Structured generation recovery

Output parameters

Workflow execution has no default aggregate token quota. Explicit user limits remain authoritative. Context reservation is a planning estimate, not the provider output cap. Default requests use the model output capacity constrained by available context; explicit limits are validated without silent reduction. Unknown model limits retain adapter handling. Normal model reasoning does not count as a timeout merely because it is long.

Failure handling

Default recovery allows two extra attempts. Explicit zero disables repair. Each retry reports a reason and attempt identity through existing structured-output and execution-stream events. A regeneration instruction requests a complete value and excludes the invalid partial candidate. Completed tool results remain in context. At model capacity, workflow-specific decomposition is explicit rather than guessed by the generic runtime.

Persistence and observable behavior

Actual requests, effective parameters, stop reasons, available usage, and retries must be distinguishable. Unknown usage stays unknown. Error paths retain metadata without requiring retention of reasoning or sensitive partial text. Paused is distinct from actively retrying. Existing durable execution and effect records own restart and side-effect reconciliation; no parallel scheduler is introduced.

Report workflow stages preserve resolved scope, supplied materials, retrieved evidence, and validated draft results. A text-only resume_task is a restart request, not a durable continuation. Acceptance observes pages and prepares local drafts without sending reports.

Implementation order and acceptance

1. Reproduce truncation through agent_loop and Runtime public calls.
2. Separate request output limits from compaction reservations.
3. Recover structured truncation without replaying completed tools; verify sync and async calls.
4. Integrate actual request diagnostics and shared recovery accounting.
5. Verify durable report stages and UI against existing execution lifecycle.
6. Independent specification and quality reviews, followed by final affected gates.

EOF recovery and terminal state

A structured stream that ends without a terminal event consumes the same recovery allowance as length truncation. Partial content is never submitted or executed. Exhausted structured recovery is paused before its error reaches Runtime persistence. Cancellation is cancelled. Normal return alone is not evidence of successful generation; canonical execution status remains authoritative. Public-entry acceptance covers empty EOF, partial EOF, mixed validation failures, disabled recovery, cancellation and completed-tool non-replay.

Repair gate: structured streaming tests, affected Agent execution, provider utilities, Runtime tools and context components, repository contracts, documentation links and diff checks; local integration on the current main snapshot, followed by installed-App source verification.

Browser Workflow reliability

Browser stages expose only the actual web_use tool, using its command-based schema. Inspection requires real browser observations; a textual JSON example is not a tool receipt. Prompts describe list_pages, observe and act according to the current tool contract. Missing tools, login and permission failures remain explicit failures; they never authorize another transport or a write.

A workflow that starts with an origin window but no bound Page preserves that origin context when it calls web_use(command="list_pages"). In a subprocess, Page inventory then goes through the parent webtab bridge, which accepts only the originating window and bindings authorized for that execution. The child keeps its own registry for Page tokens and consumes those tokens in the same process; a token is not transferred between parent and child registries. If there is no authorized origin context, inventory does not fall back to all desktop windows.

Automatic URL opening through web_use, including the direct MCP entry and page recovery, explicitly creates a background Page through Resources. It does not depend on a foreground chat route, a mounted Browser pane or pre-existing pages. Window registration and native Page target availability are distinct failure stages. The direct MCP entry preserves an explicit failed browser result as ToolReturn(is_error=True); HTTP dispatch success does not imply a successful browser operation. Acceptance starts with an empty page inventory and opens and observes a URL without manual Browser creation.

The Desktop bridge registers its exact window identifier immediately on startup and reconnection, before awaiting retained-view or resource restoration. Restoration completion may repeat the idempotent registration. A pending restoration must not prevent a Workflow from opening its first page. Registration never selects another window or broadens ownership.

desktop_unavailable means that the worker cannot use a registered Desktop WebTab at that moment. It is separate from a model response that imitates a tool call and separate from the browser page's network or document content. The installed default service is accepted only after the public /api/web-use boundary lists a page and observes it, returning a title and observation identifiers without submitting or saving an external record.

The repair uses existing Agent recovery and execution lifecycle primitives. It does not introduce a second scheduler, infer durable checkpoints from strings, bypass browser permissions, or automatically submit a report during acceptance. A new durable report state machine is outside this repair; failures must remain honest until explicit durable steps exist.

Implementation includes browser origin forwarding, immediate Desktop window registration, repetitive-response recovery, tool receipt retention and truthful error propagation. Public regressions cover these boundaries. Report writes require a real observed save/submit action and matching post-action observation with positive success evidence; an explicit failure or missing confirmation remains an unknown, non-retryable outcome. Independent report packages maintain their own revisions. Review results, complete verification and installed revisions are recorded in the task handoff; passing deterministic checks alone does not establish live external write success.

Model routing and group-report recovery

A subscription provider must preserve an explicit selected model identifier in both the request body and the routing header. The Grok proxy routes by x-grok-model-override; named models must not be silently replaced with grok-build. An explicitly selected alias remains an alias. Native function calls are executed only from provider function-call events, never by parsing tool-like prose.

The read tool treats an explicit null offset or limit as the omitted pagination argument. Strict tool schemas represent optional fields as required nullable fields, so this boundary normalizes only these two read parameters before choosing text or PDF handling. Text defaults remain line 1 and 2000 lines; PDF defaults remain page 1 and 20 pages. Explicit numeric pagination is unchanged. No global null removal or authorization change is introduced. A public adapted-tool regression verifies strict-schema arguments against text and PDF input. This separately reproduced compatibility defect is not established as the cause of the historical group-report failure.

The target recovery contract treats provider dispatch count as diagnostic, not a second failure allowance. Structured validation, repetitive output and transient transport recovery consume the existing invocation-local recovery state. A successful tool round does not consume failure recovery. A provider request that succeeds after transient transport retries returns them to the state, so transport recovery is bounded per request while structured and repetitive-output repairs accumulate over the invocation; a long Agent loop is not ended by blips that earlier requests already recovered from. Cancellation, explicit caller deadlines and non-retryable external effects remain authoritative. Exhaustion retains the original cause and a terminal recovery phase.

Group-report parsing may use prompt-based schema validation when the provider cannot express the requested schema exactly. Live acceptance exercises this actual mode with its read-only tools, not only a simpler native-schema request. Runtime errors propagate as execution errors rather than successful BLOCKED strings. Genuine missing member attribution remains a request for clarification and never permits invented authors. Local draft generation does not authorize messaging or external submission.

Verification covers a real-provider routing comparison, a native read-only tool call, the original supplied-material parse, and a complete local draft using explicitly attributed test data. Deterministic public Runtime tests cover combined transport and format repair, exhausted recovery and completed-tool preservation. Independent specification and quality review precede final complete verification and installation. Permission-policy changes and unrelated UI redesign are excluded from this repair.

Implementation status

AgentSession reserves the existing invocation-local recovery state before each automatic retry. Transport and format recovery therefore share one failed-recovery count. When that state exists, it is the sole retry-count authority for the session: a larger caller recovery allowance does not encounter a hidden local retry cap or restart completed tools. Explicit retry disabling remains respected. When recovery is exhausted, the original provider failure is retained and marked transport-exhausted so Runtime cannot restart the full invocation. Completed tool results remain in the same AgentSession context. Standalone AgentSession callers without an enclosing recovery state retain their existing retry settings. Public Runtime regressions cover combined internal errors and invalid JSON, recovery beyond the standalone limit, exhaustion and exactly-once completed-tool execution. The compatibility request counter remains; its removal is not claimed. Independent specification and quality reviews, complete automated verification and real-provider read-only acceptance are recorded in the task handoff.

Local implementation includes shared recovery accounting, output-cap separation, structured length and EOF regeneration, and paused/cancelled failure state. Public-entry regressions cover empty and partial EOF, exhaustion, cancellation, completed-tool preservation, partial-tool rejection and returned provider errors. Weekly report quota removal and parse checkpoints are maintained in the independent workflow package. Real end-to-end weekly report submission remains outside read-only acceptance; unit/component checks do not establish an external write outcome. Local main integration, default App browser acceptance and installed runtime verification are recorded separately in the task handoff.