@openchambery/web 1.19.21-beta.1 → 2.0.0-beta.1

package/server/lib/opencode/server-utils-runtime.js

@@ -21,6 +21,7 @@ export const createServerUtilsRuntime = (dependencies) => {
     setOpenCodeNotReadySince,
     clearLastOpenCodeError,
     getLoginShellPath,
+    getStoredSessionMetadata = null,
   } = dependencies;
 
   const setOpenCodePort = (port) => {
@@ -215,6 +216,7 @@ export const createServerUtilsRuntime = (dependencies) => {
       getUiNotificationClients,
       onInteractiveSessionRequest: options.onInteractiveSessionRequest,
       onSessionTurnAdmission: options.onSessionTurnAdmission,
+      getStoredSessionMetadata,
     });
   };
 

package/server/lib/opencode/skill-routes.js

@@ -1,4 +1,4 @@
-import { createOpencodeClient } from '@opencode-ai/sdk/v2';
+import { OpenCode } from '@opencode/client';
 
 const summarizeDescription = (value) => {
   const normalized = typeof value === 'string' ? value.replace(/\s+/gu, ' ').trim() : '';
@@ -127,19 +127,18 @@ export const registerSkillRoutes = (app, dependencies) => {
     }
 
     try {
-      const client = createOpencodeClient({
+      const client = OpenCode.make({
         baseUrl: buildOpenCodeUrl('/', '').replace(/\/$/, ''),
-        directory: workingDirectory || undefined,
         headers: getOpenCodeAuthHeaders(),
         fetch: (request) => fetch(request, { signal: AbortSignal.timeout(8_000) }),
       });
 
-      const response = await client.app.skills(
-        workingDirectory ? { directory: workingDirectory } : undefined,
+      const response = await client.skill.list(
+        workingDirectory ? { location: { directory: workingDirectory } } : undefined,
       );
       const payload = response?.data;
       if (!Array.isArray(payload)) {
-        return [];
+        throw new Error('OpenCode skill catalog is unavailable');
       }
 
       return payload
@@ -177,7 +176,7 @@ export const registerSkillRoutes = (app, dependencies) => {
         .filter(Boolean);
     } catch (error) {
       console.error('Failed to list OpenCode skills:', error);
-      return [];
+      throw error;
     }
   };
 

package/server/lib/opencode/skill-routes.test.js

@@ -2,16 +2,16 @@ import { describe, expect, it, vi } from 'vitest';
 import express from 'express';
 import request from 'supertest';
 
-vi.mock('@opencode-ai/sdk/v2', () => ({ createOpencodeClient: vi.fn() }));
+vi.mock('@opencode/client', () => ({ OpenCode: { make: vi.fn() } }));
 
-const { createOpencodeClient } = await import('@opencode-ai/sdk/v2');
+const { OpenCode } = await import('@opencode/client');
 const { registerSkillRoutes } = await import('./skill-routes.js');
 
 describe('skill summary route', () => {
   it('returns compact normalized skill data without content or sources', async () => {
-    createOpencodeClient.mockReturnValue({
-      app: {
-        skills: vi.fn(async () => ({ data: [{
+    OpenCode.make.mockReturnValue({
+      skill: {
+        list: vi.fn(async () => ({ data: [{
           name: 'skill',
           location: '/repo/.opencode/skills/skill/SKILL.md',
           description: ` ${'😀'.repeat(161)}\nnext `,
@@ -47,5 +47,36 @@ describe('skill summary route', () => {
     });
     expect(response.body.skills[0]).not.toHaveProperty('content');
     expect(response.body.skills[0]).not.toHaveProperty('sources');
+    expect(OpenCode.make).toHaveBeenCalledWith(expect.objectContaining({
+      baseUrl: 'http://opencode-upstream:4096',
+      headers: { Authorization: 'Basic example' },
+    }));
+    expect(OpenCode.make.mock.calls[0][0].directory).toBeUndefined();
+  });
+
+  it('returns 500 when OpenCode skill list fails instead of an empty success', async () => {
+    OpenCode.make.mockReturnValue({
+      skill: {
+        list: vi.fn(async () => { throw new Error('upstream sentinel'); }),
+      },
+    });
+    const app = express();
+    registerSkillRoutes(app, {
+      fs: { existsSync: () => false },
+      path: await import('node:path'),
+      os: await import('node:os'),
+      resolveProjectDirectory: async () => ({ directory: '/repo' }),
+      resolveOptionalProjectDirectory: async () => ({ directory: '/repo' }),
+      buildOpenCodeUrl: () => 'http://opencode-upstream:4096/',
+      getOpenCodeAuthHeaders: () => ({ Authorization: 'Basic example' }),
+      getOpenCodePort: () => 4096,
+      SKILL_SCOPE: { PROJECT: 'project', USER: 'user' },
+      discoverSkills: () => [],
+      mergeDiscoveredSkills: (primary) => primary,
+    });
+
+    const response = await request(app).get('/api/config/skills?summary=true&directory=%2Frepo').expect(500);
+    expect(JSON.stringify(response.body)).not.toContain('sentinel');
+    expect(response.body).toEqual({ error: 'Failed to list skills' });
   });
 });

package/server/lib/opencode/v1-migration-gate.js

@@ -0,0 +1,157 @@
+export const OPENCODE_V1_MIGRATION_PATH = '/api/experimental/migration/v1';
+
+// Backfill notes must stay readable by UI and docs. Do not drop them when the
+// gate blocks or later admits a migrated library.
+export const V1_MIGRATION_USER_NOTICE = [
+  'V1 history is backfilled in the opencode2 process.',
+  'Message ids are reused.',
+  'In-progress tools become interrupted.',
+  'V1 subtasks do not appear in v2.',
+].join(' ');
+
+const MIGRATION_PHASES = new Set(['required', 'running', 'completed', 'error']);
+
+const stringifyError = (error) => {
+  if (error instanceof Error && error.message) {
+    return error.message;
+  }
+  if (typeof error === 'string' && error.trim()) {
+    return error;
+  }
+  return 'V1 migration status request failed';
+};
+
+const blocked = (phase, extra = {}) => ({
+  admitTranscript: false,
+  phase,
+  userNotice: V1_MIGRATION_USER_NOTICE,
+  ...extra,
+});
+
+const admitted = (phase, extra = {}) => ({
+  admitTranscript: true,
+  phase,
+  ...extra,
+});
+
+const normalizeProgress = (progress) => {
+  if (!progress || typeof progress !== 'object' || Array.isArray(progress)) {
+    return undefined;
+  }
+  const result = {
+    label: typeof progress.label === 'string' ? progress.label : '',
+  };
+  if (Number.isFinite(progress.numerator) && progress.numerator >= 0) {
+    result.numerator = progress.numerator;
+  }
+  if (Number.isFinite(progress.denominator) && progress.denominator >= 0) {
+    result.denominator = progress.denominator;
+  }
+  return result;
+};
+
+const resolveHttpStatus = (input) => {
+  if (typeof input.httpStatus === 'number') {
+    return input.httpStatus;
+  }
+  if (typeof input.status === 'number') {
+    return input.status;
+  }
+  return undefined;
+};
+
+const resolveBody = (input) => {
+  if (input.body !== undefined) {
+    return input.body;
+  }
+  if (typeof input.status === 'string') {
+    return input;
+  }
+  return null;
+};
+
+const resolveTransportError = (input) => {
+  if (input instanceof Error || typeof input === 'string') {
+    return input;
+  }
+  if (input?.error instanceof Error || typeof input?.error === 'string') {
+    if (input.body === undefined && typeof input.status !== 'string') {
+      return input.error;
+    }
+  }
+  return null;
+};
+
+// Pure admission decision for GET /api/experimental/migration/v1.
+// required/running/error never become an empty-list success.
+export const evaluateV1MigrationGate = (input = {}) => {
+  if (input == null) {
+    return blocked('error', { error: 'V1 migration status is missing or invalid' });
+  }
+
+  const transportError = resolveTransportError(input);
+  if (transportError) {
+    return blocked('error', { error: stringifyError(transportError) });
+  }
+
+  const httpStatus = resolveHttpStatus(input);
+  if (httpStatus === 404) {
+    return admitted('absent');
+  }
+  if (Number.isInteger(httpStatus) && httpStatus >= 400) {
+    return blocked('error', { error: `V1 migration status HTTP ${httpStatus}` });
+  }
+
+  const body = resolveBody(input);
+  const phase = body && typeof body === 'object' ? body.status : undefined;
+
+  if (phase === 'required') {
+    return blocked('required');
+  }
+  if (phase === 'running') {
+    return blocked('running', { progress: normalizeProgress(body.progress) });
+  }
+  if (phase === 'completed') {
+    return admitted('completed', { userNotice: V1_MIGRATION_USER_NOTICE });
+  }
+  if (phase === 'error') {
+    return blocked('error', {
+      error: typeof body.error === 'string' && body.error.trim()
+        ? body.error
+        : 'V1 migration failed',
+    });
+  }
+
+  if (MIGRATION_PHASES.has(phase) === false) {
+    return blocked('error', { error: 'V1 migration status is missing or invalid' });
+  }
+
+  return blocked('error', { error: 'V1 migration status is missing or invalid' });
+};
+
+// Official protocol only publishes GET status. Backfill is owned by opencode2;
+// clients poll this helper and do not POST unless a later API requires it.
+export const fetchV1MigrationGate = async ({
+  url,
+  headers = {},
+  signal,
+  fetchImpl = globalThis.fetch,
+} = {}) => {
+  try {
+    const response = await fetchImpl(url, {
+      method: 'GET',
+      headers: {
+        Accept: 'application/json',
+        ...headers,
+      },
+      signal,
+    });
+    const body = await response.json().catch(() => null);
+    return evaluateV1MigrationGate({
+      httpStatus: response.status,
+      body,
+    });
+  } catch (error) {
+    return evaluateV1MigrationGate({ error });
+  }
+};

package/server/lib/opencode/v1-migration-gate.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import {
+  OPENCODE_V1_MIGRATION_PATH,
+  V1_MIGRATION_USER_NOTICE,
+  evaluateV1MigrationGate,
+  fetchV1MigrationGate,
+} from './v1-migration-gate.js';
+
+describe('V1 migration gate', () => {
+  it('denies transcript while V1 migration is required', () => {
+    expect(evaluateV1MigrationGate({ status: 'required' })).toMatchObject({
+      admitTranscript: false,
+      phase: 'required',
+      userNotice: V1_MIGRATION_USER_NOTICE,
+    });
+  });
+
+  it('denies transcript while V1 migration is running and keeps progress', () => {
+    expect(evaluateV1MigrationGate({
+      status: 'running',
+      progress: { label: 'Sessions', numerator: 3, denominator: 10 },
+    })).toEqual({
+      admitTranscript: false,
+      phase: 'running',
+      progress: { label: 'Sessions', numerator: 3, denominator: 10 },
+      userNotice: V1_MIGRATION_USER_NOTICE,
+    });
+  });
+
+  it('admits transcript when V1 migration is completed', () => {
+    expect(evaluateV1MigrationGate({ status: 'completed' })).toMatchObject({
+      admitTranscript: true,
+      phase: 'completed',
+    });
+  });
+
+  it('admits transcript when V1 library is absent (HTTP 404)', () => {
+    expect(evaluateV1MigrationGate({ httpStatus: 404 })).toEqual({
+      admitTranscript: true,
+      phase: 'absent',
+    });
+    expect(evaluateV1MigrationGate({ status: 404 })).toEqual({
+      admitTranscript: true,
+      phase: 'absent',
+    });
+  });
+
+  it('admits transcript when completed with no remaining work', () => {
+    expect(evaluateV1MigrationGate({
+      body: { status: 'completed' },
+      httpStatus: 200,
+    })).toMatchObject({
+      admitTranscript: true,
+      phase: 'completed',
+    });
+  });
+
+  it('denies transcript on V1 migration error instead of treating an empty list as success', () => {
+    expect(evaluateV1MigrationGate({
+      status: 'error',
+      error: 'disk full',
+    })).toEqual({
+      admitTranscript: false,
+      phase: 'error',
+      error: 'disk full',
+      userNotice: V1_MIGRATION_USER_NOTICE,
+    });
+    expect(evaluateV1MigrationGate({})).toMatchObject({
+      admitTranscript: false,
+      phase: 'error',
+    });
+  });
+
+  it('denies transcript on network failure instead of treating an empty list as success', () => {
+    expect(evaluateV1MigrationGate({ error: new Error('offline') })).toMatchObject({
+      admitTranscript: false,
+      phase: 'error',
+      error: 'offline',
+    });
+  });
+
+  it('exposes backfill userNotice for UI and docs', () => {
+    expect(V1_MIGRATION_USER_NOTICE).toContain('Message ids are reused');
+    expect(V1_MIGRATION_USER_NOTICE).toContain('interrupted');
+    expect(V1_MIGRATION_USER_NOTICE).toContain('V1 subtasks do not appear in v2');
+    expect(evaluateV1MigrationGate({ status: 'required' }).userNotice).toBe(V1_MIGRATION_USER_NOTICE);
+    expect(evaluateV1MigrationGate({ status: 'completed' }).userNotice).toBe(V1_MIGRATION_USER_NOTICE);
+  });
+
+  it('polls GET migration status and does not POST', async () => {
+    const fetchImpl = vi.fn(async () => new Response(JSON.stringify({ status: 'completed' }), {
+      status: 200,
+      headers: { 'content-type': 'application/json' },
+    }));
+
+    await expect(fetchV1MigrationGate({
+      url: `http://127.0.0.1:4096${OPENCODE_V1_MIGRATION_PATH}`,
+      headers: { Authorization: 'Basic test' },
+      fetchImpl,
+    })).resolves.toMatchObject({
+      admitTranscript: true,
+      phase: 'completed',
+    });
+
+    expect(fetchImpl).toHaveBeenCalledTimes(1);
+    expect(fetchImpl.mock.calls[0][0]).toContain(OPENCODE_V1_MIGRATION_PATH);
+    expect(fetchImpl.mock.calls[0][1].method).toBe('GET');
+    expect(fetchImpl.mock.calls[0][1].headers.Authorization).toBe('Basic test');
+  });
+});

package/server/lib/opencode/v2-client.js

@@ -0,0 +1,49 @@
+import { OpenCode } from '@opencode/client';
+
+/**
+ * @typedef {import('@opencode/client').OpenCodeClient} OpenCodeV2ClientRaw
+ */
+
+/**
+ * Compatibility client: official 2.x nests exact message lookup under
+ * `session.message.get`, while OpenChamber callers still use
+ * `session.message(input, requestOptions)`.
+ *
+ * @typedef {Omit<OpenCodeV2ClientRaw, 'session'> & {
+ *   session: Omit<OpenCodeV2ClientRaw['session'], 'message'> & {
+ *     message: ((input: Parameters<OpenCodeV2ClientRaw['session']['message']['get']>[0], requestOptions?: Parameters<OpenCodeV2ClientRaw['session']['message']['get']>[1]) => ReturnType<OpenCodeV2ClientRaw['session']['message']['get']>)
+ *       & OpenCodeV2ClientRaw['session']['message']
+ *   }
+ * }} OpenCodeV2Client
+ */
+
+/**
+ * Create the single server-side client for official OpenCode v2 APIs.
+ *
+ * @param {{ baseUrl: string, authHeaders?: Record<string, string>, fetchImpl?: typeof fetch }} input
+ * @returns {OpenCodeV2Client}
+ */
+export function makeOpenCodeV2Client({ baseUrl, authHeaders, fetchImpl }) {
+  const client = OpenCode.make({
+    baseUrl: baseUrl.replace(/\/$/, ''),
+    ...(authHeaders ? { headers: authHeaders } : {}),
+    ...(fetchImpl ? { fetch: fetchImpl } : {}),
+  });
+
+  const messageGet = client.session.message?.get?.bind(client.session.message);
+  if (typeof messageGet === 'function') {
+    const messageCompat = Object.assign(
+      (input, requestOptions) => messageGet(input, requestOptions),
+      client.session.message,
+    );
+    return {
+      ...client,
+      session: {
+        ...client.session,
+        message: messageCompat,
+      },
+    };
+  }
+
+  return client;
+}

package/server/lib/opencode/watcher.js

@@ -65,7 +65,8 @@ export const createOpenCodeWatcherRuntime = (deps) => {
 
     reader = createUpstreamSseReader({
       signal,
-      buildUrl: () => buildOpenCodeUrl('/global/event', ''),
+      // v2 serves the event stream at `/api/event`; `/api/global/event` is gone.
+      buildUrl: () => buildOpenCodeUrl('/event', ''),
       getHeaders: getOpenCodeAuthHeaders,
       fetchImpl,
       stallTimeoutMs: upstreamStallTimeoutMs,

package/server/lib/opencode/watcher.test.js

@@ -74,7 +74,7 @@ describe('createOpenCodeWatcherRuntime', () => {
 
     expect(fetchCalls).toEqual([
       {
-        url: 'http://127.0.0.1:4096/global/event',
+        url: 'http://127.0.0.1:4096/event',
         headers: {
           Accept: 'text/event-stream',
           'Cache-Control': 'no-cache',

package/server/lib/scheduled-tasks/DOCUMENTATION.md

@@ -15,7 +15,7 @@ Server-owned scheduled task runtime and routes for OpenChamber-only automation.
   - Next-run computation (daily/weekly/cron compatibility)
   - Timer scheduling and queueing
   - Concurrency controls
-  - Session create → archive → goal/prompt/command execution
+  - Session create → goal/prompt/command execution
   - Emits OpenChamber task-run events
   - Isolates project sync failures, retries each failed project up to three times,
     and clears pending retries during shutdown
@@ -186,44 +186,55 @@ Every actual run (timer or manual):
 4. Create an OpenCode session with:
    - title: `[Scheduled] ${taskName} yyyy-LL-dd HH:mm` (total length ≤ 120)
    - metadata: `openchamber.scheduledTask = { projectID, taskID, runID, name }`
-   - SDK/HTTP calls receive `{ signal }` as the second request-options argument
-     (`client.session.create(params, { signal })`, same for `update` /
-     `command` / `command.list`; raw `fetch` for goal PATCH and `prompt_async`
-     pass `signal` in `RequestInit`).
-5. `attachSession(runID, sessionID)` immediately after create.
-6. Archive the session via SDK `client.session.update({ sessionID, directory, time: { archived } })`.
-   - 404 receives one short bounded retry (also signal-aware); other failures
-     abort without prompt.
-   - If attach fails, the runtime still attempts archive, then fails the run.
- 7. Only after a successful archive: goal metadata PATCH (preserving the
-    `scheduledTask` marker together with `goal`), then command or `prompt_async`.
-    Non-cancellable async gaps (small-model distill, objective file write) check
-    `signal.throwIfAborted()` before continuing so a timed-out run never prompts.
-    **Admission is not completion:** `prompt_async` / command return when the
+    - SDK/HTTP calls receive `{ signal }` as the second request-options argument
+      (`client.session.create(params, { signal })`, same for `prompt` /
+      `command` / `command.list`; raw `fetch` for goal PATCH
+      pass `signal` in `RequestInit`).
+ 5. `attachSession(runID, sessionID)` immediately after create.
+    - If attach fails, the runtime fails the run without prompting.
+  6. When `goalEnabled`: refuse before OpenCode ready / session create if
+      `persistSessionGoal` is not injected; otherwise write objective file,
+      persist an active goal into the Host session-metadata store, optionally
+      notify `onGoalPersisted` to arm the goal loop, then command or
+      `session.prompt`. Non-cancellable async gaps (small-model distill,
+      objective file write) check `signal.throwIfAborted()` before continuing so
+      a timed-out run never prompts.
+    **Admission is not completion:** `session.prompt` / command return when the
     turn is accepted, not when the agent finishes.
- 8. Wait for the real session outcome (bounded by the same watchdog):
-    - Poll `session.status` + `session.messages` until the session is idle and
-      the tail is a settled assistant turn (completed, or incomplete-but-stable
-      while idle). Assistant `error` (including abort) finalizes as `error`.
-    - Goal-enabled runs poll `session.get` for terminal goal status
-      (`complete` → success; `blocked` / `budgetLimited` → error) and do not
-      finish on the first idle between goal turns.
-    - `durationMs` / `finishedAt` are wall-clock from run start through this
-      settlement — not the prompt admission latency.
- 9. On watchdog timeout after a session exists: immediately throw the canonical
+  7. Wait for the real session outcome (bounded by the same watchdog):
+     - Poll `session.active` + `message.list` until the session is idle and
+       the **latest-side** message page settles. Settlement always uses
+       `message.list({ limit: 50, order: 'desc' })` (newest first) — never
+       `order: 'asc'` page-0 + `at(-1)`, which reads an old page once the
+       session exceeds the limit.
+     - Real terminal success requires an assistant tail with `time.completed`
+       and finish not `tool-calls` (prefer `finish: 'stop'`). `finish:
+       'tool-calls'`, incomplete assistants (no `time.completed`), and
+       non-assistant tails such as `model-switched` never succeed — including
+       after multiple incomplete idle probes.
+     - `session.active` / `message.list` failures stay **unknown** (keep
+       polling under the watchdog); they never masquerade as idle success.
+     - Assistant `error` (and terminal finish `error` / `length` /
+       `content-filter`) finalizes as `error`.
+      - Goal-enabled runs: settle via Host goal terminal status when the store
+        seam is available (`readSessionMetadata` preferred over OpenCode
+        `session.get`). Store read failure is never empty-goal success.
+     - `durationMs` / `finishedAt` are wall-clock from run start through this
+       settlement — not the prompt admission latency.
+ 8. On watchdog timeout after a session exists: immediately throw the canonical
     `schedule run timed out` without awaiting non-cancellable helper work. A
     once-only abort listener registered after session create starts best-effort
-    `client.session.abort({ sessionID, directory })` as soon as the watchdog
-    aborts the signal (or right after create if the signal already aborted).
-    Abort failures must not replace the timeout error. Successful runs and
-    ordinary non-timeout failures never call session abort.
- 10. Finalize history with the ultimate run status (timeout → `error` with
+     `client.session.interrupt({ sessionID, continue: false })` as soon as the watchdog
+     aborts the signal (or right after create if the signal already aborted).
+     Interrupt failures must not replace the timeout error. Successful runs and
+     ordinary non-timeout failures never call session interrupt.
+ 9. Finalize history with the ultimate run status (timeout → `error` with
     `schedule run timed out`; assistant/goal failure → `error` with the
     recorded reason). An already-attached `session_id` remains on the history
     row so the session stays openable from history. Task state persistence
     failures also finalize history as `error`. A failed history finalize
     returns error and may leave a `running` row for next-start convergence.
-  11. `lastSessionId` is written on the task state whenever the run has a
+ 10. `lastSessionId` is written on the task state whenever the run has a
      session (success or error). If the run has no session, omit
      `lastSessionId` from the patch so a previous value is preserved. Full
      association still lives in the history table; history rows are not
@@ -239,14 +250,35 @@ that same history session. `observeSessionEvent` corrects **only task state**
 
 - `session.status` busy/retry while `lastStatus` is `error` or `success` →
   `lastStatus` `running`, clear `lastError`, keep/set `lastSessionId`
-- later `session.idle` (or idle `session.status`) with a success snapshot →
-  `lastStatus` `success`
+- later `session.idle` (or idle `session.status`) with a success snapshot from
+  `session.active` + latest-side `message.list` → `lastStatus` `success`
 - do not change `lastRunAt` / `lastDurationMs` / `nextRunAt`
+- history rows are never rewritten; `finishRun` is not called again
 
 A live run (`runningTaskKeys`) owns settlement; the observer is a no-op while
 the task is in `runningTaskKeys`. Idle correction is a no-op if `lastStatus`
-is already `success`, or if the snapshot is still error/busy/unknown. Observer
-failures are logged and must not throw out of the event bus.
+is already `success`, or if the snapshot is still error/busy/unknown
+(`session.active` failure and goal-unsupported goal tasks stay unknown).
+Observer failures are logged and must not throw out of the event bus.
+
+## Goal safety gating
+
+Session goal Host state is advertised by
+`packages/web/server/lib/session-goal/capability.js` as `{ supported: true }`.
+Goal records live in the OpenChamber session-metadata store (same seam as
+manual UI / `session-goal` runtime). Scheduled runs inject
+`persistSessionGoal`, `readSessionMetadata`, and optional `onGoalPersisted`
+from `server/index.js`.
+
+| Path | Behavior |
+|---|---|
+| `PUT` scheduled task / managed-tool create·update with `execution.goalEnabled` | Allowed when capability supported |
+| Existing `goalEnabled` task due or manual run | Requires `persistSessionGoal`; without it fail **before** OpenCode ready / session create / objective write / prompt; with it write objective + active goal then prompt |
+| Ordinary non-goal task | Unchanged |
+| Post-run observer on a goal-enabled task | Prefer Host store goal terminal status; never invent success from assistant-tail idle alone when goal is active |
+
+Do not treat objective-file hints or first-turn assistant idle as a registered
+goal success without a store-backed goal record.
 
 Run start also emits `scheduled-task-ran` with `status: running` as soon as
 task state is persisted, so the outer task list can show in-progress before
@@ -255,21 +287,21 @@ the session is attached.
 ## Watchdog cancel / upstream abort
 
 - Timeout path: abort the per-run signal → cancel in-flight cancellable
-  SDK/HTTP → start best-effort OpenCode `session.abort` via the create-time
+  SDK/HTTP → start best-effort OpenCode `session.interrupt` via the create-time
   abort listener (independent of whether the current await is cancellable) →
   **do not wait** for non-cancellable helpers (small-model distill /
   `writeObjective`) to finish → history and task state finalize as `error`
   with `schedule run timed out` within the watchdog bound. The detached
   `runPromise` is settled with a catch so late rejections are not unhandled.
 - When uncancellable helper work eventually finishes, post-await
-  `throwIfAborted` gates stop goal PATCH / command / `prompt_async`.
-- Non-timeout failures: no timeout abort; no forced `session.abort` from the
+  `throwIfAborted` gates stop goal PATCH / command / `session.prompt`.
+- Non-timeout failures: no timeout abort; no forced `session.interrupt` from the
   watchdog.
 - Runtime `stop()` clears timers, project-sync retries, and the queue only; it
   does not abort in-flight run controllers.
 - Remaining non-cancellable edges: work already fully admitted and completed
   HTTP-wise before timeout cannot be rolled back by aborting the HTTP request
-  alone; `session.abort` is the upstream stop for admitted command/prompt
+  alone; `session.interrupt` is the upstream stop for admitted command/prompt
   execution. Small-model distillation and objective file writes are not passed
   a signal; the watchdog does not await them, and abort gates block later
   stages after they complete.