name}」团队。只有收到明确的开发需求（新功能/迭代/重构/bug修复/代码改动请求）时才调用 teamflow_start 并指定 teamId=\"{teamId}\"，requirement 参数忠实转写用户原话即可（不要自行扩写、不要臆造文件路径或技术细节）。收到反馈、讨论、闲聊、UI 意见等非开发请求时，不要调用 teamflow_start，直接正常回复。【需求不明确就先澄清，不要抢跑】需求只是探索/笼统时（如「我想做个 X」「帮我搞点 Y」），先跟用户对齐：给 2–4 个方向候选（每个一句话说明它做什么、什么场合用），只问**无法自查、答错就要返工**的关键点；能从代码/文档自己查到的不问。【澄清完必须回到流水线】对齐后**务必**调用 teamflow_start 开工：requirement 保留用户原话，澄清得到的补充说明放进 requirementSupplement——不要聊完就停在对话里不动手。若 teamflow_start 返回 needs-clarification，按它列出的 blockers 继续问用户，再把答复放进 requirementSupplement 重新调用；**不要自行替用户假设后直接重调**。调用 teamflow_start 之后：流水线在后台执行，你不要再自行读取/修改代码实现该需求，也不要重复跑测试验证——只需告知用户流水线已启动，等待流水线的完成汇报后再答复用户。【回复语言】用中文回复用户（本会话界面语言为中文）。",
 		"err.tool.missingKindId": "缺少 kind/id",
 		"err.tool.missingKindIdTo": "缺少 kind/id/to",
 		"err.tool.missingAssign": "缺少 kind/id/role/assignee",
@@ -932,7 +1058,14 @@ const TOOLS_DICT = {
 	en: {
 		"tool.replyLang": "[Reply language] Reply to the user in English (this session is running with the English UI language).",
 		"tool.start.decision": "[Branch decision] {question}\n{options}\n(custom input is allowed too) — ask the user to choose, then call teamflow_start again passing the chosen option value as branchPolicy (e.g. 'new'/'keep'; dirty-workspace options can be split into branchPolicy + preAction), or pass branchName for a custom branch name.",
-		"tool.start.needsConfirm": "[Requirement confirmation] {question}\n{note} — ask the user accordingly before deciding.",
+		"tool.start.gitDecision": "[Change-archiving decision] {question}\n{options}\n— **present via ask_user_question** (turn the options into clickable choices plus an \"Other\" fallback), phrased in plain words (enabling = this run's changes are archived separately, can be undone as a whole, and you can see exactly what changed; not enabling = changes are written straight into the folder and cannot be undone in one step later). Then RE-CALL teamflow_start with the chosen value (init → branchPolicy=\"new\" + preAction=\"init\"; keep → branchPolicy=\"keep\" + preAction=\"keep-nogit\").",
+		"tool.start.gitDecisionNote": "{question}\n{options}\n{note}",
+		"tool.start.gitDecisionDanger": "[Change-archiving decision] {question}\n{options}\n— **present via ask_user_question** (clickable choices + \"Other\" fallback). Explain the reason (this location is too close to the disk root / a special directory; archiving here would sweep in many unrelated files and has been disallowed) and suggest putting the project in its own folder. Then RE-CALL teamflow_start with the chosen value (keep → branchPolicy=\"keep\" + preAction=\"keep-nogit\").",
+		"tool.start.needsConfirm": "[Requirement confirmation] {question}\n{note} — **present via ask_user_question** (clickable choices + \"Other\" fallback), then decide accordingly.",
+		"tool.start.needsClarification": "[Requirement clarification] This message is not settled enough to start (intent: {intent}) — **no pipeline was started and no run was created**. Ask each blocker as **one ask_user_question** (stem = question, choices = the competing readings + an \"Other\" fallback); once all answers are in, RE-CALL teamflow_start keeping the original requirement unchanged and putting the user's answers into requirementSupplement. Do not just assume on the user's behalf and re-call — that is exactly what this gate blocks.",
+		"tool.start.blockerReadings": "Competing readings",
+		"tool.start.blockerChanges": "What it changes",
+		"tool.start.blockerRework": "Cost if guessed wrong",
 		"tool.start.started": "The team R&D pipeline has started (runId={runId}, {status}) and runs in the background. [IMPORTANT] Stop now: do not read or modify code to implement this requirement yourself, and do not rerun tests for verification — implementation, QA and reporting are handled by the pipeline stages. Just tell the user the pipeline has started, wait for the official completion report, and relay its result. Use teamflow_status to check progress/stage tokens; the backlog is persisted under $DSH_HOME/teamflow.\n[Reply language] Reply to the user in English.",
 		"tool.start.paused": "teamflow is paused for the current session. Call teamflow_resume_session to resume, or just write the code directly.",
 		"tool.start.noTeam": "Pick a team via the 🏭 button next to the input box before sending the requirement. Without a team, teamflow is not used.",
@@ -954,6 +1087,13 @@ const TOOLS_DICT = {
 		"branch.opt.stashNewChild": "Stash the current changes and create a child branch",
 		"branch.opt.commitNewChild": "Commit the current changes and create a child branch",
 		"branch.decisionNote": "Custom input beyond these options is allowed (e.g. a specific branch name). After the user confirms, call this tool again with teamflow_start's branchPolicy (pass back the chosen option value, e.g. new/keep) plus branchName/preAction/commitMessage.",
+		"git.q.noRepo": "This folder ({path}) does not have change archiving enabled yet. With it on: this run's changes are archived separately, can be undone as a whole at any time, and you can see exactly what changed. Without it: changes are written straight into the folder and cannot be undone in one step later. Enable it?",
+		"git.opt.init": "Enable change archiving (recommended) — the version archive will be initialized{baseline}, then the run starts",
+		"git.opt.initBaseline": ", with the {n} existing files recorded as the initial state",
+		"git.opt.initNoBaseline": " (this folder has many files: archiving is enabled but existing content is NOT recorded as the initial state)",
+		"git.opt.keep": "Do not enable — modify directly (this run's changes cannot be undone in one step and will not be recorded)",
+		"git.q.danger": "This location ({path}) is not suitable for change archiving — it is too close to the disk root or a system directory; enabling it would sweep in many unrelated files and has been disallowed.",
+		"git.opt.keepOnly": "Do not enable — modify directly (suggestion: put the project in its own folder and run again, then archiving can be enabled)",
 		"tool.status.reminder": "The pipeline is still running in the background: do not modify code for this requirement or rerun verification yourself; wait for the completion report.",
 		"tool.merge.command": "Ask the user to run the following command in the project directory to complete the merge (afterwards they can delete the feature branch with git branch -d {branch}):\ngit checkout main && git merge --no-ff {branch}",
 		"tool.merge.kept": "Marked as not merged for now: feature branch {branch} is kept and teamflow_merge can be called later",
@@ -970,7 +1110,7 @@ const TOOLS_DICT = {
 		"tool.cancel.fail": "Cancel failed",
 		"tool.resume.ok": "Pipeline {runId} resumed from checkpoint \"{phase}\"",
 		"tool.resume.fail": "Resume failed: {error}",
-		"tool.ctx.team": "[TeamFlow context] The user selected the \"{icon} {name}\" team. Call teamflow_start with teamId=\"{teamId}\" only for a clear development requirement (new feature / iteration / refactor / bug fix / code change request), and transcribe the user's own words faithfully into the requirement argument (do not expand it, do not invent file paths or technical details). For feedback, discussion, small talk or UI opinions, do not call teamflow_start — just reply normally. After calling teamflow_start the pipeline runs in the background: do not read or modify code for this requirement and do not rerun verification yourself — just tell the user the pipeline has started and answer them after the pipeline reports completion. [Reply language] Reply to the user in English (this session uses the English UI language).",
+		"tool.ctx.team": "[TeamFlow context] The user selected the \"{icon} {name}\" team. Call teamflow_start with teamId=\"{teamId}\" only for a clear development requirement (new feature / iteration / refactor / bug fix / code change request), and transcribe the user's own words faithfully into the requirement argument (do not expand it, do not invent file paths or technical details). For feedback, discussion, small talk or UI opinions, do not call teamflow_start — just reply normally. [Clarify first, do not jump the gun] When the requirement is exploratory or vague (\"I want to build some kind of X\", \"help me make a Y\"), align with the user first: offer 2-4 concrete direction options (one line each on what it does and when it is used) and ask only the must-know points you cannot check yourself and whose wrong guess would cause rework; do not ask what you can find in the code or docs. [After clarifying, come back to the pipeline] Once aligned you MUST call teamflow_start to start the work: keep the user's own words in requirement and put the clarifications into requirementSupplement — do not stop at the conversation. If teamflow_start returns needs-clarification, keep asking the user about the blockers it lists and re-call with requirementSupplement; do not silently assume on the user's behalf. After calling teamflow_start the pipeline runs in the background: do not read or modify code for this requirement and do not rerun verification yourself — just tell the user the pipeline has started and answer them after the pipeline reports completion. [Reply language] Reply to the user in English (this session uses the English UI language).",
 		"err.tool.missingKindId": "missing kind/id",
 		"err.tool.missingKindIdTo": "missing kind/id/to",
 		"err.tool.missingAssign": "missing kind/id/role/assignee",
@@ -1097,6 +1237,94 @@ function extractText(blocks) {
 	if (!Array.isArray(blocks)) return "";
 	return blocks.filter((b) => b && b.type === "text" && typeof b.text === "string").map((b) => b.text).join("\n");
 }
+/** 从 `ctx.baseUrl`（宿主设为**当前 profile 目录**的 file:// URL）解析 profile。
+* 形态要求 `.../profiles/<name>/`（容忍尾斜杠与 cordis.yml 之类的文件名段）；非该形态返回 null。
+* 纯函数：`file://` 解码走 `decodeURIComponent`（路径含空格/中文时 URL 是编码过的）。 */
+function profileDirFromBaseUrl(baseUrl) {
+	const raw = String(baseUrl || "");
+	if (!raw) return null;
+	let p = raw;
+	if (/^file:\/\//i.test(p)) {
+		try {
+			p = decodeURIComponent(new URL(p).pathname);
+		} catch (e) {
+			return null;
+		}
+		if (/^\/[a-zA-Z]:/.test(p)) p = p.slice(1);
+	}
+	const norm = p.replace(/\\/g, "/");
+	const segs = norm.split("/").filter(Boolean);
+	let i = segs.lastIndexOf("profiles");
+	if (i < 0 || i + 1 >= segs.length) return null;
+	let end = segs.length;
+	if (end - i > 2 && /\.(ya?ml|json)$/i.test(segs[end - 1])) end -= 1;
+	if (end !== i + 2) return null;
+	const name = segs[i + 1];
+	if (!name) return null;
+	const isPosix = norm.startsWith("/");
+	const sep = isPosix ? "/" : "\\";
+	return {
+		home: (isPosix ? "/" : "") + segs.slice(0, i).join(sep),
+		profile: name,
+		dir: (isPosix ? "/" : "") + segs.slice(0, i + 2).join(sep)
+	};
+}
+/** 从插件模块路径反推 `$DSH_HOME/profiles/<name>`（纯函数，门禁可测）。
+* 接受 `.../profiles/<name>/node_modules/<pkg>[/lib/host.mjs]` 形态；非该形态返回 null。
+* ⚠️ 次源：`link:`/junction 安装下 `import.meta.url` 会解析到真实目标（源码目录）→ 返回 null，
+* 此时靠 {@link profileDirFromBaseUrl}（宿主给的权威锚点）兜住。 */
+function profileFromModulePath(modulePath) {
+	const raw = String(modulePath || "");
+	if (!raw) return null;
+	const norm = raw.replace(/\\/g, "/");
+	const segs = norm.split("/").filter(Boolean);
+	const i = segs.lastIndexOf("profiles");
+	if (i < 0 || i + 2 >= segs.length) return null;
+	const name = segs[i + 1];
+	if (segs[i + 2] !== "node_modules" || !name) return null;
+	const sep = norm.startsWith("/") ? "/" : "\\";
+	const homeBody = segs.slice(0, i).join(sep);
+	const home = (norm.startsWith("/") ? "/" : "") + homeBody;
+	return {
+		home,
+		profile: name,
+		dir: [
+			home,
+			"profiles",
+			name
+		].join(sep).replace(new RegExp(`\\${sep === "/" ? "/" : "\\\\"}+`, "g"), sep)
+	};
+}
+/** 探测本机安装环境。取值顺序（**主源是宿主权威锚点，不是环境变量**）：
+*  ① `baseUrl`（`ctx.baseUrl` = profile 目录）→ profile 名/目录/home 全齐，且不受 junction 影响；
+*  ② `modulePath`（插件自身文件路径）反推 —— `link:` 安装下会落空，作为次源；
+*  ③ `hintHome`（调用方给 `dshHome()`，**已有 `~/.dsh` 兜底**）只补 home；
+*  `ok` = **profile 名已知 且 目录为绝对路径**。刻意**不要求 `DSH_HOME`**：它不是"装了 dsh 就自带"
+*  （可选覆盖变量、`.env` 也设不了），默认安装下为 undefined，纳入判据会**误判失败**并把 PRD
+*  降级成"问用户"。要求绝对路径是因为相对目录照做不了（命令要在任意 cwd 下可执行）。
+*  纯函数（不碰进程/PATH；`hasCli` 由调用方探测）。 */
+function detectInstallEnv(opts) {
+	const hintHome = String(opts.dshHome || "").replace(/[\\/]+$/, "");
+	const fromUrl = profileDirFromBaseUrl(opts.baseUrl);
+	const fromPath = profileFromModulePath(opts.modulePath || "");
+	const src = fromUrl || fromPath;
+	const profile = src?.profile || "";
+	const home = src?.home || hintHome;
+	const sep = home.includes("/") && !home.includes("\\") ? "/" : "\\";
+	const profileDir = src?.dir || (profile && home ? `${home}${sep}profiles${sep}${profile}` : "");
+	return {
+		dshHome: home,
+		profile,
+		profileDir,
+		cliOnPath: opts.hasCli === true,
+		ok: !!profile && isAbsolutePath(profileDir)
+	};
+}
+/** 绝对路径判据（跨平台，纯字符串）：POSIX `/x`、Windows `C:\x`/`C:/x`、UNC `\\srv\share`。 */
+function isAbsolutePath(p) {
+	const s = String(p || "");
+	return /^\//.test(s) || /^[a-zA-Z]:[\\/]/.test(s) || /^\\\\/.test(s);
+}
 /** 从 dev/qaFix 回复中提取「验证证据」块（`[Verification evidence]` 行起，到 state 块/结尾止）。
 * dev 阶段无独立对抗校验（QA 有 QA-REPORT.md 结构化证据，dev 只有自述）——证据块是「可审计的
 * 具体自述」：命令+退出码+断言计数+失败行引用，可对照 logs/teamflow/<runId>/ 命令输出日志核实；
@@ -1308,6 +1536,46 @@ function judgeDeliverable(phase, text) {
 		length
 	};
 }
+const DOC_STAGE_FILES = {
+	prd: ["PRD.md", "TECH-CHANGE.md"],
+	design: ["DESIGN.md"],
+	tech: ["TECHNICAL.md", "TECH-CHANGE.md"],
+	qa: ["QA-REPORT.md"],
+	acceptance: ["ACCEPTANCE.md"]
+};
+/** 任务夹产物读取（单轨契约：文件即产物——QA/验收 host 只读文件，回复仅摘要）。
+* 缺失/空/读取异常返回 null（调用方决定硬失败或 journal 兜底）。`pipeline` 与 `runner` 共用。 */
+function artifactText(journal, fileName) {
+	const path = journal && journal.workspacePath && journal.runDocs ? `${journal.workspacePath}/${journal.runDocs}/${fileName}` : null;
+	if (!path) return null;
+	try {
+		if (!existsSync(path)) return null;
+		const t = readFileSync(path, "utf8").trim();
+		return t ? t : null;
+	} catch (e) {
+		return null;
+	}
+}
+/**
+* doc 类阶段的产物兜底：按 `DOC_STAGE_FILES` 取**最长**的一个候选文件（同一阶段可能有多种产物形态，
+* 如 tech 档 PRD 写 `TECH-CHANGE.md`）；无候选/文件缺失/未达下限 → null（绝不抛）。
+*/
+function stageDocText(journal, phase) {
+	const names = DOC_STAGE_FILES[phase];
+	if (!names || !names.length) return null;
+	let best = null;
+	for (const name of names) {
+		const text = artifactText(journal, name);
+		if (!text) continue;
+		const length = text.trim().length;
+		if (!best || length > best.length) best = {
+			name,
+			text,
+			length
+		};
+	}
+	return best;
+}
 /** 归一化：去 markdown 装饰、压平空白、小写（仅用于身份比较，不改原值）。 */
 function fpNorm(s) {
 	return String(s === null || s === void 0 ? "" : s).replace(/[`*]/g, "").replace(/\s+/g, " ").trim().toLowerCase();
@@ -1400,6 +1668,70 @@ function refusalHit(text) {
 		context: s.slice(start, end).replace(/\s+/g, " ").trim()
 	};
 }
+/**
+* 外部供应商不可用 vs 内容性失败（2026-09-17，实测驱动）。
+*
+* 背景：dddd 那条 run 在第一轮 01:37 连续 6 个 dev 阶段 `stopReason=error` → 快速重试两次 → 转人工；
+* 而**16 分钟后（01:53）同样的请求就成功了**——即那批失败是「供应商在一段时间窗内不可用」（限流/无额度/
+* 上游 5xx/超时），**与阶段内容无关**。旧行为把它当内容失败：快速失败、落 `failed + human`、让人误以为
+* 交付有问题。现在按错误文本分类（⚠️ **启发式**：宿主只给 `stopReason=error` + 错误文本，没有结构化错误码，
+* 故命中原文必须记日志以便日后核对）：
+*  - `external`：限流/额度/余额/上游不可用/超时/过载 → 走**长退避重试**；用尽仍失败 → 落可续跑中断态；
+*  - `content`：上下文耗尽/护栏/产出无效等 → 维持现状（不自动重试或按既有策略）；
+*  - `unknown`：未命中任何词 → 维持现状（按内容类处置，宁严勿松）。
+* `hint` 为可选的 outcome/summary 文本，一并参与匹配（错误细节可能在 stage.summary 里）。
+*/
+function classifyExternalFailure(text, hint) {
+	const s = `${String(text || "")} ${String(hint || "")}`;
+	if (!s.trim()) return "unknown";
+	if (/(?:\b429\b|\b402\b|rate[ _-]?limit|too many requests|insufficient[ _-]?(?:balance|quota|funds)|quota|exceeded[ _-]?(?:your[ _-]?)?(?:quota|limit|rate)|no[ _-]?(?:available[ _-]?)?(?:quota|balance|credit)|out of credit|billing|payment required|overload|temporarily unavailable|service unavailable|\b50[234]\b|upstream|gateway timeout|\b52[0-9]\b|timeout|timed out|ETIMEDOUT|ECONNRESET|ECONNREFUSED|socket hang up|fetch failed|network error|限流|限速|频率限制|请求过于频繁|额度|配额|余额不足|欠费|无额度|暂时不可用|服务不可用|上游不可用|超时|网络错误|连接被重置|过载|供应商)/i.test(s)) return "external";
+	if (/context[ _-]?(?:window|length)|too many tokens|maximum context|prompt is too long|上下文(?:长度|超限|耗尽)|护栏|degenerated|stalled|insufficient output|too short|产出过短/i.test(s)) return "content";
+	return "unknown";
+}
+/** 外部故障退避序列（毫秒）：30s → 60s → 120s → 240s（总等待上限 ≈ 7.5 分钟）。
+* 取值依据：dddd 实测窗口 ≈16 分钟（01:37 挂 → 01:53 恢复），故退避要能跨过几分钟的短窗口，
+* 又不至于让一条 run 无限期挂着（用尽后落**可续跑中断态**，窗口恢复后 resume 只补这一段）。 */
+const EXTERNAL_BACKOFF_MS = [
+	3e4,
+	6e4,
+	12e4,
+	24e4
+];
+/** 取第 n 次外部故障退避时长（n 从 1 起；超出序列 → null 表示退避用尽）。 */
+function externalBackoffMs(n) {
+	return EXTERNAL_BACKOFF_MS[n - 1] ?? null;
+}
+/** 工具结果文本（拼接 message.content 的 text 块）——签名与日志共用。 */
+function toolResultText(data) {
+	try {
+		const content = data?.message?.content;
+		if (!Array.isArray(content)) return "";
+		return content.map((c) => c && typeof c.text === "string" ? c.text : "").join("");
+	} catch (e) {
+		return "";
+	}
+}
+/**
+* 工具结果是否**失败**。首选结构化 `message.isError`（宿主 `tool/result` 自带，权威、不猜文本——
+* `packages/core/tools` 的 ToolExecutionResult）；缺该字段（老宿主/裁剪事件）时按 `Error`/`failed`
+* 前缀兜底，宁严勿松：只认明确失败。
+*/
+function isToolErrorResult(data) {
+	const msg = data?.message;
+	if (msg && typeof msg.isError === "boolean") return msg.isError;
+	return /^\s*(?:error|failed|fatal)\b/i.test(toolResultText(data));
+}
+/** 失败指纹：工具名 + 归一化错误前 160 字符。同一指纹反复出现 = 同一个坏环境（而非模型措辞波动）。 */
+function toolFailureSignature(tool, text) {
+	return `${String(tool || "").trim().toLowerCase() || "tool"}::${String(text || "").replace(/\s+/g, " ").trim().slice(0, 160)}`;
+}
+/** 失败次数 → 护栏动作（纯函数，阈值可测）：none = 继续观察；warn = 提醒模型停手；abort = 中止本阶段。 */
+function toolFailureAction(count, warnAt, abortAt) {
+	const n = typeof count === "number" && Number.isFinite(count) ? count : 0;
+	if (n >= abortAt) return "abort";
+	if (n >= warnAt) return "warn";
+	return "none";
+}
 /** 重试诊断包：上一轮失败详情回灌进重试 prompt（盲试 → 带因重试）。
 * 失败分类/详情/护栏原因取自 stage；产出尾部截断 1000 字符供自查修正。
 * `locale` 为**尾参可选**（缺省/`zh` → 现状中文**逐字不变**；`en` → 新增英文文案，AC-3④）。
@@ -1431,16 +1763,25 @@ function buildRetryDiagnostic(attempt, stage, locale) {
 * 反向护栏（漏报实锤 2026-09-03）：模型写「❌ 不通过」但漏写「验收结论：」前缀 → accLine 为空 →
 * 旧实现落回默认 accepted（最乐观默认值，质量门禁漏报=假交付）。现改为 **找不到结论行 → needs-human**
 * （宁严勿松：误拦截=人工看一眼，误放行=假交付；📝 全文命中与架构红词仍优先于该默认）。
+* ⚠️ 结论行取值（2026-09-17 实测 bug，`tf-mu4bve7t-duux2k`）：旧实现 `find(第一个含「验收结论」的行)` 会被
+* **章节标题**蒙住 —— 真实产物里 `## 1. 验收结论摘要`（含"验收结论"四字）排在真正的结论行
+* `验收结论：✅ 通过` 之前 → 抓到标题行 → 四档词全落空 → **明明通过却判 needs-human**。
+* 现规则：**优先取字面量模板行**（行首 `验收结论：` / `Acceptance verdict:` / `Overall verdict:`，
+* 允许 `## ` 前缀与列表符），且取**最后一个**（报告末尾的"结论"章才是终判）；仍找不到时，回退到
+* **最后一个非标题、含结论词的行**（避免"只写 ❌ 不通过、漏写前缀"的漏报变体）。
 * @param {unknown} text 验收报告全文
 * @returns {'accepted'|'rework'|'reject'|'needs-human'}
 */
 function parseAcceptanceVerdict(text) {
 	const acc = String(text || "");
-	const accLine = (acc.split("\n").find((l) => /验收结论|整体结论|Acceptance verdict|Overall verdict/i.test(l)) || "").replace(/\|.*/, "").trim();
+	const lines = acc.split("\n");
+	const literal = /^\s*(?:#{1,6}\s*|[-*+]\s*)?(?:验收结论|整体结论|Acceptance verdict|Overall verdict)\s*[:：]/i;
+	const literalHits = lines.filter((l) => literal.test(l));
+	const accLine = literalHits.length ? literalHits[literalHits.length - 1].replace(/\|.*/, "").trim() : "";
 	const hasArchRedFlag = /重复实现|重复适配|偏离蓝图|未按蓝图|该拆未拆|该抽象未抽象|破坏既有结构|结构性.*问题|架构(打回|需重构)|需.*返工|返工.*项.*(存在|仍)|仍.*(返工|重构)/.test(acc);
 	const archNegated = /无返工|无.*返工|不返工|无架构打回|无.*打回|非漂移|无.*重复|无.*偏离|无.*抽象.*问题|无.*蓝图.*问题|架构一致性.*(PASS|良好|达标|通过|无问题)|M3.*(PASS|通过|达标)|架构.*(达标|无问题|良好)/.test(acc);
 	if (hasArchRedFlag && !archNegated) return "rework";
-	if (/📝\s*需求不适用|📝\s*(?:Not applicable|N\/A)/i.test(acc)) return "reject";
+	if (acc.split("\n").map((l) => String(l).replace(/^[\s#*\-+>|]+/, "").replace(/^(?:验收结论|整体结论|结论|判定|Acceptance verdict|Overall verdict|Conclusion|Verdict)\s*[:：]\s*/i, "")).some((l) => /^📝\s*(?:需求不适用|Not applicable|N\/A)/i.test(l))) return "reject";
 	if (/不通过|需返工|未通过|\b(?:fail|failed|not pass|not passed)\b/i.test(accLine) && !/无\s*不通过|未发现不通过|未出现不通过|no failed|no failures/i.test(accLine)) {
 		if (/✅\s*通过|(?<!not\s)\bpass(?:ed)?\b|⚠️\s*conditional\s+pass/i.test(accLine)) return "accepted";
 		return "rework";
@@ -1523,6 +1864,302 @@ function extractBlueprint(text, locale) {
 		render: `${en ? "[Architecture blueprint (produced by the tech stage; implement on the existing architecture, do not rebuild)]" : "【架构蓝图（tech 阶段产出，dev 须在既有架构上实现，勿重建）】"}\n${parts.join("\n")}`
 	};
 }
+/**
+* 并发池：按 max 个 worker 消费 items，返回**同序**结果。
+*
+* `shouldStop`（可选）：取下一个任务**之前**判定，返回 true 即停止取新任务（已在飞的照常等它收尾），
+* 未取到的条目结果保持 `undefined`——**调用方必须容忍空位**（现有调用点一律 `r && …` 过滤）。
+*
+* 为什么要有它（2026-09-16 用户实测）：取消后被 dispose 的任务返回 null，worker 拿到结果会立刻
+* `cursor++` 取下一个任务并启动新子代理——用户按了「中断」，界面上却又冒出一个「开发中」
+* （取消变成了队列补位）。放在 util（无宿主私有依赖）而非 runner，是为了让行为级测试能直接喂 items 断言。
+*/
+async function runPool(items, max, fn, shouldStop) {
+	const results = new Array(items.length);
+	let cursor = 0;
+	const workers = Array.from({ length: Math.min(Math.max(1, max), items.length) }, async () => {
+		while (cursor < items.length) {
+			if (shouldStop && shouldStop()) return;
+			const i = cursor++;
+			results[i] = await fn(items[i], i);
+		}
+	});
+	await Promise.all(workers);
+	return results;
+}
+/**
+* 从产物文本里摘出「假设 / 待澄清」小节（2026-09-16 需求澄清闸门 Phase 1）。
+*
+* **行式解析而不是单条正则**——实测踩过两个坑（本批真 bug，实锤 run tf-mu34afd2-wcjaw1）：
+*  ① 产物标题常带编号/附录前缀（`## 9. 假设与待澄清`；本仓 PRD 惯例就是编号标题），
+*     `^#{1,6}\s*(假设|…)` 这类写法直接匹配不到 → 明明写了段落却误报「契约未兑现」；
+*  ② 正文用 `([\s\S]*?)(?=\n#{1,6}|\s*$)` 懒匹配时，`\s*$` 分支会在标题后立刻命中 → 摘出空串。
+* 规则：命中标题后一直取到下一个标题；`trim()` 后为空视为未记录（返回 null）。
+*/
+function extractAssumptionsSection(doc) {
+	const text = String(doc || "");
+	if (!text.trim()) return null;
+	const lines = text.split(/\r?\n/);
+	const head = /^#{1,6}\s*(?:[0-9]+[.、)]\s*)?(?:附录\s*[0-9A-Za-z]*[.、)]?\s*)?(假设|待澄清|开放问题|assumptions|open questions?)/i;
+	const isHead = (l) => /^#{1,6}\s/.test(l);
+	for (let i = 0; i < lines.length; i++) {
+		if (!head.test(lines[i])) continue;
+		const out = [];
+		for (let k = i + 1; k < lines.length; k++) {
+			if (isHead(lines[k])) break;
+			out.push(lines[k]);
+		}
+		return out.join("\n").trim() || null;
+	}
+	return null;
+}
+/**
+* 「宿主契约调研」小节的判定（2026-09-18 用户实锤新增，**硬门禁**）。
+*
+* 由来：teamflow 寄生在 dsh 上，我们对 dsh 的插件契约有权威（同仓样本可核实）；但用户明确说过
+* 「用户拿我们去干活，不只是干开发 dsh 插件」——开发 openclaw / hermes / pi 插件时，**dsh 的契约
+* 一条都不适用**（那些框架有各自的加载/注册机制），套过去就是反向返工。而我们**对它们没有权威**，
+* 凭记忆写字段名正是 dddd 事故的成因。
+*
+* 故规则：`plugin-*` 且目标宿主不是 dsh → PRD **必须**含「宿主契约调研」段（写清目标宿主是哪个、
+* 从哪儿读到它的插件加载契约、核实到哪些具体要求）。用户原话：「不然你上下文都不知道你开发个啥出来
+* 都不知道」——所以这条**偏硬**：缺失 → PRD 阶段失败（走重试，附诊断），而不是只记 warn。
+*
+* 解析方式与 `extractAssumptionsSection` 同源（行式 + 容错编号标题）：产物标题惯例带编号
+* （`## 7. 宿主契约调研`），单条正则匹配不到会误判"契约未兑现"（该坑已踩过一次）。
+*/
+function extractHostResearchSection(doc) {
+	const text = String(doc || "");
+	if (!text.trim()) return null;
+	const lines = text.split(/\r?\n/);
+	const head = /^#{1,6}\s*(?:[0-9]+[.、)]\s*)?(?:附录\s*[0-9A-Za-z]*[.、)]?\s*)?(宿主契约调研|宿主调研|host contract research|host research)/i;
+	const isHead = (l) => /^#{1,6}\s/.test(l);
+	for (let i = 0; i < lines.length; i++) {
+		if (!head.test(lines[i])) continue;
+		const out = [];
+		for (let k = i + 1; k < lines.length; k++) {
+			if (isHead(lines[k])) break;
+			out.push(lines[k]);
+		}
+		return out.join("\n").trim() || null;
+	}
+	return null;
+}
+/** dev 阶段 label 的「开发 · 」前缀（zh 存量兼容 + en）。 */
+const DEV_TITLE_PREFIX_LOCAL = /^(?:开发|Dev) · /;
+/** 重试/补跑后缀（zh + en：en 侧必须覆盖词典 `dev.taskRetry` 的实际产出 `(attempt N)`）。 */
+const RETRY_SUFFIX_LOCAL = /(?:（(?:第 \d+ 次重试|补跑)）| \((?:retry \d+|attempt \d+|follow-up run)\))$/;
+/**
+* 任务级聚合（journal 驱动）：有 done stage = 该任务已成功（历史失败尝试不翻案）。
+*
+* **只认 `taskIds`，不认 title**（2026-09-18 二次修正）：
+* 一个 stage 可能同时承载多个任务（合并执行），逐 id 记账 → 合并执行过的任务**各自**命中已做。
+*
+* 关于存量（升级前只写了 title 的 stage）：**不在本函数里做 title 回退**——那会形成
+* 「id / title 两套命名空间」，实测必然全 Miss（补跑 8 个而非 2 个）。正确做法是调用方先跑
+* `backfillDevTaskIds` 给存量 stage 补算 id（用蓝图 title 结构化匹配），之后本函数只看到 id。
+* **判定逻辑因此始终只有一个键空间**，不做"双键匹配"、不切分 title。
+*/
+function devTaskStatuses(stages) {
+	const m = /* @__PURE__ */ new Map();
+	for (const s of stages || []) {
+		const ids = Array.isArray(s.taskIds) ? s.taskIds.filter((x) => typeof x === "string" && !!x.trim()) : [];
+		for (const key of ids) {
+			const cur = m.get(key) || {
+				done: false,
+				lastStatus: null,
+				lastSeq: -1
+			};
+			if ((s.seq || 0) > cur.lastSeq) {
+				cur.lastSeq = s.seq || 0;
+				cur.lastStatus = s.status || null;
+			}
+			if (s.status === "done") cur.done = true;
+			m.set(key, cur);
+		}
+	}
+	return m;
+}
+/** dev 任务身份生成（host 侧，按定义顺序）：同一份蓝图必然产生同一组 id，故 resume 可稳定对齐。
+*  蓝图落盘后不变 → id 稳定；title 会因合并/措辞变化 → 故不可作身份（见上方注释）。 */
+function devTaskIdAt(index) {
+	return `dt-${index + 1}`;
+}
+/**
+* **存量 stage 的 id 补算**（2026-09-18 二次修正，勿回退）。
+*
+* 为什么必须有：升级前的 stage 只写了 `taskKey`（title），没有 `taskIds`。若判定只认 id，
+* 这些 stage 就成了"看不见的历史"——实测 probe-cache `tf-mu6tb281`：纯 title 判定补跑 2 个（正确），
+* 而"只认 id + 让存量回退 title"两头不靠 → **补跑 8 个**（灾难：T0/T1/T2 明明 done 却全重跑）。
+*
+* 做法：**用蓝图自己的 title 去匹配 stage 的 taskKey**，命中即该 stage 承载了这个任务。
+* 这是**结构化 → 文本**的比对（拿确定性数据去匹配），不是"按分隔符切分 title"那种反解——
+* 后者是拿文本长相当身份，同型错误已犯过两次（per-plugin 正则、固定 .gitignore 词表），明确禁止。
+*
+* 合并执行的 stage（`taskKey = "T0 … + T6 … + T7 …"`）会命中**多个**任务 title → 补算出多个 id，
+* 与"合并时 taskIds 数组累加"的新逻辑完全同构：这一类 stage 承载的几个任务**各自**记已做。
+*
+* 补算结果写回 stage（`taskIds`），下次直接读——**存量自愈一次**，不是每次都重算。
+*
+* @param stages 待补算的 dev stage（会被就地修改：补上 `taskIds`）
+* @param defs   任务定义（含 id + title，来自 `buildDevTaskDefs`，与本次 run 同源）
+* @returns 补算到的 stage 数（诊断/测试用）
+*/
+function backfillDevTaskIds(stages, defs) {
+	if (!Array.isArray(stages) || !Array.isArray(defs) || !defs.length) return 0;
+	let patched = 0;
+	for (const s of stages) {
+		if (Array.isArray(s.taskIds) && s.taskIds.length) continue;
+		const key = String(s.taskKey || String(s.label || "").replace(DEV_TITLE_PREFIX_LOCAL, "").replace(RETRY_SUFFIX_LOCAL, "").trim());
+		if (!key) continue;
+		const ids = defs.filter((d) => String(d.title || "").trim() && key.includes(String(d.title).trim())).map((d) => d.id);
+		if (!ids.length) continue;
+		s.taskIds = ids;
+		patched++;
+	}
+	return patched;
+}
+/** L1：硬拒绝初始化的路径（只做廉价字符串/路径判定，不扫盘）。 */
+function isDangerousVcsRoot(dir, home) {
+	const p = String(dir || "").replace(/\//g, "\\").replace(/[\\/]+$/, "");
+	if (!p) return true;
+	if (/^[A-Za-z]:$/.test(p)) return true;
+	const seg = (x) => String(x || "").replace(/\//g, "\\").replace(/[\\/]+$/, "").split("\\").filter(Boolean);
+	const ps = seg(p);
+	if (home) {
+		const hs = seg(home);
+		if (hs.length && ps.length <= hs.length && hs.slice(0, ps.length).join("\\").toLowerCase() === ps.join("\\").toLowerCase()) return true;
+	}
+	const sys = [
+		"windows",
+		"program files",
+		"program files (x86)",
+		"programdata",
+		"system volume information",
+		"$recycle.bin"
+	];
+	if (ps.some((s) => sys.indexOf(s.toLowerCase()) !== -1)) return true;
+	if (ps[0] && /^[A-Za-z]:$/.test(ps[0]) && ps.length <= 2) return true;
+	return false;
+}
+/** L2：有界采样统计目录规模（防"基线提交扫全盘"）。超过任一阈值即提前返回 true（不再继续数）。
+*  `maxFiles`/`maxBytes` 阈值由调用方传（默认 1000 个文件 / 100 MB）；`budgetMs` 限制采样时长（默认 1s）。 */
+function dirTooLargeForBaseline(dir, maxFiles = 1e3, maxBytes = 104857600, budgetMs = 1e3) {
+	let files = 0, bytes = 0;
+	const start = Date.now();
+	const walk = (d, depth) => {
+		if (depth > 12 || Date.now() - start > budgetMs) return files > maxFiles || bytes > maxBytes;
+		let es;
+		try {
+			es = readdirSync(d, { withFileTypes: true });
+		} catch (e) {
+			return false;
+		}
+		for (const e of es) {
+			if (e.name === ".git" || e.name === "node_modules") continue;
+			const p = d + "\\" + e.name;
+			if (e.isDirectory()) {
+				if (walk(p, depth + 1)) return true;
+			} else {
+				files++;
+				try {
+					bytes += statSync(p).size;
+				} catch (e2) {}
+				if (files > maxFiles || bytes > maxBytes) return true;
+			}
+		}
+		return false;
+	};
+	try {
+		if (!existsSync(dir)) return true;
+		return walk(dir, 0);
+	} catch (e) {
+		return true;
+	}
+}
+//#endregion
+//#region host/core/locale.ts
+/**
+* dsh-plugin-teamflow core — 运行期语言源（客户端推送槽 + 宿主 settings 只读端口）。
+*
+* 为什么单独一层：语言「从哪来」必须是**唯一读取点**，否则每个消费方各自读 settings /
+* 自建浏览器语言缓存，就会出现 PRD 明令禁止的并行机制与「同 run 语言漂移」。
+* 本文件只回答两个问题：
+*   1. 当前界面语言是什么（`ambientLocale()`）——`teamflow_*` 工具返回/Remote 错误用；
+*   2. 新 run 起跑时快照成什么（`newRunLocale()`）——写进 journal.locale，之后一律读快照。
+*
+* 三个来源（优先级同 AC-1）：
+* - **客户端推送**（`noteClientLocale`）：浏览器当前语言（含系统探测结果），经既有 Remote 面
+*   `teamflow/setLocale` 推上来。用户没在宿主显式选过语言时只有这条通道能拿到真实语言
+*   （宿主 `locale.preference` 仅在用户显式选择过时才有值）。
+* - **宿主 settings 只读端口**（`setSettingsPort`）：`ctx.get('settings').get('locale').preference`，
+*   由 `@deepseek-ai/dsh-client-locale` 的 host face 注册。host 只读不写、未注册/服务缺失一律
+*   null（全 try/catch，AC-10：解析链任一级缺失都不报错、不阻塞）。
+* - **`en`**：兜底（AC-1③）。
+*
+* 内存单槽、last-write-wins、不落盘：语言是界面态，重启后由客户端重新推送（持久化属宿主职责）。
+*/
+/** 客户端推送的语言（最近一次，内存单槽）。 */
+let clientPushed = null;
+/** 客户端推送语言：可解析即写入，非法即清空（非法值不保留旧值——避免「推了个 fr，host 还在用上次的 en」）。 */
+function noteClientLocale(v) {
+	const parsed = parseLocale(v);
+	clientPushed = parsed;
+	return parsed !== null;
+}
+/** 宿主 settings 只读端口（由门面注入；缺省 null = 宿主未提供）。 */
+let settingsPort = null;
+/** 注入宿主 settings 只读端口（门面构造时调用；宿主缺 settings 服务时传 null）。 */
+function setSettingsPort(fn) {
+	settingsPort = typeof fn === "function" ? fn : null;
+}
+/** 宿主用户显式选择的语言（读不到/服务缺失/异常 → null，永不抛出）。 */
+function hostPreference() {
+	if (!settingsPort) return null;
+	try {
+		return parseLocale(settingsPort());
+	} catch (e) {
+		return null;
+	}
+}
+/** 当前界面语言（AC-1 解析链；工具返回/Remote 错误用）。 */
+function ambientLocale() {
+	try {
+		return resolveLocale({
+			client: clientPushed,
+			host: hostPreference()
+		});
+	} catch (e) {
+		return "en";
+	}
+}
+/** 新 run 起跑时解析一次（写进 journal.locale 的快照值；AC-2）。 */
+function newRunLocale() {
+	return ambientLocale();
+}
+/**
+* 读 run 的语言快照（纯读、绝不重解析；AC-2）。
+* 历史 journal（升级前无 locale 字段）按 zh 处理——那些 run 的存量文案本就是中文，
+* 用 en 去渲染会与已落盘内容割裂（resumeRun 会补写该字段，见 core/pipeline.ts）。
+*/
+function runLocaleOf(journal) {
+	const j = journal;
+	return parseLocale(j && j.locale) || "zh";
+}
+/**
+* 缺 locale 字段时的快照取值（QA-1：resume 绝不按当前界面语言重解析）。
+* - 新 run：环境语言（AC-1 解析链）；
+* - resume/续跑：一律 `zh`——历史 journal 的存量文案本就是中文，用界面语言补写会造成同一 run 内中英混排
+*   （PRD §4.1「已落库文本保留生成时语言」）。与 `runLocaleOf` 的缺省口径严格一致。
+*/
+function localeForMissingSnapshot(resume) {
+	return resume ? "zh" : newRunLocale();
+}
+/** 读 state 注入块上下文里的语言（`state.__runCtx.locale`，由 pipeline 按快照写入）。 */
+function runCtxLocale(state) {
+	const s = state;
+	return parseLocale(s && s.__runCtx && s.__runCtx.locale) || "zh";
+}
 //#endregion
 //#region host/core/context.ts
 /**
@@ -1548,14 +2185,70 @@ function setRuntime(agents, subagents, workspaceRegistry, agentDefaultModel, llm
 function setSessionProjections(projections) {
 	runtime.sessionProjections = projections;
 }
+/**
+* **宿主锚点**（2026-09-21）：TeamflowService 构造时把 `ctx.baseUrl`（= 当前 profile 目录的
+* file:// URL，宿主在挂载插件树**之前**设好）与 `dshHomePath` 记下来，供 pipeline 起跑时探测本机
+* 安装环境。**为何不由 pipeline 自己拿**：pipeline 是纯编排模块，没有 ctx；且它链到宿主私有 peer
+* （report→@deepseek-ai/dsh-llm），Behavior 测试取不到 → 锚点经此单例搬运（与 setRuntime 同款，
+* 单向依赖不破）。
+* ⚠️ 不存 `process.env.DSH_HOME`：它**不是"装了 dsh 就自带"**（可选覆盖变量，装 dsh 不写它，
+* `.env` 也设不了 DSH_ 前缀），默认安装下为 undefined。baseUrl 才是权威事实。
+*/
+const installCtx = {};
+function setInstallCtx(ctx) {
+	const c = ctx;
+	const url = c && typeof c.baseUrl === "string" ? c.baseUrl : "";
+	if (url) installCtx.baseUrl = url;
+}
 /** 运行期 run 注册表（runId → Journal）。 */
 const runs = /* @__PURE__ */ new Map();
-/** 进行中的 stage 注册表（runId → { run, stage }），供取消/完成清理。 */
+/** 进行中的 stage 注册表（runId → `Map<stage, run>`）。**同一 run 可有多路并发子代理**（dev 并发池），
+*  故每 run 存的是 stage→handle 的表而不是单个 handle：旧形状（每 run 一个 `{run, stage}`，后启动的覆盖前一个）
+*  让取消只能停掉最后一路，兄弟继续跑到自然结束（2026-09-16 用户实测：「开发的多 agent 中断不了」）。 */
 const inFlight = /* @__PURE__ */ new Map();
+/** 登记一路在飞子代理（runAgent 拿到 handle 后调用）。 */
+function trackInFlight(runId, stage, run) {
+	if (!runId || !stage) return;
+	let m = inFlight.get(runId);
+	if (!m) {
+		m = /* @__PURE__ */ new Map();
+		inFlight.set(runId, m);
+	}
+	m.set(stage, run);
+}
+/** 注销一路在飞子代理（该阶段结束时调用）；空桶顺手清掉，避免 map 常驻膨胀。 */
+function untrackInFlight(runId, stage) {
+	const m = inFlight.get(runId);
+	if (!m) return;
+	m.delete(stage);
+	if (m.size === 0) inFlight.delete(runId);
+}
 /** 产品级 backlog 缓存（product → BacklogStore）。 */
 const stores = /* @__PURE__ */ new Map();
 /** 产品级并发锁：product → 活跃 runId（同一产品同时只允许一条流水线）。 */
 const activeProducts = /* @__PURE__ */ new Map();
+function cancelRun(runId, source = "unknown") {
+	const j = runs.get(runId);
+	if (!j || j.status !== "running") return false;
+	j.cancelled = true;
+	j.cancelSource = source;
+	j.cancelRequestedAt = Date.now();
+	try {
+		const locale = runLocaleOf(j);
+		j.logs.push({
+			t: Date.now(),
+			level: "warn",
+			message: t(locale, "log.cancelRequested", { source: t(locale, `cancelSource.${source}`) })
+		});
+	} catch (e) {}
+	const live = inFlight.get(runId);
+	if (live) for (const run of live.values()) try {
+		const p = run && typeof run.dispose === "function" ? run.dispose() : null;
+		if (p && typeof p.catch === "function") p.catch(() => {});
+	} catch (e) {}
+	persistJournal(j);
+	return true;
+}
 /** 可用的子代理 provider 名（优先 spawn）。 */
 function providerName() {
 	const subagents = runtime.subagents;
@@ -1636,89 +2329,6 @@ function workspaceScopeOf(agent) {
 	};
 }
 //#endregion
-//#region host/core/locale.ts
-/**
-* dsh-plugin-teamflow core — 运行期语言源（客户端推送槽 + 宿主 settings 只读端口）。
-*
-* 为什么单独一层：语言「从哪来」必须是**唯一读取点**，否则每个消费方各自读 settings /
-* 自建浏览器语言缓存，就会出现 PRD 明令禁止的并行机制与「同 run 语言漂移」。
-* 本文件只回答两个问题：
-*   1. 当前界面语言是什么（`ambientLocale()`）——`teamflow_*` 工具返回/Remote 错误用；
-*   2. 新 run 起跑时快照成什么（`newRunLocale()`）——写进 journal.locale，之后一律读快照。
-*
-* 三个来源（优先级同 AC-1）：
-* - **客户端推送**（`noteClientLocale`）：浏览器当前语言（含系统探测结果），经既有 Remote 面
-*   `teamflow/setLocale` 推上来。用户没在宿主显式选过语言时只有这条通道能拿到真实语言
-*   （宿主 `locale.preference` 仅在用户显式选择过时才有值）。
-* - **宿主 settings 只读端口**（`setSettingsPort`）：`ctx.get('settings').get('locale').preference`，
-*   由 `@deepseek-ai/dsh-client-locale` 的 host face 注册。host 只读不写、未注册/服务缺失一律
-*   null（全 try/catch，AC-10：解析链任一级缺失都不报错、不阻塞）。
-* - **`en`**：兜底（AC-1③）。
-*
-* 内存单槽、last-write-wins、不落盘：语言是界面态，重启后由客户端重新推送（持久化属宿主职责）。
-*/
-/** 客户端推送的语言（最近一次，内存单槽）。 */
-let clientPushed = null;
-/** 客户端推送语言：可解析即写入，非法即清空（非法值不保留旧值——避免「推了个 fr，host 还在用上次的 en」）。 */
-function noteClientLocale(v) {
-	const parsed = parseLocale(v);
-	clientPushed = parsed;
-	return parsed !== null;
-}
-/** 宿主 settings 只读端口（由门面注入；缺省 null = 宿主未提供）。 */
-let settingsPort = null;
-/** 注入宿主 settings 只读端口（门面构造时调用；宿主缺 settings 服务时传 null）。 */
-function setSettingsPort(fn) {
-	settingsPort = typeof fn === "function" ? fn : null;
-}
-/** 宿主用户显式选择的语言（读不到/服务缺失/异常 → null，永不抛出）。 */
-function hostPreference() {
-	if (!settingsPort) return null;
-	try {
-		return parseLocale(settingsPort());
-	} catch (e) {
-		return null;
-	}
-}
-/** 当前界面语言（AC-1 解析链；工具返回/Remote 错误用）。 */
-function ambientLocale() {
-	try {
-		return resolveLocale({
-			client: clientPushed,
-			host: hostPreference()
-		});
-	} catch (e) {
-		return "en";
-	}
-}
-/** 新 run 起跑时解析一次（写进 journal.locale 的快照值；AC-2）。 */
-function newRunLocale() {
-	return ambientLocale();
-}
-/**
-* 读 run 的语言快照（纯读、绝不重解析；AC-2）。
-* 历史 journal（升级前无 locale 字段）按 zh 处理——那些 run 的存量文案本就是中文，
-* 用 en 去渲染会与已落盘内容割裂（resumeRun 会补写该字段，见 core/pipeline.ts）。
-*/
-function runLocaleOf(journal) {
-	const j = journal;
-	return parseLocale(j && j.locale) || "zh";
-}
-/**
-* 缺 locale 字段时的快照取值（QA-1：resume 绝不按当前界面语言重解析）。
-* - 新 run：环境语言（AC-1 解析链）；
-* - resume/续跑：一律 `zh`——历史 journal 的存量文案本就是中文，用界面语言补写会造成同一 run 内中英混排
-*   （PRD §4.1「已落库文本保留生成时语言」）。与 `runLocaleOf` 的缺省口径严格一致。
-*/
-function localeForMissingSnapshot(resume) {
-	return resume ? "zh" : newRunLocale();
-}
-/** 读 state 注入块上下文里的语言（`state.__runCtx.locale`，由 pipeline 按快照写入）。 */
-function runCtxLocale(state) {
-	const s = state;
-	return parseLocale(s && s.__runCtx && s.__runCtx.locale) || "zh";
-}
-//#endregion
 //#region host/core/backlog.ts
 /**
 * dsh-plugin-teamflow core — Backlog 数据层与状态机（$DSH_HOME/teamflow/<product>/backlog/*）。
@@ -2135,12 +2745,13 @@ function noteTaskAssign(journal, role, assignee) {
 	persistJournal(journal);
 }
 /** 创建 dev 子卡：流水线 dev 阶段开始时，为每个 devTaskDef 建一张子卡。 */
-function createSubtask(journal, title, spec) {
+function createSubtask(journal, title, spec, dtId) {
 	const store = storeFor(journal.workspace || "default");
 	const mainTask = journal.taskId ? store.find("task", journal.taskId) : null;
 	if (!mainTask) return null;
 	const fullTitle = t(runLocaleOf(journal), "backlog.devTitle", { title });
-	const existing = store.tasks.find((t) => t.reqId === journal.reqId && t.parentId === journal.taskId && (t.taskKey && t.taskKey === title || !t.taskKey && t.title === fullTitle));
+	const key = dtId ? String(dtId) : null;
+	const existing = store.tasks.find((t) => t.reqId === journal.reqId && t.parentId === journal.taskId && (key ? t.dtId ? t.dtId === key : false : t.taskKey && t.taskKey === title || !t.taskKey && !t.dtId && t.title === fullTitle));
 	if (existing) {
 		existing.status = "pending";
 		existing.failed = false;
@@ -2148,6 +2759,7 @@ function createSubtask(journal, title, spec) {
 		existing.endedAt = null;
 		existing.retries = (existing.retries || 0) + 1;
 		existing.taskKey = existing.taskKey || title;
+		if (key) existing.dtId = key;
 		existing.updatedAt = Date.now();
 		store.persist();
 		persistJournal(journal);
@@ -2162,6 +2774,7 @@ function createSubtask(journal, title, spec) {
 		type: "subtask",
 		title: fullTitle,
 		taskKey: title,
+		dtId: key,
 		spec: spec || "",
 		status: "pending",
 		devAssign: mainTask && mainTask.devAssign || null,
@@ -2384,6 +2997,7 @@ function loadState(projectKey) {
 				base.acIndex = raw.acIndex || {};
 				base.stages = raw.stages || {};
 				base.lastRun = raw.lastRun ?? null;
+				if (raw.gitMode === "repo" || raw.gitMode === "none") base.gitMode = raw.gitMode;
 				return base;
 			}
 		}
@@ -2482,6 +3096,14 @@ function stateSliceFor(state, role) {
 		list: Object.entries(state.modules).map(([f, c]) => `${f}${c ? "→" + c : ""}`).join(t(locale, "state.commaSep"))
 	}));
 	if (state.verifyScripts.length && (role === "qa" || role === "tech" || role === "dev")) lines.push(t(locale, "state.verifyScripts", { list: state.verifyScripts.join(t(locale, "state.commaSep")) }));
+	if (state.__runCtx && Array.isArray(state.__runCtx.artifactContracts) && state.__runCtx.artifactContracts.length && (role === "qa" || role === "acceptance")) {
+		const kind = state.__runCtx.artifact || "other";
+		lines.push(t(locale, "state.artifactContracts", {
+			kind,
+			n: state.__runCtx.artifactContracts.length,
+			list: state.__runCtx.artifactContracts.map((it, i) => `${i + 1}. ${it.requirement} — ${it.criteria}`).join("\n")
+		}));
+	}
 	if (role === "pm" || role === "acceptance") {
 		if (state.stages.prd) lines.push(t(locale, "state.prdSummary", { summary: state.stages.prd }));
 		if (state.stages.tech) lines.push(t(locale, "state.techSummary", { summary: state.stages.tech }));
@@ -2830,15 +3452,79 @@ function gitCmd(cwd, args, timeoutMs = 8e3) {
 * `-c advice.addIgnoredFile=false` 也不行（那是 error 不是 advice）。
 * 复现与候选方案矩阵见 `test/commit-path.test.js`（真 git 集成测试，锁死这个坑）。
 */
-function tfAddArgs() {
+function tfAddArgs(excludes = [], cwd) {
 	return [
 		"add",
 		"-A",
 		"--",
-		"."
+		".",
+		...tfExcludePathspecs(excludes, cwd)
 	];
 }
 /**
+* 冷启动基线提交的**索引层噪音排除**（2026-09-18 方案 B 根治，勿回退为「写用户 .gitignore」）。
+*
+* 为什么存在：`git init` 后第一次 `add -A` 是**整树冷扫描**，pnpm 本地 store / node_modules
+* 在实测里是 549 文件 / 51 MB（probe-clock），默认 8s 超时被直接杀掉 → 基线提交失败。
+*
+* **为什么不再写进 `.gitignore`（用户实锤截图）**：旧实现 `pipeline.ensureCommonNoiseIgnores()`
+* 调 `mergeGitignore(before, ['.pnpm-store/','node_modules/'], 'zh')` —— 而 `mergeGitignore` 的注释
+* 参数是**整批一条**，于是 `.pnpm-store/` 顶着「TeamFlow 运行日志（插件自有产物…）」的文案写进了
+* **用户的 `.gitignore`**。两处错：① 注释张冠李戴；② **越界**——`.gitignore` 是用户的项目资产，
+* 「该忽略什么」属于 L2（PRD 阶段 PM 按技术栈规划）与用户本人，host 只该在**自己那一次 git 调用**上
+* 收敛范围，不该在用户文件里留下任何痕迹。
+*
+* 稳定性依据（temp 仓库实测，见 `test/commit-path.test.js`）：`:(exclude)` 报错退出 1 的**唯一前提**
+* 是该路径**已被 `.gitignore` 忽略**（「显式点名 + 被忽略」）。本清单里的路径**从不写进 .gitignore**，
+* 故恒定 exit 0。运行时另有 `tfExcludePathspecs` 的自检双保险。
+*/
+const BASELINE_NOISE_EXCLUDES = [".pnpm-store", "node_modules"];
+/**
+* 把排除项转成 magic pathspec，并**用 git 自己判断**哪些项不该下发。
+*
+* **为什么必须用 `git check-ignore` 而不是自己读 `.gitignore`（2026-09-18 实测修正，勿回退）**：
+* 初版自检用 `existsSync('.gitignore')` + 正则近似——**相对路径读的是宿主进程的 cwd，不是目标仓库**，
+* 于是两个方向同时错：目标仓库没忽略的项被误拦（排除失效、噪音进索引），目标仓库忽略了的项被误放
+* （点名 + 被忽略 → **exit 1，正是 2026-09-11→09-15「4 天没有任何 run 提交过」那个坑原样复活**）。
+* `git check-ignore` 以**目标仓库为根**、且用 git 自己的规则引擎（通配/取反/嵌套 `.gitignore`/全局
+* excludesfile 全覆盖），是本判据唯一正确的实现。`-q` 只取退出码：0=被忽略，1=未忽略。
+*
+* 兜底方向（宁可不排、不可 exit 1）：git 不可用/异常 → 一律**不下发**该排除项。
+* 代价只是"这次少排一点、add 慢一点"，而失败的代价是**整条提交链路静默失效**——不对称，故从严。
+*/
+function tfExcludePathspecs(excludes, cwd) {
+	const list = excludes.filter((p) => typeof p === "string" && !!p.trim());
+	if (!list.length) return [];
+	const out = [];
+	for (const p of list) {
+		const clean = p.replace(/\\/g, "/").replace(/\/+$/, "");
+		if (!clean) continue;
+		if (isIgnoredByGit(clean, cwd)) continue;
+		out.push(`:(exclude)${clean}`);
+	}
+	return out;
+}
+/** `git check-ignore` 判定（0=被忽略／1=未忽略／其它=无法判定）。无法判定时按「被忽略」处理＝不下发 pathspec。 */
+function isIgnoredByGit(rel, cwd) {
+	try {
+		execFileSync("git", [
+			"check-ignore",
+			"-q",
+			"--",
+			rel
+		], {
+			cwd: cwd || process.cwd(),
+			encoding: "utf8",
+			timeout: 4e3,
+			windowsHide: true
+		});
+		return true;
+	} catch (e) {
+		if (e.status === 1) return false;
+		return true;
+	}
+}
+/**
 * 索引兜底：把自有日志从索引里摘掉（**只动索引，不删工作区文件**）。
 *
 * 与 `.gitignore` 补写构成新的两道防线：
@@ -3096,6 +3782,29 @@ function freshTokensOf(usage) {
 	if (!usage) return 0;
 	return (usage.input || 0) + (usage.cacheWrite || 0) + (usage.output || 0);
 }
+/** 官方口径缓存命中率 = cacheRead/(input+cacheRead)（无输入记 0，不做除零外推）。 */
+function cacheHitRatioOf(usage) {
+	const input = usage && usage.input || 0;
+	const cacheRead = usage && usage.cacheRead || 0;
+	const total = input + cacheRead;
+	return total > 0 ? cacheRead / total : 0;
+}
+/**
+* 该阶段**有效的新增 token 预算** + 判定依据（供熔断日志留痕）。
+* @returns budget = 基础预算（无缓存 ×`UNCACHED_BUDGET_FACTOR`）；uncached = 是否放宽；
+*          ratio/calls = 依据（命中率与累计调用数），未放宽时也为真实值。
+*/
+function effectiveFreshBudget(usage, base) {
+	const calls = usage && usage.calls || 0;
+	const ratio = cacheHitRatioOf(usage);
+	const uncached = calls >= 5 && ratio < .5;
+	return {
+		budget: uncached ? base * 3 : base,
+		uncached,
+		ratio,
+		calls
+	};
+}
 //#endregion
 //#region host/core/guard.ts
 /**
@@ -3121,6 +3830,12 @@ function freshTokensOf(usage) {
 *  C. 空转检测：会话仍在产出事件，但连续 GUARD_NO_TOOL_MS 没有任何工具调用
 *    （纯推理打转/改写式循环；正常 agent 每分钟都在调工具）→ outcome='stalled'。
 *    兜底关系：复读判定放宽后，edit 后陷入死循环的漏网场景由 C（长时间无工具调用）兜住。
+*  D. **环境不可用检测（2026-09-23 probe-v4 实锤）**：同一工具**以完全相同错误**持续失败
+*    （达 GUARD_TOOL_FAIL_WARN 次先注入提醒，达 GUARD_TOOL_FAIL_ABORT 次中止）→ outcome='env-unavailable'
+*    （不自动重试，直接 needs-human 并点名环境）。实锤：`pwsh` 因 Windows 沙箱 ACL provision 失败
+*    （`SetNamedSecurityInfoW failed (Win32 5)`）每次同样报错，架构师重试 7 次 + 90k 字符推理后撞
+*    max-tokens 才停 —— 白烧 52.6k 输出，且汇报把真因误写成 `max-tokens`。重试/换命令/用推理代替执行
+*    都修不好环境，所以必须在烧钱之前停下并说清原因。
 *
 * 中止方式：run.dispose() → run.result 结算。outcome 命名刻意避开 isUnretryable 的
 * /token|context|limit/ 正则；只有 'degenerated' 享受干净重试豁免（runner.withRetry）。
@@ -3219,8 +3934,7 @@ function injectReminder(run, text, locale) {
 				text
 			}],
 			source: {
-				kind: "plugin",
-				plugin: "dsh-plugin-teamflow",
+				kind: "plugin:dsh-plugin-teamflow",
 				form: "notice",
 				summary: t(locale, "guard.noticeSummary")
 			}
@@ -3248,6 +3962,9 @@ function startStageGuard(opts) {
 	let lastMutationAt = 0;
 	let repeatWarned = false;
 	let busyWarned = false;
+	const callNames = /* @__PURE__ */ new Map();
+	const toolFailures = /* @__PURE__ */ new Map();
+	const toolFailWarned = /* @__PURE__ */ new Set();
 	function warnOnce(key, set, message, hint) {
 		if (set.has(key)) return;
 		set.add(key);
@@ -3365,6 +4082,8 @@ function startStageGuard(opts) {
 					}
 				}
 				observeToolCalls(newEvents);
+				observeToolFailures(newEvents);
+				if (fired) return;
 				processed = events.length;
 			}
 			for (const ev of events.slice(-200)) {
@@ -3460,6 +4179,66 @@ function startStageGuard(opts) {
 			}
 		}
 	}
+	/**
+	* 环境不可用检测（2026-09-23 probe-v4 实锤，增量处理**失败**的 tool/result）。
+	*
+	* 判据：同一工具**以完全相同错误**反复失败 = 工作区坏了（实锤：Windows 沙箱 ACL provision 失败
+	* `SetNamedSecurityInfoW failed (Win32 5): grantWrite(<workspace>)` → 该工作区所有命令全废）。
+	* 这类失败不是模型问题——重试、换命令绕过、用推理代替执行都修不好它，只会继续烧钱
+	* （那次架构师重试 7 次 + 90k 字符推理才撞 max-tokens 停下，白烧 52.6k 输出，且汇报把真因误写成 max-tokens）。
+	* 失败判定用结构化 `message.isError`（不猜文本）；指纹 = 工具名 + 归一化错误前 160 字符。
+	* 动作：达 WARN → 记 warn + 注入提醒（请模型停手上报）；达 ABORT → fire（outcome='env-unavailable'）。
+	*/
+	function observeToolFailures(events) {
+		for (const ev of events) {
+			const e = ev;
+			if (!e) continue;
+			if (e.type === "tool/call" || e.type === "tool-call") {
+				const d = e.data;
+				if (d && typeof d.callId === "string" && typeof d.name === "string") callNames.set(d.callId, d.name);
+				continue;
+			}
+			if (e.type !== "tool/result") continue;
+			if (!isToolErrorResult(e.data)) continue;
+			const callId = e.data?.message?.toolCallId;
+			const tool = typeof callId === "string" && callNames.get(callId) || "command";
+			const text = toolResultText(e.data);
+			const sig = toolFailureSignature(tool, text);
+			const n = (toolFailures.get(sig) || 0) + 1;
+			toolFailures.set(sig, n);
+			const detail = clip(String(text).replace(/\s+/g, " ").trim(), 160);
+			const action = toolFailureAction(n, 2, 3);
+			if (action === "warn" && !toolFailWarned.has(sig)) {
+				toolFailWarned.add(sig);
+				stage.envUnavailable = `${tool}: ${detail}`;
+				try {
+					journal.logs.push({
+						t: Date.now(),
+						level: "warn",
+						message: t(locale, "guard.toolFail", {
+							label,
+							tool,
+							n,
+							detail
+						})
+					});
+				} catch (err) {}
+				injectReminder(run, `[ENV GUARD · reminder] ${t(locale, "guard.reminderToolFail", {
+					tool,
+					n,
+					detail
+				})}`, locale);
+			} else if (action === "abort") {
+				stage.envUnavailable = `${tool}: ${detail}`;
+				fire(t(locale, "guard.reasonToolFail", {
+					tool,
+					n,
+					detail
+				}), "env-unavailable");
+				return;
+			}
+		}
+	}
 	return () => {
 		fired = true;
 		clearInterval(timer);
@@ -3516,19 +4295,6 @@ async function resolveStageEffort(route, attempt, effortHint, locale = "zh") {
 	}) };
 	return { effort: wanted };
 }
-/** 并发池：按 max 个 worker 消费 items，返回同序结果。 */
-async function runPool(items, max, fn) {
-	const results = new Array(items.length);
-	let cursor = 0;
-	const workers = Array.from({ length: Math.min(Math.max(1, max), items.length) }, async () => {
-		while (cursor < items.length) {
-			const i = cursor++;
-			results[i] = await fn(items[i], i);
-		}
-	});
-	await Promise.all(workers);
-	return results;
-}
 /**
 * 解析父 agent 当前生效的模型路由（provider/model）。
 *
@@ -3573,8 +4339,10 @@ function resolveChildRoute(parent) {
 	}
 	return out;
 }
-/** 运行单个阶段子代理：执行 + 产出实质校验 + token 双口径计量 + stage 状态流转。 */
-async function runAgent(journal, parent, label, phase, prompt, signal, taskKey, attempt = 1, effortHint) {
+/** 运行单个阶段子代理：执行 + 产出实质校验 + token 双口径计量 + stage 状态流转。
+*  `taskIds`：本阶段承载的**开发任务身份**（host 生成的 `dt-N`；合并任务时是数组）。
+*  与 `taskKey`（人读标题）分家——判定只认 id，title 只作展示（见 pipeline.buildDevTaskDefs 注释）。 */
+async function runAgent(journal, parent, label, phase, prompt, signal, taskKey, attempt = 1, effortHint, taskIds) {
 	const maxSeq = journal.stages.length ? Math.max(...journal.stages.map((s) => s.seq)) : 0;
 	const locale = runLocaleOf(journal);
 	let stageText = null;
@@ -3585,6 +4353,7 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 		status: "running",
 		outcome: null,
 		taskKey: taskKey || null,
+		taskIds: Array.isArray(taskIds) && taskIds.length ? [...taskIds] : null,
 		childId: null,
 		startedAt: Date.now(),
 		endedAt: null,
@@ -3599,6 +4368,8 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 	let cancelGuard = null;
 	try {
 		const route = resolveChildRoute(parent);
+		stage.provider = route.provider || providerName() || null;
+		stage.model = route.model || null;
 		const eff = await resolveStageEffort(route, attempt, effortHint, locale);
 		const effort = eff.effort;
 		const agentOptions = route.provider || route.model || effort ? {
@@ -3634,10 +4405,7 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 			signal: normalizeSignal(signal)
 		});
 		stage.childId = run.id;
-		inFlight.set(journal.id, {
-			run,
-			stage
-		});
+		trackInFlight(journal.id, stage, run);
 		try {
 			if (parent && parent.session && typeof parent.session.append === "function") parent.session.append("tool-workflow/agent-start", {
 				runId: journal.id,
@@ -3658,15 +4426,49 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 		const text = extractText(result && result.output);
 		stageText = text;
 		const verdict = judgeDeliverable(phase, text);
+		let docFallback = null;
+		if (!verdict.ok && text && stop === "completed") {
+			const doc = stageDocText(journal, phase);
+			if (doc && doc.length >= verdict.min) docFallback = {
+				name: doc.name,
+				length: doc.length
+			};
+		}
 		if (journal.cancelled) {
 			stage.status = "cancelled";
 			stage.outcome = "cancelled";
 			return null;
 		}
-		if (stop === "completed" && text && verdict.ok) {
+		if (stage.envUnavailable) {
+			stage.status = "failed";
+			stage.outcome = "env-unavailable";
+			stage.summary = t(locale, "diag.envUnavailableStage", {
+				label,
+				detail: stage.envUnavailable
+			});
+			if (text) stage.output = clip(text, 4e3);
+			journal.logs.push({
+				t: Date.now(),
+				level: "error",
+				message: stage.summary
+			});
+			return null;
+		}
+		if (stop === "completed" && text && (verdict.ok || docFallback)) {
 			stage.status = "done";
 			stage.outcome = "completed";
 			stage.output = clip(text, 5e4);
+			if (docFallback) journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: t(locale, "diag.docDelivered", {
+					label,
+					length: verdict.length,
+					min: verdict.min,
+					name: docFallback.name,
+					docLen: docFallback.length
+				})
+			});
 			if (verdict.refusal) journal.logs.push({
 				t: Date.now(),
 				level: "warn",
@@ -3755,21 +4557,47 @@ async function runAgent(journal, parent, label, phase, prompt, signal, taskKey,
 		stage.usage = accumulateSessionUsage(run);
 		stage.handoff = stageText ? handoffBrief(stageText) : null;
 		stage.endedAt = Date.now();
-		if (inFlight.get(journal.id) && inFlight.get(journal.id).stage === stage) inFlight.delete(journal.id);
-		if (run) try {
-			await run.dispose();
-		} catch (e2) {}
+		untrackInFlight(journal.id, stage);
+	}
+}
+/**
+* 该阶段失败是否「外部供应商不可用」（限流/无额度/上游 5xx/超时…）。
+* 判据 = `classifyExternalFailure(错误细节, stage.summary)`（纯函数，单测覆盖真值表）。
+* ⚠️ 启发式：宿主只给 `stopReason=error` + 错误文本，无结构化错误码；命中原文进日志便于日后核对。
+*/
+function isExternalFailure(stage) {
+	if (stage.outcome === "insubstantial" || stage.outcome === "degenerated" || stage.outcome === "stalled" || stage.outcome === "aborted" || stage.outcome === "env-unavailable") return false;
+	return classifyExternalFailure(String(stage.summary || ""), String(stage.output || "").slice(-500)) === "external";
+}
+/** 可取消等待：等待期间被取消/中断则立刻返回 false（不把 sleep 变成不可打断的挂起）。 */
+async function sleepUnlessCancelled(ms, isCancelled) {
+	const step = 1e3;
+	let waited = 0;
+	while (waited < ms) {
+		if (isCancelled()) return false;
+		const slice = Math.min(step, ms - waited);
+		await new Promise((r) => setTimeout(r, slice));
+		waited += slice;
 	}
+	return !isCancelled();
 }
 /**
 * 单阶段重试 + token 熔断（**新增口径**：input+cacheWrite+output，排除 cacheRead——见
 * `FRESH_TOKEN_BUDGET` 与 metering.freshTokensOf；汇报仍走官方 totalTokensOf 口径）。
 * 顺序：不可重试/外部中止/护栏中止 → 预算门 → 自动重试（预算合理时重试优先于熔断，2026-09-11 修正）。
 * `effortHint`：机械阶段的推理强度降档提示（第 1 次尝试生效，重试自动回升 high，见 resolveStageEffort）。 */
-async function withRetry(journal, parent, label, phase, prompt, signal, taskKey, effortHint) {
+async function withRetry(journal, parent, label, phase, prompt, signal, taskKey, effortHint, taskIds) {
 	let attempts = 0;
 	let freshTokens = 0;
+	let usageAcc = {
+		input: 0,
+		cacheRead: 0,
+		cacheWrite: 0,
+		output: 0,
+		calls: 0
+	};
 	let lastStage = null;
+	let externalAttempts = 0;
 	const locale = runLocaleOf(journal);
 	for (let attempt = 1; attempt <= 2; attempt++) {
 		attempts = attempt;
@@ -3779,9 +4607,19 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 		}) : label;
 		const promptNow = attempt > 1 && lastStage ? prompt + buildRetryDiagnostic(attempt, lastStage, locale) : prompt;
 		const beforeLen = journal.stages.length;
-		const result = await runAgent(journal, parent, labelNow, phase, promptNow, signal, taskKey, attempt, effortHint);
+		const result = await runAgent(journal, parent, labelNow, phase, promptNow, signal, taskKey, attempt, effortHint, taskIds);
 		lastStage = journal.stages[beforeLen] || null;
-		if (lastStage && lastStage.phase === phase) freshTokens += freshTokensOf(lastStage.usage);
+		if (lastStage && lastStage.phase === phase) {
+			freshTokens += freshTokensOf(lastStage.usage);
+			const u = lastStage.usage || {};
+			usageAcc = {
+				input: usageAcc.input + (u.input || 0),
+				cacheRead: usageAcc.cacheRead + (u.cacheRead || 0),
+				cacheWrite: usageAcc.cacheWrite + (u.cacheWrite || 0),
+				output: usageAcc.output + (u.output || 0),
+				calls: usageAcc.calls + (u.calls || 0)
+			};
+		}
 		if (result) return {
 			text: result,
 			attempts,
@@ -3811,6 +4649,52 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 				stage: lastStage
 			};
 		}
+		if (lastStage && isExternalFailure(lastStage)) {
+			const wait = externalBackoffMs(externalAttempts + 1);
+			if (wait !== null) {
+				externalAttempts++;
+				journal.logs.push({
+					t: Date.now(),
+					level: "warn",
+					message: t(locale, "diag.externalBackoff", {
+						label,
+						n: externalAttempts,
+						sec: Math.round(wait / 1e3),
+						detail: clip(String(lastStage.summary || ""), 200)
+					})
+				});
+				if (!await sleepUnlessCancelled(wait, () => journal.cancelled)) return {
+					text: null,
+					attempts,
+					freshTokens,
+					stage: lastStage
+				};
+				attempt--;
+				continue;
+			}
+			journal.logs.push({
+				t: Date.now(),
+				level: "error",
+				message: t(locale, "diag.externalExhausted", {
+					label,
+					n: externalAttempts
+				})
+			});
+			if (lastStage) {
+				lastStage.status = "interrupted";
+				lastStage.outcome = "external";
+			}
+			journal.interrupted = true;
+			journal.interruptedAt = Date.now();
+			journal.externalFailure = true;
+			journal.humanIntervention = true;
+			return {
+				text: null,
+				attempts,
+				freshTokens,
+				stage: lastStage
+			};
+		}
 		if (lastStage && lastStage.outcome === "aborted") {
 			journal.logs.push({
 				t: Date.now(),
@@ -3825,6 +4709,20 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 				stage: lastStage
 			};
 		}
+		if (lastStage && lastStage.outcome === "env-unavailable") {
+			journal.logs.push({
+				t: Date.now(),
+				level: "error",
+				message: t(locale, "diag.envUnavailable", { label })
+			});
+			journal.humanIntervention = true;
+			return {
+				text: null,
+				attempts,
+				freshTokens,
+				stage: lastStage
+			};
+		}
 		if (lastStage && lastStage.outcome === "degenerated") {
 			journal.logs.push({
 				t: Date.now(),
@@ -3853,15 +4751,19 @@ async function withRetry(journal, parent, label, phase, prompt, signal, taskKey,
 				stage: lastStage
 			};
 		}
-		if (freshTokens >= 2e5) {
+		const eff = effectiveFreshBudget(usageAcc, FRESH_TOKEN_BUDGET);
+		if (freshTokens >= eff.budget) {
+			const params = {
+				label,
+				fresh: Math.round(freshTokens / 1e3),
+				budget: Math.round(eff.budget / 1e3),
+				calls: eff.calls,
+				ratio: Math.round(eff.ratio * 100)
+			};
 			journal.logs.push({
 				t: Date.now(),
 				level: "error",
-				message: t(locale, "diag.breaker", {
-					label,
-					fresh: Math.round(freshTokens / 1e3),
-					budget: Math.round(FRESH_TOKEN_BUDGET / 1e3)
-				})
+				message: t(locale, eff.uncached ? "diag.breakerUncached" : "diag.breaker", params)
 			});
 			journal.humanIntervention = true;
 			return {
@@ -4154,6 +5056,7 @@ Before starting: read ${base}/AGENTS.md (team rules & doc index — read the sum
 [AGENTS.md boundary · policy] AGENTS.md is team property (injected unconditionally — consensus/index/managed zone only): **do NOT append changelog-style sections during iterations (product memory / todos / change log)** — such data belongs in ${TF_DOCS}/memory.md and task folders; besides the <!-- teamflow:begin/end --> managed zone, no stage may rewrite, reorder, or overwrite any other part of AGENTS.md.
 [Reply language · policy] Write your **final reply** (the summary handed back to the host, plus the state block) in ${replyName} — the artifact language above governs the FILES you write, this governs the TEXT you write back. Never mix languages inside one run: your reply becomes this stage's stored result and is shown in the workbench.
 Backlog (req/task/bug) source of truth is the persisted mirror $DSH_HOME/teamflow/<workspace>/ under ${base}/backlog/: single rotating task card model (${t(locale, "doc.statusChain")}); devAssign/qaAssign live on the task card.
+[Env unavailable · policy] Command tools run inside the host's sandbox. If the SAME command keeps failing with the SAME error (sandbox/ACL denial, permission, not found, unavailable), **STOP at once**: do NOT retry it, do NOT switch to another command to work around it, and do NOT replace execution with reasoning or guesswork. Reply with the tool name, the RAW error text, what you finished and what is left undone — then end the turn. The host aborts a stage after repeated identical failures and names the environment as the cause; reporting it yourself is far cheaper and keeps the real reason visible.
 `;
 }
 /** 头尾组合切片：保留头部(背景/基线) + 尾部(新增 AC/修订)，预算不变但覆盖增量段。 */
@@ -4212,16 +5115,59 @@ const ONCE_DISCIPLINE = `[ONE-SHOT WRITE · policy] The most important efficienc
 - Think it through once, then write. After writing, move on — do not polish retroactively.
 - Always end output with a state block so the host can index and the next run needn't re-read.
 `;
+/**
+* **本机安装环境注入块**（2026-09-21 用户实锤，勿写死路径）。
+*
+* 契约原来写死 `dsh plugin --profile web add`——用户是源码运行（`pnpm dsh`，`dsh` 不在 PATH），
+* 那条命令在他机器上跑不通；profile 名也可能不是 `web`。现在路径/命令**全部由 host 运行时探测**
+* （`$DSH_HOME` + 插件自身所在路径反推 profile + `dsh` 是否在 PATH），这里只把结论转述给 PM。
+* 探测失败 → 明确要求"问用户"，**不许猜**。
+* 同时点明**执行者**：流水线子代理权限被钉死在工作区、**装不了**（会话原文：
+* `permission scope was fixed ... cannot be widened`）；**主 agent 能**——它的 profile 写入被拒后
+* 宿主给出 `escalation available`，`approval/policy: ask` 下经用户批准即可。故 PRD 必须把「安装」
+* 写成一个**给主 agent 执行的步骤**，而不是"请用户手动测试"。
+*/
+function installBlock(en, rc) {
+	const env = rc && rc.installEnv;
+	if (!env) return "";
+	const ok = env.ok === true;
+	const p = env.profile || "?";
+	const dir = env.profileDir || "?";
+	const cli = env.cliOnPath === true;
+	if (en) return ok ? `\n   [THIS MACHINE · install environment, probed at run start — never assume a profile name or path] DSH_HOME=\`${env.dshHome}\`; profile=\`${p}\`; profile dir=\`${dir}\`; \`dsh\` on PATH: ${cli ? "yes (use the CLI)" : "NO (source-run — use the equivalent manual steps)"}.\n   **Who installs**: pipeline subagents CANNOT write outside the workspace (their permission scope is fixed) — so the PRD must specify the install as a step **for the main agent to execute** (it can request a one-shot escalation, which the user approves), not as "please test it manually". Write the concrete command for THIS machine (CLI form, or \`pnpm add\` inside the profile dir + the \`dsh.profile.bundles\` entry, which is auto-derived from the package's \`dsh.bundle.patch\`), plus the exact rollback.` : `\n   [THIS MACHINE · install environment] Could NOT be probed (DSH_HOME / profile name unavailable) → the PRD must instruct the main agent to **ASK THE USER** for the profile location; never invent a path. Subagents cannot install (their permission scope is fixed); the install step is for the main agent.`;
+	return ok ? `\n   【本机环境 · 起跑时探测，禁止假设 profile 名或路径】DSH_HOME=\`${env.dshHome}\`；profile=\`${p}\`；profile 目录=\`${dir}\`；\`dsh\` 在 PATH：${cli ? "是（用 CLI）" : "**否**（源码运行 → 走等价手动步骤）"}。\n   **谁执行安装**：流水线子代理**写不了**工作区之外（权限启动即固定）——所以 PRD 必须把安装写成**给主 agent 执行的步骤**（主 agent 可申请一次性升级授权，由用户批准），而不是"请用户手动测试"。请按**本机**实际情况给出可照做的命令（CLI 形式，或在 profile 目录内 \`pnpm add\` + \`dsh.profile.bundles\` 条目——后者由包的 \`dsh.bundle.patch\` 声明自动推导），并给出精确回滚。` : `\n   【本机环境】探测失败（DSH_HOME / profile 名不可得）→ PRD 必须指示主 agent **先问用户** profile 位置，**绝不许编路径**。子代理装不了（权限固定）；安装步骤归主 agent。`;
+}
 const prdPrompt = (requirement, root, runId, state) => {
 	const en = LOCALE(state) === "en";
-	/** PRD 头部声明模板：zh 逐字不变；en 为新增英文契约（仅 en 分支出现，AC-4③）。 */
 	const hdrBaseline = en ? "`Baseline dependency: <prior task folder this requirement depends on> (its established behavior must not regress)`; write `Baseline dependency: none` if no dependency." : "`基线依赖：<prior task folder this requirement depends on>（its established behavior must not regress）`; write `基线依赖：无` if no dependency.";
 	const hdrSupersede = en ? "`Supersedes: <task folder>#<AC number>: <one sentence>` (only when this requirement explicitly changes existing behavior; omit otherwise)." : "`取代：<task folder>#<AC number>：<one sentence>` (only when this requirement explicitly changes existing behavior; omit otherwise).";
+	const contract = (() => {
+		try {
+			const rc = state && state.__runCtx || {};
+			const items = Array.isArray(rc.artifactContracts) ? rc.artifactContracts : [];
+			if (!items.length) return "";
+			const kind = String(rc.artifact || "other");
+			const inst = rc.installable === true;
+			const lines = items.map((it, i) => `   ${i + 1}. ${it.requirement} — ${it.criteria}`).join("\n");
+			const repo = (ARTIFACT_REFERENCE_SAMPLES[kind] || []).join(en ? ", " : "、");
+			const where = en ? `**first look at the dsh plugins already installed on THIS machine** — \`${LOCAL_PLUGIN_SAMPLES_HINT}\`: their \`package.json\` (\`dsh\` block) and \`cordis.patch.yml\` are the authoritative, version-current samples of how the declarations are really written${repo ? `; if the workspace happens to sit inside this repo you may also read \`${repo}\`` : ""}; if neither exists, read the host docs or ask the user — **never write them from memory**` : `**先读本机已安装的 dsh 插件**——\`${LOCAL_PLUGIN_SAMPLES_HINT}\`：它们的 \`package.json\`（\`dsh\` 块）与 \`cordis.patch.yml\` 就是"声明到底怎么写"的**权威且与宿主版本同步**的样本${repo ? `；若工作区恰好在本仓内，也可就近读 \`${repo}\`` : ""}；两者都没有就去读宿主文档或问用户——**禁止凭记忆写**`;
+			return en ? `\n[DELIVERABLE SHAPE · mandatory ACs] Triage judged this deliverable as \`${kind}\`${inst ? " and it must be **installable/loadable by its host**" : ""}. The following are **objective delivery contracts of that shape** — every item MUST become a testable AC in this PRD (not prose, not a "notes" section), because downstream QA/acceptance only verify what is in the AC table:\n${lines}\n   Field names / file names vary with the host version, so ${where}.${installBlock(en, rc)}` : `\n[交付形态契约 · 必填 AC] 分诊判定本次交付物形态为 \`${kind}\`${inst ? "，且**必须可被宿主安装/加载**" : ""}。以下是该形态的**客观交付契约**——每一条都**必须落成 PRD 里可测的 AC**（不是正文说明、不是"备注"小节），因为下游 QA/验收只验 AC 表里的东西：\n${lines}\n   字段名/文件名随宿主版本演进，所以${where}。${installBlock(en, rc)}`;
+		} catch (e) {
+			return "";
+		}
+	})();
+	const hostResearchBlock = (() => {
+		const rc = state && state.__runCtx || {};
+		if (rc.hostResearch !== true) return "";
+		const host = String(rc.host || "unknown");
+		const kind = String(rc.artifact || "other");
+		return en ? `\n[HOST CONTRACT RESEARCH · mandatory section] Triage judged this deliverable as \`${kind}\` targeting a host that is **NOT this project's own host** (\`${host}\`). The hard contracts of this repo's host **do not apply** to it — do NOT carry over its profile entry declaration, bundle patch, client block or \`files\` whitelist. Instead, FIRST research the target host's own plugin/extension loading contract and write the findings into a dedicated section titled exactly "Host contract research" containing, at minimum: (a) which host framework and version this targets; (b) where its plugin/extension loading contract is documented (URL or file path you actually read); (c) the concrete requirements it imposes (entry declaration, packaging, install/load command, any safety or rollback requirement); (d) anything you could NOT verify and how the dev stage should resolve it. **Never invent field names from memory** — cite what you read. This section is a hard gate: a PRD without it fails the stage.` : `\n[宿主契约调研 · 必填段] 分诊判定本次交付物形态为 \`${kind}\`，其目标宿主**不是本项目自身的宿主**（\`${host}\`）。本仓宿主的那些硬契约（profile 层入口声明 / bundle patch / client 声明块 / files 白名单）**对它一条都不适用**，不得照搬。正确做法：**先去调研目标宿主自己的插件/扩展加载契约**，把结论写进一个标题恰为「宿主契约调研」的独立段，至少包含：(a) 目标是哪个宿主框架及其版本；(b) 它的插件/扩展加载契约**在哪儿有据可查**（你真读过的 URL 或文件路径）；(c) 它实际要求什么（入口声明 / 打包 / 安装加载命令 / 有无安全与回滚要求）；(d) 你**没能核实**的点，以及 dev 阶段该怎么解决。**禁止凭记忆写字段名**——写明你读过什么。这一段是硬门禁：PRD 缺它 → 阶段失败。`;
+	})();
 	return `You are a senior Product Manager. The current workspace IS the target project (empty = project not yet created).
 ${productCtx(root, LOCALE(state))}${stateSliceFor(state, "pm")}
 ${ONCE_DISCIPLINE}[REQUIREMENT]
 ${requirement}
-[ARTIFACT LOCATION] ${RUN(state)}/PRD.md (write once; create dirs if missing).
+[ARTIFACT LOCATION] ${RUN(state)}/PRD.md (write once; create dirs if missing).${contract}${hostResearchBlock}
 [REQUIREMENTS]
 1. First look at the state index above and the AGENTS.md doc index to decide whether this is an iterative requirement and which prior task folders relate (folder names carry date+theme; reverse date order = evolution). Do not full-read historical docs.
 2. [AC numbering] Number ACs from AC-1 within THIS folder only — ACs belong to this requirement, no global numbering.
@@ -4232,8 +5178,10 @@ ${requirement}
 4. Output the full PRD (${langDirective(LOCALE(state))}): background & goals, user stories (each with testable acceptance criteria), scope & non-goals, interaction flow summary, priority (P0/P1/P2), dependencies & risks, milestone suggestions. ACs must be testable/quantifiable; prefer precision & brevity. ${L(state, "doc.noRevisionTable")} (the folder IS the archive; its name carries the identity).
 5. [Memory write-back · convention changes ONLY] Update docs/teamflow/memory.md ONLY if this requirement introduces new team conventions / tech-stack decisions (replace the same-topic line, idempotent, no changelog-style appending); otherwise do not touch memory.
 6. [Engineering actions carried verbatim] Engineering instructions in the raw requirement (create/switch branch, commit, tag...) MUST be preserved verbatim into the "${L(state, "doc.engConstraints")}" section of the PRD: specify the action, timing, and baseline (e.g. "branch from latest main, then implement"). If the workspace already has uncommitted changes, note how to handle them. Never silently drop or reword engineering instructions.
+6b. [Version-control hygiene · mandatory when the workspace is versioned] If the workspace has (or will get, per the host log "改动存档/git init") version control: audit the existing/potential \`.gitignore\` **for THIS project's stack** — build outputs, dependency/tool caches, IDE files, local env secrets — and put "complete/extend .gitignore" into the engineering-constraints section as a dev-stage action (file names must match this project's real tooling: a Python project needs __pycache__/.venv, a Rust one target/, a pnpm monorepo .pnpm-store — read the project, don't guess from a generic list). Rationale: the closing commit stages the whole tree; noise that slips into it becomes permanent history.
 ${ARTIFACT_DELIVERY(RUN(state))}
-7. [State] End with a state block (phase="prd"): summary covers the AC highlights + one-sentence product semantics; extra contains { "acIndex": {...}, "summary": "<product one-liner>", "techStack": "..." }.${STATE_BLOCK_INSTRUCTION}`;
+7. [State] End with a state block (phase="prd"): summary covers the AC highlights + one-sentence product semantics; extra contains { "acIndex": {...}, "summary": "<product one-liner>", "techStack": "...", "openQuestions": [{ "q": "...", "why": "...", "changes": "...", "default": "..." }] }.${STATE_BLOCK_INSTRUCTION}
+8. [Assumptions · mandatory] If ANY part of the requirement is under-specified, do NOT silently decide on the user's behalf: write a dedicated section titled exactly "${L(state, "doc.assumptionsQ")}" and list every assumption / open question as one bullet — what you assumed, why, and what would change if the user decides otherwise. If nothing is under-specified, still write the section with a single line stating there are no open questions. This section is what lets a human tell whether the PRD is what they actually wanted; the host surfaces it to the user verbatim.`;
 };
 const designPrompt = (prd, root, runId, state) => `You are a senior UI/UX designer. The current workspace IS the target project.
 ${productCtx(root, LOCALE(state))}${stateSliceFor(state, "design")}
@@ -4359,6 +5307,11 @@ ${clip(devSummary, 15e3)}
    - If the injected blueprint JSON ("<!-- blueprint -->") is present, verify the implementation follows it (was the to-be-extracted module extracted? deps/assembly per blueprint? any deviations?).
    - Check for **duplicated implementations** (e.g. multiple security wrappers/storage/adapter utilities drifting), **abstraction not extracted where it should be**, **obviously broken existing structure**.
    - Report architecture findings in the defect table format (severity P1, module =${L(state, "doc.archModuleQ")}). This is part of the delivery quality gate, not just functional bugs.
+0b. [Deliverable-shape verification · mandatory when injected] If the state slice carries ${LOCALE(state) === "en" ? "\"Deliverable-shape contracts\"" : "「交付形态契约」"}, treat every item as a **required probe** (this is exactly the class of failure where a delivery "looks complete" but cannot be installed/loaded, or a stale build artifact crashes the host on startup):
+    - Run each executable criterion and record command + exit code in QA-REPORT.md (sandbox-legal ones: file/field presence, dependency protocol scan, build-freshness, load-safety via \`node -e "require(...)"\`).
+    - **Install rollback discipline**: before any profile/publish install, write down the exact uninstall command (e.g. remove the package from profile deps + bundles, or \`dsh plugin remove <name>\`); if a post-install verification fails, roll back FIRST, then report — never leave the host unbootable.
+    - Environment-blocked items (e.g. needs a host restart to verify real loading) → list them in the ${L(state, "doc.manualChecklistQ")} with method + tool, for human review. Never silently skip.
+0c. [Commit-surface hygiene probe · when the workspace is versioned] If version control is in play (host log mentions 改动存档/git, or a .gitignore exists): before signing off, run \`git status --porcelain\` and verify it contains **no dependency dirs, build outputs, tool caches, IDE files or local secrets** (per this project's stack — e.g. node_modules/, .pnpm-store/, __pycache__/, target/, dist/, .idea/, .env). Missing/incorrect .gitignore coverage → file it as a P1 defect (module = 版本控制), because the closing commit stages the whole tree and noise becomes permanent history.
 1. [Environment limits · dynamic by model capability]${VISUAL_POLICY(!!vision, LOCALE(state))}
    - Always-available sandbox-legal paths: build/assembly checks, unit tests, DOM-level E2E (jsdom or equivalent), static audit, adversarial spot-checks.
 2. [${t(LOCALE(state), "doc.manualChecklist")}] Items that cannot be auto-verified (audio output / real-device: 100dvh dynamic toolbar, safe-area, multi-touch / FPS performance / screen-reader): do NOT fail them — instead list each in the report's ${L(state, "doc.manualChecklistQ")} section (acceptance criteria + method + tool), note ${L(state, "doc.envLimitQ")}, for human review.
@@ -4478,9 +5431,14 @@ ${langNote}
 3. hotfix/single-point/pure numeric/pure docs → patch; clear "add feature X" → pick lite/medium/full by size.
 4. Focused change (even with tests/regression) → lite/tech by nature; not necessarily full.
 5. [M1 ARCHITECTURE CRITERION (important)] **Architecture-level changes** — persistence/localStorage/database/standalone module/abstraction/cross-many-files without an existing reusable wrapper (like a localStorage wrapper, storage layer, state management) — even if they look like "small features", go **at least medium** (must pass the architecture stage and produce a blueprint, avoiding scattered local implementations by dev); such changes collapse under a light "micro feature" tier. Tech-driven rework (refactor/optimize/arch upgrade) is itself tech (tech also runs the lightweight blueprint now).${enExamples}
+6. [INTENT — decide before mode] \`intent\` = \`"requirement"\` **only** when this is a settled development ask. Use \`"exploration"\` for still-thinking-out-loud phrasing ("I've been wondering about adding X", "test this out", "I want to build some kind of plugin") and \`"feedback"\` for opinions/questions about existing behavior — **neither may start a pipeline**; the caller will ask the user first. When unsure between requirement and exploration, prefer \`"exploration"\` (a wasted prompt is cheaper than a wasted pipeline).
+7. [BLOCKERS — must-know gaps only] \`blockers\` = what you **cannot** settle yourself from the repo/state index **and** whose wrong guess causes rework. Each entry needs all five fields: \`settles\` (\`"installable"\` | \`"artifact"\` | \`"host"\` | \`"scope"\` | \`"ui"\` | \`"data"\` | \`"other"\` — **which verdict field the answer will decide**; use \`"other"\` when it decides no field), \`question\` (one sentence to ask the user), \`readings\` (≥2 concrete **competing** interpretations), \`changes\` (which artifact / AC / scope it changes), \`rework\` (what gets redone if guessed wrong). Anything you can self-check, or whose wrong guess costs nothing, or that has only one sensible reading → **do not list**. No such gap → \`[]\`. Never invent questions to look thorough: unqualified entries are dropped by the caller and counted against you. **Never file a gap your own verdict already answers** — the caller checks \`settles\` against your own fields and drops contradictions: with \`installable: true\` (or a requirement that already states the delivery form) the delivery-form blocker is self-contradictory and must not appear; with a settled \`host\` the "which host" blocker is likewise dropped. Real case: a requirement ending in "${en ? "install and actually work in my dsh web profile" : "装进我的 dsh web profile 里真实可用"}" still produced that blocker → one wasted clarification round (3 questions to the user) plus a second triage call for the same requirement.
+   **One gap is must-ask whenever it applies**: a **new deliverable** (\`artifact\` ∈ plugin-host / plugin-client / plugin-full / cli / lib) whose **delivery form** the requirement does not state — must it actually be **installed/published** (真能被宿主装入 / 发 npm), or is "source in the repo" enough? These give different contract sets and different ACs, and guessing wrong means redoing the packaging work at the very end (real case: a plugin shipped without its host-load entry file and bundle declaration, because "can it be installed" was never settled). Ask it as ONE blocker (\`settles: "installable"\`) with the concrete readings (e.g. "installable into the profile & verified by a real load" vs "source-only, no packaging"), then set \`installable\` from the answer. **Do not** ask it when the requirement already states the form, or when the repo already settles it (existing conventions/scripts/docs), or when you have already set \`installable: true\`.
+8. [ARTIFACT — what kind of deliverable, and does it have to install] \`artifact\` describes the **deliverable's shape**, which decides which hard contracts the PRD must turn into ACs: \`"app"\` (end-user application) / \`"plugin-host"\` (host-side plugin: service/tools/events) / \`"plugin-client"\` (browser-side UI plugin) / \`"plugin-full"\` (both halves) / \`"cli"\` / \`"lib"\` (library/module) / \`"docs"\` / \`"data"\` / \`"other"\` (a change inside an existing product rather than a new deliverable). \`installable\` = does "done" mean the artifact must be **installable/loadable by its host** (e.g. a plugin that must actually load in a profile) rather than merely "source in a directory"? Judge from the requirement's own words ("做插件""能装上""发布") plus the repo's conventions — do NOT guess \`true\` for ordinary in-repo changes. Wrong shape is expensive: a plugin that "looks complete" but cannot be loaded fails at the very end (real case: a plugin shipped without its profile-load entry file and bundle declaration passed every functional AC because "can it be loaded" was never an AC).
+9. [HOST — which framework will load this deliverable] \`host\` says **whose plugin/extension mechanism this deliverable must satisfy**; it is a DIFFERENT axis from \`artifact\` and it decides whether this project's own hard contracts even apply: \`"dsh"\` = this DeepSeek-Harness host (the project this pipeline lives in — profile entry declaration, bundle patch, \`dsh.client\` block, \`files\` whitelist); \`"other"\` = a **different** host framework (openclaw / hermes-agent / pi-agent / any other agent framework with its own plugin or extension API); \`"unknown"\` = you cannot tell from the requirement and the repo. ${en ? "A plugin built for another host must NOT be given this host's contracts — those mechanisms do not exist there, and applying them causes rework in the wrong direction." : ""} For \`"other"\`/\`"unknown"\` with a plugin-shaped deliverable, the PRD is additionally required to carry a **host-contract research** section (which host, where its plugin/extension loading contract is documented, what it actually requires) — a run without it fails the PRD stage. If the host is a **new deliverable for an unspecified host** and getting it wrong would rework everything, file it as a blocker with \`settles: "host"\`.
 
 [OUTPUT] JSON object ONLY — no commentary, no preface, no closing text. The FIRST character of your reply must be '{'. Do NOT say anything like "here is the JSON" or "Let me output the JSON" — output the object itself:
-{ "mode": "patch|lite|tech|medium|full", "slug": "<topic words> (3-24 lowercase letters/digits/hyphens, e.g. wallkick-toggle, 7bag-random; used to name the task folder)", "kind": "one-word nature", "needDesign": true|false, "complexity": "small|medium|large", "rationale": ["key argument 1","key argument 2"], "confidence": "high|medium|low" }`;
+{ "mode": "patch|lite|tech|medium|full", "slug": "<topic words> (3-24 lowercase letters/digits/hyphens, e.g. wallkick-toggle, 7bag-random; used to name the task folder)", "kind": "one-word nature", "needDesign": true|false, "complexity": "small|medium|large", "rationale": ["key argument 1","key argument 2"], "confidence": "high|medium|low", "intent": "requirement|exploration|feedback", "artifact": "app|plugin-host|plugin-client|plugin-full|cli|lib|docs|data|other", "installable": true|false, "host": "dsh|other|unknown", "blockers": [{ "settles": "installable|artifact|host|scope|ui|data|other", "question": "...", "readings": ["competing reading A","competing reading B"], "changes": "which artifact/AC/scope it changes", "rework": "what gets redone if guessed wrong" }] }`;
 };
 /** tech 档 PRD：技术变更单（无功能 AC，重范围/目标/改动面/回归）。 */
 const techChangePrompt = (requirement, root, runId, state) => `You are the senior tech lead. The current workspace IS the target project. This is a **tech-driven rework** requirement (refactor/optimize/upgrade/architecture/dependencies/tech debt) — the product doesn't need a full feature PRD, but needs a ${L(state, "doc.techChangeB")} (tech change sheet) as the contract for dev/QA/acceptance and memory write-back.
@@ -4491,7 +5449,7 @@ ${requirement}
 1. Produce the ${L(state, "doc.techChangeQ")} (Markdown), write to ${RUN(state)}/TECH-CHANGE.md — **do NOT rewrite any functional ACs in prior task-folder PRDs** (tech-driven rework adds no user-visible acceptance items in principle; if there IS a sliver of user-visible behavior change, state it explicitly in that section).
 2. Change sheet content: background & goal (one sentence), impact scope (files/modules), tech approach (key points), behavior-compatibility impact (any user-visible change), regression & verification plan (which verify commands, regression floor), risks & rollback.
 3. Sync the change's key points into docs/teamflow/memory.md (only when new conventions/todos change; same-topic line replace, idempotent); don't touch AGENTS.md beyond the teamflow managed zone.
-4. Tight (this is a contract for dev/QA, ≤120 lines), ${langDirective(LOCALE(state))}. [Boundary] only under ${TF_DOCS}/.
+4. Tight (this is a contract for dev/QA, ≤120 lines), ${langDirective(LOCALE(state))}. [Boundary] only under ${TF_DOCS}/. Also add a short "${L(state, "doc.assumptionsQ")}" section: every place the requirement was under-specified and you decided for the user, with what would change if they decide otherwise (single line if none).
 5. [State] End with a state block (phase="tech"), extra = { "verifyScripts": [...], "scopedFiles": [...] }.${STATE_BLOCK_INSTRUCTION}`;
 /** patch 档 PRD：单点修复快速确认（不产 PRD 文档）。 */
 const patchConfirmPrompt = (requirement, root, runId, state) => `You are a senior engineer. The current workspace IS the target project. This is a **hotfix / single-point fix** requirement — no full PRD, just a short confirmation (≤40 lines).
@@ -4501,7 +5459,7 @@ ${requirement}
 [REQUIREMENTS]
 1. Judge whether it truly is a single-point/hotfix: yes → output the ${L(state, "doc.confirmSheetQ")} (confirmation sheet); no → explicitly say "suggest upgrading pipeline mode (e.g. tech/lite/full)", don't force it.
 2. [Requirement vs reality] **First verify the requirement description matches the workspace reality**: matches → produce the sheet per the outline below; mismatches → explicitly note ${L(state, "doc.mismatchNoteQ")} in the sheet, **no fabricated changes**.
-3. Sheet content: fix point (file/location), change outline, regression impact (tiny / which verify commands to run), whether to bump version along the way.
+3. Sheet content: fix point (file/location), change outline, regression impact (tiny / which verify commands to run), whether to bump version along the way, plus a one-line "${L(state, "doc.assumptionsQ")}" note (what you had to assume; "none" if nothing).
 4. Output the confirmation sheet text ONLY (${langDirective(LOCALE(state))}) — **do not touch any product docs** (no PRD this time; memory write-back belongs to acceptance stage).
 5. [State] End with a state block (phase="patch"), summary = confirmation conclusion.${STATE_BLOCK_INSTRUCTION}`;
 //#endregion
@@ -4673,14 +5631,345 @@ function normalizeMode(v) {
 	if (PIPELINE_MODES.indexOf(v) !== -1) return v;
 	return null;
 }
+const ARTIFACT_KINDS = [
+	"app",
+	"plugin-host",
+	"plugin-client",
+	"plugin-full",
+	"cli",
+	"lib",
+	"docs",
+	"data",
+	"other"
+];
+/** 形态归一：非法/缺失一律 `other`（绝不因模型没给字段就套用某类契约）。 */
+const normalizeArtifact = (raw) => ARTIFACT_KINDS.indexOf(raw) !== -1 ? raw : "other";
+const ARTIFACT_HOSTS = [
+	"dsh",
+	"other",
+	"unknown"
+];
+/** 宿主归一：非法/缺失一律 `unknown`（= 去调研，绝不默认成 dsh 而套错契约）。 */
+const normalizeHost = (raw) => ARTIFACT_HOSTS.indexOf(raw) !== -1 ? raw : "unknown";
+/**
+* dsh 宿主的**确定性标识词**（护栏用；不是"自然语言理解"，是防模型漏判丢契约）。
+*
+* 只在模型判 `unknown` 时才升级为 `dsh`——**不覆盖 `other`**：模型明确判了别的宿主就尊重它，
+* 否则"开发一个 openclaw 插件，不要 dsh 那套"会被这条正则强行拖回 dsh（拿词表当身份，本项目已两次踩过）。
+*/
+const DSH_HOST_SIGNAL = /\bdsh\b|@deepseek-ai\/dsh|deepseek[- ]harness|cordis/i;
+/** 宿主护栏：模型没判出来（`unknown`）而需求里有 dsh 标识词 → 判 `dsh`（否则整条 dsh 契约静默丢失）。 */
+function forceHost(requirement, judged) {
+	if (judged === "dsh") return "dsh";
+	if (judged === "unknown" && DSH_HOST_SIGNAL.test(String(requirement || ""))) return "dsh";
+	return judged;
+}
+/** `plugin-*` = **要被宿主加载的交付物**（只有这一类才谈"宿主契约"；cli/lib/app 与宿主加载无关）。 */
+const PLUGIN_ARTIFACTS = [
+	"plugin-host",
+	"plugin-client",
+	"plugin-full"
+];
+/** 该交付物是否必须走「宿主契约调研」（= 要被宿主加载、但宿主不是我们有权威的 dsh）。 */
+function hostResearchRequired(host, kind) {
+	return host !== "dsh" && PLUGIN_ARTIFACTS.indexOf(kind) !== -1;
+}
+/**
+* 按（宿主 × 形态）取契约 —— **唯一的契约取用入口**（pipeline 调它，不再直接调 `artifactContractsFor`）。
+*
+* 规则：`plugin-*` 且 `host !== 'dsh'` → **不下发任何 dsh 契约**，改为要求「宿主契约调研」
+* （`hostResearch: true`，PRD 必须含对应段落，硬门禁在 pipeline）。其余情况照旧取形态契约
+* （`cli`/`lib` 的"有 bin / 有 main 且可 import"是通用判据，与宿主无关，不误伤）。
+*/
+function contractsForDeliverable(host, kind, installable) {
+	if (hostResearchRequired(host, kind)) return {
+		items: [],
+		hostResearch: true
+	};
+	return {
+		items: artifactContractsFor(kind, installable),
+		hostResearch: false
+	};
+}
+/**
+* **本机已安装的 dsh 插件** = 任何 dsh 插件开发者机器上**必然存在**的样本来源（首选项）。
+*
+* 由来（2026-09-21 用户实锤追问「指向的是不是都是我本地的目录，那如果用户没有的话会导致什么结果」）：
+* 旧实现在 prompt 里写「去读**本仓**同类插件样本（`plugins/dsh-plugin-teamflow`）」——那是**本仓相对路径**：
+*  - **只在工作区位于我们仓库的 `plugins/` 下时成立**（probe-v2 恰好如此，于是"有参考"是**测试被喂了答案**）；
+*  - 而 `npm pack` 实测发布包**只有 10 个文件**（`lib/*` + `package.json` + `cordis.patch.yml` + README），
+*    **源码 `client/index.tsx` / `host/index.ts` 根本不发布** → npm 用户的机器上：① 没有
+*    `plugins/dsh-plugin-teamflow` 这个路径（PM 读空或跳过 → "禁止凭记忆写"退化成空话）；
+*    ② 连我们自己的插件目录里也只有编译产物，**没有源码样本**可读。
+* 但用户在开发 dsh 插件 = 他机器上**一定装着 dsh 宿主与若干 dsh 插件**（就在 profile 的 `node_modules` 里），
+* 那些目录的 `package.json`（`dsh` 块：`bundle.patch` / `client`）与 `cordis.patch.yml` 正是
+* 「**声明怎么写**」的权威现场，且随宿主版本演进 —— 正是本契约要核实的东西。
+* 故样本首选项 = 本机已装插件；路径**运行时由 `$DSH_HOME` 表达，不写死任何绝对路径**。
+*/
+const LOCAL_PLUGIN_SAMPLES_HINT = "$DSH_HOME/profiles/*/node_modules/<任一 dsh 插件>/";
+/** 本仓样本（**次选**：仅当工作区恰好就在本仓 `plugins/` 下时可就近读；用户机器上不存在）。 */
+const ARTIFACT_REFERENCE_SAMPLES = {
+	app: [],
+	"plugin-host": ["plugins/dsh-plugin-teamflow"],
+	"plugin-client": ["plugins/dsh-plugin-teamflow"],
+	"plugin-full": ["plugins/dsh-plugin-teamflow"],
+	cli: ["plugins/assetd"],
+	lib: ["plugins/assetd"],
+	docs: [],
+	data: [],
+	other: []
+};
+const ARTIFACT_CONTRACTS = {
+	app: [],
+	"plugin-host": [
+		{
+			requirement: "宿主半必须有 profile 层加载入口声明（参照同仓既有插件，不凭记忆写字段名）",
+			criteria: "存在该声明文件/字段；**入口 `name` 必须用包根名**（写子路径会被 loader 判为\"无 client 声明\"而**静默跳过**——踩过）"
+		},
+		{
+			requirement: "该入口声明文件必须进包分发白名单（`files` 等）",
+			criteria: "读 package.json 的 files 数组，确认包含该声明文件（漏了 = 装进 profile 后不加载）"
+		},
+		{
+			requirement: "依赖协议必须是 profile 可解析的形态（不得用 `workspace:` 等本地协议）",
+			criteria: "`node -e \"const s=require('fs').readFileSync('package.json','utf8');process.exit(/workspace:/.test(s)?1:0)\"` 退出码 0"
+		},
+		{
+			requirement: "宿主运行期依赖要按宿主模块表声明（peer/可选 peer，而非真实下载依赖）",
+			criteria: "package.json 的 peerDependencies/peerDependenciesMeta 覆盖宿主提供的 @deepseek-ai/* 包"
+		},
+		{
+			requirement: "**构建产物与源码同步**（实锤 dddd：`lib` 是旧产物 → 装上后宿主启动即炸）",
+			criteria: "提交/安装前重新构建；产物里能找到只存在于当前源码的特征字符串（或产物 mtime 晚于全部 src 文件）"
+		},
+		{
+			requirement: "**装载安全**：模块顶层不得抛错（实锤 dddd：顶层访问未注入的 `ctx.settings` → 宿主起不来）",
+			criteria: "`node -e \"require('<构建产物入口>')\"` 退出码 0（能 require = 顶层无未捕获异常）"
+		},
+		{
+			requirement: "能被 profile 真实装入（**以本机探测到的安装入口为准，不得写死 profile 名/路径/命令**）",
+			criteria: "用 host 在 PRD 里注入的「本机环境」那段给出的命令（CLI 形式，或 `dsh` 不在 PATH 时的等价手动步骤：在探测到的 profile 目录 `pnpm add` + 该包进 `dsh.profile.bundles`）；装后 profile 的 `dependencies` 出现该包、`bundles` 含包名。**探测失败时改为问用户 profile 位置，不许编路径**",
+			onlyWhenInstallable: true
+		},
+		{
+			requirement: "装载后宿主真实加载该插件（端到端判据）",
+			criteria: "重启宿主后启动日志/插件列表出现该插件；仅有源码文件不算",
+			onlyWhenInstallable: true
+		},
+		{
+			requirement: "**安装必须带回滚**（实锤 dddd：装上后宿主起不来，只能另开 agent 手术卸载）",
+			criteria: "安装前先写明卸载步骤（反向操作：`pnpm remove <包名>` / `dsh plugin remove <name>`，并确认该包已从 `dsh.profile.bundles` 摘除；包名从产物 package.json 读，不写死），装后验证失败 → 立即执行卸载恢复",
+			onlyWhenInstallable: true
+		}
+	],
+	"plugin-client": [
+		{
+			requirement: "client 半必须有 bundle 声明与被扫描的 id/name（参照同仓既有插件）",
+			criteria: "package.json 的 client 声明块**字段集合与同仓样本逐字段一致**（少一个/名字错了 = loader 不扫）；构建产出非空 client 产物，且产物里能找到注册用的包 id"
+		},
+		{
+			requirement: "**UI 挂载点的 `name` 必须是 slot 名本身**（实锤：probe-v2 交付的表格对齐器把 `name` 写成插件自己的标识 `md-table-align.dock` → 与 slot 名对不上 → **静默不挂载**、工具条永不出现，而功能单测 31/31 全绿、AC 全过）",
+			criteria: "读同仓样本核实两段式写法——`ctx.slots.inject('<slot>', () => ctx.slots.register({ name: '<同一个 slot 字符串>', id: '<本插件标识>', order: N }, Component))`：`inject` 的参数与 `register` 的 `name` **必须逐字相同**，插件自己的名字放进 `id`；端到端判据仍以「装进宿主后该 UI 真的出现」为准"
+		},
+		{
+			requirement: "构建产物必须进包分发白名单",
+			criteria: "读 files 数组确认包含构建产物目录/文件（漏了 = 装进 profile 后不加载）"
+		},
+		{
+			requirement: "**构建产物与源码同步**（实锤 dddd：旧 `lib/client.js` 让浏览器端行为与源码不符）",
+			criteria: "提交/安装前重新构建；产物含当前源码特征字符串或 mtime 晚于全部 src"
+		},
+		{
+			requirement: "**安装由主 agent 执行（子代理装不了），PRD 必须给出本机可照做的步骤**",
+			criteria: "流水线子代理权限被钉死在工作区（会话原文 `permission scope was fixed ... cannot be widened`）→ 写不了 profile；**主 agent 能**（profile 写入被拒时宿主给 `escalation available`，`approval/policy: ask` 下经用户批准即可）。故 PRD 要写成「给主 agent 的安装步骤」：本机命令（取自 host 注入的本机环境）+ 重启宿主 + GUI 可见性检查三步；**不得因为子代理跑不了就默认通过**",
+			onlyWhenInstallable: true
+		}
+	],
+	"plugin-full": [
+		{
+			requirement: "宿主半必须有 profile 层加载入口声明（参照同仓既有插件，不凭记忆写字段名）",
+			criteria: "存在该声明文件/字段；**入口 `name` 必须用包根名**（子路径会被静默跳过——踩过）"
+		},
+		{
+			requirement: "client 半必须有 bundle 声明与被扫描的 id/name",
+			criteria: "client 声明块**字段集合与同仓样本逐字段一致**；构建产出非空 client 产物且含包 id"
+		},
+		{
+			requirement: "**UI 挂载点的 `name` 必须是 slot 名本身**（实锤：probe-v2 交付的表格对齐器把 `name` 写成插件自己的标识 → 与 slot 名对不上 → **静默不挂载**、工具条永不出现，而功能单测全绿）",
+			criteria: "读同仓样本核实两段式写法——`ctx.slots.inject('<slot>', () => ctx.slots.register({ name: '<同一个 slot 字符串>', id: '<本插件标识>', order: N }, Component))`：`inject` 的参数与 `register` 的 `name` **必须逐字相同**，插件自己的名字放进 `id`；端到端判据以「装进宿主后该 UI 真的出现」为准"
+		},
+		{
+			requirement: "入口声明与构建产物都必须进包分发白名单",
+			criteria: "读 package.json 的 files 数组确认包含二者（漏了 = 装进 profile 后不加载）"
+		},
+		{
+			requirement: "依赖协议必须是 profile 可解析的形态（不得用 `workspace:` 等本地协议）",
+			criteria: "读 package.json 全文不得命中 `workspace:`"
+		},
+		{
+			requirement: "宿主运行期依赖按宿主模块表声明（peer/可选 peer）",
+			criteria: "peerDependencies/peerDependenciesMeta 覆盖宿主提供的 @deepseek-ai/* 包"
+		},
+		{
+			requirement: "**构建产物与源码同步**（实锤 dddd：旧 `lib/index.js` → 装上后宿主启动即炸）",
+			criteria: "提交/安装前重新构建；宿主与 client 产物均含当前源码特征字符串（或 mtime 晚于全部 src）"
+		},
+		{
+			requirement: "**装载安全**：两个产物的模块顶层都不得抛错（实锤 dddd：顶层访问未注入服务 → 宿主起不来，P0）",
+			criteria: "`node -e \"require('<宿主产物入口>')\"` 与 client 产物同样检查，退出码 0"
+		},
+		{
+			requirement: "能被 profile 真实装入且被宿主加载（端到端；**以本机探测到的安装入口为准，不得写死 profile 名/路径/命令**）",
+			criteria: "用 host 注入的「本机环境」给出的命令（CLI 形式，或 `dsh` 不在 PATH 时的等价手动步骤：探测到的 profile 目录内 `pnpm add` + 该包进 `dsh.profile.bundles`）+ 重启宿主后启动日志出现该插件；探测失败时问用户，不许编路径",
+			onlyWhenInstallable: true
+		},
+		{
+			requirement: "**安装必须带回滚**（实锤 dddd：装上后宿主起不来，只能另开 agent 手术卸载才能救回宿主）",
+			criteria: "安装前先写明卸载步骤（反向操作：`pnpm remove <包名>` / `dsh plugin remove <name>`，并确认该包已从 `dsh.profile.bundles` 摘除；包名从产物 package.json 读，不写死），装后验证失败 → 立即执行卸载恢复",
+			onlyWhenInstallable: true
+		},
+		{
+			requirement: "**安装由主 agent 执行（子代理装不了），PRD 必须给出本机可照做的步骤**",
+			criteria: "流水线子代理权限被钉死在工作区（会话原文 `permission scope was fixed ... cannot be widened`）→ 写不了 profile；**主 agent 能**（被拒后宿主给 `escalation available`，`approval/policy: ask` 下经用户批准即可）。PRD 写成「给主 agent 的安装步骤」：本机命令 + 重启宿主 + GUI 可见性检查三步；**不得因为子代理跑不了就默认通过**（实锤：AC-7 被列为\"人工补测\"后无人真跑，用户装完才发现问题）",
+			onlyWhenInstallable: true
+		}
+	],
+	cli: [{
+		requirement: "必须有可执行入口声明",
+		criteria: "package.json 有 bin 字段且指向真实存在的文件"
+	}, {
+		requirement: "入口文件可被执行",
+		criteria: "直接运行该入口（或 `--help`）退出码 0"
+	}],
+	lib: [{
+		requirement: "必须声明模块入口且导出可用",
+		criteria: "package.json 的 main/exports 指向真实文件，且能被 import 成功"
+	}],
+	docs: [],
+	data: [],
+	other: []
+};
+/** 取某形态的契约项（`installable=false` 时过滤掉安装类项）。 */
+function artifactContractsFor(kind, installable) {
+	return (ARTIFACT_CONTRACTS[kind] || []).filter((it) => !it.onlyWhenInstallable || installable);
+}
+const TRIAGE_SETTLES = [
+	"installable",
+	"artifact",
+	"host",
+	"scope",
+	"ui",
+	"data",
+	"other"
+];
+/** 归一：非法/缺失一律 `other`（= 不参与自洽门禁，绝不因字段缺失误丢一条真缺口）。 */
+const normalizeSettle = (raw) => TRIAGE_SETTLES.indexOf(raw) !== -1 ? raw : "other";
+const TRIAGE_INTENTS = [
+	"requirement",
+	"exploration",
+	"feedback"
+];
+/**
+* 档位「轻重」序（**只用于架构护栏强升**）。tech 与 lite 同级——两者都跑轻量蓝图，差异在语义不在轻重；
+* patch 最轻（单 agent 直改）。
+*/
+const MODE_RANK = {
+	patch: 0,
+	lite: 1,
+	tech: 1,
+	medium: 2,
+	full: 3
+};
+/**
+* **架构护栏强升**（ADR-0006 的护栏不得因「调用方显式指定档位」而失效）。
+*
+* 背景（2026-09-16 实测）：`lite` 参数描述里写了 "(recommended) for small changes"，模型逐字引用它自行传
+* `lite: true`——33 次启动里 14 次显式传档位（其中 0 次先跑 `teamflow_triage` 预览），于是 triage 的
+* 「架构信号 → 至少 medium」护栏与澄清闸门在 **42% 的启动**上被静默绕过。
+*
+* 规则：调用方**没给**档位 → 用分诊的；给了更轻的档位而分诊判 ≥medium → 升到分诊档位（架构型需求不得
+* 走轻档位）；调用方给的是 medium/full（或已 ≥ 分诊档位）→ **保持调用方选择**（避免无谓 token 放大）。
+* 返回 null 表示不改动。
+*
+* **`needDesign` 档位下限**（2026-09-18 probe-v2 实锤新增）：调用方**没给档位**却显式传了
+* `needDesign=true`（= 明确要求设计阶段），而分诊回了 `lite` —— 两件事语义冲突（`lite` 的档位定义就是
+* 「no UI design」，见 MODE 表 / `resolveStages`），旧实现让分诊的 lite 直接落地。当时 prompt 里
+* `needDesign=true → 强升 medium` 只是 regex **预筛提示**（模型可无视，实测就被无视了），这里把它变成
+* 宿主判定：**未给档位时显式 needDesign 拖到 ≥medium**。调用方显式给了 `mode`/`lite` 时依旧以调用方为准
+* （`lite` + `needDesign` 由 `resolveStages` 按 flag 追加设计阶段，不吞显式请求，也不改档位标签）。
+*/
+function guardrailUpgrade(explicit, lite, triaged, opts) {
+	const want = MODE_RANK[triaged] || 0;
+	if (!explicit && !lite) {
+		if (opts && opts.needDesign === true && want < MODE_RANK.medium) return "medium";
+		return triaged;
+	}
+	if ((explicit ? MODE_RANK[explicit] || 0 : MODE_RANK.lite) <= MODE_RANK.lite && want >= MODE_RANK.medium) return triaged;
+	return null;
+}
+/** 意图归一：非法/缺失一律 `requirement`（**绝不因为模型没给字段就拦启动**）。 */
+const normalizeIntent = (raw) => TRIAGE_INTENTS.indexOf(raw) !== -1 ? raw : "requirement";
+/**
+* **host 侧合格线**（防仪式化：prompt 只是请求，这里才是判定）。
+* 三条证据必须齐全：① ≥2 个互斥读法 ② 改变哪个产物/AC/范围 ③ 猜错返工什么。
+* 缺一即丢弃并计数——模型几乎总能为任何需求凑出"问题"，不合格线就会退化成每次都打断。
+* 上限 3 条（超过的部分按丢弃计）。
+*
+* **自洽门禁**（2026-09-18 probe-v2 实锤新增）：`ctx.installable === true` 表示同一次裁决已经**明确判定**
+* 「必须可安装/可被宿主加载」；此时任何 `settles === 'installable'` 的 blocker 都是**自我矛盾**——它问的
+* 那件事已经被自己答了。实测代价：这条 blocker 凭空造出一轮澄清（用户答了 3 个问题）→ 输入变了 →
+* 缓存必然不命中 → **同一条需求被分诊两次**（lite 15.8k + medium 15.6k），用户看到两张「需求分诊」卡。
+* 注意只按 `true` 判：`false` 是"模型没给这个字段"的默认值，既可能是「不需要装」也可能是「还不知道」——
+* 后者正是 must-ask 缺口的合法形态，丢了它就会重演 dddd「插件装不进 profile」。
+*/
+function qualifyBlockers(raw, ctx) {
+	const arr = Array.isArray(raw) ? raw : [];
+	const good = [];
+	let dropped = 0;
+	for (const b of arr) {
+		const o = b && typeof b === "object" ? b : null;
+		const question = String(o && o.question || "").trim();
+		const readings = Array.isArray(o && o.readings) ? o.readings.map((x) => String(x === null || x === void 0 ? "" : x).trim()).filter(Boolean) : [];
+		const changes = String(o && o.changes || "").trim();
+		const rework = String(o && o.rework || "").trim();
+		if (question && readings.length >= 2 && changes && rework) {
+			const settles = normalizeSettle(o && o.settles);
+			if (settles === "installable" && ctx && ctx.installable === true) {
+				dropped++;
+				continue;
+			}
+			if (settles === "host" && ctx && ctx.host && ctx.host !== "unknown") {
+				dropped++;
+				continue;
+			}
+			good.push({
+				settles,
+				question: question.slice(0, 300),
+				readings: readings.slice(0, 4).map((r) => r.slice(0, 200)),
+				changes: changes.slice(0, 300),
+				rework: rework.slice(0, 300)
+			});
+		} else dropped++;
+	}
+	const kept = good.slice(0, 3);
+	return {
+		blockers: kept,
+		dropped: dropped + Math.max(0, good.length - kept.length)
+	};
+}
 /** 解析模型 JSON 输出（容错：定位首个 {...} 块；字段缺失/非法回退 null）。 */
-function parseVerdictText(text) {
+function parseVerdictText(text, requirement = "") {
 	const m = String(text || "").match(/\{[\s\S]*\}/);
 	if (!m) return null;
 	try {
 		const raw = JSON.parse(m[0]);
 		const mode = normalizeMode(raw.mode);
 		if (!mode) return null;
+		const host = forceHost(requirement, normalizeHost(raw.host));
+		const qb = qualifyBlockers(raw.blockers, {
+			installable: raw.installable === true,
+			host
+		});
 		return {
 			mode,
 			kind: typeof raw.kind === "string" ? raw.kind : "",
@@ -4697,14 +5986,52 @@ function parseVerdictText(text) {
 				"low"
 			].indexOf(raw.confidence) !== -1 ? raw.confidence : "medium",
 			slug: /^[a-z0-9][a-z0-9-]{2,23}$/.test(String(raw.slug || "")) ? String(raw.slug) : "",
-			source: "model"
+			source: "model",
+			intent: normalizeIntent(raw.intent),
+			artifact: normalizeArtifact(raw.artifact),
+			installable: raw.installable === true,
+			host: forceHost(requirement, normalizeHost(raw.host)),
+			blockers: qb.blockers,
+			blockersDropped: qb.dropped
 		};
 	} catch (e) {
 		return null;
 	}
 }
-/** 兜底：正则预筛 → fallback verdict（模型分诊不可用/超时/解析失败时）。 */
-function fallbackVerdict(requirement, opts, locale = "zh") {
+/**
+* `journal.triage` 的落盘记录（shadow 埋点 **+ 下游消费面**）。
+*
+* ⚠️ **这里是「白名单漏字段」的第五次现场（2026-09-18 实锤，勿回退）**：旧版只搬 9 个字段，
+* **漏了 `artifact` / `installable`** → `pipeline` 的形态契约注入读 `journal.triage.artifact`
+* 永远拿到 `undefined` → `normalizeArtifact(undefined)` = `'other'` → `artifactContractsFor('other')`
+* 恒为 `[]` → **`[交付形态契约]` 从未注入过任何 PRD**。实测：全部 **64/64** 个 run 的 `triage` 都
+* 不带 `artifact`，`log.artifactContract` **一次都没落过**。即 2026-09-17 为 `dddd`（插件"看着完整"
+* 却装不进 profile、功能 AC 全绿 → 验收照样通过）建的那道防线**一直没生效**。
+*
+* 教训：这个函数不是"挑几个有价值的字段记一记"，而是**接口字段的完整搬运** —— 每个 `TriageVerdict`
+* 顶层键要么在这里被搬、要么有明确归属（见 `test/triage-gate.test.js` 的豁免表与结构化门禁，
+* 它会把「新加字段忘了搬」变成红灯）。
+*/
+function triageRecordOf(v) {
+	return {
+		mode: v.mode,
+		kind: v.kind,
+		complexity: v.complexity,
+		confidence: v.confidence,
+		source: v.source,
+		intent: v.intent,
+		blockers: v.blockers,
+		blockersDropped: v.blockersDropped,
+		artifact: normalizeArtifact(v.artifact),
+		installable: v.installable === true,
+		host: normalizeHost(v.host),
+		upgradedFrom: v.__upgradedFrom || null
+	};
+}
+/** 兜底：正则预筛 → fallback verdict（模型分诊不可用/超时/解析失败时）。`reason` = 退化原因（可见化：
+*  2026-09-18 probe-clock 实锤——分诊子代理**推理中被 90s 超时 dispose**（截图「已停止」），journal 只记
+*  一条 fallback info，没人知道为什么；现在把原因带回给调用方落 warn）。 */
+function fallbackVerdict(requirement, opts, locale = "zh", reason) {
 	const pre = suggestMode(requirement, opts, locale);
 	return {
 		mode: pre.mode,
@@ -4714,16 +6041,86 @@ function fallbackVerdict(requirement, opts, locale = "zh") {
 		rationale: [...pre.rationale, t(locale, "triage.fallback")],
 		confidence: pre.confidence,
 		slug: "",
-		source: "fallback"
+		source: "fallback",
+		intent: "requirement",
+		blockers: [],
+		blockersDropped: 0,
+		artifact: "other",
+		installable: false,
+		host: forceHost(requirement, "unknown"),
+		...reason ? { fallbackReason: String(reason).slice(0, 300) } : {}
 	};
 }
 /** 模型驱动分诊：spawn「分诊分析师」子代理思考一轮；子代理不可用/超时/解析失败 → 正则兜底。
 * 解析失败先带纠错提示重试一次（实锤 run tf-mtfo8exi：模型输出「Let me output the JSON.」开场白
-* 后无 JSON——首轮输出预算被思考耗尽/模型停早；重试提示直接输出 JSON 对象本身）。 */
+* 后无 JSON——首轮输出预算被思考耗尽/模型停早；重试提示直接输出 JSON 对象本身）。
+* **超时 240s**（2026-09-18 实锤修正，勿回退 90s）：分诊职责今天已含 intent/blockers/artifact/installable
+* 判定（输出字段翻倍），深思考模型 90s 内经常答不完 → 被 dispose（UI 显示「已停止」）→ 两次尝试全废 →
+* fallback。probe-clock 截图实证：模型推理到 artifact 判别处被掐，推理质量很高、不是卡死。 */
+const TRIAGE_TIMEOUT_MS = 24e4;
+const triageCache = /* @__PURE__ */ new Map();
+/** 缓存键 = 需求 + 澄清答复（**不含任何决策字段**；见上方注释）。 */
+function triageCacheKey(requirement, supplement) {
+	const sup = typeof supplement === "string" ? supplement.trim() : "";
+	return `${String(requirement || "").trim()}\u0000${sup}`;
+}
+/** 读缓存。**待决策条目无视 TTL**（见上方注释）；非待决策条目按 TTL 兜底回收。 */
+function triageCacheGet(key) {
+	const hit = triageCache.get(key);
+	if (!hit) return null;
+	if (!hit.pendingDecision && Date.now() - hit.at > 72e5) {
+		triageCache.delete(key);
+		return null;
+	}
+	return hit.verdict;
+}
+/**
+* 写缓存（**仅 model 裁决**；容量超限淘汰最旧）。
+* @param pendingDecision 该裁决是否**仍未被消费**（= 本次调用会返回 needs-decision、不建 run）。
+*   工具侧两次调用共享同一 key，故：首次预检返回 needs-decision 时置 true（下次复用，隔多久都行）；
+*   建 run 成功时置 false（这条需求的决策已落地，缓存降级为普通短期缓存）。
+*/
+function triageCachePut(key, verdict, pendingDecision = false) {
+	if (!verdict || verdict.source !== "model") return;
+	triageCache.delete(key);
+	triageCache.set(key, {
+		verdict,
+		at: Date.now(),
+		pendingDecision
+	});
+	while (triageCache.size > 32) {
+		const oldest = triageCache.keys().next();
+		if (oldest.done) break;
+		triageCache.delete(oldest.value);
+	}
+}
+/**
+* 标记「仍在等用户决策」（工具返回 needs-decision / needs-clarification 时调用）。
+*
+* **为什么不重新 put 一次**：`put` 会被 `source !== 'model'` 拦掉，而这里要处理的情况是
+* 「缓存里**已有**裁决、现在要把它标成待决策」——只能就地改状态。若缓存里没有该键（例如裁决来自
+* fallback、根本没入缓存），这里是**无操作**（下次调用老老实实重跑分诊，符合预期）。
+*/
+function triageCacheMarkPending(key) {
+	const hit = key ? triageCache.get(key) : void 0;
+	if (hit) hit.pendingDecision = true;
+}
+/**
+* 决策已落地 → 清除「待决策」标记（**保留裁决本身**，降级为普通短期缓存）。
+* 调用点：`teamflow_start` 在建 run 成功之后（此时这条需求的启动决策已用完）。
+*/
+function triageCacheSettle(key) {
+	const hit = triageCache.get(key);
+	if (hit) {
+		hit.pendingDecision = false;
+		hit.at = Date.now();
+	}
+}
 async function runTriage(requirement, opts, parent, signal, locale = "zh") {
 	const subagents = runtime.subagents;
-	if (!subagents || typeof subagents.start !== "function") return fallbackVerdict(requirement, opts, locale);
+	if (!subagents || typeof subagents.start !== "function") return fallbackVerdict(requirement, opts, locale, "subagents service unavailable");
 	const pre = suggestMode(requirement, opts, locale);
+	let lastReason = "";
 	for (let attempt = 1; attempt <= 2; attempt++) {
 		let run = null;
 		try {
@@ -4737,10 +6134,12 @@ async function runTriage(requirement, opts, parent, signal, locale = "zh") {
 				parent,
 				signal
 			});
-			const result = await Promise.race([run.result, new Promise((_, rej) => setTimeout(() => rej(new Error(t(locale, "err.triageTimeout"))), 9e4))]);
-			const parsed = parseVerdictText(extractText(result && result.output));
+			const result = await Promise.race([run.result, new Promise((_, rej) => setTimeout(() => rej(/* @__PURE__ */ new Error(t(locale, "err.triageTimeout") + ` (${Math.round(TRIAGE_TIMEOUT_MS / 1e3)}s)`)), TRIAGE_TIMEOUT_MS))]);
+			const parsed = parseVerdictText(extractText(result && result.output), requirement);
 			if (parsed) return parsed;
+			lastReason = `empty/unparseable verdict (stopReason=${result && result.stopReason || "unknown"})`;
 		} catch (e) {
+			lastReason = String(e && e.message || e);
 			if (attempt === 2) {}
 		} finally {
 			if (run && run.dispose) try {
@@ -4748,7 +6147,7 @@ async function runTriage(requirement, opts, parent, signal, locale = "zh") {
 			} catch (e) {}
 		}
 	}
-	return fallbackVerdict(requirement, opts, locale);
+	return fallbackVerdict(requirement, opts, locale, lastReason);
 }
 //#endregion
 //#region host/core/report.ts
@@ -4849,12 +6248,45 @@ function deliverCompletion(journal, parent) {
 		const needsHumanNotice = journal.humanIntervention && !acceptanceDone ? t(locale, "report.needsHumanNoAcceptance") : journal.knownIssuesAcceptance === true ? t(locale, "report.knownIssuesNoMerge") : "";
 		const noticeKey = `report.noticeStatus.${journal.status}`;
 		const noticeStatus = t(locale, noticeKey) === noticeKey ? journal.status : t(locale, noticeKey);
+		const cancelSrcKey = `cancelSource.${journal.cancelSource || "unknown"}`;
+		const cancelSourceLine = journal.status === "cancelled" || journal.cancelled === true ? t(locale, "report.cancelSource", { source: t(locale, cancelSrcKey) }) : "";
+		const assumptionsLine = journal.assumptions && String(journal.assumptions).trim() ? t(locale, "report.assumptions", { list: clip(String(journal.assumptions), 900) }) : "";
+		const externalLine = journal.externalFailure === true ? t(locale, "report.externalFailure") : "";
+		const installLine = (() => {
+			try {
+				const env = journal.installEnv;
+				if (!env) return "";
+				const art = normalizeArtifact(journal.triage?.artifact);
+				if (PLUGIN_ARTIFACTS.indexOf(art) === -1) return "";
+				if (env.ok !== true) return t(locale, "report.installAskUser");
+				return t(locale, "report.installPending", {
+					dir: env.profileDir || "?",
+					how: env.cliOnPath === true ? t(locale, "report.installHowCli", { profile: env.profile || "?" }) : t(locale, "report.installHowManual")
+				});
+			} catch (e) {
+				return "";
+			}
+		})();
+		const vcsLine = (() => {
+			try {
+				if (!journal.workspacePath) return "";
+				if (loadState(journal.workspacePath).gitMode === "none") return t(locale, "log.noVcsByChoice");
+				if (journal.status === "completed") return t(locale, "report.vcsArchived");
+				return "";
+			} catch (e) {
+				return "";
+			}
+		})();
 		const text = [
 			t(locale, "report.header", { id: journal.id }),
 			t(locale, "report.statusLine", {
 				status: statusLine,
 				error: journal.error ? t(locale, "report.error", { error: clip(journal.error, 300) }) : ""
 			}),
+			externalLine,
+			vcsLine,
+			cancelSourceLine,
+			assumptionsLine,
 			t(locale, "report.stagesLine", { stages: stagesLine }),
 			t(locale, "report.agents", { n: journal.agentsStarted || 0 }),
 			tokenLine,
@@ -4864,11 +6296,13 @@ function deliverCompletion(journal, parent) {
 				const m = journal.options && journal.options.mode;
 				return typeof m === "string" && m !== "full" && m !== "medium" ? t(locale, "report.mode", { mode: modeLabel(locale, m, MODE_REGISTRY[m] ? MODE_REGISTRY[m].label : m) }) : "";
 			})(),
+			journal.engine && (journal.engine.provider || journal.engine.model) ? t(locale, "report.engine", { engine: `${journal.engine.provider || "?"}/${journal.engine.model || "?"}` }) : "",
 			t(locale, "report.backlog", { reqId: journal.reqId || "—" }),
+			installLine,
 			needsHumanNotice,
 			mergeHint,
 			t(locale, "report.tabHint"),
-			t(locale, "report.next"),
+			journal.status === "cancelled" || journal.cancelled === true ? t(locale, "report.nextCancelled") : t(locale, "report.next"),
 			t(locale, "report.relay")
 		].filter(Boolean).join("\n");
 		const message = createUserMessage({
@@ -4877,8 +6311,7 @@ function deliverCompletion(journal, parent) {
 				text
 			}],
 			source: {
-				kind: "plugin",
-				plugin: "dsh-plugin-teamflow",
+				kind: "plugin:dsh-plugin-teamflow",
 				form: "notice",
 				summary: t(locale, "report.notice", {
 					status: noticeStatus,
@@ -5213,11 +6646,30 @@ function sweepWorkspaceLogs(journal, locale = "zh") {
 * 【档位阶段集】按 mode（full/medium/lite/tech/patch）经 STAGE_POLICY（constants.ts）
 * 展开实际执行阶段集（resolveStages），再与团队阶段取交集——见 ADR-0004。
 */
+/** 插件自身模块文件路径（用于反推当前 profile 目录；`import.meta.url` 在 ESM 产物里可用）。 */
+function selfModulePath() {
+	try {
+		return fileURLToPath(import.meta.url);
+	} catch (e) {
+		return "";
+	}
+}
+/** `dsh` 是否在 PATH（CLI 入口可用性）。探测失败一律按"不在"处理（走等价手动步骤，更保守）。 */
+function cliOnPath() {
+	try {
+		return spawnSync(process.platform === "win32" ? "where" : "which", ["dsh"], {
+			stdio: "ignore",
+			windowsHide: true,
+			timeout: 4e3
+		}).status === 0;
+	} catch (e) {
+		return false;
+	}
+}
 /** dev 子卡/阶段 label 的「开发 · 」前缀与重试后缀：zh 存量兼容 + en 新增（QA-2：既有解析契约只增不改）。
 *  en 侧必须覆盖词典 `dev.taskRetry` 的实际产出 `(attempt N)`（R3-2 实锤：只写 retry \d+ 时，
 *  无 taskKey 的存量/异常数据走 label 兜底会漏剥离，任务标题归一失效）——**只增不改 zh 分支**。 */
 const DEV_TITLE_PREFIX = /^(?:开发|Dev) · /;
-const RETRY_SUFFIX = /(?:（(?:第 \d+ 次重试|补跑)）| \((?:retry \d+|attempt \d+|follow-up run)\))$/;
 /** 从 journal 已完成阶段重建断点续跑产物（prd/design/scaffold/tech/qa/acceptance/dev）。 */
 function buildResumeProducts(journal) {
 	const products = {};
@@ -5302,18 +6754,139 @@ function ensureLogGitignore(cwd, journal, locale = "zh") {
 		return false;
 	}
 }
-/** 任务夹产物读取（单轨契约：文件即产物——QA/验收 host 只读文件，回复仅摘要）。
-* 缺失/空/读取异常返回 null（调用方决定硬失败或 journal 兜底）。 */
-function artifactText(journal, fileName) {
-	const path = journal && journal.workspacePath && journal.runDocs ? `${journal.workspacePath}/${journal.runDocs}/${fileName}` : null;
-	if (!path) return null;
-	try {
-		if (!existsSync(path)) return null;
-		const t = readFileSync(path, "utf8").trim();
-		return t ? t : null;
-	} catch (e) {
-		return null;
+/**
+* 基线提交前的**索引层排除**（2026-09-18 方案 B 根治，勿回退）：
+* 冷启动 `git add -A` 可能被海量噪音拖过超时（.pnpm-store 数万硬链接，probe-clock 实测 549 文件/51MB），
+* 基线提交被杀。排除项走 `tfAddArgs(BASELINE_NOISE_EXCLUDES)` 的 **magic pathspec**——
+* **只影响这一次 git 调用，绝不写用户的 `.gitignore`**。
+*
+* **旧实现为什么必须删**（用户实锤截图）：`ensureCommonNoiseIgnores()` 把 `.pnpm-store/` 写进用户
+* `.gitignore`，且因 `mergeGitignore` 的注释是**整批一条**，它顶着「TeamFlow 运行日志（插件自有产物…）」
+* 的文案落盘——注释张冠李戴只是表象，真问题是**越界**：`.gitignore` 是用户的项目资产，"该忽略什么"
+* 归 L2（PRD 阶段 PM 按技术栈规划，见 prdPrompt 必查项）与 L3（QA 收口探针）以及用户本人。
+*/
+/** 任务夹产物读取助手 `artifactText` 见 util.ts（pipeline/runner 共用：doc 类阶段的产物兜底要用它）。 */
+/**
+* tool 侧预检透传的分诊裁决（2026-09-16 需求澄清闸门）：只接受形状正确的对象；
+* 形状不对 → 返回 null，走回「内部再跑一次分诊」的原路径（绝不因为透传字段坏掉就跳过路由）。
+*/
+function normalizeTriagePassthrough(raw) {
+	const o = raw && typeof raw === "object" ? raw : null;
+	if (!o) return null;
+	const mode = normalizeMode(o.mode);
+	if (!mode) return null;
+	const qb = qualifyBlockers(o.blockers, {
+		installable: o.installable === true,
+		host: forceHost(o.requirement, normalizeHost(o.host))
+	});
+	return {
+		mode,
+		kind: typeof o.kind === "string" ? o.kind : "",
+		needDesign: o.needDesign === true,
+		complexity: [
+			"small",
+			"medium",
+			"large"
+		].indexOf(String(o.complexity)) !== -1 ? String(o.complexity) : "medium",
+		rationale: Array.isArray(o.rationale) ? o.rationale.map((x) => String(x)).slice(0, 6) : [],
+		confidence: [
+			"high",
+			"medium",
+			"low"
+		].indexOf(String(o.confidence)) !== -1 ? String(o.confidence) : "medium",
+		slug: /^[a-z0-9][a-z0-9-]{2,23}$/.test(String(o.slug || "")) ? String(o.slug) : "",
+		source: o.source === "fallback" ? "fallback" : "model",
+		intent: normalizeIntent(o.intent),
+		artifact: normalizeArtifact(o.artifact),
+		installable: o.installable === true,
+		host: forceHost(o.requirement, normalizeHost(o.host)),
+		blockers: qb.blockers,
+		blockersDropped: qb.dropped,
+		upgradedFrom: normalizeMode(o.__upgradedFrom) || null
+	};
+}
+/**
+* PRD 收口：① 摘「假设 / 待澄清」段落 `journal.assumptions`；② **宿主契约调研硬门禁**。
+*
+* ① 的由来（2026-09-16 需求澄清闸门 Phase 1）：实测 **12/12（另一次 39/39）份 PRD 都没记录过假设**——
+* agent 的替代决定完全不可见，验收人无从判断"这份 PRD 是不是我想要的"。缺失只记 warn（policy 级）。
+*
+* ② 的由来（2026-09-18 用户实锤，**偏硬**）：交付物要被**非 dsh 宿主**加载（openclaw/hermes/pi…）时，
+* dsh 的契约一条都不适用，而我们对其没有权威 → PRD **必须含「宿主契约调研」段**（目标宿主是哪个、
+* 从哪儿读到它的插件加载契约、核实到哪些要求）。缺失 → 返回失败原因（由调用方抛阶段失败 → 走重试诊断），
+* 而不是只记 warn：用户原话「不然你上下文都不知道你开发个啥出来都不知道」。
+*
+* @returns 硬门禁失败原因（null = 通过或本 run 不需要该段）
+*/
+function notePrdAssumptions(journal, locale) {
+	const doc = artifactText(journal, "PRD.md") || artifactText(journal, "TECH-CHANGE.md");
+	if (!doc) return null;
+	const body = extractAssumptionsSection(doc);
+	if (body) {
+		journal.assumptions = clip(body, 2e3);
+		journal.logs.push({
+			t: Date.now(),
+			level: "info",
+			message: t(locale, "log.prdAssumptions", { n: body.split(/\n+/).filter((l) => l.trim()).length })
+		});
+	} else journal.logs.push({
+		t: Date.now(),
+		level: "warn",
+		message: t(locale, "log.prdAssumptionsMissing")
+	});
+	if (journal.hostResearch === true) {
+		const hr = extractHostResearchSection(doc);
+		if (!hr) {
+			journal.logs.push({
+				t: Date.now(),
+				level: "error",
+				message: t(locale, "log.hostResearchMissing")
+			});
+			return t(locale, "log.hostResearchMissing");
+		}
+		journal.hostContract = clip(hr, 2e3);
+		journal.logs.push({
+			t: Date.now(),
+			level: "info",
+			message: t(locale, "log.hostResearchOk", { n: hr.split(/\n+/).filter((l) => l.trim()).length })
+		});
 	}
+	return null;
+}
+/**
+* 需求澄清闸门 · pipeline 侧兜底（2026-09-16 实测补充）：分诊判「还不是明确需求」或存在合格 must-know
+* 缺口 → **不开工**，把 run 落成**可续跑的中断态**（不建任何阶段），由完成汇报把问题交给主线程去问用户，
+* 用户答完带 `requirementSupplement` 重调（或 `teamflow_resume` 续跑）。
+*
+* 为什么兜底放在 pipeline 而不是只靠 tool 侧预检：预检在**工具调用内**跑，模型分诊可能失败并静默退回
+* 正则兜底（实测 `tf-mu35oza7-wmuckz` 漏传 signal → 0.4s fallback）→ 只靠预检会让闸门在那种情况下静默失效。
+* 代价：这一条罕见路径会留下一个零阶段 run（status=interrupted + humanIntervention），比"静默开跑"划算。
+*/
+function abortForClarification(journal, locale, verdict) {
+	journal.interrupted = true;
+	journal.interruptedAt = Date.now();
+	journal.humanIntervention = true;
+	journal.error = t(locale, "run.needsClarification", {
+		intent: verdict.intent,
+		n: verdict.blockers.length
+	});
+	journal.logs.push({
+		t: Date.now(),
+		level: "warn",
+		message: t(locale, "log.clarifyAbort", {
+			intent: verdict.intent,
+			n: verdict.blockers.length
+		})
+	});
+	for (const b of verdict.blockers) journal.logs.push({
+		t: Date.now(),
+		level: "warn",
+		message: t(locale, "log.clarifyBlocker", {
+			q: clip(b.question, 200),
+			changes: clip(b.changes, 160),
+			rework: clip(b.rework, 160)
+		})
+	});
 }
 /**
 * 断点续跑起点：第一个「没有任意 done 尝试」的阶段。
@@ -5327,42 +6900,42 @@ function interruptedPhaseOf(journal) {
 		const phaseStages = (journal.stages || []).filter((s) => phaseKeyOf(s.phase) === phase);
 		if (phaseStages.length === 0) continue;
 		if (phase === "dev") {
+			backfillDevTaskIds(phaseStages, buildDevTaskDefs(journal, [], runLocaleOf(journal)));
 			if ([...devTaskStatuses(phaseStages).values()].some((st) => !st.done)) return phase;
 		} else if (!phaseStages.some((s) => s.status === "done")) return phase;
 	}
 	return "acceptance";
 }
-/** 任务级聚合（journal 驱动，2026-09-06 状态机化）：按 stage.taskKey（旧数据 label 兜底）分组——
-* 有 done stage = 任务已成功（历史失败尝试不算失败）。
-* resume 补跑判定/阶段完成判定共用；不读 backlog（两块业务线解耦——残留失败卡污染判定实锤 json-parse r1）。 */
-function devTaskStatuses(stages) {
-	const m = /* @__PURE__ */ new Map();
-	for (const s of stages || []) {
-		const title = String(s.taskKey || String(s.label || "").replace(DEV_TITLE_PREFIX, "").replace(RETRY_SUFFIX, "").trim());
-		if (!title) continue;
-		const cur = m.get(title) || {
-			done: false,
-			lastStatus: null,
-			lastSeq: -1
-		};
-		if ((s.seq || 0) > cur.lastSeq) {
-			cur.lastSeq = s.seq || 0;
-			cur.lastStatus = s.status || null;
-		}
-		if (s.status === "done") cur.done = true;
-		m.set(title, cur);
-	}
-	return m;
+/** 任务级聚合见 `util.devTaskStatuses`（纯函数，放 util 以便行为级测试直接 import——
+*  pipeline 链到宿主私有 peer `@deepseek-ai/dsh-llm`，测试取不到，同 `cancelRun` 的处置）。
+*  任务身份与 resume 判定的完整论证见该函数注释。 */
+/**
+* 读 journal 后**先补算存量 stage 的 id** 再判定（2026-09-18 二次修正，勿回退）。
+*
+* 为什么：升级前的 stage 只写了 `taskKey`（title）。若直接判定（只认 id），历史成果会被
+* 当成"没做过"——实测 probe-cache `tf-mu6tb281`：纯 title 判定补跑 2 个，而"只认 id +
+* 存量回退 title"两头不靠 → **补跑 8 个**。补算后**只有一个键空间**（id），存量自愈并写回 journal。
+* 补算用**蓝图 title 匹配**（结构化 → 文本），不切分 title；合并执行的 stage 会补出多个 id。
+*
+* @returns 含 id 的任务定义（供后续 filter/completed 判定用）
+*/
+function devTaskDefsWithBackfill(journal, tasks, locale) {
+	const defs = buildDevTaskDefs(journal, tasks, locale);
+	const patched = backfillDevTaskIds(journal.stages || [], defs);
+	if (patched > 0) journal.logs.push({
+		t: Date.now(),
+		level: "info",
+		message: t(locale, "log.devIdsBackfilled", { n: patched })
+	});
+	return defs;
 }
-/** 开发任务定义（单一来源）：架构蓝图自动拆 > 调用方显式 tasks > 整体开发兜底。
-* resume 补跑与正常执行共用（defByTitle 按 title 匹配失败子卡）。 */
 function buildDevTaskDefs(journal, tasks, locale = "zh") {
 	const blueprintTasks = journal.blueprint && Array.isArray(journal.blueprint.tasks) && journal.blueprint.tasks.length ? journal.blueprint.tasks.map((t) => ({
 		title: t.title || t(locale, "dev.blueprintTask"),
 		files: Array.isArray(t.files) ? t.files : [],
 		spec: t.spec || ""
 	})) : [];
-	return blueprintTasks.length ? blueprintTasks : tasks.length > 0 ? tasks.map((t) => ({
+	return (blueprintTasks.length ? blueprintTasks : tasks.length > 0 ? tasks.map((t) => ({
 		title: t.title,
 		spec: t.spec,
 		files: []
@@ -5370,7 +6943,12 @@ function buildDevTaskDefs(journal, tasks, locale = "zh") {
 		title: t(locale, "dev.overall"),
 		spec: t(locale, "dev.overallSpec"),
 		files: []
-	}];
+	}]).map((d, i) => ({
+		id: devTaskIdAt(i),
+		title: d.title,
+		spec: d.spec,
+		files: d.files || []
+	}));
 }
 /**
 * 执行流水线。resume = null 全新运行；resume = { phase, products } 从断点续跑：
@@ -5380,9 +6958,26 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 	journal.status = "running";
 	if (!parseLocale(journal.locale)) journal.locale = localeForMissingSnapshot(!!resume);
 	const locale = runLocaleOf(journal);
+	if (!journal.engine) try {
+		const r = resolveChildRoute(parent);
+		const engine = {
+			provider: r.provider || providerName() || null,
+			model: r.model || null
+		};
+		journal.engine = engine;
+		journal.logs.push({
+			t: Date.now(),
+			level: "info",
+			message: t(locale, "log.engine", {
+				provider: engine.provider || "?",
+				model: engine.model || "?"
+			})
+		});
+	} catch (e) {}
 	if (!resume) journal.startedAt = Date.now();
 	const root = options.productRoot || null;
 	journal.product = root;
+	journal.requirementSupplement = options.requirementSupplement ? String(options.requirementSupplement) : null;
 	const scopeKey = journal.workspace || root || "default";
 	if (activeProducts.has(scopeKey) && activeProducts.get(scopeKey) !== journal.id) {
 		journal.status = "failed";
@@ -5399,27 +6994,118 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 		sweepWorkspaceLogs(journal, locale);
 	} catch (e) {}
 	let triageSlug = "";
-	if (options.mode === void 0 && !options.lite) try {
-		const verdict = await runTriage(requirement, { needDesign: options.needDesign }, parent, signal, locale);
-		options.mode = verdict.mode;
-		if (verdict.needDesign && !options.needDesign) options.needDesign = true;
-		triageSlug = verdict.slug || "";
-		journal.options = Object.assign({}, options);
+	const preTriage = normalizeTriagePassthrough(options.__triage);
+	const preTriageError = String(options.__triageError || "");
+	if (preTriage) {
+		triageSlug = preTriage.slug || "";
+		journal.triage = triageRecordOf(preTriage);
 		journal.logs.push({
 			t: Date.now(),
 			level: "info",
 			message: t(locale, "log.triage", {
-				kind: verdict.kind,
-				mode: verdict.mode,
-				source: verdict.source
+				kind: preTriage.kind,
+				mode: preTriage.mode,
+				source: preTriage.source
 			})
 		});
-	} catch (e) {
-		journal.logs.push({
+		const upFrom = preTriage.upgradedFrom;
+		if (upFrom) journal.logs.push({
+			t: Date.now(),
+			level: "warn",
+			message: t(locale, "log.modeUpgraded", {
+				from: upFrom,
+				to: preTriage.mode
+			})
+		});
+		if (preTriage.blockersDropped > 0) journal.logs.push({
+			t: Date.now(),
+			level: "warn",
+			message: t(locale, "log.triageBlockersDropped", { n: preTriage.blockersDropped })
+		});
+	} else if (resume) {
+		if (!journal.triage) {
+			journal.triage = {
+				mode: options.mode || "full",
+				kind: "resume",
+				complexity: "medium",
+				confidence: "medium",
+				source: "resume",
+				intent: "requirement",
+				blockers: [],
+				blockersDropped: 0,
+				upgradedFrom: null
+			};
+			journal.logs.push({
+				t: Date.now(),
+				level: "info",
+				message: t(locale, "log.triageResumed", { mode: options.mode || "full" })
+			});
+		}
+	} else if (options.mode !== "patch") {
+		if (preTriageError) journal.logs.push({
 			t: Date.now(),
 			level: "warn",
-			message: t(locale, "log.triageFail", { msg: String(e && e.message || e) })
+			message: t(locale, "log.triagePreflightFail", { msg: clip(preTriageError, 200) })
 		});
+		try {
+			const callerMode = options.mode;
+			const verdict = await runTriage(journal.requirementSupplement ? `${requirement}\n\n[CLARIFIED — the user answered the open questions below during a clarification round; treat them as authoritative and do NOT re-ask]\n${String(journal.requirementSupplement)}` : requirement, { needDesign: options.needDesign }, parent, signal, locale);
+			const up = guardrailUpgrade(callerMode, !!options.lite, verdict.mode, { needDesign: options.needDesign === true });
+			if (up) {
+				const fromMode = callerMode !== void 0 || options.lite ? callerMode || "lite" : verdict.mode;
+				if (MODE_RANK[fromMode] < MODE_RANK[up]) verdict.__upgradedFrom = fromMode;
+				options.mode = up;
+				options.lite = up === "lite" || up === "tech" || up === "patch" ? !!options.lite : false;
+			}
+			if (verdict.needDesign && !options.needDesign) options.needDesign = true;
+			triageSlug = verdict.slug || "";
+			journal.options = Object.assign({}, options);
+			journal.triage = triageRecordOf(verdict);
+			journal.logs.push({
+				t: Date.now(),
+				level: "info",
+				message: t(locale, "log.triage", {
+					kind: verdict.kind,
+					mode: verdict.mode,
+					source: verdict.source
+				})
+			});
+			const fbReason = verdict.fallbackReason;
+			if (verdict.source === "fallback" && fbReason) journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: t(locale, "log.triageFallbackReason", { msg: clip(fbReason, 200) })
+			});
+			const upFrom2 = verdict.upgradedFrom;
+			if (upFrom2) journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: t(locale, "log.modeUpgraded", {
+					from: upFrom2,
+					to: verdict.mode
+				})
+			});
+			if (verdict.blockersDropped > 0) journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: t(locale, "log.triageBlockersDropped", { n: verdict.blockersDropped })
+			});
+			const clarified = !!String(journal.requirementSupplement || "").trim();
+			if (verdict.intent !== "requirement" || verdict.blockers.length > 0) {
+				if (!clarified) return abortForClarification(journal, locale, verdict);
+				journal.logs.push({
+					t: Date.now(),
+					level: "warn",
+					message: t(locale, "log.clarifyProceedWithAssumptions", { n: verdict.blockers.length })
+				});
+			}
+		} catch (e) {
+			journal.logs.push({
+				t: Date.now(),
+				level: "warn",
+				message: t(locale, "log.triageFail", { msg: String(e && e.message || e) })
+			});
+		}
 	}
 	const tasks = normalizeTasks(options.tasks);
 	const maxConcurrency = Number.isFinite(options.maxConcurrency) && options.maxConcurrency > 0 ? Math.min(options.maxConcurrency, 8) : 3;
@@ -5501,6 +7187,74 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					n: maxConcurrency
 				})
 			});
+			if (options.preAction === "keep-nogit") try {
+				const st = loadState(scopeKey);
+				st.gitMode = "none";
+				saveState(scopeKey, st);
+			} catch (e) {}
+			if (options.preAction === "init" && journal.workspacePath) try {
+				const st = loadState(scopeKey);
+				if (runSanityCheck(journal.workspacePath, locale).inRepo) {
+					st.gitMode = "repo";
+					saveState(scopeKey, st);
+				} else if (isDangerousVcsRoot(journal.workspacePath, homedir())) {
+					journal.logs.push({
+						t: Date.now(),
+						level: "warn",
+						message: t(locale, "log.gitInitRefused", { path: journal.workspacePath })
+					});
+					options.preAction = "keep-nogit";
+					options.branchPolicy = "keep";
+					st.gitMode = "none";
+					saveState(scopeKey, st);
+				} else {
+					const iR = gitCmd(journal.workspacePath, ["init"]);
+					const baselineSkip = dirTooLargeForBaseline(journal.workspacePath);
+					if (iR !== null) {
+						if (!baselineSkip) {
+							ensureLogGitignore(journal.workspacePath, journal, locale);
+							const aR = gitRun(journal.workspacePath, tfAddArgs(BASELINE_NOISE_EXCLUDES, journal.workspacePath), 12e4);
+							journal.logs.push({
+								t: Date.now(),
+								level: "info",
+								message: t(locale, "log.baselineExcludes", { list: BASELINE_NOISE_EXCLUDES.join(", ") })
+							});
+							const cR = gitRun(journal.workspacePath, [
+								"commit",
+								"-m",
+								t(locale, "commit.baseline")
+							], 12e4);
+							journal.logs.push({
+								t: Date.now(),
+								level: "info",
+								message: t(locale, "log.gitInitDone", { baseline: cR && cR.ok ? t(locale, "log.gitBaselineDone") : t(locale, "log.gitBaselineSkip", { msg: gitFailDetail(aR, cR) }) })
+							});
+						} else journal.logs.push({
+							t: Date.now(),
+							level: "info",
+							message: t(locale, "log.gitInitDone", { baseline: t(locale, "log.gitBaselineLarge") })
+						});
+						st.gitMode = "repo";
+						saveState(scopeKey, st);
+					} else {
+						journal.logs.push({
+							t: Date.now(),
+							level: "warn",
+							message: t(locale, "log.gitInitFail", { path: journal.workspacePath })
+						});
+						options.preAction = "keep-nogit";
+						options.branchPolicy = "keep";
+						st.gitMode = "none";
+						saveState(scopeKey, st);
+					}
+				}
+			} catch (e) {
+				journal.logs.push({
+					t: Date.now(),
+					level: "warn",
+					message: t(locale, "log.gitInitFail", { path: journal.workspacePath })
+				});
+			}
 			if (options.branchPolicy !== "keep" && journal.workspacePath) try {
 				const s = runSanityCheck(journal.workspacePath, locale);
 				if (s.ok && s.inRepo && !s.hasDirty) {
@@ -5632,6 +7386,66 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 		state.__runCtx = { ...state.__runCtx || {} };
 		if (journal.runDocs) state.__runCtx.runDocs = journal.runDocs;
 		state.__runCtx.locale = locale;
+		try {
+			const tj0 = journal.triage;
+			const art0 = normalizeArtifact(tj0?.artifact);
+			if (PLUGIN_ARTIFACTS.indexOf(art0) !== -1) {
+				const env = detectInstallEnv({
+					baseUrl: installCtx.baseUrl,
+					modulePath: selfModulePath(),
+					dshHome: dshHome(),
+					hasCli: cliOnPath()
+				});
+				state.__runCtx.installEnv = env;
+				journal.installEnv = env;
+				journal.logs.push({
+					t: Date.now(),
+					level: env.ok ? "info" : "warn",
+					message: t(locale, env.ok ? "log.installEnv" : "log.installEnvUnknown", {
+						profile: env.profile || "?",
+						dir: env.profileDir || "?",
+						cli: env.cliOnPath ? "yes" : "no"
+					})
+				});
+			}
+		} catch (e) {}
+		try {
+			const tj = journal.triage;
+			const art = normalizeArtifact(tj?.artifact);
+			const inst = tj?.installable === true;
+			const hst = normalizeHost(tj?.host);
+			const { items, hostResearch } = contractsForDeliverable(hst, art, inst);
+			if (items.length) {
+				state.__runCtx.artifact = art;
+				state.__runCtx.installable = inst;
+				state.__runCtx.host = hst;
+				state.__runCtx.artifactContracts = items.map((it) => ({
+					requirement: it.requirement,
+					criteria: it.criteria
+				}));
+				journal.logs.push({
+					t: Date.now(),
+					level: "info",
+					message: t(locale, "log.artifactContract", {
+						kind: art,
+						n: items.length
+					})
+				});
+			}
+			if (hostResearch) {
+				state.__runCtx.hostResearch = true;
+				state.__runCtx.host = hst;
+				journal.hostResearch = true;
+				journal.logs.push({
+					t: Date.now(),
+					level: "warn",
+					message: t(locale, "log.hostResearch", {
+						kind: art,
+						host: hst
+					})
+				});
+			}
+		} catch (e) {}
 		try {
 			const wsCwd = workspaceScopeOf(parent).path;
 			const sanity = runSanityCheck(wsCwd, locale);
@@ -5712,7 +7526,9 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				label: t(locale, "dev.prdFull"),
 				fn: prdPrompt
 			};
-			const prdR = await withRetry(journal, parent, pForm.label, "prd", pForm.fn(requirement, root, journal.id, state), signal, void 0, options.mode === "patch" ? "low" : null);
+			const supplement = journal.requirementSupplement;
+			const prdInput = supplement ? `${requirement}\n\n[CLARIFIED — the user answered the open questions below during a clarification round; treat them as authoritative and do NOT re-assume]\n${supplement}` : requirement;
+			const prdR = await withRetry(journal, parent, pForm.label, "prd", pForm.fn(prdInput, root, journal.id, state), signal, void 0, options.mode === "patch" ? "low" : null);
 			if (!prdR.text) throw stageFailError("prd", prdR);
 			prd = prdR.text;
 			timeline.prd = prd;
@@ -5720,6 +7536,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			noteTaskStageUsage(journal);
 			if (journal.cancelled) return;
 		}
+		if (notePrdAssumptions(journal, locale)) throw stageFailError("prd", {});
 		let design = null;
 		if (enabled("design")) {
 			if (resumed("design")) {
@@ -5811,9 +7628,10 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 		let devResults = null;
 		if (resume) {
 			devResults = resume.products.dev || [];
+			const devDefs = devTaskDefsWithBackfill(journal, tasks, locale);
 			const taskStatuses = devTaskStatuses(journal.stages || []);
-			const todo = buildDevTaskDefs(journal, tasks, locale).filter((d) => {
-				const st = taskStatuses.get(String(d.title || "").trim());
+			const todo = devDefs.filter((d) => {
+				const st = taskStatuses.get(d.id);
 				return !st || !st.done;
 			});
 			if (todo.length === 0) {
@@ -5830,20 +7648,22 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					})
 				});
 				const rerun = await runPool(todo, maxConcurrency, async (task) => {
-					const prevStage = [...journal.stages].reverse().find((s) => phaseKeyOf(s.phase) === "dev" && s.status !== "done" && (s.taskKey && s.taskKey === String(task.title || "") || !s.taskKey && (s.label || "").includes(String(task.title || ""))));
+					const prevStage = [...journal.stages].reverse().find((s) => phaseKeyOf(s.phase) === "dev" && s.status !== "done" && (Array.isArray(s.taskIds) && s.taskIds.length ? s.taskIds.includes(task.id) : s.taskKey && s.taskKey === String(task.title || "") || !s.taskKey && (s.label || "").includes(String(task.title || ""))));
 					const resumePrompt = devPrompt(task, tech, prd, root, journal.id, state) + (prevStage ? buildRetryDiagnostic(2, prevStage) : "");
-					const devR = await withRetry(journal, parent, t(locale, "dev.taskRerun", { title: task.title }), "dev", resumePrompt, signal, task.title);
+					const devR = await withRetry(journal, parent, t(locale, "dev.taskRerun", { title: task.title }), "dev", resumePrompt, signal, task.title, null, [task.id]);
 					const rerunText = stageTextOf(devR);
 					noteVerifyEvidence(devR.stage, rerunText);
 					const ok = !!devR.text;
 					return {
 						title: task.title,
+						dtId: task.id,
 						failed: !ok,
 						output: rerunText || t(locale, "dev.failedPlaceholder")
 					};
-				});
+				}, () => journal.cancelled);
 				for (const t of rerun) {
-					const sub = createSubtask(journal, t.title, t.spec || "");
+					if (!t) continue;
+					const sub = createSubtask(journal, t.title, t.spec || "", t.dtId);
 					if (sub) completeSubtask(journal, sub.id, t.failed, t.output ? snippet(t.output, 1e3) : null, null);
 				}
 				devResults = [...reused, ...rerun];
@@ -5860,10 +7680,12 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			for (const t of devTaskDefs) {
 				const hit = t.files && t.files.length ? mergedDefs.find((m) => m.files.some((f) => t.files.includes(f))) : void 0;
 				if (hit) {
+					hit.ids.push(t.id);
 					hit.title = `${hit.title} + ${t.title}`;
 					hit.spec = `${hit.spec}${t.spec ? `；${t.spec}` : ""}`;
 					for (const f of t.files || []) if (!hit.files.includes(f)) hit.files.push(f);
 				} else mergedDefs.push({
+					ids: [t.id],
 					title: t.title,
 					files: t.files || [],
 					spec: t.spec || ""
@@ -5879,7 +7701,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				})
 			});
 			advanceTask(journal, "running", null, t(locale, "event.devStart"), { by: "dev" });
-			const subCards = mergedDefs.map((dt) => createSubtask(journal, dt.title, dt.spec));
+			const subCards = mergedDefs.map((dt) => createSubtask(journal, dt.title, dt.spec, dt.ids[0]));
 			devResults = await runPool(mergedDefs, maxConcurrency, async (task, idx) => {
 				const sub = subCards[idx];
 				if (sub) {
@@ -5893,7 +7715,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 						persistJournal(journal);
 					}
 				}
-				const devR = await withRetry(journal, parent, t(locale, "dev.task", { title: task.title }), "dev", devPrompt(task, tech, prd, root, journal.id, state), signal, task.title);
+				const devR = await withRetry(journal, parent, t(locale, "dev.task", { title: task.title }), "dev", devPrompt(task, tech, prd, root, journal.id, state), signal, task.title, null, task.ids);
 				const devText = stageTextOf(devR);
 				noteVerifyEvidence(devR.stage, devText);
 				const ok = !!devR.text;
@@ -5906,12 +7728,15 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					failed: !ok,
 					output: devText || t(locale, "dev.failedPlaceholder")
 				};
-			});
+			}, () => journal.cancelled);
 			timeline.dev = devResults;
 			for (const r of devResults) if (r && r.output) mergeStageState("dev", r.output);
 			noteTaskStageUsage(journal);
 			noteTaskAssign(journal, "dev", journal.stages.filter((s) => phaseKeyOf(s.phase) === "dev").map((s) => (s.childId || "").slice(0, 8)).filter(Boolean).join(",") || t(locale, "role.devTeam"));
-			const failedCount = devResults.filter((r) => r && r.failed).length;
+		}
+		if (journal.cancelled) return;
+		{
+			const failedCount = (devResults || []).filter((r) => r && r.failed).length;
 			if (failedCount > 0) {
 				advanceTask(journal, "needs-human", null, t(locale, "event.devFail"), { by: "dev" });
 				const req = storeFor(scopeKey).find("req", journal.reqId);
@@ -5924,12 +7749,12 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					level: "error",
 					message: t(locale, "log.devFailGate", {
 						failed: failedCount,
-						total: devResults.length
+						total: (devResults || []).length
 					})
 				});
 				throw new Error(t(locale, "err.devFail", {
 					failed: failedCount,
-					total: devResults.length
+					total: (devResults || []).length
 				}));
 			} else {
 				advanceTask(journal, "testable", null, t(locale, "event.devTestable"), { by: "dev" });
@@ -5939,7 +7764,6 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					message: t(locale, "log.devDone")
 				});
 			}
-			if (journal.cancelled) return;
 		}
 		persistJournal(journal);
 		let qa = null;
@@ -6228,6 +8052,7 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 					req.humanIntervention = true;
 					store.pushEvent(req, req.status, "needs-human", t(locale, "event.reqMismatchHuman"));
 				}
+				journal.humanIntervention = true;
 				journal.logs.push({
 					t: Date.now(),
 					level: "error",
@@ -6267,10 +8092,32 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 			journal.error = String(e && e.message || e);
 		}
 	} finally {
+		if (journal.cancelled && journal.status === "running") {
+			journal.status = "cancelled";
+			journal.error = journal.error || t(locale, "err.cancelled");
+		}
 		journal.endedAt = Date.now();
 		inFlight.delete(journal.id);
 		activeProducts.delete(scopeKey);
-		if (journal.workspacePath && journal.status === "completed" && !journal.humanIntervention) try {
+		const vcsState = (() => {
+			try {
+				return loadState(scopeKey).gitMode;
+			} catch (e) {
+				return;
+			}
+		})();
+		const dangerousWs = journal.workspacePath && isDangerousVcsRoot(journal.workspacePath, homedir());
+		if (journal.workspacePath && vcsState === "none") journal.logs.push({
+			t: Date.now(),
+			level: "warn",
+			message: t(locale, "log.noVcsByChoice")
+		});
+		else if (journal.workspacePath && dangerousWs) journal.logs.push({
+			t: Date.now(),
+			level: "warn",
+			message: t(locale, "log.noVcsDangerous", { path: journal.workspacePath })
+		});
+		else if (journal.workspacePath && journal.status === "completed" && !journal.humanIntervention) try {
 			const reqHead = String(journal.requirement || "").replace(/\s+/g, " ").trim().slice(0, 80);
 			ensureLogGitignore(journal.workspacePath, journal, locale);
 			const docAdd = tfDocAddArgs([journal.runDocs, `${TF_DOCS_DIR}/memory.md`].filter((p) => existsSync(`${journal.workspacePath}/${p}`)));
@@ -6316,6 +8163,11 @@ async function executePipeline(journal, parent, requirement, options, signal, re
 				message: t(locale, "log.commitFail", { msg: String(e && e.message || e) })
 			});
 		}
+		else if (journal.workspacePath && (vcsState === "none" || dangerousWs) && journal.status === "completed") journal.logs.push({
+			t: Date.now(),
+			level: "warn",
+			message: t(locale, "run.notCommitted", { docs: journal.runDocs || "" })
+		});
 		else if (journal.workspacePath && journal.runDocs && (journal.status === "failed" || journal.status === "cancelled" || journal.status === "interrupted")) journal.logs.push({
 			t: Date.now(),
 			level: "warn",
@@ -6432,21 +8284,18 @@ function startPipeline(agent, requirement, options, signal) {
 		if (firstKey !== void 0) runs.delete(firstKey);
 	}
 	persistJournal(journal);
-	executePipeline(journal, agent, journal.requirement, journal.options, signal);
+	const execOptions = Object.assign({}, journal.options, {
+		requirementSupplement: options.requirementSupplement || null,
+		__triage: options.__triage,
+		__triageError: options.__triageError,
+		branchPolicy: options.branchPolicy,
+		branchName: options.branchName,
+		preAction: options.preAction,
+		commitMessage: options.commitMessage
+	});
+	executePipeline(journal, agent, journal.requirement, execOptions, signal);
 	return journal.id;
 }
-/** 取消运行（置 cancelled + dispose 进行中的子代理）。 */
-function cancelRun(runId) {
-	const j = runs.get(runId);
-	if (!j) return false;
-	j.cancelled = true;
-	const entry = inFlight.get(runId);
-	if (entry && entry.run) try {
-		entry.run.dispose();
-	} catch (e) {}
-	persistJournal(j);
-	return true;
-}
 /** 从断点续跑：跳过已完成阶段，从第一个未完成阶段重跑（service 与工具共用）。 */
 function resumeRun(runId, sessionId) {
 	const id = typeof runId === "string" ? runId : null;
@@ -6552,6 +8401,85 @@ function resumeRun(runId, sessionId) {
 *
 * 运行环境：宿主组合（web profile）的真实 Node 进程。
 */
+/** 有界计数（决策问句里的"现有 N 个文件"；不精确——只采样，超阈值即停）。 */
+function countFilesBounded(dir, cap = 1e3) {
+	let n = 0;
+	const walk = (d, depth) => {
+		if (depth > 12 || n > cap) return;
+		let es = [];
+		try {
+			es = readdirSync(d, { withFileTypes: true });
+		} catch (e) {
+			return;
+		}
+		for (const e of es) {
+			if (e.name === ".git" || e.name === "node_modules") continue;
+			if (e.isDirectory()) walk(d + "\\" + e.name, depth + 1);
+			else {
+				n++;
+				if (n > cap) return;
+			}
+		}
+	};
+	walk(dir, 0);
+	return n;
+}
+/**
+* 需求澄清闸门 · 启动前预检（2026-09-16 Phase 1，**快路径**）。
+*
+* 分诊本来就是一次模型调用——这里把它**前移到建 run 之前**，用同一份裁决判两件事：
+* ① `intent` 是否「明确需求」（`exploration` = 还在探讨、`feedback` = 对现状的反馈）；② 有没有 **must-know**
+* 缺口（`blockers`，已过 host 合格线：≥2 互斥读法 + 改变哪个产物/AC + 猜错返工什么）。命中任一 → 返回
+* `needs-clarification`，**不建 run**——实锤：社区讨论 #6405 用户说「我想开发一个 dsh 插件」→ 直接跑完整条
+* 流水线（他本人：「我都不知道自己想要啥」）。
+*
+* ⚠️ **正确性不依赖本函数**（2026-09-16 实测教训，`tf-mu35oza7-wmuckz`）：它在**工具调用内**跑，模型分诊
+* 一旦在此失败（那次 0.4s 返回 `source=fallback`，因为漏传 `signal`）就会静默降级成正则兜底 —— 所以
+* **权威判定在 pipeline 内**：pipeline 对「没有透传裁决」的启动一律自己再跑一次分诊，并据此做闸门与
+* 架构护栏。这里失败只把原因放进 `__triageError`，由 pipeline 记 warn（不静默）。
+*
+* 边界：**只有 `patch` 档豁免**——其余一律（含显式 `lite`/`mode`）都要过闸门与架构护栏；原因：实测模型
+* **系统性**自选档位（33 次启动 14 次显式传入、0 次先 `teamflow_triage` 预览；根因是旧 `lite` 描述里的
+* "(recommended)" 被逐字引用）→ 若继续豁免，闸门与 ADR-0006 护栏会在 42% 的启动上静默失效。
+*/
+async function clarificationPreflight(requirement, options, parent, signal, locale) {
+	if (options.mode === "patch") return {
+		verdict: null,
+		cacheKey: ""
+	};
+	const triageInput = options.requirementSupplement ? `${requirement}\n\n[CLARIFIED — the user answered the open questions below during a clarification round; treat them as authoritative and do NOT re-ask]\n${String(options.requirementSupplement)}` : requirement;
+	const cacheKey = triageCacheKey(requirement, options.requirementSupplement);
+	let verdict = triageCacheGet(cacheKey);
+	let error = "";
+	if (verdict) try {
+		console.error(`[teamflow] ${t(locale, "diag.triageCacheHit")}`);
+	} catch (e) {}
+	else try {
+		verdict = await runTriage(triageInput, { needDesign: options.needDesign === true }, parent, signal, locale);
+		triageCachePut(cacheKey, verdict);
+	} catch (e) {
+		error = String(e && e.message || e);
+		verdict = null;
+	}
+	if (!verdict) return {
+		verdict: null,
+		error,
+		cacheKey
+	};
+	const alreadyClarified = !!String(options.requirementSupplement || "").trim();
+	if ((verdict.intent !== "requirement" || verdict.blockers.length > 0) && !alreadyClarified) return {
+		needsClarification: {
+			intent: verdict.intent,
+			blockers: verdict.blockers
+		},
+		cacheKey
+	};
+	if (alreadyClarified && verdict.blockers.length > 0) verdict.__clarifyProceeded = verdict.blockers.length;
+	return {
+		verdict,
+		cacheKey
+	};
+}
 /** 阶段顺序/key 映射见 constants.ts（PHASE_ORDER/PHASE_KEY_OF/PHASE_KEY_BY_NAME）。 */
 /** 按工作区作用域过滤运行见 core/products.ts（runsFor；全局面板与远程面共用）。 */
 /** 由 sessionId 推导会话所属 workspace（项目）作用域。 */
@@ -6576,6 +8504,8 @@ function snapshotOf(j) {
 			seq: s.seq,
 			label: s.label,
 			phase: s.phase,
+			taskKey: s.taskKey || null,
+			taskIds: Array.isArray(s.taskIds) && s.taskIds.length ? s.taskIds : null,
 			status: s.status,
 			outcome: s.outcome,
 			childId: s.childId,
@@ -6612,7 +8542,7 @@ function registerTools(ctx) {
 	};
 	T({
 		name: "teamflow_start",
-		description: "Start the team R&D pipeline (background async): runs the stages per team config (PRD→design→tech→dev→QA→acceptance). Specify teamId (matches teams.json) or pick a team via the UI \"+\" button first so messages auto-match. Stage failures auto-retry; beyond threshold → rework/human intervention; per-stage token usage recorded. NOTE: after calling, the implementation work is done by pipeline subagents — the main thread MUST NOT write code or run verifications for it. requirement must be a faithful transcription of the user's words; do not invent file paths / tech claims without code verification (downstream stages build the PRD from it). Branch decision: when the return status is \"needs-decision\", ASK THE USER to pick one of the options (or take their custom input, e.g. a branch name), then RE-CALL this tool passing the CHOSEN OPTION VALUE as branchPolicy (\"new\" = confirmed create branch, \"keep\" = stay), optionally combined with preAction / branchName / commitMessage. Pass branchPolicy=\"keep\" when the user chooses to stay on the current branch.",
+		description: "Start the team R&D pipeline (background async): runs the stages per team config (PRD→design→tech→dev→QA→acceptance). Specify teamId (matches teams.json) or pick a team via the UI \"+\" button first so messages auto-match. Stage failures auto-retry; beyond threshold → rework/human intervention; per-stage token usage recorded. NOTE: after calling, the implementation work is done by pipeline subagents — the main thread MUST NOT write code or run verifications for it. Routing: omit `mode`/`lite` and let auto-triage decide the tier (it applies the architecture guardrails); pass them only when the user explicitly asked for that tier. requirement must be a faithful transcription of the user's words; do not invent file paths / tech claims without code verification (downstream stages build the PRD from it). Clarification gate: if the return status is \"needs-clarification\", this is NOT a settled requirement yet (or it has must-know gaps) — do NOT retry blindly: discuss it with the user in your own words (the returned blockers list what is missing and why), then RE-CALL this tool with the original requirement plus requirementSupplement = the user's answers. Branch decision: when the return status is \"needs-decision\", ASK THE USER to pick one of the options (or take their custom input, e.g. a branch name), then RE-CALL this tool passing the CHOSEN OPTION VALUE as branchPolicy (\"new\" = confirmed create branch, \"keep\" = stay), optionally combined with preAction / branchName / commitMessage. Pass branchPolicy=\"keep\" when the user chooses to stay on the current branch.",
 		parameters: {
 			requirement: {
 				type: "string",
@@ -6633,11 +8563,11 @@ function registerTools(ctx) {
 			},
 			lite: {
 				type: "boolean",
-				description: "Lightweight mode for small changes (recommended): still runs the lightweight architecture stage (blueprint for dev, no full TECHNICAL.md), then dev → QA → acceptance; if needDesign=true the UI/UX design stage stays (saves tokens/time, traceability preserved)"
+				description: "Lightweight mode for genuinely small single-module changes. **Do NOT pick the tier yourself by default**: omit both `mode` and `lite` and let auto-triage decide — it applies the architecture guardrails (persistence/abstraction/cross-module → at least medium) that a hand-picked tier bypasses. Set `lite=true` only when the USER explicitly asked for a lightweight/fast run, or the change is a proven single-module micro change."
 			},
 			mode: {
 				type: "string",
-				description: "Route mode: full / medium / lite / tech / patch (auto-triage by default; use teamflow_triage to preview)"
+				description: "Route mode: full / medium / lite / tech / patch. **Do NOT pick the tier yourself by default** — omit it and let auto-triage decide (recommended), or preview with teamflow_triage and pass what it returns. A hand-picked lighter tier is subject to the architecture guardrail: if triage judges the requirement architectural it is upgraded (logged), so the guardrail can never be bypassed."
 			},
 			productRoot: {
 				type: "string",
@@ -6663,6 +8593,10 @@ function registerTools(ctx) {
 				type: "string",
 				description: "Custom commit message when preAction=commit"
 			},
+			requirementSupplement: {
+				type: "string",
+				description: "Extra context the user gave during a clarification round (after a \"needs-clarification\" return). Kept separate from the original requirement (which stays a faithful transcription of the user's words) and handed to the PRD stage as authoritative input."
+			},
 			tasks: {
 				type: "array",
 				description: "Optional splittable dev task list",
@@ -6691,14 +8625,26 @@ function registerTools(ctx) {
 				properties: {
 					runId: { type: "string" },
 					status: { type: "string" },
+					kind: { type: "string" },
 					question: { type: "string" },
 					options: { type: "array" },
-					note: { type: "string" }
+					note: { type: "string" },
+					intent: { type: "string" },
+					blockers: { type: "array" },
+					message: { type: "string" }
 				}
 			},
 			render: (args, value) => {
 				if (value && value.status === "needs-decision") {
 					const opts = Array.isArray(value.options) ? value.options.map((o, i) => `${i + 1}. ${o.label}`).join("\n") : "";
+					if (value.kind === "git-init") return [{
+						type: "text",
+						text: t(ambientLocale(), "tool.start.gitDecisionNote", {
+							question: value.question,
+							options: opts,
+							note: value.note || ""
+						})
+					}];
 					return [{
 						type: "text",
 						text: t(ambientLocale(), "tool.start.decision", {
@@ -6714,6 +8660,20 @@ function registerTools(ctx) {
 						note: value.note || ""
 					})
 				}];
+				if (value && value.status === "needs-clarification") {
+					const list = Array.isArray(value.blockers) ? value.blockers.map((b, i) => `${i + 1}. ${b.question}\n   · ${t(ambientLocale(), "tool.start.blockerReadings")}: ${(b.readings || []).join(" / ")}\n   · ${t(ambientLocale(), "tool.start.blockerChanges")}: ${b.changes}\n   · ${t(ambientLocale(), "tool.start.blockerRework")}: ${b.rework}`).join("\n") : "";
+					return [{
+						type: "text",
+						text: t(ambientLocale(), "tool.start.needsClarification", {
+							intent: String(value.intent || "requirement"),
+							blockers: list
+						})
+					}];
+				}
+				if (value && value.message && !value.runId) return [{
+					type: "text",
+					text: String(value.message)
+				}];
 				return [{
 					type: "text",
 					text: t(ambientLocale(), "tool.start.started", {
@@ -6757,15 +8717,67 @@ function registerTools(ctx) {
 					maxConcurrency: args.maxConcurrency,
 					branchPolicy: args.branchPolicy === "keep" ? "keep" : "auto",
 					branchName: typeof args.branchName === "string" && args.branchName.trim() ? args.branchName.trim() : null,
-					preAction: args.preAction === "stash" || args.preAction === "commit" ? args.preAction : null,
-					commitMessage: typeof args.commitMessage === "string" && args.commitMessage.trim() ? args.commitMessage.trim() : null
+					preAction: args.preAction === "stash" || args.preAction === "commit" || args.preAction === "init" || args.preAction === "keep-nogit" ? args.preAction : null,
+					commitMessage: typeof args.commitMessage === "string" && args.commitMessage.trim() ? args.commitMessage.trim() : null,
+					requirementSupplement: typeof args.requirementSupplement === "string" && args.requirementSupplement.trim() ? args.requirementSupplement.trim() : null
 				};
+				const pre = await clarificationPreflight(requirement, options, parent, exec && exec.signal, ambientLocale());
+				const triageKey = pre.cacheKey;
+				if ("needsClarification" in pre) {
+					triageCacheMarkPending(triageKey);
+					return {
+						status: "needs-clarification",
+						intent: pre.needsClarification.intent,
+						blockers: pre.needsClarification.blockers
+					};
+				}
+				if (pre.verdict) {
+					const explicit = options.mode;
+					const up = guardrailUpgrade(explicit, !!options.lite, pre.verdict.mode, { needDesign: options.needDesign === true });
+					if (up) {
+						const fromMode = explicit !== void 0 || options.lite ? explicit || "lite" : pre.verdict.mode;
+						if (MODE_RANK[fromMode] < MODE_RANK[up]) pre.verdict.__upgradedFrom = fromMode;
+						options.mode = up;
+						options.lite = up === "lite" || up === "tech" || up === "patch" ? !!options.lite : false;
+					}
+					if (pre.verdict.needDesign) options.needDesign = true;
+					options.__triage = pre.verdict;
+				} else if (pre.error) options.__triageError = pre.error;
 				const branchConfirmed = args.branchPolicy === "new";
 				if (options.branchPolicy === "auto" && !branchConfirmed && !options.branchName && !options.preAction && exec && exec.agent) {
 					const sc = workspaceScopeOf(exec.agent);
 					if (sc.path) try {
 						const s = runSanityCheck(sc.path);
-						if (s.ok && s.inRepo) {
+						if (!s.inRepo) {
+							if (loadState(sc.path).gitMode === "none" || options.preAction === "keep-nogit") {
+								options.preAction = "keep-nogit";
+								options.branchPolicy = "keep";
+							} else {
+								const home = homedir();
+								const danger = isDangerousVcsRoot(sc.path, home);
+								const tooLarge = danger ? false : dirTooLargeForBaseline(sc.path);
+								const baseline = danger ? "" : t(ambientLocale(), tooLarge ? "git.opt.initNoBaseline" : "git.opt.initBaseline", { n: countFilesBounded(sc.path) });
+								const q = danger ? t(ambientLocale(), "git.q.danger", { path: sc.path }) : t(ambientLocale(), "git.q.noRepo", { path: sc.path });
+								const optsList = danger ? [{
+									label: t(ambientLocale(), "git.opt.keepOnly"),
+									value: "keep"
+								}] : [{
+									label: t(ambientLocale(), "git.opt.init", { baseline }),
+									value: "init"
+								}, {
+									label: t(ambientLocale(), "git.opt.keep"),
+									value: "keep"
+								}];
+								triageCacheMarkPending(triageKey);
+								return {
+									status: "needs-decision",
+									kind: "git-init",
+									question: q,
+									options: optsList,
+									note: t(ambientLocale(), danger ? "tool.start.gitDecisionDanger" : "tool.start.gitDecision")
+								};
+							}
+						} else if (s.ok && s.inRepo) {
 							const onMain = !!s.branch && s.branch.trim().toLowerCase() === "main";
 							const dirty = s.hasDirty;
 							const dirtyN = s.dirty.split(/\r?\n/).filter((l) => l.trim()).length;
@@ -6836,6 +8848,7 @@ function registerTools(ctx) {
 									}
 								];
 							}
+							triageCacheMarkPending(triageKey);
 							return {
 								status: "needs-decision",
 								question,
@@ -6845,6 +8858,7 @@ function registerTools(ctx) {
 						}
 					} catch (e) {}
 				}
+				triageCacheSettle(triageKey);
 				return {
 					runId: startPipeline(parent, requirement, options, exec && exec.signal),
 					status: "running"
@@ -7233,7 +9247,7 @@ function registerTools(ctx) {
 		},
 		async execute(args) {
 			const id = args && typeof args.runId === "string" ? args.runId : null;
-			return { ok: id ? cancelRun(id) : false };
+			return { ok: id ? cancelRun(id, "tool") : false };
 		}
 	});
 	T({
@@ -7329,8 +9343,7 @@ function tryFlushPendingInjections(sessionId) {
 				text: teamflowContextText(pending.teamIcon, pending.teamName, pending.teamId)
 			}],
 			source: {
-				kind: "plugin",
-				plugin: "dsh-plugin-teamflow",
+				kind: "plugin:dsh-plugin-teamflow",
 				form: "instructions"
 			}
 		}));
@@ -7348,6 +9361,7 @@ var TeamflowService = class extends TypertRemoteService {
 	constructor(ctx) {
 		super(ctx, "teamflow");
 		setRuntime(ctx.get("agents"), ctx.get("subagents"), ctx.get("workspaceRegistry"), ctx.get("agentDefaultModel"), ctx.get("llm"));
+		setInstallCtx(ctx);
 		ctx.inject(["sessionProjections"], (projectionCtx) => {
 			setSessionProjections(projectionCtx.get("sessionProjections"));
 		});
@@ -7622,7 +9636,7 @@ var TeamflowService = class extends TypertRemoteService {
 		if (!key) return null;
 		return this.itemDetail(kind, id, sessionId, key);
 	}
-	start(sessionId, requirement, options) {
+	async start(sessionId, requirement, options) {
 		const sid = typeof sessionId === "string" ? sessionId : null;
 		const req = typeof requirement === "string" && requirement.trim() ? requirement.trim() : null;
 		if (!sid || !req) return {
@@ -7637,6 +9651,29 @@ var TeamflowService = class extends TypertRemoteService {
 		tryFlushPendingInjections(sid);
 		try {
 			const opts = options && typeof options === "object" ? options : {};
+			const pre = await clarificationPreflight(req, opts, agent, void 0, ambientLocale());
+			if ("needsClarification" in pre) {
+				triageCacheMarkPending(pre.cacheKey);
+				return {
+					ok: false,
+					status: "needs-clarification",
+					intent: pre.needsClarification.intent,
+					blockers: pre.needsClarification.blockers
+				};
+			}
+			if (pre.verdict) {
+				const explicit = opts.mode;
+				const up = guardrailUpgrade(explicit, !!opts.lite, pre.verdict.mode, { needDesign: opts.needDesign === true });
+				if (up) {
+					const fromMode = explicit !== void 0 || opts.lite ? explicit || "lite" : pre.verdict.mode;
+					if (MODE_RANK[fromMode] < MODE_RANK[up]) pre.verdict.__upgradedFrom = fromMode;
+					opts.mode = up;
+					if (up !== "lite" && up !== "tech" && up !== "patch") opts.lite = false;
+				}
+				if (pre.verdict.needDesign) opts.needDesign = true;
+				opts.__triage = pre.verdict;
+			} else if (pre.error) opts.__triageError = pre.error;
+			triageCacheSettle(pre.cacheKey);
 			return {
 				ok: true,
 				runId: startPipeline(agent, req, opts, void 0),
@@ -7656,7 +9693,7 @@ var TeamflowService = class extends TypertRemoteService {
 			ok: false,
 			error: t(ambientLocale(), "err.tool.missingRunId")
 		};
-		return { ok: cancelRun(id) };
+		return { ok: cancelRun(id, "ui") };
 	}
 	/** 工作区级 backlog 视图（自动按当前会话 workspace 隔离）。productOverride：全局面板按产品线 key 寻址。 */
 	backlog(sessionId, productOverride) {
@@ -7750,8 +9787,7 @@ var TeamflowService = class extends TypertRemoteService {
 				text: teamflowContextText(team.icon, teamNameOf(ambientLocale(), team), tid)
 			}],
 			source: {
-				kind: "plugin",
-				plugin: "dsh-plugin-teamflow",
+				kind: "plugin:dsh-plugin-teamflow",
 				form: "instructions"
 			}
 		});