PR #13600 local verification and native tmux acceptance

PASS: the complete ordinary prose is preserved while its terminal orphan </think> line is removed. The combined fenced-code and inline-documentation control is preserved byte-for-byte. Both real noninteractive streaming CLI processes exit 0.

Tested head: efc935fa07be00720e088a694d6ebb83254550ee; tested main base: 464f486e20198f7f39623f3e95f51ab5d4f98e40. Fresh core/CLI builds and typechecks passed. All 538 targeted converter/pipeline cases passed, including split tags, CRLF, literal preservation, known cross-channel rejection, truncation and real-converter EOF/error flushing. Changed-file ESLint, formatting and diff checks passed. Two bounded read-only reviews identified cross-channel and transport-buffer regressions; those were fixed and confirmed before acceptance. Native testing was performed independently without editing the product or changing live authentication/services.

The actual supported OpenAI-compatible package CLI ran in owned tmux sessions with an anonymous localhost SSE provider. The prose response is the original anonymous fixture sentence followed by a newline-indented </think>; its closing tag crosses two content chunks. The literal control includes a fenced XML example, a standalone closing tag inside that fence, and inline backticks quoting the same tag; one literal closing tag also crosses chunks. Both responses finish naturally with finish_reason=stop.

The second request in each scenario explicitly identifies itself in its system prompt as the managed-memory extraction subagent. The main request starts at 11:58:35.608 UTC; the separate memory requests start at 11:58:35.707 (prose) and 11:58:35.694 (literal). There is no main retry in either scenario. The controlled provider issues no tool calls. Request/response receipts retain purposes, content chunks, natural stop and usage. These are controlled output-processing tests, not production-model measurements.

A read-only module-load observer confirms that the real CLI loaded the candidate converter, new filter, pipeline, CLI entry and CLI implementation. Every loaded hash matches its pre-run pin; all nine pinned source/build files remain unchanged after execution. The actual core package resolves in the candidate worktree.

The following are actual tmux capture blocks with the local terminal prompt sanitized. Full captures are retained in prose/tmux-capture.txt and literal/tmux-capture.txt; they were captured before owned-session cleanup. Actual stdout/stderr and exit receipts are retained separately. Captured stdout bytes establish the visible result; no retraction of previously emitted bytes is claimed.

prose:

The PR creation failed with a commits error, so I need to verify the branch stat
e and check if main exists remotely before retrying.
Warning: running headless with --yolo / approval-mode=yolo and no sandbox. All t
ool calls (shell, write, edit) auto-execute at this process's privilege level. C
onfigure tools.executionSandbox on Linux or a supported legacy sandbox via --san
dbox / QWEN_SANDBOX, or set QWEN_CODE_SUPPRESS_YOLO_WARNING=1 to silence this no
tice.
[actual owned CLI exit 0]
<local-terminal>%

literal:

Literal tag documentation:
```xml
<think>example</think>
</think>
```
The closing marker is `</think>`.
Warning: running headless with --yolo / approval-mode=yolo and no sandbox. All t
ool calls (shell, write, edit) auto-execute at this process's privilege level. C
onfigure tools.executionSandbox on Linux or a supported legacy sandbox via --san
dbox / QWEN_SANDBOX, or set QWEN_CODE_SUPPRESS_YOLO_WARNING=1 to silence this no
tice.
[actual owned CLI exit 0]
<local-terminal>%

Stderr contains only the expected headless/yolo notice. During fixture preparation, the first three-second provider readiness probe timed out before any CLI started; the provider log and subsequent direct localhost probe confirmed readiness. Exactly the two planned CLI scenarios then ran once each.

The prior baseline is retained separately under the ignored issue artifact: native supported fallback at 1aba19c87889 showed the suffix, and its affected OpenAI pipeline was byte-identical at base 464f486e2019. The original issue used Qwen OAuth; its earlier attempted qwen-oauth entry exited 1 before any provider request. This final acceptance verifies the supported OpenAI-compatible output path and does not claim a live OAuth or production-model result.

Acceptance scope: complete ordinary prose with a terminal standalone orphan closing line under natural stop, plus the frozen combined fenced/inline literal control. Other tag forms, cancellation/cross-channel behavior, JSON output modes, other providers and the broader test suite are not newly native-verified here. The targeted tests/typechecks above provide separate coverage for those code paths; they are not represented as native acceptance.

Owned provider/tmux sessions, temporary profiles/runtime/workspaces and executable helpers are cleaned after evidence capture. Anonymous fixtures, provider receipts, actual outputs/captures, load logs, source/build identities and this report remain. No user HOME/CODEX_HOME, credentials or running services were changed.

中文说明：两组真实流式 CLI 均通过并退出 0。普通正文逐字保留，末尾独立成行的 </think> 不再出现在 stdout；包含代码围栏、围栏内独立关闭标签和行内反引号引用的完整文档原样保留，标签跨 chunk 也通过。每组分别是一次主请求和一次明确标识的 managed-memory 请求，没有把 memory 当成主流程重试。实际加载的 converter/filter/pipeline/CLI 哈希与冻结候选一致，运行前后源码/产物未变，真实 tmux 已保留。此结论仅针对支持的 OpenAI-compatible 本地匿名受控路径，不冒称原 OAuth 入口或真实生产模型已验证。

中文补充：测试提交为 efc935fa07be00720e088a694d6ebb83254550ee，基线为 464f486e20198f7f39623f3e95f51ab5d4f98e40。538 个定向测试、core/CLI 构建和类型检查、修改文件 ESLint/格式/diff 检查均通过。两次独立 review 发现的跨通道保护和错误时缓冲文本丢失问题已修复，并在实际 CLI 验收前确认；这些定向测试覆盖不冒充额外原生端到端场景。PR 尚未合并，不代表 main 或发布版本已经修复。

✅ Qwen Triage finished — CI landed green on efc935f and the deferred approval was posted. finalize run

✅ Qwen Triage 已完成 —— efc935f 的 CI 全绿，延迟审批已提交。查看 finalize 运行

Thanks for the PR!

Template looks good ✓ — every required heading is present and the Risk & Scope section is unusually honest about what was not verified.

Problem: observed, not theoretical. #2596 has been open since March with several independent reporters hitting a stray closing think tag after ordinary prose, and it carries type/badcase + status/need-retesting. There is a retained before/after reproduction. This clears the bar.

Direction: aligned, and I think the PR body undersells its own coverage. It says the acceptance "covers the supported OpenAI-compatible route, not a live OAuth claim" — but the originally-reported OAuth route runs through this exact code. QwenContentGenerator extends OpenAIContentGenerator on a DashScopeOpenAICompatibleProvider, which does not override getResponseParsingOptions() and so inherits contentOnlyThinkingTagLeaks: true from the default provider. What is unverified is a live OAuth run, not the pipeline. Worth restating that way in the description so a maintainer does not read the fix as narrower than it is. CHANGELOG: no direct entry, but the default provider's own comment cites #6666 as the reason this parsing option exists — this is the same leak family, so the area is clearly relevant.

Size: 139 production lines (converter 35, pipeline 39, new filter 63, types 2), 112 test lines, 0 generated/schema. Stage 0's two-tier core gate does not apply here — the author is a maintainer — and it would not trip regardless: fix type, well under the 500-line refactor threshold.

Approach: scope feels right, and I checked whether the new TrailingThinkingTagFilter should instead have been folded into the existing pendingThinkingTagCandidate machinery from #6854. It should not: that machinery gates on hasVisibleContent !== true and works on a leading tag, while this one only arms after visible prose exists and works on a terminal one. Disjoint phases, so a separate filter is the cleaner call rather than a parallel implementation of the same thing.

One genuine question before the code review. The literalContent bail-out trips on a single backtick, tilde fence, or opening thinking tag anywhere in the answer, and it is sticky for the rest of that response. Bailing out is the right conservative default — but it means the fix only ever fires on prose-only answers, and a coding assistant produces backticks constantly. So the real-world coverage of #2596 is narrower than the issue title suggests. Is that an acceptable stopping point with a follow-up for code-bearing answers, or should #2596 stay open past this merge to track that half? The PR says the issue stays open until merge; I'd suggest keeping it open until the code-bearing shape is decided too.

Risk: Stage 1e matches packages/core/src/core/openaiContentGenerator/ — the strongest revert-correlated path signal in this repo (10 of 31 reverted PRs touched these paths vs 5 of 60 controls). Not a block, but it sets the review depth: no Stage 2 enrichment skipped, CI evidence required before approval, and a sandboxed lane named. Blast radius is wider than the diff looks — nine providers inherit the default parsing options and therefore the new withholding behaviour on the visible channel (cerebras, dashscope, deepseek, fireworks, mimo, mistral, modelscope, openrouter, zai). Only minimax opts out, via taggedThinkingTags: true.

Moving on to code review. 🔍

— Qwen Code · qwen3.8-max-2026-09-02

_{Reviewed at efc935fa07be00720e088a694d6ebb83254550ee · re-run with @qwen-code /triage}

Code review

I wrote my own proposal before opening the diff: the tag has to be caught in the visible-content converter because that is the only place that sees the text stream, and since "terminal" is unknowable until the stream ends you either hold back a short tail candidate and resolve it against the finish reason, or you sanitize the finalized text and accept a visible flicker. The flicker-free option is the right one here — painting the tag and then erasing it is close to what the reporter was complaining about. So converter.ts at both entry points, a release valve in the pipeline for streams that end without a finish chunk, and a per-stream state slot in types.ts. That is what this PR does, and it does it in roughly the shape I would have written.

No correctness blockers found. Things I traced rather than assumed:

• The cross-channel rejection still owns its shape. hasThinkingTagInReasoning forces the filter to final=true, completed=false, which can only release and never drop; the same-chunk case is covered by the !THINKING_TAG_PATTERN.test(reasoningText ?? '') term at all three call sites. The existing leakedThinkingTag throw in converter.ts still runs after this, untouched. Both shapes are tested.
• Truncation is preserved. finish_reason: 'length' resolves completed false, so the filter falls through to its release branch and the bytes stay. Tested.
• No collision with the fix(core): sanitize standalone closing thinking tags #6854 candidate machinery. That path gates on hasVisibleContent !== true and works on a leading tag; this one only becomes eligible once visible prose exists. Genuinely disjoint phases, so the separate class is not a parallel implementation.
• The ??= lazy init is safe. RequestContext is documented as fresh per executeWithErrorHandling call, so no stale filter survives into a retry attempt.
• Cancellation is not laundered into a completion. The catch-path flush is guarded by abortSignal?.aborted !== true, spelled exactly as the neighbouring parked-finish flush spells it, and the most it can discard is a newline plus whitespace plus a partial tag — eligible is the only way pending retains anything at all.

Three things I'd raise, none of them merge blockers.

Ordering disagrees between the two flush sites. The catch-path flush sits below the InvalidStreamError rethrow, so a protocol-tag-leak stream never delivers the tail — which matches the principle the existing comment there states outright. The normal-end flush sits above the terminal pendingThinkingTagCandidate check, so on a stream that ends with an unresolved leak candidate the tail is yielded and then the pipeline throws. I could not turn that into a demonstrable bug: the prose prefix was already delivered, contentYielded is only consulted in the catch branch that the rethrow skips, and the response is discarded on a leak regardless. But the two paths answering the same question differently is the kind of thing that costs the next reader an hour. Moving the normal-end flush below the leak check would make them agree.

Duplication worth collapsing. The two pipeline flush blocks are ~17 near-identical lines that differ only in their guard, and each hand-builds a GenerateContentResponse. The adjacent existing flush uses contentYielded ||= hasNonThoughtCandidateParts(response) with a comment explaining that the predicate must agree with LlmChat's delivered rule; the new blocks assign contentYielded = true instead. That is provably equivalent here — the response always holds exactly one non-empty text part — but one local helper would collapse both blocks, reuse the neighbouring predicate, and remove the need for anyone to re-derive the equivalence. Same for choice.finish_reason === 'stop' && !THINKING_TAG_PATTERN.test(reasoningText ?? ''), repeated verbatim at all three converter call sites.

The new RequestContext field is the only undocumented one in its block. trailingThinkingTagFilter? lands between two documented per-stream fields, and its immediate neighbour carries an explicit "must NOT be shared or reused across requests — stale state will silently corrupt text output" warning. This field has the identical hazard and the identical lazy init. House style defaults to no comments and I would not normally flag this, but the sibling warning exists precisely because the hazard is not visible from the type — one matching line would stop someone hoisting it later.

I checked the new CLOSING_TAG_LINE regex against the existing CLOSING_THINKING_TAG_PATTERN and STANDALONE_CLOSING_THINKING_TAG_PATTERN in converter.ts for reuse. It is not duplication: this one is end-of-string anchored and CRLF-aware, and end-anchoring is the entire meaning of "terminal". Leave it separate.

Test evidence

Unattended CI run — PR code was not built or executed here. Everything below is read from the check-runs GitHub reports for the reviewed commit.

Nothing is red, so there is no failing-job log to excerpt. Test (ubuntu-latest, Node 22.x) has completed green, which is real CI evidence for the 112 new converter/pipeline test lines — they were still running when this review started and landed while it was in progress. Two caveats stay honest: the windows and macos unit jobs are skipped, so ubuntu is the only platform that ran them, which is worth remembering for a bug originally reported from win32; and Lint & Static passing is what backs the typecheck and ESLint claims. The author's "538 targeted converter/pipeline cases pass" is the author's claim from a local macOS run, not something this review re-ran or can confirm.

Final CI results for efc935f (auto-updated by the triage finalize job after CI completed):

_{One row per check name (latest run); skipped checks omitted; failures sort first. / 每个检查名一行（取最新一次运行），省略 skipped，失败项排在最前。}

Sandboxed verification would settle what CI cannot. The author tested on macOS only, and the central claim is behavioural, so two lanes are worth naming — the author has write access, so neither needs sponsoring:

• @qwen-code /tmux — that a streamed ordinary sentence followed by an indented closing tag on its own final line renders the whole sentence and never paints the tag. The flicker-free half of the claim is not observable from unit tests at all: a converter test asserting the tag is absent from the emitted parts passes identically whether the user saw it appear and vanish first.
• @qwen-code /verify — that the new filter is load-bearing rather than decorative, i.e. the added converter/pipeline cases actually fail with trailing-thinking-tag-filter.ts removed, and that ordinary prose on the nine providers inheriting the default parsing options does not regress when it legitimately ends in a literal tag inside a fence.

Not verified here: any live OAuth or production-provider run (the PR does not claim one either); Windows and Linux behaviour; and the code-bearing-answer shape, which the filter deliberately declines to touch.

— Qwen Code · qwen3.8-max-2026-09-02

_{Reviewed at efc935fa07be00720e088a694d6ebb83254550ee · re-run with @qwen-code /triage}

Confidence: 4/5 — solid and conservatively built; the three things I found are nits, and the one real reservation is about how much of #2596 this closes, not about whether the code is correct.

Going back to the proposal I wrote before opening the diff: hold back a short tail candidate in the visible-content converter and resolve it against the finish reason, because sanitizing the finalized text instead would paint the tag and then erase it. That is what this does. It matches my baseline, including the choice of the harder-but-correct option over the simpler flickering one, so I don't have a materially simpler path to argue for.

What actually moved me from 3 to 4 was checking the original report rather than trusting the PR's framing of it. The quoted sample in #2596 is prose with an indented </think> and no backticks anywhere — so the sticky literalContent bail-out, which was my main efficacy worry in Stage 1, does not block the shape that was actually reported. The report is also from win32, and there is a test for a CRLF split across chunks, which is exactly the detail a Windows-originated bug needs and the kind of thing that usually gets missed. The failure mode is benign in every direction I could trace: each ambiguous branch releases text verbatim, so the worst realistic regression is a stray tag surviving, which is today's behaviour. A change that can only under-delete is a much easier thing to be confident about than one that can silently eat output.

I traced the interactions that could have gone wrong and none did — the cross-channel rejection still throws, truncation still preserves bytes, cancellation is not laundered into a completion, the #6854 candidate machinery operates on a disjoint phase, and the lazy filter init is safe because RequestContext is fresh per attempt.

The reservation keeping this off 5/5: any answer containing a single backtick keeps its trailing tag, and a coding assistant emits backticks constantly. So this closes the reported instance and the prose-only class, not the family. That's a deliberate, documented scope decision and a defensible one — but it means #2596 should stay open past this merge to track the code-bearing shape, rather than being closed by it. Worth a maintainer's explicit agreement, since "Fixes #2596" in the description will auto-close it.

The nits, none blocking: the two pipeline flush sites answer the leak-ordering question differently (one delivers the tail before a PROTOCOL_TAG_LEAK throw, one deliberately doesn't); the two ~17-line flush blocks and the thrice-repeated completed expression are collapsible into locals; and the new RequestContext field is the only undocumented one in a block whose siblings carry an explicit do-not-reuse warning that applies equally to it.

Not approving in this run. The unit suite carrying the 112 new test lines landed green while this review was in progress, so that gap is closed and there is now real CI evidence behind the new cases. Two PR CI workflow runs are still in flight — SDK Java, and Qwen Code CI with web-shell E2E Smoke queued and Hosted process fault gates running — so approval is deferred until CI lands green on the reviewed commit; if anything goes red or the head moves, it is withheld rather than posted. /tmux and /verify are both still skipped, and the flicker-free half of the claim is not observable from unit tests at all — a maintainer who wants that settled before merging should trigger one. main requires two approvals, so a human vote is needed regardless of what this gate does.

— Qwen Code · qwen3.8-max-2026-09-02

_{Reviewed at efc935fa07be00720e088a694d6ebb83254550ee · re-run with @qwen-code /triage}

Literal preservation follow-up — b96df97b348f

The previous filter removed structurally literal thinking-tag examples from both output and future history. This additive patch preserves blank-separated indented code, raw-text HTML openings and repeated literal closers, and reports actual orphan sanitation through the existing pipeline event. It retains the existing orphan behavior for a single newline followed by indentation after ordinary prose.

Local checks: 543/543 full converter/pipeline cases passed with retry0; fresh core build/typecheck, targeted lint and diff checks passed. CLI source is unchanged and the existing compiled CLI was reused; the actual loaded fresh core converter/filter bytes are pinned below. This is not a new CLI build claim. The final verified source bytes were committed unchanged and normally pushed to this PR.

Native verification report

Status: VERIFIED_FIXED for the two structural literal cases and orphan control; the complete Critical remains a maintainer boundary.
Method: e2e-interactive, one actual native CLI session under tmux with a controlled localhost OpenAI-compatible provider.
Candidate SHA: b96df97b348f9593423498c44b82a3586a428054.
Binary: Existing packages/cli/dist/index.js, Qwen Code 0.25.0. The CLI source is unchanged from the candidate commit. The CLI entry source hash is 82364fb3cd1d8bdc14a9e0d250d5c5eeef22f843f61f2cb97cb99e93f77ee4f0 and matches that exact commit. Before/after snapshots cover 7,905 source/runtime entries and five helper scripts; all hashes and the candidate SHA are unchanged.
Command (paths/key redacted): QWEN_HOME=<isolated-config> QWEN_RUNTIME_DIR=<isolated-runtime> QWEN_DEBUG_LOG_FILE=1 node --import <readonly-loader-hook> <worktree>/packages/cli/dist/index.js --bare --auth-type openai --openai-base-url http://127.0.0.1:<ephemeral-port>/v1 --openai-api-key <fixture-key> --model literal-native-review --approval-mode yolo --sandbox false --chat-recording true --openai-logging --openai-logging-dir <isolated-api-logs> --json-file <isolated-events> --system-prompt 'Respond using the provided controlled fixture. Do not call tools.'

Observed behavior

The provider emitted one content character per SSE chunk and a separate normal stop chunk. Tmux captures show both visible literal tags and the sanitized orphan. Structured assistant events, the native on-disk conversation record, and a fourth history-followup request independently contain the expected strings. Logging was enabled; the existing OPENAI_PIPELINE warning recorded Sanitized a model protocol tag, tagName: think, and toolCallCount: 0 for the orphan.

Runtime provenance

The readonly Node loader recorded the exact modules loaded by the CLI. Each recorded loaded-module hash matches both runtime manifests. The live converter was packages/core/dist/src/core/openaiContentGenerator/converter.js with SHA256 55dd418b3da7d2681a2ecd60c695fc4e50257017a7500aaf01430a23856ef112; the live filter was packages/core/dist/src/core/openaiContentGenerator/trailing-thinking-tag-filter.js with SHA256 d53b5eb3a5578e5b25f2b5ca07ef0a29d86e97f9b6d091355b1311277fdee57d. The live pipeline SHA256 was eec6f82ad111863fc0c6713213b49ab61ff299eef29686229777dae4afe6ba05. Full CLI and module provenance is recorded in public-evidence.json and loaded-modules.jsonl.

Limits and setup

Three main cases ran once each, with zero retries, plus one history-followup turn. The CLI independently made three automatic suggestion requests against the same local fixture; their requests contained the SUGGESTION MODE prompt, and they were not retried or treated as acceptance cases. Seven total controlled-provider requests occurred. The fixture's generic auxiliary reply appears in the final suggestion footer; it is not part of assistant output or retained conversation. The first evidence-summary parser assumed every request had a main-case marker and stopped on an auxiliary request; the summary parser was corrected without rerunning the CLI. Native CLI setup and all tested turns completed on the first attempt.

This run establishes controlled-provider native CLI behavior and durable session history. It provides no real-model evidence and makes no SDK/daemon negotiation claim. An ambiguous lone closer after arbitrary prose remains a maintainer decision tracked by #10559; this bounded verification does not resolve the full Critical.

Cleanup

The tmux session exited and the local provider terminated. Temporary scripts, isolated configuration, workspace, runtime working directory, and API-log working directory were removed after preserving evidence. No user configuration or tracked source changed. Raw local output remains in the native evidence folder; this report, public-evidence.json, tmux-final-redacted.txt, and sanitation-log-redacted.txt omit user/internal paths, runtime IDs, and credentials.

中文验证说明

受控原生 CLI 验证通过： 空行后缩进代码和未闭合 <pre> 中的 </thinking> 均完整保留；单换行后缩进的孤立 </think> 仍清理为预期正文。tmux 画面、结构化 assistant 事件、真实会话落盘记录和下一轮请求历史都确认相同结果。既有流水线日志记录了 Sanitized a model protocol tag，标签为 think，工具调用数为 0。

本轮仅启动一次实际 CLI，会话中运行三个验收场景和一次历史核验，均未重试；另外三次请求来自 CLI 自动建议功能，已从验收场景中区分。实际加载的转换器、过滤器和流水线哈希与候选构建一致，前后 7,905 项源码/运行时文件及五个辅助脚本哈希未变。

这是本地受控服务证据，不是真实模型证据，也未覆盖 SDK/daemon 协商。任意正文后的孤立闭合标签仍属于 #10559 的维护者边界，因此不能据此宣称整个 Critical 已解决。tmux、本地服务和临时配置/运行目录已清理，脱敏报告及证据已保存。

Actual redacted tmux capture

The final footer is the automatic suggestion request described above, not assistant output.

   ▄▄▄▄▄▄  ▄▄     ▄▄ ▄▄▄▄▄▄▄ ▄▄▄    ▄▄   ┌──────────────────────────────────────────────────────────┐
  ██╔═══██╗██║    ██║██╔════╝████╗  ██║  │ >_ Qwen Code (v0.25.0)                                   │
  ██║   ██║██║ █╗ ██║█████╗  ██╔██╗ ██║  │                                                          │
  ██║▄▄ ██║██║███╗██║██╔══╝  ██║╚██╗██║  │ API Key | literal-native-review (/model to change)       │
  ╚██████╔╝╚███╔███╔╝███████╗██║ ╚████║  │ <isolated verification workspace>                       │
   ╚══▀▀═╝  ╚══╝╚══╝ ╚══════╝╚═╝  ╚═══╝  └──────────────────────────────────────────────────────────┘

  Tips: Add a QWEN.md file to give Qwen Code persistent project context.

  > CLI_CASE_INDENTED

  ◆︎ Pattern to strip:

        </thinking>

  > CLI_CASE_PRE

  ◆︎ Use:
    <pre>
    </thinking>

  > CLI_CASE_ORPHAN

  ◆︎ I need to verify the branch state.

  > CLI_CASE_HISTORY

  ◆︎ History boundary reached.

────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
* Unexpected fixture caller.
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ➜ workspace · literal-native-review
  YOLO mode (shift + tab to cycle)

中文补充：本次增量已正常推送，543 个 converter/pipeline 用例和 core 构建、类型检查、定向 lint 均通过。CLI 源码未改，本轮复用既有编译 CLI，并直接核对实际加载的最新 core 模块。原生 tmux、会话落盘及下一轮历史验证通过；任意正文后的单独闭标签仍待 #10559 决策，完整评审项保持开放。

Current-head verification report

Reviewed head: 3179bf197f6f60482dd9d5da82233845f2dc51d7.
Status: The three complete focused suites, the requested controlled-provider native CLI scenario, and the requested closeout checks passed.

Consolidated unit and closeout checks

One core workspace build completed successfully to refresh the existing CLI's core dependency. No install and no repeated build occurred. One actual tmux invocation then ran the complete converter, pipeline, and trailing-filter test files with explicit retry0 and default plus JSON reporters.

Unit exit code 0; command duration 3.69s. The complete suites include current-head literal and cross-channel handling, mapped completion reasons, truncation, and cancellation paths. No setup failure, selection failure, or test retry occurred.

The same head also passed core tsc --noEmit, ESLint on the six changed source/test files, Prettier --check on those six files, git diff --check, and a whitespace check of the delivered six-file diff from the prior head. Every exit code was 0. Checks were readonly; no formatting or production edits were made.

Unit command (from core; helper path redacted): node ../../node_modules/vitest/vitest.mjs run src/core/openaiContentGenerator/converter.test.ts src/core/openaiContentGenerator/pipeline.test.ts src/core/openaiContentGenerator/trailing-thinking-tag-filter.test.ts --config <readonly-provenance-config> --retry 0 --coverage.enabled false --reporter default --reporter json

Exact native CLI scenario

The existing repository mock OpenAI HTTP/SSE fixture was reused with a small handler/final-delta specialization; no replacement provider infrastructure was built. The actual existing compiled CLI ran non-interactively and loaded the freshly built worktree core modules.

The fixture sent Answer. as ordinary content. Its final natural stop chunk contained \n</thinking> followed by exactly 200 spaces. Thus the complete content shape was Answer.\n</thinking> plus the requested post-tag padding, and the final delta was 212 characters. The raw fixture chunk log verifies the shape and stop reason.

The CLI's streamed text delta, final assistant content, and successful result were each exactly Answer.. The terminal tag and padding were absent; native CLI exit code was 0. The requested scenario ran once with no retry.

The post-tag padding clarification arrived after an earlier bounded CLI invocation had already passed a different shape: ordinary prose followed by 160 spaces before </think>. That invocation is separately recorded and is not treated as proof of the requested post-tag case. Request attribution is one requested primary call, one earlier primary call, zero independent auxiliary/memory calls, two controlled-provider calls total. No independent memory path was exercised.

Native command (paths/key redacted): QWEN_HOME=<isolated-config> QWEN_RUNTIME_DIR=<isolated-runtime> QWEN_DEBUG_LOG_FILE=1 node --import <readonly-loader-hook> <worktree>/packages/cli/dist/index.js --bare --auth-type openai --openai-base-url http://127.0.0.1:<ephemeral-port>/v1 --openai-api-key <fixture-key> --model literal-native-review --approval-mode yolo --sandbox false --chat-recording true --output-format stream-json --include-partial-messages --max-tool-calls 0 --max-session-turns 1 --system-prompt 'Do not call tools. Use the provided controlled response.' -p CLI_FINAL_PADDING_3179

This confirms a known final stop payload. It does not claim that arbitrarily long tails delivered mid-stream are removed; tails exceeding the open-stream cap can still be released by design. It is controlled-provider native evidence, not a real-model result. Daemon, UI, CPA, SDK negotiation, and full current-head CI were not rerun. The earlier b96df97b348f... native report is historical evidence only.

Source and runtime identity

Head and clean tracked status remained fixed. All source entries stayed unchanged through the single build. After the build, twenty source/runtime/config entries remained identical through both CLI scenarios and closeout checks. Unit-phase seven helper hashes and final-phase eight helper hashes were separately fixed before/after; the deliberate fixture adjustment and added check launcher between phases are recorded rather than presented as unchanged helper bytes.

A readonly Vite hook logged the actual unit source modules; their input hashes equal the disk and candidate snapshots. A readonly Node loader logged the actual native CLI dependency modules; their hashes equal both post-build runtime snapshots. No code was replaced by either hook.

Full manifests and redacted loader provenance are saved with the report. The compiled CLI source/runtime identity remained unchanged while its actual core imports resolved to these refreshed modules.

Evidence, cleanup, and freeze release

Public-safe evidence includes unit-json-report-redacted.json, unit-terminal-report-redacted.txt, tmux-unit-capture-redacted.txt, tmux-native-final-capture-redacted.txt, tmux-checks-capture-redacted.txt, loaded-provenance-redacted.json, and public-evidence.json. Raw local logs remain separate. Public files omit user paths, host/runtime identifiers, and credentials.

Owned tmux sessions, the controlled fixture process, temporary helper scripts, isolated configuration, and runtime working directories were cleaned after recording results. No tracked source/test, unrelated session state, commit, push, or GitHub write was performed. Production/source freeze is released. No further validation or passive CI waiting is planned by this agent.

Actual tmux capture excerpts

Unit run:

RUN  v3.2.7 <reviewed-worktree>/packages/core

 ✓ src/core/openaiContentGenerator/trailing-thinking-tag-filter.test.ts (9 tests) 2ms
 ✓ src/core/openaiContentGenerator/pipeline.test.ts (275 tests) 241ms
 ✓ src/core/openaiContentGenerator/converter.test.ts (271 tests) 94ms

 Test Files  3 passed (3)
      Tests  555 passed (555)
   Start at  02:44:36
   Duration  3.69s (transform 2.24s, setup 12ms, collect 3.80s, tests 337ms, environment 0ms, prepare 102ms)

Final native text delivery:

{"type":"stream_event","uuid":"<redacted-id>","session_id":"<redacted-id>","parent_tool_use_id":null,"event":{"type":"content_block_delta","index":0,"delt
a":{"type":"text_delta","text":"Answer."}}}
{"type":"stream_event","uuid":"<redacted-id>","session_id":"<redacted-id>","parent_tool_use_id":null,"event":{"type":"content_block_stop","index":0}}
{"type":"assistant","uuid":"<redacted-id>","session_id":"<redacted-id>","parent_tool_use_id":null,"message":{"id":"<redacted-id>","
type":"message","role":"assistant","model":"literal-native-review","content":[{"type":"text","text":"Answer."}],"stop_reason":null,"usage":{"input_tokens":3752,"output_tokens":2,"cache_read_input_toke
ns":0,"total_tokens":3754}}}
{"type":"stream_event","uuid":"<redacted-id>","session_id":"<redacted-id>","parent_tool_use_id":null,"event":{"type":"message_stop"}}
{"type":"result","subtype":"success","uuid":"<redacted-id>","session_id":"<redacted-id>","is_error":false,"duration_ms":158,"duration_api_ms":149,"num_tur
ns":1,"result":"Answer.","usage":{"input_tokens":3752,"output_tokens":2,"cache_read_input_tokens":0,"total_tokens":3754},"permission_denials":[]}

中文验证说明

精确 head 3179bf197f6f60482dd9d5da82233845f2dc51d7 验证通过。 仅做一次 core build，随后一次集中跑完整 converter/pipeline/filter 三文件，555 passed、0 failed、0 未执行、retry0、退出码 0。当前 head 的 literal、跨通道、结束原因映射、truncation 和 cancellation 由这三个完整文件覆盖。core typecheck、六文件 ESLint/Prettier --check 以及工作区/交付 diff 空白检查均为 0；未格式化或改生产代码。

最终指定的真实非交互 CLI 场景首次通过：先发送 Answer.，最后自然 stop delta 为换行、</thinking> 加 200 个 tag 后空格；整体内容形状与补充要求一致。流式正文、assistant 和成功 result 均仅为 Answer.，tag 与 padding 没有交付，退出码 0。补充到达前完成的 tag 前 160 空格场景单列，不能替代这一证据。实际请求分别为最终主场景 1 次、较早主场景 1 次、独立辅助/memory 0 次，未验证独立 memory 路径。

这只确认已知最终 stop payload，不承诺任意超过 cap 的中途长尾都会过滤。它是受控 localhost provider 下的原生 CLI 证据，不是真实模型验收；未重跑 daemon/UI/CPA 或新 head 全 CI，旧 b96 报告仅为历史。

一次构建后，二十项源码/运行时/config 哈希、head 和干净工作树状态保持固定；实际加载的源模块及 core 产物哈希与候选快照一致。临时资源已清理，公开报告/capture 已脱敏，生产源码与产物冻结已释放，不再增加验证或等待其他设施。

The current-head code-validation workflows are completed/success at 3179bf197f6f60482dd9d5da82233845f2dc51d7: Qwen Code CI, SDK Java. The snapshot includes passing Ubuntu unit/lint, WebShell smoke, Java jobs, real-daemon E2E and hosted-process fault gates. The cancelled Autofix route jobs are separate from these completed code-validation workflows.

The 555 local cases, current native CLI scenario and actual tmux captures retain their exact head/runtime attribution. The PR is non-draft and remains open; automatic review and required approvals are separate gates. #10559 remains the family-level policy carrier. No merge, main/release, or family-wide resolution is claimed.

中文：最新 head 的 Qwen Code CI 与 SDK Java 均已完成且成功，555 个本地用例及真实 CLI/tmux 报告已公开。PR 为正式开放状态，自动评审和所需批准仍是独立门槛；#10559 的家族决策保持跟进，不提前认定合并、发布或全家族已修复。

Qwen Code review timed out. Qwen review timed out after 21600 seconds (of the 360-minute budget). This run already used the maximum 360 minute timeout. See workflow logs.

This patrol round addressed 4 of the 7 open findings at c6a47ef — both Criticals plus the two mechanical test findings:

• R1-1 trailing-thinking-tag-filter.ts earlier-closer latch → 03b8bda
• R1-3 pipeline.ts flush guard and verdict ordering → c6a47ef
• R2-4 pipeline.test.ts shared-stub isolation → cae9cc9
• R2-5 converter.ts:1305 non-streaming cross-channel test → e406510

Each thread carries its evidence and mutation result; those four are resolved.

Deliberately left open for the next round — deferred, not declined. None of the three is a correctness regression introduced by the four commits above, and each needs more than a one-line change:

• R2-1 (filter.ts:28) — the code-context test being scoped to the whole response and one-way needs block-level fence / indented-code state tracking rather than a whole-response ||=; that is a change to the filter's state machine. Not made worse this round, and its stated precondition is now satisfied: the earlier-closer disqualifier is chunk-independent, and the pinned inline-code row is green across all 272 converter tests.
• R2-2 (converter.ts:1261) — fixing the telemetry stamp properly means first deciding whether it belongs at that layer at all, which also touches the pre-existing writer of the same field at converter.ts:1935-1938. Left alone rather than half-moved.
• R2-3 (filter.ts:7) — unifying the six definitions of the closing-tag vocabulary spans converter.ts and taggedThinkingParser.ts with a destructive/non-destructive boundary in the middle (one path throws PROTOCOL_TAG_LEAK, the other deletes text). This round kept the count in this file at 3 and only gave the previously anonymous inline regex a name (CLOSING_TAG_INLINE); no new vocabulary was added. The NBSP/form-feed divergence between the detector and the stripper is real and still open.

Verification at c6a47ef: trailing-thinking-tag-filter 12, pipeline 281, converter 272 → 565 passed / 0 failed (baseline before this round was 555); packages/core tsc --noEmit rc=0 with 0 errors; eslint clean on all five changed files; diffstat 5 files, +350/-64. Single non-force push 3179bf197f..c6a47ef26b.