@awak-app/simy-cli 0.6.12 → 0.6.16

package/README.md

@@ -2,6 +2,15 @@
 
 Local execution agent for SIMY Local Tasks and Agentic Loop runs.
 
+Action candidate search runs once for each authenticated live conversation context,
+and again when that context changes or **Refresh** is selected. Background binding
+renewal uses the lightweight binding endpoint instead of repeating candidate search.
+Settled ordinary conversations and terminal managed tasks do not automatically
+search candidates. Bound Actions still renew to reflect changes to deadlines and
+manual links. Candidate text expires after one minute; select **Refresh** to retrieve
+current suggestions after editing Actions in SIMY. Candidate search identities are
+cached in memory, so restarting the host may retrieve live contexts again.
+
 `simy --version` prints the installed CLI version without starting an agent or
 checking for updates. `simy doctor` performs read-only local connection and
 provider login checks and prints a JSON diagnostic report: installed/running
@@ -817,6 +826,32 @@ model responses or credentials. Historical summaries are not a replacement for
 signed proof files or delivery acceptance. Records from versions that kept
 analysis only in memory cannot be recovered after that process exits.
 
+The CLI Agentic Loop uses [proportionate retry and review decisions](docs/stop-prevention/proportionate-continuation.md): reasoning notes are advisory, and an independent reviewer may explicitly defer or dismiss minor/warning/info findings with a nonempty explanation while retaining them in the receipt. Required acceptance evidence and major safety findings remain protected.
+
+### Local coding attempt result collection
+
+For `executeProcessAttempt`, native provider JSONL is read only from a successfully finished turn's final
+assistant/result channel. Tool output and intermediate messages are never a
+fallback result. Legacy line-anchored markers still work and may contain formatted
+JSON; missing, ambiguous, truncated, invalid, oversized and failed-turn results
+have distinct `result_parse.code` values. Invalid collection cannot become a
+successful empty result. Plain-text markers are supported only for explicit
+shell command overrides. This does not independently verify executor claims.
+The parser can re-read a saved raw result without rerunning the provider.
+Local Task and direct-task result parsers are separate boundaries and are not
+covered by this coding-attempt guarantee.
+
+### Explicit desktop provider selection
+
+Local coding requests may specify `model` / `reasoning_effort` and independently
+`audit_model` / `audit_reasoning_effort`. Both selections survive recovery.
+Codex receives the exact model and reasoning config; the CLI does not use a
+catalog to reject unknown model names or silently replace a rejected model.
+Claude receives the exact model; explicit reasoning is unsupported by this
+adapter and fails before dispatch. A custom shell override cannot enforce an
+explicit selection and is rejected instead of dropping it. Provider acceptance,
+authentication and actual availability still require the provider's response.
+This changes command construction only; it does not start any workflow.
 
 ### Reusing a running service and launch recovery
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.12",
+  "version": "0.6.16",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,3 +1,4 @@
+import { normalizeProviderModelSelection } from "./provider-model-selection.js";
 import { assertConnectionScope, connectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
 import { authorizeLaunch } from "./launch-authorization.js";
 import { normalizePurposeVerification, assertPurposeActor, preparePurposeVerification, verifyPurposeLocalTask, purposeSigningKeyPath, purposeVerificationCapability, purposeWorkspaceBusy } from "./purpose-local-proof.js";
@@ -1998,6 +1999,13 @@ export async function startAgent({
           return;
         }
         const { body, attachments } = await readCodingLoopStart(req);
+        let providerSelection;
+        try {
+          providerSelection = normalizeProviderModelSelection(body);
+        } catch (error) {
+          json(res, 400, { error: error.message, code: "invalid_provider_selection" });
+          return;
+        }
         const guardrailSource = String(body.source_message || "").trim();
         if (guardrailSource) {
           const guardrail = classifyExecutionRequirement(guardrailSource);
@@ -2101,6 +2109,7 @@ export async function startAgent({
         const run = createRun({
           runId,
           request: {
+            ...providerSelection,
             backend: body.backend === "claude" ? "claude" : "codex",
             execution_target: executionTarget,
             execution_device_id: session?.device_id || null,
@@ -2752,6 +2761,7 @@ export async function startAgent({
       scanRepositories,
       selectRepository,
       create: (input) => withUpdateWork(updateManager, async () => {
+        const providerSelection = normalizeProviderModelSelection(input);
         const scope = await authorizeDesktopWork();
         if (!isSessionValid(session, Date.now(), apiOrigin)) {
           throw new Error("Sign in to SIMY before starting a coding task.");
@@ -2767,6 +2777,8 @@ export async function startAgent({
         }
         const indexedRepository = await ensureRepositoryIndexed(repository);
         const request = {
+          ...providerSelection,
+          audit_backend: input.audit_backend === "claude" || input.audit_backend === "codex" ? input.audit_backend : null,
           requirement,
           repository,
           local_path: indexedRepository?.local_path || input.localPath || workspace.localPath,

package/src/auto-update.js

@@ -69,6 +69,9 @@ export class CliAutoUpdater extends EventEmitter {
   #stopped = false;
   #registryListener = null;
   #activeWork = 0;
+  #confirmedUpdate = null;
+  #confirmedReady = false;
+  #desktopIdle = () => true;
 
   constructor(options) {
     super();
@@ -95,7 +98,39 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   snapshot() {
-    return structuredClone(this.#snapshot);
+    return structuredClone({ ...this.#snapshot, requires_task_stop: !this.#isIdle() });
+  }
+
+  // Close admission before cancellation begins. The same transaction owns the
+  // idle check and installation, so a releasing worker cannot race the stop.
+  applyConfirmed(stopWork) {
+    if (this.#confirmedUpdate) return this.#confirmedUpdate;
+    if (this.#applying) return this.#applying;
+    if (!this.#snapshot.target_version || !this.#options.lastRelease) {
+      return Promise.reject(new Error('Check for an available update first.'));
+    }
+    this.#setState('stopping_tasks', { message: 'Stopping unfinished tasks before updating…', error: null });
+    this.#confirmedUpdate = (async () => {
+      try {
+        await Promise.resolve().then(stopWork);
+        await this.#checking;
+        if (!this.#snapshot.target_version) throw new Error('The update is no longer available.');
+        if (!this.#isIdle()) throw new Error('Task shutdown did not finish. Restart SIMY and retry the update.');
+        if (!this.#snapshot.automatic || classifyVersionChange(this.#options.currentVersion, this.#snapshot.target_version) === 'major') {
+          this.#setState('update_available', { message: 'Tasks stopped. Opening the update installer…' });
+          await this.performAction();
+          return this.snapshot();
+        }
+        this.#confirmedReady = true;
+        this.#setState('waiting_for_idle', { message: 'Tasks stopped. Installing the update…' });
+        return await this.maybeApply();
+      } catch (error) {
+        this.#setState('failed', { message: 'Update could not finish after stopping tasks. Restart SIMY and retry.',
+          error: errorMessage(error), action: updateAction(this.#snapshot.target_version, this.#options) });
+        return this.snapshot();
+      } finally { this.#confirmedUpdate = null; this.#confirmedReady = false; }
+    })();
+    return this.#confirmedUpdate;
   }
 
   async performAction() {
@@ -110,7 +145,7 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   acceptsNewWork() {
-    return !["updating", "restarting"].includes(this.#snapshot.state);
+    return !this.#confirmedUpdate && !["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state);
   }
 
   beginWork() {
@@ -127,10 +162,11 @@ export class CliAutoUpdater extends EventEmitter {
     };
   }
 
-  start({ registry, restartDaemon } = {}) {
+  start({ registry, restartDaemon, isDesktopIdle = () => true } = {}) {
     if (this.#snapshot.state === "disabled" || this.#checkTimer || this.#stopped) return this;
     this.#registry = registry;
     this.#restartDaemon = restartDaemon;
+    this.#desktopIdle = isDesktopIdle;
     this.#registryListener = () => {
       if (this.#snapshot.state === "waiting_for_idle") void this.maybeApply();
     };
@@ -156,7 +192,7 @@ export class CliAutoUpdater extends EventEmitter {
   async checkNow() {
     if (this.#stopped || this.#snapshot.state === "disabled") return this.snapshot();
     if (this.#checking) return this.#checking;
-    if (["updating", "restarting"].includes(this.#snapshot.state)) return this.snapshot();
+    if (["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state) || this.#confirmedUpdate) return this.snapshot();
 
     this.#checking = this.#performCheck().finally(() => {
       this.#checking = null;
@@ -237,6 +273,7 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   async maybeApply() {
+    if (this.#confirmedUpdate && !this.#confirmedReady) return this.snapshot();
     if (this.#stopped || this.#snapshot.state !== "waiting_for_idle") {
       return this.snapshot();
     }
@@ -333,7 +370,7 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   #isIdle() {
-    return this.#activeWork === 0 && isRegistryIdle(this.#registry);
+    return this.#activeWork === 0 && isRegistryIdle(this.#registry) && this.#desktopIdle();
   }
 
   #clearIdleTimer() {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.12";
+export const CLI_VERSION = "0.6.16";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/desktop-access.js

@@ -52,7 +52,9 @@ export function createDesktopAccessPolicy({ readSession, isValid, fetchAccess, i
         result = { state: payload.state,
           organizationId: payload.organizationId, organizationName: payload.organizationName.slice(0, 120), organizationSlug: payload.organizationSlug, settingsPath: payload.settingsPath, membersPath: payload.membersPath };
       } catch (error) {
-        result = { ...base, state: error?.status === 401 ? 'signed_out' : 'unavailable' };
+        result = { ...base, state: error?.status === 401 ? 'signed_out' : 'unavailable',
+          reason: error?.status === 401 ? 'authentication_required' :
+            ['TimeoutError', 'AbortError'].includes(error?.name) ? 'timeout' : 'service_unavailable' };
       }
       // Late responses never authorize a new account or a switched organization.
       if (readSession() === session && basic().state === 'checking') {

package/src/desktop-executor.js

@@ -1,4 +1,5 @@
 import spawn from "cross-spawn";
+import { normalizeProviderModelSelection } from "./provider-model-selection.js";
 
 import {
   BACKEND_VERSION_POLICIES,
@@ -48,6 +49,7 @@ export function desktopExecutorCapability(inspection) {
 export async function resolveDesktopExecutorCommand({
   backend,
   model = null,
+  reasoningEffort = null,
   instruction,
   repositoryPath,
   executionKind = "agentic_loop",
@@ -62,17 +64,26 @@ export async function resolveDesktopExecutorCommand({
     throw new Error("Desktop execution kind must be agentic_loop or direct.");
   }
   const normalizedPermissionMode = normalizePermissionMode(permissionMode);
-  const normalizedModel =
-    model === null || model === undefined
-      ? null
-      : String(model).trim();
-  if (normalizedModel !== null && !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,159}$/.test(normalizedModel)) {
-    throw new Error("Desktop executor model is invalid.");
+  const { model: normalizedModel, reasoning_effort: effort } =
+    normalizeProviderModelSelection({ model, reasoning_effort: reasoningEffort });
+  if (provider !== "codex" && effort !== null) {
+    const error = new Error("Explicit reasoning effort is not supported by this Claude command adapter.");
+    error.code = "desktop_executor_selection_unsupported";
+    throw error;
   }
+  const selectionArgs = [
+    ...(normalizedModel ? ["--model", normalizedModel] : []),
+    ...(effort ? ["--config", `model_reasoning_effort=${JSON.stringify(effort)}`] : []),
+  ];
   const target = normalizeDesktopExecutionTarget(DESKTOP_EXECUTION_TARGET);
   const override =
     provider === "claude" ? environment.SIMY_CLAUDE_COMMAND : environment.SIMY_CODEX_COMMAND;
   if (override) {
+    if (normalizedModel || effort) {
+      const error = new Error("Explicit provider selection cannot be enforced by a shell command override.");
+      error.code = "desktop_executor_selection_unsupported";
+      throw error;
+    }
     return {
       ...shellCommand(override, repositoryPath, instruction, spawnImpl),
       backend: provider,
@@ -100,7 +111,7 @@ export async function resolveDesktopExecutorCommand({
               normalizedPermissionMode,
               normalizedModel,
             )
-          : claudeBackendArgs(instruction)
+          : claudeBackendArgs(instruction, normalizedModel)
         : directExecution
           ? [
               "exec",
@@ -108,22 +119,24 @@ export async function resolveDesktopExecutorCommand({
               "--skip-git-repo-check",
               "--sandbox",
               normalizedPermissionMode === "read_only" ? "read-only" : "workspace-write",
-              ...(normalizedModel ? ["--model", normalizedModel] : []),
+              ...selectionArgs,
               instruction,
             ]
-          : ["exec", "--json", instruction],
+          : ["exec", "--json", ...selectionArgs, instruction],
     env: {},
     spawn: spawnImpl,
     backend: provider,
     execution_target: target,
     execution_kind: executionKind,
     permission_mode: normalizedPermissionMode,
+    requested_model: normalizedModel,
+    requested_reasoning_effort: effort,
     verification: "compatible_version",
     installed_version: inspection.installed_version,
   };
 }
 
-export function claudeBackendArgs(instruction) {
+export function claudeBackendArgs(instruction, model = null) {
   return [
     "-p",
     instruction,
@@ -134,6 +147,7 @@ export function claudeBackendArgs(instruction) {
     // by the user. Print mode cannot display permission prompts, so edits would
     // otherwise be silently unavailable to the desktop executor.
     "--dangerously-skip-permissions",
+    ...(model ? ["--model", model] : []),
   ];
 }
 

package/src/desktop-host.js

@@ -4,10 +4,11 @@ import { inspectProviderPlugins, unavailablePluginStatus } from './sqm/provider-
 import { openCodexAppServer } from './session-supervision/codex-app-server.js';
 import { conversationSqmChecks } from './session-supervision/sqm-presentation.js';
 import { stopOwnedDesktopHost } from "./desktop-force-quit.js";
+import { stopDesktopWorkForUpdate } from './desktop-update-stop.js';
 import { desktopAccessReady, desktopActionAllowed, requireDesktopAccess, validDesktopAccessPath } from './desktop-access.js';
 import { createActionDeadlineService } from './session-supervision/action-deadline.js';
 import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
-import { controlDelivery, verifyDelivery, createRecordReader } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
+import { controlDelivery, verifyDelivery, createRecordReader, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { createStopNotifier } from "./session-supervision/stop-notifications.js";
@@ -63,6 +64,7 @@ function desktopActionError(action, error) {
   if (["sqm_set_enabled", "sqm_set_engine_fallback", "sqm_retry_environment"].includes(action)) {
     return "Could not save SQM settings. Check your SIMY connection and try again.";
   }
+  if (action === 'update') return 'Update could not finish. Restart SIMY and retry; stopped tasks stay stopped.';
   return "Action could not finish. Refresh the status and try again.";
 }
 
@@ -115,14 +117,15 @@ export async function startDesktopHost({ input = process.stdin, output = process
   };
   const accessSnapshot = async () => setAccessSnapshot((await agent?.getDesktopStatus?.())?.access);
   let stoppingForUpdate = false;
+  let unfinishedDesktopWork = true;
   let organizationAnalysesSuspended = false;
   let organizationAnalysisDrain = Promise.resolve();
   let organizationAnalysisEpoch = 0;
   const authorizeWork = async expectedScope => {
-    if (closed || stoppingForUpdate || organizationAnalysesSuspended) throw new Error("SIMY is stopping. Reopen SIMY before starting new work.");
+    if (closed || stoppingForUpdate || updater?.acceptsNewWork?.() === false || organizationAnalysesSuspended) throw new Error("SIMY is stopping. Reopen SIMY before starting new work.");
     if (agent?.requireDesktopAccess) await agent.requireDesktopAccess();
     const access = await accessSnapshot();
-    if (closed || stoppingForUpdate || organizationAnalysesSuspended) throw new Error("SIMY is stopping. Reopen SIMY before starting new work.");
+    if (closed || stoppingForUpdate || updater?.acceptsNewWork?.() === false || organizationAnalysesSuspended) throw new Error("SIMY is stopping. Reopen SIMY before starting new work.");
     requireDesktopAccess(access);
     const scope = accessScope(access);
     if (expectedScope !== undefined && expectedScope !== scope) throw Object.assign(new Error("Desktop account or organization changed."), { code: "desktop_access_required" });
@@ -142,11 +145,37 @@ export async function startDesktopHost({ input = process.stdin, output = process
   let commands;
   let sessionStatus = { sessions: [], providers: { codex: { discovery: "loading", reason: null }, claude: { discovery: "loading", reason: null } }, refreshedAt: null, initialLoading: true };
   let sessionRefresh = null, sessionRefreshedAt = 0, sessionRefreshAgain = false, discoveryController = null, discoveryStopped = false;
+  const hasUnfinishedSessions = records => records.some(record => record.autoContinue === true || record.run && !TERMINAL.has(record.run.state)) ||
+    sessionStatus.sessions.some(candidate => candidate.autoContinue === true || ['queued', 'analyzing'].includes(analysisManager.project(candidate).analysis?.state));
   const stopDiscovery = async ({ drain = false } = {}) => {
     discoveryController?.abort();
     sessionRefreshAgain = false;
     if (drain && !dependencies.discoverSessions) await sessionRefresh;
   };
+  let confirmedUpdateStop;
+  const stopWorkForUpdate = () => confirmedUpdateStop ||= (async () => {
+    stoppingForUpdate = true; discoveryStopped = true;
+    void stopDiscovery();
+    await stopDesktopWorkForUpdate({
+      stopWork: () => Promise.all([
+        agent.stopDesktopTasks(), managedSupervisor.close(),
+        automaticContinuation?.close(), analysisManager?.close(),
+        (async () => {
+          const records = await recordReader.list();
+          await Promise.all(records.map(async record => {
+            if (record.autoContinue === true) await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({
+              root: deliveryRoot, provider: record.provider, session: record.session, enabled: false });
+            if (record.run && !TERMINAL.has(record.run.state)) await controlDelivery({ root: deliveryRoot,
+              provider: record.provider, session: record.session, taskId: record.run.managed?.taskId, action: 'stop' });
+          }));
+        })(),
+      ]),
+      killOwned: () => (dependencies.stopOwnedHost || stopOwnedDesktopHost)(process.pid,
+        { parentPid: process.ppid, includeRoot: false }),
+      timeoutMs: dependencies.updateStopTimeoutMs ?? 12_000,
+    });
+    unfinishedDesktopWork = false;
+  })();
   const refreshSessions = (force = false) => {
     if (discoveryStopped && !closed && !relay) return sessionStatus;
     if (closed || relay || !desktopAccessReady(currentAccess)) return { sessions: [], providers: {}, refreshedAt: null };
@@ -277,6 +306,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
       const requestedScope = accessScope(currentAccess);
       status.pluginSetup = { ...pluginSetup };
       status.providerPlugins = structuredClone(providerPlugins);
+      const records = await recordReader.list();
+      const update = status.update || updater.snapshot?.() || {};
+      if (!stoppingForUpdate) unfinishedDesktopWork = hasUnfinishedSessions(records);
+      status.update = { ...update, requires_task_stop: update.requires_task_stop === true ||
+        (status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 || hasUnfinishedSessions(records) };
       if (!desktopAccessReady(currentAccess)) {
         for (const item of sessionStatus.sessions) automaticContinuation?.revoke(item.provider, item.session);
         if (currentAccess.state !== 'checking') await analysisManager.update([]);
@@ -289,7 +323,6 @@ export async function startDesktopHost({ input = process.stdin, output = process
         return;
       }
       await analysisManager.updateProviderStatuses?.(status.providers);
-      const records = await recordReader.list();
       stopNotifier.observe(records);
       const projection = await actionAssociations.beginProjection?.({ records });
       status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: projection?.records || records }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
@@ -378,7 +411,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
     });
     stopWorkflows = (dependencies.startWorkflowUpdates || startWorkflowUpdates)({ enabled: env.SIMY_AUTO_UPDATE !== "0" });
     updater.on?.("change", () => { void publish().catch(() => {}); });
-    updater.start({ registry: agent.registry, restartDaemon: async (targetVersion, installation) => {
+    updater.start({ registry: agent.registry, isDesktopIdle: () => !unfinishedDesktopWork,
+      restartDaemon: async (targetVersion, installation) => {
       if (!installation?.entryPath || !installation?.executablePath) throw new Error("Signed update runtime is unavailable.");
       discoveryStopped = true;
       await stopDiscovery({ drain: true });
@@ -499,6 +533,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
       try {
         const action = command.action;
         if (action === "quit") {
+          if (command.forUpdate === true) {
+            if (command.force !== true) throw new Error('Confirm before stopping unfinished tasks.');
+            await stopWorkForUpdate();
+          }
           if (command.force !== true) {
             const status = await agent.getDesktopStatus();
             if ((status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0) throw new Error("Tasks are still running. Confirm before quitting.");
@@ -595,16 +633,15 @@ export async function startDesktopHost({ input = process.stdin, output = process
           }
         } else if (action === "check_update") await updater.checkNow();
         else if (action === "update") {
-          if (command.force === true) {
-            stoppingForUpdate = true; discoveryStopped = true;
-            void stopDiscovery();
-            // Abort dispatch immediately; existing Delivery Loop records retain
-            // their cancelled checkpoint so another host cannot silently resume.
-            await Promise.all([agent.stopDesktopTasks(), managedSupervisor.close(),
-              automaticContinuation?.close(), analysisManager?.close()]);
+          if (command.force === true && updater.applyConfirmed) await updater.applyConfirmed(stopWorkForUpdate);
+          else if (command.force === true) { await stopWorkForUpdate(); await updater.performAction(); }
+          else {
+            const status = await agent.getDesktopStatus();
+            if ((status.tasks?.activeCount || 0) + (status.sqmTasks?.activeCount || 0) > 0 ||
+              updater.snapshot().requires_task_stop === true || hasUnfinishedSessions(await recordReader.list())) throw new Error('Confirm before stopping unfinished tasks.');
+            if (updater.snapshot().state === "waiting_for_idle") await updater.maybeApply();
+            else await updater.performAction();
           }
-          if (updater.snapshot().state === "waiting_for_idle") await updater.maybeApply();
-          else await updater.performAction();
           if (command.force === true && ["failed", "error"].includes(updater.snapshot().state)) throw new Error("Update failed after stopping tasks.");
         } else if (action === "codex_login" || action === "claude_login") {
           const provider = action === "claude_login" ? "claude" : "codex";
@@ -710,7 +747,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         emit({ type: "result", id: command.id, ok: false, message: command.action === "update" && stoppingForUpdate ? "Could not finish the update after stopping tasks. Reopen SIMY and retry the update." : desktopActionError(command.action, error) });
       }
     };
-    if (command.action === "quit") {
+    if (command.action === "quit" || command.action === "update" && command.force === true) {
       void execute();
     } else if (["login", "organization_select", "organization_cancel", "authorization_open"].includes(command.action)) {
       authorizationQueue = authorizationQueue.then(execute).catch(() => {});

package/src/desktop-update-stop.js

@@ -0,0 +1,22 @@
+// Confirmed updates must not wait indefinitely on a provider or remote flush.
+// SIGKILL is ownership checked by the caller; the desktop host itself survives
+// long enough to settle its local checkpoints and perform the signed handoff.
+export async function stopDesktopWorkForUpdate({ stopWork, killOwned, timeoutMs = 12_000 }) {
+  let timer;
+  const stopping = Promise.resolve().then(stopWork);
+  // A kill failure or deadline can win the race before checkpoint cancellation
+  // settles. Observe its eventual rejection as well.
+  void stopping.catch(() => {});
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new Error('Task shutdown timed out. Restart SIMY and retry the update.')), timeoutMs);
+  });
+  try {
+    await Promise.race([(async () => {
+      // Start cancellation before taking the process snapshot so queued work is
+      // fenced and live workers observe their stop intent before termination.
+      await Promise.resolve();
+      await killOwned();
+      await stopping;
+    })(), deadline]);
+  } finally { clearTimeout(timer); }
+}

package/src/orchestrator/audit.js

@@ -134,7 +134,7 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null, s
 
   const retryProblemSolving = evaluateRetryProblemSolving(attempt, previousAttempt);
   for (const check of retryProblemSolving.checks) {
-    addCheck(check.id, check.label, check.passed, check.detail);
+    addCheck(check.id, check.label, check.passed, check.detail, check.severity);
   }
   attempt.retry_problem_solving = retryProblemSolving;
 
@@ -220,7 +220,7 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null, s
   }
 
   const findings = checks
-    .filter((check) => !check.passed)
+    .filter((check) => !check.passed && check.severity !== "advisory")
     .map((check) => ({
       code: check.id.toUpperCase(),
       title: check.label,

package/src/orchestrator/contract.js

@@ -1,3 +1,4 @@
+import { normalizeProviderModelSelection } from "../provider-model-selection.js";
 import { randomUUID } from "node:crypto";
 
 import {
@@ -103,6 +104,7 @@ export function createCodingLoopSnapshot({ runId, request, metadata = {} }) {
     charter: {
       id: `${runId}_charter`,
       requirement: cleanString(request.requirement),
+      ...normalizeProviderModelSelection(request),
       repository: cleanString(request.repository),
       backend: request.backend === "claude" ? "claude" : "codex",
       execution_target: executionTarget,

package/src/orchestrator/independent-audit.js

@@ -112,7 +112,7 @@ export function buildIndependentAuditInstruction(charter, attempt) {
         "criterion_results must contain one entry per stable criterion ID with criterion_id, passed, verification_method, evidence_refs, and observed_result.",
         "visual_review must contain inspected, artifacts, and acceptance_observations.",
         "Only passed=false entries are findings. Omit passing checks, and never report passed=true evidence as a finding.",
-        "Use passed=false when a blocker or major finding remains, or when evidence is unavailable.",
+        "Use passed=false when a blocker or major finding remains, or when required evidence is unavailable. For minor/warning/info findings, choose disposition=fix, defer, or dismiss based on impact and reversibility. Include the reason in explanation. Deferring or dismissing a non-major finding does not require human input and must not hide it. Major/blocker findings cannot be deferred by this field.",
       ].join("\n"),
     ),
   ].join("\n\n");
@@ -165,6 +165,8 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
       target: cleanString(item.target) || "pull_request",
       explanation: cleanString(item.explanation) || "Independent audit finding.",
       repairability: item.repairability === "manual" ? "manual" : "auto",
+      disposition: ["defer", "dismiss"].includes(item.disposition) && cleanString(item.explanation)
+        ? item.disposition : "fix",
       blocker_kind: ["machine", "human", "external"].includes(item.blocker_kind)
         ? item.blocker_kind : item.repairability === "manual" ? "human" : "machine",
       auto_fix_hint: cleanString(item.auto_fix_hint) || null,
@@ -249,10 +251,16 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
     findings.push({ passed: false, code: "USER_OUTCOME_UNPROVEN", severity: "blocker",
       target: "user_outcome", explanation: "The original user goal lacks independently observed operation and postcondition evidence.", repairability: "auto" });
   }
-  const requiresHuman = findings.some((item) => item.repairability === "manual");
+  // Only the independent reviewer can defer/dismiss a non-major finding.
+  // Unknown severities, generated evidence failures and major findings remain blocking.
+  const followUps = findings.filter(item => ["minor", "warning", "info"].includes(item.severity) &&
+    ["defer", "dismiss"].includes(item.disposition));
+  const blockingFindings = findings.filter(item => !followUps.includes(item));
+  const requiresHuman = blockingFindings.some((item) => item.repairability === "manual");
   return {
     ...objectiveBinding,
-    passed: result.passed === true && findings.length === 0,
+    passed: blockingFindings.length === 0 && (result.passed === true || followUps.length > 0),
+    follow_ups: followUps,
     summary: cleanString(result.summary) || "Independent audit completed.",
     findings,
     criterion_results: criterionResults,

package/src/orchestrator/instruction.js

@@ -171,8 +171,8 @@ export function buildCodingInstruction(
       [
         "Treat implementation as hypothesis testing: state assumptions, list plausible causes or approaches, inspect discriminating evidence, then choose the smallest strategy supported by that evidence.",
         attemptNumber > 1
-          ? "This is a retry. Before editing, generate at least eight distinct MECE hypotheses, select a different primary hypothesis or approach, and do not repeat the previous strategy."
-          : "For the first attempt, identify the single highest uncertainty and run the smallest discriminating verification before editing.",
+          ? "This is a retry. Repair clear failures directly; compare plausible causes when needed. Reasoning notes are advisory, not a prerequisite to editing."
+          : "For the first attempt, investigate material uncertainty before a risky operation; use a reasonable assumption for low-impact reversible choices and verify as you proceed.",
         attemptNumber > 1
           ? "Explain exactly what changed from the previous attempt and why the new evidence supports this strategy."
           : "Record the uncertainty, first verification, concrete evidence checked, observed result, selected hypothesis, and strategy in the structured result.",
@@ -244,7 +244,7 @@ export function buildPromptInterventions(
       trigger: "repair_focus",
       title: "Repair focus",
       prompt:
-        "Diagnose the reported gate failures with at least eight distinct hypotheses, select a new strategy supported by evidence, and do not repeat the previous approach.",
+        "Repair clear failures directly and verify the change. Investigate competing causes only when uncertainty warrants it; do not invent eight hypotheses or change strategy merely to satisfy a form.",
       evidence_required: [
         "hypotheses",
         "selected_hypothesis_id",

package/src/orchestrator/loop.js

@@ -10,7 +10,7 @@ import {
 } from "./independent-audit.js";
 import { buildCodingInstruction, buildPromptInterventions } from "./instruction.js";
 import { canStartProvider, codingAttemptCeiling, refreshBudgetState } from "./budget.js";
-import { buildAttempt, mergeTokenUsage } from "./result.js";
+import { buildAttempt, mergeTokenUsage, normalizeResultParseDiagnostic } from "./result.js";
 import { evaluateRetryCircuit } from "./retry.js";
 import { assessOutcomeProgress, verifyObjective } from "./outcome-monitor.js";
 import { appendEvent, publish } from "./shared.js";
@@ -291,6 +291,7 @@ async function runCodingLoopOwned({
       return snapshot;
     }
 
+    attempt.independent_audit.result_parse = normalizeResultParseDiagnostic(auditExecution.result_parse);
     attempt.independent_audit.minimum_matrix_sha256 = reviewedMatrix;
     attempt.independent_audit.evidence_identity_sha256 = reviewedEvidenceIdentity;
     attempt.independent_audit.objective_digest = reviewedObjectiveDigest;

package/src/orchestrator/problem-solving.js

@@ -1,6 +1,6 @@
 import { cleanString, stringArray } from "./shared.js";
 
-const MIN_RETRY_HYPOTHESES = 8;
+const MIN_RETRY_HYPOTHESES = 1;
 
 export function normalizeProblemSolving(value) {
   const record = value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -49,7 +49,7 @@ export function evaluateRetryProblemSolving(attempt, previousAttempt) {
   const checks = [
     {
       id: "retry_hypotheses_expanded",
-      label: "Retry considers at least eight distinct hypotheses",
+      label: "Retry considers a plausible explanation",
       passed: distinctHypotheses >= MIN_RETRY_HYPOTHESES,
       detail: `Expected at least ${MIN_RETRY_HYPOTHESES} distinct hypotheses; recorded ${distinctHypotheses}.`,
     },
@@ -78,9 +78,10 @@ export function evaluateRetryProblemSolving(attempt, previousAttempt) {
     },
   ];
   return {
-    required: true,
-    passed: checks.every((check) => check.passed),
-    checks,
+    required: false,
+    passed: true,
+    assessment_complete: checks.every((check) => check.passed),
+    checks: checks.map(check => ({ ...check, severity: "advisory" })),
     current,
     previous,
   };
@@ -91,7 +92,7 @@ export function problemSolvingResultContract() {
     "problem_solving must be an object with hypotheses, selected_hypothesis_id, evidence_checked, strategy, and changed_from_previous.",
     "Each hypothesis must use {id, statement}; evidence_checked must list concrete observations or commands.",
     "On attempt 1, record the assumptions, hypotheses considered, selected hypothesis, and implementation strategy; changed_from_previous may be null.",
-    `On every retry, record at least ${MIN_RETRY_HYPOTHESES} distinct MECE hypotheses, select one of them, check discriminating evidence, use a strategy different from the previous attempt, and explain the change in changed_from_previous.`,
+    "On retry, use reasoning proportional to the uncertainty. If the repair is clear, make it and verify it; do not invent a fixed number of hypotheses or change a working strategy merely to satisfy a form. For persistent unexplained failures, compare plausible causes and inspect discriminating evidence. These reasoning notes are advisory; unchanged failures are still subject to the retry circuit.",
   ].join("\n");
 }
 

package/src/orchestrator/result.js

@@ -56,6 +56,7 @@ export function buildAttempt({ attemptNumber, charter, instruction, promptInterv
     visual_qa_result: null,
     release_gate: null,
     executor_logs: stringArray(execution.logs).slice(-100),
+    result_parse: normalizeResultParseDiagnostic(execution.result_parse),
     token_usage:
       execution.tokenUsage && typeof execution.tokenUsage === "object"
         ? execution.tokenUsage
@@ -79,16 +80,104 @@ export function parseStructuredResult(text) {
 }
 
 export function parseStructuredMarker(text, marker) {
-  const index = String(text || "").lastIndexOf(marker);
-  if (index < 0) return {};
-  const afterMarker = String(text).slice(index + marker.length).trim();
-  const firstLine = afterMarker.split(/\r?\n/, 1)[0].trim();
+  return diagnoseStructuredMarker(text, marker).value;
+}
+
+// Parse only a line-anchored result channel. Braces in JSON strings are not
+// boundaries; JSON.parse remains responsible for syntax and object validation.
+export function diagnoseStructuredMarker(text, marker, { maxBytes = 1024 * 1024 } = {}) {
+  const failure = code => ({ code, value: {} });
+  if (typeof text !== "string") return failure("missing_marker");
+  if (Buffer.byteLength(text, "utf8") > maxBytes) return failure("result_too_large");
+  const escaped = marker.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const matches = [...text.matchAll(new RegExp(`(?:^|\\n)[ \t]*${escaped}`, "g"))];
+  if (!matches.length) return failure("missing_marker");
+  if (matches.length !== 1) return failure("ambiguous_marker");
+  const payload = text.slice(matches[0].index + matches[0][0].length).trim();
+  if (!payload) return failure("truncated_json");
+  if (!payload.startsWith("{")) return failure("result_root_not_object");
+  let depth = 0, quoted = false, escapedChar = false, end = -1;
+  for (let index = 0; index < payload.length; index += 1) {
+    const char = payload[index];
+    if (quoted) {
+      if (escapedChar) escapedChar = false;
+      else if (char === "\\") escapedChar = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === "{" || char === "[") depth += 1;
+    else if (char === "}" || char === "]") {
+      depth -= 1;
+      if (depth === 0) { end = index + 1; break; }
+    }
+  }
+  if (end < 0) return failure("truncated_json");
+  if (payload.slice(end).trim()) return failure("trailing_result_content");
   try {
-    const value = JSON.parse(firstLine);
-    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-  } catch {
-    return {};
+    const value = JSON.parse(payload.slice(0, end));
+    if (!value || Array.isArray(value) || typeof value !== "object") return failure("result_root_not_object");
+    if (!Object.keys(value).length) return failure("empty_result");
+    return { code: "parsed", value };
+  } catch { return failure("invalid_json"); }
+}
+
+// Native JSONL admits results only from a successfully finished provider turn.
+// Command output, echoed prompts and intermediate assistant items cannot be a
+// fallback channel. Explicit shell overrides retain the documented legacy text.
+export function parseProviderStructuredResult(raw, { backend, marker = "SIMY_RESULT_JSON:", allowPlainText = false,
+  maxBytes = 1024 * 1024, maxStreamBytes = 64 * 1024 * 1024 } = {}) {
+  const failure = code => ({ code, value: {} });
+  if (typeof raw !== "string") return failure("missing_provider_final");
+  if (Buffer.byteLength(raw, "utf8") > maxStreamBytes) return failure("provider_stream_too_large");
+  const events = [];
+  let malformedStream = false;
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      const event = JSON.parse(line);
+      if (event && typeof event === "object" && !Array.isArray(event) && typeof event.type === "string") {
+        // Tool payload size is independent of the bounded final result. Retain
+        // event identity/order, not arbitrary command output, during selection.
+        events.push(event.type === "result" || event.item?.type === "agent_message"
+          ? event : { type: event.type, item: { type: event.item?.type } });
+      } else malformedStream = true;
+    }
+    catch { malformedStream = true; }
   }
+  const nativeTypes = new Set(backend === "claude"
+    ? ["system", "assistant", "user", "result", "stream_event", "tool_progress", "tool_use_summary", "rate_limit_event", "auth_status"]
+    : ["thread.started", "turn.started", "turn.completed", "turn.failed", "item.started", "item.updated", "item.completed", "error"]);
+  const native = events.some(e => nativeTypes.has(e.type));
+  // A discarded line could be a later error or unfinished turn. Native streams
+  // must stay intact; only an explicit non-native override admits plain text.
+  if (malformedStream && (native || !allowPlainText)) return failure("malformed_provider_stream");
+  if (!native) return allowPlainText ? diagnoseStructuredMarker(raw, marker, {maxBytes}) : failure("missing_provider_final");
+  if (backend === "claude") {
+    const results = events.filter(e => e.type === "result");
+    if (results.length > 1) return failure("contradictory_provider_terminal");
+    const final = results[0];
+    if (!final) return failure("missing_provider_final");
+    if (events.slice(events.indexOf(final) + 1).some(e => typeof e.type === "string")) return failure("unsettled_provider_turn");
+    if (final.is_error === true || String(final.subtype || "").startsWith("error")) return failure("provider_failed");
+    return diagnoseStructuredMarker(final.result, marker, {maxBytes});
+  }
+  const end = events.findLastIndex(e => e.type === "turn.completed" || e.type === "turn.failed");
+  if (end < 0) return failure("missing_provider_final");
+  if (events[end].type === "turn.failed") return failure("provider_failed");
+  const start = events.slice(0, end).findLastIndex(e => e.type === "turn.started");
+  const turn = events.slice(start + 1, end);
+  if (turn.some(e => e.type === "turn.failed" || e.type === "turn.completed")) {
+    return failure("contradictory_provider_terminal");
+  }
+  const finalIndex = turn.findLastIndex(e => e.type === "item.completed" &&
+    e.item?.type === "agent_message" && (!e.item.phase || e.item.phase === "final_answer"));
+  if (finalIndex < 0) return failure("missing_provider_final");
+  if (turn.slice(finalIndex + 1).some(e => typeof e.type === "string")) {
+    return failure("nonterminal_agent_message");
+  }
+  const final = turn[finalIndex].item;
+  // A later unsettled turn must not replay an earlier completed result.
+  if (events.slice(end + 1).some(e => typeof e.type === "string")) return failure("unsettled_provider_turn");
+  return diagnoseStructuredMarker(final.text, marker, {maxBytes});
 }
 
 function buildArtifactPreviews(result) {
@@ -125,3 +214,10 @@ function isUsageRecord(value) {
 }
 
 function safeDigest(compute) { try { return compute(); } catch { return null; } }
+
+export function normalizeResultParseDiagnostic(value) {
+  if (!value) return null;
+  const codes = ["parsed", "missing_marker", "result_too_large", "ambiguous_marker", "truncated_json", "result_root_not_object", "trailing_result_content", "empty_result", "invalid_json", "missing_provider_final", "provider_failed", "unsettled_provider_turn", "nonterminal_agent_message", "contradictory_provider_terminal", "provider_stream_too_large", "malformed_provider_stream"];
+  return { code: codes.includes(value.code) ? value.code : "unknown_parse_diagnostic",
+    channel: ["override_or_native", "provider_final"].includes(value.channel) ? value.channel : "unknown" };
+}

package/src/provider-model-selection.js

@@ -0,0 +1,24 @@
+const SELECTION_FIELDS = ["model", "reasoning_effort", "audit_model", "audit_reasoning_effort"];
+const REASONING_EFFORTS = new Set(["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"]);
+
+// Preserve explicit selections at request boundaries; do not infer a model catalog.
+export function normalizeProviderModelSelection(input = {}) {
+  const result = {};
+  for (const field of SELECTION_FIELDS) {
+    const value = input[field];
+    if (value == null) {
+      result[field] = null;
+      continue;
+    }
+    if (typeof value !== "string" || !value.trim()) {
+      throw new Error(`${field} must be a non-empty string.`);
+    }
+    const normalized = value.trim();
+    const valid = field.endsWith("reasoning_effort")
+      ? REASONING_EFFORTS.has(normalized)
+      : /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,159}(?:\[1m\])?$/.test(normalized);
+    if (!valid) throw new Error(`${field} is invalid.`);
+    result[field] = normalized;
+  }
+  return result;
+}

package/src/runner.js

@@ -8,11 +8,10 @@ import { promisify } from "node:util";
 import {
   collectPrEvidence,
   createCodingLoopSnapshot,
-  parseStructuredMarker,
-  parseStructuredResult,
   recheckPrReadiness,
   runCodingLoop,
 } from "./orchestrator/index.js";
+import { parseProviderStructuredResult } from "./orchestrator/result.js";
 import {
   EXECUTION_IO_POLICY_VERSION,
   executionTextSha256,
@@ -180,6 +179,10 @@ export function restoreRun({ snapshot, session, apiOrigin, localPath = null, loc
     sqmHistoryRoot,
     request: {
       backend: charter.backend === "claude" ? "claude" : "codex",
+      model: charter.model || null,
+      reasoning_effort: charter.reasoning_effort || null,
+      audit_model: charter.audit_model || null,
+      audit_reasoning_effort: charter.audit_reasoning_effort || null,
       execution_target: normalizeDesktopExecutionTarget(charter.execution_target),
       execution_device_id:
         String(snapshot.metadata?.execution_device_id || session?.device_id || "").trim() || null,
@@ -1012,18 +1015,21 @@ export async function executeProcessAttempt({
   marker = "SIMY_RESULT_JSON:",
   attemptNumber = null,
   resolveCommandImpl = resolveDesktopExecutorCommand,
+  charter = run?.snapshot?.charter,
   onExecutionComplete = null,
 }) {
+  const phase = marker === "SIMY_AUDIT_JSON:" ? "reviewer" : "executor";
   const command = await resolveCommandImpl({
     backend,
     instruction,
     repositoryPath,
+    model: phase === "reviewer" ? charter?.audit_model : charter?.model,
+    reasoningEffort: phase === "reviewer" ? charter?.audit_reasoning_effort : charter?.reasoning_effort,
   });
   const startedAt = new Date().toISOString();
   const stdout = [];
   const stderr = [];
   const tokenUsageRecords = [];
-  const phase = marker === "SIMY_AUDIT_JSON:" ? "reviewer" : "executor";
   const initialBudget = budgetState(run.snapshot);
   const invocationId = randomUUID();
   const observationSender =
@@ -1106,18 +1112,17 @@ export async function executeProcessAttempt({
       run.child = null;
       await Promise.all(checkpointWrites);
       const rawStdout = stdout.join("");
-      const assistantText = extractAssistantText(rawStdout);
-      const parse =
-        marker === "SIMY_RESULT_JSON:"
-          ? parseStructuredResult
-          : (value) => parseStructuredMarker(value, marker);
-      const result = parse(assistantText);
+      const parsed = parseProviderStructuredResult(rawStdout, {
+        backend, marker, allowPlainText: command.verification === "explicit_command_override",
+      });
+      const parseError = parsed.code === "parsed" ? null : `Provider result unavailable: ${parsed.code}.`;
       const execution = {
         invocationId,
         exitCode: terminalError && exitCode === 0 ? 1 : exitCode,
-        error: error || terminalError,
+        error: error || terminalError || parseError,
         ...(terminalErrorCode ? { errorCode: terminalErrorCode } : {}),
-        result: Object.keys(result).length > 0 ? result : parse(rawStdout),
+        result: parsed.value,
+        result_parse: { code: parsed.code, channel: command.verification === "explicit_command_override" ? "override_or_native" : "provider_final" },
         tokenUsage:
           tokenUsageRecords.length > 0 ? { records: tokenUsageRecords } : {},
         logs: [...stdout, ...stderr]
@@ -1212,25 +1217,6 @@ async function pathExists(value) {
   }
 }
 
-function extractAssistantText(raw) {
-  const messages = [];
-  for (const line of String(raw || "").split(/\r?\n/)) {
-    if (!line.trim().startsWith("{")) continue;
-    try {
-      const item = JSON.parse(line);
-      if (item.type === "result" && typeof item.result === "string") messages.push(item.result);
-      if (item.type === "item.completed" && item.item?.type === "agent_message") {
-        if (typeof item.item.text === "string") messages.push(item.item.text);
-      }
-      if (item.type === "assistant" && typeof item.message?.content === "string") {
-        messages.push(item.message.content);
-      }
-    } catch {
-      // Non-JSON executor output is still available to the fallback parser.
-    }
-  }
-  return messages.join("\n");
-}
 
 function emitOutput(run, text, { backend = run.request.backend, promote = true } = {}) {
   for (const line of String(text).split(/\r?\n/)) {

package/src/session-supervision/action-association-host.js

@@ -3,6 +3,7 @@ import { listRecords, readRecord, updateRecord, TERMINAL, managedBudgetReason }
 import { createActionAssociationApi, ActionAssociationApiError } from './action-association-api.js';
 import { actionCandidateRequest, prepareActionAssociation, importActionBinding,
   settleActionAssociation, cancelActionAssociation } from './action-association.js';
+import { CANDIDATE_DISPLAY_MS, needsCandidateSearch, hasFreshCandidates } from './association-refresh.js';
 
 const namespaceFor = (origin, scope) => JSON.stringify([new URL(origin).origin, scope.organizationId, scope.userId]);
 const identity = record => ({ provider: record.provider, session: record.session, taskId: record.run.managed.taskId });
@@ -90,22 +91,34 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     let view = views.get(target.taskId);
     const request = actionCandidateRequest(record);
     const contextRevision = request?.context.revision || null;
-    if (!force && view?.auth === expected && view.contextRevision === contextRevision && now() < view.nextRefresh && (!association?.outbox || view.error)) {
-      if (queue && !view.error && view.snapshot && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
+    const active = !TERMINAL.has(record.run.state);
+    if (!force && view?.auth === expected && view.active === active && view.contextRevision === contextRevision && now() < view.nextRefresh && (!association?.outbox || view.error)) {
+      if (queue && !view.error && hasFreshCandidates(view, now()) && !association?.manualOverride && !association?.job && !association?.outbox && !TERMINAL.has(record.run.state)) await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
       return;
     }
-    view = { ...view, auth: expected, contextRevision, nextRefresh: now() + refreshMs };
+    const search = request && (needsCandidateSearch(view, expected, contextRevision, active, force) ||
+      association?.outbox && !view?.snapshot);
+    view = { ...view, auth: expected, active, contextRevision, nextRefresh: now() + refreshMs };
     views.delete(target.taskId); views.set(target.taskId, view);
     while (views.size > 500) views.delete(views.keys().next().value);
     try {
       // Never publish an outbox from an earlier organization or login before a
       // scoped server response confirms who owns the current request.
-      const snapshot = request ? await api.candidates(request, { signal: abort.signal }) : await api.readBinding(target.taskId, { signal: abort.signal });
-      const namespace = await importEnvelope(record, snapshot, expected);
+      const envelope = search ? await api.candidates(request, { signal: abort.signal }) : await api.readBinding(target.taskId, { signal: abort.signal });
+      const namespace = await importEnvelope(record, envelope, expected);
+      const reusable = view.auth === expected && view.namespace === namespace && view.snapshot?.contextRevision === contextRevision;
+      const snapshot = search ? envelope : { ...(reusable ? view.snapshot : {}), ...envelope };
       view.namespace = namespace; view.error = null;
-      view.candidates = (snapshot.candidates || []).map(publicCandidate);
+      if (search) {
+        view.candidateAuth = expected; view.candidateContextRevision = contextRevision;
+        view.candidatesExpireAt = now() + CANDIDATE_DISPLAY_MS;
+      } else if (!reusable) {
+        view.candidateAuth = null; view.candidateContextRevision = null;
+      }
+      view.candidates = (search || hasFreshCandidates(view, now()) ? snapshot.candidates || [] : []).map(publicCandidate);
       view.candidateTruncated = snapshot.retrieval?.truncated === true || view.candidates.length > 5;
-      view.snapshot = request ? snapshot : null;
+      view.snapshot = snapshot.candidateRevision ? snapshot : null;
+      if (!active && !snapshot.binding?.action && !association?.outbox) view.nextRefresh = Infinity;
       let latest = await fresh(target);
       if (!latest || !await valid(expected)) return;
       const pending = latest.run.managed.actionAssociation?.outbox;
@@ -123,7 +136,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
         await settleActionAssociation({ root, ...target, outboxId: pending.id, namespace, binding: saved.binding, now: now(), validate: validateScope(expected) });
         return;
       }
-      if (queue && request && !latest.run.managed.actionAssociation?.manualOverride && !TERMINAL.has(latest.run.state)) {
+      if (queue && request && hasFreshCandidates(view, now()) && !latest.run.managed.actionAssociation?.manualOverride && !TERMINAL.has(latest.run.state)) {
         // A read turn is queued only at the original session's safe boundary.
         // Blocked tasks retain candidates for auxiliary correction in the UI.
         await prepareActionAssociation({ root, record: latest, snapshot, webOrigin, now: now(), validate: validateScope(expected) });
@@ -245,7 +258,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
     async prepareCached(record) {
       const expected = await current();
       const view = views.get(record?.run?.managed?.taskId), request = actionCandidateRequest(record);
-      if (closed || !auth || !view || view.auth !== auth || view.error || !view.snapshot || !request || view.contextRevision !== request.context.revision || view.snapshot.contextRevision !== request.context.revision || view.namespace !== namespaceFor(webOrigin, view.snapshot.scope)) return record;
+      if (closed || !auth || !view || view.auth !== auth || view.error || !hasFreshCandidates(view, now()) || !request || view.contextRevision !== request.context.revision || view.snapshot.contextRevision !== request.context.revision || view.namespace !== namespaceFor(webOrigin, view.snapshot.scope)) return record;
       try {
         const prepared = await prepareActionAssociation({ root, record, snapshot: view.snapshot, webOrigin, now: now(), validate: validateScope(expected) });
         return prepared || record;
@@ -268,7 +281,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
           !view || view.auth !== expected ? { status: 'loading', binding: null, candidates: [], canCorrect: false } : {
             status: view.error || local?.status || 'waiting_boundary',
             binding: view.namespace && local?.namespace === view.namespace ? publicBinding(local.binding) : null,
-            candidates: (view.candidates || []).slice(0,5), canCorrect: !view.error,
+            candidates: (hasFreshCandidates(view, now()) ? view.candidates || [] : []).slice(0,5), canCorrect: !view.error,
             contextRevision: view.contextRevision, candidateRevision: view.snapshot?.candidateRevision || null, retryOn: local?.retryOn || null, truncated: view.candidateTruncated || false,
           };
         let bytes = Buffer.byteLength(JSON.stringify(run.actionAssociation));

package/src/session-supervision/association-refresh.js

@@ -0,0 +1,12 @@
+// Candidate search is event-driven; binding reads remain independently renewable.
+// Retain only the search identity after expiry, so a timer cannot restart search
+// or keep displaying candidate text after its authorization window has elapsed.
+export const CANDIDATE_DISPLAY_MS = 60_000;
+
+export function needsCandidateSearch(view, auth, contextRevision, active, force = false) {
+  return force || active && (view?.candidateAuth !== auth || view.candidateContextRevision !== contextRevision);
+}
+
+export function hasFreshCandidates(view, now) {
+  return Boolean(view?.snapshot?.candidateRevision && now < view.candidatesExpireAt);
+}

package/src/session-supervision/association-store.js

@@ -3,9 +3,14 @@ import {
   listRecords,
   readRecord,
   updateRecord,
+  TERMINAL,
 } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { associationRevision } from './action-association.js';
 import { ActionAssociationApiError } from './action-association-api.js';
+import { CANDIDATE_DISPLAY_MS, needsCandidateSearch, hasFreshCandidates } from './association-refresh.js';
+
+const activeConversation = (candidate, record) => !TERMINAL.has(record.run?.state) &&
+  (candidate.isRunning !== false || candidate.autoContinue === true || candidate.analysis?.state === 'continue');
 
 export const sessionAssociationContext = (candidate) => {
   const grounded =
@@ -111,6 +116,7 @@ export function createOrdinaryAssociationStore({
     if (record.run?.managed) return;
     const auth = await api.authRevision(),
       context = sessionAssociationContext(candidate);
+    const active = activeConversation(candidate, record);
     let view = views.get(taskId);
     if (!auth) {
       rememberView(taskId, { auth, status: 'signed_out' });
@@ -120,13 +126,15 @@ export function createOrdinaryAssociationStore({
       !force &&
       view?.auth === auth &&
       view.contextRevision === context.revision &&
+      view.active === active &&
       now() < view.nextRefresh
     )
       return;
     const previous = view?.auth === auth ? view : null;
     const sameContext = previous?.contextRevision === context.revision;
+    const search = needsCandidateSearch(previous, auth, context.revision, active, force);
     view = {
-      ...previous, auth, contextRevision: context.revision,
+      ...previous, auth, active, contextRevision: context.revision,
       // Background renewal retains the last stable presentation. A user refresh
       // can show progress without flashing every cached result back to loading.
       status: force ? 'loading' : previous?.status || 'loading',
@@ -134,19 +142,22 @@ export function createOrdinaryAssociationStore({
     };
     rememberView(taskId, view);
     try {
-      const snapshot = await api.candidates(
+      const envelope = search ? await api.candidates(
         { taskId, context, limit: 10 },
         { signal: abort.signal },
-      );
+      ) : await api.readBinding(taskId, { signal: abort.signal });
       if (closed || (await api.authRevision()) !== auth)
         throw new ActionAssociationApiError('account_changed');
       if (
-        snapshot.taskId !== taskId ||
-        snapshot.contextRevision !== context.revision ||
-        (snapshot.binding && snapshot.binding.taskId !== taskId)
+        search && (envelope.taskId !== taskId || envelope.contextRevision !== context.revision) ||
+        (envelope.binding && envelope.binding.taskId !== taskId)
       )
         throw new ActionAssociationApiError('invalid_response');
-      const namespace = namespaceFor(webOrigin, snapshot.scope);
+      const namespace = namespaceFor(webOrigin, envelope.scope);
+      const reusable = sameContext && previous.namespace === namespace && hasFreshCandidates(previous, now());
+      const snapshot = search ? envelope : {
+        ...(reusable ? previous.snapshot : {}), ...envelope, taskId, contextRevision: context.revision,
+      };
       const persisted = await updateRecord(
         root,
         candidate.provider,
@@ -184,7 +195,10 @@ export function createOrdinaryAssociationStore({
       Object.assign(view, {
         namespace,
         snapshot,
-        nextRefresh: now() + (snapshot.binding?.action ? 15_000 : 60_000),
+        candidateAuth: search ? auth : previous?.namespace === namespace ? previous?.candidateAuth : null,
+        candidateContextRevision: search ? context.revision : previous?.namespace === namespace ? previous?.candidateContextRevision : null,
+        candidatesExpireAt: search ? now() + CANDIDATE_DISPLAY_MS : previous?.candidatesExpireAt,
+        nextRefresh: snapshot.binding?.action ? now() + 15_000 : active ? now() + 60_000 : Infinity,
         failures: 0,
         status: snapshot.binding?.action
           ? 'bound'
@@ -230,7 +244,8 @@ export function createOrdinaryAssociationStore({
         candidate.binding = { ...candidate.binding, taskId };
         if (record.run?.managed) continue;
         const cached = views.get(taskId),
-          context = sessionAssociationContext(candidate);
+          context = sessionAssociationContext(candidate),
+          active = activeConversation(candidate, record);
         if (
           auth &&
           !closed &&
@@ -238,6 +253,7 @@ export function createOrdinaryAssociationStore({
           (!cached ||
             cached.auth !== auth ||
             cached.contextRevision !== context.revision ||
+            cached.active !== active ||
             now() >= cached.nextRefresh)
         ) {
           const scopedBinding = cached?.auth === auth && cached.snapshot && record.actionAssociation?.authRevision === auth && record.actionAssociation.namespace === cached.namespace;
@@ -247,7 +263,7 @@ export function createOrdinaryAssociationStore({
         }
         const view = views.get(taskId);
         const bindingSnapshot = view?.auth === auth && auth ? view.snapshot : null;
-        const snapshot = bindingSnapshot?.contextRevision === context.revision ? bindingSnapshot : null;
+        const snapshot = bindingSnapshot?.contextRevision === context.revision && hasFreshCandidates(view, now()) ? bindingSnapshot : null;
         const local = record.actionAssociation;
         const scoped = Boolean(bindingSnapshot && local?.authRevision === auth && local.namespace === view.namespace);
         const newer = scoped &&