@awak-app/simy-cli 0.7.50 → 0.7.52

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.50",
+  "version": "0.7.52",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/agent.js

@@ -1,5 +1,6 @@
 import { connectionOverview, readSqmConnectionObservation } from './connection-overview.js';
 import { flushObservability, observeHeartbeat, syncObservabilityConsent } from './cli-observability.js';
+import { syncLoopOutcomes } from './sqm/loop-outcome-outbox.js';
 import { readLocalPhotoSource } from "./local-photos.js";
 import { resolveLocalTaskDestination, saveLocalTaskDestination } from "./local-task-destination.js";
 import { observePairedNativeIdentities } from './native-provider-identity.js';
@@ -964,6 +965,14 @@ export async function startAgent({
             apiBaseUrl: requestedSession.api_base_url,
             token: requestedSession.token,
             fetchImpl: dependencies.fetch || globalThis.fetch,
+          })).catch(() => {}).then(() => syncLoopOutcomes({
+            getSession: () => session,
+            // Content-free Delivery Loop outcomes; queued on failure, never blocks the heartbeat.
+            root: sessionRoot,
+            apiOrigin,
+            apiBaseUrl: requestedSession.api_base_url,
+            token: requestedSession.token,
+            fetchImpl: dependencies.fetch || globalThis.fetch,
           })).catch(() => {});
         }
         // Register the device immediately; provider subprocesses must not delay

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.50";
+export const CLI_VERSION = "0.7.52";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/cli-observability.js

@@ -104,6 +104,20 @@ async function readStore(root) {
 async function saveStore(root, state) { await saveJson(file(root, STORE), state); }
 function status(state) { return { enabled: state.config.enabled === true, conversations: Object.values(state.config.conversations).map(({ provider, session, sequence }) => ({ provider, session, sequence })), queued: state.outbox.events.length }; }
 export async function readObservability(root) { return (await readStore(root)).config; }
+// Bound only when a NEW Loop run is persisted. A later sweep must never assign
+// the currently logged-in organization to historical conversations.
+export async function captureLoopOutcomeScope(root) {
+  const c = await readObservability(root), a = c.actor;
+  if (c.enabled !== true || !validGeneration(c.consentGeneration) || !environmentFromOrigin(a?.origin) ||
+      ![a?.accountId, a?.organizationId, a?.deviceId].every(v => typeof v === 'string' && v.length > 0)) return null;
+  const { readSession, isSessionValid } = await import('./session-store.js');
+  const session = await readSession(a.origin, root);
+  if (!isSessionValid(session, Date.now(), a.origin) || session.account_id !== a.accountId ||
+      session.organization_id !== a.organizationId || session.device_id !== a.deviceId) return null;
+  return { origin: a.origin, accountId: a.accountId, organizationId: a.organizationId,
+    deviceId: a.deviceId, consentGeneration: c.consentGeneration };
+}
+
 export async function observabilityStatus(root) { return status(await readStore(root)); }
 function stateFromRecord(record, now = Date.now()) {
   const raw = record?.run?.state;

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -5,6 +5,7 @@ import { completionContractIdentity } from './purpose-completion-contract.mjs';
 import { captureDispatchProvenance } from './update-dispatch-identity.mjs';
 import { MAX_STATE_BYTES } from './state-limits.mjs';
 import { continueResultCycle, resultEvent, resultFollowThroughInstruction, correctiveFollowupInstruction } from './result-cycle.mjs';
+import { loopStopBefore, recordLoopStop } from './loop-stop-record.mjs';
 import { currentRecoveryIncident, recordRecoveryIncident, recordRecoveryStage, settleRecoveryIncidents, resolveRecoveryReceipt } from './recovery-incident.mjs';
 import { rememberPerspectives, perspectiveScope, recallPerspectives, perspectiveInstruction } from './perspective-memory.mjs';
 import { recordHypothesisSheet } from './hypothesis-sheet.mjs';
@@ -36,7 +37,7 @@ import { minimalSufficientChangeInstruction } from './minimal-sufficient.mjs';
 import { continuationMode } from './continuation-policy.mjs';
 import { evaluateOutcomeProgress, restartOutcomeProgressWindow } from './outcome-progress.mjs';
 import { collectMeasurementTransition, retainMeasurementHookInstruction } from './measurement-collector.mjs';
-import { measurementBinding, appendMeasurement, enrollMeasurementFromPolicy, measurementCollectionEnabled, measurementPolicyEnabled } from './measurement-store.mjs';
+import { measurementBinding, appendMeasurement, enrollMeasurementFromPolicy, measurementCollectionEnabled, measurementPolicyEnabled, measurementPolicyPath } from './measurement-store.mjs';
 const measurementEnabled = async (...args) => {
   try { const binding = await measurementBinding(...args); return Boolean(binding && measurementCollectionEnabled(...args)); }
   catch { console.error('Adoption measurement configuration is unreadable; collection is incomplete.'); return false; }
@@ -292,11 +293,27 @@ export async function updateRecord(root, provider, session, mutate, { inspectPro
     const previous = await applyArchiveFence(root, applyProviderConsent(stored, await providerLinkState(root, provider)));
     const previousBytes = stored === null ? null : JSON.stringify(stored);
     const measurementPriorRunId = previous?.run?.id;
+    const priorOutcomeScope = previous?.run?.outcomeScope ? structuredClone(previous.run.outcomeScope) : null;
     let priorMeasurement, savedMeasurement;
     try { savedMeasurement = await measurementBinding(root, provider, session); priorMeasurement = savedMeasurement && measurementCollectionEnabled(root, provider, session) ? savedMeasurement : null; } catch { /* Collection never blocks task state. */ }
     const measurementPrevious = priorMeasurement ? structuredClone(previous) : null;
     const next = await mutate(previous);
     if (next) {
+      if (next.run?.id && next.run.id !== measurementPriorRunId) {
+        // Fixed at enrollment, under the same record lock; missing provenance
+        // remains null forever for this run, including explicit backfill.
+        const scope = await import('../../../cli-observability.js')
+          .then(({ captureLoopOutcomeScope }) => captureLoopOutcomeScope(dirname(root))).catch(() => null);
+        let policy;
+        try { policy = readState(measurementPolicyPath(root, provider, next.cwd)); } catch { /* Invalid optional consent never blocks task persistence. */ }
+        const enrolled = policy?.enabled === true && policy.source === 'field' && policy.loop === 'on' &&
+          policy.scope?.origin === scope?.origin && policy.scope?.account === scope?.accountId &&
+          policy.scope?.organization === scope?.organizationId && policy.scope?.device === scope?.deviceId;
+        if (scope && enrolled) next.run.outcomeScope = { ...scope, policyKey: basename(measurementPolicyPath(root, provider, next.cwd), '.json'),
+          policyDigest: createHash('sha256').update(JSON.stringify(policy)).digest('hex') }; else delete next.run.outcomeScope;
+      } else if (next.run) {
+        if (priorOutcomeScope) next.run.outcomeScope = priorOutcomeScope; else delete next.run.outcomeScope;
+      }
       // Older file_equals drafts used `path`, which an older verifier could
       // mistake for file_exists. Persist only the distinct exactPath field.
       for (const criterion of next.run?.managed?.acceptanceCriteria || []) {
@@ -2991,10 +3008,12 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
         run.state = 'recovery_required'; run.recoveryCause = 'session_end'; run.reason = 'Provider session ended. Check why it ended before resuming.';
       }
     } else if (event === 'StopFailure') {
+      const stopBefore = loopStopBefore(run);
       run.failures += 1;
       run.state = failureLimitReached(run) ? 'failed' : 'recovery_required'; run.recoveryCause = 'provider_error';
       run.reason = RETRYABLE.has(input.error) ? 'Transient provider error. Resume the existing conversation after the provider recovers.' : 'Provider error requires attention before resuming.';
       run.errorCode = text(input.error, 100); run.retryable = RETRYABLE.has(input.error);
+      recordLoopStop(run, { before: stopBefore, failed: true, source: input.turn_id ? `failure:${input.turn_id}` : null, now });
     } else if (event === 'Stop' && !suppressDispatch) {
       // OFF suppresses future Stop blocking; it never interrupts the provider
       // turn. Lease settlement and runtime observation above still run.
@@ -3008,6 +3027,7 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       // stable event ID; never dedupe on text (identical text can be a new turn).
       const key = input.turn_id ? `${input.turn_id}:${Boolean(input.stop_hook_active)}:${run.revision}` : null;
       if (key && run.lastStopKey === key) return record;
+      const stopBefore = loopStopBefore(run);
       if (run.managed && run.checkpoint?.status === 'completed' && run.revision > run.consumedRevision) {
         await verifyAutomaticCriteria(record, now);
         const pending = pendingAcceptance(run);
@@ -3024,6 +3044,7 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
           run.managed.remainingWork = run.nextStep;
         } else if (pending.length) {
           run.state = 'verification_pending'; run.reason = acceptancePendingReason(run);
+          recordLoopStop(run, { before: stopBefore, source: key, now });
           run.lastStopKey = key; notifyState(run, now); return record;
         }
       }
@@ -3074,6 +3095,7 @@ async function handleHookState({ input, provider, root = rootDirectory(), now =
       }
       decision.run.resultCycle = run.resultCycle;
       record.run = decision.run; output = decision.output;
+      recordLoopStop(record.run, { before: stopBefore, source: key, now });
       if (record.runtime && output.decision === 'block') record.runtime.isRunning = true;
       record.run.lastStopKey = key;
     }

package/src/codex-plugins/simy/hooks/loop-stop-record.mjs

@@ -0,0 +1,66 @@
+import { createHash } from 'node:crypto';
+
+// One bounded, content-free entry per stop the Delivery Loop observes. It is
+// measurement only: it never decides continuation, completion or authority.
+// The kind reads the Loop's own records (fresh checkpoint, wait state, budget
+// transition), never the provider's prose; there is no STATUS: line in a
+// normal conversation.
+export const LOOP_STOP_KINDS = Object.freeze(['claimed_done', 'plan_only', 'question', 'error', 'limit']);
+export const MAX_LOOP_STOPS = 200;
+
+const STOP_LIKE = new Set(['stop', 'final_response', 'failure']);
+
+// Snapshot the run BEFORE the Loop decides on this stop. A checkpoint counts
+// only when the provider submitted it during the turn that just ended.
+export function loopStopBefore(run, { checkpointFresh = Boolean(run?.checkpoint && run.revision > run.consumedRevision) } = {}) {
+  if (!run) return null;
+  const ledger = run.resultCycle;
+  return {
+    state: run.state,
+    checkpoint: checkpointFresh && run.checkpoint ? {
+      status: run.checkpoint.status, reportedStatus: run.checkpoint.reportedStatus, acceptanceMet: run.checkpoint.acceptanceMet,
+    } : null,
+    // A run whose earlier stops were observed before this recorder existed
+    // must not present its next stop as stop #1.
+    priorStops: Boolean(run.lastStopKey || run.continuations > 0 || run.managed?.attempts?.length ||
+      (ledger?.events || []).some(row => STOP_LIKE.has(row.kind)) || (ledger?.stops?.entries || []).length),
+  };
+}
+
+// The Loop's own review: every current acceptance criterion verified. No
+// criteria means it has not judged the stop (null), not that it passed.
+export function loopCriteriaMet(run) {
+  const criteria = run?.managed?.acceptanceCriteria;
+  if (!Array.isArray(criteria) || !criteria.length) return null;
+  const verified = run.managed.verified || {};
+  return criteria.every(item => Object.hasOwn(verified, item?.id));
+}
+
+export function classifyLoopStop({ before, after, failed = false, question = false }) {
+  if (after?.state === 'budget_exhausted' || before?.state === 'active' && after?.state === 'paused') return 'limit';
+  if (failed) return 'error';
+  const checkpoint = before?.checkpoint;
+  if (checkpoint?.status === 'error') return 'error';
+  if (checkpoint?.status === 'completed' || checkpoint?.reportedStatus === 'completed' || checkpoint?.acceptanceMet === true) return 'claimed_done';
+  if (question || checkpoint?.status === 'blocked' || after?.managed?.userQuestion || after?.managed?.plan?.userQuestion ||
+      after?.providerRequest?.kind === 'question') return 'question';
+  return 'plan_only';
+}
+
+// Append one stop to run.resultCycle.stops. `source` (turn id, attempt id)
+// coalesces a re-delivered observation; it is stored only as a short hash.
+export function recordLoopStop(run, { before, failed = false, question = false, source = null, now = Date.now() }) {
+  if (!run || !before) return null;
+  const cycle = run.resultCycle ||= { version: 1, events: [], omitted: 0 };
+  if (cycle.version !== 1) return null;
+  const stops = cycle.stops ||= { version: 1, complete: !before.priorStops, entries: [], omitted: 0 };
+  if (stops.version !== 1 || !Array.isArray(stops.entries)) return null;
+  const ref = source ? createHash('sha256').update(String(source)).digest('hex').slice(0, 16) : null;
+  if (ref && stops.entries.some(entry => entry.ref === ref)) return null;
+  const index = stops.entries.length + stops.omitted + 1;
+  if (stops.entries.length >= MAX_LOOP_STOPS) { stops.omitted++; return null; }
+  const entry = { index, kind: classifyLoopStop({ before, after: run, failed, question }),
+    criteria_met: loopCriteriaMet(run), at: new Date(now).toISOString(), ...(ref ? { ref } : {}) };
+  stops.entries.push(entry);
+  return entry;
+}

package/src/delivery-hooks/supervisor.js

@@ -5,6 +5,7 @@ import { bindCompletionArtifacts } from '../session-supervision/completion-artif
 import { recoveryWorkProposal, admitRecoveryWork } from '../session-supervision/recovery-frontier.js';
 import { safeCheckpointDiagnostic } from './checkpoint-diagnostic.js';
 import { continueResultCycle, resultEvent, executeResultCycle, acceptResultEvent } from '../codex-plugins/simy/hooks/result-cycle.mjs';
+import { loopStopBefore, recordLoopStop } from '../codex-plugins/simy/hooks/loop-stop-record.mjs';
 import { finalResponseRecoveryInstruction } from '../session-supervision/final-response-recovery.js';
 import { measurementBinding, measurementCollectionEnabled } from '../codex-plugins/simy/hooks/measurement-store.mjs';
 import { recordHandoffStage } from '../codex-plugins/simy/hooks/consistency-handoff.mjs';
@@ -596,6 +597,12 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
       if (live.state !== 'auto_resuming') {
         live.updatedAt = Date.now(); notifyState(live, live.updatedAt); return current;
       }
+      // Measurement only: one content-free stop entry per dispatched turn.
+      const stopBefore = !result.busy && dispatched ? loopStopBefore({ ...claimed.run, state: 'active',
+        checkpoint: live.checkpoint, revision: live.revision, consumedRevision: claimed.run.revision }) : null;
+      const recordStop = target => recordLoopStop(target, { before: stopBefore, source: `attempt:${leaseId}`,
+        question: ['provider_question', 'provider_approval'].includes(result.errorCode),
+        failed: (result.code !== 0 || result.cancelled) && !['provider_question', 'provider_approval'].includes(result.errorCode) });
       if (result.busy) {
         if (result.accessDenied && dispatched) {
           // The final guard rejected before the provider call. Keep its one-shot approval unused.
@@ -656,6 +663,7 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
           const pending = live.managed.acceptanceCriteria.filter(item => !Object.hasOwn(live.managed.verified, item.id));
           if (pending.length) {
             live.state = 'verification_pending'; live.reason = `Acceptance verification pending: ${pending.map(item => item.id).join(', ')}`;
+            recordStop(live);
             live.updatedAt = Date.now(); notifyState(live, live.updatedAt); return current;
           }
         }
@@ -669,6 +677,7 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
       if (result.code !== 0) await continueResultCycle(current, resultEvent(current, {
         kind: 'failure', origin: 'executor_result', sourceId: result.providerTurnId || leaseId,
         attemptId: leaseId, resultRef: `attempt:${leaseId}` }));
+      recordStop(current.run);
       current.run.updatedAt = Date.now(); notifyState(current.run, current.run.updatedAt); return current;
     });
     // Settling uncertainty must precede unlocking: otherwise another session

package/src/desktop-host.js

@@ -1267,7 +1267,9 @@ export async function startDesktopHost({ input = process.stdin, output = process
       status.controllerCompletions = retainedCompletions;
       status.controllerEventsVersion = 1;
       status.controllerEvents = preferenceScope ? await notificationJournal.snapshot(preferenceScope) : [];
-      const projection = await actionAssociations.beginProjection?.({ records });
+      const projection = await actionAssociations.beginProjection?.({ records,
+        prioritySessionKeys: statisticsSelection.key ? [statisticsSelection.key] : [],
+        scope: { organizationId: status.access?.organizationId, userId: status.auth?.userId } });
       status.deliveryHooks = await (dependencies.deliveryHookStatus || deliveryHookStatus)({ root: deliveryRoot, records: projection?.records || records }).catch(() => ({ error: "Delivery hook status unavailable", providers: {}, runs: [] }));
       // A full record projection owns this receipt. Connection-only heartbeats
       // replay the cached receipt; they must never mint evidence of a fresh read.

package/src/session-supervision/action-association-host.js

@@ -205,12 +205,14 @@ export function createActionAssociationHost({ root, sessionRoot, webOrigin, api
   return {
     // A projection is private to one desktop frame. Mutations and deadline
     // validation still reread the exact record and current authentication.
-    async beginProjection({ records: suppliedRecords } = {}) {
+    async beginProjection({ records: suppliedRecords, prioritySessionKeys = [], scope } = {}) {
       const authRevision = await current();
       const records = suppliedRecords || await list(root);
       const taskIds = new Set(records.map(record => record.run?.managed?.taskId).filter(Boolean));
       for (const taskId of views.keys()) if (!taskIds.has(taskId)) views.delete(taskId);
-      return { records, authRevision, byKey: new Map(records.map(record => [`${record.provider}:${record.session}`, record])) };
+      const associationNamespace = scope?.organizationId && scope?.userId ? namespaceFor(webOrigin, scope) : null;
+      return { records, authRevision, prioritySessionKeys, associationNamespace,
+        byKey: new Map(records.map(record => [`${record.provider}:${record.session}`, record])) };
     },
     async validateProjection(projection) {
       return !closed && await current() === projection.authRevision;

package/src/session-supervision/association-store.js

@@ -8,6 +8,7 @@ import {
 import { associationRevision } from './action-association.js';
 import { ActionAssociationApiError } from './action-association-api.js';
 import { CANDIDATE_DISPLAY_MS, needsCandidateSearch, hasFreshCandidates } from './association-refresh.js';
+import { liveSessionWindow, supervisedSession } from './discovery-window.js';
 
 const activeConversation = (candidate, record) => !TERMINAL.has(record.run?.state) &&
   (candidate.isRunning !== false || candidate.autoContinue === true || candidate.analysis?.state === 'continue');
@@ -222,16 +223,37 @@ export function createOrdinaryAssociationStore({
         ]),
       );
       const auth = snapshot && Object.hasOwn(snapshot, 'authRevision') ? snapshot.authRevision : await api.authRevision();
+      const selected = new Set(snapshot?.prioritySessionKeys || []);
+      const keyFor = candidate => `${candidate.provider}:${candidate.session}`;
+      const observed = new Set(liveSessionWindow(sessions.filter(candidate => candidate.archived !== true || selected.has(keyFor(candidate))), {
+        priority: candidate => {
+          const record = records.get(keyFor(candidate));
+          // Token renewal changes authRevision without changing the account /
+          // organization namespace. Retain those bound reminders for a fresh
+          // authorized read; another organization's binding is not a watch.
+          const association = record?.actionAssociation;
+          const namespace = snapshot?.associationNamespace;
+          const scopedBinding = auth && association?.binding?.action && (namespace
+            ? association.namespace === namespace : association.authRevision === auth);
+          return selected.has(keyFor(candidate)) || candidate.isRunning === true || candidate.autoContinue === true ||
+            supervisedSession(record) || Boolean(scopedBinding);
+        },
+      }).map(keyFor));
       const taskIds = new Set([...records.values()].map(record => record.run?.managed?.taskId || record.associationTaskId).filter(Boolean));
       for (const taskId of views.keys()) if (!taskIds.has(taskId) && !inFlight.has(taskId)) views.delete(taskId);
       const pending = [];
       for (const candidate of sessions) {
-        let record;
+        const observe = observed.has(keyFor(candidate));
+        let record = records.get(keyFor(candidate));
+        // Complete history is navigation, not a subscription. Do not create
+        // identities or start network discovery for untouched historical rows.
+        if (!observe && !record?.associationTaskId && !record?.run?.managed?.taskId) {
+          candidate.actionAssociation = { status: 'unavailable', binding: null, candidates: [], canCorrect: false, canReadBinding: false };
+          continue;
+        }
         try {
-          record = await ensure(
-            candidate,
-            records.get(`${candidate.provider}:${candidate.session}`) || null,
-          );
+          if (record && record.cwd !== candidate.cwd) throw new ActionAssociationApiError('conflict');
+          if (observe) record = await ensure(candidate, record || null);
         } catch (error) {
           // A stale workspace or unreadable local record affects only this
           // optional association. Never rewrite its identity or stop the host.
@@ -244,9 +266,10 @@ export function createOrdinaryAssociationStore({
         candidate.binding = { ...candidate.binding, taskId };
         if (record.run?.managed) continue;
         const cached = views.get(taskId),
-          context = sessionAssociationContext(candidate),
+          context = observe ? sessionAssociationContext(candidate) : null,
           active = activeConversation(candidate, record);
         if (
+          observe &&
           auth &&
           !closed &&
           !inFlight.has(taskId) &&
@@ -263,7 +286,7 @@ export function createOrdinaryAssociationStore({
         }
         const view = views.get(taskId);
         const bindingSnapshot = view?.auth === auth && auth ? view.snapshot : null;
-        const snapshot = bindingSnapshot?.contextRevision === context.revision && hasFreshCandidates(view, now()) ? bindingSnapshot : null;
+        const snapshot = context && bindingSnapshot?.contextRevision === context.revision && hasFreshCandidates(view, now()) ? bindingSnapshot : null;
         const local = record.actionAssociation;
         const scoped = Boolean(bindingSnapshot && local?.authRevision === auth && local.namespace === view.namespace);
         const newer = scoped &&
@@ -337,17 +360,25 @@ export function createOrdinaryAssociationStore({
     },
     correct(command, candidate) {
       const work = serial.then(async () => {
-        const before = await find(candidate);
+        let before = await find(candidate);
+        const bootstrap = command.action === 'session_action_refresh' && !command.taskId;
+        // A user can explicitly inspect history outside the live window. Only
+        // that read-only refresh may create its previously unreserved identity;
+        // select/unlink still require the exact existing task and revisions.
+        if (bootstrap && !before?.run?.managed) {
+          if (!await api.authRevision()) throw new ActionAssociationApiError('signed_out');
+          before = await ensure(candidate, before || null);
+        }
         if (
           !before ||
-          before.associationTaskId !== command.taskId ||
+          (!bootstrap && before.associationTaskId !== command.taskId) ||
           before.run?.managed
         )
           throw new ActionAssociationApiError('invalid_request');
         const auth = await api.authRevision();
         if (!auth) throw new ActionAssociationApiError('signed_out');
         await sync(candidate, true);
-        const view = views.get(command.taskId);
+        const view = views.get(bootstrap ? before.associationTaskId : command.taskId);
         if (
           !view?.snapshot ||
           view.auth !== auth ||

package/src/sqm/claude-plugin.js

@@ -40,13 +40,17 @@ export async function claudePluginFiles() {
   // Standalone hooks do not ship the CLI capability dependency graph. Freeze the
   // maintained package version into their generated collector instead.
   files.set("hooks/cli-observability.mjs", collector.replace("./web-api.js", "./web-api.mjs")
-    .replace("import { CLI_VERSION } from './cli-contract.js';", `const CLI_VERSION = ${JSON.stringify(packageInfo.version)};`));
+    .replace("import { CLI_VERSION } from './cli-contract.js';", `const CLI_VERSION = ${JSON.stringify(packageInfo.version)};`)
+    .replace("'./session-store.js'", "'./session-store.mjs'"));
+  files.set("hooks/session-store.mjs", (await readFile(new URL("../session-store.js", import.meta.url), "utf8"))
+    .replace('"./web-origin.js"', '"./web-origin.mjs"'));
+  files.set("hooks/web-origin.mjs", await readFile(new URL("../web-origin.js", import.meta.url), "utf8"));
   files.set("hooks/web-api.mjs", await readFile(new URL("../web-api.js", import.meta.url), "utf8"));
   const deliveryLoop = await readFile(path.join(SOURCE, "hooks/delivery-loop.mjs"), "utf8");
   files.set("hooks/delivery-loop.mjs", deliveryLoop.replace(
     "const observeDeliveryRecord = (...args) => import('../../../cli-observability.js')\n  .then(({ observeDeliveryRecord: observe }) => observe(...args)).catch(() => false);",
     "import { observeDeliveryRecord } from './cli-observability.mjs';",
-  ));
+  ).replaceAll("'../../../cli-observability.js'", "'./cli-observability.mjs'"));
   files.set("hooks/recovery-incident.mjs", await readFile(path.join(SOURCE, "hooks/recovery-incident.mjs"), "utf8"));
   files.set("hooks/minimal-sufficient.mjs", await readFile(path.join(SOURCE, "hooks/minimal-sufficient.mjs"), "utf8"));
   files.set("hooks/outcome-progress.mjs", await readFile(path.join(SOURCE, "hooks/outcome-progress.mjs"), "utf8"));
@@ -63,6 +67,7 @@ export async function claudePluginFiles() {
   files.set("hooks/purpose-evidence.mjs", await readFile(path.join(SOURCE, "hooks/purpose-evidence.mjs"), "utf8"));
   files.set("hooks/user-experience.mjs", await readFile(path.join(SOURCE, "hooks/user-experience.mjs"), "utf8"));
   files.set("hooks/result-cycle.mjs", await readFile(path.join(SOURCE, "hooks/result-cycle.mjs"), "utf8"));
+  files.set("hooks/loop-stop-record.mjs", await readFile(path.join(SOURCE, "hooks/loop-stop-record.mjs"), "utf8"));
   for (const name of ['measurement-contract', 'measurement-store', 'measurement-snapshot', 'measurement-judge', 'measurement-collector'])
     files.set(`hooks/${name}.mjs`, await readFile(path.join(SOURCE, `hooks/${name}.mjs`), 'utf8'));
   files.set("hooks/scene-reasoning.mjs", await readFile(path.join(SOURCE, "hooks/scene-reasoning.mjs"), "utf8"));

package/src/sqm/command.js

@@ -1,6 +1,7 @@
 import { loadHypothesisKnowledge } from './hypothesis-knowledge.js';
 import { verifyLocalTestArtifacts } from './local-tests.js';
 import { sqmConversationIdentity } from './conversation-identity.js';
+import { recordLoopSqmProof, resolveLoopConversationBinding } from './loop-conversation.js';
 import { safeSqmDiagnostic } from "./diagnostics.js";
 import { createSqmHistoryStore, createSqmCheckRecorder } from "./history-store.js";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
@@ -20,6 +21,7 @@ import { ensureSqmSession, sqmSessionScope } from "./session.js";
 import { formatSqmCoverage } from "./report.js";
 import { sqmDiagnostic } from "./request-recovery.js";
 import { withSemanticCancellation } from "./reasoned-assessment.js";
+import { runSqmLoopOutcomeCommand } from "./loop-outcome-command.js";
 
 export async function runSqmCommand(argv, options) {
   try {
@@ -32,6 +34,7 @@ export async function runSqmCommand(argv, options) {
 }
 
 async function runSqmCommandWithSignal(argv, { cliVersion, signal, knowledgeLoader = loadHypothesisKnowledge }) {
+  if (argv[0] === "effect" && argv[1] === "backfill") return await runSqmLoopOutcomeCommand(argv.slice(1));
   if (argv.includes("--help") || argv.includes("-h") || !argv.length) {
     printHelp();
     return 0;
@@ -203,7 +206,10 @@ async function runSqmCommandWithSignal(argv, { cliVersion, signal, knowledgeLoad
     }
     if (minCheck.status === "unavailable") { await save(minCheck); return printUnavailable(minCheck, argv); }
     stage = "full_check";
-    const fullOptions = { ...common, minCheck, deviceId, signingKeyPath: option(argv, "--signing-key") || undefined };
+    // Bound only while this exact conversation has an open Delivery Loop run.
+    const loopBinding = await resolveLoopConversationBinding({ provider: conversationProvider, session: providerSession });
+    const fullOptions = { ...common, minCheck, deviceId, signingKeyPath: option(argv, "--signing-key") || undefined,
+      conversationRef: loopBinding?.conversationRef ?? null };
     const full = semanticProvider || common.localTests
       ? await withSemanticCancellation(signal => runSqmCheck({ ...fullOptions, signal }), { signal: common.signal })
       : await runSqmCheck(fullOptions);
@@ -227,6 +233,10 @@ async function runSqmCommandWithSignal(argv, { cliVersion, signal, knowledgeLoad
         matcher_diagnostics: result.matcher_diagnostics,
       }),
     ]);
+    if (loopBinding) {
+      try { result.loop_conversation = { recorded: await recordLoopSqmProof(loopBinding, result.proof.proof_id) }; }
+      catch { result.loop_conversation = { recorded: false, warning: "loop_record_update_failed" }; }
+    }
     let upload = { uploaded: false, reason: "disabled" };
     if (!argv.includes("--no-upload")) {
       const evidenceEndpoint = process.env.SIMY_SQM_EVIDENCE_URL || (validSession?.api_base_url ? new URL("sqm/run-evidence", validSession.api_base_url).href : undefined);
@@ -290,6 +300,7 @@ function printHelp() {
   simy sqm lint --bundle <path>
   simy sqm replay --bundle <path> --dataset <path>
   simy sqm knowledge --query <mechanism> [--offset <number>] [--offline] [--host <origin>] --json
+  simy sqm effect backfill [--dry-run] [--json] [--host <origin>]
 
 knowledge searches the verified scoped catalog using existing authorization only;
 it never opens sign-in, runs checks or certifies the candidate. Use nextOffset
@@ -304,6 +315,8 @@ Two-stage SQM flow:
              checks. Saves the storage acknowledgement beside the proof.
   lint       Report broad matchers and missing evaluation gates before publish.
   replay     Evaluate a bundle against labelled historical repository snapshots.
+  effect     backfill sends content-free Delivery Loop outcomes for the Quality
+             Monitor "Adoption effect" page (see "simy sqm effect backfill --help").
 
 Options:
   --base <branch>             Compare against this base branch (default: dev)

package/src/sqm/index.js

@@ -182,7 +182,7 @@ export async function runSqmCheck(options) {
     throw candidateError("Repository identity changed during SQM full verification; no current proof can be signed.");
   }
   options.signal?.throwIfAborted();
-  const result = await buildFullCheck({ repository: context.repository, bundle: context.loaded.bundle, minCheck, evaluation, organizationId: options.organizationId, cliVersion: options.cliVersion, deviceId: options.deviceId, accountId: options.accountId, signingKeyPath: options.signingKeyPath, createSigningKey: options.createSigningKey });
+  const result = await buildFullCheck({ repository: context.repository, bundle: context.loaded.bundle, minCheck, evaluation, organizationId: options.organizationId, cliVersion: options.cliVersion, deviceId: options.deviceId, accountId: options.accountId, signingKeyPath: options.signingKeyPath, createSigningKey: options.createSigningKey, conversationRef: options.conversationRef ?? null });
   options.signal?.throwIfAborted();
   if (minCheck !== options.minCheck) result.recovery = { code: "knowledge_bundle_changed", previous_min_digest: options.minCheck.result_digest, current_min_digest: minCheck.result_digest };
   return result;
@@ -237,8 +237,8 @@ async function buildMinCheck({ repository, bundle, evaluation, organizationId, c
   });
 }
 
-async function buildFullCheck({ repository, bundle, minCheck, evaluation, organizationId, cliVersion, deviceId, accountId, signingKeyPath, createSigningKey }) {
-  const proof = buildProof({ organizationId, repository, bundle, minCheck, evaluation, findings: evaluation.findings, cliVersion });
+async function buildFullCheck({ repository, bundle, minCheck, evaluation, organizationId, cliVersion, deviceId, accountId, signingKeyPath, createSigningKey, conversationRef = null }) {
+  const proof = buildProof({ organizationId, repository, bundle, minCheck, evaluation, findings: evaluation.findings, cliVersion, conversationRef });
   const signedEvidence = await signProof(proof, { deviceId, accountId, keyPath: signingKeyPath, createSigningKey });
   const verification = verifySignedEvidence(proof, signedEvidence);
   return {

package/src/sqm/loop-conversation.js

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+
+import { readRecord, rootDirectory, updateRecord } from "../codex-plugins/simy/hooks/delivery-loop.mjs";
+
+// Binds an SQM full check to the Delivery Loop conversation it ran in, without
+// sending conversation content: only `sha256(provider + ":" + session)` leaves
+// the device (contract sqm_loop_outcome.v1 / proof.provenance.conversation_ref).
+export const SQM_LOOP_PROOF_ID_LIMIT = 50;
+export const CONVERSATION_REF = /^sha256:[0-9a-f]{64}$/;
+const PROOF_ID = /^SQM-PROOF-[0-9a-f-]{36}$/i;
+const OPEN_STATES = new Set(["active", "paused", "blocked", "recovery_required", "auto_resuming", "verification_pending"]);
+const PROVIDERS = new Set(["codex", "claude"]);
+
+export function sqmConversationRef(provider, session) {
+  if (!PROVIDERS.has(provider) || typeof session !== "string" || !session) throw new Error("A provider and exact session ID are required.");
+  return `sha256:${createHash("sha256").update(`${provider}:${session}`, "utf8").digest("hex")}`;
+}
+
+// Only a conversation whose Delivery Loop run is still open is Loop-managed.
+// Standalone checks, unknown conversations and finished runs get no binding.
+export function loopConversationBinding(record) {
+  const run = record?.run;
+  if (!run || typeof run.id !== "string" || !run.id || !OPEN_STATES.has(run.state)) return null;
+  if (!PROVIDERS.has(record.provider) || typeof record.session !== "string") return null;
+  return { provider: record.provider, session: record.session, runId: run.id, conversationRef: sqmConversationRef(record.provider, record.session) };
+}
+
+export async function resolveLoopConversationBinding({ provider, session, root = rootDirectory(), readRecordImpl = readRecord } = {}) {
+  if (!PROVIDERS.has(provider) || typeof session !== "string" || !session) return null;
+  try { return loopConversationBinding(await readRecordImpl(root, provider, session)); }
+  catch { return null; } // An unreadable loop record never blocks or tags a check.
+}
+
+// Appends a signed proof ID to the same Loop run that was bound when the proof
+// was built. A run that ended or was replaced meanwhile is left unchanged.
+export async function recordLoopSqmProof(binding, proofId, { root = rootDirectory(), updateRecordImpl = updateRecord } = {}) {
+  if (!binding?.runId || !PROOF_ID.test(proofId || "")) return false;
+  let recorded = false;
+  await updateRecordImpl(root, binding.provider, binding.session, record => {
+    if (!record?.run || record.run.id !== binding.runId || !OPEN_STATES.has(record.run.state)) return record;
+    const current = loopSqmProofIds(record);
+    if (!current.includes(proofId)) record.run.sqmProofIds = [...current, proofId].slice(-SQM_LOOP_PROOF_ID_LIMIT);
+    recorded = true;
+    return record;
+  });
+  return recorded;
+}
+
+// Read side for sqm_loop_outcome.v1.sqm_proof_ids: valid, unique, at most 50,
+// oldest first. Returns [] for records without Loop-bound SQM proofs.
+export function loopSqmProofIds(record) {
+  const ids = Array.isArray(record?.run?.sqmProofIds) ? record.run.sqmProofIds : [];
+  return [...new Set(ids.filter(id => typeof id === "string" && PROOF_ID.test(id)))].slice(-SQM_LOOP_PROOF_ID_LIMIT);
+}

package/src/sqm/loop-outcome-command.js

@@ -0,0 +1,74 @@
+// `simy sqm effect backfill`: send one content-free `sqm_loop_outcome.v1`
+// record for every local Delivery Loop conversation. Past runs have no stop
+// record, so they go as stops_recorded:false with no stops.
+import { defaultSessionRoot, isSessionValid, readSession } from "../session-store.js";
+import { resolveWebOrigin } from "../web-origin.js";
+import { buildLoopOutcomeRecord, summarizeLoopOutcomes } from "./loop-outcome.js";
+import { syncLoopOutcomes } from "./loop-outcome-outbox.js";
+
+export function printLoopOutcomeHelp(logger = console) {
+  logger.log(`Usage:
+  simy sqm effect backfill [--dry-run] [--json] [--host <origin>]
+
+backfill reads this machine's Delivery Loop records and sends one record per
+conversation the Loop ran in: provider, outcome, Loop-added turns, tokens and
+timestamps. Conversation text, titles, folders and objectives are never sent;
+the conversation is identified only by a one-way hash. Conversations from
+before stop recording send no stop list. --dry-run prints the counts and sends
+nothing. Sending needs this device's CLI observability consent; without it the
+client sends nothing. Unbound historical runs are never assigned to the current
+organization. Failed sends stay
+queued and the running SIMY agent retries them.`);
+}
+
+async function listEntries(root) {
+  const { listRecords } = await import("../codex-plugins/simy/hooks/delivery-loop.mjs");
+  return listRecords(`${root}/delivery-hooks`);
+}
+
+export async function runSqmLoopOutcomeCommand(argv, { fetchImpl = globalThis.fetch, logger = console, root = defaultSessionRoot(),
+  now = Date.now(), entries, session: providedSession } = {}) {
+  const [action, ...rest] = argv;
+  if (action !== "backfill" || rest.includes("--help")) { printLoopOutcomeHelp(logger); return action === "backfill" ? 0 : 2; }
+  const json = rest.includes("--json"), dryRun = rest.includes("--dry-run");
+  const host = rest.includes("--host") ? rest[rest.indexOf("--host") + 1] : undefined;
+  const all = entries || await listEntries(root);
+  const records = [], sources = [], skipped = {};
+  for (const entry of all) {
+    const built = buildLoopOutcomeRecord(entry, { now });
+    if (built.record) { records.push(built.record); sources.push(entry); }
+    else if (built.skipped !== "no_run") skipped[built.skipped] = (skipped[built.skipped] || 0) + 1;
+  }
+  const summary = { dry_run: dryRun, delivery_records: all.length, ...summarizeLoopOutcomes(records, skipped) };
+  if (dryRun) {
+    logger.log(json ? JSON.stringify(summary, null, 2) : formatSummary(summary, "Read"));
+    return 0;
+  }
+  const webOrigin = resolveWebOrigin(host);
+  let session = providedSession ?? await readSession(webOrigin, root);
+  if (!providedSession && !isSessionValid(session, now, webOrigin)) session = null;
+  if (!session?.token) throw new Error(`Sending needs an organization-bound SIMY session. Run \`simy --host ${webOrigin}\` once, then retry.`);
+  const result = await syncLoopOutcomes({ root, apiOrigin: webOrigin, apiBaseUrl: session.api_base_url,
+    token: session.token, fetchImpl, now, entries: sources, minIntervalMs: 0,
+    ...(providedSession ? { getSession: () => providedSession } : {}) });
+  const failed = Boolean(result.failure);
+  const output = { ...summary, sent: result };
+  if (json) logger.log(JSON.stringify(output, null, 2));
+  else {
+    logger.log(formatSummary(summary, "Read"));
+    logger.log(result.skipped ? `Not sent: ${result.skipped}.`
+      : `Stored: ${result.sent} proven-scope record(s); ${result.pending} queued; ${result.unproven} lack matching enrollment provenance${result.failure ? ` (${result.failure})` : ""}.`);
+  }
+  return failed ? 1 : 0;
+}
+
+function formatSummary(summary, verb) {
+  const states = Object.entries(summary.final_states).filter(([, n]) => n).map(([state, n]) => `${state} ${n}`).join(", ") || "none";
+  const skipped = Object.entries(summary.skipped).map(([reason, n]) => `${reason} ${n}`).join(", ");
+  return [`${verb} ${summary.conversations} Delivery Loop conversation(s) from ${summary.delivery_records} local record(s)${summary.dry_run ? "; nothing was sent (--dry-run)" : ""}.`,
+    `  provider: codex ${summary.providers.codex}, claude ${summary.providers.claude}`,
+    `  outcome: ${states}`,
+    `  Loop-added turns: ${summary.continuations_total}; tokens known for ${summary.tokens_known} (total ${summary.tokens_total})`,
+    `  with stop record: ${summary.stops_recorded}`,
+    ...(skipped ? [`  not sent: ${skipped}`] : [])].join("\n");
+}

package/src/sqm/loop-outcome-outbox.js

@@ -0,0 +1,221 @@
+// Local queue for `sqm_loop_outcome.v1` records (contract 8.1/8.2). The agent
+// sweeps delivery records on its authenticated heartbeat, queues one record
+// per conversation when it ends or reaches a milestone, and drains the queue
+// with backoff. Network I/O never runs inside a delivery-state update, and a
+// missing route (404 before the web relay ships) only leaves records queued.
+import { createHash } from "node:crypto";
+import { isSessionValid } from "../session-store.js";
+import { captureLoopOutcomeScope } from "../cli-observability.js";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+
+import { acquireLock, atomicSave, readState } from "../codex-plugins/simy/hooks/update-state-store.mjs";
+import { webApiHeaders, webApiUrl } from "../web-api.js";
+import { buildLoopOutcomeRecord, loopOutcomeDigest, loopOutcomeReceiptProblem, loopOutcomeRecordProblem } from "./loop-outcome.js";
+
+export const LOOP_OUTCOME_OUTBOX = "sqm-loop-outcome-outbox.json";
+export const LOOP_OUTCOME_ROUTE = "sqm/loop-outcome";
+export const ACTIVE_RECORD_INTERVAL_MS = 10 * 60_000;
+export const CONSENT_RECHECK_MS = 6 * 60 * 60_000;
+// The heartbeat runs every 20s; reading every delivery record is not free.
+export const SWEEP_INTERVAL_MS = 5 * 60_000;
+const MAX_FLUSH = 25;
+const MAX_PENDING = 1000;
+const MAX_BACKOFF_MS = 60 * 60_000;
+
+// Keep legacy queues untouched. Each proven enrollment scope has an isolated
+// retry ledger; switching organization or consent generation cannot drain it.
+export const sameLoopOutcomeScope = (a, b) => a && b &&
+  ["origin", "accountId", "organizationId", "deviceId", "consentGeneration"].every(k =>
+    typeof a[k] === "string" && a[k].length > 0 && a[k] === b[k]);
+export function loopOutcomeScopeRoot(root, scope) {
+  if (!sameLoopOutcomeScope(scope, scope)) throw new Error("Loop outcome scope is unproven.");
+  const key = [scope.origin, scope.accountId, scope.organizationId, scope.deviceId, scope.consentGeneration];
+  return path.join(root, "sqm-loop-outcomes", createHash("sha256").update(JSON.stringify(key)).digest("hex"));
+}
+
+export function loopOutcomeCollectionCurrent(root, binding) {
+  if (!/^[a-f0-9]{64}$/.test(binding?.policyKey || "") || !/^[a-f0-9]{64}$/.test(binding?.policyDigest || "")) return false;
+  try {
+    const policy = readState(path.join(root, "delivery-hooks", "measurement-policies", binding.policyKey + ".json"));
+    return policy?.enabled === true && policy.source === "field" && policy.loop === "on" &&
+      createHash("sha256").update(JSON.stringify(policy)).digest("hex") === binding.policyDigest;
+  } catch { return false; }
+}
+
+const blank = () => ({ schemaVersion: 1, conversations: {}, pending: {}, retry: { attempts: 0, at: 0 }, consentBlockedUntil: 0 });
+
+export async function readLoopOutcomeOutbox(root) {
+  try {
+    const state = JSON.parse(await readFile(path.join(root, LOOP_OUTCOME_OUTBOX), "utf8"));
+    if (state?.schemaVersion === 1 && state.conversations && state.pending && state.retry) return state;
+  } catch { /* missing or unreadable: start over; records are re-derived from delivery state */ }
+  return blank();
+}
+
+async function saveOutbox(root, state) {
+  atomicSave(path.join(root, LOOP_OUTCOME_OUTBOX), state);
+}
+
+// Reuse the existing exclusive-owner/atomic-save protocol. Retry policy stays
+// local to this async queue; crashed locks are never stolen by elapsed time.
+async function withOutboxLock(root, operation) {
+  let release;
+  for (let attempt = 0; ; attempt++) {
+    try { release = acquireLock(path.join(root, LOOP_OUTCOME_OUTBOX)); break; }
+    catch (error) {
+      if (error.code !== "state_busy" || attempt >= 120) throw error;
+      await new Promise(resolve => setTimeout(resolve, 10));
+    }
+  }
+  try { return await operation(); }
+  finally { release(); }
+}
+
+async function defaultEntries(root) {
+  const { listRecords } = await import("../codex-plugins/simy/hooks/delivery-loop.mjs");
+  return listRecords(path.join(root, "delivery-hooks"));
+}
+
+const milestone = (record, entry) =>
+  `${record.final_state}:${entry.run?.resultCycle?.stops?.entries?.length || 0}:${record.continuations}`;
+
+// Queue changed conversations. An active run is queued at a milestone (new
+// stop, state or turn) at most once per ACTIVE_RECORD_INTERVAL_MS; an ended
+// run is queued whenever its outcome changes.
+export async function collectLoopOutcomes(options = {}) {
+  if (!sameLoopOutcomeScope(options.scope, options.scope)) return { queued: 0, pending: 0, skipped: "unproven_scope" };
+  const storageRoot = loopOutcomeScopeRoot(options.root, options.scope);
+  return withOutboxLock(storageRoot, () => collectLoopOutcomesLocked({ ...options, storageRoot }));
+}
+
+async function collectLoopOutcomesLocked({ root, storageRoot, scope, now = Date.now(), entries, minIntervalMs = 0 }) {
+  const state = await readLoopOutcomeOutbox(storageRoot);
+  if (state.consentBlockedUntil > now) return { queued: 0, pending: Object.keys(state.pending).length, consentRequired: true };
+  if (minIntervalMs && Number.isFinite(state.sweptAt) && now - state.sweptAt < minIntervalMs) return { queued: 0, pending: Object.keys(state.pending).length, deferred: true };
+  let queued = 0, unproven = 0;
+  for (const entry of entries || await defaultEntries(root)) {
+    if (!sameLoopOutcomeScope(entry.run?.outcomeScope, scope) || !loopOutcomeCollectionCurrent(root, entry.run?.outcomeScope)) { unproven++; continue; }
+    const { record } = buildLoopOutcomeRecord(entry, { now });
+    if (!record) continue;
+    const ref = record.conversation_ref, previous = state.conversations[ref];
+    const digest = loopOutcomeDigest(record), mark = milestone(record, entry);
+    if (previous?.digest === digest) continue;
+    if (record.final_state === "active" && previous &&
+        (previous.milestone === mark || now - previous.enqueuedAt < ACTIVE_RECORD_INTERVAL_MS)) continue;
+    state.conversations[ref] = { collection: { policyKey: entry.run.outcomeScope.policyKey, policyDigest: entry.run.outcomeScope.policyDigest }, digest, milestone: mark, enqueuedAt: now, sentAt: previous?.sentAt || null };
+    state.pending[ref] = record;
+    queued++;
+  }
+  const refs = Object.keys(state.pending);
+  if (refs.length > MAX_PENDING) {
+    refs.sort((a, b) => Date.parse(state.pending[a].recorded_at) - Date.parse(state.pending[b].recorded_at));
+    for (const ref of refs.slice(0, refs.length - MAX_PENDING)) { delete state.pending[ref]; delete state.conversations[ref]; }
+  }
+  state.sweptAt = now;
+  if (queued || minIntervalMs) await saveOutbox(storageRoot, state);
+  return { queued, pending: Object.keys(state.pending).length, unproven };
+}
+
+// One POST. Returns stored | consent_required | rejected | failed; never throws.
+export async function sendLoopOutcome({ endpoint, token, record, consentGeneration, fetchImpl = globalThis.fetch }) {
+  const problem = loopOutcomeRecordProblem(record);
+  if (problem) return { status: "rejected", problem };
+  let response;
+  try {
+    response = await fetchImpl(endpoint, { method: "POST",
+      headers: webApiHeaders({ token }, { accept: "application/json", "content-type": "application/json", ...(consentGeneration ? { "x-simy-consent-generation": consentGeneration } : {}) }),
+      body: JSON.stringify(record), signal: AbortSignal.timeout(10_000) });
+  } catch (error) {
+    return { status: "failed", problem: "network", detail: error?.name || "error" };
+  }
+  const body = await response.json().catch(() => null);
+  if (response.status === 403 && (body?.error === "consent_required" || body?.error?.code === "consent_required" || body?.code === "consent_required")) {
+    return { status: "consent_required" };
+  }
+  if ([400, 409, 422].includes(response.status)) return { status: "rejected", problem: `http_${response.status}` };
+  if (!response.ok) return { status: "failed", problem: `http_${response.status}` };
+  const receiptProblem = loopOutcomeReceiptProblem(response.status, body);
+  if (receiptProblem) return { status: "failed", problem: `receipt_${receiptProblem}` };
+  return { status: "stored", created: body.created, outcome_id: body.outcome_id };
+}
+
+export async function flushLoopOutcomes({ root, scope, authorize, fetchImpl = globalThis.fetch, now = Date.now() }) {
+  if (!sameLoopOutcomeScope(scope, scope) || typeof authorize !== "function") return { sent: 0, skipped: "unproven_scope" };
+  const storageRoot = loopOutcomeScopeRoot(root, scope);
+  const initial = await readLoopOutcomeOutbox(storageRoot);
+  if (initial.retry.at > now || initial.consentBlockedUntil > now) return { sent: 0, pending: Object.keys(initial.pending).length, deferred: true };
+  const batch = Object.values(initial.pending)
+    .sort((a, b) => Date.parse(a.recorded_at) - Date.parse(b.recorded_at)).slice(0, MAX_FLUSH);
+  if (!batch.length) return { sent: 0, pending: 0 };
+  const results = [];
+  for (const record of batch) {
+    // Resolve current credentials and consent immediately before EACH send.
+    // A changed login/organization/generation leaves this partition untouched.
+    if (!loopOutcomeCollectionCurrent(root, initial.conversations[record.conversation_ref]?.collection)) continue;
+    const auth = await authorize();
+    if (!auth?.token || !sameLoopOutcomeScope(auth.scope, scope)) break;
+    const result = await sendLoopOutcome({ endpoint: auth.endpoint, token: auth.token, record, consentGeneration: scope.consentGeneration, fetchImpl });
+    results.push([record, result]);
+    if (result.status === "failed" || result.status === "consent_required") break;
+  }
+  // Keep network I/O outside the lock. Reconcile under the same lock as sweeps
+  // so another collector cannot overwrite the freshly read state before save.
+  return withOutboxLock(storageRoot, () => applyFlushResults(storageRoot, results, now));
+}
+
+async function applyFlushResults(root, results, now) {
+  const state = await readLoopOutcomeOutbox(root);
+  let sent = 0, failure = null;
+  for (const [record, result] of results) {
+    const ref = record.conversation_ref, current = state.pending[ref];
+    const same = current && loopOutcomeDigest(current) === loopOutcomeDigest(record);
+    if (result.status === "stored") {
+      sent++;
+      if (same) delete state.pending[ref];
+      if (state.conversations[ref]) state.conversations[ref].sentAt = now;
+    } else if (result.status === "rejected") {
+      if (same) delete state.pending[ref];
+    } else if (result.status === "consent_required") {
+      // Quietly stop without erasing the original scope's pending evidence.
+      // A new consent generation uses a different partition and cannot replay it.
+      state.consentBlockedUntil = now + CONSENT_RECHECK_MS;
+      failure = "consent_required";
+    } else {
+      failure = result.problem;
+    }
+  }
+  if (failure && failure !== "consent_required") {
+    state.retry = { attempts: state.retry.attempts + 1, at: now + Math.min(MAX_BACKOFF_MS, 30_000 * 2 ** state.retry.attempts) };
+  } else if (!failure) {
+    state.retry = { attempts: 0, at: 0 };
+  }
+  await saveOutbox(root, state);
+  return { sent, pending: Object.keys(state.pending).length, ...(failure ? { failure } : {}) };
+}
+
+export function loopOutcomeEndpoint({ apiOrigin, apiBaseUrl }) {
+  return webApiUrl(LOOP_OUTCOME_ROUTE, { webOrigin: apiOrigin, apiBaseUrl }).href;
+}
+
+// Agent heartbeat entry. Same consent as CLI observability: nothing is
+// collected or sent unless this device's observability consent is active.
+export async function syncLoopOutcomes({ root, apiOrigin, apiBaseUrl, token, fetchImpl = globalThis.fetch, now = Date.now(), entries,
+  getSession, minIntervalMs = SWEEP_INTERVAL_MS } = {}) {
+  if (!token) return { sent: 0, skipped: "no_token" };
+  const authorize = async () => {
+    const scope = await captureLoopOutcomeScope(root).catch(() => null);
+    const session = getSession ? await getSession() : await import("../session-store.js")
+      .then(({ readSession }) => readSession(apiOrigin, root)).catch(() => null);
+    if (!scope || !session?.token || !isSessionValid(session, now, apiOrigin) || scope.origin !== apiOrigin ||
+        scope.accountId !== session.account_id || scope.organizationId !== session.organization_id ||
+        scope.deviceId !== session.device_id) return null;
+    const endpoint = loopOutcomeEndpoint({ apiOrigin, apiBaseUrl: session.api_base_url || apiBaseUrl });
+    if (new URL(endpoint).origin !== scope.origin) return null;
+    return { scope, token: session.token, endpoint };
+  };
+  const auth = await authorize();
+  if (!auth) return { sent: 0, skipped: "no_consent" };
+  const collected = await collectLoopOutcomes({ root, scope: auth.scope, now, entries, minIntervalMs });
+  return { ...await flushLoopOutcomes({ root, scope: auth.scope, authorize, fetchImpl, now }), unproven: collected.unproven || 0 };
+}

package/src/sqm/loop-outcome.js

@@ -0,0 +1,141 @@
+// `sqm_loop_outcome.v1`: one content-free record per Delivery Loop
+// conversation for the Quality Monitor "Adoption effect" page. Built only from
+// counts, states and timestamps in the local delivery record; the
+// conversation's text, title, cwd and objective never enter it.
+import { createHash } from "node:crypto";
+
+import { LOOP_STOP_KINDS, MAX_LOOP_STOPS } from "../codex-plugins/simy/hooks/loop-stop-record.mjs";
+import { loopSqmProofIds, sqmConversationRef, SQM_LOOP_PROOF_ID_LIMIT } from "./loop-conversation.js";
+
+export const LOOP_OUTCOME_CONTRACT = "sqm_loop_outcome.v1";
+export const LOOP_OUTCOME_KEYS = Object.freeze(["contract_version", "conversation_ref", "provider", "model", "loop_started_at",
+  "ended_at", "final_state", "continuations", "tokens_used", "stops_recorded", "stops", "sqm_proof_ids", "recorded_at"]);
+export const LOOP_OUTCOME_STOP_KEYS = Object.freeze(["index", "kind", "criteria_met", "at"]);
+export const LOOP_OUTCOME_FINAL_STATES = Object.freeze(["active", "completed", "reported_done", "returned_to_human", "budget_exhausted", "failed"]);
+const PROVIDERS = new Set(["codex", "claude"]);
+const MAX_PROOF_IDS = SQM_LOOP_PROOF_ID_LIMIT;
+
+// Contract 8.1. `auto_resuming` and `verification_pending` are the Loop still
+// working on the conversation (not in 8.1's table); any other unknown state is
+// not sent rather than guessed.
+const FINAL_STATE = Object.freeze({
+  completed: "completed", reported_done: "reported_done",
+  stopped: "returned_to_human", paused: "returned_to_human", blocked: "returned_to_human", recovery_required: "returned_to_human",
+  budget_exhausted: "budget_exhausted", failed: "failed",
+  active: "active", auto_resuming: "active", verification_pending: "active",
+});
+
+export function loopOutcomeFinalState(runState) {
+  return Object.hasOwn(FINAL_STATE, runState) ? FINAL_STATE[runState] : null;
+}
+
+const iso = value => Number.isFinite(value) && value > 0 ? new Date(value).toISOString() : null;
+const count = value => Number.isSafeInteger(value) && value >= 0 ? value : null;
+
+// Returns { record } or { skipped: <reason> }. Stops are sent only when the
+// recorder observed the run from its first stop (otherwise #1 would not be the
+// first stop); older runs, including every backfilled one, send
+// stops_recorded:false with no stops. Backfill uses this same builder so it
+// never overwrites a conversation's recorded stops with an empty list.
+export function buildLoopOutcomeRecord(entry, { now = Date.now() } = {}) {
+  const run = entry?.run;
+  if (!run || typeof run !== "object") return { skipped: "no_run" };
+  if (!PROVIDERS.has(entry.provider) || typeof entry.session !== "string" || !entry.session) return { skipped: "unsupported_provider" };
+  const finalState = loopOutcomeFinalState(run.state);
+  if (!finalState) return { skipped: "unknown_state" };
+  const startedAt = iso(run.startedAt);
+  if (!startedAt) return { skipped: "missing_start" };
+  const ledger = run.resultCycle?.stops;
+  const stopsRecorded = ledger?.version === 1 && ledger.complete === true && Array.isArray(ledger.entries);
+  const stops = stopsRecorded ? ledger.entries.slice(0, MAX_LOOP_STOPS).map(stop => ({
+    index: stop.index, kind: stop.kind, criteria_met: stop.criteria_met ?? null, at: stop.at })) : [];
+  const model = typeof run.managed?.resumeModel === "string" && run.managed.resumeModel.trim() ? run.managed.resumeModel.trim().slice(0, 100) : null;
+  const endedAt = finalState === "active" ? null : iso(run.updatedAt) || new Date(now).toISOString();
+  const record = {
+    contract_version: LOOP_OUTCOME_CONTRACT,
+    conversation_ref: sqmConversationRef(entry.provider, entry.session),
+    provider: entry.provider,
+    model,
+    loop_started_at: startedAt,
+    ended_at: endedAt,
+    final_state: finalState,
+    continuations: count(run.continuations) ?? 0,
+    tokens_used: count(run.managed?.tokensUsed),
+    stops_recorded: stopsRecorded,
+    stops,
+    sqm_proof_ids: loopSqmProofIds(entry),
+    recorded_at: new Date(now).toISOString(),
+  };
+  const problem = loopOutcomeRecordProblem(record);
+  return problem ? { skipped: `invalid:${problem}` } : { record };
+}
+
+const isIso = value => typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/u.test(value) && Number.isFinite(Date.parse(value));
+const sameKeys = (value, keys) => value && typeof value === "object" && !Array.isArray(value) &&
+  Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+
+// Mirrors 8.1 (unknown keys are rejected, value ranges enforced) so a record
+// the backend would refuse never enters the queue.
+export function loopOutcomeRecordProblem(record) {
+  if (!sameKeys(record, LOOP_OUTCOME_KEYS)) return "keys";
+  if (record.contract_version !== LOOP_OUTCOME_CONTRACT) return "contract_version";
+  if (typeof record.conversation_ref !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(record.conversation_ref)) return "conversation_ref";
+  if (!PROVIDERS.has(record.provider)) return "provider";
+  if (record.model !== null && (typeof record.model !== "string" || !record.model || record.model.length > 100)) return "model";
+  if (!isIso(record.loop_started_at)) return "loop_started_at";
+  if (record.ended_at !== null && !isIso(record.ended_at)) return "ended_at";
+  if (!LOOP_OUTCOME_FINAL_STATES.includes(record.final_state)) return "final_state";
+  if ((record.final_state === "active") !== (record.ended_at === null)) return "ended_at";
+  if (!Number.isSafeInteger(record.continuations) || record.continuations < 0) return "continuations";
+  if (record.tokens_used !== null && (!Number.isSafeInteger(record.tokens_used) || record.tokens_used < 0)) return "tokens_used";
+  if (typeof record.stops_recorded !== "boolean") return "stops_recorded";
+  if (!Array.isArray(record.stops) || record.stops.length > MAX_LOOP_STOPS) return "stops";
+  if (!record.stops_recorded && record.stops.length) return "stops";
+  let previous = 0;
+  for (const stop of record.stops) {
+    if (!sameKeys(stop, LOOP_OUTCOME_STOP_KEYS)) return "stops";
+    if (!Number.isSafeInteger(stop.index) || stop.index <= previous) return "stops";
+    if (!LOOP_STOP_KINDS.includes(stop.kind)) return "stops";
+    if (![true, false, null].includes(stop.criteria_met)) return "stops";
+    if (!isIso(stop.at)) return "stops";
+    previous = stop.index;
+  }
+  if (!Array.isArray(record.sqm_proof_ids) || record.sqm_proof_ids.length > MAX_PROOF_IDS ||
+      new Set(record.sqm_proof_ids).size !== record.sqm_proof_ids.length ||
+      record.sqm_proof_ids.some(id => typeof id !== "string" || !/^SQM-PROOF-[0-9a-f-]{36}$/iu.test(id))) return "sqm_proof_ids";
+  if (!isIso(record.recorded_at)) return "recorded_at";
+  return null;
+}
+
+// 8.2: 201 { outcome_id, created: true, recorded_at } or 200 { ..., created: false }.
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+export function loopOutcomeReceiptProblem(status, body) {
+  if (![200, 201].includes(status)) return "status";
+  if (!body || typeof body !== "object" || Array.isArray(body)) return "body";
+  if (typeof body.outcome_id !== "string" || !UUID.test(body.outcome_id)) return "outcome_id";
+  if (typeof body.created !== "boolean" || body.created !== (status === 201)) return "created";
+  if (!isIso(body.recorded_at)) return "recorded_at";
+  return null;
+}
+
+// Change detection for the queue: everything but the creation time.
+export function loopOutcomeDigest(record) {
+  const { recorded_at: _recordedAt, ...rest } = record;
+  return createHash("sha256").update(JSON.stringify(rest)).digest("hex");
+}
+
+// Content-free tallies for `backfill --dry-run`.
+export function summarizeLoopOutcomes(records, skipped = {}) {
+  const finalStates = Object.fromEntries(LOOP_OUTCOME_FINAL_STATES.map(state => [state, 0]));
+  const providers = { codex: 0, claude: 0 };
+  let continuations = 0, tokensKnown = 0, tokens = 0, stopsRecorded = 0;
+  for (const record of records) {
+    finalStates[record.final_state]++; providers[record.provider]++;
+    continuations += record.continuations;
+    if (record.tokens_used !== null) { tokensKnown++; tokens += record.tokens_used; }
+    if (record.stops_recorded) stopsRecorded++;
+  }
+  return { conversations: records.length, providers, final_states: finalStates,
+    continuations_total: continuations, tokens_known: tokensKnown, tokens_total: tokens,
+    stops_recorded: stopsRecorded, skipped };
+}

package/src/sqm/proof.js

@@ -37,7 +37,8 @@ export function verifyMinCheck(value) {
   return value;
 }
 
-export function buildProof({ organizationId, repository, bundle, minCheck, evaluation, findings, cliVersion, executedAt = new Date().toISOString() }) {
+export function buildProof({ organizationId, repository, bundle, minCheck, evaluation, findings, cliVersion, executedAt = new Date().toISOString(), conversationRef = null }) {
+  if (conversationRef !== null && !/^sha256:[0-9a-f]{64}$/.test(conversationRef)) throw new Error("SQM conversation reference is invalid.");
   const enforcingModules = evaluation.modules.filter((module) => module.enforcement === "blocking");
   const enforcingFindings = findings.filter((finding) => finding.enforcement === "blocking");
   const statuses = enforcingModules.flatMap((module) => module.scenarios.map((scenario) => scenario.status));
@@ -91,7 +92,9 @@ export function buildProof({ organizationId, repository, bundle, minCheck, evalu
         ...(requiresPostDeploy ? ["post_deploy_evidence_required"] : []),
       ],
     },
-    provenance: { cli_version: cliVersion, executed_at: executedAt, executor: "simy-cli" },
+    // conversation_ref is set only for checks inside a Delivery Loop conversation
+    // and is covered by the proof digest and per-run signature.
+    provenance: { cli_version: cliVersion, executed_at: executedAt, executor: "simy-cli", ...(conversationRef ? { conversation_ref: conversationRef } : {}) },
   };
   return { ...proof, integrity: { algorithm: "sha256", digest: taggedDigest(proof) } };
 }