refactor(scheduler): M1 把 process() 拆成 step 状态机 + TaskFrame（行为等价）

设计依据 docs/zh/input-scheduler-design.md §14 M1。

- 新增 task.go：Step 游标、TaskFrame，以及 stepPrepare/stepLLM/
  stepToolBegin/stepToolExec/stepToolAfter/stepTurnEnd 六个 step；
  原函数内嵌的 provider 回退/重试抽为 resolveProviders + callLLMWithFallback
- process() 改为驱动状态机的薄壳：签名不变，调用方（processInput/
  processConsolidation/测试）零改动
- StepToolExec 显式标注为临界区：工具副作用不可回滚，执行中不是安全点
- 步数上限护栏：转移缺失时以错误退出而非死循环
- 新增 task_test.go：R3（工具往返结果与配对正确）、X3（多轮必然终止）、
  批中途中断必须放弃剩余工具、未知 step 必须失败退出
- 验收：既有 agent 全量测试通过；-race 通过（TMPDIR 指向真实磁盘，
  /tmp tmpfs 已 98% 满会导致链接失败，与代码无关）

internal/agent/core/process.go

@@ -7,12 +7,10 @@ import (
 	"fmt"
 	"log"
 	"strings"
-	"time"
 
 	agentAPI "gitcode.com/JianFeeeee/HomeAgent/internal/agent/api"
 	"gitcode.com/JianFeeeee/HomeAgent/internal/events"
 	sdk "gitcode.com/JianFeeeee/HomeAgent/internal/sdk"
-	pubsdk "gitcode.com/JianFeeeee/homeagent-sdk/sdk"
 )
 
 // continuationPlaceholder 是工具轮之后补的 user 占位内容。
@@ -99,420 +97,6 @@ func dropContinuationPlaceholders(msgs []agentAPI.Message) []agentAPI.Message {
 	return out
 }
 
-func (a *Agent) process(input string, stageCtx *sdk.StageContext) (response string, toolsUsed []string, toolResults []ToolResultItem, err error) {
-	a.mu.Lock()
-	defer a.mu.Unlock()
-
-	if a.provider == nil {
-		return "", nil, nil, fmt.Errorf("agent: no LLM provider configured")
-	}
-
-	budget := ComputeTokenBudget(a.provider, a.systemPrompt)
-
-	memContext := a.buildMemoryContext(input, budget.MemoryTokens)
-	sysPrompt := a.buildSystemPrompt(memContext, input)
-	tools := a.buildToolDefs()
-
-	msgs := a.buildMessages(sysPrompt, input, budget.ContextTokens)
-	// 工具提醒（interrupt）：以 system 角色注入，不让模型误认为用户发言
-	if a.interruptInput {
-		last := msgs[len(msgs)-1]
-		last.Role = "system"
-		last.Content = "[中断消息] " + last.Content
-		msgs[len(msgs)-1] = last
-		a.interruptInput = false
-	}
-	if blocks, ok := stageCtx.Extra["media_blocks"].([]agentAPI.ContentBlock); ok && len(blocks) > 0 {
-		if len(msgs) > 0 {
-			msgs[len(msgs)-1].Blocks = blocks
-		}
-	}
-
-	log.Printf("[agent] tool call loop start, max_ctx=%d target=%d fixed=%d mem=%d ctx=%d %d tools, %d events, personality=%t, docs=%d",
-		budget.MaxContext, budget.TargetUsage, budget.FixedTokens, budget.MemoryTokens, budget.ContextTokens,
-		len(tools), a.context.Len(),
-		a.personality != nil && a.personality.Content != "",
-		a.docStoreSize())
-
-	if a.runStage(sdk.StagePreAction, stageCtx) {
-		return *stageCtx.Response, toolsUsed, toolResults, nil
-	}
-	if len(stageCtx.ContextMsgs) > 0 {
-		for _, m := range stageCtx.ContextMsgs {
-			role, _ := m["role"].(string)
-			content, _ := m["content"].(string)
-			if role != "" {
-				msgs = append(msgs, agentAPI.Message{Role: role, Content: content})
-			}
-		}
-	}
-
-	// lastBatchReplyOnly 记录上一批工具调用是否全部是输出通道发送。
-	lastBatchReplyOnly := false
-
-	for turn := 0; ; turn++ {
-		for _, interrupt := range a.drainInterrupts() {
-			msgs = append(msgs, agentAPI.Message{
-				Role:    "system",
-				Content: "[中断消息] " + interrupt,
-			})
-		}
-
-		// zen 兼容网关要求请求的最后一条消息必须是 user(thinking 续写模式校验),
-		// 工具轮产出的 tool/assistant 消息作结尾会被 400 拒绝,故补一条 user 占位。
-		// 注意:仅当尾部确为工具轮产物(assistant/tool)时才补位;首轮 system 上下文结尾不补,
-		// 否则会错误覆盖实际用户输入(如 injectSourceContext 追加的 system 说明)。
-		//
-		// 补位前先移除前面轮次插入的同类占位，保证占位**不随轮次线性累积**——
-		// 占位是核心插的传输层附加物，不是用户发言，不该在 prompt 里叠成 N 条。
-		//
-		// 文案分情况：上一批全是 output_send__* 时不能说“继续”，详见
-		// replyDeliveredPlaceholder 的说明。
-		msgs = dropContinuationPlaceholders(msgs)
-		if last := msgs[len(msgs)-1]; last.Role == "assistant" || last.Role == "tool" {
-			msgs = append(msgs, agentAPI.Message{
-				Role:    "user",
-				Content: continuationFor(lastBatchReplyOnly),
-			})
-		}
-
-		req := &agentAPI.CompletionRequest{
-			Messages:        msgs,
-			MaxTokens:       4096,
-			Tools:           tools,
-			ToolChoice:      "auto",
-			DisableThinking: !a.thinkingEnabled,
-		}
-
-		var providers []agentAPI.Provider
-		if a.providerManager != nil {
-			// 精确模型名走 byModel 路由；AUTO/空走优先级链
-			var allProviders []agentAPI.Provider
-			if req.Model != "" && !strings.EqualFold(req.Model, "AUTO") {
-				allProviders = a.providerManager.ResolveForModel(req.Model)
-			} else {
-				allProviders = a.providerManager.OrderedProviders()
-			}
-			providers = make([]agentAPI.Provider, 0, len(allProviders))
-			for _, p := range allProviders {
-				if a.providerManager.IsAvailable(p.Name()) {
-					providers = append(providers, p)
-				}
-			}
-		}
-		if len(providers) == 0 {
-			providers = []agentAPI.Provider{a.provider}
-		}
-		var resp *agentAPI.CompletionResponse
-		var llmErr error
-
-		for pi, fbProvider := range providers {
-			if pi > 0 {
-				log.Printf("[agent] LLM fallback: trying provider %q (fallback #%d/%d)",
-					fbProvider.Name(), pi, len(providers)-1)
-			}
-
-			// 同源瞬时错误重试：网关瞬断（502/503/504/429/网络抖动）通常秒级恢复，
-			// 直接跳下一个 provider（或直接报错）会丢掉本可成功的请求。
-			// 凭证错误（401/403）与用户中断不重试。
-			const maxAttempts = 2
-			for attempt := 1; attempt <= maxAttempts; attempt++ {
-				if attempt > 1 {
-					log.Printf("[agent] provider %q transient failure, retry %d/%d in 2s: %v",
-						fbProvider.Name(), attempt, maxAttempts, llmErr)
-					select {
-					case <-time.After(2 * time.Second):
-					case <-a.ctx.Done():
-						llmErr = a.ctx.Err()
-					}
-					if llmErr == nil || errors.Is(llmErr, context.Canceled) || errors.Is(llmErr, context.DeadlineExceeded) {
-						break
-					}
-				}
-
-				fCtx, fCancel := context.WithCancel(a.ctx)
-				a.llmMu.Lock()
-				a.cancelLLM = fCancel
-				a.llmMu.Unlock()
-
-				resp, llmErr = chatStreamWithFallback(fCtx, fbProvider, req, a)
-
-				a.llmMu.Lock()
-				a.cancelLLM = nil
-				a.llmMu.Unlock()
-				fCancel()
-
-				if llmErr == nil {
-					a.providerManager.ResetAvailability(fbProvider.Name())
-					if fbProvider != a.provider {
-						a.provider = fbProvider
-						log.Printf("[agent] switched active provider to %q after fallback",
-							fbProvider.Name())
-					}
-					break
-				}
-
-				// 用户中断：立即终止，不重试也不换 provider
-				if errors.Is(llmErr, context.Canceled) {
-					break
-				}
-				// 凭证错误：重试无意义，跳出重试循环进入 provider 标记/切换
-				var pe *agentAPI.ProviderError
-				if errors.As(llmErr, &pe) && (pe.StatusCode == 401 || pe.StatusCode == 403) {
-					break
-				}
-				// 其余错误（含 5xx/429/网络）：还有重试机会则继续，否则跳出
-			}
-
-			if llmErr == nil {
-				break
-			}
-			if errors.Is(llmErr, context.Canceled) {
-				break
-			}
-			var pe *agentAPI.ProviderError
-			if errors.As(llmErr, &pe) && (pe.StatusCode == 401 || pe.StatusCode == 403) {
-				a.providerManager.ReportStatus(fbProvider.Name(), pe.StatusCode)
-				log.Printf("[agent] provider %q marked unavailable (HTTP %d)", fbProvider.Name(), pe.StatusCode)
-			} else {
-				a.providerManager.MarkUnavailable(fbProvider.Name())
-			}
-			log.Printf("[agent] provider %q failed: %v", fbProvider.Name(), llmErr)
-		}
-
-		if llmErr != nil {
-			if errors.Is(llmErr, context.Canceled) && a.ctx.Err() == nil {
-				if a.currentOutputChannel == "_consolidation_" {
-					return "", toolsUsed, toolResults, fmt.Errorf("interrupted by user input")
-				}
-				continue
-			}
-			return "", toolsUsed, toolResults, fmt.Errorf("all %d providers failed, last error: %w",
-				len(providers), llmErr)
-		}
-
-		stageCtx.LLMText = resp.Content
-		stageCtx.ReasoningContent = resp.ReasoningContent
-		stageCtx.TokenUsage = map[string]int{
-			"prompt_tokens":     resp.TokenUsage.Prompt,
-			"completion_tokens": resp.TokenUsage.Completion,
-			"total_tokens":      resp.TokenUsage.Total,
-		}
-		stageCtx.ToolCalls = convertToolCalls(resp.ToolCalls)
-		for i := range stageCtx.ToolCalls {
-			if stageCtx.ToolCalls[i].Plugin == "" {
-				stageCtx.ToolCalls[i].Plugin = a.resolveToolPlugin(stageCtx.ToolCalls[i].Name)
-			}
-		}
-		if a.runStage(sdk.StagePostAction, stageCtx) {
-			return *stageCtx.Response, toolsUsed, toolResults, nil
-		}
-		resp.Content = stageCtx.LLMText
-		resp.ToolCalls = convertBackToolCalls(stageCtx.ToolCalls)
-
-		chainPayload := map[string]interface{}{
-			"content":    resp.Content,
-			"reasoning":  resp.ReasoningContent,
-			"tool_calls": resp.ToolCalls,
-			"phase":      "intermediate",
-			"turn":       turn,
-		}
-		if resp.TokenUsage.Total > 0 {
-			chainPayload["usage"] = map[string]int{
-				"prompt":     resp.TokenUsage.Prompt,
-				"completion": resp.TokenUsage.Completion,
-				"total":      resp.TokenUsage.Total,
-			}
-		}
-		a.publishEvent(events.EventAgentLLMChain, chainPayload)
-
-		if resp.ReasoningContent != "" {
-			a.publishEvent(events.EventReasoning, map[string]interface{}{
-				"content": resp.ReasoningContent,
-				"channel": a.currentOutputChannel,
-			})
-		}
-
-		if len(resp.ToolCalls) == 0 {
-			return resp.Content, toolsUsed, toolResults, nil
-		}
-
-		// 本批是否全部是输出通道发送（=模型刚交付了给用户的回复）。
-		// 必须在执行前判定：执行过程中的中断/拒绝分支会 continue/break，
-		// 放在循环里统计会漏。
-		replyOnly := true
-		for _, tc := range resp.ToolCalls {
-			if !isOutputDeliveryTool(tc.Name) {
-				replyOnly = false
-				break
-			}
-		}
-
-		contentOnce := true
-		for _, tc := range resp.ToolCalls {
-			if len(a.interceptCh) > 0 {
-				for _, interrupt := range a.drainInterrupts() {
-					msgs = append(msgs, agentAPI.Message{Role: "system", Content: "[中断消息] " + interrupt})
-				}
-				a.publishEvent(events.EventToolCall, map[string]interface{}{
-					"tool":    tc.Name,
-					"plugin":  a.resolveToolPlugin(tc.Name),
-					"args":    tc.Arguments,
-					"status":  "interrupted",
-					"reason":  "user interrupt before execution",
-					"channel": a.currentOutputChannel,
-				})
-				break
-			}
-
-			toolsUsed = append(toolsUsed, tc.Name)
-			pluginName := a.resolveToolPlugin(tc.Name)
-			log.Printf("[agent] executing tool: %s (plugin=%s, id=%s)", tc.Name, pluginName, tc.ID)
-			if tc.RawArguments != "" {
-				log.Printf("[agent] tool %s raw_arguments: %s", tc.Name, truncateStr(tc.RawArguments, 300))
-			}
-
-			sdkTC := sdk.ToolCall{ID: tc.ID, Name: tc.Name, Plugin: pluginName, Arguments: tc.Arguments}
-			stageCtx.ToolCalls = []sdk.ToolCall{sdkTC}
-			stageCtx.ToolResults = nil
-			if a.runStage(sdk.StageBeforeToolcall, stageCtx) {
-				result := fmt.Sprintf("工具 %s 已被插件拒绝", tc.Name)
-				msgs = append(msgs, agentAPI.Message{Role: "assistant", ToolCalls: []agentAPI.ToolCall{tc}})
-				msgs = append(msgs, agentAPI.Message{Role: "tool", ToolCallID: tc.ID, Content: result})
-				a.publishEvent(events.EventToolCall, map[string]interface{}{
-					"tool":    tc.Name,
-					"plugin":  pluginName,
-					"args":    tc.Arguments,
-					"result":  result,
-					"status":  "denied",
-					"channel": a.currentOutputChannel,
-				})
-				continue
-			}
-			tc.Arguments = stageCtx.ToolCalls[0].Arguments
-
-			if pluginName != "" && !a.pluginHealth.isHealthy(pluginName) {
-				result := fmt.Sprintf("插件 %s 处于崩溃状态，已跳过执行，等待自动恢复重载", pluginName)
-				log.Printf("[agent] skip tool %s: plugin %s unhealthy", tc.Name, pluginName)
-				msgs = append(msgs, agentAPI.Message{Role: "assistant", ToolCalls: []agentAPI.ToolCall{tc}})
-				msgs = append(msgs, agentAPI.Message{Role: "tool", ToolCallID: tc.ID, Content: result})
-				continue
-			}
-
-			result := a.executeToolCall(tc)
-			toolResults = append(toolResults, ToolResultItem{Name: tc.Name, Output: result})
-			log.Printf("[agent] tool %s result: %s", tc.Name, truncateStr(result, 100))
-
-			stageCtx.ToolResults = []sdk.ToolResult{{CallID: tc.ID, Name: tc.Name, Plugin: pluginName, Success: true, Result: result}}
-			a.runStage(sdk.StageAfterToolcall, stageCtx)
-			if len(stageCtx.ToolResults) > 0 {
-				if r, ok := stageCtx.ToolResults[0].Result.(string); ok {
-					result = r
-				}
-			}
-			// ContextPolicy: prune 工具调用后执行上下文裁剪（§13.8）
-			if def := a.stageHost.ToolDef(tc.Name); def != nil && def.ContextPolicy == "prune" {
-				if a.context != nil {
-					topK := a.maxContextSize - 1
-					if topK < 1 {
-						topK = 1
-					}
-					// 查询向量取**清洗后**的有效内容，否则噪声（ANSI/base64/JSON
-					// 包装）会把相关性打分带偏，裁掉本该保留的事件。
-					a.context.Prune(a.toolOutputForQuery(tc.Name, result), topK, a.docStore)
-				}
-			}
-
-			msgContent := ""
-			if contentOnce {
-				msgContent = resp.Content
-				contentOnce = false
-			}
-			msgs = append(msgs, agentAPI.Message{Role: "assistant", Content: msgContent, ReasoningContent: resp.ReasoningContent, ToolCalls: []agentAPI.ToolCall{tc}})
-
-			// 多模态工具结果：插件通过 SDK.SetToolBlocks 注入 image_url/audio_url block。
-			//
-			// 媒体不挂在 tool message 上，而是另起一条紧随其后的 user message——
-			// 这也是插件文案一直在说的「注入后续对话」。
-			// 为何不能挂 tool message：同一张图、同一模型、三轮实测——
-			//   图在 user message      → 3/3 读到
-			//   图在 tool message      → 0/3（模型答「没能读到这张图」）
-			//   tool 纯文本 + 后接 user → 3/3 读到
-			// tool message 那轮 prompt_tokens 反而更高（7967 vs 7089），base64 确实
-			// 进了上游，但 role=tool 上的多模态 content 数组不被当作可视内容。
-			//
-			// 主模型不支持该模态时更不能直接塞：网关会把 image_url 静默剥离后仍
-			// 返回 200，模型回答「我没有看到图片」而内核以为注入成功。改走回退链。
-			toolMsg := agentAPI.Message{Role: "tool", ToolCallID: tc.ID, Content: result}
-			var mediaMsg *agentAPI.Message
-			if rawBlocks := a.io.ConsumeToolBlocks(); len(rawBlocks) > 0 {
-				var blocks []agentAPI.ContentBlock
-				for _, b := range rawBlocks {
-					if cb, ok := b.(pubsdk.ContentBlock); ok {
-						// 跨包类型拷贝（pubsdk.ContentBlock → agentAPI.ContentBlock）
-						block := agentAPI.ContentBlock{Type: cb.Type, Text: cb.Text}
-						if cb.ImageURL != nil {
-							block.ImageURL = &agentAPI.ImageURL{URL: cb.ImageURL.URL, Detail: cb.ImageURL.Detail}
-						}
-						if cb.AudioURL != nil {
-							block.AudioURL = &agentAPI.AudioURL{URL: cb.AudioURL.URL}
-						}
-						blocks = append(blocks, block)
-					}
-				}
-				if len(blocks) > 0 {
-					// 先落进 CAS：无论下面走直视还是回退转写，媒体本体都该进记忆。
-					// 不存的后果是 ToolResultItem.Output 只剩那句
-					// "[已将图片注入后续对话] /tmp/x.png"，文件一删线索就断了。
-					a.stageMediaDigests(a.captureBlockMedia(blocks, tc.Name)...)
-
-					if native, fallbackText := a.prepareToolBlocks(blocks); len(native) > 0 {
-						// 能直视：另起一条 user message 承载媒体，并补一句来源说明，
-						// 否则模型会把它当成用户新发的图而不是工具拉回来的。
-						mediaBlocks := append([]agentAPI.ContentBlock{{
-							Type: "text",
-							Text: fmt.Sprintf("[以下是 %s 注入的媒体内容]", tc.Name),
-						}}, native...)
-						mediaMsg = &agentAPI.Message{Role: "user", Blocks: mediaBlocks}
-					} else if fallbackText != "" {
-						// 回退链已把媒体转写成文字：并进 tool message 的纯文本 content，
-						// 不再另起消息（文字在 tool message 里本来就能被读到）。
-						toolMsg.Content = result + "\n\n" + fallbackText
-						result = toolMsg.Content
-						if len(toolResults) > 0 {
-							toolResults[len(toolResults)-1].Output = result
-						}
-					}
-				}
-			}
-			msgs = append(msgs, toolMsg)
-			if mediaMsg != nil {
-				// 必须紧跟在 toolMsg 之后：中间插入其他消息会让 tool_call_id 配对断开。
-				msgs = append(msgs, *mediaMsg)
-			}
-
-			a.publishEvent(events.EventToolCall, map[string]interface{}{
-				"tool":    tc.Name,
-				"plugin":  pluginName,
-				"args":    tc.Arguments,
-				"result":  result,
-				"status":  "ok",
-				"channel": a.currentOutputChannel,
-			})
-
-			if len(a.interceptCh) > 0 {
-				for _, interrupt := range a.drainInterrupts() {
-					msgs = append(msgs, agentAPI.Message{Role: "system", Content: "[中断消息] " + interrupt})
-				}
-				break
-			}
-		}
-
-		// 供下一轮顶部选择补位文案。
-		lastBatchReplyOnly = replyOnly
-	}
-}
-
 // chatStreamWithFallback 优先流式调用 provider，失败时回退非流式 Chat()。
 //
 // 流式路径：ChatStream 拿到 chunk channel，逐块累积 content/reasoning_content，