@awak-app/simy-cli 0.7.16 → 0.7.17

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import { decideLoop, compactWorkHistory } from './loop-kernel.mjs';
+import { completionContractIdentity } from './purpose-completion-contract.mjs';
 import { captureDispatchProvenance } from './update-dispatch-identity.mjs';
 import { MAX_STATE_BYTES } from './state-limits.mjs';
-import { continueResultCycle, resultEvent } from './result-cycle.mjs';
+import { continueResultCycle, resultEvent, resultFollowThroughInstruction, correctiveFollowupInstruction } from './result-cycle.mjs';
 import { currentRecoveryIncident, recordRecoveryIncident, recordRecoveryStage, settleRecoveryIncidents, resolveRecoveryReceipt } from './recovery-incident.mjs';
 import { rememberPerspectives, perspectiveScope, recallPerspectives, perspectiveInstruction } from './perspective-memory.mjs';
 import { recordHypothesisSheet } from './hypothesis-sheet.mjs';
@@ -276,7 +278,16 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
       if (serialized === previousBytes) return next;
       temporary = `${file}.${randomUUID()}.tmp`;
       await writeFile(temporary, serialized, { mode: 0o600 });
-      await rename(temporary, file);
+      // Windows readers or antivirus can briefly deny replacing the JSON.
+      // Keep the writer lock and the same complete payload while retrying;
+      // never rerun mutate or delete the last durable state to force a save.
+      for (let attempt = 0; ; attempt++) {
+        try { await rename(temporary, file); break; }
+        catch (error) {
+          if (error.code !== 'EPERM' || attempt >= 4) throw error;
+          await new Promise(resolve => setTimeout(resolve, 25 * (attempt + 1)));
+        }
+      }
     }
     return next;
   } finally { if (temporary) await rm(temporary, { force: true }); await releaseStateLock(lock, lockToken); }
@@ -464,7 +475,7 @@ export function evaluateAssessedPlan(plan, policy, scopes, now = Date.now(), { a
   const localWrite = action.kind === 'local_edit' || allowLocalTestWrites && action.kind === 'local_test' && facts.externalEffect === 'local';
   const autonomous = policy === 'autonomous' && llmDelegated;
   const external = autonomous && allowReversibleExternal && action.kind === 'external' && facts.externalEffect === 'external';
-  let reason = null, waitKind = 'research';
+  let reason = null, waitKind = autonomous ? 'research' : 'human';
   if (!scopes.includes(action.scope)) { reason = 'Action scope is outside the task enrollment.'; waitKind = 'authority'; }
   else if (facts.inObjective !== true) reason = 'Establish objective fit or choose work within the original task.';
   else if (facts.reversibility === 'irreversible') { reason = 'Irreversible consequences require an exact user decision.'; waitKind = 'human'; }
@@ -495,11 +506,12 @@ export function canExecuteAutonomousExternal(managed) {
 // Shared by live Stop hooks and cold exact-session recovery. Keep the result
 // contract identical across transports; the host still verifies acceptance.
 export function assessedCheckpointContract(decision, managed = null) {
-  const observationField = flexibleReasoning(managed) ? 'Plan diagnosis, recommendation and its reason are optional when the selected action is clear. Optional observations may be omitted; do not create evidence files, citations or extra reports. Actual tool results are captured by the controller.' : 'Include evidence:["concrete observation"] in actionResult.';
-  return `${minimalSufficientChangeInstruction({ turn: 'assessed' })}\nReturn ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened"} for THIS selected action. ${observationField} ${actionReversibilityInstruction} This is provider-reported, not independent verification. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. Missing facts are unknown. Completion claims go to SIMY independent inspection of the actual frozen acceptance conditions; no worker-authored proof is certification. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. missing_information requires a specific question. external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
+  const observationField = flexibleReasoning(managed) ? 'Plan diagnosis, recommendation and its reason are optional when the selected action is clear. Optional observations may be omitted; do not create evidence files, citations or extra reports. Actual tool results are captured by the controller.' : 'Return the observed result; evidence attachments and extra reports are optional.';
+  return `${minimalSufficientChangeInstruction({ turn: 'assessed' })}\nReturn ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened"} for THIS selected action. ${observationField} ${actionReversibilityInstruction} This is provider-reported, not independent verification. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. Missing facts are unknown. Successful diagnosis or repair is only an action result, not completion of the original user task. If original work remains, return in_progress with remainingWork and the next assessed plan, preserving the original objective, corrections and acceptance criteria. Do not repeat effects already performed. Completion claims go to SIMY independent inspection of the actual frozen acceptance conditions; no worker-authored proof is certification. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. ${informationWaitInstruction} external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
+
 }
 export function understandingCheckpointContract(decision) {
-  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use manual."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic for purpose search or manual otherwise. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
+  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\n${correctiveFollowupInstruction}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use manual."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic for purpose search or manual otherwise. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
 }
 function boundedContextList(value, maxItems = 8, maxLength = 300) {
   if (!Array.isArray(value) || value.length > maxItems) throw new Error('Session understanding has too many items.');
@@ -516,7 +528,9 @@ function boundedMatchingContext(value) {
 }
 function sessionUnderstanding(value) {
   if (!value || typeof value !== 'object' || Array.isArray(value) || !['clear', 'ambiguous', 'context_missing', 'already_done'].includes(value.state)) throw new Error('A structured session understanding is required.');
-  const basis = Array.isArray(value.basis) && value.basis.length <= 6 ? value.basis.map(item => {
+  // The checkpoint already has a byte limit. Preserve valid user references
+  // and their indices instead of discarding all context when there are >6.
+  const basis = Array.isArray(value.basis) ? value.basis.map(item => {
     if (!['user', 'assistant', 'artifact'].includes(item?.source)) throw new Error('Understanding basis needs a source.');
     const turnRef = contextText(item.turnRef, 100) || null;
     const snippet = contextText(item.snippet, 240) || null;
@@ -588,11 +602,13 @@ function recordPurposeProgress(run, now, countAttempt = true) {
 }
 function recordDecision(managed, plan, now) {
   let decision = evaluateAssessedPlan(plan, managed.autonomyPolicy, managed.approvalScopes, now, { allowLocalTestWrites: searchEnabled(managed), llmDelegated: searchEnabled(managed), allowReversibleExternal: searchEnabled(managed) && managed.resumeChannel === 'codex_app_server' });
-  if (searchEnabled(managed) && decision.outcome === 'wait') {
+  const dependencyPending = option => (option?.dependsOn || []).some(id =>
+    !managed.purpose?.evidence?.units?.some(unit => unit.id === id && unit.status === 'verified' && unit.purposeRevision === managed.purpose.evidence.purposeRevision));
+  if (searchEnabled(managed) && (decision.outcome === 'wait' || dependencyPending(plan.alternatives.find(row => row.id === plan.selectedOptionId)))) {
     rememberSearchWait(managed, decision.waitKind === 'research' ? 'research' : 'authorization', { action: decision.action, reason: decision.reason }, now);
     const priorities = new Map((managed.purpose.lastReview?.priorities || []).map(row => [row.optionId, row.rank]));
     for (const candidate of [...plan.alternatives].sort((a, b) => (priorities.get(a.id) ?? 99) - (priorities.get(b.id) ?? 99))) {
-      if (candidate.id === plan.selectedOptionId || !candidate.independent) continue;
+      if (candidate.id === plan.selectedOptionId || !candidate.independent || dependencyPending(candidate)) continue;
       const alternative = { ...plan, selectedOptionId: candidate.id, recommendation: { optionId: candidate.id, reason: 'Continue the highest listed eligible independent alternative.' } };
       const assessed = evaluateAssessedPlan(alternative, managed.autonomyPolicy, managed.approvalScopes, now, { allowLocalTestWrites: searchEnabled(managed), llmDelegated: searchEnabled(managed), allowReversibleExternal: searchEnabled(managed) && managed.resumeChannel === 'codex_app_server' });
       if (assessed.outcome !== 'wait' && !managed.rejectedActionOverflow && !managed.rejectedActionDigests?.includes(digest(JSON.stringify(assessed.action)))) {
@@ -625,8 +641,7 @@ function recordDecision(managed, plan, now) {
       writeResources: option?.writeResources || (decision.action.kind === 'read' ? [] : ['task']),
       requiredCapabilities: option?.requiredCapabilities || [decision.action.kind], requiredPermissions: option?.requiredPermissions || [decision.action.scope],
       status: decision.outcome === 'wait' ? 'waiting' : 'planned', evidenceRefs: [], purposeRevision: ledger.purposeRevision || 1, action: decision.action, createdAt: now });
-    if (ledger.units.length > 128) { ledger.unitsOmitted = true; ledger.units = ledger.units.filter(row => ['waiting','planned','unknown'].includes(row.status)).concat(ledger.units.filter(row => !['waiting','planned','unknown'].includes(row.status)).slice(-64)); }
-    if (ledger.units.length > 192) throw new Error('Work frontier needs reconciliation before more dispatch.');
+    compactWorkHistory(ledger);
   }
   managed.plan = plan; managed.decision = decision; managed.proposedAction = decision.action;
   managed.decisionHistory ||= [];
@@ -752,7 +767,63 @@ export function deliveryAcceptanceContext(run) {
     `${run.managed?.deliveryLevel ? ` Frozen delivery level: ${JSON.stringify(run.managed.deliveryLevel)}.` : ''}` +
     ` Pending acceptance (last recorded checks): ${JSON.stringify(pendingAcceptance(run))}. Continue only within the original request and permissions; manual checks require the user. SQM is optional and 0 applicable checks do not establish quality acceptance.`;
 }
-export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), executionCwd, upgradeRunId, objective, nextStep, maxMinutes, maxContinuations, maxFailures, continuationPolicy, managed, admission,
+// CLI automation is the default for connected providers with executing hooks.
+// Saved workspace overrides and revoked provider consent take precedence.
+async function automaticPath(root, provider, cwd) {
+  if (!['codex', 'claude'].includes(provider)) throw new Error('Choose --provider codex|claude.');
+  cwd = await realpath(cwd);
+  return { cwd, file: join(root, 'automatic', `${digest(`${provider}\0${cwd}`)}.json`) };
+}
+async function withAutomaticLock(root, provider, cwd, operation) {
+  const location = await automaticPath(root, provider, cwd);
+  await mkdir(dirname(location.file), { recursive: true, mode: 0o700 });
+  const lock = `${location.file}.lock`, token = await waitForStateLock(lock, processIdentity);
+  try { return await operation(location); } finally { await releaseStateLock(lock, token); }
+}
+export async function automaticDeliveryStatus({ root = rootDirectory(), provider, cwd = process.cwd() }) {
+  const location = await automaticPath(root, provider, cwd);
+  const saved = await read(location.file);
+  const link = await providerLinkState(root, provider);
+  const enabled = link.connected && (saved === null ? !link.requiresConsent
+    : saved.schemaVersion === 1 && saved.provider === provider && saved.cwd === location.cwd &&
+      saved.enabled === true && saved.providerLinkEpoch === link.epoch);
+  return { provider, cwd: location.cwd, enabled: Boolean(enabled), source: saved === null ? 'cli_default' : 'workspace',
+    reason: enabled ? 'The next nonempty prompt in a conversation without a loop starts Delivery Loop.' : 'Automatic start is disabled by a saved override or provider consent; it will not be restored by updates.',
+    prerequisite: 'SIMY plugin hooks must be enabled in the provider. This setting does not grant hook trust.',
+    existingLoops: 'Existing loops, pauses, stops and completed tasks are preserved.' };
+}
+export async function setAutomaticDelivery({ root = rootDirectory(), provider, cwd = process.cwd(), enabled }) {
+  if (typeof enabled !== 'boolean') throw new Error('Automatic start requires a boolean choice.');
+  return withAutomaticLock(root, provider, cwd, async location => {
+    const link = await providerLinkState(root, provider);
+    if (enabled && !link.connected) throw new Error('Reconnect this provider to SIMY before enabling automatic start.');
+    const temporary = `${location.file}.${randomUUID()}.tmp`;
+    try {
+      await writeFile(temporary, JSON.stringify({ schemaVersion: 1, provider, cwd: location.cwd, enabled,
+        providerLinkEpoch: link.epoch }), { mode: 0o600 });
+      await rename(temporary, location.file);
+    } finally { await rm(temporary, { force: true }); }
+    return automaticDeliveryStatus({ root, provider, cwd: location.cwd });
+  });
+}
+function initialDeliveryRun(objective, nextStep, now, maxFailures) {
+  return { id: randomUUID(), objective: text(objective), state: 'active', nextStep: text(nextStep),
+    startedAt: now, updatedAt: now, maxFailures: positive(maxFailures, 3, 10),
+    maxFailuresSource: maxFailures === undefined ? 'default' : 'explicit', continuations: 0, failures: 0,
+    revision: 0, consumedRevision: -1, checkpoint: null, reason: 'started', managed: null };
+}
+function hookDeliveryContext(record, automatic = false) {
+  const { provider, session, run } = record;
+  const identity = `SIMY connected to this ${provider} conversation: ${session}.`;
+  if (!run && automatic && !record.automaticStartBlocked && !record.providerArchived && !record.parentSession && !(record.autoContinue === false && record.autoContinueEpoch)) return `${identity} Automatic Delivery Loop start is enabled for this workspace. The next nonempty user prompt starts checkpoint tracking in this conversation; do not issue a duplicate start. Provider permissions and user stops remain authoritative.`;
+  if (!run) return `${identity} Delivery Loop has not started. When the user requests it, use simy delivery start --provider ${provider} --session ${session} with the agreed objective and next step. For future conversations in this workspace, the user can enable automatic start once with simy delivery auto on --provider ${provider}. Never enable, trust, resume, or reset a loop without the user's request.`;
+  return `${identity} Existing loop: ${run.state}. ${deliveryAcceptanceContext(run)} ` +
+    (['active', 'reported_done', 'completed'].includes(run.state) ? `${correctiveFollowupInstruction} ` : '') +
+    (provider === 'codex' && ['completed', 'reported_done'].includes(run.state) ? `Finished run ID: ${run.id}. Its completion does not supervise later user requests. If the user explicitly requests supervision of the current goal, use simy delivery followup --provider codex --session ${session} --previous-run-id ${run.id} --objective CURRENT_GOAL. A different goal archives the old run; the same ordinary reported_done goal retains identity and budgets for read-only reconciliation. A new prompt alone is not consent to run this command. ` : '') +
+    (run.state === 'active' && !run.managed ? `Before ending the turn, submit an honest JSON checkpoint with simy delivery checkpoint --provider ${provider} --session ${session} --file -. Use status in_progress with summary, remainingWork and nextStep for remaining work; completed with summary, acceptanceMet:true and evidence for finished work; or blocked with summary and blocker missing_information or authorization. The first completed checkpoint requests an outcome check in this conversation; inspect the actual result and submit a fresh checkpoint. If requested work remains, perform the first authorized step instead of ending with self-evaluation or a plan. Completion is provider-reported, not independently verified. ${informationWaitInstruction} ` : '') +
+    `Preserve the current task and its permissions, pauses and stops; never restart or reset it automatically.`;
+}
+export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), executionCwd, upgradeRunId, previousRunId, reconcileRunId, objective, nextStep, maxMinutes, maxContinuations, maxFailures, continuationPolicy, managed, admission,
   liveHookAdmission, autoContinueEpoch, providerLinkEpoch, inspectProcess = processIdentity, now = Date.now() }) {
   const link = await providerLinkState(root, provider);
   if (providerLinkEpoch !== undefined && providerLinkEpoch !== link.epoch) throw Object.assign(new Error("SIMY provider connection changed before enrollment."), { code: "provider_link_changed" });
@@ -777,12 +848,27 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     }
     if ((!previous?.observedAt && !admitted) || sessionCwd !== cwd && executionCwd !== cwd) throw new Error('No matching verified provider session observed here. Select an exact discovered session or explicitly bind its task execution directory.');
     const upgrading = upgradeRunId !== undefined;
-    if (upgrading && (!canUpgradeDelivery(previous.run) || previous.run.id !== upgradeRunId)) throw new Error('Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.');
-    if (previous.run && !upgrading) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
+    const following = previousRunId !== undefined;
+    const reconciling = reconcileRunId !== undefined;
+    if (reconciling && (!upgrading || following || previous.run?.id !== reconcileRunId || upgradeRunId !== reconcileRunId || previous.run.managed || previous.run.state !== 'reported_done' || text(objective) !== previous.run.objective)) throw new Error('Reconciliation requires the exact unverified ordinary completion and its unchanged original objective.');
+    if (following || reconciling) {
+      const prior = previous.run;
+      if (following && (upgrading || !prior || prior.id !== previousRunId || !['completed', 'reported_done'].includes(prior.state))) throw new Error('Follow-up requires the exact finished run; active work, stops and exhausted budgets cannot be replaced.');
+      if (following && text(objective) === prior.objective) throw new Error('Follow-up requires a new objective; use the original task controls for unfinished work.');
+      if (hasPendingUserStop(root, previous) || previous.providerArchived || previous.automaticStartBlocked || previous.autoContinue === false && previous.autoContinueEpoch ||
+          prior.managed?.resumeLease || prior.managed?.liveWorkspaceLease || prior.managed?.outcomeAudit?.lease || prior.managed?.executionUncertain || prior.managed?.pendingApproval || prior.managed?.nativeWait ||
+          ['pending', 'transferred', 'pending_received'].includes(prior.managed?.handoff?.status) || previous.associationTaskId) throw new Error('Resolve the existing stop, opt-out, ownership, approval or uncertain result before enrolling follow-up work.');
+      const gateRoot = rootFromDelivery(root), gate = readDispatchGate(gateRoot);
+      const fences = Object.values(gate.taskFences?.records || {}).filter(item => item.taskId === (prior.managed?.taskId || prior.id) && item.identity.provider === provider && item.identity.session === session);
+      if (fences.some(item => !readTaskAdmission({ root: gateRoot, identity: item.identity, taskId: item.taskId }).canResume)) throw new Error('Existing task admission must be reconciled before enrolling follow-up work.');
+    }
+    if (upgrading && ((!reconciling && !canUpgradeDelivery(previous.run)) || previous.run.id !== upgradeRunId)) throw new Error('Only the exact nonterminal ordinary loop can be upgraded; resolve its blocker or resume its original task first.');
+    if (previous.run && !upgrading && !following) throw new Error('This session already has a Delivery Loop. Resume or stop it; budgets cannot be reset by starting again.');
     if (upgrading && (text(objective) !== previous.run.objective || executionCwd && previous.run.executionCwd && executionCwd !== previous.run.executionCwd)) throw new Error('Upgrade must preserve the original objective and task directory.');
     const managedConfig = managed && { ...(managed === true ? {} : managed),
       ...(continuationPolicy === undefined ? {} : { continuationPolicy }) };
     const managedState = managedSpec(managedConfig, session, provider, previous.process, admitted ? admission : null, now);
+    if ((following || reconciling) && (provider !== 'codex' || !admitted || !managedState?.autoRecovery || managedState.capability !== 'codex_app_server' || managedState.initialAction.kind !== 'read' || managedState.contextBootstrap)) throw new Error('Follow-up requires exact-session managed supervision, a concrete goal and read-only reconciliation.');
     if (upgrading && (!managedState?.autonomyPolicy || managedState.initialAction.kind !== 'read' || managedState.contextBootstrap)) throw new Error('Upgrade requires read-only reconciliation and frozen acceptance of the original objective.');
     if (!managedState && continuationMode(continuationPolicy) === 'progress') throw new Error('Progress continuation requires frozen managed acceptance criteria.');
     if (autoContinueEpoch && managedState) managedState.autoContinueEpoch = autoContinueEpoch;
@@ -794,7 +880,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       identity: liveHookAdmission.identity, hookStartedAt: liveHookAdmission.hookStartedAt };
     const waiting = managedState?.decision?.outcome === 'wait';
     const queued = managedState?.capability === 'codex_app_server';
-    const run = { id: randomUUID(), objective: text(objective), state: waiting ? 'blocked' : queued ? 'recovery_required' : 'active', nextStep: text(nextStep), startedAt: now, updatedAt: now,
+    const run = { ...initialDeliveryRun(objective, nextStep, now, maxFailures), state: waiting ? 'blocked' : queued ? 'recovery_required' : 'active',
       ...(managedState?.purpose ? { ...(maxMinutes === undefined ? {} : { deadline: now + positive(maxMinutes, 120, 1440) * 60_000 }), ...(maxContinuations === undefined ? {} : { maxContinuations: positive(maxContinuations, 50, 1000) }) } : {}),
       maxFailures: positive(maxFailures, 3, 10), maxFailuresSource: maxFailures === undefined ? 'default' : 'explicit',
       continuations: 0, failures: 0, revision: 0, consumedRevision: -1, checkpoint: null, reason: waiting ? managedState.decision.reason : queued ? 'Exact-session supervision is queued; SIMY will acquire the provider writer lock before dispatch.' : 'started',
@@ -821,6 +907,15 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     if (waiting) escalate(run, run.reason);
     const latest = await providerLinkState(root, provider);
     if (!latest.connected || latest.epoch !== link.epoch) throw Object.assign(new Error("SIMY connection changed before enrollment."), { code: "provider_link_disconnected" });
+    if (following || reconciling) {
+      const priorId = previousRunId || reconcileRunId;
+      if (following) run.previousRunId = priorId;
+      run.previousRunArchive = join('finished-runs', `${digest(`${provider}\0${session}\0${priorId}`)}.json`);
+      const archive = { schemaVersion: 1, provider, session, cwd: previous.cwd, run: previous.run };
+      const file = join(root, run.previousRunArchive), saved = readState(file);
+      if (saved && digest(saved) !== digest(archive)) throw new Error('Finished run archive differs; reconcile its history before enrolling follow-up work.');
+      if (!saved) atomicSave(file, archive);
+    }
     return { ...previous, run };
   });
 }
@@ -910,6 +1005,7 @@ export function queuePurposeDiagnosis(run, reason, key, now = Date.now(), recove
     question: run.managed.understandingQuestion?.text || run.managed.userQuestion || null,
     dependency: run.managed.dependencyWait || null };
   recordDecision(run.managed, purposeDiagnosisPlan(run.managed, reason), now);
+  purpose.diagnosisDecisionId = run.managed.decision.id;
   if (run.managed.executionUncertain) prepareRecoveryDiagnosis(run, now);
   if (run.managed.phase === 'needs_clarification') run.managed.phase = 'understanding';
   run.managed.userQuestion = null; run.managed.understandingQuestion = null; run.managed.dependencyWait = null;
@@ -922,6 +1018,9 @@ export function queuePurposeDiagnosis(run, reason, key, now = Date.now(), recove
   return true;
 }
 
+export const informationWaitInstruction = 'Use blocked/missing_information only with a nonempty question field containing a concrete question that requires the user\'s answer. Missing verification evidence, zero applicable SQM rules/scenarios, or unfinished checks alone are remaining work: inspect applicability and available evidence, then propose authorized repair or verification. Keep unmet acceptance criteria unverified; do not invent rules or lower acceptance. If investigation finds a real user-only choice or unavailable input, ask that specific question. Preserve native permissions, explicit stops, refusals and budgets.';
+const informationWaitDiagnosis = 'Read the current task context and available verification evidence to determine whether progress really requires a user answer. Identify an authorized next investigation or verification step, or return blocked/missing_information with the specific user question. Do not repeat prior side effects or claim that incomplete verification passed.';
+
 export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, expectedLease, toolEvidence = [], sourceContext, controllerEvidence, now = Date.now() }) {
   if (checkpoint?.kind === 'action_association') return checkpointActionAssociation({ root, provider, session, cwd, checkpoint, expectedLease, now });
   if (checkpoint?.kind === 'session_understanding') return checkpointUnderstanding({ root, provider, session, cwd, checkpoint, expectedLease, sourceContext, controllerEvidence, now });
@@ -929,7 +1028,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
   const statuses = ['in_progress', 'completed', 'blocked', 'error'];
   if (!checkpoint || !statuses.includes(checkpoint.status)) throw new Error('Checkpoint status must be in_progress, completed, blocked, or error.');
   if (!text(checkpoint.summary)) throw new Error('Checkpoint summary is required.');
-  if (['in_progress', 'error'].includes(checkpoint.status) && !text(checkpoint.nextStep)) throw new Error('A concrete nextStep is required.');
+  if (checkpoint.status === 'error' && !text(checkpoint.nextStep)) throw new Error('A concrete nextStep is required.');
   if (checkpoint.status === 'blocked' && !['authorization', 'missing_information', 'external_dependency'].includes(checkpoint.blocker)) throw new Error('Specify authorization, missing_information, or external_dependency.');
   const evidence = Array.isArray(checkpoint.evidence) ? checkpoint.evidence.map(v => text(v, 1000)).filter(Boolean).slice(0, 20) : [];
   const settled = await updateRecord(root, provider, session, async record => {
@@ -939,10 +1038,34 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     let repairPlan = null;
     if (!run || !checkpointDirectoryMatches(record, cwd)) throw new Error('No matching active Delivery Loop.');
     if (run.managed?.phase === 'understanding' || run.managed?.phase === 'needs_clarification') throw new Error('Session understanding needs its separate structured checkpoint.');
-    if (checkpoint.status === 'completed' && !run.managed && (!evidence.length || checkpoint.acceptanceMet !== true)) throw new Error('Completion requires acceptanceMet and concrete verification evidence.');
     if (expectedLease && (run.state !== 'auto_resuming' || run.managed?.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Managed recovery lease changed; checkpoint discarded.');
     if (TERMINAL.has(run.state) || run.state === 'blocked' || run.state === 'recovery_required') throw new Error('Loop is stopped or awaiting a human resume.');
     if (['paused', 'verification_pending'].includes(run.state)) throw new Error('Managed task is paused or awaiting acceptance verification.');
+    const remainingWork = text(checkpoint.remainingWork, 4000);
+    const resultDisposition = decideLoop({ completion_claim: checkpoint.status === 'completed',
+      remaining_work: Boolean(remainingWork), acceptance_failed: checkpoint.acceptanceMet === false });
+    const incompleteResult = !run.managed && checkpoint.status === 'completed' && resultDisposition.action === 'repair';
+    const missingNextStep = checkpoint.status === 'in_progress' && !nextStep;
+    if (incompleteResult || (missingNextStep && !run.managed)) {
+      effectiveStatus = 'in_progress';
+      nextStep ||= resultFollowThroughInstruction();
+    }
+    if (missingNextStep && run.managed) throw new Error('A concrete nextStep is required.');
+    if (effectiveStatus === 'completed' && !run.managed && checkpoint.acceptanceMet !== true) throw new Error('Completion requires the requested outcome to be checked (acceptanceMet).');
+    // A worker's unsupported information-wait claim is a recoverable reporting
+    // error, not evidence that a human must act. Reuse the current executor and
+    // failure budget; never resume a previously stopped/blocked task here.
+    const unsupportedWait = checkpoint.status === 'blocked' && checkpoint.blocker === 'missing_information' && !text(checkpoint.question, 1000);
+    if (unsupportedWait) {
+      if (run.blockerSource === 'provider' || run.managed?.pendingApproval || run.managed?.nativeWait || run.managed?.purpose?.nativeBoundary) {
+        throw new Error('Missing information blocker needs a specific user question; existing permission boundaries remain in force.');
+      }
+      effectiveStatus = 'error'; nextStep = informationWaitDiagnosis;
+      if (run.managed) {
+        repairPlan = purposeDiagnosisPlan(run.managed, informationWaitDiagnosis);
+        repairPlan.alternatives[0].action.summary = informationWaitDiagnosis;
+      }
+    }
     if (run.managed) {
       if (searchEnabled(run.managed) && expectedLease && sourceContext) run.managed.purpose.originalContext ||= sourceContext;
     if (searchEnabled(run.managed) && expectedLease) retainControllerEvidence(run.managed, controllerEvidence, now);
@@ -954,7 +1077,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
         actionResult = { decisionId: performed.id, status: result.status, summary: text(result.summary, 300), evidence: Array.isArray(result.evidence) ? result.evidence.map(item => text(item, 300)).filter(Boolean).slice(0, 5) : [], source: 'provider_reported' };
         const capturedAction = expectedLease && ['read','local_edit','local_test'].includes(performed.action.kind) && toolEvidence.some(item => item?.source === 'codex_tool_event' && /^[a-f0-9]{64}$/.test(item.digest || '') && item.kind === 'commandExecution' && item.exitCode === 0 && (!item.status || item.status === 'completed'));
         if (flexibleReasoning(run.managed) && capturedAction) actionResult.observationSource = 'controller_tool_result';
-        if (result.status === 'observed' && !actionResult.evidence.length && !flexibleReasoning(run.managed)) throw new Error('Observed action result needs concrete evidence.');
+        // Observation prose is optional; actual execution receipts belong to the controller.
         // Local observations remain the worker's report until independent
         // inspection. Missing paperwork alone is not an unknown side effect.
         // For remote effects, keep reconciliation before any repeat operation.
@@ -980,6 +1103,9 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       if (searchEnabled(run.managed) && performed && actionResult) {
         const unit = evidenceLedger(run.managed).units?.find(row => row.id === performed.id);
         if (unit) { unit.status = actionResult.status === 'failed' ? 'failed' : ['not_run', 'unverified'].includes(actionResult.status) ? 'waiting' : 'observed'; unit.evidenceRefs = (toolEvidence || []).map(row => row.ref || row.digest); unit.updatedAt = now;
+          // A returned local operation releases execution occupancy, not outcome
+          // acceptance. Unknown/external effects still require reconciliation.
+          if (expectedLease && actionResult.status === 'observed' && ['local_edit', 'local_test'].includes(performed.action.kind) && !run.managed.executionUncertain) unit.localExecutionSettledAt = now;
           if (unit.status === 'observed' && unit.criterionIds.length && unit.criterionIds.every(id=>run.managed.verified[id] && !['semantic','manual'].includes(run.managed.acceptanceCriteria.find(row=>row.id===id)?.check.type))) {unit.status='verified';unit.verificationSource='controller_automatic_criteria';}
         }
       }
@@ -998,6 +1124,11 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       if (performed) {
         run.managed.workHistory ||= [];
         run.managed.workHistory.push({ decisionId: performed.id, action: performed.action, status: checkpoint.status, summary: text(checkpoint.summary, 300), result: actionResult, verification: `${Math.max(0, Object.keys(run.managed.verified).length - previouslyVerified)} new acceptance criteria verified`, at: now });
+        // A repair check is an observed read, not completion of the original task.
+        if (run.managed.repairRequest?.status === 'running' && performed.action.kind === 'read' && actionResult?.status === 'observed' &&
+            ['resolved', 'unresolved', 'needs_human'].includes(checkpoint.repairResult?.status) && text(checkpoint.repairResult?.summary, 600)) {
+          run.managed.workHistory.at(-1).repairResult = { status: checkpoint.repairResult.status, summary: text(checkpoint.repairResult.summary, 600) };
+        }
         run.managed.workHistory = run.managed.workHistory.slice(-10);
         if (performed.outcome === 'report') run.managed.notification = { key: `report:${run.revision + 1}`, kind: 'action_report', message: `Attempted ${performed.action.summary}: ${text(checkpoint.summary, 300)}. ${run.managed.workHistory.at(-1).verification}.`, at: now };
         if (run.managed.approvedAction?.id === performed.id) delete run.managed.approvedAction;
@@ -1006,15 +1137,15 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
         if (run.managed.autonomyPolicy) {
           const plan = repairPlan || assessedPlan(checkpoint.plan, run.managed);
           const selected = plan.alternatives.find(item => item.id === plan.selectedOptionId);
-          if (checkpoint.proposedAction && JSON.stringify(actionDescriptor(checkpoint.proposedAction)) !== JSON.stringify(selected.action)) throw new Error('Proposed action differs from selected assessed option.');
+          if (!unsupportedWait && checkpoint.proposedAction && JSON.stringify(actionDescriptor(checkpoint.proposedAction)) !== JSON.stringify(selected.action)) throw new Error('Proposed action differs from selected assessed option.');
           recordDecision(run.managed, plan, now);
-          if (purposeEnabled(run) && !searchEnabled(run.managed) && ['failed', 'not_run'].includes(actionResult.status)) {
+          if (!unsupportedWait && purposeEnabled(run) && !searchEnabled(run.managed) && ['failed', 'not_run'].includes(actionResult.status)) {
             recordDecision(run.managed, purposeDiagnosisPlan(run.managed, `Investigate the ${actionResult.status} action before further changes: ${actionResult.summary}`), now);
-          } else if (!searchEnabled(run.managed) && (actionResult.status === 'not_run' || actionResult.status === 'failed' && run.managed.decision.action.kind !== 'read')) {
+          } else if (!unsupportedWait && !searchEnabled(run.managed) && (actionResult.status === 'not_run' || actionResult.status === 'failed' && run.managed.decision.action.kind !== 'read')) {
             run.managed.decision.outcome = 'wait'; run.managed.decision.reason = actionResult.status === 'not_run' ? 'Previous selected action was not run.' : 'Failed action requires a read-only diagnosis before another change.';
             run.managed.pendingApproval = { id: run.managed.decision.id, ...run.managed.decision.action, reason: run.managed.decision.reason };
           }
-        } else run.managed.proposedAction = actionDescriptor(checkpoint.proposedAction);
+        } else run.managed.proposedAction = unsupportedWait ? repairPlan.alternatives[0].action : actionDescriptor(checkpoint.proposedAction);
       }
       if (checkpoint.status === 'blocked' && checkpoint.blocker === 'authorization') {
         const request = checkpoint.approval;
@@ -1036,8 +1167,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
           run.managed.pendingApproval = { id: digest(`${run.managed.taskId}:${run.revision + 1}:${JSON.stringify(proposed)}`), ...proposed };
         }
       }
-      if (run.managed.autonomyPolicy && checkpoint.status === 'blocked' && checkpoint.blocker === 'missing_information') {
-        if (!text(checkpoint.question, 1000)) throw new Error('Missing information blocker needs a specific user question.');
+      if (effectiveStatus === 'blocked' && checkpoint.blocker === 'missing_information') {
         run.managed.userQuestion = text(checkpoint.question, 1000);
       }
     }
@@ -1046,7 +1176,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       if (!text(wait?.condition, 1000) || !text(wait?.owner, 200) || !text(wait?.nextCheck, 1000) || !nextStep) throw new Error('External dependency needs waitCondition {condition, owner, nextCheck} and a nextStep.');
       run.managed.dependencyWait = { id: randomUUID(), condition: text(wait.condition, 1000), owner: text(wait.owner, 200), nextCheck: text(wait.nextCheck, 1000), createdAt: now };
     }
-    if (searchEnabled(run.managed) && checkpoint.status === 'blocked') {
+    if (searchEnabled(run.managed) && checkpoint.status === 'blocked' && !unsupportedWait) {
       rememberSearchWait(run.managed, checkpoint.blocker, { reason: checkpoint.summary, question: checkpoint.question,
         condition: checkpoint.waitCondition?.condition, owner: checkpoint.waitCondition?.owner, action: checkpoint.approval || null }, now);
       if (checkpoint.plan && checkpoint.blocker !== 'authorization' && checkpoint.plan.alternatives?.find(o => o.id === checkpoint.plan.selectedOptionId)?.independent === true) recordDecision(run.managed, assessedPlan(checkpoint.plan, run.managed), now);
@@ -1074,7 +1204,12 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       nextStep = run.nextStep;
     }
     run.blockerSource = effectiveStatus === 'blocked' ? 'checkpoint' : null;
-    run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep, blocker: checkpoint.blocker, evidence, acceptanceMet: checkpoint.acceptanceMet === true };
+    run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep,
+      blocker: unsupportedWait ? undefined : checkpoint.blocker,
+      ...(unsupportedWait ? { reportedBlocker: checkpoint.blocker } : checkpoint.blocker === 'missing_information' ? { question: text(checkpoint.question, 1000) } : {}),
+      ...(remainingWork ? { remainingWork } : {}), ...(incompleteResult ? { reportedStatus: checkpoint.status } : {}),
+      evidence, acceptanceMet: !unsupportedWait && !incompleteResult && checkpoint.acceptanceMet === true };
+    if (!run.managed && effectiveStatus !== 'completed') delete run.completionCheck;
     run.revision += 1; run.updatedAt = now;
     recordManagedOutcomeProgress(run, now);
     // File predicates were reread above; a prior semantic verdict can belong
@@ -1093,9 +1228,9 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
         run.state = 'reported_done'; run.reason = 'Original session reported the goal done; no independent acceptance check was available.';
       }
     }
-    if (run.managed?.liveWorkspaceLease) {
+    if (run.managed?.liveWorkspaceLease || expectedLease && run.managed?.executionAttempt?.id === expectedLease) {
       run.managed.executionAttempt = { ...run.managed.executionAttempt, phase: 'checkpointed', checkpointRevision: run.revision, endedAt: now };
-      run.managed.liveWorkspaceLease.checkpointRevision = run.revision;
+      if (run.managed.liveWorkspaceLease) run.managed.liveWorkspaceLease.checkpointRevision = run.revision;
     }
     for (const request of run.managed?.consistencyOutbox || []) if (request.decisionId && request.decisionId === checkpoint.actionResult?.decisionId) {
       recordHandoffStage(request, run.managed.workHistory?.at(-1)?.result?.status === 'observed' ? 'inspected' : 'inspection_failed', now);
@@ -1130,7 +1265,10 @@ export function externalReviewIsCurrent(managed,review,now) {
   if (review.semanticInspection?.source === 'controller_actual_read_set') refs.push(...(review.semanticInspection.observationRefs || []).map(ref => ({ ref })));
   const ledger=managed.purpose.evidence;
   const observations=[...(ledger?.observations||[]),...(ledger?.reviewObservationActionId===(review.decisionId||managed.decision.id) ? ledger.reviewObservations||[] : [])];
-  return refs.every(link=>observations.some(item=>item.id===link.ref && item.status==='observed' && currentPurposeObservation(item,now,review.observationWindow)));
+  const inspected = new Set(review.semanticInspection?.source === 'controller_actual_read_set' ? review.semanticInspection.observationRefs || [] : []);
+  return refs.filter(link => inspected.has(link.ref) || observations.some(item => item.id === link.ref))
+    .every(link=>observations.some(item=>item.id===link.ref && item.status==='observed' && currentPurposeObservation(item,now,review.observationWindow)));
+
 }
 export async function settlePurposeVerification({ root, provider, session, expectedLease, review, verifySnapshot, now = Date.now() }) {
   const started = Date.now(), initialNow = now;
@@ -1145,8 +1283,16 @@ export async function settlePurposeVerification({ root, provider, session, expec
       managed.purpose.search?.verificationDecisionId !== managed.decision.id || run.revision !== managed.resumeLease.checkpointRevision || now >= run.deadline) throw new Error('Independent review lease changed.');
     const state = searchState(managed);
     if (review?.source !== 'independent_codex_session' || !review.session || review.session === session || !review.workspaceDigest || typeof review.passed !== 'boolean') throw new Error('Independent review provenance is missing.');
+    const verificationUnit = managed.purpose.evidence?.units?.find(unit => unit.id === managed.decision.id);
+    if (verificationUnit?.action?.kind === 'read' && verificationUnit.status === 'dispatched') {
+      verificationUnit.status = 'observed'; verificationUnit.observedAt = now;
+    }
     retainApplicableRules(managed, review.rules || []);
     review = assessRuleReview(review, managed);
+    if (review.contractDigest !== completionContractIdentity(managed)) {
+      review = { ...review, passed: false, needsHuman: false,
+        findings: [...review.findings, 'Requested behavior changed; check the current request.'] };
+    }
     if (currentDigest !== review.workspaceDigest) {
       review = { ...review, passed: false, needsHuman: false, findings: [...review.findings, 'Workspace changed before review settlement; verify the new revision.'] };
     }
@@ -1156,45 +1302,64 @@ export async function settlePurposeVerification({ root, provider, session, expec
         'Required operation, effect reconciliation or original-purpose contract remains unresolved. Preserve the waiting unit and continue independent authorized work.'] };
     }
     if(!externalReviewIsCurrent(managed,review,now)) review={...review,passed:false,needsHuman:false,controllerEvidenceFailure:{code:'independent_reference_invalid',targets:['current_external_observations'],instruction:'Controller external observations expired before settlement; reacquire the same authorized observations and independently re-evaluate without replaying writes.'}};
-    // Validate counterevidence against a disposable ledger before mutations.
-    // Verifier contract failures are verifier work, never worker checkpoint errors.
-    if (!review.controllerEvidenceFailure) {
-      try { reconcileFindings(structuredClone(managed), review, now); }
-      catch (error) {
-        if (!/^(Reopening a closed finding|Finding resolution needs|Independent review left unresolved findings|A finding cannot be open and resolved\.)/.test(error.message)) throw error;
-        review = { ...review, passed: false, needsHuman: false, controllerEvidenceFailure: {
-          code: 'independent_finding_evidence_invalid', targets: [...(review.resolutions || []).map(row => `resolution:${row.id}`), ...(review.findings || []).filter(row => row.reopenReason).map(row => `reopen:${row.id}`)],
-          instruction: error.message + ' Repeat isolated verification and reconcile existing findings with primary reads. For reopening use the exact prior closure read scope.',
-          requiredReads: (managed.purpose.evidence?.findings || []).filter(row => row.status !== 'open').map(row => ({ id: row.id, closedReads: row.closedReads || [] }))
-        } };
-      }
-    }
     if (review.controllerEvidenceFailure) {
       const prior = state.verifierFailures;
       const key = digest(JSON.stringify([currentDigest, review.controllerEvidenceFailure.code, review.controllerEvidenceFailure.targets]));
       state.verifierFailures = { key, attempts: prior?.key === key ? prior.attempts + 1 : 1, at: now, failure: review.controllerEvidenceFailure };
       state.review = review;
       run.revision += 1; run.updatedAt = now;
-      queuePurposeVerification(run, `${review.controllerEvidenceFailure.instruction} Invalid targets: ${(review.controllerEvidenceFailure.targets || []).join(', ')}. Use a narrow direct read containing the cited excerpt within 2000 characters.`, now);
-      managed.nextAttemptAt = now + Math.min(60_000, 1000 * 2 ** Math.min(state.verifierFailures.attempts - 1, 6));
+      // An invalid review record is not a product defect and must not send
+      // the verifier around a citation-repair loop. The normal planner selects
+      // useful work or another actual outcome check under existing authority.
+      const reason = 'The review record could not establish completion. Preserve existing work and inspect the original requested behavior through another available method. Repair concrete defects or continue remaining authorized work; do not generate citations, evidence files or audit forms. Unknown external effects still require reconciliation before any retry.';
+      const fallbackPlan = purposeDiagnosisPlan(managed, reason);
+      fallbackPlan.alternatives[0].action.summary = 'Inspect the original requested behavior using existing results or another available method; continue concrete work without audit paperwork.';
+      recordDecision(managed, fallbackPlan, now);
+      state.phase = 'repairing';
+      delete state.verificationDecisionId;
+      run.checkpoint = null; run.state = 'recovery_required';
+      run.recoveryCause = 'session_supervision'; run.reason = reason;
+      run.nextStep = managed.decision.action.summary;
+      managed.autoRecovery = true; managed.nextAttemptAt = now;
       notifyState(run, now); return record;
     }
     const openFindings = reconcileFindings(managed, review, now);
+    if ((review.passed || review.needsHuman) && openFindings.length) {
+      review = { ...review, passed: false, needsHuman: false, findings: openFindings };
+    }
     const units=evidenceLedger(managed).units;
+    // A bound independent read can establish an earlier effect even when its
+    // result is wrong. Release only its resource reservation, not its pending
+    // acceptance or replay prohibition; a new assessed repair is still needed.
+    for (const unit of units) if (unit.status === 'observed' && unit.criterionIds?.length &&
+      unit.criterionIds.every(id => review.criteria?.some(row =>
+        row.id === id && typeof row.passed === 'boolean' && row.evidenceRefs?.some(link =>
+          review.capturedReads?.some(read => read.target === link.target))))) {
+      unit.effectReconciledRevision = unit.purposeRevision;
+    }
+
+    await verifyAutomaticCriteria(record, now);
+    const criteria = effectiveAcceptanceCriteria(managed);
+    const independentlySatisfied = id => {
+      const criterion = criteria.find(row => row.id === id);
+      if (!criterion) return false;
+      if (criterion.check.type === 'manual') return managed.verified[id]?.source === 'user';
+      if (criterion.check.type !== 'semantic') return Boolean(managed.verified[id]);
+      return review.criteria.some(row => row.id === id && row.passed) || review.passed && review.inspectionPerformed === true;
+    };
     for (const result of (review.passed || review.needsHuman) ? review.workUnits || [] : []) {
       const unit=units.find(row=>row.id===result.id);
       if (!unit || !['verified','superseded'].includes(result.status) || !text(result.result || review.summary) ||
-          unit.criterionIds.some(id=>!review.criteria.some(row=>row.id===id && row.passed))) throw new Error('Required unit resolution needs independent criterion-linked evidence.');
-      if (unit.purposeRevision !== evidenceLedger(managed).purposeRevision) throw new Error('Unit belongs to an old purpose revision.');
+          unit.criterionIds.some(id=>!independentlySatisfied(id))) continue; // Incomplete optional bookkeeping cannot settle an operation or reject the review.
+      if (unit.purposeRevision !== evidenceLedger(managed).purposeRevision) continue;
       unit.status=result.status;unit.evidenceRefs=result.evidenceRefs;unit.verifiedAt=now;
     }
     state.review = review; delete state.verificationDecisionId;
     run.revision += 1; run.updatedAt = now;
-    await verifyAutomaticCriteria(record, now);
     if (review.passed || review.needsHuman) {
       for (const criterion of effectiveAcceptanceCriteria(managed)) {
-        if (criterion.check.type === 'semantic' && review.criteria.some(row => row.id === criterion.id && row.passed)) {
-          managed.verified[criterion.id] = { source: 'independent_codex_session', checkedAt: now, workspaceDigest: review.workspaceDigest, session: review.session };
+        if (criterion.check.type === 'semantic' && (review.criteria.some(row => row.id === criterion.id && row.passed) || review.passed && review.inspectionPerformed)) {
+          managed.verified[criterion.id] = { source: 'independent_codex_session', checkedAt: now, workspaceDigest: review.workspaceDigest, session: review.session, assessment: review.criteria.some(row => row.id === criterion.id) ? 'criterion' : 'whole_outcome' };
         }
       }
       for (const unit of units) if (unit.id.startsWith('criterion:') && unit.criterionIds.every(id=>managed.verified[id])) {unit.status='verified';unit.evidenceRefs=review.criteria.filter(row=>unit.criterionIds.includes(row.id)).flatMap(row=>row.evidenceRefs || []);}
@@ -1224,18 +1389,11 @@ export async function settlePurposeVerification({ root, provider, session, expec
         notifyState(run, now); return record;
       }
     }
-    if (!review.passed && !review.needsHuman && openFindings.length && openFindings.every(item => item.owner === 'controller')) {
-      const ledger = evidenceLedger(managed);
-      const lookup = createHash('sha256').update(JSON.stringify({ findings: openFindings.map(item => item.id).sort(), receipts: ledger.receipts.map(item => item.id), baseline: ledger.baseline?.digest, workspace: review.workspaceDigest })).digest('hex');
-      if (state.controllerLookup !== lookup && (ledger.baseline || ledger.receipts.length)) {
-        state.controllerLookup = lookup;
-        queuePurposeVerification(run, 'Controller retrieved existing baseline and tool receipts; reconcile the missing evidence against the supplied ledger before requesting worker repairs.', now);
-        notifyState(run, now); return record;
-      }
-    }
     if (!review.passed && !review.needsHuman) {
       const reason = `Outcome review found remaining work: ${[review.summary, ...openFindings.map(findingText)].join(' ').slice(0, 1800)}`;
-      recordDecision(managed, purposeDiagnosisPlan(managed, reason), now);
+      const fallbackPlan = purposeDiagnosisPlan(managed, reason);
+      fallbackPlan.alternatives[0].action.summary = 'Inspect the original requested behavior using existing results or another available method; continue concrete work without audit paperwork.';
+      recordDecision(managed, fallbackPlan, now);
       state.phase = 'repairing'; managed.purpose.lastRecovery = { reason, at: now };
       run.checkpoint = null; run.state = 'recovery_required'; run.recoveryCause = 'session_supervision';
       run.nextStep = managed.decision.action.summary; run.reason = reason; managed.autoRecovery = true;
@@ -1290,6 +1448,13 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
       validatePurposeReview(checkpoint.purposeReview, plan, run.managed.purpose.ruleIds, searchEnabled(run.managed) ? run.managed.purpose.lastReview?.rules || [] : [], run.managed), now);
     if (searchEnabled(run.managed) && expectedLease && sourceContext) run.managed.purpose.originalContext ||= sourceContext;
     if (searchEnabled(run.managed) && expectedLease) retainControllerEvidence(run.managed, controllerEvidence, now);
+    // This read has returned under the current lease. Release its resource
+    // occupancy before selecting the next action; observation is not acceptance.
+    const understandingUnit = run.managed.purpose?.evidence?.units?.find(unit => unit.id === decision.id);
+    if (understandingUnit && decision.action.kind === 'read') {
+      understandingUnit.status = result.status === 'observed' ? 'observed' : 'failed';
+      understandingUnit.updatedAt = now;
+    }
     run.managed.sessionUnderstanding = understanding;
     run.managed.understandingRevision = (run.managed.understandingRevision || 0) + 1;
     run.managed.understandingAnswer = null;
@@ -1448,7 +1613,7 @@ export async function verifyDelivery({ root = rootDirectory(), provider, session
     run.updatedAt = now; return record;
   });
 }
-function prepareWaitingDiagnosis(run, reason, now) {
+export function prepareWaitingDiagnosis(run, reason, now) {
   const managed = run.managed, scope = managed.approvalScopes[0];
   if (!scope) throw new Error('Waiting recovery needs an enrolled scope.');
   const action = { kind: 'read', scope, summary: 'Inspect the resolved wait and current result before choosing new work; do not replay the prior action' };
@@ -1577,7 +1742,10 @@ export function decideStop(run, now = Date.now()) {
   // A fresh, explicitly evidenced completion may finish at the budget boundary.
   const fresh = next.checkpoint && next.revision > next.consumedRevision;
   const cp = fresh ? next.checkpoint : null;
-  if (cp?.status === 'completed') {
+  const completionChecked = Number.isSafeInteger(next.completionCheck?.revision) &&
+    next.revision > next.completionCheck.revision && next.consumedRevision >= next.completionCheck.revision;
+  const inspectCompletion = !next.managed && cp?.status === 'completed' && !completionChecked;
+  if (cp?.status === 'completed' && !inspectCompletion) {
     const pending = pendingAcceptance(next);
     if (pending.length) return finish('verification_pending', acceptancePendingReason(next));
     if (!next.managed || !next.managed.acceptanceCriteria.length) return finish('reported_done',
@@ -1629,7 +1797,7 @@ export function decideStop(run, now = Date.now()) {
     }
     const reportedStep = next.managed.associationCheckpointRevision !== next.revision && next.managed.contextBootstrap && next.managed.phase === 'active' && !next.managed.acceptanceCriteria.length &&
       !['session_understanding', 'action_association'].includes(cp?.kind) && cp?.status === 'in_progress' &&
-      next.managed.workHistory?.at(-1)?.result?.status === 'observed' && next.managed.workHistory.at(-1).result.evidence?.length;
+      next.managed.workHistory?.at(-1)?.result?.status === 'observed' && (next.managed.workHistory.at(-1).result.evidence?.length || next.managed.workHistory.at(-1).result.observationSource === 'controller_tool_result');
     if (next.managed.continuationPolicy === 'progress') {
       if (next.managed.associationCheckpointRevision !== next.revision && !initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook && !['session_understanding', 'action_association'].includes(cp?.kind) && (!fresh || next.managed.progressCheckpointRevision !== next.revision)) recordManagedOutcomeProgress(next, now, Boolean(fresh));
     } else if (next.managed.verifiedRevision > next.managed.consumedVerifiedRevision) next.managed.noProgress = 0;
@@ -1672,8 +1840,15 @@ export function decideStop(run, now = Date.now()) {
     if (legacyApprovedHook) delete next.managed.approvedAction;
   }
   next.reason = fresh ? 'continue_pending_work' : 'checkpoint_missing';
+  // A first standard completion is a candidate. One live continuation checks
+  // the actual endpoint; only a subsequent checkpoint can report it done.
+  // Missing/duplicate Stops cannot count as the result of that continuation.
+  if (inspectCompletion) {
+    next.completionCheck = { revision: next.revision, requestedAt: now };
+    next.reason = 'check_reported_outcome';
+  }
   const selected = next.managed?.autonomyPolicy ? next.managed.decision : null;
-  const instruction = selected && next.managed.phase === 'action_association' ? `${associationContract(next.managed.actionAssociation.job)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping.` : selected && next.managed.phase === 'understanding' ? `Understand the current user request in this ORIGINAL conversation. ${next.managed.understandingAnswer ? `The user answered question ${next.managed.understandingAnswer.questionId}: ${next.managed.understandingAnswer.text}. ` : ''}${understandingCheckpointContract(selected)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable. This updates SIMY metadata only; do not create a checkpoint file in the task workspace.` : selected ? `${initialHook ? `Managed objective: ${next.objective}. Frozen acceptance criteria: ${JSON.stringify(next.managed.acceptanceCriteria)}. ` : ''}${replanHook ? `Replan context: ${next.managed.plan.diagnosis}. ` : ''}Execute only selected ${selected.action.kind} action in scope ${selected.action.scope}: ${selected.action.summary}. Expected verification: ${selected.expectedVerification}. Rollback: ${selected.rollback || 'none needed'}. ${assessedCheckpointContract(selected, next.managed)} Submit that JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable; do not create a task-workspace checkpoint file.` : fresh ? `${minimalSufficientChangeInstruction()}\n${next.nextStep}` : `${minimalSufficientChangeInstruction()}\nCheck the actual delivery status first. Record an honest checkpoint with simy delivery checkpoint before stopping; do not claim completion without verification. Pending step: ${next.nextStep}`;
+  const instruction = inspectCompletion ? resultFollowThroughInstruction({ completion: true }) : selected && next.managed.phase === 'action_association' ? `${associationContract(next.managed.actionAssociation.job)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping.` : selected && next.managed.phase === 'understanding' ? `Understand the current user request in this ORIGINAL conversation. ${next.managed.understandingAnswer ? `The user answered question ${next.managed.understandingAnswer.questionId}: ${next.managed.understandingAnswer.text}. ` : ''}${understandingCheckpointContract(selected)} Submit the JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable. This updates SIMY metadata only; do not create a checkpoint file in the task workspace.` : selected ? `${initialHook ? `Managed objective: ${next.objective}. Frozen acceptance criteria: ${JSON.stringify(next.managed.acceptanceCriteria)}. ` : ''}${replanHook ? `Replan context: ${next.managed.plan.diagnosis}. ` : ''}Execute only selected ${selected.action.kind} action in scope ${selected.action.scope}: ${selected.action.summary}. Expected verification: ${selected.expectedVerification}. Rollback: ${selected.rollback || 'none needed'}. ${assessedCheckpointContract(selected, next.managed)} Submit that JSON checkpoint through standard input using simy delivery checkpoint --provider ${next.managed.thread.provider} --session ${next.managed.thread.id} --file - before stopping. A shell heredoc is suitable; do not create a task-workspace checkpoint file.` : fresh ? `${minimalSufficientChangeInstruction()}\n${informationWaitInstruction}\n${next.nextStep}` : `${minimalSufficientChangeInstruction()}\n${informationWaitInstruction}\n${resultFollowThroughInstruction()}`;
   return { run: next, output: { decision: 'block', reason: `SIMY Delivery Loop (${next.continuations} continuations). ${next.executionCwd ? `Use task execution directory ${JSON.stringify(next.executionCwd)} for task work and acceptance. ` : ''}${deliveryAcceptanceContext(next)} ${instruction}\n${purposeContract(next.managed)}\nStay within the original request and permissions. If one action lacks authorization or information, preserve that dependency and select independent authorized work. Resume this same task; do not start a replacement loop.` } };
 }
 // A process signature protects against PID reuse. Never treat a stale timer alone
@@ -1786,7 +1961,7 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
     const currentLink = await providerLinkState(root, provider);
     if (!currentLink.connected || currentLink.epoch !== link.epoch) return old;
     if (old && old.cwd !== cwd) return old;
-    const record = old || { schemaVersion: 1, provider, session: input.session_id, cwd, run: null };
+    const record = old || await applyArchiveFence(root, { schemaVersion: 1, provider, session: input.session_id, cwd, run: null });
     const stopMarker = readState(stopMarkerPath(root, provider, input.session_id));
     if (record.run && typeof stopMarker?.runId === 'string' && stopMarker.runId === record.run.id && stopMarker.id !== record.run.handledStopMarkerId) { record.run.state = 'stopped'; record.run.reason = 'User interrupted the provider.'; }
     // Inherited provider identity links an AI-launched conversation to its
@@ -1847,9 +2022,28 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       if (identity) { record.hookStartedAt = now; record.hookSessionProcess = { ...identity }; }
       else { delete record.hookStartedAt; delete record.hookSessionProcess; delete record.process; }
       const approved = record.run?.managed?.approvedAction;
-      output = { hookSpecificOutput: { hookEventName: 'SessionStart', additionalContext: `SIMY hooks observed this ${provider} session: ${input.session_id}. Only if the user requests SIMY Delivery Loop, use simy delivery start --provider ${provider} --session ${input.session_id} with the agreed objective and next step. Existing loop: ${record.run?.state || 'not started'}.${approved ? ` User approved exactly one ${approved.action.kind} action in scope ${approved.action.scope}: ${approved.action.summary}. Next step: ${approved.nextStep}. ${approved.dispatchedAt ? 'That approval was already dispatched; any repeated action needs a new approval.' : 'Resume the original conversation to dispatch this one action.'}` : ''} Never enable, trust, resume, or reset a loop on the user's behalf without their request.` } };
+      output = { hookSpecificOutput: { hookEventName: event, additionalContext: hookDeliveryContext(record, !env.SIMY_PARENT_SESSION && !(provider === 'claude' && env.CODEX_THREAD_ID) && (await automaticDeliveryStatus({ root, provider, cwd })).enabled) +
+        (approved ? ` User approved exactly one ${approved.action.kind} action in scope ${approved.action.scope}: ${approved.action.summary}. Next step: ${approved.nextStep}. ${approved.dispatchedAt ? 'That approval was already dispatched; any repeated action needs a new approval.' : 'Resume the original conversation to dispatch this one action.'}` : '') } };
     }
     if (event === 'SessionEnd') record.hookEndedAt = now;
+    if (!record.run && (['Interrupt', 'PermissionRequest'].includes(event) ||
+        event === 'Notification' && ['permission_prompt', 'elicitation_dialog'].includes(input.notification_type))) record.automaticStartBlocked = event;
+    if (event === 'UserPromptSubmit') {
+      const automatic = await automaticDeliveryStatus({ root, provider, cwd });
+      if (!record.run && !record.providerArchived && !record.automaticStartBlocked && !record.parentSession && !(record.autoContinue === false && record.autoContinueEpoch) &&
+          !env.SIMY_PARENT_SESSION && !(provider === 'claude' && env.CODEX_THREAD_ID) && automatic.enabled && text(input.prompt)) {
+        record.run = { ...initialDeliveryRun(input.prompt, 'Address the user request in this conversation and verify the result.', now),
+          enrollmentSource: automatic.source === 'cli_default' ? 'cli_automatic' : 'workspace_automatic' };
+      }
+      // A completion claim made before a new user turn cannot answer that turn's
+      // corrections. Keep its evidence and the original goal, but require a
+      // fresh result. This does not classify the prompt or reopen finished work.
+      if (record.run?.state === 'active' && !record.run.managed && text(input.prompt)) {
+        delete record.run.completionCheck;
+        if (record.run.checkpoint?.status === 'completed') record.run.consumedRevision = record.run.revision;
+      }
+      output = { hookSpecificOutput: { hookEventName: event, additionalContext: hookDeliveryContext(record, automatic.enabled && !env.SIMY_PARENT_SESSION && !(provider === 'claude' && env.CODEX_THREAD_ID)) } };
+    }
     const run = record.run;
     if(run && event==='Stop') {
       // Recheck the actual retained task under its record lock. Lifecycle
@@ -1886,7 +2080,6 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       }
     }
     if (!run || TERMINAL.has(run.state)) return record;
-    if (event === 'UserPromptSubmit') output = { hookSpecificOutput: { hookEventName: event, additionalContext: deliveryAcceptanceContext(run) } };
     if (event === 'Interrupt') { run.state = 'stopped'; run.reason = 'User interrupted the provider.'; }
     else if (run.state === 'auto_resuming' && ['Stop', 'SessionEnd', 'StopFailure'].includes(event)) {
       // The supervisor owns this exact attempt and consumes its structured
@@ -1978,6 +2171,7 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
   });
   try {
     if (event === 'SessionStart') observed = await withSessionParentLock(root, applyObservation, inspectProcess);
+    else if (event === 'UserPromptSubmit') observed = await withAutomaticLock(root, provider, cwd, applyObservation);
     else observed = await applyObservation();
   } catch (error) {
     if (claimedWorkspace?.release) await claimedWorkspace.release();
@@ -2244,7 +2438,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       const selectedKind = run.managed?.decision?.action?.kind;
       const approvedWait = run.managed?.decision?.outcome === 'wait' && run.managed.approvedAction?.id === run.managed.decision.id && !run.managed.approvedAction.dispatchedAt;
       const queuedAppServer = run.managed?.resumeChannel === 'codex_app_server' &&
-        ['read', 'local_edit', 'local_test', ...(searchEnabled(run.managed) ? ['external'] : [])].includes(selectedKind) &&
+        ['read', 'local_edit', 'local_test', ...(searchEnabled(run.managed) && run.managed.autonomyPolicy === 'autonomous' && run.managed.decision?.assessment?.reversibility === 'reversible' ? ['external'] : [])].includes(selectedKind) &&
         (run.managed.decision.outcome !== 'wait' || approvedWait);
       if (queuedAppServer) run.managed.autoRecovery = true;
       run.state = queuedAppServer ? 'recovery_required' : 'active';