@awak-app/simy-cli 0.7.29 → 0.7.31

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -18,7 +18,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { atomicSave, readState } from './update-state-store.mjs';
-import { captureHookOwner, fenceHook, rootFromDelivery, readDispatchGate, readTaskAdmission } from './update-dispatch-gate.mjs';
+import { captureHookOwner, fenceHook, rootFromDelivery, readDispatchGate, readTaskAdmission, reattachHookOwner, settleHookContinuation, DISPATCH_MODULE_DIGEST } from './update-dispatch-gate.mjs';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 const observeDeliveryRecord = (...args) => import('../../../cli-observability.js')
   .then(({ observeDeliveryRecord: observe }) => observe(...args)).catch(() => false);
@@ -26,7 +26,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { acquireWorkspaceLease, releaseWorkspaceLease } from './workspace-lease.mjs';
 import { purposeEnabled, purposeContract, purposeDiagnosisPlan, validatePurposeReview, flexibleReasoning } from './purpose-cycle.mjs';
-import { effectiveAcceptanceCriteria } from './acceptance-policy.mjs';
+import { effectiveAcceptanceCriteria, acceptanceIdentity } from './acceptance-policy.mjs';
 import { assessRuleReview } from './purpose-rule-review.mjs';
 import { associationContract, validateAssociationResult } from './action-association.mjs';
 import { minimalSufficientChangeInstruction } from './minimal-sufficient.mjs';
@@ -241,7 +241,12 @@ async function waitForStateLock(lock, inspectProcess) {
   for (;;) {
     try { token = await acquireStateLock(lock, inspectProcess); break; }
     catch (error) {
-      if (Date.now() >= deadline || !/^(?:Delivery state is busy; retry the command\.|Delivery state lock owner is unavailable; inspect the lock before retrying\.)$/.test(error.message)) throw error;
+      // Windows can deny mkdir while a removed lock directory is still closing.
+      // Retry only acquisition at this exact path within the existing deadline;
+      // owner writes, unrelated permission failures and mutations are not replayed.
+      const pendingWindowsDirectory = process.platform === 'win32' && error.code === 'EPERM' &&
+        error.syscall === 'mkdir' && error.path === lock;
+      if (Date.now() >= deadline || (!pendingWindowsDirectory && !/^(?:Delivery state is busy; retry the command\.|Delivery state lock owner is unavailable; inspect the lock before retrying\.)$/.test(error.message))) throw error;
       await new Promise(resolve => setTimeout(resolve, 10));
     }
   }
@@ -554,12 +559,14 @@ export function canExecuteAutonomousExternal(managed) {
 // Shared by live Stop hooks and cold exact-session recovery. Keep the result
 // contract identical across transports; the host still verifies acceptance.
 export function assessedCheckpointContract(decision, managed = null) {
+  const scopes = managed?.approvalScopes ?? (decision.action?.scope ? [decision.action.scope] : []);
+  const actionFields = `Enrolled action.scope labels: ${JSON.stringify(scopes)}. scope is an exact enrollment label, not a filename or target description. Reuse an enrolled label for work within that scope; do not invent labels. Put concrete file names and affected targets in action.summary. These labels do not expand the original objective or provider permissions. Describe actual effects consistently: read uses externalEffect:"none"; local_edit uses externalEffect:"local". Do not relabel an outside-scope action to bypass approval.`;
   const observationField = flexibleReasoning(managed) ? 'Plan diagnosis, recommendation and its reason are optional when the selected action is clear. Optional observations may be omitted; do not create evidence files, citations or extra reports. Actual tool results are captured by the controller.' : 'Return the observed result; evidence attachments and extra reports are optional.';
-  return `${minimalSufficientChangeInstruction({ turn: 'assessed' })}\nReturn ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened"} for THIS selected action. ${observationField} ${actionReversibilityInstruction} This is provider-reported, not independent verification. When the requested outcome is a conversational answer or correction, put the actual answer text in summary. Saying it was prepared or delivered is insufficient; do not place the answer only in an undeclared JSON field. For an answer-only request, returning that text here is the conversational result: do not invent a separate message-delivery action unless the original user requested a separate destination. This does not verify implementation or external effects. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. Missing facts are unknown. Successful diagnosis or repair is only an action result, not completion of the original user task. If original work remains, return in_progress with remainingWork and the next assessed plan, preserving the original objective, corrections and acceptance criteria. Do not repeat effects already performed. Report completed only when the original requested outcome is achieved; keep unfinished checks as remaining work. Do not add audit reports, certification, or evidence-submission tasks. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. ${informationWaitInstruction} external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
+  return `${minimalSufficientChangeInstruction({ turn: 'assessed' })}\nReturn ONLY one JSON object with top-level status:"in_progress|completed|blocked|error" and summary:"what happened". Use the key status, NEVER kind, for an ordinary work checkpoint. Record actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"what actually happened"} for THIS selected action. ${observationField} ${actionReversibilityInstruction} This is provider-reported, not independent verification. When the requested outcome is a conversational answer or correction, put the actual answer text in summary. Saying it was prepared or delivered is insufficient; do not place the answer only in an undeclared JSON field. For an answer-only request, returning that text here is the conversational result: do not invent a separate message-delivery action unless the original user requested a separate destination. This does not verify implementation or external effects. For in_progress/error include nextStep, remainingWork, and plan:{diagnosis,alternatives:[{id,action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification,rollback}],selectedOptionId,recommendation:{optionId,reason},userQuestion?} for the NEXT action; select one assessed option but do not execute it in this turn. Valid action.kind values are exactly read, local_edit, local_test, external, destructive, scope_change, unknown; use local_edit for writing local files. ${actionFields} Risk is low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. Missing facts are unknown. Successful diagnosis or repair is only an action result, not completion of the original user task. If original work remains, return in_progress with remainingWork and the next assessed plan, preserving the original objective, corrections and acceptance criteria. Do not repeat effects already performed. Report completed only when the original requested outcome is achieved; keep unfinished checks as remaining work. Do not add audit reports, certification, or evidence-submission tasks. Blocked requires blocker set to exactly authorization, missing_information, or external_dependency, plus nextStep. For authorization, include an assessed plan and set approval to an exact copy of the selected plan alternative action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. ${informationWaitInstruction} external_dependency requires waitCondition:{condition,owner,nextCheck} with the observable resumption condition, dependency owner, and bounded recheck instruction, plus nextStep.`;
 
 }
 export function understandingCheckpointContract(decision) {
-  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\n${correctiveFollowupInstruction}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use manual."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic for purpose search or manual otherwise. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. If and only if the original user requests ONLY a conversational answer or design (no implementation, files, tests, deployment or external effects), no independent review/audit or human acceptance is requested anywhere in the user context, and the existing answer already satisfies every requested point, you may include sessionUnderstanding.conversationOutcome:{kind:"answer_only",independentReviewRequested:false,requestTurnRefs:["exact user turn refs"],answerTurnRefs:["exact assistant answer turn refs"]}. Include the latest user and latest answer references, and exact user excerpts in the criteria basis. Read and judge the actual answer, including factual errors and unsupported claims; its mere existence or a worker saying done is insufficient. If the answer is wrong or incomplete, use clear with the next read action to formulate the missing/corrected answer, not already_done. Omit conversationOutcome for uncertain scope, missing context or requested effects; a design that describes unimplemented work is complete only when the user asked for design alone. This optional classification ends only an initially uncontracted conversational task as reported_done; it does not waive a frozen acceptance contract or assert independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
+  return `${minimalSufficientChangeInstruction({ turn: 'understanding' })}\n${correctiveFollowupInstruction}\nThis is an UNDERSTANDING turn, not a work turn. Read the existing conversation context and available read-only evidence; ${decision.purpose ? "Authorized read-only API and web research is allowed within existing provider permissions; do not send private material to external services. Do not edit files, write to external services, or start the proposed next action." : "do not edit files, call external services, or start the proposed next action."} Return ONLY JSON {kind:"session_understanding",summary:"...",actionResult:{decisionId:"${decision.id}",status:"observed|failed|not_run",summary:"...",evidence:["..."]},sessionUnderstanding:{state:"clear|ambiguous|context_missing|already_done",objective:"current user goal",constraints:["..."],done:["..."],remaining:["..."],nextAction:{kind:"read|local_edit|local_test|external|destructive|scope_change|unknown",scope:"task",summary:"..."},criteria:[{description:"...",source:"user_grounded|proposed",basisIndex:0,check:{type:"manual|semantic|file_exists|file_contains|file_equals",path:"relative/path",text:"expected text"}}],ambiguities:["..."],question:"one focused user question if unclear",basis:[{source:"user|assistant|artifact",turnRef:"if available",snippet:"short relevant excerpt"}]},plan:{diagnosis:"...",alternatives:[{id:"...",action:{kind,scope,summary},assessment:{risk,reversibility,externalEffect,blastRadius,uncertainty,inObjective,userChoice},expectedVerification:"...",rollback:"..."}],selectedOptionId:"...",recommendation:{optionId:"...",reason:"..."}}}. For clear, choose one NEXT action but do not execute it. Set sessionUnderstanding.nextAction to an exact copy of the selected plan alternative's action object: kind, scope, and summary strings MUST be identical, with no paraphrasing. Complete every known assessment field: risk low|medium|high|unknown; reversibility reversible|irreversible|unknown; externalEffect none|local|external|unknown; blastRadius single_file|repository|multi_system|unknown; uncertainty low|medium|high|unknown; inObjective and userChoice booleans. For blastRadius, single_file and repository describe filesystem scope; multi_system is the conservative category for a known non-filesystem boundary, including an API/service or conversation. State the actual affected targets in the plan; this category grants no additional target or permission. Use unknown for missing scope facts, not merely because a known target is not a file. For a read-only single-file action with no effects, use reversible, none, single_file when those facts are known; unknown facts require AI investigation; reversible preferences are delegated under autonomous policy. Write objective and criteria in the original user's language. Lead objective with the intended user experience (who can do what in which situation), when grounded in the request. Criteria must describe observable outcomes for that experience, not merely code written or tests passing. Keep technical-only requests technical; do not invent new UX obligations. Preserve done and remaining as the recorded stages of the whole requested work, distinguishing reported implementation from verified outcomes. Use only the original user's goal; constraints[] must contain only constraints from the original user, not these SIMY turn instructions. Do not invent new work or acceptance obligations. Include a user-grounded criterion only with a basisIndex pointing to a user message. Use file_equals for a user-requested file whose complete UTF-8 contents must be exact (including whitespace/newlines), file_contains only for a requested substring, and file_exists only for existence. ${decision.search ? "For semantic outcomes use check.type semantic; reserve manual for an explicit requirement for a human decision. Missing verification tooling is work to do, not a manual condition." : "For semantic conditions use semantic; do not create human verification requirements."} Never emit file_equals with null, omitted, guessed, or placeholder text. If exact expected contents are unknown, choose read to learn them and use semantic and obtain the needed observation automatically. Do not invent a file check from repository hints alone. If the original work is already done, choose already_done with remaining:[], nextAction:null, no plan, and no new goal. First recover missing context with authorized reads and infer reversible defaults from the original request. Select read investigation when facts remain unknown. Only if the original goal cannot be grounded at all or irreversible personal consequences require a decision, set one ambiguity and one focused question, nextAction:null, and omit plan. Provider statements about past work and semantic success are not independent verification. If and only if the original user requests ONLY a conversational answer or design (no implementation, files, tests, deployment or external effects), no independent review/audit or human acceptance is requested anywhere in the user context, and the existing answer already satisfies every requested point, you may include sessionUnderstanding.conversationOutcome:{kind:"answer_only",independentReviewRequested:false,requestTurnRefs:["exact user turn refs"],answerTurnRefs:["exact assistant answer turn refs"]}. Include the latest user and latest answer references, and exact user excerpts in the criteria basis. Read and judge the actual answer, including factual errors and unsupported claims; its mere existence or a worker saying done is insufficient. If the answer is wrong or incomplete, use clear with the next read action to formulate the missing/corrected answer, not already_done. Omit conversationOutcome for uncertain scope, missing context or requested effects; a design that describes unimplemented work is complete only when the user asked for design alone. This optional classification ends only an initially uncontracted conversational task as reported_done; it does not waive a frozen acceptance contract or assert independent verification. Optionally include sessionUnderstanding.matchingContext:{deliverables:["concrete requested output"],projectHints:["project name"],repositoryUrls:[],relatedUrls:[],actionIds:[],sourceRefs:[{platform:"slack",externalThreadId:"exact thread",channelExternalId:"exact channel"}]}. Extract only explicit conversation evidence; IDs and sources are retrieval signals, never authenticated identity. Do not infer URLs or identifiers.`;
 }
 function boundedContextList(value, maxItems = 8, maxLength = 300) {
   if (!Array.isArray(value) || value.length > maxItems) throw new Error('Session understanding has too many items.');
@@ -591,7 +598,7 @@ function sessionUnderstanding(value) {
     if (!description || !['user_grounded', 'proposed'].includes(item?.source)) throw new Error('Understanding criterion needs a description and provenance.');
     const basisIndex = Number.isSafeInteger(item.basisIndex) && item.basisIndex >= 0 && item.basisIndex < basis.length ? item.basisIndex : null;
     if (item.source === 'user_grounded' && (basisIndex === null || basis[basisIndex].source !== 'user')) throw new Error('User-grounded criterion needs a user-message basis.');
-    const check = item.check?.type || 'manual';
+    const check = item.check?.type || 'semantic';
     if (!['manual', 'semantic', 'file_exists', 'file_contains', 'file_equals'].includes(check)) throw new Error('Unsupported inferred acceptance check.');
     if (!['manual', 'semantic'].includes(check) && (!text(item.check.path, 500) || isAbsolute(item.check.path) || item.check.path.split(/[\\/]/).includes('..'))) throw new Error('Inferred file check needs a relative task path.');
     if (check === 'file_contains' && !text(item.check.text, 1000)) throw new Error('Inferred file check needs expected text.');
@@ -676,7 +683,11 @@ function recordPurposeProgress(run, now, countAttempt = true) {
   }
 }
 function recordDecision(managed, plan, now) {
-  let decision = evaluateAssessedPlan(plan, managed.autonomyPolicy, managed.approvalScopes, now, { allowLocalTestWrites: searchEnabled(managed), llmDelegated: searchEnabled(managed), allowReversibleExternal: searchEnabled(managed) && managed.resumeChannel === 'codex_app_server' });
+  // Classify effectful local tests as writes, with the same scope, policy and
+  // rollback checks as local_edit. Native write permissions remain independent.
+  const assessmentOptions = { allowLocalTestWrites: true, llmDelegated: searchEnabled(managed),
+    allowReversibleExternal: searchEnabled(managed) && managed.resumeChannel === 'codex_app_server' };
+  let decision = evaluateAssessedPlan(plan, managed.autonomyPolicy, managed.approvalScopes, now, assessmentOptions);
   const dependencyPending = option => (option?.dependsOn || []).some(id =>
     !managed.purpose?.evidence?.units?.some(unit => unit.id === id && unit.status === 'verified' && unit.purposeRevision === managed.purpose.evidence.purposeRevision));
   if (searchEnabled(managed) && (decision.outcome === 'wait' || dependencyPending(plan.alternatives.find(row => row.id === plan.selectedOptionId)))) {
@@ -685,7 +696,7 @@ function recordDecision(managed, plan, now) {
     for (const candidate of [...plan.alternatives].sort((a, b) => (priorities.get(a.id) ?? 99) - (priorities.get(b.id) ?? 99))) {
       if (candidate.id === plan.selectedOptionId || !candidate.independent || dependencyPending(candidate)) continue;
       const alternative = { ...plan, selectedOptionId: candidate.id, recommendation: { optionId: candidate.id, reason: 'Continue the highest listed eligible independent alternative.' } };
-      const assessed = evaluateAssessedPlan(alternative, managed.autonomyPolicy, managed.approvalScopes, now, { allowLocalTestWrites: searchEnabled(managed), llmDelegated: searchEnabled(managed), allowReversibleExternal: searchEnabled(managed) && managed.resumeChannel === 'codex_app_server' });
+      const assessed = evaluateAssessedPlan(alternative, managed.autonomyPolicy, managed.approvalScopes, now, assessmentOptions);
       if (assessed.outcome !== 'wait' && !managed.rejectedActionOverflow && !managed.rejectedActionDigests?.includes(digest(JSON.stringify(assessed.action)))) {
         plan = alternative; decision = assessed; break;
       }
@@ -718,6 +729,7 @@ function recordDecision(managed, plan, now) {
       status: decision.outcome === 'wait' ? 'waiting' : 'planned', evidenceRefs: [], purposeRevision: ledger.purposeRevision || 1, action: decision.action, createdAt: now });
     compactWorkHistory(ledger);
   }
+  delete managed.controllerDecisionWait;
   managed.plan = plan; managed.decision = decision; managed.proposedAction = decision.action;
   managed.decisionHistory ||= [];
   if (managed.decisionHistory.at(-1)?.id !== decision.id) managed.decisionHistory.push({ id: decision.id, at: now, outcome: decision.outcome, reason: decision.reason, selectedOptionId: decision.selectedOptionId, action: decision.action });
@@ -758,7 +770,7 @@ function managedSpec(spec, session, provider, observedProcess, admission, now) {
     if (typeof item !== 'object' || !item || !text(item.description, 500)) throw new Error('Each acceptance criterion needs a description.');
     const id = text(item.id, 80) || `criterion-${index + 1}`;
     if (!/^[A-Za-z0-9_-]+$/.test(id) || ['USER-GOAL', '__proto__', 'constructor', 'prototype', 'toString', 'valueOf', 'hasOwnProperty'].includes(id)) throw new Error('Invalid acceptance criterion ID.');
-    const check = item.check || { type: 'manual' };
+    const check = item.check || { type: 'semantic' };
     if (!['manual', 'semantic', 'file_exists', 'file_contains', 'file_equals'].includes(check.type)) throw new Error('Unsupported acceptance check.');
     if (!['manual', 'semantic'].includes(check.type) && (!text(check.path, 500) || isAbsolute(check.path) || check.path.split(/[\\/]/).includes('..'))) throw new Error('Acceptance file must be relative to the task directory.');
     if (check.type === 'file_contains' && !text(check.text, 1000)) throw new Error('file_contains needs expected text.');
@@ -830,9 +842,11 @@ export function pendingAcceptance(run) {
   if (enrollment && (enrollment.objective !== run.objective || enrollment.acceptanceDigest !== digest(JSON.stringify(run.managed.acceptanceCriteria)) ||
       JSON.stringify(enrollment.deliveryLevel) !== JSON.stringify(run.managed.deliveryLevel || null))) return [{ id: 'enrollment', description: 'Original objective, level and acceptance contract',
     check: 'manual', detail: 'Enrollment changed unexpectedly; stop and inspect before enrolling a revised task' }];
-  const pending = effectiveAcceptanceCriteria(run.managed).filter(item => !Object.hasOwn(run.managed.verified, item.id))
+  const feedback = new Map(pendingAcceptanceFeedback(run).map(item => [item.criterionId, item]));
+  const pending = effectiveAcceptanceCriteria(run.managed).filter(item => !Object.hasOwn(run.managed.verified, item.id) || feedback.has(item.id))
     .map(item => ({ id: item.id, description: item.description, check: item.check.type,
-      detail: run.managed.criterionObservations?.[item.id]?.observed_result || (item.check.type === 'manual' ? 'Explicit user verification required' : 'Independent check not yet passed') }));
+      detail: feedback.has(item.id) ? `User result feedback: ${feedback.get(item.id).reason}` :
+        run.managed.criterionObservations?.[item.id]?.observed_result || (item.check.type === 'manual' ? 'Explicit user verification required' : 'Independent check not yet passed') }));
   // File predicates and a worker claim cannot waive an explicit review.
   // The host checkpoint path supplies an independently bound result when available.
   if (run.managed?.independentReviewRequired && !searchEnabled(run.managed) && run.managed.liveOutcomeReview?.passed !== true) pending.push({
@@ -905,10 +919,24 @@ export function liveOutcomeReviewEligible(record) {
     !m.liveOutcomeReview && !m.pendingApproval && !m.nativeWait && !m.executionUncertain && !m.purpose?.nativeBoundary &&
     !managedBudgetReason(run) && automaticContinuationAllowed(record));
 }
+// Checkpoints are rejected while only manual acceptance is pending, so the
+// review instruction applies only where an independent review can follow.
+function reviewInstruction(run) {
+  const m = run.managed;
+  if (m?.capability !== 'live_hook' || m?.thread?.provider !== 'claude') return '';
+  if (run.state === 'verification_pending' && !m.independentReviewRequired && !effectiveAcceptanceCriteria(m).some(c => c.check.type === 'semantic'))
+    return (text(run.checkpoint?.remainingWork)
+      ? 'Manual acceptance is pending. The completion report records remaining work, but no additional executable next plan has been accepted. '
+      : 'Only manual acceptance remains and the user verifies it. ') +
+      'Checkpoints are not accepted until the user verifies or resumes this task; do not resubmit one. ';
+  return 'When the requested artifact is ready or repaired, submit a completed work checkpoint to request independent review. This does not grant acceptance. If nativeOutcomeReview.prompt is absent, submit that checkpoint first to obtain a fresh review prompt; never reuse a pre-repair prompt. ';
+}
 export function deliveryAcceptanceContext(run) {
-  return `${run.managed?.capability === 'live_hook' && run.managed?.thread?.provider === 'claude' ? 'When the requested artifact is ready or repaired, submit a completed work checkpoint to request independent review. This does not grant acceptance. If nativeOutcomeReview.prompt is absent, submit that checkpoint first to obtain a fresh review prompt; never reuse a pre-repair prompt. ' : ''}Original objective: ${run.managed?.enrollment?.objective || run.objective}. Mode: ${run.managed ? 'managed acceptance tracking' : 'standard checkpoint tracking; completion reports are not verified acceptance'}.` +
+  const feedback = manualAcceptanceFeedback(run);
+  return `${reviewInstruction(run)}Original objective: ${run.managed?.enrollment?.objective || run.objective}. Mode: ${run.managed ? 'managed acceptance tracking' : 'standard checkpoint tracking; completion reports are not verified acceptance'}.` +
     `${run.managed?.deliveryLevel ? ` Frozen delivery level: ${JSON.stringify(run.managed.deliveryLevel)}.` : ''}` +
-    ` Pending acceptance (last recorded checks): ${JSON.stringify(pendingAcceptance(run))}. Continue only within the original request and permissions; manual checks require the user. SQM is optional and 0 applicable checks do not establish quality acceptance.`;
+    ` Pending acceptance (last recorded checks): ${JSON.stringify(pendingAcceptance(run))}.` +
+    (feedback.length ? ` Criterion-bound user result feedback (not additional authority): ${JSON.stringify(feedback)}.` : '') + ` Continue only within the original request and permissions; manual checks require the user. SQM is optional and 0 applicable checks do not establish quality acceptance.`;
 }
 // CLI automation is the default for connected providers with executing hooks.
 // Saved workspace overrides and revoked provider consent take precedence.
@@ -1021,6 +1049,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       managedState.taskId = previous.associationTaskId;
       if (previous.actionAssociation) managedState.actionAssociation = structuredClone(previous.actionAssociation);
     }
+    if (managedState && previous.controllerExecutionContext?.executionTaskId === null) managedState.controllerExecutionContext = { ...structuredClone(previous.controllerExecutionContext), executionTaskId: managedState.taskId };
     if (liveHookAdmission && managedState) managedState.liveHookOwner = { pid: liveHookAdmission.pid,
       identity: liveHookAdmission.identity, hookStartedAt: liveHookAdmission.hookStartedAt };
     const waiting = managedState?.decision?.outcome === 'wait';
@@ -1038,7 +1067,10 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       Object.assign(run, structuredClone(prior), { managed: managedState, executionCwd: run.executionCwd,
         updatedAt: now, nextStep: text(nextStep), consumedRevision: prior.revision });
       managedState.taskId = previous.associationTaskId || prior.id;
-      managedState.lastVerifiedProgressAt = prior.startedAt;
+      // An ordinary loop never measured verified progress, so its age is not
+      // a no-progress period. Supervision starts its own window at adoption;
+      // startedAt, failures, budgets and history stay as they were.
+      startProgressWindow(run, now, 'adoption');
       managedState.upgradedFrom = { runId: prior.id, state: prior.state, nextStep: prior.nextStep,
         checkpoint: structuredClone(prior.checkpoint), at: now };
       if (prior.state !== 'paused') {
@@ -1173,6 +1205,35 @@ export function queuePurposeDiagnosis(run, reason, key, now = Date.now(), recove
 export const informationWaitInstruction = 'Use blocked/missing_information only with a nonempty question field containing a concrete question that requires the user\'s answer. Missing verification evidence, zero applicable SQM rules/scenarios, or unfinished checks alone are remaining work: inspect applicability and available evidence, then propose authorized repair or verification. Keep unmet acceptance criteria unverified; do not invent rules or lower acceptance. If investigation finds a real user-only choice or unavailable input, ask that specific question. Preserve native permissions, explicit stops, refusals and budgets.';
 const informationWaitDiagnosis = 'Read the current task context and available verification evidence to determine whether progress really requires a user answer. Identify an authorized next investigation or verification step, or return blocked/missing_information with the specific user question. Do not repeat prior side effects or claim that incomplete verification passed.';
 
+// A worker authorization classification is not itself a native permission
+// request. Diagnose existing authority before presenting a synthetic gate.
+export function controllerApprovalDiagnosisEligible(record, now = Date.now()) {
+  const run = record?.run, managed = run?.managed;
+  const pending = managed?.pendingApproval || managed?.controllerDecisionWait;
+  return Boolean(purposeEnabled(run) && searchEnabled(managed) && managed.autonomyPolicy === 'autonomous' && automaticContinuationAllowed(record) && pending &&
+    managed.resumeChannel === 'codex_app_server' && !managed.providerWarning && !managed.usageBlocked && !managedBudgetReason(run, now) &&
+    !['pending', 'transferred', 'pending_received'].includes(managed.handoff?.status) &&
+    !pending.denied && !managed.nativeWait && !managed.purpose?.nativeBoundary && !run.providerRequest &&
+    !managed.userQuestion && !managed.understandingQuestion && !managed.executionUncertain && run.stopReason?.actor !== 'user');
+}
+export function diagnoseControllerApproval(record, now) {
+  const run = record.run, managed = run?.managed;
+  if (!controllerApprovalDiagnosisEligible(record, now)) {
+    // A deferred diagnosis must remain visible when its dispatch is no longer
+    // possible. Restoring the request grants no authority to execute it.
+    if (managed?.controllerDecisionWait && !managed.pendingApproval) {
+      managed.pendingApproval = managed.controllerDecisionWait;
+      delete managed.controllerDecisionWait;
+    }
+    return false;
+  }
+  const pending = managed.pendingApproval || managed.controllerDecisionWait;
+  const queued = queuePurposeDiagnosis(run, `Inspect existing user instructions and provider permissions for the waiting action: ${pending.summary}. Do not execute or approve it during diagnosis. Continue already authorized work, or identify concrete indispensable missing information.`, `controller-approval:${digest(JSON.stringify([pending.kind,pending.scope,pending.summary]))}`, now, 'authorization_diagnosis');
+  if (queued) delete managed.controllerDecisionWait;
+  else { managed.controllerDecisionWait = { ...pending }; managed.pendingApproval = null; }
+  return queued;
+}
+
 export async function checkpointDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), checkpoint, expectedLease, expectedNativeHandoff, toolEvidence = [], sourceContext, controllerEvidence, now = Date.now() }) {
   if (expectedNativeHandoff && checkpoint?.kind) throw new Error('Native handoff requires an ordinary action checkpoint.');
   if (checkpoint?.kind === 'action_association') return checkpointActionAssociation({ root, provider, session, cwd, checkpoint, expectedLease, now });
@@ -1207,11 +1268,27 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
     const remainingWork = text(checkpoint.remainingWork, 4000);
     const resultDisposition = decideLoop({ completion_claim: checkpoint.status === 'completed',
       remaining_work: Boolean(remainingWork), acceptance_failed: checkpoint.acceptanceMet === false });
-    const incompleteResult = !run.managed && checkpoint.status === 'completed' && resultDisposition.action === 'repair';
+    // A current managed report can contradict its own completion claim. Only
+    // its explicit, assessed next plan can keep the work lane active; never
+    // recover a plan from historical remainingWork/nextStep or reopen a wait.
+    // Completed reports may also describe manual/external verification without
+    // a next plan. Preserve those waits; prose alone never admits execution.
+    const managedWorkRemains = Boolean(run.managed && checkpoint.status === 'completed' && remainingWork && checkpoint.plan != null);
+    const incompleteResult = managedWorkRemains || !run.managed && checkpoint.status === 'completed' && resultDisposition.action === 'repair';
+    if (managedWorkRemains) {
+      if (!run.managed.autonomyPolicy || !run.managed.decision || !nextStep) throw new Error('Remaining managed work requires a current assessed next plan and nextStep.');
+      if (acceptanceAuthorityHeld(run) || run.managed.outcomeAudit?.lease ||
+          run.managed.resumeLease && run.managed.resumeLease.id !== expectedLease ||
+          ['pending', 'pending_received', 'transferred'].includes(run.managed.handoff?.status) ||
+          hasPendingUserStop(root, record)) throw new Error('Remaining managed work is held by the existing execution or authority boundary.');
+      repairPlan = assessedPlan(checkpoint.plan, run.managed);
+      const selected = repairPlan.alternatives.find(option => option.id === repairPlan.selectedOptionId);
+      if (selected.action.summary !== nextStep) throw new Error('Remaining work nextStep must match its selected assessed action.');
+    }
     const missingNextStep = checkpoint.status === 'in_progress' && !nextStep;
     if (incompleteResult || (missingNextStep && !run.managed)) {
       effectiveStatus = 'in_progress';
-      nextStep ||= resultFollowThroughInstruction();
+      if (!run.managed) nextStep ||= resultFollowThroughInstruction();
     }
     if (missingNextStep && run.managed) throw new Error('A concrete nextStep is required.');
     if (effectiveStatus === 'completed' && !run.managed && checkpoint.acceptanceMet !== true) throw new Error('Completion requires the requested outcome to be checked (acceptanceMet).');
@@ -1237,6 +1314,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       if (performed) {
         const result = checkpoint.actionResult;
         if (result?.decisionId !== performed.id || !['observed', 'failed', 'not_run'].includes(result?.status) || !text(result.summary, 500)) throw new Error('Checkpoint needs an actionResult bound to the selected decision.');
+        if (managedWorkRemains && result.status !== 'observed') throw new Error('Remaining managed work needs an observed result for the current selected action.');
         actionResult = { decisionId: performed.id, status: result.status, summary: text(result.summary, 300), evidence: Array.isArray(result.evidence) ? result.evidence.map(item => text(item, 300)).filter(Boolean).slice(0, 5) : [], source: 'provider_reported' };
         const capturedAction = expectedLease && ['read','local_edit','local_test'].includes(performed.action.kind) && toolEvidence.some(item => item?.source === 'codex_tool_event' && /^[a-f0-9]{64}$/.test(item.digest || '') && item.kind === 'commandExecution' && item.exitCode === 0 && (!item.status || item.status === 'completed'));
         if (flexibleReasoning(run.managed) && capturedAction) actionResult.observationSource = 'controller_tool_result';
@@ -1379,6 +1457,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       nextStep = run.nextStep;
     }
     run.blockerSource = effectiveStatus === 'blocked' ? 'checkpoint' : null;
+    run.providerRequest = null;
     run.checkpoint = { status: effectiveStatus, summary: text(checkpoint.summary), nextStep,
       blocker: unsupportedWait ? undefined : checkpoint.blocker,
       ...(unsupportedWait ? { reportedBlocker: checkpoint.blocker } : checkpoint.blocker === 'missing_information' ? { question: text(checkpoint.question, 1000) } : {}),
@@ -1415,6 +1494,7 @@ export async function checkpointDelivery({ root = rootDirectory(), provider, ses
       recordHandoffStage(request, run.managed.workHistory?.at(-1)?.result?.status === 'observed' ? 'inspected' : 'inspection_failed', now);
       request.observedAt = now; request.result = run.managed.workHistory?.at(-1)?.result?.status || checkpoint.actionResult.status;
     }
+    diagnoseControllerApproval(record, now);
     await continueResultCycle(record, resultEvent(record, { kind: 'checkpoint', origin: 'checkpointDelivery',
       sourceId: expectedLease || `checkpoint:${run.revision}`, attemptId: expectedLease,
       resultRef: `checkpoint:${run.revision}`, now }));
@@ -1672,8 +1752,8 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
     if (understanding.state === 'clear') {
       run.objective = understanding.objective;
       run.managed.remainingWork = understanding.remaining.join(' ').slice(0, 4000);
-      // User-grounded semantic criteria remain frozen for explicit human
-      // verification; provider-proposed criteria remain interpretation only.
+      // Keep user-grounded conditions for automatic result verification;
+      // provider-proposed criteria remain interpretation only.
       run.managed.acceptanceCriteria = understanding.criteria.filter(item => item.source === 'user_grounded')
         .map(item => ({ id: item.id, description: item.description, check: item.check.type === 'file_equals'
           ? { type: 'file_equals', exactPath: item.check.path, text: item.check.text } : item.check }));
@@ -1684,6 +1764,7 @@ async function checkpointUnderstanding({ root, provider, session, cwd, checkpoin
       recordDecision(run.managed, plan, now);
       run.reason = run.managed.decision.outcome === 'wait' ? run.managed.decision.reason : 'Session goal understood; selected next action awaits the normal dispatch gate.';
       if (run.managed.decision.outcome === 'wait') { run.state = 'blocked'; run.blocker = 'authorization'; escalate(run, run.reason); }
+      diagnoseControllerApproval(record, now);
     } else if (understanding.state === 'already_done') {
       run.objective = understanding.objective;
       run.managed.remainingWork = null;
@@ -1745,9 +1826,12 @@ export async function verifyAutomaticCriteria(record, now) {
       evidence_refs: [`host-check:${managed.taskId}:${criterion.id}:${sha256 || 'failed'}`] };
   };
   const failed = (criterion, detail) => { delete managed.verified[criterion.id]; observe(criterion, false, detail); };
+  const feedbackPending = new Set(pendingAcceptanceFeedback(record.run).map(item => item.criterionId));
   for (const criterion of effectiveAcceptanceCriteria(managed)) {
     if (criterion.check.type === 'manual') {
-      if (managed.verified[criterion.id]?.source !== 'user') delete managed.verified[criterion.id];
+      // Result feedback keeps earlier independent context as evidence while
+      // pendingAcceptance still requires a fresh human decision for this check.
+      if (managed.verified[criterion.id]?.source !== 'user' && !feedbackPending.has(criterion.id)) delete managed.verified[criterion.id];
       continue;
     }
     if (criterion.check.type === 'semantic') continue;
@@ -1792,38 +1876,155 @@ function settleCompletionHandoffs(run, now, review) {
     request.workspaceDigest = review.workspaceDigest;
   }
 }
+// Criterion feedback is a separate control plane from operation approvals.
+// It records human evidence without granting a scope or interrupting a writer.
+const MANUAL_ACCEPTANCE_STATES = new Set(['active', 'auto_resuming', 'verification_pending', 'paused', 'blocked', 'recovery_required']);
+function manualAcceptanceUnavailable(record) {
+  const run = record?.run, m = run?.managed;
+  if (!m) return 'not_managed';
+  if (record.providerArchived) return 'archived';
+  if (!text(run.id, 200) || !text(m.taskId, 200) || !Number.isSafeInteger(deliveryDecisionRevision(run)) || !text(taskDirectory(record), 4000)) return 'identity_unavailable';
+  if (!MANUAL_ACCEPTANCE_STATES.has(run.state)) return 'task_not_open';
+  if (['pending', 'pending_received', 'transferred'].includes(m.handoff?.status)) return 'handoff_locked';
+  if (!m.enrollment || m.enrollment.objective !== run.objective || m.enrollment.acceptanceDigest !== digest(JSON.stringify(m.acceptanceCriteria)) ||
+      JSON.stringify(m.enrollment.deliveryLevel) !== JSON.stringify(m.deliveryLevel || null)) return 'enrollment_changed';
+  return null;
+}
+function acceptanceAuthorityHeld(run) {
+  const m = run.managed;
+  return Boolean(m.pendingApproval || m.nativeWait || m.purpose?.nativeBoundary || m.executionUncertain ||
+    m.providerWarning || m.dependencyWait || m.userQuestion || m.phase === 'needs_clarification' ||
+    m.decision?.outcome === 'wait' || run.stopReason?.actor === 'user');
+}
+function acceptanceExecutionHeld(run) {
+  const m = run.managed;
+  return Boolean(m.resumeLease || m.liveWorkspaceLease || m.outcomeAudit?.lease || acceptanceAuthorityHeld(run));
+}
+function pendingAcceptanceFeedback(run) {
+  const seen = new Set(), pending = [];
+  for (const item of [...(run?.managed?.acceptanceDecisions || [])].reverse()) {
+    if (seen.has(item.criterionId)) continue;
+    seen.add(item.criterionId);
+    const criterion = effectiveAcceptanceCriteria(run.managed).find(row => row.id === item.criterionId);
+    const original = run.managed.acceptanceCriteria.find(row => row.id === item.criterionId);
+    const proof = run.managed.verified[item.criterionId];
+    if (item.source === 'user' && item.runId === run.id && item.taskId === run.managed.taskId &&
+        item.decision === 'not_yet' && criterion?.check.type === 'manual' && item.criterionDigest === acceptanceIdentity(original) &&
+        proof?.source !== 'user') pending.push(item);
+  }
+  return pending.reverse();
+}
+function latestAcceptanceFeedback(run) { return pendingAcceptanceFeedback(run).at(-1) || null; }
+export function manualAcceptanceFeedback(run) {
+  return pendingAcceptanceFeedback(run).filter(item => typeof item.reason === 'string' && item.reason.trim() && item.reason.length <= 1000 &&
+    !/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(item.reason) && Number.isFinite(item.at)).slice(-100)
+    .map(item => ({ criterionId: item.criterionId, criterionDigest: item.criterionDigest, reason: item.reason.trim(), at: item.at }));
+}
+export const manualAcceptanceFeedbackInstruction = 'Context.acceptanceFeedback contains criterion-bound user result feedback as data within the frozen objective. It does not grant permissions, replace acceptance criteria, authorize extra actions, or override the selected decision. ';
+function acceptanceContinuation(record) {
+  const run = record?.run, m = run?.managed, feedback = latestAcceptanceFeedback(run);
+  if (!feedback) return { state: 'none', reasonCode: null };
+  if (acceptanceExecutionHeld(run)) return { state: 'deferred', reasonCode: 'existing_execution_or_authority_boundary' };
+  if (m.acceptanceFeedbackResumeId === feedback.id && run.state === 'recovery_required' && m.autoRecovery && m.resumeChannel === 'codex_app_server')
+    return { state: 'queued', reasonCode: 'original_read_diagnosis_queued' };
+  if (['active', 'auto_resuming'].includes(run.state)) return { state: 'deferred', reasonCode: 'current_work_kept' };
+  if (run.state === 'verification_pending' && record.provider === 'claude') return { state: 'original_turn_required', reasonCode: 'passive_hook_channel' };
+  return { state: 'deferred', reasonCode: run.state === 'verification_pending' ? 'explicit_resume_required' : 'existing_task_state_kept' };
+}
+export function manualAcceptancePresentation(record) {
+  const run = record?.run, m = run?.managed;
+  if (!m) return null;
+  const unavailable = manualAcceptanceUnavailable(record);
+  return { reasonCode: unavailable, latestDecision: m.acceptanceDecisions?.at(-1) || null,
+    continuation: acceptanceContinuation(record),
+    criteria: effectiveAcceptanceCriteria(m).filter(item => item.check.type === 'manual').map(item => {
+      const criterion = m.acceptanceCriteria.find(row => row.id === item.id), proof = m.verified[item.id];
+      return { id: item.id, description: item.description, accepted: proof?.source === 'user',
+        canAccept: !unavailable && proof?.source !== 'user', canNotYet: !unavailable,
+        latestDecision: m.acceptanceDecisions?.findLast(row => row.criterionId === item.id) || null,
+        controls: { provider: record.provider, session: record.session, taskId: m.taskId, expectedRunId: run.id,
+          expectedRevision: deliveryDecisionRevision(run), expectedWorkspace: taskDirectory(record),
+          criterionId: item.id, expectedCriterionDigest: acceptanceIdentity(criterion) } };
+    }) };
+}
+async function applyManualAcceptance(record, criterionId, now, settle, root) {
+  const run = record.run, session = record.session, started = Date.now(), initialNow = now;
+  newVerifiedCriterion(run, criterionId, now);
+  run.managed.verified[criterionId] = { source: 'user', checkedAt: now };
+  recordPurposeProgress(run, now, false);
+  if (settle && searchEnabled(run.managed)) {
+    const review = run.managed.purpose.search?.review;
+    const currentDigest = await workspaceIdentity(taskDirectory(record), root, undefined, { excludedPaths: review?.manifest?.source === 'controller_certified_independent_proposal' ? review.manifest.exclusions.map(row => row.path) : [] }).catch(() => null);
+    now=initialNow+Math.max(0,Date.now()-started);
+    if (review?.source !== 'independent_codex_session' || !review.session || review.session===session || (!review.passed && !review.needsHuman) || !review.workspaceDigest || currentDigest !== review.workspaceDigest || !externalReviewIsCurrent(run.managed,review,now)) {
+      for (const c of run.managed.acceptanceCriteria) if (c.check.type === 'semantic') delete run.managed.verified[c.id];
+      queuePurposeVerification(run, 'Human decision recorded; recheck the changed workspace before completing.', now);
+    }
+  }
+  if (settle && run.state === 'verification_pending' && run.checkpoint?.status === 'completed') {
+    await verifyAutomaticCriteria(record, now);
+    if (!pendingAcceptance(run).length) {
+      const barrier=purposeCompletionBarrier(run);
+      if(barrier) queuePurposeVerification(run, 'Human decision recorded; '+barrier+' Independently reconcile the required operation before completing.', now);
+      else {run.state = 'completed'; run.reason = run.checkpoint.summary; bindControllerCompletion(run, now); settleCompletionHandoffs(run, now, run.managed.purpose?.search?.review || {});}
+    }
+  }
+}
 export async function verifyDelivery({ root = rootDirectory(), provider, session, taskId, criterionId, now = Date.now() }) {
-  const started=Date.now(), initialNow=now;
   return updateRecord(root, provider, session, async record => {
     const run = record?.run;
     if (!run?.managed || run.state !== 'verification_pending') throw new Error('Managed task is not awaiting acceptance verification.');
     if (taskId !== run.managed.taskId) throw new Error('Managed task identity changed; refresh its status.');
-    const criterion = run.managed.acceptanceCriteria.find(item => item.id === criterionId);
+    const criterion = effectiveAcceptanceCriteria(run.managed).find(item => item.id === criterionId);
     if (!criterion || criterion.check.type !== 'manual') throw new Error('Only manual criteria can be verified by the user.');
-    newVerifiedCriterion(run, criterionId, now);
-    run.managed.verified[criterionId] = { source: 'user', checkedAt: now };
-    recordPurposeProgress(run, now, false);
-    if (searchEnabled(run.managed)) {
-      const review = run.managed.purpose.search?.review;
-      const currentDigest = await workspaceIdentity(taskDirectory(record), root, undefined, { excludedPaths: review?.manifest?.source === 'controller_certified_independent_proposal' ? review.manifest.exclusions.map(row => row.path) : [] }).catch(() => null);
-      now=initialNow+Math.max(0,Date.now()-started);
-      if (review?.source !== 'independent_codex_session' || !review.session || review.session===session || (!review.passed && !review.needsHuman) || !review.workspaceDigest || currentDigest !== review.workspaceDigest || !externalReviewIsCurrent(run.managed,review,now)) {
-        for (const c of run.managed.acceptanceCriteria) if (c.check.type === 'semantic') delete run.managed.verified[c.id];
-        queuePurposeVerification(run, 'Human decision recorded; recheck the changed workspace before completing.', now);
-      }
-    }
-    if (run.state === 'verification_pending' && run.checkpoint?.status === 'completed') {
-      await verifyAutomaticCriteria(record, now);
-      if (!pendingAcceptance(run).length) {
-        const barrier=purposeCompletionBarrier(run);
-        if(barrier) queuePurposeVerification(run, 'Human decision recorded; '+barrier+' Independently reconcile the required operation before completing.', now);
-        else {run.state = 'completed'; run.reason = run.checkpoint.summary; bindControllerCompletion(run, now); settleCompletionHandoffs(run, now, run.managed.purpose?.search?.review || {});}
-      }
-    }
-    notifyState(run, now);
-    run.updatedAt = now; return record;
+    await applyManualAcceptance(record, criterionId, now, !acceptanceExecutionHeld(run), root);
+    advanceDeliveryControlRevision(run);
+    notifyState(run, now); run.updatedAt = now; return record;
   });
 }
+export async function decideManualAcceptance({ root = rootDirectory(), provider, session, taskId, expectedRunId, expectedRevision,
+  expectedWorkspace, criterionId, expectedCriterionDigest, decision, reason, authorize, now = Date.now() }) {
+  let updated = await updateRecord(root, provider, session, async record => {
+    if (authorize) await authorize();
+    const run = record?.run, unavailable = manualAcceptanceUnavailable(record);
+    if (unavailable) throw new Error(`Manual acceptance contract is unavailable: ${unavailable}.`);
+    if (taskId !== run.managed.taskId || expectedRunId !== run.id || !Number.isSafeInteger(expectedRevision) ||
+        expectedRevision !== deliveryDecisionRevision(run) || expectedWorkspace !== taskDirectory(record)) throw new Error('This decision changed. Refresh before choosing.');
+    const criterion = run.managed.acceptanceCriteria.find(item => item.id === criterionId);
+    const effective = effectiveAcceptanceCriteria(run.managed).find(item => item.id === criterionId);
+    if (!criterion || effective?.check.type !== 'manual') throw new Error('Only a known manual criterion can receive a user decision.');
+    if (expectedCriterionDigest !== acceptanceIdentity(criterion)) throw new Error('This criterion changed. Refresh before choosing.');
+    if (!['accept', 'not_yet'].includes(decision)) throw new Error('Choose Accept or Not yet.');
+    if (decision === 'not_yet' && (typeof reason !== 'string' || !reason.trim() || reason.length > 1000 || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(reason))) throw new Error('Provide a result feedback reason of 1 to 1000 characters.');
+    if ((run.managed.acceptanceDecisions?.length || 0) >= 100) throw new Error('Acceptance decision history is full; retain and archive its evidence before continuing.');
+    const previous = run.managed.verified[criterionId];
+    if (decision === 'accept' && previous?.source === 'user') throw new Error('This criterion already has verification evidence. Refresh before choosing.');
+    const entry = { id: randomUUID(), source: 'user', decision, criterionId, criterionDigest: expectedCriterionDigest, runId: run.id, taskId,
+      workspace: expectedWorkspace, revision: expectedRevision, at: now, reason: decision === 'not_yet' ? reason.trim() : null,
+      ...(decision === 'not_yet' && previous?.source === 'user' ? { priorUserAttestation: structuredClone(previous) } : {}),
+      ...(decision === 'accept' && previous && previous.source !== 'user' ? { priorIndependentAttestation: structuredClone(previous) } : {}) };
+    run.managed.acceptanceDecisions ||= []; run.managed.acceptanceDecisions.push(entry);
+    if (decision === 'accept') await applyManualAcceptance(record, criterionId, now, run.state === 'verification_pending' && !acceptanceExecutionHeld(run), root);
+    else if (previous?.source === 'user') delete run.managed.verified[criterionId];
+    advanceDeliveryControlRevision(run);
+    notifyState(run, now); run.updatedAt = now;
+    if (authorize) await authorize();
+    return record;
+  });
+  const run = updated.run, m = run.managed;
+  // Not yet authorizes only feedback within the frozen goal. If an already
+  // enrolled original controller can safely inspect it, queue that diagnosis;
+  // otherwise preserve the current work/hold and say what actually happened.
+  if (decision === 'not_yet' && provider === 'codex' && updated.autoContinue === true && automaticContinuationAllowed(updated) &&
+      m.resumeChannel === 'codex_app_server' && canResumePendingVerification(run) && !acceptanceExecutionHeld(run) && !deliveryStopBlocksResume(run, now) &&
+      (await providerLinkState(root, provider)).connected) {
+    try {
+      updated = await controlDelivery({ root, provider, session, taskId, expectedRunId: run.id,
+        expectedRevision: deliveryDecisionRevision(run), action: 'resume', authorize, now });
+    } catch { /* The feedback remains recorded; a changed task is never forced. */ }
+  }
+  return { record: updated, decision: updated.run.managed.acceptanceDecisions.at(-1), continuation: acceptanceContinuation(updated) };
+}
 export function prepareWaitingDiagnosis(run, reason, now) {
   const managed = run.managed, scope = managed.approvalScopes[0];
   if (!scope) throw new Error('Waiting recovery needs an enrolled scope.');
@@ -1893,14 +2094,25 @@ export function canExplicitlyResumeStopped(run) {
     Boolean(run.managed.autonomyPolicy && run.managed.approvalScopes?.length) &&
     !run.managed.resumeLease && !run.managed.liveWorkspaceLease;
 }
+// Acceptance can remain pending while the user asks for more work. Reopening
+// work never verifies a criterion or interrupts an owned review/provider turn.
+export function canResumePendingVerification(run) {
+  const m = run?.managed;
+  return Boolean(run?.state === 'verification_pending' && m?.autonomyPolicy && m.approvalScopes?.length &&
+    !m.resumeLease && !m.liveWorkspaceLease && !m.outcomeAudit?.lease && !m.executionUncertain && !m.nativeWait && !m.providerWarning && !m.purpose?.nativeBoundary);
+}
 // Time spent waiting for a person is not missing work progress. An explicit
 // resume, answer or approval starts a new progress window; failures remain.
 function continueAfterHumanDecision(run, now) {
   const stop = deliveryStop(run, now);
   if ([STOP_CODES.failureLimit, 'purpose_budget'].includes(stop?.code)) throw new Error(stop.reason);
-  if (!run.managed) return;
+  if (run.managed) startProgressWindow(run, now, stop?.code ?? 'human_decision');
+}
+// Starts a recorded no-progress window. Failure counts and verified criteria
+// are never touched; only the time/attempt progress clock restarts.
+function startProgressWindow(run, now, code) {
   run.managed.progressWindowResets = [...(run.managed.progressWindowResets || []),
-    { at: now, code: stop?.code ?? 'human_decision', noProgress: run.managed.noProgress }].slice(-10);
+    { at: now, code, noProgress: run.managed.noProgress ?? 0 }].slice(-10);
   run.managed.noProgress = 0;
   run.managed.outcomeProgress = restartOutcomeProgressWindow(run.managed.outcomeProgress);
   run.managed.lastVerifiedProgressAt = now;
@@ -1940,13 +2152,16 @@ function recordManagedOutcomeProgress(run, now, assessmentAvailable = true) {
   managed.progressCheckpointRevision = run.revision;
 }
 // Manual/legacy runs have no marker and retain their existing controls.
+export const ownerRenewalPending = record => ['awaiting_human', 'prepared', 'gate_committed'].includes(record?.run?.managed?.ownerRenewal?.status);
 export function automaticContinuationAllowed(record) {
+  if (ownerRenewalPending(record) || record?.run?.managed?.ownerRenewal?.needsReadOnlyReassessment === true) return false;
   if (record?.providerArchived === true || record?.run?.managed?.purpose && record.autoContinue === false) return false;
   const epoch = record?.run?.managed?.autoContinueEpoch;
   return !epoch || record.autoContinue === true && record.autoContinueEpoch === epoch;
 }
 
 export function decideStop(run, now = Date.now()) {
+  if (ownerRenewalPending({ run })) return { run, output: {} };
   if (TERMINAL.has(run.state) || ['blocked', 'recovery_required', 'paused', 'verification_pending'].includes(run.state)) return { run, output: {} };
   const next = structuredClone(run);
   const finish = (state, reason) => { next.state = state; next.reason = reason; next.updatedAt = now; return { run: next, output: {} }; };
@@ -1988,7 +2203,9 @@ export function decideStop(run, now = Date.now()) {
   // Keep prior failures until actual fresh work succeeds or another attempt fails.
   if (next.managed?.associationCheckpointRevision !== next.revision && !initialHook && !replanHook && !understandingHook && !approvedHook && !legacyApprovedHook) {
     if (!fresh || cp.status === 'error') next.failures += 1;
-    else next.failures = 0;
+    // Normal observed work may clear consecutive failures under existing policy;
+    // reinterpreting a contradictory completion report is not a new success.
+    else if (!(next.managed && cp?.reportedStatus === 'completed' && cp.remainingWork)) next.failures = 0;
   }
   if (failureLimitReached(next)) return finish('failed', 'Repeated failure or missing progress checkpoint; human review required.');
   if (next.managed) {
@@ -2073,6 +2290,7 @@ export async function processIdentity(pid) {
 // of turn/permission events. Permission and dispatch decisions remain in the loop.
 export async function claudeHookChannel(record, { session, cwd, inspectProcess = processIdentity, platform = process.platform } = {}) {
   const unavailable = (code, reason) => ({ ready: false, code, reason });
+  if (ownerRenewalPending(record)) return unavailable('owner_renewal_pending', 'The original conversation connection recovery is not complete.');
   if (platform === 'win32') return unavailable('platform_unsupported', 'Claude process verification is unavailable on Windows; monitoring remains available.');
   if (!record) return unavailable('hook_missing', 'Waiting for the original Claude hook. SIMY recovers automatically when the next verified prompt or response-end hook arrives. If no notifications arrive, check the SIMY plugin in the original Claude window.');
   if (record.provider !== 'claude' || record.session !== session) return unavailable('session_mismatch', 'The observed hook belongs to a different Claude conversation. Refresh this conversation.');
@@ -2123,6 +2341,81 @@ export function canEmitHookContinuation(root, observed) {
     !['paused', 'blocked', 'recovery_required', 'verification_pending'].includes(latest.run.state) &&
     automaticContinuationAllowed(latest) && !hasPendingUserStop(root, latest));
 }
+// Without a provider turn ID, a nonempty terminal message supplies a stable,
+// conservative event fingerprint. A repeated identical message remains unknown
+// rather than being invented as another turn from a fresh local random UUID.
+function hookTerminalExecutionId(provider, input) {
+  return text(input.turn_id, 200) || (provider === 'claude' && text(input.last_assistant_message, 65536)
+    ? `claude-stop:${digest(JSON.stringify([input.hook_event_name, input.last_assistant_message]))}` : '');
+}
+async function settleOwnedContinuation(root, { provider, input, observedProcess }) {
+  if (input.stop_hook_active !== true || !observedProcess) return null;
+  const record = await read(recordPath(root, provider, input.session_id)), owner = record?.hookSessionProcess;
+  if (!record?.run || owner?.pid !== observedProcess.pid || owner?.identity !== observedProcess.identity) return null;
+  let cwd; try { cwd = await realpath(input.cwd); } catch { return null; }
+  if (cwd !== record.cwd) return null;
+  const executionId = hookTerminalExecutionId(provider, input);
+  try {
+    return settleHookContinuation({ root: rootFromDelivery(root), provider, session: input.session_id, writer: observedProcess,
+      runId: record.run.id, taskId: record.run.managed?.taskId || record.run.id, continuation: record.run.continuations, executionId,
+      status: input.hook_event_name === 'Stop' ? 'completed' : 'failed', response: text(input.last_assistant_message, 65536) });
+  } catch (error) { if (!error?.code) throw error; return null; }
+}
+// Claude Code also submits harness notifications (finished background tasks,
+// side-session or CI events) as prompts, and an empty event carries no human
+// intent. Neither is a reconnect boundary.
+const AUTOMATED_PROMPT = /^<(task-notification|side-sessions-event|ci-monitor-event|system-reminder)\b/;
+const humanPrompt = input => (input.origin?.kind === undefined || input.origin.kind === 'human') &&
+  text(input.prompt) !== '' && !AUTOMATED_PROMPT.test(text(input.prompt));
+// An observation of a replacement writer is not adoption or execution consent.
+// The explicit recovery action separately verifies the transcript's human UUID.
+function observeReplacementWriter(record, { input, event, identity, now, invalidationId, epoch, root }) {
+  if (record.provider !== 'claude' || !record.run?.managed?.liveHookOwner ||
+      record.run.state !== 'paused' || record.autoContinue !== false || !identity?.identity) return;
+  if (event === 'UserPromptSubmit') {
+    if (!humanPrompt(input) || typeof input.prompt !== 'string' || Buffer.byteLength(input.prompt) > MAX_BYTES) {
+      delete record.ownerRenewalCandidate; return;
+    }
+    const request = record.run.managed.ownerRenewal;
+    record.ownerRenewalCandidate = { version: 1, id: randomUUID(),
+      ownerRenewalId: request?.status === 'awaiting_human' ? request.id : null,
+      provider: 'claude', session: record.session, cwd: record.cwd, writer: { ...identity },
+      observedAt: now, promptSHA256: createHash('sha256').update(input.prompt).digest('hex'),
+      promptBytes: Buffer.byteLength(input.prompt), permissionMode: text(input.permission_mode, 64) || null,
+      model: null, moduleDigest: DISPATCH_MODULE_DIGEST, providerEpoch: epoch,
+      generation: readDispatchGate(rootFromDelivery(root)).generation,
+      eventFence: invalidationId };
+  } else if (record.ownerRenewalCandidate) {
+    const candidate = record.ownerRenewalCandidate;
+    if (event === 'Stop' && candidate.writer.pid === identity.pid && candidate.writer.identity === identity.identity)
+      candidate.eventFence = invalidationId;
+    else delete record.ownerRenewalCandidate;
+  }
+}
+// A human prompt in the exact original process is the supported reconnect
+// boundary after recovery advanced the update generation. Autonomous Stop never
+// adopts; a failed check is recorded for the UI and leaves dispatch fenced.
+async function reattachAtUserBoundary(root, { provider, input, observedProcess, now = Date.now() }) {
+  // A disconnected provider link leaves every hook inert, including reconnects.
+  if (!humanPrompt(input) || !(await providerLinkState(root, provider)).connected) return null;
+  const file = recordPath(root, provider, input.session_id);
+  const record = await read(file), owner = record?.hookSessionProcess;
+  let cwd; try { cwd = await realpath(input.cwd); } catch { return null; }
+  if (!record || !observedProcess || record.cwd !== cwd || record.providerArchived === true || hasPendingUserStop(root, record) ||
+      owner?.pid !== observedProcess.pid || owner?.identity !== observedProcess.identity) return null;
+  let outcome;
+  try {
+    const result = reattachHookOwner({ root: rootFromDelivery(root), provider, session: input.session_id, writer: observedProcess,
+      permissionMode: text(input.permission_mode, 64), taskIds: [record.run?.managed?.taskId, record.run?.id].filter(Boolean), observedAt: now });
+    if (!result.reattached) return result;
+    outcome = { state: 'reattached', at: now, fromGeneration: result.fromGeneration, generation: result.generation };
+  } catch (error) {
+    if (!error?.code) throw error;
+    outcome = { state: 'blocked', at: now, code: error.code };
+  }
+  await updateRecord(root, provider, input.session_id, current => current && current.cwd === cwd ? { ...current, writerReconnect: outcome } : current);
+  return outcome;
+}
 export async function handleHook(options) {
   const root = options.root || rootDirectory(), event = options.input?.hook_event_name;
   if (!EVENTS.has(event) || !text(options.input?.session_id) || !text(options.input?.cwd)) return {};
@@ -2138,10 +2431,19 @@ export async function handleHook(options) {
     if (record?.run) atomicSave(stopMarkerPath(root, options.provider, options.input.session_id), { schemaVersion: 1, id: randomUUID(), runId: record.run.id });
   }
   // Stop/permission lifecycle must never wait on the update dispatch lock.
-  if (event !== 'Stop' && event !== 'SessionStart') { const output = await handleHookState({ ...options, root, suppressDispatch: true }); if (options.emit) options.emit(output); return output; }
+  if (event !== 'Stop' && event !== 'SessionStart') {
+    const userBoundary = options.provider === 'claude' && event === 'UserPromptSubmit';
+    const settles = event === 'StopFailure' && options.input.stop_hook_active === true;
+    if ((userBoundary || settles) && options.observedProcess === undefined) options = { ...options, observedProcess: await providerProcess(options.provider) };
+    if (settles) await settleOwnedContinuation(root, options);
+    const output = await handleHookState({ ...options, root, suppressDispatch: true });
+    if (userBoundary) await reattachAtUserBoundary(root, options);
+    if (options.emit) options.emit(output); return output;
+  }
   try {
     const observedProcess = options.observedProcess === undefined ? await providerProcess(options.provider) : options.observedProcess;
     options = { ...options, observedProcess };
+    if (event === 'Stop') await settleOwnedContinuation(root, options);
     const owner = captureHookOwner(rootFromDelivery(root), options.provider, options.input?.session_id, observedProcess);
     let current = await read(recordPath(root, options.provider, options.input.session_id)), pendingOutput;
     return await fenceHook(owner, `${options.provider}:${options.input?.session_id}`, async suppressDispatch => {
@@ -2151,7 +2453,10 @@ export async function handleHook(options) {
       return hasPendingUserStop(root, current) ? {} : output;
     }, options.emit, () => pendingOutput?.decision !== 'block' || canEmitHookContinuation(root, current), () => {
       const taskId = current?.run?.managed?.taskId || current?.run?.id;
-      return taskId ? { taskId, attemptId: (current.run.managed?.executionAttempt?.phase === 'dispatching' ? current.run.managed.executionAttempt.id : null) || `${taskId}:hook:${current.run.continuations}`, provenance: captureDispatchProvenance({ root: owner.root, provider: current.provider, providerSession: current.session, worktree: taskDirectory(current), taskId, recordRef: recordPath(root, current.provider, current.session) }) } : null;
+      return taskId ? { taskId, attemptId: (current.run.managed?.executionAttempt?.phase === 'dispatching' ? current.run.managed.executionAttempt.id : null) || `${taskId}:hook:${current.run.continuations}`,
+        hookBinding: observedProcess ? { version: 1, provider: current.provider, session: current.session, runId: current.run.id, taskId,
+          continuation: current.run.continuations, pid: observedProcess.pid, processIdentity: observedProcess.identity,
+          sourceExecutionId: hookTerminalExecutionId(options.provider, options.input) || null } : null, provenance: captureDispatchProvenance({ root: owner.root, provider: current.provider, providerSession: current.session, worktree: taskDirectory(current), taskId, recordRef: recordPath(root, current.provider, current.session) }) } : null;
     });
   } catch (error) {
     if (error.code !== 'state_busy') throw error;
@@ -2191,6 +2496,8 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       }
     }
     const owner = record.run?.managed?.liveHookOwner || (['ConfigChange', 'PostModelSwitch'].includes(event) ? record.hookSessionProcess : null);
+    if (owner && (!identity || identity.pid !== owner.pid || identity.identity !== owner.identity))
+      observeReplacementWriter(record, { input, event, identity, now, invalidationId, epoch: link.epoch, root });
     if (provider === 'claude' && ['SessionStart', 'UserPromptSubmit', 'Stop', 'StopFailure', 'SessionEnd', 'Interrupt', 'ConfigChange', 'PostModelSwitch'].includes(event) &&
         (!identity || owner && (identity.pid !== owner.pid || identity.identity !== owner.identity))) {
       // An unverified lifecycle event invalidates prior proof without adopting
@@ -2329,6 +2636,8 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
     else if (run.state !== 'paused' && (event === 'PermissionRequest' || event === 'Notification' && ['permission_prompt', 'elicitation_dialog'].includes(input.notification_type))) {
       // A native permission wait is still authoritative while independent
       // acceptance is pending; lifecycle bookkeeping must not hide it.
+      const requestId = text(input.tool_use_id, 200) || (run.state === 'blocked' ? run.providerRequest?.id : null) || randomUUID();
+      run.providerRequest = { id: requestId, kind: event === 'Notification' && input.notification_type === 'elicitation_dialog' ? 'question' : 'approval', source: 'provider_hook', observedAt: now };
       run.state = 'blocked'; run.blocker = 'authorization'; run.reason = 'Resolve the provider approval or input request, then explicitly resume Delivery Loop.';
     }
     else if (['paused', 'verification_pending'].includes(run.state) || run.state === 'blocked' &&
@@ -2503,10 +2812,13 @@ export function deliveryDecisionRevision(run) {
   const revision = run.revision + controls;
   return Number.isSafeInteger(revision) ? revision : undefined;
 }
-export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, expectedRunId, expectedRevision, approvalId, autonomyPolicy, continuationPolicy, questionId, waitId, answer, purposeUpdate, resumeObservation, action, inspectProcess = processIdentity, now = Date.now() }) {
+export async function controlDelivery({ root = rootDirectory(), provider, session, taskId, expectedRunId, expectedRevision, approvalId, autonomyPolicy, continuationPolicy, questionId, waitId, answer, purposeUpdate, resumeObservation, action, authorize, inspectProcess = processIdentity, now = Date.now() }) {
   const updated = await updateRecord(root, provider, session, async record => {
+    if (authorize) await authorize();
     const run = record?.run;
     if (!run) throw new Error('Delivery Loop not found.');
+    if (ownerRenewalPending(record) && !['stop', 'pause'].includes(action))
+      throw Object.assign(new Error('Finish the original conversation connection recovery before changing its controls.'), { code: 'owner_renewal_pending' });
     if ((expectedRunId !== undefined || expectedRevision !== undefined) &&
         (typeof expectedRunId !== 'string' || !expectedRunId || !Number.isSafeInteger(expectedRevision) || expectedRevision < 0 ||
          run.id !== expectedRunId || deliveryDecisionRevision(run) !== expectedRevision)) throw new Error('This decision changed. Refresh before choosing.');
@@ -2521,7 +2833,8 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
     }
     if (['pending', 'pending_received'].includes(run.managed?.handoff?.status)) throw new Error('Task handoff is locked; use delivery handoff_cancel or retry the same target to complete the transfer.');
     if (action !== 'stop' && run.managed?.handoff?.status === 'transferred') throw new Error('Task handoff is locked; continue in the received target session.');
-    const commitControl = () => {
+    const commitControl = async () => {
+      if (authorize) await authorize();
       advanceDeliveryControlRevision(run);
       return record;
     };
@@ -2608,6 +2921,12 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       else { run.state = 'recovery_required'; run.recoveryCause = 'policy_change'; run.reason = 'Policy changed; resume the original conversation for the selected action.'; run.managed.autoRecovery = false; }
     }
     else if (action === 'stop') {
+      if (ownerRenewalPending(record)) {
+        // Explicit Stop ends only the pending binding request, never its audit
+        // history, old unknown attempts or the task's terminal-state contract.
+        Object.assign(run.managed.ownerRenewal, { status: 'cancelled', cancelledAt: now, cancelReason: 'explicit_user_stop' });
+        if (TERMINAL.has(run.state)) return commitControl();
+      }
       if (TERMINAL.has(run.state)) return record;
       run.stopReason = { actor: 'user', code: 'explicit_stop', at: now };
       run.state = 'stopped'; run.reason = 'Stopped by user.';
@@ -2655,12 +2974,14 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       }
     }
     else if (action === 'resume') {
+      run.providerRequest = null;
       const marker = readState(stopMarkerPath(root, provider, session));
       if (marker?.runId === run.id) run.handledStopMarkerId = marker.id;
       const wasStopped = canExplicitlyResumeStopped(run);
+      const wasVerifying = canResumePendingVerification(run);
       if (run.managed?.dependencyWait) throw new Error('Confirm the exact external dependency condition before resuming.');
       if (run.managed?.phase === 'needs_clarification') throw new Error('Answer the current session question before resuming.');
-      if (!['blocked', 'recovery_required', 'paused'].includes(run.state) && !wasStopped) throw new Error('Only a blocked, paused, recoverable, or stopped managed app-server loop without a live lease can resume.');
+      if (!['blocked', 'recovery_required', 'paused'].includes(run.state) && !wasStopped && !wasVerifying) throw new Error('Only a blocked, paused, recoverable, unowned pending-verification task, or stopped managed app-server loop can resume.');
       if (run.managed && run.state === 'blocked' && run.blocker === 'missing_information') {
         prepareWaitingDiagnosis(run, `Inspect the previous information question and current conversation before choosing work: ${text(run.managed.userQuestion, 1000)}. Do not replay the prior action.`, now);
         run.blocker = null;
@@ -2668,6 +2989,16 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
       if (run.managed?.executionUncertain) { prepareRecoveryDiagnosis(run, now); run.blocker = null; }
       if (run.managed?.pendingApproval) throw new Error('Resolve the exact pending approval before resuming.');
       if (run.managed?.autonomyPolicy && run.managed.decision?.outcome === 'wait' && (run.managed.approvedAction?.id !== run.managed.decision.id || run.managed.approvedAction.dispatchedAt)) throw new Error('Selected action requires a fresh scoped user decision.');
+      if (wasVerifying) {
+        run.resumeHistory ||= [];
+        run.resumeHistory.push({ at: now, source: 'explicit_resume', priorState: run.state,
+          reason: run.reason, checkpoint: run.checkpoint ?? null });
+        const feedback = latestAcceptanceFeedback(run);
+        prepareWaitingDiagnosis(run, 'The user requested continued work while acceptance remains pending. Inspect the original goal, current result and remaining next steps. Do not replay prior effects or treat this resume as acceptance.' +
+          (feedback ? ` Criterion-bound user result feedback (does not grant scope or permissions): ${JSON.stringify(manualAcceptanceFeedback(run))}` : ''), now);
+        if (feedback) run.managed.acceptanceFeedbackResumeId = feedback.id;
+        run.blocker = null; run.blockerSource = null;
+      }
       if (wasStopped) {
         const link = await providerLinkState(root, provider);
         if (!link.connected) throw new Error('Restore the existing provider connection before resuming.');
@@ -2704,6 +3035,13 @@ export async function controlDelivery({ root = rootDirectory(), provider, sessio
           // connector permissions or the frozen enrollment authority here.
         }
       }
+      if (run.managed?.ownerRenewal?.needsReadOnlyReassessment) {
+        prepareWaitingDiagnosis(run, 'The original Claude connection was restored. Re-read the latest human request and current constraints in this original conversation before proposing work. Do not replay the historical selected action or perform an implementation when the current request is design-only.', now);
+        run.managed.awaitingReplanHook = true;
+        run.checkpoint = null; run.consumedRevision = run.revision;
+        run.managed.ownerRenewal.needsReadOnlyReassessment = false;
+        run.managed.ownerRenewal.reassessmentDecisionId = run.managed.decision.id;
+      }
       continueAfterHumanDecision(run, now);
       delete run.stopReason;
       if (run.managed?.approvedAction && run.recoveryCause === 'approved_action' && !run.managed.approvedAction.dispatchedAt && run.managed.capability !== 'live_hook' && run.managed.resumeChannel !== 'codex_app_server') {