codex-orchestrator 2.0.13 → 2.0.15

package/dist/src/v2/run-issue.js

@@ -1,7 +1,7 @@
 import { dirname, resolve } from 'node:path';
 import { checkedChangePayloadSha256, } from './checked-change.js';
 import { parseAgentAutoConfig } from './config.js';
-import { canonicalJson, containsCredentialEvidence, parseJsonWithoutDuplicateKeys, sha256 } from './containment.js';
+import { canonicalJson, containsCredentialEvidence, containsHostIdentityEvidence, parseJsonWithoutDuplicateKeys, sha256 } from './containment.js';
 import { findDeniedPathMatch } from './adapters/path-policy.js';
 import { adoptActiveAttempt, confirmActiveAttemptCleanup, createActiveAttempt, launchActiveAttempt, observeActiveAttempt, } from './active-attempt.js';
 import { validateImplementationReport } from './implementation-report.js';
@@ -11,9 +11,9 @@ import { CandidateProofInspectionError, ProofLaunchAuthorizationError } from './
 import { CheckProcessQuiescenceError, resolveIssueCheckPolicy } from './issue-check-policy.js';
 import { IssueInitializationUnrecoverableError, WorkflowGenerationUnrecoverableError, } from './run-store.js';
 import { createPendingEffect } from './run-store.js';
-import { blockReviewFeedback, initializeReviewFeedback, projectReviewFeedbackBatch, publishReviewFeedback, reserveNextReviewFeedbackRound, } from './review-feedback.js';
+import { blockReviewFeedback, initializeReviewFeedback, projectReviewFeedbackBatch, publishReviewFeedback, respondReviewFeedback, reserveNextReviewFeedbackRound, settleReviewFeedbackResponse, } from './review-feedback.js';
 import { createIssueDeliveryAuthority } from './delivery-authority.js';
-import { blockedLabelPolicy, blockedLabelProjection, claimComment, claimRunId, freezeCriteria, historicalClaimCounts, isClaimMarkerComment, isExactClaimMarkerLine, isAdoptableAttempt, observedHistoricalClaimKeys, outcomeEvidenceBytes, publicOutcome, publicIssueSnapshot, refreshClaimedIssueSnapshot, snapshotIssue, sameInspectionIdentity, sameStrings, semanticChangesMatch, } from './run-state-projections.js';
+import { claimComment, claimRunId, freezeCriteria, historicalClaimCounts, isClaimMarkerComment, isExactClaimMarkerLine, isAdoptableAttempt, observedHistoricalClaimKeys, outcomeEvidenceBytes, publicOutcome, publicIssueSnapshot, refreshClaimedIssueSnapshot, snapshotIssue, sameInspectionIdentity, sameStrings, semanticChangesMatch, } from './run-state-projections.js';
 import { applyValidationTransition, nextValidationTransition, projectValidationFeedbackActivation, projectValidationProofPassed, projectValidationProofStart, projectValidationRepair, projectValidationReviewApproved, projectValidationReviewNeedsWork, projectValidationReviewReportRepair, projectValidationReviewTransportRetry, } from './validation-progression.js';
 import { settleCommentEffect, settleCommitEffect, settleCleanupEffect, settleDraftPullRequestEffect, settleLabelsEffect, settlePushEffect, } from './pending-effect-settlement.js';
 export class OwnerLockSafetyError extends Error {
@@ -77,7 +77,7 @@ export class RunIssue {
         if (!observation || observation.state !== 'OPEN' || !this.hasTrustedClaim(observation, active.record)) {
             return { result: await this.publicationDiverged(active, 'claim-comment-observation-diverged') };
         }
-        if (sameStrings(observation.labels, expectedLabels))
+        if (claimLabelProjectionSettled(observation.labels, config))
             return { active };
         const labels = new Set(observation.labels);
         if (!labels.has(config.github.labels.auto.name)
@@ -98,7 +98,7 @@ export class RunIssue {
                 observation = await this.readIssue(issueNumber);
                 if (!observation || !this.hasTrustedClaim(observation, active.record))
                     return 'diverged';
-                return sameStrings(observation.labels, expectedLabels) ? 'confirmed' : 'absent';
+                return claimLabelProjectionSettled(observation.labels, config) ? 'confirmed' : 'absent';
             },
             invoke: () => this.dependencies.issues.setLabels(issueNumber, expectedLabels),
         });
@@ -241,7 +241,7 @@ export class RunIssue {
                 });
                 if (settlement.status === 'unauthorized') {
                     return this.signal.aborted
-                        ? await this.terminal(await this.clearEffect(active), { status: 'cancelled' })
+                        ? await this.terminal(await this.confirmEffect(active), { status: 'cancelled' })
                         : await this.revoked(active);
                 }
                 if (settlement.status === 'unknown')
@@ -273,7 +273,7 @@ export class RunIssue {
             });
             if (settlement.status === 'unauthorized') {
                 return this.signal.aborted
-                    ? await this.terminal(await this.clearEffect(active), { status: 'cancelled' })
+                    ? await this.terminal(await this.confirmEffect(active), { status: 'cancelled' })
                     : await this.revoked(active);
             }
             if (settlement.status === 'unknown')
@@ -320,7 +320,7 @@ export class RunIssue {
             });
             if (settlement.status === 'unauthorized') {
                 return this.signal.aborted
-                    ? await this.terminal(await this.clearEffect(active), { status: 'cancelled' })
+                    ? await this.terminal(await this.confirmEffect(active), { status: 'cancelled' })
                     : await this.revoked(active);
             }
             if (settlement.status === 'unknown')
@@ -332,74 +332,9 @@ export class RunIssue {
         const pullRequest = await this.dependencies.pullRequests.findOpen({ headBranch: branchName, baseBranch: config.github.baseBranch });
         if (!pullRequest || pullRequest.body !== prBody)
             return await this.publicationDiverged(active, 'pr-missing-before-handoff');
-        const handoffMarker = `<!-- codex-orchestrator:run:${runId}:handoff -->`;
-        const handoffBody = `${handoffMarker}\nReview-ready draft PR: ${pullRequest.url}`;
-        if (active.record.pendingEffect?.kind === 'handoff-comment' || !active.record.pendingEffect) {
-            if (!active.record.pendingEffect) {
-                active = await this.persist(active, {
-                    pendingEffect: { kind: 'handoff-comment', issueNumber, marker: handoffMarker, bodySha256: sha256(handoffBody) },
-                });
-            }
-            const pendingEffect = active.record.pendingEffect;
-            if (pendingEffect?.kind !== 'handoff-comment' || pendingEffect.issueNumber !== issueNumber
-                || pendingEffect.marker !== handoffMarker || pendingEffect.bodySha256 !== sha256(handoffBody)) {
-                return this.publicationDiverged(active, 'handoff-comment-pendingEffect-diverged');
-            }
-            const settlement = await settleCommentEffect(pendingEffect, {
-                observe: async () => {
-                    const observation = await this.readIssue(issueNumber);
-                    if (!observation)
-                        return 'diverged';
-                    const matching = commentsWithMarker(observation, handoffMarker);
-                    if (matching.length === 0)
-                        return 'absent';
-                    return matching.length === 1 && sha256(matching[0].body) === sha256(handoffBody) ? 'confirmed' : 'diverged';
-                },
-                authorize: async () => !this.signal.aborted && await this.authorized(active, config),
-                invoke: () => this.dependencies.issues.postComment(issueNumber, handoffBody),
-            });
-            if (settlement.status === 'unauthorized') {
-                return this.signal.aborted
-                    ? await this.terminal(await this.clearEffect(active), { status: 'cancelled' })
-                    : await this.revoked(active);
-            }
-            if (settlement.status === 'unknown')
-                return await this.invokedFailure(active, 'handoff-comment-delivery-unknown');
-            if (settlement.status !== 'confirmed')
-                return await this.publicationDiverged(active, 'handoff-comment-observation-diverged');
-            active = await this.confirmEffect(active);
-        }
-        const terminalLabels = [config.github.labels.review.name];
-        if (active.record.pendingEffect?.kind === 'final-labels' || !active.record.pendingEffect) {
-            if (!active.record.pendingEffect)
-                active = await this.persist(active, { pendingEffect: { kind: 'final-labels', issueNumber, expected: terminalLabels } });
-            const pendingEffect = active.record.pendingEffect;
-            if (pendingEffect?.kind !== 'final-labels' || pendingEffect.issueNumber !== issueNumber
-                || !sameStrings(pendingEffect.expected, terminalLabels)) {
-                return this.publicationDiverged(active, 'terminal-labels-pendingEffect-diverged');
-            }
-            const settlement = await settleLabelsEffect(pendingEffect, {
-                observe: async () => {
-                    const observation = await this.readIssue(issueNumber);
-                    return !observation ? 'diverged' : sameStrings(observation.labels, terminalLabels) ? 'confirmed' : 'absent';
-                },
-                authorize: async () => !this.signal.aborted && await this.authorized(active, config),
-                invoke: () => this.dependencies.issues.setLabels(issueNumber, terminalLabels),
-            });
-            if (settlement.status === 'unauthorized') {
-                return this.signal.aborted
-                    ? await this.terminal(await this.clearEffect(active), { status: 'cancelled' })
-                    : await this.revoked(active);
-            }
-            if (settlement.status === 'unknown')
-                return await this.invokedFailure(active, 'terminal-labels-delivery-unknown');
-            if (settlement.status !== 'confirmed')
-                return await this.publicationDiverged(active, 'terminal-labels-diverged');
-            active = await this.confirmEffect(active);
-        }
-        return this.persistTerminal(active, {
+        return this.terminal(active, {
             status: 'review-ready', pullRequestUrl: pullRequest.url, continuationEpoch: commitSha,
-        }, 'review-ready', false, {
+        }, 'review-ready', {
             reviewFeedback: initializeReviewFeedback(active.record.reviewFeedback ?? {
                 version: 1, updateEpoch: 0, consumedSourceIds: [], previousPublishedHeadSha: null,
                 repairRound: 0, activeBatch: null, history: [], verifiedReceipt: null,
@@ -484,7 +419,7 @@ export class RunIssue {
                     || pendingEffect.message !== message || pendingEffect.candidateRef !== candidateBinding.candidateRef) {
                     return this.persistRetainedCommitIntentTerminal(active, 'review-feedback-candidate-pendingEffect-diverged');
                 }
-                let authorizationFailure;
+                let authorizationValidation;
                 const settlement = await settleCommitEffect(pendingEffect, {
                     observe: async () => {
                         const observed = await candidate.createOrObserveCommit({
@@ -500,9 +435,8 @@ export class RunIssue {
                     authorize: async () => {
                         if (!await this.authorized(active, config))
                             return false;
-                        const validation = await coordinator.revalidate({ batch, epoch: 'pre-update', expectedHeadSha: oldHead });
-                        authorizationFailure = await this.mapFeedbackRevalidation(active, validation, 'review-feedback-precommit-revalidation-failed');
-                        return !authorizationFailure;
+                        authorizationValidation = await coordinator.revalidate({ batch, issueNumber, epoch: 'pre-update', expectedHeadSha: oldHead });
+                        return authorizationValidation.status === 'valid';
                     },
                     invoke: async () => {
                         const invoked = await candidate.createOrObserveCommit({
@@ -515,8 +449,16 @@ export class RunIssue {
                     },
                 });
                 if (settlement.status === 'unauthorized') {
-                    return authorizationFailure
-                        ?? this.persistRetainedCommitIntentTerminal(active, 'review-feedback-publication-authority-revoked');
+                    if (authorizationValidation?.status === 'retryable') {
+                        return this.invokedFailure(active, 'review-feedback-precommit-revalidation-failed-retryable');
+                    }
+                    active = await this.confirmEffect(active);
+                    if (authorizationValidation) {
+                        const failure = await this.mapFeedbackRevalidation(active, authorizationValidation, 'review-feedback-precommit-revalidation-failed');
+                        if (failure)
+                            return failure;
+                    }
+                    return this.blockReviewFeedback(active, 'safety', 'review-feedback-publication-authority-revoked');
                 }
                 if (settlement.status === 'unknown') {
                     return this.invokedFailure(active, 'candidate-ref-update-unknown', 'Candidate update outcome is unknown; retain and observe the exact commit effect.');
@@ -551,7 +493,7 @@ export class RunIssue {
                 || pendingEffect.parentSha !== oldHead || pendingEffect.message !== message) {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-commit-pendingEffect-diverged');
             }
-            let authorizationFailure;
+            let authorizationValidation;
             const settlement = await settleCommitEffect(pendingEffect, {
                 observe: async () => {
                     const observed = await this.dependencies.git.inspectHead(active.record.worktreePath);
@@ -566,20 +508,30 @@ export class RunIssue {
                 authorize: async () => {
                     if (!await this.authorized(active, config))
                         return false;
-                    const validation = await coordinator.revalidate({ batch, epoch: 'pre-update', expectedHeadSha: oldHead });
-                    authorizationFailure = await this.mapFeedbackRevalidation(active, validation, 'review-feedback-precommit-revalidation-failed');
-                    return !authorizationFailure;
+                    authorizationValidation = await coordinator.revalidate({ batch, issueNumber, epoch: 'pre-update', expectedHeadSha: oldHead });
+                    return authorizationValidation.status === 'valid';
                 },
                 invoke: async () => {
                     await this.dependencies.git.commit({ worktreePath: active.record.worktreePath, message: pendingEffect.message });
                 },
             });
             if (settlement.status === 'unauthorized') {
-                return authorizationFailure
-                    ?? this.blockReviewFeedback(active, 'safety', 'review-feedback-publication-authority-revoked');
+                if (authorizationValidation?.status === 'retryable') {
+                    return this.invokedFailure(active, 'review-feedback-precommit-revalidation-failed-retryable');
+                }
+                active = await this.confirmEffect(active);
+                if (authorizationValidation) {
+                    const failure = await this.mapFeedbackRevalidation(active, authorizationValidation, 'review-feedback-precommit-revalidation-failed');
+                    if (failure)
+                        return failure;
+                }
+                return this.blockReviewFeedback(active, 'safety', 'review-feedback-publication-authority-revoked');
             }
             if (settlement.status === 'unknown')
                 return this.invokedFailure(active, 'review-feedback-commit-delivery-unknown');
+            if (settlement.status === 'diverged') {
+                return this.blockReviewFeedback(await this.confirmEffect(active), 'safety', 'review-feedback-commit-observation-diverged');
+            }
             if (settlement.status !== 'confirmed') {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-commit-observation-diverged');
             }
@@ -608,7 +560,7 @@ export class RunIssue {
                 || pendingEffect.treeSha !== commit.treeSha || pendingEffect.branch !== active.record.branchName || pendingEffect.priorRemoteSha !== oldHead) {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-push-pendingEffect-diverged');
             }
-            let authorizationFailure;
+            let authorizationValidation;
             const settlement = await settlePushEffect(pendingEffect, {
                 observe: async () => {
                     remote = await this.dependencies.git.getRemoteBranchSha(active.record.worktreePath, active.record.branchName);
@@ -617,9 +569,8 @@ export class RunIssue {
                 authorize: async () => {
                     if (!await this.authorized(active, config))
                         return false;
-                    const validation = await coordinator.revalidate({ batch, epoch: 'pre-update', expectedHeadSha: oldHead });
-                    authorizationFailure = await this.mapFeedbackRevalidation(active, validation, 'review-feedback-prepush-revalidation-failed');
-                    return !authorizationFailure;
+                    authorizationValidation = await coordinator.revalidate({ batch, issueNumber, epoch: 'pre-update', expectedHeadSha: oldHead });
+                    return authorizationValidation.status === 'valid';
                 },
                 invoke: () => this.dependencies.git.push({
                     worktreePath: active.record.worktreePath,
@@ -627,16 +578,28 @@ export class RunIssue {
                 }),
             });
             if (settlement.status === 'unauthorized') {
-                return authorizationFailure
-                    ?? this.blockReviewFeedback(active, 'safety', 'review-feedback-publication-authority-revoked');
+                if (authorizationValidation?.status === 'retryable') {
+                    return this.invokedFailure(active, 'review-feedback-prepush-revalidation-failed-retryable');
+                }
+                active = await this.confirmEffect(active);
+                if (authorizationValidation) {
+                    const failure = await this.mapFeedbackRevalidation(active, authorizationValidation, 'review-feedback-prepush-revalidation-failed');
+                    if (failure)
+                        return failure;
+                }
+                return this.blockReviewFeedback(active, 'safety', 'review-feedback-publication-authority-revoked');
             }
             if (settlement.status === 'unknown')
                 return this.invokedFailure(active, 'review-feedback-push-delivery-unknown');
+            if (settlement.status === 'diverged') {
+                return this.blockReviewFeedback(await this.confirmEffect(active), 'safety', 'review-feedback-push-observation-diverged');
+            }
             if (settlement.status !== 'confirmed') {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-push-observation-diverged');
             }
+            active = await this.confirmEffect(active);
         }
-        const postPush = await coordinator.revalidate({ batch, epoch: 'post-push', expectedHeadSha: head });
+        const postPush = await coordinator.revalidate({ batch, issueNumber, epoch: 'post-push', expectedHeadSha: head });
         const postPushFailure = await this.mapFeedbackRevalidation(active, postPush, 'review-feedback-postpush-revalidation-failed');
         if (postPushFailure)
             return postPushFailure;
@@ -668,10 +631,7 @@ export class RunIssue {
                 || pendingEffect.marker !== marker || pendingEffect.bodySha256 !== sha256(body) || pendingEffect.epochHeadSha !== head) {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-summary-pendingEffect-diverged');
             }
-            const validation = await coordinator.revalidate({ batch, epoch: 'post-push', expectedHeadSha: head });
-            const validationFailure = await this.mapFeedbackRevalidation(active, validation, 'review-feedback-summary-revalidation-failed');
-            if (validationFailure)
-                return validationFailure;
+            let authorizationValidation;
             let matches = [];
             const settlement = await settleCommentEffect(pendingEffect, {
                 observe: async () => {
@@ -681,16 +641,33 @@ export class RunIssue {
                         return 'absent';
                     return matches.length === 1 && matches[0].body === body ? 'confirmed' : 'diverged';
                 },
-                authorize: () => this.authorized(active, config),
+                authorize: async () => {
+                    if (!await this.authorized(active, config))
+                        return false;
+                    authorizationValidation = await coordinator.revalidate({ batch, issueNumber, epoch: 'post-push', expectedHeadSha: head });
+                    return authorizationValidation.status === 'valid';
+                },
                 invoke: async () => {
                     await this.dependencies.pullRequests.postConversationComment(batch.pullRequest.number, body);
                 },
             });
             if (settlement.status === 'unauthorized') {
+                if (authorizationValidation?.status === 'retryable') {
+                    return this.invokedFailure(active, 'review-feedback-summary-revalidation-failed-retryable');
+                }
+                active = await this.confirmEffect(active);
+                if (authorizationValidation) {
+                    const failure = await this.mapFeedbackRevalidation(active, authorizationValidation, 'review-feedback-summary-revalidation-failed');
+                    if (failure)
+                        return failure;
+                }
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-publication-authority-revoked');
             }
             if (settlement.status === 'unknown')
                 return this.invokedFailure(active, 'review-feedback-summary-delivery-unknown');
+            if (settlement.status === 'diverged') {
+                return this.blockReviewFeedback(await this.confirmEffect(active), 'safety', 'review-feedback-summary-observation-diverged');
+            }
             if (settlement.status !== 'confirmed') {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-summary-observation-diverged');
             }
@@ -723,23 +700,37 @@ export class RunIssue {
                 || !sameStrings(pendingEffect.expected, finalLabels)) {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-final-labels-pendingEffect-diverged');
             }
-            const validation = await coordinator.revalidate({ batch, epoch: 'post-push', expectedHeadSha: head });
-            const validationFailure = await this.mapFeedbackRevalidation(active, validation, 'review-feedback-final-labels-revalidation-failed');
-            if (validationFailure)
-                return validationFailure;
+            let authorizationValidation;
             const settlement = await settleLabelsEffect(pendingEffect, {
                 observe: async () => {
                     const issue = await this.readIssue(issueNumber);
-                    return !issue ? 'diverged' : sameStrings(issue.labels, finalLabels) ? 'confirmed' : 'absent';
+                    return !issue ? 'diverged' : sameStrings(managedLabelProjection(issue.labels, config), finalLabels) ? 'confirmed' : 'absent';
+                },
+                authorize: async () => {
+                    if (!await this.authorized(active, config))
+                        return false;
+                    authorizationValidation = await coordinator.revalidate({ batch, issueNumber, epoch: 'post-push', expectedHeadSha: head });
+                    return authorizationValidation.status === 'valid';
                 },
-                authorize: () => this.authorized(active, config),
                 invoke: () => this.dependencies.issues.setLabels(issueNumber, finalLabels),
             });
             if (settlement.status === 'unauthorized') {
+                if (authorizationValidation?.status === 'retryable') {
+                    return this.invokedFailure(active, 'review-feedback-final-labels-revalidation-failed-retryable');
+                }
+                active = await this.confirmEffect(active);
+                if (authorizationValidation) {
+                    const failure = await this.mapFeedbackRevalidation(active, authorizationValidation, 'review-feedback-final-labels-revalidation-failed');
+                    if (failure)
+                        return failure;
+                }
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-publication-authority-revoked');
             }
             if (settlement.status === 'unknown')
                 return this.invokedFailure(active, 'review-feedback-final-labels-delivery-unknown');
+            if (settlement.status === 'diverged') {
+                return this.blockReviewFeedback(await this.confirmEffect(active), 'safety', 'review-feedback-final-labels-diverged');
+            }
             if (settlement.status !== 'confirmed') {
                 return this.blockReviewFeedback(active, 'safety', 'review-feedback-final-labels-diverged');
             }
@@ -755,10 +746,17 @@ export class RunIssue {
             summaryCommentId: summaryId,
             publishedAt: this.timestamp(),
         };
-        const pullRequestUrl = `https://github.com/${active.record.canonicalRepository}/pull/${batch.pullRequest.number}`;
-        return this.persistTerminal(active, {
-            status: 'review-ready', pullRequestUrl, continuationEpoch: head,
-        }, 'review-ready', false, {
+        const pullRequest = await this.dependencies.pullRequests.findOpen({
+            headBranch: active.record.branchName,
+            baseBranch: config.github.baseBranch,
+        });
+        if (!pullRequest || pullRequest.number !== batch.pullRequest.number || pullRequest.nodeId !== batch.pullRequest.nodeId
+            || pullRequest.headSha !== head) {
+            return this.blockReviewFeedback(active, 'safety', 'review-feedback-published-pr-identity-diverged');
+        }
+        return this.terminal(active, {
+            status: 'review-ready', pullRequestUrl: pullRequest.url, continuationEpoch: head,
+        }, 'review-ready', {
             reviewFeedback: publishReviewFeedback(active.record.reviewFeedback, receipt),
         });
     }
@@ -774,13 +772,16 @@ export class RunIssue {
             baseBranch: config.github.baseBranch,
         });
         if (!pullRequest?.number || !pullRequest.nodeId || !pullRequest.headSha) {
-            return { result: await this.persistTerminal(starting, { status: 'blocked', kind: 'safety', resumable: false }, 'review-feedback-pr-identity-missing', false) };
+            return { result: await this.terminal(starting, { status: 'blocked', kind: 'safety', resumable: false }, 'review-feedback-pr-identity-missing') };
+        }
+        if (pullRequest.url !== terminal.pullRequestUrl) {
+            return { result: await this.terminal(starting, { status: 'blocked', kind: 'safety', resumable: false }, 'review-feedback-prior-handoff-identity-mismatch') };
         }
         const expectedHeadSha = feedback.previousPublishedHeadSha === null
             ? pullRequest.headSha
             : feedback.previousPublishedHeadSha;
         if (!expectedHeadSha) {
-            return { result: await this.persistTerminal(starting, { status: 'blocked', kind: 'safety', resumable: false }, 'review-feedback-head-missing', false) };
+            return { result: await this.terminal(starting, { status: 'blocked', kind: 'safety', resumable: false }, 'review-feedback-head-missing') };
         }
         const observed = await this.dependencies.reviewFeedback.observeAndFreeze({
             runId: starting.record.runId,
@@ -797,29 +798,40 @@ export class RunIssue {
                 headSha: pullRequest.headSha,
                 body: pullRequest.body,
             },
+            ...(starting.record.terminalNotifications ? {
+                issueCommentCutoff: {
+                    issueNumber: starting.record.issueNumber,
+                    ...starting.record.terminalNotifications.commentCutoff,
+                },
+            } : {}),
         });
         if (observed.status === 'retryable')
             return { result: await this.invokedFailure(starting, 'review-feedback-observation-retryable') };
         if (observed.status === 'blocked') {
-            return { result: await this.persistTerminal(starting, { status: 'blocked', kind: 'safety', resumable: false }, 'review-feedback-observation-blocked', false) };
+            return { result: await this.terminal(starting, { status: 'blocked', kind: 'safety', resumable: false }, 'review-feedback-observation-blocked') };
         }
+        let ready = starting;
         if (feedback.previousPublishedHeadSha === null) {
-            const sourceIds = observed.status === 'frozen'
+            const issueCommentBatch = observed.status === 'frozen'
+                && observed.batch.sources.every((source) => source.kind === 'issue-comment');
+            const sourceIds = observed.status === 'frozen' && !issueCommentBatch
                 ? observed.batch.sources.map((source) => source.sourceId)
-                : observed.eligibleSourceIds;
-            const active = await this.persist(starting, {
+                : observed.status === 'none' ? observed.eligibleSourceIds : [];
+            ready = await this.persist(starting, {
                 reviewFeedback: initializeReviewFeedback(feedback, expectedHeadSha, sourceIds),
             });
-            return { result: publicOutcome(active.record.terminalOutcome) };
+            if (!issueCommentBatch)
+                return { result: publicOutcome(ready.record.terminalOutcome) };
         }
-        if (feedback.activeBatch || observed.status === 'none')
+        const readyFeedback = ready.record.reviewFeedback;
+        if (readyFeedback.activeBatch || observed.status === 'none')
             return { result: publicOutcome(terminal) };
         if (!await this.authorizedForExactLabels(starting, [config.github.labels.review.name])) {
             return { result: publicOutcome(terminal) };
         }
-        const projected = projectReviewFeedbackBatch(observed.batch, starting.record.directReview.targetRevision);
-        const candidateTreeSha = await this.dependencies.git.getTreeSha(starting.record.worktreePath);
-        const activation = projectValidationFeedbackActivation(starting.record, {
+        const projected = projectReviewFeedbackBatch(observed.batch, ready.record.directReview.targetRevision);
+        const candidateTreeSha = await this.dependencies.git.getTreeSha(ready.record.worktreePath);
+        const activation = projectValidationFeedbackActivation(ready.record, {
             batch: observed.batch,
             repairFindings: projected.repairFindings,
             candidateTreeSha,
@@ -830,7 +842,16 @@ export class RunIssue {
                 expected: sortedUnique([config.github.labels.auto.name, config.github.labels.running.name]),
             },
         });
-        const active = await this.persistValidationTransition(starting, activation);
+        if (observed.batch.sources.every((source) => source.kind === 'issue-comment')) {
+            activation.changes.cycle = ready.record.cycle + 1;
+            activation.changes.checks = structuredClone(ready.record.checks);
+            activation.changes.checkedChangeSha256 = ready.record.checkedChangeSha256;
+            activation.changes.proofId = ready.record.proofId;
+            activation.changes.proofReceipt = structuredClone(ready.record.proofReceipt);
+            activation.changes.implementationResult = structuredClone(ready.record.implementationResult);
+            activation.changes.terminalNotifications = undefined;
+        }
+        const active = await this.persistValidationTransition(ready, activation);
         return this.resumeActivatedReviewFeedback(active, targetRoot, config);
     }
     async resumeActivatedReviewFeedback(starting, targetRoot, config) {
@@ -844,41 +865,45 @@ export class RunIssue {
         const runningLabels = sortedUnique([config.github.labels.auto.name, config.github.labels.running.name]);
         const reviewLabels = [config.github.labels.review.name];
         const pendingEffect = active.record.pendingEffect;
-        if (pendingEffect && (pendingEffect.kind !== 'review-activation-labels'
-            || pendingEffect.issueNumber !== active.record.issueNumber
-            || pendingEffect.batchId !== batch.batchId
-            || !sameStrings(pendingEffect.expected, runningLabels))) {
+        const activationEffect = pendingEffect?.kind === 'review-activation-labels' ? pendingEffect : undefined;
+        if (pendingEffect && pendingEffect.kind !== 'continuation-worktree-create' && (!activationEffect
+            || activationEffect.issueNumber !== active.record.issueNumber
+            || activationEffect.batchId !== batch.batchId
+            || !sameStrings(activationEffect.expected, runningLabels))) {
             return { result: await this.blockReviewFeedback(active, 'safety', 'review-feedback-activation-pendingEffect-diverged') };
         }
         const issue = await this.readIssue(active.record.issueNumber);
-        const labelsAreRunning = !!issue && issue.state === 'OPEN' && sameStrings(issue.labels, runningLabels)
+        const labelsAreRunning = !!issue && issue.state === 'OPEN' && sameStrings(managedLabelProjection(issue.labels, config), runningLabels)
             && this.hasTrustedClaim(issue, active.record);
-        const labelsAreReview = !!issue && issue.state === 'OPEN' && sameStrings(issue.labels, reviewLabels)
+        const labelsAreReview = !!issue && issue.state === 'OPEN' && sameStrings(managedLabelProjection(issue.labels, config), reviewLabels)
             && this.hasTrustedClaim(issue, active.record);
         if (!labelsAreRunning && !labelsAreReview) {
             return { result: await this.blockReviewFeedback(active, 'safety', 'review-feedback-activation-authority-revoked') };
         }
         const validation = await this.dependencies.reviewFeedback.revalidate({
-            batch, epoch: 'pre-update', expectedHeadSha,
+            batch, issueNumber: active.record.issueNumber, epoch: 'pre-update', expectedHeadSha,
         });
         const validationFailure = await this.mapFeedbackRevalidation(active, validation, 'review-feedback-activation-revalidation-failed');
         if (validationFailure)
             return { result: validationFailure };
-        if (pendingEffect) {
-            const settlement = await settleLabelsEffect(pendingEffect, {
+        if (activationEffect) {
+            const settlement = await settleLabelsEffect(activationEffect, {
                 observe: async () => {
                     const observed = await this.readIssue(active.record.issueNumber);
                     if (!observed || !this.hasTrustedClaim(observed, active.record))
                         return 'diverged';
-                    if (sameStrings(observed.labels, runningLabels))
+                    if (sameStrings(managedLabelProjection(observed.labels, config), runningLabels))
                         return 'confirmed';
-                    return sameStrings(observed.labels, reviewLabels) ? 'absent' : 'diverged';
+                    return sameStrings(managedLabelProjection(observed.labels, config), reviewLabels) ? 'absent' : 'diverged';
                 },
                 invoke: () => this.dependencies.issues.setLabels(active.record.issueNumber, runningLabels),
             });
             if (settlement.status === 'unknown') {
                 return { result: await this.invokedFailure(active, 'review-feedback-activation-labels-delivery-unknown') };
             }
+            if (settlement.status === 'diverged') {
+                return { result: await this.blockReviewFeedback(await this.confirmEffect(active), 'safety', 'review-feedback-activation-labels-diverged') };
+            }
             if (settlement.status !== 'confirmed') {
                 return { result: await this.blockReviewFeedback(active, 'safety', 'review-feedback-activation-labels-diverged') };
             }
@@ -998,26 +1023,17 @@ export class RunIssue {
                 if (active.record.pendingEffect?.kind === 'outcome-evidence') {
                     if (active.record.terminalOutcome) {
                         const observed = await this.observeOutcomeEvidenceEffect(active, active.record.pendingEffect.code, active.record.pendingEffect.summary);
-                        await this.confirmEffect(observed.active);
+                        active = await this.confirmEffect(observed.active);
+                        active = await this.settleTerminalNotificationsBestEffort(active);
                         return publicOutcome(active.record.terminalOutcome);
                     }
                     const seed = parseTerminalSeedSummary(active.record.pendingEffect.summary);
-                    return await this.persistTerminal(active, seed, active.record.pendingEffect.code, false);
+                    return await this.terminal(active, seed, active.record.pendingEffect.code);
                 }
-                if (active.record.pendingEffect?.kind === 'review-blocked-labels') {
-                    return await this.blockReviewFeedback(active, active.record.pendingEffect.blockKind, active.record.pendingEffect.evidenceCode);
-                }
-                if (active.record.pendingEffect?.kind === 'blocked-labels') {
-                    return await this.publishBlockedTerminal(active, {
-                        status: 'blocked',
-                        kind: active.record.pendingEffect.blockKind,
-                        resumable: active.record.pendingEffect.resumable,
-                    }, active.record.pendingEffect.evidenceCode);
-                }
-                if (existing.terminalOutcome?.status === 'blocked'
-                    && issue?.state === 'OPEN'
-                    && blockedLabelProjection(issue.labels, config).status !== 'settled') {
-                    return await this.reconcilePersistedBlockedTerminal(active, issue, existing.terminalOutcome);
+                if (active.record.terminalOutcome && (active.record.terminalNotifications
+                    || active.record.pendingEffect?.kind === 'terminal-comment'
+                    || active.record.pendingEffect?.kind === 'terminal-labels')) {
+                    active = await this.settleTerminalNotificationsBestEffort(active);
                 }
                 if (active.record.terminalOutcome?.status === 'transport-failed'
                     && !active.record.terminalOutcome.resumable
@@ -1072,7 +1088,9 @@ export class RunIssue {
                         return reconciled;
                     active = reconciled.active;
                 }
-                if (active.record.reviewFeedback?.activeBatch && active.record.pendingEffect?.kind === 'review-activation-labels') {
+                if (active.record.reviewFeedback?.activeBatch
+                    && (active.record.pendingEffect?.kind === 'review-activation-labels'
+                        || active.record.pendingEffect?.kind === 'continuation-worktree-create')) {
                     const activation = await this.resumeActivatedReviewFeedback(active, targetRoot, config);
                     if ('result' in activation)
                         return activation.result;
@@ -1193,7 +1211,7 @@ export class RunIssue {
             }
             attemptLoop: while (true) {
                 if (!await this.authorized(active, config)) {
-                    return await this.terminal(active, { status: 'blocked', kind: 'safety', resumable: true });
+                    return await this.terminal(active, { status: 'blocked', kind: 'safety', resumable: true }, 'authorization-revoked');
                 }
                 if (this.signal.aborted)
                     return await this.terminal(active, { status: 'cancelled' });
@@ -1224,6 +1242,12 @@ export class RunIssue {
                         ...(feedbackBatch ? {
                             reviewFeedbackRound: active.record.reviewFeedback.repairRound,
                             reviewFeedback: feedbackProjection.workerFeedback,
+                            reviewFeedbackPullRequest: {
+                                number: feedbackBatch.pullRequest.number,
+                                headSha: feedbackBatch.pullRequest.headSha,
+                                headRefName: feedbackBatch.pullRequest.headRefName,
+                                url: `https://github.com/${active.record.canonicalRepository}/pull/${feedbackBatch.pullRequest.number}`,
+                            },
                         } : {}),
                         onPrepared: async (prepared) => {
                             const currentActive = active;
@@ -1327,8 +1351,11 @@ export class RunIssue {
                         }
                         return await this.terminal(active, implementationBlockerOutcome(report.blocker));
                     }
+                    if (report.status === 'answer-only' || report.status === 'boundary') {
+                        return this.completeIssueFeedbackResponse(active, report, config);
+                    }
                     if (await this.dependencies.git.getHead(worktreePath) !== expectedImplementationHead(active.record)) {
-                        return await this.terminal(active, { status: 'blocked', kind: 'safety', resumable: true });
+                        return await this.terminal(active, { status: 'blocked', kind: 'safety', resumable: true }, 'implementation-head-drift');
                     }
                     const changedFiles = await this.dependencies.git.listChangedFiles(worktreePath);
                     if (changedFiles.length === 0 || !sameStrings(changedFiles, report.changedFiles)) {
@@ -1348,6 +1375,7 @@ export class RunIssue {
                         active = await this.adoptAttempt(active, sha256(canonicalJson(report)), {
                             transportRetries: active.record.transportRetries,
                             reportRepairs: 0,
+                            implementationResult: { summary: report.summary, residualRisks: report.residualRisks },
                         });
                         active = await this.clearAttempt(active);
                     }
@@ -1880,7 +1908,10 @@ export class RunIssue {
         const record = { ...active.record, ...normalized, updatedAt: this.timestamp() };
         if (Object.hasOwn(changes, 'pendingEffect') && changes.pendingEffect === undefined)
             delete record.pendingEffect;
-        for (const key of ['checkedChangeSha256', 'proofId', 'proofReceipt', 'terminalOutcome', 'outcomeEvidenceId', 'reviewFeedback', 'changeBindingVersion', 'candidateBinding', 'candidateMaterialization', 'activeAttempt']) {
+        if (Object.hasOwn(changes, 'terminalOutcome') && changes.terminalOutcome === undefined
+            && !Object.hasOwn(changes, 'terminalNotifications'))
+            delete record.terminalNotifications;
+        for (const key of ['checkedChangeSha256', 'proofId', 'proofReceipt', 'terminalOutcome', 'outcomeEvidenceId', 'reviewFeedback', 'changeBindingVersion', 'candidateBinding', 'candidateMaterialization', 'activeAttempt', 'terminalNotifications']) {
             if (Object.hasOwn(changes, key) && changes[key] === undefined)
                 delete record[key];
         }
@@ -1974,7 +2005,7 @@ export class RunIssue {
     }
     async authorizedForExactLabels(active, expectedLabels) {
         const issue = await this.readIssue(active.record.issueNumber);
-        return !!issue && issue.state === 'OPEN' && sameStrings(issue.labels, expectedLabels)
+        return !!issue && issue.state === 'OPEN' && sameStrings(managedLabelProjection(issue.labels, active.config), expectedLabels)
             && this.hasTrustedClaim(issue, active.record);
     }
     hasTrustedClaim(issue, record) {
@@ -2030,6 +2061,7 @@ export class RunIssue {
         }
         const validation = await this.dependencies.reviewFeedback.revalidate({
             batch,
+            issueNumber,
             epoch: 'pre-update',
             expectedHeadSha: batch.priorPublishedHeadSha,
         });
@@ -2392,7 +2424,7 @@ export class RunIssue {
                 : this.persistCandidateEvidenceSafetyTerminal(active, 'candidate-execution-missing');
         }
         if (inspection.value === 'mutated') {
-            return this.persistTerminal(active, { status: 'blocked', kind: 'safety', resumable: false }, 'candidate-materialization-mutated', false);
+            return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: false }, 'candidate-materialization-mutated');
         }
         if (active.record.activeAttempt?.stage === 'observed' && active.record.activeAttempt.result) {
             return { active };
@@ -2484,7 +2516,7 @@ export class RunIssue {
                 reviewFeedback: blockReviewFeedback(active.record.reviewFeedback, 'safety', this.timestamp()),
             });
         }
-        return this.persistTerminal(active, { status: 'blocked', kind: 'safety', resumable: false }, evidenceCode, false);
+        return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: false }, evidenceCode);
     }
     mapCandidateFailure(active, code) {
         if (code === 'candidate-unstable' || code === 'candidate-io-failed' || code === 'candidate-materialization-io-failed') {
@@ -2857,54 +2889,7 @@ export class RunIssue {
         return transitioned;
     }
     async blockReviewFeedback(active, kind, evidenceCode, outcome = { status: 'blocked', kind, resumable: false }) {
-        const feedback = active.record.reviewFeedback;
-        if (!feedback?.activeBatch)
-            return this.terminal(active, { status: 'blocked', kind, resumable: false }, evidenceCode);
-        {
-            const config = active.config;
-            const blockedLabels = [config.github.labels.auto.name, config.github.labels.blocked.name].sort();
-            const existingIntent = active.record.pendingEffect;
-            if (existingIntent?.kind !== 'review-blocked-labels') {
-                active = await this.persist(active, { pendingEffect: {
-                        kind: 'review-blocked-labels', issueNumber: active.record.issueNumber,
-                        batchId: feedback.activeBatch.batchId, expected: blockedLabels, blockKind: kind, evidenceCode,
-                    } });
-            }
-            else if (existingIntent.issueNumber !== active.record.issueNumber
-                || existingIntent.batchId !== feedback.activeBatch.batchId
-                || !sameStrings(existingIntent.expected, blockedLabels)
-                || existingIntent.blockKind !== kind
-                || existingIntent.evidenceCode !== evidenceCode) {
-                return this.invokedFailure(active, 'review-feedback-blocked-labels-pendingEffect-diverged');
-            }
-            const ownedRunningLabels = [config.github.labels.auto.name, config.github.labels.running.name].sort();
-            const ownedReviewLabels = [config.github.labels.review.name];
-            const effect = active.record.pendingEffect;
-            if (effect?.kind !== 'review-blocked-labels') {
-                return this.invokedFailure(active, 'review-feedback-blocked-labels-pendingEffect-diverged');
-            }
-            const settlement = await settleLabelsEffect(effect, {
-                observe: async () => {
-                    const issue = await this.readIssue(active.record.issueNumber);
-                    if (!issue || issue.state !== 'OPEN')
-                        return 'diverged';
-                    if (sameStrings(issue.labels, blockedLabels))
-                        return 'confirmed';
-                    return sameStrings(issue.labels, ownedRunningLabels) || sameStrings(issue.labels, ownedReviewLabels)
-                        ? 'absent' : 'diverged';
-                },
-                invoke: () => this.dependencies.issues.setLabels(active.record.issueNumber, blockedLabels),
-            });
-            if (settlement.status === 'unknown') {
-                return this.invokedFailure(active, 'review-feedback-blocked-labels-delivery-unknown');
-            }
-            if (settlement.status !== 'confirmed') {
-                return this.invokedFailure(active, 'review-feedback-blocked-labels-observation-diverged');
-            }
-        }
-        return this.persistTerminal(active, outcome, evidenceCode, false, {
-            reviewFeedback: blockReviewFeedback(feedback, kind, this.timestamp()),
-        }, true);
+        return this.terminal(active, outcome, evidenceCode);
     }
     async mapImplementationFailure(active, result) {
         if (result.kind === 'transport-failed')
@@ -2937,7 +2922,7 @@ export class RunIssue {
     async revoked(active) {
         if (active.record.pendingEffect)
             return this.invokedFailure(active, 'revoked-with-pending-effect');
-        return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: true });
+        return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: true }, 'authorization-revoked');
     }
     async invokedFailure(active, code, summary = 'Publication delivery requires reconciliation.') {
         const evidence = await this.dependencies.writeEvidence({ runId: active.record.runId, code, summary });
@@ -2951,8 +2936,8 @@ export class RunIssue {
         });
         return { status: 'repair-ready', source, blockerIds: [...new Set(blockerIds)].sort(), evidencePath: evidence.path };
     }
-    async observeOutcomeEvidenceEffect(active, code, summary, replaceConfirmedEffect = false) {
-        if (!active.record.pendingEffect || replaceConfirmedEffect) {
+    async observeOutcomeEvidenceEffect(active, code, summary) {
+        if (!active.record.pendingEffect) {
             const recordedAt = this.timestamp();
             const path = this.dependencies.outcomeEvidencePath(active.record.runId, code, sha256(summary));
             const bytes = outcomeEvidenceBytes({ runId: active.record.runId, code, summary, recordedAt });
@@ -2983,115 +2968,311 @@ export class RunIssue {
             throw new PostEffectStateError(active);
         return { active, path: effect.path, id: `evidence:${effect.runId}:${effect.code}` };
     }
-    async terminal(active, outcome, evidenceCode = outcome.status, retainIntent = false) {
-        if (active.record.reviewFeedback?.activeBatch && outcome.status === 'blocked') {
-            return this.blockReviewFeedback(active, outcome.kind, evidenceCode, outcome);
+    async completeIssueFeedbackResponse(starting, report, config) {
+        let active = starting;
+        const feedback = active.record.reviewFeedback;
+        const batch = feedback?.activeBatch;
+        if (!feedback || !batch || batch.sources.some((source) => source.kind !== 'issue-comment')) {
+            return this.terminal(active, { status: 'internal-error', code: 'issue-feedback-response-source-invalid' });
         }
-        if (outcome.status === 'blocked') {
-            return this.publishBlockedTerminal(active, outcome, evidenceCode);
+        if (await this.dependencies.git.getHead(active.record.worktreePath) !== batch.priorPublishedHeadSha
+            || (await this.dependencies.git.listChangedFilesIgnoringUntrackedRoot(active.record.worktreePath, config.proof.artifactDir)).length !== 0) {
+            return this.terminal(active, { status: 'internal-error', code: 'issue-feedback-response-mutated-worktree' });
         }
-        return this.persistTerminal(active, outcome, evidenceCode, retainIntent);
-    }
-    async publishBlockedTerminal(starting, outcome, evidenceCode) {
-        let active = starting;
-        const autoBlocked = [active.config.github.labels.auto.name, active.config.github.labels.blocked.name].sort();
-        const blockedOnly = [active.config.github.labels.blocked.name];
-        let expected = autoBlocked;
-        const existing = active.record.pendingEffect;
-        if (!existing) {
-            active = await this.persist(active, { pendingEffect: {
-                    kind: 'blocked-labels',
-                    issueNumber: active.record.issueNumber,
-                    expected,
-                    blockKind: outcome.kind,
-                    resumable: outcome.resumable,
-                    evidenceCode,
-                } });
+        const marker = `<!-- codex-orchestrator:run:${active.record.runId}:issue-feedback:${batch.batchId} -->`;
+        const response = publicIssueFeedbackText(report.response, report.status === 'boundary'
+            ? 'This request cannot be acted on without a new issue-local decision or authority.'
+            : 'The requested answer could not be published safely.');
+        const body = [
+            marker,
+            report.status === 'boundary' ? 'codex-orchestrator reached an authority boundary.' : 'codex-orchestrator answered this follow-up.',
+            '',
+            response,
+            ...(report.status === 'boundary' ? ['', `Boundary: ${report.boundary.kind}`] : []),
+        ].join('\n');
+        const directReview = active.record.directReview;
+        const sourceIds = batch.sources.map((source) => source.sourceId);
+        const restoredDirectReview = {
+            ...structuredClone(directReview),
+            status: 'clear',
+            stage: 'review',
+            review: { ...structuredClone(directReview.review), disposition: 'clear' },
+            repairFindings: directReview.repairFindings.filter((finding) => !sourceIds.includes(finding.sourceId)),
+        };
+        const pullRequest = await this.dependencies.pullRequests.findOpen({
+            headBranch: active.record.branchName,
+            baseBranch: config.github.baseBranch,
+        });
+        if (!pullRequest?.url || pullRequest.number !== batch.pullRequest.number
+            || pullRequest.nodeId !== batch.pullRequest.nodeId || pullRequest.headSha !== batch.pullRequest.headSha
+            || pullRequest.headRefName !== batch.pullRequest.headRefName
+            || pullRequest.baseRefName !== batch.pullRequest.baseRefName) {
+            return this.terminal(active, { status: 'blocked', kind: 'safety', resumable: false }, 'issue-feedback-prior-handoff-identity-mismatch', { reviewFeedback: blockReviewFeedback({
+                    ...feedback,
+                    consumedSourceIds: feedback.consumedSourceIds.filter((id) => !sourceIds.includes(id)),
+                }, 'safety', this.timestamp()) });
+        }
+        const terminalSeed = {
+            status: 'review-ready',
+            pullRequestUrl: pullRequest.url,
+            continuationEpoch: batch.priorPublishedHeadSha,
+        };
+        const terminalOutcome = {
+            ...terminalSeed,
+            evidencePath: this.dependencies.outcomeEvidencePath(active.record.runId, 'review-ready', sha256(canonicalJson(terminalSeed))),
+        };
+        const respondedAt = this.timestamp();
+        const initialReceipt = {
+            kind: 'responded',
+            batchId: batch.batchId,
+            sourceIds,
+            responseKind: report.status,
+            publication: 'failed',
+            diagnostic: 'issue-feedback-response-publication-not-settled',
+            respondedAt,
+        };
+        let comments = active.record.issueSnapshot.comments ?? [];
+        try {
+            comments = (await this.readIssue(active.record.issueNumber))?.comments ?? comments;
         }
-        else if (existing.kind !== 'blocked-labels'
-            || existing.issueNumber !== active.record.issueNumber
-            || existing.blockKind !== outcome.kind
-            || existing.resumable !== outcome.resumable
-            || existing.evidenceCode !== evidenceCode) {
-            return this.invokedFailure(active, 'blocked-labels-pendingEffect-diverged');
+        catch { /* bounded fallback */ }
+        const freshNotifications = terminalNotificationState(active.record, terminalSeed, this.timestamp(), comments);
+        const consumedChanges = {
+            lifecycle: 'review-ready',
+            terminalOutcome,
+            outcomeEvidenceId: `evidence:${active.record.runId}:review-ready`,
+            reviewFeedback: respondReviewFeedback(feedback, initialReceipt),
+            directReview: restoredDirectReview,
+            reworkFindings: [],
+            reportRepairs: 0,
+            transportRetries: 0,
+            terminalNotifications: {
+                ...freshNotifications,
+                comment: { status: 'delivered', attempts: 0 },
+                labels: { status: 'delivered', attempts: 0 },
+            },
+        };
+        active = isAdoptableAttempt(active.record.activeAttempt)
+            ? await this.adoptAttempt(active, sha256(canonicalJson(report)), consumedChanges)
+            : await this.persist(active, consumedChanges);
+        let publication = 'failed';
+        let commentId;
+        let diagnostic;
+        const validation = this.dependencies.reviewFeedback
+            ? await this.dependencies.reviewFeedback.revalidate({
+                batch, issueNumber: active.record.issueNumber, epoch: 'pre-update', expectedHeadSha: batch.priorPublishedHeadSha,
+            })
+            : { status: 'blocked', reason: 'review feedback revalidation unavailable' };
+        if (validation.status !== 'valid') {
+            publication = 'suppressed';
+            diagnostic = validation.status === 'retryable'
+                ? 'issue-feedback-response-revalidation-retryable'
+                : 'issue-feedback-response-revalidation-blocked';
         }
         else {
-            expected = existing.expected;
-            if (!sameStrings(expected, autoBlocked) && !sameStrings(expected, blockedOnly) && expected.length !== 0) {
-                return this.invokedFailure(active, 'blocked-labels-pendingEffect-diverged');
-            }
-        }
-        let issue = await this.readIssue(active.record.issueNumber);
-        if (!issue)
-            return this.invokedFailure(active, 'blocked-labels-issue-missing');
-        let projection = blockedLabelProjection(issue.labels, active.config);
-        if (issue.state === 'OPEN' && projection.status === 'transition') {
-            if (!this.dependencies.issues.transitionToBlocked) {
-                return this.invokedFailure(active, 'blocked-labels-transition-unavailable');
-            }
             try {
-                await this.dependencies.issues.transitionToBlocked(active.record.issueNumber, blockedLabelPolicy(active.config));
+                let issue = await this.readIssue(active.record.issueNumber);
+                let matches = issue ? commentsWithMarker(issue, marker) : [];
+                if (matches.length === 0) {
+                    await this.dependencies.issues.postComment(active.record.issueNumber, body);
+                    issue = await this.readIssue(active.record.issueNumber);
+                    matches = issue ? commentsWithMarker(issue, marker) : [];
+                }
+                const match = matches.length === 1 && sha256(matches[0].body) === sha256(body) ? matches[0] : undefined;
+                if (match) {
+                    publication = 'delivered';
+                    commentId = match.id ?? `marker:${batch.batchId}`;
+                }
+                else {
+                    diagnostic = 'issue-feedback-response-observation-diverged';
+                }
             }
             catch {
-                return this.invokedFailure(active, 'blocked-labels-delivery-unknown');
+                diagnostic = 'issue-feedback-response-delivery-failed';
             }
-            issue = await this.readIssue(active.record.issueNumber);
-            projection = issue ? blockedLabelProjection(issue.labels, active.config) : { status: 'diverged' };
         }
-        if (!issue)
-            return this.invokedFailure(active, 'blocked-labels-observation-missing');
-        if (issue.state === 'OPEN') {
-            if (projection.status !== 'settled') {
-                return this.invokedFailure(active, 'blocked-labels-observation-diverged');
-            }
-            if (!sameStrings(expected, projection.expected)) {
-                expected = projection.expected;
-                const pendingEffect = active.record.pendingEffect;
-                if (pendingEffect?.kind !== 'blocked-labels')
-                    return this.invokedFailure(active, 'blocked-labels-pendingEffect-diverged');
-                try {
-                    const { effectId: _effectId, ...intent } = pendingEffect;
-                    active = await this.persist(active, { pendingEffect: { ...intent, expected } });
-                }
-                catch {
-                    throw new PostEffectStateError(active);
-                }
-            }
+        try {
+            await this.dependencies.issues.setLabels(active.record.issueNumber, [config.github.labels.review.name]);
+        }
+        catch {
+            diagnostic = diagnostic ?? 'issue-feedback-review-label-reconciliation-failed';
         }
+        const receipt = {
+            kind: 'responded',
+            batchId: batch.batchId,
+            sourceIds,
+            responseKind: report.status,
+            publication,
+            ...(commentId ? { commentId } : {}),
+            ...(diagnostic ? { diagnostic } : {}),
+            respondedAt,
+        };
         try {
-            active = await this.confirmEffect(active);
-            return await this.persistTerminal(active, outcome, evidenceCode, false);
+            active = await this.persist(active, {
+                reviewFeedback: settleReviewFeedbackResponse(active.record.reviewFeedback, receipt),
+            });
         }
         catch {
-            throw new PostEffectStateError(active);
+            return publicOutcome(terminalOutcome);
+        }
+        try {
+            active = await this.clearAttempt(active);
         }
+        catch {
+            return publicOutcome(terminalOutcome);
+        }
+        return publicOutcome(active.record.terminalOutcome);
     }
-    async reconcilePersistedBlockedTerminal(active, issue, outcome) {
-        if (!this.dependencies.issues.transitionToBlocked) {
-            return this.invokedFailure(active, 'blocked-labels-transition-unavailable');
+    async terminal(active, outcome, evidenceCode = outcome.status, additionalChanges = {}) {
+        if (active.record.pendingEffect && active.record.pendingEffect.kind !== 'outcome-evidence') {
+            return this.invokedFailure(active, 'terminal-pending-effect-unsettled', 'Terminal state requires the existing effect postcondition to settle first.');
         }
+        const feedback = active.record.reviewFeedback;
+        const terminalChanges = feedback?.activeBatch && !additionalChanges.reviewFeedback ? {
+            ...additionalChanges,
+            reviewFeedback: blockReviewFeedback(feedback, outcome.status === 'blocked' ? outcome.kind : 'safety', this.timestamp()),
+        } : additionalChanges;
+        return this.persistTerminal(active, outcome, evidenceCode, terminalChanges);
+    }
+    async settleTerminalNotificationsBestEffort(starting) {
+        let active = starting;
+        if (!active.record.terminalOutcome || !active.record.terminalNotifications)
+            return active;
+        if (active.record.pendingEffect && active.record.pendingEffect.kind !== 'terminal-comment'
+            && active.record.pendingEffect.kind !== 'terminal-labels')
+            return active;
         try {
-            await this.dependencies.issues.transitionToBlocked(active.record.issueNumber, blockedLabelPolicy(active.config));
+            active = await this.settleTerminalComment(active);
         }
         catch {
-            return this.invokedFailure(active, 'blocked-labels-delivery-unknown');
+            return active;
         }
-        const observation = await this.readIssue(active.record.issueNumber);
-        if (!observation || observation.state !== 'OPEN'
-            || blockedLabelProjection(observation.labels, active.config).status !== 'settled') {
-            return this.invokedFailure(active, 'blocked-labels-observation-diverged');
+        try {
+            active = await this.settleTerminalLabels(active);
         }
-        return publicOutcome(outcome);
+        catch {
+            return active;
+        }
+        return active;
     }
-    async persistTerminal(active, outcome, evidenceCode, retainIntent, additionalChanges = {}, replaceConfirmedEffect = false) {
-        const evidence = await this.observeOutcomeEvidenceEffect(active, evidenceCode, canonicalJson(outcome), replaceConfirmedEffect);
+    async settleTerminalComment(starting) {
+        let active = starting;
+        const notifications = active.record.terminalNotifications;
+        if (notifications.comment.status !== 'pending' || notifications.comment.attempts >= TERMINAL_NOTIFICATION_ATTEMPTS)
+            return active;
+        const body = terminalComment(active.record.runId, active.record.cycle, notifications.report);
+        const marker = body.split('\n')[0];
+        const attempt = notifications.comment.attempts + 1;
+        if (!active.record.pendingEffect) {
+            active = await this.persist(active, { pendingEffect: {
+                    kind: 'terminal-comment', issueNumber: active.record.issueNumber, marker, bodySha256: sha256(body),
+                    outcome: notifications.report.outcome, attempt,
+                } });
+        }
+        const effect = active.record.pendingEffect;
+        if (effect?.kind !== 'terminal-comment' || effect.issueNumber !== active.record.issueNumber
+            || effect.marker !== marker || effect.bodySha256 !== sha256(body)
+            || effect.outcome !== notifications.report.outcome || effect.attempt !== attempt)
+            return active;
+        const settlement = await settleCommentEffect(effect, {
+            observe: async () => {
+                const issue = await this.readIssue(effect.issueNumber);
+                if (!issue || issue.state !== 'OPEN')
+                    return 'diverged';
+                const matching = commentsWithMarker(issue, marker);
+                if (matching.length === 0)
+                    return 'absent';
+                return matching.length === 1 && sha256(matching[0].body) === effect.bodySha256 ? 'confirmed' : 'diverged';
+            },
+            invoke: () => this.dependencies.issues.postComment(effect.issueNumber, body),
+        });
+        const delivered = settlement.status === 'confirmed';
+        const status = delivered ? 'delivered'
+            : attempt >= TERMINAL_NOTIFICATION_ATTEMPTS ? 'exhausted' : 'pending';
+        const diagnostic = delivered ? {} : { diagnostic: terminalNotificationDiagnostic('comment', settlement.status) };
+        return this.persist(active, {
+            terminalNotifications: {
+                ...notifications,
+                comment: { status, attempts: attempt, ...diagnostic },
+            },
+            pendingEffect: undefined,
+        });
+    }
+    async settleTerminalLabels(starting) {
+        let active = starting;
+        let notifications = active.record.terminalNotifications;
+        const policy = terminalLabelChanges(active.config, notifications.report.outcome);
+        if (notifications.labels.status === 'delivered') {
+            const issue = await this.readIssue(active.record.issueNumber);
+            const settled = issue && policy.add.every((label) => issue.labels.includes(label))
+                && policy.remove.every((label) => !issue.labels.includes(label));
+            if (settled)
+                return active;
+            notifications = { ...notifications, labels: { status: 'pending', attempts: 0 } };
+            active = await this.persist(active, { terminalNotifications: notifications });
+        }
+        if (notifications.labels.status !== 'pending' || notifications.labels.attempts >= TERMINAL_NOTIFICATION_ATTEMPTS)
+            return active;
+        const attempt = notifications.labels.attempts + 1;
+        if (!active.record.pendingEffect) {
+            active = await this.persist(active, { pendingEffect: {
+                    kind: 'terminal-labels', issueNumber: active.record.issueNumber, ...policy,
+                    outcome: notifications.report.outcome, attempt,
+                } });
+        }
+        const effect = active.record.pendingEffect;
+        if (effect?.kind !== 'terminal-labels' || effect.issueNumber !== active.record.issueNumber
+            || effect.outcome !== notifications.report.outcome || effect.attempt !== attempt
+            || !sameStrings(effect.add, policy.add) || !sameStrings(effect.remove, policy.remove))
+            return active;
+        const settlement = await settleLabelsEffect(effect, {
+            observe: async () => {
+                const issue = await this.readIssue(effect.issueNumber);
+                if (!issue)
+                    return 'diverged';
+                return effect.add.every((label) => issue.labels.includes(label))
+                    && effect.remove.every((label) => !issue.labels.includes(label)) ? 'confirmed' : 'absent';
+            },
+            invoke: async () => {
+                if (!this.dependencies.issues.reconcileTerminalLabels)
+                    throw new Error('terminal label reconciliation unavailable');
+                await this.dependencies.issues.reconcileTerminalLabels(effect.issueNumber, {
+                    outcome: effect.outcome, add: effect.add, remove: effect.remove,
+                });
+            },
+        });
+        const delivered = settlement.status === 'confirmed';
+        const status = delivered ? 'delivered'
+            : attempt >= TERMINAL_NOTIFICATION_ATTEMPTS ? 'exhausted' : 'pending';
+        const diagnostic = delivered ? {} : { diagnostic: terminalNotificationDiagnostic('labels', settlement.status) };
+        return this.persist(active, {
+            terminalNotifications: {
+                ...notifications,
+                labels: { status, attempts: attempt, ...diagnostic },
+            },
+            pendingEffect: undefined,
+        });
+    }
+    async persistTerminal(active, outcome, evidenceCode, additionalChanges = {}) {
+        const evidence = await this.observeOutcomeEvidenceEffect(active, evidenceCode, canonicalJson(outcome));
         active = evidence.active;
         const terminalOutcome = { ...outcome, evidencePath: evidence.path };
+        let terminalComments = active.record.issueSnapshot.comments ?? [];
+        if (outcome.status !== 'transport-failed') {
+            try {
+                terminalComments = (await this.readIssue(active.record.issueNumber))?.comments ?? terminalComments;
+            }
+            catch {
+                // Terminal notification observation is best-effort and cannot change the Run outcome.
+            }
+        }
+        const notifications = terminalNotificationState(active.record, outcome, this.timestamp(), terminalComments);
         const changes = {
             ...additionalChanges,
             lifecycle: outcome.status,
             terminalOutcome,
             outcomeEvidenceId: evidence.id,
+            ...(notifications ? { terminalNotifications: notifications } : {}),
         };
         if (outcome.status !== 'review-ready' && active.record.directReview && active.record.directReview.status !== 'terminal') {
             changes.directReview = projectTerminalDirectReview(active.record.directReview, outcome.status === 'blocked'
@@ -3099,8 +3280,13 @@ export class RunIssue {
                 : { status: outcome.status }, outcome.status === 'internal-error' ? outcome.code : undefined);
         }
         active = await this.persist(active, changes);
-        if (!retainIntent)
+        try {
             active = await this.confirmEffect(active);
+        }
+        catch {
+            return publicOutcome(terminalOutcome);
+        }
+        active = await this.settleTerminalNotificationsBestEffort(active);
         return publicOutcome(terminalOutcome);
     }
     async preClaimInternal(code, issueNumber) {
@@ -3138,6 +3324,142 @@ class PostEffectStateError extends Error {
         this.active = active;
     }
 }
+const TERMINAL_NOTIFICATION_ATTEMPTS = 3;
+function terminalNotificationState(record, outcome, observedAt, comments) {
+    if (outcome.status === 'transport-failed')
+        return undefined;
+    const commentId = issueCommentHighWaterMark(comments);
+    return {
+        version: 1,
+        commentCutoff: { commentId, observedAt },
+        report: terminalReportSnapshot(record, outcome),
+        comment: { status: 'pending', attempts: 0 },
+        labels: { status: 'pending', attempts: 0 },
+    };
+}
+function terminalReportSnapshot(record, outcome) {
+    const summary = outcome.status === 'blocked'
+        ? outcome.blocker?.summary ?? `The run stopped at ${outcome.kind}.`
+        : outcome.status === 'internal-error'
+            ? internalErrorSummary(outcome.code)
+            : outcome.status === 'cancelled'
+                ? 'The run was cancelled before completion.'
+                : record.implementationResult?.summary ?? record.proofReceipt?.summary ?? 'The authorized implementation is ready for review.';
+    const nextAction = outcome.status === 'review-ready'
+        ? 'Review the draft PR. To request an in-scope follow-up, comment on this issue.'
+        : outcome.status === 'blocked'
+            ? outcome.resumable
+                ? 'Resolve the stated blocker, then rerun the same issue.'
+                : 'Provide the missing decision or authority in this issue before continuing.'
+            : outcome.status === 'internal-error'
+                ? 'Inspect the package-owned evidence for the code above, correct the runner condition, and retry the same issue.'
+                : 'Re-add the authorization label and rerun the same issue if the work should continue.';
+    return {
+        version: 1,
+        outcome: outcome.status,
+        summary: publicTerminalText(summary, 'Terminal summary is unavailable.'),
+        ...(outcome.status === 'review-ready' ? { pullRequestUrl: outcome.pullRequestUrl } : {}),
+        passedChecks: record.checks.filter((check) => check.status === 'passed').slice(0, 16)
+            .map((check) => publicTerminalText(check.id, 'Unnamed check.', 200)),
+        publishableProof: (record.proofReceipt?.publishableEvidence ?? []).slice(0, 4).map((proof) => publicTerminalText(`${proof.ref}: ${proof.description}`, 'Publishable proof detail is unavailable.', 500)),
+        unverified: record.proofReceipt ? [] : ['No publishable Acceptance Proof receipt was retained.'],
+        risks: (record.implementationResult?.residualRisks ?? []).slice(0, 4)
+            .map((risk) => publicTerminalText(risk, 'Risk detail is unavailable.', 500)),
+        reviewFocus: (record.directReview?.review.coverage ?? []).slice(0, 8)
+            .map((focus) => publicTerminalText(focus, 'Review focus is unavailable.', 250)),
+        nextAction,
+        ...(outcome.status === 'blocked' ? { blocker: {
+                kind: outcome.kind,
+                resumable: outcome.resumable,
+                attempted: (outcome.blocker?.attempted ?? []).slice(0, 8)
+                    .map((attempt) => publicTerminalText(attempt, 'Attempt detail is unavailable.', 500)),
+            } } : {}),
+    };
+}
+function internalErrorSummary(code) {
+    return code === 'implementation-change-set-invalid'
+        ? 'The implementation report declared changed files, but the runner found no matching worktree changes.'
+        : `The runner encountered an internal failure (${code}) and could not complete this run.`;
+}
+function terminalComment(runId, cycle, report) {
+    const markerKind = report.outcome === 'review-ready' ? 'handoff' : report.outcome;
+    const marker = `<!-- codex-orchestrator:run:${runId}:cycle:${cycle}:${markerKind} -->`;
+    if (report.outcome === 'review-ready') {
+        return [
+            marker,
+            'codex-orchestrator completed this run.',
+            '',
+            '## Summary', report.summary,
+            '',
+            '## Pull request', report.pullRequestUrl ?? 'Draft PR URL is unavailable.',
+            '',
+            '## Passed checks', ...terminalList(report.passedChecks),
+            '',
+            '## Publishable proof', ...terminalList(report.publishableProof),
+            '',
+            '## Not verified', ...terminalList(report.unverified),
+            '',
+            '## Known risks', ...terminalList(report.risks),
+            '',
+            '## Review focus', ...terminalList(report.reviewFocus),
+            '',
+            '## Follow-up', report.nextAction,
+        ].join('\n');
+    }
+    const title = report.outcome === 'blocked' ? 'blocked' : report.outcome === 'internal-error' ? 'stopped after an internal error' : 'was cancelled';
+    return [
+        marker,
+        `codex-orchestrator ${title} this run.`,
+        '',
+        ...(report.blocker ? [`Kind: ${report.blocker.kind}`, `Resumable: ${report.blocker.resumable ? 'yes' : 'no'}`, ''] : []),
+        '## Reason', `Reason: ${report.summary}`,
+        ...(report.blocker ? ['', 'Attempted:', ...terminalList(report.blocker.attempted)] : []),
+        '',
+        '## Retained work and state',
+        ...terminalList([
+            ...report.passedChecks.map((check) => `Passed check: ${check}`),
+            ...report.publishableProof.map((proof) => `Proof: ${proof}`),
+        ]),
+        '',
+        '## Next action', report.nextAction,
+    ].join('\n');
+}
+function terminalList(values) {
+    return values.length > 0 ? values.map((value) => `- ${value}`) : ['- None recorded.'];
+}
+function terminalNotificationDiagnostic(kind, status) {
+    return status === 'unknown'
+        ? `terminal-${kind}-delivery-unknown`
+        : `terminal-${kind}-observation-${status}`;
+}
+function terminalLabelChanges(config, outcome) {
+    const labels = config.github.labels;
+    if (outcome === 'review-ready')
+        return {
+            add: [labels.review.name], remove: [labels.auto.name, labels.running.name, labels.blocked.name].sort(),
+        };
+    if (outcome === 'blocked')
+        return { add: [labels.blocked.name], remove: [labels.running.name, labels.review.name].sort() };
+    return {
+        add: [],
+        remove: [labels.running.name, labels.blocked.name, labels.review.name, ...(outcome === 'cancelled' ? [labels.auto.name] : [])].sort(),
+    };
+}
+function claimLabelProjectionSettled(labels, config) {
+    const policy = config.github.labels;
+    return labels.includes(policy.auto.name) && labels.includes(policy.running.name)
+        && !labels.includes(policy.blocked.name) && !labels.includes(policy.review.name);
+}
+function issueCommentHighWaterMark(comments) {
+    const ids = comments.map((comment) => comment.id).filter((id) => Boolean(id));
+    const decimal = ids.filter((id) => /^\d+$/u.test(id));
+    if (decimal.length > 0)
+        return decimal.reduce((highest, id) => BigInt(id) > BigInt(highest) ? id : highest);
+    return ids.at(-1) ?? null;
+}
+function publicTerminalText(value, fallback, maxLength = 2_000) {
+    return publicBlockedText(value, fallback, maxLength);
+}
 function lifecycleForAttempt(operationId) {
     if (operationId === 'configured-check')
         return 'checking';
@@ -3277,6 +3599,27 @@ function pendingCandidateBoundary(record) {
 function commentsWithMarker(issue, marker) {
     return issue.comments.filter((comment) => comment.body.split('\n')[0] === marker);
 }
+function managedLabelProjection(labels, config) {
+    const policy = config.github.labels;
+    const managed = new Set([policy.auto.name, policy.running.name, policy.blocked.name, policy.review.name]);
+    return labels.filter((label) => managed.has(label)).sort();
+}
+function publicBlockedText(value, fallback, maxLength) {
+    if (containsCredentialEvidence(value) || containsHostIdentityEvidence(value)
+        || /["']?token["']?\s*[:=]\s*["']?[^\s"']{8,}/iu.test(value))
+        return fallback;
+    const normalized = value.replace(/[\r\n]+/gu, ' ').trim();
+    if (normalized.length === 0)
+        return fallback;
+    return normalized.length <= maxLength
+        ? normalized
+        : `${normalized.slice(0, Math.max(0, maxLength - 12))} [truncated]`;
+}
+function publicIssueFeedbackText(value, fallback) {
+    if (/\b(?:chain[- ]of[- ]thought|reasoning artifact|local-only log|private reasoning|debug log)\b/iu.test(value))
+        return fallback;
+    return publicBlockedText(value, fallback, 4_000);
+}
 function sortedUnique(values) {
     return [...new Set(values)].sort();
 }