evolcore 0.0.4 → 0.0.6

package/dist/core/message/response-engine.js

@@ -2,7 +2,7 @@ import path from 'path';
 import fs from 'fs';
 import os from 'os';
 import crypto from 'crypto';
-import { BaseagentRunnerUnavailableError, hasCompact, hasClearSession, autoCompactWindowForModel, isClaudeContextUsageModel } from '../../agents/runner-types.js';
+import { BaseagentRunnerUnavailableError, hasCompact, autoCompactWindowForContextWindow, autoCompactWindowForModel, isClaudeContextUsageModel, numericToken } from '../../agents/runner-types.js';
 import { buildTaskRuntimeEnv } from '../../cli/task-context.js';
 import { IMRenderer } from './im-renderer.js';
 import { createSendFileMarkerPattern } from './file-markers.js';
@@ -10,7 +10,7 @@ import { createTextInferenceProvider } from '../inference/text-inference.js';
 import { StreamIdleMonitor } from './stream-idle-monitor.js';
 import { logger } from '../../utils/logger.js';
 import { isHostChinese } from '../../utils/locale.js';
-import { getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
+import { getErrorMessage, classifyError, ErrorType, ERROR_PREFIX, isInfraError, isAbortTerminalReason, prefixErrorType, isRetryableError, isContextTooLongText } from '../../utils/error-utils.js';
 import { isEvolcoreSendCommandForSession } from '../permission/ec-command-parser.js';
 import { summarizeToolInput } from '../../utils/tool-summary.js';
 import { getPackageRoot, resolveRoot, resolvePaths } from '../../paths.js';
@@ -28,7 +28,9 @@ import { AGENT_DELEGATION_TOKEN_ENV } from '../auth/agent-delegation.js';
 import { hasTrustedPrincipal } from '../auth/authenticated-actor.js';
 // Re-export 工具函数（向后兼容，让其他模块可以从 response-engine 导入）
 export { buildEnvelope, sendInteractionPayload } from './message-utils.js';
-import { constrainResolvedModelForRole } from '../model/model-permission.js';
+import { constrainResolvedModelForRole, isModelAllowedForRoleBaseagent } from '../model/model-permission.js';
+import { eligibleFallbackModels } from '../model/model-fallback.js';
+import { RetryScheduler } from './retry-scheduler.js';
 import { constrainRuntimePermissionMode, resolveRuntimeStringField } from '../role/runtime-policy.js';
 import { resolveEffective, resolveEffectiveFieldWithSource } from '../../config/config-manager.js';
 import { dispatchToMentionMode } from '../../config/mention-mode.js';
@@ -130,9 +132,11 @@ function createRetryAttemptTimeout(timeoutMs) {
         },
     };
 }
+const MAX_CONTEXT_RECOVERY_ATTEMPTS = 2;
 const RETRY_EXHAUSTED_MARK = Symbol('evolcore.retryExhausted');
 const RETRY_MADE_PROGRESS_MARK = Symbol('evolcore.retryMadeProgress');
 const RETRY_HEALTH_RECORDED_MARK = Symbol('evolcore.retryHealthRecorded');
+const MODEL_FALLBACK_EXHAUSTED_MARK = Symbol('evolcore.modelFallbackExhausted');
 function markRetryExhausted(error, retries) {
     if (error && typeof error === 'object') {
         error[RETRY_EXHAUSTED_MARK] = retries;
@@ -163,16 +167,84 @@ function markRetryHealthRecorded(error) {
 function wasRetryHealthRecorded(error) {
     return !!(error && typeof error === 'object' && error[RETRY_HEALTH_RECORDED_MARK] === true);
 }
+function markModelFallbackExhausted(error, message) {
+    error[MODEL_FALLBACK_EXHAUSTED_MARK] = message;
+    return error;
+}
+function getModelFallbackExhaustedMessage(error) {
+    const message = error && typeof error === 'object'
+        ? error[MODEL_FALLBACK_EXHAUSTED_MARK]
+        : undefined;
+    return typeof message === 'string' ? message : undefined;
+}
 function isNonErrorInterruptReason(reason) {
     return reason === 'new_message'
         || reason === 'stop'
         || reason === 'recalled'
         || reason === 'daemon_restart';
 }
+function isExpectedTerminalInterrupt(reason) {
+    return isAbortTerminalReason(reason);
+}
 function formatRetryableErrorFinalMessage(error, retries) {
     const reason = getErrorMessage(error, undefined, false) || 'API 暂时不可用';
     return `❌ API 暂时不可用，已自动重试 ${retries} 次仍失败，任务已停止。\n原因：${reason}`;
 }
+/**
+ * A protocol failure may be replayed only when the stream provides no evidence
+ * that model work or a side effect occurred. This deliberately excludes normal
+ * silent completions, which can be input-accepted and still return an empty
+ * result after consuming tokens.
+ */
+function isSafeProtocolReplayCandidate(result, reason) {
+    if (reason !== 'input_not_consumed' && reason !== 'empty_success')
+        return false;
+    if (result.isError
+        || result.hasReceivedText
+        || result.assistantUuid
+        || (result.textCount ?? 0) > 0
+        || (result.toolUseCount ?? 0) > 0
+        || (result.openToolUseIds?.length ?? 0) > 0
+        || result.lastReplyText.trim()
+        || result.fullText.trim()
+        || hasRecordedTokenUsage(result)) {
+        return false;
+    }
+    return true;
+}
+function usageHasTokens(usage) {
+    if (!usage)
+        return false;
+    if (numericToken(usage.input_tokens) > 0
+        || numericToken(usage.output_tokens) > 0
+        || numericToken(usage.cache_read_input_tokens) > 0
+        || numericToken(usage.cache_creation_input_tokens) > 0) {
+        return true;
+    }
+    return Array.isArray(usage.iterations) && usage.iterations.some(usageHasTokens);
+}
+function hasRecordedTokenUsage(result) {
+    return usageHasTokens(result.tokenUsage)
+        || usageHasTokens(result.lastModelCall?.tokenUsage)
+        || result.modelCalls?.some(call => usageHasTokens(call.tokenUsage)) === true;
+}
+function formatProtocolReplayExhaustedMessage(reason, replayAttempts) {
+    if (replayAttempts === 0 || (reason !== 'input_not_consumed' && reason !== 'empty_success')) {
+        return `Agent 协议未闭合（${reason}），任务未提交`;
+    }
+    const detail = reason === 'input_not_consumed'
+        ? '模型服务未确认接收本次输入'
+        : '模型服务未返回可提交的结果';
+    return `${detail}（${reason}），已立即重试 ${replayAttempts} 次仍失败，任务未提交。\n请稍后重试；若持续出现，请切换模型或向上游服务商提供错误代码和发生时间。`;
+}
+function withFallbackModel(override, candidate) {
+    const { model: _model, effort: _effort, effortMode: _effortMode, ...preserved } = override || {};
+    return {
+        ...preserved,
+        model: candidate.model,
+        ...(candidate.effort ? { effort: candidate.effort } : { effortMode: 'model_default' }),
+    };
+}
 function getStreamErrorText(result) {
     return [
         result.errors?.join('\n'),
@@ -217,6 +289,17 @@ function streamHitContextLimit(result) {
         isContextTooLongText(result.errors?.join(' ') || '') ||
         isContextTooLongText(result.fullText);
 }
+/** Preserve task-level audit facts when a context recovery starts a new SDK stream. */
+function mergeContextRecoveryResult(previous, next) {
+    return {
+        ...next,
+        inputAccepted: previous.inputAccepted || next.inputAccepted,
+        textCount: (previous.textCount ?? 0) + (next.textCount ?? 0),
+        toolUseCount: (previous.toolUseCount ?? 0) + (next.toolUseCount ?? 0),
+        numTurns: (previous.numTurns ?? 0) + (next.numTurns ?? 0),
+        contextRecoveryAttempts: (previous.contextRecoveryAttempts ?? 0) + 1,
+    };
+}
 /**
  * `isContextTooLongText` 是给错误分类用的宽松匹配，不能拿来删除模型正文：正常回答
  * 可能会说明或引用 `Prompt is too long`。这里只识别网关会单独输出的短错误行。
@@ -292,9 +375,6 @@ function getContextCompactFailedHint(agent) {
 function canCompactAgent(agent) {
     return hasCompact(agent) && agent.capabilities?.compact !== false;
 }
-function canClearAgent(agent) {
-    return hasClearSession(agent) && agent.capabilities?.clear !== false;
-}
 export async function resolveGroupRulesForTurn(opts, sync = syncGroupRulesContext) {
     if (!opts.isAunGroup)
         return {};
@@ -305,9 +385,7 @@ export async function resolveGroupRulesForTurn(opts, sync = syncGroupRulesContex
     return sync({ selfAid: opts.selfAid, groupId: opts.groupId, channel: opts.channel });
 }
 function autoCompactTokensFromMaxTokens(maxTokens) {
-    if (!maxTokens || maxTokens <= 0)
-        return undefined;
-    return maxTokens >= 1000000 ? maxTokens - 100000 : maxTokens;
+    return autoCompactWindowForContextWindow(maxTokens);
 }
 /**
  * 构造 OutboundEnvelope —— 出站三件套的信封部分。
@@ -341,8 +419,10 @@ export class ResponseEngine {
     primaryRunnerKey;
     interruptedSessions = new Map(); // sessionId → reason ('new_message' | 'stop' | ...)
     timeoutErrors = new Map();
-    /** sessionId → 模型降级状态（带退避探测，进程重启清零） */
+    /** sessionId → 已成功的模型降级状态（进程重启清零） */
     modelFallbackMap = new Map();
+    /** sessionId → interruptible task-level API retry delays. */
+    retryDelayWaiters = new Map();
     interactionRouter;
     messageQueue;
     handoffRuntime;
@@ -479,6 +559,7 @@ export class ResponseEngine {
                 const reason = (event.reason || 'new_message');
                 this.turnCoordinator.invalidate(event.sessionId, reason);
                 this.interruptedSessions.set(event.sessionId, reason);
+                this.cancelRetryDelays(event.sessionId);
                 this.agentDelegationRegistry?.revokeSession(event.sessionId);
             }
         });
@@ -512,6 +593,9 @@ export class ResponseEngine {
         this.messageQueue = queue;
     }
     async interruptSession(sessionId, reason) {
+        // A retry delay has no active runner stream to abort. Wake it before any
+        // session-store I/O so /stop and a newer message take effect immediately.
+        this.cancelRetryDelays(sessionId);
         const session = await this.sessionManager.getSessionById(sessionId);
         if (!session)
             return;
@@ -831,30 +915,22 @@ export class ResponseEngine {
             return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
             undefined, turnLease);
         }
-        await this.emitOperationalNotice(renderer, '⚠️ 压缩失败，尝试清空会话历史后重试...', 'warn', 'compact-failed-clear');
-        await renderer.flush();
-        if (!canClearAgent(agent)) {
-            throw new Error('CONTEXT_COMPACT_FAILED');
-        }
-        const previousAgentSessionId = session.agentSessionId;
-        let cleared = false;
-        try {
-            cleared = await agent.clearSession(session.id, previousAgentSessionId, absoluteProjectPath);
-        }
-        catch (error) {
-            logger.warn(`[ResponseEngine] clearSession failed after compact failure: ${error}`);
-        }
-        if (!cleared) {
-            throw new Error('CONTEXT_COMPACT_FAILED');
+        // Dropping the whole session hides the root cause and can replay side
+        // effects in unattended trigger tasks. Surface an actionable failure
+        // instead; callers may explicitly start a fresh task if that is desired.
+        throw new Error('CONTEXT_COMPACT_FAILED');
+    }
+    async recoverFromContextLimit(initialResult, opts) {
+        let result = initialResult;
+        let attempts = initialResult.contextRecoveryAttempts ?? 0;
+        while (attempts < MAX_CONTEXT_RECOVERY_ATTEMPTS) {
+            const recovered = await this.retryAfterContextRecovery('上下文已自动压缩，请继续之前未完成的任务。', opts);
+            result = mergeContextRecoveryResult(result, recovered);
+            attempts = result.contextRecoveryAttempts ?? attempts + 1;
+            if (!result.isError || !streamHitContextLimit(result))
+                return result;
         }
-        session.agentSessionId = undefined;
-        await this.sessionManager.updateSession(session.id, { agentSessionId: null });
-        await this.emitOperationalNotice(renderer, '✅ 会话已清空，继续处理...', 'info', 'clear-retry');
-        await renderer.flush();
-        const retryStream = await agent.runQuery(session.id, '会话历史已清空，请继续之前未完成的任务。', absoluteProjectPath, undefined, undefined, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
-        agent.registerStream(streamKey, retryStream);
-        return await this.processEventStream(retryStream, session, agent, renderer, resetTimer, shouldSuppress, proactive, undefined, // 重试分支不调插件钩子
-        undefined, turnLease);
+        return result;
     }
     /**
      * 根据 channel 标识查找渠道信息
@@ -1357,6 +1433,36 @@ export class ResponseEngine {
             ? configuredSeconds * 1000
             : undefined;
     }
+    waitForRetryDelay(sessionId, delayMs) {
+        if (this.interruptedSessions.has(sessionId))
+            return Promise.resolve(false);
+        return new Promise(resolve => {
+            let settled = false;
+            const waiters = this.retryDelayWaiters.get(sessionId) ?? new Set();
+            this.retryDelayWaiters.set(sessionId, waiters);
+            const finish = (elapsed) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                waiters.delete(cancel);
+                if (waiters.size === 0)
+                    this.retryDelayWaiters.delete(sessionId);
+                resolve(elapsed);
+            };
+            const cancel = () => finish(false);
+            const timer = setTimeout(() => finish(true), delayMs);
+            timer.unref?.();
+            waiters.add(cancel);
+        });
+    }
+    cancelRetryDelays(sessionId) {
+        const waiters = this.retryDelayWaiters.get(sessionId);
+        if (!waiters)
+            return;
+        for (const cancel of [...waiters])
+            cancel();
+    }
     /** 自动安全模式已禁用：仅保留错误计数，不再自动切换状态 */
     async _processMessageInternal(message, session, absoluteProjectPath, resetTimer, shouldSuppress, getLastIdleSec, outputState = { middleOutputMode: 'all' }, timeoutControl) {
         const messageId = `${message.channel}_${message.channelId}_${message.timestamp || Date.now()}`;
@@ -1703,6 +1809,11 @@ export class ResponseEngine {
                 });
             };
         }
+        // Kept outside the task body so a thrown terminal error can preserve the
+        // work already performed in its trigger audit metadata.
+        let streamResult = { isError: false, lastReplyText: '', fullText: '', hasReceivedText: false };
+        let startTime = Date.now();
+        let protocolReplayAttempts = 0;
         try {
             const isBackground = this.isBackgroundSession(session, message.channel, message.channelId);
             // 记录收到消息
@@ -1879,7 +1990,7 @@ export class ResponseEngine {
             // 均以普通非最终文本显示运行提示；none 不显示。其它 activity 在 all 下仍保持结构化。
             // 它仍发生在真正的 prompt 执行之前。
             await this.runPendingAutoCompactAtTaskStart(session, agent, absoluteProjectPath, renderer);
-            const startTime = Date.now();
+            startTime = Date.now();
             if (isProactive) {
                 logger.info(`[ResponseEngine] proactive mode: outputs via thought.put task=${taskId}`);
             }
@@ -2151,12 +2262,15 @@ export class ResponseEngine {
                 : body;
             // 先用裸文本兜底；vars 构造完成后用消息渲染层重算（见下方 effectivePrompt 重赋值）。
             let effectivePrompt = wrapPrompt(message.content);
-            let streamResult = { isError: false, lastReplyText: '', fullText: '', hasReceivedText: false };
             let renderResult;
             let effectiveSystemPrompt;
             let modelOverride;
-            let usedFallback = false;
+            let usedFallback;
             let skipEvolcoreModel = false;
+            let probingPrimaryModel = false;
+            let primaryModel;
+            let fallbackCandidates = [];
+            let previousFallbackState;
             let agentModel;
             let v2HandoffIds = [];
             let v2HandoffDirection;
@@ -2211,64 +2325,50 @@ export class ResponseEngine {
                 let effectiveEffortSource;
                 const triggerModelOverride = message.triggerMeta?.modelOverride;
                 const triggerEffortOverride = message.triggerMeta?.effortOverride;
-                let appliedTriggerModelOverride = false;
-                let effectiveTriggerEffortOverride;
-                // 取降级状态，按退避策略决定是否跳过 evolcore 作用域模型
-                const fbState = this.modelFallbackMap.get(session.id) ?? {
-                    failCount: 0, fallbackActive: false,
-                    messagesSinceFallback: 0, nextProbeAt: 2, hintShown: false,
-                };
-                // 退避期内递增消息计数，判断是否到探测点
-                if (fbState.fallbackActive) {
-                    fbState.messagesSinceFallback++;
-                    skipEvolcoreModel = fbState.messagesSinceFallback < fbState.nextProbeAt;
-                    this.modelFallbackMap.set(session.id, fbState);
-                }
-                // 非跳过时：尝试解析 evolcore 作用域模型
+                const hasExplicitTriggerModel = typeof triggerModelOverride === 'string'
+                    && triggerModelOverride.trim().length > 0;
                 let evolcoreModelOverride;
-                if (!skipEvolcoreModel) {
-                    try {
-                        const selector = { self: selfAid || undefined, peerKey };
-                        const modelResolution = resolveEffectiveFieldWithSource(`baseagents.${normalizedBaseagent.canonical}.model`, selector, { cache: true });
-                        const effortResolution = resolveEffectiveFieldWithSource(`baseagents.${normalizedBaseagent.canonical}.${normalizedBaseagent.canonical === 'codex' ? 'reasoning' : 'effort'}`, selector, { cache: true });
-                        const modelDecision = constrainResolvedModelForRole({
-                            role: peerRole,
-                            baseagent: normalizedBaseagent.canonical,
-                            model: modelResolution.value,
-                            resolveModelId: typeof agent.resolveModelId === 'function'
-                                ? agent.resolveModelId.bind(agent)
-                                : undefined,
-                            selfAid: selfAid || undefined,
-                        });
-                        const model = modelDecision.model;
-                        const effortField = `baseagents.${normalizedBaseagent.canonical}.${normalizedBaseagent.canonical === 'codex' ? 'reasoning' : 'effort'}`;
-                        const effortDecision = resolveRuntimeStringField({
-                            selfAid: selfAid || undefined,
-                            role: peerRole,
-                            field: effortField,
-                            configuredValue: effortResolution.value,
-                        });
-                        const effectiveEffortValue = effortDecision.effectiveValue;
-                        const effort = effectiveEffortValue === 'auto' ? undefined : effectiveEffortValue;
-                        effectiveModelSource = modelDecision.constrained
-                            ? 'role'
-                            : modelResolution.source ? `${modelResolution.source.target}:${modelResolution.source.file}` : undefined;
-                        effectiveEffortSource = effortDecision.decidedBy === 'role'
-                            ? 'role'
-                            : effortResolution.source
-                                ? `${effortResolution.source.target}:${effortResolution.source.file}`
-                                : undefined;
-                        if (model || effort) {
-                            evolcoreModelOverride = { model, effort };
-                            effectiveModel = model;
-                        }
-                        effectiveEffort = effectiveEffortValue;
-                    }
-                    catch (e) {
-                        logger.warn(`[ResponseEngine] effective model config resolution failed: ${e instanceof Error ? e.message : String(e)}`);
+                try {
+                    const selector = { self: selfAid || undefined, peerKey };
+                    const modelResolution = resolveEffectiveFieldWithSource(`baseagents.${normalizedBaseagent.canonical}.model`, selector, { cache: true });
+                    const effortResolution = resolveEffectiveFieldWithSource(`baseagents.${normalizedBaseagent.canonical}.${normalizedBaseagent.canonical === 'codex' ? 'reasoning' : 'effort'}`, selector, { cache: true });
+                    const modelDecision = constrainResolvedModelForRole({
+                        role: peerRole,
+                        baseagent: normalizedBaseagent.canonical,
+                        model: modelResolution.value,
+                        resolveModelId: typeof agent.resolveModelId === 'function'
+                            ? agent.resolveModelId.bind(agent)
+                            : undefined,
+                        selfAid: selfAid || undefined,
+                    });
+                    const model = modelDecision.model;
+                    const effortField = `baseagents.${normalizedBaseagent.canonical}.${normalizedBaseagent.canonical === 'codex' ? 'reasoning' : 'effort'}`;
+                    const effortDecision = resolveRuntimeStringField({
+                        selfAid: selfAid || undefined,
+                        role: peerRole,
+                        field: effortField,
+                        configuredValue: effortResolution.value,
+                    });
+                    const effectiveEffortValue = effortDecision.effectiveValue;
+                    const effort = effectiveEffortValue === 'auto' ? undefined : effectiveEffortValue;
+                    effectiveModelSource = modelDecision.constrained
+                        ? 'role'
+                        : modelResolution.source ? `${modelResolution.source.target}:${modelResolution.source.file}` : undefined;
+                    effectiveEffortSource = effortDecision.decidedBy === 'role'
+                        ? 'role'
+                        : effortResolution.source
+                            ? `${effortResolution.source.target}:${effortResolution.source.file}`
+                            : undefined;
+                    if (model || effort) {
+                        evolcoreModelOverride = { model, effort };
+                        effectiveModel = model;
                     }
-                    modelOverride = evolcoreModelOverride;
+                    effectiveEffort = effectiveEffortValue;
                 }
+                catch (e) {
+                    logger.warn(`[ResponseEngine] effective model config resolution failed: ${e instanceof Error ? e.message : String(e)}`);
+                }
+                modelOverride = evolcoreModelOverride;
                 if (triggerModelOverride || triggerEffortOverride) {
                     const constrainedOverride = { ...(modelOverride || {}) };
                     if (triggerModelOverride) {
@@ -2287,7 +2387,6 @@ export class ResponseEngine {
                             delete constrainedOverride.model;
                         effectiveModel = triggerModelDecision.model;
                         effectiveModelSource = triggerModelDecision.constrained ? 'role' : 'trigger';
-                        appliedTriggerModelOverride = !triggerModelDecision.constrained;
                     }
                     if (triggerEffortOverride) {
                         const effortField = `baseagents.${normalizedBaseagent.canonical}.${normalizedBaseagent.canonical === 'codex' ? 'reasoning' : 'effort'}`;
@@ -2298,9 +2397,9 @@ export class ResponseEngine {
                             configuredValue: triggerEffortOverride,
                         });
                         const triggerEffort = triggerEffortDecision.effectiveValue;
-                        effectiveTriggerEffortOverride = triggerEffort === 'auto' ? undefined : triggerEffort;
-                        if (effectiveTriggerEffortOverride)
-                            constrainedOverride.effort = effectiveTriggerEffortOverride;
+                        const effectiveTriggerEffort = triggerEffort === 'auto' ? undefined : triggerEffort;
+                        if (effectiveTriggerEffort)
+                            constrainedOverride.effort = effectiveTriggerEffort;
                         else
                             delete constrainedOverride.effort;
                         effectiveEffort = triggerEffort;
@@ -2308,6 +2407,46 @@ export class ResponseEngine {
                     }
                     modelOverride = constrainedOverride;
                 }
+                agentModel = (typeof agent.getModel === 'function') ? agent.getModel() : undefined;
+                primaryModel = modelOverride?.model || agentModel;
+                if (!hasExplicitTriggerModel && primaryModel) {
+                    const fallbackResolution = eligibleFallbackModels({
+                        baseagent: normalizedBaseagent.canonical,
+                        currentModel: primaryModel,
+                        resolveModelId: typeof agent.resolveModelId === 'function'
+                            ? agent.resolveModelId.bind(agent)
+                            : undefined,
+                        isAllowed: model => isModelAllowedForRoleBaseagent(peerRole, normalizedBaseagent.canonical, model, typeof agent.resolveModelId === 'function'
+                            ? agent.resolveModelId.bind(agent)
+                            : undefined, selfAid || undefined),
+                    });
+                    fallbackCandidates = fallbackResolution.candidates;
+                    if (fallbackResolution.rejected.length > 0) {
+                        logger.warn(`[ResponseEngine] Ignored ${fallbackResolution.rejected.length} fallback model candidate(s): session=${session.id}`);
+                    }
+                    const existingFallback = this.modelFallbackMap.get(session.id);
+                    if (existingFallback
+                        && (existingFallback.baseagent !== normalizedBaseagent.canonical
+                            || existingFallback.primaryModel !== primaryModel
+                            || !fallbackCandidates.some(candidate => candidate.model === existingFallback.activeFallback.model))) {
+                        this.modelFallbackMap.delete(session.id);
+                    }
+                    else if (existingFallback) {
+                        previousFallbackState = existingFallback;
+                        existingFallback.messagesSinceFallback++;
+                        probingPrimaryModel = existingFallback.messagesSinceFallback >= existingFallback.nextProbeAt;
+                        if (!probingPrimaryModel) {
+                            skipEvolcoreModel = true;
+                            usedFallback = existingFallback.activeFallback;
+                            modelOverride = withFallbackModel(modelOverride, usedFallback);
+                            effectiveModel = usedFallback.model;
+                            effectiveModelSource = 'fallback';
+                            effectiveEffort = usedFallback.effort;
+                            effectiveEffortSource = usedFallback.effort ? 'fallback' : 'model_default';
+                        }
+                        this.modelFallbackMap.set(session.id, existingFallback);
+                    }
+                }
                 // permissionMode 随角色策略或 trigger override 传入；单 runner
                 // 嵌入/测试路径没有 self/peer 作用域时，避免制造无配置来源的 override。
                 const shouldPassPermissionMode = !!message.triggerMeta?.permissionModeOverride || !!selfAid;
@@ -2320,7 +2459,6 @@ export class ResponseEngine {
                         sessionTitle: deriveSessionTitle(session.name, message.content, session.threadId),
                     };
                 }
-                agentModel = (typeof agent.getModel === 'function') ? agent.getModel() : undefined;
                 const causationPath = inputCausation.trigger?.path ?? [];
                 const originNode = causationPath[0];
                 logger.info(`[ResponseEngine] execution context session=${session.id}`
@@ -2418,8 +2556,8 @@ export class ResponseEngine {
                         baseAgentName: normalizedBaseagent.displayName,
                         baseAgentModel: agentModel || undefined,
                         effectiveModel: effectiveModel || agentModel || undefined,
-                        modelFallbackActive: (fbState.fallbackActive || skipEvolcoreModel) ? true : undefined,
-                        modelFallbackModel: (fbState.fallbackActive || skipEvolcoreModel) ? (agentModel || undefined) : undefined,
+                        modelFallbackActive: usedFallback ? true : undefined,
+                        modelFallbackModel: usedFallback?.model,
                         agentSessionId: session.agentSessionId || undefined,
                         // 渲染模式：各类型当前激活的 modeName（从内存 config 读，渲染层据此选 manifest section）。
                         renderModes: this.agentRegistry?.resolveByChannel(channelKey)?.config?.render ?? undefined,
@@ -2603,12 +2741,11 @@ export class ResponseEngine {
                     });
                     runtimeEnv[AGENT_DELEGATION_TOKEN_ENV] = delegationToken;
                 }
-                // 可重试错误（403/429/5xx/模型繁忙）按明确退避序列重试。
-                const RETRY_DELAYS_MS = [5_000, 10_000, 30_000];
-                const MAX_RETRIES = RETRY_DELAYS_MS.length;
+                const retryScheduler = new RetryScheduler(fallbackCandidates, modelOverride?.model || agentModel, model => (typeof agent.resolveModelId === 'function'
+                    ? (agent.resolveModelId(model) ?? model)
+                    : model));
                 const retryAttemptTimeoutMs = this.retryAttemptTimeoutMs();
                 let runAttempt = 1;
-                let consecutiveRetryFailures = 0;
                 const recordRetryHealthError = async (retryError) => {
                     if (!policy.accumulateErrors(chatType, identityRole))
                         return;
@@ -2624,10 +2761,10 @@ export class ResponseEngine {
                 };
                 while (true) {
                     let streamRegistered = false;
-                    const shouldTimeoutRetryAttempt = consecutiveRetryFailures > 0 && retryAttemptTimeoutMs !== undefined;
+                    const shouldTimeoutRetryAttempt = retryScheduler.shouldTimeoutAttempt() && retryAttemptTimeoutMs !== undefined;
                     let attemptTimeout;
                     try {
-                        logger.info(`[ResponseEngine] agent.runQuery start: agent=${agent.name} session=${session.id} task=${taskId} attempt=${runAttempt} consecutiveFailures=${consecutiveRetryFailures} agentSessionId=${session.agentSessionId ?? 'none'}`);
+                        logger.info(`[ResponseEngine] agent.runQuery start: agent=${agent.name} session=${session.id} task=${taskId} attempt=${runAttempt} apiRetries=${retryScheduler.apiRetryAttemptsMade} agentSessionId=${session.agentSessionId ?? 'none'}`);
                         const stream = await agent.runQuery(session.id, effectivePrompt, absoluteProjectPath, session.agentSessionId, renderResult?.images.length ? renderResult.images : message.images, effectiveSystemPrompt, this.sessionManager, modelOverride, runtimeEnv);
                         agent.registerStream(streamKey, stream);
                         streamRegistered = true;
@@ -2642,15 +2779,32 @@ export class ResponseEngine {
                         streamResult = attemptTimeout
                             ? await Promise.race([processAttempt, attemptTimeout.promise])
                             : await processAttempt;
+                        if (!streamResult.isError) {
+                            const protocolDecision = this.turnCoordinator.evaluateCommit(turnLease, this.buildTurnCommitEvidence(session, streamResult));
+                            const protocolReason = protocolDecision.ok ? undefined : protocolDecision.reason;
+                            const safeProtocolReplay = isSafeProtocolReplayCandidate(streamResult, protocolReason);
+                            const protocolRetry = retryScheduler.afterProtocolFailure(safeProtocolReplay ? protocolReason : undefined, safeProtocolReplay);
+                            if (protocolRetry.kind === 'protocol_replay') {
+                                protocolReplayAttempts = protocolRetry.attempt;
+                                agent.cleanupStream(streamKey);
+                                logger.warn(`[ResponseEngine] Replaying zero-work protocol failure: session=${session.id} `
+                                    + `task=${taskId} reason=${protocolReason} attempt=${protocolRetry.attempt}/${protocolRetry.maxAttempts}`);
+                                await this.emitOperationalNotice(renderer, `模型未确认完成，正在立即重试 ${protocolRetry.attempt}/${protocolRetry.maxAttempts}`, 'warn', 'protocol-retry');
+                                await renderer.flush();
+                                runAttempt++;
+                                continue;
+                            }
+                        }
                         if (streamResult.isError && !streamHitContextLimit(streamResult)) {
                             const streamErrorText = getStreamErrorText(streamResult);
-                            if (streamErrorText && isRetryableError(new Error(streamErrorText))) {
+                            const streamError = streamErrorText ? new Error(streamErrorText) : undefined;
+                            if (streamError && (isRetryableError(streamError) || classifyError(streamError) === ErrorType.MODEL_UNAVAILABLE)) {
                                 renderer.discardPending();
-                                throw new Error(streamErrorText);
+                                throw streamError;
                             }
                         }
                         // 探测成功（退避期内到达探测点且用的是 evolcore 模型）→ 清零降级状态
-                        if (fbState.fallbackActive && !skipEvolcoreModel && !usedFallback) {
+                        if (probingPrimaryModel && !usedFallback) {
                             this.modelFallbackMap.delete(session.id);
                             logger.info(`[ResponseEngine] Model probe succeeded, cleared fallback state for session=${session.id}`);
                         }
@@ -2673,47 +2827,67 @@ export class ResponseEngine {
                             permissionError._errorAlreadySent = true;
                             throw permissionError;
                         }
-                        // 模型不可用：累计计数，本次切换到 baseAgentModel 立即重试，不让用户看到失败
-                        if (classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE && !appliedTriggerModelOverride && evolcoreModelOverride?.model) {
-                            fbState.failCount++;
-                            if (fbState.failCount >= 2) {
-                                fbState.fallbackActive = true;
-                                fbState.messagesSinceFallback = 0;
-                                fbState.nextProbeAt = Math.min(Math.pow(2, fbState.failCount - 1), 8);
+                        if (classifyError(retryError) === ErrorType.MODEL_UNAVAILABLE && !hasExplicitTriggerModel) {
+                            if (probingPrimaryModel && previousFallbackState) {
+                                const resumedFallback = previousFallbackState.activeFallback;
+                                retryScheduler.markModelAttempted(resumedFallback.model);
+                                modelOverride = withFallbackModel(modelOverride, resumedFallback);
+                                usedFallback = resumedFallback;
+                                skipEvolcoreModel = true;
+                                probingPrimaryModel = false;
+                                previousFallbackState.messagesSinceFallback = 0;
+                                previousFallbackState.nextProbeAt = Math.min(previousFallbackState.nextProbeAt * 2, 8);
+                                this.modelFallbackMap.set(session.id, previousFallbackState);
+                                await this.emitOperationalNotice(renderer, `原模型 ${primaryModel ?? '默认模型'} 仍不可用，继续使用备用模型 ${resumedFallback.model}`, 'warn', 'model-probe-fallback');
+                                await renderer.flush();
+                                runAttempt++;
+                                continue;
                             }
-                            this.modelFallbackMap.set(session.id, fbState);
-                            logger.warn(`[ResponseEngine] Model unavailable: ${evolcoreModelOverride.model}, failCount=${fbState.failCount}, fallbackActive=${fbState.fallbackActive}`);
-                            // 切换到 baseAgentModel 重试（清除 model/effort，让 runQuery 使用 this.model；
-                            // 保留 permissionMode —— 它与模型无关，不能因模型降级而丢失）
-                            modelOverride = {
-                                ...(effectiveTriggerEffortOverride ? { effort: effectiveTriggerEffortOverride } : {}),
-                                permissionMode: effectivePermissionMode,
-                                ...(modelOverride?.sessionTitle ? { sessionTitle: modelOverride.sessionTitle } : {}),
-                                ...(modelOverride?.turn ? { turn: modelOverride.turn } : {}),
-                            };
-                            usedFallback = true;
-                            runAttempt++;
-                            continue;
+                            const modelFallback = retryScheduler.afterModelUnavailable();
+                            if (modelFallback.kind === 'model_fallback') {
+                                modelOverride = withFallbackModel(modelOverride, modelFallback.candidate);
+                                usedFallback = modelFallback.candidate;
+                                skipEvolcoreModel = true;
+                                if (primaryModel) {
+                                    this.modelFallbackMap.set(session.id, {
+                                        baseagent: normalizedBaseagent.canonical,
+                                        primaryModel,
+                                        activeFallback: modelFallback.candidate,
+                                        messagesSinceFallback: 0,
+                                        nextProbeAt: 2,
+                                        hintShown: false,
+                                    });
+                                }
+                                logger.warn(`[ResponseEngine] Model unavailable: switching ${primaryModel ?? '<runner-default>'} to ${modelFallback.candidate.model} (${modelFallback.attempt}/${modelFallback.candidateCount})`);
+                                await this.emitOperationalNotice(renderer, `模型 ${primaryModel ?? '默认模型'} 不可用，正在切换备用模型 ${modelFallback.candidate.model}（${modelFallback.attempt}/${modelFallback.candidateCount}）`, 'warn', 'model-fallback');
+                                await renderer.flush();
+                                runAttempt++;
+                                continue;
+                            }
+                            this.modelFallbackMap.delete(session.id);
+                            const candidateHint = fallbackCandidates.length === 0
+                                ? '未配置可用备用模型'
+                                : '备用模型均不可用';
+                            throw markModelFallbackExhausted(new Error(`model_not_found: ${primaryModel ?? 'runner_default'}`), `当前模型 ${primaryModel ?? '默认模型'} 不可用，${candidateHint}。请稍后重试；管理员可在 agents/defaults.json 的 baseagents.${normalizedBaseagent.canonical}.fallbackModels 配置同类备用模型。`);
                         }
                         if (retryAttemptTimedOut || isRetryableError(retryError)) {
-                            if (didRetryMakeProgress(retryError)) {
-                                consecutiveRetryFailures = 0;
-                            }
                             await recordRetryHealthError(retryError);
-                            if (consecutiveRetryFailures < MAX_RETRIES) {
+                            const apiRetry = retryScheduler.afterTransientFailure(didRetryMakeProgress(retryError));
+                            if (apiRetry.kind === 'api_retry') {
                                 // 检查中断状态：如果任务已被中断（/stop 或新消息），立即退出重试循环
                                 const interruptReason = this.interruptedSessions.get(session.id);
                                 if (interruptReason) {
                                     logger.info(`[ResponseEngine] Task interrupted during retry wait (reason=${interruptReason}), aborting retry loop session=${session.id}`);
                                     throw new Error('TASK_INTERRUPTED');
                                 }
-                                const delay = RETRY_DELAYS_MS[consecutiveRetryFailures];
-                                const nextRetryNumber = consecutiveRetryFailures + 1;
-                                consecutiveRetryFailures++;
-                                logger.warn(`[ResponseEngine] Retryable error (attempt ${runAttempt}, consecutive ${consecutiveRetryFailures}/${MAX_RETRIES}), retrying in ${delay}ms:`, retryError);
-                                await this.emitOperationalNotice(renderer, `API 不可用，${delay / 1000}秒后重试 ${nextRetryNumber}/${MAX_RETRIES}`, 'warn', 'retry');
+                                logger.warn(`[ResponseEngine] Retryable error (attempt ${runAttempt}, api retry ${apiRetry.attempt}/${apiRetry.maxAttempts}), retrying in ${apiRetry.delayMs}ms:`, retryError);
+                                await this.emitOperationalNotice(renderer, `API 不可用，${apiRetry.delayMs / 1000}秒后重试 ${apiRetry.attempt}/${apiRetry.maxAttempts}`, 'warn', 'retry');
                                 await renderer.flush();
-                                await new Promise(resolve => setTimeout(resolve, delay));
+                                const retryDelayElapsed = await this.waitForRetryDelay(session.id, apiRetry.delayMs);
+                                if (!retryDelayElapsed) {
+                                    logger.info(`[ResponseEngine] Task interrupted during retry delay session=${session.id}`);
+                                    throw new Error('TASK_INTERRUPTED');
+                                }
                                 // 延迟后再次检查中断状态（延迟期间可能收到中断信号）
                                 const postDelayInterrupt = this.interruptedSessions.get(session.id);
                                 if (postDelayInterrupt) {
@@ -2723,7 +2897,7 @@ export class ResponseEngine {
                                 runAttempt++;
                                 continue;
                             }
-                            markRetryExhausted(retryError, MAX_RETRIES);
+                            markRetryExhausted(retryError, retryScheduler.apiRetryAttemptsMade);
                         }
                         throw retryError; // 不可重试或已耗尽重试次数
                     }
@@ -2734,7 +2908,7 @@ export class ResponseEngine {
             }
             catch (error) {
                 if (classifyError(error) === ErrorType.CONTEXT_TOO_LONG && session.agentSessionId && canCompactAgent(agent)) {
-                    streamResult = await this.retryAfterContextRecovery('上下文已自动压缩，请继续之前未完成的任务。', {
+                    streamResult = await this.recoverFromContextLimit(streamResult, {
                         streamKey,
                         renderer,
                         agent,
@@ -2775,7 +2949,7 @@ export class ResponseEngine {
             const isPromptTooLong = streamResult.isError && !!session.agentSessionId && !!compactAgent
                 && streamHitContextLimit(streamResult);
             if (isPromptTooLong) {
-                streamResult = await this.retryAfterContextRecovery('上下文已自动压缩，请继续之前未完成的任务。', {
+                streamResult = await this.recoverFromContextLimit(streamResult, {
                     streamKey,
                     renderer,
                     agent,
@@ -2833,7 +3007,7 @@ export class ResponseEngine {
                         subtype: 'protocol_incomplete',
                         terminalReason: 'protocol_incomplete',
                         protocolIncompleteReason: reason,
-                        errors: [`Agent 协议未闭合（${reason}），任务未提交`],
+                        errors: [formatProtocolReplayExhaustedMessage(reason, protocolReplayAttempts)],
                         lastReplyText: '',
                         fullText: '',
                         hasReceivedText: false,
@@ -2994,13 +3168,12 @@ export class ResponseEngine {
             this.agentDelegationRegistry?.revokeTask(session.id, taskId);
             logger.info(`[ResponseEngine] session ${session.id} processing cleared task=${taskId}`);
             // 降级模型回复末尾追加标记（代码层硬注入，不依赖模型输出）
-            const usingFallback = usedFallback || (skipEvolcoreModel && agentModel != null);
-            if (usingFallback && agentModel) {
+            if (usedFallback) {
                 const curFbState = this.modelFallbackMap.get(session.id);
                 const showHint = curFbState && curFbState.nextProbeAt >= 8 && !curFbState.hintShown;
                 const suffix = showHint
-                    ? `\n\n---\n⚠️ [降级模型: ${agentModel} | 可告诉我"帮我检查可用模型"来诊断]`
-                    : `\n\n---\n⚠️ [降级模型: ${agentModel}]`;
+                    ? `\n\n---\n⚠️ [降级模型: ${usedFallback.model} | 可告诉我"帮我检查可用模型"来诊断]`
+                    : `\n\n---\n⚠️ [降级模型: ${usedFallback.model}]`;
                 renderer.addText(suffix);
                 if (showHint && curFbState) {
                     curFbState.hintShown = true;
@@ -3016,7 +3189,8 @@ export class ResponseEngine {
                 // Flush 剩余内容（文件标记已在 flush 时自动移除）
                 await renderer.flush(true);
             }
-            if (!streamResult.isError) {
+            const terminalInterrupt = isExpectedTerminalInterrupt(streamResult.terminalReason);
+            if (!streamResult.isError && !terminalInterrupt) {
                 const commitDecision = await this.turnCoordinator.commit(session, turnLease, this.buildTurnCommitEvidence(session, streamResult));
                 if (!commitDecision.ok) {
                     logger.info(`[ResponseEngine] Turn commit rejected after flush: session=${session.id} task=${taskId} reason=${commitDecision.reason}`);
@@ -3033,13 +3207,14 @@ export class ResponseEngine {
                 }
             }
             else {
-                await this.turnCoordinator.finish(session, turnLease, 'failed', streamResult.protocolIncompleteReason || streamResult.terminalReason || streamResult.subtype);
+                await this.turnCoordinator.finish(session, turnLease, terminalInterrupt ? 'cancelled' : 'failed', streamResult.protocolIncompleteReason || streamResult.terminalReason || streamResult.subtype);
             }
             // 注意：不在此处清除 interruptedSessions，由下一条消息的 prompt 包装逻辑消费
             const interruptReason = this.interruptedSessions.get(session.id);
-            if (streamResult.isError) {
+            if (streamResult.isError || terminalInterrupt) {
                 // Agent 流正常结束但任务结果失败（权限被拒、max turns、工具链失败等）
-                const errorSummary = streamResult.errors?.join('; ') || '任务执行失败';
+                const errorSummary = streamResult.errors?.join('; ')
+                    || (terminalInterrupt ? '用户交互未确认，任务已暂停' : '任务执行失败');
                 const userErrorSummary = streamResult.subtype === 'protocol_incomplete'
                     ? errorSummary
                     : streamHitContextLimit(streamResult)
@@ -3050,10 +3225,30 @@ export class ResponseEngine {
                 // 用户主动打断（新消息/​/stop/​撤回）会让 SDK 流在工具调用中途被掐断，
                 // 末尾 result message 形状异常并被标记为 error（含 SDK 内部 ede_diagnostic 串）。
                 // 这不是真正的失败，不应把诊断串暴露给用户，也不计入错误统计。
-                const isExpectedInterrupt = isNonErrorInterruptReason(interruptReason);
+                const isExpectedInterrupt = isNonErrorInterruptReason(interruptReason)
+                    || isExpectedTerminalInterrupt(streamResult.terminalReason);
                 if (!isExpectedInterrupt && !permissionTerminalFailure) {
-                    await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
-                    await adapter.send(envelope, { kind: 'status.error', metadata: { errorType: rawSubtype } }).catch(() => { });
+                    const terminalMetadata = {
+                        errorType: rawSubtype,
+                        message: userErrorSummary,
+                        durationMs: Date.now() - startTime,
+                        numTurns: streamResult.numTurns,
+                        toolCallCount: streamResult.toolUseCount ?? 0,
+                        tokenUsage: streamResult.tokenUsage,
+                        contextUsage: streamResult.contextUsage,
+                        contextRecoveryAttempts: streamResult.contextRecoveryAttempts ?? 0,
+                    };
+                    // DaemonChannel settles a trigger when it receives a terminal
+                    // payload. Send the metadata-bearing status first so failed runs do
+                    // not lose their tool counts and recovery diagnostics.
+                    if (message.source === 'trigger') {
+                        await adapter.send(envelope, { kind: 'status.error', metadata: terminalMetadata }).catch(() => { });
+                        await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
+                    }
+                    else {
+                        await adapter.send(envelope, { kind: 'result.error', text: userErrorSummary, reason: rawSubtype }).catch(() => { });
+                        await adapter.send(envelope, { kind: 'status.error', metadata: terminalMetadata }).catch(() => { });
+                    }
                     this.touchAgentActivity(channelKey);
                 }
                 if (isExpectedInterrupt) {
@@ -3061,7 +3256,15 @@ export class ResponseEngine {
                     // 这里不再补发 task:error（否则同一次打断被记两遍且错误归类为 error）。
                     // 仅记 info 日志收尾。注意：task:interrupted 已填充 interruptedSessions，
                     // stats 侧已据此收尾任务生命周期，无需在此重复发事件。
-                    logger.info(`[${message.channel}] Stream result error suppressed (user interrupt: ${interruptReason}): ${errorSummary}`);
+                    const interactionCancelled = isExpectedTerminalInterrupt(streamResult.terminalReason)
+                        && !isNonErrorInterruptReason(interruptReason);
+                    if (interactionCancelled) {
+                        await adapter.send(envelope, {
+                            kind: 'status.interrupted',
+                            metadata: { reason: 'interaction_cancelled' },
+                        }).catch(() => { });
+                    }
+                    logger.info(`[${message.channel}] Stream result error suppressed (${interactionCancelled ? 'interaction cancellation' : `user interrupt: ${interruptReason}`}): ${errorSummary}`);
                     logger.message({
                         msgId: messageId,
                         sessionId: session.id,
@@ -3070,7 +3273,7 @@ export class ResponseEngine {
                         error: errorSummary,
                         terminalReason: streamResult.terminalReason
                     });
-                    await this.publishTriggerExecutionInterrupted(message, adapter, envelope, interruptReason ?? 'interrupted', taskCausation);
+                    await this.publishTriggerExecutionInterrupted(message, adapter, envelope, interactionCancelled ? 'interaction_cancelled' : (interruptReason ?? 'interrupted'), taskCausation);
                 }
                 else {
                     logger.error(`[ResponseEngine] Task failed: session=${session.id} task=${taskId} ` +
@@ -3439,6 +3642,7 @@ export class ResponseEngine {
             // 用户主动中断（新消息打断 或 /stop 命令）时静默，不发送错误提示
             // processEventStream 已通过 renderer 发过错误时也跳过
             const retryExhaustedCount = getRetryExhaustedCount(error);
+            const modelFallbackExhaustedMessage = getModelFallbackExhaustedMessage(error);
             if (isUserInterrupt) {
                 logger.info(`[ResponseEngine] User interrupt by new_message, skip sending error message`);
             }
@@ -3450,11 +3654,13 @@ export class ResponseEngine {
                 const idleSec = getLastIdleSec?.() || 0;
                 const userMessage = retryExhaustedCount
                     ? formatRetryableErrorFinalMessage(error, retryExhaustedCount)
-                    : isTotalExecutionTimeout
-                        ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
-                        : isTimeout
-                            ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
-                            : getErrorMessage(error, undefined);
+                    : modelFallbackExhaustedMessage
+                        ? modelFallbackExhaustedMessage
+                        : isTotalExecutionTimeout
+                            ? `⚠️ 任务超过总执行时限（${Math.round(totalExecutionMs / 1000)}秒），已自动中断`
+                            : isTimeout
+                                ? (idleSec > 0 ? `⚠️ 任务超时（${idleSec}秒无响应），已自动中断` : '⚠️ 任务超时，已自动中断')
+                                : getErrorMessage(error, undefined);
                 // 获取 session 用于话题回复（如果 resolveSession 已执行）
                 let sendOpts;
                 try {
@@ -3471,10 +3677,32 @@ export class ResponseEngine {
                 const errorPayload = {
                     kind: 'result.error',
                     text: userMessage,
-                    reason: retryExhaustedCount ? 'retry_exhausted' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
+                    reason: retryExhaustedCount ? 'retry_exhausted' : modelFallbackExhaustedMessage ? 'model_unavailable' : isTotalExecutionTimeout ? 'total_execution_timeout' : isTimeout ? 'timeout' : errType,
                 };
-                await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
-                if (!isUserInterrupt && daemonTrigger) {
+                if (!isUserInterrupt && daemonTrigger && procStatus === 'error') {
+                    // DaemonChannel settles a trigger on the first terminal payload. Put
+                    // the complete failure metadata first so the audit retains tool
+                    // counts and context-recovery diagnostics even for thrown errors
+                    // (for example when compact itself fails).
+                    await adapter.send({ ...envelope, replyContext: sendOpts }, {
+                        kind: 'status.error',
+                        metadata: {
+                            errorType: errType,
+                            message: userMessage,
+                            durationMs: Date.now() - startTime,
+                            numTurns: streamResult.numTurns,
+                            toolCallCount: streamResult.toolUseCount ?? 0,
+                            tokenUsage: streamResult.tokenUsage,
+                            contextUsage: streamResult.contextUsage,
+                            contextRecoveryAttempts: streamResult.contextRecoveryAttempts ?? 0,
+                        },
+                    }).catch(() => { });
+                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                }
+                else {
+                    await adapter.send({ ...envelope, replyContext: sendOpts }, errorPayload);
+                }
+                if (!isUserInterrupt && daemonTrigger && procStatus !== 'error') {
                     await adapter.send({ ...envelope, replyContext: sendOpts }, statusPayload).catch(() => { });
                 }
                 // Proactive 可观测：catch 块的基础设施错误也透传为 thought，保证按 task_id 聚合完整
@@ -3574,9 +3802,14 @@ export class ResponseEngine {
                     return undefined;
                 const recordedAutoCompactTokens = row.auto_compact_tokens ?? undefined;
                 const inferredAutoCompactTokens = autoCompactTokensFromMaxTokens(row.max_tokens ?? undefined);
-                const autoCompactTokens = recordedAutoCompactTokens && recordedAutoCompactTokens > 0
+                const candidateAutoCompactTokens = recordedAutoCompactTokens && recordedAutoCompactTokens > 0
                     ? recordedAutoCompactTokens
                     : inferredAutoCompactTokens ?? autoCompactWindowForModel(model);
+                // Historic rows may contain the old fixed 350k threshold. Never let a
+                // persisted value exceed the context window that accompanied it.
+                const autoCompactTokens = inferredAutoCompactTokens
+                    ? Math.min(candidateAutoCompactTokens, inferredAutoCompactTokens)
+                    : candidateAutoCompactTokens;
                 return { totalTokens, autoCompactTokens };
             }
             finally {
@@ -3693,6 +3926,7 @@ export class ResponseEngine {
             resultText: result.lastReplyText || result.fullText,
             inputTokens: result.tokenUsage?.input_tokens ?? 0,
             outputTokens: result.tokenUsage?.output_tokens ?? 0,
+            hasTokenUsage: hasRecordedTokenUsage(result),
         };
     }
     /**
@@ -4106,7 +4340,8 @@ export class ResponseEngine {
                         // 上下文过长的错误不在此处输出 notice，留给外层 isPromptTooLong 触发 auto-compact
                         const isContextError = isContextTooLongText(event.error || '');
                         const isRetryableRuntimeError = isRetryableError(new Error(event.error || ''));
-                        if (!isContextError && !isRetryableRuntimeError && !hasErrorResult && !shouldSuppress()) {
+                        const isRecoverableModelError = classifyError(new Error(event.error || '')) === ErrorType.MODEL_UNAVAILABLE;
+                        if (!isContextError && !isRetryableRuntimeError && !isRecoverableModelError && !hasErrorResult && !shouldSuppress()) {
                             hasErrorResult = true;
                             renderer.addNotice(getRuntimeErrorMessage(event.error || '任务执行失败', false), 'warn', 'runtime-error', true);
                         }
@@ -4115,7 +4350,7 @@ export class ResponseEngine {
                     // SDK 可能产生多个 complete 事件（如 subagent 或 auto-compact 二次查询），
                     // 仅记录状态，最终 flush(true) 在流结束后统一执行
                     if (event.type === 'complete') {
-                        const isAbort = event.terminalReason === 'aborted_streaming' || event.terminalReason === 'aborted_tools';
+                        const isAbort = isExpectedTerminalInterrupt(event.terminalReason);
                         logger.info(`[ResponseEngine] ${isAbort ? 'task interrupted' : 'complete event'}: queryFinal=${event.queryFinal !== false} isError=${event.isError} terminalReason=${event.terminalReason ?? 'none'} subtype=${event.subtype ?? 'none'} hasReceivedText=${hasReceivedText}`);
                         // 自动回填会话名称
                         if (event.sessionTitle && shouldAutoFillSessionTitle(session.name, session.threadId)) {
@@ -4132,7 +4367,8 @@ export class ResponseEngine {
                         // 但用户主动中断（新消息打断 或 /stop 命令）时不显示错误提示
                         // 上下文过长的错误留给外层 isPromptTooLong 触发 auto-compact，不在此处输出
                         const interruptReason = this.interruptedSessions.get(session.id);
-                        const isUserInterrupt = isNonErrorInterruptReason(interruptReason);
+                        const isUserInterrupt = isNonErrorInterruptReason(interruptReason)
+                            || isExpectedTerminalInterrupt(event.terminalReason);
                         const isContextTooLong = event.terminalReason === 'prompt_too_long'
                             || isContextTooLongText(event.errors?.join(' ') || '')
                             || isContextTooLongText(lastReplyText);
@@ -4140,10 +4376,13 @@ export class ResponseEngine {
                         const isRetryableCompleteError = event.isError && !isContextTooLong && completeErrorText
                             ? isRetryableError(new Error(completeErrorText))
                             : false;
+                        const isRecoverableModelError = event.isError && !isContextTooLong && completeErrorText
+                            ? classifyError(new Error(completeErrorText)) === ErrorType.MODEL_UNAVAILABLE
+                            : false;
                         if (event.isError && completeErrorText && isPendingTextSameAsStreamError(renderer.getRemainingText(), completeErrorText)) {
                             renderer.discardPendingText();
                         }
-                        if (event.isError && !hasErrorResult && !shouldSuppress() && !isUserInterrupt && !isContextTooLong && !isRetryableCompleteError) {
+                        if (event.isError && !hasErrorResult && !shouldSuppress() && !isUserInterrupt && !isContextTooLong && !isRetryableCompleteError && !isRecoverableModelError) {
                             // 使用 terminalReason 提供更友好的错误提示（不带 emoji，由 formatter 统一加）
                             const userFriendlyMessage = event.terminalReason === 'prompt_too_long'
                                 ? getContextTooLongHint(agent)