@awak-app/simy-cli 0.6.28 → 0.6.30

package/src/session-supervision/consistency-auditor.js

@@ -1,5 +1,6 @@
+import { completionClaimUnbound } from '../codex-plugins/simy/hooks/completion-binding.mjs';
 import { createHash, randomUUID } from 'node:crypto';
-import { automaticContinuationAllowed, processIdentity, readRecord, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { automaticContinuationAllowed, queuePurposeVerification, processIdentity, readRecord, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { purposeDiagnosisPlan } from '../codex-plugins/simy/hooks/purpose-cycle.mjs';
 import { reconcileFindings } from '../codex-plugins/simy/hooks/purpose-evidence.mjs';
 import { requireProviderLink } from '../provider-links.js';
@@ -12,17 +13,19 @@ const contract = record => createHash('sha256').update(JSON.stringify([record.ru
   record.run.objective, record.run.managed.acceptanceCriteria, record.autoContinueEpoch])).digest('hex');
 export const canAuditOutcome = record => record?.provider === 'codex' && record.autoContinue === true &&
   record.providerArchived !== true && record.run?.managed && automaticContinuationAllowed(record) &&
-  !['stopped', 'completed', 'reported_done', 'budget_exhausted'].includes(record.run.state) &&
+  !['stopped', 'budget_exhausted'].includes(record.run.state) &&
+  (!['completed','reported_done'].includes(record.run.state) || completionClaimUnbound(record)) &&
+  record.run.stopReason?.actor !== 'user' &&
   !(record.run.state === 'paused' && pauseOrigin(record.run) === 'user') &&
   !record.run.managed.resumeLease && !record.run.managed.liveWorkspaceLease &&
   !(Number.isFinite(record.run.deadline) && Date.now() >= record.run.deadline) &&
   !(Number.isFinite(record.run.maxContinuations) && record.run.continuations >= record.run.maxContinuations) &&
-  !record.run.managed.usageBlocked && !(record.run.managed.maxTokens && record.run.managed.tokensUsed >= record.run.managed.maxTokens);
+  !(record.run.managed.outcomeAudit?.usageReceipts?.filter(row => !row.settled).length >= 128) && !record.run.managed.usageBlocked && !(record.run.managed.maxTokens && record.run.managed.tokensUsed >= record.run.managed.maxTokens);
 
 // A distinct provider context reads original instructions and primary evidence.
 // It has its own read-only lease; original turns are never resumed or edited.
-export async function auditConsistencyTask(record, findings, request, { root, signal,
-  execute = executeCodexAppServer, openClient = openCodexAppServer, authorize = async () => {} } = {}) {
+async function auditConsistencyAttempt(record, findings, request, { root, signal,
+  execute = executeCodexAppServer, openClient = openCodexAppServer, authorize = async () => {}, writeRecord = updateRecord } = {}) {
   if (!canAuditOutcome(record)) return { received: false, reason: 'audit_boundary' };
   const link = await requireProviderLink({ root, provider: record.provider });
   const accessScope = await authorize(record);
@@ -30,20 +33,33 @@ export async function auditConsistencyTask(record, findings, request, { root, si
   try { metadata = await readCodexSession(client, record.session); }
   finally { await client.close(); }
   if (await realpath(metadata.cwd) !== record.cwd || metadata.model !== (record.run.managed.resumeModel || record.admission?.model)) return { received: false, reason: 'original_identity_unverified' };
-  const key = contract(record), id = randomUUID();
+  signal?.throwIfAborted();
+  const key = contract(record), id = request.attemptId;
   const owner = { pid: process.pid, identity: await processIdentity(process.pid) };
   const oldLease = record.run.managed.outcomeAudit?.lease;
-  if (oldLease && await leaseOwnerDead(oldLease.owner, processIdentity)) await updateRecord(root, record.provider, record.session, live => {
+  const oldOwnerDead = oldLease && await leaseOwnerDead(oldLease.owner, processIdentity);
+  if (oldLease && (Date.now() >= oldLease.expiresAt || oldOwnerDead)) {
+    // The final provider total cannot be recovered from a dead owner's memory.
+    await accountAuditUsage(root, record, oldLease.id, null, writeRecord);
+    await writeRecord(root, record.provider, record.session, live => {
     if (live?.run?.managed?.outcomeAudit?.lease?.id === oldLease.id) {
       delete live.run.managed.outcomeAudit.lease;
+      // A confirmed dead process cannot deliver late usage. Settle its dedupe
+      // slot, while retaining unknown consumption and every hard-budget block.
+      // Expiry alone does not prove death, so live-owner receipts stay pending.
+      if (oldOwnerDead) {
+        const receipt = live.run.managed.outcomeAudit.usageReceipts?.find(row => row.id === oldLease.id);
+        if (receipt) receipt.settled = true;
+      }
       live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: 'audit_owner_exited' };
     }
     return live;
   });
-  const claimed = await updateRecord(root, record.provider, record.session, live => {
-    if (!canAuditOutcome(live) || contract(live) !== key || live.run.managed.outcomeAudit?.lease) return live;
+  }
+  const claimed = await writeRecord(root, record.provider, record.session, live => {
+    if (signal?.aborted || !canAuditOutcome(live) || contract(live) !== key || live.run.managed.outcomeAudit?.lease) return live;
     live.run.managed.outcomeAudit = { ...live.run.managed.outcomeAudit,
-      lease: { id, owner, requestId: request.id, contract: key, startedAt: Date.now() } };
+      lease: { id, owner, requestId: request.id, contract: key, startedAt: Date.now(), expiresAt: request.deadlineAt } };
     return live;
   });
   if (claimed?.run?.managed?.outcomeAudit?.lease?.id !== id) return { received: false, reason: 'audit_lease_busy' };
@@ -66,48 +82,130 @@ export async function auditConsistencyTask(record, findings, request, { root, si
   signal?.addEventListener('abort', abort, { once: true });
   if (signal?.aborted) abort();
   let result;
-  let usage = null;
+  let usage = null, usageWrites = Promise.resolve();
   try {
-    result = await execute(view, { root, signal: controller.signal, openClient, auditOnly: true, beforeDispatch,
-      onUsage: value => { usage = value; if (m.maxTokens && Number.isFinite(value?.tokens) && (m.tokensUsed || 0) + value.tokens >= m.maxTokens) controller.abort(); } });
+    result = await execute(view, { root, signal: controller.signal, openClient, auditOnly: true, authorizePreparation:beforeDispatch, beforeDispatch,
+      onUsage: value => { usage = value; usageWrites = usageWrites.then(() => accountAuditUsage(root, record, id, value, writeRecord)); usageWrites.catch(() => controller.abort()); if (m.maxTokens && Number.isFinite(value?.tokens) && (m.tokensUsed || 0) + value.tokens >= m.maxTokens) controller.abort(); } });
     await beforeDispatch();
     const review = result.verification;
     if (!review || review.source !== 'independent_codex_session' || !review.session || review.session === record.session) throw new Error('Independent audit provenance unavailable.');
     let persisted = false;
-    await updateRecord(root, record.provider, record.session, live => {
-      if (!live?.run?.managed || contract(live) !== key || live.run.managed.outcomeAudit?.lease?.id !== id || !canAuditOutcome(live)) return live;
+    await writeRecord(root, record.provider, record.session, live => {
+      if (signal?.aborted || Date.now() >= request.deadlineAt || !live?.run?.managed || contract(live) !== key || live.run.managed.outcomeAudit?.lease?.id !== id || !canAuditOutcome(live)) return live;
       const audit = live.run.managed.outcomeAudit;
       audit.lastReport = review; audit.lastSuccessAt = Date.now(); audit.requestId = request.id;
       audit.targetContract = key; audit.lastFailure = null;
       // Existing finding reconciliation enforces stable IDs, counterevidence
       // and reopen reasons. A delivered audit never certifies task completion.
-      if (live.run.managed.purpose?.enabled) reconcileFindings(live.run.managed, review, Date.now());
+      if (completionClaimUnbound(live)) {
+        audit.completionRecovery = { at: Date.now(), priorState: live.run.state, priorRevision: live.run.revision };
+        live.run.revision++;
+        queuePurposeVerification(live.run, 'Prior terminal claim has no current controller completion receipt. Independently recheck the original frozen acceptance and remaining defects; an audit report alone cannot certify completion.', Date.now());
+      } else if (live.run.managed.purpose?.enabled) reconcileFindings(live.run.managed, review, Date.now());
       persisted = true;
       return live;
     });
     return { received: true, audited: persisted, ...(persisted ? { passed: review.passed } : { reason: 'target_changed' }) };
   } catch (error) {
     const safeCode = ['cancelled', 'closed', 'identity', 'unsupported', 'approval', 'permission_restore', 'manual_provider_action', 'timeout'].includes(error?.code) ? error.code : 'independent_audit_failed';
-    await updateRecord(root, record.provider, record.session, live => {
+    await writeRecord(root, record.provider, record.session, live => {
       if (live?.run?.managed?.outcomeAudit?.lease?.id === id) live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: safeCode };
       return live;
     });
     return { received: true, audited: false, reason: 'independent_audit_failed' };
   } finally {
     signal?.removeEventListener('abort', abort);
-    await updateRecord(root, record.provider, record.session, live => {
+    let usageWriteFailed = false;
+    try { await usageWrites; } catch { usageWriteFailed = true; }
+    try {
+      await accountAuditUsage(root, record, id, usageWriteFailed ? null : result?.usage || usage, writeRecord);
+    } finally { await writeRecord(root, record.provider, record.session, live => {
       if (live?.run?.managed?.outcomeAudit?.lease?.id === id) {
-        const observed = result?.usage || usage;
-        const audit = live.run.managed.outcomeAudit;
-        const measured = observed?.source === 'codex_app_server' && Number.isSafeInteger(observed.tokens) && observed.tokens >= 0;
-        audit.lastUsage = measured ? observed : null;
-        if (measured) {
-          audit.tokensUsed = (audit.tokensUsed || 0) + observed.tokens;
-          live.run.managed.tokensUsed = (live.run.managed.tokensUsed || 0) + observed.tokens;
-        } else if (live.run.managed.maxTokens) { live.run.managed.unknownConsumption = true; live.run.managed.usageBlocked = true; }
-        delete audit.lease;
+        delete live.run.managed.outcomeAudit.lease;
       }
       return live;
-    });
+    }); }
   }
 }
+
+async function accountAuditUsage(root, record, id, observed, writeRecord = updateRecord) {
+  await writeRecord(root, record.provider, record.session, live => {
+    if (!live?.run?.managed || live.run.id !== record.run.id || live.run.managed.taskId !== record.run.managed.taskId) return live;
+    const audit = live.run.managed.outcomeAudit ||= {};
+    const measured = observed?.source === 'codex_app_server' && Number.isSafeInteger(observed.tokens) && observed.tokens >= 0;
+    audit.usageReceipts ||= [];
+    let receipt = audit.usageReceipts.find(row => row.id === id);
+    if (!receipt) { receipt = { id, tokens: 0, source: measured ? 'measured' : 'unknown' }; audit.usageReceipts.push(receipt); }
+    if (measured) {
+      const delta = Math.max(0, observed.tokens - receipt.tokens);
+      receipt.tokens += delta; receipt.source = 'measured';
+      audit.tokensUsed = (audit.tokensUsed || 0) + delta;
+      live.run.managed.tokensUsed = (live.run.managed.tokensUsed || 0) + delta;
+      audit.lastUsage = observed;
+    } else {
+      audit.lastUsage = null; audit.unknownConsumption = true;
+      if (live.run.managed.maxTokens) { live.run.managed.unknownConsumption = true; live.run.managed.usageBlocked = true; }
+    }
+    // Keep dedupe identities; never discard an unaccounted late audit receipt.
+    delete audit.usageReceiptCapacity;
+    return live;
+  });
+}
+
+// An inspection deadline bounds one read-only audit, not the user's task.
+// Abort fences all late report adoption. Original effect leases are untouched.
+export async function auditConsistencyTask(record, findings, request, options = {}) {
+  if (!canAuditOutcome(record)) return { received: false, reason: 'audit_boundary' };
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  options.signal?.addEventListener('abort', abort, { once: true });
+  if (options.signal?.aborted) abort();
+  const attemptId = randomUUID();
+  const timeoutMs = options.auditTimeoutMs ?? 120_000;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error('Invalid audit inspection deadline.');
+  let timer, writes = Promise.resolve();
+  const writeRecord = (...args) => {
+    const pending = writes.catch(() => {}).then(async () => {
+      for (let retry = 0; ; retry++) {
+        try { return await (options.writeRecord || updateRecord)(...args); }
+        catch (error) {
+          if (!['Delivery state is busy; retry the command.', 'Delivery state lock owner is unavailable; inspect the lock before retrying.'].includes(error.message) || retry >= 10) throw error;
+          await new Promise(resolve => setTimeout(resolve, 20 * (retry + 1)));
+        }
+      }
+    });
+    writes = pending; return pending;
+  };
+  const deadlineAt = Date.now() + timeoutMs;
+  let attemptFinished = false, outerFinished = false;
+  const settleReceipt = async () => {
+    await writeRecord(options.root, record.provider, record.session, live => {
+      if (live?.run?.id !== record.run.id || live.run.managed?.taskId !== record.run.managed.taskId) return live;
+      const audit = live.run.managed.outcomeAudit;
+      const receipt = audit?.usageReceipts?.find(row => row.id === attemptId);
+      if (receipt) receipt.settled = true;
+      if (audit?.usageReceipts) {
+        const terminal = audit.usageReceipts.filter(row => row.settled);
+        audit.usageReceipts = audit.usageReceipts.filter(row => !row.settled || terminal.slice(-64).includes(row));
+        delete audit.usageReceiptCapacity;
+      }
+      return live;
+    });
+  };
+  const operation = auditConsistencyAttempt(record, findings, { ...request, attemptId, deadlineAt }, { ...options, signal: controller.signal, writeRecord }).finally(async () => { attemptFinished = true; if (outerFinished) await settleReceipt(); });
+  const expiration = new Promise(resolve => { timer = setTimeout(() => { controller.abort(); resolve({ received: true, audited: false, reason: 'audit_timeout' }); }, timeoutMs); });
+  try {
+    const result = await Promise.race([operation, expiration]);
+    if (result.reason === 'audit_timeout') {
+      await accountAuditUsage(options.root, record, attemptId, null, writeRecord);
+      await writeRecord(options.root, record.provider, record.session, live => {
+        if (live?.run?.managed?.outcomeAudit?.lease?.id === attemptId) {
+          delete live.run.managed.outcomeAudit.lease;
+          live.run.managed.outcomeAudit.lastFailure = { at: Date.now(), code: 'audit_timeout' };
+        }
+        return live;
+      });
+    }
+    return result;
+  } finally { clearTimeout(timer); options.signal?.removeEventListener('abort', abort); outerFinished = true; if (attemptFinished) await settleReceipt(); }
+}

package/src/session-supervision/discovery-window.js

@@ -11,5 +11,17 @@ export function recentSessionWindow(items, { limit = RECENT_SESSION_LIMIT, prior
   const recent = [...items].sort((a, b) => (b.lastActivityAt || 0) - (a.lastActivityAt || 0) || a.session.localeCompare(b.session));
   const retained = [], history = [];
   for (const item of recent) (priority(item) ? retained : history).push(item);
-  return [...retained, ...history.slice(0, Math.max(0, limit - retained.length))];
+  const selected = [...retained, ...history.slice(0, Math.max(0, limit - retained.length))];
+  const byKey = new Map(items.map(item => [`${item.provider}:${item.session}`, item]));
+  const included = new Set(selected.map(item => `${item.provider}:${item.session}`));
+  // Keep observed ancestors so a recent child does not silently become a root.
+  for (const item of selected) {
+    let parent = item.parentSession;
+    while (parent && selected.length < items.length) {
+      const key = `${parent.provider}:${parent.session}`;
+      if (included.has(key) || !byKey.has(key)) break;
+      const ancestor = byKey.get(key); included.add(key); selected.push(ancestor); parent = ancestor.parentSession;
+    }
+  }
+  return selected;
 }

package/src/session-supervision/index.js

@@ -1,10 +1,11 @@
+import { completionClaimUnbound } from '../codex-plugins/simy/hooks/completion-binding.mjs';
 import { pauseOrigin } from './autonomous-upgrade.js';
 import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/acceptance-policy.mjs';
 import { purposeFailureMode } from '../codex-plugins/simy/hooks/purpose-search.mjs';
 import { realpath } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { TERMINAL as TERMINAL_RUNS, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
-import { listCodexSessions, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
+import { TERMINAL as TERMINAL_RUNS, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
 import { originalSessionTarget } from './original-session-target.js';
@@ -44,6 +45,7 @@ function autoContinueState(record, isRunning, availability) {
   if (record?.autoContinue !== true) return { autoContinueStatus: 'off', autoContinueReason: null };
   const state = record.run?.state;
   if (state === 'budget_exhausted') return { autoContinueStatus: 'needs_user', autoContinueReason: 'Local execution limits have been removed. Resume this same conversation to continue.' };
+  if (completionClaimUnbound(record)) return { autoContinueStatus: 'watching', autoContinueReason: 'Verification of the recorded completion remains pending.' };
   if (['completed', 'reported_done'].includes(state)) return { autoContinueStatus: 'finished', autoContinueReason: 'Continuation finished for this conversation.' };
   const managed = record.run?.managed;
   const recoverableCause = record.run?.recoveryCause === 'process_exit' || managed?.resumeChannel === 'codex_app_server' && ['session_supervision', 'approved_action'].includes(record.run?.recoveryCause);
@@ -112,12 +114,13 @@ async function requireClaudeChannel(record, metadata, inspectProcess) {
 }
 
 export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
-  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, codexHome, connectedProviders = ['codex', 'claude'] } = {}) {
+  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false } = {}) {
   const assertActive = () => { if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation discovery was cancelled.'); };
   assertActive();
   const connected = new Set(connectedProviders);
   const records = (await listRecords(root)).filter(record => connected.has(record.provider));
   const priorities = records.filter(retainedSession);
+  let archivedCodex = [];
   let discovered = [], codexError = null, codexReasonCode = null, claude = [], claudeError = null;
   let archiveStates = new Map();
   await Promise.all([
@@ -125,8 +128,25 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       try { if (connected.has('codex')) discovered = await withClient(openClient, async client => {
         const active = await listCodexSessions({ client, inspectState: true, maxSessions: RECENT_SESSION_LIMIT, codexHome,
           prioritySessions: priorities.filter(record => record.provider === 'codex').map(record => record.session) });
+        if (includeArchived) {
+          const observedArchives = new Map();
+          const archiveClient = { request: async (method, params) => {
+            const response = await client.request(method, params);
+            if (method === 'thread/list' && params.archived === true) {
+              for (const thread of (response?.data || []).slice(0, params.limit)) {
+                const item = codexThreadMetadata(thread);
+                if (item && ['cli', 'vscode', 'appServer'].includes(item.source)) observedArchives.set(item.session, { ...item, archived: true });
+              }
+            }
+            return response;
+          } };
+          try { await listCodexSessions({ client: archiveClient, archived: true, maxSessions: RECENT_SESSION_LIMIT }); }
+          catch { /* Keep positive archive pages even if a later page fails. */ }
+          archivedCodex = [...observedArchives.values()];
+        }
         const ids = new Set(active.map(item => item.session));
         archiveStates = await readCodexArchiveStates(client, records.filter(record => record.provider === 'codex' && !ids.has(record.session)), { codexHome });
+        for (const item of archivedCodex) archiveStates.set(item.session, true);
         return active;
       }, signal); }
       catch (error) {
@@ -147,6 +167,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const record = records[index];
     if (record.provider !== 'codex') continue;
     const isArchived = archiveStates.get(record.session) === true;
+    if (isArchived) await recordProviderArchive(root, record.provider, record.session, true, now);
     if (isArchived && record.providerArchived === true) continue;
     if (!isArchived && !(record.providerArchived === true && (activeCodex.has(record.session) || archiveStates.get(record.session) === false))) continue;
     try { records[index] = await updateRecord(root, record.provider, record.session, current => {
@@ -161,7 +182,9 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
         }
       }
       return current;
-    }); } catch {
+    });
+      if (!isArchived) await recordProviderArchive(root, record.provider, record.session, false, now);
+    } catch {
       // Reconciliation can contend with a hook writer or an unreclaimable
       // legacy lock. Preserve stored state and retry on the next refresh;
       // one record must not discard either provider's entire catalog.
@@ -170,20 +193,30 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   assertActive();
   const byKey = new Map();
   const recordsByKey = new Map(records.map(record => [`${record.provider}:${record.session}`, record]));
-  for (const item of [...discovered, ...claude]) {
+  for (const item of [...discovered, ...claude, ...archivedCodex]) {
+    if (includeArchived && item.archived === true) { byKey.set(`${item.provider}:${item.session}`, item); continue; }
     if ((item.provider !== 'codex' || archiveStates.get(item.session) !== true) && recordsByKey.get(`${item.provider}:${item.session}`)?.providerArchived !== true) byKey.set(`${item.provider}:${item.session}`, item);
   }
+  const requiredAncestors = new Set();
+  for (const item of byKey.values()) {
+    let parent = recordsByKey.get(`${item.provider}:${item.session}`)?.parentSession || item.parentSession;
+    for (let depth = 0; parent && depth < 256; depth++) {
+      const key = `${parent.provider}:${parent.session}`;
+      if (requiredAncestors.has(key)) break;
+      requiredAncestors.add(key); parent = recordsByKey.get(key)?.parentSession;
+    }
+  }
   for (const record of records) {
     // Positive provider evidence still suppresses archived conversations if
     // their local reconciliation could not be persisted. Never grant work
     // from an unsuccessful unarchive reconciliation.
-    if (record.provider === 'codex' && archiveStates.get(record.session) === true) continue;
-    if (record.providerArchived === true) continue;
+    const archived = record.providerArchived === true || record.provider === 'codex' && archiveStates.get(record.session) === true;
+    if (archived && !includeArchived) continue;
     const key = `${record.provider}:${record.session}`;
     // A hook observation can belong to an AI-created worker. Only explicit
     // supervision may restore a conversation absent from provider discovery.
-    if (!byKey.has(key) && retainedSession(record)) byKey.set(key, {
-      provider: record.provider, session: record.session, cwd: record.cwd, title: '', source: record.admission?.source || 'hook',
+    if (!byKey.has(key) && (retainedSession(record) || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
+      provider: record.provider, session: record.session, cwd: record.cwd, title: '', archived, source: record.admission?.source || 'hook',
       lastActivityAt: record.observedAt || record.admission?.validatedAt || record.run?.updatedAt || null,
       observation: { source: record.admission?.source || `${record.provider}_hook`, observedAt: record.observedAt || record.admission?.validatedAt || null },
       availability: 'unknown', model: record.admission?.model || null,
@@ -191,15 +224,32 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   }
   // Select recent history before live probes, keeping explicit supervision
   // visible even during a truncated discovery or provider outage.
-  const items = recentSessionWindow([...byKey.values()], {
+  const catalog = [...byKey.values()].map(item => {
+    const record = recordsByKey.get(`${item.provider}:${item.session}`);
+    return { ...item, ...((record?.parentSession || item.parentSession) ? { parentSession: record?.parentSession || item.parentSession } : {}) };
+  });
+  const items = [...recentSessionWindow(catalog.filter(item => item.archived !== true), {
     priority: item => retainedSession(recordsByKey.get(`${item.provider}:${item.session}`)),
-  }), projected = new Array(items.length);
+  }), ...recentSessionWindow(catalog.filter(item => item.archived === true))];
+  // Include archived ancestors of active rows even when archive visibility is off.
+  const catalogByKey = new Map(catalog.map(item => [`${item.provider}:${item.session}`, item]));
+  const includedKeys = new Set(items.map(item => `${item.provider}:${item.session}`));
+  for (const item of items) {
+    let parent = item.parentSession;
+    while (parent) {
+      const key = `${parent.provider}:${parent.session}`;
+      if (includedKeys.has(key) || !catalogByKey.has(key)) break;
+      const ancestor = catalogByKey.get(key); includedKeys.add(key); items.push(ancestor); parent = ancestor.parentSession;
+    }
+  }
+  const projected = new Array(items.length);
   const codexTitles = items.some(item => item.provider === 'codex' && !sessionTitle(item.title)) ? await listCodexTitles() : new Map();
   assertActive();
   let nextItem = 0;
   const project = async item => {
     const record = recordsByKey.get(`${item.provider}:${item.session}`);
     const run = record?.run;
+    const archived = item.archived === true || record?.providerArchived === true;
     const mode = run?.managed ? run.state === 'recovery_required' && run.recoveryCause === 'session_supervision' ? 'pending_takeover' : 'managed' : run ? 'standard_loop' : record?.monitor ? 'monitor' : 'unmanaged';
     const codexChannel = codexContinuationChannel(item.observation.source, item.model, codexError ? { code: codexReasonCode, reason: codexError } : null);
     const supported = item.provider === 'codex' && codexChannel.ready;
@@ -214,7 +264,9 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
           cwd: await realpath(item.cwd), source: item.observation.source, model: item.model, validatedAt: now };
       } catch { /* Missing workspaces cannot grant an admission. */ }
     }
-    const availability = autoContinueAvailability(run, claudeChannel || codexChannel);
+    const availability = archived ? { canEnable: false, reasonCode: 'session_archived',
+      reason: 'Restore the original provider conversation before enabling automatic continuation.' }
+      : autoContinueAvailability(run, claudeChannel || codexChannel);
     const upgradeable = canUpgradeDelivery(run);
     const continuationIssue = liveHook && run ? !run.managed && !upgradeable
       ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
@@ -231,14 +283,15 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       } catch { /* Unverified process leaves runtime status unknown. */ }
     }
     return { provider: item.provider, session: item.session, cwd: item.cwd,
-      ...((item.parentSession || record?.parentSession) ? { parentSession: item.parentSession || record.parentSession } : {}),
+      ...((item.parentSession || record?.parentSession) ? { parentSession: record?.parentSession || item.parentSession } : {}),
       title: sessionTitle(item.title) || (item.provider === 'codex' ? codexTitles.get(item.session) || '' : ''), source: item.source,
       ...(typeof isRunning === 'boolean' ? { isRunning } : {}),
       ...(item.latestTurnId ? { latestTurnId: item.latestTurnId } : {}),
       ...(item.providerGoal !== undefined ? { providerGoal: item.providerGoal } : {}),
       ...(item.goalReadState ? { goalReadState: item.goalReadState } : {}),
       tracked: typeof record?.tracked === 'boolean' ? record.tracked : record?.monitor === true,
-      autoContinue: record?.autoContinue === true,
+      archived,
+      autoContinue: !archived && record?.autoContinue === true,
       autoContinueEpoch: record?.autoContinue === true ? record.autoContinueEpoch : null,
       autoContinueAvailability: availability,
       ...autoContinueState(record, isRunning, availability),
@@ -247,13 +300,13 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       binding: { mode, taskId: run?.managed?.taskId || record?.associationTaskId || null },
       originalSessionTarget: originalSessionTarget(item.provider, item.session),
       continuationMode: item.provider === 'claude' ? liveHook ? 'live_hook' : 'manual' : supported ? 'codex_app_server' : 'manual',
-      ...(continuationAdmission ? { continuationAdmission } : {}),
+      ...(!archived && continuationAdmission ? { continuationAdmission } : {}),
       continuationReasonCode: availability.reasonCode || claudeChannel?.code || 'ready',
       capabilities: { canMonitor: item.capabilities?.canMonitor ?? true,
-        canPurposeContinue: supported && (!run || !['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(run.state)),
-        canAnalyze: !run && (item.provider === 'codex' ? item.observation.source === 'codex_app_server' && !codexError : item.observation.source === 'claude_local_index' && !claudeError),
-        canEnroll: (supported || liveHook) && !run, canContinue: (supported || liveHook) && !run,
-        canAutoContinue: (supported || liveHook) && (!run || upgradeable || Boolean(run.managed) && !TERMINAL_RUNS.has(run.state)) },
+        canPurposeContinue: !archived && supported && (!run || !['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(run.state)),
+        canAnalyze: !archived && !run && (item.provider === 'codex' ? item.observation.source === 'codex_app_server' && !codexError : item.observation.source === 'claude_local_index' && !claudeError),
+        canEnroll: !archived && (supported || liveHook) && !run, canContinue: !archived && (supported || liveHook) && !run,
+        canAutoContinue: !archived && (supported || liveHook) && (!run || upgradeable || Boolean(run.managed) && !TERMINAL_RUNS.has(run.state)) },
       reason: item.provider === 'claude' ? continuationIssue?.reason || claudeChannel.reason :
         codexError || (!supported ? 'Exact model or provider metadata is unavailable.' : null),
     };
@@ -443,7 +496,8 @@ export async function enrollSession({ root, provider, session, objective, accept
   }
   const cwd = await realpath(metadata.cwd);
   const initialPlan = initialDiagnosisPlan(objective.trim(), contextBootstrap);
-  const admission = provider === 'codex' ? { source: 'codex_app_server', provider, session, cwd, model: metadata.model } : undefined;
+  const admission = provider === 'codex' ? { source: 'codex_app_server', provider, session, cwd, model: metadata.model,
+    ...(metadata.nativeSandbox ? {nativeSandbox:metadata.nativeSandbox,nativeSandboxSource:metadata.nativeSandboxSource} : {}) } : undefined;
   const liveRecord = provider === 'claude' ? await readRecord(root, provider, session) : null;
   await requireProviderLink({ root, provider, expectedEpoch: link.epoch });
   const rules = purposeDriven ? await loadPurposeRuleSet() : null;

package/src/session-supervision/purpose-recovery.js

@@ -13,9 +13,12 @@ import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/accepta
 export async function observePurposeTurn(record, { openClient = openCodexAppServer } = {}) {
   const client = await openClient();
   try {
-    const metadata = await readCodexSession(client, record.session);
-    if (await realpath(metadata.cwd) !== record.cwd || metadata.model !== record.run.managed.resumeModel) return { state: 'unknown' };
-    const result = await client.request('thread/turns/list', { threadId: record.session, limit: 1, sortDirection: 'desc', itemsView: 'summary' });
+    const session=record.run.managed.nativeWait?.session || record.session;
+    const cwd=session===record.session?record.cwd:record.run.managed.nativeWait?.cwd;
+    if(!cwd)return {state:'unknown'};
+    const metadata = await readCodexSession(client, session);
+    if (await realpath(metadata.cwd) !== cwd || metadata.model !== record.run.managed.resumeModel) return { state: 'unknown' };
+    const result = await client.request('thread/turns/list', { threadId: session, limit: 1, sortDirection: 'desc', itemsView: 'summary' });
     const turn = result?.data?.[0];
     if (!turn?.id || !['completed', 'failed', 'interrupted', 'inProgress'].includes(turn.status)) return { state: 'unknown' };
     return { state: turn.status === 'inProgress' ? 'running' : 'idle', turnId: turn.id, status: turn.status };
@@ -236,7 +239,7 @@ export async function reconcilePurposeTasks({ root, signal, prepareCandidate = p
     } else if (run.state === 'recovery_required' && ['provider_error', 'process_exit', 'shutdown_cancelled', 'interrupted_owner'].includes(run.recoveryCause) &&
         !run.managed.autoRecovery && now >= run.updatedAt + 15_000) {
       const code = run.managed.attempts?.at(-1)?.errorCode;
-      if (code && !['checkpoint', 'checkpoint_rejected', 'closed', 'timeout', 'unavailable', 'turn_failed', 'provider_error', ...(searchEnabled(run.managed) ? ['permission_narrowed', 'manual_provider_action', 'unsupported'] : [])].includes(code)) continue;
+      if (code && !['checkpoint', 'checkpoint_rejected', 'closed', 'timeout', 'unavailable', 'turn_failed', 'provider_error', ...(searchEnabled(run.managed) ? ['permission_narrowed', 'permission_restore', 'manual_provider_action', 'unsupported'] : [])].includes(code)) continue;
       obstacle = { type: 'execution_error', detail: code || run.recoveryCause };
     }
     if (!obstacle) continue;