[Ehsan-hash]

Planning output recovery currently trusts _forest_chunk.total and builds a list of every missing index. A tiny malformed response can therefore trigger a very large allocation before recovery continues.

Limit each output assembly to 2 through 64 complete JSON chunks, rejecting oversized totals before recording them. Progress replies retain at most 16 missing indices and include the exact missing count and a truncation flag. The recovery prompts and runtime documentation describe these bounds; task history and context-read steps remain unrestricted.

Validation: reproduced the original unsafe enumeration with an offline provider fixture and intercepted it before allocating a huge list. Oversized-count tests reach that guard against the original implementation. All 34 affected offline planning tests pass, including native and JSON-only tool formats, complete out-of-order 64-chunk merges, preserved assembly state and bounded progress replies. Two unrelated localhost HTTP transport tests were excluded under the network-disabled test profile. No live provider or model request was made.

Fixes #394

[Ehsan-hash]

The local job passed on 3b80074. The separate observation-integration job exceeded its 15-minute limit while running npx playwright install --with-deps chromium, so the browser tests did not run. Its PostgreSQL/API checks and frontend build passed before that step. No source change or rerun made for this setup timeout.