@awak-app/simy-cli 0.7.27 → 0.7.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.27",
+  "version": "0.7.29",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -39,11 +39,11 @@
     "test:e2e:console:real-provider": "node ./scripts/real-provider-console-e2e.js",
     "test:e2e:console:fullstack": "node ./scripts/fullstack-cli-smoke.js",
     "check": "npm run check:auto-update && node --check ./src/desktop-executor.js && node --check ./src/local-task.js && node --check ./scripts/desktop-executor-e2e.js && node --check ./scripts/pre-guardrail-e2e.js && node --check ./scripts/fixtures/fake-desktop-provider.js && npm run check:syntax && npm run check:session-supervision-syntax && npm run check:real-provider-syntax && npm test && npm run check:package",
-    "check:session-supervision-syntax": "node --check ./src/session-supervision/session-list.js && node --check ./src/console/sessions.js && node --check ./src/session-supervision/remote-hosts.js && node --check ./src/session-supervision/remote-entry.js && node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs && node --check ./src/session-supervision/purpose-instruction.js && node --check ./src/session-supervision/purpose-recovery.js && node --check ./src/session-supervision/purpose-candidate.js && node --check ./src/codex-plugins/simy/hooks/scene-reasoning.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-cycle.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-rule-review.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-search.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-evidence.mjs && node --check ./src/session-supervision/purpose-observer.js && node --check ./src/session-supervision/purpose-verification.js && node --check ./src/codex-plugins/simy/hooks/purpose-workspace.mjs && node --check ./scripts/purpose-search-live-e2e.js && node --check ./src/session-supervision/remote-managed-delivery.js",
+    "check:session-supervision-syntax": "node --check ./src/session-supervision/session-list.js && node --check ./src/console/sessions.js && node --check ./src/session-supervision/remote-hosts.js && node --check ./src/session-supervision/remote-entry.js && node --check ./src/session-supervision/index.js && node --check ./src/session-supervision/discovery-window.js && node --check ./src/session-supervision/codex-app-server.js && node --check ./src/session-supervision/claude-sessions.js && node --check ./src/session-supervision/claude-outcome-review.js && node --check ./src/session-supervision/original-session-target.js && node --check ./src/session-supervision/action-association.js && node --check ./src/session-supervision/action-association-host.js && node --check ./src/session-supervision/action-association-api.js && node --check ./src/session-supervision/association-store.js && node --check ./src/session-supervision/action-deadline.js && node --check ./src/session-supervision/action-deadline-store.js && node --check ./src/codex-plugins/simy/hooks/action-association.mjs && node --check ./src/session-supervision/purpose-instruction.js && node --check ./src/session-supervision/purpose-recovery.js && node --check ./src/session-supervision/purpose-candidate.js && node --check ./src/codex-plugins/simy/hooks/scene-reasoning.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-cycle.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-rule-review.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-search.mjs && node --check ./src/codex-plugins/simy/hooks/purpose-evidence.mjs && node --check ./src/session-supervision/purpose-observer.js && node --check ./src/session-supervision/purpose-verification.js && node --check ./src/codex-plugins/simy/hooks/purpose-workspace.mjs && node --check ./scripts/purpose-search-live-e2e.js && node --check ./src/session-supervision/remote-managed-delivery.js",
     "check:auto-update": "node --check ./src/auto-update.js && node --check ./scripts/auto-update-e2e.js && npm run check:sqm",
     "check:workflow-observation-sender": "node --check ./src/workflow-observation-sender.js",
     "check:sqm": "node --check ./src/sqm/provider-plugin-repair.js && node --check ./src/sqm/provider-plugin-status.js && node --check ./src/sqm/advisory-guidance.js && node --check ./src/sqm/canonical.js && node --check ./src/sqm/validation.js && node --check ./src/sqm/reliability.js && node --check ./src/sqm/repository.js && node --check ./src/sqm/checkers.js && node --check ./src/sqm/bundle-store.js && node --check ./src/sqm/proof.js && node --check ./src/sqm/evidence-client.js && node --check ./src/sqm/session.js && node --check ./src/sqm/index.js && node --check ./src/sqm/command.js && node --check ./src/sqm/agent-skill.js && node --check ./src/sqm/workflow-onboarding.js && node --check ./src/sqm/workflow-update.js && node --check ./src/sqm/history-store.js && node --check ./src/sqm/review-worker.js && node --check ./scripts/sqm-complete-loop-e2e.js && node --check ./scripts/sqm-local-review-e2e.js",
-    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js && node --check ./scripts/codex-plugin-runtime-e2e.js",
+    "check:real-provider-syntax": "node --check ./scripts/real-codex-probe.js && node --check ./scripts/real-claude-probe.js && node --check ./scripts/claude-delivery-fault-live-e2e.mjs && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/claude-parity-runtime-e2e.js && node --check ./scripts/claude-plugin-runtime-e2e.js && node --check ./scripts/codex-plugin-runtime-e2e.js",
     "check:syntax": "node --check ./src/purpose-local-proof.js && node --check ./src/device-signing-identity.js && node --check ./src/index.js && node --check ./src/install-update.js && node --check ./src/agent.js && node --check ./src/connection-discovery.js && node --check ./src/connection-diagnostics.js && node --check ./src/launch-authorization.js && node --check ./src/codex-plugins/simy/hooks/connection-reminder.mjs && node --check ./src/codex-plugins/simy/hooks/dev-work.mjs && node --check ./src/dev-work-events.js && node --check ./src/browser.js && node --check ./src/web-api.js && node --check ./src/durable-local-task-worker.js && node --check ./src/durable-local-task-steps-contract.js && node --check ./src/bounded-local-task-subtasks-contract.js && node --check ./src/bounded-local-task-subtask-pool.js && node --check ./src/local-task-artifact-contract.js && node --check ./src/execution-capability-contract.js && node --check ./src/shutdown.js && node --check ./src/run-registry.js && node --check ./src/direct-executor.js && node --check ./src/execution-guardrail.js && node --check ./src/backend-executable.js && node --check ./src/login-shell-path.js && node --check ./src/hook-runtime.js && node --check ./src/provider-stream.js && node --check ./src/console/index.js && node --check ./src/console/app.js && node --check ./src/console/commands.js && node --check ./src/local-attachments.js && node --check ./src/repository-inventory.js && node --check ./src/session-store.js && node --check ./src/web-origin.js && node --check ./src/workspace-context.js && node --check ./src/orchestrator/index.js && node --check ./src/orchestrator/shared.js && node --check ./src/orchestrator/recovery.js && node --check ./src/orchestrator/risk.js && node --check ./src/orchestrator/contract.js && node --check ./src/orchestrator/completion-contract.js && node --check ./src/orchestrator/pr-preparation.js && node --check ./src/orchestrator/minimum-completion.js && node --check ./src/orchestrator/delivery/scripts/check-minimum-completion.mjs && node --check ./src/orchestrator/instruction.js && node --check ./src/orchestrator/problem-solving.js && node --check ./src/orchestrator/budget.js && node --check ./src/orchestrator/execution-io.js && node --check ./src/orchestrator/presentation.js && node --check ./src/orchestrator/result.js && node --check ./src/orchestrator/retry.js && node --check ./src/orchestrator/evidence.js && node --check ./src/orchestrator/independent-audit.js && node --check ./src/orchestrator/audit.js && node --check ./src/orchestrator/loop.js && node --check ./src/runner.js && node --check ./src/coding-run-store.js && node --check ./scripts/fixtures/completion-contract-fixture.js && node --check ./scripts/fixtures/fake-coding-backend.js && node --check ./scripts/e2e-terminal-evidence.js && node --check ./scripts/audit-gate-e2e.js && node --check ./scripts/completion-contract-e2e.js && node --check ./scripts/retry-circuit-e2e.js && node --check ./scripts/follow-up-charter-e2e.js && node --check ./scripts/task-routing-e2e.js && node --check ./scripts/executor-version-preflight-e2e.js && node --check ./scripts/blocked-recovery-e2e.js && node --check ./scripts/process-localization-e2e.js && node --check ./scripts/hypothesis-retries-e2e.js && node --check ./scripts/budget-enforcement-e2e.js && node --check ./scripts/local-task-default-workspace-e2e.js && node --check ./scripts/local-task-idempotency-e2e.js && node --check ./scripts/console-e2e-fixture.js && node --check ./scripts/console-e2e.js && node --check ./scripts/console-recovery-e2e-fixture.js && node --check ./scripts/console-recovery-e2e.js && node --check ./scripts/real-provider-console-fixture.js && node --check ./scripts/real-provider-console-e2e.js && node --check ./scripts/fullstack-cli-smoke.js && node --check ./scripts/check-package-contents.js && node --check ./src/codex-plugins/simy/hooks/delivery-loop.mjs && node --check ./src/delivery-hooks/command.js && node --check ./src/delivery-hooks/desktop.js && node --check ./src/delivery-hooks/supervisor.js && node --check ./src/delivery-hooks/recovery.js && node --check ./src/delivery-hooks/supervisor-owner.js && node --check ./src/delivery-hooks/supervisor-watchdog.js && node --check ./src/delivery-hooks/supervisor-service.js && node --check ./scripts/supervisor-watchdog-live-e2e.js && node --check ./src/codex-plugins/simy/hooks/recovery-incident.mjs && node --check ./src/session-supervision/automatic-continuation.js && node --check ./src/session-supervision/stop-notifications.js",
     "check:package": "node ./scripts/check-package-contents.js",
     "build:macos-installer:dev": "bash packaging/build-macos-arm64.sh --unsigned-dev",

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.27";
+export const CLI_VERSION = "0.7.29";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/cli-observability.js

@@ -7,7 +7,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { webApiHeaders, webApiUrl } from './web-api.js';
 // Keep this leaf module package-safe: hooks load it before the full CLI contract.
-const CLI_VERSION = '0.7.27';
+const CLI_VERSION = '0.7.29';
 
 const STORE = 'cli-observability-state.json';
 const LEGACY_CONFIG = 'cli-observability.json';

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -432,14 +432,14 @@ function assessedPlan(value, managed = null) {
   if (!alternatives.some(option => option.id === recommendation.optionId) || (!flexible && !recommendation.reason)) throw new Error('Plan recommendation must identify an assessed option and reason.');
   return { diagnosis: text(value.diagnosis, 2000), alternatives, selectedOptionId, recommendation, userQuestion: text(value.userQuestion, 1000) || null };
 }
-function missingAcceptanceDiagnosis(managed, missing) {
+export function missingAcceptanceDiagnosis(managed, missing) {
   const names = missing.map(item => item.id).join(', ');
   const scope = managed.decision.action.scope;
   const action = { kind: 'read', scope, summary: `Inspect missing acceptance checks: ${names}` };
-  return assessedPlan({ diagnosis: `Worker claimed completion, but independent file checks still fail: ${names}. Diagnose the discrepancy before any repair.`,
+  return assessedPlan({ diagnosis: `Worker claimed completion, but independent acceptance checks still fail: ${names}. Diagnose the discrepancy before any repair.`,
     alternatives: [{ id: 'inspect_missing_acceptance', action,
       assessment: { risk: 'low', reversibility: 'reversible', externalEffect: 'none', blastRadius: 'single_file', uncertainty: 'low', inObjective: true, userChoice: false },
-      expectedVerification: `Report observed file state for ${names}`, rollback: 'No changes to undo' }],
+      expectedVerification: `Report actual outcome and unmet conditions for ${names}`, rollback: 'No changes to undo' }],
     selectedOptionId: 'inspect_missing_acceptance', recommendation: { optionId: 'inspect_missing_acceptance', reason: 'Independent checks have not verified completion.' } });
 }
 function rejectedActionDiagnosis(managed, rejected) {
@@ -503,6 +503,18 @@ export function canResearchReplan(run, provider, now) {
     !m.userQuestion && !['understanding', 'needs_clarification', 'action_association'].includes(m.phase) &&
     !m.nativeWait && !m.providerWarning && !m.usageBlocked && !m.purpose?.nativeBoundary && !run.blocker && !deliveryStop(run, now, { checkProgress: false }));
 }
+// A legacy worker can mislabel a filesystem write as effect-free. Keep that
+// write held; only diagnose its assessment after the original turn has settled.
+function canDiagnoseLegacyLocalEffect(run, provider, now) {
+  const m = run?.managed, d = m?.decision, pending = m?.pendingApproval;
+  if (!['active', 'blocked'].includes(run?.state) || searchEnabled(m) || m?.capability !== 'live_hook' || m.autonomyPolicy !== 'autonomous' ||
+      d?.action?.kind !== 'local_edit' || d.assessment?.externalEffect !== 'none' ||
+      d.assessment.reversibility !== 'reversible' || d.reason !== 'Local write has inconsistent effect boundaries.' ||
+      pending?.id !== d.id || pending.denied || m.plan?.userQuestion ||
+      m.rejectedActionDigests?.includes(digest(JSON.stringify(d.action)))) return false;
+  return canResearchReplan({ ...run, state: 'blocked', managed: { ...m, pendingApproval: null,
+    decision: { ...d, waitKind: 'research' } } }, provider, now);
+}
 export function evaluateAssessedPlan(plan, policy, scopes, now = Date.now(), { allowLocalTestWrites = false, llmDelegated = false, allowReversibleExternal = false } = {}) {
   const option = plan.alternatives.find(item => item.id === plan.selectedOptionId);
   const { action } = option;
@@ -514,9 +526,10 @@ export function evaluateAssessedPlan(plan, policy, scopes, now = Date.now(), { a
   if (!scopes.includes(action.scope)) { reason = 'Action scope is outside the task enrollment.'; waitKind = 'authority'; }
   else if (facts.inObjective !== true) reason = 'Establish objective fit or choose work within the original task.';
   else if (facts.reversibility === 'irreversible') { reason = 'Irreversible consequences require an exact user decision.'; waitKind = 'human'; }
-  else if (facts.reversibility !== 'reversible' || facts.externalEffect === 'unknown' || facts.blastRadius === 'unknown') reason = 'Investigate effect boundaries and reversibility before execution.';
+  else if (facts.reversibility !== 'reversible' || facts.externalEffect === 'unknown' || facts.blastRadius === 'unknown') reason = `Investigate unresolved assessment fields before execution: ${['reversibility', 'externalEffect', 'blastRadius'].filter(key => key === 'reversibility' ? facts[key] !== 'reversible' : facts[key] === 'unknown').map(key => `${key}=${facts[key]}`).join(', ')}. Inspect the actual target and operation contract; preserve facts that remain unknown.`;
   else if (!autonomous && (facts.userChoice !== false || Object.values(facts).includes('unknown') || facts.userChoice === null)) reason = 'Action assessment or user choice needs review under the selected policy.';
   else if (!option.expectedVerification) reason = 'Expected verification is missing; acquire a verification method.';
+  else if (autonomous && allowReversibleExternal && action.kind === 'external' && facts.externalEffect !== 'external') reason = 'External action and declared effects disagree. Inspect the target and correct the assessment without executing it; API/service mutations have external effects even for a loopback service, while local filesystem work uses a local action.';
   else if ((!LOCAL_ACTIONS.has(action.kind) || facts.externalEffect === 'external') && !external) { reason = 'This action needs existing external authority or a reversible supported alternative.'; waitKind = 'authority'; }
   else if ((localWrite || external) && (!option.rollback || external && /^(?:no changes|none|n\/a)/i.test(option.rollback.trim()))) reason = 'Effectful work needs a concrete restoration plan.';
   else if (localWrite && facts.externalEffect !== 'local') reason = 'Local write has inconsistent effect boundaries.';
@@ -542,11 +555,11 @@ export function canExecuteAutonomousExternal(managed) {
 // contract identical across transports; the host still verifies acceptance.
 export function assessedCheckpointContract(decision, managed = null) {
   const observationField = flexibleReasoning(managed) ? 'Plan diagnosis, recommendation and its reason are optional when the selected action is clear. Optional observations may be omitted; do not create evidence files, citations or extra reports. Actual tool results are captured by the controller.' : 'Return the observed result; evidence attachments and extra reports are optional.';
-  return `${minimalSufficientChangeInstruction({ turn: 'assessed' })}\nReturn ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened"} for THIS selected action. ${observationField} ${actionReversibilityInstruction} This is provider-reported, not independent verification. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. Missing facts are unknown. Successful diagnosis or repair is only an action result, not completion of the original user task. If original work remains, return in_progress with remainingWork and the next assessed plan, preserving the original objective, corrections and acceptance criteria. Do not repeat effects already performed. Completion claims go to SIMY independent inspection of the actual frozen acceptance conditions; no worker-authored proof is certification. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. ${informationWaitInstruction} external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
+  return `${minimalSufficientChangeInstruction({ turn: 'assessed' })}\nReturn ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened"} for THIS selected action. ${observationField} ${actionReversibilityInstruction} This is provider-reported, not independent verification. When the requested outcome is a conversational answer or correction, put the actual answer text in summary. Saying it was prepared or delivered is insufficient; do not place the answer only in an undeclared JSON field. For an answer-only request, returning that text here is the conversational result: do not invent a separate message-delivery action unless the original user requested a separate destination. This does not verify implementation or external effects. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. Missing facts are unknown. Successful diagnosis or repair is only an action result, not completion of the original user task. If original work remains, return in_progress with remainingWork and the next assessed plan, preserving the original objective, corrections and acceptance criteria. Do not repeat effects already performed. Report completed only when the original requested outcome is achieved; keep unfinished checks as remaining work. Do not add audit reports, certification, or evidence-submission tasks. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. ${informationWaitInstruction} external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
 
 }
 export function understandingCheckpointContract(decision) {
-  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\n${correctiveFollowupInstruction}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use manual."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic for purpose search or manual otherwise. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
+  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\n${correctiveFollowupInstruction}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use manual."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic for purpose search or manual otherwise. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. If and only if the original user requests ONLY a conversational answer or design (no implementation, files, tests, deployment or external effects), no independent review/audit or human acceptance is requested anywhere in the user context, and the existing answer already satisfies every requested point, you may include sessionUnderstanding.conversationOutcome:{kind:"answer_only",independentReviewRequested:false,requestTurnRefs:["exact user turn refs"],answerTurnRefs:["exact assistant answer turn refs"]}. Include the latest user and latest answer references, and exact user excerpts in the criteria basis. Read and judge the actual answer, including factual errors and unsupported claims; its mere existence or a worker saying done is insufficient. If the answer is wrong or incomplete, use clear with the next read action to formulate the missing/corrected answer, not already_done. Omit conversationOutcome for uncertain scope, missing context or requested effects; a design that describes unimplemented work is complete only when the user asked for design alone. This optional classification ends only an initially uncontracted conversational task as reported_done; it does not waive a frozen acceptance contract or assert independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
 }
 function boundedContextList(value, maxItems = 8, maxLength = 300) {
   if (!Array.isArray(value) || value.length > maxItems) throw new Error('Session understanding has too many items.');
@@ -588,13 +601,40 @@ function sessionUnderstanding(value) {
   }) : [];
   const result = { state: value.state, objective: contextText(value.objective, 1000), constraints: boundedContextList(value.constraints),
     done: boundedContextList(value.done), remaining: boundedContextList(value.remaining), nextAction: value.nextAction ? actionDescriptor(value.nextAction) : null,
-    criteria, matchingContext: value.matchingContext && typeof value.matchingContext === 'object' ? boundedMatchingContext(value.matchingContext) : null, ambiguities: boundedContextList(value.ambiguities, 3), question: contextText(value.question, 500) || null, basis };
+    criteria, conversationOutcome: normalizeConversationOutcome(value.conversationOutcome), matchingContext: value.matchingContext && typeof value.matchingContext === 'object' ? boundedMatchingContext(value.matchingContext) : null, ambiguities: boundedContextList(value.ambiguities, 3), question: contextText(value.question, 500) || null, basis };
   if (result.state === 'clear' && (!result.objective || !result.remaining.length || !result.nextAction || result.ambiguities.length || result.question)) throw new Error('Clear understanding needs an objective, remaining work, and an unambiguous next action.');
   if (result.state === 'already_done' && (!result.objective || result.remaining.length || result.nextAction)) throw new Error('Already-finished understanding must have no remaining action.');
   if (['clear', 'already_done'].includes(result.state) && !basis.some(item => item.source === 'user')) throw new Error('Inferred session goal needs a user-message basis.');
   if (['ambiguous', 'context_missing'].includes(result.state) && (!result.question || result.ambiguities.length !== 1)) throw new Error('Unclear understanding needs one focused question.');
   return result;
 }
+function normalizeConversationOutcome(value) {
+  if (value?.kind !== 'answer_only' || value.independentReviewRequested !== false) return null;
+  const refs = key => Array.isArray(value[key]) && value[key].length > 0 && value[key].length <= 32 &&
+    value[key].every(ref => typeof ref === 'string' && ref.length > 0 && ref.length <= 160) ? [...new Set(value[key])] : null;
+  const requestTurnRefs = refs('requestTurnRefs'), answerTurnRefs = refs('answerTurnRefs');
+  return requestTurnRefs && answerTurnRefs ? { kind: 'answer_only', independentReviewRequested: false, requestTurnRefs, answerTurnRefs } : null;
+}
+function conversationUnderstandingComplete(run, understanding, context) {
+  const managed = run.managed, outcome = understanding.conversationOutcome;
+  if (!managed.contextBootstrap || managed.acceptanceCriteria.length || managed.independentReviewRequired ||
+      understanding.state !== 'already_done' || !outcome || context?.proseComplete !== true || context.proseOnly !== true || context.incomplete || context.awaitingTurn ||
+      !understanding.criteria.length || understanding.criteria.some(c => c.source !== 'user_grounded' || c.check.type !== 'semantic') ||
+      managed.executionUncertain || managed.purpose?.nativeBoundary) return false;
+  if ([...(managed.workHistory || []), ...(managed.purpose?.evidence?.units || [])].some(row => row.action?.kind && row.action.kind !== 'read') ||
+      managed.purpose?.evidence?.receipts?.some(row => row.kind === 'fileChange')) return false;
+  const messages = context.messages || [], latestUser = messages.findLastIndex(row => row.role === 'user');
+  const latestAnswer = messages.findLastIndex(row => row.role === 'assistant');
+  if (latestUser < 0 || latestAnswer <= latestUser || !outcome.requestTurnRefs.includes(messages[latestUser].turnRef) ||
+      !outcome.answerTurnRefs.includes(messages[latestAnswer].turnRef)) return false;
+  if (outcome.requestTurnRefs.some(ref => !messages.some(row => row.role === 'user' && row.turnRef === ref)) ||
+      outcome.answerTurnRefs.some(ref => !messages.some((row, index) => index > latestUser && row.role === 'assistant' && row.turnRef === ref && row.text?.trim()))) return false;
+  return understanding.criteria.every(criterion => {
+    const basis = understanding.basis[criterion.basisIndex];
+    return basis?.source === 'user' && outcome.requestTurnRefs.includes(basis.turnRef) && basis.snippet &&
+      messages.some(row => row.role === 'user' && row.turnRef === basis.turnRef && row.text.includes(basis.snippet));
+  });
+}
 function recordPurposeReview(managed, review, now) {
   const purpose = managed.purpose;
   if (searchEnabled(managed)) reconcileRequirements(managed, review, now);
@@ -790,15 +830,83 @@ export function pendingAcceptance(run) {
   if (enrollment && (enrollment.objective !== run.objective || enrollment.acceptanceDigest !== digest(JSON.stringify(run.managed.acceptanceCriteria)) ||
       JSON.stringify(enrollment.deliveryLevel) !== JSON.stringify(run.managed.deliveryLevel || null))) return [{ id: 'enrollment', description: 'Original objective, level and acceptance contract',
     check: 'manual', detail: 'Enrollment changed unexpectedly; stop and inspect before enrolling a revised task' }];
-  return effectiveAcceptanceCriteria(run.managed).filter(item => !Object.hasOwn(run.managed.verified, item.id))
+  const pending = effectiveAcceptanceCriteria(run.managed).filter(item => !Object.hasOwn(run.managed.verified, item.id))
     .map(item => ({ id: item.id, description: item.description, check: item.check.type,
       detail: run.managed.criterionObservations?.[item.id]?.observed_result || (item.check.type === 'manual' ? 'Explicit user verification required' : 'Independent check not yet passed') }));
+  // File predicates and a worker claim cannot waive an explicit review.
+  // The host checkpoint path supplies an independently bound result when available.
+  if (run.managed?.independentReviewRequired && !searchEnabled(run.managed) && run.managed.liveOutcomeReview?.passed !== true) pending.push({
+    id: 'independent-review', description: 'Required independent outcome review', check: 'semantic',
+    detail: 'Independent outcome review has not passed; file checks alone cannot complete this task' });
+  return pending;
 }
 function acceptancePendingReason(run) {
   return `Acceptance verification pending: ${pendingAcceptance(run).map(item => `${item.id} (${item.description}): ${item.detail}`).join('; ')}`;
 }
+// Only the host review executor calls this; worker checkpoints cannot supply a
+// passing verdict. Recheck the enrollment, holds, and actual workspace at commit.
+export async function settleLiveOutcomeReview({ root, provider, session, snapshot, review }) {
+  return updateRecord(root, provider, session, async record => {
+    if (!liveOutcomeReviewEligible(record) || record.run.id !== snapshot.run.id || record.run.revision !== snapshot.run.revision || record.run.controlRevision !== snapshot.run.controlRevision ||
+        JSON.stringify(record.run.managed.enrollment) !== JSON.stringify(snapshot.run.managed.enrollment) ||
+        hasPendingUserStop(root, record) || !(await providerLinkState(root, provider)).connected) return record;
+    const run = record.run, managed = run.managed;
+    const owner = managed.liveHookOwner;
+    if (owner && await processIdentity(owner.pid) !== owner.identity) return record;
+    if (review.inspectionAvailable !== false && await workspaceIdentity(taskDirectory(record)).catch(() => null) !== review.workspaceDigest)
+      review = { passed: false, inspectionAvailable: false, summary: 'Workspace changed during independent review; reread the current outcome before retrying.', findings: [], source: 'controller_review_unavailable', checkedAt: Date.now() };
+    managed.liveOutcomeReview = review;
+    if (review.nativeRequest) {
+      managed.nativeOutcomeReview = review.nativeRequest;
+      const plan = missingAcceptanceDiagnosis(managed, [{ id: 'native-independent-review', description: review.summary }]);
+      plan.alternatives[0].action.summary = `Use native Agent ${review.nativeRequest.agentType} with the exact managed.nativeOutcomeReview.prompt from simy delivery status. No extra context, fork, resume, model override or tools. Wait for its result, then submit a completed checkpoint. Keep the original budget. If unavailable, report not_run; do not retry or launch another Claude process.`;
+      plan.diagnosis = review.summary;
+      recordDecision(managed, plan, Date.now());
+      run.state = 'active';
+      run.checkpoint = { ...run.checkpoint, status: 'in_progress', reportedStatus: 'completed', acceptanceMet: false, nextStep: plan.alternatives[0].action.summary };
+      run.nextStep = run.checkpoint.nextStep;
+      return record;
+    }
+    if (review.budgetBoundary) {
+      // Do not spend the original worker allowance on retrying an executor that
+      // cannot share its cap. Keep acceptance pending at the genuine Stop.
+      run.reason = review.summary;
+      return record;
+    }
+    if (review.passed) {
+      for (const criterion of effectiveAcceptanceCriteria(managed)) if (criterion.check.type === 'semantic')
+        managed.verified[criterion.id] = { source: 'independent_claude_review', checkedAt: Date.now(), workspaceDigest: review.workspaceDigest };
+      await verifyAutomaticCriteria(record, Date.now());
+      // Keep the original writer lease until its genuine Stop boundary.
+      if (!pendingAcceptance(run).length) { run.state = 'active'; run.reason = 'Independent review passed; awaiting original Stop readback.'; }
+    } else if (managed.autonomyPolicy && managed.decision) {
+      const missing = [{ id: 'independent-review', description: review.summary }];
+      const plan = missingAcceptanceDiagnosis(managed, missing);
+      plan.diagnosis = [review.summary, ...(review.findings || [])].join(' ').slice(0, 4000);
+      if (review.inspectionAvailable === false) {
+        plan.alternatives[0].action.summary = 'Inspect independent review availability and missing observations without changing the deliverable';
+        plan.alternatives[0].expectedVerification = 'Identify the concrete observation or provider failure and an authorized way to retry verification of the original outcome.';
+        plan.diagnosis = `Independent inspection unavailable; no product defect has been established. ${plan.diagnosis}`;
+        run.failures += 1;
+      }
+      recordDecision(managed, plan, Date.now());
+      run.state = 'active';
+      run.checkpoint = { ...run.checkpoint, status: 'in_progress', reportedStatus: 'completed', acceptanceMet: false, nextStep: plan.alternatives[0].action.summary };
+      run.nextStep = run.checkpoint.nextStep; managed.remainingWork = plan.diagnosis;
+    }
+    return record;
+  });
+}
+export function liveOutcomeReviewEligible(record) {
+  const run = record?.run, m = run?.managed;
+  return Boolean(record?.provider === 'claude' && m?.capability === 'live_hook' && !searchEnabled(m) &&
+    run.state === 'verification_pending' && run.checkpoint?.status === 'completed' &&
+    (m.independentReviewRequired || effectiveAcceptanceCriteria(m).some(c => c.check.type === 'semantic')) &&
+    !m.liveOutcomeReview && !m.pendingApproval && !m.nativeWait && !m.executionUncertain && !m.purpose?.nativeBoundary &&
+    !managedBudgetReason(run) && automaticContinuationAllowed(record));
+}
 export function deliveryAcceptanceContext(run) {
-  return `Original objective: ${run.managed?.enrollment?.objective || run.objective}. Mode: ${run.managed ? 'managed acceptance tracking' : 'standard checkpoint tracking; completion reports are not verified acceptance'}.` +
+  return `${run.managed?.capability === 'live_hook' && run.managed?.thread?.provider === 'claude' ? 'When the requested artifact is ready or repaired, submit a completed work checkpoint to request independent review. This does not grant acceptance. If nativeOutcomeReview.prompt is absent, submit that checkpoint first to obtain a fresh review prompt; never reuse a pre-repair prompt. ' : ''}Original objective: ${run.managed?.enrollment?.objective || run.objective}. Mode: ${run.managed ? 'managed acceptance tracking' : 'standard checkpoint tracking; completion reports are not verified acceptance'}.` +
     `${run.managed?.deliveryLevel ? ` Frozen delivery level: ${JSON.stringify(run.managed.deliveryLevel)}.` : ''}` +
     ` Pending acceptance (last recorded checks): ${JSON.stringify(pendingAcceptance(run))}. Continue only within the original request and permissions; manual checks require the user. SQM is optional and 0 applicable checks do not establish quality acceptance.`;
 }
@@ -1065,7 +1173,8 @@ export function queuePurposeDiagnosis(run, reason, key, now = Date.now(), recove
 export const informationWaitInstruction = 'Use blocked/missing_information only with a nonempty question field containing a concrete question that requires the user\'s answer. Missing verification evidence, zero applicable SQM rules/scenarios, or unfinished checks alone are remaining work: inspect applicability and available evidence, then propose authorized repair or verification. Keep unmet acceptance criteria unverified; do not invent rules or lower acceptance. If investigation finds a real user-only choice or unavailable input, ask that specific question. Preserve native permissions, explicit stops, refusals and budgets.';
 const informationWaitDiagnosis = 'Read the current task context and available verification evidence to determine whether progress really requires a user answer. Identify an authorized next investigation or verification step, or return blocked/missing_information with the specific user question. Do not repeat prior side effects or claim that incomplete verification passed.';
 
-export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, expectedLease, toolEvidence = [], sourceContext, controllerEvidence, now = Date.now() }) {
+export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, expectedLease, expectedNativeHandoff, toolEvidence = [], sourceContext, controllerEvidence, now = Date.now() }) {
+  if (expectedNativeHandoff && checkpoint?.kind) throw new Error('Native handoff requires an ordinary action checkpoint.');
   if (checkpoint?.kind === 'action_association') return checkpointActionAssociation({ root, provider, session, cwd, checkpoint, expectedLease, now });
   if (checkpoint?.kind === 'session_understanding') return checkpointUnderstanding({ root, provider, session, cwd, checkpoint, expectedLease, sourceContext, controllerEvidence, now });
   try { cwd = await realpath(cwd); } catch { throw new Error('No matching active Delivery Loop.'); }
@@ -1081,6 +1190,16 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     let nextStep = text(checkpoint.nextStep);
     let repairPlan = null;
     if (!run || !checkpointDirectoryMatches(record, cwd)) throw new Error('No matching active Delivery Loop.');
+    if (expectedNativeHandoff) {
+      const h = run.managed?.nativeHandoff, expected = expectedNativeHandoff;
+      if (h?.id !== expected.id || h.turnId !== expected.turnId || h.phase !== 'finished' || h.turnStatus !== 'completed' || run.id !== expected.runId ||
+          h.decisionId !== expected.decisionId || h.decisionId !== run.managed.decision?.id || run.revision !== expected.revision ||
+          run.controlRevision !== expected.controlRevision || record.autoContinueEpoch !== expected.epoch ||
+          !record.autoContinue || !automaticContinuationAllowed(record) || hasPendingUserStop(root, record) ||
+          run.stopReason || run.state !== 'recovery_required') throw new Error('Native handoff changed; checkpoint discarded.');
+      if (h.checkpointRevision !== undefined) return record;
+      run.state = 'active';
+    }
     if (run.managed?.phase === 'understanding' || run.managed?.phase === 'needs_clarification') throw new Error('Session understanding needs its separate structured checkpoint.');
     if (expectedLease && (run.state !== 'auto_resuming' || run.managed?.resumeLease?.id !== expectedLease || run.revision !== run.managed.resumeLease.checkpointRevision)) throw new Error('Managed recovery lease changed; checkpoint discarded.');
     if (TERMINAL.has(run.state) || run.state === 'blocked' || run.state === 'recovery_required') throw new Error('Loop is stopped or awaiting a human resume.');
@@ -1266,6 +1385,10 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       ...(remainingWork ? { remainingWork } : {}), ...(incompleteResult ? { reportedStatus: checkpoint.status } : {}),
       evidence, acceptanceMet: !unsupportedWait && !incompleteResult && checkpoint.acceptanceMet === true };
     if (!run.managed && effectiveStatus !== 'completed') delete run.completionCheck;
+    if (run.managed?.liveOutcomeReview) {
+      delete run.managed.liveOutcomeReview;
+      for (const criterion of effectiveAcceptanceCriteria(run.managed)) if (criterion.check.type === 'semantic') delete run.managed.verified[criterion.id];
+    }
     run.revision += 1; run.updatedAt = now;
     recordManagedOutcomeProgress(run, now);
     // File predicates were reread above; a prior semantic verdict can belong
@@ -1296,6 +1419,14 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       sourceId: expectedLease || `checkpoint:${run.revision}`, attemptId: expectedLease,
       resultRef: `checkpoint:${run.revision}`, now }));
     notifyState(run, now);
+    if (expectedNativeHandoff) {
+      run.managed.nativeHandoff.checkpointRevision = run.revision;
+      const attempt = run.managed.executionAttempt;
+      if (attempt?.decisionId === expectedNativeHandoff.decisionId) {
+        attempt.phase = 'checkpointed'; attempt.checkpointRevision = run.revision;
+      }
+      if (run.state === 'active') { run.state = 'recovery_required'; run.recoveryCause = 'session_supervision'; }
+    }
     return record;
   });
   return settled;
@@ -1326,6 +1457,16 @@ export function externalReviewIsCurrent(managed,review,now) {
     .every(link=>observations.some(item=>item.id===link.ref && item.status==='observed' && currentPurposeObservation(item,now,review.observationWindow)));
 
 }
+function verifiedConversationResult(managed, review) {
+  const inspection = review.semanticInspection;
+  if (inspection?.source !== 'controller_conversation_answer' || inspection.digest !== review.answerContext?.digest ||
+      !/^[a-f0-9]{64}$/.test(inspection.digest || '') || !review.inspectionPerformed) return null;
+  const answer = (managed.purpose?.evidence?.receipts || []).filter(row => row.kind === 'agentMessage' && row.ref?.startsWith('answer:')).at(-1);
+  if (!answer || answer.ref !== inspection.answerRefs?.at(-1) || answer.id !== inspection.answerDigest ||
+      answer.observation?.truncated || answer.observation?.redacted || typeof answer.observation?.text !== 'string' ||
+      createHash('sha256').update(answer.observation.text).digest('hex') !== inspection.answerDigest) return null;
+  return answer.observation.text;
+}
 export async function settlePurposeVerification({ root, provider, session, expectedLease, review, verifySnapshot, now = Date.now() }) {
   const started = Date.now(), initialNow = now;
   const snapshot = (await listRecords(root)).find(record => record.provider === provider && record.session === session);
@@ -1426,7 +1567,7 @@ export async function settlePurposeVerification({ root, provider, session, expec
       if (review.passed && !pending.length && !managed.purpose.nativeBoundary && !managed.executionUncertain && pendingAcceptance(run).length === 0) {
         for (const unit of evidenceLedger(managed).units || []) if (unit.status === 'observed' && unit.criterionIds.every(id => managed.verified[id])) unit.status = 'verified';
         run.state = 'completed'; run.reason = review.summary; state.phase = 'completed';
-        run.checkpoint = { status: 'completed', summary: review.summary, evidence: review.criteria.map(c => c.evidence) };
+        run.checkpoint = { status: 'completed', summary: verifiedConversationResult(managed, review) || review.summary, evidence: review.criteria.map(c => c.evidence) };
         bindControllerCompletion(run, now);
         managed.autoRecovery = false;
         settleCompletionHandoffs(run, now, review);
@@ -1497,6 +1638,7 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     const result = checkpoint.actionResult;
     if (decision?.action.kind !== 'read' || result?.decisionId !== decision.id || !['observed', 'failed', 'not_run'].includes(result.status) || !text(result.summary, 300)) throw new Error('Understanding result must match the selected read decision.');
     const understanding = sessionUnderstanding(checkpoint.sessionUnderstanding);
+    const conversationalCompletion = Boolean(expectedLease) && conversationUnderstandingComplete(run, understanding, sourceContext);
     if (['clear', 'already_done'].includes(understanding.state) && result.status !== 'observed') throw new Error('Clear understanding requires an observed read result.');
     const plan = understanding.state === 'clear' ? assessedPlan(checkpoint.plan, run.managed) : null;
     if (plan && JSON.stringify(plan.alternatives.find(item => item.id === plan.selectedOptionId).action) !== JSON.stringify(understanding.nextAction)) throw new Error('Understood next action differs from selected assessed option.');
@@ -1548,8 +1690,16 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
       run.managed.phase = 'active';
       run.state = 'reported_done';
       run.reason = 'Original conversation reports no remaining work; independent completion was not verified.';
-      if (purposeEnabled(run)) {
-        run.managed.acceptanceCriteria = understanding.criteria.filter(item => item.source === 'user_grounded').map(item => ({ id: item.id, description: item.description,
+      if (conversationalCompletion) {
+        // These are inferred expectations, not a user-enrolled verification
+        // contract. Preserve them in sessionUnderstanding without promoting
+        // them into new audit obligations or claiming independent acceptance.
+        run.reason = 'The requested conversational answer was checked against its user context; no independent acceptance was requested.';
+        run.managed.autoRecovery = false;
+        run.checkpoint = { ...run.checkpoint, status: 'completed', summary: checkpoint.summary };
+        bindControllerCompletion(run, now);
+      } else if (purposeEnabled(run)) {
+        if (!run.managed.acceptanceCriteria.length) run.managed.acceptanceCriteria = understanding.criteria.filter(item => item.source === 'user_grounded').map(item => ({ id: item.id, description: item.description,
           check: item.check.type === 'file_equals' ? { type: 'file_equals', exactPath: item.check.path, text: item.check.text } : item.check }));
         if (searchEnabled(run.managed)) queuePurposeVerification(run, 'Original conversation reports completion.', now);
         else queuePurposeDiagnosis(run, 'The conversation reports completion. Check the original purpose against actual artifacts and outcomes before accepting that claim.', 'reported_completion', now);
@@ -1583,6 +1733,11 @@ function newVerifiedCriterion(run, id, now) {
 }
 export async function verifyAutomaticCriteria(record, now) {
   const managed = record.run.managed;
+  if (managed.liveOutcomeReview?.passed && managed.liveOutcomeReview.workspaceDigest !== await workspaceIdentity(taskDirectory(record)).catch(() => null)) {
+    managed.liveOutcomeReview = { ...managed.liveOutcomeReview, passed: false, summary: 'Workspace changed after independent review; inspect the current result.' };
+    delete managed.nativeOutcomeReview;
+    for (const criterion of effectiveAcceptanceCriteria(managed)) if (criterion.check.type === 'semantic') delete managed.verified[criterion.id];
+  }
   managed.criterionObservations = {};
   const observe = (criterion, passed, detail, sha256 = null) => {
     managed.criterionObservations[criterion.id] = { criterion_id: criterion.id, passed,
@@ -2154,20 +2309,52 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
         run.reason = 'Prior live action stopped without a settled checkpoint; explicitly resume read-only result diagnosis.';
       }
     }
+    if (event === 'Stop' && !suppressDispatch && automaticContinuationAllowed(record) &&
+        canDiagnoseLegacyLocalEffect(run, provider, now)) {
+      const latestLink = await providerLinkState(root, provider);
+      if (latestLink.connected && latestLink.epoch === link.epoch) {
+        recordDecision(run.managed, researchWaitDiagnosis(run.managed), now);
+        run.state = 'active'; run.reason = 'The inconsistent local write remains unexecuted; inspect its assessment first.';
+        run.nextStep = run.managed.decision.action.summary;
+        run.checkpoint = null; run.consumedRevision = run.revision;
+        run.managed.escalation = null;
+      }
+    }
     if (!run || TERMINAL.has(run.state)) return record;
     if (event === 'Interrupt') { run.state = 'stopped'; run.reason = 'User interrupted the provider.'; }
     else if (run.state === 'auto_resuming' && ['Stop', 'SessionEnd', 'StopFailure'].includes(event)) {
       // The supervisor owns this exact attempt and consumes its structured
       // final result once. Provider lifecycle hooks must not race that lease.
     }
-    else if (['paused', 'verification_pending'].includes(run.state) || run.state === 'blocked' && run.managed?.dependencyWait) {
+    else if (run.state !== 'paused' && (event === 'PermissionRequest' || event === 'Notification' && ['permission_prompt', 'elicitation_dialog'].includes(input.notification_type))) {
+      // A native permission wait is still authoritative while independent
+      // acceptance is pending; lifecycle bookkeeping must not hide it.
+      run.state = 'blocked'; run.blocker = 'authorization'; run.reason = 'Resolve the provider approval or input request, then explicitly resume Delivery Loop.';
+    }
+    else if (['paused', 'verification_pending'].includes(run.state) || run.state === 'blocked' &&
+        (run.managed?.dependencyWait || run.managed?.pendingApproval || run.managed?.nativeWait ||
+         ['authorization', 'execution_uncertain'].includes(run.blocker))) {
       // A provider lifecycle event cannot override an explicit pause or a
       // completion candidate awaiting independent acceptance checks.
     }
-    else if (event === 'PermissionRequest' || event === 'Notification' && ['permission_prompt', 'elicitation_dialog'].includes(input.notification_type)) {
-      run.state = 'blocked'; run.blocker = 'authorization'; run.reason = 'Resolve the provider approval or input request, then explicitly resume Delivery Loop.';
-    } else if (event === 'SessionEnd') {
-      run.state = 'recovery_required'; run.recoveryCause = 'session_end'; run.reason = 'Provider session ended. Check why it ended before resuming.';
+    else if (event === 'SessionEnd') {
+      const managed = run.managed, lastAttempt = managed?.attempts?.at(-1);
+      // Ending the native writer must not erase a previously authorized retry.
+      // A matching undispatched busy receipt also recovers this queue when an
+      // older hook already replaced its cause with session_end.
+      const undispatchedBusy = lastAttempt?.outcome === 'busy' && lastAttempt.id === managed?.executionAttempt?.id &&
+        managed.executionAttempt.phase === 'claimed' && !managed.executionAttempt.dispatchedAt;
+      const queued = provider === 'codex' && record.autoContinue === true && automaticContinuationAllowed(record) &&
+        managed?.resumeChannel === 'codex_app_server' && managed.autoRecovery === true &&
+        !managed.pendingApproval && !managed.executionUncertain && run.state === 'recovery_required' &&
+        (['session_supervision', 'approved_action'].includes(run.recoveryCause) || run.recoveryCause === 'session_end' && undispatchedBusy);
+      if (queued) {
+        // Keep nextAttemptAt, the selected decision, approvals and all budgets.
+        if (run.recoveryCause === 'session_end') run.recoveryCause = 'session_supervision';
+        run.reason = 'The native session ended. Previously authorized automatic continuation is waiting for the writer lock to become available.';
+      } else {
+        run.state = 'recovery_required'; run.recoveryCause = 'session_end'; run.reason = 'Provider session ended. Check why it ended before resuming.';
+      }
     } else if (event === 'StopFailure') {
       run.failures += 1;
       run.state = failureLimitReached(run) ? 'failed' : 'recovery_required'; run.recoveryCause = 'provider_error';
@@ -2178,6 +2365,10 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       // turn. Lease settlement and runtime observation above still run.
       const latestLink = await providerLinkState(root, provider);
       if (!automaticContinuationAllowed(record) || !latestLink.connected || latestLink.epoch !== link.epoch) return record;
+      // Preserve the reason for a held action, including uncertainty observed
+      // while settling this Stop's writer lease. Acceptance is not a wait release.
+      if (run.state !== 'active' || run.managed?.nativeWait || run.managed?.purpose?.nativeBoundary ||
+          run.managed?.pendingApproval && run.checkpoint?.status === 'completed') return record;
       // Codex turn IDs make re-delivered Stop events idempotent. Claude has no
       // stable event ID; never dedupe on text (identical text can be a new turn).
       const key = input.turn_id ? `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}` : null;
@@ -2185,7 +2376,18 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       if (run.managed && run.checkpoint?.status === 'completed' && run.revision > run.consumedRevision) {
         await verifyAutomaticCriteria(record, now);
         const pending = pendingAcceptance(run);
-        if (pending.length) {
+        const missingFiles = pending.filter(item => ['file_exists', 'file_contains', 'file_equals'].includes(item.check) || run.managed.liveOutcomeReview?.passed === false && item.check === 'semantic');
+        if (missingFiles.length && run.managed.autonomyPolicy && !run.managed.pendingApproval &&
+            !run.managed.nativeWait && !run.managed.purpose?.nativeBoundary && !run.managed.executionUncertain) {
+          // Completion reads at checkpoint time can become stale before Stop.
+          // Use the same assessed diagnosis as a failed checkpoint predicate;
+          // a new file mismatch is useful work, not human acceptance waiting.
+          recordDecision(run.managed, missingAcceptanceDiagnosis(run.managed, missingFiles), now);
+          run.checkpoint = { ...run.checkpoint, status: 'in_progress', reportedStatus: 'completed', acceptanceMet: false,
+            nextStep: `Diagnose failed acceptance checks: ${missingFiles.map(item => item.id).join(', ')}` };
+          run.nextStep = run.checkpoint.nextStep;
+          run.managed.remainingWork = run.nextStep;
+        } else if (pending.length) {
           run.state = 'verification_pending'; run.reason = acceptancePendingReason(run);
           run.lastStopKey = key; notifyState(run, now); return record;
         }
@@ -2302,7 +2504,7 @@ export function deliveryDecisionRevision(run) {
   return Number.isSafeInteger(revision) ? revision : undefined;
 }
 export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, expectedRunId, expectedRevision, approvalId, autonomyPolicy, continuationPolicy, questionId, waitId, answer, purposeUpdate, resumeObservation, action, inspectProcess = processIdentity, now = Date.now() }) {
-  return updateRecord(root, provider, session, async record => {
+  const updated = await updateRecord(root, provider, session, async record => {
     const run = record?.run;
     if (!run) throw new Error('Delivery Loop not found.');
     if ((expectedRunId !== undefined || expectedRevision !== undefined) &&
@@ -2413,7 +2615,7 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     else if (action === 'pause') {
       const queuedAppServer = run.state === 'recovery_required' && ['session_supervision', 'approved_action'].includes(run.recoveryCause) &&
         run.managed?.resumeChannel === 'codex_app_server' && run.managed.autoRecovery;
-      if (!run.managed || !['active', 'auto_resuming'].includes(run.state) && !queuedAppServer) throw new Error('Only a running or queued managed task can pause.');
+      if (!run.managed || !['active', 'auto_resuming'].includes(run.state) && !queuedAppServer && !liveOutcomeReviewEligible(record)) throw new Error('Only a running or queued managed task can pause.');
       if (queuedAppServer || run.state === 'auto_resuming' && run.managed.resumeChannel === 'codex_app_server') run.managed.pausedRecoveryCause = run.recoveryCause || 'session_supervision';
       run.state = 'paused'; run.reason = 'Paused by user.';
       run.stopReason = { actor: 'user', code: 'explicit_pause', at: now };
@@ -2534,7 +2736,8 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
         run.checkpoint = { status: 'in_progress', summary: run.reason, nextStep: run.nextStep, evidence: [], acceptanceMet: false };
         run.revision += 1;
         run.managed.approvedAction = { id: pending.id, nextStep: run.nextStep, action: { kind: pending.kind, scope: pending.scope, summary: pending.summary } };
-        if (searchEnabled(run.managed) && run.managed.resumeChannel === 'codex_app_server' && pending.kind === 'external' && run.managed.decision?.assessment?.reversibility === 'reversible') run.managed.autoRecovery = true;
+        if (run.managed.resumeChannel === 'codex_app_server' &&
+            (['read', 'local_edit', 'local_test'].includes(pending.kind) || searchEnabled(run.managed) && pending.kind === 'external' && run.managed.decision?.assessment?.reversibility === 'reversible')) run.managed.autoRecovery = true;
       } else {
         pending.denied = true; run.reason = `User rejected ${pending.scope}.`; run.blocker = 'authorization';
         rememberRejectedAction(run.managed, pending);
@@ -2546,6 +2749,10 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     }
     run.updatedAt = now; notifyState(run, now); return commitControl();
   });
+  if (['stop', 'pause'].includes(action) && updated?.run?.managed?.nativeHandoff) {
+    void import('../../../session-supervision/native-handoff.js').then(({ reconcileNativeHandoff }) => reconcileNativeHandoff({ root, record: updated })).catch(() => {});
+  }
+  return updated;
 }
 export async function reconcileRecords({ root = rootDirectory(), now = Date.now(), inspectProcess = processIdentity, records: suppliedRecords } = {}) {
   const records = suppliedRecords || await listRecords(root);

package/src/codex-plugins/simy/hooks/purpose-search.mjs

@@ -34,14 +34,32 @@ export function searchState(managed) {
 const actionKey = action => hash([action.kind, action.scope, bounded(action.summary).replace(/\s+/g, ' ')]);
 const experimentContext = run => hash([run.managed.verifiedRevision, run.managed.purpose.evidence?.current?.digest || null]);
 
+// Actual failed operations survive changes to the worker's prose. Keep only a
+// digest here: captured output may contain sensitive data and is not authority.
+function failedOperationKey(toolEvidence) {
+  const operations = [];
+  for (const item of toolEvidence || []) {
+    if (item?.source !== 'codex_tool_event' || item.kind !== 'commandExecution' ||
+        !Number.isInteger(item.exitCode) || item.exitCode === 0 || item.observation?.truncated) continue;
+    let captured;
+    try { captured = JSON.parse(item.observation?.text); } catch { continue; }
+    const command = item.command || captured.command;
+    if (typeof command !== 'string' || typeof captured.output !== 'string') continue;
+    operations.push([command, item.exitCode, captured.output]);
+  }
+  return operations.length ? hash(operations) : null;
+}
+
 // Compact history survives the short conversational window and process restart.
 // It is a search hint, never a permission or an acceptance receipt.
 export function repeatedSearchAction(run) {
   if (!searchEnabled(run.managed)) return null;
   const action = run.managed.decision?.action;
   if (!action || !['read', 'local_edit', 'local_test'].includes(action.kind)) return null;
-  return searchState(run.managed).experimentIndex?.find(item => item.actionKey === actionKey(action) &&
-    item.context === experimentContext(run) && item.failures >= 2) || null;
+  const state = searchState(run.managed), context = experimentContext(run);
+  return state.experimentIndex?.find(item => item.context === context && item.failures >= 2 &&
+    (item.actionKey === actionKey(action) || item.observedOperation && item.lastCycle === state.cycle &&
+      item.action.kind === action.kind && item.action.scope === action.scope)) || null;
 }
 
 // These are leads for the next experiment, not completion or authority receipts.
@@ -50,9 +68,10 @@ export function recordSearchExperiment(run, performed, result, review, toolEvide
   const state = searchState(run.managed);
   state.cycle += 1;
   state.experimentIndex ||= [];
-  const key = actionKey(performed.action), context = experimentContext(run);
+  const observedOperation = result.status === 'failed' ? failedOperationKey(toolEvidence) : null;
+  const key = observedOperation ? hash([performed.action.kind, performed.action.scope, observedOperation]) : actionKey(performed.action), context = experimentContext(run);
   const prior = state.experimentIndex.find(item => item.actionKey === key && item.context === context);
-  const entry = prior || { actionKey: key, context, action: performed.action, attempts: 0, failures: 0, firstCycle: state.cycle };
+  const entry = prior || { actionKey: key, context, ...(observedOperation ? { observedOperation } : {}), action: performed.action, attempts: 0, failures: 0, firstCycle: state.cycle };
   entry.attempts += 1;
   entry.failures = result.status === 'failed' ? entry.failures + 1 : 0;
   Object.assign(entry, { lastCycle: state.cycle, result: result.status, finding: bounded(result.summary, 300), refutation: bounded(review?.refutation, 300) });