@awak-app/simy-cli 0.5.34 → 0.5.35

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -1,19 +1,26 @@
 #!/usr/bin/env node
 // Standalone by design: this exact module is shipped to both provider plugins.
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdir, readFile, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { isAbsolute, join, relative, resolve } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 
-export const TERMINAL = new Set(['completed', 'stopped', 'failed', 'budget_exhausted']);
+export const TERMINAL = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
 const EVENTS = new Set(['SessionStart', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification']);
 const MAX_BYTES = 64 * 1024;
 const RETRYABLE = new Set(['overloaded', 'server_error', 'rate_limit']);
+const APPROVAL_DECISIONS = new Set(['automatic', 'proceed_and_report', 'wait']);
+const LOCAL_ACTIONS = new Set(['read', 'local_edit', 'local_test']);
+const ACTIONS = new Set([...LOCAL_ACTIONS, 'external', 'destructive', 'scope_change', 'unknown']);
+const AUTONOMY_POLICIES = new Set(['strict', 'balanced', 'autonomous']);
+const ASSESSMENT_FIELDS = { risk: ['low', 'medium', 'high', 'unknown'], reversibility: ['reversible', 'irreversible', 'unknown'], externalEffect: ['none', 'local', 'external', 'unknown'], blastRadius: ['single_file', 'repository', 'multi_system', 'unknown'], uncertainty: ['low', 'medium', 'high', 'unknown'] };
 export const rootDirectory = (env = process.env) => join(env.SIMY_HOME?.trim() || join(homedir(), '.simy'), 'delivery-hooks');
 const digest = value => createHash('sha256').update(value).digest('hex');
 const text = (value, max = 4000) => typeof value === 'string' ? value.trim().slice(0, max) : '';
+const exactText = value => typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 1000 ? value : null;
+const contextText = (value, max = 500) => text(value, max).replace(/\b(?:sk|key)-[A-Za-z0-9_-]{12,}\b|\bBearer\s+\S+|\b(?:password|token|api[_-]?key)\s*[:=]\s*\S+/gi, '[redacted]');
 export function recordPath(root, provider, session) {
   if (!['codex', 'claude'].includes(provider) || typeof session !== 'string' || !/^[A-Za-z0-9_-]{1,256}$/.test(session)) throw new Error('A provider and exact session ID are required.');
   return join(root, `${digest(`${provider}\0${session}`)}.json`);
@@ -32,8 +39,18 @@ export async function updateRecord(root, provider, session, mutate) {
   try {
     const next = await mutate(await read(file));
     if (next) {
+      // Older file_equals drafts used `path`, which an older verifier could
+      // mistake for file_exists. Persist only the distinct exactPath field.
+      for (const criterion of next.run?.managed?.acceptanceCriteria || []) {
+        if (criterion.check?.type === 'file_equals' && criterion.check.path) {
+          criterion.check.exactPath = criterion.check.path;
+          delete criterion.check.path;
+        }
+      }
       temporary = `${file}.${randomUUID()}.tmp`;
-      await writeFile(temporary, JSON.stringify(next), { mode: 0o600 });
+      const serialized = JSON.stringify(next);
+      if (Buffer.byteLength(serialized) > MAX_BYTES) throw new Error('Delivery state exceeds 64 KiB; reduce task details.');
+      await writeFile(temporary, serialized, { mode: 0o600 });
       await rename(temporary, file);
     }
     return next;
@@ -51,53 +68,504 @@ function positive(value, fallback, max) {
   if (!Number.isSafeInteger(value) || value < 1 || value > max) throw new Error('Invalid delivery budget.');
   return value;
 }
-export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxContinuations, maxFailures, maxMinutes, now = Date.now() }) {
+function actionDescriptor(value) {
+  if (!value || !ACTIONS.has(value.kind) || !text(value.scope, 200) || !text(value.summary, 1000)) throw new Error('Managed continuation requires a concrete proposedAction with kind, scope, and summary.');
+  return { kind: value.kind, scope: text(value.scope, 200), summary: text(value.summary, 1000) };
+}
+function assessment(value) {
+  const result = {};
+  for (const [field, allowed] of Object.entries(ASSESSMENT_FIELDS)) result[field] = allowed.includes(value?.[field]) ? value[field] : 'unknown';
+  result.inObjective = value?.inObjective === true ? true : value?.inObjective === false ? false : null;
+  result.userChoice = value?.userChoice === true ? true : value?.userChoice === false ? false : null;
+  return result;
+}
+function assessedPlan(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || !text(value.diagnosis, 2000) || !Array.isArray(value.alternatives) || !value.alternatives.length || value.alternatives.length > 5) throw new Error('An assessed plan needs a diagnosis and one to five alternatives.');
+  const alternatives = value.alternatives.map(option => {
+    const id = text(option?.id, 80);
+    if (!/^[A-Za-z0-9_-]{1,80}$/.test(id)) throw new Error('Invalid plan option ID.');
+    return { id, action: actionDescriptor(option.action), assessment: assessment(option.assessment), expectedVerification: text(option.expectedVerification, 1000), rollback: text(option.rollback, 1000) };
+  });
+  if (new Set(alternatives.map(option => option.id)).size !== alternatives.length) throw new Error('Duplicate plan option ID.');
+  const selectedOptionId = text(value.selectedOptionId, 80);
+  if (!alternatives.some(option => option.id === selectedOptionId)) throw new Error('Selected action must match an assessed option.');
+  const recommendation = { optionId: text(value.recommendation?.optionId, 80), reason: text(value.recommendation?.reason, 1000) };
+  if (!alternatives.some(option => option.id === recommendation.optionId) || !recommendation.reason) throw new Error('Plan recommendation must identify an assessed option and reason.');
+  return { diagnosis: text(value.diagnosis, 2000), alternatives, selectedOptionId, recommendation, userQuestion: text(value.userQuestion, 1000) || null };
+}
+function missingAcceptanceDiagnosis(managed, missing) {
+  const names = missing.map(item => item.id).join(', ');
+  const scope = managed.decision.action.scope;
+  const action = { kind: 'read', scope, summary: `Inspect missing acceptance checks: ${names}` };
+  return assessedPlan({ diagnosis: `Worker claimed completion, but independent file checks still fail: ${names}. Diagnose the discrepancy before any repair.`,
+    alternatives: [{ id: 'inspect_missing_acceptance', action,
+      assessment: { risk: 'low', reversibility: 'reversible', externalEffect: 'none', blastRadius: 'single_file', uncertainty: 'low', inObjective: true, userChoice: false },
+      expectedVerification: `Report observed file state for ${names}`, rollback: 'No changes to undo' }],
+    selectedOptionId: 'inspect_missing_acceptance', recommendation: { optionId: 'inspect_missing_acceptance', reason: 'Independent checks have not verified completion.' } });
+}
+function rejectedActionDiagnosis(managed, rejected) {
+  const scope = managed.approvalScopes[0];
+  if (!scope) throw new Error('Replanning needs an enrolled task scope.');
+  const action = { kind: 'read', scope, summary: `Review the rejected ${rejected.kind} proposal and prior checkpoint; propose a different assessed action without executing it` };
+  return assessedPlan({ diagnosis: `The user rejected ${rejected.kind} in scope ${rejected.scope}: ${rejected.summary}. Inspect only the recorded task state and propose an alternative. Do not execute the rejected action.`,
+    alternatives: [{ id: 'diagnose_rejected_action', action,
+      assessment: { risk: 'low', reversibility: 'reversible', externalEffect: 'none', blastRadius: 'single_file', uncertainty: 'low', inObjective: true, userChoice: false },
+      expectedVerification: 'Report the rejection reason and a concrete, different assessed next option.', rollback: 'No changes to undo.' }],
+    selectedOptionId: 'diagnose_rejected_action', recommendation: { optionId: 'diagnose_rejected_action', reason: 'Read the recorded rejection before choosing different work.' } });
+}
+export function evaluateAssessedPlan(plan, policy, scopes, now = Date.now()) {
+  const option = plan.alternatives.find(item => item.id === plan.selectedOptionId);
+  const { action } = option;
+  const facts = assessment(option.assessment);
+  let reason = null;
+  if (!scopes.includes(action.scope)) reason = 'Action scope is outside the task enrollment.';
+  else if (facts.inObjective !== true || facts.userChoice !== false) reason = 'Objective fit or user choice needs review.';
+  else if (Object.values(facts).includes('unknown') || facts.inObjective === null || facts.userChoice === null) reason = 'Action assessment is incomplete.';
+  else if (!option.expectedVerification) reason = 'Expected verification is missing.';
+  else if (!LOCAL_ACTIONS.has(action.kind) || facts.externalEffect === 'external' || facts.reversibility === 'irreversible' || facts.blastRadius === 'multi_system' || facts.risk === 'high' || facts.uncertainty === 'high') reason = 'Action has external, irreversible, broad, or high-uncertainty effects.';
+  else if (action.kind === 'local_edit' && (!option.rollback || facts.reversibility !== 'reversible' || facts.externalEffect !== 'local')) reason = 'Local edit needs a concrete rollback and local reversible effects.';
+  else if (action.kind !== 'local_edit' && facts.externalEffect !== 'none') reason = 'Read or test action has unexpected side effects.';
+  else if (policy === 'strict' && (action.kind === 'local_edit' || facts.risk !== 'low' || facts.uncertainty !== 'low')) reason = 'Strict policy requires low-risk read or local test.';
+  else if (policy === 'balanced' && (facts.risk !== 'low' || facts.uncertainty !== 'low' || action.kind === 'local_edit' && facts.blastRadius !== 'single_file')) reason = 'Balanced policy requires a low-risk, narrow action.';
+  else if (policy === 'autonomous' && (facts.risk === 'medium' && facts.blastRadius !== 'repository' && facts.blastRadius !== 'single_file')) reason = 'Medium-risk action exceeds the repository boundary.';
+  return { id: digest(JSON.stringify({ plan, policy })), outcome: reason ? 'wait' : policy === 'autonomous' && facts.risk === 'medium' ? 'report' : 'proceed', reason: reason || 'Selected action fits the enrolled objective, scope, and policy.', selectedOptionId: option.id, action, assessment: facts, expectedVerification: option.expectedVerification, rollback: option.rollback, policy, at: now };
+}
+// Shared by live Stop hooks and cold exact-session recovery. Keep the result
+// contract identical across transports; the host still verifies acceptance.
+export function assessedCheckpointContract(decision) {
+  return `Return ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened",evidence:["concrete observation"]} for THIS selected action. This is provider-reported, not independent verification. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. Missing facts are unknown. Completed requires evidence, and SIMY independently checks frozen acceptance. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. missing_information requires a specific question.`;
+}
+export function understandingCheckpointContract(decision) {
+  return `This is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; do not edit files, call external services, or start the proposed next action. Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require review. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. For semantic conditions use manual. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. If material context is missing, set exactly one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification.`;
+}
+function boundedContextList(value, maxItems = 8, maxLength = 300) {
+  if (!Array.isArray(value) || value.length > maxItems) throw new Error('Session understanding has too many items.');
+  return value.map(item => contextText(item, maxLength)).filter(Boolean);
+}
+function sessionUnderstanding(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || !['clear', 'ambiguous', 'context_missing', 'already_done'].includes(value.state)) throw new Error('A structured session understanding is required.');
+  const basis = Array.isArray(value.basis) && value.basis.length <= 6 ? value.basis.map(item => {
+    if (!['user', 'assistant', 'artifact'].includes(item?.source)) throw new Error('Understanding basis needs a source.');
+    const turnRef = contextText(item.turnRef, 100) || null;
+    const snippet = contextText(item.snippet, 240) || null;
+    if (!turnRef && !snippet) throw new Error('Understanding basis needs a reference or excerpt.');
+    return { source: item.source, turnRef, snippet };
+  }) : [];
+  if (!basis.length && value.state !== 'context_missing') throw new Error('Understanding needs bounded context evidence.');
+  const criteria = Array.isArray(value.criteria) && value.criteria.length <= 10 ? value.criteria.map((item, index) => {
+    const description = contextText(item?.description, 300);
+    if (!description || !['user_grounded', 'proposed'].includes(item?.source)) throw new Error('Understanding criterion needs a description and provenance.');
+    const basisIndex = Number.isSafeInteger(item.basisIndex) && item.basisIndex >= 0 && item.basisIndex < basis.length ? item.basisIndex : null;
+    if (item.source === 'user_grounded' && (basisIndex === null || basis[basisIndex].source !== 'user')) throw new Error('User-grounded criterion needs a user-message basis.');
+    const check = item.check?.type || 'manual';
+    if (!['manual', 'file_exists', 'file_contains', 'file_equals'].includes(check)) throw new Error('Unsupported inferred acceptance check.');
+    if (check !== 'manual' && (!text(item.check.path, 500) || isAbsolute(item.check.path) || item.check.path.split(/[\\/]/).includes('..'))) throw new Error('Inferred file check needs a relative task path.');
+    if (check === 'file_contains' && !text(item.check.text, 1000)) throw new Error('Inferred file check needs expected text.');
+    if (check === 'file_equals' && exactText(item.check.text) === null) throw new Error('Inferred file_equals needs bounded exact UTF-8 text.');
+    return { id: `inferred-${index + 1}`, description, source: item.source, basisIndex,
+      check: check === 'manual' ? { type: 'manual' } : { type: check, path: text(item.check.path, 500), ...(check === 'file_contains' ? { text: contextText(item.check.text, 1000) } : {}), ...(check === 'file_equals' ? { text: exactText(item.check.text) } : {}) } };
+  }) : [];
+  const result = { state: value.state, objective: contextText(value.objective, 1000), constraints: boundedContextList(value.constraints),
+    done: boundedContextList(value.done), remaining: boundedContextList(value.remaining), nextAction: value.nextAction ? actionDescriptor(value.nextAction) : null,
+    criteria, ambiguities: boundedContextList(value.ambiguities, 3), question: contextText(value.question, 500) || null, basis };
+  if (result.state === 'clear' && (!result.objective || !result.remaining.length || !result.nextAction || result.ambiguities.length || result.question)) throw new Error('Clear understanding needs an objective, remaining work, and an unambiguous next action.');
+  if (result.state === 'already_done' && (!result.objective || result.remaining.length || result.nextAction)) throw new Error('Already-finished understanding must have no remaining action.');
+  if (['clear', 'already_done'].includes(result.state) && !basis.some(item => item.source === 'user')) throw new Error('Inferred session goal needs a user-message basis.');
+  if (['ambiguous', 'context_missing'].includes(result.state) && (!result.question || result.ambiguities.length !== 1)) throw new Error('Unclear understanding needs one focused question.');
+  return result;
+}
+function recordDecision(managed, plan, now) {
+  const decision = evaluateAssessedPlan(plan, managed.autonomyPolicy, managed.approvalScopes, now);
+  if (managed.rejectedActionOverflow || managed.rejectedActionDigests?.includes(digest(JSON.stringify(decision.action)))) {
+    decision.outcome = 'wait';
+    decision.reason = 'A previously rejected action requires a fresh exact user decision.';
+  }
+  managed.decisionGeneration = (managed.decisionGeneration || 0) + 1;
+  decision.id = digest(`${managed.taskId}:${managed.decisionGeneration}:${decision.id}`);
+  managed.plan = plan; managed.decision = decision; managed.proposedAction = decision.action;
+  managed.decisionHistory ||= [];
+  if (managed.decisionHistory.at(-1)?.id !== decision.id) managed.decisionHistory.push({ id: decision.id, at: now, outcome: decision.outcome, reason: decision.reason, selectedOptionId: decision.selectedOptionId, action: decision.action });
+  managed.decisionHistory = managed.decisionHistory.slice(-10);
+  managed.pendingApproval = decision.outcome === 'wait' ? { id: decision.id, ...decision.action, reason: decision.reason } : null;
+  return decision;
+}
+function rememberRejectedAction(managed, pending) {
+  if (!managed.autonomyPolicy) return;
+  managed.rejectedActionDigests ||= [];
+  const rejectedDigest = digest(JSON.stringify({ kind: pending.kind, scope: pending.scope, summary: pending.summary }));
+  if (!managed.rejectedActionDigests.includes(rejectedDigest)) {
+    if (managed.rejectedActionDigests.length < 50) managed.rejectedActionDigests.push(rejectedDigest);
+    else managed.rejectedActionOverflow = true;
+  }
+  const history = managed.decisionHistory?.findLast(item => item.id === pending.id);
+  if (history) history.userDecision = 'rejected';
+}
+function escalate(run, cause) {
+  if (!run.managed?.autonomyPolicy) return;
+  const managed = run.managed;
+  const history = (managed.workHistory || []).slice(-5);
+  managed.escalation = { cause, tried: history.map(item => ({ action: item.action?.summary, result: item.status, reason: item.summary })), results: history.map(item => ({ action: item.action?.summary, result: item.status, reason: item.verification })), remainingWork: text(managed.remainingWork || run.nextStep, 1000), userQuestion: managed.userQuestion || managed.plan?.userQuestion || 'Which action should be authorized or revised?', options: (managed.plan?.alternatives || []).map(option => ({ id: option.id, action: { kind: option.action.kind, scope: option.action.scope, summary: text(option.action.summary, 200) } })), recommendation: managed.plan?.recommendation || null };
+}
+export function notifyState(run, now) {
+  if (!run?.managed || !['blocked', 'verification_pending', 'recovery_required', 'failed', 'budget_exhausted', 'completed', 'reported_done'].includes(run.state)) return;
+  const key = `${run.state}:${run.revision}:${run.reason}`;
+  if (run.managed.notificationKey === key) return;
+  run.managed.notificationKey = key;
+  run.managed.notification = { key, kind: run.state, message: run.reason, at: now };
+}
+function managedSpec(spec, session, provider, observedProcess, admission) {
+  if (!spec) return null;
+  if (spec !== true && (typeof spec !== 'object' || Array.isArray(spec))) throw new Error('Invalid managed task specification.');
+  const config = spec === true ? {} : spec;
+  if (!Array.isArray(config.acceptanceCriteria) || (!config.acceptanceCriteria.length && config.contextBootstrap !== true) || config.acceptanceCriteria.length > 20) throw new Error('Managed tasks require acceptanceCriteria.');
+  const criteria = config.acceptanceCriteria.map((item, index) => {
+    if (typeof item !== 'object' || !item || !text(item.description, 500)) throw new Error('Each acceptance criterion needs a description.');
+    const id = text(item.id, 80) || `criterion-${index + 1}`;
+    if (!/^[A-Za-z0-9_-]+$/.test(id) || ['__proto__', 'constructor', 'prototype', 'toString', 'valueOf', 'hasOwnProperty'].includes(id)) throw new Error('Invalid acceptance criterion ID.');
+    const check = item.check || { type: 'manual' };
+    if (!['manual', 'file_exists', 'file_contains', 'file_equals'].includes(check.type)) throw new Error('Unsupported acceptance check.');
+    if (check.type !== 'manual' && (!text(check.path, 500) || isAbsolute(check.path) || check.path.split(/[\\/]/).includes('..'))) throw new Error('Acceptance file must be relative to the task directory.');
+    if (check.type === 'file_contains' && !text(check.text, 1000)) throw new Error('file_contains needs expected text.');
+    if (check.type === 'file_equals' && exactText(check.text) === null) throw new Error('file_equals needs bounded exact UTF-8 text.');
+    return { id, description: text(item.description, 500), check: { type: check.type, ...(check.type === 'file_equals' ? { exactPath: check.path } : check.type === 'manual' ? {} : { path: check.path }), ...(check.type === 'file_contains' ? { text: text(check.text, 1000) } : {}), ...(check.type === 'file_equals' ? { text: exactText(check.text) } : {}) } };
+  });
+  if (new Set(criteria.map(item => item.id)).size !== criteria.length) throw new Error('Duplicate acceptance criterion ID.');
+  const approvalPolicy = config.approvalPolicy || 'wait';
+  if (!APPROVAL_DECISIONS.has(approvalPolicy)) throw new Error('Invalid approval policy.');
+  const scopes = Array.isArray(config.approvalScopes) ? config.approvalScopes.map(value => text(value, 200)).filter(Boolean) : [];
+  const initialAction = actionDescriptor(config.initialAction);
+  const autonomyPolicy = config.autonomyPolicy === undefined ? null : config.autonomyPolicy;
+  if (autonomyPolicy !== null && !AUTONOMY_POLICIES.has(autonomyPolicy)) throw new Error('Invalid autonomy policy.');
+  const initialPlan = autonomyPolicy ? assessedPlan(config.initialPlan) : null;
+  if (initialPlan && JSON.stringify(initialPlan.alternatives.find(item => item.id === initialPlan.selectedOptionId).action) !== JSON.stringify(initialAction)) throw new Error('Initial action must be the selected assessed option.');
+  if (config.contextBootstrap === true && (!initialPlan || initialAction.kind !== 'read' || initialAction.scope !== 'task' || initialPlan.alternatives.length !== 1 || evaluateAssessedPlan(initialPlan, autonomyPolicy, ['task']).outcome !== 'proceed')) throw new Error('Session understanding requires an assessed read-only initial action.');
+  const actionDueAt = config.actionDueAt === undefined ? null : typeof config.actionDueAt === 'string' ? Date.parse(config.actionDueAt) : NaN;
+  if (actionDueAt !== null && !Number.isFinite(actionDueAt)) throw new Error('Invalid actionDueAt timestamp.');
+  if (config.autoRecoverySandbox && !['read-only', 'workspace-write'].includes(config.autoRecoverySandbox)) throw new Error('Invalid autoRecoverySandbox.');
+  const resumeModel = text(config.resumeModel, 80) || null;
+  if (resumeModel && !/^[A-Za-z0-9][A-Za-z0-9._-]{1,79}$/.test(resumeModel)) throw new Error('Invalid resumeModel.');
+  const exactCodexSession = provider === 'codex' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(session);
+  const appServerChannel = config.resumeChannel === 'codex_app_server' && admission?.source === 'codex_app_server' && admission.session === session;
+  const autoRecovery = config.autoRecovery === true && exactCodexSession && Boolean(resumeModel) &&
+    (appServerChannel || config.resumeChannel === 'codex_exec' && Boolean(observedProcess?.identity));
+  const managed = { taskId: randomUUID(), thread: { provider, id: session },
+    actionId: text(config.actionId, 200) || null, actionDueAt, acceptanceCriteria: criteria, verified: {}, remainingWork: text(config.remainingWork, 4000) || null,
+    initialAction, proposedAction: initialAction, approvalPolicy, approvalScopes: [...new Set(scopes)].slice(0, 20),
+    grants: Object.fromEntries(scopes.map(scope => [scope, { decision: approvalPolicy }])), maxNoProgress: positive(config.maxNoProgress, 3, 20),
+    noProgress: 0, verifiedRevision: 0, consumedVerifiedRevision: 0, notification: null, notificationKey: null,
+    autoRecovery, resumeModel, autoRecoveryUnavailableReason: config.autoRecovery === true && !autoRecovery ? 'Exact Codex process, session UUID, and resumeModel are required.' : null,
+    autoRecoverySandbox: config.autoRecoverySandbox || 'read-only', resumeChannel: config.resumeChannel || null,
+    capability: appServerChannel && autoRecovery ? 'codex_app_server' : autoRecovery ? 'codex_exec_resume' : 'live_hook',
+    awaitingInitialHook: provider === 'claude' && Boolean(observedProcess?.identity) && Boolean(autonomyPolicy),
+    autonomyPolicy, plan: null, decision: null, decisionHistory: [], workHistory: [], escalation: null,
+    ...(config.contextBootstrap === true ? { contextBootstrap: true, phase: 'understanding', sessionUnderstanding: null, understandingRevision: 0 } : {}) };
+  if (initialPlan) recordDecision(managed, initialPlan, Date.now());
+  return managed;
+}
+export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxContinuations, maxFailures, maxMinutes, managed, admission,
+  liveHookAdmission, inspectProcess = processIdentity, now = Date.now() }) {
   cwd = await realpath(cwd);
   if (!text(objective) || !text(nextStep)) throw new Error('Objective and concrete next step are required.');
-  return updateRecord(root, provider, session, previous => {
-    if (!previous?.observedAt || previous.cwd !== cwd) throw new Error('No matching hook session observed here. Enable SIMY hooks, then start a new turn and use the session ID from hook context.');
+  return updateRecord(root, provider, session, async previous => {
+    const admitted = admission?.source === 'codex_app_server' && admission.provider === provider && admission.session === session && admission.cwd === cwd && previous?.admission?.source === admission.source && previous.admission.session === session && previous.cwd === cwd;
+    if (liveHookAdmission) {
+      const process = previous?.process;
+      if (provider !== 'claude' || previous?.hookStartedAt !== liveHookAdmission.hookStartedAt ||
+          !(['SessionStart', 'Stop'].includes(previous.lastEvent) || previous.lastEvent === 'Notification' && previous.lastNotificationType === 'idle_prompt') || process?.pid !== liveHookAdmission.pid ||
+          process?.identity !== liveHookAdmission.identity || !process.identity ||
+          await inspectProcess(process.pid) !== process.identity) throw new Error('Claude live hook changed before enrollment; refresh the session.');
+    }
+    if ((!previous?.observedAt && !admitted) || previous.cwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or enable SIMY hooks.');
     if (previous.run) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
-    return { ...previous, run: { id: randomUUID(), objective: text(objective), state: 'active', nextStep: text(nextStep), startedAt: now, updatedAt: now,
+    const managedState = managedSpec(managed, session, provider, previous.process, admitted ? admission : null);
+    if (liveHookAdmission && managedState) managedState.liveHookOwner = { pid: liveHookAdmission.pid,
+      identity: liveHookAdmission.identity, hookStartedAt: liveHookAdmission.hookStartedAt };
+    const waiting = managedState?.decision?.outcome === 'wait';
+    const queued = managedState?.capability === 'codex_app_server';
+    const run = { id: randomUUID(), objective: text(objective), state: waiting ? 'blocked' : queued ? 'recovery_required' : 'active', nextStep: text(nextStep), startedAt: now, updatedAt: now,
       deadline: now + positive(maxMinutes, 30, 1440) * 60_000, maxContinuations: positive(maxContinuations, 6, 50), maxFailures: positive(maxFailures, 3, 10),
-      continuations: 0, failures: 0, revision: 0, consumedRevision: -1, checkpoint: null, reason: 'started' } };
+      continuations: 0, failures: 0, revision: 0, consumedRevision: -1, checkpoint: null, reason: waiting ? managedState.decision.reason : queued ? 'Exact-session supervision is queued; SIMY will acquire the provider writer lock before dispatch.' : 'started',
+      ...(queued ? { recoveryCause: 'session_supervision' } : {}), managed: managedState };
+    if (waiting) escalate(run, run.reason);
+    return { ...previous, run };
   });
 }
-export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, now = Date.now() }) {
+export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, expectedLease, now = Date.now() }) {
+  if (checkpoint?.kind === 'session_understanding') return checkpointUnderstanding({ root, provider, session, cwd, checkpoint, expectedLease, now });
   try { cwd = await realpath(cwd); } catch { throw new Error('No matching active Delivery Loop.'); }
   const statuses = ['in_progress', 'completed', 'blocked', 'error'];
   if (!checkpoint || !statuses.includes(checkpoint.status)) throw new Error('Checkpoint status must be in_progress, completed, blocked, or error.');
   if (!text(checkpoint.summary)) throw new Error('Checkpoint summary is required.');
   if (['in_progress', 'error'].includes(checkpoint.status) && !text(checkpoint.nextStep)) throw new Error('A concrete nextStep is required.');
-  if (checkpoint.status === 'blocked' && !['authorization', 'missing_information'].includes(checkpoint.blocker)) throw new Error('Specify authorization or missing_information.');
+  if (checkpoint.status === 'blocked' && !['authorization', 'missing_information', 'external_dependency'].includes(checkpoint.blocker)) throw new Error('Specify authorization, missing_information, or external_dependency.');
   const evidence = Array.isArray(checkpoint.evidence) ? checkpoint.evidence.map(v => text(v, 1000)).filter(Boolean).slice(0, 20) : [];
-  if (checkpoint.status === 'completed' && (!evidence.length || checkpoint.acceptanceMet !== true)) throw new Error('Completion requires acceptanceMet and concrete verification evidence.');
-  return updateRecord(root, provider, session, record => {
+  return updateRecord(root, provider, session, async record => {
     const run = record?.run;
+    let effectiveStatus = checkpoint.status;
+    let nextStep = text(checkpoint.nextStep);
+    let repairPlan = null;
     if (!run || record.cwd !== cwd) throw new Error('No matching active Delivery Loop.');
+    if (run.managed?.phase === 'understanding' || run.managed?.phase === 'needs_clarification') throw new Error('Session understanding needs its separate structured checkpoint.');
+    if (checkpoint.status === 'completed' && !run.managed && (!evidence.length || checkpoint.acceptanceMet !== true)) throw new Error('Completion requires acceptanceMet and concrete verification evidence.');
+    if (expectedLease && (run.state !== 'auto_resuming' || run.managed?.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Managed recovery lease changed; checkpoint discarded.');
     if (TERMINAL.has(run.state) || run.state === 'blocked' || run.state === 'recovery_required') throw new Error('Loop is stopped or awaiting a human resume.');
-    run.checkpoint = { status: checkpoint.status, summary: text(checkpoint.summary), nextStep: text(checkpoint.nextStep), blocker: checkpoint.blocker, evidence, acceptanceMet: checkpoint.acceptanceMet === true };
+    if (['paused', 'verification_pending'].includes(run.state)) throw new Error('Managed task is paused or awaiting acceptance verification.');
+    if (run.managed) {
+      const performed = run.managed.autonomyPolicy ? structuredClone(run.managed.decision) : null;
+      let actionResult = null;
+      if (performed) {
+        const result = checkpoint.actionResult;
+        if (result?.decisionId !== performed.id || !['observed', 'failed', 'not_run'].includes(result?.status) || !text(result.summary, 500)) throw new Error('Checkpoint needs an actionResult bound to the selected decision.');
+        actionResult = { decisionId: performed.id, status: result.status, summary: text(result.summary, 300), evidence: Array.isArray(result.evidence) ? result.evidence.map(item => text(item, 300)).filter(Boolean).slice(0, 5) : [], source: 'provider_reported' };
+        if (result.status === 'observed' && !actionResult.evidence.length) throw new Error('Observed action result needs concrete evidence.');
+      }
+      const previouslyVerified = Object.keys(run.managed.verified).length;
+      run.managed.remainingWork = text(checkpoint.remainingWork, 4000) || run.managed.remainingWork;
+      await verifyAutomaticCriteria(record, now);
+      if (run.managed.autonomyPolicy && checkpoint.status === 'completed') {
+        const missing = run.managed.acceptanceCriteria.filter(item => item.check.type !== 'manual' && !Object.hasOwn(run.managed.verified, item.id));
+        if (missing.length) {
+          effectiveStatus = 'in_progress';
+          repairPlan = checkpoint.plan && nextStep ? assessedPlan(checkpoint.plan) : missingAcceptanceDiagnosis(run.managed, missing);
+          nextStep ||= `Diagnose failed acceptance checks: ${missing.map(item => item.id).join(', ')}`;
+        }
+      }
+      if (performed) {
+        run.managed.workHistory ||= [];
+        run.managed.workHistory.push({ decisionId: performed.id, action: performed.action, status: checkpoint.status, summary: text(checkpoint.summary, 300), result: actionResult, verification: `${Math.max(0, Object.keys(run.managed.verified).length - previouslyVerified)} new acceptance criteria verified`, at: now });
+        run.managed.workHistory = run.managed.workHistory.slice(-10);
+        if (performed.outcome === 'report') run.managed.notification = { key: `report:${run.revision + 1}`, kind: 'action_report', message: `Attempted ${performed.action.summary}: ${text(checkpoint.summary, 300)}. ${run.managed.workHistory.at(-1).verification}.`, at: now };
+        if (run.managed.approvedAction?.id === performed.id) delete run.managed.approvedAction;
+      }
+      if (['in_progress', 'error'].includes(effectiveStatus)) {
+        if (run.managed.autonomyPolicy) {
+          const plan = repairPlan || assessedPlan(checkpoint.plan);
+          const selected = plan.alternatives.find(item => item.id === plan.selectedOptionId);
+          if (checkpoint.proposedAction && JSON.stringify(actionDescriptor(checkpoint.proposedAction)) !== JSON.stringify(selected.action)) throw new Error('Proposed action differs from selected assessed option.');
+          recordDecision(run.managed, plan, now);
+          if (actionResult.status === 'not_run' || actionResult.status === 'failed' && run.managed.decision.action.kind !== 'read') {
+            run.managed.decision.outcome = 'wait'; run.managed.decision.reason = actionResult.status === 'not_run' ? 'Previous selected action was not run.' : 'Failed action requires a read-only diagnosis before another change.';
+            run.managed.pendingApproval = { id: run.managed.decision.id, ...run.managed.decision.action, reason: run.managed.decision.reason };
+          }
+        } else run.managed.proposedAction = actionDescriptor(checkpoint.proposedAction);
+      }
+      if (checkpoint.status === 'blocked' && checkpoint.blocker === 'authorization') {
+        const request = checkpoint.approval;
+        if (!text(checkpoint.nextStep)) throw new Error('Authorization request requires the proposed nextStep.');
+        if (!text(request?.scope, 200) || !text(request?.summary, 1000)) throw new Error('Authorization blocker requires a scoped approval request.');
+        const proposed = actionDescriptor({ kind: request.kind || 'unknown', scope: request.scope, summary: request.summary });
+        if (run.managed.autonomyPolicy) {
+          const plan = assessedPlan(checkpoint.plan);
+          if (JSON.stringify(plan.alternatives.find(item => item.id === plan.selectedOptionId).action) !== JSON.stringify(proposed)) throw new Error('Authorization request must match the selected assessed option.');
+          const decision = recordDecision(run.managed, plan, now);
+          decision.outcome = 'wait'; decision.reason = 'Provider authorization requires an exact user decision.';
+          run.managed.pendingApproval = { id: decision.id, ...proposed, reason: decision.reason };
+        } else {
+          run.managed.proposedAction = proposed;
+          run.managed.pendingApproval = { id: digest(`${run.managed.taskId}:${run.revision + 1}:${JSON.stringify(proposed)}`), ...proposed };
+        }
+      }
+      if (run.managed.autonomyPolicy && checkpoint.status === 'blocked' && checkpoint.blocker === 'missing_information') {
+        if (!text(checkpoint.question, 1000)) throw new Error('Missing information blocker needs a specific user question.');
+        run.managed.userQuestion = text(checkpoint.question, 1000);
+      }
+    }
+    run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep, blocker: checkpoint.blocker, evidence, acceptanceMet: checkpoint.acceptanceMet === true };
     run.revision += 1; run.updatedAt = now;
+    if (run.managed && effectiveStatus === 'completed') {
+      const pending = run.managed.acceptanceCriteria.filter(item => !Object.hasOwn(run.managed.verified, item.id));
+      if (pending.length) { run.state = 'verification_pending'; run.reason = `Acceptance verification pending: ${pending.map(item => item.id).join(', ')}`; }
+      else if (run.managed.contextBootstrap && !run.managed.acceptanceCriteria.length) {
+        run.state = 'reported_done'; run.reason = 'Original session reported the goal done; no independent acceptance check was available.';
+      }
+    }
+    notifyState(run, now);
     return record;
   });
 }
+async function checkpointUnderstanding({ root, provider, session, cwd, checkpoint, expectedLease, now }) {
+  try { cwd = await realpath(cwd); } catch { throw new Error('No matching active Delivery Loop.'); }
+  if (!text(checkpoint.summary, 1000)) throw new Error('Understanding checkpoint needs a summary.');
+  return updateRecord(root, provider, session, async record => {
+    const run = record?.run;
+    if (!run || record.cwd !== cwd || run.managed?.phase !== 'understanding' ||
+        TERMINAL.has(run.state) || ['blocked', 'paused', 'recovery_required', 'verification_pending'].includes(run.state)) throw new Error('No active session understanding turn.');
+    if (expectedLease && (run.state !== 'auto_resuming' || run.managed.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Session understanding lease changed; checkpoint discarded.');
+    if (now >= run.deadline) throw new Error('Session understanding deadline expired.');
+    const decision = run.managed.decision;
+    const result = checkpoint.actionResult;
+    if (decision?.action.kind !== 'read' || result?.decisionId !== decision.id || !['observed', 'failed', 'not_run'].includes(result.status) || !text(result.summary, 300)) throw new Error('Understanding result must match the selected read decision.');
+    const understanding = sessionUnderstanding(checkpoint.sessionUnderstanding);
+    if (['clear', 'already_done'].includes(understanding.state) && result.status !== 'observed') throw new Error('Clear understanding requires an observed read result.');
+    const plan = understanding.state === 'clear' ? assessedPlan(checkpoint.plan) : null;
+    if (plan && JSON.stringify(plan.alternatives.find(item => item.id === plan.selectedOptionId).action) !== JSON.stringify(understanding.nextAction)) throw new Error('Understood next action differs from selected assessed option.');
+    run.managed.sessionUnderstanding = understanding;
+    run.managed.understandingRevision = (run.managed.understandingRevision || 0) + 1;
+    run.managed.understandingAnswer = null;
+    run.managed.workHistory ||= [];
+    run.managed.workHistory.push({ decisionId: decision.id, action: decision.action, status: 'session_understanding', summary: contextText(checkpoint.summary, 300),
+      result: { decisionId: decision.id, status: result.status, summary: contextText(result.summary, 300), source: 'provider_reported' },
+      verification: 'Context interpretation only; no acceptance verified', at: now });
+    run.managed.workHistory = run.managed.workHistory.slice(-10);
+    run.checkpoint = { kind: 'session_understanding', status: 'in_progress', summary: contextText(checkpoint.summary, 1000), evidence: [], acceptanceMet: false };
+    run.revision += 1; run.updatedAt = now;
+    if (expectedLease) run.continuations += 1;
+    if (result.status !== 'observed') run.failures += 1;
+    if (run.failures >= run.maxFailures) {
+      run.state = 'failed'; run.reason = 'Repeated session understanding failures; inspect the original conversation.';
+      notifyState(run, now); return record;
+    }
+    if (understanding.state === 'clear') {
+      run.objective = understanding.objective;
+      run.managed.remainingWork = understanding.remaining.join(' ').slice(0, 4000);
+      // Only mechanical checks tied to a cited user message become frozen
+      // acceptance. Semantic/provider-proposed criteria remain visible above.
+      run.managed.acceptanceCriteria = understanding.criteria.filter(item => item.source === 'user_grounded' && item.check.type !== 'manual')
+        .map(item => ({ id: item.id, description: item.description, check: item.check.type === 'file_equals'
+          ? { type: 'file_equals', exactPath: item.check.path, text: item.check.text } : item.check }));
+      run.managed.verified = {};
+      run.managed.phase = 'active';
+      run.nextStep = understanding.nextAction.summary;
+      recordDecision(run.managed, plan, now);
+      run.reason = run.managed.decision.outcome === 'wait' ? run.managed.decision.reason : 'Session goal understood; selected next action awaits the normal dispatch gate.';
+      if (run.managed.decision.outcome === 'wait') { run.state = 'blocked'; run.blocker = 'authorization'; escalate(run, run.reason); }
+    } else if (understanding.state === 'already_done') {
+      run.objective = understanding.objective;
+      run.managed.remainingWork = null;
+      run.managed.phase = 'active';
+      run.state = 'reported_done';
+      run.reason = 'Original conversation reports no remaining work; independent completion was not verified.';
+    } else {
+      run.managed.phase = 'needs_clarification';
+      run.managed.understandingQuestion = { id: randomUUID(), text: understanding.question, revision: run.managed.understandingRevision };
+      run.state = 'blocked'; run.blocker = 'missing_information';
+      run.reason = understanding.question;
+      run.managed.autoRecovery = false;
+    }
+    notifyState(run, now);
+    return record;
+  });
+}
+export async function verifyAutomaticCriteria(record, now) {
+  const managed = record.run.managed;
+  for (const criterion of managed.acceptanceCriteria) {
+    if (criterion.check.type === 'manual') continue;
+    const path = criterion.check.type === 'file_equals' ? criterion.check.exactPath || criterion.check.path : criterion.check.path;
+    if (!path) { delete managed.verified[criterion.id]; continue; }
+    const file = resolve(record.cwd, path);
+    const rel = relative(record.cwd, file);
+    if (rel.startsWith('..') || isAbsolute(rel)) { delete managed.verified[criterion.id]; continue; }
+    try {
+      const actual = await realpath(file);
+      const actualRel = relative(record.cwd, actual);
+      if (actualRel.startsWith('..') || isAbsolute(actualRel)) { delete managed.verified[criterion.id]; continue; }
+      const info = await stat(actual);
+      if (!info.isFile() || info.size > 1024 * 1024) { delete managed.verified[criterion.id]; continue; }
+      const content = await readFile(actual);
+      if (criterion.check.type === 'file_contains' && !content.toString('utf8').includes(criterion.check.text)) { delete managed.verified[criterion.id]; continue; }
+      if (criterion.check.type === 'file_equals' && !content.equals(Buffer.from(criterion.check.text, 'utf8'))) { delete managed.verified[criterion.id]; continue; }
+      if (!Object.hasOwn(managed.verified, criterion.id)) managed.verifiedRevision += 1;
+      managed.verified[criterion.id] = { source: criterion.check.type, checkedAt: now, path, sha256: digest(content) };
+    } catch { delete managed.verified[criterion.id]; }
+  }
+}
+export async function verifyDelivery({ root = rootDirectory(), provider, session, taskId, criterionId, now = Date.now() }) {
+  return updateRecord(root, provider, session, async record => {
+    const run = record?.run;
+    if (!run?.managed || run.state !== 'verification_pending') throw new Error('Managed task is not awaiting acceptance verification.');
+    if (taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
+    const criterion = run.managed.acceptanceCriteria.find(item => item.id === criterionId);
+    if (!criterion || criterion.check.type !== 'manual') throw new Error('Only manual criteria can be verified by the user.');
+    if (!Object.hasOwn(run.managed.verified, criterionId)) run.managed.verifiedRevision += 1;
+    run.managed.verified[criterionId] = { source: 'user', checkedAt: now };
+    if (run.state === 'verification_pending' && run.checkpoint?.status === 'completed') {
+      await verifyAutomaticCriteria(record, now);
+      if (run.managed.acceptanceCriteria.every(item => Object.hasOwn(run.managed.verified, item.id))) {
+        run.state = 'completed'; run.reason = run.checkpoint.summary;
+      }
+    }
+    notifyState(run, now);
+    run.updatedAt = now; return record;
+  });
+}
 export function decideStop(run, now = Date.now()) {
-  if (TERMINAL.has(run.state) || ['blocked', 'recovery_required'].includes(run.state)) return { run, output: {} };
+  if (TERMINAL.has(run.state) || ['blocked', 'recovery_required', 'paused', 'verification_pending'].includes(run.state)) return { run, output: {} };
   const next = structuredClone(run);
   const finish = (state, reason) => { next.state = state; next.reason = reason; next.updatedAt = now; return { run: next, output: {} }; };
   // A fresh, explicitly evidenced completion may finish at the budget boundary.
   const fresh = next.checkpoint && next.revision > next.consumedRevision;
   const cp = fresh ? next.checkpoint : null;
-  if (cp?.status === 'completed') return finish('completed', cp.summary);
-  if (cp?.status === 'blocked') { next.blocker = cp.blocker; return finish('blocked', cp.summary); }
+  if (cp?.status === 'completed') return finish(next.managed?.contextBootstrap && !next.managed.acceptanceCriteria.length ? 'reported_done' : 'completed',
+    next.managed?.contextBootstrap && !next.managed.acceptanceCriteria.length ? 'Original session reported the goal done; no independent acceptance check was available.' : cp.summary);
+  if (cp?.status === 'blocked') {
+    next.blocker = cp.blocker;
+    const approval = next.managed?.pendingApproval;
+    const grant = approval && Object.hasOwn(next.managed.grants, approval.scope) ? next.managed.grants[approval.scope] : null;
+    if (!next.managed?.autonomyPolicy && approval && LOCAL_ACTIONS.has(approval.kind) && grant && grant.decision !== 'wait') {
+      next.managed.pendingApproval = null;
+      next.managed.notification = grant.decision === 'proceed_and_report' ? { key: `approval:${approval.id}`, kind: 'approval', message: `Proceeding under grant for ${approval.scope}.`, at: now } : next.managed.notification;
+      next.nextStep = text(cp.nextStep) || next.nextStep;
+    } else { escalate(next, cp.summary); return finish('blocked', cp.summary); }
+  }
   if (now >= next.deadline || next.continuations >= next.maxContinuations) return finish('budget_exhausted', 'Delivery time or continuation budget exhausted.');
-  if (!fresh || cp.status === 'error') next.failures += 1;
-  else next.failures = 0;
+  const initialHook = next.managed?.awaitingInitialHook && next.revision === 0 && !next.checkpoint;
+  const replanHook = next.managed?.capability === 'live_hook' && next.managed.awaitingReplanHook === true;
+  const understandingHook = next.managed?.capability === 'live_hook' && next.managed.awaitingUnderstandingHook === true;
+  const approvedHook = next.managed?.capability === 'live_hook' && next.managed.decision?.outcome === 'wait' &&
+    next.managed.approvedAction?.id === next.managed.decision.id && !next.managed.approvedAction.dispatchedAt;
+  const legacyApprovedHook = next.managed?.capability === 'live_hook' && !next.managed.autonomyPolicy &&
+    next.managed.approvedAction && !next.managed.approvedAction.dispatchedAt &&
+    JSON.stringify(next.managed.approvedAction.action) === JSON.stringify(next.managed.proposedAction) &&
+    next.managed.approvedAction.nextStep === next.nextStep;
+  // A first hook or approved dispatch has not produced a new checkpoint yet.
+  // Keep prior failures until actual fresh work succeeds or another attempt fails.
+  if (!initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook) {
+    if (!fresh || cp.status === 'error') next.failures += 1;
+    else next.failures = 0;
+  }
   if (next.failures >= next.maxFailures) return finish('failed', 'Repeated failure or missing progress checkpoint; human review required.');
+  if (next.managed) {
+    if (next.managed.autonomyPolicy && next.managed.decision?.outcome === 'wait' && !approvedHook) {
+      escalate(next, next.managed.decision.reason);
+      return finish('blocked', next.managed.decision.reason);
+    }
+    const action = next.managed.proposedAction;
+    if (!next.managed.autonomyPolicy && action && cp?.status !== 'blocked') {
+      const grant = Object.hasOwn(next.managed.grants, action.scope) ? next.managed.grants[action.scope] : null;
+      const oneShot = !next.managed.approvedAction?.dispatchedAt && next.managed.approvedAction?.nextStep === (cp?.nextStep || next.nextStep) && JSON.stringify(next.managed.approvedAction.action) === JSON.stringify(action);
+      if (!oneShot && (!LOCAL_ACTIONS.has(action.kind) || !grant || grant.decision === 'wait')) {
+        next.managed.pendingApproval = { id: digest(`${next.managed.taskId}:${next.revision}:${JSON.stringify(action)}`), ...action };
+        return finish('blocked', `Review proposed ${action.kind} action: ${action.summary}`);
+      }
+      if (!oneShot && grant.decision === 'proceed_and_report') next.managed.notification = { key: `action:${next.revision}`, kind: 'action', message: `Proceeding with ${action.summary}`, at: now };
+    }
+    const reportedStep = next.managed.contextBootstrap && next.managed.phase === 'active' && !next.managed.acceptanceCriteria.length &&
+      cp?.kind !== 'session_understanding' && cp?.status === 'in_progress' &&
+      next.managed.workHistory?.at(-1)?.result?.status === 'observed' && next.managed.workHistory.at(-1).result.evidence?.length;
+    if (next.managed.verifiedRevision > next.managed.consumedVerifiedRevision) next.managed.noProgress = 0;
+    else if (reportedStep) next.managed.reportedProgress = (next.managed.reportedProgress || 0) + 1;
+    else if (!initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && cp?.kind !== 'session_understanding') next.managed.noProgress += 1;
+    next.managed.consumedVerifiedRevision = next.managed.verifiedRevision;
+    if (next.managed.noProgress >= next.managed.maxNoProgress) { escalate(next, 'No verified acceptance progress within the configured continuation limit.'); return finish('failed', 'No verified acceptance progress within the configured continuation limit.'); }
+  }
   next.consumedRevision = next.revision;
+  if (initialHook) next.managed.awaitingInitialHook = false;
+  if (replanHook) next.managed.awaitingReplanHook = false;
+  if (understandingHook) next.managed.awaitingUnderstandingHook = false;
   if (cp?.nextStep) next.nextStep = cp.nextStep;
-  next.continuations += 1; next.updatedAt = now; next.state = 'active';
+  if (!(next.managed?.contextBootstrap && cp?.kind === 'session_understanding' && next.managed.resumeChannel === 'codex_app_server')) next.continuations += 1;
+  next.updatedAt = now; next.state = 'active';
+  if (approvedHook || legacyApprovedHook) {
+    const approval = next.managed.approvedAction;
+    approval.dispatchedAt = now;
+    next.managed.dispatches ||= [];
+    next.managed.dispatches.push({ approvalId: approval.id, at: now, channel: 'live_hook' });
+    next.managed.dispatches = next.managed.dispatches.slice(-20);
+    if (legacyApprovedHook) delete next.managed.approvedAction;
+  }
   next.reason = fresh ? 'continue_pending_work' : 'checkpoint_missing';
-  const instruction = fresh ? next.nextStep : `Check the actual delivery status first. Record an honest checkpoint with simy delivery checkpoint before stopping; do not claim completion without verification. Pending step: ${next.nextStep}`;
+  const selected = next.managed?.autonomyPolicy ? next.managed.decision : null;
+  const instruction = selected && next.managed.phase === 'understanding' ? `Understand the current user request in this ORIGINAL conversation. ${next.managed.understandingAnswer ? `The user answered question ${next.managed.understandingAnswer.questionId}: ${next.managed.understandingAnswer.text}. ` : ''}${understandingCheckpointContract(selected)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable. This updates SIMY metadata only; do not create a checkpoint file in the task workspace.` : selected ? `${initialHook ? `Managed objective: ${next.objective}. Frozen acceptance criteria: ${JSON.stringify(next.managed.acceptanceCriteria)}. ` : ''}${replanHook ? `Replan context: ${next.managed.plan.diagnosis}. ` : ''}Execute only selected ${selected.action.kind} action in scope ${selected.action.scope}: ${selected.action.summary}. Expected verification: ${selected.expectedVerification}. Rollback: ${selected.rollback || 'none needed'}. ${assessedCheckpointContract(selected)} Submit that JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable; do not create a task-workspace checkpoint file.` : fresh ? next.nextStep : `Check the actual delivery status first. Record an honest checkpoint with simy delivery checkpoint before stopping; do not claim completion without verification. Pending step: ${next.nextStep}`;
   return { run: next, output: { decision: 'block', reason: `SIMY Delivery Loop (${next.continuations}/${next.maxContinuations}). ${instruction}\nStay within the original request and permissions. If authorization or information is missing, record a blocked checkpoint and stop. Do not reset budgets or start a replacement loop.` } };
 }
 // A process signature protects against PID reuse. Never treat a stale timer alone
@@ -112,7 +580,7 @@ async function providerProcess(provider) {
   let pid = process.ppid;
   for (let i = 0; i < 3 && pid > 1; i++) {
     const identity = await processIdentity(pid);
-    if (identity && new RegExp(`(?:^|[/\\\\ ])${provider}(?:$|[ .-])`, 'i').test(identity)) return { pid, identity };
+    if (identity && new RegExp(`(?:^|[/\\\\ ])${provider}(?:$|[/\\\\ .-])`, 'i').test(identity)) return { pid, identity };
     try { const r = await promisify(execFile)('/bin/ps', ['-p', String(pid), '-o', 'ppid='], { timeout: 300, maxBuffer: 128 }); pid = Number(r.stdout.trim()); } catch { return null; }
   }
   return null;
@@ -121,26 +589,48 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
   if (!EVENTS.has(input?.hook_event_name) || !text(input.session_id) || !text(input.cwd)) return {};
   let cwd; try { cwd = await realpath(input.cwd); } catch { return {}; }
   const event = input.hook_event_name;
-  const identity = observedProcess === undefined && event === 'SessionStart' ? await providerProcess(provider) : observedProcess;
+  const identity = observedProcess === undefined && (event === 'SessionStart' || provider === 'claude' && event === 'Stop') ? await providerProcess(provider) : observedProcess;
   let output = {};
-  await updateRecord(root, provider, input.session_id, old => {
+  await updateRecord(root, provider, input.session_id, async old => {
     if (old && old.cwd !== cwd) return old;
     const record = old || { schemaVersion: 1, provider, session: input.session_id, cwd, run: null };
+    const owner = record.run?.managed?.liveHookOwner;
+    if (owner && ['SessionStart', 'Stop'].includes(event) &&
+        (!identity || identity.pid !== owner.pid || identity.identity !== owner.identity)) {
+      if (!TERMINAL.has(record.run.state) && !['paused', 'verification_pending'].includes(record.run.state)) {
+        if (!(record.run.state === 'blocked' && record.run.managed.pendingApproval)) record.run.state = 'recovery_required';
+        record.run.recoveryCause = 'hook_owner_mismatch';
+        record.run.reason = 'A different or unverified Claude process reported this session. Inspect and explicitly resume in the original conversation.';
+        record.run.managed.autoRecovery = false; record.run.updatedAt = now; notifyState(record.run, now);
+      }
+      return record;
+    }
     record.observedAt = now; record.lastEvent = event;
+    record.lastNotificationType = event === 'Notification' ? text(input.notification_type, 80) : null;
     if (identity) record.process = identity;
     if (event === 'SessionStart') {
-      output = { hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `SIMY hooks observed this ${provider} session: ${input.session_id}. Only if the user requests SIMY Delivery Loop, use simy delivery start --provider ${provider} --session ${input.session_id} with the agreed objective and next step. Existing loop: ${record.run?.state || 'not started'}. Never enable, trust, resume, or reset a loop on the user's behalf without their request.` } };
+      if (identity) record.hookStartedAt = now;
+      const approved = record.run?.managed?.approvedAction;
+      output = { hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `SIMY hooks observed this ${provider} session: ${input.session_id}. Only if the user requests SIMY Delivery Loop, use simy delivery start --provider ${provider} --session ${input.session_id} with the agreed objective and next step. Existing loop: ${record.run?.state || 'not started'}.${approved ? ` User approved exactly one ${approved.action.kind} action in scope ${approved.action.scope}: ${approved.action.summary}. Next step: ${approved.nextStep}. ${approved.dispatchedAt ? 'That approval was already dispatched; any repeated action needs a new approval.' : 'Resume the original conversation to dispatch this one action.'}` : ''} Never enable, trust, resume, or reset a loop on the user's behalf without their request.` } };
     }
     const run = record.run;
     if (!run || TERMINAL.has(run.state)) return record;
     if (event === 'Interrupt') { run.state = 'stopped'; run.reason = 'User interrupted the provider.'; }
+    else if (run.state === 'auto_resuming' && ['Stop', 'SessionEnd', 'StopFailure'].includes(event)) {
+      // The supervisor owns this exact attempt and consumes its structured
+      // final result once. Provider lifecycle hooks must not race that lease.
+    }
+    else if (['paused', 'verification_pending'].includes(run.state) && ['SessionEnd', 'StopFailure'].includes(event)) {
+      // A provider lifecycle event cannot override an explicit pause or a
+      // completion candidate awaiting independent acceptance checks.
+    }
     else if (event === 'PermissionRequest' || event === 'Notification' && ['permission_prompt', 'elicitation_dialog'].includes(input.notification_type)) {
       run.state = 'blocked'; run.blocker = 'authorization'; run.reason = 'Resolve the provider approval or input request, then explicitly resume Delivery Loop.';
     } else if (event === 'SessionEnd') {
-      run.state = 'recovery_required'; run.reason = 'Provider session ended. Check why it ended before resuming; no automatic restart.';
+      run.state = 'recovery_required'; run.recoveryCause = 'session_end'; run.reason = 'Provider session ended. Check why it ended before resuming.';
     } else if (event === 'StopFailure') {
       run.failures += 1;
-      run.state = run.failures >= run.maxFailures ? 'failed' : 'recovery_required';
+      run.state = run.failures >= run.maxFailures ? 'failed' : 'recovery_required'; run.recoveryCause = 'provider_error';
       run.reason = RETRYABLE.has(input.error) ? 'Transient provider error. Resume the existing conversation after the provider recovers.' : 'Provider error requires attention before resuming.';
       run.errorCode = text(input.error, 100); run.retryable = RETRYABLE.has(input.error);
     } else if (event === 'Stop') {
@@ -148,25 +638,147 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       // stable event ID; never dedupe on text (identical text can be a new turn).
       const key = input.turn_id ? `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}` : null;
       if (key && run.lastStopKey === key) return record;
+      if (run.managed && run.checkpoint?.status === 'completed') {
+        await verifyAutomaticCriteria(record, now);
+        const pending = run.managed.acceptanceCriteria.filter(item => !Object.hasOwn(run.managed.verified, item.id));
+        if (pending.length) {
+          run.state = 'verification_pending'; run.reason = `Acceptance verification pending: ${pending.map(item => item.id).join(', ')}`;
+          run.lastStopKey = key; notifyState(run, now); return record;
+        }
+      }
       const decision = decideStop(run, now); record.run = decision.run; output = decision.output;
       record.run.lastStopKey = key;
     }
     record.run.updatedAt = now;
+    notifyState(record.run, now);
     return record;
   });
   return output;
 }
-export async function controlDelivery({ root = rootDirectory(), provider, session, action, now = Date.now() }) {
+export function canReplanDelivery(run, provider, now = Date.now()) {
+  const managed = run?.managed;
+  const supported = managed?.resumeChannel === 'codex_app_server' && provider === 'codex' ||
+    managed?.capability === 'live_hook' && provider === 'claude' && Boolean(managed.liveHookOwner?.identity);
+  return Boolean(supported && managed.autonomyPolicy && managed.approvalScopes?.length && !managed.rejectedActionOverflow &&
+    run.state === 'blocked' && managed.pendingApproval?.denied === true &&
+    now < run.deadline && run.continuations < run.maxContinuations && run.failures < run.maxFailures);
+}
+export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, questionId, answer, action, now = Date.now() }) {
   return updateRecord(root, provider, session, record => {
     const run = record?.run;
     if (!run) throw new Error('Delivery Loop not found.');
-    if (action === 'stop') { run.state = 'stopped'; run.reason = 'Stopped by user.'; }
+    if (run.managed && taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
+    if (action === 'session_answer') {
+      const question = run.managed?.understandingQuestion;
+      if (run.managed?.phase !== 'needs_clarification' || run.state !== 'blocked' || !question || question.id !== questionId ||
+          !text(answer, 1000) || typeof answer !== 'string' || answer.length > 1000) throw new Error('Session question changed or answer is empty; refresh its status.');
+      if (now >= run.deadline || run.continuations >= run.maxContinuations || run.failures >= run.maxFailures) throw new Error('Original budget exhausted. Session cannot continue.');
+      const read = { kind: 'read', scope: 'task', summary: 'Re-examine the original conversation using the new user answer without changing files' };
+      const plan = assessedPlan({ diagnosis: `Resolve the recorded question before any work: ${question.text}`,
+        alternatives: [{ id: 'understand_answer', action: read,
+          assessment: { risk: 'low', reversibility: 'reversible', externalEffect: 'none', blastRadius: 'single_file', uncertainty: 'low', inObjective: true, userChoice: false },
+          expectedVerification: 'Return a revised grounded session understanding or one focused remaining question.', rollback: 'No changes to undo.' }],
+        selectedOptionId: 'understand_answer', recommendation: { optionId: 'understand_answer', reason: 'Incorporate the user answer before choosing work.' } });
+      const decision = recordDecision(run.managed, plan, now);
+      if (decision.outcome !== 'proceed') throw new Error('Read-only understanding cannot be dispatched under current policy.');
+      run.managed.understandingAnswer = { questionId, text: contextText(answer, 1000) };
+      run.managed.understandingQuestion = null;
+      run.managed.phase = 'understanding';
+      run.blocker = null; run.checkpoint = null; run.consumedRevision = run.revision;
+      run.nextStep = 'Use the user answer to re-understand the original request; do not execute a work action.';
+      if (run.managed.resumeChannel === 'codex_app_server') {
+        run.managed.autoRecovery = true; run.state = 'recovery_required'; run.recoveryCause = 'session_supervision';
+        run.reason = 'User answer recorded; read-only understanding is queued in the exact Codex conversation.';
+      } else {
+        run.managed.awaitingUnderstandingHook = true; run.state = 'active';
+        run.reason = 'User answer recorded; understanding awaits the original Claude Stop boundary.';
+      }
+    }
+    else if (action === 'set_policy') {
+      if (!run.managed?.autonomyPolicy || !run.managed.plan || TERMINAL.has(run.state) || !AUTONOMY_POLICIES.has(autonomyPolicy)) throw new Error('Only a nonterminal assessed managed task can change autonomy policy.');
+      run.managed.autonomyPolicy = autonomyPolicy;
+      const decision = recordDecision(run.managed, run.managed.plan, now);
+      if (decision.outcome === 'wait') { run.state = 'blocked'; run.reason = decision.reason; escalate(run, decision.reason); }
+      else { run.state = 'recovery_required'; run.recoveryCause = 'policy_change'; run.reason = 'Policy changed; resume the original conversation for the selected action.'; run.managed.autoRecovery = false; }
+    }
+    else if (action === 'stop') {
+      if (TERMINAL.has(run.state)) return record;
+      run.state = 'stopped'; run.reason = 'Stopped by user.';
+    }
+    else if (action === 'pause') {
+      const queuedAppServer = run.state === 'recovery_required' && ['session_supervision', 'approved_action'].includes(run.recoveryCause) &&
+        run.managed?.resumeChannel === 'codex_app_server' && run.managed.autoRecovery;
+      if (!run.managed || !['active', 'auto_resuming'].includes(run.state) && !queuedAppServer) throw new Error('Only a running or queued managed task can pause.');
+      if (queuedAppServer || run.state === 'auto_resuming' && run.managed.resumeChannel === 'codex_app_server') run.managed.pausedRecoveryCause = run.recoveryCause || 'session_supervision';
+      run.state = 'paused'; run.reason = 'Paused by user.';
+    }
+    else if (action === 'replan') {
+      if (!canReplanDelivery(run, provider, now)) throw new Error('Replanning needs a rejected assessed approval, a supported original-session channel, and remaining budget.');
+      const rejected = run.managed.pendingApproval;
+      // Also cover denied records written by earlier versions before rejection
+      // fingerprints existed; never re-authorize that exact action on upgrade.
+      rememberRejectedAction(run.managed, rejected);
+      const plan = rejectedActionDiagnosis(run.managed, rejected);
+      const decision = recordDecision(run.managed, plan, now);
+      if (decision.outcome !== 'proceed' || decision.action.kind !== 'read') throw new Error('Safe read diagnosis is unavailable; keep the rejected action blocked.');
+      delete run.managed.approvedAction;
+      run.managed.userQuestion = null;
+      run.managed.escalation = null;
+      run.blocker = null;
+      run.nextStep = 'Review the recorded rejection and propose a different assessed option without executing it.';
+      run.checkpoint = null; run.consumedRevision = run.revision;
+      if (run.managed.resumeChannel === 'codex_app_server') {
+        run.managed.autoRecovery = true;
+        run.state = 'recovery_required'; run.recoveryCause = 'session_supervision';
+        run.reason = 'Rejected action remains denied; safe read diagnosis is queued in the exact Codex session.';
+      } else {
+        run.managed.awaitingReplanHook = true;
+        run.state = 'active';
+        run.reason = 'Rejected action remains denied; safe read diagnosis awaits the original Claude Stop boundary.';
+      }
+    }
     else if (action === 'resume') {
-      if (!['blocked', 'recovery_required'].includes(run.state)) throw new Error('Only a blocked or recoverable loop can resume.');
+      if (run.managed?.phase === 'needs_clarification') throw new Error('Answer the current session question before resuming.');
+      if (!['blocked', 'recovery_required', 'paused'].includes(run.state)) throw new Error('Only a blocked, paused, or recoverable loop can resume.');
+      if (run.managed?.pendingApproval) throw new Error('Resolve the exact pending approval before resuming.');
+      if (run.managed?.autonomyPolicy && run.managed.decision?.outcome === 'wait' && (run.managed.approvedAction?.id !== run.managed.decision.id || run.managed.approvedAction.dispatchedAt)) throw new Error('Selected action requires a fresh scoped user decision.');
       if (now >= run.deadline || run.continuations >= run.maxContinuations || run.failures >= run.maxFailures) throw new Error('Original budget exhausted. Loop cannot resume.');
-      run.state = 'active'; run.reason = 'Explicit user resume'; run.checkpoint = null; run.consumedRevision = run.revision;
+      if (run.managed?.approvedAction && run.recoveryCause === 'approved_action' && !run.managed.approvedAction.dispatchedAt && run.managed.capability !== 'live_hook' && run.managed.resumeChannel !== 'codex_app_server') {
+        run.managed.approvedAction.dispatchedAt = now;
+        run.managed.dispatches ||= [];
+        run.managed.dispatches.push({ approvalId: run.managed.approvedAction.id, at: now, channel: 'manual_original_conversation' });
+        run.managed.dispatches = run.managed.dispatches.slice(-20);
+      }
+      const selectedKind = run.managed?.decision?.action?.kind;
+      const approvedWait = run.managed?.decision?.outcome === 'wait' && run.managed.approvedAction?.id === run.managed.decision.id && !run.managed.approvedAction.dispatchedAt;
+      const queuedAppServer = run.managed?.resumeChannel === 'codex_app_server' &&
+        ['read', 'local_edit', 'local_test'].includes(selectedKind) &&
+        (run.managed.decision.outcome !== 'wait' || approvedWait);
+      if (queuedAppServer) run.managed.autoRecovery = true;
+      run.state = queuedAppServer ? 'recovery_required' : 'active';
+      if (queuedAppServer) run.recoveryCause = approvedWait ? 'approved_action' : 'session_supervision';
+      delete run.managed?.pausedRecoveryCause;
+      run.reason = queuedAppServer ? 'Exact-session supervision resumed; writer acquisition is queued.' : 'Explicit user resume';
+      run.checkpoint = null; run.consumedRevision = run.revision;
+    } else if (action === 'approve' || action === 'reject') {
+      const pending = run.managed?.pendingApproval;
+      if (!pending || pending.id !== approvalId || pending.denied || run.state !== 'blocked') throw new Error('Pending approval changed; refresh its status.');
+      run.managed.notification = { key: `approval:${pending.id}`, kind: 'approval', message: `${action === 'approve' ? 'Approved' : 'Rejected'} ${pending.scope}.`, at: now };
+      if (action === 'approve') {
+        if (now >= run.deadline || run.continuations >= run.maxContinuations) throw new Error('Original budget exhausted. Task cannot resume.');
+        run.managed.pendingApproval = null;
+        run.nextStep = run.checkpoint?.nextStep || run.nextStep;
+        run.state = 'recovery_required'; run.recoveryCause = 'approved_action';
+        run.reason = `User approved ${pending.scope}. Resume the original conversation to continue this exact action.`;
+        run.checkpoint = { status: 'in_progress', summary: run.reason, nextStep: run.nextStep, evidence: [], acceptanceMet: false };
+        run.revision += 1;
+        run.managed.approvedAction = { id: pending.id, nextStep: run.nextStep, action: { kind: pending.kind, scope: pending.scope, summary: pending.summary } };
+      } else {
+        pending.denied = true; run.reason = `User rejected ${pending.scope}.`; run.blocker = 'authorization';
+        rememberRejectedAction(run.managed, pending);
+      }
     } else throw new Error('Unsupported control.');
-    run.updatedAt = now; return record;
+    run.updatedAt = now; notifyState(run, now); return record;
   });
 }
 export async function reconcileRecords({ root = rootDirectory(), now = Date.now(), inspectProcess = processIdentity } = {}) {
@@ -174,13 +786,20 @@ export async function reconcileRecords({ root = rootDirectory(), now = Date.now(
   for (const record of records) {
     if (!record.run || TERMINAL.has(record.run.state)) continue;
     const observed = record.process ? await inspectProcess(record.process.pid) : null;
-    await updateRecord(root, record.provider, record.session, current => {
+    await updateRecord(root, record.provider, record.session, async current => {
       if (!current?.run || TERMINAL.has(current.run.state)) return current;
       const run = current.run;
-      if (now >= run.deadline) { run.state = 'budget_exhausted'; run.reason = 'Delivery time budget exhausted.'; run.updatedAt = now; }
+      if (run.state === 'verification_pending' && run.managed) {
+        await verifyAutomaticCriteria(current, now);
+        if (run.managed.acceptanceCriteria.every(item => Object.hasOwn(run.managed.verified, item.id))) {
+          run.state = 'completed'; run.reason = run.checkpoint.summary; run.updatedAt = now;
+        }
+      }
+      if (now >= run.deadline && !TERMINAL.has(run.state) && run.state !== 'verification_pending') { run.state = 'budget_exhausted'; run.reason = 'Delivery time budget exhausted.'; run.updatedAt = now; }
       else if (run.state === 'active' && observed !== null && observed !== current.process?.identity && current.process?.identity === record.process?.identity) {
-        run.state = 'recovery_required'; run.reason = 'Observed provider process exited. Reopen the existing conversation and explicitly resume.'; run.updatedAt = now;
+        run.state = 'recovery_required'; run.recoveryCause = 'process_exit'; run.reason = run.managed?.autoRecovery ? 'Observed provider process exited. Managed recovery is eligible for a bounded exact-session attempt.' : 'Observed provider process exited. Reopen the existing conversation and explicitly resume.'; run.updatedAt = now;
       }
+      notifyState(run, now);
       return current;
     }).catch(() => {});
   }