@awak-app/simy-cli 0.6.2 → 0.6.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.2",
+  "version": "0.6.4",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -43,7 +43,7 @@
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",
     "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js",
-    "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/session-supervision/automatic-continuation.js",
+    "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/session-supervision/automatic-continuation.js && node --check ./src/session-supervision/stop-notifications.js",
     "check:package": "node ./scripts/check-package-contents.js",
     "build:macos-installer:dev": "bash packaging/build-macos-arm64.sh --unsigned-dev",
     "build:macos-installer": "bash packaging/build-macos-arm64.sh --production",

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.2";
+export const CLI_VERSION = "0.6.4";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function withCliContract(

package/src/codex-plugins/simy/hooks/README.md

@@ -22,7 +22,7 @@ scans ports or reads stored session tokens.
 Claude distributions. SessionStart supplies the exact session identity. It does
 not start a loop. After an explicit `simy delivery start`, Stop checks that
 session's checkpoint and returns bounded next-step instructions. Approval/input
-blocks, interruption, completion, failures and budgets stop automatic continuation.
+blocks, interruption, completion, failures and missing progress stop automatic continuation.
 Provider errors/exits are surfaced to SIMY's desktop; a dead provider is not
 silently restarted. No hook writes trust, permission settings, or SQM evidence.
 
@@ -31,27 +31,21 @@ keyed by provider and session ID and bound to the canonical working directory.
 Historical hook observations do not prove hooks are still enabled. See the
 bundled delivery-loop skill for checkpoint commands and explicit recovery.
 
-Managed tasks may explicitly select `--continuation-policy progress`. Existing
-tasks without that choice keep their bounded contract. Progress mode treats the
-ordinary time, continuation and token thresholds as warnings, with independent
-hard ceilings of 24 hours from the original start, 50 continuations and, on the
-host-observed Codex channel, 15 million provider tokens. Claude live hooks expose
-no trustworthy usage stream; their status explicitly reports that token limits
-are unsupported. Required approvals, missing observed usage, manual stops and
-unreconciled effects continue to block dispatch.
-
-The host records passing, failed and unevaluated frozen acceptance checks.
-Provider summaries, test counts, renamed evidence and restored old criteria
-cannot manufacture progress. Three attempts without new verified criteria, or
-30 minutes without verified progress at a dispatch/checkpoint boundary, pause
-the original run. Active tools are allowed to reach their checkpoint within the
-hard ceiling; activity alone does not prove progress.
-
-`delivery extend` raises explicitly selected ceilings within those global caps.
-It records the old and new bounds, preserves run identity, usage, checkpoints,
-criteria and approvals, and does not start a new provider turn. A separate resume
-is required after an exhausted run becomes paused. `delivery continuation_policy`
-requires an explicit choice and never infers progress consent from an extension.
+SIMY does not limit a task's elapsed time, number of turns or provider tokens.
+A task stops after its failure limit (three by default). Missing progress is
+evaluated after three steps without a newly verified acceptance criterion, or
+30 minutes without verified progress at a dispatch/checkpoint boundary. The
+policy-specific pause behavior is described below. Provider summaries, test counts, renamed evidence and restored old
+criteria cannot manufacture progress, and activity alone does not prove it.
+Required approvals, manual stops and unreconciled effects still block dispatch.
+
+Context-first tasks without host-checkable acceptance pause rather than fail at
+that limit, so Auto-continue stays available after review. An explicit resume,
+answer or approval resets both no-progress attempt counters and the progress clock,
+even before a threshold was reached. Failure counts and verified criterion history
+remain; reusing old evidence cannot count as fresh progress.
+`delivery continuation_policy` switches between the `bounded` and `progress`
+policies only after an explicit choice; `progress` also pauses rather than fails.
 
 ## Project 実装状況 (dev-work) hook
 

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -8,8 +8,8 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
 import { associationContract, validateAssociationResult } from './action-association.mjs';
-import { continuationMode, MAX_COMPLETION_TOKENS } from './continuation-policy.mjs';
-import { evaluateOutcomeProgress } from './outcome-progress.mjs';
+import { continuationMode } from './continuation-policy.mjs';
+import { evaluateOutcomeProgress, restartOutcomeProgressWindow } from './outcome-progress.mjs';
 
 export const TERMINAL = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
 const EVENTS = new Set(['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification']);
@@ -374,7 +374,7 @@ function escalate(run, cause) {
   managed.escalation = { cause, tried: history.map(item => ({ action: item.action?.summary, result: item.status, reason: item.summary })), results: history.map(item => ({ action: item.action?.summary, result: item.status, reason: item.verification })), remainingWork: text(managed.remainingWork || run.nextStep, 1000), userQuestion: managed.userQuestion || managed.plan?.userQuestion || 'Which action should be authorized or revised?', options: (managed.plan?.alternatives || []).map(option => ({ id: option.id, action: { kind: option.action.kind, scope: option.action.scope, summary: text(option.action.summary, 200) } })), recommendation: managed.plan?.recommendation || null };
 }
 export function notifyState(run, now) {
-  if (!run?.managed || !['blocked', 'verification_pending', 'recovery_required', 'failed', 'budget_exhausted', 'completed', 'reported_done'].includes(run.state)) return;
+  if (!run?.managed || !['blocked', 'verification_pending', 'recovery_required', 'paused', 'failed', 'budget_exhausted', 'completed', 'reported_done'].includes(run.state)) return;
   const key = `${run.state}:${run.revision}:${run.reason}`;
   if (run.managed.notificationKey === key) return;
   run.managed.notificationKey = key;
@@ -420,11 +420,8 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
     initialAction, proposedAction: initialAction, approvalPolicy, approvalScopes: [...new Set(scopes)].slice(0, 20),
     grants: Object.fromEntries(scopes.map(scope => [scope, { decision: approvalPolicy }])), maxNoProgress: positive(config.maxNoProgress, 3, 20),
     maxNoProgressMinutes: positive(config.maxNoProgressMinutes, 30, 1440), lastVerifiedProgressAt: now,
-    maxTokens: config.maxTokens === undefined ? null : positive(config.maxTokens, null, Number.MAX_SAFE_INTEGER), tokensUsed: 0, usageAvailable: null,
     noProgress: 0, verifiedRevision: 0, consumedVerifiedRevision: 0, notification: null, notificationKey: null,
     continuationPolicy: continuationMode(config.continuationPolicy),
-    providerTokenCeiling: appServerChannel ? positive(config.providerTokenCeiling, MAX_COMPLETION_TOKENS, MAX_COMPLETION_TOKENS) : null,
-    budgetCapability: { time: false, continuations: false, providerTokens: appServerChannel, localExecutionLimits: false },
     autoRecovery, resumeModel, autoRecoveryUnavailableReason: config.autoRecovery === true && !autoRecovery ? 'Exact Codex process, session UUID, and resumeModel are required.' : null,
     autoRecoverySandbox: config.autoRecoverySandbox || 'read-only', resumeChannel: config.resumeChannel || null,
     capability: appServerChannel && autoRecovery ? 'codex_app_server' : autoRecovery ? 'codex_exec_resume' : 'live_hook',
@@ -434,7 +431,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
   if (initialPlan) recordDecision(managed, initialPlan, Date.now());
   return managed;
 }
-export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxContinuations, maxFailures, maxMinutes, continuationPolicy, hardMaxMinutes, hardMaxContinuations, providerTokenCeiling, managed, admission,
+export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), objective, nextStep, maxFailures, continuationPolicy, managed, admission,
   liveHookAdmission, autoContinueEpoch, inspectProcess = processIdentity, now = Date.now() }) {
   cwd = await realpath(cwd);
   if (!text(objective) || !text(nextStep)) throw new Error('Objective and concrete next step are required.');
@@ -451,8 +448,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     if ((!previous?.observedAt && !admitted) || previous.cwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or enable SIMY hooks.');
     if (previous.run) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
     const managedConfig = managed && { ...(managed === true ? {} : managed),
-      ...(continuationPolicy === undefined ? {} : { continuationPolicy }),
-      ...(providerTokenCeiling === undefined ? {} : { providerTokenCeiling }) };
+      ...(continuationPolicy === undefined ? {} : { continuationPolicy }) };
     const managedState = managedSpec(managedConfig, session, provider, previous.process, admitted ? admission : null, now);
     if (!managedState && continuationMode(continuationPolicy) === 'progress') throw new Error('Progress continuation requires frozen managed acceptance criteria.');
     if (autoContinueEpoch && managedState) managedState.autoContinueEpoch = autoContinueEpoch;
@@ -465,12 +461,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     const waiting = managedState?.decision?.outcome === 'wait';
     const queued = managedState?.capability === 'codex_app_server';
     const run = { id: randomUUID(), objective: text(objective), state: waiting ? 'blocked' : queued ? 'recovery_required' : 'active', nextStep: text(nextStep), startedAt: now, updatedAt: now,
-      deadline: now + positive(maxMinutes, 30, 1440) * 60_000, maxContinuations: positive(maxContinuations, 6, 50), maxFailures: positive(maxFailures, 3, 10),
-      ...(managedState?.continuationPolicy === 'progress' ? {
-        hardDeadline: now + positive(hardMaxMinutes ?? managedConfig.hardMaxMinutes, 1440, 1440) * 60_000,
-        hardMaxContinuations: positive(hardMaxContinuations ?? managedConfig.hardMaxContinuations, 50, 50),
-        budgetWarnings: [], budgetExtensionHistory: [],
-      } : {}),
+      maxFailures: positive(maxFailures, 3, 10),
       continuations: 0, failures: 0, revision: 0, consumedRevision: -1, checkpoint: null, reason: waiting ? managedState.decision.reason : queued ? 'Exact-session supervision is queued; SIMY will acquire the provider writer lock before dispatch.' : 'started',
       ...(queued ? { recoveryCause: 'session_supervision' } : {}), managed: managedState };
     if (waiting) escalate(run, run.reason);
@@ -774,37 +765,54 @@ export function prepareRecoveryDiagnosis(run, now = Date.now()) {
   run.nextStep = decision.action.summary;
   return decision;
 }
-export function deliveryBudgetState(run, now = Date.now(), { checkProgress = true } = {}) {
+// Local time, turn and token caps were removed. A managed task stops only after
+// repeated failures or when no progress is verified; both reasons are shown to
+// people, so keep them plain and actionable. Codes drive state transitions.
+export const STOP_CODES = Object.freeze({ failureLimit: 'failure_limit', noProgressTime: 'no_progress_time', noProgressAttempts: 'no_progress_attempts' });
+export function deliveryStop(run, now = Date.now(), { checkProgress = true } = {}) {
   const managed = run.managed;
-  const progress = managed?.continuationPolicy === 'progress';
-  // Historical policies/counters remain immutable, but local elapsed time,
-  // turn count and token usage no longer limit either new or restored tasks.
-  const deadline = Infinity;
-  const maxContinuations = Infinity;
-  const tokenCeiling = null;
-  const warnings = [];
-  const checkpointDetail = run.checkpoint ? '' : ' No progress checkpoint was recorded.';
-  if (progress) {
-    if (now >= run.deadline) warnings.push('soft_time_limit');
-    if (run.continuations >= run.maxContinuations) warnings.push('soft_continuation_limit');
-    if (managed.maxTokens && managed.tokensUsed >= managed.maxTokens) warnings.push('soft_token_limit');
-  }
-  let reason = null;
-  if (run.failures >= run.maxFailures) {
-    reason = `Delivery failure limit exhausted (${run.failures}/${run.maxFailures}).${checkpointDetail}`;
-  } else if (checkProgress && managed && now - (managed.lastVerifiedProgressAt ?? run.startedAt) >= (managed.maxNoProgressMinutes ?? 30) * 60_000) {
-    reason = 'No verified acceptance progress within the configured time limit.';
-  } else if (checkProgress && managed && managed.noProgress >= managed.maxNoProgress) {
-    reason = 'No verified acceptance progress within the configured continuation limit.';
-  }
-  return { continuationPolicy: progress ? 'progress' : 'bounded', localLimitsRemoved: true, deadline, maxContinuations, tokenCeiling, warnings, reason };
+  if (run.failures >= run.maxFailures) return { code: STOP_CODES.failureLimit,
+    reason: `Stopped after ${run.failures} failed attempts. Open the original conversation to see what went wrong.` };
+  if (!checkProgress || !managed) return null;
+  const minutes = managed.maxNoProgressMinutes ?? 30;
+  if (now - (managed.lastVerifiedProgressAt ?? run.startedAt) >= minutes * 60_000) return { code: STOP_CODES.noProgressTime,
+    reason: `Paused because no progress was confirmed in ${minutes} minutes. Review the original conversation, then resume.` };
+  if (managed.noProgress >= managed.maxNoProgress) return { code: STOP_CODES.noProgressAttempts,
+    reason: `Paused after ${managed.noProgress} steps without confirmed progress. Review the original conversation, then resume.` };
+  return null;
+}
+// What a provider turn is told about its remaining room to work.
+export function deliveryProgressContext(run) {
+  return { continuations: run.continuations, failures: run.failures, maxFailures: run.maxFailures,
+    stepsWithoutConfirmedProgress: run.managed?.noProgress ?? 0, maxStepsWithoutConfirmedProgress: run.managed?.maxNoProgress ?? null,
+    minutesWithoutConfirmedProgress: run.managed?.maxNoProgressMinutes ?? null };
 }
 export function managedBudgetReason(run, now = Date.now(), options) {
-  return deliveryBudgetState(run, now, options).reason;
+  return deliveryStop(run, now, options)?.reason ?? null;
+}
+// Only repeated failures make a task unrecoverable. A missing-progress pause is a
+// review point: an explicit resume starts a fresh progress window.
+export function deliveryStopBlocksResume(run, now = Date.now()) {
+  return deliveryStop(run, now)?.code === STOP_CODES.failureLimit;
 }
-export function managedDispatchDeadline(run) {
-  return deliveryBudgetState(run).deadline;
+// Time spent waiting for a person is not missing work progress. An explicit
+// resume, answer or approval starts a new progress window; failures remain.
+function continueAfterHumanDecision(run, now) {
+  const stop = deliveryStop(run, now);
+  if (stop?.code === STOP_CODES.failureLimit) throw new Error(stop.reason);
+  if (!run.managed) return;
+  run.managed.progressWindowResets = [...(run.managed.progressWindowResets || []),
+    { at: now, code: stop?.code ?? 'human_decision', noProgress: run.managed.noProgress }].slice(-10);
+  run.managed.noProgress = 0;
+  run.managed.outcomeProgress = restartOutcomeProgressWindow(run.managed.outcomeProgress);
+  run.managed.lastVerifiedProgressAt = now;
 }
+const stoppedState = stop => stop.code === STOP_CODES.failureLimit ? 'budget_exhausted' : 'paused';
+// Context-first tasks usually have no host-checkable acceptance, so worker
+// reports can never reset noProgress. Reaching that limit pauses for review
+// instead of failing permanently and ending Auto-continue for the conversation.
+const pausesWithoutProgress = managed => managed.continuationPolicy === 'progress' ||
+  managed.contextBootstrap === true && !managed.acceptanceCriteria.some(criterion => criterion.check?.type !== 'manual');
 
 function recordManagedOutcomeProgress(run, now, assessmentAvailable = true) {
   const managed = run.managed;
@@ -842,7 +850,6 @@ export function automaticContinuationAllowed(record) {
 export function decideStop(run, now = Date.now()) {
   if (TERMINAL.has(run.state) || ['blocked', 'recovery_required', 'paused', 'verification_pending'].includes(run.state)) return { run, output: {} };
   const next = structuredClone(run);
-  next.budgetWarnings = deliveryBudgetState(next, now).warnings;
   const finish = (state, reason) => { next.state = state; next.reason = reason; next.updatedAt = now; return { run: next, output: {} }; };
   // A fresh, explicitly evidenced completion may finish at the budget boundary.
   const fresh = next.checkpoint && next.revision > next.consumedRevision;
@@ -859,8 +866,8 @@ export function decideStop(run, now = Date.now()) {
       next.nextStep = text(cp.nextStep) || next.nextStep;
     } else { escalate(next, cp.summary); return finish('blocked', cp.summary); }
   }
-  const budgetReason = managedBudgetReason(next, now);
-  if (budgetReason) return finish(budgetReason.startsWith('No verified') ? 'paused' : 'budget_exhausted', budgetReason);
+  const stop = deliveryStop(next, now);
+  if (stop) return finish(stoppedState(stop), stop.reason);
   const initialHook = next.managed?.awaitingInitialHook && next.revision === 0 && !next.checkpoint;
   const replanHook = next.managed?.capability === 'live_hook' && next.managed.awaitingReplanHook === true;
   const understandingHook = next.managed?.capability === 'live_hook' && (next.managed.awaitingUnderstandingHook === true || next.managed.awaitingAssociationHook === true);
@@ -901,7 +908,11 @@ export function decideStop(run, now = Date.now()) {
     else if (next.managed.associationCheckpointRevision !== next.revision && !initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && !['session_understanding', 'action_association'].includes(cp?.kind)) next.managed.noProgress += 1;
     if (reportedStep) next.managed.reportedProgress = (next.managed.reportedProgress || 0) + 1;
     next.managed.consumedVerifiedRevision = next.managed.verifiedRevision;
-    if (next.managed.noProgress >= next.managed.maxNoProgress) { escalate(next, 'No verified acceptance progress within the configured continuation limit.'); return finish(next.managed.continuationPolicy === 'progress' ? 'paused' : 'failed', 'No verified acceptance progress within the configured continuation limit.'); }
+    if (next.managed.noProgress >= next.managed.maxNoProgress) {
+      const stop = deliveryStop(next, now);
+      escalate(next, stop.reason);
+      return finish(pausesWithoutProgress(next.managed) ? 'paused' : 'failed', stop.reason);
+    }
   }
   next.consumedRevision = next.revision;
   if (initialHook) next.managed.awaitingInitialHook = false;
@@ -1122,7 +1133,7 @@ export function canReplanDelivery(run, provider, now = Date.now()) {
     managed?.capability === 'live_hook' && provider === 'claude' && Boolean(managed.liveHookOwner?.identity);
   return Boolean(supported && managed.autonomyPolicy && managed.approvalScopes?.length && !managed.rejectedActionOverflow &&
     run.state === 'blocked' && managed.pendingApproval?.denied === true &&
-    !managedBudgetReason(run, now));
+    !deliveryStopBlocksResume(run, now));
 }
 export function canChangeDeliveryContinuation(run) {
   return Boolean(run?.managed && ['paused', 'blocked', 'failed', 'budget_exhausted', 'verification_pending', 'recovery_required'].includes(run.state) &&
@@ -1130,7 +1141,8 @@ export function canChangeDeliveryContinuation(run) {
 }
 function reopenLegacyLimitStop(run, now) {
   if (run?.state !== 'budget_exhausted' ||
-      managedBudgetReason(run, now, { checkProgress: false }) ||
+      deliveryStop(run, now)?.code === STOP_CODES.failureLimit ||
+      // Reasons persisted by older versions for stops that were not obsolete caps.
       /No verified|failure limit/i.test(run.reason || '') ||
       run.managed?.noProgress >= run.managed?.maxNoProgress) return;
   if (run.managed) {
@@ -1138,9 +1150,9 @@ function reopenLegacyLimitStop(run, now) {
     // Time spent stopped at an obsolete cap is not failed execution progress.
     run.managed.lastVerifiedProgressAt = now;
   }
-  run.state = 'paused'; run.reason = 'Local limits removed; resume this same task.';
+  run.state = 'paused'; run.reason = 'SIMY no longer limits time or turns. Resume this task to continue.';
 }
-export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, continuationPolicy, limits, questionId, waitId, answer, action, now = Date.now() }) {
+export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, approvalId, autonomyPolicy, continuationPolicy, questionId, waitId, answer, action, now = Date.now() }) {
   for (let retry = 0; ; retry += 1) {
     try { return await updateRecord(root, provider, session, record => {
     const run = record?.run;
@@ -1149,49 +1161,12 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     if (['pending', 'pending_received'].includes(run.managed?.handoff?.status)) throw new Error('Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.');
     if (action !== 'stop' && run.managed?.handoff?.status === 'transferred') throw new Error('Task handoff is locked; continue in the received target session.');
     reopenLegacyLimitStop(run, now);
-    if (action === 'extend' || action === 'continuation_policy') {
-      if (!canChangeDeliveryContinuation(run)) throw new Error('Pause a managed task before changing its continuation bounds.');
-      if (action === 'continuation_policy') {
-        if (!['bounded', 'progress'].includes(continuationPolicy)) throw new Error('Select an explicit continuation policy.');
-        run.managed.continuationPolicy = continuationMode(continuationPolicy);
-        if (continuationPolicy === 'progress') {
-          run.hardDeadline ??= run.startedAt + 1440 * 60_000;
-          run.hardMaxContinuations ??= 50;
-          if (run.managed.resumeChannel === 'codex_app_server') run.managed.providerTokenCeiling ??= MAX_COMPLETION_TOKENS;
-        }
-        run.continuationPolicyHistory ||= [];
-        run.continuationPolicyHistory.push({ policy: continuationPolicy, at: now, source: 'explicit_controller_selection' });
-      } else {
-        if (!limits || typeof limits !== 'object' || Array.isArray(limits) || !Object.keys(limits).length ||
-            Object.keys(limits).some(key => !['hardMaxMinutes', 'hardMaxContinuations', 'providerTokenCeiling'].includes(key))) throw new Error('Supply explicit continuation ceiling increases.');
-        const progress = run.managed.continuationPolicy === 'progress';
-        const before = { deadline: progress ? run.hardDeadline : run.deadline,
-          maxContinuations: progress ? run.hardMaxContinuations : run.maxContinuations,
-          tokens: progress ? run.managed.providerTokenCeiling : run.managed.maxTokens };
-        const after = { ...before };
-        if (limits.hardMaxMinutes !== undefined) {
-          after.deadline = run.startedAt + positive(limits.hardMaxMinutes, null, 1440) * 60_000;
-          if (after.deadline <= before.deadline) throw new Error('Extension must increase the original deadline within 24 hours of its start.');
-        }
-        if (limits.hardMaxContinuations !== undefined) {
-          after.maxContinuations = positive(limits.hardMaxContinuations, null, 50);
-          if (after.maxContinuations <= before.maxContinuations) throw new Error('Extension must increase the continuation ceiling within 50 turns.');
-        }
-        if (limits.providerTokenCeiling !== undefined) {
-          if (run.managed.resumeChannel !== 'codex_app_server') throw new Error('Provider token ceilings require host-observed Codex usage.');
-          after.tokens = positive(limits.providerTokenCeiling, null, MAX_COMPLETION_TOKENS);
-          if (after.tokens <= (before.tokens || 0)) throw new Error('Extension must increase the provider token ceiling.');
-        }
-        if (after.deadline <= now || after.maxContinuations <= run.continuations || after.tokens && after.tokens <= run.managed.tokensUsed) throw new Error('Extended ceilings must exceed already consumed time, turns, and tokens.');
-        if (progress) { run.hardDeadline = after.deadline; run.hardMaxContinuations = after.maxContinuations; run.managed.providerTokenCeiling = after.tokens; }
-        else { run.deadline = after.deadline; run.maxContinuations = after.maxContinuations; run.managed.maxTokens = after.tokens; }
-        run.budgetExtensionHistory ||= [];
-        run.budgetExtensionHistory.push({ before, after, at: now, source: 'explicit_controller_extension' });
-      }
-      run.budgetWarnings = deliveryBudgetState(run, now).warnings;
-      if (run.state === 'budget_exhausted' && !managedBudgetReason(run, now)) {
-        run.state = 'paused'; run.reason = 'Continuation bounds changed; explicitly resume this same task.';
-      }
+    if (action === 'continuation_policy') {
+      if (!canChangeDeliveryContinuation(run)) throw new Error('Pause a managed task before changing its continuation policy.');
+      if (!['bounded', 'progress'].includes(continuationPolicy)) throw new Error('Select an explicit continuation policy.');
+      run.managed.continuationPolicy = continuationMode(continuationPolicy);
+      run.continuationPolicyHistory ||= [];
+      run.continuationPolicyHistory.push({ policy: continuationPolicy, at: now, source: 'explicit_controller_selection' });
       run.updatedAt = now;
       return record;
     }
@@ -1209,7 +1184,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       const question = run.managed?.understandingQuestion;
       if (run.managed?.phase !== 'needs_clarification' || run.state !== 'blocked' || !question || question.id !== questionId ||
           !text(answer, 1000) || typeof answer !== 'string' || answer.length > 1000) throw new Error('Session question changed or answer is empty; refresh its status.');
-      if (managedBudgetReason(run, now)) throw new Error('Original budget exhausted. Session cannot continue.');
+      continueAfterHumanDecision(run, now);
       const read = { kind: 'read', scope: 'task', summary: 'Re-examine the original conversation using the new user answer without changing files' };
       const plan = assessedPlan({ diagnosis: `Resolve the recorded question before any work: ${question.text}`,
         alternatives: [{ id: 'understand_answer', action: read,
@@ -1250,7 +1225,8 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       run.state = 'paused'; run.reason = 'Paused by user.';
     }
     else if (action === 'replan') {
-      if (!canReplanDelivery(run, provider, now)) throw new Error('Replanning needs a rejected assessed approval, a supported original-session channel, and remaining budget.');
+      if (!canReplanDelivery(run, provider, now)) throw new Error('Replanning needs a rejected assessed approval, a supported original-session channel, and fewer failures than the limit.');
+      continueAfterHumanDecision(run, now);
       const rejected = run.managed.pendingApproval;
       // Also cover denied records written by earlier versions before rejection
       // fingerprints existed; never re-authorize that exact action on upgrade.
@@ -1285,7 +1261,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       if (run.managed?.executionUncertain) { prepareRecoveryDiagnosis(run, now); run.blocker = null; }
       if (run.managed?.pendingApproval) throw new Error('Resolve the exact pending approval before resuming.');
       if (run.managed?.autonomyPolicy && run.managed.decision?.outcome === 'wait' && (run.managed.approvedAction?.id !== run.managed.decision.id || run.managed.approvedAction.dispatchedAt)) throw new Error('Selected action requires a fresh scoped user decision.');
-      if (managedBudgetReason(run, now)) throw new Error('Original budget exhausted. Loop cannot resume.');
+      continueAfterHumanDecision(run, now);
       if (run.managed?.approvedAction && run.recoveryCause === 'approved_action' && !run.managed.approvedAction.dispatchedAt && run.managed.capability !== 'live_hook' && run.managed.resumeChannel !== 'codex_app_server') {
         run.managed.approvedAction.dispatchedAt = now;
         run.managed.dispatches ||= [];
@@ -1308,7 +1284,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       if (!pending || pending.id !== approvalId || pending.denied || run.state !== 'blocked') throw new Error('Pending approval changed; refresh its status.');
       run.managed.notification = { key: `approval:${pending.id}`, kind: 'approval', message: `${action === 'approve' ? 'Approved' : 'Rejected'} ${pending.scope}.`, at: now };
       if (action === 'approve') {
-        if (managedBudgetReason(run, now)) throw new Error('Original budget exhausted. Task cannot resume.');
+        continueAfterHumanDecision(run, now);
         run.managed.pendingApproval = null;
         run.nextStep = run.checkpoint?.nextStep || run.nextStep;
         run.state = 'recovery_required'; run.recoveryCause = 'approved_action';
@@ -1351,11 +1327,10 @@ export async function reconcileRecords({ root = rootDirectory(), now = Date.now(
       }
       const activeTurn = run.managed &&
         (run.state === 'auto_resuming' || current.runtime?.isRunning === true || run.managed.executionAttempt?.phase === 'dispatching');
-      const budgetState = deliveryBudgetState(run, now, { checkProgress: !activeTurn });
-      run.budgetWarnings = budgetState.warnings;
-      if (budgetState.reason && !TERMINAL.has(run.state) && !['verification_pending', 'paused'].includes(run.state)) {
-        run.state = budgetState.reason.startsWith('No verified') ? 'paused' : 'budget_exhausted';
-        run.reason = budgetState.reason; run.updatedAt = now;
+      const stop = deliveryStop(run, now, { checkProgress: !activeTurn });
+      if (stop && !TERMINAL.has(run.state) && !['verification_pending', 'paused'].includes(run.state)) {
+        run.state = stoppedState(stop);
+        run.reason = stop.reason; run.updatedAt = now;
       }
       else if (run.state === 'active' && observed !== null && observed !== current.process?.identity && current.process?.identity === record.process?.identity) {
         run.state = 'recovery_required'; run.recoveryCause = 'process_exit'; run.reason = run.managed?.autoRecovery ? 'Observed provider process exited. Managed recovery is eligible for a bounded exact-session attempt.' : 'Observed provider process exited. Reopen the existing conversation and explicitly resume.'; run.updatedAt = now;

package/src/codex-plugins/simy/hooks/outcome-progress.mjs

@@ -27,6 +27,16 @@ function classifyBlockers(findings) {
   return blockers;
 }
 
+// Human review grants a new attempt window, not new proof. Keep the comparison
+// history so previously verified criteria cannot be presented as fresh progress.
+export function restartOutcomeProgressWindow(previous) {
+  if (!previous) return previous;
+  const nextActions = (previous.next_actions || []).filter(action => action !== "reassess_approach");
+  return { ...previous, no_progress_attempts: 0, stalled: false, stall_reason: null,
+    has_progress: false, newly_verified_ids: [], next_actions: nextActions,
+    next_action: nextActions[0] || "repair_or_verify" };
+}
+
 /**
  * Compare controller-owned independent observations against one frozen objective.
  * Evidence references identify proof; changing their paths/hashes is not progress.

package/src/codex-plugins/simy/skills/delivery-loop/SKILL.md

@@ -8,7 +8,7 @@ description: Continue an explicitly requested SIMY Delivery Loop in the current
 Use only when the user explicitly requests this skill or SIMY Delivery Loop for the current task. Installing this plugin does not opt a task in. Do not run SQM unless separately requested.
 
 1. Require the SIMY SessionStart hook context with the exact provider and session ID. If absent, explain how to install the SIMY plugin, review and enable its hooks with `/hooks`, and start a new conversation. Codex settings can be opened at `codex://settings`; a hooks subpage deep link is not guaranteed. Never change hook trust or bypass permissions yourself.
-2. For a regular Delivery Loop, use `simy delivery start --provider <provider> --session <exact-session-id> --objective '<user outcome and acceptance criteria>' --next-step '<concrete next action>'`. When the user explicitly asks for a managed task with durable acceptance tracking, add `--managed-file <task.json>` as described below. Default limits: 6 automatic continuations, 3 consecutive failures/missing checkpoints, 30 minutes. Set different finite limits only if the user requests them. Use the current working directory. Never invent a session ID, start another loop to reset limits, or resume a stopped loop without a user request.
+2. For a regular Delivery Loop, use `simy delivery start --provider <provider> --session <exact-session-id> --objective '<user outcome and acceptance criteria>' --next-step '<concrete next action>'`. When the user explicitly asks for a managed task with durable acceptance tracking, add `--managed-file <task.json>` as described below. The loop stops after 3 failures/missing checkpoints and pauses for review when no progress is verified; it does not limit elapsed time or turns. Set a different failure limit only if the user requests it. Use the current working directory. Never invent a session ID, start another loop to reset limits, or resume a stopped loop without a user request.
 3. Work in the current conversation with its normal permissions. Before ending each turn, submit a JSON checkpoint through standard input with `simy delivery checkpoint --provider <provider> --session <id> --file -` (for example, a shell heredoc). This updates SIMY state; it does not require writing a checkpoint file to the user's workspace. A file path remains supported when authorized.
 
 Checkpoint shapes:

package/src/delivery-hooks/command.js

@@ -21,15 +21,14 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
   if (action === 'activity') return runActivityCommand(args, { root, output });
   if (!action || action === '--help') {
     output('simy delivery activity [--watch] [--json] [--provider codex|claude] [--session ID] — local observations every 60 seconds; not productive time.');
-    output('Progress: --continuation-policy progress [--hard-max-minutes 1440] [--hard-max-continuations 50] [--provider-token-ceiling 15000000 (Codex only)]. Soft thresholds warn; approvals, missing usage and no verified progress still stop.');
+    output('A task stops after repeated failures, and pauses for review when no progress is confirmed. Resume starts a new progress window.');
     output('simy delivery continuation_policy --provider PROVIDER --session ID --task-id ID --continuation-policy bounded|progress');
-    output('simy delivery extend --provider PROVIDER --session ID --task-id ID --hard-max-minutes N|--hard-max-continuations N|--provider-token-ceiling N');
-    output('simy delivery continue --provider codex|claude --session ID [--max-no-progress-minutes 30] [--max-tokens N (Codex only)]\nsimy delivery dependency_ready --provider PROVIDER --session ID --task-id ID --wait-id ID --answer TEXT\nsimy delivery handoff|handoff_cancel --provider codex --session ID --task-id ID --target-session ID');
-    output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--max-continuations 6] [--max-failures 3] [--max-minutes 30]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Manual managed start requires an acceptance specification. Desktop Continue infers the original conversation goal first. Resume preserves original task identity, usage history and approvals; local time, turn and token counters do not stop work.');
+    output('simy delivery continue --provider codex|claude --session ID [--max-no-progress-minutes 30] [--max-failures 3]\nsimy delivery dependency_ready --provider PROVIDER --session ID --task-id ID --wait-id ID --answer TEXT\nsimy delivery handoff|handoff_cancel --provider codex --session ID --task-id ID --target-session ID');
+    output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--max-failures 3]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Manual managed start requires an acceptance specification. Desktop Continue infers the original conversation goal first. Resume preserves original task identity, history and approvals.');
     return 0;
   }
   const options = {};
-  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-continuations', 'max-failures', 'max-minutes', 'max-no-progress-minutes', 'max-tokens', 'continuation-policy', 'hard-max-minutes', 'hard-max-continuations', 'provider-token-ceiling', 'file', 'managed-file', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
+  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
   for (let i = 0; i < args.length; i += 2) {
     const key = args[i]?.replace(/^--/, '');
     if (!args[i]?.startsWith('--') || !allowed.has(key) || args[i + 1] === undefined || Object.hasOwn(options, key)) throw new Error('Invalid delivery option. Use simy delivery --help.');
@@ -39,9 +38,8 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
   let result;
   if (action === 'status') result = (await listRecords(root)).filter(r => (!options.provider || r.provider === options.provider) && (!options.session || r.session === options.session));
   else if (action === 'continue') result = await continueSession({ ...base, autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
-    ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes'],
-      ['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling'],
-      ['max-no-progress-minutes', 'maxNoProgressMinutes'], ['max-tokens', 'maxTokens']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
+    ...Object.fromEntries([['max-failures', 'maxFailures'], ['max-no-progress-minutes', 'maxNoProgressMinutes']]
+      .filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
   else if (action === 'handoff') result = await handoffSession({ ...base, taskId: options['task-id'], targetSession: options['target-session'] });
   else if (action === 'handoff_cancel') result = await cancelHandoffSession({ ...base, taskId: options['task-id'], targetSession: options['target-session'] });
   else if (action === 'start') {
@@ -51,22 +49,20 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
       if (Buffer.byteLength(data) > 64 * 1024) throw new Error('Managed task specification exceeds 64 KiB.');
       managed = JSON.parse(data);
     }
-    if (options['max-tokens'] !== undefined || options['max-no-progress-minutes'] !== undefined) {
-      if (!managed || typeof managed !== 'object') throw new Error('Managed budget flags require --managed-file; use delivery continue for context-first supervision.');
-      managed = { ...managed, ...Object.fromEntries([['max-tokens', 'maxTokens'], ['max-no-progress-minutes', 'maxNoProgressMinutes']]
-        .filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) };
+    if (options['max-no-progress-minutes'] !== undefined) {
+      if (!managed || typeof managed !== 'object') throw new Error('--max-no-progress-minutes requires --managed-file; use delivery continue for context-first supervision.');
+      managed = { ...managed, maxNoProgressMinutes: Number(options['max-no-progress-minutes']) };
     }
     result = await startDelivery({ ...base, objective: options.objective, nextStep: options['next-step'], managed, continuationPolicy: options['continuation-policy'],
-    ...Object.fromEntries([['max-continuations', 'maxContinuations'], ['max-failures', 'maxFailures'], ['max-minutes', 'maxMinutes'],
-      ['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
+    ...(options['max-failures'] === undefined ? {} : { maxFailures: Number(options['max-failures']) }) });
   }
   else if (action === 'checkpoint') {
     if (!options.file) throw new Error('--file is required.');
     const data = options.file === '-' ? await readCheckpointInput(input) : await readFile(options.file, 'utf8');
     if (Buffer.byteLength(data) > 64 * 1024) throw new Error('Checkpoint exceeds 64 KiB.');
     result = await checkpointDelivery({ ...base, checkpoint: JSON.parse(data) });
-  } else if (['stop', 'pause', 'resume', 'replan', 'approve', 'reject', 'set_policy', 'dependency_ready', 'extend', 'continuation_policy'].includes(action)) result = await controlDelivery({ ...base, taskId: options['task-id'], approvalId: options['approval-id'], autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
-    limits: Object.fromEntries([['hard-max-minutes', 'hardMaxMinutes'], ['hard-max-continuations', 'hardMaxContinuations'], ['provider-token-ceiling', 'providerTokenCeiling']].filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])), waitId: options['wait-id'], answer: options.answer, action });
+  } else if (['stop', 'pause', 'resume', 'replan', 'approve', 'reject', 'set_policy', 'dependency_ready', 'continuation_policy'].includes(action)) result = await controlDelivery({ ...base, taskId: options['task-id'], approvalId: options['approval-id'], autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
+    waitId: options['wait-id'], answer: options.answer, action });
   else if (action === 'verify') result = await verifyDelivery({ ...base, taskId: options['task-id'], criterionId: options['criterion-id'] });
   else throw new Error('Unknown delivery command.');
   output(JSON.stringify(result, null, 2));

package/src/delivery-hooks/desktop.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { canReplanDelivery, deliveryBudgetState, managedBudgetReason, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { canReplanDelivery, deliveryStop, deliveryStopBlocksResume, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { originalSessionTarget } from '../session-supervision/original-session-target.js';
 
 export const HOOK_SETUP = Object.freeze({
@@ -31,17 +31,11 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
     runs: records.filter(r => r.run).sort((a, b) => b.run.updatedAt - a.run.updatedAt).slice(0, 30).map(r => ({
       provider: r.provider, session: r.session, originalSessionTarget: originalSessionTarget(r.provider, r.session),
       objective: r.run.objective, state: r.run.state, reason: r.run.reason,
-      continuations: r.run.continuations, maxContinuations: null, deadline: null,
-      localExecutionLimits: false,
+      continuations: r.run.continuations,
       continuationPolicy: r.run.managed?.continuationPolicy || 'bounded',
       startedAt: r.run.startedAt,
-      continuationLimits: deliveryBudgetState(r.run, now),
-      canChangeContinuation: false,
-      hardDeadline: null, hardMaxContinuations: null,
-      budgetWarnings: deliveryBudgetState(r.run, now).warnings,
-      budgetCapability: r.run.managed?.budgetCapability || null,
+      stopCode: deliveryStop(r.run, now)?.code ?? null,
       outcomeProgress: r.run.managed?.outcomeProgress || null,
-      budgetExtensionHistory: r.run.budgetExtensionHistory || [],
       needsAttention: ['blocked', 'failed', 'recovery_required', 'budget_exhausted', 'verification_pending'].includes(r.run.state), updatedAt: r.run.updatedAt,
       managed: Boolean(r.run.managed), taskId: r.run.managed?.taskId || null, actionId: r.run.managed?.actionId || null,
       actionDueAt: r.run.managed?.actionDueAt ?? null,
@@ -56,8 +50,6 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
       handoff: r.run.managed?.handoff || null, threadHistory: r.run.managed?.threadHistory || [],
       progressBudget: r.run.managed ? { minutes: r.run.managed.maxNoProgressMinutes, lastVerifiedProgressAt: r.run.managed.lastVerifiedProgressAt,
         attempts: r.run.managed.noProgress, maxAttempts: r.run.managed.maxNoProgress } : null,
-      tokenBudget: r.run.managed?.maxTokens ? { limit: r.run.managed.maxTokens, used: r.run.managed.tokensUsed,
-        usageAvailable: r.run.managed.usageAvailable, source: 'provider_observed', dollarCost: null } : null,
       pendingApproval: r.run.managed?.pendingApproval || null,
       autonomyPolicy: r.run.managed?.autonomyPolicy || null, plan: r.run.managed?.plan || null,
       decision: r.run.managed?.decision || null, decisionHistory: r.run.managed?.decisionHistory || [],
@@ -77,14 +69,14 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
         r.run.managed.resumeChannel === 'codex_app_server' && r.run.managed.autoRecovery),
       canResume: ['blocked', 'recovery_required', 'paused'].includes(r.run.state) && r.run.managed?.phase !== 'needs_clarification' &&
         !r.run.managed?.pendingApproval && !r.run.managed?.dependencyWait && !['pending', 'pending_received', 'transferred'].includes(r.run.managed?.handoff?.status) &&
-        !managedBudgetReason(r.run, now),
+        !deliveryStopBlocksResume(r.run, now),
       canApprove: r.run.state === 'blocked' && Boolean(r.run.managed?.pendingApproval) && !r.run.managed.pendingApproval.denied,
       canReject: r.run.state === 'blocked' && Boolean(r.run.managed?.pendingApproval) && !r.run.managed.pendingApproval.denied,
       canReplan: canReplanDelivery(r.run, r.provider, now),
       canAnswer: r.run.managed?.phase === 'needs_clarification' && r.run.state === 'blocked' && Boolean(r.run.managed.understandingQuestion?.id) &&
-        !managedBudgetReason(r.run, now),
+        !deliveryStopBlocksResume(r.run, now),
       canResolveDependency: r.run.state === 'blocked' && r.run.blocker === 'external_dependency' && Boolean(r.run.managed?.dependencyWait?.id) &&
-        !managedBudgetReason(r.run, now) && !['pending', 'pending_received', 'transferred'].includes(r.run.managed?.handoff?.status),
+        !deliveryStopBlocksResume(r.run, now) && !['pending', 'pending_received', 'transferred'].includes(r.run.managed?.handoff?.status),
       canSetPolicy: Boolean(r.run.managed?.autonomyPolicy) && !['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(r.run.state),
     })),
   };

package/src/delivery-hooks/supervisor.js

@@ -1,14 +1,14 @@
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { dirname } from 'node:path';
-import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, deliveryBudgetState, listRecords, readRecord, managedBudgetReason, managedDispatchDeadline, notifyState, processIdentity, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, deliveryProgressContext, deliveryStop, listRecords, readRecord, managedBudgetReason, notifyState, processIdentity, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { resolveBackendExecutable } from '../backend-executable.js';
 import { executeCodexAppServer } from '../session-supervision/codex-app-server.js';
 import { acquireWorkspaceLease, leaseOwnerDead } from '../session-supervision/workspace-lease.js';
 
 const MAX_OUTPUT = 64 * 1024;
 const SAFE_PROVIDER_CODES = new Set(['identity', 'permission_narrowed', 'permission_restore', 'turn_failed', 'checkpoint',
-  'closed', 'timeout', 'unsupported', 'unavailable', 'manual_provider_action', 'checkpoint_rejected', 'provider_approval', 'usage_unavailable']);
+  'closed', 'timeout', 'unsupported', 'unavailable', 'manual_provider_action', 'checkpoint_rejected', 'provider_approval']);
 function safeProviderCode(code) { return SAFE_PROVIDER_CODES.has(code) ? code : 'provider_error'; }
 function providerFailureReason(code) {
   if (code === 'permission_restore') return 'Codex sandbox restoration could not be confirmed; inspect the original conversation before resuming.';
@@ -40,9 +40,8 @@ async function assertActiveLease(root, provider, session, leaseId, signal, curre
   if (signal?.aborted || current?.run?.state !== 'auto_resuming' || current.run.managed?.resumeLease?.id !== leaseId) {
     throw new Error('Managed recovery lease changed before provider dispatch.');
   }
-  if (currentTime() >= managedDispatchDeadline(current.run)) throw new Error('Managed recovery deadline expired before provider dispatch.');
   if (!automaticContinuationAllowed(current)) throw new Error('Automatic continuation was disabled before provider dispatch.');
-  if (managedBudgetReason(current.run, currentTime())) throw new Error('Managed progress budget expired before provider dispatch.');
+  if (managedBudgetReason(current.run, currentTime())) throw new Error('Managed task stopped before provider dispatch.');
   const managed = current.run.managed;
   const approvedWait = managed.decision?.outcome === 'wait' && managed.approvedAction?.id === managed.decision.id && !managed.approvedAction.dispatchedAt;
   if (managed.autonomyPolicy && ((managed.decision?.outcome === 'wait' && !approvedWait) || managed.resumeLease.decisionId !== managed.decision?.id)) throw new Error('Assessed action changed before provider dispatch.');
@@ -80,13 +79,11 @@ export async function executeCodexResume(record, { signal, root, leaseId, execut
     lastDependencyResolution: run.managed.lastDependencyResolution,
     remainingWork: run.managed.remainingWork, acceptanceCriteria: run.managed.acceptanceCriteria, proposedAction: run.managed.proposedAction,
     currentDecision: run.managed.autonomyPolicy ? run.managed.decision : undefined, diagnosis: run.managed.plan?.diagnosis,
-    budgets: { ...deliveryBudgetState(run), continuations: run.continuations, failures: run.failures, maxFailures: run.maxFailures,
-      localExecutionLimits: false } };
+    progress: deliveryProgressContext(run) };
   const prompt = run.managed.autonomyPolicy ? `Continue the existing SIMY managed task in this exact session. Context: ${JSON.stringify(context)}\nExecute ONLY currentDecision.action. Its expectedVerification and rollback apply to this turn. Stay within provider permissions. End with ONLY one JSON checkpoint. ${assessedCheckpointContract(run.managed.decision)} Do not write SIMY state directly.` : `Continue the existing SIMY managed task in this exact session. Context: ${JSON.stringify(context)}\nStay within the original task and provider permissions. End with ONLY one JSON object: {"status":"in_progress|completed|blocked|error","summary":"...","nextStep":"...","remainingWork":"...","proposedAction":{"kind":"read|local_edit|local_test|external|destructive|scope_change|unknown","scope":"...","summary":"..."},"evidence":[],"acceptanceMet":false}. For blocked include blocker (authorization, missing_information, external_dependency), and for authorization include approval {kind,scope,summary}. Do not claim completion without checking frozen acceptance. SIMY independently verifies supported criteria. Do not write SIMY state directly. If approval or input is needed, return blocked and stop.`;
   const sandbox = run.managed.autonomyPolicy && run.managed.decision?.action.kind === 'read' ? 'read-only' : run.managed.autoRecoverySandbox;
   const args = ['exec', '--json', '--skip-git-repo-check', '-s', sandbox, '-m', run.managed.resumeModel, 'resume', record.session, prompt];
   if (signal?.aborted) throw new Error('Managed recovery cancelled before provider dispatch.');
-  if (currentTime() >= managedDispatchDeadline(run)) throw new Error('Managed recovery deadline expired before provider dispatch.');
   await beforeDispatch();
   if (signal?.aborted) throw new Error('Managed recovery cancelled before provider dispatch.');
 
@@ -196,9 +193,9 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
       const approved = live?.managed?.decision?.outcome === 'wait' && ['read', 'local_edit', 'local_test'].includes(live.managed.decision.action?.kind) &&
         live.managed.approvedAction?.id === live.managed.decision.id && !live.managed.approvedAction.dispatchedAt;
       if (!live?.managed?.autoRecovery || live.state !== 'recovery_required' || !allowedCause || live.managed.pendingApproval || live.managed.autonomyPolicy && (!live.managed.decision || live.managed.decision.outcome === 'wait' && !approved) || appChannel && live.managed.nextAttemptAt > currentTime()) return current;
-      const budgetReason = managedBudgetReason(live, currentTime());
-      if (budgetReason) {
-        live.state = budgetReason.startsWith('No verified') ? 'paused' : 'failed'; live.reason = budgetReason; live.updatedAt = currentTime(); notifyState(live, live.updatedAt); return current;
+      const stop = deliveryStop(live, currentTime());
+      if (stop) {
+        live.state = stop.code === 'failure_limit' ? 'failed' : 'paused'; live.reason = stop.reason; live.updatedAt = currentTime(); notifyState(live, live.updatedAt); return current;
       }
       live.state = 'auto_resuming'; live.managed.resumeLease = { id: leaseId, claimedAt: currentTime(), checkpointRevision: live.revision, decisionId: live.managed.decision?.id || null,
         owner: { pid: process.pid, identity: ownerIdentity } };
@@ -217,7 +214,6 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
     let result;
     let resource;
     let lastActivityAt = currentTime();
-    let usage = null;
     let dispatched = false, waitingForTool = false;
     const controller = new AbortController();
     const abort = () => controller.abort();
@@ -262,10 +258,6 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         const runner = execute || (appServer ? executeCodexAppServer : executeCodexResume);
         result = await runner(claimed, { signal: controller.signal, root, leaseId, currentTime, leaseMonitored: true,
           onActivity: observation => { lastActivityAt = currentTime(); waitingForTool = observation?.waitingForTool === true; },
-          onUsage: observed => {
-            usage = observed;
-
-          },
           beforeDispatch: async providerSandbox => {
             await assertActiveLease(root, record.provider, record.session, leaseId, controller.signal, currentTime);
             await updateRecord(root, record.provider, record.session, current => {
@@ -298,9 +290,6 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         errorCode: error?.code || 'provider_error', restorationUnverified: error?.restorationUnverified === true }; }
     finally { stopWatch(); signal?.removeEventListener('abort', abort); }
     if (controller.signal.aborted) result = { ...result, code: -2, cancelled: true };
-    if (deliveryBudgetState(claimed.run).tokenCeiling && !usage && !result.busy && dispatched) {
-      result = { ...result, usageUnavailable: true };
-    }
     if (result.code === 0) {
       try {
         await checkpointDelivery({ root, provider: record.provider, session: record.session, cwd: record.cwd,
@@ -327,14 +316,6 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
       const live = current?.run;
       if (live?.managed?.resumeLease?.id !== leaseId) return current;
       delete live.managed.resumeLease;
-      delete live.managed.usageBlocked;
-      if (usage) {
-        live.managed.tokensUsed = (live.managed.tokensUsed || 0) + usage.tokens;
-        live.managed.usageAvailable = true;
-        live.managed.lastUsage = { ...usage, attemptId: leaseId };
-      } else if (!result.busy && deliveryBudgetState(live).tokenCeiling && dispatched) {
-        live.managed.usageAvailable = false; live.managed.usageBlocked = true;
-      }
       const attempt = live.managed.executionAttempt;
       if (!result.busy && attempt?.phase === 'dispatching' && attempt.action?.kind !== 'read') live.managed.executionUncertain = {
         attemptId: leaseId, decisionId: attempt.decisionId, action: attempt.action, at: Date.now() };
@@ -351,13 +332,8 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
         if (live.state !== 'auto_resuming') live.reason = `${String(live.reason || '').slice(0, 400)} ${live.managed.providerWarning}`.trim();
       }
       if (live.state !== 'auto_resuming') {
-        if (live.managed.usageBlocked && !['stopped', 'paused', 'completed', 'reported_done'].includes(live.state)) {
-          live.managed.autoRecovery = false;
-          live.reason = `${live.reason} Provider token usage is unavailable; further budgeted turns are blocked.`;
-        }
         live.updatedAt = Date.now(); notifyState(live, live.updatedAt); return current;
       }
-      live.budgetWarnings = deliveryBudgetState(live).warnings;
       if (result.busy) {
         if (result.accessDenied && dispatched) {
           // The final guard rejected before the provider call. Keep its one-shot approval unused.

package/src/desktop-host.js

@@ -9,6 +9,7 @@ import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
 import { controlDelivery, verifyDelivery, createRecordReader } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
+import { createStopNotifier } from "./session-supervision/stop-notifications.js";
 import { answerSession, continueSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
 import { createContinuationAnalysisManager } from "./session-supervision/analysis-manager.js";
 import { analyzeContinuation, readContinuationContext } from "./session-supervision/continuation-analysis.js";
@@ -95,6 +96,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const makeActionAssociations = () => (dependencies.createActionAssociationHost || createActionAssociationHost)({ root: join(root, "delivery-hooks"), sessionRoot: root, webOrigin, list: () => recordReader.list(), onChange: () => { if (!closed) setImmediate(() => { void publish().catch(() => {}); }); } });
   let actionAssociations = makeActionAssociations();
   const statisticsCache = new Map();
+  const stopNotifier = createStopNotifier({ emit: event => { if (!closed && !relay) emit(event); } });
   let currentAccess = { state: 'checking', organizationId: null, organizationName: null };
   const accessScope = access => JSON.stringify([access?.revision ?? null, access?.organizationId ?? null]);
   const setAccessSnapshot = async access => {
@@ -105,7 +107,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       discoveryController?.abort();
       sessionRefreshAgain = Boolean(sessionRefresh) && desktopAccessReady(currentAccess);
       for (const item of sessionStatus.sessions) automaticContinuation?.revoke(item.provider, item.session);
-      sessionStatus = { sessions: [], providers: {}, refreshedAt: null }; sessionRefreshedAt = 0;
+      sessionStatus = { sessions: [], providers: {}, refreshedAt: null, initialLoading: true }; sessionRefreshedAt = 0;
       await analysisManager?.update([]);
     }
     return currentAccess;
@@ -134,7 +136,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     beforeClaim: record => actionAssociations.prepareCached?.(record) || record });
   let shuttingDown = null;
   let commands;
-  let sessionStatus = { sessions: [], providers: { codex: { discovery: "loading", reason: null }, claude: { discovery: "loading", reason: null } }, refreshedAt: null };
+  let sessionStatus = { sessions: [], providers: { codex: { discovery: "loading", reason: null }, claude: { discovery: "loading", reason: null } }, refreshedAt: null, initialLoading: true };
   let sessionRefresh = null, sessionRefreshedAt = 0, sessionRefreshAgain = false, discoveryController = null, discoveryStopped = false;
   const stopDiscovery = async ({ drain = false } = {}) => {
     discoveryController?.abort();
@@ -158,8 +160,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
             sessionRefreshAgain = desktopAccessReady(latestAccess);
             return;
           }
-          await analysisManager.update(value.sessions); sessionStatus = value; sessionRefreshedAt = Date.now(); })
-        .catch(() => { if (closed || relay || controller.signal.aborted) return; sessionStatus = { ...sessionStatus, providers: { codex: { discovery: "unavailable", reason: "Conversation discovery unavailable." }, claude: { discovery: "unavailable", reason: "Conversation discovery unavailable." } } }; sessionRefreshedAt = Date.now(); })
+          await analysisManager.update(value.sessions); sessionStatus = { ...value, initialLoading: false }; sessionRefreshedAt = Date.now(); })
+        .catch(() => { if (closed || relay || controller.signal.aborted) return; sessionStatus = { ...sessionStatus, initialLoading: false, providers: { codex: { discovery: "unavailable", reason: "Conversation discovery unavailable." }, claude: { discovery: "unavailable", reason: "Conversation discovery unavailable." } } }; sessionRefreshedAt = Date.now(); })
         .finally(() => { if (discoveryController === controller) discoveryController = null; sessionRefresh = null; if (sessionRefreshAgain && !closed && !relay) { sessionRefreshAgain = false; refreshSessions(true); }
           if (!closed) setImmediate(() => { void publish().catch(() => {}); }); });
     }
@@ -244,6 +246,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       }
       await analysisManager.updateProviderStatuses?.(status.providers);
       const records = await recordReader.list();
+      stopNotifier.observe(records);
       const projection = await actionAssociations.beginProjection?.({ records });
       status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: projection?.records || records }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
       await actionAssociations.decorate(status.deliveryHooks, projection);
@@ -573,9 +576,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
         else if (action === "codex_hooks" || action === "claude_hooks") {
           const provider = action === "codex_hooks" ? "codex" : "claude";
           await (dependencies.openHookSettings || openHookSetup)(provider);
-        } else if (["delivery_stop", "delivery_resume", "delivery_pause", "delivery_approve", "delivery_reject", "delivery_replan", "delivery_set_policy", "delivery_dependency_ready", "delivery_extend", "delivery_continuation_policy"].includes(action)) {
+        } else if (["delivery_stop", "delivery_resume", "delivery_pause", "delivery_approve", "delivery_reject", "delivery_replan", "delivery_set_policy", "delivery_dependency_ready", "delivery_continuation_policy"].includes(action)) {
           await controlDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
-            taskId: command.taskId, approvalId: command.approvalId, autonomyPolicy: command.autonomyPolicy, limits: command.limits, continuationPolicy: command.continuationPolicy, waitId: command.waitId, answer: command.answer, action: action.slice("delivery_".length) });
+            taskId: command.taskId, approvalId: command.approvalId, autonomyPolicy: command.autonomyPolicy, continuationPolicy: command.continuationPolicy, waitId: command.waitId, answer: command.answer, action: action.slice("delivery_".length) });
         } else if (action === "delivery_verify") {
           await verifyDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
             taskId: command.taskId, criterionId: command.criterionId });
@@ -591,7 +594,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           }
           if (command.enabled) await authorizeWork(commandScope);
           await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({ root: join(root, 'delivery-hooks'),
-            provider: command.provider, session: command.session, enabled: command.enabled, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling });
+            provider: command.provider, session: command.session, enabled: command.enabled, continuationPolicy: command.continuationPolicy });
           if (!command.enabled) automaticContinuation.revoke(command.provider, command.session);
           // Acknowledge the durable preference before discovery or analysis.
           emit({ type: "result", id: command.id, ok: true });
@@ -626,8 +629,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         } else if (action === "session_enroll") {
           await (dependencies.enrollSession || enrollSession)({ root: join(root, "delivery-hooks"), provider: command.provider,
             session: command.session, objective: command.objective, acceptanceCriteria: command.acceptanceCriteria,
-            autonomyPolicy: command.autonomyPolicy, maxMinutes: command.maxMinutes,
-            maxContinuations: command.maxContinuations, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling });
+            autonomyPolicy: command.autonomyPolicy, maxFailures: command.maxFailures, maxNoProgressMinutes: command.maxNoProgressMinutes, continuationPolicy: command.continuationPolicy });
           await refreshSessions(true);
         } else if (action === "session_analyze") {
           const candidate = await selectedSession(command, { reuseDiscovery: true });
@@ -639,9 +641,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await continueAnalyzedSession({ root: join(root, 'delivery-hooks'), candidate, manager,
             readContext: dependencies.readContinuationContext || readContinuationContext,
             enroll: async options => { await authorizeWork(commandScope); return guardedEnroll(options); }, beforeEnroll: () => authorizeWork(commandScope),
-            settings: { autonomyPolicy: command.autonomyPolicy, maxMinutes: command.maxMinutes,
-              maxContinuations: command.maxContinuations, maxFailures: command.maxFailures,
-              maxNoProgressMinutes: command.maxNoProgressMinutes, maxTokens: command.maxTokens, continuationPolicy: command.continuationPolicy, hardMaxMinutes: command.hardMaxMinutes, hardMaxContinuations: command.hardMaxContinuations, providerTokenCeiling: command.providerTokenCeiling } });
+            settings: { autonomyPolicy: command.autonomyPolicy, maxFailures: command.maxFailures,
+              maxNoProgressMinutes: command.maxNoProgressMinutes, continuationPolicy: command.continuationPolicy } });
           await refreshSessions(true);
         } else if (action === "session_answer") {
           await (dependencies.answerSession || answerSession)({ root: join(root, "delivery-hooks"), provider: command.provider,

package/src/session-supervision/action-association-host.js

@@ -160,7 +160,7 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
       if (closed) return;
       const managed = record.run.managed, job = managed.actionAssociation?.job;
       if (job && !managed.resumeLease && (!expected || TERMINAL.has(record.run.state) || ['paused', 'blocked'].includes(record.run.state) || record.run.state === 'recovery_required' && record.run.recoveryCause !== 'session_supervision' ||
-          managedBudgetReason(record.run, now()) || now() >= record.run.deadline || record.run.continuations >= record.run.maxContinuations ||
+          managedBudgetReason(record.run, now()) ||
           managed.understandingRevision !== job.understandingRevision || record.run.revision !== job.runRevision || managed.actionAssociation.invalidated)) {
         await cancelActionAssociation({ root, ...identity(record), expectedJobId: job.id, now: now() });
       }

package/src/session-supervision/action-association.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { listRecords, updateRecord, TERMINAL } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { listRecords, managedBudgetReason, updateRecord, TERMINAL } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { associationSignals, associationRevision } from '../codex-plugins/simy/hooks/action-association.mjs';
 export { associationSignals, associationRevision, associationContract, validateAssociationResult } from '../codex-plugins/simy/hooks/action-association.mjs';
 
@@ -25,7 +25,7 @@ export async function queueActionAssociation({ root, provider, session, taskId,
     await assertScope(validate);
     const run = record?.run, managed = run?.managed;
     if (!managed || managed.taskId !== taskId || run.revision !== expectedRevision) return record;
-    if (!stable(run) || now >= run.deadline || run.continuations >= run.maxContinuations) {
+    if (!stable(run) || managedBudgetReason(run, now)) {
       if (!managed.actionAssociation?.job && !managed.actionAssociation?.outbox && !managed.actionAssociation?.manualOverride) managed.actionAssociation = { ...managed.actionAssociation, status: 'waiting_boundary', retryOn: 'original_session_safe_boundary', updatedAt: now };
       return record;
     }

package/src/session-supervision/codex-app-server.js

@@ -2,7 +2,7 @@ import { associationContract } from '../codex-plugins/simy/hooks/action-associat
 import { spawn } from 'node:child_process';
 import { realpath } from 'node:fs/promises';
 import { CODEX_WRITER_LOCK_MINIMUM_VERSION, compareVersions, inspectBackendExecutable } from '../backend-executable.js';
-import { assessedCheckpointContract, deliveryBudgetState, understandingCheckpointContract } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { assessedCheckpointContract, deliveryProgressContext, understandingCheckpointContract } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { boundConversation, boundProviderGoal, textContent } from './conversation-context.js';
 import { JsonDataUrlFilter } from './json-data-url-filter.js';
 
@@ -394,7 +394,7 @@ export function isCodexWriterBusy(error) {
   return error instanceof CodexAppServerError && error.code === -32600 && /already has an active writer/i.test(error.message);
 }
 
-export async function executeCodexAppServer(record, { openClient = openCodexAppServer, signal, beforeDispatch = async () => {}, onActivity = () => {}, onUsage = () => {} } = {}) {
+export async function executeCodexAppServer(record, { openClient = openCodexAppServer, signal, beforeDispatch = async () => {}, onActivity = () => {} } = {}) {
   const run = record.run, decision = run.managed?.decision;
   if (!decision || !run.managed.autonomyPolicy) throw new CodexAppServerError('decision', 'An assessed action is required before Codex dispatch.');
   if (!['read', 'local_edit', 'local_test'].includes(decision.action?.kind)) throw new CodexAppServerError('manual_provider_action', 'This action must be completed in the original provider conversation.');
@@ -405,7 +405,6 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
   const client = await openClient({ signal });
   let originalSandbox = null, overrideStarted = false, activeTurnId = null, turnCompleted = false, turnStart = null;
   let primaryError = null;
-  let usage = null, lastTotal = null;
   try {
     const metadata = await readCodexSession(client, record.session);
     if (await realpath(metadata.cwd) !== record.cwd || metadata.model !== run.managed.resumeModel) throw new CodexAppServerError('identity', 'Codex session workspace or model changed.');
@@ -422,8 +421,7 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
       enrolledScopes: run.managed.approvalScopes,
       lastDependencyResolution: run.managed.lastDependencyResolution,
       ...(authorizedWait ? { approvedAction: { approvalId: approved.id, action: approved.action, oneShot: true } } : {}),
-      budgets: { ...deliveryBudgetState(run), continuations: run.continuations, failures: run.failures, maxFailures: run.maxFailures,
-        localExecutionLimits: false } };
+      progress: deliveryProgressContext(run) };
     const approvalInstruction = authorizedWait ? `SIMY recorded a matching, one-shot scoped user approval ${approved.id} for this exact selected action. The decision outcome "wait" describes its pre-approval assessment; the approved action is authorized now. Execute it once, then report what actually happened. ` : '';
     const prompt = run.managed.phase === 'action_association' ? associationContract(run.managed.actionAssociation.job) : run.managed.phase === 'understanding' ? `Understand the ORIGINAL user request in this exact Codex conversation. This first/clarifying turn is read-only and must not perform task work. Context: ${JSON.stringify({ ...context, priorUnderstanding: run.managed.sessionUnderstanding, userAnswer: run.managed.understandingAnswer })}\n${understandingCheckpointContract(decision)} Do not write SIMY state directly.` : `Continue this existing SIMY managed task in the exact Codex conversation. Context: ${JSON.stringify(context)}\n${approvalInstruction}Execute ONLY the selected decision action. Do not perform any action from the NEXT plan in this turn. For a next local action within the enrolled task use the exact scope "task"; do not relabel external, broad, or destructive work as local. Preserve provider permissions. End with one JSON checkpoint. ${assessedCheckpointContract(decision)} Do not write SIMY state directly.`;
     const initialSandbox = run.managed.providerSandbox || resumed.sandbox;
@@ -439,21 +437,12 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
       let turnId = null, completion = null, settled = false;
       const messages = new Map();
       const activeTools = new Set();
-      const earlyUsage = [];
       const earlyActivity = [];
       const observeActivity = (method, params) => {
         if (method === 'item/started' && ['commandExecution', 'mcpToolCall', 'webSearch', 'fileChange'].includes(params.item?.type)) activeTools.add(params.item.id);
         if (method === 'item/completed') activeTools.delete(params.item?.id);
         onActivity({ waitingForTool: activeTools.size > 0 });
       };
-      const observeUsage = params => {
-        const total = params.tokenUsage?.total?.totalTokens, last = params.tokenUsage?.last?.totalTokens;
-        if (!Number.isSafeInteger(total) || total < 0 || !Number.isSafeInteger(last) || last < 0 || last > total) return;
-        if (lastTotal === null) usage = { source: 'codex_app_server', tokens: last, observedAt: Date.now() };
-        else usage.tokens += Math.max(0, total - lastTotal);
-        lastTotal = Math.max(lastTotal ?? 0, total);
-        onUsage({ ...usage });
-      };
       const cleanup = () => { unsubscribe(); signal?.removeEventListener('abort', cancelled); client.child.removeListener('close', closed); };
       const finish = (error, value) => { if (settled) return; settled = true; cleanup(); if (error) reject(error); else resolve(value); };
       const cancelled = () => finish(new CodexAppServerError('cancelled', 'Codex turn was cancelled.'));
@@ -474,10 +463,6 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
           if (turnId) observeActivity(method, params);
         } else if (!turnId && typeof params.turnId === 'string' && earlyActivity.length < 100) earlyActivity.push({ method, turnId: params.turnId,
           item: { id: params.item?.id, type: params.item?.type } });
-        if (method === 'thread/tokenUsage/updated') {
-          if (turnId && params.turnId === turnId) observeUsage(params);
-          else if (!turnId && earlyUsage.length < 100) earlyUsage.push({ turnId: params.turnId, tokenUsage: params.tokenUsage });
-        }
         if (method === 'item/completed' && params.item?.type === 'agentMessage' && typeof params.item.text === 'string' && typeof params.turnId === 'string') messages.set(params.turnId, params.item.text);
         if (method === 'turn/completed') { completion = params; if (params.turn?.id === turnId) turnCompleted = true; complete(); }
       });
@@ -487,14 +472,13 @@ export async function executeCodexAppServer(record, { openClient = openCodexAppS
       turnStart = client.request('turn/start', { threadId: record.session, input: [{ type: 'text', text: prompt }], cwd: record.cwd,
         model: run.managed.resumeModel, sandboxPolicy })
         .then(response => { turnId = response?.turn?.id; activeTurnId = turnId; if (!turnId) finish(new CodexAppServerError('turn_failed', 'Codex did not start a turn.')); else {
-          for (const params of earlyUsage) if (params.turnId === turnId) observeUsage(params);
           for (const params of earlyActivity) if (params.turnId === turnId) observeActivity(params.method, params);
           complete();
         } })
         .catch(error => finish(error));
     });
     const checkpoint = await done;
-    return { code: 0, checkpoint, usage };
+    return { code: 0, checkpoint };
   } catch (error) {
     primaryError = error;
     throw error;

package/src/session-supervision/handoff.js

@@ -12,7 +12,8 @@ function unsettled(managed) {
 }
 function exactSource(record, taskId, targetSession, now, allowStoppedPending = false) {
   if (!record?.run?.managed || !record.admission || record.admission.session !== record.session || record.admission.cwd !== record.cwd || record.run.managed.taskId !== taskId) throw new Error('Exact managed task is unavailable.');
-  if (now !== undefined && managedBudgetReason(record.run, now)) throw new Error('Original task budget exhausted; handoff cannot restore it.');
+  const stopReason = now === undefined ? null : managedBudgetReason(record.run, now);
+  if (stopReason) throw new Error(`${stopReason} Resume it in its original conversation before handing it off.`);
   const prior = record.run.managed.handoff;
   const transfer = prior?.status === 'received' ? null : prior;
   if (transfer && transfer.targetSession !== targetSession) throw new Error('A different handoff is already recorded.');

package/src/session-supervision/index.js

@@ -144,7 +144,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
 }
 
 // Explicit execution authority: legacy monitor/tracked records stay read-only.
-export async function setSessionAutoContinue({ root, provider, session, enabled, continuationPolicy, hardMaxMinutes, hardMaxContinuations, providerTokenCeiling, ...options }) {
+export async function setSessionAutoContinue({ root, provider, session, enabled, continuationPolicy, ...options }) {
   if (!['codex', 'claude'].includes(provider) || typeof enabled !== 'boolean') throw new Error('Unsupported automatic continuation request.');
   if (enabled) await trackSession({ root, provider, session, tracked: true, ...options });
   return updateRecord(root, provider, session, async previous => {
@@ -155,18 +155,13 @@ export async function setSessionAutoContinue({ root, provider, session, enabled,
     if (enabled && provider === 'claude') await requireClaudeChannel(previous,
       { session, cwd: previous.cwd, observation: { source: previous.admission?.source } }, options.inspectProcess || processIdentity);
     const epoch = previous.autoContinue === enabled && previous.autoContinueEpoch ? previous.autoContinueEpoch : randomUUID();
-    const settings = { autonomyPolicy: 'balanced', maxMinutes: 30, maxContinuations: 6, maxFailures: 3,
-      ...previous.autoContinueSettings,
-      ...(continuationPolicy === undefined ? {} : { continuationPolicy }),
-      ...(hardMaxMinutes === undefined ? {} : { hardMaxMinutes }),
-      ...(hardMaxContinuations === undefined ? {} : { hardMaxContinuations }),
-      ...(providerTokenCeiling === undefined ? {} : { providerTokenCeiling }) };
+    // Settings persisted by older versions may carry removed time, turn and
+    // token caps; only the fields that still govern a task are forwarded.
+    const { autonomyPolicy = 'balanced', maxFailures = 3, continuationPolicy: savedPolicy } = previous.autoContinueSettings || {};
+    const settings = { autonomyPolicy, maxFailures,
+      ...(continuationPolicy ?? savedPolicy) === undefined ? {} : { continuationPolicy: continuationPolicy ?? savedPolicy } };
     if (settings.continuationPolicy !== undefined && !['bounded', 'progress'].includes(settings.continuationPolicy)) throw new Error('Choose a continuation policy.');
-    for (const [key, maximum] of [['hardMaxMinutes', 1440], ['hardMaxContinuations', 50], ['providerTokenCeiling', 15_000_000]]) {
-      if (settings[key] !== undefined && (!Number.isSafeInteger(settings[key]) || settings[key] < 1 || settings[key] > maximum)) throw new Error('Invalid continuation ceiling.');
-    }
-    if (providerTokenCeiling !== undefined && provider !== 'codex') throw new Error('Token ceilings require host-observed Codex usage.');
-    if (previous.run && [continuationPolicy, hardMaxMinutes, hardMaxContinuations, providerTokenCeiling].some(value => value !== undefined)) throw new Error('Change an existing task through its explicit continuation controls.');
+    if (previous.run && continuationPolicy !== undefined) throw new Error('Change an existing task through its explicit continuation controls.');
     const next = { ...previous, autoContinue: enabled, autoContinueEpoch: epoch,
       ...(enabled ? { tracked: true, monitor: true, autoContinueSettings: settings } : { tracked: false, monitor: false }) };
     // Adopt existing supervision without restarting it or renewing its budgets.
@@ -224,7 +219,7 @@ export async function monitorSession({ root, provider, session, monitor = true,
 }
 
 export async function enrollSession({ root, provider, session, objective, acceptanceCriteria, contextBootstrap = false, autonomyPolicy = 'balanced',
-  maxMinutes = 30, maxContinuations = 6, maxFailures = 3, maxNoProgressMinutes, maxTokens, continuationPolicy, hardMaxMinutes, hardMaxContinuations, providerTokenCeiling, autoContinueEpoch, openClient = openCodexAppServer,
+  maxFailures = 3, maxNoProgressMinutes, continuationPolicy, autoContinueEpoch, openClient = openCodexAppServer,
   readClaude = readClaudeSession, inspectProcess = processIdentity, now = Date.now() }) {
   if (!['codex', 'claude'].includes(provider)) throw new Error('This provider does not have a verified exact-session enrollment channel.');
   if (typeof objective !== 'string' || !objective.trim() || objective.length > 4000) throw new Error('A concrete objective is required.');
@@ -249,13 +244,13 @@ export async function enrollSession({ root, provider, session, objective, accept
   const admission = provider === 'codex' ? { source: 'codex_app_server', provider, session, cwd, model: metadata.model } : undefined;
   const liveRecord = provider === 'claude' ? await readRecord(root, provider, session) : null;
   const run = await startDelivery({ root, provider, session, cwd, objective: objective.trim(), nextStep: 'Inspect current evidence and propose the next assessed action.',
-    maxMinutes, maxContinuations, maxFailures, continuationPolicy, hardMaxMinutes, hardMaxContinuations, providerTokenCeiling, now, admission, inspectProcess, autoContinueEpoch,
+    maxFailures, continuationPolicy, now, admission, inspectProcess, autoContinueEpoch,
     liveHookAdmission: liveRecord ? { hookStartedAt: liveRecord.hookStartedAt, pid: liveRecord.process.pid, identity: liveRecord.process.identity } : undefined,
-    managed: { acceptanceCriteria, contextBootstrap, autonomyPolicy, maxNoProgressMinutes, maxTokens, approvalScopes: ['task'], approvalPolicy: 'wait',
+    managed: { acceptanceCriteria, contextBootstrap, autonomyPolicy, maxNoProgressMinutes, approvalScopes: ['task'], approvalPolicy: 'wait',
       initialAction: initialPlan.alternatives[0].action, initialPlan, remainingWork: objective.trim(),
       autoRecovery: provider === 'codex', resumeChannel: provider === 'codex' ? 'codex_app_server' : null,
       resumeModel: metadata.model } });
-  return { provider, session, taskId: run.run.managed.taskId, state: run.run.state, deadline: run.run.deadline };
+  return { provider, session, taskId: run.run.managed.taskId, state: run.run.state };
 }
 
 export async function continueSession(options) {

package/src/session-supervision/stop-notifications.js

@@ -0,0 +1,43 @@
+import { createHash } from 'node:crypto';
+import { deliveryStop } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+// Auto-continue works while nobody is watching, so a person must learn when it
+// stops. Map a stopped run to a notification kind; the native window owns copy.
+export function stopNotificationKind(run, now = Date.now()) {
+  if (!run?.managed?.autoContinueEpoch) return null;
+  // The clock keeps aging while paused; the persisted human decision takes
+  // precedence over a threshold that was reached only after that decision.
+  if (run.state === 'paused') return run.reason === 'Paused by user.' ? null : deliveryStop(run, now) ? 'paused' : null;
+  if (run.state === 'blocked' || run.state === 'verification_pending') return 'needs_decision';
+  if (run.state === 'recovery_required' && run.managed.autoRecovery !== true) return 'needs_decision';
+  if (run.state === 'failed' || run.state === 'budget_exhausted') return 'failed';
+  if (run.state === 'completed' || run.state === 'reported_done') return 'finished';
+  return null;
+}
+
+// The first observation is a baseline: restarting SIMY must not replay alerts
+// for runs that stopped earlier. Each distinct stop is announced once.
+export function createStopNotifier({ emit, now = Date.now } = {}) {
+  // Retain one stop fingerprint per currently observed task, rather than an
+  // event cache whose eviction could replay the entire historical baseline.
+  const seen = new Map();
+  let baseline = true;
+  return {
+    observe(records) {
+      const present = new Set();
+      for (const record of records) {
+        const run = record?.run, kind = stopNotificationKind(run, now());
+        const key = JSON.stringify([record.provider, record.session, run?.managed?.taskId]);
+        present.add(key);
+        if (!kind) { seen.delete(key); continue; }
+        const id = createHash('sha256').update(JSON.stringify([record.provider, record.session, run.managed.taskId, run.state, run.revision, run.reason])).digest('hex').slice(0, 32);
+        if (seen.get(key) === id) continue;
+        seen.set(key, id);
+        if (!baseline) emit({ type: 'notify', id, kind, provider: record.provider, session: record.session,
+          objective: String(run.objective || '').slice(0, 200) });
+      }
+      for (const key of seen.keys()) if (!present.has(key)) seen.delete(key);
+      baseline = false;
+    },
+  };
+}