@awak-app/simy-cli 0.6.29 → 0.6.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.6.29",
+  "version": "0.6.30",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.6.29";
+export const CLI_VERSION = "0.6.30";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -9,7 +9,7 @@ import { searchEnabled, failureLimitReached, searchState, recordSearchExperiment
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
@@ -65,9 +65,40 @@ function applyProviderConsent(record, link) {
       revision: (record.run.revision || 0) + 1,
       ...(record.run.managed ? { managed: { ...record.run.managed, autoRecovery: false } } : {}) } } : {}) };
 }
+async function applyArchiveFence(root, record) {
+  if (!record) return record;
+  const file = `${recordPath(root, record.provider, record.session)}.archive-fence`;
+  let archived;
+  try { archived = JSON.parse(await readFile(file, 'utf8')).archived !== false; }
+  catch (error) { if (error.code === 'ENOENT') return record; archived = true; }
+  if (!archived) return record;
+  return { ...record, providerArchived: true, autoContinue: false, tracked: false, monitor: false,
+    ...(record.run && !TERMINAL.has(record.run.state) ? { run: { ...record.run, state: 'paused',
+      reason: 'The original provider conversation was archived.',
+      ...(record.run.managed ? { managed: { ...record.run.managed, autoRecovery: false } } : {}) } } : {}) };
+}
+export async function recordProviderArchive(root, provider, session, archived, observedAt) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const file = `${recordPath(root, provider, session)}.archive-fence`;
+  const lock = `${file}.lock`, token = await acquireStateLock(lock, processIdentity);
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    let previous; try { previous = JSON.parse(await readFile(file, 'utf8')); } catch {}
+    if (previous?.observedAt > observedAt) return;
+    await writeFile(temporary, JSON.stringify({ provider, session, archived, observedAt }), { mode: 0o600 });
+    await rename(temporary, file);
+  } finally { await rm(temporary, { force: true }); await releaseStateLock(lock, token); }
+}
 async function currentProviderConsent(root, records) {
   const links = Object.fromEntries(await Promise.all(['codex', 'claude'].map(async provider => [provider, await providerLinkState(root, provider)])));
-  return records.map(record => applyProviderConsent(record, links[record.provider] || {}));
+  let archiveNames;
+  try { archiveNames = new Set((await readdir(root)).filter(name => name.endsWith('.archive-fence'))); }
+  catch { /* A failed index read falls back to fresh per-record fencing. */ }
+  return Promise.all(records.map(record => {
+    const current = applyProviderConsent(record, links[record.provider] || {});
+    if (archiveNames && !archiveNames.has(`${basename(recordPath(root, record.provider, record.session))}.archive-fence`)) return current;
+    return applyArchiveFence(root, current);
+  }));
 }
 export async function linkedProvider(root, provider) {
   return (await providerLinkState(root, provider)).connected === true;
@@ -177,6 +208,34 @@ async function acquireStateLock(lock, inspectProcess, depth = 0) {
     await releaseStateLock(reclaim, token);
   }
 }
+export async function withSessionParentLock(root, operation, inspectProcess = processIdentity) {
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const lock = join(root, 'session-lineage.lock');
+  // Distinct SessionStart hooks share this lock. Wait within the hook timeout
+  // for short writers, without reclaiming unknown owners or replaying work.
+  const deadline = Date.now() + 500;
+  let token;
+  for (;;) {
+    try { token = await acquireStateLock(lock, inspectProcess); break; }
+    catch (error) {
+      if (Date.now() >= deadline || !/^(?:Delivery state is busy; retry the command\.|Delivery state lock owner is unavailable; inspect the lock before retrying\.)$/.test(error.message)) throw error;
+      await new Promise(resolve => setTimeout(resolve, 10));
+    }
+  }
+  try { return await operation(); } finally { await releaseStateLock(lock, token); }
+}
+export async function validateSessionParent(root, child, parent) {
+  const key = item => `${item.provider}:${item.session}`;
+  const seen = new Set([key(child)]);
+  let cursor = parent;
+  for (let depth = 0; cursor; depth++) {
+    if (depth >= 256 || seen.has(key(cursor))) throw new Error('Parent relationship would create a cycle or exceed the ancestry limit.');
+    seen.add(key(cursor));
+    const ancestor = await readRecord(root, cursor.provider, cursor.session);
+    if (!ancestor?.observedAt && !ancestor?.admission?.validatedAt) throw new Error('The parent ancestry must contain observed provider conversations.');
+    cursor = ancestor.parentSession;
+  }
+}
 export async function updateRecord(root, provider, session, mutate, { inspectProcess = processIdentity } = {}) {
   await mkdir(root, { recursive: true, mode: 0o700 });
   const file = recordPath(root, provider, session), lock = `${file}.lock`;
@@ -186,7 +245,7 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
   let temporary;
   try {
     const stored = await read(file);
-    const previous = applyProviderConsent(stored, await providerLinkState(root, provider));
+    const previous = await applyArchiveFence(root, applyProviderConsent(stored, await providerLinkState(root, provider)));
     const previousBytes = stored === null ? null : JSON.stringify(stored);
     const next = await mutate(previous);
     if (next) {
@@ -212,7 +271,7 @@ export async function readRecord(root = rootDirectory(), provider, session) {
   const path = recordPath(root, provider, session);
   try {
     const record = await read(path);
-    return record?.schemaVersion === 1 && record.provider === provider && record.session === session ? applyProviderConsent(record, await providerLinkState(root, provider)) : null;
+    return record?.schemaVersion === 1 && record.provider === provider && record.session === session ? applyArchiveFence(root, applyProviderConsent(record, await providerLinkState(root, provider))) : null;
   } catch { return null; } // Match listRecords' treatment of unreadable records.
 }
 const RECORD_NAME = /^[a-f0-9]{64}\.json$/;
@@ -1557,7 +1616,7 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
   const event = input.hook_event_name;
   const identity = observedProcess === undefined && (['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event)) ? await providerProcess(provider) : observedProcess;
   let output = {}, boundaryLease = null, claimedWorkspace = null;
-  try { await updateRecord(root, provider, input.session_id, async old => {
+  const applyObservation = () => updateRecord(root, provider, input.session_id, async old => {
     const currentLink = await providerLinkState(root, provider);
     if (!currentLink.connected || currentLink.epoch !== link.epoch) return old;
     if (old && old.cwd !== cwd) return old;
@@ -1569,7 +1628,11 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       const parentId = env.SIMY_PARENT_SESSION || (parentProvider === 'codex' ? env.CODEX_THREAD_ID : null);
       if (['codex', 'claude'].includes(parentProvider) && /^[0-9a-f-]{36}$/i.test(parentId || '') &&
           !(parentProvider === provider && parentId === input.session_id)) {
-        record.parentSession = { provider: parentProvider, session: parentId };
+        const parent = { provider: parentProvider, session: parentId };
+        try {
+          await validateSessionParent(root, { provider, session: input.session_id }, parent);
+          record.parentSession = parent;
+        } catch { /* Unverified or cyclic ancestry never changes navigation. */ }
       }
     }
     const owner = record.run?.managed?.liveHookOwner;
@@ -1711,7 +1774,11 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
     record.run.updatedAt = now;
     notifyState(record.run, now);
     return record;
-  }); } catch (error) {
+  });
+  try {
+    if (event === 'SessionStart') await withSessionParentLock(root, applyObservation, inspectProcess);
+    else await applyObservation();
+  } catch (error) {
     if (claimedWorkspace?.release) await claimedWorkspace.release();
     throw error;
   }

package/src/delivery-hooks/command.js

@@ -1,3 +1,4 @@
+import { linkSessionParent } from '../session-supervision/session-lineage.js';
 import { adoptAutonomousPolicy } from '../session-supervision/autonomous-upgrade.js';
 import { deliveryEvidence } from './evidence.js';
 import { readFile } from 'node:fs/promises';
@@ -79,6 +80,7 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     output('simy delivery runtime install|status|workflows — install an immutable local candidate, inspect its version/digest, or refresh existing plugin sources/cache while preserving enabled state and hook trust. Never enables a task.');
     output('simy delivery runtime doctor|desktop-install|desktop-activate|watch — audit live host/state/monitor alignment, or prepare a separate local desktop using the verified fixed runtime. Does not start or resume tasks.');
     output('simy delivery runtime policy-adopt [--task-id ID [--criterion-id ID]] — explicitly delegate decisions within existing permissions. Manual acceptance stays manual unless the user names the exact task and criterion to delegate its verifier.');
+    output('simy delivery link_parent --provider codex|claude --session CHILD --parent-provider codex|claude --parent-session PARENT — record an explicit observed navigation relationship without starting work.');
     output('simy delivery supervise [--once] — service already opted-in tasks with this runtime; refuses an active desktop host.');
     output('simy delivery evidence --provider codex|claude --session ID — read-only execution and acceptance receipts.');
     output('simy delivery activity [--watch] [--json] [--provider codex|claude] [--session ID] — local observations every 60 seconds; not productive time.');
@@ -88,11 +90,12 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--execution-cwd PATH] [--max-failures 3]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Standard start tracks checkpoints and reports done without certifying acceptance. Managed start freezes the original objective, optional user-selected deliveryLevel, and acceptance specification. Desktop Continue infers the original conversation goal first. Continue adopts an eligible ordinary loop with the same goal and failure budget; its first managed action reconciles prior work read-only. --execution-cwd explicitly binds the task directory while provider identity retains its original folder. Resume preserves original task identity, history and approvals.');
     return 0;
   }
-  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'execution-cwd', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
+  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'execution-cwd', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session', 'parent-provider', 'parent-session']);
   const options = parseDeliveryOptions(args, allowed);
   const base = { root, cwd, provider: options.provider, session: options.session };
   let result;
-  if (action === 'evidence') {
+  if (action === 'link_parent') result = await linkSessionParent({ ...base, parentProvider: options['parent-provider'], parentSession: options['parent-session'] });
+  else if (action === 'evidence') {
     const record = await readRecord(root, options.provider, options.session);
     if (!record) throw new Error('Exact provider session record not found.');
     result = deliveryEvidence(record, root);

package/src/desktop-host.js

@@ -152,7 +152,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
   let providerLinks = await readProviderLinks(root);
   const providerLinkBusy = new Set(), providerLinkFeedback = {}, explicitAnalyses = new Set();
   const linkedSessions = sessions => sessions.filter(item => providerLinks[item.provider]?.connected === true);
-  const analysisSessions = sessions => linkedSessions(sessions).filter(item => !providerLinks[item.provider].requiresConsent ||
+  const analysisSessions = sessions => linkedSessions(sessions).filter(item => item.archived !== true).filter(item => !providerLinks[item.provider].requiresConsent ||
     item.autoContinue === true || item.tracked === true || item.monitor === true || explicitAnalyses.has(`${item.provider}:${item.session}`));
   const authorizeProvider = async (provider, scope, expectedEpoch) => {
     await authorizeWork(scope);
@@ -386,7 +386,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (!sessionRefresh && (force || Date.now() - sessionRefreshedAt >= 15_000)) {
       const requestedScope = accessScope(currentAccess);
       const controller = discoveryController = new AbortController();
-      sessionRefresh = Promise.resolve().then(() => { if (controller.signal.aborted) return null; return (dependencies.discoverSessions || discoverSessions)({ root: deliveryRoot, signal: controller.signal, connectedProviders: PROVIDER_LINKS.filter(provider => providerLinks[provider].connected) }); })
+      sessionRefresh = Promise.resolve().then(() => { if (controller.signal.aborted) return null; return (dependencies.discoverSessions || discoverSessions)({ root: deliveryRoot, signal: controller.signal, includeArchived: true, connectedProviders: PROVIDER_LINKS.filter(provider => providerLinks[provider].connected) }); })
         .then(async value => {
           if (closed || relay || controller.signal.aborted) return;
           const latestAccess = await accessSnapshot();

package/src/session-supervision/discovery-window.js

@@ -11,5 +11,17 @@ export function recentSessionWindow(items, { limit = RECENT_SESSION_LIMIT, prior
   const recent = [...items].sort((a, b) => (b.lastActivityAt || 0) - (a.lastActivityAt || 0) || a.session.localeCompare(b.session));
   const retained = [], history = [];
   for (const item of recent) (priority(item) ? retained : history).push(item);
-  return [...retained, ...history.slice(0, Math.max(0, limit - retained.length))];
+  const selected = [...retained, ...history.slice(0, Math.max(0, limit - retained.length))];
+  const byKey = new Map(items.map(item => [`${item.provider}:${item.session}`, item]));
+  const included = new Set(selected.map(item => `${item.provider}:${item.session}`));
+  // Keep observed ancestors so a recent child does not silently become a root.
+  for (const item of selected) {
+    let parent = item.parentSession;
+    while (parent && selected.length < items.length) {
+      const key = `${parent.provider}:${parent.session}`;
+      if (included.has(key) || !byKey.has(key)) break;
+      const ancestor = byKey.get(key); included.add(key); selected.push(ancestor); parent = ancestor.parentSession;
+    }
+  }
+  return selected;
 }

package/src/session-supervision/index.js

@@ -4,8 +4,8 @@ import { effectiveAcceptanceCriteria } from '../codex-plugins/simy/hooks/accepta
 import { purposeFailureMode } from '../codex-plugins/simy/hooks/purpose-search.mjs';
 import { realpath } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
-import { TERMINAL as TERMINAL_RUNS, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
-import { listCodexSessions, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
+import { TERMINAL as TERMINAL_RUNS, canUpgradeDelivery, enablePurposeDelivery, claudeHookChannel, controlDelivery, listRecords, readRecord, processIdentity, startDelivery, updateRecord, recordProviderArchive } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { listCodexSessions, codexThreadMetadata, openCodexAppServer, readCodexSession, readCodexArchiveStates, CodexAppServerError } from './codex-app-server.js';
 import { listClaudeSessions, readClaudeSession } from './claude-sessions.js';
 import { loadPurposeRuleSet } from './purpose-instruction.js';
 import { originalSessionTarget } from './original-session-target.js';
@@ -114,12 +114,13 @@ async function requireClaudeChannel(record, metadata, inspectProcess) {
 }
 
 export async function discoverSessions({ root, openClient = openCodexAppServer, listClaude = listClaudeSessions,
-  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, codexHome, connectedProviders = ['codex', 'claude'] } = {}) {
+  inspectProcess = processIdentity, now = Date.now(), signal, listCodexTitles = readCodexTitles, codexHome, connectedProviders = ['codex', 'claude'], includeArchived = false } = {}) {
   const assertActive = () => { if (signal?.aborted) throw new CodexAppServerError('cancelled', 'Conversation discovery was cancelled.'); };
   assertActive();
   const connected = new Set(connectedProviders);
   const records = (await listRecords(root)).filter(record => connected.has(record.provider));
   const priorities = records.filter(retainedSession);
+  let archivedCodex = [];
   let discovered = [], codexError = null, codexReasonCode = null, claude = [], claudeError = null;
   let archiveStates = new Map();
   await Promise.all([
@@ -127,8 +128,25 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       try { if (connected.has('codex')) discovered = await withClient(openClient, async client => {
         const active = await listCodexSessions({ client, inspectState: true, maxSessions: RECENT_SESSION_LIMIT, codexHome,
           prioritySessions: priorities.filter(record => record.provider === 'codex').map(record => record.session) });
+        if (includeArchived) {
+          const observedArchives = new Map();
+          const archiveClient = { request: async (method, params) => {
+            const response = await client.request(method, params);
+            if (method === 'thread/list' && params.archived === true) {
+              for (const thread of (response?.data || []).slice(0, params.limit)) {
+                const item = codexThreadMetadata(thread);
+                if (item && ['cli', 'vscode', 'appServer'].includes(item.source)) observedArchives.set(item.session, { ...item, archived: true });
+              }
+            }
+            return response;
+          } };
+          try { await listCodexSessions({ client: archiveClient, archived: true, maxSessions: RECENT_SESSION_LIMIT }); }
+          catch { /* Keep positive archive pages even if a later page fails. */ }
+          archivedCodex = [...observedArchives.values()];
+        }
         const ids = new Set(active.map(item => item.session));
         archiveStates = await readCodexArchiveStates(client, records.filter(record => record.provider === 'codex' && !ids.has(record.session)), { codexHome });
+        for (const item of archivedCodex) archiveStates.set(item.session, true);
         return active;
       }, signal); }
       catch (error) {
@@ -149,6 +167,7 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
     const record = records[index];
     if (record.provider !== 'codex') continue;
     const isArchived = archiveStates.get(record.session) === true;
+    if (isArchived) await recordProviderArchive(root, record.provider, record.session, true, now);
     if (isArchived && record.providerArchived === true) continue;
     if (!isArchived && !(record.providerArchived === true && (activeCodex.has(record.session) || archiveStates.get(record.session) === false))) continue;
     try { records[index] = await updateRecord(root, record.provider, record.session, current => {
@@ -163,7 +182,9 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
         }
       }
       return current;
-    }); } catch {
+    });
+      if (!isArchived) await recordProviderArchive(root, record.provider, record.session, false, now);
+    } catch {
       // Reconciliation can contend with a hook writer or an unreclaimable
       // legacy lock. Preserve stored state and retry on the next refresh;
       // one record must not discard either provider's entire catalog.
@@ -172,20 +193,30 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   assertActive();
   const byKey = new Map();
   const recordsByKey = new Map(records.map(record => [`${record.provider}:${record.session}`, record]));
-  for (const item of [...discovered, ...claude]) {
+  for (const item of [...discovered, ...claude, ...archivedCodex]) {
+    if (includeArchived && item.archived === true) { byKey.set(`${item.provider}:${item.session}`, item); continue; }
     if ((item.provider !== 'codex' || archiveStates.get(item.session) !== true) && recordsByKey.get(`${item.provider}:${item.session}`)?.providerArchived !== true) byKey.set(`${item.provider}:${item.session}`, item);
   }
+  const requiredAncestors = new Set();
+  for (const item of byKey.values()) {
+    let parent = recordsByKey.get(`${item.provider}:${item.session}`)?.parentSession || item.parentSession;
+    for (let depth = 0; parent && depth < 256; depth++) {
+      const key = `${parent.provider}:${parent.session}`;
+      if (requiredAncestors.has(key)) break;
+      requiredAncestors.add(key); parent = recordsByKey.get(key)?.parentSession;
+    }
+  }
   for (const record of records) {
     // Positive provider evidence still suppresses archived conversations if
     // their local reconciliation could not be persisted. Never grant work
     // from an unsuccessful unarchive reconciliation.
-    if (record.provider === 'codex' && archiveStates.get(record.session) === true) continue;
-    if (record.providerArchived === true) continue;
+    const archived = record.providerArchived === true || record.provider === 'codex' && archiveStates.get(record.session) === true;
+    if (archived && !includeArchived) continue;
     const key = `${record.provider}:${record.session}`;
     // A hook observation can belong to an AI-created worker. Only explicit
     // supervision may restore a conversation absent from provider discovery.
-    if (!byKey.has(key) && retainedSession(record)) byKey.set(key, {
-      provider: record.provider, session: record.session, cwd: record.cwd, title: '', source: record.admission?.source || 'hook',
+    if (!byKey.has(key) && (retainedSession(record) || requiredAncestors.has(key) && (record.observedAt || record.admission?.validatedAt))) byKey.set(key, {
+      provider: record.provider, session: record.session, cwd: record.cwd, title: '', archived, source: record.admission?.source || 'hook',
       lastActivityAt: record.observedAt || record.admission?.validatedAt || record.run?.updatedAt || null,
       observation: { source: record.admission?.source || `${record.provider}_hook`, observedAt: record.observedAt || record.admission?.validatedAt || null },
       availability: 'unknown', model: record.admission?.model || null,
@@ -193,15 +224,32 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
   }
   // Select recent history before live probes, keeping explicit supervision
   // visible even during a truncated discovery or provider outage.
-  const items = recentSessionWindow([...byKey.values()], {
+  const catalog = [...byKey.values()].map(item => {
+    const record = recordsByKey.get(`${item.provider}:${item.session}`);
+    return { ...item, ...((record?.parentSession || item.parentSession) ? { parentSession: record?.parentSession || item.parentSession } : {}) };
+  });
+  const items = [...recentSessionWindow(catalog.filter(item => item.archived !== true), {
     priority: item => retainedSession(recordsByKey.get(`${item.provider}:${item.session}`)),
-  }), projected = new Array(items.length);
+  }), ...recentSessionWindow(catalog.filter(item => item.archived === true))];
+  // Include archived ancestors of active rows even when archive visibility is off.
+  const catalogByKey = new Map(catalog.map(item => [`${item.provider}:${item.session}`, item]));
+  const includedKeys = new Set(items.map(item => `${item.provider}:${item.session}`));
+  for (const item of items) {
+    let parent = item.parentSession;
+    while (parent) {
+      const key = `${parent.provider}:${parent.session}`;
+      if (includedKeys.has(key) || !catalogByKey.has(key)) break;
+      const ancestor = catalogByKey.get(key); includedKeys.add(key); items.push(ancestor); parent = ancestor.parentSession;
+    }
+  }
+  const projected = new Array(items.length);
   const codexTitles = items.some(item => item.provider === 'codex' && !sessionTitle(item.title)) ? await listCodexTitles() : new Map();
   assertActive();
   let nextItem = 0;
   const project = async item => {
     const record = recordsByKey.get(`${item.provider}:${item.session}`);
     const run = record?.run;
+    const archived = item.archived === true || record?.providerArchived === true;
     const mode = run?.managed ? run.state === 'recovery_required' && run.recoveryCause === 'session_supervision' ? 'pending_takeover' : 'managed' : run ? 'standard_loop' : record?.monitor ? 'monitor' : 'unmanaged';
     const codexChannel = codexContinuationChannel(item.observation.source, item.model, codexError ? { code: codexReasonCode, reason: codexError } : null);
     const supported = item.provider === 'codex' && codexChannel.ready;
@@ -216,7 +264,9 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
           cwd: await realpath(item.cwd), source: item.observation.source, model: item.model, validatedAt: now };
       } catch { /* Missing workspaces cannot grant an admission. */ }
     }
-    const availability = autoContinueAvailability(run, claudeChannel || codexChannel);
+    const availability = archived ? { canEnable: false, reasonCode: 'session_archived',
+      reason: 'Restore the original provider conversation before enabling automatic continuation.' }
+      : autoContinueAvailability(run, claudeChannel || codexChannel);
     const upgradeable = canUpgradeDelivery(run);
     const continuationIssue = liveHook && run ? !run.managed && !upgradeable
       ? { code: 'existing_loop', reason: 'This conversation already has a Delivery Loop. Use its existing controls.' }
@@ -233,14 +283,15 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       } catch { /* Unverified process leaves runtime status unknown. */ }
     }
     return { provider: item.provider, session: item.session, cwd: item.cwd,
-      ...((item.parentSession || record?.parentSession) ? { parentSession: item.parentSession || record.parentSession } : {}),
+      ...((item.parentSession || record?.parentSession) ? { parentSession: record?.parentSession || item.parentSession } : {}),
       title: sessionTitle(item.title) || (item.provider === 'codex' ? codexTitles.get(item.session) || '' : ''), source: item.source,
       ...(typeof isRunning === 'boolean' ? { isRunning } : {}),
       ...(item.latestTurnId ? { latestTurnId: item.latestTurnId } : {}),
       ...(item.providerGoal !== undefined ? { providerGoal: item.providerGoal } : {}),
       ...(item.goalReadState ? { goalReadState: item.goalReadState } : {}),
       tracked: typeof record?.tracked === 'boolean' ? record.tracked : record?.monitor === true,
-      autoContinue: record?.autoContinue === true,
+      archived,
+      autoContinue: !archived && record?.autoContinue === true,
       autoContinueEpoch: record?.autoContinue === true ? record.autoContinueEpoch : null,
       autoContinueAvailability: availability,
       ...autoContinueState(record, isRunning, availability),
@@ -249,13 +300,13 @@ export async function discoverSessions({ root, openClient = openCodexAppServer,
       binding: { mode, taskId: run?.managed?.taskId || record?.associationTaskId || null },
       originalSessionTarget: originalSessionTarget(item.provider, item.session),
       continuationMode: item.provider === 'claude' ? liveHook ? 'live_hook' : 'manual' : supported ? 'codex_app_server' : 'manual',
-      ...(continuationAdmission ? { continuationAdmission } : {}),
+      ...(!archived && continuationAdmission ? { continuationAdmission } : {}),
       continuationReasonCode: availability.reasonCode || claudeChannel?.code || 'ready',
       capabilities: { canMonitor: item.capabilities?.canMonitor ?? true,
-        canPurposeContinue: supported && (!run || !['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(run.state)),
-        canAnalyze: !run && (item.provider === 'codex' ? item.observation.source === 'codex_app_server' && !codexError : item.observation.source === 'claude_local_index' && !claudeError),
-        canEnroll: (supported || liveHook) && !run, canContinue: (supported || liveHook) && !run,
-        canAutoContinue: (supported || liveHook) && (!run || upgradeable || Boolean(run.managed) && !TERMINAL_RUNS.has(run.state)) },
+        canPurposeContinue: !archived && supported && (!run || !['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted'].includes(run.state)),
+        canAnalyze: !archived && !run && (item.provider === 'codex' ? item.observation.source === 'codex_app_server' && !codexError : item.observation.source === 'claude_local_index' && !claudeError),
+        canEnroll: !archived && (supported || liveHook) && !run, canContinue: !archived && (supported || liveHook) && !run,
+        canAutoContinue: !archived && (supported || liveHook) && (!run || upgradeable || Boolean(run.managed) && !TERMINAL_RUNS.has(run.state)) },
       reason: item.provider === 'claude' ? continuationIssue?.reason || claudeChannel.reason :
         codexError || (!supported ? 'Exact model or provider metadata is unavailable.' : null),
     };

package/src/session-supervision/session-lineage.js

@@ -0,0 +1,27 @@
+import { readRecord, updateRecord, withSessionParentLock, validateSessionParent } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+
+const providers = new Set(['codex', 'claude']);
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const key = item => `${item.provider}:${item.session}`;
+
+// This is navigation metadata only. Linking never enrolls, resumes, archives,
+// approves or changes the provider's native conversation identity.
+export async function linkSessionParent({ root, provider, session, parentProvider, parentSession }) {
+  const child = { provider, session }, parent = { provider: parentProvider, session: parentSession };
+  for (const item of [child, parent]) {
+    if (!providers.has(item.provider) || !uuid.test(item.session || '')) throw new Error('Exact provider and session IDs are required.');
+  }
+  if (key(child) === key(parent)) throw new Error('A conversation cannot be its own parent.');
+  return withSessionParentLock(root, async () => {
+    const record = await readRecord(root, provider, session);
+    if (!record?.observedAt && !record?.admission?.validatedAt) throw new Error('The child must be an observed provider conversation.');
+    await validateSessionParent(root, child, parent);
+    return await updateRecord(root, provider, session, current => {
+      if (!current) throw new Error('The child conversation is no longer available.');
+      if (current.parentSession && key(current.parentSession) !== key(parent)) throw new Error('An existing parent cannot be silently replaced.');
+      current.parentSession = parent;
+      current.parentSessionSource = 'explicit';
+      return current;
+    });
+  });
+}