deepstrike 0.2.34__tar.gz → 0.2.35__tar.gz

{deepstrike-0.2.34 → deepstrike-0.2.35}/Cargo.lock

@@ -194,7 +194,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-core"
-version = "0.2.34"
+version = "0.2.35"
 dependencies = [
  "compact_str",
  "pretty_assertions",
@@ -206,7 +206,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-node"
-version = "0.2.34"
+version = "0.2.35"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -218,7 +218,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-py"
-version = "0.2.34"
+version = "0.2.35"
 dependencies = [
  "compact_str",
  "deepstrike-core",
@@ -229,7 +229,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-sdk"
-version = "0.2.34"
+version = "0.2.35"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -263,7 +263,7 @@ dependencies = [
 
 [[package]]
 name = "deepstrike-wasm"
-version = "0.2.34"
+version = "0.2.35"
 dependencies = [
  "compact_str",
  "deepstrike-core",

{deepstrike-0.2.34 → deepstrike-0.2.35}/Cargo.toml

@@ -3,13 +3,13 @@ resolver = "2"
 members = ["crates/deepstrike-core", "crates/deepstrike-py"]
 
 [workspace.package]
-version = "0.2.34"
+version = "0.2.35"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/kongusen/deepstrike"
 
 [workspace.dependencies]
-deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.34" }
+deepstrike-core = { path = "crates/deepstrike-core", version = "0.2.35" }
 notify = "6"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

{deepstrike-0.2.34 → deepstrike-0.2.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepstrike
-Version: 0.2.34
+Version: 0.2.35
 Requires-Dist: httpx>=0.27
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: anyio>=4.0
@@ -11,6 +11,12 @@ Requires-Dist: dashscope>=1.20
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
 
+<p align="center">
+  <a href="https://github.com/kongusen/deepstrike">
+    <img src="https://raw.githubusercontent.com/kongusen/deepstrike/main/docs/public/banner.png" alt="DeepStrike" width="420" />
+  </a>
+</p>
+
 # DeepStrike Python SDK
 
 Runtime framework built on a Rust kernel. The kernel owns loop control, context compression, governance, signal routing, and memory paging — the SDK owns all I/O (LLM calls, tool execution, disk, long-term memory).

{deepstrike-0.2.34 → deepstrike-0.2.35}/README.md

@@ -1,3 +1,9 @@
+<p align="center">
+  <a href="https://github.com/kongusen/deepstrike">
+    <img src="https://raw.githubusercontent.com/kongusen/deepstrike/main/docs/public/banner.png" alt="DeepStrike" width="420" />
+  </a>
+</p>
+
 # DeepStrike Python SDK
 
 Runtime framework built on a Rust kernel. The kernel owns loop control, context compression, governance, signal routing, and memory paging — the SDK owns all I/O (LLM calls, tool execution, disk, long-term memory).

{deepstrike-0.2.34 → deepstrike-0.2.35}/crates/deepstrike-core/src/proc/mod.rs

@@ -84,6 +84,7 @@ impl AgentProcess {
             TerminationReason::UserAbort => "user_abort",
             TerminationReason::Error => "error",
             TerminationReason::MilestoneExceeded => "milestone_exceeded",
+            TerminationReason::ContextOverflow => "context_overflow",
         })
     }
 }

{deepstrike-0.2.34 → deepstrike-0.2.35}/crates/deepstrike-core/src/runtime/kernel.rs

@@ -346,10 +346,24 @@ pub enum KernelInputEvent {
         // on a 0 clock (effectively unlimited). Can become required once all SDKs feed time.
         #[serde(default, skip_serializing_if = "Option::is_none")]
         now_ms: Option<u64>,
+        /// Provider stop_reason for this response — `max_tokens` (Anthropic) / `length` (OpenAI)
+        /// signal an output-cap truncation, which drives the kernel's max-output-tokens recovery.
+        /// Additive: omitted by providers/SDKs that don't report it (no-op recovery).
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        stop_reason: Option<String>,
     },
     ToolResults {
         results: Vec<ToolResult>,
     },
+    /// Reactive recovery entry point: the SDK's provider stream failed. The kernel classifies the
+    /// error (context-overflow vs other) and runs the bounded compact-and-retry recovery ladder,
+    /// returning `CallProvider` to retry with a freshly compacted context or `Done` to terminate.
+    /// The runners forward the raw provider error text and dispatch the result, instead of each
+    /// owning the classify + compact + retry + give-up policy. Additive ABI: a brand-new variant,
+    /// byte-identical on the wire for SDKs that never send it.
+    ProviderError {
+        message: String,
+    },
     Signal {
         signal: RuntimeSignal,
     },
@@ -994,6 +1008,7 @@ impl KernelRuntime {
                 observed_input_tokens,
                 observed_output_tokens: _,
                 now_ms,
+                stop_reason,
             } => {
                 if let Some(tokens) = observed_input_tokens {
                     self.sm.ctx.set_observed_prompt_tokens(tokens);
@@ -1003,11 +1018,18 @@ impl KernelRuntime {
                 if let Some(ms) = now_ms {
                     self.sm.set_observed_time(ms);
                 }
+                // Stash stop_reason so `feed` can detect an output-cap truncation and drive recovery.
+                self.sm.set_pending_stop_reason(stop_reason);
                 self.sm.feed(LoopEvent::LLMResponse { message })
             }
             KernelInputEvent::ToolResults { results } => {
                 self.sm.feed(LoopEvent::ToolResults { results })
             }
+            KernelInputEvent::ProviderError { message } => {
+                // Reactive recovery is a kernel decision: classify + bounded compact-and-retry,
+                // returning the next action (retry or honest terminal) through the common tail.
+                self.sm.recover_from_provider_error(&message)
+            }
             KernelInputEvent::Signal { signal } => match self.sm.signal_event(signal) {
                 Some(action) => action,
                 // Non-actionable disposition (queued / observed / ignored / dropped):
@@ -1232,6 +1254,7 @@ mod tests {
             message: Message::assistant("done"),
             observed_input_tokens: None,
             observed_output_tokens: None,
+            stop_reason: None,
             now_ms: None,
         }));
 
@@ -1450,6 +1473,7 @@ mod tests {
                 message: msg,
                 observed_input_tokens: None,
                 observed_output_tokens: None,
+                stop_reason: None,
                 now_ms: None,
             }));
             runtime.step(KernelInput::new(KernelInputEvent::ToolResults {
@@ -1717,6 +1741,7 @@ mod tests {
             message: msg,
             observed_input_tokens: None,
             observed_output_tokens: None,
+            stop_reason: None,
             now_ms: Some(100),
         }));
         let step = runtime.step(KernelInput::new(KernelInputEvent::ToolResults {
@@ -1767,6 +1792,7 @@ mod tests {
             message: assistant_calling(tool),
             observed_input_tokens: None,
             observed_output_tokens: None,
+            stop_reason: None,
             now_ms: None,
         }))
     }
@@ -1992,6 +2018,7 @@ mod tests {
             message: assistant_calling("fetch"),
             observed_input_tokens: None,
             observed_output_tokens: None,
+            stop_reason: None,
             now_ms: Some(1_000),
         }));
         assert!(
@@ -2011,6 +2038,7 @@ mod tests {
             message: assistant_calling("fetch"),
             observed_input_tokens: None,
             observed_output_tokens: None,
+            stop_reason: None,
             now_ms: Some(1_001),
         }));
         assert!(

{deepstrike-0.2.34 → deepstrike-0.2.35}/crates/deepstrike-core/src/scheduler/state_machine/eviction.rs

@@ -1,12 +1,63 @@
 //! MM / eviction execution impl for [`super::LoopStateMachine`].
 
-use super::{KernelObservation, LoopStateMachine};
+use super::{KernelObservation, LoopAction, LoopPhase, LoopStateMachine};
 use crate::context::pressure::PressureAction;
 use crate::mm::{page_in_requests_from_calls, tier_hint_for_compress};
 use crate::runtime::kernel::KernelPressureAction;
 use crate::types::message::{Message, ToolCall};
+use crate::types::result::TerminationReason;
+
+/// Max consecutive compact-and-retry attempts before a context overflow is declared
+/// unrecoverable. Bounds the reactive recovery ladder (anti-spiral); resets on any successful
+/// provider turn. The `force_compress` "nothing left to save" check is the real terminator —
+/// this is the belt-and-suspenders cap so a degenerate provider that 413s forever still ends.
+const MAX_RECOVERY_ATTEMPTS: u8 = 2;
+
+/// Classify a provider error message as a context-overflow (prompt-too-long / 413). Centralizes
+/// the case-insensitive string match the four SDK runners (node/python/rust/wasm) each used to
+/// own, so the recovery vocabulary lives in exactly one place.
+pub(crate) fn is_prompt_too_long(message: &str) -> bool {
+    let msg = message.to_lowercase();
+    msg.contains("413")
+        || msg.contains("too long")
+        || msg.contains("prompt too long")
+        || msg.contains("context length exceeded")
+        || msg.contains("context_length_exceeded")
+}
 
 impl LoopStateMachine {
+    /// Reactive recovery for a provider error the SDK reports via [`KernelInputEvent::ProviderError`].
+    /// Owns the policy the SDK runners used to duplicate: classify → compact-and-retry on overflow
+    /// (bounded, anti-spiral) → honest terminal when the ladder is exhausted. Returns the next
+    /// [`LoopAction`] so the kernel's normal action tail dispatches it: `CallLLM` to retry the
+    /// provider with a freshly compacted context, or `Done { ContextOverflow }` to give up.
+    ///
+    /// This is the reactive twin of the proactive eviction checkpoint in `feed` — same execution
+    /// funnel (`force_compact` → `EvictionOp`s), now driven by a real provider 413 instead of an
+    /// rho threshold, and surfaced as a kernel decision rather than SDK control flow.
+    pub fn recover_from_provider_error(&mut self, message: &str) -> LoopAction {
+        self.observations.clear();
+        if !is_prompt_too_long(message) {
+            // Non-overflow provider failures aren't recoverable here — terminate with `Error`,
+            // the same outcome the runners produced, minus the fabricated `timeout`.
+            return self.terminate(TerminationReason::Error, None);
+        }
+        if self.recovery_attempts >= MAX_RECOVERY_ATTEMPTS {
+            return self.terminate(TerminationReason::ContextOverflow, None);
+        }
+        self.recovery_attempts += 1;
+        if self.force_compact() {
+            // Recovered headroom: re-render and retry as a normal turn (tools intact). The
+            // Compressed/PageOut observations pushed by `force_compact` ride out in this same
+            // step, so the SDK still archives the evicted messages.
+            self.phase = LoopPhase::Reason;
+            self.emit_call_llm()
+        } else {
+            // Nothing left to compact — the prompt genuinely won't fit. Honest terminal.
+            self.terminate(TerminationReason::ContextOverflow, None)
+        }
+    }
+
     /// 强行进行一次最大力度的压缩归档。通常用于收到模型 API 413 (Prompt too long) 时做兜底重试。
     pub fn force_compact(&mut self) -> bool {
         let action = PressureAction::AutoCompact;

{deepstrike-0.2.34 → deepstrike-0.2.35}/crates/deepstrike-core/src/scheduler/state_machine/mod.rs

@@ -188,6 +188,21 @@ pub struct LoopStateMachine {
     /// When set, the next LLM call strips tools to force a text response,
     /// then terminates with this reason once the response arrives.
     pub(super) pending_termination: Option<TerminationReason>,
+    /// Reactive context-overflow recovery: consecutive compact-and-retry attempts since the last
+    /// successful provider turn. Bounds the recovery ladder (anti-spiral) and resets to 0 on any
+    /// `LLMResponse`, mirroring the per-turn `hasAttemptedReactiveCompact` reset the SDK runners
+    /// used to own. See `recover_from_provider_error`.
+    pub(super) recovery_attempts: u8,
+    /// Max-output-tokens recovery: consecutive continue-and-retry turns since the model last
+    /// finished a response WITHOUT hitting the output cap. When a turn is cut off at the cap
+    /// (provider `stop_reason` = max_tokens/length) the kernel keeps the partial, nudges the model
+    /// to resume mid-thought, and re-calls — bounded by `MAX_OUTPUT_RECOVERY` (mirrors query.ts's
+    /// MAX_OUTPUT_TOKENS_RECOVERY_LIMIT). Resets to 0 on any non-truncated response.
+    pub(super) output_recovery_attempts: u8,
+    /// Transient carrier for the provider `stop_reason` of the in-flight response, set by the
+    /// kernel ABI just before `feed(LLMResponse)` and taken (cleared) inside it. `None` when the
+    /// SDK/provider doesn't report one (every non-Anthropic provider today ⇒ no-op).
+    pub(super) pending_stop_reason: Option<String>,
     /// Number of history messages present at session start (after preload_history).
     /// drain_new_messages() returns the slice from this offset onward.
     pub(super) session_history_baseline: usize,
@@ -265,6 +280,9 @@ impl LoopStateMachine {
             group_tokens_base: 0,
             group_spawns_base: 0,
             pending_termination: None,
+            recovery_attempts: 0,
+            output_recovery_attempts: 0,
+            pending_stop_reason: None,
             session_history_baseline: 0,
             checkpoint: TurnCheckpoint::default(),
             milestone: MilestoneTracker::new(),
@@ -393,6 +411,12 @@ impl LoopStateMachine {
         }
     }
 
+    /// Stash the in-flight response's provider `stop_reason` so `feed(LLMResponse)` can detect an
+    /// output-cap truncation. Set by the kernel ABI right before feeding the result; `None` clears it.
+    pub fn set_pending_stop_reason(&mut self, stop_reason: Option<String>) {
+        self.pending_stop_reason = stop_reason;
+    }
+
     /// Pre-populate the history partition with messages from a prior session.
     ///
     /// Call **before** `start()` when resuming a conversation. Sets the baseline
@@ -464,14 +488,41 @@ impl LoopStateMachine {
             LoopEvent::Start { task } => self.start(task),
 
             LoopEvent::LLMResponse { message } => {
+                // A response arrived ⇒ the prompt fit ⇒ the overflow recovery ladder is reset.
+                self.recovery_attempts = 0;
                 let tokens = self.message_tokens(&message);
                 self.total_tokens += tokens as u64;
 
+                // Max-output-tokens recovery (mirrors query.ts): a response cut off at the output
+                // cap reports stop_reason = max_tokens (Anthropic) / length (OpenAI). A clean finish
+                // resets the ladder.
+                const MAX_OUTPUT_RECOVERY: u8 = 3;
+                const OUTPUT_TRUNCATION_NUDGE: &str = "Output token limit hit. Resume directly — no apology, no recap of what you were doing. Pick up mid-thought if that is where the cut happened. Break remaining work into smaller pieces.";
+                let truncated = matches!(
+                    self.pending_stop_reason.take().as_deref(),
+                    Some("max_tokens") | Some("length"),
+                );
+                if !truncated {
+                    self.output_recovery_attempts = 0;
+                }
+
                 if let Some(reason) = self.pending_termination.take() {
                     return self.terminate(reason, Some(message));
                 }
 
                 if message.tool_calls.is_empty() {
+                    // The model was cut off at the output cap with no tool call. Keep the partial,
+                    // nudge it to resume mid-thought, and re-call — instead of mistaking the
+                    // truncation for a finished turn. Bounded by MAX_OUTPUT_RECOVERY; once exhausted
+                    // the partial stands and the turn terminates normally below. (A truncated
+                    // *tool-call* turn isn't handled here — it falls through to tool execution.)
+                    if truncated && self.output_recovery_attempts < MAX_OUTPUT_RECOVERY {
+                        self.output_recovery_attempts += 1;
+                        self.ctx.push_history(message, tokens);
+                        self.ctx.push_signal(OUTPUT_TRUNCATION_NUDGE.to_string());
+                        self.phase = LoopPhase::Reason;
+                        return self.emit_call_llm();
+                    }
                     // When a milestone contract is active and not yet complete,
                     // request evaluation instead of terminating.
                     if !self.milestone.is_complete() {
@@ -795,6 +846,9 @@ impl LoopStateMachine {
             group_tokens_base: 0,
             group_spawns_base: 0,
             pending_termination: None,
+            recovery_attempts: 0,
+            output_recovery_attempts: 0,
+            pending_stop_reason: None,
             session_history_baseline: 0,
             checkpoint: TurnCheckpoint::default(),
             milestone: crate::scheduler::milestone::MilestoneTracker::new(),

{deepstrike-0.2.34 → deepstrike-0.2.35}/crates/deepstrike-core/src/scheduler/state_machine/tests.rs

@@ -537,6 +537,145 @@
         assert!(obs.iter().any(|o| matches!(o, KernelObservation::PageOut { .. })));
     }
 
+    // ---- Reactive recovery ladder (lifted from the SDK runners into the kernel) ----
+
+    fn compactible_machine() -> LoopStateMachine {
+        let mut sm = LoopStateMachine::new(LoopPolicy {
+            max_tokens: 100,
+            max_turns: 100,
+            ..LoopPolicy::default()
+        });
+        sm.start(RuntimeTask::new("test"));
+        for i in 0..10 {
+            sm.ctx.push_history(Message::user(format!("filler {i}")), 50);
+        }
+        sm
+    }
+
+    #[test]
+    fn recover_overflow_compacts_and_retries() {
+        let mut sm = compactible_machine();
+        let action = sm.recover_from_provider_error("HTTP 413: prompt is too long");
+        // Recovered headroom ⇒ retry the provider with a freshly compacted context.
+        assert!(matches!(action, LoopAction::CallLLM { .. }));
+        assert_eq!(sm.recovery_attempts, 1);
+        // The eviction rode out as observations so the SDK still archives the evicted messages.
+        let obs = sm.take_observations();
+        assert!(obs.iter().any(|o| matches!(o, KernelObservation::Compressed { .. })));
+    }
+
+    #[test]
+    fn recover_overflow_exhausted_terminates_context_overflow() {
+        // Fresh machine with nothing compactible ⇒ force_compact saves 0 ⇒ honest terminal.
+        let mut sm = sm();
+        sm.start(RuntimeTask::new("test"));
+        let action = sm.recover_from_provider_error("context_length_exceeded");
+        match action {
+            LoopAction::Done { result } => {
+                assert_eq!(result.termination, TerminationReason::ContextOverflow);
+            }
+            other => panic!("expected Done(ContextOverflow), got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn recover_non_overflow_terminates_error() {
+        let mut sm = compactible_machine();
+        let action = sm.recover_from_provider_error("500 Internal Server Error");
+        match action {
+            LoopAction::Done { result } => {
+                assert_eq!(result.termination, TerminationReason::Error);
+            }
+            other => panic!("expected Done(Error), got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn recover_attempt_cap_is_bounded() {
+        // Even a provider that 413s forever must terminate, not loop. Drive past the cap and
+        // assert a terminal appears within a bounded number of attempts.
+        let mut sm = compactible_machine();
+        let mut terminated = false;
+        for _ in 0..6 {
+            if let LoopAction::Done { result } = sm.recover_from_provider_error("413 too long") {
+                assert_eq!(result.termination, TerminationReason::ContextOverflow);
+                terminated = true;
+                break;
+            }
+        }
+        assert!(terminated, "recovery ladder must terminate under repeated overflow");
+    }
+
+    #[test]
+    fn recovery_attempts_reset_on_successful_response() {
+        let mut sm = compactible_machine();
+        let action = sm.recover_from_provider_error("413 too long");
+        assert!(matches!(action, LoopAction::CallLLM { .. }));
+        assert_eq!(sm.recovery_attempts, 1);
+        // A response that fits resets the ladder (mirrors the per-turn SDK guard reset).
+        sm.feed(LoopEvent::LLMResponse { message: Message::assistant("recovered") });
+        assert_eq!(sm.recovery_attempts, 0);
+    }
+
+    #[test]
+    fn is_prompt_too_long_classifier() {
+        use super::eviction::is_prompt_too_long;
+        assert!(is_prompt_too_long("Error 413"));
+        assert!(is_prompt_too_long("prompt is TOO LONG"));
+        assert!(is_prompt_too_long("context_length_exceeded"));
+        assert!(!is_prompt_too_long("429 rate limited"));
+        assert!(!is_prompt_too_long("connection reset"));
+    }
+
+    // ---- Max-output-tokens recovery (Phase 4) ----
+
+    #[test]
+    fn truncated_response_continues_then_resets() {
+        let mut sm = sm();
+        sm.start(RuntimeTask::new("write a long thing"));
+        // Cut off at the output cap with no tool call ⇒ keep the partial and re-call (don't finish).
+        sm.set_pending_stop_reason(Some("max_tokens".into()));
+        let action = sm.feed(LoopEvent::LLMResponse { message: Message::assistant("partial...") });
+        assert!(matches!(action, LoopAction::CallLLM { .. }));
+        assert_eq!(sm.output_recovery_attempts, 1);
+        // A clean finish (no stop_reason) terminates normally AND resets the ladder.
+        let action = sm.feed(LoopEvent::LLMResponse { message: Message::assistant("...the rest. done") });
+        match action {
+            LoopAction::Done { result } => assert_eq!(result.termination, TerminationReason::Completed),
+            other => panic!("expected Done(Completed), got {other:?}"),
+        }
+        assert_eq!(sm.output_recovery_attempts, 0);
+    }
+
+    #[test]
+    fn truncation_recovery_is_bounded() {
+        let mut sm = sm();
+        sm.start(RuntimeTask::new("write forever"));
+        // 3 attempts continue; the 4th consecutive truncation gives up and accepts the partial.
+        for _ in 0..3 {
+            sm.set_pending_stop_reason(Some("length".into()));
+            let action = sm.feed(LoopEvent::LLMResponse { message: Message::assistant("more") });
+            assert!(matches!(action, LoopAction::CallLLM { .. }));
+        }
+        sm.set_pending_stop_reason(Some("length".into()));
+        let action = sm.feed(LoopEvent::LLMResponse { message: Message::assistant("more") });
+        match action {
+            LoopAction::Done { result } => assert_eq!(result.termination, TerminationReason::Completed),
+            other => panic!("expected Done(Completed) after the cap, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn no_stop_reason_terminates_normally() {
+        // The no-op safety path: a provider that never reports stop_reason (every non-Anthropic
+        // provider today) finishes the turn as before — no spurious continue.
+        let mut sm = sm();
+        sm.start(RuntimeTask::new("answer"));
+        let action = sm.feed(LoopEvent::LLMResponse { message: Message::assistant("the answer") });
+        assert!(matches!(action, LoopAction::Done { .. }));
+        assert_eq!(sm.output_recovery_attempts, 0);
+    }
+
     // ---- Layer 5: AutoCompact → semantic page-out (SDK does the LLM summary) ----
     //
     // Contract: AutoCompact keeps a structural summary in-context (sync, zero-I/O) and pages the

{deepstrike-0.2.34 → deepstrike-0.2.35}/crates/deepstrike-core/src/types/result.rs

@@ -14,6 +14,11 @@ pub enum TerminationReason {
     Error,
     /// Milestone phase retry budget exhausted and rollback_policy = Terminate.
     MilestoneExceeded,
+    /// Reactive recovery ladder exhausted on a provider context-overflow (prompt-too-long /
+    /// 413): the kernel compacted as hard as it could and the prompt still won't fit. Distinct
+    /// from `Timeout` (which the SDK used to fabricate for this case) so embedders can tell an
+    /// unrecoverable overflow from a wall-clock deadline.
+    ContextOverflow,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]

{deepstrike-0.2.34 → deepstrike-0.2.35}/deepstrike/providers/anthropic.py

@@ -259,6 +259,9 @@ class AnthropicProvider:
                         # read + cache write) for accurate context accounting.
                         full_input = uncached_input + cache_read + cache_creation
                         by_slot = _estimate_cache_read_by_slot(cache_read, slot_bp)
+                        # stop_reason is only present on message_delta (the closing frame);
+                        # "max_tokens" drives the kernel's output-cap recovery.
+                        stop_reason = getattr(getattr(event, "delta", None), "stop_reason", None)
                         yield UsageEvent(
                             total_tokens=full_input + output_tokens,
                             input_tokens=full_input,
@@ -266,6 +269,7 @@ class AnthropicProvider:
                             cache_read_input_tokens=cache_read,
                             cache_creation_input_tokens=cache_creation,
                             cache_read_input_tokens_by_slot=by_slot,
+                            stop_reason=stop_reason,
                         )
                 elif event.type == "content_block_start":
                     idx = event.index

{deepstrike-0.2.34 → deepstrike-0.2.35}/deepstrike/providers/openai.py

@@ -304,6 +304,10 @@ class OpenAIProvider(ReasoningReplayMixin):
             stream_options={"include_usage": True},
         )
 
+        # Phase 4: OpenAI signals an output-cap truncation via finish_reason="length", which arrives
+        # on a choices frame BEFORE the trailing usage frame — capture it and attach it to the usage
+        # event. The kernel treats "length" as a truncation (== Anthropic "max_tokens").
+        finish_reason_seen: "str | None" = None
         async for chunk in stream:
             usage = getattr(chunk, "usage", None)
             if usage:
@@ -314,11 +318,14 @@ class OpenAIProvider(ReasoningReplayMixin):
                     input_tokens=getattr(usage, "prompt_tokens", 0) or 0,
                     output_tokens=getattr(usage, "completion_tokens", 0) or 0,
                     cache_read_input_tokens=openai_cached_prompt_tokens(usage),
+                    stop_reason=finish_reason_seen,
                 )
                 continue
             choice = chunk.choices[0] if chunk.choices else None
             if not choice:
                 continue
+            if choice.finish_reason:
+                finish_reason_seen = choice.finish_reason
 
             delta = getattr(choice, "delta", None)
             if not delta:

{deepstrike-0.2.34 → deepstrike-0.2.35}/deepstrike/providers/stream.py

@@ -66,6 +66,9 @@ class UsageEvent:
     # I1: pro-rata per-slot attribution of cache_read_input_tokens (Anthropic only). None when the
     # provider doesn't honor cache_control. Shape: {"system": int?, "tools": int?, "messages": int?}.
     cache_read_input_tokens_by_slot: "dict | None" = None
+    # Provider stop reason — "max_tokens" (Anthropic) / "length" (OpenAI) flag an output-cap
+    # truncation that drives the kernel's max-output-tokens recovery. None when not reported.
+    stop_reason: "str | None" = None
 
 
 @dataclass