fix: close 11 correctness findings in the merged runtime

[zhanghanduo]

Summary

Eleven correctness defects surfaced by a high-effort review of the extracted runtime. All of them are already on main (they predate #15, which the review over-scoped into); none were caught by the suite. They share one shape: each is invisible in the default configuration and only surfaces once a second feature is switched on — a middleware chain gets registered, a ContextPolicy gets an include_fields list, an operator points the loader at an explicit config path, a stream retries.

Five commits, grouped by subsystem so each is reviewable on its own.

Token accounting — e5a71e4

BudgetObserver read ctx.usage["input_tokens"] / ["output_tokens"], but the loop normalises every provider payload to prompt_tokens / completion_tokens. tokens_used stayed 0 for the whole run, so neither the budget_exhausted intervention nor the warn_ratio warning could ever fire. The alias-only tests passed because they fed raw input_tokens.

ContextSizeGuard carries a comment describing having fixed exactly this for itself, and InputTokenGauge open-codes the same two-spelling read — three consumers, three chances to get it wrong. Added usage_input_tokens / usage_output_tokens beside extract_usage and routed all three through them.

LLM middleware — 871fff3

• SummarizationMiddleware bounded its orphan-avoidance loop at len(rest) - 1, one element short. With keep_recent=3 over a tail of [assistant(tool_calls), tool, tool, tool] the kept window was [tool] — precisely the orphan the loop exists to prevent, and the Azure 400 No tool call found for function call output it was written to stop.
• LLMProxy.stream emitted run_after from a finally nested inside the retry while True. A stream failing before its first chunk called every middleware's after_llm with an empty LLMResponse and then again with the real one — cost/usage accounting and history-appending middleware double-counted.
• LLMProxy._make_ctx wrote its per-call step_id / prompt_id back into the shared ExecutionScope.metadata. Two concurrent chat / stream calls on one scope (which _next_call_index documents as supported) clobbered each other, so _log_llm_exception attributed failures to the other call's step. Only session_id is scope-stable, so only it is published back.

DAG node wrappers — 7eb7aa2

• metadata["max_retries"] never retried. The condition was err_result is None and attempt < max_retries, making retry depend on a middleware suppressing the error. With the default ExecutionMiddleware.on_error (which returns the error) a node declaring retries raised on attempt 0 and was never retried. The suppression branch keeps its documented behaviour but now logs the swallowed exception, so a genuine crash is no longer traceless.
• A None delta crashed the wrapper. MiniDAGRunner explicitly accepts None as "no state change", but the middleware wrapper passed it into run_after_phase and then result.get(...). A node that worked with no middleware registered raised AttributeError the moment a chain was added — and the surrounding except misreported the contract violation as a middleware error.
• ctx.task_id was empty under a ContextPolicy. The NodeContext wrapper was applied inside the context filter, so task_id_getter read the already-filtered state. Any node whose include_fields omitted task_id — the normal use of the policy — saw ctx.task_id == "", and every task-scoped lookup or telemetry emission from it was attributed to the empty task id.

Skills loader — e4fa196

The auto-reload and reload() both called ExtensionsConfig.from_file() with no argument, discarding the path the config came from and restarting the cwd/env search. For a config loaded from an explicit path outside those locations the search finds nothing and returns empty defaults — and since is_skill_enabled defaults to True for anything unlisted, an operator disabling one skill got every skill re-enabled: the decision inverted, not merely lost. The empty config also carries no _file_path, so has_changed returned False from then on and the state could never recover. ExtensionsConfig now exposes source_path; an unreadable config keeps the previous state rather than failing open.

Separately, toggle_skill was the only accessor that did not discover lazily, so on a fresh loader it was a silent no-op. The existing test called discover() first, which hid it.

Observers — 58de97c

• The landing turn could be replayed with tools. LeakedToolCallRetryObserver returns continue_to_next_turn=True to replay a leaked turn, but LastTurnForcer strips tools via a one-shot _llm_strip_tools that _prepare_llm_request has already consumed — so the replay re-bound tools on the one turn the policy guaranteed would have none. The existing blocked_tool_calls guard cannot see this: with no tools bound nothing was parsed, while a prose answer merely mentioning finalize_answer(...) still trips _looks_like_leak.
• TrajectoryFileObserver read a coalescing bound of 0 as "never due" rather than "bound disabled", contradicting its own module header. With SWARM_TRAJECTORY_COALESCE_N=0 and the default COALESCE_MS=0 the JSON snapshot was written once and frozen until on_loop_end forced a flush — so a process killed before that (OOM, hard timeout) left only the start state, the exact case the snapshot exists for.

Tests

37 new tests across 6 files. Every one was verified to fail against the pre-fix code (by stashing each fix and re-running), so they are regression tests rather than restatements of current behaviour. Two guard the fixes from over-correcting: a healthy non-tool tail must still be kept intact by summarization, and a genuine leak on a normal turn must still retry.

Validation

• uv run ruff check agent_core tests
• uv run pyright agent_core — 0 errors, 0 warnings
• uv run pytest -q — 770 passed (was 711)
• uv build, plus a smoke run of all 11 paths against the built wheel

Note on review scope

The review that produced these ran against a stale local main, so it reported them alongside #15's own findings. #15's four (SpawnGuard reservation leaks, the AgentComm ordinal contract, the EventSink append mismatch, and wall_deadline_s going unenforced) are fixed on that branch; these eleven are independent of it and land here.