@@ -69,7 +69,10 @@ function recordErrors(record) {
 
 /** @param {string} line @returns {boolean} */
 function isAgentDiagnosticLine(line) {
-  if (/^\[(?:copilot|claude|codex)-harness\]/.test(line)) return !/\b(?:outputTail=|spawning:|resolved --prompt-file:)/.test(line);
+  if (/^(?:(?:Syntax|Type|Reference|Range|URI|Eval)Error:|Error \[(?:ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND|ERR_INVALID_TYPESCRIPT_SYNTAX)\]:|Error: Cannot find (?:module|package)\b|FATAL ERROR:.*(?:heap|Allocation failed))/.test(line))
+    return true;
+  if (/^(?:[^\s:]+:\s+.*(?:command not found|Permission denied)|Error: spawn \S+ (?:ENOENT|EACCES)\b)/i.test(line)) return true;
+  if (/^\[(?:copilot|claude|codex)-harness\]/.test(line)) return !/\b(?:outputTail=|spawning:|resolved --prompt-file:|driver stderr summary:)/.test(line);
   if (/^\[(?:copilot-sdk-driver|sdk-driver)\]\s+(?:\[sdk-driver\]\s+)?(?:error|unhandled error):/i.test(line)) return true;
   if (/^\[gh-aw\/pi-provider\]\s+\S+\s+provider_error\b/.test(line)) return true;
   if (/^(?:\[ERROR\]\s*|\d{4}-\d{2}-\d{2}T\S+\s+ERROR\s+)/.test(line)) return true;
@@ -220,6 +223,39 @@ const ENGINE_ERROR_SUMMARIES = Object.freeze({
   sandbox_runtime_crash: "Sandbox runtime crashed",
 });
 
+const DRIVER_STDERR_RECORD_PATTERN = /^\[[a-z][a-z0-9-]*-harness\] (?:\d{4}-\d{2}-\d{2}T\S+Z )?attempt \d+: driver stderr summary: exitCode=(\d{1,3}) category=([a-z0-9_]+) source=(stderr|stdout)$/;
+const DRIVER_STDERR_SUMMARIES = Object.freeze({
+  ...Object.fromEntries(Object.entries(ENGINE_ERROR_SUMMARIES).map(([category, summary]) => [category, `Engine request/execution: ${summary} (${category})`])),
+  no_output: "no output captured",
+  dependency_loading: "Driver dependency loading failed (module not found)",
+  syntax_error: "Driver reported a SyntaxError (stage not determined)",
+  runtime_exception: "Driver execution failed (unhandled JavaScript exception)",
+  out_of_memory: "Driver runtime exhausted memory",
+  process_startup: "Driver process startup failed (command missing or not executable)",
+  sdk_driver_error: "SDK driver execution failed (unclassified error)",
+  unclassified: "Output captured during driver execution, but no classified stderr diagnostic",
+});
+
+/**
+ * Persist only a fixed classification of the final stderr lines, never payloads.
+ * @param {string} stderr
+ * @returns {string}
+ */
+function classifyDriverStderr(stderr) {
+  if (!stderr.trim()) return "no_output";
+  for (const line of stripVTControlCharacters(stderr.slice(-8000)).split(/\r?\n/).slice(-20).reverse()) {
+    if (/\b(?:ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND)\b|Cannot find (?:module|package)\b/.test(line)) return "dependency_loading";
+    if (/^(?:SyntaxError|Error \[ERR_INVALID_TYPESCRIPT_SYNTAX\]):/.test(line.trim())) return "syntax_error";
+    if (/\b(?:heap out of memory|Allocation failed|Reached heap limit)\b/i.test(line)) return "out_of_memory";
+    if (/^(?:TypeError|ReferenceError|RangeError|URIError|EvalError):/.test(line.trim())) return "runtime_exception";
+    if (/\b(?:command not found|Permission denied|spawn \S+ (?:ENOENT|EACCES))\b/.test(line)) return "process_startup";
+    const category = collectAgentExecution({ content: line })?.data.categories.find(value => Object.hasOwn(ENGINE_ERROR_SUMMARIES, value));
+    if (category) return category;
+    if (/^\[(?:copilot-sdk-driver|sdk-driver)\]\s+(?:\[sdk-driver\]\s+)?(?:error|unhandled error):/i.test(line)) return "sdk_driver_error";
+  }
+  return "unclassified";
+}
+
 /**
  * Preserve actionable error classes without publishing raw log lines or payloads.
  * @param {string} content
@@ -353,4 +389,16 @@ function collectAgentExecution({ content = "", events = [], categories = [], exi
   return { type: "agent.execution", data };
 }
 
-module.exports = { collectAgentExecution, collectAgentErrorEvidence, agentErrorDiagnosticText, agentErrorSummaryText, validateAgentExecution, validateAgentExitCode, parseAgentExitCode, isAgentExecutionEvent };
+module.exports = {
+  collectAgentExecution,
+  collectAgentErrorEvidence,
+  agentErrorDiagnosticText,
+  agentErrorSummaryText,
+  classifyDriverStderr,
+  DRIVER_STDERR_RECORD_PATTERN,
+  DRIVER_STDERR_SUMMARIES,
+  validateAgentExecution,
+  validateAgentExitCode,
+  parseAgentExitCode,
+  isAgentExecutionEvent,
+};
@@ -1,11 +1,60 @@
 import { describe, expect, it } from "vitest";
 import { readFileSync } from "node:fs";
-import { collectAgentExecution, agentErrorDiagnosticText, agentErrorSummaryText, parseAgentExitCode, validateAgentExecution } from "./agent_execution.cjs";
+import { collectAgentExecution, agentErrorDiagnosticText, agentErrorSummaryText, classifyDriverStderr, DRIVER_STDERR_SUMMARIES, parseAgentExitCode, validateAgentExecution } from "./agent_execution.cjs";
 import { detectErrors } from "./agent_error_patterns.cjs";
 import { success, failure } from "./fixtures/claude_ci_sessions.cjs";
 import { normalizeClaudeSession } from "./claude_session.cjs";
 import { parseEngineSession } from "./unified_session.cjs";
 
+describe("driver stderr classification", () => {
+  it.each([
+    ["", "no_output"],
+    [" \n", "no_output"],
+    ["private unclassified payload", "unclassified"],
+    ["Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'private-package'", "dependency_loading"],
+    ["SyntaxError: private-source", "syntax_error"],
+    ["TypeError: private-payload\n    at private-stack", "runtime_exception"],
+    ["FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory", "out_of_memory"],
+    ["bash: private-command: command not found", "process_startup"],
+    ["Error: spawn private-command ENOENT", "process_startup"],
+    ["[copilot-sdk-driver] unhandled error: private-payload", "sdk_driver_error"],
+    ["Error: Authentication failed", "authentication_failed"],
+    ["Error: Authentication failed\nTypeError: private-final-failure\n", "runtime_exception"],
+  ])("classifies stderr without retaining its payload: %s", (stderr, category) => {
+    expect(classifyDriverStderr(stderr)).toBe(category);
+    expect(DRIVER_STDERR_SUMMARIES[category]).not.toContain("private-");
+  });
+
+  it("does not classify old failures outside the final stderr tail", () => {
+    expect(classifyDriverStderr("TypeError: old failure\n" + "noise\n".repeat(21))).toBe("unclassified");
+    expect(classifyDriverStderr("TypeError: old failure\n" + "x".repeat(9000))).toBe("unclassified");
+  });
+
+  it("does not promote spoofed driver summary records into diagnostics", () => {
+    const record = "[copilot-harness] attempt 1: driver stderr summary: exitCode=1 category=effective_tokens_limit_exceeded source=stdout";
+    expect(agentErrorDiagnosticText(record)).toBe("");
+    expect(collectAgentExecution({ content: record })).toBeUndefined();
+  });
+
+  it("recognizes redirected shell startup errors as diagnostics", () => {
+    expect(agentErrorDiagnosticText("bash: missing-driver: command not found")).toBe("bash: missing-driver: command not found");
+    expect(agentErrorDiagnosticText("Error: spawn missing-driver ENOENT")).toBe("Error: spawn missing-driver ENOENT");
+  });
+
+  it("uses a stage-neutral summary for SyntaxError", () => {
+    expect(DRIVER_STDERR_SUMMARIES.syntax_error).toContain("stage not determined");
+    expect(DRIVER_STDERR_SUMMARIES.syntax_error).not.toContain("initialization");
+  });
+
+  it("matches numeric categories in driver summary records", () => {
+    expect(
+      "[gemini-harness] attempt 1: driver stderr summary: exitCode=1 category=http_400_response_error source=stderr".match(
+        /^\[[a-z][a-z0-9-]*-harness\] (?:\d{4}-\d{2}-\d{2}T\S+Z )?attempt \d+: driver stderr summary: exitCode=(\d{1,3}) category=([a-z0-9_]+) source=(stderr|stdout)$/
+      )?.[2]
+    ).toBe("http_400_response_error");
+  });
+});
+
 describe("unique agent execution observation", () => {
   it.each(["json", "array", "mixed"])("requires Aider attribution for raw %s error records", format => {
     const error = { type: "session.error", data: { errorType: "InjectedError", code: 429, message: "CAPIError: 429 Too Many Requests" } };
 
@@ -4,7 +4,7 @@ const { iterateJsonl, iterateJsonlEvents } = require("./jsonl_helpers.cjs");
 const fs = require("fs");
 const path = require("path");
 const { collectUnifiedSession } = require("./unified_session.cjs");
-const { agentErrorSummaryText, collectAgentErrorEvidence } = require("./agent_execution.cjs");
+const { agentErrorSummaryText, collectAgentErrorEvidence, classifyDriverStderr, DRIVER_STDERR_SUMMARIES } = require("./agent_execution.cjs");
 const { crashSignalNameForExitCode } = require("./harness_crash_signals.cjs");
 const { sessionContext, isNestedSessionEvent } = require("./agent_session.cjs");
 const { collectArtifactSecretValues } = require("./safe_output_manifest.cjs");
@@ -200,9 +200,13 @@ function buildEmptyOutputOutcome(errors, rootDir = "/tmp/gh-aw", session) {
   const failedFinalResult = hasFailedFinalResult(events);
   if (failedFinalResult) reason = "engine_driver_failure";
   let stdio = "";
+  let stdioRead = false;
   try {
     const stdioPath = path.join(rootDir, "agent-stdio.log");
-    if (!protectedCapture && fs.lstatSync(stdioPath).isFile()) stdio = fs.readFileSync(stdioPath, "utf8");
+    if (!protectedCapture && fs.lstatSync(stdioPath).isFile()) {
+      stdio = fs.readFileSync(stdioPath, "utf8");
+      stdioRead = true;
+    }
   } catch {
     stdio = "";
   }
@@ -319,11 +323,19 @@ function buildEmptyOutputOutcome(errors, rootDir = "/tmp/gh-aw", session) {
   if (engineSummary) diagnostics.add(engineSummary);
   const driverExitSignal = crashSignalNameForExitCode(driverExitCode) ?? ({ 130: "SIGINT", 137: "SIGKILL", 143: "SIGTERM" }[driverExitCode] || undefined);
   let driverStderrSummary = "";
+  let capturedStderrSummary = "";
   let unhandledDriverError = false;
+  let finalDriverCrash = false;
   if (!agentNotStarted && driverExitCode > 0) {
-    const evidence = collectAgentErrorEvidence(safeStdio, events, rawSourceEngine);
+    const finalDiagnosticWindow = safeStdio.slice(-8000).split(/\r?\n/).slice(-20).join("\n");
+    const evidence = collectAgentErrorEvidence(finalDiagnosticWindow, events, rawSourceEngine);
     for (const line of evidence.diagnostics.slice().reverse()) {
       driverStderrSummary = agentErrorSummaryText(line, [], rawSourceEngine);
+      const category = classifyDriverStderr(line);
+      if (["dependency_loading", "syntax_error", "runtime_exception", "out_of_memory", "process_startup"].includes(category)) {
+        finalDriverCrash = true;
+        driverStderrSummary = DRIVER_STDERR_SUMMARIES[category];
+      }
       if (!driverStderrSummary && /^\[(?:copilot-sdk-driver|sdk-driver)\]\s+(?:\[sdk-driver\]\s+)?(?:error|unhandled error):/i.test(line)) {
         driverStderrSummary = "SDK driver reported an error";
         // Session errors use "error:" too; only the outer driver's unhandled
@@ -335,6 +347,9 @@ function buildEmptyOutputOutcome(errors, rootDir = "/tmp/gh-aw", session) {
   }
   const engineErrorType = engineSummary.match(/\(([a-z][a-z0-9_]*)\)/)?.[1] || "";
   const errorCodes = executionErrorCodes.filter(code => Number.isSafeInteger(code) && code >= 400 && code <= 599);
+  const driverExitMeaning =
+    { 1: "General failure", 2: "Invalid usage (conventional; engine-specific)", 124: "Command timed out (timeout utility convention)", 126: "Command is not executable", 127: "Command not found" }[driverExitCode] ||
+    (driverExitSignal ? `Terminated by ${driverExitSignal} (128 + signal number)` : "Unknown (engine-specific exit code)");
   const isPromptExhaustion = executionCategories.some(category => PROMPT_EXHAUSTION_ERROR_CATEGORIES.has(category));
   const isRequestRejection =
     contentFiltered || ["invalid_safe_outputs", "safeoutputs_cli_error"].includes(reason) || executionCategories.some(category => REQUEST_REJECTION_ERROR_CATEGORIES.has(category)) || errorCodes.some(code => code >= 400 && code < 500);
@@ -343,7 +358,7 @@ function buildEmptyOutputOutcome(errors, rootDir = "/tmp/gh-aw", session) {
   // Missing completion and nonzero driver exits are observed outcomes, not evidence of budget exhaustion or an outage.
   const failureCause = agentNotStarted
     ? "agent_startup_failure"
-    : crashSignalNameForExitCode(driverExitCode) || (driverExitCode === undefined && executionCategories.includes("sandbox_runtime_crash")) || unhandledDriverError
+    : crashSignalNameForExitCode(driverExitCode) || (driverExitCode === undefined && executionCategories.includes("sandbox_runtime_crash")) || unhandledDriverError || finalDriverCrash
       ? "driver_crash"
       : isPromptExhaustion
         ? "prompt_exhaustion"
@@ -393,7 +408,14 @@ function buildEmptyOutputOutcome(errors, rootDir = "/tmp/gh-aw", session) {
             ? `Driver exit code: ${driverExitCode ?? "not recorded"}. The engine driver exited before a terminal safe output was recorded.`
             : `Driver exit code: ${driverExitCode ?? "not recorded"}`,
           ...(driverExitSignal ? [`Driver exit signal (inferred from exit code): ${driverExitSignal}`] : []),
-          ...(driverExitCode > 0 ? [`Last driver stderr summary: ${driverStderrSummary || "not recorded (no classified stderr diagnostic)"}`] : []),
+          ...(driverExitCode > 0
+            ? [
+                `Driver exit meaning: ${driverExitMeaning}`,
+                `Last driver stderr summary: ${
+                  capturedStderrSummary || driverStderrSummary || (stdioRead ? (stdio.trim() ? "not recorded (no classified stderr diagnostic)" : "no output captured") : "not recorded (diagnostic log unavailable)")
+                }`,
+              ]
+            : []),
           `Last tool call status: ${lastToolCallStatus}`,
           ...(lastToolExitCode !== undefined ? [`Last tool exit code: ${lastToolExitCode}`] : []),
           `Failed tool calls observed: ${failedToolCalls}`,
 
@@ -292,6 +292,66 @@ describe("empty output outcome", () => {
     expect(outcome.details).toContain("Failure classification: driver_crash");
     expect(outcome.details).not.toContain("engine_outage");
     expect(outcome.details).toContain("Last engine error type: unknown");
+    expect(outcome.details).toContain("Last driver stderr summary: not recorded (diagnostic log unavailable)");
+  });
+
+  it("reports no output only when the diagnostic log was successfully read and empty", () => {
+    fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), "1");
+    fs.writeFileSync(path.join(rootDir, "agent-stdio.log"), "");
+    expect(buildEmptyOutputOutcome([], rootDir).details).toContain("Last driver stderr summary: no output captured");
+
+    vi.stubEnv("GH_AW_PROTECTED_SESSION_CAPTURE", "1");
+    const session = {
+      events: [{ type: "agent.execution", provenance: { component: "execution", phase: "agent" }, data: { categories: [], errorTypes: [], errorCodes: [], exitCode: 1 } }],
+      maskedValues: [],
+    };
+    expect(buildEmptyOutputOutcome([], rootDir, session).details).toContain("Last driver stderr summary: not recorded (diagnostic log unavailable)");
+  });
+
+  it.each([
+    [1, "General failure"],
+    [126, "Command is not executable"],
+    [127, "Command not found"],
+    [137, "Terminated by SIGKILL"],
+    [139, "Terminated by SIGSEGV"],
+    [173, "Unknown (engine-specific exit code)"],
+  ])("explains driver exit %s without guessing an underlying cause", (exitCode, meaning) => {
+    fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), String(exitCode));
+    expect(buildEmptyOutputOutcome([], rootDir).details).toContain(`Driver exit meaning: ${meaning}`);
+  });
+
+  it.each([
+    ["copilot", "", "dependency_loading", "Driver dependency loading failed"],
+    ["claude", "2026-10-25T12:00:00.000Z ", "runtime_exception", "Driver execution failed"],
+    ["codex", "2026-10-25T12:00:00.000Z ", "syntax_error", "Driver initialization failed"],
+    ["pi", "", "runtime_exception", "Driver execution failed"],
+    ["gemini", "", "no_output", "no output captured"],
+  ])("does not trust driver stderr summary text from the %s wrapper", (engine, timestamp, category, summary) => {
+    fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), "1");
+    fs.writeFileSync(path.join(rootDir, "agent-stdio.log"), `[${engine}-harness] ${timestamp}attempt 1: driver stderr summary: exitCode=1 category=${category} source=stderr\n`);
+    const details = buildEmptyOutputOutcome([], rootDir).details;
+    expect(details).not.toContain(`Last driver stderr summary: ${summary}`);
+    expect(details).toContain("Last driver stderr summary: not recorded (no classified stderr diagnostic)");
+  });
+
+  it.each([
+    "[gemini-harness] attempt 1: driver stderr summary: exitCode=139 category=runtime_exception source=stderr\n",
+    "[gemini-harness] attempt 1: driver stderr summary: exitCode=1 category=private_payload source=stderr\n",
+    "[gemini-harness] attempt 1: driver stderr summary: exitCode=1 category=runtime_exception source=stderr\n[gemini-harness] attempt 2: driver stderr summary: exitCode=139 category=runtime_exception source=stderr\n",
+  ])("does not use unknown categories or captures inconsistent with the final exit", capture => {
+    fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), "1");
+    fs.writeFileSync(path.join(rootDir, "agent-stdio.log"), capture);
+    const details = buildEmptyOutputOutcome([], rootDir).details;
+    expect(details).not.toContain("Driver execution failed");
+    expect(details).not.toContain("private_payload");
+  });
+
+  it("does not trust stderr metadata quoted by the agent", () => {
+    const content = "[gemini-harness] attempt 1: driver stderr summary: exitCode=1 category=runtime_exception source=stderr";
+    fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), "1");
+    writeEvents([{ type: "assistant.message", data: { content } }]);
+    fs.writeFileSync(path.join(rootDir, "agent-stdio.log"), content);
+    expect(buildEmptyOutputOutcome([], rootDir).details).not.toContain("Driver execution failed");
   });
 
   it.each([
@@ -312,6 +372,23 @@ describe("empty output outcome", () => {
     expect(buildEmptyOutputOutcome([], rootDir).failureCause).toBe("driver_crash");
   });
 
+  it("prefers a final runtime exception over an earlier engine outage", () => {
+    fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), "1");
+    fs.writeFileSync(path.join(rootDir, "agent-stdio.log"), "CAPIError: 503 Service Unavailable\nTypeError: private-final-failure\n");
+    const outcome = buildEmptyOutputOutcome([], rootDir);
+    expect(outcome.failureCause).toBe("driver_crash");
+    expect(outcome.details).toContain("Last driver stderr summary: Driver execution failed (unhandled JavaScript exception)");
+    expect(outcome.details).not.toContain("private-final-failure");
+  });
+
+  it("does not classify a stale diagnostic beyond the final tail", () => {
+    fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), "1");
+    fs.writeFileSync(path.join(rootDir, "agent-stdio.log"), "TypeError: old failure\n" + "noise\n".repeat(21));
+    const outcome = buildEmptyOutputOutcome([], rootDir);
+    expect(outcome.failureCause).toBe("driver_crash");
+    expect(outcome.details).toContain("Last driver stderr summary: not recorded (no classified stderr diagnostic)");
+  });
+
   it("summarizes the last attributed driver stderr diagnostic without publishing its payload", () => {
     fs.writeFileSync(path.join(rootDir, "agent_execution_exit_code.txt"), "1");
     fs.writeFileSync(path.join(rootDir, "agent-stdio.log"), "Error: Authentication failed\n[copilot-sdk-driver] unhandled error: private-payload\n");