[hetaoBackend]

Change

Content-review failures could stop a turn without production diagnostics while the TUI blamed the user's network. Both V1 and V2 now emit a bounded failure record in production with a local review ID, endpoint hostname, scene, duration, failure category, and available status code. Transport classification keeps only allowlisted DNS, connection, TLS, timeout, abort, or unknown categories; no raw exception, request/response body, token, attachment URL, or upstream trace header is logged.

The TUI explains that review returned no usable result and withheld unreviewed output. /reload retains the actual diagnostic and no longer directs every failure to keybindings. Legacy and Runtime V2 runners record the session/turn and review-stop outcome separately from the existing completed terminal. Completed still preserves approved output; a real runner failure remains authoritative. Fail-closed behavior and retry limits are unchanged, as is the legacy V1 service-degradation policy.

Refs #218. No community patch was imported. Documentation impact: warning text changes only; no new commands or configuration.

Validation

• Focused regression tests passed for production V1/V2 redaction, DNS/connection/TLS/timeout/abort classification, invalid and unreadable responses, exhausted retries, Runtime V2 failure precedence, TUI review notices, and /reload diagnostics.
• pnpm typecheck and git diff --check: passed.
• Full pnpm verify on clean HEAD 5eca87671f88d22757f5199187f9d143d7a5aaf1 (macOS arm64, Node 26.4.0): 14/14 gates passed, 131.0 seconds.
• NOT RUN locally: Linux/Windows verification, live managed-account review requests, or a reproduction on the reporter's network-restricted Arch Linux host. Offline fixtures do not establish service availability or the original incident's cause.

Publication and contribution checks

• I have permission to contribute these changes under the existing applicable licenses; no imported patch or license change.
• No credentials, account data, real user content, internal history or private review material is included.
• The new diagnostics source file was reviewed before regenerating release/public-source.json. Tests extend existing declared Vitest files.
• No shared documentation or capability contract changed. Offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes: none.

Shared-source port: pending after public review.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}