@cspeach/cli 1.1.26 → 1.1.28

package/dist/repl.js

@@ -109,7 +109,7 @@ function prefillReadline(rl, text) {
 import { BracketedPasteDecoder, enableBracketedPaste, disableBracketedPaste, } from './repl/bracketed-paste.js';
 import { InkStdinPasteGuard } from './repl/ink-stdin-guard.js';
 import { printHelp } from './commands/help.js';
-import { shouldUseInk, setOneShotOverride } from './renderer/tty.js';
+import { shouldUseInk, setOneShotOverride, isHeadless } from './renderer/tty.js';
 import { applyStartupRendering } from './renderer/rendering-mode.js';
 import { createClassicOutputEmitter } from './renderer/notices.js';
 import { saveConfig } from './config/loader.js';
@@ -118,6 +118,10 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { streamsRoot } from './agent/turn-stream.js';
 import { parseAndValidateReroute } from './commands/reroute.js';
+import { DEFAULT_PLAN_MODE } from './commands/plan-gate.js';
+import { autoRoutedNotice } from './commands/plan-resume.js';
+import { makeRegroundDeps } from './commands/plan-reground.js';
+import { createPlanHopTracker } from './repl/plan-hop.js';
 import { emitPlanTurnEnd } from './repl/plan-turn-end.js';
 import { SKILL_CATALOG } from './skill-catalog.js';
 import { replPreviewHook, inkPreviewHook } from './repl/update-method-preview-hook.js';
@@ -156,6 +160,7 @@ import './tools/cap/sap-link-tool.js';
 import './tools/cap/link-smoke.js';
 import './tools/lane/app-lane-resolve.js';
 import './tools/extend-model/tool.js';
+import './tools/text-elements/tools.js';
 import './tools/capability/tool.js';
 import './tools/web/web_fetch.js';
 import './tools/web/web_search.js';
@@ -419,6 +424,7 @@ export async function runRepl(opts) {
     // flow below when the file is absent (back-compat for pre-`cspeach login`
     // users).
     let signIn;
+    let signedInAs;
     try {
         const authFile = await readAuthFile();
         if (authFile) {
@@ -437,6 +443,7 @@ export async function runRepl(opts) {
                     console.log(note.trimEnd());
             }
             else {
+                signedInAs = meResult.profile.email;
                 const banner = formatLoginBanner(meResult.profile);
                 if (getLook() === 'panels') {
                     signIn = signInFragment(meResult.profile);
@@ -811,8 +818,8 @@ export async function runRepl(opts) {
                     ? formatAttention({ text: 'Last turn was stopped by you', next: 'type continue to finish where it left off' })
                     : formatAttention({ text: 'Last turn was interrupted', fact: readableInterruptReason(session.turnInterruptedReason), next: 'type continue to finish where it left off' }));
             }
-            if (recap.plan)
-                startupNotices.push(formatAttention({ text: `Unfinished plan ${recap.plan.text}`, next: recap.plan.next }));
+            // 2026-10-04 — no passive "Unfinished plan" line: the startup
+            // "Continue '<plan>'?" offer (commands/plan-startup.ts) replaces it.
             process.stdout.write(panelsStartTail({ status: panelsStatus, third: panelsResumeLine(recap.last, turnCount), notices: startupNotices }));
         }
         else {
@@ -857,6 +864,11 @@ export async function runRepl(opts) {
         get: () => pendingDispatchValue,
         set: (cmd) => { pendingDispatchValue = cmd; },
     };
+    // Task 13 fix round — the plan chain queues through planHops.queue, which
+    // marks the command as an in-run hop (one progress line, no guarded
+    // notice). Anything else in the slot (the /abap-app start, a skill switch)
+    // is not a hop. Shared by the Ink and readline branches like the slot.
+    const planHops = createPlanHopTracker(pendingDispatchAccessor);
     // v0.3: Ink-mode REPL branch. When running under a real TTY in REPL mode
     // (not one-shot, not CI), mount the <App /> frame instead of the readline
     // loop. The non-Ink path below is preserved byte-for-byte for piped/CI
@@ -947,7 +959,9 @@ export async function runRepl(opts) {
             chunkEmitter.emit('chunk', '\n' + formatInfo(line));
         };
         /** Auto-dispatch of the next plan phase, unless a post-turn cancel stopped it. */
-        const autoDispatch = (cmd) => {
+        // Task 13 fix round — `planHop` travels WITH the command into handleSubmit,
+        // so a refused submit can never leave a stale hop mark behind.
+        const autoDispatch = (cmd, planHop = false) => {
             // Round 4 item 9b — the exit is already under way: start nothing new.
             // Final review B-I2 — `/exit` typed mid-turn (exitAfterTurn) stops it too.
             const decision = autoDispatchDecision({ done, exitRequested: exitAfterTurn, cancelPending: pendingCancel.pending }, cmd);
@@ -958,14 +972,17 @@ export async function runRepl(opts) {
                 chunkEmitter.emit('chunk', formatInfo(decision.line));
                 return;
             }
-            chunkEmitter.emit('chunk', formatInfo(`Auto-routed: ${cmd}`));
-            setImmediate(() => { void handleSubmit(cmd); });
+            // Task 13 — no echo for a plan hop: the chain already said "Next: <title>".
+            const notice = autoRoutedNotice(cmd);
+            if (notice)
+                chunkEmitter.emit('chunk', formatInfo(notice));
+            setImmediate(() => { void handleSubmit(cmd, { planHop }); });
         };
         // BUG-2b — the actual dispatch. Wrapped by handleSubmit (below) which
         // owns the single-flight reserve()/release() lifecycle. All re-entrant
         // callers (the setImmediate auto-dispatch / re-audit legs) go through the
         // WRAPPER so they are guarded and reserved too.
-        const dispatchSubmit = async (line) => {
+        const dispatchSubmit = async (line, submitOpts) => {
             const trimmed = line.trim();
             if (!trimmed)
                 return;
@@ -1026,6 +1043,7 @@ export async function runRepl(opts) {
                 }
                 await runExportAuditCommand({
                     session,
+                    operator: signedInAs,
                     transport: getCurrentTransport(),
                     filename,
                     emit: (l) => chunkEmitter.emit('chunk', l + '\n'),
@@ -1453,6 +1471,8 @@ export async function runRepl(opts) {
             // persists the version-N+1 REVISION after the turn.
             let planResume = null;
             let planResumeMsgStart = 0;
+            // Task 13 — this dispatch is an in-run hop of a plan run (queued by the chain).
+            let planHop = false;
             // D-B — the wall-clock start of THIS phase attempt's turn, threaded to
             // the post-phase audit as the evidence-window cutoff (so an audit never
             // sees an earlier attempt's tool-call rows in the shared session JSONL).
@@ -1469,9 +1489,12 @@ export async function runRepl(opts) {
                 try {
                     const { preparePlanResume } = await import('./commands/plan-resume.js');
                     const { inkAwarePrompt, inkAwareConfirm } = await import('./agent/loop.js');
+                    planHop = submitOpts?.planHop === true;
                     planResume = await preparePlanResume({
                         body: prompt,
                         cwd: process.cwd(),
+                        // Task 13 — an in-run hop prints one progress line, not the board.
+                        boardStyle: planHop ? 'line' : 'full',
                         configMode: cfg.plan_mode,
                         // Audit off-switch (2026-07-06, owner) — config default; per-run
                         // --audit/--no-audit flags in the body override it (parsed inside).
@@ -1481,6 +1504,9 @@ export async function runRepl(opts) {
                         sessionId: session.id,
                         // 2026-10-02 — deploy card on a direct resume into ui.deploy.
                         sapAlias: session.sap_system ?? undefined,
+                        // 2026-10-04 — re-check SAP before the step (skipped without a SAP system).
+                        reground: standalone ? undefined : makeRegroundDeps(adt),
+                        interactive: !isHeadless(),
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
                         log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
@@ -1490,10 +1516,33 @@ export async function runRepl(opts) {
                     chunkEmitter.emit('chunk', '\n' + formatFailure({ what: 'Could not resume the plan', detail: [err.message] }));
                 }
                 if (!planResume) {
+                    // 2026-10-04 — the resume could not start: the run is over, and the
+                    // plan object-list grant ends with it.
+                    {
+                        const { clearPlanGrant } = await import('./approvals/plan-grant.js');
+                        clearPlanGrant();
+                    }
                     session.last_skill = previousSkill ?? null;
                     session.last_object = extractedObject ?? previousObject ?? null;
                     return;
                 }
+                // 2026-10-04 (F13) — a typed resume in guarded mode with no grant for
+                // this plan shows the object list once before the step. Yes approves
+                // it; No runs the step with a card per write. Never on a chain hop.
+                if (!isHeadless()) {
+                    try {
+                        const { offerObjectListOnResume, inkStartupChooser } = await import('./commands/plan-startup.js');
+                        await offerObjectListOnResume({
+                            prepared: planResume,
+                            planHop,
+                            sessionId: session.id,
+                            sapAlias: session.sap_system ?? undefined,
+                            choose: inkStartupChooser(),
+                            log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
+                        });
+                    }
+                    catch { /* best-effort: each write asks */ }
+                }
                 // Task 6 (agentic-flow) — re-audit-on-resume: the last executed phase
                 // has an unresolved audit (crash before the verdict write, auditor
                 // infra outage, or a guarded-mode hand-edit). NO model turn this
@@ -1506,10 +1555,11 @@ export async function runRepl(opts) {
                         await runReauditPass({
                             savedPath: planResume.path,
                             phaseIds: planResume.reauditPhaseIds ?? [planResume.reauditPhaseId],
+                            force: planResume.reauditForce,
                             sessionId: session.id,
                             cwd: process.cwd(),
                             sapAlias: session.sap_system ?? undefined,
-                            mode: planResume.effectiveMode ?? 'step',
+                            mode: planResume.effectiveMode ?? DEFAULT_PLAN_MODE,
                             modeFlag: planResume.mode,
                             // Off-switch (I3) — footer honesty on re-audit boards; (I2) the
                             // per-run audit flag survives onto chain-built resume commands.
@@ -1517,7 +1567,7 @@ export async function runRepl(opts) {
                             auditFlag: planResume.auditFlag,
                             prompt: inkAwarePrompt,
                             confirm: inkAwareConfirm,
-                            queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                            queueDispatch: (cmd) => planHops.queue(cmd),
                             log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
                         });
                     }
@@ -1538,22 +1588,30 @@ export async function runRepl(opts) {
                         const { releaseRunLeaseUnlessChained } = await import('./projects/run-lease.js');
                         releaseRunLeaseUnlessChained(planResume.path, reauditDispatched);
                     }
+                    // 2026-10-04 — the re-audit leg queued nothing: the run is over and
+                    // the plan object-list grant ends with it.
+                    if (!reauditDispatched) {
+                        const { clearPlanGrant } = await import('./approvals/plan-grant.js');
+                        clearPlanGrant();
+                    }
                     if (reauditDispatched) {
                         pendingDispatchAccessor.set(null);
-                        autoDispatch(reauditDispatched);
+                        autoDispatch(reauditDispatched, planHops.take(reauditDispatched));
                     }
                     return;
                 }
-                // A1 (defect D23) — true bounded phases: EVERY plan-resume turn
-                // (harness-dispatched or manually typed) starts from reset session
-                // messages. The envelope + bounded prompt carry all needed state;
-                // prior transcript is pure context cost (a 6-phase run once
-                // snowballed to a 3.24M-token cache read per call).
+                // 2026-10-04 (continuous run) — a phase boundary is save + COMPACT:
+                // the previous phase becomes one summary message (spec-gap answers,
+                // decisions, transport survive). Falls back to today's reset if the
+                // summariser fails, so the run never dead-ends. Still bounded: prior
+                // transcript never snowballs (A1 / defect D23).
                 {
-                    const { resetContextForPlanResume } = await import('./commands/plan-resume.js');
-                    if (resetContextForPlanResume(session)) {
-                        chunkEmitter.emit('chunk', formatInfo('Plan phase starts in a fresh bounded context · earlier conversation cleared'));
-                    }
+                    const { beginPlanPhaseContext, makePhaseBoundarySummariser } = await import('./commands/plan-boundary.js');
+                    await beginPlanPhaseContext({
+                        session,
+                        summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg)),
+                        log: (line) => chunkEmitter.emit('chunk', line + '\n'),
+                    });
                 }
                 planResumeMsgStart = session.messages.length;
                 planPhaseStartedAt = new Date().toISOString(); // D-B evidence-window cutoff
@@ -1616,7 +1674,8 @@ export async function runRepl(opts) {
                     planContinue = { prepared: r.prepared, marker };
                     planPhaseStartedAt = marker.attemptStartedAt;
                     planResumeMsgStart = session.messages.length;
-                    chunkEmitter.emit('chunk', formatInfo(`Re-attaching to in-flight plan phase ${marker.phaseId} (${r.prepared.path})`));
+                    const { continuationNotice } = await import('./commands/plan-continue.js');
+                    chunkEmitter.emit('chunk', formatInfo(continuationNotice(r.prepared)));
                 }
                 else if (r.stale) {
                     session.plan_in_flight = null; // plan/phase gone for good — marker is noise
@@ -1674,7 +1733,7 @@ export async function runRepl(opts) {
                     // Task 7 — plan-phase subagent read-only enforcement: set for EVERY
                     // plan-resume phase turn regardless of mode (guarded AND step);
                     // agent_run consults the flag and forces its read-only tool filter.
-                    setPlanPhaseActive(true);
+                    setPlanPhaseActive(true, planPhaseCtx.envelope.id);
                     // Task 10 — the writes declaration of the phase EXECUTING this turn
                     // (fail-safe: undefined ⇒ true, the deviation backstop never fires).
                     // request_approval consults it in guarded mode to deny undeclared
@@ -1682,11 +1741,15 @@ export async function runRepl(opts) {
                     // never reached its post-phase chain so it can't block THIS phase.
                     setCurrentPhaseWrites(planPhaseCtx.nextPhaseWrites ?? true);
                     getAndResetPlanDeviation();
+                    // Stale "SAP unreachable" from an earlier turn must not pause THIS step.
+                    (await import('./sap/reachability-state.js')).getAndResetSapUnreachable();
                     planPhaseFlagSet = true;
-                    if ((planPhaseCtx.effectiveMode ?? 'step') === 'guarded') {
+                    if ((planPhaseCtx.effectiveMode ?? DEFAULT_PLAN_MODE) === 'guarded') {
                         setGuardedRunActive(true);
                         guardedRunFlagSet = true;
-                        chunkEmitter.emit('chunk', formatInfo('Guarded mode · auto-approve is off for this run'));
+                        // Task 13 — once per run (first hop only), in plain words.
+                        if (!planHop)
+                            chunkEmitter.emit('chunk', formatInfo('Continuous build · auto-approve is off; each write still runs snapshot, syntax check, activate, verify'));
                     }
                     // Off-switch (2026-07-06, owner) — announce plainly that this run's
                     // phases are NOT audited (honesty: off is a choice, never a lie).
@@ -1694,6 +1757,8 @@ export async function runRepl(opts) {
                         chunkEmitter.emit('chunk', chalk.dim('plan audits: off\n'));
                     }
                 }
+                // 2026-10-04 — the phase's expert skill rides along in the system prompt.
+                const planPhaseDelegate = planPhaseCtx?.nextDelegateTo;
                 await runTurn({
                     provider,
                     userMessage: prompt,
@@ -1707,6 +1772,7 @@ export async function runRepl(opts) {
                     // Task 19 — auto-compact at turn end, except plan resume/continue
                     // turns (their post-turn persist indexes messages from turn start).
                     autoCompact: planResume === null && planContinue === null,
+                    delegateSkill: planPhaseDelegate,
                     // A4 — undefined on every non-plan turn (and when tiering is off).
                     modelOverride: planModelOverride,
                     // Task 9 — a tier-down, never the session role (proxy must not enforce it).
@@ -1849,7 +1915,7 @@ export async function runRepl(opts) {
                         sessionId: session.id,
                         cwd: process.cwd(),
                         sapAlias: session.sap_system ?? undefined,
-                        mode: planResume.effectiveMode ?? 'step',
+                        mode: planResume.effectiveMode ?? DEFAULT_PLAN_MODE,
                         modeFlag: planResume.mode,
                         // Off-switch — skips the normal post-phase audit when 'off'; the
                         // per-run flag survives onto chain-built resume commands (I2).
@@ -1862,7 +1928,7 @@ export async function runRepl(opts) {
                         subagentDispatches: planSubagentDispatches,
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
-                        queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                        queueDispatch: (cmd) => planHops.queue(cmd),
                         log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
                     });
                 }
@@ -1901,8 +1967,9 @@ export async function runRepl(opts) {
                             emit: (line) => chunkEmitter.emit('chunk', line + '\n'),
                         });
                     }
-                    else if (r.kind === 'none') {
-                        chunkEmitter.emit('chunk', chalk.dim(`phase ${planContinue.marker.phaseId} still in flight — no completion manifest this turn\n`));
+                    else if (r.kind === 'none' && !(await import('./sap/reachability-state.js')).isSapUnreachableNoted()) {
+                        const { stillInFlightLine } = await import('./commands/plan-continue.js');
+                        chunkEmitter.emit('chunk', chalk.dim(`${stillInFlightLine(planContinue.prepared.envelope, planContinue.marker.phaseId)}\n`));
                     }
                 }
                 catch (err) {
@@ -1923,7 +1990,7 @@ export async function runRepl(opts) {
                         subagentDispatches: planSubagentDispatches,
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
-                        queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                        queueDispatch: (cmd) => planHops.queue(cmd),
                         log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
                     });
                 }
@@ -1934,6 +2001,35 @@ export async function runRepl(opts) {
             // C1 — the phase reached a resolved terminal (revision persisted, chain
             // ran or is queued): the marker's job is done. Applies to --resume AND
             // continuation dispatches; a null outcome keeps the marker (still in flight).
+            // 2026-10-04 (spec §3.5) — SAP went unreachable during the step and
+            // nothing was saved: pause, Enter to retry, then run the SAME step
+            // again as an in-run hop. A queued re-run keeps the lease and the plan
+            // grant (the run goes on); a stop queues nothing, so the run-end
+            // release + grant clear below apply as for any other stop.
+            if ((planResume || planContinue) && !pendingDispatchAccessor.get()) {
+                try {
+                    const { handleSapUnreachableAfterPlanTurn, makeSapProbe } = await import('./commands/plan-sap-pause.js');
+                    const { inkAwarePrompt } = await import('./agent/loop.js');
+                    const { isHeadless } = await import('./renderer/tty.js');
+                    await handleSapUnreachableAfterPlanTurn({
+                        prepared: planResume ?? planContinue.prepared,
+                        persisted: planOutcome !== null,
+                        probe: makeSapProbe(adt),
+                        prompt: inkAwarePrompt,
+                        interactive: !isHeadless(),
+                        queue: (cmd) => planHops.queue(cmd),
+                        log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
+                    });
+                }
+                catch (err) {
+                    // The plan file is already safe; the user still gets one instruction.
+                    try {
+                        const { reportSapPauseFailure } = await import('./commands/plan-sap-pause.js');
+                        reportSapPauseFailure(planResume ?? planContinue.prepared, err, (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'));
+                    }
+                    catch { /* nothing more can be shown */ }
+                }
+            }
             if (planOutcome)
                 session.plan_in_flight = null;
             // Task 9 — the chain leg for this dispatch truly ends here (verdict
@@ -1950,6 +2046,28 @@ export async function runRepl(opts) {
             if (planResume || planContinue) {
                 const { releaseRunLeaseUnlessChained } = await import('./projects/run-lease.js');
                 releaseRunLeaseUnlessChained((planResume ?? planContinue.prepared).path, pendingDispatchAccessor.get());
+                // 2026-10-04 — the run is over (no next step queued, e.g. the turn
+                // failed before the chain ran): the plan object-list grant ends with it.
+                if (pendingDispatchAccessor.get() === null) {
+                    const { clearPlanGrant } = await import('./approvals/plan-grant.js');
+                    clearPlanGrant();
+                }
+            }
+            // 2026-10-04 — auto-compact is ON for plan turns: after the revision is
+            // saved, and only when no next step is queued (that step compacts itself).
+            if (planResume || planContinue) {
+                try {
+                    const { maybeAutoCompactAfterPlanTurn, makeAutoCompactSummariser } = await import('./commands/plan-boundary.js');
+                    const { resolveAutoCompactThreshold } = await import('./models/resolve.js');
+                    await maybeAutoCompactAfterPlanTurn({
+                        session,
+                        config: { ...cfg.compact, auto_threshold_tokens: resolveAutoCompactThreshold(cfg) },
+                        queued: pendingDispatchAccessor.get() !== null,
+                        summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg)),
+                        emit: (line) => chunkEmitter.emit('chunk', line + '\n'),
+                    });
+                }
+                catch { /* auto-compact must never fail a finished turn */ }
             }
             // A4 — turn-cost line must price at the model that actually ran the
             // turn (planModelOverride on tiered plan phases), not session.model.
@@ -1972,16 +2090,16 @@ export async function runRepl(opts) {
             const dispatched = pendingDispatchAccessor.get();
             if (dispatched) {
                 pendingDispatchAccessor.set(null);
-                // No context clear here: resetContextForPlanResume (called in the
-                // plan-resume prepare branch of handleSubmit) is the single owner of
-                // the transcript reset — it runs for typed AND dispatched resumes,
+                // No context clear here: beginPlanPhaseContext (plan-boundary.ts,
+                // called in the plan-resume prepare branch of handleSubmit) is the
+                // single owner of the phase-boundary compaction — it runs for typed AND dispatched resumes,
                 // and only AFTER preparePlanResume succeeds, so a failed prepare
                 // never destroys the session context.
                 // Schedule on next tick so the current handleSubmit's promise
                 // resolves cleanly before the next one starts. Recursion via
                 // setImmediate keeps the call stack flat across long chains.
                 // (autoDispatch skips it when a post-turn Ctrl+C / /exit asked to stop.)
-                autoDispatch(dispatched);
+                autoDispatch(dispatched, planHops.take(dispatched));
             }
         };
         // BUG-2b (2026-07-05 live smoke) — single-flight dispatch guard.
@@ -2002,7 +2120,7 @@ export async function runRepl(opts) {
         // beginSubmit does mid-turn, instead of starting a twin.
         /** Round 4 item 9b — the in-flight (or last) dispatch; settled before unmount on exit. */
         let dispatchTail = null;
-        const handleSubmit = async (line) => {
+        const handleSubmit = async (line, submitOpts) => {
             if (turnStatusEmitter.isBusy()) {
                 const t = line.trim();
                 // Fix round 3 (item 5): slash commands are never steering text.
@@ -2027,7 +2145,7 @@ export async function runRepl(opts) {
             postTurnMayChain = false;
             try {
                 // Round 4 item 9b — the exit path waits (capped) for this to finish.
-                const run = dispatchSubmit(line);
+                const run = dispatchSubmit(line, submitOpts);
                 dispatchTail = run;
                 await run;
             }
@@ -2232,6 +2350,28 @@ export async function runRepl(opts) {
             // in commit 349ff75.
             patchConsole: true,
         });
+        // 2026-10-04 (spec §3.5) — "Continue '<plan>'?" when an unfinished plan
+        // sits in this folder. Best-effort: never blocks the prompt.
+        if (!isHeadless()) {
+            void (async () => {
+                try {
+                    const { offerContinueAtStartup, inkStartupChooser } = await import('./commands/plan-startup.js');
+                    const { resolveWorkspacePath } = await import('./projects/workspace.js');
+                    const ws = await resolveWorkspacePath().catch(() => undefined);
+                    if (!ws)
+                        return;
+                    await offerContinueAtStartup({
+                        workspaceDir: ws,
+                        sessionId: session.id,
+                        sapAlias: session.sap_system ?? undefined,
+                        choose: inkStartupChooser(),
+                        submit: (cmd) => { void handleSubmit(cmd); },
+                        log: (...lines) => chunkEmitter.emit('chunk', lines.join('\n') + '\n'),
+                    });
+                }
+                catch { /* the offer is best-effort */ }
+            })();
+        }
         await donePromise;
         // Round 4 item 9b — a second idle Ctrl+C right after a turn resolved the
         // exit while post-turn work (saving, audit) still ran. Let it finish,
@@ -2556,6 +2696,29 @@ export async function runRepl(opts) {
         })),
         log: (line) => console.log(chalk.dim(line)),
     });
+    // 2026-10-04 (spec §3.5) — "Continue '<plan>'?" (classic: numbered
+    // choices, Enter = the first). Continue queues the resume for the loop.
+    if (!isHeadless()) {
+        try {
+            const { offerContinueAtStartup, classicStartupChooser } = await import('./commands/plan-startup.js');
+            const { inkAwarePrompt } = await import('./agent/loop.js');
+            const { resolveWorkspacePath } = await import('./projects/workspace.js');
+            const ws = await resolveWorkspacePath().catch(() => undefined);
+            if (ws) {
+                await offerContinueAtStartup({
+                    workspaceDir: ws,
+                    sessionId: session.id,
+                    sapAlias: session.sap_system ?? undefined,
+                    choose: classicStartupChooser(inkAwarePrompt, (...l) => l.forEach((x) => console.log(x))),
+                    submit: (cmd) => pendingDispatchAccessor.set(cmd),
+                    log: (...l) => l.forEach((x) => console.log(x)),
+                });
+            }
+        }
+        catch { /* best-effort */ }
+    }
+    // Task 13 — classic in-run hop flag: set by the loop-top consumer from planHops.take().
+    let classicPlanHop = false;
     while (true) {
         // Re-attach the bare-Esc detector every iteration. Inquirer prompts
         // (slash-picker, approval, ask_question, safety-confirm) remove
@@ -2568,15 +2731,22 @@ export async function runRepl(opts) {
         // wait and feed that command to the loop directly — the user's
         // consent was the picker pick, no Enter required. Cleared
         // immediately so a stale value never re-fires.
+        classicPlanHop = false; // a typed line is never an in-run hop
         const dispatchedCmd = pendingDispatchAccessor.get();
         if (dispatchedCmd) {
             pendingDispatchAccessor.set(null);
-            // No context clear here: resetContextForPlanResume (called in the
-            // plan-resume prepare branch below) is the single owner of the
-            // transcript reset — it runs for typed AND dispatched resumes, and
+            // No context clear here: beginPlanPhaseContext (plan-boundary.ts,
+            // called in the plan-resume prepare branch below) is the single owner
+            // of the phase-boundary compaction — it runs for typed AND dispatched resumes, and
             // only AFTER preparePlanResume succeeds, so a failed prepare never
             // destroys the session context.
-            console.log(formatInfo(`Auto-routed: ${dispatchedCmd}`).trimEnd());
+            // Task 13 — no echo for a plan hop: the chain already said "Next: <title>".
+            {
+                const n = autoRoutedNotice(dispatchedCmd);
+                if (n)
+                    console.log(formatInfo(n).trimEnd());
+                classicPlanHop = planHops.take(dispatchedCmd);
+            }
             line = dispatchedCmd;
         }
         else if (earlyLines.size() > 0) {
@@ -2713,6 +2883,7 @@ export async function runRepl(opts) {
             }
             await runExportAuditCommand({
                 session,
+                operator: signedInAs,
                 transport: getCurrentTransport(),
                 filename,
                 emit: (l) => console.log(l),
@@ -3221,6 +3392,8 @@ export async function runRepl(opts) {
         // envelope revision after the turn.
         let planResume = null;
         let planResumeMsgStart = 0;
+        // Task 13 — in-run hop flag (see Ink path).
+        let planHop = false;
         // D-B — see the Ink-path mirror above: this attempt's turn-start cutoff.
         let planPhaseStartedAt = '';
         // A4 — set only when plan model tiering picks Sonnet for this phase.
@@ -3233,9 +3406,13 @@ export async function runRepl(opts) {
             try {
                 const { preparePlanResume } = await import('./commands/plan-resume.js');
                 const { inkAwarePrompt, inkAwareConfirm } = await import('./agent/loop.js');
+                planHop = classicPlanHop;
+                classicPlanHop = false;
                 planResume = await preparePlanResume({
                     body: prompt,
                     cwd: process.cwd(),
+                    // Task 13 — an in-run hop prints one progress line, not the board.
+                    boardStyle: planHop ? 'line' : 'full',
                     configMode: cfg.plan_mode,
                     // Audit off-switch (2026-07-06, owner) — config default; per-run
                     // --audit/--no-audit flags in the body override it (parsed inside).
@@ -3244,6 +3421,9 @@ export async function runRepl(opts) {
                     sessionId: session.id,
                     // 2026-10-02 — deploy card on a direct resume into ui.deploy.
                     sapAlias: session.sap_system ?? undefined,
+                    // 2026-10-04 — re-check SAP before the step (skipped without a SAP system).
+                    reground: standalone ? undefined : makeRegroundDeps(adt),
+                    interactive: !isHeadless(),
                     prompt: inkAwarePrompt,
                     confirm: inkAwareConfirm,
                     log: (...lines) => lines.forEach((l) => console.log(l)),
@@ -3253,10 +3433,31 @@ export async function runRepl(opts) {
                 console.log('\n' + formatFailure({ what: 'Could not resume the plan', detail: [err.message] }));
             }
             if (!planResume) {
+                // 2026-10-04 — resume could not start: the grant ends with the run (classic mirror).
+                {
+                    const { clearPlanGrant } = await import('./approvals/plan-grant.js');
+                    clearPlanGrant();
+                }
                 session.last_skill = previousSkill ?? null;
                 session.last_object = extractedObject ?? previousObject ?? null;
                 continue;
             }
+            // 2026-10-04 (F13) — classic mirror: the object list once before a typed guarded step.
+            if (!isHeadless()) {
+                try {
+                    const { offerObjectListOnResume, classicStartupChooser } = await import('./commands/plan-startup.js');
+                    const { inkAwarePrompt } = await import('./agent/loop.js');
+                    await offerObjectListOnResume({
+                        prepared: planResume,
+                        planHop,
+                        sessionId: session.id,
+                        sapAlias: session.sap_system ?? undefined,
+                        choose: classicStartupChooser(inkAwarePrompt, (...l) => l.forEach((x) => console.log(x))),
+                        log: (...l) => l.forEach((x) => console.log(x)),
+                    });
+                }
+                catch { /* best-effort: each write asks */ }
+            }
             // Task 6 — re-audit-on-resume (classic mirror of the Ink branch; see
             // there for the design note). No model turn: the chain re-judges the
             // unresolved phase and queues any follow-up through pendingDispatch,
@@ -3268,17 +3469,18 @@ export async function runRepl(opts) {
                     await runReauditPass({
                         savedPath: planResume.path,
                         phaseIds: planResume.reauditPhaseIds ?? [planResume.reauditPhaseId],
+                        force: planResume.reauditForce,
                         sessionId: session.id,
                         cwd: process.cwd(),
                         sapAlias: session.sap_system ?? undefined,
-                        mode: planResume.effectiveMode ?? 'step',
+                        mode: planResume.effectiveMode ?? DEFAULT_PLAN_MODE,
                         modeFlag: planResume.mode,
                         // Off-switch (I3/I2) — classic mirror; see the Ink re-audit site.
                         auditMode: planResume.auditMode,
                         auditFlag: planResume.auditFlag,
                         prompt: inkAwarePrompt,
                         confirm: inkAwareConfirm,
-                        queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                        queueDispatch: (cmd) => planHops.queue(cmd),
                         log: (...lines) => lines.forEach((l) => console.log(l)),
                     });
                 }
@@ -3293,17 +3495,24 @@ export async function runRepl(opts) {
                     const { releaseRunLeaseUnlessChained } = await import('./projects/run-lease.js');
                     releaseRunLeaseUnlessChained(planResume.path, pendingDispatchAccessor.get());
                 }
+                // 2026-10-04 — re-audit leg queued nothing: grant ends with the run (classic mirror).
+                if (pendingDispatchAccessor.get() === null) {
+                    const { clearPlanGrant } = await import('./approvals/plan-grant.js');
+                    clearPlanGrant();
+                }
                 session.last_skill = previousSkill ?? null;
                 session.last_object = extractedObject ?? previousObject ?? null;
                 continue;
             }
-            // A1 (defect D23) — see the Ink path: every plan-resume turn starts
-            // from reset session messages (true bounded phases).
+            // 2026-10-04 (continuous run) — see the Ink path: a phase boundary is
+            // save + COMPACT, falling back to today's reset if the summariser fails.
             {
-                const { resetContextForPlanResume } = await import('./commands/plan-resume.js');
-                if (resetContextForPlanResume(session)) {
-                    console.log(formatInfo('Plan phase starts in a fresh bounded context · earlier conversation cleared').trimEnd());
-                }
+                const { beginPlanPhaseContext, makePhaseBoundarySummariser } = await import('./commands/plan-boundary.js');
+                await beginPlanPhaseContext({
+                    session,
+                    summarise: makePhaseBoundarySummariser(provider, resolveModelRole('compact', cfg)),
+                    log: (line) => console.log(line),
+                });
             }
             planResumeMsgStart = session.messages.length;
             planPhaseStartedAt = new Date().toISOString(); // D-B evidence-window cutoff
@@ -3355,7 +3564,8 @@ export async function runRepl(opts) {
                 planContinue = { prepared: r.prepared, marker };
                 planPhaseStartedAt = marker.attemptStartedAt;
                 planResumeMsgStart = session.messages.length;
-                console.log(formatInfo(`Re-attaching to in-flight plan phase ${marker.phaseId} (${r.prepared.path})`).trimEnd());
+                const { continuationNotice } = await import('./commands/plan-continue.js');
+                console.log(formatInfo(continuationNotice(r.prepared)).trimEnd());
             }
             else if (r.stale) {
                 session.plan_in_flight = null; // plan/phase gone for good — marker is noise
@@ -3431,16 +3641,20 @@ export async function runRepl(opts) {
                 const { setPlanPhaseActive, setGuardedRunActive, setCurrentPhaseWrites, getAndResetPlanDeviation } = await import('./commands/plan-gate.js');
                 // Task 7 — plan-phase subagent read-only enforcement (classic mirror):
                 // set for EVERY plan-resume phase turn regardless of mode.
-                setPlanPhaseActive(true);
+                setPlanPhaseActive(true, planPhaseCtx.envelope.id);
                 // Task 10 — executing phase's writes declaration for the deviation
                 // backstop + stale-flag discard (classic mirror; see Ink path note).
                 setCurrentPhaseWrites(planPhaseCtx.nextPhaseWrites ?? true);
                 getAndResetPlanDeviation();
+                // Stale "SAP unreachable" from an earlier turn must not pause THIS step (classic mirror).
+                (await import('./sap/reachability-state.js')).getAndResetSapUnreachable();
                 planPhaseFlagSet = true;
-                if ((planPhaseCtx.effectiveMode ?? 'step') === 'guarded') {
+                if ((planPhaseCtx.effectiveMode ?? DEFAULT_PLAN_MODE) === 'guarded') {
                     setGuardedRunActive(true);
                     guardedRunFlagSet = true;
-                    console.log(formatInfo('Guarded mode · auto-approve is off for this run').trimEnd());
+                    // Task 13 — once per run (first hop only), in plain words.
+                    if (!planHop)
+                        console.log(formatInfo('Continuous build · auto-approve is off; each write still runs snapshot, syntax check, activate, verify').trimEnd());
                 }
                 // Off-switch (2026-07-06, owner) — announce plainly that this run's
                 // phases are NOT audited (honesty: off is a choice, never a lie).
@@ -3448,6 +3662,8 @@ export async function runRepl(opts) {
                     console.log(chalk.dim('plan audits: off'));
                 }
             }
+            // 2026-10-04 — the phase's expert skill rides along in the system prompt.
+            const planPhaseDelegate = planPhaseCtx?.nextDelegateTo;
             await runTurn({
                 provider,
                 userMessage: prompt,
@@ -3460,6 +3676,7 @@ export async function runRepl(opts) {
                 // Task 19 — auto-compact at turn end, except plan resume/continue
                 // turns (their post-turn persist indexes messages from turn start).
                 autoCompact: planResume === null && planContinue === null,
+                delegateSkill: planPhaseDelegate,
                 // A4 — undefined on every non-plan turn (and when tiering is off).
                 modelOverride: planModelOverride,
                 // Task 9 — a tier-down, never the session role (proxy must not enforce it).
@@ -3583,7 +3800,7 @@ export async function runRepl(opts) {
                     sessionId: session.id,
                     cwd: process.cwd(),
                     sapAlias: session.sap_system ?? undefined,
-                    mode: planResume.effectiveMode ?? 'step',
+                    mode: planResume.effectiveMode ?? DEFAULT_PLAN_MODE,
                     modeFlag: planResume.mode,
                     // Off-switch (I3/I2) — classic mirror of the Ink chain call: skip
                     // the audit when 'off'; per-run flag survives onto resume commands.
@@ -3595,7 +3812,7 @@ export async function runRepl(opts) {
                     subagentDispatches: planSubagentDispatches,
                     prompt: inkAwarePrompt,
                     confirm: inkAwareConfirm,
-                    queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                    queueDispatch: (cmd) => planHops.queue(cmd),
                     log: (...lines) => lines.forEach((l) => console.log(l)),
                 });
             }
@@ -3634,8 +3851,9 @@ export async function runRepl(opts) {
                         emit: (line) => console.log(line),
                     });
                 }
-                else if (r.kind === 'none') {
-                    console.log(chalk.dim(`phase ${planContinue.marker.phaseId} still in flight — no completion manifest this turn`));
+                else if (r.kind === 'none' && !(await import('./sap/reachability-state.js')).isSapUnreachableNoted()) {
+                    const { stillInFlightLine } = await import('./commands/plan-continue.js');
+                    console.log(chalk.dim(stillInFlightLine(planContinue.prepared.envelope, planContinue.marker.phaseId)));
                 }
             }
             catch (err) {
@@ -3656,7 +3874,7 @@ export async function runRepl(opts) {
                     subagentDispatches: planSubagentDispatches,
                     prompt: inkAwarePrompt,
                     confirm: inkAwareConfirm,
-                    queueDispatch: (cmd) => pendingDispatchAccessor.set(cmd),
+                    queueDispatch: (cmd) => planHops.queue(cmd),
                     log: (...lines) => lines.forEach((l) => console.log(l)),
                 });
             }
@@ -3667,6 +3885,32 @@ export async function runRepl(opts) {
         // C1 — the phase reached a resolved terminal (revision persisted, chain
         // ran or is queued): the marker's job is done. Applies to --resume AND
         // continuation dispatches; a null outcome keeps the marker (still in flight).
+        // 2026-10-04 (spec §3.5) — SAP unreachable mid-step: pause, Enter to
+        // retry, re-run the SAME step as an in-run hop (classic mirror of the Ink site).
+        if ((planResume || planContinue) && !pendingDispatchAccessor.get()) {
+            try {
+                const { handleSapUnreachableAfterPlanTurn, makeSapProbe } = await import('./commands/plan-sap-pause.js');
+                const { inkAwarePrompt } = await import('./agent/loop.js');
+                const { isHeadless } = await import('./renderer/tty.js');
+                await handleSapUnreachableAfterPlanTurn({
+                    prepared: planResume ?? planContinue.prepared,
+                    persisted: planOutcome !== null,
+                    probe: makeSapProbe(adt),
+                    prompt: inkAwarePrompt,
+                    interactive: !isHeadless(),
+                    queue: (cmd) => planHops.queue(cmd),
+                    log: (...lines) => lines.forEach((l) => console.log(l)),
+                });
+            }
+            catch (err) {
+                // The plan file is already safe; the user still gets one instruction (classic mirror).
+                try {
+                    const { reportSapPauseFailure } = await import('./commands/plan-sap-pause.js');
+                    reportSapPauseFailure(planResume ?? planContinue.prepared, err, (...lines) => lines.forEach((l) => console.log(l)));
+                }
+                catch { /* nothing more can be shown */ }
+            }
+        }
         if (planOutcome)
             session.plan_in_flight = null;
         // Task 9 — chain leg truly ends here: release the run lease UNLESS a
@@ -3677,6 +3921,27 @@ export async function runRepl(opts) {
         if (planResume || planContinue) {
             const { releaseRunLeaseUnlessChained } = await import('./projects/run-lease.js');
             releaseRunLeaseUnlessChained((planResume ?? planContinue.prepared).path, pendingDispatchAccessor.get());
+            // 2026-10-04 — run over: the plan object-list grant ends with it (classic mirror).
+            if (pendingDispatchAccessor.get() === null) {
+                const { clearPlanGrant } = await import('./approvals/plan-grant.js');
+                clearPlanGrant();
+            }
+        }
+        // 2026-10-04 — auto-compact is ON for plan turns (classic mirror of the
+        // Ink site): after the revision is saved, only when no next step is queued.
+        if (planResume || planContinue) {
+            try {
+                const { maybeAutoCompactAfterPlanTurn, makeAutoCompactSummariser } = await import('./commands/plan-boundary.js');
+                const { resolveAutoCompactThreshold } = await import('./models/resolve.js');
+                await maybeAutoCompactAfterPlanTurn({
+                    session,
+                    config: { ...cfg.compact, auto_threshold_tokens: resolveAutoCompactThreshold(cfg) },
+                    queued: pendingDispatchAccessor.get() !== null,
+                    summarise: makeAutoCompactSummariser(provider, resolveModelRole('compact', cfg)),
+                    emit: (line) => console.log(line),
+                });
+            }
+            catch { /* auto-compact must never fail a finished turn */ }
         }
         // Status footer after each turn.
         // tool_result messages also have role:'user' but content is an array —