@awak-app/simy-cli 0.7.11 → 0.7.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.11",
+  "version": "0.7.12",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,3 +1,4 @@
+import { createLedgerExecutionWorker, discoverLedgerWorkers } from './update-detachment/worker-ledger.js';
 import { normalizeProviderModelSelection } from "./provider-model-selection.js";
 import { assertConnectionScope, connectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
 import { authorizeLaunch } from "./launch-authorization.js";
@@ -118,6 +119,7 @@ import {
   DirectTaskRegistry,
   startDirectTask,
   stopDirectTask,
+  restoreDirectWorkerTask,
 } from "./direct-executor.js";
 import {
   classifyExecutionRequirement,
@@ -214,6 +216,22 @@ export async function startAgent({
   // as its device (see /v1/auth/complete), so keep it after it is cleared.
   let reclaimableSession = null;
   if (session && sessionRequiresWebAuthorization(session, apiOrigin)) session = null;
+  const recoverDirectWorkers = async () => {
+    if (!isSessionValid(session, Date.now(), apiOrigin) || !session?.account_id || !session?.device_id) return [];
+    const actor = { account: session.account_id, device: session.device_id };
+    const actorCurrent = () => isSessionValid(session, Date.now(), apiOrigin) && session.account_id === actor.account && session.device_id === actor.device;
+    const handles = await discoverLedgerWorkers({ root: sessionRoot, ...actor, origin: apiOrigin });
+    for (const handle of handles) {
+      const worker = createLedgerExecutionWorker({ identity: handle.identity });
+      // Async adoption must not publish an old actor's task after sign-in changes.
+      const restored = await restoreDirectWorkerTask({ worker, handle, registry: new DirectTaskRegistry() });
+      if (!actorCurrent()) return [];
+      if (!directRegistry.get(handle.taskId)) directRegistry.create(restored);
+      else await restoreDirectWorkerTask({ worker, handle, registry: directRegistry });
+    }
+    return handles;
+  };
+  await recoverDirectWorkers();
   const purposeKeyPath = dependencies.purposeSigningKeyPath || purposeSigningKeyPath(sessionRoot);
   let purposeSigner = null;
   const refreshPurposeSigner = async () => {
@@ -526,7 +544,7 @@ export async function startAgent({
       await callback?.(...args);
       await guard();
     };
-    return { ...options, beforeProviderInvocation: wrap(options.beforeProviderInvocation), beforeSpawn: wrap(options.beforeSpawn) };
+    return { ...options, sessionRoot, beforeProviderInvocation: wrap(options.beforeProviderInvocation), beforeSpawn: wrap(options.beforeSpawn) };
   };
   const codingRuntimeOptions = run => {
     const wrap = (custom, marker) => async context => {
@@ -1960,8 +1978,9 @@ export async function startAgent({
           json(res, 401, { error: "simy session expired; run simy again" });
           return;
         }
+        await recoverDirectWorkers();
         const task = directRegistry.get(decodeURIComponent(directExecutionMatch[1]));
-        if (!task) {
+        if (!task || task.worker_handle && (task.worker_handle.identity.account !== session?.account_id || task.worker_handle.identity.device !== session?.device_id)) {
           json(res, 404, { error: "direct task not found" });
           return;
         }
@@ -2055,7 +2074,15 @@ export async function startAgent({
         const link = inspectedLinks.get(inspection);
         await authorizeProviderDispatch(body.backend, requestAccessScope, link);
         const runDirectTask = dependencies.runDirectTask || startDirectTask;
-        const directOptions = { resolveCommand: async input => {
+        const directWorkerIdentity = { root: sessionRoot, provider: body.backend,
+          session: task.id, account: session.account_id, device: session.device_id,
+          origin: apiOrigin, worktree: repositoryPath };
+        // Production command resolution is wrapped for authorization; explicitly
+        // select the durable owner so this wrapper cannot disable worker execution.
+        const directWorker = (typeof dependencies.executionWorker === "function" ? dependencies.executionWorker({ identity: directWorkerIdentity }) : dependencies.executionWorker) || (!dependencies.runDirectTask &&
+          !dependencies.resolveDesktopExecutorCommand && process.platform !== "win32"
+          ? createLedgerExecutionWorker({ identity: directWorkerIdentity }) : null);
+        const directOptions = { session, apiOrigin, sessionRoot, ...(directWorker ? { worker: directWorker, workerBinding: directWorkerIdentity } : {}), resolveCommand: async input => {
           const command = await (dependencies.resolveDesktopExecutorCommand || resolveDesktopExecutorCommand)(input);
           await authorizeProviderDispatch(body.backend, requestAccessScope, link);
           return command;
@@ -2635,6 +2662,11 @@ export async function startAgent({
     startHeartbeatTimer();
   }
 
+  const directTaskVisible = task => !task.worker_handle || isSessionValid(session, Date.now(), apiOrigin) && task.worker_handle.identity.account === session.account_id && task.worker_handle.identity.device === session.device_id;
+  const directRegistryView = {
+    list: () => directRegistry.list().filter(directTaskVisible),
+    get: id => { const task = directRegistry.get(id); return task && directTaskVisible(task) ? task : null; },
+  };
   const stopDesktopTask = async key => {
     if (typeof key !== "string" || key.length > 256) throw new Error("Select a running task.");
     if (key.startsWith("sqm:")) {
@@ -2644,7 +2676,7 @@ export async function startAgent({
     const match = /^(0|1|2):(.+)$/.exec(key);
     if (!match) throw new Error("Select a running task.");
     const index = Number(match[1]);
-    const task = [registry, directRegistry, localTaskRegistry][index].get(match[2]);
+    const task = [registry, directRegistryView, localTaskRegistry][index].get(match[2]);
     if (!task) throw new Error("This task is no longer available.");
     if (!canStopDesktopTask(task, index)) return;
     await [stopLocalCodingRun, stopDirectTask, stopLocalTask][index](task);
@@ -2654,7 +2686,7 @@ export async function startAgent({
     desktopWorkSuspended = true;
     const stops = [sqmLocalReviewWorker?.close?.(), durableLocalTaskWorker?.close?.(),
       ...[registry, directRegistry, localTaskRegistry].flatMap((source, index) => source.list()
-        .filter(task => canStopDesktopTask(task, index))
+        .filter(task => canStopDesktopTask(task, index) && task.update_owner_transferred !== true)
         .map(task => [stopLocalCodingRun, stopDirectTask, stopLocalTask][index](task)))];
     const results = await Promise.allSettled(stops);
     const failure = results.find(result => result.status === "rejected");
@@ -2693,6 +2725,7 @@ export async function startAgent({
     return JSON.stringify(scope) === JSON.stringify(currentHistoryScope()) ? items : [];
   };
   const getDesktopStatus = async () => {
+    await recoverDirectWorkers();
     const authorization = authorizationWindow.snapshot();
     const auth = desktopAuthStatus(session, { webOrigin: apiOrigin });
     if (auth.state === "signed_in" && organizationState === "unknown") void refreshOrganizations();
@@ -2716,7 +2749,7 @@ export async function startAgent({
         pending: Boolean(pendingOrganization || desktopLoginPending) },
       ...(enforceDesktopAccess ? { access: { ...desktopAccess.snapshot(), revision: desktopScopeRevision() } } : {}),
       connection: connectionStatus.snapshot({ authenticated: auth.state === "signed_in" }),
-      tasks: desktopTaskStatus([registry, directRegistry, localTaskRegistry]),
+      tasks: desktopTaskStatus([registry, directRegistryView, localTaskRegistry]),
       organizations: { state: organizationState, items: organizationItems, selectedId: session?.organization_id ?? null,
         switching: Boolean(pendingOrganization), canSwitch: auth.state === "signed_in" },
       sqm: { enabled: sqmEnabled, engineFallbackEnabled: sqmEngineSettings.enable_engine_fallback,
@@ -2743,6 +2776,8 @@ export async function startAgent({
     port,
     registry,
     directRegistry,
+    recoverDirectWorkers,
+    directWorkerHandles: () => directRegistry.list().map(task => task.worker_handle).filter(handle => handle && handle.identity.account === session?.account_id && handle.identity.device === session?.device_id),
     localTaskRegistry,
     durableLocalTaskWorker,
     sqmLocalReviewWorker,
@@ -2813,6 +2848,10 @@ export async function startAgent({
       if (!isSessionValid(session, Date.now(), apiOrigin) || pendingOrganization) return null;
       return { token: session.token, api_base_url: session.api_base_url };
     },
+    getUpdateDetachmentContext() {
+      return { actor: isSessionValid(session, Date.now(), apiOrigin) && !pendingOrganization ? { account: session.account_id, device: session.device_id, origin: apiOrigin } : null,
+        runs: registry.list(), directTasks: directRegistry.list(), localTasks: localTaskRegistry.list() };
+    },
     getDesktopStatus,
     stopDesktopTask,
     stopDesktopTasks,
@@ -2824,7 +2863,8 @@ export async function startAgent({
         if (JSON.stringify(scope) !== JSON.stringify(currentHistoryScope())) return null;
         return sqmLocalReviewWorker?.desktopTaskDetail?.(key) ?? detail;
       }
-      return desktopTaskDetail([registry, directRegistry, localTaskRegistry], key);
+      await recoverDirectWorkers();
+      return desktopTaskDetail([registry, directRegistryView, localTaskRegistry], key);
     },
     async refreshDesktopStatus() {
       if (isSessionValid(session, Date.now(), apiOrigin)) {

package/src/auto-update.js

@@ -69,6 +69,8 @@ export class CliAutoUpdater extends EventEmitter {
   #stopped = false;
   #registryListener = null;
   #activeWork = 0;
+  #coordinator = null;
+  #connectionTransferred = false;
   #confirmedUpdate = null;
   #confirmedReady = false;
   #desktopIdle = () => true;
@@ -157,7 +159,7 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   acceptsNewWork() {
-    return this.#applyHolds === 0 && !this.#confirmedUpdate && !["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state);
+    return (!this.#coordinator || this.#coordinator.acceptsNewWork()) && this.#applyHolds === 0 && !this.#confirmedUpdate && !["stopping_tasks", "updating", "restarting"].includes(this.#snapshot.state);
   }
 
   beginWork() {
@@ -174,7 +176,12 @@ export class CliAutoUpdater extends EventEmitter {
     };
   }
 
-  start({ registry, restartDaemon, isDesktopIdle = () => true } = {}) {
+  updateDrainState() { return { activeWork:this.#activeWork, applyHolds:this.#applyHolds }; }
+
+  setCoordinator(coordinator) { this.#coordinator = coordinator; }
+
+  start({ registry, restartDaemon, isDesktopIdle = () => true, coordinator } = {}) {
+    this.#coordinator = coordinator || null;
     if (this.#snapshot.state === "disabled" || this.#checkTimer || this.#stopped) return this;
     this.#registry = registry;
     this.#restartDaemon = restartDaemon;
@@ -284,15 +291,27 @@ export class CliAutoUpdater extends EventEmitter {
     }
   }
 
-  async maybeApply() {
+  async maybeApply({ detach = false } = {}) {
     if (this.#confirmedUpdate && !this.#confirmedReady) return this.snapshot();
     if (this.#stopped || this.#snapshot.state !== "waiting_for_idle") {
       return this.snapshot();
     }
     if (this.#applying) return this.#applying;
-    if (!this.#isIdle()) return this.snapshot();
-
-    this.#applying = this.#performUpdate().finally(() => {
+    if (!this.#isIdle() && !(detach && this.#coordinator)) return this.snapshot();
+
+    this.#applying = (this.#coordinator
+      ? this.#coordinator.detachUpdate(async () => {
+          const result = await this.#performUpdate();
+          return { healthy: result.state === "updated", connectionTransferred: this.#connectionTransferred };
+        }).then(connection => {
+          if (connection.state !== 'connected') throw new Error('Original conversation reconciliation requires recovery.');
+          return this.snapshot();
+        })
+      : this.#performUpdate()).catch(error => {
+        this.#clearIdleTimer();
+        this.#setState("failed", { message: "Update connection requires recovery before retrying.", error: errorMessage(error) });
+        return this.snapshot();
+      }).finally(() => {
       this.#applying = null;
     });
     return this.#applying;
@@ -344,7 +363,8 @@ export class CliAutoUpdater extends EventEmitter {
         message: `SIMY CLI ${targetVersion} is installed. Verifying the restarted daemon...`,
       });
       this.#announce();
-      await this.#restartDaemon?.(targetVersion, installation);
+      const handoff = await this.#restartDaemon?.(targetVersion, installation);
+      this.#connectionTransferred = handoff?.connectionTransferred === true;
       this.#clearIdleTimer();
       this.#setState("updated", {
         message: `SIMY CLI ${targetVersion} is running.`,
@@ -382,7 +402,8 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   #isIdle() {
-    return this.#applyHolds === 0 && this.#activeWork === 0 && isRegistryIdle(this.#registry) && this.#desktopIdle();
+    if (this.#coordinator?.snapshot().state === 'detached') return this.#applyHolds === 0 && this.#activeWork === 0;
+    return this.#applyHolds === 0 && this.#activeWork === 0 && isRegistryIdle(this.#registry, { allowSuspended: Boolean(this.#coordinator) }) && this.#desktopIdle();
   }
 
   #clearIdleTimer() {
@@ -905,12 +926,14 @@ export async function reexecuteCliCommand({
   });
 }
 
-export function isRegistryIdle(registry) {
+export function isRegistryIdle(registry, { allowSuspended = false } = {}) {
   const runs = registry?.list?.() || [];
   return runs.every((run) => {
     if (run?.operation || run?.child || run?.pendingLedgerUpdate || run?.ledgerUpdateRunning) {
       return false;
     }
+    if (allowSuspended && ["paused", "blocked", "waiting_human"].includes(run?.controlState || run?.status) && !run?.unsettledPermission) return true;
+    if (run?.unsettledPermission) return false;
     if (NON_IDLE_STATES.has(run?.status)) return false;
     if (NON_IDLE_CONTROL_STATES.has(run?.controlState)) return false;
     return true;

package/src/cli-contract.js

@@ -13,7 +13,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.11";
+export const CLI_VERSION = "0.7.12";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { captureDispatchProvenance } from './update-dispatch-identity.mjs';
 import { MAX_STATE_BYTES } from './state-limits.mjs';
 import { currentRecoveryIncident, recordRecoveryIncident, recordRecoveryStage, settleRecoveryIncidents, resolveRecoveryReceipt } from './recovery-incident.mjs';
 import { rememberPerspectives, perspectiveScope, recallPerspectives, perspectiveInstruction } from './perspective-memory.mjs';
@@ -13,6 +14,8 @@ import { searchEnabled, failureLimitReached, searchState, recordSearchExperiment
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
+import { atomicSave, readState } from './update-state-store.mjs';
+import { captureHookOwner, fenceHook, rootFromDelivery, readDispatchGate, readTaskAdmission } from './update-dispatch-gate.mjs';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -26,7 +29,7 @@ import { continuationMode } from './continuation-policy.mjs';
 import { evaluateOutcomeProgress, restartOutcomeProgressWindow } from './outcome-progress.mjs';
 
 export const TERMINAL = new Set(['completed', 'reported_done', 'stopped', 'failed', 'budget_exhausted']);
-const EVENTS = new Set(['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification']);
+const EVENTS = new Set(['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'PermissionRequest', 'Notification', 'ConfigChange', 'PostModelSwitch']);
 const MAX_BYTES = 256 * 1024;
 const RETRYABLE = new Set(['overloaded', 'server_error', 'rate_limit']);
 const APPROVAL_DECISIONS = new Set(['automatic', 'proceed_and_report', 'wait']);
@@ -1694,19 +1697,79 @@ async function providerProcess(provider) {
   }
   return null;
 }
-export async function handleHook({ input, provider, root = rootDirectory(), now = Date.now(), observedProcess = undefined, inspectProcess = processIdentity, recallMemory = recallPerspectives, env = process.env }) {
+export const stopMarkerPath = (root, provider, session) => `${recordPath(root, provider, session)}.user-stop`;
+export const updateInvalidationPath = (root, provider, session) => `${recordPath(root, provider, session)}.update-invalidation`;
+export function hasPendingUpdateInvalidation(root, record) {
+  const marker = readState(updateInvalidationPath(root, record.provider, record.session));
+  return !marker || marker.schemaVersion !== 1 || typeof marker.id !== 'string' || !marker.id || marker.id !== record.updateObservation?.invalidationId;
+}
+export function hasPendingUserStop(root, record) {
+  if (!record?.run) return false;
+  const marker = readState(stopMarkerPath(root, record.provider, record.session));
+  return Boolean(marker && marker.runId === record.run.id && marker.id !== record.run.handledStopMarkerId);
+}
+// Synchronous last check after the dispatch journal, immediately before emission.
+// A UI stop/pause or OFF committed during async evaluation must win over old output.
+export function canEmitHookContinuation(root, observed) {
+  const latest = readState(recordPath(root, observed?.provider, observed?.session));
+  return Boolean(latest?.run && latest.run.id === observed?.run?.id &&
+    latest.run.revision === observed.run.revision && !TERMINAL.has(latest.run.state) &&
+    !['paused', 'blocked', 'recovery_required', 'verification_pending'].includes(latest.run.state) &&
+    automaticContinuationAllowed(latest) && !hasPendingUserStop(root, latest));
+}
+export async function handleHook(options) {
+  const root = options.root || rootDirectory(), event = options.input?.hook_event_name;
+  if (!EVENTS.has(event) || !text(options.input?.session_id) || !text(options.input?.cwd)) return {};
+  const permissionWait = event === 'PermissionRequest' || event === 'Notification' && ['permission_prompt', 'elicitation_dialog'].includes(options.input.notification_type);
+  if (options.provider === 'claude' && (permissionWait || ['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'ConfigChange', 'PostModelSwitch'].includes(event))) {
+    const priorInvalidationId = readState(updateInvalidationPath(root, options.provider, options.input.session_id))?.id || null;
+    const marker = { schemaVersion: 1, id: randomUUID(), event };
+    atomicSave(updateInvalidationPath(root, options.provider, options.input.session_id), marker);
+    options = { ...options, invalidationId: marker.id, priorInvalidationId };
+  }
+  if (event === 'Interrupt') {
+    const record = await read(recordPath(root, options.provider, options.input?.session_id));
+    if (record?.run) atomicSave(stopMarkerPath(root, options.provider, options.input.session_id), { schemaVersion: 1, id: randomUUID(), runId: record.run.id });
+  }
+  // Stop/permission lifecycle must never wait on the update dispatch lock.
+  if (event !== 'Stop' && event !== 'SessionStart') { const output = await handleHookState({ ...options, root, suppressDispatch: true }); if (options.emit) options.emit(output); return output; }
+  try {
+    const observedProcess = options.observedProcess === undefined ? await providerProcess(options.provider) : options.observedProcess;
+    options = { ...options, observedProcess };
+    const owner = captureHookOwner(rootFromDelivery(root), options.provider, options.input?.session_id, observedProcess);
+    let current = await read(recordPath(root, options.provider, options.input.session_id)), pendingOutput;
+    return await fenceHook(owner, `${options.provider}:${options.input?.session_id}`, async suppressDispatch => {
+      const output = await handleHookState({ ...options, root, suppressDispatch });
+      pendingOutput = output;
+      current = await read(recordPath(root, options.provider, options.input.session_id));
+      return hasPendingUserStop(root, current) ? {} : output;
+    }, options.emit, () => pendingOutput?.decision !== 'block' || canEmitHookContinuation(root, current), () => {
+      const taskId = current?.run?.managed?.taskId || current?.run?.id;
+      return taskId ? { taskId, attemptId: (current.run.managed?.executionAttempt?.phase === 'dispatching' ? current.run.managed.executionAttempt.id : null) || `${taskId}:hook:${current.run.continuations}`, provenance: captureDispatchProvenance({ root: owner.root, provider: current.provider, providerSession: current.session, worktree: taskDirectory(current), taskId, recordRef: recordPath(root, current.provider, current.session) }) } : null;
+    });
+  } catch (error) {
+    if (error.code !== 'state_busy') throw error;
+    // Still reconcile the boundary/checkpoint. No automatic instruction is emitted.
+    await handleHookState({ ...options, root, suppressDispatch: true });
+    if (options.emit) options.emit({});
+    return {};
+  }
+}
+async function handleHookState({ input, provider, root = rootDirectory(), now = Date.now(), observedProcess = undefined, inspectProcess = processIdentity, suppressDispatch = false, invalidationId = null, priorInvalidationId = null, recallMemory = recallPerspectives, env = process.env }) {
   const link = await providerLinkState(root, provider);
   if (!link.connected) return {};
   if (!EVENTS.has(input?.hook_event_name) || !text(input.session_id) || !text(input.cwd)) return {};
   let cwd; try { cwd = await realpath(input.cwd); } catch { return {}; }
   const event = input.hook_event_name;
-  const identity = observedProcess === undefined && (['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event)) ? await providerProcess(provider) : observedProcess;
+  const identity = observedProcess === undefined && (['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'ConfigChange', 'PostModelSwitch'].includes(event)) ? await providerProcess(provider) : observedProcess;
   let output = {}, boundaryLease = null, claimedWorkspace = null, observed;
   const applyObservation = () => updateRecord(root, provider, input.session_id, async old => {
     const currentLink = await providerLinkState(root, provider);
     if (!currentLink.connected || currentLink.epoch !== link.epoch) return old;
     if (old && old.cwd !== cwd) return old;
     const record = old || { schemaVersion: 1, provider, session: input.session_id, cwd, run: null };
+    const stopMarker = readState(stopMarkerPath(root, provider, input.session_id));
+    if (record.run && typeof stopMarker?.runId === 'string' && stopMarker.runId === record.run.id && stopMarker.id !== record.run.handledStopMarkerId) { record.run.state = 'stopped'; record.run.reason = 'User interrupted the provider.'; }
     // Inherited provider identity links an AI-launched conversation to its
     // origin. Never infer parentage from a shared workspace or nearby time.
     if (event === 'SessionStart' && !record.parentSession) {
@@ -1721,18 +1784,36 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
         } catch { /* Unverified or cyclic ancestry never changes navigation. */ }
       }
     }
-    const owner = record.run?.managed?.liveHookOwner;
-    if (owner && ['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt'].includes(event) &&
+    const owner = record.run?.managed?.liveHookOwner || (['ConfigChange', 'PostModelSwitch'].includes(event) ? record.hookSessionProcess : null);
+    if (provider === 'claude' && ['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'ConfigChange', 'PostModelSwitch'].includes(event) &&
+        (!identity || owner && (identity.pid !== owner.pid || identity.identity !== owner.identity))) {
+      // An unverified lifecycle event invalidates prior proof without adopting
+      // its claimed process. In particular, never retain pre-change policy.
+      record.updateObservation = { schemaVersion: 1, process: null, source: event, observedAt: now, invalidationId,
+        model: null, permissionMode: null, backgroundIdle: false };
+    }
+    if (owner && ['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'ConfigChange', 'PostModelSwitch'].includes(event) &&
         (!identity || identity.pid !== owner.pid || identity.identity !== owner.identity)) {
-      if (!TERMINAL.has(record.run.state) && !['paused', 'verification_pending'].includes(record.run.state)) {
-        if (!(record.run.state === 'blocked' && record.run.managed.pendingApproval)) record.run.state = 'recovery_required';
+      if (record.run && !TERMINAL.has(record.run.state) && !['paused', 'verification_pending'].includes(record.run.state)) {
+        if (!(record.run.state === 'blocked' && record.run.managed?.pendingApproval)) record.run.state = 'recovery_required';
         record.run.recoveryCause = 'hook_owner_mismatch';
         record.run.reason = 'A different or unverified provider process reported this session. Inspect and explicitly resume in the original conversation.';
-        record.run.managed.autoRecovery = false; record.run.updatedAt = now; notifyState(record.run, now);
+        if (record.run.managed) record.run.managed.autoRecovery = false;
+        record.run.updatedAt = now; notifyState(record.run, now);
       }
       return record;
     }
     record.observedAt = now; record.lastEvent = event;
+    if (provider === 'claude' && identity && ['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'ConfigChange', 'PostModelSwitch'].includes(event)) {
+      // Optional model/mode observations are not complete permission evidence.
+      // Only an explicit empty task AND wakeup registry proves this boundary.
+      // The supported Claude baseline has no PostModelSwitch hook: a later Stop
+      // cannot prove that the SessionStart model is still selected.
+      record.updateObservation = { schemaVersion: 1, process: { ...identity }, source: event, observedAt: now, invalidationId,
+        model: event === 'SessionStart' ? text(input.model, 200) || null : null,
+        permissionMode: text(input.permission_mode, 64) || null,
+        backgroundIdle: event === 'Stop' && Array.isArray(input.background_tasks) && input.background_tasks.length === 0 && Array.isArray(input.session_crons) && input.session_crons.length === 0 };
+    }
     record.lastNotificationType = event === 'Notification' ? text(input.notification_type, 80) : null;
     if (identity) {
       // Legacy records have no frozen hook owner; a new process must not inherit
@@ -1751,6 +1832,14 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
     }
     if (event === 'SessionEnd') record.hookEndedAt = now;
     const run = record.run;
+    if(run && event==='Stop') {
+      // Recheck the actual retained task under its record lock. Lifecycle
+      // intake may continue after an update, but cannot spend failure or
+      // continuation budgets while that task's admission remains blocked.
+      const gateRoot=rootFromDelivery(root),gate=readDispatchGate(gateRoot);
+      const fences=Object.values(gate.taskFences?.records || {}).filter(item=>item.taskId===(run.managed?.taskId || run.id) && item.identity.provider===provider && item.identity.session===input.session_id);
+      if(fences.some(item=>!readTaskAdmission({root:gateRoot,identity:item.identity,taskId:item.taskId}).canResume))suppressDispatch=true;
+    }
     if (run && event === 'Stop' && input.turn_id && run.lastStopKey === `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}`) return record;
     // Observation only: human prompts mark work in progress, and real provider
     // stop/end boundaries settle it. Never infer running from SessionStart or
@@ -1797,7 +1886,7 @@ export async function handleHook({ input, provider, root = rootDirectory(), now
       run.state = failureLimitReached(run) ? 'failed' : 'recovery_required'; run.recoveryCause = 'provider_error';
       run.reason = RETRYABLE.has(input.error) ? 'Transient provider error. Resume the existing conversation after the provider recovers.' : 'Provider error requires attention before resuming.';
       run.errorCode = text(input.error, 100); run.retryable = RETRYABLE.has(input.error);
-    } else if (event === 'Stop') {
+    } else if (event === 'Stop' && !suppressDispatch) {
       // OFF suppresses future Stop blocking; it never interrupts the provider
       // turn. Lease settlement and runtime observation above still run.
       const latestLink = await providerLinkState(root, provider);
@@ -1926,6 +2015,13 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
          run.id !== expectedRunId || deliveryDecisionRevision(run) !== expectedRevision)) throw new Error('This decision changed. Refresh before choosing.');
     if (record.providerArchived === true && !['stop', 'pause'].includes(action)) throw new Error('Restore the original provider conversation before changing Delivery Loop.');
     if (run.managed && taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
+    if (['resume','replan','dependency_ready','session_answer'].includes(action)) {
+      const gateRoot=rootFromDelivery(root),gate=readDispatchGate(gateRoot);
+      const fences=Object.values(gate.taskFences?.records || {}).filter(item=>item.taskId===(run.managed?.taskId || run.id) && item.identity.provider===provider && item.identity.session===session);
+      if(fences.some(item=>!readTaskAdmission({root:gateRoot,identity:item.identity,taskId:item.taskId}).canResume)) {
+        throw Object.assign(new Error('Open the original conversation to review and continue. SIMY cannot resume this task until its current provider model and permissions are verified.'),{code:'task_admission_blocked'});
+      }
+    }
     if (['pending', 'pending_received'].includes(run.managed?.handoff?.status)) throw new Error('Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.');
     if (action !== 'stop' && run.managed?.handoff?.status === 'transferred') throw new Error('Task handoff is locked; continue in the received target session.');
     const commitControl = () => {
@@ -2062,6 +2158,8 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       }
     }
     else if (action === 'resume') {
+      const marker = readState(stopMarkerPath(root, provider, session));
+      if (marker?.runId === run.id) run.handledStopMarkerId = marker.id;
       const wasStopped = canExplicitlyResumeStopped(run);
       if (run.managed?.dependencyWait) throw new Error('Confirm the exact external dependency condition before resuming.');
       if (run.managed?.phase === 'needs_clarification') throw new Error('Answer the current session question before resuming.');
@@ -2193,7 +2291,6 @@ export async function main(provider) {
   let raw = '';
   try {
     for await (const chunk of process.stdin) { raw += String(chunk); if (Buffer.byteLength(raw) > MAX_BYTES) throw new Error('Hook input too large.'); }
-    const output = await handleHook({ input: JSON.parse(raw || '{}'), provider });
-    process.stdout.write(`${JSON.stringify(output)}\n`);
+    await handleHook({ input: JSON.parse(raw || '{}'), provider, emit: output => process.stdout.write(`${JSON.stringify(output)}\n`) });
   } catch { process.stdout.write('{}\n'); process.stderr.write('SIMY could not check delivery state; continuation was skipped. Inspect simy delivery status.\n'); }
 }