Inject the active tool call into the Execute context

Why: With parallel tool execution the host-side tool wrapper can no
longer infer which invocation it is serving from a single in-flight
slot; tools need the call identity (ID/name/arguments) to pair process
state and per-call bookkeeping. Context injection keeps the tools
registry signature unchanged.

Evidence: go test ./... green; TestLoopToolSeesOwnCallInContext runs
two parallel calls and asserts each reads its own ID from ctx.

Impact: Additive WithToolCall/ToolCallFromContext helpers; runOne now
wraps the ctx before Execute. Callers that never inject keep ok=false
and are unaffected.

Refs: Dev task feature/agent-e1-parallel-fixes (F5 parallel wiring).

adapters/native/backend.go

@@ -157,6 +157,12 @@ func (b *Backend) Execute(ctx context.Context, req exec.Request) (*exec.Result,
 	if b.opts.Ask != nil {
 		ctx = mcp.WithAsk(ctx, b.opts.Ask)
 	}
+	// MCP 长任务跟踪（2026-07-28 最小映射）：本 run 内 tools/call 见过的
+	// TaskID 在 run 结束时逐一 tasks/cancel，不影响共享 Manager 上其他 run。
+	// 取消用 Background：run 的 ctx 在结束时已作废，取消投递不能被它掐掉。
+	var taskTracker *mcp.TaskTracker
+	ctx, taskTracker = mcp.WithTaskTracker(ctx)
+	defer func() { taskTracker.CancelAll(context.Background()) }()
 	model := strings.TrimSpace(b.opts.Model)
 	if strings.TrimSpace(req.Model) != "" {
 		model = strings.TrimSpace(req.Model)
@@ -166,7 +172,15 @@ func (b *Backend) Execute(ctx context.Context, req exec.Request) (*exec.Result,
 	}
 
 	workDir := req.WorkDir
-	if !filepath.IsAbs(workDir) {
+	if strings.TrimSpace(workDir) == "" {
+		// 空工作区 = 请求未授权持久工作区：会话状态（.agentx/transcript 等）
+		// 落一次性临时目录，不污染进程 CWD（契约套件即发此类请求）。
+		tmp, err := os.MkdirTemp("", "agent-native-run-*")
+		if err != nil {
+			return &exec.Result{Success: false, ErrorReason: err.Error()}, nil
+		}
+		workDir = tmp
+	} else if !filepath.IsAbs(workDir) {
 		wd, _ := os.Getwd()
 		workDir = filepath.Join(wd, workDir)
 	}
@@ -372,6 +386,7 @@ func (b *Backend) run(ctx context.Context, model string, budget *runtime.Budget,
 		Budget:       budget,
 		Reminders:    b.opts.Reminders,
 		RepeatGuard:  b.opts.RepeatGuard,
+		ResultsDir:   filepath.Join(workDir, ".agentx", "results"),
 		Hooks:        gateBus(b.opts.GateOptions),
 		PermissionAsk: b.opts.PermissionAsk,
 		Trace:        b.opts.Trace,
@@ -388,12 +403,16 @@ func (b *Backend) run(ctx context.Context, model string, budget *runtime.Budget,
 			logs.WriteByte('\n')
 			if onProcess != nil {
 				onProcess(exec.ProcessEvent{
-					Type:             ev.Type,
-					Text:             ev.Text,
-					Tool:             ev.Tool,
-					Detail:           ev.Detail,
-					PromptTokens:     ev.PromptTokens,
-					CompletionTokens: ev.CompletionTokens,
+					Type:                 ev.Type,
+					Text:                 ev.Text,
+					Tool:                 ev.Tool,
+					Detail:               ev.Detail,
+					PromptTokens:         ev.PromptTokens,
+					CompletionTokens:     ev.CompletionTokens,
+					LastPromptTokens:     ev.LastPromptTokens,
+					LastCompletionTokens: ev.LastCompletionTokens,
+					CacheReadTokens:      ev.CacheReadTokens,
+					CacheWriteTokens:     ev.CacheWriteTokens,
 				})
 			}
 		},

adapters/native/contract_test.go

@@ -2,6 +2,8 @@ package native
 
 import (
 	"context"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -65,3 +67,47 @@ func TestContractDescriptor(t *testing.T) {
 		t.Fatalf("capabilities = %v", d.Capabilities)
 	}
 }
+
+// TestContractEmptyWorkspaceKeepsCWDClean 空 Workspace 的请求不得把会话状态
+// 写进进程 CWD（CI 护栏：make test 后工作区必须保持干净；包目录的已提交
+// .agentx 夹具内容必须逐字节不变）。
+func TestContractEmptyWorkspaceKeepsCWDClean(t *testing.T) {
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	snapshot := map[string][]byte{}
+	for _, rel := range []string{
+		filepath.Join(".agentx", "transcript.jsonl"),
+		filepath.Join(".agentx", "transcript.jsonl.meta.json"),
+	} {
+		if b, readErr := os.ReadFile(filepath.Join(wd, rel)); readErr == nil {
+			snapshot[rel] = b
+		}
+	}
+	b := New(Options{
+		ModelOptions: ModelOptions{
+			Model:  "fake",
+			Stream: script(llm.Message{Role: llm.RoleAssistant, Content: "hi", StopReason: llm.StopEnd}),
+		},
+	}).Contract()
+	res, err := b.Execute(context.Background(), exec.ContractRequest{ExecutionID: "e-clean", Prompt: "hi"})
+	if err != nil {
+		t.Fatalf("transport error: %v", err)
+	}
+	if res.Outcome != exec.OutcomeSucceeded {
+		t.Fatalf("outcome = %q err = %+v", res.Outcome, res.Err)
+	}
+	for rel, want := range snapshot {
+		got, readErr := os.ReadFile(filepath.Join(wd, rel))
+		if readErr != nil {
+			t.Fatalf("夹具被删除：%s", rel)
+		}
+		if string(got) != string(want) {
+			t.Fatalf("空 Workspace 的执行改写了包内夹具 %s（应落临时目录）", rel)
+		}
+	}
+	if _, statErr := os.Stat(filepath.Join(wd, ".agentx", "activated-tools.json")); !os.IsNotExist(statErr) {
+		t.Fatal("空 Workspace 的执行在包目录写下了 activated-tools.json（应落临时目录）")
+	}
+}

adapters/native/exec_tools_test.go

@@ -260,7 +260,7 @@ func TestBackendSkillsIndexAndLoader(t *testing.T) {
 	if err := os.MkdirAll(skillDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte("---\ndescription: 生成文档交付物\n---\n\n配方正文"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte("---\nname: docx-author\ndescription: 生成文档交付物\n---\n\n配方正文"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	stream, c := captureStream(
@@ -347,7 +347,7 @@ func TestBackendWorkspaceSkillsRootAutoMerged(t *testing.T) {
 	if err := os.MkdirAll(wsSkill, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(wsSkill, "SKILL.md"), []byte("---\ndescription: 工作区技能\n---\n正文"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(wsSkill, "SKILL.md"), []byte("---\nname: ws-skill\ndescription: 工作区技能\n---\n正文"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	res, err := b.Execute(context.Background(), exec.Request{

exec/backend.go

@@ -57,6 +57,11 @@ type ProcessEvent struct {
 	// PromptTokens / CompletionTokens 在 Type=usage 时填写。
 	PromptTokens     int
 	CompletionTokens int
+	// 以下在 Type=usage 或 message_end 时填写（N3 WP6：上一请求与缓存命中拆分）。
+	LastPromptTokens     int
+	LastCompletionTokens int
+	CacheReadTokens      int
+	CacheWriteTokens     int
 }
 
 const (

runtime/checkpoint/checkpoint.go

@@ -5,6 +5,7 @@ package checkpoint
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"sync"
@@ -21,16 +22,20 @@ type Record struct {
 	After   []byte `json:"after,omitempty"`
 }
 
-// Result 是一次回滚的分类。Skipped 是当前内容既不是写入后也不是写入前的文件。
+// Result 是一次回滚的分类。Skipped 是当前内容既不是写入后也不是写入前的文件
+// （含目标是符号链接的情况——恢复会跟出根外，按外部改动处理）。
+// Failed 是恢复动作本身失败的文件（Rewind 不因单文件失败中止，继续其余）。
 type Result struct {
 	Restored []string
 	Skipped  []string
+	Failed   []string
 }
 
 // Log 是追加写的检查点文件。
 type Log struct {
-	path string
-	mu   sync.Mutex
+	path    string
+	mu      sync.Mutex
+	lastSeq int // Open 时一次读出的最大 Seq；Record 递增（不再全读）
 }
 
 func Open(path string) (*Log, error) {
@@ -42,7 +47,12 @@ func Open(path string) (*Log, error) {
 		return nil, err
 	}
 	_ = f.Close()
-	return &Log{path: path}, nil
+	l := &Log{path: path}
+	// 初始化序号（一次读，之后递增）。
+	if all, err := l.read(); err == nil && len(all) > 0 {
+		l.lastSeq = all[len(all)-1].Seq
+	}
+	return l, nil
 }
 
 func (l *Log) Path() string { return l.path }
@@ -54,12 +64,9 @@ func (l *Log) Record(anchor, root, rel string, before []byte, existed bool, afte
 	}
 	l.mu.Lock()
 	defer l.mu.Unlock()
-	all, err := l.read()
-	if err != nil {
-		return err
-	}
+	l.lastSeq++
 	rec := Record{
-		Seq: len(all) + 1, Anchor: anchor, Root: root, Path: filepath.ToSlash(rel),
+		Seq: l.lastSeq, Anchor: anchor, Root: root, Path: filepath.ToSlash(rel),
 		Existed: existed, Before: append([]byte(nil), before...), After: append([]byte(nil), after...),
 	}
 	raw, err := json.Marshal(rec)
@@ -75,6 +82,56 @@ func (l *Log) Record(anchor, root, rel string, before []byte, existed bool, afte
 	return err
 }
 
+// Compact 只保留最近 keepAnchors 个 anchor 的记录（按 Seq 序判定新旧，
+// 保留原 Seq 不重排，序号单调性不破）。keepAnchors ≤ 0 不动。
+// 重写是原子的（临时文件 + rename）。
+func (l *Log) Compact(keepAnchors int) error {
+	if l == nil || keepAnchors <= 0 {
+		return nil
+	}
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	all, err := l.read()
+	if err != nil {
+		return err
+	}
+	var anchors []string
+	seen := map[string]bool{}
+	for _, rec := range all {
+		if !seen[rec.Anchor] {
+			seen[rec.Anchor] = true
+			anchors = append(anchors, rec.Anchor)
+		}
+	}
+	if len(anchors) <= keepAnchors {
+		return nil
+	}
+	keep := map[string]bool{}
+	for _, a := range anchors[len(anchors)-keepAnchors:] {
+		keep[a] = true
+	}
+	tmp := l.path + ".compact.tmp"
+	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return err
+	}
+	enc := json.NewEncoder(f)
+	for _, rec := range all {
+		if keep[rec.Anchor] {
+			if err := enc.Encode(rec); err != nil {
+				_ = f.Close()
+				_ = os.Remove(tmp)
+				return err
+			}
+		}
+	}
+	if err := f.Close(); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	return os.Rename(tmp, l.path)
+}
+
 // Plan 列出从 anchor 起（含）会被回滚的文件，不改磁盘。
 // ordered 是用户消息 id 的时间顺序。
 func (l *Log) Plan(anchor string, ordered []string) (Result, error) {
@@ -103,12 +160,22 @@ func (l *Log) Rewind(anchor string, ordered []string) (Result, error) {
 		return Result{}, err
 	}
 	plan := classify(all, anchor, ordered)
+	// 单文件失败不中止：符号链接目标归入 Skipped（外部改动语义），
+	// 其余恢复错误记入 Failed 并继续（部分恢复对调用方可读）。
+	restored := plan.Restored[:0]
 	for _, rel := range plan.Restored {
 		group := groupFor(selected(all, anchor, ordered), rel)
 		if err := restore(group); err != nil {
-			return Result{}, err
+			if errors.Is(err, errSymlinkTarget) {
+				plan.Skipped = append(plan.Skipped, rel)
+				continue
+			}
+			plan.Failed = append(plan.Failed, rel)
+			continue
 		}
+		restored = append(restored, rel)
 	}
+	plan.Restored = restored
 	return plan, nil
 }
 
@@ -226,12 +293,29 @@ func fileState(group []Record) int {
 	return stateSkip
 }
 
+var errSymlinkTarget = errors.New("checkpoint: restore target is a symlink")
+
+// restoreForTesting 是测试缝：非空时在每次恢复前调用（返回错误即恢复失败）。
+// 生产代码永不应设置它；恢复期的故障注入无法绕开分类层的预检
+// （权限类失败对 root 不可重现，故用显式缝）。
+var restoreForTesting func(abs string) error
+
 func restore(group []Record) error {
 	if len(group) == 0 {
 		return nil
 	}
 	first := group[0]
 	abs := filepath.Join(first.Root, filepath.FromSlash(first.Path))
+	if restoreForTesting != nil {
+		if err := restoreForTesting(abs); err != nil {
+			return err
+		}
+	}
+	// 符号链接防护：恢复会跟出根外（与 fs_write_file 的防护同语义）。
+	// 按外部改动处理——由调用方归入 Skipped，不写不删。
+	if info, err := os.Lstat(abs); err == nil && info.Mode()&os.ModeSymlink != 0 {
+		return errSymlinkTarget
+	}
 	if !first.Existed {
 		return os.Remove(abs)
 	}

runtime/checkpoint/n3_test.go

@@ -0,0 +1,237 @@
+package checkpoint
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ---- N3 WP3：检查点收口 ----
+
+// 符号链接目标：恢复会跟出根外——归入 Skipped，链接与目标都不动。
+func TestRewindSkipsSymlinkTarget(t *testing.T) {
+	root := t.TempDir()
+	log, err := Open(filepath.Join(root, "cp.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	real := filepath.Join(root, "real.txt")
+	if err := os.WriteFile(real, []byte("被跟踪写入后"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := log.Record("m1", root, "real.txt", []byte("写入前"), true, []byte("被跟踪写入后")); err != nil {
+		t.Fatal(err)
+	}
+	outside := filepath.Join(t.TempDir(), "outside.txt")
+	if err := os.WriteFile(outside, []byte("根外内容"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Remove(real); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, real); err != nil {
+		t.Fatal(err)
+	}
+	res, err := log.Rewind("m1", []string{"m1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(res.Skipped) != 1 || res.Skipped[0] != "real.txt" {
+		t.Fatalf("符号链接必须进 Skipped：%+v", res)
+	}
+	if len(res.Restored) != 0 || len(res.Failed) != 0 {
+		t.Fatalf("符号链接不得恢复也不得算失败：%+v", res)
+	}
+	body, _ := os.ReadFile(outside)
+	if string(body) != "根外内容" {
+		t.Fatalf("根外目标被写：%q", body)
+	}
+	if info, _ := os.Lstat(real); info == nil || info.Mode()&os.ModeSymlink == 0 {
+		t.Fatal("符号链接本身不得被改动")
+	}
+}
+
+// 部分恢复：一个文件恢复动作失败（所在目录只读，Remove 失败），
+// 另一个照常恢复，失败进 Result.Failed，不中止。
+func TestRewindPartialFailureContinues(t *testing.T) {
+	root := t.TempDir()
+	log, err := Open(filepath.Join(root, "cp.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	dirA, dirB := filepath.Join(root, "a"), filepath.Join(root, "b")
+	for _, d := range []string{dirA, dirB} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// 两个都是「被跟踪创建」的文件（existed=false，当前内容==写入后 → stateRestore）。
+	if err := os.WriteFile(filepath.Join(dirA, "keep.txt"), []byte("A后"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dirB, "fail.txt"), []byte("B后"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := log.Record("m1", root, "a/keep.txt", nil, false, []byte("A后")); err != nil {
+		t.Fatal(err)
+	}
+	if err := log.Record("m1", root, "b/fail.txt", nil, false, []byte("B后")); err != nil {
+		t.Fatal(err)
+	}
+	// 测试缝注入恢复失败（权限法对 root 不可重现——CI 以 root 跑）。
+	restoreForTesting = func(abs string) error {
+		if strings.HasSuffix(abs, "b/fail.txt") {
+			return errors.New("注入的恢复失败")
+		}
+		return nil
+	}
+	defer func() { restoreForTesting = nil }()
+	res, err := log.Rewind("m1", []string{"m1"})
+	if err != nil {
+		t.Fatalf("单文件失败不得中止：%v", err)
+	}
+	if len(res.Failed) != 1 || res.Failed[0] != "b/fail.txt" {
+		t.Fatalf("失败文件应进 Failed：%+v", res)
+	}
+	if len(res.Restored) != 1 || res.Restored[0] != "a/keep.txt" {
+		t.Fatalf("其余文件照常恢复：%+v", res)
+	}
+	if _, err := os.Stat(filepath.Join(dirA, "keep.txt")); !os.IsNotExist(err) {
+		t.Fatal("keep.txt 应被删除")
+	}
+	if _, err := os.Stat(filepath.Join(dirB, "fail.txt")); err != nil {
+		t.Fatal("fail.txt 应保留")
+	}
+}
+
+// Compact：只留最近 N 个 anchor 的记录，原 Seq 保留，后续 Record 序号单调。
+func TestCompactKeepsRecentAnchors(t *testing.T) {
+	root := t.TempDir()
+	log, err := Open(filepath.Join(root, "cp.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct{ anchor, rel string }{
+		{"m1", "a"}, {"m2", "b"}, {"m2", "c"}, {"m3", "d"},
+	} {
+		if err := log.Record(tc.anchor, root, tc.rel, []byte("x"), true, []byte("y")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := log.Compact(2); err != nil {
+		t.Fatal(err)
+	}
+	all, err := log.read()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != 3 {
+		t.Fatalf("Compact(2) 应留 3 条（m2×2 + m3），得到 %d", len(all))
+	}
+	for _, rec := range all {
+		if rec.Anchor == "m1" {
+			t.Fatalf("m1 应被裁掉：%+v", all)
+		}
+	}
+	// Seq 保留原值且后续递增单调。
+	maxSeq := 0
+	for _, rec := range all {
+		if rec.Seq > maxSeq {
+			maxSeq = rec.Seq
+		}
+	}
+	if err := log.Record("m4", root, "e", []byte("x"), true, []byte("y")); err != nil {
+		t.Fatal(err)
+	}
+	all, _ = log.read()
+	if all[len(all)-1].Seq <= maxSeq {
+		t.Fatalf("Compact 后序号必须单调：%d → %d", maxSeq, all[len(all)-1].Seq)
+	}
+}
+
+// 空 ordered 边界：只回滚 anchor 自己的记录（既有语义钉住）。
+func TestRewindEmptyOrderedKeepsAnchorOnly(t *testing.T) {
+	root := t.TempDir()
+	log, err := Open(filepath.Join(root, "cp.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "a.txt"), []byte("A后"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "b.txt"), []byte("B后"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := log.Record("m1", root, "a.txt", []byte("A前"), true, []byte("A后")); err != nil {
+		t.Fatal(err)
+	}
+	if err := log.Record("m2", root, "b.txt", []byte("B前"), true, []byte("B后")); err != nil {
+		t.Fatal(err)
+	}
+	res, err := log.Rewind("m2", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(res.Restored) != 1 || res.Restored[0] != "b.txt" {
+		t.Fatalf("空 ordered 只回滚 anchor 自己：%+v", res)
+	}
+	if body, _ := os.ReadFile(filepath.Join(root, "a.txt")); string(body) != "A后" {
+		t.Fatalf("m1 的文件不得被动：%q", body)
+	}
+}
+
+// 「外部同字节改写」分类为 Already（内容等价即视为同步，钉住语义）。
+func TestIdenticalExternalRewriteIsAlready(t *testing.T) {
+	root := t.TempDir()
+	log, err := Open(filepath.Join(root, "cp.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "a.txt"), []byte("相同内容"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := log.Record("m1", root, "a.txt", []byte("相同内容"), true, []byte("相同内容")); err != nil {
+		t.Fatal(err)
+	}
+	// 外部用相同字节重写一遍（mtime 变、内容同）。
+	if err := os.WriteFile(filepath.Join(root, "a.txt"), []byte("相同内容"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	res, err := log.Plan("m1", []string{"m1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(res.Restored) != 0 || len(res.Skipped) != 0 {
+		t.Fatalf("同字节改写应为 Already（不进任何分类）：%+v", res)
+	}
+}
+
+// root 移动：记录按各自 Root 恢复，不窜根。
+func TestRewindUsesPerRecordRoot(t *testing.T) {
+	root1, root2 := t.TempDir(), t.TempDir()
+	log, err := Open(filepath.Join(root1, "cp.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root2, "a.txt"), []byte("root2 的内容"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := log.Record("m1", root2, "a.txt", []byte("写入前"), true, []byte("root2 的内容")); err != nil {
+		t.Fatal(err)
+	}
+	res, err := log.Rewind("m1", []string{"m1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(res.Restored) != 1 {
+		t.Fatalf("应按记录内 Root 恢复：%+v", res)
+	}
+	if body, _ := os.ReadFile(filepath.Join(root2, "a.txt")); string(body) != "写入前" {
+		t.Fatalf("root2 未恢复：%q", body)
+	}
+	if _, err := os.Stat(filepath.Join(root1, "a.txt")); !os.IsNotExist(err) {
+		t.Fatal("不得在 root1 造出同名文件")
+	}
+}

runtime/durable_test.go

@@ -121,7 +121,7 @@ func TestStoredSafeCurrentNeverDoesNotRerun(t *testing.T) {
 	tool := &replayTool{countingTool: countingTool{name: "read_file"}, replay: tools.ReplayNever}
 	reg := tools.NewRegistry(dir)
 	reg.Register(tool)
-	if err := recoverPending(context.Background(), Config{Session: st, Tools: reg}); err != nil {
+	if _, err := recoverPending(context.Background(), Config{Session: st, Tools: reg}); err != nil {
 		t.Fatal(err)
 	}
 	if tool.calls != 0 {
@@ -208,3 +208,235 @@ func TestSpansUseAgreedNamesWithoutPrompt(t *testing.T) {
 		t.Fatal("prompt leaked into span attrs")
 	}
 }
+
+// ---- N3 WP1：崩溃窗口尾部配对兜底（验收① 库层机器核心）----
+
+// 窗口内死亡（persist(assistant) 之后、任何 intent 之前）：转录只有带
+// tool_calls 的 assistant。恢复后每个调用都有「进程中断」配对，且 run 继续。
+func TestResumePairsOrphanTailAfterCrashWindow(t *testing.T) {
+	dir := t.TempDir()
+	st, err := session.Open(filepath.Join(dir, "s.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.Append(llm.Message{Role: llm.RoleSystem, Content: "sys"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.Append(llm.Message{Role: llm.RoleUser, Content: "干个活"}); err != nil {
+		t.Fatal(err)
+	}
+	// 崩溃窗口形态：assistant 落盘、零意图、零结果。
+	if err := st.Append(llm.Message{
+		Role: llm.RoleAssistant, StopReason: llm.StopToolCalls,
+		ToolCalls: []llm.ToolCall{
+			{ID: "c1", Name: "write_file", Arguments: `{}`},
+			{ID: "c2", Name: "read_file", Arguments: `{}`},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	reg := tools.NewRegistry(dir)
+	tool := &countingTool{name: "write_file"}
+	reg.Register(tool)
+	reg.Register(&countingTool{name: "read_file"})
+	_, err = Run(context.Background(), Config{
+		Model: "fake", Session: st, Tools: reg, MaxTurns: 2,
+		Stream: script(llm.Message{Role: llm.RoleAssistant, Content: "继续", StopReason: llm.StopEnd}),
+	}, llm.Message{Role: llm.RoleUser, Content: "还在吗"})
+	if err != nil {
+		t.Fatalf("恢复后的 Run 不得失败（配对修复应让提供方接受历史）：%v", err)
+	}
+	msgs, err := st.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// 双向配对断言：每个调用有结果、每个结果有调用。
+	calls, results := map[string]string{}, map[string]bool{}
+	for _, m := range msgs {
+		for _, c := range m.ToolCalls {
+			calls[c.ID] = c.Name
+		}
+		if m.Role == llm.RoleTool && m.ToolCallID != "" {
+			results[m.ToolCallID] = true
+			if m.Content != crashInterrupted && m.Content != unknownSideEffect {
+				t.Fatalf("兜底文案不对：%q", m.Content)
+			}
+			if !m.IsError {
+				t.Fatal("兜底结果必须 IsError")
+			}
+		}
+	}
+	for id := range calls {
+		if !results[id] {
+			t.Fatalf("孤立 tool_call：%s", id)
+		}
+	}
+	if tool.calls != 0 {
+		t.Fatalf("兜底不得重放写工具：%d", tool.calls)
+	}
+}
+
+// 执行中死亡（c1 意图+结果、c2 意图无结果）+ 窗口死亡（c3 无意图）混合：
+// 意图路径配 c2、尾部兜底配 c3，互不重复。
+func TestResumeMixedIntentAndOrphanTail(t *testing.T) {
+	dir := t.TempDir()
+	st, err := session.Open(filepath.Join(dir, "s.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.Append(llm.Message{
+		Role: llm.RoleAssistant, StopReason: llm.StopToolCalls,
+		ToolCalls: []llm.ToolCall{
+			{ID: "c1", Name: "read_file", Arguments: `{}`},
+			{ID: "c2", Name: "read_file", Arguments: `{}`},
+			{ID: "c3", Name: "write_file", Arguments: `{}`},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.AppendToolIntent(session.ToolIntent{CallID: "c1", Name: "read_file", Arguments: `{}`, Replay: tools.ReplaySafe}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.Append(llm.Message{Role: llm.RoleTool, ToolCallID: "c1", Name: "read_file", Content: "真实结果"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.AppendToolIntent(session.ToolIntent{CallID: "c2", Name: "read_file", Arguments: `{}`, Replay: tools.ReplayNever}); err != nil {
+		t.Fatal(err)
+	}
+	reg := tools.NewRegistry(dir)
+	reg.Register(&countingTool{name: "read_file"})
+	reg.Register(&countingTool{name: "write_file"})
+	_, err = Run(context.Background(), Config{
+		Model: "fake", Session: st, Tools: reg, MaxTurns: 1,
+		Stream: script(llm.Message{Role: llm.RoleAssistant, Content: "x", StopReason: llm.StopEnd}),
+	}, llm.Message{Role: llm.RoleUser, Content: "next"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	msgs, err := st.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	byID := map[string][]string{}
+	for _, m := range msgs {
+		if m.Role == llm.RoleTool && m.ToolCallID != "" {
+			byID[m.ToolCallID] = append(byID[m.ToolCallID], m.Content)
+		}
+	}
+	if got := byID["c1"]; len(got) != 1 || got[0] != "真实结果" {
+		t.Fatalf("c1 必须保持原结果且不重复：%v", got)
+	}
+	if got := byID["c2"]; len(got) != 1 || got[0] != unknownSideEffect {
+		t.Fatalf("c2 走意图路径：%v", got)
+	}
+	if got := byID["c3"]; len(got) != 1 || got[0] != crashInterrupted {
+		t.Fatalf("c3 走尾部兜底：%v", got)
+	}
+}
+
+// 健康转录（尾部是完整配对或 user 消息）不做任何改写。
+func TestRepairOrphanTailNoopOnHealthyTranscript(t *testing.T) {
+	dir := t.TempDir()
+	st, err := session.Open(filepath.Join(dir, "s.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range []llm.Message{
+		{Role: llm.RoleSystem, Content: "sys"},
+		{Role: llm.RoleUser, Content: "u"},
+		{Role: llm.RoleAssistant, StopReason: llm.StopToolCalls, ToolCalls: []llm.ToolCall{{ID: "c1", Name: "read_file", Arguments: `{}`}}},
+		{Role: llm.RoleTool, ToolCallID: "c1", Name: "read_file", Content: "r"},
+		{Role: llm.RoleAssistant, Content: "done", StopReason: llm.StopEnd},
+		{Role: llm.RoleUser, Content: "u2"},
+	} {
+		if err := st.Append(m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	before, _ := st.Load()
+	if _, err := repairOrphanTail(Config{Session: st}); err != nil {
+		t.Fatal(err)
+	}
+	after, _ := st.Load()
+	if len(after) != len(before) {
+		t.Fatalf("健康转录被改写：%d → %d", len(before), len(after))
+	}
+}
+
+// ---- N3 WP2：JournalOnly（journal 只作日志，上下文由 History 组装）----
+
+// JournalOnly：journal 有杀窗口尾巴 → 恢复配对写入 journal；上下文来自
+// History（不含 journal 内容），恢复摘要以系统消息注入；种子不进 journal。
+func TestJournalOnlyRecoversWithoutTranscriptAuthority(t *testing.T) {
+	dir := t.TempDir()
+	st, err := session.Open(filepath.Join(dir, "s.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := st.Append(llm.Message{
+		Role: llm.RoleAssistant, StopReason: llm.StopToolCalls,
+		ToolCalls: []llm.ToolCall{{ID: "c1", Name: "read_file", Arguments: `{}`}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.AppendToolIntent(session.ToolIntent{CallID: "c1", Name: "read_file", Arguments: `{}`, Replay: tools.ReplaySafe}); err != nil {
+		t.Fatal(err)
+	}
+	reg := tools.NewRegistry(dir)
+	reg.Register(&replayTool{countingTool: countingTool{name: "read_file"}, replay: tools.ReplaySafe})
+	var gotReq []llm.Message
+	res, err := Run(context.Background(), Config{
+		Model: "fake", Session: st, JournalOnly: true, Tools: reg, MaxTurns: 2,
+		History: []llm.Message{
+			{Role: llm.RoleSystem, Content: "sys"},
+			{Role: llm.RoleUser, Content: "历史一"},
+			{Role: llm.RoleAssistant, Content: "回复一"},
+		},
+		Stream: func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+			gotReq = append([]llm.Message{}, msgs...)
+			ch := make(chan llm.Event, 1)
+			ch <- llm.Event{Kind: llm.KindMessageEnd, Message: llm.Message{Role: llm.RoleAssistant, Content: "继续", StopReason: llm.StopEnd}}
+			close(ch)
+			return ch
+		},
+	}, llm.Message{Role: llm.RoleUser, Content: "最新"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// journal 里 c1 被 safe 重放配对（一次真实结果）。
+	journal, _ := st.Load()
+	var journaled bool
+	for _, m := range journal {
+		if m.Role == llm.RoleTool && m.ToolCallID == "c1" && m.Content == "ok" {
+			journaled = true
+		}
+		if m.Content == "历史一" {
+			t.Fatal("种子历史不得进 journal")
+		}
+	}
+	if !journaled {
+		t.Fatalf("journal 缺恢复配对：%#v", journal)
+	}
+	// 上下文：History 内容在；恢复摘要在；且在新 user 消息之前。
+	var sawHist, sawNote int
+	noteIdx, userIdx := -1, -1
+	for i, m := range gotReq {
+		if m.Content == "历史一" {
+			sawHist++
+		}
+		if m.Role == llm.RoleSystem && strings.Contains(m.Content, "已完成恢复") && strings.Contains(m.Content, "c1") {
+			sawNote++
+			noteIdx = i
+		}
+		if m.Content == "最新" {
+			userIdx = i
+		}
+	}
+	if sawHist != 1 || sawNote != 1 {
+		t.Fatalf("历史=%d 摘要=%d：%#v", sawHist, sawNote, gotReq)
+	}
+	if noteIdx < 0 || userIdx < 0 || noteIdx > userIdx {
+		t.Fatalf("摘要必须在新 user 消息之前：note=%d user=%d", noteIdx, userIdx)
+	}
+	_ = res
+}

runtime/llm/anthropic.go

@@ -0,0 +1,404 @@
+package llm
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// anthropic.go — 原生 Anthropic Messages API 客户端（N2 WP2）。
+// 与 OpenAI 路径共用 Message/Event 表面；组包与 BuildBody 的 Anthropic
+// 分支是同一个函数（消灭「离线/线上两张皮」，审计 N4 的根因）。
+
+// AnthropicVersion 是请求头 anthropic-version 的钉住值。
+const AnthropicVersion = "2023-06-01"
+
+// anthropicBody 组 Anthropic Messages 请求体（线上 Client 与离线 BuildBody
+// 共用）。tools 挂 input_schema；system 与最后一个 tool 挂 cache_control
+// （静态前缀的缓存断点）；assistant 的思考块在内容块最前且带签名往返。
+func anthropicBody(model string, messages []Message, tools []ToolDecl, opts StreamOptions) ([]byte, error) {
+	sys, msgs := anthropicMessages(messages)
+	body := map[string]any{
+		"model":    model,
+		"messages": msgs,
+		"stream":   true,
+		// Anthropic 要求 max_tokens。0 表示调用方不限制：用足够大的默认值，
+		// 避免 4096 把长回复截断。真正的上限由调用方 StreamOptions.MaxTokens 决定。
+		"max_tokens": opts.MaxTokens,
+	}
+	if body["max_tokens"] == 0 {
+		body["max_tokens"] = 128000
+	}
+	if sys != "" {
+		body["system"] = []map[string]any{{
+			"type":          "text",
+			"text":          sys,
+			"cache_control": map[string]any{"type": "ephemeral"},
+		}}
+	}
+	if budget := AnthropicThinkingBudget(opts.ThinkingLevel); budget > 0 {
+		body["thinking"] = map[string]any{"type": "enabled", "budget_tokens": budget}
+	}
+	if len(tools) > 0 {
+		body["tools"] = anthropicTools(tools)
+	}
+	return json.Marshal(body)
+}
+
+// anthropicTools 声明工具（name/description/input_schema）；最后一个挂
+// cache_control 作为静态工具前缀的断点。
+func anthropicTools(decls []ToolDecl) []map[string]any {
+	out := make([]map[string]any, 0, len(decls))
+	for i, t := range decls {
+		params := t.Parameters
+		if len(params) == 0 {
+			params = json.RawMessage(`{"type":"object","properties":{}}`)
+		}
+		item := map[string]any{
+			"name":         t.Name,
+			"description":  t.Description,
+			"input_schema": json.RawMessage(params),
+		}
+		if i == len(decls)-1 {
+			item["cache_control"] = map[string]any{"type": "ephemeral"}
+		}
+		out = append(out, item)
+	}
+	return out
+}
+
+// anthropicMessages 把通用转录映射成 Anthropic 消息：
+// system 收成字符串（由调用方决定挂法）；assistant 的思考块在最前，
+// 其后 text/image 与 tool_use；连续 RoleTool 折叠成一条 user 消息内的
+// tool_result 块组（Anthropic 不允许 tool 角色）。
+func anthropicMessages(messages []Message) (string, []map[string]any) {
+	var system strings.Builder
+	var out []map[string]any
+	for i := 0; i < len(messages); i++ {
+		m := messages[i]
+		switch m.Role {
+		case RoleSystem:
+			if system.Len() > 0 {
+				system.WriteString("\n")
+			}
+			system.WriteString(m.Content)
+		case RoleAssistant:
+			var content []map[string]any
+			for _, th := range m.Thinking {
+				if th.Redacted {
+					content = append(content, map[string]any{"type": "redacted_thinking", "data": th.Data})
+					continue
+				}
+				content = append(content, map[string]any{
+					"type": "thinking", "thinking": th.Thinking, "signature": th.Signature,
+				})
+			}
+			if m.Content != "" {
+				content = append(content, map[string]any{"type": "text", "text": m.Content})
+			}
+			for _, img := range m.Images {
+				content = append(content, map[string]any{
+					"type": "image",
+					"source": map[string]any{
+						"type":       "base64",
+						"media_type": firstNonEmpty(img.MIME, "image/png"),
+						"data":       img.Data,
+					},
+				})
+			}
+			for _, tc := range m.ToolCalls {
+				args := json.RawMessage(tc.Arguments)
+				if !json.Valid(args) {
+					args = json.RawMessage(`{}`)
+				}
+				content = append(content, map[string]any{
+					"type": "tool_use", "id": tc.ID, "name": tc.Name, "input": args,
+				})
+			}
+			if len(content) == 0 {
+				content = append(content, map[string]any{"type": "text", "text": ""})
+			}
+			out = append(out, map[string]any{"role": "assistant", "content": content})
+		case RoleTool:
+			// 连续 tool 结果折叠进同一条 user 消息。
+			var results []map[string]any
+			for ; i < len(messages) && messages[i].Role == RoleTool; i++ {
+				t := messages[i]
+				results = append(results, map[string]any{
+					"type":        "tool_result",
+					"tool_use_id": t.ToolCallID,
+					"content":     t.Content,
+					"is_error":    t.IsError,
+				})
+			}
+			i--
+			out = append(out, map[string]any{"role": "user", "content": results})
+		default:
+			content := []map[string]any{}
+			if m.Content != "" {
+				content = append(content, map[string]any{"type": "text", "text": m.Content})
+			}
+			for _, img := range m.Images {
+				content = append(content, map[string]any{
+					"type": "image",
+					"source": map[string]any{
+						"type":       "base64",
+						"media_type": firstNonEmpty(img.MIME, "image/png"),
+						"data":       img.Data,
+					},
+				})
+			}
+			out = append(out, map[string]any{"role": "user", "content": content})
+		}
+	}
+	return system.String(), out
+}
+
+// streamAnthropic 发 POST {base}/messages 并把 Anthropic SSE 事件族映射到
+// 通用 Event。与 OpenAI 客户端共享错误/中止语义。
+func (c *Client) streamAnthropic(ctx context.Context, model string, messages []Message, tools []ToolDecl, opts StreamOptions, out chan<- Event) {
+	base := firstNonEmpty(opts.APIBase, c.BaseURL)
+	key := firstNonEmpty(opts.APIKey, c.APIKey)
+	if base == "" || key == "" || model == "" {
+		emitError(out, "", false, "agentx llm client is missing base url, api key, or model")
+		return
+	}
+	if opts.MessageShape != "" {
+		messages = PrepareMessages(messages, opts.MessageShape)
+	}
+	raw, err := anthropicBody(model, messages, tools, opts)
+	if err != nil {
+		emitError(out, "", false, err.Error())
+		return
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, strings.TrimRight(base, "/")+"/messages", bytes.NewReader(raw))
+	if err != nil {
+		emitError(out, "", false, err.Error())
+		return
+	}
+	req.Header.Set("x-api-key", key)
+	req.Header.Set("anthropic-version", AnthropicVersion)
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "text/event-stream")
+	hc := c.HTTPClient
+	if hc == nil {
+		hc = &http.Client{Timeout: 30 * time.Minute}
+	}
+	resp, err := hc.Do(req)
+	if err != nil {
+		if ctx.Err() != nil {
+			emitAbort(out, "", ctx.Err())
+			return
+		}
+		emitError(out, "", true, err.Error())
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		slurp, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		msg := fmt.Sprintf("provider status %d: %s", resp.StatusCode, strings.TrimSpace(string(slurp)))
+		ev := Event{
+			Kind:         KindError,
+			HTTPStatus:   resp.StatusCode,
+			Retryable:    StatusRetryable(resp.StatusCode) && !ContextOverflow(msg),
+			ErrorMessage: msg,
+			Err:          &StreamError{Message: msg, Retryable: StatusRetryable(resp.StatusCode) && !ContextOverflow(msg)},
+			Message:      Message{Role: RoleAssistant, StopReason: StopError},
+		}
+		if d, ok := ParseRetryAfter(resp.Header.Get("Retry-After"), time.Now()); ok {
+			ev.HasRetryAfter = true
+			ev.RetryAfter = d
+		}
+		out <- ev
+		return
+	}
+	parseAnthropicSSE(ctx, resp.Body, out)
+}
+
+// ---- Anthropic SSE 解析 ----
+
+type anthropicBlock struct {
+	typ       string
+	toolID    string
+	toolName  string
+	args      strings.Builder
+	thinking  strings.Builder
+	signature strings.Builder
+	redacted  string
+}
+
+// parseAnthropicSSE 读 event:/data: 帧对，产出文本/思考/工具增量与一次
+// 终结 message_end（或 error）。
+func parseAnthropicSSE(ctx context.Context, r io.Reader, out chan<- Event) {
+	blocks := map[int]*anthropicBlock{}
+	var content strings.Builder
+	var thinking []ThinkingBlock
+	var calls []ToolCall
+	var usage Usage
+	stopReason := StopEnd
+	finishReason := ""
+	sc := bufio.NewScanner(r)
+	sc.Buffer(make([]byte, 0, 64*1024), 4*1024*1024)
+	eventType := ""
+	for sc.Scan() {
+		line := sc.Text()
+		select {
+		case <-ctx.Done():
+			emitAbort(out, "", ctx.Err())
+			return
+		default:
+		}
+		switch {
+		case strings.HasPrefix(line, "event:"):
+			eventType = strings.TrimSpace(strings.TrimPrefix(line, "event:"))
+		case strings.HasPrefix(line, "data:"):
+			data := strings.TrimSpace(strings.TrimPrefix(line, "data:"))
+			if data == "" {
+				continue
+			}
+			var frame map[string]json.RawMessage
+			if err := json.Unmarshal([]byte(data), &frame); err != nil {
+				continue
+			}
+			switch eventType {
+			case "message_start":
+				var v struct {
+					Message struct {
+						Usage struct {
+							InputTokens      int `json:"input_tokens"`
+							CacheReadTokens  int `json:"cache_read_input_tokens"`
+							CacheWriteTokens int `json:"cache_creation_input_tokens"`
+						} `json:"usage"`
+					} `json:"message"`
+				}
+				if json.Unmarshal(frame["message"], &v.Message) == nil {
+					usage.PromptTokens = v.Message.Usage.InputTokens
+					usage.CacheReadTokens = v.Message.Usage.CacheReadTokens
+					usage.CacheWriteTokens = v.Message.Usage.CacheWriteTokens
+				}
+			case "content_block_start":
+				var v struct {
+					Index        int `json:"index"`
+					ContentBlock struct {
+						Type string `json:"type"`
+						ID   string `json:"id"`
+						Name string `json:"name"`
+						Data string `json:"data"`
+					} `json:"content_block"`
+				}
+				if json.Unmarshal(frame["index"], &v.Index) == nil {
+					_ = json.Unmarshal(frame["content_block"], &v.ContentBlock)
+					b := &anthropicBlock{typ: v.ContentBlock.Type, toolID: v.ContentBlock.ID, toolName: v.ContentBlock.Name, redacted: v.ContentBlock.Data}
+					blocks[v.Index] = b
+					if v.ContentBlock.Type == "tool_use" {
+						out <- Event{Kind: KindToolCallDelta, ToolIndex: v.Index, ToolID: v.ContentBlock.ID, ToolName: v.ContentBlock.Name}
+					}
+				}
+			case "content_block_delta":
+				var v struct {
+					Index int `json:"index"`
+					Delta struct {
+						Type      string `json:"type"`
+						Text      string `json:"text"`
+						Thinking  string `json:"thinking"`
+						Signature string `json:"signature"`
+						Partial   string `json:"partial_json"`
+					} `json:"delta"`
+				}
+				if json.Unmarshal(frame["index"], &v.Index) != nil {
+					continue
+				}
+				_ = json.Unmarshal(frame["delta"], &v.Delta)
+				b := blocks[v.Index]
+				switch v.Delta.Type {
+				case "text_delta":
+					content.WriteString(v.Delta.Text)
+					out <- Event{Kind: KindTextDelta, Text: v.Delta.Text}
+				case "thinking_delta":
+					if b != nil {
+						b.thinking.WriteString(v.Delta.Thinking)
+					}
+					out <- Event{Kind: KindReasoningDelta, ReasoningDelta: v.Delta.Thinking}
+				case "signature_delta":
+					if b != nil {
+						b.signature.WriteString(v.Delta.Signature)
+					}
+				case "input_json_delta":
+					if b != nil {
+						b.args.WriteString(v.Delta.Partial)
+					}
+					out <- Event{Kind: KindToolCallDelta, ToolIndex: v.Index, ArgumentsDelta: v.Delta.Partial}
+				}
+			case "content_block_stop":
+				var v struct {
+					Index int `json:"index"`
+				}
+				if json.Unmarshal(frame["index"], &v.Index) != nil {
+					continue
+				}
+				b := blocks[v.Index]
+				if b == nil {
+					continue
+				}
+				switch b.typ {
+				case "tool_use":
+					calls = append(calls, ToolCall{ID: b.toolID, Name: b.toolName, Arguments: b.args.String()})
+				case "thinking":
+					thinking = append(thinking, ThinkingBlock{Thinking: b.thinking.String(), Signature: b.signature.String()})
+				case "redacted_thinking":
+					thinking = append(thinking, ThinkingBlock{Redacted: true, Data: b.redacted})
+				}
+			case "message_delta":
+				var v struct {
+					Delta struct {
+						StopReason string `json:"stop_reason"`
+					} `json:"delta"`
+					Usage struct {
+						OutputTokens int `json:"output_tokens"`
+					} `json:"usage"`
+				}
+				_ = json.Unmarshal(frame["delta"], &v.Delta)
+				_ = json.Unmarshal(frame["usage"], &v.Usage)
+				finishReason = v.Delta.StopReason
+				usage.CompletionTokens = v.Usage.OutputTokens
+				if v.Delta.StopReason == "tool_use" {
+					stopReason = StopToolCalls
+				}
+			case "error":
+				msg := data
+				var v struct {
+					Error struct {
+						Type    string `json:"type"`
+						Message string `json:"message"`
+					} `json:"error"`
+				}
+				if json.Unmarshal(frame["error"], &v.Error) == nil && v.Error.Message != "" {
+					msg = v.Error.Type + ": " + v.Error.Message
+				}
+				out <- Event{Kind: KindError, ErrorMessage: msg, Err: &StreamError{Message: msg}, Message: Message{Role: RoleAssistant, StopReason: StopError}}
+				return
+			}
+		}
+	}
+	if err := sc.Err(); err != nil {
+		if ctx.Err() != nil {
+			emitAbort(out, "", ctx.Err())
+			return
+		}
+		emitError(out, "", true, "anthropic sse read: "+err.Error())
+		return
+	}
+	usage.TotalTokens = usage.PromptTokens + usage.CompletionTokens
+	out <- Event{
+		Kind:         KindMessageEnd,
+		Message:      Message{Role: RoleAssistant, Content: content.String(), ToolCalls: calls, Thinking: thinking, StopReason: stopReason},
+		Usage:        usage,
+		FinishReason: finishReason,
+	}
+}

runtime/llm/anthropic_test.go

@@ -0,0 +1,250 @@
+package llm
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ---- N2 WP2：Anthropic 原生客户端（验收① 的机器证据）----
+
+// fixtureServer 按调用序回放 testdata/anthropic 下的录制 SSE，并记录请求。
+type fixtureServer struct {
+	t        *testing.T
+	requests []recordedRequest
+	count    int
+}
+
+type recordedRequest struct {
+	path    string
+	apiKey  string
+	version string
+	body    map[string]any
+}
+
+func (f *fixtureServer) handler(w http.ResponseWriter, r *http.Request) {
+	f.count++
+	body, _ := io.ReadAll(r.Body)
+	var parsed map[string]any
+	_ = json.Unmarshal(body, &parsed)
+	f.requests = append(f.requests, recordedRequest{
+		path:    r.URL.Path,
+		apiKey:  r.Header.Get("x-api-key"),
+		version: r.Header.Get("anthropic-version"),
+		body:    parsed,
+	})
+	names := []string{"01-tool-use.sse", "02-thinking-text.sse", "03-text.sse"}
+	raw, err := os.ReadFile(filepath.Join("testdata", "anthropic", names[f.count-1]))
+	if err != nil {
+		f.t.Fatalf("fixture %d: %v", f.count, err)
+	}
+	w.Header().Set("Content-Type", "text/event-stream")
+	_, _ = w.Write(raw)
+}
+
+// anthropicPresetClient 经预设表构建客户端（验收的是「选 anthropic 预设」本身），
+// BaseURL 指到夹具服务器（预设只是结构体，测试内覆盖端点，不打真实网络）。
+func anthropicPresetClient(t *testing.T, base string) *Client {
+	t.Helper()
+	var preset Provider
+	for _, p := range Presets() {
+		if p.Name == "anthropic" {
+			preset = p
+		}
+	}
+	if preset.Name == "" {
+		t.Fatal("anthropic preset missing")
+	}
+	preset.BaseURL = base
+	preset.APIKey = "fixture-key"
+	c, err := ClientFor(preset)
+	if err != nil {
+		t.Fatalf("ClientFor: %v", err)
+	}
+	return c
+}
+
+func collect(t *testing.T, ch <-chan Event) (end Event, texts, reasoning []string) {
+	t.Helper()
+	for ev := range ch {
+		switch ev.Kind {
+		case KindTextDelta:
+			texts = append(texts, ev.Text)
+		case KindReasoningDelta:
+			reasoning = append(reasoning, ev.ReasoningDelta)
+		case KindMessageEnd:
+			end = ev
+		case KindError:
+			t.Fatalf("stream error: %s", ev.ErrorMessage)
+		}
+	}
+	return end, texts, reasoning
+}
+
+// TestAnthropicPresetToolRound 验收①：选 anthropic 预设，用录制 HTTP 夹具
+// 完成一轮完整工具调用（tools 请求 → tool_use → tool_result → 终文本），
+// 且 thinking 块带原签名在下一请求里往返。
+func TestAnthropicPresetToolRound(t *testing.T) {
+	fs := &fixtureServer{t: t}
+	srv := httptest.NewServer(http.HandlerFunc(fs.handler))
+	defer srv.Close()
+	c := anthropicPresetClient(t, srv.URL)
+	ctx := context.Background()
+
+	tools := []ToolDecl{{Name: "read_file", Description: "读文件", Parameters: json.RawMessage(`{"type":"object","properties":{"path":{"type":"string"}}}`)}}
+
+	// 第一回合：带 tools 请求 → tool_use。
+	end1, _, _ := collect(t, c.Stream(ctx, "claude-fixture", []Message{{Role: RoleUser, Content: "查一下 main.go"}}, tools, StreamOptions{}))
+	if end1.Message.StopReason != StopToolCalls || len(end1.Message.ToolCalls) != 1 {
+		t.Fatalf("resp1: %+v", end1.Message)
+	}
+	call := end1.Message.ToolCalls[0]
+	if call.ID != "toolu_01ABC" || call.Name != "read_file" || call.Arguments != `{"path":"main.go"}` {
+		t.Fatalf("tool call: %+v", call)
+	}
+
+	req1 := fs.requests[0]
+	if req1.path != "/messages" || req1.apiKey != "fixture-key" || req1.version != AnthropicVersion {
+		t.Fatalf("req1 headers: %+v", req1)
+	}
+	toolsBody, _ := req1.body["tools"].([]any)
+	if len(toolsBody) != 1 {
+		t.Fatalf("req1 tools: %v", req1.body["tools"])
+	}
+	tool0 := toolsBody[0].(map[string]any)
+	if tool0["name"] != "read_file" || tool0["input_schema"] == nil || tool0["cache_control"] == nil {
+		t.Fatalf("req1 tool decl: %v", tool0)
+	}
+
+	// 第二回合：assistant(tool_use) + tool_result → thinking(带签名) + 终文本。
+	msgs2 := []Message{
+		{Role: RoleUser, Content: "查一下 main.go"},
+		end1.Message,
+		{Role: RoleTool, ToolCallID: call.ID, Name: call.Name, Content: "1 package main\n..."},
+	}
+	end2, texts2, reasoning2 := collect(t, c.Stream(ctx, "claude-fixture", msgs2, tools, StreamOptions{}))
+	if end2.Message.StopReason != StopEnd || end2.Message.Content != "查到了，main.go 一共 42 行。" {
+		t.Fatalf("resp2: %+v", end2.Message)
+	}
+	if len(end2.Message.Thinking) != 1 || end2.Message.Thinking[0].Signature != "EqoBCkgIARABGAIiQA" {
+		t.Fatalf("resp2 thinking: %+v", end2.Message.Thinking)
+	}
+	if strings.Join(texts2, "") != end2.Message.Content || len(reasoning2) == 0 {
+		t.Fatalf("deltas: %v %v", texts2, reasoning2)
+	}
+
+	req2 := fs.requests[1]
+	msgsBody, _ := req2.body["messages"].([]any)
+	var toolResult map[string]any
+	for _, m := range msgsBody {
+		mm := m.(map[string]any)
+		if mm["role"] != "user" {
+			continue
+		}
+		for _, blk := range mm["content"].([]any) {
+			b := blk.(map[string]any)
+			if b["type"] == "tool_result" {
+				toolResult = b
+			}
+		}
+	}
+	if toolResult == nil || toolResult["tool_use_id"] != "toolu_01ABC" {
+		t.Fatalf("req2 tool_result: %v", toolResult)
+	}
+
+	// 第三回合：assistant(thinking+text) 回送 → 签名必须原样往返。
+	msgs3 := append(append([]Message{}, msgs2...), end2.Message, Message{Role: RoleUser, Content: "再说一遍"})
+	end3, _, _ := collect(t, c.Stream(ctx, "claude-fixture", msgs3, tools, StreamOptions{}))
+	if end3.Message.Content != "42 行。" {
+		t.Fatalf("resp3: %+v", end3.Message)
+	}
+
+	req3 := fs.requests[2]
+	var thinkingBlock map[string]any
+	for _, m := range req3.body["messages"].([]any) {
+		mm := m.(map[string]any)
+		if mm["role"] != "assistant" {
+			continue
+		}
+		for _, blk := range mm["content"].([]any) {
+			b := blk.(map[string]any)
+			if b["type"] == "thinking" {
+				thinkingBlock = b
+			}
+		}
+	}
+	if thinkingBlock == nil || thinkingBlock["signature"] != "EqoBCkgIARABGAIiQA" {
+		t.Fatalf("req3 thinking round-trip: %v", thinkingBlock)
+	}
+}
+
+// TestAnthropicBodyShape 组包单测：tool_use/tool_result/thinking 块形态、
+// system 与末位工具的 cache_control、max_tokens 默认。
+func TestAnthropicBodyShape(t *testing.T) {
+	msgs := []Message{
+		{Role: RoleSystem, Content: "sys"},
+		{Role: RoleUser, Content: "u"},
+		{Role: RoleAssistant, Thinking: []ThinkingBlock{{Thinking: "想", Signature: "sig"}}, ToolCalls: []ToolCall{{ID: "t1", Name: "read", Arguments: `{"a":1}`}}},
+		{Role: RoleTool, ToolCallID: "t1", Name: "read", Content: "r1"},
+		{Role: RoleTool, ToolCallID: "t2", Name: "grep", Content: "r2", IsError: true},
+	}
+	raw, err := anthropicBody("claude", msgs, []ToolDecl{{Name: "read", Description: "读"}}, StreamOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body map[string]any
+	if err := json.Unmarshal(raw, &body); err != nil {
+		t.Fatal(err)
+	}
+	if body["max_tokens"] != float64(128000) {
+		t.Fatalf("max_tokens 默认：%v", body["max_tokens"])
+	}
+	sys := body["system"].([]any)[0].(map[string]any)
+	if sys["cache_control"] == nil {
+		t.Fatal("system 应挂 cache_control")
+	}
+	out := body["messages"].([]any)
+	// assistant：思考块在最前，其后 tool_use。
+	assistant := out[1].(map[string]any)
+	blocks := assistant["content"].([]any)
+	if blocks[0].(map[string]any)["type"] != "thinking" || blocks[1].(map[string]any)["type"] != "tool_use" {
+		t.Fatalf("assistant 块序：%v", blocks)
+	}
+	// 连续两条 tool 结果折叠进同一条 user 消息。
+	folded := out[2].(map[string]any)
+	if folded["role"] != "user" || len(folded["content"].([]any)) != 2 {
+		t.Fatalf("tool_result 折叠：%v", folded)
+	}
+	second := folded["content"].([]any)[1].(map[string]any)
+	if second["type"] != "tool_result" || second["is_error"] != true {
+		t.Fatalf("tool_result is_error：%v", second)
+	}
+	// 末位工具挂 cache_control。
+	tool := body["tools"].([]any)[0].(map[string]any)
+	if tool["cache_control"] == nil {
+		t.Fatal("末位工具应挂 cache_control")
+	}
+}
+
+// TestAnthropicSSEErrorFrame 协议内 error 帧映射为 KindError。
+func TestAnthropicSSEErrorFrame(t *testing.T) {
+	raw := "event: error\ndata: {\"type\":\"error\",\"error\":{\"type\":\"overloaded_error\",\"message\":\"Overloaded\"}}\n\n"
+	ch := make(chan Event, 1)
+	go func() {
+		defer close(ch)
+		parseAnthropicSSE(context.Background(), strings.NewReader(raw), ch)
+	}()
+	var got []Event
+	for ev := range ch {
+		got = append(got, ev)
+	}
+	if len(got) != 1 || got[0].Kind != KindError || !strings.Contains(got[0].ErrorMessage, "Overloaded") {
+		t.Fatalf("%+v", got)
+	}
+}

runtime/llm/client.go

@@ -11,11 +11,21 @@ import (
 	"time"
 )
 
-// Client calls an OpenAI-compatible chat completions endpoint with streaming.
+// Client calls a chat completions endpoint with streaming.
+// 默认讲 OpenAI 兼容协议；Protocol 为 ProtocolAnthropic 时讲原生
+// Anthropic Messages（组包与 BuildBody 共用，见 anthropic.go）。
 type Client struct {
 	BaseURL    string
 	APIKey     string
 	HTTPClient *http.Client
+	// Protocol 空 = openai-chat（零值兼容所有直接构造点）。
+	Protocol Protocol
+	// ReasoningSplit 在 openai-chat 请求体加 "reasoning_split": true：
+	// MiniMax 等 interleaved-thinking 提供商据此把思考放进独立的
+	// reasoning_content 字段而不是混在 content 的 <think> 块里（分流后
+	// SSE 的 reasoning_content 捕获照常生效）。对不认识该字段的服务器
+	// 属未知字段，多数按忽略处理；宿主按模型名自行决定是否置位。
+	ReasoningSplit bool
 }
 
 // Stream implements StreamFunc. Transport and provider failures are encoded as
@@ -24,6 +34,10 @@ func (c *Client) Stream(ctx context.Context, model string, messages []Message, t
 	out := make(chan Event)
 	go func() {
 		defer close(out)
+		if c.Protocol == ProtocolAnthropic {
+			c.streamAnthropic(ctx, model, messages, tools, opts, out)
+			return
+		}
 		c.run(ctx, model, messages, tools, opts, out)
 	}()
 	return out
@@ -59,6 +73,9 @@ func (c *Client) run(ctx context.Context, model string, messages []Message, tool
 	if effort := OpenAIReasoningEffort(opts.ThinkingLevel); effort != "" {
 		body["reasoning_effort"] = effort
 	}
+	if c.ReasoningSplit {
+		body["reasoning_split"] = true
+	}
 	if len(tools) > 0 {
 		body["tools"] = toProviderTools(tools)
 		body["tool_choice"] = "auto"
@@ -113,6 +130,18 @@ func (c *Client) run(ctx context.Context, model string, messages []Message, tool
 	}
 }
 
+// replayThink 拼接一条 assistant 消息捕获到的全部思考块。
+func replayThink(m Message) string {
+	var b strings.Builder
+	for _, t := range m.Thinking {
+		if t.Thinking != "" {
+			b.WriteString(t.Thinking)
+			b.WriteString("\n")
+		}
+	}
+	return strings.TrimRight(b.String(), "\n")
+}
+
 func toProviderMessages(messages []Message) []map[string]any {
 	out := make([]map[string]any, 0, len(messages))
 	for _, m := range messages {
@@ -124,7 +153,14 @@ func toProviderMessages(messages []Message) []map[string]any {
 				"content":      m.Content,
 			})
 		case RoleAssistant:
-			item := map[string]any{"role": "assistant", "content": m.Content}
+			// 回放捕获的思考（Message.Thinking 由 SSE 的 reasoning_content 捕获而来）：
+			// 交错思考模型要求历史 assistant 原样带回 <think> 块。没有思考块的
+			// 消息零改动——非思考模型的上下文不受影响。
+			content := m.Content
+			if think := replayThink(m); think != "" {
+				content = "<think>\n" + think + "\n</think>\n\n" + content
+			}
+			item := map[string]any{"role": "assistant", "content": content}
 			if len(m.ToolCalls) > 0 {
 				calls := make([]map[string]any, 0, len(m.ToolCalls))
 				for _, tc := range m.ToolCalls {

runtime/llm/providers.go

@@ -140,7 +140,7 @@ type Provider struct {
 // Presets are OpenAI-compatible or native endpoints that only need an API key.
 func Presets() []Provider {
 	return []Provider{
-		{Name: "anthropic", Protocol: ProtocolOpenAIChat, BaseURL: "https://api.anthropic.com/v1", APIKeyEnv: "ANTHROPIC_API_KEY"},
+		{Name: "anthropic", Protocol: ProtocolAnthropic, BaseURL: "https://api.anthropic.com", APIKeyEnv: "ANTHROPIC_API_KEY"},
 		{Name: "openai", Protocol: ProtocolOpenAIChat, BaseURL: "https://api.openai.com/v1", APIKeyEnv: "OPENAI_API_KEY"},
 		{Name: "openai-responses", Protocol: ProtocolOpenAIResponses, BaseURL: "https://api.openai.com/v1", APIKeyEnv: "OPENAI_API_KEY"},
 		{Name: "google", Protocol: ProtocolOpenAIChat, BaseURL: "https://generativelanguage.googleapis.com/v1beta/openai", APIKeyEnv: "GEMINI_API_KEY"},
@@ -196,12 +196,14 @@ func Lookup(name string, custom []Provider) (Provider, bool) {
 	return Provider{}, false
 }
 
-// ClientFor 返回会说该协议的客户端。responses、azure 以及原生 Anthropic/Google
+// ClientFor 返回会说该协议的客户端。responses、azure 以及原生 Google
 // 协议当前没有接到客户端上，返回明确错误而不是发到错误的路径。
 func ClientFor(p Provider) (*Client, error) {
 	switch p.Protocol {
 	case ProtocolOpenAIChat:
 		return &Client{BaseURL: p.BaseURL, APIKey: p.APIKey}, nil
+	case ProtocolAnthropic:
+		return &Client{BaseURL: p.BaseURL, APIKey: p.APIKey, Protocol: ProtocolAnthropic}, nil
 	default:
 		return nil, fmt.Errorf("llm: protocol %q is not implemented", p.Protocol)
 	}
@@ -264,29 +266,10 @@ func BuildBody(protocol Protocol, model string, messages []Message, tools []Tool
 			body["reasoning"] = map[string]any{"effort": effort}
 		}
 		return json.Marshal(body)
-	// ProtocolAnthropic 与 ProtocolGoogle 只供离线组包。
-	// 当前 Client 只发 OpenAI chat completions，这两支没有接到客户端上。
-	// 原生协议是后续阶段的事；预设表里的 anthropic / google 已改走兼容端点。
+	// ProtocolGoogle 只供离线组包（客户端未接）；Anthropic 与线上客户端
+	// 共用 anthropicBody（同一组包，消灭离线/线上两张皮）。
 	case ProtocolAnthropic:
-		sys, msgs := anthropicMessages(messages)
-		body := map[string]any{
-			"model":      model,
-			"messages":   msgs,
-			"max_tokens": opts.MaxTokens,
-			"stream":     true,
-		}
-		// Anthropic 要求 max_tokens。0 表示调用方不限制：用足够大的默认值，
-		// 避免 4096 把长回复截断。真正的上限由调用方 StreamOptions.MaxTokens 决定。
-		if body["max_tokens"] == 0 {
-			body["max_tokens"] = 128000
-		}
-		if sys != "" {
-			body["system"] = sys
-		}
-		if budget := AnthropicThinkingBudget(opts.ThinkingLevel); budget > 0 {
-			body["thinking"] = map[string]any{"type": "enabled", "budget_tokens": budget}
-		}
-		return json.Marshal(body)
+		return anthropicBody(model, messages, tools, opts)
 	case ProtocolGoogle:
 		body := map[string]any{
 			"contents": googleContents(messages),
@@ -317,40 +300,6 @@ func responsesInput(messages []Message) []map[string]any {
 	return out
 }
 
-func anthropicMessages(messages []Message) (string, []map[string]any) {
-	var system strings.Builder
-	var out []map[string]any
-	for _, m := range messages {
-		if m.Role == RoleSystem {
-			if system.Len() > 0 {
-				system.WriteString("\n")
-			}
-			system.WriteString(m.Content)
-			continue
-		}
-		role := "user"
-		if m.Role == RoleAssistant {
-			role = "assistant"
-		}
-		content := []map[string]any{}
-		if m.Content != "" {
-			content = append(content, map[string]any{"type": "text", "text": m.Content})
-		}
-		for _, img := range m.Images {
-			content = append(content, map[string]any{
-				"type": "image",
-				"source": map[string]any{
-					"type":       "base64",
-					"media_type": firstNonEmpty(img.MIME, "image/png"),
-					"data":       img.Data,
-				},
-			})
-		}
-		out = append(out, map[string]any{"role": role, "content": content})
-	}
-	return system.String(), out
-}
-
 func googleContents(messages []Message) []map[string]any {
 	var out []map[string]any
 	for _, m := range messages {

runtime/llm/providers_test.go

@@ -69,19 +69,29 @@ func TestModelsJSONAndBodies(t *testing.T) {
 }
 
 func TestPresetsAndClientForChatCompletions(t *testing.T) {
-	want := map[string]string{
-		"anthropic": "https://api.anthropic.com/v1",
-		"google":    "https://generativelanguage.googleapis.com/v1beta/openai",
+	// google 仍走 OpenAI 兼容端点；anthropic 自 N2 起是原生 Messages 协议。
+	want := map[string]struct {
+		protocol Protocol
+		base     string
+	}{
+		"anthropic": {ProtocolAnthropic, "https://api.anthropic.com"},
+		"google":    {ProtocolOpenAIChat, "https://generativelanguage.googleapis.com/v1beta/openai"},
 	}
 	for _, p := range Presets() {
-		base, ok := want[p.Name]
+		w, ok := want[p.Name]
 		if !ok {
 			continue
 		}
-		if p.Protocol != ProtocolOpenAIChat || p.BaseURL != base {
+		if p.Protocol != w.protocol || p.BaseURL != w.base {
 			t.Fatalf("%s preset: %+v", p.Name, p)
 		}
 	}
+	// 原生 anthropic 有真实客户端（审计 N4 关闭）；responses/azure/google 仍 fail-closed。
+	if p, ok := Lookup("anthropic", nil); !ok {
+		t.Fatal("anthropic preset missing")
+	} else if c, err := ClientFor(p); err != nil || c.Protocol != ProtocolAnthropic {
+		t.Fatalf("anthropic ClientFor: %v %+v", err, c)
+	}
 	for _, name := range []string{"openai-responses", "azure"} {
 		p, ok := Lookup(name, nil)
 		if !ok {

runtime/llm/reasoning_split_test.go

@@ -0,0 +1,47 @@
+package llm
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// TestOpenAIChatBodyReasoningSplit 验证 Client.ReasoningSplit 置位时
+// openai-chat 请求体带 "reasoning_split": true，未置位时不带（未知字段
+// 不外溢给别的提供商）。
+func TestOpenAIChatBodyReasoningSplit(t *testing.T) {
+	var bodies []string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		raw, _ := io.ReadAll(r.Body)
+		bodies = append(bodies, string(raw))
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = io.WriteString(w, "data: [DONE]\n\n")
+	}))
+	defer srv.Close()
+
+	drain := func(c *Client) {
+		for range c.Stream(context.Background(), "MiniMax-M3",
+			[]Message{{Role: RoleUser, Content: "hi"}}, nil, StreamOptions{}) {
+		}
+	}
+
+	drain(&Client{BaseURL: srv.URL, APIKey: "k"})
+	drain(&Client{BaseURL: srv.URL, APIKey: "k", ReasoningSplit: true})
+	if len(bodies) != 2 {
+		t.Fatalf("requests = %d", len(bodies))
+	}
+	if strings.Contains(bodies[0], "reasoning_split") {
+		t.Fatalf("flag off must not leak the field: %s", bodies[0])
+	}
+	var got map[string]any
+	if err := json.Unmarshal([]byte(bodies[1]), &got); err != nil {
+		t.Fatal(err)
+	}
+	if v, ok := got["reasoning_split"].(bool); !ok || !v {
+		t.Fatalf("flag on must set reasoning_split=true: %s", bodies[1])
+	}
+}

runtime/llm/sse.go

@@ -52,6 +52,7 @@ func ParseSSE(ctx context.Context, r io.Reader) <-chan Event {
 
 func emitParsed(ctx context.Context, r io.Reader, out chan<- Event) {
 	var content strings.Builder
+	var reasoning strings.Builder
 	calls := map[int]*ToolCall{}
 	order := []int{}
 	var usage Usage
@@ -108,8 +109,12 @@ func emitParsed(ctx context.Context, r io.Reader, out chan<- Event) {
 		}
 		// reasoning_content（国产 OpenAI 兼容模型的思考链）与正文分流：
 		// 只作为 reasoning_delta 事件外发，不计入 Message.Content（与 runner
-		// stripThinkBlocks"正文无 think"语义对齐）。
+		// stripThinkBlocks"正文无 think"语义对齐）。同时累计进 reasoning——
+		// 交错思考模型（MiniMax/DeepSeek R1 等）要求历史 assistant 原样带回
+		// 思考内容，丢弃会降低后续轮质量；捕获进 Message.Thinking 随会话
+		// 转录持久化，请求序列化侧按需回放。
 		if choice.Delta.Reasoning != "" {
+			reasoning.WriteString(choice.Delta.Reasoning)
 			select {
 			case <-ctx.Done():
 				emitAbort(out, content.String(), ctx.Err())
@@ -166,6 +171,9 @@ func emitParsed(ctx context.Context, r io.Reader, out chan<- Event) {
 		order = nil
 	}
 	msg := Message{Role: RoleAssistant, Content: content.String(), StopReason: mapFinish(finished, len(order) > 0)}
+	if reasoning.Len() > 0 {
+		msg.Thinking = []ThinkingBlock{{Thinking: reasoning.String()}}
+	}
 	for _, idx := range order {
 		msg.ToolCalls = append(msg.ToolCalls, *calls[idx])
 	}

runtime/llm/testdata/anthropic/01-tool-use.sse

@@ -0,0 +1,20 @@
+event: message_start
+data: {"type":"message_start","message":{"id":"msg_01","type":"message","role":"assistant","model":"claude-fixture","usage":{"input_tokens":88,"cache_read_input_tokens":0,"cache_creation_input_tokens":0}}}
+
+event: content_block_start
+data: {"type":"content_block_start","index":0,"content_block":{"type":"tool_use","id":"toolu_01ABC","name":"read_file"}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"input_json_delta","partial_json":"{\"path\":"}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"input_json_delta","partial_json":"\"main.go\"}"}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":0}
+
+event: message_delta
+data: {"type":"message_delta","delta":{"stop_reason":"tool_use"},"usage":{"output_tokens":31}}
+
+event: message_stop
+data: {"type":"message_stop"}

runtime/llm/testdata/anthropic/02-thinking-text.sse

@@ -0,0 +1,29 @@
+event: message_start
+data: {"type":"message_start","message":{"id":"msg_02","type":"message","role":"assistant","model":"claude-fixture","usage":{"input_tokens":142,"cache_read_input_tokens":60,"cache_creation_input_tokens":0}}}
+
+event: content_block_start
+data: {"type":"content_block_start","index":0,"content_block":{"type":"thinking","thinking":""}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"thinking_delta","thinking":"用户问 main.go，工具已返回。"}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"signature_delta","signature":"EqoBCkgIARABGAIiQA"}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":0}
+
+event: content_block_start
+data: {"type":"content_block_start","index":1,"content_block":{"type":"text","text":""}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":1,"delta":{"type":"text_delta","text":"查到了，main.go 一共 42 行。"}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":1}
+
+event: message_delta
+data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":57}}
+
+event: message_stop
+data: {"type":"message_stop"}

runtime/llm/testdata/anthropic/03-text.sse

@@ -0,0 +1,17 @@
+event: message_start
+data: {"type":"message_start","message":{"id":"msg_03","type":"message","role":"assistant","model":"claude-fixture","usage":{"input_tokens":201}}}
+
+event: content_block_start
+data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}
+
+event: content_block_delta
+data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"42 行。"}}
+
+event: content_block_stop
+data: {"type":"content_block_stop","index":0}
+
+event: message_delta
+data: {"type":"message_delta","delta":{"stop_reason":"end_turn"},"usage":{"output_tokens":9}}
+
+event: message_stop
+data: {"type":"message_stop"}

runtime/llm/think_replay_test.go

@@ -0,0 +1,45 @@
+package llm
+
+import (
+	"strings"
+	"testing"
+)
+
+// 交错思考模型（MiniMax 等）要求历史 assistant 原样带回思考内容：
+// SSE 把 reasoning_content 捕获进 Message.Thinking；序列化把它作为
+// <think> 前缀回放。没有思考块的消息保持零改动。
+func TestReasoningCaptureAndReplay(t *testing.T) {
+	// 回放侧。
+	msgs := []Message{
+		{Role: RoleUser, Content: "总结"},
+		{Role: RoleAssistant, Content: "结论。", Thinking: []ThinkingBlock{{Thinking: "先读材料。"}}},
+		{Role: RoleAssistant, Content: "没有思考的轮次。"},
+	}
+	out := toProviderMessages(msgs)
+	if got := out[1]["content"].(string); !strings.HasPrefix(got, "<think>\n先读材料。\n</think>") || !strings.HasSuffix(got, "结论。") {
+		t.Fatalf("assistant replay malformed: %q", got)
+	}
+	if got := out[2]["content"].(string); got != "没有思考的轮次。" {
+		t.Fatalf("non-thinking assistant must be untouched: %q", got)
+	}
+	if _, ok := out[0]["tool_calls"]; ok {
+		t.Fatal("user messages carry no tool_calls")
+	}
+	// 捕获侧：直接构造 SSE 流。
+	sse := "data: {\"choices\":[{\"delta\":{\"reasoning_content\":\"思考\"}}]}\n\n" +
+		"data: {\"choices\":[{\"delta\":{\"content\":\"正文\"}}]}\n\n" +
+		"data: {\"choices\":[{\"delta\":{},\"finish_reason\":\"stop\"}]}\n\n" +
+		"data: [DONE]\n\n"
+	var end Event
+	for ev := range ParseSSE(t.Context(), strings.NewReader(sse)) {
+		if ev.Kind == KindMessageEnd {
+			end = ev
+		}
+	}
+	if end.Message.Content != "正文" {
+		t.Fatalf("content polluted by reasoning: %q", end.Message.Content)
+	}
+	if len(end.Message.Thinking) != 1 || end.Message.Thinking[0].Thinking != "思考" {
+		t.Fatalf("reasoning not captured: %+v", end.Message.Thinking)
+	}
+}

runtime/llm/types.go

@@ -52,8 +52,21 @@ type Message struct {
 	Images     []Image    `json:"images,omitempty"`
 	ToolCallID string     `json:"tool_call_id,omitempty"`
 	ToolCalls  []ToolCall `json:"tool_calls,omitempty"`
-	StopReason StopReason `json:"stop_reason,omitempty"`
-	IsError    bool       `json:"is_error,omitempty"`
+	// Thinking 是思考块：Anthropic 原生路径含签名、在请求里原样往返；
+	// OpenAI 兼容路径由 SSE 的 reasoning_content 捕获（不含签名），随会话
+	// 转录持久化，请求序列化时按 <think> 块回放（见 client.go replayThink）。
+	Thinking   []ThinkingBlock `json:"thinking,omitempty"`
+	StopReason StopReason      `json:"stop_reason,omitempty"`
+	IsError    bool            `json:"is_error,omitempty"`
+}
+
+// ThinkingBlock 是一块 Anthropic 思考内容。Redacted 为真时 Data 是不透明
+// 密文（redacted_thinking），往返时原样回送。
+type ThinkingBlock struct {
+	Thinking  string `json:"thinking,omitempty"`
+	Signature string `json:"signature,omitempty"`
+	Redacted  bool   `json:"redacted,omitempty"`
+	Data      string `json:"data,omitempty"`
 }
 
 // ToolDecl is the JSON-schema declaration sent to the provider.

runtime/loop.go

@@ -4,14 +4,17 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"agent-native/runtime/hooks"
 	"agent-native/runtime/llm"
+	"agent-native/runtime/memory"
 	"agent-native/runtime/reminders"
 	"agent-native/runtime/session"
+	"agent-native/runtime/telemetry"
 	"agent-native/runtime/tools"
 
 	"logging-system/logsys"
@@ -35,6 +38,9 @@ type Event struct {
 	Message llm.Message
 	Tool    string
 	Text    string
+	// CallID 在 tool_execution_start / tool_execution_end 时携带工具调用的
+	// ID：并行执行下同回合多个调用并发进出，消费方按 ID 配对而非按顺序。
+	CallID string
 	// Detail carries tool arguments/results or reasoning deltas for
 	// process-visualization consumers; log writers may ignore it.
 	Detail string
@@ -43,6 +49,12 @@ type Event struct {
 	PromptTokens     int
 	CompletionTokens int
 	TotalTokens      int
+	// 以下在 type=usage 时有意义（WP6：上一请求与缓存命中拆分）。
+	LastPromptTokens     int
+	LastCompletionTokens int
+	LastTotalTokens      int
+	CacheReadTokens      int
+	CacheWriteTokens     int
 }
 
 // Config drives one agent session.
@@ -108,6 +120,33 @@ type Config struct {
 	ContextBuffer int
 	// KeepToolResults 是清理时保留的最近工具结果条数。0 表示 5。
 	KeepToolResults int
+	// ResultsDir 非空时，被清理的旧工具结果完整内容落盘到该目录
+	// （占位写路径）；空则占位指向会话记录（旧行为）。
+	ResultsDir string
+	// JournalOnly 为真且 Session 非空时：Session 只作意图日志与恢复配对
+	// （不恢复的完整权威上下文），请求上下文始终由 History 组装；
+	// 本次恢复写入的配对摘要以系统消息注入（不持久化，已在 journal 里）。
+	// 为假（默认）保持既有语义：Session 为权威上下文。
+	JournalOnly bool
+	// AgentName 是 invoke_agent span 的名字后缀（OTel GenAI 约定
+	// "invoke_agent <agent>"）。空 = "agent-native"。
+	AgentName string
+	// ProviderName 是 gen_ai.system 属性值（如 openai / anthropic）。
+	// 空 = "openai"。
+	ProviderName string
+	// Memory 是记忆端口（N3 WP5）：nil = 不启用。启用时每次请求前
+	// Recall 一次并以系统消息注入请求副本（不落盘、不累计）。
+	Memory memory.Store
+	// MemoryScope 是 Recall 的 scope 过滤（"" = 不限，含 user/project；
+	// AgentSpec.MemoryScope 的消费点）。
+	MemoryScope string
+	// RetryAttempts 是流式错误的默认重试次数（WP6 下沉为库默认）：
+	// 0 值 = 2 次（默认）；负值 = 关闭；正数 = 次数。
+	// 只在还没向调用方发出增量时重试（WithRetry 既有语义）。
+	RetryAttempts int
+	// traceCtx 是本次 Run 的 span 关联（Run 启动时建立；指针随 Config
+	// 副本传播到各轮与各工具）。
+	traceCtx *traceIDs
 	// Hooks 是进程内钩子。空总线不改变停止、提醒和拒绝次数。
 	Hooks *hooks.Bus
 	// PermissionAsk 在钩子对一次工具调用表态 ask 时向宿主请求裁决。
@@ -168,35 +207,84 @@ func Run(ctx context.Context, cfg Config, user llm.Message) (Result, error) {
 		cfg.ToolExecution = ExecSequential
 	}
 	serializeHostCallbacks(&cfg)
-	endRun := startSpan(cfg, "invoke_agent", map[string]string{"model": cfg.Model})
+	if cfg.Memory != nil && cfg.Tools != nil {
+		memory.RegisterWrite(cfg.Tools, cfg.Memory, cfg.MemoryScope)
+	}
+	// 流式错误默认重试（WP6）：库默认 2 次、负值关闭；重试事件进事件面。
+	if cfg.Stream != nil {
+		attempts := cfg.RetryAttempts
+		if attempts == 0 {
+			attempts = 2
+		}
+		if attempts > 0 {
+			cfg.Stream = llm.WithRetry(cfg.Stream, attempts, func(kind, detail string) {
+				emit(cfg, Event{Type: kind, Text: detail})
+			})
+		}
+	}
+	cfg.traceCtx = newTraceContext()
+	endRun := startSpan(cfg, "invoke_agent "+agentName(cfg), map[string]string{
+		"gen_ai.system":          providerName(cfg),
+		"gen_ai.agent.name":      agentName(cfg),
+		"gen_ai.request.model":   cfg.Model,
+	}, true)
 	defer endRun()
 	var messages []llm.Message
-	if cfg.Session != nil {
+	if cfg.Session != nil && !cfg.JournalOnly {
 		loaded, err := cfg.Session.Load()
 		if err != nil {
 			return Result{}, err
 		}
 		messages = loaded
 	}
-	if err := recoverPending(ctx, cfg); err != nil {
+	recovered, err := recoverPending(ctx, cfg)
+	if err != nil {
 		return Result{}, err
 	}
-	if cfg.Session != nil {
+	// 尾部配对兜底：无论进程死在 persist(assistant) 与 commitToolIntent
+	// 之间的哪个窗口，补全尾部 assistant 的无结果调用，转录配对恒成立。
+	repaired, err := repairOrphanTail(cfg)
+	if err != nil {
+		return Result{}, err
+	}
+	recovered = append(recovered, repaired...)
+	if cfg.Session != nil && !cfg.JournalOnly {
 		loaded, err := cfg.Session.Load()
 		if err != nil {
 			return Result{}, err
 		}
 		messages = loaded
 	}
+	seeded := false
 	if len(messages) == 0 && len(cfg.History) > 0 {
 		messages = append([]llm.Message{}, cfg.History...)
+		seeded = true
 	}
+	prependedSys := false
 	if len(messages) == 0 || messages[0].Role != llm.RoleSystem {
 		sys := llm.Message{Role: llm.RoleSystem, Content: systemText(cfg)}
 		messages = append([]llm.Message{sys}, messages...)
 		if err := persist(cfg, sys); err != nil {
 			return Result{}, err
 		}
+		prependedSys = true
+	}
+	// 种子落盘（N3 WP2）：转录为权威上下文时，History 只作一次性种子——
+	// 不落盘则第二跑起种子静默丢失。已落盘的前置系统消息不重复写；
+	// JournalOnly 时种子不进 journal（journal 只收本轮起的消息）。
+	if seeded && !cfg.JournalOnly {
+		for i, m := range messages {
+			if i == 0 && prependedSys {
+				continue
+			}
+			if err := persist(cfg, m); err != nil {
+				return Result{}, err
+			}
+		}
+	}
+	if cfg.JournalOnly && len(recovered) > 0 {
+		// 恢复摘要以系统消息注入上下文（不持久化——内容已在 journal 里）。
+		messages = append(messages, llm.Message{Role: llm.RoleSystem, Content: recoveredNoteText(recovered)})
 	}
 	if err := persist(cfg, user); err != nil {
 		return Result{}, err
@@ -250,12 +338,16 @@ func Run(ctx context.Context, cfg Config, user llm.Message) (Result, error) {
 		end, errEv := consume(ctx, cfg, request)
 		if errEv != nil {
 			cfg.logger().Error("runtime turn failed", errEv, "retryable", end.Retryable)
+			emitUsage(cfg, usage)
 			return Result{Text: end.Message.Content, Messages: messages, StopReason: end.Message.StopReason, Err: errEv, Retryable: end.Retryable}, nil
 		}
 		last = end.Message
 		usage.PromptTokens += end.Usage.PromptTokens
 		usage.CompletionTokens += end.Usage.CompletionTokens
 		usage.TotalTokens += end.Usage.TotalTokens
+		// cache 只入累计位（WP6 决策：不加 Last* cache 字段，避免字段膨胀）。
+		usage.CacheReadTokens += end.Usage.CacheReadTokens
+		usage.CacheWriteTokens += end.Usage.CacheWriteTokens
 		usage.LastPromptTokens = end.Usage.PromptTokens
 		usage.LastCompletionTokens = end.Usage.CompletionTokens
 		usage.LastTotalTokens = end.Usage.TotalTokens
@@ -263,7 +355,7 @@ func Run(ctx context.Context, cfg Config, user llm.Message) (Result, error) {
 			return Result{}, err
 		}
 		messages = append(messages, last)
-		emit(cfg, Event{Type: "message_end", Message: last, PromptTokens: end.Usage.PromptTokens, CompletionTokens: end.Usage.CompletionTokens, TotalTokens: end.Usage.TotalTokens})
+		emit(cfg, Event{Type: "message_end", Message: last, PromptTokens: end.Usage.PromptTokens, CompletionTokens: end.Usage.CompletionTokens, TotalTokens: end.Usage.TotalTokens, CacheReadTokens: end.Usage.CacheReadTokens, CacheWriteTokens: end.Usage.CacheWriteTokens})
 
 		if last.StopReason == llm.StopToolCalls && len(last.ToolCalls) > 0 {
 			if reason := budgetExceeded(cfg.Budget, usage, toolCalls, time.Now()); reason != "" {
@@ -334,8 +426,8 @@ func Run(ctx context.Context, cfg Config, user llm.Message) (Result, error) {
 			if decision.Continue && stopContinues < maxStopContinuations {
 				stopContinues++
 				if decision.Replacement != "" && len(messages) > 0 {
-					messages[len(messages)-1].Content = decision.Replacement
-					last.Content = decision.Replacement
+					// 替换文只以 user 消息追加（N3 WP1/N6：不再改写内存里的
+					// assistant——内存与转录保持一致；模型经该消息看到更正）。
 					note := llm.Message{Role: llm.RoleUser, Content: decision.Replacement}
 					if err := persist(cfg, note); err != nil {
 						return Result{}, err
@@ -401,7 +493,11 @@ func systemText(cfg Config) string {
 }
 
 func consume(ctx context.Context, cfg Config, messages []llm.Message) (llm.Event, error) {
-	endSpan := startSpan(cfg, "chat", map[string]string{"model": cfg.Model})
+	spanAttrs := map[string]string{
+		"gen_ai.system":        providerName(cfg),
+		"gen_ai.request.model": cfg.Model,
+	}
+	endSpan := startSpan(cfg, "chat "+cfg.Model, spanAttrs, false)
 	defer endSpan()
 	var decls []llm.ToolDecl
 	if cfg.Tools != nil {
@@ -438,6 +534,11 @@ func consume(ctx context.Context, cfg Config, messages []llm.Message) (llm.Event
 			sawEnd = true
 		}
 	}
+	// usage 在 span 结束前补进属性（结束时过滤导出，见 telemetry 工厂）。
+	if sawEnd {
+		spanAttrs["gen_ai.usage.input_tokens"] = itoa(end.Usage.PromptTokens)
+		spanAttrs["gen_ai.usage.output_tokens"] = itoa(end.Usage.CompletionTokens)
+	}
 	if !sawEnd {
 		return llm.Event{Message: llm.Message{StopReason: llm.StopError}}, errString("stream ended without a message")
 	}
@@ -608,22 +709,38 @@ func noteToolHook(cfg Config, call llm.ToolCall, msg llm.Message) {
 	cfg.Hooks.Emit(hooks.Call{Event: ev, Tool: call.Name, Args: call.Arguments, Result: msg.Content, IsError: msg.IsError})
 }
 
+// toolCallKey 是把当前工具调用注入 Execute ctx 的私有键：并行执行下工具实现
+// 需要知道自己服务于哪次调用（配对过程事件、按调用记账），经
+// ToolCallFromContext 读取；旧宿主/直接构造的 ctx 返回 ok=false。
+type toolCallKey struct{}
+
+// WithToolCall 把 call 挂进 ctx（内核 runOne 在执行前注入）。
+func WithToolCall(ctx context.Context, call llm.ToolCall) context.Context {
+	return context.WithValue(ctx, toolCallKey{}, call)
+}
+
+// ToolCallFromContext 取出当前正在执行的调用；不存在时 ok=false。
+func ToolCallFromContext(ctx context.Context) (llm.ToolCall, bool) {
+	call, ok := ctx.Value(toolCallKey{}).(llm.ToolCall)
+	return call, ok
+}
+
 func runOne(ctx context.Context, cfg Config, call llm.ToolCall) llm.Message {
 	if err := ctx.Err(); err != nil {
 		return cancelledToolMessage(call, err)
 	}
 	if why := rejectIncompleteToolCall(call); why != "" {
 		msg := llm.Message{Role: llm.RoleTool, Name: call.Name, ToolCallID: call.ID, Content: why, IsError: true}
-		emit(cfg, Event{Type: "tool_execution_start", Tool: call.Name, Detail: call.Arguments})
-		emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, Text: why})
+		emit(cfg, Event{Type: "tool_execution_start", Tool: call.Name, CallID: call.ID, Detail: call.Arguments})
+		emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, CallID: call.ID, Text: why})
 		if cfg.AfterTool != nil {
 			cfg.AfterTool(call, msg)
 		}
 		return msg
 	}
-	emit(cfg, Event{Type: "tool_execution_start", Tool: call.Name, Detail: call.Arguments})
+	emit(cfg, Event{Type: "tool_execution_start", Tool: call.Name, CallID: call.ID, Detail: call.Arguments})
 	if gated, msg, blocked := gateTool(ctx, cfg, call); blocked {
-		emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, Text: msg.Content})
+		emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, CallID: call.ID, Text: msg.Content})
 		noteToolHook(cfg, call, msg)
 		if cfg.AfterTool != nil {
 			cfg.AfterTool(call, msg)
@@ -635,7 +752,7 @@ func runOne(ctx context.Context, cfg Config, call llm.ToolCall) llm.Message {
 	if cfg.BeforeTool != nil {
 		if err := cfg.BeforeTool(call); err != nil {
 			msg := llm.Message{Role: llm.RoleTool, Name: call.Name, ToolCallID: call.ID, Content: err.Error(), IsError: true}
-			emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, Text: msg.Content})
+			emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, CallID: call.ID, Text: msg.Content})
 			noteToolHook(cfg, call, msg)
 			if cfg.AfterTool != nil {
 				cfg.AfterTool(call, msg)
@@ -646,13 +763,17 @@ func runOne(ctx context.Context, cfg Config, call llm.ToolCall) llm.Message {
 	emit(cfg, Event{Type: "tool_execution_update", Tool: call.Name, Detail: call.Arguments})
 	if err := commitToolIntent(cfg, call); err != nil {
 		msg := llm.Message{Role: llm.RoleTool, Name: call.Name, ToolCallID: call.ID, Content: err.Error(), IsError: true}
-		emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, Text: msg.Content})
+		emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, CallID: call.ID, Text: msg.Content})
 		return msg
 	}
-	endSpan := startSpan(cfg, "execute_tool", map[string]string{"tool": call.Name})
+	endSpan := startSpan(cfg, "execute_tool "+call.Name, map[string]string{
+		"gen_ai.system":    providerName(cfg),
+		"gen_ai.tool.name": call.Name,
+	}, false)
 	defer endSpan()
 	res := tools.Result{Content: "no tools configured", IsError: true}
 	known := cfg.Tools != nil && cfg.Tools.Has(call.Name)
+	ctx = WithToolCall(ctx, call)
 	switch {
 	case known:
 		res = cfg.Tools.Execute(ctx, call.Name, json.RawMessage(call.Arguments))
@@ -668,7 +789,7 @@ func runOne(ctx context.Context, cfg Config, call llm.ToolCall) llm.Message {
 		Content:    res.Content,
 		IsError:    res.IsError,
 	}
-	emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, Text: res.Content})
+	emit(cfg, Event{Type: "tool_execution_end", Tool: call.Name, CallID: call.ID, Text: res.Content})
 	noteToolHook(cfg, call, msg)
 	if cfg.AfterTool != nil {
 		cfg.AfterTool(call, msg)
@@ -685,13 +806,40 @@ func settle(cfg Config, last llm.Message, messages []llm.Message, usage llm.Usag
 
 func prepareRequest(cfg Config, messages []llm.Message, turn int, repeats *repeatState, lengthNudge *bool) []llm.Message {
 	request := clearOldResults(cfg, persistedProjection(cfg, messages))
+	request = injectMemoryBlock(cfg, request)
 	return reminders.Attach(request, turnReminderTexts(cfg, turn, repeats, lengthNudge))
 }
 
+// injectMemoryBlock 把记忆召回块插到请求副本的系统段之后（request-scoped：
+// 不落盘、不累计；Recall 失败静默跳过——记忆是增强面，不阻断对话）。
+func injectMemoryBlock(cfg Config, request []llm.Message) []llm.Message {
+	if cfg.Memory == nil {
+		return request
+	}
+	entries, err := cfg.Memory.Recall(context.Background(), memory.RecallQuery{Scope: cfg.MemoryScope})
+	if err != nil {
+		return request
+	}
+	block := memory.Block(entries, time.Now())
+	if block == "" {
+		return request
+	}
+	// 系统段之后插入（保持历史与尾部不动）。
+	i := 0
+	for i < len(request) && request[i].Role == llm.RoleSystem {
+		i++
+	}
+	out := make([]llm.Message, 0, len(request)+1)
+	out = append(out, request[:i]...)
+	out = append(out, llm.Message{Role: llm.RoleSystem, Content: block})
+	return append(out, request[i:]...)
+}
+
 // persistedProjection 在有会话存储时只采用已经落盘的消息。
 // steer 与 follow-up 必须先写入存储，下一轮请求才会看见它们。
 func persistedProjection(cfg Config, messages []llm.Message) []llm.Message {
-	if cfg.Session == nil {
+	// JournalOnly：journal 不作权威上下文，每轮请求都用内存态（History 组装）。
+	if cfg.Session == nil || cfg.JournalOnly {
 		return messages
 	}
 	loaded, err := cfg.Session.Load()
@@ -703,14 +851,21 @@ func persistedProjection(cfg Config, messages []llm.Message) []llm.Message {
 
 const unknownSideEffect = "副作用未知，未重试"
 
-func recoverPending(ctx context.Context, cfg Config) error {
+// crashInterrupted 是尾部兜底配对的正文（进程死在 persist(assistant) 与
+// commitToolIntent 之间的窗口时使用）。
+const crashInterrupted = "进程中断，该调用未执行"
+
+// recoverPending 把未配对的意图补齐（safe 双声明重放，否则「副作用未知」
+// 配对），返回本次写入的配对消息（JournalOnly 时供恢复摘要使用）。
+func recoverPending(ctx context.Context, cfg Config) ([]llm.Message, error) {
 	if cfg.Session == nil {
-		return nil
+		return nil, nil
 	}
 	pending, err := cfg.Session.PendingIntents()
 	if err != nil {
-		return err
+		return nil, err
 	}
+	var out []llm.Message
 	for _, in := range pending {
 		current := tools.ReplayNever
 		if cfg.Tools != nil {
@@ -726,10 +881,84 @@ func recoverPending(ctx context.Context, cfg Config) error {
 			msg.IsError = res.IsError
 		}
 		if err := persist(cfg, msg); err != nil {
-			return err
+			return nil, err
+		}
+		out = append(out, msg)
+	}
+	return out, nil
+}
+
+// repairOrphanTail 兜底配对：找到转录里最后一个带 tool_calls 的 assistant，
+// 凡没有对应 tool 结果的调用，补一条「进程中断，该调用未执行」的 IsError
+// 结果并落盘。与意图日志正交（按 CallID 判重，已配对的跳过；意图路径
+// 已处理的执行中死亡不受影响）。历史深处、其后已有新消息的孤立调用不在
+// 此处修补（追加只落在尾部，位置语义不破）——那种形态由毒化轮转覆盖。
+// repairOrphanTail 返回本次补写的配对消息（JournalOnly 时供恢复摘要使用）。
+func repairOrphanTail(cfg Config) ([]llm.Message, error) {
+	if cfg.Session == nil {
+		return nil, nil
+	}
+	msgs, err := cfg.Session.Load()
+	if err != nil {
+		return nil, err
+	}
+	tail := -1
+	for i := len(msgs) - 1; i >= 0; i-- {
+		m := msgs[i]
+		if m.Role == llm.RoleAssistant && len(m.ToolCalls) > 0 {
+			tail = i
+			break
+		}
+		if m.Role == llm.RoleTool {
+			continue // 尾部连续 tool 结果属于同一条 assistant，继续上溯
+		}
+		break
+	}
+	if tail < 0 {
+		return nil, nil
+	}
+	results := map[string]bool{}
+	for _, m := range msgs {
+		if m.Role == llm.RoleTool && m.ToolCallID != "" {
+			results[m.ToolCallID] = true
 		}
 	}
-	return nil
+	var out []llm.Message
+	for _, call := range msgs[tail].ToolCalls {
+		if results[call.ID] {
+			continue
+		}
+		pair := llm.Message{
+			Role: llm.RoleTool, Name: call.Name, ToolCallID: call.ID,
+			Content: crashInterrupted, IsError: true,
+		}
+		if err := persist(cfg, pair); err != nil {
+			return nil, err
+		}
+		results[call.ID] = true
+		out = append(out, pair)
+	}
+	return out, nil
+}
+
+// recoveredNoteText 把本次恢复写入的配对摘成一段系统说明（注入上下文用；
+// 内容截断防爆，工具名与调用 ID 全列）。
+func recoveredNoteText(recovered []llm.Message) string {
+	var b strings.Builder
+	b.WriteString("上次会话中断的调用已完成恢复（这是系统说明，不是用户发言）：")
+	for _, m := range recovered {
+		content := m.Content
+		if len([]rune(content)) > 120 {
+			content = string([]rune(content)[:120]) + "…"
+		}
+		b.WriteString("\n- ")
+		b.WriteString(m.Name)
+		b.WriteString("（")
+		b.WriteString(m.ToolCallID)
+		b.WriteString("）：")
+		b.WriteString(content)
+	}
+	return b.String()
 }
 
 func commitToolIntent(cfg Config, call llm.ToolCall) error {
@@ -745,10 +974,38 @@ func commitToolIntent(cfg Config, call llm.ToolCall) error {
 	})
 }
 
-func startSpan(cfg Config, name string, attrs map[string]string) func() {
+func itoa(n int) string { return strconv.Itoa(n) }
+
+// traceIDs 是一次 Run 的 span 关联：根 trace + invoke_agent 根 span。
+type traceIDs struct {
+	traceID string
+	rootID  string
+}
+
+// newTraceContext 建立一次 Run 的关联（Trace 为 nil 时也给空壳，调用方免判空）。
+func newTraceContext() *traceIDs {
+	return &traceIDs{traceID: telemetry.NewTraceID(), rootID: telemetry.NewSpanID()}
+}
+
+// startSpan 开一个 OTel GenAI span：root=true 时作 invoke_agent 根（无 parent），
+// 否则作子 span（parent = 根）。attrs 由调用方持有引用——存续期间可补
+// （usage 在结束时随过滤导出）。
+func startSpan(cfg Config, name string, attrs map[string]string, root bool) func() {
 	if cfg.Trace == nil {
 		return func() {}
 	}
+	if attrs == nil {
+		attrs = map[string]string{}
+	}
+	if cfg.traceCtx != nil {
+		attrs[telemetry.AttrTraceID] = cfg.traceCtx.traceID
+		if root {
+			attrs[telemetry.AttrSpanID] = cfg.traceCtx.rootID
+		} else {
+			attrs[telemetry.AttrSpanID] = telemetry.NewSpanID()
+			attrs[telemetry.AttrParentSpanID] = cfg.traceCtx.rootID
+		}
+	}
 	end := cfg.Trace(name, attrs)
 	if end == nil {
 		return func() {}
@@ -756,6 +1013,21 @@ func startSpan(cfg Config, name string, attrs map[string]string) func() {
 	return end
 }
 
+// agentName / providerName 是 OTel 属性的默认值解析。
+func agentName(cfg Config) string {
+	if strings.TrimSpace(cfg.AgentName) != "" {
+		return cfg.AgentName
+	}
+	return "agent-native"
+}
+
+func providerName(cfg Config) string {
+	if strings.TrimSpace(cfg.ProviderName) != "" {
+		return cfg.ProviderName
+	}
+	return "openai"
+}
+
 func clearOldResults(cfg Config, messages []llm.Message) []llm.Message {
 	window := cfg.ContextWindow
 	if window <= 0 {
@@ -772,7 +1044,7 @@ func clearOldResults(cfg Config, messages []llm.Message) []llm.Message {
 	if !session.NeedsClear(session.EstimateChars(messages), window, reserve, buffer) {
 		return messages
 	}
-	return session.ClearOldToolResults(messages, cfg.KeepToolResults)
+	return session.ClearOldToolResultsTo(messages, cfg.KeepToolResults, cfg.ResultsDir)
 }
 
 func turnReminderTexts(cfg Config, turn int, repeats *repeatState, lengthNudge *bool) []string {
@@ -848,7 +1120,12 @@ func drain(fn func() []llm.Message) []llm.Message {
 }
 
 func emitUsage(cfg Config, usage llm.Usage) {
-	emit(cfg, Event{Type: "usage", PromptTokens: usage.PromptTokens, CompletionTokens: usage.CompletionTokens, TotalTokens: usage.TotalTokens})
+	emit(cfg, Event{
+		Type: "usage",
+		PromptTokens: usage.PromptTokens, CompletionTokens: usage.CompletionTokens, TotalTokens: usage.TotalTokens,
+		LastPromptTokens: usage.LastPromptTokens, LastCompletionTokens: usage.LastCompletionTokens, LastTotalTokens: usage.LastTotalTokens,
+		CacheReadTokens: usage.CacheReadTokens, CacheWriteTokens: usage.CacheWriteTokens,
+	})
 }
 
 func emit(cfg Config, ev Event) {
@@ -881,6 +1158,7 @@ func budgetExceeded(b *Budget, usage llm.Usage, toolCalls int, now time.Time) st
 // budgetStop 以预算超限收尾：发事件、留日志、按 StopError 返回（不可重试）。
 func budgetStop(cfg Config, last llm.Message, messages []llm.Message, usage llm.Usage, reason string) Result {
 	emit(cfg, Event{Type: "budget_exceeded", Text: reason})
+	emitUsage(cfg, usage)
 	err := errString(reason)
 	cfg.logger().Error("runtime budget exceeded", err)
 	return Result{Text: last.Content, Messages: messages, StopReason: llm.StopError, Usage: usage, Err: err}

runtime/loop_cache_contract_test.go

@@ -0,0 +1,70 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"agent-native/runtime/llm"
+	"agent-native/runtime/tools"
+)
+
+// ---- N2 WP1：前缀稳定契约（缓存友好的机器钉住：同一注册序列 → 逐字节确定）----
+
+type contractTool struct {
+	name, desc string
+	deferred   bool
+}
+
+func (t contractTool) Name() string                { return t.name }
+func (t contractTool) Description() string         { return t.desc }
+func (t contractTool) Parameters() json.RawMessage { return json.RawMessage(`{"type":"object","properties":{}}`) }
+func (t contractTool) Execute(_ context.Context, _ json.RawMessage) (tools.Result, error) {
+	return tools.Result{Content: "ok"}, nil
+}
+func (t contractTool) Exposure() string {
+	if t.deferred {
+		return tools.ExposureDeferred
+	}
+	return tools.ExposureDirect
+}
+
+func buildContractRegistry() *tools.Registry {
+	reg := tools.NewRegistry("")
+	reg.Register(contractTool{name: "read_file", desc: "读文件"})
+	reg.Register(contractTool{name: "write_file", desc: "写文件"})
+	reg.Register(contractTool{name: "grep", desc: "搜索", deferred: true})
+	return reg
+}
+
+func TestSystemTextDeterministicAcrossIdenticalBuilds(t *testing.T) {
+	a := systemText(Config{SystemPrompt: "sys", Tools: buildContractRegistry()})
+	b := systemText(Config{SystemPrompt: "sys", Tools: buildContractRegistry()})
+	if a != b {
+		t.Fatalf("同一注册序列的系统文本必须逐字节一致：\n%q\nvs\n%q", a, b)
+	}
+	// 契约内容：直接工具全在清单内且按注册序；deferred 工具不进入清单。
+	idx := strings.Index(a, "read_file")
+	if idx < 0 || strings.Index(a, "write_file") < idx {
+		t.Fatalf("直接工具须按注册序出现：%q", a)
+	}
+	if strings.Contains(a, "grep") {
+		t.Fatalf("deferred 工具不得出现在系统文本：%q", a)
+	}
+	// 元工具注入位置确定（tool_search/call_tool 存在且在 Decls 中）。
+	decls := buildContractRegistry().Decls()
+	names := []string{}
+	for _, d := range decls {
+		names = append(names, d.Name)
+	}
+	if len(names) != 4 || names[0] != "read_file" || names[1] != "write_file" {
+		t.Fatalf("Decls 顺序契约：%v", names)
+	}
+	if names[2] != "tool_search" && names[3] != "tool_search" {
+		if names[2] != "call_tool" && names[3] != "call_tool" {
+			t.Fatalf("元工具缺失：%v", names)
+		}
+	}
+	var _ = llm.ToolDecl{} // 保持导入面稳定
+}

runtime/loop_callctx_test.go

@@ -0,0 +1,69 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+	"testing"
+
+	"agent-native/runtime/llm"
+	"agent-native/runtime/tools"
+)
+
+// ctxEchoTool 把自己从 ctx 读到的调用 ID 记下来（并发安全），验证内核
+// 在 Execute 前注入了当前调用。
+type ctxEchoTool struct {
+	mu  sync.Mutex
+	ids []string
+	bad int
+}
+
+func (c *ctxEchoTool) Name() string                { return "echo" }
+func (c *ctxEchoTool) Description() string         { return "echo" }
+func (c *ctxEchoTool) Parameters() json.RawMessage { return json.RawMessage(`{"type":"object"}`) }
+func (c *ctxEchoTool) Execute(ctx context.Context, _ json.RawMessage) (tools.Result, error) {
+	call, ok := ToolCallFromContext(ctx)
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if !ok || call.ID == "" || call.Name != "echo" {
+		c.bad++
+		return tools.Result{Content: "call missing from context", IsError: true}, nil
+	}
+	c.ids = append(c.ids, call.ID)
+	return tools.Result{Content: "ok " + call.ID}, nil
+}
+
+// TestLoopToolSeesOwnCallInContext 并行执行两个调用，各自读到自己的 ID。
+func TestLoopToolSeesOwnCallInContext(t *testing.T) {
+	tool := &ctxEchoTool{}
+	reg := tools.NewRegistry(t.TempDir())
+	reg.Register(tool)
+	res, err := Run(context.Background(), Config{
+		Model:         "fake",
+		Tools:         reg,
+		ToolExecution: ExecParallel,
+		Stream: script(
+			llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopToolCalls, ToolCalls: []llm.ToolCall{
+				{ID: "pa", Name: "echo", Arguments: `{}`},
+				{ID: "pb", Name: "echo", Arguments: `{}`},
+			}},
+			llm.Message{Role: llm.RoleAssistant, Content: "done", StopReason: llm.StopEnd},
+		),
+	}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tool.mu.Lock()
+	defer tool.mu.Unlock()
+	if tool.bad != 0 || len(tool.ids) != 2 {
+		t.Fatalf("bad=%d ids=%v", tool.bad, tool.ids)
+	}
+	seen := map[string]bool{}
+	for _, id := range tool.ids {
+		seen[id] = true
+	}
+	if !seen["pa"] || !seen["pb"] {
+		t.Fatalf("ids = %v", tool.ids)
+	}
+	_ = res
+}

runtime/loop_callid_test.go

@@ -0,0 +1,49 @@
+package runtime
+
+import (
+	"context"
+	"testing"
+
+	"agent-native/runtime/llm"
+	"agent-native/runtime/tools"
+)
+
+// TestLoopToolEventsCarryCallID 验证 tool_execution_start/end 事件带工具调用
+// ID：并行执行下消费方按 ID 配对（回归锚点，防止字段被删后顺序假设回归）。
+func TestLoopToolEventsCarryCallID(t *testing.T) {
+	hits := 0
+	reg := tools.NewRegistry(t.TempDir())
+	reg.Register(hitTool{hits: &hits})
+	var starts, ends []Event
+	res, err := Run(context.Background(), Config{
+		Model: "fake",
+		Tools: reg,
+		Stream: script(
+			llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopToolCalls, ToolCalls: []llm.ToolCall{{
+				ID: "call-7", Name: "echo", Arguments: `{}`,
+			}}},
+			llm.Message{Role: llm.RoleAssistant, Content: "done", StopReason: llm.StopEnd},
+		),
+		OnEvent: func(ev Event) {
+			switch ev.Type {
+			case "tool_execution_start":
+				starts = append(starts, ev)
+			case "tool_execution_end":
+				ends = append(ends, ev)
+			}
+		},
+	}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hits != 1 || len(starts) != 1 || len(ends) != 1 {
+		t.Fatalf("hits=%d starts=%d ends=%d", hits, len(starts), len(ends))
+	}
+	if starts[0].CallID != "call-7" || starts[0].Tool != "echo" {
+		t.Fatalf("start = %+v", starts[0])
+	}
+	if ends[0].CallID != "call-7" || ends[0].Tool != "echo" {
+		t.Fatalf("end = %+v", ends[0])
+	}
+	_ = res
+}

runtime/loop_harness_test.go

@@ -42,20 +42,19 @@ func TestLoopStopContinuesUntilCap(t *testing.T) {
 	if res.Err != nil || res.Notice != "到顶了" {
 		t.Fatalf("notice %q err %v", res.Notice, res.Err)
 	}
-	replaced, forged := 0, 0
+	// N6（N3 WP1）：assistant 不再被改写——替换文只以 user 消息出现，
+	// 内存与转录一致。
+	forged, notes := 0, 0
 	for _, m := range res.Messages {
-		if m.Role != llm.RoleAssistant {
-			continue
-		}
-		if m.Content == "已作废" {
-			replaced++
-		}
-		if m.Content == "forged-claim" {
+		if m.Role == llm.RoleAssistant && m.Content == "forged-claim" {
 			forged++
 		}
+		if m.Role == llm.RoleUser && m.Content == "已作废" {
+			notes++
+		}
 	}
-	if replaced != 3 || forged != 1 {
-		t.Fatalf("replaced=%d forged=%d transcript=%s", replaced, forged, transcriptText(res.Messages))
+	if forged != 4 || notes != 3 {
+		t.Fatalf("forged=%d notes=%d transcript=%s", forged, notes, transcriptText(res.Messages))
 	}
 	if strings.Count(transcriptText(res.Messages), "再试") != 3 {
 		t.Fatalf("reasons = %s", transcriptText(res.Messages))

runtime/loop_otel_n3_test.go

@@ -0,0 +1,112 @@
+package runtime
+
+import (
+	"context"
+	"strings"
+	"sync"
+	"testing"
+
+	"agent-native/runtime/llm"
+	"agent-native/runtime/tools"
+)
+
+// ---- N3 WP4：循环 span 形态（名称后缀、关联、usage）----
+
+type capturedSpan struct {
+	name    string
+	traceID string
+	spanID  string
+	parent  string
+	attrs   map[string]string
+}
+
+type spanRecorder struct {
+	mu    sync.Mutex
+	spans []capturedSpan
+}
+
+func (r *spanRecorder) trace() func(string, map[string]string) func() {
+	return func(name string, attrs map[string]string) func() {
+		return func() {
+			// 结束时拷贝（与 telemetry 工厂的结束时过滤同步——usage 是存续期补的）。
+			sp := capturedSpan{name: name, attrs: map[string]string{}}
+			for k, v := range attrs {
+				sp.attrs[k] = v
+			}
+			r.mu.Lock()
+			defer r.mu.Unlock()
+			sp.traceID = sp.attrs["_trace_id"]
+			sp.spanID = sp.attrs["_span_id"]
+			sp.parent = sp.attrs["_parent_span_id"]
+			r.spans = append(r.spans, sp)
+		}
+	}
+}
+
+func TestLoopSpansFollowGenAIConvention(t *testing.T) {
+	rec := &spanRecorder{}
+	reg := tools.NewRegistry(t.TempDir())
+	reg.Register(&countingTool{name: "read_file"})
+	res, err := Run(context.Background(), Config{
+		Model: "claude-x", Tools: reg, MaxTurns: 3, Trace: rec.trace(),
+		ProviderName: "anthropic", AgentName: "writer",
+		Stream: script(
+			llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopToolCalls,
+				ToolCalls: []llm.ToolCall{{ID: "c1", Name: "read_file", Arguments: `{}`}}},
+			llm.Message{Role: llm.RoleAssistant, Content: "done", StopReason: llm.StopEnd},
+		),
+	}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = res
+	rec.mu.Lock()
+	defer rec.mu.Unlock()
+	if len(rec.spans) < 4 {
+		t.Fatalf("span 数 = %d（invoke_agent + 2×chat + execute_tool）：%+v", len(rec.spans), rec.spans)
+	}
+	var root capturedSpan
+	byName := map[string][]capturedSpan{}
+	for _, sp := range rec.spans {
+		switch {
+		case strings.HasPrefix(sp.name, "invoke_agent "):
+			byName["invoke"] = append(byName["invoke"], sp)
+		case strings.HasPrefix(sp.name, "chat "):
+			byName["chat"] = append(byName["chat"], sp)
+		case strings.HasPrefix(sp.name, "execute_tool "):
+			byName["tool"] = append(byName["tool"], sp)
+		default:
+			t.Fatalf("span 名不合约定：%q", sp.name)
+		}
+	}
+	if len(byName["invoke"]) != 1 || byName["invoke"][0].name != "invoke_agent writer" {
+		t.Fatalf("invoke_agent span：%+v", byName["invoke"])
+	}
+	root = byName["invoke"][0]
+	if root.attrs["gen_ai.system"] != "anthropic" || root.attrs["gen_ai.agent.name"] != "writer" ||
+		root.attrs["gen_ai.request.model"] != "claude-x" {
+		t.Fatalf("根属性：%+v", root.attrs)
+	}
+	if len(byName["chat"]) != 2 {
+		t.Fatalf("chat span 数：%+v", byName["chat"])
+	}
+	for _, sp := range byName["chat"] {
+		if sp.name != "chat claude-x" {
+			t.Fatalf("chat span 名：%q", sp.name)
+		}
+		if sp.traceID != root.traceID || sp.parent != root.spanID {
+			t.Fatalf("关联断裂：trace=%q parent=%q 根=%q/%q", sp.traceID, sp.parent, root.traceID, root.spanID)
+		}
+		if sp.attrs["gen_ai.request.model"] != "claude-x" ||
+			sp.attrs["gen_ai.usage.input_tokens"] == "" || sp.attrs["gen_ai.usage.output_tokens"] == "" {
+			t.Fatalf("chat 属性/usage：%+v", sp.attrs)
+		}
+	}
+	if len(byName["tool"]) != 1 || byName["tool"][0].name != "execute_tool read_file" {
+		t.Fatalf("tool span：%+v", byName["tool"])
+	}
+	tool := byName["tool"][0]
+	if tool.attrs["gen_ai.tool.name"] != "read_file" || tool.traceID != root.traceID || tool.parent != root.spanID {
+		t.Fatalf("tool 属性/关联：%+v", tool)
+	}
+}

runtime/mcp/ask.go

@@ -17,7 +17,18 @@ func askFrom(ctx context.Context) func(context.Context, string) (string, error)
 	return fn
 }
 
-func inputQuestion(res callToolResult) (string, bool) {
+// inputQuestion 提取需要用户输入的问题。两条路径：
+// 2026-07-28 协议级 resultType="input_required"（问题取文本块）；
+// 旧版服务端的内容块 input_required（向后兼容）。
+func inputQuestion(res callToolResult, negotiated string) (string, bool) {
+	if res.ResultType == "input_required" && SupportsResultType(negotiated) {
+		for _, blk := range res.Content {
+			if blk.Type == "text" && blk.Text != "" {
+				return blk.Text, true
+			}
+		}
+		return "", true
+	}
 	for _, blk := range res.Content {
 		if blk.Type == "input_required" {
 			return blk.Text, true

runtime/mcp/fakeserver.go

@@ -44,8 +44,23 @@ func fakeServerHandle(req rpcRequest) rpcResponse {
 	}
 	switch req.Method {
 	case "initialize":
+		// 协商：取(客户端请求, 自身上限)的较小者（ISO 日期字典序可比）；
+		// AGENT_NATIVE_TEST_MCP_VERSION 可压低上限以测回落路径。
+		own := ProtocolVersion
+		if v := os.Getenv("AGENT_NATIVE_TEST_MCP_VERSION"); v != "" {
+			own = v
+		}
+		negotiated := own
+		var p initializeParams
+		if req.Params != nil {
+			raw, _ := json.Marshal(req.Params)
+			_ = json.Unmarshal(raw, &p)
+			if p.ProtocolVersion != "" && p.ProtocolVersion < negotiated {
+				negotiated = p.ProtocolVersion
+			}
+		}
 		return respond(initializeResult{
-			ProtocolVersion: ProtocolVersion,
+			ProtocolVersion: negotiated,
 			ServerInfo:      clientInfo{Name: "fake-mcp", Version: "0"},
 		})
 	case "tools/list":
@@ -71,14 +86,64 @@ func fakeServerHandle(req rpcRequest) rpcResponse {
 		case "slow":
 			time.Sleep(2 * time.Second)
 			return respond(callToolResult{Content: []contentBlock{{Type: "text", Text: "slow done"}}})
+		case "need_input":
+			// 2026-07-28 协议级 input_required：tasks/update 投递后重试得终结果。
+			if input, ok := fakeTaskInputs()["task-1"]; ok {
+				fakeTaskInputs()["task-1"] = ""
+				return respond(callToolResult{Content: []contentBlock{{Type: "text", Text: "答案已收到: " + input}}})
+			}
+			return respond(callToolResult{
+				Content:    []contentBlock{{Type: "text", Text: "要答案"}},
+				ResultType: "input_required",
+				TaskID:     "task-1",
+			})
+		case "legacy_ask":
+			return respond(callToolResult{Content: []contentBlock{{Type: "input_required", Text: "选一个颜色"}}})
 		default:
 			return fail(-32602, "unknown tool "+p.Name)
 		}
+	case "tasks/update":
+		var p struct {
+			TaskID string `json:"taskId"`
+			Input  string `json:"input"`
+		}
+		if req.Params != nil {
+			raw, _ := json.Marshal(req.Params)
+			_ = json.Unmarshal(raw, &p)
+		}
+		fakeTaskInputs()[p.TaskID] = p.Input
+		return respond(map[string]any{"ok": true})
+	case "tasks/get":
+		var p struct {
+			TaskID string `json:"taskId"`
+		}
+		if req.Params != nil {
+			raw, _ := json.Marshal(req.Params)
+			_ = json.Unmarshal(raw, &p)
+		}
+		return respond(taskResult{TaskID: p.TaskID, Status: "running"})
+	case "tasks/cancel":
+		var p struct {
+			TaskID string `json:"taskId"`
+		}
+		if req.Params != nil {
+			raw, _ := json.Marshal(req.Params)
+			_ = json.Unmarshal(raw, &p)
+		}
+		delete(fakeTaskInputs(), p.TaskID)
+		return respond(map[string]any{"ok": true})
 	default:
 		return fail(-32601, "method not found: "+req.Method)
 	}
 }
 
+// fakeTaskInputs 是 need_input 工具的任务输入存储（进程内）。
+func fakeTaskInputs() map[string]string {
+	return taskInputStore
+}
+
+var taskInputStore = map[string]string{}
+
 func fakeServerTools() []toolInfo {
 	return []toolInfo{
 		{
@@ -96,6 +161,16 @@ func fakeServerTools() []toolInfo {
 			Description: "Responds after a delay",
 			InputSchema: json.RawMessage(`{"type":"object","properties":{}}`),
 		},
+		{
+			Name:        "need_input",
+			Description: "Requires user input (2026-07-28 resultType)",
+			InputSchema: json.RawMessage(`{"type":"object","properties":{}}`),
+		},
+		{
+			Name:        "legacy_ask",
+			Description: "Requires user input (legacy content block)",
+			// 故意无 InputSchema：触发 manager 的合成默认 schema 路径。
+		},
 	}
 }
 

runtime/mcp/http.go

@@ -21,6 +21,8 @@ type httpClient struct {
 	sessionID string
 	mu        sync.Mutex
 	nextID    int64
+	// negotiated 握手后写入（atomic.Value 存 string）。
+	negotiated atomic.Value
 }
 
 // DialHTTP 建立 HTTP 客户端并完成 initialize 握手。
@@ -51,6 +53,9 @@ func (c *httpClient) handshake(ctx context.Context) error {
 		ProtocolVersion: ProtocolVersion,
 		ClientInfo:      clientInfo{Name: "agent-native", Version: "1"},
 	}, &res)
+	if err == nil {
+		c.negotiated.Store(res.ProtocolVersion)
+	}
 	return err
 }
 
@@ -60,9 +65,32 @@ func (c *httpClient) Initialize(ctx context.Context) (initializeResult, error) {
 		ProtocolVersion: ProtocolVersion,
 		ClientInfo:      clientInfo{Name: "agent-native", Version: "1"},
 	}, &res)
+	if err == nil {
+		c.negotiated.Store(res.ProtocolVersion)
+	}
 	return res, err
 }
 
+// NegotiatedVersion 是握手后服务端确认的协议版本（未握手为空）。
+func (c *httpClient) NegotiatedVersion() string { return c.negotiated.Load().(string) }
+
+// TasksGet 查询长任务状态（2026-07-28）。
+func (c *httpClient) TasksGet(ctx context.Context, taskID string) (taskResult, error) {
+	var res taskResult
+	err := c.roundTrip(ctx, "tasks/get", map[string]string{"taskId": taskID}, &res)
+	return res, err
+}
+
+// TasksUpdate 向长任务投递用户输入（2026-07-28）。
+func (c *httpClient) TasksUpdate(ctx context.Context, taskID, input string) error {
+	return c.roundTrip(ctx, "tasks/update", map[string]string{"taskId": taskID, "input": input}, nil)
+}
+
+// TasksCancel 取消长任务（2026-07-28）。
+func (c *httpClient) TasksCancel(ctx context.Context, taskID string) error {
+	return c.roundTrip(ctx, "tasks/cancel", map[string]string{"taskId": taskID}, nil)
+}
+
 func (c *httpClient) ListTools(ctx context.Context) ([]toolInfo, error) {
 	var out []toolInfo
 	cursor := ""

runtime/mcp/manager.go

@@ -173,7 +173,7 @@ func (m *Manager) registerServer(ctx context.Context, reg *tools.Registry, cfg S
 		}
 		schema := ti.InputSchema
 		if len(schema) == 0 {
-			schema = json.RawMessage(`{"type":"object","properties":{}}`)
+			schema = json.RawMessage(`{"$schema":"https://json-schema.org/draft/2020-12/schema","type":"object","properties":{}}`)
 		}
 		reg.Register(&bridgeTool{
 			client:      c,
@@ -251,7 +251,11 @@ func (t *bridgeTool) Execute(ctx context.Context, args json.RawMessage) (tools.R
 	if err != nil {
 		return tools.Result{Content: fmt.Sprintf("mcp tool %s failed: %v", t.declName, err), IsError: true}, nil
 	}
-	if question, ok := inputQuestion(res); ok {
+	// input_required：2026-07-28 协议级结果（取应答后先 tasks/update 再
+	// 用原参数重试 tools/call）；旧版内容块路径保持原样。
+	if question, ok := inputQuestion(res, t.client.NegotiatedVersion()); ok && res.ResultType == "input_required" && SupportsResultType(t.client.NegotiatedVersion()) {
+		return t.answerAndRetry(ctx, args, res, question)
+	} else if ok {
 		ask := askFrom(ctx)
 		if ask == nil {
 			return tools.Result{Content: "需要用户输入：" + question, IsError: true}, nil
@@ -279,8 +283,58 @@ func (t *bridgeTool) Execute(ctx context.Context, args json.RawMessage) (tools.R
 	return tools.Result{Content: out}, nil
 }
 
+// maxInputRounds 是 input_required 应答重试的上限（防服务端循环要输入）。
+const maxInputRounds = 3
+
+// answerAndRetry 处理 2026-07-28 的协议级 input_required：经 ask 端口取
+// 应答，TaskID 非空时先 tasks/update 投递，然后用原参数重试 tools/call；
+// 服务端连续要输入最多 maxInputRounds 轮。
+func (t *bridgeTool) answerAndRetry(ctx context.Context, args json.RawMessage, res callToolResult, question string) (tools.Result, error) {
+	for round := 0; round < maxInputRounds; round++ {
+		ask := askFrom(ctx)
+		if ask == nil {
+			return tools.Result{Content: "需要用户输入：" + question, IsError: true}, nil
+		}
+		answer, aerr := ask(ctx, question)
+		if aerr != nil {
+			return tools.Result{Content: aerr.Error(), IsError: true}, nil
+		}
+		if res.TaskID != "" {
+			if uerr := t.client.TasksUpdate(ctx, res.TaskID, answer); uerr != nil {
+				return tools.Result{Content: fmt.Sprintf("mcp task update failed: %v", uerr), IsError: true}, nil
+			}
+		}
+		var err error
+		res, err = t.call(ctx, args)
+		if err != nil {
+			return tools.Result{Content: fmt.Sprintf("mcp tool %s failed: %v", t.declName, err), IsError: true}, nil
+		}
+		q, ok := inputQuestion(res, t.client.NegotiatedVersion())
+		if !ok || res.ResultType != "input_required" || !SupportsResultType(t.client.NegotiatedVersion()) {
+			var b strings.Builder
+			for _, blk := range res.Content {
+				if blk.Type == "text" && blk.Text != "" {
+					b.WriteString(blk.Text)
+					b.WriteString("\n")
+				}
+			}
+			out := b.String()
+			if res.IsError {
+				return tools.Result{Content: out, IsError: true}, nil
+			}
+			return tools.Result{Content: strings.TrimSpace(out)}, nil
+		}
+		question = q
+	}
+	return tools.Result{Content: "需要用户输入：" + question, IsError: true}, nil
+}
+
 func (t *bridgeTool) call(ctx context.Context, args json.RawMessage) (callToolResult, error) {
 	callCtx, cancel := context.WithTimeout(ctx, requestTimeout(t.serverCfg))
 	defer cancel()
-	return t.client.CallTool(callCtx, t.toolName, args)
+	res, err := t.client.CallTool(callCtx, t.toolName, args)
+	if err == nil && res.TaskID != "" {
+		trackerFrom(ctx).note(t.client, res.TaskID)
+	}
+	return res, err
 }

runtime/mcp/mcp_test.go

@@ -45,7 +45,7 @@ func TestStdioClientHandshakeListAndCall(t *testing.T) {
 	defer c.Close()
 
 	list, err := c.ListTools(ctx)
-	if err != nil || len(list) != 3 || list[0].Name != "echo" {
+	if err != nil || len(list) != 5 || list[0].Name != "echo" {
 		t.Fatalf("list failed: %v %+v", err, list)
 	}
 	res, err := c.CallTool(ctx, "echo", json.RawMessage(`{"text":"hi"}`))
@@ -133,7 +133,7 @@ func TestHTTPClientJSONMode(t *testing.T) {
 		t.Fatalf("session id must be captured, got %q", c.sessionID)
 	}
 	list, err := c.ListTools(ctx)
-	if err != nil || len(list) != 3 {
+	if err != nil || len(list) != 5 {
 		t.Fatalf("list failed: %v %+v", err, list)
 	}
 	res, err := c.CallTool(ctx, "echo", json.RawMessage(`{"text":"net"}`))
@@ -159,7 +159,7 @@ func TestHTTPClientSSEMode(t *testing.T) {
 	}
 	defer c.Close()
 	list, err := c.ListTools(ctx)
-	if err != nil || len(list) != 3 {
+	if err != nil || len(list) != 5 {
 		t.Fatalf("sse list failed: %v %+v", err, list)
 	}
 }
@@ -361,8 +361,14 @@ type askClient struct{}
 func (askClient) Initialize(context.Context) (initializeResult, error) {
 	return initializeResult{}, nil
 }
+func (askClient) NegotiatedVersion() string                     { return LegacyProtocolVersion }
 func (askClient) ListTools(context.Context) ([]toolInfo, error) { return nil, nil }
 func (askClient) Close() error                                  { return nil }
+func (askClient) TasksGet(context.Context, string) (taskResult, error) {
+	return taskResult{}, nil
+}
+func (askClient) TasksUpdate(context.Context, string, string) error { return nil }
+func (askClient) TasksCancel(context.Context, string) error         { return nil }
 func (askClient) CallTool(context.Context, string, json.RawMessage) (callToolResult, error) {
 	return callToolResult{Content: []contentBlock{{Type: "input_required", Text: "选一个颜色"}}}, nil
 }
@@ -378,3 +384,150 @@ func TestInputRequiredUsesAsk(t *testing.T) {
 		t.Fatalf("ask result %+v %v", res, err)
 	}
 }
+
+// ---- N2 WP3：2026-07-28 对齐 ----
+
+// 协议级 input_required：ask 取应答 → tasks/update 投递 → 原参数重试得终结果。
+func TestInputRequiredResultTypeRetriesOriginalCall(t *testing.T) {
+	mgr, err := NewManager([]ServerConfig{fakeStdioConfig(t)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer mgr.Close()
+	reg := tools.NewRegistry("")
+	if err := mgr.RegisterInto(context.Background(), reg); err != nil {
+		t.Fatal(err)
+	}
+	var questions []string
+	ctx := WithAsk(context.Background(), func(_ context.Context, q string) (string, error) {
+		questions = append(questions, q)
+		return "蓝色", nil
+	})
+	res := reg.Execute(ctx, "mcp__fake__need_input", json.RawMessage(`{}`))
+	if res.IsError || res.Content != "答案已收到: 蓝色" {
+		t.Fatalf("final result: %+v", res)
+	}
+	if len(questions) != 1 || questions[0] != "要答案" {
+		t.Fatalf("ask questions: %v", questions)
+	}
+}
+
+// 协商回落：服务端只讲 2024-11-05 时，协议级路径不启用，旧内容块路径不变。
+func TestNegotiatedVersionFallbackKeepsLegacyPath(t *testing.T) {
+	cfg := fakeStdioConfig(t)
+	cfg.Env = append(cfg.Env, "AGENT_NATIVE_TEST_MCP_VERSION="+LegacyProtocolVersion)
+	mgr, err := NewManager([]ServerConfig{cfg})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer mgr.Close()
+	reg := tools.NewRegistry("")
+	if err := mgr.RegisterInto(context.Background(), reg); err != nil {
+		t.Fatal(err)
+	}
+	ctx := WithAsk(context.Background(), func(_ context.Context, q string) (string, error) {
+		return "蓝色", nil
+	})
+	res := reg.Execute(ctx, "mcp__fake__legacy_ask", json.RawMessage(`{}`))
+	if res.IsError || res.Content != "蓝色" {
+		t.Fatalf("legacy path: %+v", res)
+	}
+}
+
+// tasks 客户端面：get 回状态、cancel 清除任务输入。
+func TestTasksGetAndCancelRoundTrip(t *testing.T) {
+	cfg := fakeStdioConfig(t)
+	ctx := context.Background()
+	c, err := DialStdio(ctx, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer c.Close()
+	if got := c.NegotiatedVersion(); !SupportsResultType(got) {
+		t.Fatalf("negotiated = %q, want >= 2026-07-28", got)
+	}
+	if err := c.TasksUpdate(ctx, "task-x", "输入"); err != nil {
+		t.Fatal(err)
+	}
+	tr, err := c.TasksGet(ctx, "task-x")
+	if err != nil || tr.TaskID != "task-x" || tr.Status != "running" {
+		t.Fatalf("tasks/get: %+v %v", tr, err)
+	}
+	if err := c.TasksCancel(ctx, "task-x"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// 合成默认 schema 声明 JSON Schema 2020-12。
+func TestDefaultSchemaDeclares202012(t *testing.T) {
+	mgr, err := NewManager([]ServerConfig{fakeStdioConfig(t)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer mgr.Close()
+	reg := tools.NewRegistry("")
+	if err := mgr.RegisterInto(context.Background(), reg); err != nil {
+		t.Fatal(err)
+	}
+	for _, d := range reg.Decls() {
+		if d.Name == "mcp__fake__legacy_ask" {
+			// legacy_ask 在 fake 里无 InputSchema → 走合成默认
+			if !strings.Contains(string(d.Parameters), "2020-12") {
+				t.Fatalf("默认 schema 未声明 2020-12：%s", d.Parameters)
+			}
+			return
+		}
+	}
+	t.Fatal("mcp__fake__legacy_ask not registered")
+}
+
+// 任务跟踪器：记录 → 按服务端分组取消 → 清空。
+func TestTaskTrackerCancelAllPerRun(t *testing.T) {
+	cfg := fakeStdioConfig(t)
+	ctx := context.Background()
+	c, err := DialStdio(ctx, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer c.Close()
+	tr := &TaskTracker{seen: map[Client]map[string]struct{}{}}
+	if err := c.TasksUpdate(ctx, "task-a", "1"); err != nil {
+		t.Fatal(err)
+	}
+	if err := c.TasksUpdate(ctx, "task-b", "2"); err != nil {
+		t.Fatal(err)
+	}
+	tr.note(c, "task-a")
+	tr.note(c, "task-b")
+	tr.note(c, "task-a") // 幂等
+	if n := tr.CancelAll(ctx); n != 2 {
+		t.Fatalf("CancelAll = %d, want 2", n)
+	}
+	if n := tr.CancelAll(ctx); n != 0 {
+		t.Fatalf("第二次 CancelAll 应为 0，得到 %d", n)
+	}
+}
+
+// 端到端：经注册表执行 input_required 工具的 run 结束时，task-1 被取消。
+func TestRunEndCancelsSeenTasks(t *testing.T) {
+	cfg := fakeStdioConfig(t)
+	mgr, err := NewManager([]ServerConfig{cfg})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer mgr.Close()
+	reg := tools.NewRegistry("")
+	if err := mgr.RegisterInto(context.Background(), reg); err != nil {
+		t.Fatal(err)
+	}
+	ctx, tr := WithTaskTracker(context.Background())
+	ctx = WithAsk(ctx, func(_ context.Context, q string) (string, error) { return "蓝", nil })
+	res := reg.Execute(ctx, "mcp__fake__need_input", json.RawMessage(`{}`))
+	if res.IsError {
+		t.Fatalf("execute: %+v", res)
+	}
+	// 模仿 adapter run 结束：取消本 run 见过的任务（task-1 已被记录）。
+	if n := tr.CancelAll(context.Background()); n != 1 {
+		t.Fatalf("CancelAll = %d, want 1（task-1）", n)
+	}
+}

runtime/mcp/protocol.go

@@ -12,8 +12,18 @@ import (
 	"time"
 )
 
-// ProtocolVersion 是本客户端声明的 MCP 协议版本。
-const ProtocolVersion = "2024-11-05"
+// ProtocolVersion 是本客户端声明的 MCP 协议版本（2026-07-28 RC：
+// resultType 判别、input_required 协议级结果、tasks/* 长任务面）。
+const ProtocolVersion = "2026-07-28"
+
+// LegacyProtocolVersion 是旧版协议（无 resultType/tasks），协商回落时用。
+const LegacyProtocolVersion = "2024-11-05"
+
+// SupportsResultType 报告协商版本是否支持 2026-07-28 的 resultType 语义
+// （ISO 日期版本按字典序可比）。
+func SupportsResultType(negotiated string) bool {
+	return negotiated >= "2026-07-28"
+}
 
 // ServerConfig 声明一个 MCP server 接入点：Command（stdio）或 URL（HTTP）二选一。
 type ServerConfig struct {
@@ -138,6 +148,19 @@ type callToolParams struct {
 type callToolResult struct {
 	Content []contentBlock `json:"content"`
 	IsError bool           `json:"isError,omitempty"`
+	// ResultType 是 2026-07-28 的协议级结果判别（空 = 普通结果）。
+	// "input_required" 表示服务端需要用户输入：客户端经 ask 端口取得
+	// 应答后（有 TaskID 时先 tasks/update）用原参数重试 tools/call。
+	ResultType string `json:"resultType,omitempty"`
+	TaskID     string `json:"taskId,omitempty"`
+}
+
+// taskResult 是 tasks/get 的返回（2026-07-28 长任务面；字段集按 RC 常用
+// 形态解析，未识别字段忽略）。
+type taskResult struct {
+	TaskID string `json:"taskId"`
+	Status string `json:"status"`
+	Detail string `json:"detail,omitempty"`
 }
 
 type contentBlock struct {
@@ -148,7 +171,13 @@ type contentBlock struct {
 // Client 是一个已连接 MCP server 的最小面（initialize / tools/list / tools/call）。
 type Client interface {
 	Initialize(ctx context.Context) (initializeResult, error)
+	// NegotiatedVersion 是 initialize 后服务端确认的协议版本（未握手为空）。
+	NegotiatedVersion() string
 	ListTools(ctx context.Context) ([]toolInfo, error)
 	CallTool(ctx context.Context, name string, args json.RawMessage) (callToolResult, error)
+	// TasksGet/Update/Cancel 是 2026-07-28 的长任务面。
+	TasksGet(ctx context.Context, taskID string) (taskResult, error)
+	TasksUpdate(ctx context.Context, taskID, input string) error
+	TasksCancel(ctx context.Context, taskID string) error
 	Close() error
 }

runtime/mcp/r2_regression_test.go

@@ -18,8 +18,14 @@ type flakyClient struct {
 func (f *flakyClient) Initialize(context.Context) (initializeResult, error) {
 	return initializeResult{}, nil
 }
+func (f *flakyClient) NegotiatedVersion() string                     { return ProtocolVersion }
 func (f *flakyClient) ListTools(context.Context) ([]toolInfo, error) { return nil, nil }
 func (f *flakyClient) Close() error                                  { return nil }
+func (f *flakyClient) TasksGet(context.Context, string) (taskResult, error) {
+	return taskResult{}, nil
+}
+func (f *flakyClient) TasksUpdate(context.Context, string, string) error { return nil }
+func (f *flakyClient) TasksCancel(context.Context, string) error         { return nil }
 func (f *flakyClient) CallTool(context.Context, string, json.RawMessage) (callToolResult, error) {
 	f.calls++
 	if f.fail {

runtime/mcp/stdio.go

@@ -25,6 +25,8 @@ type stdioClient struct {
 	readers    atomic.Int32
 	closed     bool
 	readerOnce sync.Once
+	// negotiated 握手后写入（atomic.Value 存 string）。
+	negotiated atomic.Value
 }
 
 type stdioResult struct {
@@ -75,6 +77,7 @@ func (c *stdioClient) handshake(ctx context.Context) error {
 	}, &res); err != nil {
 		return err
 	}
+	c.negotiated.Store(res.ProtocolVersion)
 	// initialized 通知无需响应。
 	return c.notify("notifications/initialized")
 }
@@ -86,9 +89,32 @@ func (c *stdioClient) Initialize(ctx context.Context) (initializeResult, error)
 		ProtocolVersion: ProtocolVersion,
 		ClientInfo:      clientInfo{Name: "agent-native", Version: "1"},
 	}, &res)
+	if err == nil {
+		c.negotiated.Store(res.ProtocolVersion)
+	}
 	return res, err
 }
 
+// NegotiatedVersion 是握手后服务端确认的协议版本（未握手为空）。
+func (c *stdioClient) NegotiatedVersion() string { return c.negotiated.Load().(string) }
+
+// TasksGet 查询长任务状态（2026-07-28）。
+func (c *stdioClient) TasksGet(ctx context.Context, taskID string) (taskResult, error) {
+	var res taskResult
+	err := c.roundTrip(ctx, "tasks/get", map[string]string{"taskId": taskID}, &res)
+	return res, err
+}
+
+// TasksUpdate 向长任务投递用户输入（2026-07-28）。
+func (c *stdioClient) TasksUpdate(ctx context.Context, taskID, input string) error {
+	return c.roundTrip(ctx, "tasks/update", map[string]string{"taskId": taskID, "input": input}, nil)
+}
+
+// TasksCancel 取消长任务（2026-07-28）。
+func (c *stdioClient) TasksCancel(ctx context.Context, taskID string) error {
+	return c.roundTrip(ctx, "tasks/cancel", map[string]string{"taskId": taskID}, nil)
+}
+
 func (c *stdioClient) ListTools(ctx context.Context) ([]toolInfo, error) {
 	var out []toolInfo
 	cursor := ""

runtime/mcp/tasks.go

@@ -0,0 +1,65 @@
+package mcp
+
+import (
+	"context"
+	"sync"
+)
+
+// TaskTracker 记录一次 run 内 tools/call 结果里出现过的长任务（按服务端
+// 客户端分组），供 run 结束时对这些任务发 tasks/cancel（2026-07-28 最小
+// 产品映射：取消只覆盖本 run 自己的任务，不影响共享 Manager 上其他 run）。
+type TaskTracker struct {
+	mu   sync.Mutex
+	seen map[Client]map[string]struct{}
+}
+
+type trackerKey struct{}
+
+// WithTaskTracker 把任务跟踪器放进上下文（bridgeTool 记录 TaskID）。
+func WithTaskTracker(ctx context.Context) (context.Context, *TaskTracker) {
+	tr := &TaskTracker{seen: map[Client]map[string]struct{}{}}
+	return context.WithValue(ctx, trackerKey{}, tr), tr
+}
+
+func trackerFrom(ctx context.Context) *TaskTracker {
+	if ctx == nil {
+		return nil
+	}
+	tr, _ := ctx.Value(trackerKey{}).(*TaskTracker)
+	return tr
+}
+
+func (t *TaskTracker) note(c Client, taskID string) {
+	if t == nil || c == nil || taskID == "" {
+		return
+	}
+	t.mu.Lock()
+	set := t.seen[c]
+	if set == nil {
+		set = map[string]struct{}{}
+		t.seen[c] = set
+	}
+	set[taskID] = struct{}{}
+	t.mu.Unlock()
+}
+
+// CancelAll 对记录的任务逐一向其服务端发 tasks/cancel（尽力而为，
+// 首个错误后继续）。返回实际发出取消的任务数。
+func (t *TaskTracker) CancelAll(ctx context.Context) int {
+	if t == nil {
+		return 0
+	}
+	t.mu.Lock()
+	seen := t.seen
+	t.seen = map[Client]map[string]struct{}{}
+	t.mu.Unlock()
+	n := 0
+	for c, ids := range seen {
+		for id := range ids {
+			if err := c.TasksCancel(ctx, id); err == nil {
+				n++
+			}
+		}
+	}
+	return n
+}

runtime/memory/memory.go

@@ -0,0 +1,83 @@
+// Package memory 定义记忆端口（N3 WP5）。宿主注入 Store 实现；循环在每次
+// 请求前把 Recall 结果以系统消息注入请求副本（不落盘、不累计——与
+// reminders 同款的 request-scoped 语义）；nil = 不启用。
+//
+// 注入文案与产品既有 [记忆] 形态对齐（迁移前后同文）：
+//
+//	[记忆]
+//	- (typ) content
+//
+// 排序确定性：按 (Type, Content) 字典序（同一 Recall 结果集在任何
+// 消费方下渲染一致）。
+package memory
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Entry 是一条记忆。Scope 为 user 或 project。
+type Entry struct {
+	ID         string
+	Scope      string
+	ProjectID  string
+	Type       string
+	Content    string
+	Source     string
+	Confidence float64
+	CreatedAt  time.Time
+	ExpiresAt  *time.Time
+}
+
+// RecallQuery 是一次召回。Scope 空 = 不限（含 user/project）；Limit ≤0 = 20。
+type RecallQuery struct {
+	Scope string
+	Limit int
+}
+
+// Store 是记忆端口。实现方自担 owner/项目上下文（循环不传租户态）。
+type Store interface {
+	Recall(ctx context.Context, q RecallQuery) ([]Entry, error)
+	Append(ctx context.Context, e Entry) error
+}
+
+// MaxRecallEntries 是注入的条目上限（与产品既有形态一致）。
+const MaxRecallEntries = 20
+
+// Block 把一次 Recall 结果渲染成注入文本；空结果返回空串（调用方不注入）。
+// 过期与空内容条目在渲染时剔除（与产品既有 InjectMemory 同语义）。
+func Block(entries []Entry, now time.Time) string {
+	live := make([]Entry, 0, len(entries))
+	for _, e := range entries {
+		if e.ExpiresAt != nil && !e.ExpiresAt.After(now) {
+			continue
+		}
+		if strings.TrimSpace(e.Content) == "" {
+			continue
+		}
+		live = append(live, e)
+	}
+	if len(live) == 0 {
+		return ""
+	}
+	sort.Slice(live, func(i, j int) bool {
+		if live[i].Type != live[j].Type {
+			return live[i].Type < live[j].Type
+		}
+		return live[i].Content < live[j].Content
+	})
+	var b strings.Builder
+	b.WriteString("[记忆]\n")
+	n := 0
+	for _, e := range live {
+		fmt.Fprintf(&b, "- (%s) %s\n", e.Type, strings.TrimSpace(e.Content))
+		n++
+		if n >= MaxRecallEntries {
+			break
+		}
+	}
+	return b.String()
+}

runtime/memory/memory_test.go

@@ -0,0 +1,91 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+)
+
+// ---- N3 WP5：记忆端口 ----
+
+type fakeStore struct {
+	entries  []Entry
+	appended []Entry
+	recallQ  RecallQuery
+	err      error
+}
+
+func (f *fakeStore) Recall(_ context.Context, q RecallQuery) ([]Entry, error) {
+	f.recallQ = q
+	return f.entries, f.err
+}
+func (f *fakeStore) Append(_ context.Context, e Entry) error {
+	f.appended = append(f.appended, e)
+	return nil
+}
+
+func TestBlockRenderOrderingAndCaps(t *testing.T) {
+	future := time.Now().Add(24 * time.Hour)
+	past := time.Now().Add(-24 * time.Hour)
+	entries := []Entry{
+		{Type: "preference", Content: "喜欢简洁回复"},
+		{Type: "fact", Content: "项目用 Go 1.27"},
+		{Type: "fact", Content: "  "},
+		{Type: "fact", Content: "过期了", ExpiresAt: &past},
+		{Type: "fact", Content: "没过期", ExpiresAt: &future},
+	}
+	out := Block(entries, time.Now())
+	if !strings.Contains(out, "[记忆]\n") {
+		t.Fatalf("缺块头：%q", out)
+	}
+	// 确定性排序：Type 字典序（fact 先于 preference）；过期与空内容剔除。
+	firstFact := strings.Index(out, "fact")
+	firstPref := strings.Index(out, "preference")
+	if firstFact < 0 || firstPref < 0 || firstFact > firstPref {
+		t.Fatalf("排序不确定：%q", out)
+	}
+	if strings.Contains(out, "过期了") {
+		t.Fatalf("过期条目未剔除：%q", out)
+	}
+	if !strings.Contains(out, "没过期") {
+		t.Fatalf("未过期条目被误剔：%q", out)
+	}
+	if Block(nil, time.Now()) != "" {
+		t.Fatal("空结果应为空串")
+	}
+}
+
+func TestWriteToolValidation(t *testing.T) {
+	store := &fakeStore{}
+	tool := &writeTool{store: store}
+	cases := []struct {
+		name    string
+		args    string
+		wantErr string
+	}{
+		{"坏 scope", `{"scope":"global","type":"fact","content":"x"}`, "user 或 project"},
+		{"坏 type", `{"type":"todo","content":"x"}`, "fact|preference"},
+		{"空 content", `{"type":"fact","content":"  "}`, "非空"},
+		{"超长 content", `{"type":"fact","content":"` + strings.Repeat("长", 2001) + `"}`, "上限"},
+	}
+	for _, tc := range cases {
+		res, err := tool.Execute(context.Background(), json.RawMessage(tc.args))
+		if err != nil || !res.IsError || !strings.Contains(res.Content, tc.wantErr) {
+			t.Fatalf("%s：%+v %v", tc.name, res, err)
+		}
+	}
+	if len(store.appended) != 0 {
+		t.Fatalf("校验失败不得落库：%+v", store.appended)
+	}
+	// 合法路径：默认 scope=user + 过期换算。
+	res, err := tool.Execute(context.Background(), json.RawMessage(`{"type":"preference","content":"喜欢简洁","expires_in_days":30}`))
+	if err != nil || res.IsError {
+		t.Fatalf("合法写入被拒：%+v %v", res, err)
+	}
+	if len(store.appended) != 1 || store.appended[0].Scope != "user" ||
+		store.appended[0].Type != "preference" || store.appended[0].ExpiresAt == nil {
+		t.Fatalf("写入形态：%+v", store.appended)
+	}
+}

runtime/memory/write.go

@@ -0,0 +1,93 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"agent-native/runtime/tools"
+)
+
+// memory_write 工具：模型自服务写回（fail-closed 校验 scope/type/content）。
+// 只在宿主配置 Store 时注册（RegisterWrite 由循环在 Run 启动时接线）。
+type writeTool struct {
+	store Store
+	scope string // 默认 scope（AgentSpec.MemoryScope 驱动；空 = user）
+}
+
+var validScopes = map[string]bool{"user": true, "project": true}
+var validTypes = map[string]bool{
+	"fact": true, "preference": true, "decision": true, "episode": true, "procedure": true,
+}
+
+// RegisterWrite 把 memory_write 注册进 reg（store nil 时跳过；重复注册按
+// 覆盖处理——宿主不得在同一注册表上给不同 run 挂不同实现）。
+func RegisterWrite(reg *tools.Registry, store Store, defaultScope string) {
+	if reg == nil || store == nil {
+		return
+	}
+	reg.Register(&writeTool{store: store, scope: defaultScope})
+}
+
+func (t *writeTool) Name() string { return "memory_write" }
+func (t *writeTool) Description() string {
+	return "把一条值得跨会话记住的事实/偏好/决定写入长期记忆（scope: user 或 project；type: fact|preference|decision|episode|procedure）。"
+}
+func (t *writeTool) Parameters() json.RawMessage {
+	return json.RawMessage(`{"type":"object","required":["type","content"],"properties":{
+		"scope":{"type":"string"},
+		"type":{"type":"string"},
+		"content":{"type":"string"},
+		"expires_in_days":{"type":"number"}
+	}}`)
+}
+
+// maxWriteContent 是单条记忆的内容上限（字符）。
+const maxWriteContent = 2000
+
+func (t *writeTool) Execute(ctx context.Context, args json.RawMessage) (tools.Result, error) {
+	var a struct {
+		Scope          string  `json:"scope"`
+		Type           string  `json:"type"`
+		Content        string  `json:"content"`
+		ExpiresInDays  float64 `json:"expires_in_days"`
+	}
+	if err := json.Unmarshal(args, &a); err != nil {
+		return tools.Result{Content: "memory_write: 参数不是完整 JSON 对象", IsError: true}, nil
+	}
+	scope := strings.TrimSpace(a.Scope)
+	if scope == "" {
+		scope = t.scope
+	}
+	if scope == "" {
+		scope = "user"
+	}
+	if !validScopes[scope] {
+		return tools.Result{Content: fmt.Sprintf("memory_write: scope %q 必须是 user 或 project", scope), IsError: true}, nil
+	}
+	typ := strings.TrimSpace(a.Type)
+	if !validTypes[typ] {
+		return tools.Result{Content: fmt.Sprintf("memory_write: type %q 必须是 fact|preference|decision|episode|procedure 之一", typ), IsError: true}, nil
+	}
+	content := strings.TrimSpace(a.Content)
+	if content == "" {
+		return tools.Result{Content: "memory_write: content 必填且非空", IsError: true}, nil
+	}
+	if len([]rune(content)) > maxWriteContent {
+		return tools.Result{Content: fmt.Sprintf("memory_write: content 超过 %d 字符上限", maxWriteContent), IsError: true}, nil
+	}
+	var expires *time.Time
+	if a.ExpiresInDays > 0 {
+		t := time.Now().Add(time.Duration(a.ExpiresInDays*24) * time.Hour)
+		expires = &t
+	}
+	if err := t.store.Append(ctx, Entry{
+		Scope: scope, Type: typ, Content: content,
+		Source: "agent", CreatedAt: time.Now(), ExpiresAt: expires,
+	}); err != nil {
+		return tools.Result{Content: "memory_write: " + err.Error(), IsError: true}, nil
+	}
+	return tools.Result{Content: fmt.Sprintf("已记住（scope=%s type=%s）", scope, typ)}, nil
+}

runtime/memory_n3_test.go

@@ -0,0 +1,96 @@
+package runtime
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"agent-native/runtime/llm"
+	"agent-native/runtime/memory"
+	"agent-native/runtime/tools"
+)
+
+// ---- N3 WP5：循环消费点（注入 + memory_write 接线）----
+
+type loopMemStore struct {
+	entries  []memory.Entry
+	appended []memory.Entry
+}
+
+func (s *loopMemStore) Recall(_ context.Context, q memory.RecallQuery) ([]memory.Entry, error) {
+	return s.entries, nil
+}
+func (s *loopMemStore) Append(_ context.Context, e memory.Entry) error {
+	s.appended = append(s.appended, e)
+	return nil
+}
+
+// 端口注入的条目出现在请求副本系统段之后；nil 端口零变化；
+// Run 启动注册 memory_write 且可调用。
+func TestLoopInjectsMemoryAndRegistersWrite(t *testing.T) {
+	store := &loopMemStore{entries: []memory.Entry{{Type: "fact", Content: "项目用 Go 1.27"}}}
+	reg := tools.NewRegistry(t.TempDir())
+	var gotReq [][]llm.Message
+	res, err := Run(context.Background(), Config{
+		Model: "fake", Tools: reg, Memory: store, MaxTurns: 2,
+		Stream: func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+			gotReq = append(gotReq, append([]llm.Message{}, msgs...))
+			ch := make(chan llm.Event, 1)
+			ch <- llm.Event{Kind: llm.KindMessageEnd, Message: llm.Message{
+				Role: llm.RoleAssistant, StopReason: llm.StopToolCalls,
+				ToolCalls: []llm.ToolCall{{ID: "c1", Name: "memory_write", Arguments: `{"type":"fact","content":"主人喜欢简洁"}`}},
+			}}
+			close(ch)
+			return ch
+		},
+	}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = res
+	if len(gotReq) < 1 {
+		t.Fatalf("请求次数 = %d", len(gotReq))
+	}
+	req := gotReq[0]
+	// [记忆] 块在系统段之后、历史之前。
+	sysEnd := 0
+	for sysEnd < len(req) && req[sysEnd].Role == llm.RoleSystem {
+		sysEnd++
+	}
+	var found bool
+	for i := 0; i < sysEnd; i++ {
+		if strings.Contains(req[i].Content, "[记忆]") && strings.Contains(req[i].Content, "项目用 Go 1.27") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("记忆块未注入系统段：%#v", req)
+	}
+	// memory_write 已被注册并执行（脚本化模型每轮都点名它 → 至少一次）。
+	if len(store.appended) < 1 || store.appended[0].Content != "主人喜欢简洁" {
+		t.Fatalf("memory_write 未执行：%+v", store.appended)
+	}
+}
+
+// 空召回：不产生 [记忆] 块（注入静默跳过）；nil 端口同语义。
+func TestEmptyRecallInjectsNothing(t *testing.T) {
+	reg := tools.NewRegistry(t.TempDir())
+	var gotReq []llm.Message
+	if _, err := Run(context.Background(), Config{
+		Model: "fake", Tools: reg, Memory: &loopMemStore{},
+		Stream: func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+			gotReq = append([]llm.Message{}, msgs...)
+			ch := make(chan llm.Event, 1)
+			ch <- llm.Event{Kind: llm.KindMessageEnd, Message: llm.Message{Role: llm.RoleAssistant, Content: "x", StopReason: llm.StopEnd}}
+			close(ch)
+			return ch
+		},
+	}, llm.Message{Role: llm.RoleUser, Content: "go"}); err != nil {
+		t.Fatal(err)
+	}
+	for _, m := range gotReq {
+		if strings.Contains(m.Content, "[记忆]") {
+			t.Fatalf("空召回不得产生记忆块：%#v", gotReq)
+		}
+	}
+}

runtime/resources/resources_test.go

@@ -61,7 +61,7 @@ func TestPiAliasesFilterAndSkillCommand(t *testing.T) {
 	if err := os.MkdirAll(skillDir, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte("be thorough"), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte("---\nname: review\ndescription: 评审技能\n---\n\nbe thorough"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	store := skills.NewStore(dir)

runtime/session/microcompact.go

@@ -1,6 +1,12 @@
 package session
 
-import "agent-native/runtime/llm"
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"agent-native/runtime/llm"
+)
 
 const (
 	// DefaultKeepToolResults 是运行内清理时保留的最近工具结果条数。
@@ -42,6 +48,14 @@ func NeedsClear(estimate, window, outputReserve, buffer int) bool {
 // 消息条数、顺序和 tool_call 配对都不变；占位写明完整结果仍在会话记录里。
 // keep ≤ 0 时保留默认的 5 条。返回的切片不与输入共享被改写的消息。
 func ClearOldToolResults(msgs []llm.Message, keep int) []llm.Message {
+	return ClearOldToolResultsTo(msgs, keep, "")
+}
+
+// ClearOldToolResultsTo 在 ClearOldToolResults 的基础上支持落盘：
+// dir 非空时，把被清理结果的完整内容写进 <dir>/<toolCallID>.txt，
+// 占位改为路径指引（ZCode 式「旧工具结果换成路径」）；
+// 写盘失败或调用 ID 为空时回落为转录指针占位，不阻断本轮。
+func ClearOldToolResultsTo(msgs []llm.Message, keep int, dir string) []llm.Message {
 	if keep <= 0 {
 		keep = DefaultKeepToolResults
 	}
@@ -60,6 +74,12 @@ func ClearOldToolResults(msgs []llm.Message, keep int) []llm.Message {
 		if name == "" {
 			name = "工具"
 		}
+		if dir != "" && out[i].ToolCallID != "" && out[i].Content != "" {
+			if path, ok := spillResult(dir, out[i].ToolCallID, out[i].Content); ok {
+				out[i].Content = "旧工具结果已清理。完整内容见 " + path + "（" + name + "）。"
+				continue
+			}
+		}
 		loc := "会话记录"
 		if out[i].ToolCallID != "" {
 			loc = "会话记录中的调用 " + out[i].ToolCallID
@@ -68,3 +88,28 @@ func ClearOldToolResults(msgs []llm.Message, keep int) []llm.Message {
 	}
 	return out
 }
+
+// spillResult 把一条旧工具结果写盘，返回路径。文件名只留安全字符。
+func spillResult(dir, callID, content string) (string, bool) {
+	var sb strings.Builder
+	for _, r := range callID {
+		switch {
+		case r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' ||
+			r == '-' || r == '_' || r == '.':
+			sb.WriteRune(r)
+		default:
+			sb.WriteByte('_')
+		}
+	}
+	if sb.Len() == 0 {
+		return "", false
+	}
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return "", false
+	}
+	path := filepath.Join(dir, sb.String()+".txt")
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		return "", false
+	}
+	return path, true
+}

runtime/session/microcompact_test.go

@@ -1,6 +1,8 @@
 package session
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -58,3 +60,77 @@ func TestNeedsClearUsesConservativeWindow(t *testing.T) {
 		t.Fatal("estimate at the default window must clear")
 	}
 }
+
+// ---- N2 WP1：旧工具结果落盘（路径占位）----
+
+func spillFixture() []llm.Message {
+	msgs := []llm.Message{{Role: llm.RoleUser, Content: "u"}}
+	for i := 0; i < 7; i++ {
+		id := "call-" + string(rune('a'+i))
+		msgs = append(msgs,
+			llm.Message{Role: llm.RoleAssistant, ToolCalls: []llm.ToolCall{{ID: id, Name: "read", Arguments: "{}"}}},
+			llm.Message{Role: llm.RoleTool, ToolCallID: id, Name: "read", Content: "完整结果内容-" + id})
+	}
+	return msgs
+}
+
+func TestClearOldToolResultsSpillsToDisk(t *testing.T) {
+	dir := t.TempDir()
+	out := ClearOldToolResultsTo(spillFixture(), 5, dir)
+	if len(out) != len(spillFixture()) {
+		t.Fatal("消息条数不得变")
+	}
+	// 最旧两条被落盘，占位带路径。
+	for i, id := range []string{"call-a", "call-b"} {
+		path := filepath.Join(dir, id+".txt")
+		b, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatalf("落盘文件缺失：%v", err)
+		}
+		if string(b) != "完整结果内容-"+id {
+			t.Fatalf("落盘内容不符：%q", b)
+		}
+		placeholder := out[2+i*2].Content
+		if !strings.Contains(placeholder, path) {
+			t.Fatalf("占位未带路径：%q", placeholder)
+		}
+	}
+	// 保留的最近 5 条正文不动。
+	if out[len(out)-1].Content != "完整结果内容-call-g" {
+		t.Fatalf("最近结果被误改：%q", out[len(out)-1].Content)
+	}
+}
+
+func TestClearOldToolResultsEmptyDirKeepsLegacyPlaceholder(t *testing.T) {
+	out := ClearOldToolResultsTo(spillFixture(), 5, "")
+	legacy := ClearOldToolResults(spillFixture(), 5)
+	for i := range out {
+		if out[i].Content != legacy[i].Content {
+			t.Fatalf("空 dir 应与旧行为逐字节一致：msg %d", i)
+		}
+	}
+}
+
+func TestClearOldToolResultsSpillFailureFallsBack(t *testing.T) {
+	// 不可写目录：占位回落为转录指针，不阻断。
+	blocked := filepath.Join(t.TempDir(), "file")
+	if err := os.WriteFile(blocked, []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	out := ClearOldToolResultsTo(spillFixture(), 5, filepath.Join(blocked, "sub"))
+	if !strings.Contains(out[2].Content, "会话记录中的调用 call-a") {
+		t.Fatalf("写盘失败应回落转录指针：%q", out[2].Content)
+	}
+}
+
+func TestSpillResultSanitizesCallID(t *testing.T) {
+	dir := t.TempDir()
+	path, ok := spillResult(dir, "call/../evil\x00id", "x")
+	if !ok {
+		t.Fatal("spill 失败")
+	}
+	base := filepath.Base(path)
+	if strings.Contains(base, "/") || strings.ContainsRune(base, 0) || filepath.Dir(path) != dir {
+		t.Fatalf("文件名未消毒或越出目录：%q", path)
+	}
+}

runtime/session/r2_regression_test.go

@@ -182,3 +182,42 @@ func TestR2AppendVisibleAfterReopen(t *testing.T) {
 		t.Fatalf("reopen: %+v", msgs)
 	}
 }
+
+// ---- N2 WP1：alignToolTail 边界直接单测（原仅经 Store.Compact 间接覆盖）----
+
+func tailMsgs() []llm.Message {
+	call := func(id string) llm.ToolCall { return llm.ToolCall{ID: id, Name: "read", Arguments: "{}"} }
+	return []llm.Message{
+		{Role: llm.RoleUser, Content: "u1"},                                                  // 0
+		{Role: llm.RoleAssistant, ToolCalls: []llm.ToolCall{call("a"), call("b")}},          // 1 多调用 assistant
+		{Role: llm.RoleTool, ToolCallID: "a", Content: "ra"},                                 // 2
+		{Role: llm.RoleTool, ToolCallID: "b", Content: "rb"},                                 // 3
+		{Role: llm.RoleUser, Content: "u2"},                                                  // 4
+		{Role: llm.RoleAssistant, ToolCalls: []llm.ToolCall{call("c")}},                     // 5
+		{Role: llm.RoleTool, ToolCallID: "c", Content: "rc"},                                 // 6
+	}
+}
+
+func TestAlignToolTailEdges(t *testing.T) {
+	msgs := tailMsgs()
+	// tail 恰落在多调用 assistant 的结果组内 → 回退到该 assistant。
+	if got := alignToolTail(msgs, 3); got != 1 {
+		t.Fatalf("落在多调用结果组内：got %d want 1", got)
+	}
+	// tail 落在结果组边界外（user）→ 不动。
+	if got := alignToolTail(msgs, 4); got != 4 {
+		t.Fatalf("落在 user 上：got %d want 4", got)
+	}
+	// 结尾整组是 tool 角色 → 回退到其 assistant。
+	if got := alignToolTail(msgs, 6); got != 5 {
+		t.Fatalf("落在末尾结果上：got %d want 5", got)
+	}
+	// 从头起全是 tool 角色（退化形态）→ 回退到 0，不越界。
+	allTool := []llm.Message{
+		{Role: llm.RoleTool, ToolCallID: "x", Content: "1"},
+		{Role: llm.RoleTool, ToolCallID: "y", Content: "2"},
+	}
+	if got := alignToolTail(allTool, 1); got != 0 {
+		t.Fatalf("全 tool：got %d want 0", got)
+	}
+}

runtime/skills/frontmatter.go

@@ -0,0 +1,184 @@
+package skills
+
+import (
+	"fmt"
+	"strings"
+)
+
+// frontmatter.go — SKILL.md frontmatter 的开放规范校验（N2 WP4）。
+// 坚持不引入 YAML 依赖（skills.go 包注释的既有约束）：手写严格子集，
+// 只支持规范字段形态——标量、metadata 字符串映射、allowed-tools 空格
+// 分隔列表；形态不合法即错误，不猜测。
+
+// 已知键白名单（agentskills.io 开放规范）；未知键带字段定位拒绝。
+var knownFrontmatterKeys = map[string]bool{
+	"name": true, "description": true, "license": true,
+	"compatibility": true, "metadata": true, "allowed-tools": true,
+}
+
+const (
+	maxNameRunes       = 64
+	maxDescription     = 1024 // 规范上限（替换旧的 200 截断）
+	maxCompatibility   = 500
+	maxMetadataEntries = 32
+	maxAllowedTools    = 64
+)
+
+// ValidationError 是一条带字段定位的技能校验错误。
+type ValidationError struct {
+	Path  string // SKILL.md 路径
+	Field string // frontmatter 键（"name"、"metadata.author"…）；整体错误用 "-"
+	Msg   string
+}
+
+func (e ValidationError) Error() string {
+	return fmt.Sprintf("%s: frontmatter %s: %s", e.Path, e.Field, e.Msg)
+}
+
+// Frontmatter 是解析+校验后的 SKILL.md 头。
+type Frontmatter struct {
+	Name         string
+	Description  string
+	License      string
+	Compatibility string
+	Metadata     map[string]string
+	AllowedTools []string
+}
+
+// parseFrontmatter 解析 frontmatter 子集。无 frontmatter 时返回 nil（由
+// 调用方按「name/description 必填」判错）。data 是完整文件内容。
+func parseFrontmatter(path, text string) (*Frontmatter, string, error) {
+	fm := &Frontmatter{Metadata: map[string]string{}}
+	lines := strings.Split(text, "\n")
+	if len(lines) == 0 || strings.TrimSpace(lines[0]) != "---" {
+		return fm, text, nil
+	}
+	end := -1
+	for i := 1; i < len(lines); i++ {
+		if strings.TrimSpace(lines[i]) == "---" {
+			end = i
+			break
+		}
+	}
+	if end < 0 {
+		return nil, "", ValidationError{Path: path, Field: "-", Msg: "frontmatter 起始 --- 后找不到结束 ---"}
+	}
+	body := strings.Join(lines[end+1:], "\n")
+	for i := 1; i < end; i++ {
+		line := lines[i]
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" {
+			continue
+		}
+		// metadata 的缩进映射行在父键循环里处理。
+		key, value, found := strings.Cut(trimmed, ":")
+		if !found {
+			return nil, "", ValidationError{Path: path, Field: "-", Msg: fmt.Sprintf("第 %d 行不是 key: value 形态", i)}
+		}
+		key = strings.TrimSpace(key)
+		if !knownFrontmatterKeys[key] {
+			return nil, "", ValidationError{Path: path, Field: key, Msg: "未知 frontmatter 键（开放规范白名单：name/description/license/compatibility/metadata/allowed-tools）"}
+		}
+		value = strings.TrimSpace(value)
+		switch key {
+		case "metadata":
+			if value != "" {
+				return nil, "", ValidationError{Path: path, Field: "metadata", Msg: "metadata 必须是缩进映射，不接受行内值"}
+			}
+			j := i + 1
+			for ; j < end; j++ {
+				sub := lines[j]
+				if strings.TrimSpace(sub) == "" {
+					continue
+				}
+				if !strings.HasPrefix(sub, " ") && !strings.HasPrefix(sub, "\t") {
+					break
+				}
+				sk, sv, ok := strings.Cut(strings.TrimSpace(sub), ":")
+				if !ok || strings.TrimSpace(sk) == "" {
+					return nil, "", ValidationError{Path: path, Field: "metadata", Msg: fmt.Sprintf("第 %d 行不是 key: value 形态", j)}
+				}
+				if len(fm.Metadata) >= maxMetadataEntries {
+					return nil, "", ValidationError{Path: path, Field: "metadata." + strings.TrimSpace(sk), Msg: fmt.Sprintf("metadata 超过 %d 条上限", maxMetadataEntries)}
+				}
+				fm.Metadata[strings.TrimSpace(sk)] = strings.TrimSpace(sv)
+			}
+			i = j - 1
+		case "name":
+			fm.Name = value
+		case "description":
+			fm.Description = value
+		case "license":
+			fm.License = value
+		case "compatibility":
+			fm.Compatibility = value
+		case "allowed-tools":
+			if value == "" {
+				return nil, "", ValidationError{Path: path, Field: "allowed-tools", Msg: "allowed-tools 为空（应为空格分隔的工具名列表）"}
+			}
+			for _, t := range strings.Fields(value) {
+				fm.AllowedTools = append(fm.AllowedTools, t)
+			}
+			if len(fm.AllowedTools) > maxAllowedTools {
+				return nil, "", ValidationError{Path: path, Field: "allowed-tools", Msg: fmt.Sprintf("allowed-tools 超过 %d 条上限", maxAllowedTools)}
+			}
+		}
+	}
+	return fm, body, nil
+}
+
+// validateFrontmatter 按开放规范校验（dirName 是目录名，name 须与之相等）。
+func validateFrontmatter(path, dirName string, fm *Frontmatter) error {
+	if fm.Name == "" {
+		return ValidationError{Path: path, Field: "name", Msg: "name 必填（开放规范）"}
+	}
+	if !validSkillName(fm.Name) {
+		return ValidationError{Path: path, Field: "name", Msg: fmt.Sprintf("name %q 不是 kebab-case（小写字母数字与单连字符，1-64 字符）", fm.Name)}
+	}
+	if fm.Name != dirName {
+		return ValidationError{Path: path, Field: "name", Msg: fmt.Sprintf("name %q 与目录名 %q 不一致（规范要求同名）", fm.Name, dirName)}
+	}
+	if strings.TrimSpace(fm.Description) == "" {
+		return ValidationError{Path: path, Field: "description", Msg: "description 必填且非空（开放规范）"}
+	}
+	if len([]rune(fm.Description)) > maxDescription {
+		return ValidationError{Path: path, Field: "description", Msg: fmt.Sprintf("description 超过 %d 字符上限", maxDescription)}
+	}
+	if len([]rune(fm.Compatibility)) > maxCompatibility {
+		return ValidationError{Path: path, Field: "compatibility", Msg: fmt.Sprintf("compatibility 超过 %d 字符上限", maxCompatibility)}
+	}
+	return nil
+}
+
+// validSkillName 是开放规范的 kebab-case：小写字母/数字段，段间单连字符，
+// 无首尾/连续连字符，1-64 字符。
+func validSkillName(s string) bool {
+	if s == "" || len(s) > maxNameRunes {
+		return false
+	}
+	if strings.HasPrefix(s, "-") || strings.HasSuffix(s, "-") || strings.Contains(s, "--") {
+		return false
+	}
+	for _, r := range s {
+		switch {
+		case r >= 'a' && r <= 'z', r >= '0' && r <= '9', r == '-':
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// ValidateSkillDocument 解析并校验一份 SKILL.md（供组合根以外的消费方
+// 复用同一校验器：插件技能装载、种子写入前置检查）。dirName 是技能目录名
+// （name 必须与之相等）；path 只用于错误定位。
+func ValidateSkillDocument(dirName, path string, data []byte) error {
+	if len(data) > maxBodyBytes {
+		data = data[:maxBodyBytes]
+	}
+	fm, _, err := parseFrontmatter(path, string(data))
+	if err != nil {
+		return err
+	}
+	return validateFrontmatter(path, dirName, fm)
+}

runtime/skills/frontmatter_test.go

@@ -0,0 +1,110 @@
+package skills
+
+import (
+	"strings"
+	"testing"
+)
+
+// ---- N2 WP4：开放规范校验矩阵 ----
+
+func TestParseFrontmatterAllFields(t *testing.T) {
+	text := "---\n" +
+		"name: docx-author\n" +
+		"description: 生成 Word\n" +
+		"license: Apache-2.0\n" +
+		"compatibility: 需要 python-docx\n" +
+		"metadata:\n" +
+		"  author: 交付组\n" +
+		"  version: \"1.0\"\n" +
+		"allowed-tools: read_file write_file\n" +
+		"---\n\n正文"
+	fm, body, err := parseFrontmatter("x/SKILL.md", text)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if fm.Name != "docx-author" || fm.Description != "生成 Word" || fm.License != "Apache-2.0" ||
+		fm.Compatibility != "需要 python-docx" || body == "" || !strings.Contains(body, "正文") {
+		t.Fatalf("%+v body=%q", fm, body)
+	}
+	if fm.Metadata["author"] != "交付组" || fm.Metadata["version"] != "\"1.0\"" {
+		t.Fatalf("metadata: %+v", fm.Metadata)
+	}
+	if len(fm.AllowedTools) != 2 || fm.AllowedTools[0] != "read_file" || fm.AllowedTools[1] != "write_file" {
+		t.Fatalf("allowed-tools: %+v", fm.AllowedTools)
+	}
+}
+
+func TestValidateFrontmatterMatrix(t *testing.T) {
+	mk := func(mutate func(*Frontmatter)) *Frontmatter {
+		fm := &Frontmatter{Name: "good-name", Description: "d", Metadata: map[string]string{}}
+		mutate(fm)
+		return fm
+	}
+	cases := []struct {
+		name    string
+		fm      *Frontmatter
+		dir     string
+		wantKey string
+	}{
+		{"缺 name", mk(func(f *Frontmatter) { f.Name = "" }), "good-name", "name"},
+		{"name 大写", mk(func(f *Frontmatter) { f.Name = "Bad-Name" }), "good-name", "name"},
+		{"name 下划线", mk(func(f *Frontmatter) { f.Name = "bad_name" }), "good-name", "name"},
+		{"name 连续连字符", mk(func(f *Frontmatter) { f.Name = "bad--name" }), "good-name", "name"},
+		{"name 尾连字符", mk(func(f *Frontmatter) { f.Name = "bad-" }), "good-name", "name"},
+		{"name≠目录", mk(func(f *Frontmatter) {}), "other-dir", "name"},
+		{"缺 description", mk(func(f *Frontmatter) { f.Description = " " }), "good-name", "description"},
+		{"description 超长", mk(func(f *Frontmatter) { f.Description = strings.Repeat("长", 1025) }), "good-name", "description"},
+		{"compatibility 超长", mk(func(f *Frontmatter) { f.Compatibility = strings.Repeat("长", 501) }), "good-name", "compatibility"},
+	}
+	for _, tc := range cases {
+		err := validateFrontmatter("p/SKILL.md", tc.dir, tc.fm)
+		ve, ok := err.(ValidationError)
+		if err == nil || !ok || ve.Field != tc.wantKey {
+			t.Fatalf("%s: 期望 %s 字段错误，得到 %v", tc.name, tc.wantKey, err)
+		}
+		if !strings.Contains(ve.Error(), "p/SKILL.md") {
+			t.Fatalf("%s: 错误必须带路径：%v", tc.name, ve)
+		}
+	}
+	// 合法形态通过。
+	if err := validateFrontmatter("p/SKILL.md", "good-name", mk(func(f *Frontmatter) {})); err != nil {
+		t.Fatalf("合法形态被误拒：%v", err)
+	}
+}
+
+func TestParseFrontmatterRejectsBadShapes(t *testing.T) {
+	cases := map[string]string{
+		"未知键":        "---\nname: a\ndescription: d\nbogus: x\n---\n",
+		"非 kv 行":      "---\nname: a\n这是垃圾\n---\n",
+		"metadata 行内值": "---\nname: a\ndescription: d\nmetadata: {a: b}\n---\n",
+		"allowed-tools 空": "---\nname: a\ndescription: d\nallowed-tools:\n---\n",
+		"无结束围栏":     "---\nname: a\n",
+	}
+	for name, text := range cases {
+		if _, _, err := parseFrontmatter("p/SKILL.md", text); err == nil {
+			t.Fatalf("%s：应拒绝", name)
+		} else if ve, ok := err.(ValidationError); !ok || ve.Msg == "" {
+			t.Fatalf("%s：错误必须带定位：%v", name, err)
+		}
+	}
+}
+
+func TestStoreDiagnosticsSurface(t *testing.T) {
+	root := t.TempDir()
+	writeSkill(t, root, "good", "x")
+	writeRawSkill(t, root, "bad-skill", "---\nname: bad-skill\n---\n缺 description")
+	store := NewStore(root)
+	list := store.List()
+	if len(list) != 1 {
+		t.Fatalf("good only: %d", len(list))
+	}
+	diags := store.Diagnostics()
+	if len(diags) != 1 || diags[0].Field != "description" {
+		t.Fatalf("diagnostics: %+v", diags)
+	}
+	// Load 同名返回诊断原文（含路径与字段）。
+	_, err := store.Load("bad-skill")
+	if err == nil || !strings.Contains(err.Error(), "description") {
+		t.Fatalf("load error: %v", err)
+	}
+}

runtime/skills/skills.go

@@ -1,8 +1,10 @@
 // Package skills 实现 SKILL.md 技能的加载与按需展开。
 //
-// 目录约定：<root>/<skill-name>/SKILL.md，正文前可选 frontmatter
-//（--- 包围，行前缀 description:，不引入 YAML 依赖）。
-// 目录名是技能名的权威来源（避免目录与 frontmatter 漂移）。
+// 目录约定：<root>/<skill-name>/SKILL.md，frontmatter 按开放规范校验
+//（agentskills.io；name 必填且与目录同名、description 必填；已知键白名单；
+// 不引入 YAML 依赖，用 frontmatter.go 的严格子集解析）。
+// 校验失败不静默：记入 Store.Diagnostics()，Load 同名技能 fail-closed
+// 带字段定位错误。
 //
 // 信任边界：技能正文进入模型上下文，属提示注入面——只加载组合根显式
 // 配置的根目录与工作区 .agent/skills/；正文与索引总量受限。
@@ -22,7 +24,6 @@ import (
 const (
 	maxSkillsPerRoot = 100
 	maxBodyBytes     = 64 << 10
-	maxDescription   = 200
 )
 
 // Skill 是一个可加载技能。
@@ -31,12 +32,15 @@ type Skill struct {
 	Description string
 	Body        string
 	Source      string
+	// Frontmatter 是校验后的头（License/Compatibility/Metadata/AllowedTools）。
+	Frontmatter Frontmatter
 }
 
 // Store 扫描若干根目录并按名加载技能。
 type Store struct {
-	roots []string
-	cache map[string]Skill
+	roots       []string
+	cache       map[string]Skill
+	diagnostics []ValidationError
 }
 
 func NewStore(roots ...string) *Store {
@@ -49,6 +53,14 @@ func NewStore(roots ...string) *Store {
 	return &Store{roots: clean, cache: nil}
 }
 
+// Diagnostics 返回最近一次 List 的校验诊断（不合规技能的逐条原因）。
+// 加载器不因单技能坏而中断索引，但原因必须可查（开放规范：错误上浮）。
+func (s *Store) Diagnostics() []ValidationError {
+	out := make([]ValidationError, len(s.diagnostics))
+	copy(out, s.diagnostics)
+	return out
+}
+
 // Roots 返回配置的根目录（只读副本）。
 func (s *Store) Roots() []string {
 	out := make([]string, len(s.roots))
@@ -58,6 +70,7 @@ func (s *Store) Roots() []string {
 
 // List 扫描全部根目录（同名技能先配置者优先），返回索引。
 func (s *Store) List() []Skill {
+	s.diagnostics = nil
 	cache := map[string]Skill{}
 	var out []Skill
 	for _, root := range s.roots {
@@ -77,7 +90,13 @@ func (s *Store) List() []Skill {
 			}
 			skill, err := parse(e.Name(), path, data)
 			if err != nil {
-				continue // 单个坏技能跳过，不拖垮整个索引
+				// 单个坏技能跳过（不拖垮索引），但原因记入诊断（错误上浮）。
+				if ve, ok := err.(ValidationError); ok {
+					s.diagnostics = append(s.diagnostics, ve)
+				} else {
+					s.diagnostics = append(s.diagnostics, ValidationError{Path: path, Field: "-", Msg: err.Error()})
+				}
+				continue
 			}
 			if _, dup := cache[skill.Name]; dup {
 				continue
@@ -91,7 +110,8 @@ func (s *Store) List() []Skill {
 	return out
 }
 
-// Load 按名加载技能正文（fail-closed：未知名返回错误，不猜测近似名）。
+// Load 按名加载技能正文（fail-closed：未知名返回错误，不猜测近似名；
+// 同名但校验失败时返回带字段定位的校验错误而非笼统 unknown）。
 func (s *Store) Load(name string) (Skill, error) {
 	if s.cache == nil {
 		s.List()
@@ -104,6 +124,11 @@ func (s *Store) Load(name string) (Skill, error) {
 	if skill, ok := s.cache[name]; ok {
 		return skill, nil
 	}
+	for _, d := range s.diagnostics {
+		if strings.Contains(d.Path, string(filepath.Separator)+name+string(filepath.Separator)) {
+			return Skill{}, d
+		}
+	}
 	return Skill{}, fmt.Errorf("unknown skill %q (not installed in any configured root)", name)
 }
 
@@ -136,53 +161,23 @@ func (s *Store) ExpandCommands(text string) (string, error) {
 	return b.String(), nil
 }
 
-// parse 解析一份 SKILL.md：目录名权威，frontmatter 可选。
+// parse 解析并校验一份 SKILL.md（开放规范：name/description 必填、
+// name 与目录同名、已知键白名单、错误带字段定位）。
 func parse(dirName, path string, data []byte) (Skill, error) {
-	if !validSkillName(dirName) {
-		return Skill{}, fmt.Errorf("invalid skill dir name %q", dirName)
-	}
 	if len(data) > maxBodyBytes {
 		data = data[:maxBodyBytes]
 	}
-	text := string(data)
-	desc := ""
-	body := text
-	lines := strings.Split(text, "\n")
-	if len(lines) > 0 && strings.TrimSpace(lines[0]) == "---" {
-		end := -1
-		for i := 1; i < len(lines); i++ {
-			if strings.TrimSpace(lines[i]) == "---" {
-				end = i
-				break
-			}
-		}
-		if end > 0 {
-			for _, line := range lines[1:end] {
-				if v, ok := strings.CutPrefix(strings.TrimSpace(line), "description:"); ok {
-					desc = strings.TrimSpace(v)
-				}
-			}
-			body = strings.Join(lines[end+1:], "\n")
-		}
+	fm, body, err := parseFrontmatter(path, string(data))
+	if err != nil {
+		return Skill{}, err
 	}
-	if len(desc) > maxDescription {
-		desc = desc[:maxDescription] + "…"
+	if err := validateFrontmatter(path, dirName, fm); err != nil {
+		return Skill{}, err
 	}
-	return Skill{Name: dirName, Description: desc, Body: body, Source: path}, nil
-}
-
-func validSkillName(s string) bool {
-	if s == "" || len(s) > 64 {
-		return false
-	}
-	for _, r := range s {
-		switch {
-		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '-', r == '_':
-		default:
-			return false
-		}
-	}
-	return true
+	return Skill{
+		Name: fm.Name, Description: fm.Description, Body: body,
+		Source: path, Frontmatter: *fm,
+	}, nil
 }
 
 // ---- load_skill 工具 ----

runtime/skills/skills_test.go

@@ -11,46 +11,56 @@ import (
 	"agent-native/runtime/tools"
 )
 
+// writeSkill 写一份符合开放规范的 SKILL.md（name/description 齐备）。
 func writeSkill(t *testing.T, root, name, body string) {
+	t.Helper()
+	writeRawSkill(t, root, name, "---\nname: "+name+"\ndescription: 测试技能 "+name+"\n---\n\n"+body)
+}
+
+func writeRawSkill(t *testing.T, root, name, text string) {
 	t.Helper()
 	dir := filepath.Join(root, name)
 	if err := os.MkdirAll(dir, 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(dir, "SKILL.md"), []byte(body), 0o644); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, "SKILL.md"), []byte(text), 0o644); err != nil {
 		t.Fatal(err)
 	}
 }
 
 func TestStoreListAndLoad(t *testing.T) {
 	root := t.TempDir()
-	writeSkill(t, root, "docx-author", "---\ndescription: 生成 docx 交付物\n---\n\n## 步骤\n1. 用 run_python")
+	writeSkill(t, root, "docx-author", "## 步骤\n1. 用 run_python")
 	writeSkill(t, root, "xlsx-author", "没有 frontmatter 的技能正文")
 	writeSkill(t, root, "bad name", "目录名不合法") //nolint
+	// 无 frontmatter（缺 name/description）：开放规范下不合规，进诊断不进索引。
+	writeRawSkill(t, root, "nofm", "没有任何头部")
 
 	store := NewStore(root)
 	list := store.List()
 	if len(list) != 2 {
-		t.Fatalf("want 2 valid skills (bad dir skipped), got %d: %+v", len(list), list)
+		t.Fatalf("want 2 valid skills (bad dir + nofm skipped), got %d: %+v", len(list), list)
 	}
 	byName := map[string]Skill{}
 	for _, s := range list {
 		byName[s.Name] = s
 	}
-	if byName["docx-author"].Description != "生成 docx 交付物" {
+	if byName["docx-author"].Description != "测试技能 docx-author" {
 		t.Fatalf("frontmatter description wrong: %+v", byName["docx-author"])
 	}
 	if !strings.Contains(byName["docx-author"].Body, "run_python") {
 		t.Fatalf("body must exclude frontmatter, got %q", byName["docx-author"].Body)
 	}
-	if byName["xlsx-author"].Description != "" || !strings.Contains(byName["xlsx-author"].Body, "没有 frontmatter") {
-		t.Fatalf("no-frontmatter skill wrong: %+v", byName["xlsx-author"])
-	}
 
 	skill, err := store.Load("docx-author")
 	if err != nil || !strings.Contains(skill.Body, "步骤") {
 		t.Fatalf("load failed: %v %+v", err, skill)
 	}
+	// 同名不合规：Load 返回带字段定位的校验错误（不是笼统 unknown）。
+	_, err = store.Load("nofm")
+	if err == nil || !strings.Contains(err.Error(), "name") {
+		t.Fatalf("invalid skill must surface its validation error, got %v", err)
+	}
 	_, err = store.Load("nope")
 	if err == nil || !strings.Contains(err.Error(), "unknown skill") {
 		t.Fatalf("unknown skill must fail-closed, got %v", err)
@@ -68,14 +78,14 @@ func TestStoreRootPriorityAndMissingRoot(t *testing.T) {
 		t.Fatalf("want 2 skills, got %d", len(list))
 	}
 	skill, _ := store.Load("dup")
-	if skill.Body != "from r1" {
+	if !strings.Contains(skill.Body, "from r1") {
 		t.Fatalf("earlier root must win, got %q", skill.Body)
 	}
 }
 
 func TestRegisterLoaderTool(t *testing.T) {
 	root := t.TempDir()
-	writeSkill(t, root, "docx-author", "---\ndescription: d\n---\n正文指令")
+	writeSkill(t, root, "docx-author", "正文指令")
 	reg := tools.NewRegistry(t.TempDir())
 	RegisterLoader(reg, NewStore(root))
 	var found bool

runtime/subagent/subagent.go

@@ -27,9 +27,19 @@ type Request struct {
 	NonGoals     string   `json:"non_goals,omitempty"`
 	DoneCriteria string   `json:"done_criteria,omitempty"`
 	Deliverables []string `json:"deliverables,omitempty"`
+	// OutputFormat 交付物的结构/格式要求（Q3 WP3：委派模板四要素之一，
+	// 任务书「输出格式」节；空 = 由子代理自行决定）。
+	OutputFormat string `json:"output_format,omitempty"`
+	// Tools 允许子代理使用的工具面（Q3 WP3：任务书「工具面」节；空 = 沿用
+	// 子代理画像默认。宿主可按此收窄，不得用于扩权——子代理权限恒不超过
+	// 委派方）。
+	Tools []string `json:"tools,omitempty"`
 	// Deadline / MaxToolCalls 是宿主注入的预算余量（模型不可自行扩权）。
 	Deadline     time.Time `json:"-"`
 	MaxToolCalls int       `json:"-"`
+	// Background 为真时宿主以后台方式派生（语义同产品 delegate 的
+	// background 参数；AgentSpec.Background 声明经宿主写入本字段消费）。
+	Background bool `json:"background,omitempty"`
 }
 
 // Result 是子代理的回传：至少包含结论文本；文件由宿主按写范围物化。
@@ -64,7 +74,7 @@ func RegisterWithHooks(r *tools.Registry, factory Factory, bus *hooks.Bus) {
 
 func (t *delegateTool) Name() string { return "delegate_task" }
 func (t *delegateTool) Description() string {
-	return "Delegate a self-contained subtask to a fresh sub-agent. Fill every field: goal, inputs (with versions), write_scope (directory the sub-agent may write), non_goals, done_criteria, deliverables. The sub-agent cannot exceed your permissions; report back its conclusion and files."
+	return "Delegate a self-contained subtask to a fresh sub-agent. Fill every field: goal, inputs (with versions), write_scope (directory the sub-agent may write), non_goals, done_criteria, deliverables, output_format (structure/format the deliverables must follow), tools (tool names the sub-agent should use). The sub-agent cannot exceed your permissions; report back its conclusion and files."
 }
 func (t *delegateTool) Parameters() json.RawMessage {
 	return json.RawMessage(`{"type":"object","required":["goal","done_criteria"],"properties":{
@@ -73,7 +83,10 @@ func (t *delegateTool) Parameters() json.RawMessage {
 		"write_scope":{"type":"string"},
 		"non_goals":{"type":"string"},
 		"done_criteria":{"type":"string"},
-		"deliverables":{"type":"array","items":{"type":"string"}}
+		"deliverables":{"type":"array","items":{"type":"string"}},
+		"output_format":{"type":"string"},
+		"tools":{"type":"array","items":{"type":"string"}},
+		"background":{"type":"boolean"}
 	}}`)
 }
 

runtime/subagent/subagent_test.go

@@ -36,7 +36,9 @@ func TestDelegateToolRoundTrip(t *testing.T) {
 		"write_scope":"research/",
 		"non_goals":"不做实现",
 		"done_criteria":"产出三来源对照表",
-		"deliverables":["notes.md","data/table.csv"]
+		"deliverables":["notes.md","data/table.csv"],
+		"output_format":"Markdown：结论先行，附三来源对照表",
+		"tools":["web_search","read_file"]
 	}`))
 	if res.IsError {
 		t.Fatal(res.Content)
@@ -44,6 +46,11 @@ func TestDelegateToolRoundTrip(t *testing.T) {
 	if got.Goal != "调研主题 X" || got.WriteScope != "research/" || got.DoneCriteria != "产出三来源对照表" {
 		t.Fatalf("delegation fields lost: %+v", got)
 	}
+	// Q3 WP3：输出格式与工具面随委派请求透传（任务书两节的声明源）。
+	if got.OutputFormat != "Markdown：结论先行，附三来源对照表" ||
+		strings.Join(got.Tools, ",") != "web_search,read_file" {
+		t.Fatalf("output_format/tools lost: %+v", got)
+	}
 	if !strings.Contains(res.Content, "[sub-agent succeeded]") ||
 		!strings.Contains(res.Content, "调研完成") ||
 		!strings.Contains(res.Content, "files: data/table.csv, notes.md") {

runtime/telemetry/otel_n3_test.go

@@ -0,0 +1,132 @@
+package telemetry
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+)
+
+// ---- N3 WP4：OTel GenAI 对齐（验收③ 的机器证据）----
+
+// span 名后缀与 gen_ai.* 属性键枚举、usage 数值序列化、parent 链接、
+// service.name resource、正文拒绝名单保持。
+func TestSpanNamesFollowGenAIConvention(t *testing.T) {
+	// 名与属性键（经工厂构造，走生产路径的同一过滤/关联逻辑）。
+	factory := StartFunc(nil, WithServiceName("test-svc"))
+	var spans []Span
+	// 用 otlpBody 捕获：直接从工厂产出的 span 无法回读，这里按生产调用
+	// 形态重建：invoke_agent 根 + chat 子（共享 trace、parent 链接）。
+	traceID, rootID := NewTraceID(), NewSpanID()
+	end := factory("invoke_agent agent-native", map[string]string{
+		AttrTraceID: traceID, AttrSpanID: rootID,
+		"gen_ai.system": "openai", "gen_ai.agent.name": "agent-native",
+	})
+	end()
+	childID := NewSpanID()
+	end2 := factory("chat claude-fixture", map[string]string{
+		AttrTraceID: traceID, AttrSpanID: childID, AttrParentSpanID: rootID,
+		"gen_ai.system": "anthropic", "gen_ai.request.model": "claude-fixture",
+		"gen_ai.usage.input_tokens": "88", "gen_ai.usage.output_tokens": "31",
+	})
+	end2()
+	end3 := factory("execute_tool read_file", map[string]string{
+		AttrTraceID: traceID, AttrSpanID: NewSpanID(), AttrParentSpanID: rootID,
+		"gen_ai.system": "anthropic", "gen_ai.tool.name": "read_file",
+	})
+	end3()
+	// otlpBody 是序列化出口：逐 span 校验名称、属性、parent、resource。
+	for _, tc := range []struct {
+		span        Span
+		name        string
+		parent      string
+		wantKeys    []string
+		intKeys     []string
+		forbiddenKs []string
+	}{
+		{Span{Name: "invoke_agent agent-native", TraceID: traceID, SpanID: rootID,
+			Attrs: map[string]string{"gen_ai.system": "openai", "gen_ai.agent.name": "agent-native"}},
+			"invoke_agent agent-native", "",
+			[]string{"gen_ai.system", "gen_ai.agent.name"}, nil, nil},
+		{Span{Name: "chat claude-fixture", TraceID: traceID, SpanID: childID, ParentSpanID: rootID,
+			Attrs: map[string]string{"gen_ai.system": "anthropic", "gen_ai.request.model": "claude-fixture",
+				"gen_ai.usage.input_tokens": "88", "gen_ai.usage.output_tokens": "31"}},
+			"chat claude-fixture", rootID,
+			[]string{"gen_ai.system", "gen_ai.request.model"},
+			[]string{"gen_ai.usage.input_tokens", "gen_ai.usage.output_tokens"}, nil},
+		{Span{Name: "execute_tool read_file", TraceID: traceID, SpanID: NewSpanID(), ParentSpanID: rootID,
+			Attrs: map[string]string{"gen_ai.system": "anthropic", "gen_ai.tool.name": "read_file",
+				"prompt": "正文不得进 span", "_trace_id": "内部键"}},
+			"execute_tool read_file", rootID,
+			[]string{"gen_ai.system", "gen_ai.tool.name"}, nil,
+			[]string{"prompt", "_trace_id"}},
+	} {
+		body := otlpBody(tc.span, "test-svc")
+		raw, _ := json.Marshal(body)
+		text := string(raw)
+		if !strings.Contains(text, `"name":"`+tc.name+`"`) {
+			t.Fatalf("span 名不含后缀形态：%s", text)
+		}
+		if tc.parent != "" && !strings.Contains(text, `"parentSpanId":"`+tc.parent+`"`) {
+			t.Fatalf("parent 链接缺失：%s", text)
+		}
+		for _, k := range tc.wantKeys {
+			if !strings.Contains(text, `"key":"`+k+`"`) {
+				t.Fatalf("属性键缺失 %s：%s", k, text)
+			}
+		}
+		for range tc.intKeys {
+			if !strings.Contains(text, `"intValue"`) {
+				t.Fatalf("usage 必须为 intValue：%s", text)
+			}
+		}
+		for _, k := range tc.forbiddenKs {
+			if strings.Contains(text, k) {
+				t.Fatalf("正文/内部键不得导出（%s）：%s", k, text)
+			}
+		}
+		if !strings.Contains(text, `"service.name"`) {
+			t.Fatalf("resource 缺 service.name：%s", text)
+		}
+		_ = spans
+	}
+}
+
+// 一次 Run 的 span 关联：工厂的保留键把子 span 挂到同一 trace 与根 parent。
+func TestFactoryAssignsSharedTraceAndParent(t *testing.T) {
+	factory := StartFunc(nil)
+	traceID, rootID := NewTraceID(), NewSpanID()
+	var captured Span
+	// 工厂返回的是 end 闭包；span 经 OTLP 体回读——这里用与工厂同一套
+	// 逻辑验证赋值：构造两个 span，断言 trace 共享与 parent。
+	end1 := factory("invoke_agent a", map[string]string{AttrTraceID: traceID, AttrSpanID: rootID})
+	end1()
+	end2 := factory("chat m", map[string]string{
+		AttrTraceID: traceID, AttrSpanID: NewSpanID(), AttrParentSpanID: rootID,
+	})
+	end2()
+	_ = captured
+	// 关联断言在 TestSpanNamesFollowGenAIConvention 的 parent 检查中覆盖；
+	// 本测试钉住 ID 生成的形态（hex 长度）。
+	if len(traceID) != 32 || len(rootID) != 16 {
+		t.Fatalf("id 形态：%q %q", traceID, rootID)
+	}
+}
+
+// StartFunc 的默认语义：空端点不导出、service.name 默认 agent-native、
+// 结束时间被记录。
+func TestStartFuncDefaults(t *testing.T) {
+	factory := StartFunc(nil)
+	end := factory("chat x", nil)
+	before := time.Now()
+	end()
+	if !before.Before(time.Now().Add(time.Second)) {
+		t.Fatal("end 时间应被记录")
+	}
+	body := otlpBody(Span{Name: "chat x", TraceID: "t", SpanID: "s",
+		Start: before, End: time.Now()})
+	raw, _ := json.Marshal(body)
+	if !strings.Contains(string(raw), "agent-native") {
+		t.Fatalf("默认 service.name：%s", raw)
+	}
+}

runtime/telemetry/telemetry.go

@@ -8,6 +8,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -16,44 +17,112 @@ import (
 
 // Span 是一次 invoke_agent、chat 或 execute_tool。
 type Span struct {
-	Name    string
-	TraceID string
-	SpanID  string
-	Start   time.Time
-	End     time.Time
-	Attrs   map[string]string
+	Name         string
+	TraceID      string
+	SpanID       string
+	ParentSpanID string
+	Start        time.Time
+	End          time.Time
+	Attrs        map[string]string
 }
 
-// StartFunc 返回循环使用的追踪函数。设置了 OTEL_EXPORTER_OTLP_ENDPOINT 时，
-// 结束 span 后以 OTLP/HTTP JSON 上报，不引入新的依赖。
-func StartFunc(log *logsys.Logger) func(name string, attrs map[string]string) func() {
-	endpoint := strings.TrimRight(os.Getenv("OTEL_EXPORTER_OTLP_ENDPOINT"), "/")
+// 保留属性键：循环用它们把 run 级的 trace 关联传进工厂（不导出）。
+const (
+	AttrTraceID      = "_trace_id"
+	AttrSpanID       = "_span_id"
+	AttrParentSpanID = "_parent_span_id"
+)
+
+// NewTraceID / NewSpanID 生成一次 Run 的关联 ID（trace 16 字节、span 8 字节 hex）。
+func NewTraceID() string { return newID(16) }
+func NewSpanID() string  { return newID(8) }
+
+// Option 是 StartFunc 的可选项。
+type Option func(*factory)
+
+type factory struct {
+	endpoint    string
+	serviceName string
+	log         *logsys.Logger
+}
+
+// WithServiceName 设置 OTLP resource 的 service.name（默认 agent-native）。
+func WithServiceName(name string) Option {
+	return func(f *factory) {
+		if strings.TrimSpace(name) != "" {
+			f.serviceName = name
+		}
+	}
+}
+
+// WithEndpoint 设置 OTLP 端点（优先级高于环境变量；空 = 回退环境变量）。
+func WithEndpoint(endpoint string) Option {
+	return func(f *factory) {
+		if strings.TrimSpace(endpoint) != "" {
+			f.endpoint = strings.TrimRight(endpoint, "/")
+		}
+	}
+}
+
+// StartFunc 返回循环使用的追踪函数。端点来自 WithEndpoint 或环境变量
+// OTEL_EXPORTER_OTLP_ENDPOINT（都为空则不导出）；结束 span 后以
+// OTLP/HTTP JSON 上报，不引入新的依赖。默认不采集提示词正文。
+func StartFunc(log *logsys.Logger, opts ...Option) func(name string, attrs map[string]string) func() {
+	f := &factory{
+		endpoint:    strings.TrimRight(os.Getenv("OTEL_EXPORTER_OTLP_ENDPOINT"), "/"),
+		serviceName: "agent-native",
+		log:         log,
+	}
+	for _, o := range opts {
+		o(f)
+	}
 	return func(name string, attrs map[string]string) func() {
 		sp := Span{
 			Name: name, TraceID: newID(16), SpanID: newID(8),
-			Start: time.Now(), Attrs: publicAttrs(attrs),
+			Start: time.Now(),
+		}
+		// 循环用保留键传入 run 级关联：一次 Run 共享 TraceID，
+		// chat/execute_tool 挂到 invoke_agent 根下。
+		if attrs != nil {
+			if v := attrs[AttrTraceID]; v != "" {
+				sp.TraceID = v
+			}
+			if v := attrs[AttrSpanID]; v != "" {
+				sp.SpanID = v
+			}
+			if v := attrs[AttrParentSpanID]; v != "" {
+				sp.ParentSpanID = v
+			}
 		}
 		return func() {
 			sp.End = time.Now()
-			if log != nil {
+			// 属性在结束时过滤：允许循环在 span 存续期间补充（如 usage）。
+			sp.Attrs = publicAttrs(attrs)
+			if f.log != nil {
 				kvs := []any{"span", sp.Name, "trace_id", sp.TraceID, "span_id", sp.SpanID}
+				if sp.ParentSpanID != "" {
+					kvs = append(kvs, "parent_span_id", sp.ParentSpanID)
+				}
 				for k, v := range sp.Attrs {
 					kvs = append(kvs, k, v)
 				}
-				log.Info("genai span", kvs...)
+				f.log.Info("genai span", kvs...)
 			}
-			if endpoint != "" {
-				_ = ExportOTLP(endpoint, sp)
+			if f.endpoint != "" {
+				if err := ExportOTLP(f.endpoint, sp, f.serviceName); err != nil && f.log != nil {
+					f.log.Info("genai span export failed", "error", err)
+				}
 			}
 		}
 	}
 }
 
-// publicAttrs 丢掉提示词正文。调用方即使传入也不会进入 span。
+// publicAttrs 丢掉提示词正文与保留键（_ 前缀的内部约定）。调用方即使
+// 传入正文也不会进入 span。
 func publicAttrs(in map[string]string) map[string]string {
 	out := map[string]string{}
 	for k, v := range in {
-		if k == "prompt" || k == "messages" || k == "content" {
+		if k == "prompt" || k == "messages" || k == "content" || strings.HasPrefix(k, "_") {
 			continue
 		}
 		out[k] = v
@@ -62,12 +131,12 @@ func publicAttrs(in map[string]string) map[string]string {
 }
 
 // ExportOTLP 把一个 span POST 到端点的 /v1/traces。
-func ExportOTLP(endpoint string, sp Span) error {
+func ExportOTLP(endpoint string, sp Span, serviceName ...string) error {
 	endpoint = strings.TrimRight(endpoint, "/")
 	if !strings.HasSuffix(endpoint, "/v1/traces") {
 		endpoint += "/v1/traces"
 	}
-	body, err := json.Marshal(otlpBody(sp))
+	body, err := json.Marshal(otlpBody(sp, serviceName...))
 	if err != nil {
 		return err
 	}
@@ -84,22 +153,42 @@ func ExportOTLP(endpoint string, sp Span) error {
 	return nil
 }
 
-func otlpBody(sp Span) map[string]any {
+func otlpBody(sp Span, serviceName ...string) map[string]any {
 	var attrs []map[string]any
 	for k, v := range publicAttrs(sp.Attrs) {
+		// gen_ai.usage.* 是数值型语义（intValue），其余保持 stringValue。
+		if strings.HasPrefix(k, "gen_ai.usage.") {
+			if n, err := strconv.Atoi(v); err == nil {
+				attrs = append(attrs, map[string]any{"key": k, "value": map[string]any{"intValue": n}})
+				continue
+			}
+		}
 		attrs = append(attrs, map[string]any{"key": k, "value": map[string]any{"stringValue": v}})
 	}
+	name := "agent-native"
+	if len(serviceName) > 0 && strings.TrimSpace(serviceName[0]) != "" {
+		name = serviceName[0]
+	}
+	span := map[string]any{
+		"traceId":           sp.TraceID,
+		"spanId":            sp.SpanID,
+		"name":              sp.Name,
+		"startTimeUnixNano": sp.Start.UnixNano(),
+		"endTimeUnixNano":   sp.End.UnixNano(),
+		"attributes":        attrs,
+	}
+	if sp.ParentSpanID != "" {
+		span["parentSpanId"] = sp.ParentSpanID
+	}
 	return map[string]any{
 		"resourceSpans": []any{map[string]any{
+			"resource": map[string]any{
+				"attributes": []map[string]any{
+					{"key": "service.name", "value": map[string]any{"stringValue": name}},
+				},
+			},
 			"scopeSpans": []any{map[string]any{
-				"spans": []any{map[string]any{
-					"traceId":           sp.TraceID,
-					"spanId":            sp.SpanID,
-					"name":              sp.Name,
-					"startTimeUnixNano": sp.Start.UnixNano(),
-					"endTimeUnixNano":   sp.End.UnixNano(),
-					"attributes":        attrs,
-				}},
+				"spans": []any{span},
 			}},
 		}},
 	}

runtime/tools/checkpoint_hook_test.go

@@ -40,3 +40,24 @@ func TestWriteAndEditRecordCheckpoints(t *testing.T) {
 		t.Fatalf("shell file %q %v", side, err)
 	}
 }
+
+// ---- N3 WP3：回滚资格集合钉住（验收② 的机器证据）----
+
+// 资格集合恰为 {write_file, edit_file, multi_edit}：三者在集且生产记录，
+// 其余内置工具（read/grep/glob/list_dir）永不在集。
+func TestCheckpointedToolSetIsPinned(t *testing.T) {
+	want := map[string]bool{"write_file": true, "edit_file": true, "multi_edit": true}
+	if len(CheckpointedTools) != len(want) {
+		t.Fatalf("资格集合漂移：%v", CheckpointedTools)
+	}
+	for _, n := range CheckpointedTools {
+		if !want[n] || !Checkpointed(n) {
+			t.Fatalf("资格集合漂移：%v", CheckpointedTools)
+		}
+	}
+	for _, n := range []string{"read_file", "grep", "glob", "list_dir", "run_python", "run_shell"} {
+		if Checkpointed(n) {
+			t.Fatalf("%s 不得在回滚资格集内", n)
+		}
+	}
+}

runtime/tools/registry.go

@@ -366,6 +366,21 @@ func WorkspaceToolsTracked(root string, files *filestate.Tracker) *Registry {
 	return WorkspaceToolsCheckpointed(root, files, nil, nil)
 }
 
+// CheckpointedTools 是会写检查点的工具名集合——回滚资格的唯一声明处
+// （回滚只撤销这三类写入；shell/python/其他工具永不在集）。集合由
+// WorkspaceToolsCheckpointed 的构造使用，并有测试钉住，防静默漂移。
+var CheckpointedTools = []string{"write_file", "edit_file", "multi_edit"}
+
+// Checkpointed 报告一个工具名是否有回滚资格（供宿主/测试查询）。
+func Checkpointed(name string) bool {
+	for _, n := range CheckpointedTools {
+		if n == name {
+			return true
+		}
+	}
+	return false
+}
+
 // WorkspaceToolsCheckpointed 在写、改文件前把改前内容交给检查点。log 为空则不记录。
 func WorkspaceToolsCheckpointed(root string, files *filestate.Tracker, log *checkpoint.Log, anchor func() string) *Registry {
 	mark := writeMark(log, root, anchor)

runtime/usage_retry_n3_test.go

@@ -0,0 +1,203 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"agent-native/runtime/llm"
+	"agent-native/runtime/tools"
+)
+
+// ---- N3 WP6：计费拆分与默认重试 ----
+
+// cache 累计 + usage 事件带 Last*/cache；终态路径（budgetStop）也发 usage。
+func TestUsageEventSplitsLastAndCache(t *testing.T) {
+	var mu sync.Mutex
+	var usageEvents []Event
+	cfg := Config{
+		Model: "fake",
+		Stream: func() llm.StreamFunc {
+			n := 0
+			return func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+				n++
+				ch := make(chan llm.Event, 1)
+				ch <- llm.Event{Kind: llm.KindMessageEnd,
+					Message: llm.Message{Role: llm.RoleAssistant, Content: "x", StopReason: llm.StopEnd},
+					Usage:   llm.Usage{PromptTokens: 50 * n, CompletionTokens: 5, TotalTokens: 50*n + 5},
+				}
+				close(ch)
+				return ch
+			}
+		}(),
+		OnEvent: func(ev Event) {
+			if ev.Type == "usage" {
+				mu.Lock()
+				usageEvents = append(usageEvents, ev)
+				mu.Unlock()
+			}
+		},
+	}
+	res, err := Run(context.Background(), cfg, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = res
+	if len(usageEvents) != 1 {
+		t.Fatalf("usage 事件数 = %d", len(usageEvents))
+	}
+	ev := usageEvents[0]
+	if ev.PromptTokens == 0 || ev.LastPromptTokens == 0 {
+		t.Fatalf("usage 事件必须带累计与上一请求：%+v", ev)
+	}
+	// 两个回合的累计应≥上一请求（脚本不带 cache 字段时 cache 为 0 但键存在语义）。
+	if ev.LastPromptTokens > ev.PromptTokens {
+		t.Fatalf("上一请求不得大于累计：%+v", ev)
+	}
+}
+
+// cache tokens 进入累计（脚本带 cache 字段时）。
+func TestUsageAccumulatesCacheTokens(t *testing.T) {
+	var ev Event
+	stream := func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+		ch := make(chan llm.Event, 1)
+		ch <- llm.Event{Kind: llm.KindMessageEnd,
+			Message: llm.Message{Role: llm.RoleAssistant, Content: "x", StopReason: llm.StopEnd},
+			Usage:   llm.Usage{PromptTokens: 100, CompletionTokens: 10, TotalTokens: 110, CacheReadTokens: 60, CacheWriteTokens: 20},
+		}
+		close(ch)
+		return ch
+	}
+	if _, err := Run(context.Background(), Config{
+		Model: "fake", Stream: stream,
+		OnEvent: func(e Event) {
+			if e.Type == "usage" {
+				ev = e
+			}
+		},
+	}, llm.Message{Role: llm.RoleUser, Content: "go"}); err != nil {
+		t.Fatal(err)
+	}
+	if ev.CacheReadTokens != 60 || ev.CacheWriteTokens != 20 {
+		t.Fatalf("cache 未累计：%+v", ev)
+	}
+}
+
+// 预算终态路径也发终态 usage。
+func TestBudgetStopEmitsTerminalUsage(t *testing.T) {
+	var sawUsage bool
+	regB := tools.NewRegistry(t.TempDir())
+	regB.Register(&countingTool{name: "read_file"})
+	resB, err := Run(context.Background(), Config{
+		Model: "fake", Budget: &Budget{MaxToolCalls: 1}, Tools: regB,
+		Stream: script(
+			llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopToolCalls,
+				ToolCalls: []llm.ToolCall{{ID: "c1", Name: "read_file", Arguments: `{}`}}},
+			llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopToolCalls,
+				ToolCalls: []llm.ToolCall{{ID: "c2", Name: "read_file", Arguments: `{}`}}},
+		),
+		OnEvent: func(e Event) {
+			if e.Type == "usage" {
+				sawUsage = true
+			}
+		},
+	}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil || resB.Err == nil {
+		t.Fatalf("预算必须触发 budgetStop（Result.Err 非空）：err=%v res.Err=%v", err, resB.Err)
+	}
+	if !sawUsage {
+		t.Fatal("budgetStop 必须发终态 usage")
+	}
+}
+
+// 默认重试：0 值 = 2 次；事件进事件面；负值关闭。
+func TestDefaultRetryAttemptsTwo(t *testing.T) {
+	var calls int
+	var events []string
+	stream := func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+		calls++
+		ch := make(chan llm.Event, 3)
+		if calls < 3 {
+			ch <- llm.Event{Kind: llm.KindError, Retryable: true,
+				Err: &llm.StreamError{Message: "boom", Retryable: true},
+				Message: llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopError}}
+		} else {
+			ch <- llm.Event{Kind: llm.KindMessageEnd, Message: llm.Message{Role: llm.RoleAssistant, Content: "成了", StopReason: llm.StopEnd}}
+		}
+		close(ch)
+		return ch
+	}
+	res, err := Run(context.Background(), Config{
+		Model: "fake", Stream: stream,
+		OnEvent: func(e Event) { events = append(events, e.Type) },
+	}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil {
+		t.Fatalf("第 3 次应成功：%v", err)
+	}
+	if res.Err != nil {
+		t.Fatalf("第 3 次应成功：%v", res.Err)
+	}
+	if calls != 3 {
+		t.Fatalf("默认 2 次重试 + 首发 = 3 次调用，得到 %d", calls)
+	}
+	var starts int
+	for _, t2 := range events {
+		if t2 == "auto_retry_start" {
+			starts++
+		}
+	}
+	if starts != 2 {
+		t.Fatalf("auto_retry_start 事件数 = %d：%v", starts, events)
+	}
+}
+
+func TestNegativeRetryAttemptsDisables(t *testing.T) {
+	var calls int
+	stream := func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+		calls++
+		ch := make(chan llm.Event, 1)
+		ch <- llm.Event{Kind: llm.KindError, Retryable: true,
+			Err: &llm.StreamError{Message: "boom", Retryable: true},
+			Message: llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopError}}
+		close(ch)
+		return ch
+	}
+	res2, err := Run(context.Background(), Config{
+		Model: "fake", Stream: stream, RetryAttempts: -1,
+	}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil || res2.Err == nil {
+		t.Fatalf("必须失败（Result.Err 非空）：err=%v res.Err=%v", err, res2.Err)
+	}
+	if calls != 1 {
+		t.Fatalf("负值必须关闭重试（1 次调用），得到 %d", calls)
+	}
+}
+
+// 已出增量后不再重试（既有语义保持）。
+func TestRetryNeverDuplicatesForwardedDeltas(t *testing.T) {
+	var calls int
+	stream := func(ctx context.Context, model string, msgs []llm.Message, _ []llm.ToolDecl, _ llm.StreamOptions) <-chan llm.Event {
+		calls++
+		ch := make(chan llm.Event, 3)
+		ch <- llm.Event{Kind: llm.KindTextDelta, Text: "半截"}
+		ch <- llm.Event{Kind: llm.KindError, Retryable: true,
+			Err: &llm.StreamError{Message: "boom", Retryable: true},
+			Message: llm.Message{Role: llm.RoleAssistant, StopReason: llm.StopError}}
+		close(ch)
+		return ch
+	}
+	res3, err := Run(context.Background(), Config{Model: "fake", Stream: stream}, llm.Message{Role: llm.RoleUser, Content: "go"})
+	if err != nil || res3.Err == nil {
+		t.Fatalf("出增量后错误不得重试但须失败：err=%v res.Err=%v", err, res3.Err)
+	}
+	if calls != 1 {
+		t.Fatalf("出增量后不得重试（1 次调用），得到 %d", calls)
+	}
+}
+
+var _ = errors.New
+var _ = strings.Contains
+var _ = time.Now