[xiaobaifly7]

Goal And Delivered Outcome

A Driver admission failure currently loses its stage and cause. In particular, missing can mean exhausted version probes, a swallowed probe timeout/output limit, or a later spawn ENOENT (including a missing Session cwd). A standalone version probe cannot distinguish these cases.

Emit one safe diagnostic record with the admission stage, CLI kind and underlying probe kind, OS/exit code, candidate label, cwd-existence sample, combined-signal state and elapsed milliseconds. Preserve the primary probe and the last seven probe summaries, in probe order, with an omitted count when the eight-record limit is exceeded. Diagnostic exporter failures cannot interrupt admission, reservation retirement or restoration of competing user input. Pre-step rejections identify the exact branch and other messages' source kinds only.

• Outcome basis: a reproduced diagnostic gap in the current resolver/Driver.
• Intended base: main, fresh branch from d3ac3bd8d69821ae5843b7cef5fdb6dcbc7cae74.
• Related to [Bug]: DSH plugin continuation admission failures are not surfaced in GoalBar #8506, which is claimed by another contributor and concerns surfacing admission failures in GoalBar. This PR does not close or implement [Bug]: DSH plugin continuation admission failures are not surfaced in GoalBar #8506. It changes the Driver's diagnostic record only: no GoalBar projection, schema, recovery controls or frontend files.
• Related cancellation defect: fix(dsh): honor cancellation when command probes finish #8520. That independently changes cancellation handling; this PR preserves command selection, cancellation and retry behavior.

Author Declaration

• Written by: model_agent, OpenAI Codex (GPT-6).

Implemented against

• Specification: no written specification; the diagnostic requirements in this PR are the basis. Existing owners are packages/dsh-loopx-plugin/src/cli.ts and src/driver.ts at the base above.

Criterion	Disposition	Symbol / path	Test
Identify resolve-command, resolve-binding, quota, heartbeat, pre-step-recheck and maintenance-slot	implemented	evaluate, buildPlan, authorityStillAllows	Driver stage and recheck cases
Retain safe probe cause/code/candidate and distinguish spawn cwd failure	implemented	LoopXCliError, resolveLoopXCommand, runJsonCommand	CLI fallback and real missing-cwd Node spawn
Record rejection branch and competing source kinds without contents/IDs	implemented	onPreStep	both batch arrival phases and recheck case
Exclude output, paths, message text and arbitrary labels	implemented	cliErrorFields, preStepRejection	negative disclosure tests

The cwd field is sampled immediately before invoking the runner; unknown means no readable sample, not a nonexistent directory. Candidate labels are fixed and errors are rendered from bounded scalar allowlists. Source kinds accept only short kind tokens; other values become unknown. These are local diagnostic labels, not a new authority or persisted control-plane vocabulary.

Scope And Continuation

Complete within the Driver logging gap. Shared CLI helpers retain only metadata needed by the existing logger. No command output or exception message is rendered in these records, and no new logging sink, dependency or configuration is introduced. Warnings are best effort at the Driver's existing callback boundary. Windows runtime provisioning and installed-host recovery remain outside this source PR. GoalBar's owner can continue #8506 independently.

Validation

• Tested revision: def68a81a4435fda2d70cc5abbf6746ed076a6d2.
• Run state: finished.
• Input classes: synthetic.

Check kind	Result	Evidence / limitation
unit	passed	Complete tests/driver.spec.ts: 75 passed. CLI diagnostic/resolver group: 23 passed; three unchanged mutation/reaping tests excluded.
regression_parity	passed	All three review regressions fail against the previous PR head and pass after the correction: a real Cordis Logger with a throwing exporter preserves one restored user message in both pre-step arrival phases, and a nine-candidate resolver path using real Node child processes preserves the primary timeout plus final exit within eight summaries, without raw output, argv or paths.
integration	passed	Compiled-package fake-host checks: 26 passed, including existing Pause/failure behavior, all rejection branches, safe fields, log bounds, real missing-cwd Node spawn and retained host-context acceptance. No live Harness used.
static	passed	Host/client/test TypeScript configurations and source-package build pass on the revised head; diff, bilingual RFC and public-boundary checks pass. Existing installed compiler/test-runner entrypoints were used.
static	blocked	The pnpm wrapper reports ERR_PNPM_VERIFY_DEPS_BEFORE_RUN; direct installed compiler/test-runner entrypoints were used without package/lockfile changes.
integration	failed	The previous head's quick premerge did not pass: quality and package catalog phases failed, and the runtime phase was interrupted when the task-owned validation process tree was stopped. It was not repeated for this review correction; no complete premerge qualification is claimed.
real_entrypoint	not_run	No installed-host deployment, restart or live-session failure/recovery was attempted for this revised source head.

Remote CI on the previous head also failed typescript-core (2/3) and aggregate checks: two content_digest_single_owner.test.ts assertions omit the existing benchmark_cli_source_activation.ts consumer from their pinned inventories. Both files are unchanged from this PR's actual base; this correction does not repair that separate baseline failure. New-head CI and a fresh independent review remain pending.

The original runner/resolver were also exercised offline: probe-time failures collapse to missing, post-resolution timeout/abort/output-limit retain their own kinds, missing cwd produces ENOENT, and eight concurrent Node spawns succeed. Those cases characterize possible paths; they do not establish the cause of an earlier live failure. Full plugin-suite, packaged/runtime and historical-incident qualification remain open.

Frontend / Visual Evidence

• UI impact: none. No GoalBar or component/protocol changes.
• Before/after, viewports, preview and craft review: N/A.
• Source data: synthetic.

Type of Change

• Bug fix
• Test update

LoopX Area

• Host or runtime integration
• Capability or extension

Technical Direction

Make the existing DSH Driver failure diagnosable without changing its admission policy or duplicating GoalBar's failure-projection work.

Shared-authority RFC fixture impact

N/A; no shared-authority, storage or provider promotion change.

Boundary Checklist

• No private state, credentials, raw traces, local machine paths or internal links in the diff or PR.
• Scoped to Driver diagnostics; [Bug]: DSH plugin continuation admission failures are not surfaced in GoalBar #8506 remains with its existing contributor.
• No paired RFC changed.
• UI impact is none.
• Every commit includes a DCO sign-off.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

动机 / Motivation

这项改动面向排查 DSH 自动续跑没有开始的操作者。探测、绑定、配额或最后一次准入核验失败时，他们需要知道卡在哪一步。旧警告常把不同失败压成同一个 missing；本提案添加安全阶段和原因记录，但日志失败不能妨碍原有的用户消息恢复。已验证正常情况下能定位失败阶段并隐藏原始输出；当前 head 在导出器抛错时会丢掉原拒绝流程，并在九个候选时遗漏首个超时。范围是 Driver 诊断；GoalBar 的用户可见错误仍由独立 issue #8506 负责，取消竞态由 #8520 处理。

改动思路 / Approach

绑定、配额、预约和输入恢复由原 Driver/Core 拥有。阶段、路径存在样本及探测原因只是派生的观察值。 原行为不变会留下笼统 missing；把状态接进 GoalBar 又扩大到独立用户流程。保留现有错误类型，收集有界安全原因；诊断写入变为 best effort，并始终保留最早的主候选及末次原因。 当前风险不在标签的数量，在观察器被放到关键状态转换之前。 当前范围是 Driver 日志和共享命令错误的安全摘要；状态转换仍由原 Driver 负责。 诊断收集是有用的，但控制路径不应依赖日志；把记录降为无副作用的观察并为首末探测保留空间，比重写准入状态更小。

具体改动 / Changes

依据 DSH 设计：docs/plans/2026-08-20-dsh-native-skill-driver.md，固定修订 d3ac3bd。逐项：Human input priority — not_met；Same-session revalidation — implemented；Separate cancellation race — out_of_scope。

关键代码讲解

• cli.ts:68：安全字段来自枚举式代码和候选标签；新增 cwd 样本可区分缺少工作目录和可执行文件。输出裁剪需要保留原因而不披露原文。
• cli.ts:417：继续沿现有候选顺序探测，区分非零退出、格式/版本无效及传输失败，并把安全摘要放入现有 typed 错误。
• driver.ts:692：拒绝竞争输入前新增 warning；调用顺序决定导出错误能否跨过原有恢复动作。
• driver.ts:862：维护、解析、绑定、配额和 heartbeat 阶段只是当前尝试的派生信息。测试覆盖短标签、合成失败和真实缺 cwd；未变更 GoalBar schema 或组件。

对主干的风险 / Risks

[P2] 日志失败不得阻断用户消息恢复（driver.ts:693）。预步骤同时拿到原自动续跑预约和用户消息，已配置的 Cordis exporter 在 warn 时抛错。基线返回 reject 并恢复该消息；当前 head 抛出日志错误，Driver 没有把用户消息放回队列，也没执行预约退休路径。日志故障变成会话控制故障。把记录与拒绝、退休及恢复解耦；所有新日志观察器都应隔离导出错误，确保原状态转换和返回值。 复验：真实 Cordis Logger 启用 throwing exporter，给已领取预约加一条人工消息；验证 reject、原消息恰好恢复一次、下游不执行。

[P2] 有界输出仍须保留主要探测原因（cli.ts:70）。托管 launcher 可用，PATH 有四个版本化解释器；第一候选探测超时，后八次返回非零。真正第一条 timeout 在 Logger 输出消失，最后八条只剩 exit，用户仍分不清首个 launcher 超时和普通 Python 退出。上限保持八条，但预留主候选和末候选，按探测顺序保留可用条目，必要时报告省略数量。 复验：运行有真实可执行 stub 的九候选路径，断言首个 timeout 和末个 exit 均可见，至多八条，且不含 cwd、argv 或原始输出。

语义与 CI 对齐

现有测试 120 项、三组类型检查、源包构建、DCO 与 diff/RFC 配对均通过。两条反例通过真实 exporter 和真实探测进程复现，是当前 head 的运行语义或承诺缺口。合成 #8520 后取消三例恢复通过，两条反例仍在。变更质量核验保留这两项阻断；远端 CI 和全仓 premerge 未验证。

我的整体评价 / Verdict

精确 head：324c61469e818c9131d2045be65d788d834a1d36。长程推进：日志抛错时跳过原恢复，属于回归。用户体验：可能需要重发已提交的人工输入；主超时未显示也削弱故障定位。诊断收集是有用的，但控制路径不应依赖日志；把记录降为无副作用的观察并为首末探测保留空间，比重写准入状态更小。核对了 Driver pre-step、logger 与未修改的 GoalBar service；没有渲染变化。 未在已安装 DSH、Windows 或旧 SDK 上重启会话；未查询远端 CI，也未跑整仓 premerge。本地 package build 不代表安装或合并资格。

English verdict: REQUEST_CHANGES — 324c614; a real logger exporter failure bypasses user-message restoration, and the ninth candidate can hide the primary timeout.

[loopx-agent]

Reviewer: model_agent · gpt-6.1-sol · OpenAI · runtime_reported · max

动机 / Motivation

启用了 DSH 自动续跑的操作者，需要知道一次尝试停在版本探测、绑定还是最后的准入检查。主干的日志常把探测失败写成笼统的 missing。上一评审提交补了阶段和原因，却会在日志导出器抛错时丢掉待恢复的用户消息，九个候选时也会丢掉首个超时。本提交让日志异常留在诊断边界内，竞争输入按原规则恢复一次，并在八条记录内保留首个原因和最后一次失败。范围是 Driver 日志。GoalBar 的失败展示由 #8506 跟进，探测取消由 #8520 跟进。

改动思路 / Approach

现有同一 Session 的 Driver 持有预约与人工输入优先权，LoopX 绑定和配额持有真实准入权。 在既有 warn 回调隔离导出异常，在既有错误格式化器保留首尾即可。准入、消息恢复和重试沿用已有 owner。 当前 PR 的范围是 Driver 警告边界、CLI 探测摘要及相应回归。 先用同一批输入核验 Driver 是否照常拒绝竞争预约，再检查诊断是否在同一条版本探测路径保留首因和末次结果。

具体改动 / Changes

依据 docs/plans/2026-08-20-dsh-native-skill-driver.md 的固定修订 d3ac3bd。Human input priority 为 implemented。Passive before activation 为 implemented。Same-session receipt 为 implemented。Bounded probe record 为 implemented。GoalBar failure presentation 为 out_of_scope。 同一会话 Driver 设计 · #8506

关键代码讲解

• cliErrorFields 对已有 typed 失败取首项及最后七项，按候选实际顺序记录，并显示省略数。真实 launcher 的首个超时仍可见，记录不带命令原文、路径或输出。 cli.ts L68 · cli.spec.ts L20
• Driver 在原 warn 回调隔离同步导出异常。原 onPreStep 继续退休预约并恢复人工输入。早到时下游未调用，晚到时下游调用一次，两种时序都只恢复一次。 driver.ts L507 · driver.ts L673 · driver.spec.ts L470
• evaluate 只记录当前尝试的阶段和安全原因。当前 Session 继续经过原绑定与配额检查，现有同轮结算用例实际调用 LoopX CLI，并验证只结算一次。 driver.ts L866 · admission-closeout.integration.spec.ts L275

对主干的风险 / Risks

在上一提交重跑新提交的三个回归用例，三项都失败。独立测试进一步覆盖两种输入时序下的健康、缺省和抛错导出器，真实九候选探测以及八、九、十三条记录的边界。新提交共通过 179 项定向测试，独立探针 11 项通过。主干与本提交都通过真实 CLI 的同轮结算对照。三个 TypeScript 配置、两份包构建、公开边界、DCO、双语 RFC 和精确变更质量回执均通过。 上一轮评审

我的整体评价 / Verdict

精确 head 为 def68a81a4435fda2d70cc5abbf6746ed076a6d2。批准。上一轮的两项发现已在当前提交复验。日志故障时原消息能恢复，诊断保留首因和末次结果。本轮未复验安装态 DSH、Windows、完整 premerge 或远端 CI。真实 CLI 测试使用隔离的 File authority 和受控宿主。

English verdict: APPROVE — def68a8. The revised Driver preserves human input under exporter failure, and bounded logs retain the primary and final probe causes.

[mergify]

This pull request has merge conflicts with main and cannot be merged
until they are resolved. Please rebase or merge the base branch, @xiaobaifly7.

Choose the remote for the base repository, not an out-of-date fork.
For a fork clone, first inspect git remote -v; upstream must point
to https://github.com/loopx-project/loopx.git. If it is absent, add it
with git remote add upstream https://github.com/loopx-project/loopx.git.
Then run:

git fetch upstream
git rebase upstream/main
# Resolve each conflict, git add the resolved files, then git rebase --continue.
git push --force-with-lease origin HEAD

For a same-repository clone whose origin points to
https://github.com/loopx-project/loopx.git, use origin instead of
upstream for fetch/rebase. If you prefer merging the base, use
git merge <base-remote>/main and push normally.

Keep the DCO Signed-off-by trailer on every commit when you rebase.
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/syncing-a-fork