@dsh-enhanced/assistant-delivery 0.1.24 → 0.1.31

package/lib/agent-runtime.js

@@ -2,16 +2,19 @@ import { createHash } from 'node:crypto';
 import { mkdir, stat } from 'node:fs/promises';
 import { installModelSelection, } from '@deepseek-ai/dsh-agent';
 import { contentHasImage, createUserMessage, ReasoningEffortId, } from '@deepseek-ai/dsh-llm';
-import { effectiveSandboxMode, setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
+import { setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
 import { isAppendSurfaceEvent, SessionId } from '@deepseek-ai/dsh-session';
-import { effectiveApprovalPolicy, setApprovalPolicy, } from '@deepseek-ai/dsh-user-approval';
+import { setApprovalPolicy, } from '@deepseek-ai/dsh-user-approval';
 import { approvalReviewerOf, setApprovalReviewer, waitForApprovalReviewerSessionEventReady, } from '@dsh-enhanced/assistant-policy';
 import { resolveLlmRouteCapability } from '@dsh-enhanced/llm-route-capabilities';
 import { externalPrincipalId } from './canonical.js';
 import { feedbackSignalInput, feedbackUsage, parseFeedbackCommand, } from './feedback-command.js';
+import { objectiveStateMessage } from './feedback-command.js';
 import { learningCommandUsage, parseLearningCommand, serializeLearningExport, } from './learning-command.js';
 import { isExactDeliveryCommand, learningDispatchRecoveryCode, parseDeliveryCommand, permissionDispatchRecoveryCode, } from './session-commands.js';
 import { DeliveryStoreError } from './store.js';
+import { SessionLeaseUnavailable } from './session-lease-runtime.js';
+import { isDeliveryGoalWakeDeadline } from './goal-wake-types.js';
 import { parseWorkflowCommand, workflowCommandUsage, } from './workflow-command.js';
 const SAFE_NATIVE_COMMANDS = new Set(['compact']);
 class UserSessionCancellation extends Error {
@@ -477,16 +480,17 @@ async function appendApprovalReviewer(session, reviewer) {
         throw new ApprovalReviewerReaderUnavailableError(error);
     }
 }
-function currentPermissionLevel(service, targets, events) {
-    const current = service.current(events);
+function currentPermissionLevel(service, targets, session) {
+    const events = session.snapshotEvents();
+    const current = service.current(session);
     if (current === targets.full) {
-        return effectiveSandboxMode(events) === 'danger-full-access'
-            && effectiveApprovalPolicy(events) === 'never'
+        return explicitSandboxMode(events) === 'danger-full-access'
+            && explicitApprovalPolicy(events) === 'never'
             && approvalReviewerOf(events) === 'none'
             ? 'full'
             : 'custom';
     }
-    if (effectiveSandboxMode(events) !== 'workspace-write' || effectiveApprovalPolicy(events) !== 'ask')
+    if (explicitSandboxMode(events) !== 'workspace-write' || explicitApprovalPolicy(events) !== 'ask')
         return 'custom';
     const reviewer = approvalReviewerOf(events);
     if (targets.ask === targets.auto && current === targets.ask)
@@ -507,7 +511,7 @@ function canonicalPresetReviewer(name) {
     return undefined;
 }
 async function ensurePermissionReviewer(session, preset, reviewer) {
-    if (approvalReviewerOf(session.events) === reviewer)
+    if (approvalReviewerOf(session.snapshotEvents()) === reviewer)
         return;
     if (canonicalPresetReviewer(preset) === reviewer) {
         // PermissionPresetService deliberately makes a net-zero selection a no-op.
@@ -519,17 +523,17 @@ async function ensurePermissionReviewer(session, preset, reviewer) {
     await appendApprovalReviewer(session, reviewer);
 }
 function ensureSandboxMode(session, mode) {
-    if (explicitSandboxMode(session.events) === mode)
+    if (explicitSandboxMode(session.snapshotEvents()) === mode)
         return;
     setSandboxMode(session, mode);
-    if (explicitSandboxMode(session.events) !== mode)
+    if (explicitSandboxMode(session.snapshotEvents()) !== mode)
         session.append('sandbox/mode', { mode });
 }
 function ensureApprovalPolicy(session, policy) {
-    if (explicitApprovalPolicy(session.events) === policy)
+    if (explicitApprovalPolicy(session.snapshotEvents()) === policy)
         return;
     setApprovalPolicy(session, policy);
-    if (explicitApprovalPolicy(session.events) !== policy)
+    if (explicitApprovalPolicy(session.snapshotEvents()) !== policy)
         session.append('approval/policy', { policy });
 }
 function permissionLevelLabel(level) {
@@ -846,7 +850,7 @@ function assertAdoptableUnstartedSession(session, workspace, presetId) {
     if (session.header.cwd !== workspace || session.header.agentPreset !== presetId) {
         throw new DurableAgentIdentityError('assistant-delivery: durable orphan session identity does not match the requested generation');
     }
-    if (session.events.some(event => event.type === 'turn/start' || event.type === 'user/message')
+    if (session.snapshotEvents().some(event => event.type === 'turn/start' || event.type === 'user/message')
         || session.deriveMessages().length > 0) {
         throw new DurableAgentIdentityError('assistant-delivery: refusing to adopt a deterministic session that already started a user turn');
     }
@@ -1018,16 +1022,27 @@ function finalAssistant(events, from, expectedTurn) {
         ...(failureCode === undefined ? {} : { failureCode }),
     };
 }
+function isScheduledGoalRuntimeContext(source) {
+    return (source.kind === 'plugin' && source.plugin === '@deepseek-ai/dsh-system-prompt' && source.form === 'snapshot')
+        || (source.kind === 'skill-catalog' && source.form === 'catalog');
+}
 export class DshDeliveryRuntime {
     ctx;
     policy;
     options;
     dispatchControl = 'explicit';
     activeSessionControls = new Map();
+    sessionLeases;
     constructor(ctx, policy, options) {
         this.ctx = ctx;
         this.policy = policy;
         this.options = options;
+        this.sessionLeases = options.sessionLeases;
+    }
+    async resumeAgent(options) {
+        const id = String(options.resumeSessionId);
+        this.sessionLeases.assert(id);
+        return this.sessionLeases.resume(this.ctx, options);
     }
     async cancelActive(binding, command) {
         const sessionId = binding.sessionId;
@@ -1045,8 +1060,9 @@ export class DshDeliveryRuntime {
             if (!control.controller.signal.aborted) {
                 control.controller.abort(new UserSessionCancellation(control.command));
             }
+            this.sessionLeases.cancel(sessionId, new UserSessionCancellation(control.command));
         }
-        // rc.8 `whenIdle()` follows every later wakeup. Waiting on it here lets an
+        // `whenIdle()` follows every later wakeup. Waiting on it here lets an
         // unrelated followup keep `/stop` or `/new` alive forever. Clear pending
         // input and wait only for Delivery's exact reply-scheduling boundary.
         if (activeAgent)
@@ -1085,27 +1101,377 @@ export class DshDeliveryRuntime {
         if (this.activeSessionControls.get(sessionId) === control)
             this.activeSessionControls.delete(sessionId);
     }
-    async disposeAfterReplyBoundary(sessionId, handle) {
+    /**
+     * Keep one Delivery-owned handle alive just long enough for the host's native
+     * goal driver to retire the exact armed goal it observed. Delivery never
+     * queues a round itself: the driver remains the only continuation producer.
+     */
+    waitForNativeGoalContinuation(binding, envelope, agent, signal) {
+        if (this.options.goalContinuationTimeoutMs === 0)
+            return undefined;
+        const goals = this.ctx.get('goals');
+        const agents = this.ctx.get('agents');
+        if (goals === undefined || agents?.get(agent.id) !== agent)
+            return undefined;
+        let initial;
+        try {
+            initial = goals.get(agent);
+        }
+        catch {
+            return undefined;
+        }
+        // Install this watcher before the foreground followup. A goal can be
+        // resumed or created by that turn, and the native round driver observes
+        // the same idle boundary immediately afterwards.
+        if (initial?.phase !== 'active' || initial.activation !== 'armed')
+            initial = undefined;
+        let goalId = initial === undefined ? undefined : String(initial.id);
+        const session = agent.session;
+        let settled = false;
+        let settledQuiescent = false;
+        // `goal/changed` is synchronous. In particular, disarming our own goal can
+        // emit it before cancelUnknown() has reached finish(false), so remember that
+        // this is a forced, unknown outcome before mutating the native goal.
+        let cancelling = false;
+        let activeGoalSteps = 0;
+        let settleRequested = false;
+        let resolve;
+        const completion = new Promise(done => { resolve = done; });
+        let timeout;
+        let deadlineAt;
+        let removeGoalChanged;
+        let removeStatus;
+        let removeAbort;
+        let removePreStep;
+        let removeRequest;
+        let removePreExecute;
+        let removeToolGuard;
+        const releaseFences = () => {
+            removeGoalChanged?.();
+            removeStatus?.();
+            removeAbort?.();
+            removePreStep?.();
+            removeRequest?.();
+            removePreExecute?.();
+            removeToolGuard?.();
+            removeGoalChanged = undefined;
+            removeStatus = undefined;
+            removeAbort = undefined;
+            removePreStep = undefined;
+            removeRequest = undefined;
+            removePreExecute = undefined;
+            removeToolGuard = undefined;
+        };
+        const finish = (quiescent) => {
+            if (settled)
+                return;
+            settled = true;
+            settledQuiescent = quiescent;
+            resolve(quiescent);
+        };
+        const isAuthorized = () => {
+            try {
+                return this.options.isInboundAuthorized(binding, envelope);
+            }
+            catch {
+                return false;
+            }
+        };
+        const pinArmedGoal = () => {
+            if (goalId !== undefined || settleRequested)
+                return goalId !== undefined;
+            try {
+                const current = goals.get(agent);
+                if (current?.phase !== 'active' || current.activation !== 'armed')
+                    return false;
+                initial = current;
+                goalId = String(current.id);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        };
+        const disposition = () => {
+            // A replacement is deliberately not adopted. It needs its own explicit
+            // foreground owner/acceptance boundary.
+            if (goalId === undefined || initial === undefined)
+                return 'still-running';
+            if (agents?.get(agent.id) !== agent || agent.session !== session)
+                return 'unavailable';
+            try {
+                const current = goals.get(agent);
+                if (current === undefined)
+                    return 'settled';
+                if (String(current.id) !== goalId)
+                    return 'replacement';
+                return current.phase !== 'active' || current.activation !== 'armed'
+                    ? 'settled'
+                    : 'still-running';
+            }
+            catch {
+                return 'unavailable';
+            }
+        };
+        const disarmAndCancel = (reason) => {
+            try {
+                const current = goals.get(agent);
+                if (goalId !== undefined && current !== undefined && String(current.id) === goalId
+                    && current.phase === 'active' && current.activation === 'armed') {
+                    goals.disarm(agent);
+                }
+            }
+            catch { }
+            try {
+                agent.cancel({ kind: 'hook', reason });
+            }
+            catch { }
+        };
+        const finishNaturally = () => {
+            // Goal state is only an observation.  It cannot turn a cancelled or
+            // revoked foreground authority into a successful, quiescent outcome.
+            if (signal.aborted) {
+                cancelUnknown('assistant-delivery-goal-continuation-cancelled');
+            }
+            else if (!isAuthorized()) {
+                cancelUnknown('assistant-delivery-goal-continuation-authorization-revoked');
+            }
+            else {
+                finish(true);
+            }
+        };
+        const maybeFinish = () => {
+            if (settled || cancelling || activeGoalSteps !== 0 || goalId === undefined)
+                return;
+            // A terminal goal record does not prove that its final model/tool turn
+            // has retired.  `whenIdle()` is deliberately avoided here because it
+            // can follow a later wakeup forever; the current Agent state and inbox
+            // are the bounded observation needed before declaring quiescence.
+            if (agent.status !== 'idle' || agent.inbox.hasPending)
+                return;
+            const current = disposition();
+            if (current === 'settled')
+                finishNaturally();
+            // Missing identity/readback and replacement are intentionally unknown:
+            // neither proves that the exact pinned goal drained.
+            else if (current !== 'still-running')
+                finish(false);
+        };
+        const cancelUnknown = (reason) => {
+            if (cancelling)
+                return;
+            cancelling = true;
+            disarmAndCancel(reason);
+            // A hard timeout or /stop must settle this foreground operation even if
+            // a third-party tool ignores cancellation. Keep the fences until the
+            // Delivery-owned handle is disposed, rather than waiting for idle here.
+            if (!settled)
+                finish(false);
+        };
+        const guardContinuationAuthorization = () => {
+            if (cancelling)
+                return false;
+            if (isAuthorized())
+                return true;
+            cancelUnknown('assistant-delivery-goal-continuation-authorization-revoked');
+            return false;
+        };
+        const teardownTimeoutMs = () => deadlineAt === undefined
+            ? undefined
+            : Math.max(0, deadlineAt - Date.now());
+        const isQuiescent = () => {
+            if (!settledQuiescent || cancelling)
+                return false;
+            // The goal can reach a terminal native state before the Agent scope has
+            // finished disposing.  Authority is still live at that point.
+            if (signal.aborted || !isAuthorized()) {
+                cancelUnknown(signal.aborted
+                    ? 'assistant-delivery-goal-continuation-cancelled'
+                    : 'assistant-delivery-goal-continuation-authorization-revoked');
+                return false;
+            }
+            return true;
+        };
+        removeGoalChanged = this.ctx.on('goal/changed', ({ agent: changed }) => {
+            if (changed !== agent)
+                return;
+            pinArmedGoal();
+            maybeFinish();
+        });
+        removeStatus = this.ctx.on('agent/status', ({ agent: changed, status }) => {
+            // The round driver can wake after an idle status, so idle alone is not a
+            // completion signal. It is only useful after the goal itself disarmed.
+            if (changed === agent && status === 'idle')
+                maybeFinish();
+        });
+        const aborted = () => cancelUnknown('assistant-delivery-goal-continuation-cancelled');
+        signal.addEventListener('abort', aborted, { once: true });
+        removeAbort = () => signal.removeEventListener('abort', aborted);
+        removePreStep = agent.ctx.on('agent/pre-step', async (_input, next) => {
+            // The native loop supplies only the inbox claim for a later model step;
+            // after a tool result it need not repeat the original `goal` source.
+            // Once this watcher fixed a GoalId, every later model step on the owned
+            // Agent is therefore fenced until its handle tears down.
+            if (goalId === undefined)
+                return await next();
+            if (!guardContinuationAuthorization())
+                return { kind: 'reject' };
+            activeGoalSteps += 1;
+            try {
+                const result = await next();
+                // A pre-step waterfall's `next()` can finish before the next model
+                // boundary.  Recheck immediately after it so a revocation in that
+                // window still cancels the owned Agent before another request/tool.
+                if (!guardContinuationAuthorization())
+                    return { kind: 'reject' };
+                return result;
+            }
+            finally {
+                activeGoalSteps -= 1;
+                // Do not wait for `whenIdle()`: an uncooperative tool can keep it
+                // pending forever.  The timeout/cancellation path already settled
+                // non-quiescent, and the fences remain until handle teardown.
+                maybeFinish();
+            }
+        }, { prepend: true });
+        removeRequest = agent.ctx.on('agent/request', async (_payload, next) => {
+            if (goalId === undefined)
+                return await next();
+            if (!guardContinuationAuthorization()) {
+                throw new Error('assistant-delivery: goal continuation authorization revoked before model request');
+            }
+            const request = await next();
+            if (!guardContinuationAuthorization()) {
+                throw new Error('assistant-delivery: goal continuation authorization revoked while preparing model request');
+            }
+            return request;
+        }, { prepend: true });
+        removePreExecute = agent.ctx.on('tools/pre-execute', async (_execution, next) => {
+            if (guardContinuationAuthorization())
+                return await next();
+            return { kind: 'deny', reason: 'assistant-delivery: goal continuation authorization revoked' };
+        }, { prepend: true });
+        removeToolGuard = agent.ctx.tools.guard(() => guardContinuationAuthorization()
+            ? undefined
+            : 'assistant-delivery: goal continuation authorization revoked');
+        const beginSettling = () => {
+            if (!settleRequested) {
+                settleRequested = true;
+                // A goal may create and complete during the foreground pre-step,
+                // before Delivery reaches `settle()`.  That still leaves its Agent
+                // scope to tear down, so it needs the same bounded deadline.
+                deadlineAt = Date.now() + this.options.goalContinuationTimeoutMs;
+            }
+            if (settled)
+                return completion;
+            if (goalId === undefined) {
+                finishNaturally();
+                return completion;
+            }
+            timeout = setTimeout(() => cancelUnknown('assistant-delivery-goal-continuation-timeout'), this.options.goalContinuationTimeoutMs);
+            timeout.unref?.();
+            // A driver may have already claimed its first round before the original
+            // Delivery turn reached its reply boundary. All step and tool guards
+            // were installed above, before that round could begin.
+            if (signal.aborted)
+                cancelUnknown('assistant-delivery-goal-continuation-cancelled');
+            else if (!isAuthorized())
+                cancelUnknown('assistant-delivery-goal-continuation-authorization-revoked');
+            else
+                maybeFinish();
+            return completion;
+        };
+        if (signal.aborted)
+            aborted();
+        return {
+            settle: beginSettling,
+            teardownTimeoutMs,
+            isQuiescent,
+            dispose: () => {
+                if (timeout !== undefined)
+                    clearTimeout(timeout);
+                if (!settled)
+                    cancelUnknown('assistant-delivery-goal-continuation-teardown');
+                releaseFences();
+            },
+        };
+    }
+    async disposeAfterReplyBoundary(sessionId, handle, afterDisposed, abandonDisposal = false, timeoutMs) {
         const control = this.activeSessionControls.get(sessionId);
         control?.resolveReplySafe();
-        if (handle === undefined)
-            return;
+        if (handle === undefined) {
+            afterDisposed?.();
+            return true;
+        }
         const disposal = Promise.resolve().then(() => handle.dispose());
-        const disposition = control === undefined
-            ? await disposal.then(() => 'disposed')
-            : await Promise.race([
-                disposal.then(() => 'disposed'),
-                control.cancelRequested.then(() => 'cancelled'),
-            ]);
-        if (disposition === 'cancelled') {
+        let clearDeadline;
+        const deadline = timeoutMs === undefined
+            ? undefined
+            : timeoutMs <= 0
+                ? Promise.resolve('timed-out')
+                : new Promise(resolve => {
+                    const timeout = setTimeout(() => resolve('timed-out'), timeoutMs);
+                    timeout.unref?.();
+                    clearDeadline = () => clearTimeout(timeout);
+                });
+        let removeAbort;
+        const aborted = control === undefined
+            ? undefined
+            : new Promise(resolve => {
+                const abort = () => resolve('aborted');
+                control.controller.signal.addEventListener('abort', abort, { once: true });
+                removeAbort = () => control.controller.signal.removeEventListener('abort', abort);
+                if (control.controller.signal.aborted)
+                    abort();
+            });
+        let released = false;
+        const releaseAfterDisposal = () => {
+            if (released)
+                return;
+            released = true;
+            try {
+                afterDisposed?.();
+            }
+            catch (error) {
+                this.ctx.logger.warn(`assistant-delivery: continuation fence release failed: ${String(error)}`);
+            }
+        };
+        let disposition;
+        try {
+            disposition = control === undefined
+                ? (abandonDisposal ? 'abandoned' : await Promise.race([
+                    disposal.then(() => 'disposed', () => 'rejected'),
+                    ...(deadline === undefined ? [] : [deadline]),
+                ]))
+                : await Promise.race([
+                    disposal.then(() => 'disposed', () => 'rejected'),
+                    control.cancelRequested.then(() => 'cancelled'),
+                    ...(aborted === undefined ? [] : [aborted]),
+                    ...(deadline === undefined ? [] : [deadline]),
+                    ...(abandonDisposal ? [Promise.resolve('abandoned')] : []),
+                ]);
+        }
+        finally {
+            removeAbort?.();
+            clearDeadline?.();
+        }
+        if (disposition === 'cancelled' || disposition === 'abandoned'
+            || disposition === 'aborted' || disposition === 'timed-out') {
             // The Delivery turn is already cancelled and cannot enqueue another
             // reply. Teardown remains owned, but a third-party disposer must not
             // hold the conversation transition or its fresh generation hostage.
-            void disposal.catch(error => {
-                this.ctx.logger.warn(`assistant-delivery: cancelled session disposer failed for ${sessionFingerprint(sessionId)}: ${String(error)}`);
+            void disposal.then(() => releaseAfterDisposal(), error => {
+                this.ctx.logger.warn(`assistant-delivery: detached session disposer failed for ${sessionFingerprint(sessionId)}: ${String(error)}`);
+                releaseAfterDisposal();
             });
-            return;
+            return false;
         }
+        releaseAfterDisposal();
+        if (disposition === 'rejected') {
+            this.ctx.logger.warn(`assistant-delivery: session disposer failed for ${sessionFingerprint(sessionId)}`);
+            return false;
+        }
+        return true;
     }
     /** Wait for only the turn that claims Delivery's exact message identity. */
     followupTurn(agent, message, onClaimed, onSettled) {
@@ -1209,7 +1575,7 @@ export class DshDeliveryRuntime {
         }
     }
     /**
-     * Queue a synthetic completion turn only after the previous exact turn retired. rc.8 may still
+     * Queue a synthetic completion turn only after the previous exact turn retired. The runtime may still
      * serialize scoped tool schemas, but every call is denied before approval/execution while this
      * turn owns the Agent, so recovering prose cannot repeat an external side effect.
      */
@@ -1264,7 +1630,7 @@ export class DshDeliveryRuntime {
             if (agent.status !== 'idle' || agent.inbox.hasPending) {
                 throw new AutomaticCompletionUnavailableError('assistant-delivery: automatic completion lost the idle scheduling boundary');
             }
-            const latestBoundary = agent.session.events.findLast(event => event.type === 'turn/start' || event.type === 'turn/end');
+            const latestBoundary = agent.session.snapshotEvents().findLast(event => event.type === 'turn/start' || event.type === 'turn/end');
             if (latestBoundary?.type !== 'turn/end' || latestBoundary.data.turn !== expectedPreviousTurn) {
                 throw new AutomaticCompletionUnavailableError('assistant-delivery: another turn crossed the automatic completion boundary');
             }
@@ -1292,15 +1658,15 @@ export class DshDeliveryRuntime {
                 releaseToolBarriers();
         }
     }
-    async setupAgent(agentCtx, workspace, presetId, principal, selected, agentPresets) {
+    async setupAgent(agentCtx, workspace, presetId, principal, selected, agentPresets, initiator = 'external') {
         const agent = agentCtx.agent;
         if (agent === undefined)
             throw new Error('assistant-delivery: unpublished Agent identity is missing');
         if (agent.session.header.cwd !== workspace || agent.session.header.agentPreset !== presetId) {
             throw new DurableAgentIdentityError('assistant-delivery: durable Agent identity does not match its conversation binding');
         }
-        const unbind = this.policy.bindInitiator(agent, 'external', principal);
-        agentCtx.effect(() => unbind, 'assistant-delivery.external-initiator');
+        const unbind = this.policy.bindInitiator(agent, initiator, principal);
+        agentCtx.effect(() => unbind, `assistant-delivery.${initiator}-initiator`);
         installModelSelection(agentCtx, { current: selected, assembled: undefined });
         await agentPresets?.mount(agentCtx, presetId);
     }
@@ -1343,7 +1709,9 @@ export class DshDeliveryRuntime {
         }
     }
     async reconcileNativeFullPermissionReviewer(session) {
+        this.sessionLeases.assert(String(session.id));
         const result = await this.policy.reconcileNativeFullReviewer(session);
+        this.sessionLeases.assert(String(session.id));
         if (result === 'unavailable') {
             throw new ApprovalReviewerReaderUnavailableError(new Error('assistant-policy: native full reviewer reconciliation is unavailable'));
         }
@@ -1482,7 +1850,7 @@ export class DshDeliveryRuntime {
             signal.throwIfAborted();
             await requireWorkspace(binding.workspace);
             signal.throwIfAborted();
-            handle = await agents.resume({
+            handle = await this.resumeAgent({
                 resumeSessionId: SessionId(binding.sessionId),
                 signal,
                 agentOptions: {
@@ -1532,7 +1900,7 @@ export class DshDeliveryRuntime {
                     const flushed = await sessions.flush(session);
                     return reviewerReady
                         && flushed
-                        && currentPermissionLevel(permissionPresets, targets, session.events) === 'ask';
+                        && currentPermissionLevel(permissionPresets, targets, session) === 'ask';
                 }
                 catch {
                     return false;
@@ -1596,8 +1964,8 @@ export class DshDeliveryRuntime {
             if (action.kind === 'invalid' || action.kind === 'warn-full') {
                 return retryPermissionRecovery(recovery ?? 'failure-notice');
             }
-            const currentStateHash = permissionStateHash(session.events, targets.tableFingerprint);
-            const beforeLevel = currentPermissionLevel(permissionPresets, targets, session.events);
+            const currentStateHash = permissionStateHash(session.snapshotEvents(), targets.tableFingerprint);
+            const beforeLevel = currentPermissionLevel(permissionPresets, targets, session);
             const recoveredCommittedTarget = recovery === 'commit'
                 && action.kind === 'switch'
                 && beforeLevel === action.level;
@@ -1641,7 +2009,7 @@ export class DshDeliveryRuntime {
                 return reply({ text: '权限卡片已过期或状态已变化；当前权限未改变。请重新发送 /permissions。', format: 'plain' });
             }
             if (action.kind === 'show') {
-                const level = currentPermissionLevel(permissionPresets, targets, session.events);
+                const level = currentPermissionLevel(permissionPresets, targets, session);
                 const emergencyStop = this.policy.getEmergencyStop();
                 if (emergencyStop.enabled)
                     return authorizationFailure('revoked');
@@ -1653,7 +2021,7 @@ export class DshDeliveryRuntime {
                         issuedAt,
                         expiresAt: issuedAt + this.options.permissionPickerTtlMs,
                         current: level,
-                        expectedStateHash: permissionStateHash(session.events, targets.tableFingerprint),
+                        expectedStateHash: permissionStateHash(session.snapshotEvents(), targets.tableFingerprint),
                         emergencyStopVersion: emergencyStop.version,
                         bindingVersion: binding.version,
                         sessionId: binding.sessionId,
@@ -1727,7 +2095,7 @@ export class DshDeliveryRuntime {
                 signal.throwIfAborted();
                 return retryPermissionRecovery('failure-notice');
             }
-            const afterLevel = currentPermissionLevel(permissionPresets, targets, session.events);
+            const afterLevel = currentPermissionLevel(permissionPresets, targets, session);
             if (afterLevel !== action.level) {
                 const safeAskPersisted = await compensateToAsk();
                 signal.throwIfAborted();
@@ -1812,9 +2180,14 @@ export class DshDeliveryRuntime {
         const setup = async (agentCtx) => {
             await this.setupAgent(agentCtx, workspace, presetId, externalPrincipalId(input.envelope.principal), selected, agentPresets);
         };
+        const lease = this.sessionLeases.open({ kind: 'construction', sessionId: String(id),
+            conversation: input.envelope.conversation, principal: input.envelope.principal,
+            workspace, agentPreset: presetId, generation: input.generation,
+            ...(input.previous === undefined ? {} : { previous: input.previous }) }, input.signal);
         let handle;
         let adopted = false;
         try {
+            lease.dispatch();
             const agentOptions = {
                 provider: selected.provider,
                 model: selected.model,
@@ -1823,22 +2196,22 @@ export class DshDeliveryRuntime {
             const persistence = this.ctx.get('sessionPersistence');
             const persisted = persistence === undefined
                 ? false
-                : (await persistence.list(input.signal)).some(header => String(header.id) === String(id));
+                : (await persistence.list(lease.signal)).some(header => String(header.id) === String(id));
             if (persisted) {
-                handle = await agents.resume({
+                handle = await this.resumeAgent({
                     resumeSessionId: id,
                     agentOptions,
-                    signal: input.signal,
+                    signal: lease.signal,
                     setup,
                 });
                 adopted = true;
             }
             if (handle === undefined) {
-                handle = await agents.create({
+                handle = await this.sessionLeases.create(this.ctx, {
                     sessionId: id,
                     meta: { cwd: workspace, agentPreset: presetId },
                     agentOptions,
-                    signal: input.signal,
+                    signal: lease.signal,
                     setup,
                 });
             }
@@ -1853,8 +2226,340 @@ export class DshDeliveryRuntime {
                 policyRef: input.previous?.policyRef ?? this.options.policyRef };
         }
         finally {
-            await handle?.dispose();
+            try {
+                if (handle !== undefined)
+                    await handle.dispose();
+            }
+            finally {
+                lease.close();
+            }
+        }
+    }
+    /**
+     * Resume one previously owner-scheduled native Goal.  This is deliberately
+     * not an inbound-message path: it creates no delivery source and never
+     * calls followup().  The native round driver remains the only producer of
+     * `source.kind === 'goal'` work.
+     */
+    async resumeScheduledGoal(binding, input) {
+        const denied = () => ({ outcome: 'denied', dispatched: false, quiescent: false });
+        const now = Date.now();
+        if (!this.validGoalWakeInput(binding, input, now))
+            return denied();
+        const duration = input.deadlineAt - now;
+        const deadline = new AbortController();
+        const expire = setTimeout(() => deadline.abort(new Error('assistant-delivery: scheduled goal wake expired')), duration);
+        expire.unref?.();
+        const abort = () => deadline.abort(input.signal.reason);
+        input.signal.addEventListener('abort', abort, { once: true });
+        if (input.signal.aborted)
+            abort();
+        const signal = deadline.signal;
+        let lease;
+        let control;
+        let handle;
+        let releaseFences;
+        let dispatched = false;
+        let terminal = false;
+        let disposed = false;
+        let goalOutput;
+        try {
+            signal.throwIfAborted();
+            const persisted = this.options.getModelSelection(binding.conversation);
+            const requested = toModelRoute(persisted ?? { provider: this.options.provider, model: this.options.model });
+            const resolved = await this.resolveExecutionRoute(binding.conversation, persisted, requested, signal);
+            if ('retry' in resolved) {
+                return denied();
+            }
+            const selected = agentSelection(resolved.route);
+            const presets = this.options.getAgentPresets();
+            const presetId = presets === undefined ? binding.agentPreset : (await presets.resolve(binding.agentPreset)).id;
+            signal.throwIfAborted();
+            await requireWorkspace(binding.workspace);
+            signal.throwIfAborted();
+            try {
+                lease = this.sessionLeases.open({ kind: 'bound', binding }, signal);
+            }
+            catch (error) {
+                if (error instanceof SessionLeaseUnavailable) {
+                    return { outcome: error.kind, dispatched: false, quiescent: false };
+                }
+                throw error;
+            }
+            control = this.beginSessionControl(binding.sessionId, lease.signal);
+            lease.dispatch();
+            handle = await this.resumeAgent({
+                resumeSessionId: SessionId(binding.sessionId),
+                signal: control.controller.signal,
+                agentOptions: { provider: selected.provider, model: selected.model, maxTokens: this.options.maxOutputTokens },
+                setup: async (agentCtx) => {
+                    // Restored inbox entries may wake immediately on Session publication.
+                    // Install the background-only gate before that publication boundary.
+                    if (agentCtx.agent === undefined)
+                        throw new Error('assistant-delivery: wake Agent missing');
+                    releaseFences = this.installScheduledGoalFences(agentCtx.agent, input);
+                    await this.setupAgent(agentCtx, binding.workspace, presetId, input.attestation.principalId, selected, presets, 'background');
+                    const llm = this.ctx.get('llm');
+                    if (llm === undefined)
+                        throw new Error('assistant-delivery: llm service is required');
+                    requireAdapterToolCallProtocol(llm, selected.provider, selected.model, presetId, agentCtx.tools.schemas(agentCtx.agent).length);
+                },
+            });
+            const agent = handle.agent;
+            this.assertScheduledGoal(input, agent, 'before-resume');
+            await this.reconcileNativeFullPermissionReviewer(agent.session);
+            this.assertScheduledGoal(input, agent, 'before-resume');
+            const goals = this.ctx.get('goals');
+            const current = goals?.get(agent);
+            if (goals === undefined || current === undefined || String(current.id) !== input.native.goalId
+                || current.revision !== input.native.revision || current.phase !== 'paused'
+                || current.activation !== 'disarmed' || current.roundsStarted >= current.maxGoalRounds) {
+                return denied();
+            }
+            if (agent.status !== 'idle' || agent.inbox.hasPending) {
+                return denied();
+            }
+            this.assertScheduledGoal(input, agent, 'before-resume');
+            input.beforeResume(agent);
+            // `beforeResume` is the durable goal-wake CAS. Once it returned, native
+            // resume might have committed before throwing, so this invocation is no
+            // longer retry-safe regardless of the result of `goals.resume()`.
+            dispatched = true;
+            this.assertScheduledGoal(input, agent, 'before-resume');
+            const beforeSequence = agent.session.snapshotEvents().at(-1)?.seq ?? 0;
+            goals.resume(agent, { id: current.id, revision: current.revision });
+            terminal = await this.waitForScheduledGoalTerminal(agent, input, control.controller.signal);
+            if (terminal && input.includeOutput === true) {
+                this.assertScheduledGoal(input, agent, 'terminal');
+                const events = agent.session.snapshotEvents().filter(event => event.seq > beforeSequence);
+                const message = events.findLast(event => event.type === 'user/message'
+                    && event.data.source.kind === 'goal' && String(event.data.source.goalId) === input.native.goalId
+                    && event.data.source.revision === input.native.revision + 1);
+                const start = message === undefined ? undefined : events.findLast(event => event.type === 'turn/start' && event.seq < message.seq);
+                const turn = start?.type === 'turn/start' ? start.data.turn : undefined;
+                const end = events.find(event => event.type === 'turn/end' && event.data.turn === turn);
+                const inputs = start === undefined || end === undefined ? [] : events.filter(event => event.seq > start.seq && event.seq < end.seq
+                    && event.type === 'user/message' && !isScheduledGoalRuntimeContext(event.data.source));
+                const output = finalAssistant(events, 0, inputs.length === 1 && inputs[0]?.seq === message?.seq ? turn : undefined);
+                if (output.completed && !output.truncated && !output.stopped && !output.hasUnpairedToolCall
+                    && output.failureCode === undefined && output.text.trim() !== ''
+                    && Buffer.byteLength(output.text, 'utf8') <= this.options.maxTextBytes)
+                    goalOutput = output.text;
+            }
+        }
+        catch (error) {
+            if (!(error instanceof SessionLeaseUnavailable) && !signal.aborted) {
+                this.ctx.logger.warn(`assistant-delivery: scheduled goal wake failed: ${String(error)}`);
+            }
+            terminal = false;
+            try {
+                const agent = handle?.agent;
+                const goals = this.ctx.get('goals');
+                if (agent !== undefined) {
+                    try {
+                        goals?.disarm(agent);
+                    }
+                    catch { }
+                    agent.cancel({ kind: 'hook', reason: 'assistant-delivery-scheduled-goal-wake-cancelled' });
+                }
+            }
+            catch { }
         }
+        finally {
+            input.signal.removeEventListener('abort', abort);
+            clearTimeout(expire);
+            try {
+                const remaining = Math.max(0, input.deadlineAt - Date.now());
+                disposed = await this.disposeAfterReplyBoundary(binding.sessionId, handle, releaseFences, !terminal, remaining);
+            }
+            finally {
+                if (handle === undefined)
+                    releaseFences?.();
+                if (control !== undefined)
+                    this.endSessionControl(binding.sessionId, control);
+                lease?.close();
+            }
+        }
+        const quiescent = terminal && disposed && !signal.aborted;
+        return { outcome: quiescent ? 'succeeded' : 'unknown', dispatched, quiescent,
+            ...(quiescent && goalOutput !== undefined ? { output: goalOutput } : {}) };
+    }
+    validGoalWakeInput(binding, input, now) {
+        if (input === null || typeof input !== 'object' || input.signal === undefined
+            || typeof input.signal.aborted !== 'boolean' || typeof input.signal.addEventListener !== 'function'
+            || typeof input.signal.removeEventListener !== 'function' || input.signal.aborted
+            || !isDeliveryGoalWakeDeadline(input.deadlineAt, now) || typeof input.assertCurrent !== 'function'
+            || typeof input.beforeResume !== 'function' || typeof input.settle !== 'function'
+            || typeof input.resolveOutcomeFeedbackTarget !== 'function'
+            || (input.includeOutput !== undefined && typeof input.includeOutput !== 'boolean') || typeof input.native?.goalId !== 'string'
+            || input.native.goalId.length === 0 || input.native.goalId.length > 512
+            || !Number.isSafeInteger(input.native.revision) || input.native.revision < 1)
+            return false;
+        const attestation = input.attestation;
+        return attestation !== null && typeof attestation === 'object'
+            && attestation.bindingId === binding.id && attestation.bindingVersion === binding.version
+            && attestation.bindingGeneration === binding.generation && attestation.sessionId === binding.sessionId
+            && attestation.scope?.workspace === binding.workspace && attestation.scope.preset === binding.agentPreset
+            && attestation.principalId === externalPrincipalId(binding.principal)
+            && typeof attestation.principalLineage?.principalRecordId === 'string'
+            && attestation.principalLineage.principalRecordId.length > 0
+            && Number.isSafeInteger(attestation.principalLineage.principalVersion)
+            && attestation.principalLineage.principalVersion >= 1;
+    }
+    assertScheduledGoal(input, agent, phase) {
+        this.sessionLeases.assert(String(agent.session.id));
+        input.signal.throwIfAborted();
+        if (Date.now() >= input.deadlineAt)
+            throw new Error('assistant-delivery: scheduled goal wake expired');
+        input.assertCurrent(agent, phase);
+    }
+    installScheduledGoalFences(agent, input) {
+        const goalTurn = () => {
+            const events = agent.session.snapshotEvents();
+            const start = events.findLast(event => event.type === 'turn/start');
+            // DSH persists runtime context snapshots as user/message too; they are
+            // context for this turn, never a second input or a grant of authority.
+            const messages = start === undefined ? [] : events.filter(event => event.seq > start.seq && event.type === 'user/message'
+                && !isScheduledGoalRuntimeContext(event.data.source));
+            if (start === undefined || events.some(event => event.seq > start.seq && event.type === 'turn/end')
+                || messages.length !== 1 || messages[0]?.type !== 'user/message')
+                throw new Error('assistant-delivery: exact native goal turn required');
+            const source = messages[0].data.source;
+            const native = this.ctx.get('goals')?.get(agent);
+            if (source.kind !== 'goal' || String(source.goalId) !== input.native.goalId
+                || source.revision !== input.native.revision + 1 || source.round < 1
+                || native === undefined || native.phase !== 'active' || String(native.id) !== input.native.goalId
+                || native.revision !== source.revision || native.roundsStarted !== source.round)
+                throw new Error('assistant-delivery: foreign wake input denied');
+        };
+        const reject = () => {
+            try {
+                agent.cancel({ kind: 'hook', reason: 'assistant-delivery-scheduled-goal-wake-revoked' });
+            }
+            catch { }
+            throw new Error('assistant-delivery: scheduled goal wake authorization changed');
+        };
+        const request = agent.ctx.on('agent/request', async (_payload, next) => {
+            try {
+                goalTurn();
+                this.assertScheduledGoal(input, agent, 'running');
+            }
+            catch {
+                return reject();
+            }
+            const result = await next();
+            try {
+                goalTurn();
+                this.assertScheduledGoal(input, agent, 'running');
+            }
+            catch {
+                return reject();
+            }
+            return result;
+        }, { prepend: true });
+        const preExecute = agent.ctx.on('tools/pre-execute', async (_payload, next) => {
+            try {
+                goalTurn();
+                this.assertScheduledGoal(input, agent, 'running');
+            }
+            catch {
+                return { kind: 'deny', reason: 'assistant-delivery: scheduled goal wake authorization changed' };
+            }
+            const result = await next();
+            try {
+                goalTurn();
+                this.assertScheduledGoal(input, agent, 'running');
+            }
+            catch {
+                return { kind: 'deny', reason: 'assistant-delivery: scheduled goal wake authorization changed' };
+            }
+            return result;
+        }, { prepend: true });
+        const guard = agent.ctx.tools.guard(() => {
+            try {
+                goalTurn();
+                this.assertScheduledGoal(input, agent, 'running');
+                return undefined;
+            }
+            catch {
+                return 'assistant-delivery: scheduled goal wake authorization changed';
+            }
+        });
+        return () => { request(); preExecute(); guard(); };
+    }
+    waitForScheduledGoalTerminal(agent, input, signal) {
+        return new Promise(resolve => {
+            let settled = false;
+            let verifying = false;
+            const finish = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                removeGoal();
+                removeStatus();
+                signal.removeEventListener('abort', aborted);
+                resolve(value);
+            };
+            const check = () => {
+                if (settled || verifying)
+                    return;
+                try {
+                    this.sessionLeases.assert(String(agent.session.id));
+                    input.signal.throwIfAborted();
+                    if (Date.now() >= input.deadlineAt)
+                        throw new Error('assistant-delivery: scheduled goal wake expired');
+                    const goals = this.ctx.get('goals');
+                    const current = goals?.get(agent);
+                    if (current === undefined || String(current.id) !== input.native.goalId)
+                        return finish(false);
+                    if (current.phase === 'active') {
+                        input.assertCurrent(agent, 'running');
+                        return;
+                    }
+                    if (agent.status !== 'idle' || agent.inbox.hasPending)
+                        return;
+                    input.assertCurrent(agent, 'terminal');
+                    // Native idle/round-limit can precede the asynchronous step and
+                    // whole-goal verifier. Keep the Agent and its lease alive until that
+                    // exact terminal round settles; cancellation still ends this wait.
+                    verifying = true;
+                    void Promise.resolve().then(() => input.settle(agent, signal)).then(() => {
+                        if (settled)
+                            return;
+                        signal.throwIfAborted();
+                        this.assertScheduledGoal(input, agent, 'terminal');
+                        if (agent.status !== 'idle' || agent.inbox.hasPending)
+                            throw new Error('assistant-delivery: goal changed during terminal settlement');
+                        finish(true);
+                    }).catch(() => {
+                        if (settled)
+                            return;
+                        try {
+                            agent.cancel({ kind: 'hook', reason: 'assistant-delivery-scheduled-goal-settlement-failed' });
+                        }
+                        catch { }
+                        finish(false);
+                    });
+                }
+                catch {
+                    try {
+                        agent.cancel({ kind: 'hook', reason: 'assistant-delivery-scheduled-goal-wake-revoked' });
+                    }
+                    catch { }
+                    finish(false);
+                }
+            };
+            const removeGoal = this.ctx.on('goal/changed', ({ agent: changed }) => { if (changed === agent)
+                check(); });
+            const removeStatus = this.ctx.on('agent/status', ({ agent: changed }) => { if (changed === agent)
+                check(); });
+            const aborted = () => finish(false);
+            signal.addEventListener('abort', aborted, { once: true });
+            if (signal.aborted)
+                aborted();
+            else
+                check();
+        });
     }
     async prepare(binding, envelope, signal, context) {
         const imageCount = (envelope.attachments ?? [])
@@ -1954,9 +2659,13 @@ export class DshDeliveryRuntime {
         signal.throwIfAborted();
         markDispatching();
         signal.throwIfAborted();
-        if (parsed.kind === 'objective') {
-            const objective = await this.options.dispatchObjectiveFeedback(binding, envelope, parsed.objectiveStatus);
+        if (parsed.kind === 'objective' || parsed.kind === 'objective-revision' || parsed.kind === 'objective-status') {
+            const objective = await this.options.dispatchObjectiveFeedback(binding, envelope, parsed.kind === 'objective' ? parsed.objectiveStatus : parsed);
             signal.throwIfAborted();
+            if (typeof objective === 'object') {
+                this.options.replyCommand(binding, envelope.eventId, { text: (parsed.kind === 'objective-status' ? '' : `已把该次任务结果记录为 ${objective.objectiveStatus}；同一次任务只计一票。\n`) + objectiveStateMessage(objective), format: 'plain' });
+                return { outcome: 'processed' };
+            }
             if (objective === 'unknown') {
                 return {
                     outcome: 'not-processed',
@@ -1980,13 +2689,13 @@ export class DshDeliveryRuntime {
             }
             if (objective === 'conflict') {
                 this.options.replyCommand(binding, envelope.eventId, {
-                    text: '该次任务已经记录了不同的任务结果；为避免重复计票，本次未覆盖原记录。',
+                    text: '该次任务已经记录了不同的任务结果或反馈版本已变化，本次未覆盖。请回复原任务结果发送 /feedback status，使用当前版本更正或撤回。',
                     format: 'plain',
                 });
                 return { outcome: 'processed' };
             }
             this.options.replyCommand(binding, envelope.eventId, {
-                text: `已把该次任务结果记录为 ${parsed.objectiveStatus}；同一次任务只计一票。`,
+                text: parsed.kind === 'objective-status' ? '尚未记录任务反馈，请回复原任务结果发送 /feedback achieved、partial 或 not-achieved。' : `已把该次任务结果记录为 ${parsed.objectiveStatus}；同一次任务只计一票。回复原结果发送 /feedback status 可更正或撤回。`,
                 format: 'plain',
             });
             return { outcome: 'processed' };
@@ -2271,7 +2980,7 @@ export class DshDeliveryRuntime {
                 ? binding.agentPreset
                 : (await agentPresets.resolve(binding.agentPreset)).id;
             await requireWorkspace(binding.workspace);
-            handle = await agents.resume({
+            handle = await this.resumeAgent({
                 resumeSessionId: SessionId(binding.sessionId),
                 signal,
                 agentOptions: {
@@ -2299,7 +3008,7 @@ export class DshDeliveryRuntime {
             }
             if (command.name === 'status' || command.name === 'session') {
                 const messages = agent.session.deriveMessages().length;
-                const turns = agent.session.events.filter(event => event.type === 'turn/end').length;
+                const turns = agent.session.snapshotEvents().filter(event => event.type === 'turn/end').length;
                 return this.replySessionCommand(binding, envelope, {
                     text: [
                         '当前会话',
@@ -2433,12 +3142,41 @@ export class DshDeliveryRuntime {
                 format: 'plain',
             }, outerSignal, markDispatching);
         }
-        const control = this.beginSessionControl(binding.sessionId, outerSignal);
+        let lease;
+        try {
+            lease = this.sessionLeases.open({ kind: 'bound', binding }, outerSignal);
+        }
+        catch (error) {
+            if (error instanceof SessionLeaseUnavailable) {
+                if (error.kind === 'unknown' && !outerSignal.aborted) {
+                    try {
+                        if (this.options.isInboundAuthorized(binding, envelope))
+                            this.options.replyCommand(binding, envelope.eventId, {
+                                text: '上一次执行是否已经停止还无法确认，因此暂时无法继续这个会话。请先核对外部操作；需要独立开始新任务可发送 /new，旧会话会保留。',
+                                format: 'plain',
+                            });
+                    }
+                    catch { /* Keep the exact unknown execution diagnostic even if its notice is unavailable. */ }
+                }
+                return {
+                    outcome: 'not-processed', failureCode: `session-lease-${error.kind}`,
+                    retryable: error.kind === 'busy', retryAfterMs: this.sessionLeases.leaseMs,
+                };
+            }
+            throw error;
+        }
+        let control;
         try {
-            return await this.processControlled(binding, envelope, control.controller.signal, sessionCommand, prepared, markDispatching);
+            control = this.beginSessionControl(binding.sessionId, lease.signal);
+            lease.dispatch();
+            return await this.processControlled(binding, envelope, control.controller.signal, sessionCommand, prepared, markDispatching === undefined ? undefined : () => {
+                lease.assert();
+                markDispatching();
+                lease.assert();
+            });
         }
         catch (error) {
-            if (control.command !== undefined && causedByUserCancellation(error)) {
+            if (control?.command !== undefined && causedByUserCancellation(error)) {
                 return permissionCommand(sessionCommand) === undefined
                     ? { outcome: 'processed' }
                     : {
@@ -2450,7 +3188,9 @@ export class DshDeliveryRuntime {
             throw error;
         }
         finally {
-            this.endSessionControl(binding.sessionId, control);
+            if (control !== undefined)
+                this.endSessionControl(binding.sessionId, control);
+            lease.close();
         }
     }
     async processControlled(binding, envelope, signal, sessionCommand, prepared, markDispatching) {
@@ -2560,6 +3300,10 @@ export class DshDeliveryRuntime {
         const selected = agentSelection(selectedRoute);
         let handle;
         let dispatched = false;
+        let acceptance;
+        let acceptanceSucceeded = false;
+        let goalContinuation;
+        let goalContinuationQuiescent = true;
         let removeAbort;
         let removeProgress;
         let progressOpen = true;
@@ -2582,7 +3326,7 @@ export class DshDeliveryRuntime {
                 ? binding.agentPreset
                 : (await agentPresets.resolve(binding.agentPreset)).id;
             await requireWorkspace(binding.workspace);
-            handle = await agents.resume({ resumeSessionId: SessionId(binding.sessionId), signal,
+            handle = await this.resumeAgent({ resumeSessionId: SessionId(binding.sessionId), signal,
                 agentOptions: { provider: selected.provider, model: selected.model,
                     maxTokens: this.options.maxOutputTokens },
                 setup: async (agentCtx) => {
@@ -2607,7 +3351,7 @@ export class DshDeliveryRuntime {
                 if (authorizationFailure !== undefined)
                     return authorizationFailure;
             }
-            let turnFrom = agent.session.events.length;
+            let turnFrom = agent.session.snapshotEvents().length;
             const automaticCompletionTurns = new Map();
             const automaticCompletionToolViolations = new Set();
             removeProgress = this.ctx.on('session/event', (session, event) => {
@@ -2649,6 +3393,11 @@ export class DshDeliveryRuntime {
             const authorizationFailure = preDispatchAuthorizationFailure();
             if (authorizationFailure !== undefined)
                 return authorizationFailure;
+            // Mount the native-goal fences before the foreground message is queued:
+            // an owner tool can create/resume a goal in that very first turn and the
+            // host driver is otherwise free to claim its first round at idle.
+            goalContinuation = this.waitForNativeGoalContinuation(binding, envelope, agent, signal);
+            acceptance = this.options.prepareForegroundTaskAcceptance(binding, envelope);
             markDispatching();
             // Once the durable marker exists, even a synchronous followup failure is ambiguous:
             // implementations may enqueue before throwing, so no retry is safe.
@@ -2663,7 +3412,7 @@ export class DshDeliveryRuntime {
             let assembledText = '';
             let bestEffortText = '';
             while (true) {
-                const output = finalAssistant(agent.session.events, turnFrom, deliveryTurn);
+                const output = finalAssistant(agent.session.snapshotEvents(), turnFrom, deliveryTurn);
                 let addedText = false;
                 if (output.text.trim() !== '') {
                     if (completionKind === 'compact' || completionKind === 'regenerate') {
@@ -2714,7 +3463,7 @@ export class DshDeliveryRuntime {
                                 ? 'compact'
                                 : 'continue';
                     automaticTurns += 1;
-                    turnFrom = agent.session.events.length;
+                    turnFrom = agent.session.snapshotEvents().length;
                     const completionMessage = createUserMessage({
                         content: [{
                                 type: 'text',
@@ -2828,13 +3577,20 @@ export class DshDeliveryRuntime {
                 break;
             }
             signal.throwIfAborted();
-            // Agent answers are authored as Markdown (tables, bold, inline code), so request Markdown
-            // rendering; sending them as plain text shows the raw `|---|` and `**` syntax to the user.
+            // The foreground reply has already crossed its durable reply path.
+            // Retain the same Agent afterwards only for the native goal driver; its
+            // unknown result must never turn the original reply into a claim that
+            // the business goal was achieved.
             const learning = await this.options.replyCompletedPreferenceTurn(agent, binding, envelope, { text: assembledText, format: 'markdown' });
             if (learning === 'unknown') {
                 this.ctx.logger.warn('assistant-delivery: completed-turn preference projection is ambiguous');
             }
+            if (goalContinuation !== undefined) {
+                goalContinuationQuiescent = await goalContinuation.settle();
+            }
+            signal.throwIfAborted();
             publishProgress({ kind: 'completed' });
+            acceptanceSucceeded = goalContinuationQuiescent;
             return { outcome: 'processed' };
         }
         catch (error) {
@@ -2878,7 +3634,24 @@ export class DshDeliveryRuntime {
             removeAbort?.();
             removeProgress?.();
             progressOpen = false;
-            await this.disposeAfterReplyBoundary(binding.sessionId, handle);
+            let disposed = false;
+            try {
+                disposed = await this.disposeAfterReplyBoundary(binding.sessionId, handle, () => goalContinuation?.dispose(), !goalContinuationQuiescent, goalContinuation?.teardownTimeoutMs());
+            }
+            finally {
+                acceptanceSucceeded = acceptanceSucceeded && disposed && !signal.aborted
+                    && (goalContinuation?.isQuiescent() ?? true);
+                if (acceptance !== undefined) {
+                    try {
+                        await this.options.completeForegroundTaskAcceptance(acceptance, {
+                            status: acceptanceSucceeded ? 'succeeded' : 'unknown', quiescent: acceptanceSucceeded,
+                        });
+                    }
+                    catch (error) {
+                        this.ctx.logger.warn(`assistant-delivery: acceptance completion failed: ${String(error)}`);
+                    }
+                }
+            }
         }
     }
 }