@autopilot-harness/core 0.2.5 → 0.2.7

package/dist/review-engine.js

@@ -250,45 +250,160 @@ export class ReviewEngine {
             this.maybeResetErrorCountOnItemChange(session);
             const transcriptPath = input.transcriptPath?.trim() || undefined;
             const events = transcriptPath ? readTranscriptTail(transcriptPath) : [];
-            // Code-edit fix wins over pending redelivery (marker-before-pending).
+            // Code-edit fix wins over pending redelivery (marker-before-pending),
+            // except undelivered recover/stuck — E2 must not clobber that tip
+            // (resumeFix sticky edit during recover claim/emit window).
             if (chain.code_edited === 1) {
-                return this.e2Fix(session, chain);
+                const tip = chain.pending_followup?.trim() ?? "";
+                if (!isRecoverOrStuckFollowupMessage(tip)) {
+                    const fix = this.e2Fix(session, chain);
+                    // null: paused, or recover/stuck landed under the write lock — fall
+                    // through so tryRedeliverPending can still inject the live tip.
+                    if (fix)
+                        return fix;
+                }
             }
             // Pending redelivery / in-flight: never advance confirm_left while prior undelivered.
-            const redelivered = this.tryRedeliverPending(session.conversation_id, chain, events, transcriptPath);
+            // Refresh after possible E2 miss (recover may have landed under e2Fix lock).
+            const chainLive = this.store.getReviewChain(session.conversation_id) ?? chain;
+            const redelivered = this.tryRedeliverPending(session.conversation_id, chainLive, events, transcriptPath);
             if (redelivered)
                 return redelivered;
             if (events.length > 0 && followupInFlight(events)) {
                 return null;
             }
-            if (this.pendingBlocksAdvance(session.conversation_id, chain, events, transcriptPath)) {
+            if (this.pendingBlocksAdvance(session.conversation_id, chainLive, events, transcriptPath)) {
                 return null;
             }
-            // Order: E4 → E5 → E3 → E0 (E2 handled above)
-            if (chain.confirm_left !== null && chain.confirm_left > 0) {
-                return this.e4Confirm(session, chain);
-            }
-            if (chain.confirm_left === 0 ||
-                (chain.item_confirm_complete === 1 && chain.confirm_left === null)) {
-                return this.e5Gate(session, chain);
-            }
-            // loopCount alone must not re-arm after a hard halt neutralize (fix_round
-            // cleared). Keep E8 recovery for checklist executing only: after
-            // clearChainPending mid-fix, fix_round>0 + loopCount still reaches E3.
-            // Do NOT use that path for ambient/planning — leftover fix_round after an
-            // error recover (armChain=false) would otherwise open a phantom confirm
-            // chain with no new code_edited (seen with project-scope ambient).
-            const inChain = chain.chain_pending === 1 ||
-                (input.loopCount > 0 &&
-                    chain.fix_round > 0 &&
-                    isChecklistExecuting(session));
-            if (chain.confirm_left === null &&
-                chain.item_confirm_complete === 0 &&
+            // Refresh after redeliver/clear — chainLive may still hold a tip that
+            // tryRedeliverPending / pendingBlocksAdvance just cleared as delivered.
+            const chainAfterPending = this.store.getReviewChain(session.conversation_id) ?? chainLive;
+            // Undelivered recover/stuck owns the tip — do not E4/E5/residue/E3/E0 over it
+            // (pendingBlocksAdvance fail-opens without transcript_path in unit tests).
+            {
+                const liveTip = chainAfterPending.pending_followup?.trim() ?? "";
+                if (isRecoverOrStuckFollowupMessage(liveTip)) {
+                    return null;
+                }
+            }
+            // Early E2 may have skipped while recover/stuck owned the tip. After that
+            // tip is cleared, sticky code_edited must still win over E4/E5 (otherwise
+            // e4Confirm refuses code_edited and returns null — mid-confirm stall).
+            if (chainAfterPending.code_edited === 1) {
+                const tip = chainAfterPending.pending_followup?.trim() ?? "";
+                if (!isRecoverOrStuckFollowupMessage(tip)) {
+                    const fix = this.e2Fix(session, chainAfterPending);
+                    if (fix)
+                        return fix;
+                    // e2Fix lost a race (recover/stuck landed under the write lock) —
+                    // redeliver that tip instead of falling into E4 refuse-null.
+                    const afterE2 = this.store.getReviewChain(session.conversation_id) ??
+                        chainAfterPending;
+                    const afterTip = afterE2.pending_followup?.trim() ?? "";
+                    if (isRecoverOrStuckFollowupMessage(afterTip)) {
+                        const again = this.tryRedeliverPending(session.conversation_id, afterE2, events, transcriptPath);
+                        if (again)
+                            return again;
+                        return null;
+                    }
+                }
+            }
+            // Order: E4 → E5 → residue-E2 → E3 → E0 (E2 via code_edited handled above)
+            if (chainAfterPending.confirm_left !== null &&
+                chainAfterPending.confirm_left > 0) {
+                return this.e4Confirm(session, chainAfterPending);
+            }
+            if (chainAfterPending.confirm_left === 0 ||
+                (chainAfterPending.item_confirm_complete === 1 &&
+                    chainAfterPending.confirm_left === null)) {
+                return this.e5Gate(session, chainAfterPending);
+            }
+            // Recover/abort residue on checklist executing: chain_pending cleared and
+            // code_edited may be lost, but fix_round>0 means mid-item review was
+            // active. Prefer another fix round over E3 confirm so prior edits are not
+            // "confirmed" without a fix pass (Commerce M2 / abort-after-recover).
+            if (chainAfterPending.chain_pending === 0 &&
+                chainAfterPending.fix_round > 0 &&
+                chainAfterPending.code_edited === 0 &&
+                chainAfterPending.item_confirm_complete === 0 &&
+                isChecklistExecuting(session)) {
+                const cid = session.conversation_id;
+                const rearmed = this.store.exclusiveWrite(() => {
+                    if (!this.sessionRunnable(cid)) {
+                        return { commit: false, value: false };
+                    }
+                    const fresh = this.store.getReviewChain(cid);
+                    if (!fresh ||
+                        fresh.code_edited === 1 ||
+                        fresh.confirm_left !== null ||
+                        fresh.item_confirm_complete === 1 ||
+                        fresh.chain_pending === 1 ||
+                        fresh.fix_round <= 0 ||
+                        isRecoverOrStuckFollowupMessage(fresh.pending_followup?.trim() ?? "")) {
+                        return { commit: false, value: false };
+                    }
+                    this.store.updateReviewChain(cid, { code_edited: 1 });
+                    return { commit: true, value: true };
+                });
+                if (rearmed) {
+                    const live = this.store.getReviewChain(cid);
+                    if (live?.code_edited === 1) {
+                        const fix = this.e2Fix(session, live);
+                        if (fix)
+                            return fix;
+                        // Same as post-gate E2: recover/stuck may have won the lock — redeliver
+                        // instead of falling through to E3/E0 with a sticky edit marker.
+                        const afterE2 = this.store.getReviewChain(cid) ?? live;
+                        const afterTip = afterE2.pending_followup?.trim() ?? "";
+                        if (isRecoverOrStuckFollowupMessage(afterTip)) {
+                            const again = this.tryRedeliverPending(cid, afterE2, events, transcriptPath);
+                            if (again)
+                                return again;
+                            return null;
+                        }
+                    }
+                }
+            }
+            // Refresh after possible residue rearm so E3/E0 see live markers.
+            const chainNow = this.store.getReviewChain(input.conversationId) ?? chain;
+            // Concurrent residue/recover may have armed code_edited after the outer
+            // snapshot — prefer E2 over E3/E0 on the live marker, but still refuse to
+            // clobber undelivered recover/stuck (same as the early gate).
+            if (chainNow.code_edited === 1) {
+                const tip = chainNow.pending_followup?.trim() ?? "";
+                if (isRecoverOrStuckFollowupMessage(tip)) {
+                    const again = this.tryRedeliverPending(session.conversation_id, chainNow, events, transcriptPath);
+                    if (again)
+                        return again;
+                    return null;
+                }
+                const fix = this.e2Fix(session, chainNow);
+                if (fix)
+                    return fix;
+                const afterE2 = this.store.getReviewChain(session.conversation_id) ?? chainNow;
+                const afterTip = afterE2.pending_followup?.trim() ?? "";
+                if (isRecoverOrStuckFollowupMessage(afterTip)) {
+                    const again = this.tryRedeliverPending(session.conversation_id, afterE2, events, transcriptPath);
+                    if (again)
+                        return again;
+                    return null;
+                }
+            }
+            // After hard halt neutralize, fix_round is cleared so bare residue cannot
+            // re-arm. Checklist executing: fix_round>0 still reaches E3 even when
+            // chain_pending was cleared (recover armChain=false) and loopCount=0
+            // (Cursor often reports 0). Do NOT use fix_round alone for ambient/
+            // planning — leftover fix_round after recover would open a phantom
+            // confirm chain with no new code_edited (project-scope ambient).
+            const inChain = chainNow.chain_pending === 1 ||
+                (chainNow.fix_round > 0 && isChecklistExecuting(session));
+            if (chainNow.confirm_left === null &&
+                chainNow.item_confirm_complete === 0 &&
                 inChain) {
-                return this.e3ArmConfirm(session, chain);
+                return this.e3ArmConfirm(session, chainNow);
             }
             // E0': no product-code edit — checklist continue via verify / soft evidence.
-            return this.e0NoCodeContinue(session, chain);
+            return this.e0NoCodeContinue(session, chainNow);
         }
         catch (err) {
             // Purge races / late id throws from upsert|updateReviewChain must not crash the hook.
@@ -305,22 +420,21 @@ export class ReviewEngine {
         if (!pending)
             return false;
         if (events.length > 0 && automationFollowupPresent(events, pending)) {
-            try {
-                // Only clear the snapshot needle — a concurrent replace must survive.
-                const cleared = this.store.clearPendingFollowupIf(conversationId, (m) => m.trim() === pending);
-                if (!cleared) {
-                    // Live pending was replaced (e.g. error-recover claim). Keep blocking
-                    // so stale confirm_left cannot advance and overwrite the new pending.
+            // Clear + ambient E3 arm in one writer txn (crash must not leave tip
+            // gone with chain_pending still 0 → silent ambient stall).
+            const cleared = this.clearMatchingPendingAndArmAmbient(conversationId, pending);
+            if (!cleared) {
+                // Needle miss, lock/arm failure (rolled back), or concurrent replace —
+                // any remaining live tip must block so E4 cannot clobber it.
+                try {
                     const live = this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
                         "";
-                    if (live &&
-                        !(events.length > 0 && automationFollowupPresent(events, live))) {
+                    if (live)
                         return true;
-                    }
                 }
-            }
-            catch {
-                /* already delivered — clearing stamp is best-effort */
+                catch {
+                    /* fail-open only when chain unreadable */
+                }
             }
             return false;
         }
@@ -331,7 +445,19 @@ export class ReviewEngine {
         return true;
     }
     tryRedeliverPending(conversationId, chain, events, transcriptPath) {
-        const pending = chain.pending_followup?.trim();
+        // Prefer live pending — outer snapshot may predate a concurrent recover claim
+        // (E2 TOCTOU fall-through must still redeliver the tip that won the lock).
+        let pending = chain.pending_followup?.trim() ?? "";
+        if (!pending) {
+            try {
+                pending =
+                    this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
+                        "";
+            }
+            catch {
+                pending = "";
+            }
+        }
         if (!pending)
             return null;
         // Without transcript_path, skip redelivery (avoid duplicate spam in unit tests).
@@ -341,15 +467,11 @@ export class ReviewEngine {
         // cannot inject during claim sleep (would race CAS for a second recover).
         // CAS emit clears that hold → host-drop redelivery is immediate again.
         if (events.length > 0 && automationFollowupPresent(events, pending)) {
-            try {
-                const cleared = this.store.clearPendingFollowupIf(conversationId, (m) => m.trim() === pending);
-                // Snapshot looked delivered but live was replaced — fall through to the
-                // locked live-row path instead of dropping the new pending.
-                if (cleared)
-                    return null;
-            }
-            catch {
-                /* already delivered — clearing stamp is best-effort */
+            const cleared = this.clearMatchingPendingAndArmAmbient(conversationId, pending);
+            // Snapshot looked delivered but live was replaced / arm rolled back —
+            // fall through to the locked live-row path instead of dropping the tip.
+            if (cleared) {
+                return null;
             }
         }
         // Apply even after a delivered-snapshot miss (replaced live pending): do not
@@ -376,7 +498,10 @@ export class ReviewEngine {
                 // already present on the transcript.
                 if (events.length > 0 &&
                     automationFollowupPresent(events, livePending)) {
-                    this.store.clearPendingFollowupIf(conversationId, (m) => m.trim() === livePending);
+                    const cleared = this.store.clearPendingFollowupIf(conversationId, (m) => m.trim() === livePending);
+                    if (cleared) {
+                        this.armAmbientChainAfterDeliveredFixTip(conversationId, livePending);
+                    }
                     return { commit: true, value: null };
                 }
                 try {
@@ -397,7 +522,10 @@ export class ReviewEngine {
                     return { commit: true, value: null };
                 }
                 if (events.length > 0 && automationFollowupPresent(events, after)) {
-                    this.store.clearPendingFollowupIf(conversationId, (m) => m.trim() === after);
+                    const cleared = this.store.clearPendingFollowupIf(conversationId, (m) => m.trim() === after);
+                    if (cleared) {
+                        this.armAmbientChainAfterDeliveredFixTip(conversationId, after);
+                    }
                     return { commit: true, value: null };
                 }
                 return {
@@ -465,15 +593,56 @@ export class ReviewEngine {
      * Clear sticky code_edited so Stop→revert→resend cannot open a phantom fix
      * chain on the next completed stop (disk may already be clean).
      * Leave fix/confirm pending alone (delivery retry still valid if inject raced).
-     * Both clears share one exclusiveWrite so a mid-abort failure cannot leave
+     *
+     * Project-scope ambient/planning: after recover soft-reset cleared
+     * chain_pending, sticky code_edited may be the only handoff marker. Clearing
+     * it without a freeze leaves fix_round residue that cannot E3 (bare fix_round
+     * must not phantom-confirm). Freeze into confirm_left, or re-arm chain_pending
+     * when an undelivered fix tip remains. Checklist executing keeps residue-E2.
+     *
+     * Clears + freeze share one exclusiveWrite so a mid-abort failure cannot leave
      * recover gone while code_edited sticky (or the reverse).
      */
     handleAbortedStop(session) {
         try {
             const cid = session.conversation_id;
+            const ambientFreeze = this.config.reviewScope === "project" &&
+                !isChecklistExecuting(session);
             this.store.exclusiveWrite(() => {
                 this.store.clearPendingFollowupIf(cid, isRecoverOrStuckFollowupMessage);
+                const chain = this.store.getReviewChain(cid);
+                const pending = chain?.pending_followup?.trim() ?? "";
+                const fixPending = this.isFixFollowupMessage(pending);
+                const mid = this.isMidConfirmOrE5(chain);
+                const fixRound = chain?.fix_round ?? 0;
+                const wasArmed = chain?.chain_pending === 1;
                 this.store.clearCodeEdited(cid);
+                if (ambientFreeze && !mid && fixRound > 0) {
+                    if (fixPending) {
+                        // Tip still undelivered: keep it; ensure chain_pending so a later
+                        // clean completion can E3 (soft-reset may have cleared it).
+                        this.store.updateReviewChain(cid, { chain_pending: 1 });
+                    }
+                    else if (!pending && wasArmed) {
+                        // Armed chain was the handoff — freeze into confirm (Stop = pause
+                        // progress, not open another auto fix). Do NOT key off hadEdit alone:
+                        // stale fix_round + a fresh afterFileEdit would phantom-confirm.
+                        // Mid-fix recover soft-reset keeps chain_pending when resumeFix.
+                        // Require empty pending so a custom tip is not left desynced under a
+                        // new confirm_left (recover/stuck already cleared above).
+                        const rounds = this.config.confirmRounds;
+                        if (rounds > 0) {
+                            this.store.updateReviewChain(cid, {
+                                confirm_left: rounds,
+                                chain_pending: 0,
+                                code_edited: 0,
+                            });
+                        }
+                        else {
+                            this.store.updateReviewChain(cid, { chain_pending: 1 });
+                        }
+                    }
+                }
                 return { commit: true, value: undefined };
             });
         }
@@ -692,8 +861,12 @@ export class ReviewEngine {
                     if (!stamp) {
                         return { commit: false, value: { role: "failed" } };
                     }
-                    // Recover must not keep a leftover fix chain_pending (phantom E3).
-                    this.store.clearChainPending(conversationId);
+                    // Recover must not keep bare leftover chain_pending (phantom E3).
+                    // Preserve mid-fix ambient resumeFix (code_edited sticky + armed).
+                    const liveRedeliver = this.store.getReviewChain(conversationId);
+                    if (liveRedeliver?.code_edited !== 1) {
+                        this.store.clearChainPending(conversationId);
+                    }
                     // Hold completed-stop redeliver through claim sleep; CAS clears it.
                     this.armRecoverClaimRedeliverHold(conversationId, debounceMs);
                     return {
@@ -710,19 +883,18 @@ export class ReviewEngine {
                     if (fixTipAtClaim &&
                         live &&
                         !this.isMidConfirmOrE5(live)) {
-                        this.store.updateReviewChain(conversationId, { code_edited: 1 });
+                        // Keep chain_pending with sticky edit so abort wasArmed can freeze.
+                        this.store.updateReviewChain(conversationId, {
+                            code_edited: 1,
+                            chain_pending: 1,
+                        });
                     }
                 }
                 else {
-                    // Executing skips ambient soft-reset; re-arm fix for dead fix tip /
-                    // pending, but not while confirm_left says mid-confirm or E5-ready.
-                    const resumeFix = !this.isMidConfirmOrE5(chain) &&
-                        (this.isFixFollowupMessage(pending) ||
-                            chain?.code_edited === 1 ||
-                            fixTipAtClaim);
-                    if (resumeFix) {
-                        this.store.updateReviewChain(conversationId, { code_edited: 1 });
-                    }
+                    // Executing skips ambient soft-reset — same readyForE3 / resumeFix rules.
+                    this.applyExecutingErrorRecoverChainAdjustments(conversationId, {
+                        fixTipAtClaim,
+                    });
                 }
                 this.store.savePendingFollowup(conversationId, message, {
                     armChain: false,
@@ -731,9 +903,18 @@ export class ReviewEngine {
                 if (!stamp) {
                     return { commit: false, value: { role: "failed" } };
                 }
-                // Executing claim skips ambient soft-reset — still disarm chain_pending.
-                // Ambient soft-reset already cleared chain_pending; clear again is idempotent.
-                this.store.clearChainPending(conversationId);
+                // Executing: always disarm leftover fix chain_pending (phantom E3).
+                // Ambient: soft-reset / fixTipAtClaim may keep chain_pending with
+                // code_edited for abort handoff — do not wipe that.
+                if (!ambient) {
+                    this.store.clearChainPending(conversationId);
+                }
+                else {
+                    const liveAfter = this.store.getReviewChain(conversationId);
+                    if (liveAfter?.code_edited !== 1) {
+                        this.store.clearChainPending(conversationId);
+                    }
+                }
                 this.armRecoverClaimRedeliverHold(conversationId, debounceMs);
                 return {
                     commit: true,
@@ -947,8 +1128,13 @@ export class ReviewEngine {
                 if (!this.store.casBumpPendingFollowupAt(conversationId, expectedStamp)) {
                     return { commit: false, value: null };
                 }
-                // Defense: recover emit must not leave chain_pending armed.
-                this.store.clearChainPending(conversationId);
+                // Defense: recover emit must not leave bare chain_pending armed (phantom
+                // E3). Mid-fix ambient resume keeps code_edited + chain_pending for
+                // abort wasArmed handoff — preserve that pair.
+                const afterBump = this.store.getReviewChain(conversationId);
+                if (afterBump?.code_edited !== 1) {
+                    this.store.clearChainPending(conversationId);
+                }
                 return {
                     commit: true,
                     value: {
@@ -1084,34 +1270,48 @@ export class ReviewEngine {
      */
     emitRecoverAfterFailedClaim(conversationId, action, opts) {
         const ambientSoftReset = opts?.ambientSoftReset === true;
-        try {
-            return this.store.exclusiveWrite(() => {
-                const session = this.store.getSession(conversationId);
-                if (!session || !this.sessionErrorRecoverable(session)) {
-                    return { commit: false, value: null };
-                }
-                const pending = this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
-                    "";
-                if (isRecoverFollowupMessage(pending)) {
-                    return { commit: false, value: null };
-                }
-                if (ambientSoftReset) {
-                    this.applySoftResetAmbientChainForErrorRecover(conversationId);
-                }
-                this.store.savePendingFollowup(conversationId, action.message, {
-                    armChain: false,
-                });
-                const live = this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
-                    "";
-                // Under lock, require a stamped recover row — silent savePending no-op
-                // must not return action (two compensators could both "win").
-                if (!isRecoverFollowupMessage(live)) {
-                    return { commit: false, value: null };
-                }
-                // armChain=false does not clear a leftover fix chain_pending=1 → phantom E3.
-                this.store.clearChainPending(conversationId);
-                return { commit: true, value: action };
+        const writeRecover = () => this.store.exclusiveWrite(() => {
+            const session = this.store.getSession(conversationId);
+            if (!session || !this.sessionErrorRecoverable(session)) {
+                return { commit: false, value: null };
+            }
+            const pending = this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
+                "";
+            if (isRecoverFollowupMessage(pending)) {
+                return { commit: false, value: null };
+            }
+            if (ambientSoftReset) {
+                this.applySoftResetAmbientChainForErrorRecover(conversationId);
+            }
+            else {
+                // Executing compensate: same readyForE3 / resumeFix as successful claim.
+                this.applyExecutingErrorRecoverChainAdjustments(conversationId);
+            }
+            this.store.savePendingFollowup(conversationId, action.message, {
+                armChain: false,
             });
+            const live = this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
+                "";
+            // Under lock, require a stamped recover row — silent savePending no-op
+            // must not return action (two compensators could both "win").
+            if (!isRecoverFollowupMessage(live)) {
+                return { commit: false, value: null };
+            }
+            // Executing: disarm leftover fix chain_pending. Ambient soft-reset may
+            // keep chain_pending with resumeFix sticky edit for abort handoff.
+            if (!ambientSoftReset) {
+                this.store.clearChainPending(conversationId);
+            }
+            else {
+                const liveChain = this.store.getReviewChain(conversationId);
+                if (liveChain?.code_edited !== 1) {
+                    this.store.clearChainPending(conversationId);
+                }
+            }
+            return { commit: true, value: action };
+        });
+        try {
+            return writeRecover();
         }
         catch {
             if (!this.sessionStillErrorRecoverable(conversationId)) {
@@ -1125,12 +1325,55 @@ export class ReviewEngine {
                 }
             }
             catch {
-                /* fall through to legacy emit */
+                /* fall through */
+            }
+            // One full locked retry (adjust + stamp + clear). Do NOT adjust in a
+            // separate txn then unlocked-emit: that can leave confirm_left/code_edited
+            // armed without a recover stamp if emit/savePending no-ops.
+            try {
+                return writeRecover();
+            }
+            catch {
+                /* fall through */
+            }
+            // Locked stamp+clear without chain adjust (degraded). Closes the gap where
+            // unlocked emit leaves chain_pending=1 alongside recover pending for E3.
+            try {
+                return this.store.exclusiveWrite(() => {
+                    if (!this.sessionStillErrorRecoverable(conversationId)) {
+                        return { commit: false, value: null };
+                    }
+                    const pending = this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
+                        "";
+                    if (isRecoverFollowupMessage(pending)) {
+                        return { commit: false, value: null };
+                    }
+                    this.store.savePendingFollowup(conversationId, action.message, {
+                        armChain: false,
+                    });
+                    const live = this.store.getReviewChain(conversationId)?.pending_followup?.trim() ??
+                        "";
+                    if (!isRecoverFollowupMessage(live)) {
+                        return { commit: false, value: null };
+                    }
+                    // Degraded: no soft-reset — only disarm bare leftover chain_pending.
+                    const liveChain = this.store.getReviewChain(conversationId);
+                    if (liveChain?.code_edited !== 1) {
+                        this.store.clearChainPending(conversationId);
+                    }
+                    return { commit: true, value: action };
+                });
+            }
+            catch {
+                /* fall through to legacy unlocked emit */
             }
             // Legacy path: never unlocked soft-reset (confirm/fix pending desync).
             this.emit(conversationId, action);
             try {
-                this.store.clearChainPending(conversationId);
+                const liveChain = this.store.getReviewChain(conversationId);
+                if (liveChain?.code_edited !== 1) {
+                    this.store.clearChainPending(conversationId);
+                }
             }
             catch {
                 /* best-effort */
@@ -1186,6 +1429,46 @@ export class ReviewEngine {
             return "failed";
         }
     }
+    /**
+     * Executing error-recover chain adjust (call under exclusiveWrite, before
+     * savePendingFollowup + clearChainPending). Mirrors ambient readyForE3 /
+     * resumeFix without soft-resetting mid-confirm/E5.
+     *
+     * Ready-for-E3 (delivered fix, chain_pending only, empty pending) arms
+     * confirm_left=confirmRounds so post-recover continues E4 — not another E2
+     * solely from fix_round>0. Mid-fix residue still forces code_edited.
+     */
+    applyExecutingErrorRecoverChainAdjustments(conversationId, opts) {
+        this.store.ensureReviewChain(conversationId);
+        const chain = this.store.getReviewChain(conversationId);
+        if (!chain)
+            return;
+        // Never reshape under an already-stamped recover row (peer / re-entry).
+        if (isRecoverFollowupMessage(chain.pending_followup?.trim() ?? "")) {
+            return;
+        }
+        const pending = chain.pending_followup?.trim() ?? "";
+        const readyForE3 = !this.isMidConfirmOrE5(chain) &&
+            chain.chain_pending === 1 &&
+            chain.code_edited === 0 &&
+            pending.length === 0;
+        const rounds = this.config.confirmRounds;
+        if (readyForE3 && rounds > 0) {
+            this.store.updateReviewChain(conversationId, {
+                confirm_left: rounds,
+                code_edited: 0,
+            });
+            return;
+        }
+        const resumeFix = !this.isMidConfirmOrE5(chain) &&
+            (this.isFixFollowupMessage(pending) ||
+                chain.code_edited === 1 ||
+                opts?.fixTipAtClaim === true ||
+                chain.fix_round > 0);
+        if (resumeFix) {
+            this.store.updateReviewChain(conversationId, { code_edited: 1 });
+        }
+    }
     /**
      * Ambient/planning error recover: drop confirm/pending arming so recover
      * (armChain=false) cannot leave chain_pending=1 → phantom E3.
@@ -1200,7 +1483,8 @@ export class ReviewEngine {
      * do not regress to another fix. Ready-for-E3 requires empty pending (not
      * merely !fixPending). Force code_edited only for an active fix
      * (code_edited / undelivered fix pending / chain_pending with pending still
-     * set). Bare leftover fix_round is ignored (ambient phantom residue).
+     * set). Mid-fix resumeFix keeps chain_pending=1 so abort can freeze via
+     * wasArmed; bare leftover fix_round stays disarmed (ambient phantom residue).
      */
     applySoftResetAmbientChainForErrorRecover(conversationId) {
         this.store.ensureReviewChain(conversationId);
@@ -1238,7 +1522,10 @@ export class ReviewEngine {
                     ? rounds
                     : null,
             item_confirm_complete: atE5 ? chain.item_confirm_complete : 0,
-            chain_pending: 0,
+            // Mid-fix resume keeps chain_pending so abort clearing code_edited still
+            // has wasArmed handoff (freeze into confirm). Ready-for-E3 / idle residue
+            // stay 0 — bare fix_round must not phantom-E3 after recover tip clears.
+            chain_pending: resumeFix ? 1 : 0,
             // Preserve an in-flight edit marker (E2 wins over E4); else force only for mid-fix.
             code_edited: resumeFix || chain.code_edited === 1 ? 1 : 0,
         });
@@ -1248,6 +1535,62 @@ export class ReviewEngine {
         const line = firstSubstantiveLine(message) || message.trim();
         return line.startsWith("Review fix") || line.startsWith("自审修复");
     }
+    /**
+     * Unlocked callers: clear snapshot needle + ambient E3 arm in one
+     * exclusiveWrite. A crash mid-pair must not leave tip cleared with
+     * chain_pending still 0 (silent ambient stall). Safe under an open writer
+     * only via {@link armAmbientChainAfterDeliveredFixTip} after an inline clear
+     * (clearPendingFollowupIf runs in-txn when writeDepth > 0).
+     */
+    clearMatchingPendingAndArmAmbient(conversationId, pending) {
+        try {
+            return this.store.exclusiveWrite(() => {
+                const cleared = this.store.clearPendingFollowupIf(conversationId, (m) => m.trim() === pending);
+                if (cleared) {
+                    // Do not swallow: arm failure must ROLLBACK the clear in this txn.
+                    this.armAmbientChainAfterDeliveredFixTip(conversationId, pending);
+                }
+                return { commit: true, value: cleared };
+            });
+        }
+        catch {
+            // Nested lock / SQLITE_BUSY / arm throw after rollback — caller treats
+            // false like a needle miss (re-check live tip / fall through).
+            return false;
+        }
+    }
+    /**
+     * After a delivered ambient fix tip is cleared, recover/abort may have left
+     * chain_pending=0. Re-arm so this completed stop can E3 → confirm instead of
+     * silent stall. Never arms bare stale fix_round without a delivered fix tip
+     * (keeps F-ERR-AMBIENT-STALE-FIX-ROUND / F-ABORT-NO-PHANTOM-FIX).
+     * Call under the same writer txn as the clear when possible — throws must
+     * propagate so the clear can roll back. Still arms when code_edited=1 so a
+     * concurrent abort clearing sticky edit keeps wasArmed handoff.
+     */
+    armAmbientChainAfterDeliveredFixTip(conversationId, deliveredPending) {
+        if (!this.isFixFollowupMessage(deliveredPending))
+            return;
+        if (this.config.reviewScope !== "project")
+            return;
+        const session = this.store.getSession(conversationId);
+        if (!session || isChecklistExecuting(session))
+            return;
+        const chain = this.store.getReviewChain(conversationId);
+        if (!chain || chain.fix_round <= 0)
+            return;
+        if (this.isMidConfirmOrE5(chain))
+            return;
+        // Already armed — idempotent. Do NOT skip when code_edited=1: sticky edit
+        // alone is not enough if abort clears it before same-stop E2 (wasArmed
+        // freeze needs chain_pending).
+        if (chain.chain_pending === 1)
+            return;
+        const live = chain.pending_followup?.trim() ?? "";
+        if (live)
+            return;
+        this.store.updateReviewChain(conversationId, { chain_pending: 1 });
+    }
     /** Mid-confirm or E5-ready — must not phantom-arm code_edited over E4/E5. */
     isMidConfirmOrE5(chain) {
         if (!chain)
@@ -1311,7 +1654,10 @@ export class ReviewEngine {
         if (chain.code_edited === 1 ||
             chain.confirm_left !== null ||
             chain.item_confirm_complete === 1 ||
-            chain.chain_pending === 1) {
+            chain.chain_pending === 1 ||
+            // Mid-item review residue (e.g. recover cleared chain_pending): never
+            // soft-advance/done — caller should have taken residue-E2 or E3.
+            chain.fix_round > 0) {
             return null;
         }
         const parsed = this.parseSessionChecklist(session);
@@ -1359,6 +1705,7 @@ export class ReviewEngine {
                 reportPath,
                 currentItemId: liveId,
                 projectRoot: trustRoot ?? undefined,
+                notBefore: liveChain?.updated_at,
             })) {
                 return null;
             }
@@ -1431,7 +1778,9 @@ export class ReviewEngine {
                 fresh.code_edited === 1 ||
                 fresh.confirm_left !== null ||
                 fresh.item_confirm_complete === 1 ||
-                fresh.chain_pending === 1) {
+                fresh.chain_pending === 1 ||
+                fresh.fix_round > 0 ||
+                isRecoverOrStuckFollowupMessage(fresh.pending_followup?.trim() ?? "")) {
                 return { commit: false, value: null };
             }
             const refreshed = this.parseSessionChecklist(lockedSession);
@@ -1449,6 +1798,7 @@ export class ReviewEngine {
                     reportPath,
                     currentItemId: targets.current.id,
                     projectRoot: trustRoot ?? undefined,
+                    notBefore: fresh.updated_at,
                 })) {
                     return { commit: false, value: null };
                 }
@@ -1550,7 +1900,9 @@ export class ReviewEngine {
                 fresh.code_edited === 1 ||
                 fresh.confirm_left !== null ||
                 fresh.item_confirm_complete === 1 ||
-                fresh.chain_pending === 1) {
+                fresh.chain_pending === 1 ||
+                fresh.fix_round > 0 ||
+                isRecoverOrStuckFollowupMessage(fresh.pending_followup?.trim() ?? "")) {
                 return { commit: false, value: null };
             }
             const refreshed = this.parseSessionChecklist(sess);
@@ -1573,6 +1925,7 @@ export class ReviewEngine {
                 reportPath,
                 currentItemId: lockedItem.id,
                 projectRoot: trustRoot ?? undefined,
+                notBefore: fresh.updated_at,
             })) {
                 return { commit: false, value: null };
             }
@@ -1636,7 +1989,8 @@ export class ReviewEngine {
                 fresh.code_edited === 1 ||
                 fresh.confirm_left !== null ||
                 fresh.item_confirm_complete === 1 ||
-                fresh.chain_pending === 1) {
+                fresh.chain_pending === 1 ||
+                fresh.fix_round > 0) {
                 return { commit: false, value: false };
             }
             this.store.updateReviewChain(conversationId, {
@@ -1692,6 +2046,11 @@ export class ReviewEngine {
             if (!fresh || fresh.code_edited !== 1) {
                 return { commit: false, value: null };
             }
+            // TOCTOU: recover/stuck may land after the outer completed-stop gate.
+            const pendingLive = fresh.pending_followup?.trim() ?? "";
+            if (isRecoverOrStuckFollowupMessage(pendingLive)) {
+                return { commit: false, value: null };
+            }
             const fixRound = this.nextSessionRound(fresh);
             const message = this.render("review.fix", { round: fixRound, total: rounds });
             const out = {
@@ -1729,10 +2088,16 @@ export class ReviewEngine {
             }
             const fresh = this.store.getReviewChain(cid);
             // Lost the race to another stop (already confirming, at E5, or code edit).
+            // Refuse undelivered fix/recover/stuck pending: unlocked emit can leave
+            // chain_pending=1 with recover stamped until clearChainPending runs —
+            // E3 must not clobber that recover with confirm.
+            const pendingLive = fresh?.pending_followup?.trim() ?? "";
             if (!fresh ||
                 fresh.code_edited === 1 ||
                 fresh.confirm_left !== null ||
-                fresh.item_confirm_complete === 1) {
+                fresh.item_confirm_complete === 1 ||
+                this.isFixFollowupMessage(pendingLive) ||
+                isRecoverOrStuckFollowupMessage(pendingLive)) {
                 return { commit: false, value: null };
             }
             const sessionRound = this.nextSessionRound(fresh);
@@ -1786,6 +2151,11 @@ export class ReviewEngine {
             if (!fresh || fresh.code_edited === 1 || fresh.confirm_left !== expectedLeft) {
                 return { commit: false, value: null };
             }
+            // Do not clobber undelivered recover/stuck (same as E2/E3 gates).
+            const pendingLive = fresh.pending_followup?.trim() ?? "";
+            if (isRecoverOrStuckFollowupMessage(pendingLive)) {
+                return { commit: false, value: null };
+            }
             const sessionRound = this.nextSessionRound(fresh);
             const message = this.render(kind, {
                 n,
@@ -1885,6 +2255,11 @@ export class ReviewEngine {
                 if (!atE5) {
                     return { commit: false, value: null };
                 }
+                // Do not clobber undelivered recover/stuck (same as E2/E3/E4/E5b).
+                const pendingLive = fresh.pending_followup?.trim() ?? "";
+                if (isRecoverOrStuckFollowupMessage(pendingLive)) {
+                    return { commit: false, value: null };
+                }
                 const sess = this.store.getSession(cid);
                 if (!sess ||
                     !isChecklistExecuting(sess)) {
@@ -1987,6 +2362,11 @@ export class ReviewEngine {
             if (!atE5) {
                 return { commit: false, value: null };
             }
+            // Do not clobber undelivered recover/stuck (same as E2/E3/E4).
+            const pendingLive = fresh.pending_followup?.trim() ?? "";
+            if (isRecoverOrStuckFollowupMessage(pendingLive)) {
+                return { commit: false, value: null };
+            }
             const lockedSession = this.store.getSession(cid);
             if (!lockedSession ||
                 !sessionReviewRunnable(lockedSession, this.config.reviewScope)) {