@awak-app/simy-cli 0.7.28 → 0.7.31

package/src/desktop-host.js

@@ -1,12 +1,24 @@
+import { createClaudeDesktopArchiveController } from './session-supervision/claude-desktop-archive.js';
+import { createClaudeDesktopNativeAdapter } from './session-supervision/claude-desktop-native.js';
+import { applyControllerExecutionContext } from './session-supervision/execution-context.js';
+import { createOwnerTransport } from './session-supervision/owner-transport.js';
+import { createControllerStore, controllerScope } from './session-supervision/controller-store.js';
+import { createOperationJournal } from './session-supervision/operation-journal.js';
+import { createNotificationJournal } from './session-supervision/notification-journal.js';
+import { createRemoteMetadata } from './session-supervision/remote-metadata.js';
+import { projectControllerCompletion } from './native-development-report-completion.js';
 import { remoteOperationFailure } from './session-supervision/remote-errors.js';
 import { copyDesktopText } from './desktop-clipboard.js';
-import { createRemoteHostManager } from './session-supervision/remote-hosts.js';
+import { createRemoteHostManager, allowedActions, controllerPolicyActions } from './session-supervision/remote-hosts.js';
+import { manualAcceptanceCommand, manualAcceptanceContinuation } from './session-supervision/manual-acceptance-command.js';
 import { readDesktopAutoUpdate, writeDesktopAutoUpdate } from './desktop-update-settings.js';
 import { createUpdateRuntime } from './update-detachment/runtime.js';
 import { createCoordinatorReconciler } from "./update-detachment/reconciliation-adapter.js";
 import { createLedgerCoordinatorAdapters } from "./update-detachment/ledger-adapter.js";
 import { createUpdateCoordinator } from "./update-detachment/coordinator.js";
+import { reconnectWithHistoryRecovery } from "./update-detachment/history-recovery.js";
 import { sessionWorkState, compareSessionWork, reconcileFamilyCompletion, expireSessionWorkState } from './session-supervision/work-state.js';
+import { conversationPresentation, expireConversationPresentation } from './session-supervision/conversation-presentation.js';
 import { createPullRequestObserver } from './session-supervision/pull-requests.js';
 import { createTeamThreads, teamThreadKey } from './team-threads.js';
 import { createTeamStatusFenceStore } from './team-status-fence-store.js';
@@ -17,18 +29,19 @@ import { readCodexStatistics, unavailableStatistics } from './session-supervisio
 import { readClaudeStatistics } from './session-supervision/claude-sessions.js';
 import { inspectProviderPlugins, unavailablePluginStatus } from './sqm/provider-plugin-status.js';
 import { repairProviderPlugin } from './sqm/provider-plugin-repair.js';
-import { openCodexAppServer } from './session-supervision/codex-app-server.js';
-import { conversationSqmChecks } from './session-supervision/sqm-presentation.js';
+import { openCodexAppServer, verifyCodexArchiveState } from './session-supervision/codex-app-server.js';
+import { conversationSqmChecks, conversationSqmResult } from './session-supervision/sqm-presentation.js';
 import { stopOwnedDesktopHost } from "./desktop-force-quit.js";
 import { stopDesktopWorkForUpdate } from './desktop-update-stop.js';
 import { desktopAccessReady, desktopActionAllowed, requireDesktopAccess, validDesktopAccessPath } from './desktop-access.js';
 import { createActionDeadlineService } from './session-supervision/action-deadline.js';
 import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
-import { controlDelivery, verifyDelivery, createRecordReader, readRecord, updateRecord, recordProviderArchive, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
+import { controlDelivery, verifyDelivery, decideManualAcceptance, createRecordReader, readRecord, updateRecord, recordProviderArchive, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { createStopNotifier } from "./session-supervision/stop-notifications.js";
 import { AutoContinueUnavailableError, answerSession, continueSession, followupSession, resumeSession, discoverSessions, enrollSession, monitorSession, trackSession, setSessionAutoContinue } from "./session-supervision/index.js";
+import { renewClaudeSessionOwner } from './session-supervision/claude-owner-renewal.js';
 import { createContinuationAnalysisManager } from "./session-supervision/analysis-manager.js";
 import { analyzeContinuation, readContinuationContext } from "./session-supervision/continuation-analysis.js";
 import { continueAnalyzedSession, createAutomaticContinuation } from "./session-supervision/automatic-continuation.js";
@@ -82,6 +95,7 @@ async function withReadCancellation(signal, work) {
 }
 
 function desktopActionError(action, error) {
+  if (String(error?.code).startsWith('claude_desktop_')) return error.message;
   if (String(error?.code).startsWith("remote_host_")) return error.message;
   if (error?.code === "provider_link_changed") return "SIMY connection changed. Refresh and select the conversation again.";
   if (error?.code === "provider_link_disconnected") return "Reconnect this provider to SIMY before using it.";
@@ -109,6 +123,7 @@ function desktopActionError(action, error) {
   if (action === 'authorization_copy') return 'Could not copy the connection link. Reopen the connection page and try again.';
   if (action === 'authorization_open' || error?.code === 'desktop_browser_unavailable') return "Could not open your browser. Open the verification link again, or check your default browser.";
   if (error?.code === "desktop_access_required") return "Sign in to an organization with SQM and Developer access before using SIMY.";
+  if (action === 'delivery_acceptance_decide') return 'Acceptance decision was not confirmed. Refresh this conversation before retrying.';
   if (action === "codex_hooks" || action === "claude_hooks") return "Could not open the setup guide. Check your default browser, or use /hooks inside the provider.";
   if (action === "install_plugins") return error?.code === "plugin_setup_busy"
     ? "Another SIMY process is preparing plugins. Wait, then refresh to check the files."
@@ -167,11 +182,23 @@ export function createDesktopFrameWriter(output) {
 export async function startDesktopHost({ input = process.stdin, output = process.stdout, env = process.env,
   updatePackageRoot, dependencies = {}, exit = (code) => process.exit(code) } = {}) {
   const frames = createDesktopFrameWriter(output);
-  const emit = (event) => frames.write(`${JSON.stringify(event)}\n`, event.type === "status");
+  const pendingRemoteReceipts = new Map();
+  let operationJournal, ownerTransport;
+  const writeEvent = event => { ownerTransport?.publish(event); frames.write(`${JSON.stringify(event)}\n`, event.type === 'status'); };
+  const emit = (event) => {
+    const pending = event.type === 'result' ? pendingRemoteReceipts.get(event.id) : null;
+    if (pending) {
+      pendingRemoteReceipts.delete(event.id);
+      void operationJournal.finish(pending.scope, pending.command, event).then(() => writeEvent(event)).catch(() => writeEvent({ type: 'result', id: event.id, ok: false, code: 'remote_operation_unknown' }));
+    } else writeEvent(event);
+  };
   // A heartbeat remains a complete native frame. Only its observation time is
   // volatile; reuse the encoded body after comparing freshly authorized data.
   // Detach the comparison value because registries may mutate nested objects.
   let encodedStatus = null, lastStatus = null, updateProgress = null;
+  // Per verified source reader, never accepted from a projection or command.
+  const acceptanceReaderId = randomUUID();
+  let acceptanceReadbackSequence = 0;
   let remoteHosts;
   const emitStatus = status => {
     const updateSettings = updater?.snapshot?.() || {};
@@ -179,10 +206,23 @@ export async function startDesktopHost({ input = process.stdin, output = process
       auto_update_supported: updateSettings.auto_update_supported === true,
       auto_update_enabled: updateSettings.auto_update_enabled === true,
       auto_update_busy: updateSettings.auto_update_busy === true } };
-    if (env.SIMY_REMOTE_CHILD === "1") status = { ...status, remoteSessionProtocol: 1 };
+    if (env.SIMY_REMOTE_CHILD === "1") status = { ...status, remoteSessionProtocol: 1, remoteControl: { version: 2, actions: [...allowedActions] } };
+    ownerTransport?.publish({ type: 'status', status: { ...status, remoteSessionProtocol: 1, remoteControl: { version: 2, actions: [...allowedActions] } } });
     if (remoteHosts) {
-      void remoteHosts.update(PROVIDER_LINKS.some(provider => providerLinks[provider].connected) ? status : { ...status, access: { state: "unavailable" } }).catch(() => {});
-      if (PROVIDER_LINKS.some(provider => providerLinks[provider].connected)) status = remoteHosts.project(status, { providerLinks });
+      void remoteHosts.update({ ...status, providerLinks }).catch(() => {});
+      status = remoteHosts.project(status, { providerLinks });
+      for (const candidate of status.sessionSupervision?.sessions || []) {
+        if (!candidate.hostId || candidate.hostId === 'local') continue;
+        const key = teamThreadKey(agent?.getTeamThreadsScope?.() || {}, candidate);
+        const sharing = teamThreads?.snapshot();
+        candidate.teamSharing = { threadKey: key, enabled: sharing?.own?.some(row => row.threadKey === key && row.enabled) === true, pendingStop: sharing?.pendingStops?.includes(key) === true };
+      }
+    }
+    if (preferenceScope && desktopAccessReady(status.access) && status.sessionSupervision?.sessions) {
+      const catalogScope = preferenceScope;
+      status = { ...status, sessionSupervision: { ...status.sessionSupervision, sessions: status.sessionSupervision.sessions.filter(row => controllerPreferences.get(catalogScope, row).deleted !== true).map(row => { const saved = controllerPreferences.get(catalogScope, row); return { ...row, controllerPreferences: saved, ...(saved.pinned === undefined ? {} : { listPinned: saved.pinned, listPinScopes: saved.pinScopes }), ...(saved.hidden === undefined ? {} : { localHidden: saved.hidden }) }; }) } };
+      const catalog = { observedAt: Date.now(), sessions: structuredClone(status.sessionSupervision.sessions), hosts: structuredClone(status.remoteHosts?.items || []), providerLinks: structuredClone(providerLinks) };
+      void controllerPreferences.change(catalogScope, state => { state.catalog = catalog; }).catch(() => {});
     }
     if (updateProgress) status = { ...status, update: { ...status.update, ...updateProgress } };
     const { sampledAt, ...content } = status;
@@ -194,6 +234,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
     frames.write(`{"type":"status","status":{${observation}${encodedStatus}}}\n`, true);
   };
   const root = env.SIMY_HOME?.trim() || join(homedir(), ".simy");
+  const controllerPreferences = createControllerStore(root);
+  operationJournal = createOperationJournal(join(root, 'remote-operations'));
   const diagnostics = createRuntimeDiagnostics(root, { name: "desktop-host" });
   const webOrigin = resolveWebOrigin(null, env);
   const candidate = Boolean(env.SIMY_DESKTOP_SUPERVISOR_TOKEN);
@@ -231,12 +273,23 @@ export async function startDesktopHost({ input = process.stdin, output = process
   const statisticsCache = new Map();
   let activeStatisticsRead = null;
   let statisticsSelection = { key: null, generation: 0 };
-  const stopNotifier = createStopNotifier({ emit: event => { if (!closed && !relay) emit(event); } });
-  if (env.SIMY_REMOTE_CHILD !== "1" && process.platform !== "win32") remoteHosts = (dependencies.createRemoteHostManager || createRemoteHostManager)({ root, onChange: () => { if (!closed && !relay) setImmediate(() => { void publish().catch(() => {}); }); } });
+  const notificationJournal = createNotificationJournal(join(root, 'remote-events'));
+  const completionJournal = createNotificationJournal(join(root, 'source-completions'));
+  let retainedCompletions = [];
+  const stopNotifier = createStopNotifier({ hostId: 'local', emit: event => {
+    if (!closed && !relay) {
+      void notificationJournal.append({ ...event, scope: preferenceScope }).catch(() => {});
+      emit(event);
+    }
+  } });
+  if (env.SIMY_REMOTE_CHILD !== "1") remoteHosts = (dependencies.createRemoteHostManager || createRemoteHostManager)({ root, store: controllerPreferences, onNotify: event => { if (!closed && !relay) emit(event); }, onChange: () => { if (!closed && !relay) setImmediate(() => { void publish().catch(() => {}); }); } });
+  const remoteMetadata = createRemoteMetadata({ root, webOrigin, onChange: () => { if (!closed && !relay) setImmediate(() => void publish().catch(() => {})); } });
   let teamThreads;
   let currentAccess = { state: 'checking', organizationId: null, organizationName: null };
+  let preferenceScope = null, emailSync = null, emailSyncRetryAt = 0;
   let nativeDevelopmentReports = { state: 'loading', enrollments: [] };
   let nativeDevelopmentReportsScope = null;
+  let nativeDevelopmentReportsController = null;
   let nativeDevelopmentReportsRequest = null;
   let nativeDevelopmentReportsGeneration = 0;
   let nativeDevelopmentReportsRetryAt = 0;
@@ -255,6 +308,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       // credential/organization revision itself did not change.
       nativeDevelopmentReports = { state: 'loading', enrollments: [] };
       nativeDevelopmentReportsScope = null;
+      nativeDevelopmentReportsController = null;
       nativeDevelopmentReportsGeneration++;
       nativeDevelopmentReportsRetryAt = 0;
       nativeCompletionInFlight.clear();
@@ -310,30 +364,61 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (failure) throw failure.reason;
   };
   const localCliApiSession = () => dependencies.getLocalCliApiSession?.() || agent?.getLocalCliApiSession?.() || null;
+  const reportDeviceSession = () => {
+    const session = localCliApiSession();
+    return session ? { ...session } : null;
+  };
+  const sameReportController = (left, right) => Boolean(left?.deviceSession && right?.deviceSession &&
+    left.scope === right.scope && left.controllerScope === right.controllerScope &&
+    left.deviceSession.token === right.deviceSession.token && left.deviceSession.api_base_url === right.deviceSession.api_base_url);
+  const requireReportController = async (context, { ready = true } = {}) => {
+    const status = await agent.getDesktopStatus();
+    const currentDevice = localCliApiSession();
+    const latestAccess = agent.getDesktopAccess ? agent.getDesktopAccess() : status?.access;
+    if (!context.deviceSession || !currentDevice || currentDevice.token !== context.deviceSession.token ||
+        currentDevice.api_base_url !== context.deviceSession.api_base_url ||
+        accessScope(status?.access) !== context.scope ||
+        accessScope(latestAccess) !== context.scope ||
+        !controllerScope(status) || (context.controllerScope !== undefined && controllerScope(status) !== context.controllerScope)) {
+      throw Object.assign(new Error('Desktop account or organization changed.'), { code: 'desktop_access_required' });
+    }
+    if (ready) { requireDesktopAccess(status.access); requireDesktopAccess(latestAccess); }
+    return status;
+  };
   const nativeReportsApi = (fixedSession = null) => (dependencies.createNativeDevelopmentReportsApi || createNativeDevelopmentReportsApi)({
     webOrigin,
     readSession: async () => fixedSession || localCliApiSession(),
     fetchImpl: dependencies.fetch || globalThis.fetch,
   });
-  const refreshNativeDevelopmentReports = async ({ force = false } = {}) => {
+  const refreshNativeDevelopmentReports = async ({ force = false, controller } = {}) => {
     if (!desktopAccessReady(currentAccess)) return nativeDevelopmentReports;
+    if (controller.scope !== accessScope(currentAccess) || controller.controllerScope !== preferenceScope) return nativeDevelopmentReports;
     if (nativeDevelopmentReportsMutation) return nativeDevelopmentReports;
     const requestedScope = accessScope(currentAccess);
-    if (!force && nativeDevelopmentReportsScope === requestedScope && nativeDevelopmentReports.state === 'ready') return nativeDevelopmentReports;
-    if (!force && Date.now() < nativeDevelopmentReportsRetryAt) return nativeDevelopmentReports;
-    if (nativeDevelopmentReportsRequest?.scope === requestedScope) return nativeDevelopmentReportsRequest.promise;
-    nativeDevelopmentReports = { state: 'loading', enrollments: nativeDevelopmentReportsScope === requestedScope ? nativeDevelopmentReports.enrollments : [] };
+    const sameController = sameReportController(controller, nativeDevelopmentReportsController);
+    if (!force && sameController && nativeDevelopmentReportsScope === requestedScope && nativeDevelopmentReports.state === 'ready') return nativeDevelopmentReports;
+    if (!force && sameController && Date.now() < nativeDevelopmentReportsRetryAt) return nativeDevelopmentReports;
+    if (sameReportController(nativeDevelopmentReportsRequest?.controller, controller)) return nativeDevelopmentReportsRequest.promise;
+    nativeDevelopmentReports = { state: 'loading', enrollments: sameController ? nativeDevelopmentReports.enrollments : [] };
     nativeDevelopmentReportsScope = requestedScope;
+    nativeDevelopmentReportsController = controller;
     const generation = nativeDevelopmentReportsGeneration;
-    const job = { scope: requestedScope, generation, promise: null };
-    job.promise = nativeReportsApi().list().then(enrollments => {
-      if (accessScope(currentAccess) === requestedScope && nativeDevelopmentReportsGeneration === generation) {
+    const job = { scope: requestedScope, controller, generation, promise: null };
+    job.promise = Promise.resolve().then(async () => {
+      await requireReportController(controller);
+      if (nativeDevelopmentReportsGeneration !== generation || accessScope(currentAccess) !== requestedScope) return null;
+      const enrollments = await nativeReportsApi(controller.deviceSession).list();
+      await requireReportController(controller);
+      return enrollments;
+    }).then(enrollments => {
+      if (!enrollments) return nativeDevelopmentReports;
+      if (sameReportController(controller, nativeDevelopmentReportsController) && accessScope(currentAccess) === requestedScope && nativeDevelopmentReportsGeneration === generation) {
         nativeDevelopmentReports = { state: 'ready', enrollments };
         nativeDevelopmentReportsRetryAt = 0;
       }
       return nativeDevelopmentReports;
     }).catch(() => {
-      if (accessScope(currentAccess) === requestedScope && nativeDevelopmentReportsGeneration === generation) {
+      if (sameReportController(controller, nativeDevelopmentReportsController) && accessScope(currentAccess) === requestedScope && nativeDevelopmentReportsGeneration === generation) {
         nativeDevelopmentReports = { state: 'unavailable', enrollments: [] };
         nativeDevelopmentReportsRetryAt = Date.now() + 30_000;
       }
@@ -345,26 +430,85 @@ export async function startDesktopHost({ input = process.stdin, output = process
     nativeDevelopmentReportsRequest = job;
     return job.promise;
   };
-  const submitNativeDevelopmentReportCompletions = ({ records, scope, deviceSession }) => {
-    if (!deviceSession?.token || !deviceSession?.api_base_url || nativeDevelopmentReports.state !== "ready" || nativeDevelopmentReportsScope !== scope) return;
+  const syncEmailPreferences = async controller => {
+    const { controllerScope: scope, deviceSession } = controller;
+    if (!scope || emailSync || nativeDevelopmentReportsMutation || Date.now() < emailSyncRetryAt || !deviceSession) return;
+    const generation = nativeDevelopmentReportsGeneration;
+    const stillCurrent = () => !closed && scope === preferenceScope && controller.scope === accessScope(currentAccess) && generation === nativeDevelopmentReportsGeneration;
+    emailSync = (async () => {
+      const state = await controllerPreferences.load(scope);
+      for (const [key, value] of Object.entries(state.conversations)) {
+        const pending = value.emailPreference;
+        if (pending?.state !== 'pending' || !stillCurrent()) continue;
+        try {
+          await requireReportController(controller);
+          if (!stillCurrent()) return;
+          const api = nativeReportsApi(deviceSession);
+          const [hostId, provider, session] = JSON.parse(key);
+          const matches = row => (row.host_id || 'local') === hostId && row.provider === provider && row.provider_session_id === session;
+          const prior = (await api.list()).find(matches);
+          await requireReportController(controller);
+          if (!stillCurrent() || controllerPreferences.get(scope, { hostId, provider, session }).emailPreference?.id !== pending.id) return;
+          if (!prior || prior.enabled !== pending.request.enabled || pending.request.enabled && prior.request_title !== pending.request.request_title) {
+            await api.save({ ...pending.request, expected_revision: prior?.revision || 0 });
+          }
+          await requireReportController(controller);
+          const enrollments = await api.list();
+          await requireReportController(controller);
+          const applied = enrollments.find(matches);
+          if (pending.request.enabled ? !applied?.enabled || applied.request_title !== pending.request.request_title : applied?.enabled) throw new Error('Preference sync remains pending.');
+          if (!stillCurrent()) return;
+          await controllerPreferences.change(scope, data => {
+            const current = data.conversations[key]?.emailPreference;
+            if (current?.id === pending.id) current.state = 'applied';
+          });
+          await requireReportController(controller);
+          if (!stillCurrent()) return;
+          nativeDevelopmentReports = { state: 'ready', enrollments }; nativeDevelopmentReportsScope = controller.scope;
+          nativeDevelopmentReportsController = controller;
+        } catch (error) {
+          if ([400,403].includes(error?.status)) await controllerPreferences.change(scope, data => { const current = data.conversations[key]?.emailPreference; if (current?.id === pending.id) current.state = 'conflict'; });
+          emailSyncRetryAt = Date.now() + 30_000; return;
+        }
+      }
+    })().finally(() => { emailSync = null; });
+    await emailSync;
+  };
+  const submitNativeDevelopmentReportCompletions = ({ completions, controller }) => {
+    const { scope, deviceSession } = controller;
+    if (!deviceSession?.token || !deviceSession?.api_base_url || !sameReportController(controller, nativeDevelopmentReportsController) || nativeDevelopmentReports.state !== "ready" || nativeDevelopmentReportsScope !== scope) return;
     const generation = nativeDevelopmentReportsGeneration;
     for (const enrollment of nativeDevelopmentReports.enrollments) {
-      if (enrollment.provider !== "codex" || enrollment.enabled !== true) continue;
-      const record = records.find(item => item.provider === enrollment.provider && item.session?.toLowerCase() === enrollment.provider_session_id?.toLowerCase());
-      const completion = projectNativeDevelopmentReportCompletion({ enrollment, record });
-      if (!completion) continue;
-      const key = [scope, completion.provider, completion.provider_session_id, completion.task_id, completion.enrollment_revision, completion.managed_revision, completion.acceptance_digest].join(":");
+      if (enrollment.enabled !== true) continue;
+      const desired = controllerPreferences.get(controller.controllerScope, { hostId: enrollment.host_id || 'local', provider: enrollment.provider, session: enrollment.provider_session_id }).emailPreference;
+      if (desired?.request.enabled === false) continue;
+      const hostId = enrollment.host_id || 'local';
+      const observations = hostId === 'local' ? completions : remoteHosts?.completions?.() || [];
+      for (const observed of observations.filter(item => (item.host_id || 'local') === hostId && item.provider === enrollment.provider && item.provider_session_id === enrollment.provider_session_id)) {
+      const completion = { ...observed, host_id: hostId, enrollment_revision: enrollment.revision };
+      const key = [scope, completion.provider, completion.provider_session_id, completion.host_id, completion.task_id, completion.enrollment_revision, completion.managed_revision, completion.acceptance_digest].join(":");
       // A terminal response is tied to the consent identity, rather than a
       // particular proof revision: a new consent revision is required before
       // the desktop may offer that server a different attestation.
-      const rejectionKey = [scope, completion.provider, completion.provider_session_id, completion.task_id, completion.enrollment_revision].join(":");
+      const rejectionKey = [scope, completion.provider, completion.provider_session_id, completion.host_id, completion.task_id, completion.enrollment_revision].join(":");
       if (nativeCompletionSuccess.has(key) || nativeCompletionRejected.has(rejectionKey) || nativeCompletionInFlight.has(key) || Date.now() < (nativeCompletionRetryAt.get(key) || 0)) continue;
       const job = Promise.resolve().then(async () => {
+        await requireReportController(controller);
         if (closed || relay || nativeDevelopmentReportsGeneration !== generation || accessScope(currentAccess) !== scope) return null;
-        const receipt = await sendNativeDevelopmentReportCompletion({ api: nativeReportsApi(deviceSession), enrollment, record });
+        const receipt = await nativeReportsApi(deviceSession).submitCompletion(completion);
+        await requireReportController(controller);
         if (receipt && nativeDevelopmentReportsGeneration === generation && accessScope(currentAccess) === scope) {
-          nativeCompletionSuccess.add(key);
-          nativeCompletionRetryAt.delete(key);
+          if (receipt.status === 'pending') nativeCompletionRetryAt.set(key, Date.now() + 30_000);
+          else { nativeCompletionSuccess.add(key); nativeCompletionRetryAt.delete(key); }
+          const receiptScope = controller.controllerScope;
+          await controllerPreferences.change(receiptScope, state => {
+            const identity = JSON.stringify([hostId, completion.provider, completion.provider_session_id]);
+            const row = state.conversations[identity] ||= {};
+            row.emailDeliveries ||= {};
+            row.emailDeliveries[completion.task_id] = { ...receipt, checkedAt: Date.now(), provider: completion.provider, provider_session_id: completion.provider_session_id, host_id: hostId };
+          });
+          await requireReportController(controller);
+          if (!closed) void publish().catch(() => {});
         }
         return receipt;
       }).catch(error => {
@@ -377,6 +521,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         return null;
       }).finally(() => nativeCompletionInFlight.delete(key));
       nativeCompletionInFlight.set(key, job);
+      }
     }
   };
   let organizationAnalysesSuspended = false;
@@ -486,6 +631,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
     }
     return sessionStatus;
   };
+  const claudeDesktopNative = dependencies.claudeDesktopNative || createClaudeDesktopNativeAdapter();
+  const archiveClaudeDesktop = createClaudeDesktopArchiveController({ native: claudeDesktopNative, ...(dependencies.readClaudeDesktopTarget ? { readTarget: dependencies.readClaudeDesktopTarget } : {}) });
   const selectedSession = async (command, { reuseDiscovery = false, preferObserved = false } = {}) => {
     const scope = await authorizeWork();
     const link = await requireProviderLink({ root: deliveryRoot, provider: command.provider });
@@ -676,7 +823,17 @@ export async function startDesktopHost({ input = process.stdin, output = process
       if (!await acceptStatusAccess(sampledAccess)) { publishAgain = true; return; }
       status.access = sampledAccess;
       status.updateDetachment = updateRuntime.snapshot(coordinator.snapshot(),updater?.snapshot?.(),{accessReady:desktopAccessReady(sampledAccess)});
+      preferenceScope = controllerScope(status);
+      if (preferenceScope) await controllerPreferences.load(preferenceScope);
       const requestedLinks = await decorateProviderSettings(status);
+      if (JSON.stringify(await readProviderLinks(root)) !== requestedLinks) { publishAgain = true; return; }
+      const latestAccess = agent.getDesktopAccess ? agent.getDesktopAccess() : await accessSnapshot();
+      if (accessScope(latestAccess) !== accessScope(status.access) || latestAccess?.state !== status.access?.state) {
+        publishAgain = true;
+        return;
+      }
+      // Select cached record evidence after all asynchronous authorization:
+      // a full projection may have advanced it while those reads were waiting.
       const sameScope = desktopAccessReady(currentAccess) &&
         accessScope(lastStatus?.access) === accessScope(currentAccess);
       status.deliveryHooks = sameScope && lastStatus?.deliveryHooks
@@ -685,12 +842,14 @@ export async function startDesktopHost({ input = process.stdin, output = process
         ? structuredClone(lastStatus.sessionSupervision) : { sessions: [], providers: {}, refreshedAt: null, initialLoading: desktopAccessReady(currentAccess) };
       // Complete fast frames must retain the current saved preference so OFF
       // remains available while unrelated conversation enrichment is waiting.
-      status.nativeDevelopmentReports = sameScope && nativeDevelopmentReportsScope === accessScope(currentAccess)
+      status.nativeDevelopmentReports = sameScope && sameReportController(nativeDevelopmentReportsController, {
+        scope: accessScope(status.access), controllerScope: controllerScope(status), deviceSession: reportDeviceSession(),
+      }) && nativeDevelopmentReportsScope === accessScope(currentAccess)
         ? structuredClone(nativeDevelopmentReports) : { state: 'loading', enrollments: [] };
       // Cached enrichment must follow the current connection preference even
       // while a full projection is waiting on records or remote metadata.
       status.deliveryHooks.runs = linkedSessions(status.deliveryHooks.runs || []);
-      status.sessionSupervision.sessions = linkedSessions(status.sessionSupervision.sessions || []).map(candidate => expireSessionWorkState(candidate)).sort(compareSessionWork);
+      status.sessionSupervision.sessions = linkedSessions(status.sessionSupervision.sessions || []).map(candidate => expireConversationPresentation(expireSessionWorkState(candidate))).sort(compareSessionWork);
       status.sessionSupervision.providers ||= {};
       for (const provider of PROVIDER_LINKS) {
         if (!providerLinks[provider].connected) status.sessionSupervision.providers[provider] = { discovery: 'disconnected', reason: null };
@@ -705,12 +864,6 @@ export async function startDesktopHost({ input = process.stdin, output = process
         status.sqmChecks = { activeCount: 0, items: [] };
         status.sqmTasks = { activeCount: status.sqmTasks?.activeCount || 0, items: [] };
       }
-      if (JSON.stringify(await readProviderLinks(root)) !== requestedLinks) { publishAgain = true; return; }
-      const latestAccess = agent.getDesktopAccess ? agent.getDesktopAccess() : await accessSnapshot();
-      if (accessScope(latestAccess) !== accessScope(status.access) || latestAccess?.state !== status.access?.state) {
-        publishAgain = true;
-        return;
-      }
       if (!closed && !relay) { connectionRevision += 1; latestConnectionStatus = structuredClone(status); emitStatus(status); }
     }).finally(() => { connectionPublishing = null; });
     return connectionPublishing;
@@ -719,6 +872,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     if (closed || relay || !agent) return Promise.resolve();
     if (publishing) { publishAgain = true; return publishConnectionStatus(); }
     const requestedConnectionRevision = connectionRevision;
+    const deviceSession = reportDeviceSession();
     publishing = Promise.resolve(agent.getDesktopStatus()).then(async (status) => {
       if (closed || relay) return;
       const sampledAccess = structuredClone(status.access || { state: 'unavailable', organizationId: null, organizationName: null });
@@ -726,6 +880,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
       status.access = sampledAccess;
       status.updateDetachment = updateRuntime.snapshot(coordinator.snapshot(),updater?.snapshot?.(),{accessReady:desktopAccessReady(sampledAccess)});
       const requestedScope = accessScope(currentAccess);
+      preferenceScope = controllerScope(status);
+      const reportController = { scope: requestedScope, controllerScope: preferenceScope, deviceSession };
+      if (preferenceScope) await controllerPreferences.load(preferenceScope);
       const requestedLinks = await decorateProviderSettings(status);
       const allRecords = await recordReader.list();
       const records = linkedSessions(allRecords);
@@ -753,25 +910,52 @@ export async function startDesktopHost({ input = process.stdin, output = process
       // Listing only reads rows previously registered by this device/account/org;
       // it never passes the locally discovered catalog to Web.
       if (agent.getLocalCliApiSession || dependencies.getLocalCliApiSession) {
-        void refreshNativeDevelopmentReports();
+        void refreshNativeDevelopmentReports({ controller: reportController });
       }
-      status.nativeDevelopmentReports = structuredClone(nativeDevelopmentReports);
+      if (reportController.controllerScope) void syncEmailPreferences(reportController);
+      const preferenceState = reportController.controllerScope ? await controllerPreferences.load(reportController.controllerScope) : null;
+      status.notificationPreferences = preferenceState?.notificationPreferences || {};
+      status.nativeDevelopmentReports = { ...structuredClone(sameReportController(reportController, nativeDevelopmentReportsController) ? nativeDevelopmentReports : { state: 'loading', enrollments: [] }), deliveries: Object.values(preferenceState?.conversations || {}).flatMap(row => Object.values(row.emailDeliveries || {})), preferences: Object.values(preferenceState?.conversations || {}).flatMap(row => row.emailPreference ? [{ ...row.emailPreference.request, sync: row.emailPreference.state }] : []) };
       // This is an asynchronous local attestation. It neither changes a
       // Delivery Loop nor places receipt or device data in status frames.
+      let reportCompletions = [];
+      if (reportController.controllerScope) {
+        for (const completion of allRecords.map(projectControllerCompletion).filter(Boolean)) {
+          await completionJournal.append({ id: [completion.provider, completion.provider_session_id, completion.task_id].join(':'), scope: reportController.controllerScope, completion });
+        }
+        reportCompletions = (await completionJournal.snapshot(reportController.controllerScope)).map(event => event.completion);
+      }
+      retainedCompletions = reportCompletions;
       submitNativeDevelopmentReportCompletions({
-        records: allRecords,
-        scope: requestedScope,
-        deviceSession: localCliApiSession(),
+        completions: reportCompletions,
+        controller: reportController,
       });
+      status.controllerCompletions = retainedCompletions;
+      status.controllerEventsVersion = 1;
+      status.controllerEvents = preferenceScope ? await notificationJournal.snapshot(preferenceScope) : [];
       const projection = await actionAssociations.beginProjection?.({ records });
       status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: projection?.records || records }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
+      // A full record projection owns this receipt. Connection-only heartbeats
+      // replay the cached receipt; they must never mint evidence of a fresh read.
+      const acceptanceReadbackId = randomUUID();
+      const readbackOrder = !status.deliveryHooks.error && acceptanceReadbackSequence < Number.MAX_SAFE_INTEGER
+        ? { readerId: acceptanceReaderId, sequence: ++acceptanceReadbackSequence } : null;
+      status.deliveryHooks.runs = (status.deliveryHooks.runs || []).map(run => {
+        if (!run.manualAcceptance || run.hostId && run.hostId !== 'local') return run;
+        const manualAcceptance = { ...run.manualAcceptance };
+        delete manualAcceptance.readbackId; delete manualAcceptance.readbackOrder;
+        return { ...run, manualAcceptance: { ...manualAcceptance,
+          ...(readbackOrder ? { readbackId: acceptanceReadbackId, readbackOrder } : {}) } };
+      });
       await actionAssociations.decorate(status.deliveryHooks, projection);
       const discovery = refreshSessions();
       if (coordinator.acceptsNewWork()) automaticContinuation?.tick(discovery.sessions);
       const sessions = discovery.sessions.map(candidate => automaticContinuation.project(analysisManager.project(candidate)));
       await actionAssociations.decorateSessions?.(sessions, projection);
-      const stateRunsBySession = new Map((projection?.records || records).filter(record => record.run).map(record => [`${record.provider}:${record.session}`, record.run]));
+      const stateRecordsBySession = new Map((projection?.records || records).filter(record => record.run).map(record => [`${record.provider}:${record.session}`, record]));
+      const stateRunsBySession = new Map([...stateRecordsBySession].map(([key, record]) => [key, record.run]));
       const runsBySession = new Map((status.deliveryHooks.runs || []).map(run => [`${run.provider}:${run.session}`, run]));
+      const recordedSqmChecks = [...(status.sqmChecks?.items || []), ...(status.sqmTasks?.items || [])];
       for (const session of sessions) {
         const key = `${session.provider}:${session.session}`;
         session.statistics = activeStatisticsRead?.key === key && !activeStatisticsRead.controller.signal.aborted
@@ -779,7 +963,8 @@ export async function startDesktopHost({ input = process.stdin, output = process
             ? { ...statisticsCache.get(key), refreshing: true }
             : { state: 'loading', hours: [], activity: [] }
           : statisticsCache.get(key) || unavailableStatistics();
-        session.sqmActivity = conversationSqmChecks(session, [...(status.sqmChecks?.items || []), ...(status.sqmTasks?.items || [])]);
+        session.sqmActivity = conversationSqmChecks(session, recordedSqmChecks);
+        session.sqmResult = conversationSqmResult(session, recordedSqmChecks);
         session.actionDeadline = { status: 'unavailable', online: false, reminder: null };
         try {
           const context = await actionAssociations.deadlineContext?.(session, projection);
@@ -797,8 +982,13 @@ export async function startDesktopHost({ input = process.stdin, output = process
       }
       status.sessionSupervision = { ...discovery, refreshing: Boolean(sessionRefresh), sessions: reconcileFamilyCompletion(sessions.map(candidate => ({ ...candidate,
         decisionRequest: sessionDecisionPresentation(candidate, runsBySession.get(`${candidate.provider}:${candidate.session}`)),
-        workState: sessionWorkState(candidate, runsBySession.get(`${candidate.provider}:${candidate.session}`) || stateRunsBySession.get(`${candidate.provider}:${candidate.session}`), { provider: discovery.providers?.[candidate.provider] }) }))).sort(compareSessionWork) };
-      teamThreads?.tick(sessions);
+        workState: sessionWorkState(candidate, runsBySession.get(`${candidate.provider}:${candidate.session}`) || stateRunsBySession.get(`${candidate.provider}:${candidate.session}`), { provider: discovery.providers?.[candidate.provider] }) }))).map(candidate => ({ ...candidate, conversationPresentation: conversationPresentation(candidate,
+          runsBySession.get(`${candidate.provider}:${candidate.session}`), { rawRecord: stateRecordsBySession.get(`${candidate.provider}:${candidate.session}`) }) })).sort(compareSessionWork) };
+      const sharingSessions = remoteHosts ? remoteHosts.project({ ...status, sessionSupervision: { ...status.sessionSupervision, sessions } }, { providerLinks }).sessionSupervision.sessions : sessions;
+      const remoteRows = sharingSessions.filter(row => row.hostId && row.hostId !== 'local');
+      await remoteMetadata.decorate(preferenceScope, remoteRows);
+      remoteHosts?.setMetadata?.(remoteRows);
+      teamThreads?.tick(sharingSessions);
       status.teamThreads = teamThreads?.snapshot();
       for (const session of status.sessionSupervision.sessions) {
         const key = teamThreadKey(agent.getTeamThreadsScope?.() || {}, session);
@@ -820,6 +1010,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
         if (accessScope(latestConnectionStatus?.access) !== requestedScope || !desktopAccessReady(latestConnectionStatus?.access)) { publishAgain = true; return; }
         status = { ...structuredClone(latestConnectionStatus), deliveryHooks: status.deliveryHooks, sessionSupervision: status.sessionSupervision };
       }
+      await remoteMetadata.syncPending(preferenceScope, async command => {
+        await authorizeProvider(command.provider, requestedScope);
+        return remoteHosts.control(command);
+      }).catch(() => diagnostics.write('conversation context synchronization pending'));
       status.teamThreads = teamThreads?.snapshot();
       if (!closed && !relay) {
         // Native stop admission waits for this authorized projection, so an old
@@ -844,7 +1038,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     const results = await Promise.allSettled([stopDiscovery({ drain: true }), publishing, connectionPublishing,
       pluginInspection,
       ...providerRepairJobs,
-      remoteHosts?.close(), actionAssociations.close(), automaticContinuation?.close(), analysisManager?.close(),
+      controllerPreferences.close(), operationJournal.close(), remoteHosts?.close(), remoteMetadata.close(), actionAssociations.close(), automaticContinuation?.close(), analysisManager?.close(),
       managedSupervisor.close(), recordReader.close(), stopWorkflows(),
       agent ? createAgentShutdown(agent)() : undefined]);
     const failure = results.find(result => result.status === "rejected");
@@ -863,6 +1057,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         if (relay.exitCode !== null) { clearTimeout(limit); done(); }
       });
     } else await stopAgent();
+    await ownerTransport?.close();
     await lock?.release();
   })();
 
@@ -898,7 +1093,14 @@ export async function startDesktopHost({ input = process.stdin, output = process
       readScope: () => agent.getTeamThreadsScope?.() || {key: accessScope(currentAccess),allowed:false,authenticated:false},
       request: (body,signal) => agent.requestTeamThreads(body,signal),
       fenceStore: createTeamStatusFenceStore(root),
-      readContext: dependencies.readTeamThreadContext,
+      readContext: async (candidate, options) => {
+        if (candidate.hostId && candidate.hostId !== 'local') {
+          const result = await remoteHosts.forward({ id: randomUUID(), action: 'session_read_context', provider: candidate.provider, session: candidate.session, hostId: candidate.hostId }, await agent.getDesktopStatus());
+          if (!result.ok || !Array.isArray(result.data?.messages)) throw new Error('Remote context unavailable.');
+          return result.data;
+        }
+        return (dependencies.readTeamThreadContext || readContinuationContext)(candidate, options);
+      },
       onChange: () => { if(!closed) setImmediate(() => {void publish().catch(() => {});}); },
     });
     stopWorkflows = (dependencies.startWorkflowUpdates || startWorkflowUpdates)({ enabled: env.SIMY_AUTO_UPDATE !== "0" });
@@ -1089,9 +1291,18 @@ export async function startDesktopHost({ input = process.stdin, output = process
     let command; try { command = JSON.parse(line); } catch { return; }
     if (typeof command.id !== "string" || command.id.length > 128) return;
     if (relay) {
+      if (command.action === 'session_renew_claude_owner') {
+        emit({ type: 'result', id: command.id, ok: false, message: 'Use the verified local conversation host for connection recovery.' }); return;
+      }
       if (!relay.stdin.destroyed && relay.exitCode === null) relay.stdin.write(`${JSON.stringify(command)}\n`);
       return;
     }
+    // Bind email intent when received, before either the preference queue or
+    // authorization/session reads can yield. Published identity only restricts
+    // this binding; fresh controller checks below still authorize every write.
+    const emailDispatchController = command.action === 'session_set_email_reports' ? {
+      deviceSession: reportDeviceSession(), scope: accessScope(currentAccess), controllerScope: controllerScope(lastStatus),
+    } : null;
     if(command.action==='cancel_detach_update') {
       try {updateRuntime.validate(command,coordinator.snapshot(),updater?.snapshot?.(),{accessReady:desktopAccessReady(currentAccess)});coordinator.cancel();emit({type:'result',id:command.id,ok:true});}
       catch {emit({type:'result',id:command.id,ok:false,message:'This update operation changed. Refresh its status.'});}
@@ -1116,7 +1327,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           const access=await accessSnapshot(); requireDesktopAccess(access);
           updateRuntime.validate(command,coordinator.snapshot(),updater?.snapshot?.());
           if(action==='detach_update')await updater.maybeApply({detach:true});
-          else await coordinator.reconnect();
+          else await reconnectWithHistoryRecovery({root,coordinator,eligible:()=>updateRuntime.historyRecoveryEligible()});
           emit({type:'result',id:command.id,ok:coordinator.snapshot().state==='connected' && (action!=='detach_update' || updater.snapshot().state==='updated')});
           await publish();return;
         }
@@ -1142,6 +1353,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
           finally { clearTimeout(deadline); exit(0); }
           return;
         }
+        if (['task_stop','task_detail'].includes(action) && remoteHosts?.isRemoteTask(command.taskKey)) {
+          const result = await remoteHosts.forwardTask(command, await agent.getDesktopStatus(), detail => emit(detail));
+          emit(result); void publish().catch(() => {}); return;
+        }
         if (action === "task_stop") {
           if (command.force !== true) throw new Error("Confirm before stopping this task.");
           await agent.stopDesktopTask(command.taskKey);
@@ -1161,6 +1376,13 @@ export async function startDesktopHost({ input = process.stdin, output = process
         }
         const access = await accessSnapshot();
         const commandScope = accessScope(access);
+        if (action === 'controller_pair') {
+          if (typeof command.organizationId !== 'string' || !command.organizationId) throw new Error('Select the controller organization.');
+          const url = await agent.requestDesktopLogin(command.organizationId);
+          if (!url || new URL(url).origin !== webOrigin) throw new Error('Remote sign-in URL is unavailable.');
+          emit({ type: 'result', id: command.id, ok: true, data: { authorizationUrl: url } });
+          return;
+        }
         if (!desktopActionAllowed(access, command)) throw Object.assign(new Error('Desktop access is required.'), { code: 'desktop_access_required' });
         const recoveryControl = ['provider_disconnect', 'session_unmonitor'].includes(action) || action === 'auto_update_set_enabled' && command.enabled === false ||
           ['session_set_auto_continue', 'session_set_email_reports', 'team_thread_share'].includes(action) && command.enabled === false;
@@ -1176,15 +1398,12 @@ export async function startDesktopHost({ input = process.stdin, output = process
           else if(action === 'team_thread_open') ok = await teamThreads.open({memberId:command.memberId,threadKey:command.threadKey});
           else {
             if (command.organizationId !== undefined && command.organizationId !== access.organizationId) throw new Error('Sharing organization changed. Confirm again.');
-            // Publication reads this host's provider context. Never reinterpret
-            // a remote or ambiguous identity as a same-ID local conversation.
-            if ((command.hostId && command.hostId !== 'local') || (!command.hostId && remoteHosts?.hasSession(command.session))) {
-              throw new Error('Team sharing requires an explicitly selected local conversation.');
-            }
-            const selected = sessionStatus.sessions.find(item => (!item.hostId || item.hostId === 'local') && item.provider === command.provider && item.session === command.session);
+            if (!command.hostId && remoteHosts?.hasSession(command.session)) throw new Error('Select the conversation host.');
+            const selected = command.hostId && command.hostId !== 'local' ? remoteHosts?.candidate(command)
+              : sessionStatus.sessions.find(item => (!item.hostId || item.hostId === 'local') && item.provider === command.provider && item.session === command.session);
             if (command.enabled === false) {
               // Revocation uses authenticated own rows, never provider context.
-              const key = command.threadKey ?? teamThreadKey(agent.getTeamThreadsScope(), { provider: command.provider, session: command.session });
+              const key = command.threadKey ?? teamThreadKey(agent.getTeamThreadsScope(), { hostId: command.hostId, provider: command.provider, session: command.session });
               ok = await teamThreads.stopSharing(key);
             } else {
               if(!selected || command.threadKey) throw new Error('Refresh and select your conversation again.');
@@ -1194,19 +1413,103 @@ export async function startDesktopHost({ input = process.stdin, output = process
           emit({type:'result',id:command.id,ok:ok===true}); void publish().catch(() => {}); return;
         }
 
+        if (action === 'controller_provider_connect') {
+          const source = await agent.getDesktopStatus();
+          if (source.auth?.userId !== command.userId || source.access?.organizationId !== command.organizationId) throw new Error('Remote account changed.');
+          await changeProviderLink(command.provider, true);
+          emit({ type: 'result', id: command.id, ok: true }); await publish(); return;
+        }
+        if (['remote_host_login','remote_host_provider_connect'].includes(action)) {
+          if (!remoteHosts) throw new Error('Nested remote setup is unavailable.');
+          const result = await remoteHosts.configure(command, await agent.getDesktopStatus());
+          if (!result.ok) { emit(result); return; }
+          if (action === 'remote_host_login') {
+            const url = result.data?.authorizationUrl;
+            if (!url || new URL(url).origin !== webOrigin) throw new Error('Remote sign-in origin is invalid.');
+            const opened = await (dependencies.openLogin || openAuthorizationUrl)(url, { logger: silentLogger });
+            if (!opened.opened) throw new Error('Could not open the sign-in page.');
+          }
+          emit({ type: 'result', id: command.id, ok: true }); void publish().catch(() => {}); return;
+        }
+        if (action === 'notification_set_preferences') {
+          const value = command.preferences;
+          if (!value || typeof value !== 'object' || Array.isArray(value) || Object.entries(value).some(([kind, enabled]) => !['finished','failed','paused','needs_decision'].includes(kind) || typeof enabled !== 'boolean')) throw new Error('Invalid notification preferences.');
+          await authorizeWork(commandScope);
+          const scope = controllerScope(await agent.getDesktopStatus());
+          await controllerPreferences.change(scope, state => { state.notificationPreferences = { ...state.notificationPreferences, ...value }; });
+          emit({ type: 'result', id: command.id, ok: true }); await publish(); return;
+        }
+        if (action === 'session_import_preferences') {
+          const candidate = command.hostId && command.hostId !== 'local' ? remoteHosts?.candidate(command) : await selectedSession(command, { preferObserved: true });
+          if (!candidate || candidate.teamRemote || ![command.pinned, command.deleted].every(value => value === undefined || typeof value === 'boolean')) throw new Error('Invalid legacy conversation preferences.');
+          await authorizeWork(commandScope);
+          const scope = controllerScope(await agent.getDesktopStatus());
+          await controllerPreferences.change(scope, state => {
+            const key = JSON.stringify([command.hostId || 'local', command.provider, command.session]);
+            const row = state.conversations[key] ||= {};
+            if (row.nativePreferencesMigrated) return;
+            if (row.deleted === undefined && command.deleted === true) row.deleted = true;
+            if (row.pinned === undefined && command.pinned !== undefined) { row.pinned = command.pinned; row.pinScopes = command.pinned ? ['legacy'] : []; }
+            if (row.deleted) { row.pinned = false; row.pinScopes = []; }
+            row.nativePreferencesMigrated = true;
+          });
+          emit({ type: 'result', id: command.id, ok: true }); await publish(); return;
+        }
+        if (action === 'session_remove') {
+          const candidate = command.hostId && command.hostId !== 'local' ? remoteHosts?.candidate(command) : await selectedSession(command, { preferObserved: true });
+          if (!candidate || candidate.isRunning || candidate.autoContinue || candidate.teamRemote) throw new Error('Stop this conversation before removing it from the list.');
+          await authorizeWork(commandScope);
+          const scope = controllerScope(await agent.getDesktopStatus());
+          await controllerPreferences.set(scope, { ...candidate, hostId: command.hostId || 'local' }, { deleted: true, pinned: false, pinScopes: [] });
+          emit({ type: 'result', id: command.id, ok: true }); await publish(); return;
+        }
+        if (command.requestId && !['refresh','session_statistics','session_read_context','session_renew_claude_owner'].includes(action)) {
+          const receiptScope = controllerScope(await agent.getDesktopStatus());
+          const reconcileReceived = !controllerPolicyActions.has(action) &&
+            !(['session_archive', 'session_restore'].includes(action) && command.scope === 'local') &&
+            remoteHosts?.supportsReplay?.(command) === true;
+          const previous = await operationJournal.begin(receiptScope, command, { reconcileReceived });
+          if (previous) { emit({ ...previous, type: 'result', id: command.id }); return; }
+          pendingRemoteReceipts.set(command.id, { scope: receiptScope, command });
+        }
         let commandProviderLink;
         if (command.provider && !["provider_repair", "refresh", "provider_connect", "provider_disconnect", "delivery_stop", "delivery_pause", "delivery_reject", "session_untrack", "session_unmonitor"].includes(action) &&
           !(action === "session_set_auto_continue" && command.enabled === false)) {
           commandProviderLink = await requireProviderLink({ root: deliveryRoot, provider: command.provider });
         }
-        if (command.hostId && command.hostId !== 'local') {
+        if (action === 'session_renew_claude_owner') {
+          requireDesktopAccess(access);
+          if (command.hostId !== 'local' || command.provider !== 'claude')
+            throw Object.assign(new Error('Connection recovery requires the verified local Claude host.'), { code: 'owner_renewal_local_only' });
+          if (command.expectedProviderEpoch !== commandProviderLink.epoch)
+            throw Object.assign(new Error('Provider connection changed; refresh before recovering it.'), { code: 'provider_link_changed' });
+          await authorizeProvider('claude', commandScope, commandProviderLink?.epoch);
+          const data = await (dependencies.renewClaudeSessionOwner || renewClaudeSessionOwner)({
+            root: deliveryRoot, hostId: command.hostId, provider: command.provider, session: command.session,
+            taskId: command.taskId, expectedRunId: command.expectedRunId, expectedRevision: command.expectedRevision,
+            expectedGateRevision: command.expectedGateRevision, expectedGeneration: command.expectedGeneration,
+            expectedProviderEpoch: command.expectedProviderEpoch, requestId: command.ownerRenewalRequestId,
+            ownerRenewalId: command.ownerRenewalId, candidateId: command.candidateId,
+          }, { authorize: () => authorizeProvider('claude', commandScope, commandProviderLink.epoch) });
+          emit({ type: 'result', id: command.id, ok: true, data }); void publish().catch(() => {}); return;
+        }
+        if (command.hostId && command.hostId !== 'local' && action !== 'session_set_email_reports') {
           if (!remoteHosts || !PROVIDER_LINKS.includes(command.provider)) throw Object.assign(new Error('Remote host is unavailable.'), { code: 'remote_host_unavailable' });
           await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
           const status = await agent.getDesktopStatus();
           // Status collection can yield while provider consent is revoked.
           // Reject before writing SSH bytes, not only after its result arrives.
           await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
-          const result = await remoteHosts.forward(command, status);
+          if (['session_action_refresh','session_action_select','session_action_unlink','session_deadline_decide'].includes(action)) {
+            const context = await remoteMetadata.command(controllerScope(status), command);
+            if (context && action !== 'session_action_refresh') await remoteMetadata.syncPending(controllerScope(status), async sync => {
+              await authorizeProvider(sync.provider, commandScope);
+              return remoteHosts.control(sync);
+            });
+            emit({ type: 'result', id: command.id, ok: true, data: { executionSync: context && action !== 'session_action_refresh' ? 'pending' : 'unchanged' } }); void publish().catch(() => {}); return;
+          }
+          const localPreference = action === 'session_set_pinned' || ['session_archive','session_restore'].includes(action) && command.scope === 'local';
+          const result = localPreference ? await remoteHosts.setPreference(command) : controllerPolicyActions.has(action) ? await remoteHosts.control(command) : await remoteHosts.forward(command, status);
           await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
           emit(result); void publish().catch(() => {}); return;
         }
@@ -1268,6 +1571,35 @@ export async function startDesktopHost({ input = process.stdin, output = process
           emit({ type: "result", id: command.id, ok: true });
           return;
         }
+        if (action === 'controller_events') {
+          await authorizeWork(commandScope);
+          const events = await notificationJournal.snapshot(controllerScope(await agent.getDesktopStatus()), command.after ?? 0);
+          await authorizeWork(commandScope);
+          emit({ type: 'result', id: command.id, ok: true, data: { events } });
+          return;
+        }
+        if (action === 'session_get_status') {
+          await selectedSession(command);
+          await publish();
+          await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
+          const row = lastStatus?.sessionSupervision?.sessions?.find(item =>
+            item.provider === command.provider && item.session === command.session && (!item.hostId || item.hostId === 'local'));
+          if (!row) throw new Error('This conversation status is unavailable; refresh its provider.');
+          // The same app projection carries observation time and next action;
+          // saved consent and an active record cannot prove a provider send.
+          const { provider, session, title, autoContinue, autoContinueStatus, autoContinueReason,
+            binding, workState, dispatchReadiness, conversationPresentation } = row;
+          emit({ type: 'result', id: command.id, ok: true, data: { provider, session, title,
+            autoContinue, autoContinueStatus, autoContinueReason, binding, workState, dispatchReadiness, conversationPresentation } });
+          return;
+        }
+        if (action === 'session_read_context') {
+          const candidate = await selectedSession(command, { preferObserved: true });
+          const context = await (dependencies.readTeamThreadContext || readContinuationContext)(candidate, {});
+          await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
+          emit({ type: 'result', id: command.id, ok: true, data: { messages: context.messages, incomplete: context.incomplete, truncated: context.truncated } });
+          return;
+        }
         if (action === "session_statistics") {
           await authorizeWork(commandScope);
           // Authorization can wait for scope cleanup. Only the latest selection
@@ -1452,9 +1784,23 @@ export async function startDesktopHost({ input = process.stdin, output = process
         } else if (["delivery_stop", "delivery_resume", "delivery_pause", "delivery_approve", "delivery_reject", "delivery_replan", "delivery_set_policy", "delivery_dependency_ready", "delivery_continuation_policy"].includes(action)) {
           await (action === "delivery_resume" ? dependencies.resumeSession || resumeSession : controlDelivery)({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
             taskId: command.taskId, expectedRunId: command.expectedRunId, expectedRevision: command.expectedRevision, approvalId: command.approvalId, autonomyPolicy: command.autonomyPolicy, continuationPolicy: command.continuationPolicy, waitId: command.waitId, answer: command.answer, action: action.slice("delivery_".length) });
+        } else if (action === 'delivery_acceptance_decide') {
+          const controls = manualAcceptanceCommand(command);
+          await authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
+          const authorize = () => authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch);
+          const result = await (dependencies.decideManualAcceptance || decideManualAcceptance)({ root: deliveryRoot, ...controls, authorize });
+          await authorize();
+          const continuation = manualAcceptanceContinuation(result?.continuation);
+          if (!continuation) throw new Error('Manual acceptance receipt is unavailable; refresh before retrying.');
+          emit({ type: 'result', id: command.id, ok: true, continuation });
+          void publish().catch(() => {}); return;
         } else if (action === "delivery_verify") {
           await verifyDelivery({ root: join(root, "delivery-hooks"), provider: command.provider, session: command.session,
             taskId: command.taskId, criterionId: command.criterionId });
+        } else if (action === 'session_sync_context') {
+          const target = await selectedSession(command, { preferObserved: true });
+          await applyControllerExecutionContext({ root: deliveryRoot, provider: command.provider, session: command.session, cwd: target.cwd, context: command.context,
+            authorize: () => authorizeProvider(command.provider, commandScope, commandProviderLink?.epoch) });
         } else if (["session_action_select", "session_action_unlink", "session_action_refresh"].includes(action)) {
           const candidate = await selectedSession(command);
           await authorizeWork(commandScope);
@@ -1474,7 +1820,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           }
           if (command.enabled) await authorizeWork(commandScope);
           await (dependencies.setSessionAutoContinue || setSessionAutoContinue)({ root: join(root, 'delivery-hooks'),
-            provider: command.provider, session: command.session, enabled: command.enabled, continuationPolicy: command.continuationPolicy, admission, expectedProviderEpoch: providerEpoch });
+            provider: command.provider, session: command.session, enabled: command.enabled, initialContinuationPolicy: command.continuationPolicy, admission, expectedProviderEpoch: providerEpoch });
           if (!command.enabled) automaticContinuation.revoke(command.provider, command.session);
           // Acknowledge the durable preference before discovery or analysis.
           emit({ type: "result", id: command.id, ok: true });
@@ -1485,12 +1831,25 @@ export async function startDesktopHost({ input = process.stdin, output = process
           return;
         } else if (action === "session_set_email_reports") {
           if (typeof command.enabled !== 'boolean') throw new Error('Choose whether development report emails are enabled.');
+          // Freeze credentials before session/identity/persistence awaits. A
+          // controller change must never move this consent to another device.
+          const deviceSession = emailDispatchController.deviceSession;
+          if (!deviceSession) throw new Error('SIMY desktop sign-in is required.');
+          if (!emailDispatchController.controllerScope) throw Object.assign(new Error('Refresh the desktop account before changing completion emails.'), { code: 'desktop_access_required' });
+          const requireEmailController = async () => {
+            const status = await requireReportController(emailDispatchController, { ready: command.enabled });
+            if (command.enabled) requireWorkAdmission();
+            return status;
+          };
+          await requireEmailController();
           if (command.enabled) {
-            if (command.provider !== 'codex') throw new Error('Development report email is not available for this provider yet.');
+            if (!PROVIDER_LINKS.includes(command.provider)) throw new Error('Unsupported provider.');
             // Initial consent binds only to a currently observed local session.
             // The title remains caller-provided; the host never reads transcript
             // content to populate it.
-            await selectedSession(command, { preferObserved: true });
+            if (command.hostId && command.hostId !== 'local') {
+              if (!remoteHosts?.candidate(command)) throw new Error('Select a known remote conversation.');
+            } else await selectedSession(command, { preferObserved: true });
           }
           if (command.enabled) await authorizeWork(commandScope);
           // Validate before the recovery path: an invalid local command is not
@@ -1498,18 +1857,24 @@ export async function startDesktopHost({ input = process.stdin, output = process
           const request = normalizeNativeDevelopmentReportSave({
             provider: command.provider,
             provider_session_id: command.session,
+            host_id: command.hostId || 'local',
             request_title: command.requestTitle,
             enabled: command.enabled,
             expected_revision: command.expectedRevision,
           });
-          const deviceSession = localCliApiSession();
-          if (!deviceSession) throw new Error('SIMY desktop sign-in is required.');
+          await requireEmailController();
+          const savedPreferenceScope = emailDispatchController.controllerScope;
+          const reportController = emailDispatchController;
+          const preferenceId = randomUUID();
+          const target = { hostId: command.hostId || 'local', provider: command.provider, session: command.session };
+          await controllerPreferences.set(savedPreferenceScope, target, { emailPreference: { id: preferenceId, request, state: 'pending' } });
+          await requireEmailController();
           // Keep the credential tuple fixed across PUT and its readback. A
           // changed account/device scope must fail instead of confirming one
           // user’s write with another user’s registry.
           const reportsApi = nativeReportsApi(deviceSession);
           const sameIdentity = enrollment => enrollment.provider === request.provider &&
-            enrollment.provider_session_id === String(request.provider_session_id || '').toLowerCase();
+            enrollment.provider_session_id === String(request.provider_session_id || '').toLowerCase() && (enrollment.host_id || 'local') === (request.host_id || 'local');
           const matchesSaved = enrollment => sameIdentity(enrollment) && enrollment.enabled === request.enabled &&
             (!request.enabled || enrollment.request_title === String(request.request_title || '').trim());
           const confirmed = enrollments => request.enabled
@@ -1530,6 +1895,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
             // The server may have committed before a connection failure. Read
             // back the device-scoped registry before reporting an error.
             const recovered = await reportsApi.list().catch(() => null);
+            await requireEmailController();
             if (!recovered) {
               invalidateMutation();
               throw error;
@@ -1538,6 +1904,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
             // the next explicit choice starts from the server's revision.
             if (nativeDevelopmentReportsGeneration === mutationGeneration && accessScope(currentAccess) === commandScope) {
               nativeDevelopmentReports = { state: 'ready', enrollments: recovered };
+              nativeDevelopmentReportsController = reportController;
               nativeDevelopmentReportsRetryAt = 0;
               recoveredCurrent = true;
             }
@@ -1546,12 +1913,12 @@ export async function startDesktopHost({ input = process.stdin, output = process
             const enrollments = await reportsApi.list();
             if (!confirmed(enrollments)) throw new Error('Development report email settings could not be confirmed.');
             if (command.enabled) await authorizeWork(commandScope);
-            const currentDeviceSession = localCliApiSession();
-            if (!currentDeviceSession || currentDeviceSession.token !== deviceSession.token || currentDeviceSession.api_base_url !== deviceSession.api_base_url) {
-              throw Object.assign(new Error('Desktop account or organization changed.'), { code: 'desktop_access_required' });
-            }
+            await requireEmailController();
             if (nativeDevelopmentReportsGeneration !== mutationGeneration) throw new Error('Development report email settings changed; refresh and try again.');
+            await controllerPreferences.set(savedPreferenceScope, target, { emailPreference: { id: preferenceId, request, state: 'applied' } });
+            await requireEmailController();
             nativeDevelopmentReportsScope = accessScope(currentAccess);
+            nativeDevelopmentReportsController = reportController;
             nativeDevelopmentReports = { state: 'ready', enrollments };
             nativeDevelopmentReportsRetryAt = 0;
             // Fence a GET that was in flight before this completed mutation.
@@ -1564,6 +1931,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
             // prior ready revision cached forever. Preserve a 409 readback,
             // which is itself the current server state.
             if (!recoveredCurrent) invalidateMutation();
+            const currentScope = controllerScope(await agent.getDesktopStatus());
+            if (currentScope === savedPreferenceScope && ![400,401,403].includes(error?.status) && error?.code !== 'desktop_access_required') {
+              emit({ type: 'result', id: command.id, ok: true, data: { syncState: 'pending' } });
+              return;
+            }
             throw error;
           } finally {
             nativeDevelopmentReportsMutation = false;
@@ -1587,7 +1959,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
           await authorizeWork(commandScope);
           const pinScope = command.pinScope ?? 'legacy';
           if (typeof pinScope !== 'string' || !pinScope || pinScope.length > 512) throw new Error('Invalid pin scope.');
-          await updateRecord(deliveryRoot, command.provider, command.session, previous => {
+          const updated = await updateRecord(deliveryRoot, command.provider, command.session, previous => {
             const scopes = new Set(Array.isArray(previous?.listPinScopes) ? previous.listPinScopes : previous?.listPinned ? ['legacy'] : []);
             if (command.enabled) scopes.add(pinScope); else scopes.delete(pinScope);
             return {
@@ -1596,17 +1968,63 @@ export async function startDesktopHost({ input = process.stdin, output = process
               ...(command.enabled ? { listMetadata: { title: candidate.title || '', createdAt: candidate.createdAt ?? null, lastActivityAt: candidate.lastActivityAt ?? null } } : {}),
             };
           });
+          const scope = controllerScope(await agent.getDesktopStatus()), target = { ...candidate, hostId: 'local' };
+          const scopes = new Set(controllerPreferences.get(scope, target).pinScopes || []);
+          if (command.enabled) scopes.add(pinScope); else scopes.delete(pinScope);
+          await controllerPreferences.set(scope, target, { pinned: scopes.size > 0, pinScopes: [...scopes], metadata: updated.listMetadata });
           refreshSessions(true);
+        } else if (action === 'session_provider_setup') {
+          if (command.provider !== 'claude' || !['inspect', 'setup'].includes(command.operation)) throw new Error('Choose Claude Desktop setup or inspection.');
+          await authorizeProvider('claude', commandScope, commandProviderLink?.epoch);
+          const data = await claudeDesktopNative[command.operation]();
+          emit({ type: 'result', id: command.id, ok: true, data });
+          return;
         } else if (action === "session_archive" || action === "session_restore") {
           const candidate = await selectedSession(command, { preferObserved: true });
           await authorizeWork(commandScope);
           if (!['local', 'provider'].includes(command.scope)) throw new Error('Choose local or provider archive explicitly.');
           const archived = action === 'session_archive';
           if (command.scope === 'provider') {
-            if (command.provider !== 'codex') throw new Error('Archive or restore this conversation in Claude, then refresh SIMY.');
+            if (command.provider === 'claude') {
+              const verifySelection = async () => {
+                const fresh = await selectedSession(command);
+                await authorizeProvider('claude', commandScope, selectedLinkEpochs.get(candidate));
+                if (fresh.cwd !== candidate.cwd) throw new Error('The conversation workspace changed. Refresh and retry.');
+                const record = await readRecord(deliveryRoot, 'claude', command.session);
+                if (fresh.isRunning || fresh.autoContinue || record?.autoContinue || record?.run && !TERMINAL.has(record.run.state))
+                  throw Object.assign(new Error('Stop this conversation and turn off automatic continuation before organizing it.'), { code: 'claude_desktop_running' });
+              };
+              await verifySelection();
+              const operation = new AbortController();
+              let checking = false;
+              const verifyAuthority = async () => {
+                if (closed) throw new Error('SIMY is shutting down.');
+                await authorizeProvider('claude', commandScope, selectedLinkEpochs.get(candidate));
+                const current = await readRecord(deliveryRoot, 'claude', command.session);
+                if (current?.autoContinue || current?.run && !TERMINAL.has(current.run.state))
+                  throw Object.assign(new Error('The conversation became active during native control.'), { code: 'claude_desktop_running' });
+              };
+              const watchdog = setInterval(() => {
+                if (checking) return; checking = true;
+                void verifyAuthority().catch(error => operation.abort(error)).finally(() => { checking = false; });
+              }, 100);
+              let data;
+              try {
+                data = await archiveClaudeDesktop(candidate, archived, { signal: operation.signal, beforeDispatch: verifySelection });
+                await verifyAuthority();
+              } finally { clearInterval(watchdog); }
+
+              await recordProviderArchive(deliveryRoot, 'claude', command.session, archived, Date.now());
+              refreshSessions(true);
+              emit({ type: 'result', id: command.id, ok: true, data });
+              void publish().catch(() => {});
+              return;
+            }
+            if (command.provider !== 'codex') throw new Error('Unsupported conversation provider.');
             const client = await (dependencies.openCodexAppServer || openCodexAppServer)();
             try { await client.request(archived ? 'thread/archive' : 'thread/unarchive', { threadId: command.session });
-              if (archived) await recordProviderArchive(deliveryRoot, command.provider, command.session, true, Date.now());
+              await verifyCodexArchiveState(client, command.session, archived);
+              await recordProviderArchive(deliveryRoot, command.provider, command.session, archived, Date.now());
             }
             finally { await client.close(); }
           } else {
@@ -1728,6 +2146,10 @@ export async function startDesktopHost({ input = process.stdin, output = process
     }
   });
   commands.on("close", () => { if (!closed) void close().then(() => exit(0)); });
+  if (lock && !dependencies.startAgent) {
+    ownerTransport = await createOwnerTransport({ root, nonce: lock.nonce, allowedActions, allowControllerArchive: env.SIMY_REMOTE_CHILD !== '1', dispatch: command => commands.emit('line', JSON.stringify(command)) });
+    await publish();
+  }
   return { close, publish, agent };
 }