autonomous-sdlc-harness 0.6.0 → 0.6.2

package/templates/github/workflows/harness-run.yml

@@ -9,7 +9,8 @@
 #
 # THE INPUT CONTRACT. Composed on the shell side by `remote-run.sh` alone:
 #   action           run | pause | warm | stop. Only `run` and `warm` start a
-#                    job; `pause` and `stop` are jobless, titled marker runs
+#                    job; `pause` and `stop` are jobless, titled marker runs,
+#                    except a `pause` from the wrong ref (THE REF CHECK)
 #   branch           the run's branch (for warm: GitHub's default branch)
 #   engine           task | user_review | docs                (action=run)
 #   resume           none | answer | pause                    (action=run)
@@ -33,7 +34,8 @@
 #                                     HARNESS_REMOTE_STOP, CLAUDE_CODE_OAUTH_TOKEN,
 #                                     ANTHROPIC_API_KEY, HARNESS_PUSH_URL,
 #                                     HARNESS_GIT_TOKEN, the artifact harness-state,
-#                                     HARNESS_CLI_VERSION
+#                                     HARNESS_CLI_VERSION, HARNESS_RUN_ACTORS,
+#                                     HARNESS_TRIGGER_ALLOWED_BOTS
 #   cli/src/generators/githubWorkflows.ts   --upgrade-workflows
 #   cli/src/generators/projectSettings.ts   the marketplace and plugin key
 #                                     autonomous-sdlc-harness@autonomous-sdlc-harness
@@ -69,6 +71,38 @@
 # report step's reason below: scripts older than this file carry no `collect`
 # verb.
 #
+# THE REF CHECK. Finding 6 of Gate 12 round 6: GitHub lists a run under the ref
+# it was dispatched from (Use workflow from), so a run or pause dispatched from
+# a ref other than its `branch` input is invisible to every lookup by that
+# branch. When `action` is `run` or `pause` and `github.ref_name` is not
+# `inputs.branch`, the `wrong-ref` job fails, naming the ref to use, and `run`
+# and `collect` are skipped; the jobless `pause` marker gains that failing job
+# only when its ref is wrong. `warm` is exempt because it dispatches on the
+# default branch with that branch as its input, so the two already agree.
+# `stop` is exempt because a deleted branch's stop marker is sent from the
+# default branch, its own ref being gone, and the stop check matches the
+# `harness stop <branch>` title across every branch's runs, under any ref.
+#
+# THE RUN-ACTOR GATE. The first step of `run` and of `collect`, byte-identical
+# in both, refuses a `github.triggering_actor` the repository variable
+# HARNESS_RUN_ACTORS does not admit, so the Run workflow form, `gh workflow run`
+# and a re-run by someone not on the list launch nothing; a refused `run` sets
+# no SCRIPTS_DIR, so its `always()` and `!cancelled()` steps skip too. The list:
+# split on `,`, each entry trimmed, empty entries dropped, matched
+# case-insensitively, `*` admitting every writer; an empty list admits the owner
+# of a user-owned repository alone, and nobody otherwise.
+#   * A step, not a job: Re-run failed jobs and Re-run job do not re-run an
+#     upstream job that succeeded, so a gate job would never see the re-runner's
+#     triggering_actor (docs/team-accounts-research.md, G2).
+#   * `github-actions[bot]` passes: every harness dispatch is made with
+#     GITHUB_TOKEN and names it. Measured 2026-10-05 for the trigger, the comment
+#     commands and `collect`; inferred for the `remote-run.sh continue` chain and
+#     the harness-resume.yml poller, which Gate 12 observation (xv) confirms.
+#   * Not closed: a writer who edits this file on a branch can remove the gate
+#     or dispatch as the bot. That writer can already read the secret (G7).
+#   * Resolved before it: the job-level HARNESS_PUSH_URL secret, at job start.
+#     The credential secrets and HARNESS_GIT_TOKEN are read only by later steps.
+#
 # ACTION PINS.
 #   actions/checkout@v5
 #   actions/setup-node@v5
@@ -93,7 +127,8 @@
 #     so your CI runs on it without an approval click), HARNESS_PUSH_URL
 #     (optional notifications).
 #   Variables: HARNESS_RUNNER, HARNESS_REMOTE_STOP (any value stops every job
-#     before it launches anything), HARNESS_STEP_TIMEOUT_MINUTES,
+#     before it launches anything), HARNESS_RUN_ACTORS (THE RUN-ACTOR GATE),
+#     HARNESS_STEP_TIMEOUT_MINUTES,
 #     HARNESS_SELF_PAUSE_AFTER_MINUTES, HARNESS_MAX_CHAIN, and the watcher
 #     tunables listed in the `run` job's `env:` under their own names. An unset
 #     variable arrives empty and the script reading it applies its own default.
@@ -234,8 +269,20 @@ defaults:
     shell: bash
 
 jobs:
+  wrong-ref:
+    if: (inputs.action == 'run' || inputs.action == 'pause') && github.ref_name != inputs.branch
+    runs-on: ${{ vars.HARNESS_RUNNER || 'ubuntu-latest' }}
+    steps:
+      - name: Refuse a dispatch from another ref
+        env:
+          IN_REF: ${{ github.ref_name }}
+          IN_BRANCH: ${{ inputs.branch }}
+        run: |
+          echo "::error::this run was dispatched from '$IN_REF', but its branch input is '$IN_BRANCH': GitHub lists a run under the ref it was dispatched from, so no lookup of '$IN_BRANCH' would find it. Run the workflow again with Use workflow from set to '$IN_BRANCH'."
+          exit 1
+
   run:
-    if: inputs.action == 'run'
+    if: inputs.action == 'run' && github.ref_name == inputs.branch
     runs-on: ${{ vars.HARNESS_RUNNER || 'ubuntu-latest' }}
     # The self-hosted job limit, 5 days; a hosted job stops at its own limit.
     timeout-minutes: 7200
@@ -253,6 +300,7 @@ jobs:
       HARNESS_INPUT_PARK_LOOP_CLEAR: ${{ inputs.park_loop_clear }}
       HARNESS_INPUT_CHAIN: ${{ inputs.chain }}
       HARNESS_REMOTE_STOP: ${{ vars.HARNESS_REMOTE_STOP }}
+      HARNESS_RUN_ACTORS: ${{ vars.HARNESS_RUN_ACTORS }}
       HARNESS_MAX_CHAIN: ${{ vars.HARNESS_MAX_CHAIN }}
       STALL_WARN_SECS: ${{ vars.STALL_WARN_SECS }}
       STALL_KILL_SECS: ${{ vars.STALL_KILL_SECS }}
@@ -274,6 +322,51 @@ jobs:
       HARNESS_STEP_ALLOWANCE_MINUTES: '30'
       HARNESS_SELF_PAUSE_MARGIN_MINUTES: '90'
     steps:
+      - name: Refuse an actor not on HARNESS_RUN_ACTORS
+        env:
+          IN_TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+          IN_OWNER: ${{ github.repository_owner }}
+          IN_OWNER_TYPE: ${{ github.event.repository.owner.type }}
+        run: |
+          actor="$IN_TRIGGERING_ACTOR"
+          if [ "$actor" = 'github-actions[bot]' ]; then
+            echo "@$actor passes: every harness dispatch is made with GITHUB_TOKEN and names it."
+            exit 0
+          fi
+          lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
+          want=$(lower "$actor")
+          rest="${HARNESS_RUN_ACTORS-},"
+          listed=""
+          while [ -n "$rest" ]; do
+            entry="${rest%%,*}"
+            rest="${rest#*,}"
+            entry="${entry#"${entry%%[![:space:]]*}"}"
+            entry="${entry%"${entry##*[![:space:]]}"}"
+            [ -n "$entry" ] || continue
+            listed=1
+            if [ "$entry" = '*' ]; then
+              echo "@$actor passes: HARNESS_RUN_ACTORS carries *, which admits every writer."
+              exit 0
+            fi
+            if [ -n "$want" ] && [ "$(lower "$entry")" = "$want" ]; then
+              echo "@$actor passes: listed in HARNESS_RUN_ACTORS."
+              exit 0
+            fi
+          done
+          if [ -n "$listed" ]; then
+            why="@${actor:-(no actor)} is not listed in it."
+          elif [ "$IN_OWNER_TYPE" = User ] && [ -n "$IN_OWNER" ]; then
+            if [ -n "$want" ] && [ "$(lower "$IN_OWNER")" = "$want" ]; then
+              echo "@$actor passes: HARNESS_RUN_ACTORS is unset, which admits the owner of this user-owned repository alone."
+              exit 0
+            fi
+            why="it is unset, which admits the owner of this user-owned repository, @$IN_OWNER, alone, and @${actor:-(no actor)} is not that owner."
+          else
+            why="it is unset, and this repository has no single owner to admit (its owner type is ${IN_OWNER_TYPE:-unreadable}), so it admits nobody."
+          fi
+          echo "::error::@${actor:-(no actor)} dispatched or re-ran this run, and the repository variable HARNESS_RUN_ACTORS does not admit them: $why Nothing was launched and no credential was read. Add the login to the comma-separated repository variable HARNESS_RUN_ACTORS, or set it to * for every writer (docs/remote-execution.md, section 9)."
+          exit 1
+
       - name: Compute the time budget
         env:
           IN_RUNNER_ENVIRONMENT: ${{ runner.environment }}
@@ -486,7 +579,7 @@ jobs:
 
   collect:
     needs: run
-    if: ${{ inputs.action == 'run' && !cancelled() }}
+    if: ${{ inputs.action == 'run' && !cancelled() && github.ref_name == inputs.branch }}
     runs-on: ${{ vars.HARNESS_RUNNER || 'ubuntu-latest' }}
     concurrency:
       group: harness-review-${{ inputs.branch }}
@@ -497,7 +590,53 @@ jobs:
       HARNESS_INPUT_BRANCH: ${{ inputs.branch }}
       HARNESS_REMOTE_STOP: ${{ vars.HARNESS_REMOTE_STOP }}
       HARNESS_TRIGGER_ALLOWED_BOTS: ${{ vars.HARNESS_TRIGGER_ALLOWED_BOTS }}
+      HARNESS_RUN_ACTORS: ${{ vars.HARNESS_RUN_ACTORS }}
     steps:
+      - name: Refuse an actor not on HARNESS_RUN_ACTORS before collecting
+        env:
+          IN_TRIGGERING_ACTOR: ${{ github.triggering_actor }}
+          IN_OWNER: ${{ github.repository_owner }}
+          IN_OWNER_TYPE: ${{ github.event.repository.owner.type }}
+        run: |
+          actor="$IN_TRIGGERING_ACTOR"
+          if [ "$actor" = 'github-actions[bot]' ]; then
+            echo "@$actor passes: every harness dispatch is made with GITHUB_TOKEN and names it."
+            exit 0
+          fi
+          lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
+          want=$(lower "$actor")
+          rest="${HARNESS_RUN_ACTORS-},"
+          listed=""
+          while [ -n "$rest" ]; do
+            entry="${rest%%,*}"
+            rest="${rest#*,}"
+            entry="${entry#"${entry%%[![:space:]]*}"}"
+            entry="${entry%"${entry##*[![:space:]]}"}"
+            [ -n "$entry" ] || continue
+            listed=1
+            if [ "$entry" = '*' ]; then
+              echo "@$actor passes: HARNESS_RUN_ACTORS carries *, which admits every writer."
+              exit 0
+            fi
+            if [ -n "$want" ] && [ "$(lower "$entry")" = "$want" ]; then
+              echo "@$actor passes: listed in HARNESS_RUN_ACTORS."
+              exit 0
+            fi
+          done
+          if [ -n "$listed" ]; then
+            why="@${actor:-(no actor)} is not listed in it."
+          elif [ "$IN_OWNER_TYPE" = User ] && [ -n "$IN_OWNER" ]; then
+            if [ -n "$want" ] && [ "$(lower "$IN_OWNER")" = "$want" ]; then
+              echo "@$actor passes: HARNESS_RUN_ACTORS is unset, which admits the owner of this user-owned repository alone."
+              exit 0
+            fi
+            why="it is unset, which admits the owner of this user-owned repository, @$IN_OWNER, alone, and @${actor:-(no actor)} is not that owner."
+          else
+            why="it is unset, and this repository has no single owner to admit (its owner type is ${IN_OWNER_TYPE:-unreadable}), so it admits nobody."
+          fi
+          echo "::error::@${actor:-(no actor)} dispatched or re-ran this run, and the repository variable HARNESS_RUN_ACTORS does not admit them: $why Nothing was launched and no credential was read. Add the login to the comma-separated repository variable HARNESS_RUN_ACTORS, or set it to * for every writer (docs/remote-execution.md, section 9)."
+          exit 1
+
       - name: Check out the default branch for collecting
         uses: actions/checkout@v5
         with:

package/templates/github/workflows/harness-trigger.yml

@@ -33,7 +33,8 @@
 #     the authority.
 #
 # WHO CAN START A RUN. `remote-run.sh`'s `trigger` paragraph owns the check —
-# the labeller, bots and HARNESS_TRIGGER_ALLOWED_BOTS, the permission call —
+# the labeller, bots and HARNESS_TRIGGER_ALLOWED_BOTS, the permission call, the
+# allow-list HARNESS_RUN_ACTORS, and the `repository_dispatch` sender check —
 # and the order its refusals are made in. Nothing here pre-filters on it.
 #
 # THE PERMISSIONS, declared because the default token may be read-only
@@ -69,6 +70,7 @@
 #                                     HARNESS_REMOTE_STOP, HARNESS_TRIGGER_LABEL,
 #                                     DEFAULT_TRIGGER_LABEL (`sdlc-harness`),
 #                                     HARNESS_TRIGGER_ALLOWED_BOTS,
+#                                     HARNESS_RUN_ACTORS,
 #                                     TRIGGER_DISPATCH_EVENT_TYPE (`harness-task`)
 #   cli/src/config/model.ts           DEFAULTS.scriptsDir
 #
@@ -112,6 +114,7 @@ jobs:
       HARNESS_REMOTE_SLUG: ${{ github.repository }}
       HARNESS_TRIGGER_LABEL: ${{ vars.HARNESS_TRIGGER_LABEL || 'sdlc-harness' }}
       HARNESS_TRIGGER_ALLOWED_BOTS: ${{ vars.HARNESS_TRIGGER_ALLOWED_BOTS }}
+      HARNESS_RUN_ACTORS: ${{ vars.HARNESS_RUN_ACTORS }}
     steps:
       - name: Check out the default branch
         uses: actions/checkout@v5

package/templates/scripts/autonomous-watcher.sh

@@ -329,6 +329,20 @@
 #     count are seeded from it; the auto-resume count only when
 #     HARNESS_INPUT_CHAIN is above 0, because a chain of 0 is a user's own
 #     dispatch; `chain` never — every write records this job's own input.
+#   * THE PAUSE NOTE belongs to the run that wrote it. Before its own first
+#     write, the job reads the restored `remote_status.json`'s `status` and
+#     `engine`. In job mode, a carried `PAUSE_PROGRESS.md` is kept only when
+#     the job's `resume` is `pause`, the restored `remote_status.json` says
+#     `status: paused`, and its `engine` equals the job's engine. In every other
+#     case — a fresh launch (`resume none`), an answer resume (`resume
+#     answer`), a pause resume whose previous job did not pause (a stop or a
+#     kill), or a different engine — it is moved aside, never deleted, to
+#     `<state_dir>/autonomous_logs/remote_superseded/<epoch>[-<n>]/PAUSE_PROGRESS.md`.
+#     The move is lib/harness-run-lib.sh's `hr_remote_move_aside`; this script
+#     writes nothing under `remote_superseded/` itself. Separately, a pause
+#     resume whose previous job did not pause, or paused for a different
+#     engine, is re-launched with a clause saying there is no pause note,
+#     whether or not a note was carried (`pause_note_stale` in the registry).
 #   * IT WRITES `remote_status.json` with decision `continue` before the spawn,
 #     so a job killed mid-run leaves a bundle that says continue, again after
 #     every successful control poll, and once more when the run leaves
@@ -1205,17 +1219,27 @@ job_report() {
 #   resumed_at          when the most recent resume happened — stamped by BOTH
 #                       resume paths, so it does not say which one
 #   resumed_for_index   a space-separated list of the clarification indexes one
-#                       park-resume consumed (`1 2 3`). Set by resume_parked_run
-#                       and archived then cleared by classify_run_exit, which is
-#                       the whole of its lifetime — so A NON-EMPTY VALUE ON A
-#                       `completed` RECORD IS A DEFECT: it means the pairs it
-#                       names are still sitting unarchived at the top level,
-#                       where they trigger a resume of a run that already read
-#                       them. It is NOT a defect on a `paused` record: the pause
-#                       branch returns before the archival and leaves it set on
-#                       purpose, because a pause mid park-resume left those
-#                       answers unconsumed. The pause resume never writes this
-#                       field — a pause is not an answer.
+#                       park-resume consumed (`1 2 3`). Set by begin_park_resume
+#                       and archived then cleared by classify_run_exit together
+#                       with `launch_answered_set`, which is the whole of its
+#                       lifetime — so A NON-EMPTY VALUE ON A `completed` RECORD
+#                       IS A DEFECT: it means the pairs it names are still
+#                       sitting unarchived at the top level, where they trigger
+#                       a resume of a run that already read them. It is NOT a
+#                       defect on a `paused` record: the pause branch returns
+#                       before the archival and leaves it set on purpose,
+#                       because a pause mid park-resume left those answers
+#                       unconsumed. The pause resume never writes this field —
+#                       a pause is not an answer. It is not the only record of
+#                       the consumed set: `launch_answered_set` re-derives it
+#   launch_answered_set every top-level answered pair's index when the current
+#                       session launched (`1 2`), which is the set a re-entering
+#                       engine consumes. Written by spawn_engine at every launch,
+#                       local and job mode alike, from the clarification channel
+#                       on disk; archived then cleared by classify_run_exit on a
+#                       non-pause exit, and left set by a pause exit. The remote
+#                       bundle does not carry it: the next job's launch
+#                       re-derives it from the restored channel
 #   resume_kind         `answer` when the park resume launched the current
 #                       session, `pause` when the pause resume did, and empty
 #                       otherwise. Read and cleared by classify_run_exit on every
@@ -1311,7 +1335,14 @@ job_report() {
 #                       bound of the next control poll, this job's or the next
 #                       chained one's. Set at start (see JOB MODE) and advanced
 #                       by every successful poll
-#   execution           `github-actions` on a remote record — one
+#   pause_note_stale    job mode only: `1` when a `pause` job's restored
+#                       `status.json` was not `paused` or named another engine,
+#                       so spawn_engine's pause-resume prompt says there is no
+#                       pause note instead of naming PAUSE_PROGRESS.md. Cleared
+#                       with run_job's fresh-launch defaults, and by
+#                       classify_run_exit's job-mode pause arm, whose session
+#                       just wrote its own note for a later relaunch to read
+#   execution          `github-actions` on a remote record — one
 #                       launch_remote_run wrote through
 #                       lib/harness-run-lib.sh's `hr_remote_record_init` — and
 #                       absent on a local one. Fixed for the run's life: a later
@@ -1803,8 +1834,18 @@ files, each paired by index with its question_<i>.md, and resume from the park p
   # committed flow-progress LEDGER (deterministic), with PAUSE_PROGRESS.md as a
   # human-readable hint. Mutually exclusive with the clarification resume above:
   # a run resumes from a park OR from a pause, never both.
+  # JOB MODE ONLY: `pause_note_stale` (see the registry) swaps the note-naming
+  # opening for the stop/kill one; a local record never carries the field.
+  local pause_note_stale=""
+  if [ -n "$pause_resume" ] && [ "$JOB_MODE" = "1" ]; then
+    pause_note_stale="$(registry_get "$branch" pause_note_stale)"
+  fi
   local pause_resume_clause=""
-  if [ -n "$pause_resume" ]; then
+  if [ -n "$pause_resume" ] && [ "$pause_note_stale" = "1" ]; then
+    pause_resume_clause="This is a RESUME after the previous job was stopped or ended without pausing: there is no pause \
+note — resume strictly from the committed flow-progress ledger ${state_rel}/flow_progress/${branch}_progress.md — continue \
+at the first phase entry still marked [ ] and SKIP every phase already marked [x]; do NOT restart completed phases. "
+  elif [ -n "$pause_resume" ]; then
     pause_resume_clause="This is a RESUME from a PAUSE: read ${state_rel}/PAUSE_PROGRESS.md for the pause note, then \
 resume strictly from the committed flow-progress ledger ${state_rel}/flow_progress/${branch}_progress.md — continue at the \
 first phase entry still marked [ ] and SKIP every phase already marked [x]; do NOT restart completed phases. "
@@ -1852,7 +1893,11 @@ ${GLOBAL_STOP}. End at 'branch ready for review' — never merge, never push to
     # own pause-resume clause pointing at the checklist, and omits the
     # clarification-channel language the other two carry.
     local docs_pause_clause=""
-    if [ -n "$pause_resume" ]; then
+    if [ -n "$pause_resume" ] && [ "$pause_note_stale" = "1" ]; then
+      docs_pause_clause="This is a RESUME after the previous job was stopped or ended without pausing: there is no \
+pause note — resume strictly from the checklist ${state_rel}/docs_catalog/${branch}_docs.md — continue at the first entry \
+still marked [ ] and SKIP every entry already marked [x]; do NOT rewrite completed docs. "
+    elif [ -n "$pause_resume" ]; then
       docs_pause_clause="This is a RESUME from a PAUSE: read ${state_rel}/PAUSE_PROGRESS.md for the pause note, then \
 resume strictly from the checklist ${state_rel}/docs_catalog/${branch}_docs.md — continue at the first entry still marked [ ] \
 and SKIP every entry already marked [x]; do NOT rewrite completed docs. "
@@ -1929,6 +1974,11 @@ EOF
     formatter="cat"
   fi
 
+  # The answered pairs this session will consume, re-derived from disk at every
+  # launch so no job boundary can lose them; classify_run_exit archives them.
+  registry_set "$branch" launch_answered_set \
+    "$(top_level_answered_pairs "$worktree/$state_rel/clarifications/$branch")"
+
   # Spawn ONE detached subshell that runs the agent IN THE FOREGROUND and then
   # classifies the exit from its REAL exit code. The agent must be a CHILD of
   # this subshell — not a sibling of a separate monitor — or that code is
@@ -2168,11 +2218,13 @@ max_question_index() {
 #
 # Consume-then-archive contract: on a resume the watcher LEAVES the whole
 # answered set at the TOP LEVEL so the re-launched engine can self-detect and
-# consume it. Exactly that set is archived only AFTER that resumed engine exits —
-# here, keyed off the `resumed_for_index` list the resume recorded. That is what
-# stops a pair the engine already read from triggering another resume, without
-# emptying the paths the re-entering engine reads; a pair written mid-session is
-# not in the list and stays.
+# consume it, and a re-entering engine consumes EVERY top-level answered pair.
+# So the archived set is every pair answered when the session launched — the
+# union of `resumed_for_index` and `launch_answered_set` — archived only AFTER
+# that session exits, and never on a pause exit. That is what stops a pair the
+# engine already read from triggering another resume, without emptying the
+# paths the re-entering engine reads; a pair written mid-session is in neither
+# set and stays.
 classify_run_exit() {
   local branch="$1" worktree="$2" log_path="$3" rc="$4"
 
@@ -2226,7 +2278,9 @@ classify_run_exit() {
           reason=overload
         fi
       fi
-      registry_set "$branch" pause_reason "$reason" status paused
+      # pause_note_stale is cleared here, not in a shell global: this runs in the
+      # launch subshell, and only a registry write reaches run_job.
+      registry_set "$branch" pause_reason "$reason" status paused pause_note_stale ""
       log "run '$branch' paused (PAUSE honored, reason $reason) — rc=$rc"
       if [ "$reason" = "user" ]; then
         notify paused "$branch" "$log_path" "paused as you asked — run /autonomous-sdlc-harness:branch-resume $branch to continue; $(hr_github_resume_route "$branch" "$(registry_get "$branch" engine)")"
@@ -2239,23 +2293,25 @@ classify_run_exit() {
     return 0
   fi
 
-  # If this exit followed a resume — and was NOT a pause, handled above — every
-  # answer in `resumed_for_index` has now been consumed by the re-launched
-  # engine. Archive exactly that set before classifying, so none of it is ever
+  # This exit was NOT a pause, handled above, so the session consumed every pair
+  # it launched with: the union of `resumed_for_index` and `launch_answered_set`.
+  # Archive exactly that union before classifying, so none of it is ever
   # reprocessed; nothing else is archived. A legacy single-index value is a
   # one-element list.
-  local consumed_set consumed_n
-  consumed_set="$(registry_get "$branch" resumed_for_index)"
-  if [ -n "$consumed_set" ]; then
+  local consumed_set consumed_n archived=" "
+  consumed_set="$(registry_get "$branch" resumed_for_index) $(registry_get "$branch" launch_answered_set)"
+  if [ -n "${consumed_set// /}" ]; then
     # An empty clar_dir means the state directory was unresolvable above; the
-    # field is still cleared, because leaving it set would make the next exit
+    # fields are still cleared, because leaving them set would make the next exit
     # try to archive pairs whose location is no better known than it is now.
     if [ -n "$clar_dir" ]; then
       for consumed_n in $consumed_set; do
+        case "$archived" in *" $consumed_n "*) continue ;; esac
+        archived="${archived}${consumed_n} "
         archive_answered_pair "$clar_dir" "$consumed_n"
       done
     fi
-    registry_set "$branch" resumed_for_index ""
+    registry_set "$branch" resumed_for_index "" launch_answered_set ""
   fi
 
   local parked=0
@@ -2399,6 +2455,32 @@ park_answered_set() {
   printf '%s\n' "${answered_set% }"
 }
 
+# top_level_answered_pairs <clar_dir>
+#
+# Every top-level index with both files, space-separated and numerically sorted,
+# whether or not another top-level question is still unanswered; prints nothing
+# when there is none. spawn_engine records it at every launch. Each
+# index is printed as its file name spells it, because archive_answered_pair
+# rebuilds the file names from it; `sort -n` orders a zero-padded one in base 10.
+top_level_answered_pairs() {
+  local clar_dir="$1" q n answered_list="" answered_set
+  for q in "$clar_dir"/question_*.md; do
+    [ -e "$q" ] || continue
+    n="${q##*/}"
+    n="${n#question_}"
+    n="${n%.md}"
+    case "$n" in
+      '' | *[!0-9]*) continue ;;
+    esac
+    [ -f "$clar_dir/answer_${n}.md" ] || continue
+    answered_list="${answered_list}${n}
+"
+  done
+  [ -n "$answered_list" ] || return 0
+  answered_set="$(printf '%s' "$answered_list" | sort -n | tr '\n' ' ')"
+  printf '%s\n' "${answered_set% }"
+}
+
 # begin_park_resume <branch> <clar_dir> <answered_set>
 #
 # The registry half of a park resume, shared by resume_parked_run and job mode.
@@ -4060,6 +4142,7 @@ run_job() {
   local branch="$1" engine="$2" resume="$3"
   local worktree="$MAIN_REPO" log_path="$LOGS_DIR/$branch.log"
   local state_rel state_abs clar_dir remote_status key value answered_set="" prev_reason=""
+  local prev_status="" prev_engine="" aside_rc
 
   JOB_START_EPOCH="$(job_int "${HARNESS_JOB_STARTED_EPOCH:-}")" || JOB_START_EPOCH="$(date +%s)"
   state_rel="$(run_state_dir "$worktree")" || fatal "job: the state directory in '$worktree' is unresolvable"
@@ -4083,8 +4166,11 @@ run_job() {
   registry_set "$branch" auto_resumes 0
   registry_set "$branch" pause_reason ""
   registry_set "$branch" control_polled_at ""
+  registry_set "$branch" pause_note_stale ""
   if [ -f "$remote_status" ]; then
     prev_reason="$(hr_remote_status_get "$remote_status" pause_reason)" || prev_reason=""
+    prev_status="$(hr_remote_status_get "$remote_status" status)" || prev_status=""
+    prev_engine="$(hr_remote_status_get "$remote_status" engine)" || prev_engine=""
     for key in park_loop_cycles resume_max_question_index stall_restarts; do
       value="$(hr_remote_status_get "$remote_status" "$key")" && registry_set "$branch" "$key" "$value"
     done
@@ -4095,6 +4181,25 @@ run_job() {
     fi
   fi
 
+  # The pause note belongs to the run that wrote it (the header's JOB MODE
+  # block). Two decisions, deliberately independent: the clause reads the
+  # restored status alone, so a run stopped before it ever paused is never
+  # pointed at a note; the move governs only a note that exists.
+  if [ "$resume" = "pause" ] && { [ "$prev_status" != "paused" ] || [ "$prev_engine" != "$engine" ]; }; then
+    registry_set "$branch" pause_note_stale 1
+    log "job: '$branch' resumes after a job that did not pause for engine $engine (prev_status '${prev_status}', prev_engine '${prev_engine}') — no pause note"
+  fi
+  if ! { [ "$resume" = "pause" ] && [ "$prev_status" = "paused" ] && [ "$prev_engine" = "$engine" ]; } \
+    && [ -f "$state_abs/$HR_REMOTE_PAUSE_FILE" ]; then
+    aside_rc=0
+    hr_remote_move_aside "$worktree" "$HR_REMOTE_PAUSE_FILE" || aside_rc=$?
+    case "$aside_rc" in
+      0) log "job: '$branch' carried a $HR_REMOTE_PAUSE_FILE that is not this run's (resume $resume, prev_status '${prev_status}', prev_engine '${prev_engine}', engine $engine) — moved aside to $HR_REMOTE_ASIDE" ;;
+      3) ;;
+      *) log "job: WARNING — could not move the carried $HR_REMOTE_PAUSE_FILE of '$branch' aside (hr_remote_move_aside exit $aside_rc); continuing" ;;
+    esac
+  fi
+
   registry_set "$branch" engine "$engine"
   registry_set "$branch" worktree "$worktree"
   registry_set "$branch" log_path "$log_path"

package/templates/scripts/lib/harness-run-lib.sh

@@ -79,9 +79,12 @@
 #      files under the eight planning paths `hr_remote_planning_paths` assigns;
 #      outside it, only the caller-named `<out_dir>` (its `planning/` included)
 #      of `hr_remote_bundle_write` and the caller-named `<out_json>`
-#      of `hr_remote_status_write`. Written only by `hr_remote_status_write`,
-#      `hr_remote_bundle_write` and `hr_remote_bundle_restore`, and nothing
-#      there but a writer's own failed temp file is ever removed.
+#      of `hr_remote_status_write`. The move-aside directory receives the
+#      clarification directory and `PAUSE_PROGRESS.md`, both moved there by
+#      `hr_remote_move_aside` alone. Written only by `hr_remote_status_write`,
+#      `hr_remote_bundle_write`, `hr_remote_bundle_restore` and
+#      `hr_remote_move_aside`, and nothing there but a writer's own failed temp
+#      file is ever removed.
 #   4. THE ARTIFACT PLACEMENT writes one artifact into a working copy. Fence:
 #      the caller-named `<worktree>/<rel>`, its parent directories and that
 #      path's index entry, plus whatever the two caller-named wrappers do.
@@ -95,7 +98,7 @@
 #
 # A caller that calls no `hr_lane_*`, `hr_registry_init`, `hr_registry_set`,
 # `hr_remote_record_init`, `hr_registry_lock`, `hr_registry_unlock`, `hr_remote_status_write`,
-# `hr_remote_bundle_write`, `hr_remote_bundle_restore`, `hr_place_artifact`,
+# `hr_remote_bundle_write`, `hr_remote_bundle_restore`, `hr_remote_move_aside`, `hr_place_artifact`,
 # `hr_commit_placed` or `hr_push_landed` function still gets a library that only reads. The
 # lane's ceilings are the only environment values here that carry policy, because
 # the lane is machine-scoped and has no configuration key to carry them; each is
@@ -211,7 +214,8 @@
 # `HR_LANE_OWNER_AT` and `HR_LANE_BROKEN_OWNER`, and the remote state bundle's
 # names, which `hr_remote_names_var` assigns, with `HR_REMOTE_PLANNING_PATHS`
 # (`hr_remote_planning_paths`) and `HR_REMOTE_PLANNING_PLACED` /
-# `HR_REMOTE_PLANNING_KEPT` (`hr_remote_bundle_restore`). Every one of them is assigned
+# `HR_REMOTE_PLANNING_KEPT` (`hr_remote_bundle_restore`) and `HR_REMOTE_ASIDE`
+# (`hr_remote_move_aside`). Every one of them is assigned
 # before it is read by the function that owns it, so an inherited value from a
 # parent process is overwritten rather than believed.
 #
@@ -2179,6 +2183,45 @@ EOF
   return 0
 }
 
+# hr_remote_move_aside <root> <rel_path>
+#
+# Moves `<root>/<state_dir>/<rel_path>`, a file or a directory, with one `mv`
+# into `autonomous_logs/remote_superseded/<epoch>/<rel_path>` (`<epoch>-<n>`,
+# the first `n` = 1, 2, … where that path is free, when an earlier move took
+# that second), creating the parents and removing nothing. On success
+# `HR_REMOTE_ASIDE` holds the absolute destination; it is empty at entry.
+#
+# 0 moved; 1 a missing argument, a <rel_path> that is absolute or has a `..`
+# segment, or a failed `mkdir` / `mv`; 2 — touching nothing — <root>'s
+# configuration is unresolvable; 3 — touching nothing — no source exists.
+hr_remote_move_aside() {
+  local root="${1-}" rel="${2-}" state base epoch aside n
+  HR_REMOTE_ASIDE=''
+  [ -n "$root" ] && [ -n "$rel" ] || return 1
+  case "$rel" in
+    /*) return 1 ;;
+  esac
+  case "/$rel/" in
+    */../*) return 1 ;;
+  esac
+  state=$(hr_state_dir "$root") || return 2
+  hr_remote_names_var
+  base="${root%/}/$state"
+  [ -e "$base/$rel" ] || [ -L "$base/$rel" ] || return 3
+  epoch=$(date +%s)
+  aside="$base/$HR_REMOTE_SUPERSEDED_DIR/$epoch"
+  n=0
+  while [ -e "$aside/$rel" ] || [ -L "$aside/$rel" ]; do
+    n=$((n + 1))
+    aside="$base/$HR_REMOTE_SUPERSEDED_DIR/$epoch-$n"
+  done
+  aside="$aside/$rel"
+  mkdir -p "${aside%/*}" 2>/dev/null || return 1
+  mv "$base/$rel" "$aside" 2>/dev/null || return 1
+  HR_REMOTE_ASIDE=$aside
+  return 0
+}
+
 # hr_remote_bundle_restore <bundle_dir> <root> <branch> <mode>
 #
 # <mode> `job` places the clarification directory, `PAUSE_PROGRESS.md`, the
@@ -2195,20 +2238,18 @@ EOF
 # stay `0` in `mirror` mode.
 #
 # THE CLARIFICATION DIRECTORY IS REPLACED WHOLESALE, AND NOTHING IS DELETED. An
-# existing target is moved aside with one `mv` into
-# `autonomous_logs/remote_superseded/<epoch>/clarifications/<branch>` (`<epoch>-<n>`
-# when an earlier restore took that second) before the
-# bundle's copy goes in, so a stale local pair cannot survive and no recursive
-# removal is ever shelled out. A bundle carrying no clarification directory
-# leaves the target alone: in a mirror it may hold an answer not yet relayed.
-#
-# 0 restored; 1 a missing argument, an unknown <mode> or a failed copy; 2 —
-# touching nothing — when the bundle is unrecognised (no readable `status.json`,
-# a schema other than `HR_REMOTE_STATE_SCHEMA`, or a `branch` other than
-# <branch>) or <root>'s configuration is unresolvable.
+# existing target is moved aside by `hr_remote_move_aside` before the bundle's
+# copy goes in, so a stale local pair cannot survive and no recursive removal is
+# ever shelled out. A bundle carrying no clarification directory leaves the
+# target alone: in a mirror it may hold an answer not yet relayed.
+#
+# 0 restored; 1 a missing argument, an unknown <mode>, a failed move aside or a
+# failed copy; 2 — touching nothing — when the bundle is unrecognised (no
+# readable `status.json`, a schema other than `HR_REMOTE_STATE_SCHEMA`, or a
+# `branch` other than <branch>) or <root>'s configuration is unresolvable.
 hr_remote_bundle_restore() {
   local bundle="${1-}" root="${2-}" branch="${3-}" mode="${4-}"
-  local state base named target epoch aside n tmp pdir file rel p inset
+  local state base named target tmp pdir file rel p inset
   HR_REMOTE_PLANNING_PLACED=0
   HR_REMOTE_PLANNING_KEPT=0
   [ -n "$bundle" ] && [ -n "$root" ] && [ -n "$branch" ] || return 1
@@ -2226,16 +2267,7 @@ hr_remote_bundle_restore() {
   if [ -d "$bundle/$HR_REMOTE_CLARIFY_DIR/$branch" ]; then
     target="$base/$HR_REMOTE_CLARIFY_DIR/$branch"
     if [ -e "$target" ]; then
-      epoch=$(date +%s)
-      aside="$base/$HR_REMOTE_SUPERSEDED_DIR/$epoch"
-      n=0
-      while [ -e "$aside/$HR_REMOTE_CLARIFY_DIR/$branch" ]; do
-        n=$((n + 1))
-        aside="$base/$HR_REMOTE_SUPERSEDED_DIR/$epoch-$n"
-      done
-      aside="$aside/$HR_REMOTE_CLARIFY_DIR/$branch"
-      mkdir -p "${aside%/*}" 2>/dev/null || return 1
-      mv "$target" "$aside" 2>/dev/null || return 1
+      hr_remote_move_aside "$root" "$HR_REMOTE_CLARIFY_DIR/$branch" || return 1
     fi
     mkdir -p "${target%/*}" 2>/dev/null || return 1
     cp -R "$bundle/$HR_REMOTE_CLARIFY_DIR/$branch" "$target" 2>/dev/null || return 1