copilot-operator 0.1.13 → 0.1.15

package/dist/src/orchestrator/taskRunner.js

@@ -14,14 +14,14 @@ import { createHash } from 'node:crypto';
 import { readFile, mkdir, writeFile, appendFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { createTransport, isReplyTimeout } from '../transport/chatTransport.js';
-import { buildChatName, chatCode, savePointer } from '../transport/chatSession.js';
+import { buildChatName, chatCode, loadPointer, savePointer } from '../transport/chatSession.js';
 import { parseReply, formatErrorMessage, findLikelyDamage, damageGuidance } from '../protocol/parser.js';
 import { resolveDeviations, describeDeviations, mergeDisputes, describeDisputes } from '../protocol/replySchema.js';
 import { buildCoveringMessage, assertSendable } from '../protocol/reporter.js';
 import { runStep } from '../exec/runner.js';
 import { availableShells, detectShells, effectiveShell, preferredShell, refusalForChat, resolveShell, shellNote } from '../exec/shells.js';
-import { runChecks, failureMessage, failureReport, environmentProblemIn, COMMIT_CLEAN_CHECK, CONTENT_CLEAN_CHECK, RUNNER_CHECK_KINDS } from '../exec/checks.js';
-import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing } from './derivedChecks.js';
+import { runChecks, failureMessage, failureRedactions, failureReport, environmentProblemIn, COMMIT_CLEAN_CHECK, CONTENT_CLEAN_CHECK, RUNNER_CHECK_KINDS } from '../exec/checks.js';
+import { activeChecks, suspendDisputed, settleAfterReview, onlyDerivedFailing, isDerivedCheck } from './derivedChecks.js';
 import { workingDirFor, isWorkingDirProblem, workingDirNote } from '../exec/workDir.js';
 import { redactSecrets } from '../exec/redaction.js';
 import { snapshotProcesses, reapLeftovers, describeLeftovers, ProcessTracker } from '../exec/processes.js';
@@ -30,10 +30,11 @@ import { describeCrash } from '../transport/edgeCrash.js';
 import { runReview, findingsMessage, deliverableFor } from './review.js';
 import { allAboutTheTask, isRepeat, findingId } from '../protocol/reviewSchema.js';
 import { repoState, workingTreePaths } from '../vcs/git.js';
-import { describeStep, checkCommandRefusal } from '../exec/policy.js';
+import { describeStep, checkCommandRefusal, commandRefusal } from '../exec/policy.js';
+import { networkFetchReason } from '../exec/network.js';
 import { collectPolicyManifest, describePolicyManifest } from '../exec/policyManifest.js';
 import { assessIsolation, readIsolationSignals } from '../exec/isolation.js';
-import { projectRoots } from '../exec/confinement.js';
+import { confinementRefusal, projectRoots } from '../exec/confinement.js';
 import { writeReport } from '../exec/reportFile.js';
 import { Pacer } from '../util/pacing.js';
 import { RunLog } from '../log/runLog.js';
@@ -44,9 +45,7 @@ import { composeHandoff } from '../session/handoff.js';
 import { ProgressWatch } from './progress.js';
 import { contractConflicts, readsTreeClean } from './contract.js';
 import { treeFingerprint } from '../vcs/git.js';
-import { mirrorProject, describeMirror, MirrorSelectionError } from '../context/projectMirror.js';
-import { keptOnDesktop, mirrorSourceRoot, projectNameFor, projectTargetDir, removeLegacyFlatMirror } from '../context/desktopMirror.js';
-import { prepareForTask, commitTaskResult, repoDirOf } from '../vcs/taskVcs.js';
+import { prepareForTask, commitTaskResult, repoDirOf, trackedRepoOf } from '../vcs/taskVcs.js';
 import { exportMachine, writeAttemptRecord } from '../session/exports.js';
 /** Why a task that was reported as done is being closed as failed. */
 function checksFailedReason(outcomes) {
@@ -57,6 +56,25 @@ function checksFailedReason(outcomes) {
             .map((o) => `${o.check.name} (${o.detail})`)
             .join('; ')}`;
 }
+/** A package runner (`npx` and its kin): it fetches the tool it names unless the project has it installed. */
+const PACKAGE_RUNNER = /\b(?:npx|pnpx|bunx)(?:\.cmd|\.exe)?\s|\b(?:pnpm|yarn)(?:\.cmd)?\s+dlx\s|\bnpm(?:\.cmd)?\s+exec\s/i;
+/**
+ * Why a check's command line is refused for itself, or null when the gate refuses it, if at all,
+ * only for what the project's files hold now.
+ *
+ * `checkCommandRefusal` is the gate; this is the part of it that nothing in the tree decides — the
+ * command's own words, the settings, the folders it reaches. The other two parts read the files,
+ * and the work can change both: the scripts the command runs, refused while missing or while they
+ * hold a line the gate refuses (see `scriptFiles.ts`), and a package runner, held only while its
+ * tool is not installed in the project (see `network.ts`). A command with a package runner in it is
+ * left to them whatever else it fetches: ending a task on a check the work could still have made
+ * run is the worse mistake of the two.
+ */
+function lineRefusal(command, shell, cwd, cfg, roots) {
+    return (commandRefusal(command, shell, cfg.denyPatterns, cfg.allowedPrograms) ??
+        confinementRefusal(command, { roots, cwd }) ??
+        (PACKAGE_RUNNER.test(command) ? null : networkFetchReason(command, cwd)));
+}
 /**
  * Why a task ended because of the machine rather than because of the work.
  *
@@ -100,6 +118,20 @@ export function earlierTasksForReview(session, task, limit = 3, maxChars = 2500)
         .slice(-limit)
         .map((t) => ({ title: t.title, prompt: t.prompt.length > maxChars ? `${t.prompt.slice(0, maxChars)}\n[… ${t.prompt.length - maxChars} more characters]` : t.prompt }));
 }
+/**
+ * Parts of a reason joined as the sentences they are: every part that another follows ends with a
+ * full stop unless it already ends as a sentence does, and an empty part is left out.
+ *
+ * A reason is mostly written as a clause — "stopped by the operator before the review" — so that it
+ * reads inside other sentences too, and one followed by the next with only a space between them ran
+ * into it: "… before the review After that, the runner committed …". A part that already ends with
+ * its own full stop is not given a second one, and the last part is left as it was written, so a
+ * reason of one clause reads as it always has.
+ */
+function sentences(...parts) {
+    const kept = parts.map((p) => (p ?? '').trim()).filter(Boolean);
+    return kept.map((p, i) => (i === kept.length - 1 || /[.!?…]["'”’)\]]*$/.test(p) ? p : `${p}.`)).join(' ');
+}
 /**
  * The reason line for a task the model gave up on, built from what it says it tried.
  *
@@ -137,6 +169,29 @@ function refusedResult(step, reason, by = 'runner') {
         lastOutputAgoMs: 0,
     };
 }
+/**
+ * The same chat, refusing to send once the run has been stopped.
+ *
+ * Handed to the review, whose own loop looks at the signal at the top of each round and after a
+ * step it ran. Every other message it sends — a format repair, a refused "pass", a turned-down
+ * check — goes out before it looks again, and a Stop pressed while the reviewer was answering would
+ * have one more sent and its answer waited for, a Stop that took as long as a reply. Refused here,
+ * the review ends at the send, and the runner, seeing the Stop, ends the task `aborted` (see
+ * `gateOnReview`). Everything else is the chat itself, unchanged.
+ */
+function sendsUntilStopped(transport, signal) {
+    if (!signal)
+        return transport;
+    return new Proxy(transport, {
+        get(target, key) {
+            if (key === 'sendAndConfirm') {
+                return (...args) => signal.aborted ? Promise.reject(new Error('the run was stopped; nothing more is sent')) : target.sendAndConfirm(...args);
+            }
+            const value = Reflect.get(target, key, target);
+            return typeof value === 'function' ? value.bind(target) : value;
+        },
+    });
+}
 /** One place that writes to the transcript, the console and the live stream at once. */
 class Sink {
     log;
@@ -197,8 +252,22 @@ export async function openBrowser(cfg, bus, transportDir, sessionId) {
             });
         },
     });
-    await transport.open();
-    await transport.ensureSignedIn();
+    /*
+     * A window that opened and then failed to reach the chat — sign-in not done in time, a
+     * verification challenge not cleared, the consumer Copilot — is closed here, since nobody else
+     * holds it: the caller has no transport yet, so its own `finally` closes nothing. Left open, the
+     * run ended and gave up its claim on the browser with Edge still on the profile, and the next start
+     * or read of the models, the one the error asks for, was refused as "Edge is already running with
+     * this profile" until the window was closed by hand.
+     */
+    try {
+        await transport.open();
+        await transport.ensureSignedIn();
+    }
+    catch (e) {
+        await transport.close().catch(() => undefined);
+        throw e;
+    }
     return transport;
 }
 /**
@@ -225,6 +294,80 @@ export async function enterSessionConversation(transport, session, opts) {
         await transport.newChat();
     }
 }
+/**
+ * Whether an attempt's task reached a conversation, and which, as its run folder records it.
+ *
+ * `chat.json` is written the moment the message that carries the task has gone into a conversation
+ * (see `runTask`), and never before: not when the attempt starts, and not when a new conversation
+ * answers the contract, which is a message earlier. The transcript answers for an attempt that has
+ * no `chat.json`. It records every opening message as it is sent (`message-sent`), and since
+ * 2026-10-01 how many the opening had and whether this one carried the task. So an attempt that sent
+ * nothing at all never delivered its task, whenever it ran; one that sent the second message of an
+ * opening delivered it, since the task is always the last and an opening has two at most. Only an
+ * older attempt that sent one message without saying more cannot be told: one message is a whole
+ * opening into a conversation that had the contract, or the contract alone, stopped before the task.
+ */
+async function deliveryOf(runDir) {
+    const pointer = await loadPointer(join(runDir, 'chat.json'));
+    if (pointer)
+        return { sent: true, pointer };
+    const raw = await readFile(join(runDir, 'transcript.jsonl'), 'utf8').catch(() => null);
+    if (raw === null)
+        return { sent: 'unknown' };
+    const sent = [];
+    for (const line of raw.split('\n')) {
+        if (!line.includes('"message-sent"'))
+            continue;
+        try {
+            const e = JSON.parse(line);
+            if (e.type === 'message-sent')
+                sent.push(e);
+        }
+        catch {
+            // A line cut in half by a crash: the lines around it still answer.
+        }
+    }
+    if (sent.length === 0)
+        return { sent: false };
+    if (sent.some((e) => e.task === true || (typeof e.of !== 'number' && Number(e.index) >= 1)))
+        return { sent: true, pointer: null };
+    return sent.every((e) => typeof e.of === 'number') ? { sent: false } : { sent: 'unknown' };
+}
+/**
+ * Where the assignment a "Continue" carries on is, against the conversation the session is in now.
+ *
+ * `here` — in the session's conversation, or nothing on record says otherwise; `elsewhere` — in
+ * another one, with its pointer when the attempt kept one; `nowhere` — no conversation was ever given
+ * it, because the attempt was stopped before its task was sent (see `deliveryOf`), and so was every
+ * attempt it continued. Then the assignment started with the first of those, and `buildsOn` is what
+ * that one was told about the work before it.
+ *
+ * The newest attempt that delivered its task is the one whose conversation has the assignment and
+ * the latest work on it; an undelivered continuation added nothing to any chat, so the one it
+ * continued is asked instead. An attempt whose record cannot say is answered from the session's own
+ * pointer, as far as that goes: a conversation registered by another attempt after this one started
+ * cannot hold it. That is what a later task's retry in a fresh conversation leaves behind (see
+ * `runSession`), the one thing that moves a session.
+ */
+async function conversationOfAttempt(runsDir, attempts, current) {
+    const fromThePointer = (a) => current && current.runId !== a.runId && !!a.startedAt && Date.parse(current.createdAt) > Date.parse(a.startedAt)
+        ? { where: 'elsewhere', pointer: null }
+        : { where: 'here' };
+    for (let i = attempts.length - 1; i >= 0; i -= 1) {
+        const a = attempts[i];
+        const delivered = a.runId ? await deliveryOf(join(runsDir, a.runId)) : { sent: 'unknown' };
+        if (delivered.sent === true) {
+            if (!delivered.pointer)
+                return fromThePointer(a);
+            return current?.chatId === delivered.pointer.chatId ? { where: 'here' } : { where: 'elsewhere', pointer: delivered.pointer };
+        }
+        if (delivered.sent === 'unknown')
+            return fromThePointer(a);
+        if (!a.continuing)
+            return { where: 'nowhere', buildsOn: a.buildsOn };
+    }
+    return { where: 'here' };
+}
 /**
  * Joins the conversation of another session in the same group, when there is one.
  *
@@ -469,23 +612,42 @@ export async function runTask(transport, session, task, deps) {
          * The checks about a clean tree, now that the runner has committed. A done task whose tree is
          * still not clean after the commit has failed; any other ending keeps its own reason, and the
          * results are recorded all the same.
+         *
+         * Not once the operator has stopped the run, for the reason a stopped round at the gate records
+         * nothing: these checks cannot run then, and one cut short or never started reads as failed ("the
+         * operator stopped the run before this check ran"). Such rows were recorded as the task's results
+         * and named as failures in its handoff, and a done task was failed on them. A Stop is no verdict
+         * on the work, whether it came before these checks or while they ran: they decide nothing, and a
+         * task that was done but whose tree was never judged ends `aborted`, as every Stop ends a task,
+         * which "Continue" carries on to be judged.
          */
         let afterCommitResults = [];
         if (afterCommitChecks.length > 0 && runAfterCommit) {
-            const outcomes = await runAfterCommit(afterCommitChecks).catch((e) => {
-                sink.event('checks-after-commit-error', { error: String(e) }, `the checks after the commit could not run: ${e.message}`, 'warn');
-                return [];
-            });
-            afterCommitResults = outcomes.map((o) => ({ name: `${o.check.name} (after the commit)`, passed: o.passed, detail: o.detail }));
-            for (const o of outcomes) {
-                sink.event(o.passed ? 'check-passed' : 'check-failed', { name: o.check.name, detail: o.detail, afterCommit: true }, `${o.passed ? 'passed' : 'FAILED'} after the commit: ${o.check.name} — ${o.detail}`, o.passed ? 'info' : 'warn');
+            const outcomes = signal?.aborted
+                ? []
+                : await runAfterCommit(afterCommitChecks).catch((e) => {
+                    sink.event('checks-after-commit-error', { error: String(e) }, `the checks after the commit could not run: ${e.message}`, 'warn');
+                    return [];
+                });
+            if (signal?.aborted) {
+                sink.event('checks-after-commit-stopped', { checks: afterCommitChecks.map((c) => c.name) }, `the operator stopped the run, so the check(s) after the commit decide nothing: ${afterCommitChecks.map((c) => c.name).join(', ')}`, 'warn');
+                if (status === 'done') {
+                    status = 'aborted';
+                    reason = 'stopped by the operator before the checks after the commit had decided';
+                }
             }
-            const failedAfter = outcomes.filter((o) => !o.passed);
-            if (status === 'done' && failedAfter.length > 0) {
-                status = 'failed';
-                reason =
-                    `after the runner's commit${vcsAfter?.commit ? ` (${vcsAfter.commit.slice(0, 8)})` : ''}${vcsAfter?.problem ? `, which did not happen: ${vcsAfter.problem}` : ''}, ` +
-                        `${failedAfter.length} check(s) about the working tree still failed: ${failedAfter.map((o) => `${o.check.name} (${o.detail})`).join('; ')}`;
+            else {
+                afterCommitResults = outcomes.map((o) => ({ name: `${o.check.name} (after the commit)`, passed: o.passed, detail: o.detail }));
+                for (const o of outcomes) {
+                    sink.event(o.passed ? 'check-passed' : 'check-failed', { name: o.check.name, detail: o.detail, afterCommit: true }, `${o.passed ? 'passed' : 'FAILED'} after the commit: ${o.check.name} — ${o.detail}`, o.passed ? 'info' : 'warn');
+                }
+                const failedAfter = outcomes.filter((o) => !o.passed);
+                if (status === 'done' && failedAfter.length > 0) {
+                    status = 'failed';
+                    reason =
+                        `after the runner's commit${vcsAfter?.commit ? ` (${vcsAfter.commit.slice(0, 8)})` : ''}${vcsAfter?.problem ? `, which did not happen: ${vcsAfter.problem}` : ''}, ` +
+                            `${failedAfter.length} check(s) about the working tree still failed: ${failedAfter.map((o) => `${o.check.name} (${o.detail})`).join('; ')}`;
+                }
             }
         }
         /*
@@ -494,10 +656,8 @@ export async function runTask(transport, session, task, deps) {
          * tree is dirty" is not left standing beside a commit on the record.
          */
         if (status !== 'done' && vcsAfter?.commit && vcsAfter.commit !== task.vcs?.commit) {
-            reason =
-                `${reason ?? ''} After that, the runner committed the task's changes as ${vcsAfter.commit.slice(0, 8)} on ${vcsAfter.branch}` +
-                    `${vcsAfter.afterCommit ? (vcsAfter.afterCommit.clean ? '; the working tree is clean' : `; still uncommitted: ${vcsAfter.afterCommit.changed.slice(0, 8).join(', ')}`) : ''}.`;
-            reason = reason.trim();
+            reason = sentences(reason, `After that, the runner committed the task's changes as ${vcsAfter.commit.slice(0, 8)} on ${vcsAfter.branch}` +
+                `${vcsAfter.afterCommit ? (vcsAfter.afterCommit.clean ? '; the working tree is clean' : `; still uncommitted: ${vcsAfter.afterCommit.changed.slice(0, 8).join(', ')}`) : ''}.`);
         }
         if (vcsAfter?.branch) {
             await record('VERSION CONTROL', [
@@ -548,8 +708,6 @@ export async function runTask(transport, session, task, deps) {
         await setTask((t) => {
             t.handoff = composeHandoff(t, notRun);
         });
-        // Its last changes, checks and commit included, go to the Desktop copies too.
-        deps.onWorkChanged?.();
         sink.event('task-finished', { status, reason, iterations }, `task "${task.title}" ${status}${reason ? `: ${reason}` : ''}`);
         await log.close();
         /*
@@ -717,67 +875,59 @@ export async function runTask(transport, session, task, deps) {
             sink.event('contract-conflict', { conflicts }, `the task contradicts itself: ${conflicts.join(' | ')}`, 'error');
             return await finish('blocked', `the task contradicts itself, so it was not started: ${conflicts.join(' ')} Change the prompt, the checks, the scope or read-only, and queue it again.`);
         }
-        // --- project mirror, attached to the first message of the task ---------------------
-        let mirrorFiles = [];
-        if (session.mirror.enabled && session.mirror.rootDir) {
-            // One folder per project, and the project's name in front of every file name, so three
-            // repositories mirrored in turn do not delete each other's copies or collide in the chat.
-            // The bot's own Desktop copy named as the root means the project it is a copy of. See `mirrorSourceRoot`.
-            const source = mirrorSourceRoot(cfg, session.mirror.rootDir);
-            if ('problem' in source) {
-                sink.event('mirror-refused', { error: source.problem }, source.problem, 'error');
-                return await finish('failed', `${source.problem} Nothing was sent to the chat.`);
-            }
-            if (source.fromCopy) {
-                sink.event('mirror-source', { asked: source.fromCopy, used: source.rootDir }, `the root of the files to attach is the bot's Desktop copy ${source.fromCopy}; they are copied from the project itself, ${source.rootDir}`, 'warn');
-            }
-            const sourceRoot = source.rootDir;
-            const projectName = projectNameFor(sourceRoot, cfg);
-            // A project kept on the Desktop has its folder there looked after by the Desktop mirror; the
-            // attachments are copied into this attempt's own folder instead. See `keptOnDesktop`.
-            const onDesktop = keptOnDesktop(cfg, sourceRoot);
-            const targetDir = onDesktop ? log.path('attachments') : projectTargetDir(cfg, projectName);
-            await removeLegacyFlatMirror(cfg).catch(() => undefined);
-            /*
-             * A selection that cannot be copied stops the task before anything is sent: the chat would
-             * otherwise work without the files it was promised. The copies already there are kept.
-             */
-            const result = await mirrorProject({
-                rootDir: sourceRoot,
-                // `rules-engine` in a plan usually means the repository's folder, wherever the root is.
-                alsoUnder: [repoDirOf(session)],
-                includeDirs: session.mirror.includeDirs.length ? session.mirror.includeDirs : ['.'],
-                excludeDirs: session.mirror.excludeDirs,
-                targetDir,
-                namePrefix: projectName,
-                separator: cfg.projectMirror.separator,
-                txtMode: cfg.projectMirror.txtMode,
-                // The session's own switches win: they are what the operator ticked for this project.
-                // Settings only supply the fallback for a session saved before they existed.
-                respectGitignore: session.mirror.respectGitignore ?? cfg.projectMirror.respectGitignore,
-                ignoreDirs: cfg.projectMirror.ignoreDirs,
-                includeEnvFiles: session.mirror.includeEnvFiles ?? cfg.projectMirror.includeEnvFiles,
-                maxFileBytes: cfg.projectMirror.maxFileBytes,
-            }).catch((e) => (e instanceof MirrorSelectionError ? e : Promise.reject(e)));
-            if (result instanceof MirrorSelectionError) {
-                sink.event('mirror-refused', { error: result.message }, result.message, 'error');
-                return await finish('failed', `${result.message} Nothing was sent to the chat. Fix the files to attach and queue the task again.`);
+        /*
+         * "Continue" carries a task on in the conversation that has it, which is the session's own
+         * unless the session has moved since — a later task's retry in a fresh conversation moves it.
+         * Then "carry on; the assignment is the one you were given above", sent where the session is
+         * now, landed in a conversation that had never seen the task. So the attempt's own conversation
+         * is opened again and the session goes back to it, the later queued tasks with it; where that
+         * cannot be done, a fresh one is opened and the task goes out in full, with the contract,
+         * saying that it continues an earlier attempt (see `composeOpening`).
+         *
+         * An attempt stopped before its task was sent gave it to no conversation at all, so "carry on"
+         * has nothing to point at anywhere: the task goes out in full where the session is, as it would
+         * have the first time, since no chat has done any of it. See `conversationOfAttempt`.
+         */
+        /** What the opening says about the attempts before this one; see `composeOpening`. */
+        let continuing = task.continuing;
+        let buildsOn = task.buildsOn;
+        if (task.continuing) {
+            const found = await conversationOfAttempt(cfg.resolved.runsDir, task.attempts ?? [], session.chat);
+            if (found.where === 'nowhere') {
+                continuing = undefined;
+                buildsOn = found.buildsOn;
+                sink.event('continue-never-sent', { fromAttempt: task.continuing.fromAttempt }, 'the attempt this continues was stopped before its task reached any conversation, so the task goes out in full');
             }
-            sink.event('mirror', { targetDir, onDesktop, ...result }, `project mirror${onDesktop ? ' (attachments, in the run folder: the Desktop copy is kept by the Desktop mirror)' : ''}: ${describeMirror(result)}`);
-            if (session.mirror.includeEnvFiles) {
-                const envCount = Object.keys(result.mapping).filter((p) => /(^|\/)\.env(\.|$)/i.test(p)).length;
-                if (envCount > 0) {
-                    sink.event('mirror-env', { envCount }, `${envCount} .env file(s) are being attached, as configured`, 'warn');
+            if (found.where === 'elsewhere') {
+                const own = found.pointer;
+                // By its id only. Every conversation of a session carries the session's name, the fresh
+                // ones a retry opens included, so the name would find one of those just as readily.
+                const back = !!own && (await transport.openConversation(own.chatId).catch(() => false));
+                if (!back)
+                    await transport.newChat();
+                const chat = back && own ? own : undefined;
+                session.chat = chat;
+                session.contractSent = !!chat;
+                await store.updateSession(session.id, (s) => {
+                    s.chat = chat;
+                    s.contractSent = !!chat;
+                });
+                sink.event(back ? 'chat-returned' : 'chat-fresh-for-continue', { chatId: chat?.chatId ?? null, from: own?.chatId ?? null }, back
+                    ? `continuing in the task's own conversation "${own?.name}", where it was stopped; the session carries on there`
+                    : `the conversation this task was stopped in is not the session's any more and ${own ? 'could not be opened again' : 'is not on record'}, so it continues in a fresh one, sent in full`, back ? 'info' : 'warn');
+                /*
+                 * The picker belongs to the conversation, and the run applied the session's model to the one
+                 * it started in, not to this one: a fresh conversation opens on the chat's default, and the
+                 * record would go on naming the model the session asked for. Applied again here, as the
+                 * fresh-chat retry in `runSession` does for the same reason.
+                 */
+                const modelNow = await applySessionModel(transport, session, bus, cfg);
+                if (effectiveModels(session, cfg).model) {
+                    await store.updateSession(session.id, (s) => {
+                        s.modelInUse = modelNow;
+                    });
                 }
             }
-            for (const s of result.skipped.slice(0, 20)) {
-                sink.event('mirror-skipped', { ...s }, `not copied: ${s.relPath} (${s.reason})`);
-            }
-            const all = Object.values(result.mapping).sort();
-            mirrorFiles = all.slice(0, cfg.projectMirror.maxAttachedFiles).map((n) => join(targetDir, n));
-            if (all.length > mirrorFiles.length) {
-                sink.event('mirror-truncated', { total: all.length, attached: mirrorFiles.length }, `only the first ${mirrorFiles.length} of ${all.length} mirrored files will be attached`, 'warn');
-            }
         }
         // --- opening messages -------------------------------------------------------------
         const { content: level1 } = await store.getLevel1();
@@ -788,9 +938,11 @@ export async function runTask(transport, session, task, deps) {
             prompt: task.prompt,
             taskTitle: task.title,
             taskNumber,
-            contractAlreadySent: session.contractSent,
-            continuing: task.continuing,
-            buildsOn: task.buildsOn,
+            // Said of the session's conversation, so with none on record nothing has had it: this run
+            // entered a fresh one (see `enterSessionConversation`), whatever an older record says.
+            contractAlreadySent: session.contractSent && !!session.chat,
+            continuing,
+            buildsOn,
             workDirNote: workingDirNote(work),
             vcsNote: prepared.note,
             readOnlyNote: task.readOnly ? READ_ONLY_NOTE : undefined,
@@ -806,14 +958,27 @@ export async function runTask(transport, session, task, deps) {
         });
         await record('OPENING MESSAGE', opening.firstMessage);
         let lastMarkdown = '';
+        // The task is always in the last message of the opening; a first one before it is the contract.
+        const taskIndex = opening.messages.length - 1;
+        /** Whether this opening's contract has been answered, to be recorded once the conversation is. */
+        let contractAnswered = false;
         for (const [index, message] of opening.messages.entries()) {
             if (signal?.aborted)
                 return await finish('aborted', 'stopped before the task was sent');
-            const isFirstOfTask = index === 0;
-            const attach = isFirstOfTask && mirrorFiles.length ? mirrorFiles : [];
             await pacer.throttleSend();
-            const before = await transport.sendAndConfirm(message, attach);
-            sink.event('message-sent', { index, chars: message.length, attached: attach.length }, `message ${index + 1}/${opening.messages.length} sent`);
+            const before = await transport.sendAndConfirm(message);
+            const carriesTask = index === taskIndex;
+            sink.event('message-sent', { index, of: opening.messages.length, task: carriesTask, chatId: session.chat?.chatId ?? null, chars: message.length }, `message ${index + 1}/${opening.messages.length} sent`);
+            /*
+             * Where this attempt's task is, kept in its run folder once the message carrying it is in a
+             * conversation, and not before: what "Continue" goes back to (see `conversationOfAttempt`). It
+             * was kept as soon as the attempt entered a conversation, so an attempt stopped before its task
+             * went out — or after a new conversation had answered only the contract — left a record saying
+             * the task was there, and "Continue" told that chat to carry on with an assignment it never had.
+             * A new conversation is known only once it answers, and is kept where it is registered, below.
+             */
+            if (carriesTask && session.chat)
+                await savePointer(log.path('chat.json'), session.chat);
             const reply = await transport.waitForReply(before);
             lastMarkdown = reply.markdown;
             await saveReply(`opening-${index + 1}`, reply);
@@ -835,16 +1000,31 @@ export async function runTask(transport, session, task, deps) {
                     await store.updateSession(session.id, (s) => {
                         s.chat = chat;
                     });
-                    await savePointer(log.path('chat.json'), chat);
+                    if (carriesTask)
+                        await savePointer(log.path('chat.json'), chat);
                     sink.event('chat-registered', { ...chat }, `chat: ${name}`);
                 }
             }
-        }
-        if (!session.contractSent) {
-            session.contractSent = true;
-            await store.updateSession(session.id, (s) => {
-                s.contractSent = true;
-            });
+            /*
+             * The contract is in the conversation once its message has been answered, whether or not the
+             * task follows. Recorded only after the whole opening, a Stop between the two left a
+             * conversation that had the contract on record as one that had not, and the next task sent it
+             * a second time.
+             *
+             * And recorded once that conversation is on record itself, which may be a message later: its
+             * id is read from the page's address, which may not have changed yet when the contract is
+             * answered (the registration above tries again after the task). Recorded before, a Stop in
+             * between left a session with no conversation that said it had the contract, and the next
+             * task opened a fresh one and sent it only the reminder that the contract "still applies".
+             */
+            if (index < taskIndex)
+                contractAnswered = true;
+            if (contractAnswered && session.chat && !session.contractSent) {
+                session.contractSent = true;
+                await store.updateSession(session.id, (s) => {
+                    s.contractSent = true;
+                });
+            }
         }
         // --- the loop ---------------------------------------------------------------------
         // How many times the checks have been run for this task, and how many times they may be.
@@ -862,7 +1042,7 @@ export async function runTask(transport, session, task, deps) {
          * files are committed and marked, because refusing would leave the tree dirty and the next
          * task refusing to start over it.
          */
-        const willCommit = !!(session.vcs?.enabled && session.vcs.commitOnFinish && repoDirOf(session));
+        const willCommit = !!(session.vcs?.commitOnFinish && trackedRepoOf(session));
         /** The runner's own checks that have been pointed out to the chat once already. */
         const pointedOut = new Set();
         /**
@@ -870,9 +1050,11 @@ export async function runTask(transport, session, task, deps) {
          *
          * Returns `accept` when there is nothing to check or everything passed, `retry` when the
          * failures have been sent back for Copilot to fix, `give-up` when it has had its rounds,
-         * and `environment` when the machine could not run the checks at all. The checks run here,
-         * at the end, and not as steps: they are not work, they are the question of whether the work
-         * happened, and a task cannot be trusted to answer that about itself.
+         * `environment` when the machine could not run the checks at all, `invalid` when every
+         * failing check was refused for good (see `refusedForGood`), and `stopped` when the operator
+         * stopped the run while they ran. The checks run here, at the end, and not as steps: they are
+         * not work, they are the question of whether the work happened, and a task cannot be trusted
+         * to answer that about itself.
          */
         const gateOnChecks = async () => {
             const every = [...(task.checks ?? []), ...activeChecks(reviewChecks)];
@@ -889,6 +1071,8 @@ export async function runTask(transport, session, task, deps) {
             // a missing interpreter asked nothing of the work and must not cost the task one.
             const round = checkRounds + 1;
             sink.event('checks-started', { round, count: checks.length }, `checking the task against ${checks.length} condition(s)`);
+            /** The commands this round refused only for what the project's files hold now; see `lineRefusal`. */
+            const refusedForTheFiles = new Set();
             const checkOptions = {
                 cwd: work.cwd,
                 tracker,
@@ -900,16 +1084,61 @@ export async function runTask(transport, session, task, deps) {
                  * reviewer's — is refused rather than held: there is no approval screen here. Requests to
                  * this machine are not downloads and still run. See `network.ts`.
                  */
-                deny: (command, shell, cwd) => checkCommandRefusal(command, shell, cfg.execution, { roots: confinement.roots, cwd }),
+                deny: (command, shell, cwd) => {
+                    const refused = checkCommandRefusal(command, shell, cfg.execution, { roots: confinement.roots, cwd });
+                    if (refused && !lineRefusal(command, shell, cwd, cfg.execution, confinement.roots))
+                        refusedForTheFiles.add(command);
+                    return refused;
+                },
                 roots: confinement.roots,
                 repoDir: willCommit ? repoDirOf(session) : undefined,
                 baseCommit: prepared.vcs.baseCommit,
                 // The same shell a step that named none is given, so the gate and the work it judges
                 // cannot have been read by different interpreters.
                 defaultShell,
+                // What a check says is quoted to the chat — here, and in a reviewer's brief — so the
+                // operator's own patterns are applied where it is said, with the built-in shapes.
+                redactPatterns: cfg.report.redactPatterns,
             };
             runAfterCommit = (cs) => runChecks(cs, checkOptions);
-            const outcomes = (lastOutcomes = await runChecks(checks, checkOptions));
+            const ran = await runChecks(checks, checkOptions);
+            /*
+             * The operator stopped the run, which is not a verdict on the work. The check in flight was
+             * killed and the ones after it never ran, so what this round "found" is only the Stop: it is
+             * not recorded as the task's results, not counted as a rejected "done", and the task ends
+             * `aborted` — continuable, like every other Stop. It used to be read as a failed round and
+             * end the task `failed`, which "Continue" does not offer.
+             */
+            if (deps.signal?.aborted) {
+                sink.event('checks-stopped', { round }, 'the operator stopped the run while the checks ran; this round decides nothing', 'warn');
+                return 'stopped';
+            }
+            /** Refused before it ran for its own command line, which nothing in the tree decides; see `lineRefusal`. */
+            const refusedForGood = (o) => !!o.refusedBeforeRunning && !refusedForTheFiles.has((o.check.run ?? '').trim());
+            /*
+             * A reviewer's check the runner now refuses for its own line: dropped, and the round judged on
+             * the others. The review keeps no check the runner refuses (see `validateDerivedChecks`), but
+             * one it kept can be refused later — a deny pattern added in Settings, the allowlist narrowed,
+             * the project folders changed — and it then outlives every attempt, Continue and a rerun
+             * included. Read as a check of the task's that can never run, it ended each of them at the
+             * first "done" as `invalid-check`, with no way out; before that it was sent back as work to
+             * fix. The finding stands without it, as at the review, and the next reviewer judges the work.
+             */
+            const unrunnable = ran.filter((o) => isDerivedCheck(o.check) && refusedForGood(o));
+            if (unrunnable.length > 0) {
+                const why = new Map(unrunnable.map((o) => [o.check.name, o.detail]));
+                reviewChecks = reviewChecks.map((rc) => rc.state === 'active' && why.has(rc.check.name)
+                    ? { ...rc, state: 'dropped', droppedBecause: `the runner refuses it now, before it runs: ${why.get(rc.check.name)}` }
+                    : rc);
+                await setTask((t) => {
+                    t.reviewChecks = reviewChecks;
+                });
+                for (const o of unrunnable) {
+                    sink.event('review-check-blocked', { round, name: o.check.name, detail: o.detail }, `the check "${o.check.name}" is refused by the runner now and never ran; dropped, the finding stands without it — ${o.detail}`, 'warn');
+                }
+            }
+            const outcomes = ran.filter((o) => !unrunnable.includes(o));
+            lastOutcomes = outcomes;
             /*
              * The runner's own checks are advice given once, not a gate: a second "done" with the finding
              * still there is committed and the finding stays on the task. Refusing instead would leave the
@@ -946,18 +1175,37 @@ export async function runTask(transport, session, task, deps) {
                 sink.event('checks-environment', { round, requested: problem.requested, available: problem.available, checks: outcomes.filter((o) => o.environmentProblem).map((o) => o.check.name) }, problem.message, 'error');
                 return 'environment';
             }
+            /*
+             * The checks, not the work — the same reasoning as the machine above.
+             *
+             * Every check still failing was refused before it ran, for its own command line, the
+             * settings, or a folder or file outside the project: nothing the chat does can make it run.
+             * These are the plan's checks and the runner's own; a reviewer's is dropped instead (above).
+             * Sending it back as "the task is not finished yet" spent the rounds on it, and with version
+             * control on the second "done" with an unchanged tree ended the task `blocked` as no progress,
+             * to be retried in fresh conversations that could not fix it either. So nothing is sent, the
+             * round is not counted, and the task ends `failed` with `invalid-check`. A check refused only
+             * for what a script it runs holds, or for a tool not installed yet, still goes back: those the
+             * work can change (see `lineRefusal`).
+             */
+            const failed = outcomes.filter((o) => !o.passed);
+            if (failed.length > 0 && failed.every(refusedForGood)) {
+                stopCode = 'invalid-check';
+                for (const o of failed) {
+                    sink.event('check-failed', { name: o.check.name, detail: o.detail }, `FAILED: ${o.check.name} — ${o.detail}`, 'warn');
+                }
+                sink.event('checks-invalid', { round, checks: failed.map((o) => o.check.name) }, `${failed.length} check(s) were refused before they ran, and nothing the chat does can change that; the task ends on the checks, not on the work`, 'error');
+                return 'invalid';
+            }
             checkRounds = round;
             for (const o of outcomes) {
                 sink.event(o.passed ? 'check-passed' : 'check-failed', { name: o.check.name, detail: o.detail }, `${o.passed ? 'passed' : 'FAILED'}: ${o.check.name} — ${o.detail}`, o.passed ? 'info' : 'warn');
             }
-            const failed = outcomes.filter((o) => !o.passed);
             if (failed.length === 0) {
                 sink.event('checks-passed', { count: outcomes.length }, `all ${outcomes.length} check(s) passed`);
                 return 'accept';
             }
             stats.doneRejected += 1;
-            if (deps.signal?.aborted)
-                return 'give-up';
             // The same failures as last time, and not a file changed since they were reported.
             const stuck = progress.afterFailedChecks(await treeNow(), failed.map((o) => ({ name: o.check.name, detail: o.detail })));
             if (stuck) {
@@ -987,15 +1235,28 @@ export async function runTask(transport, session, task, deps) {
                 sink.event('checks-exhausted', { rounds: checkRounds - 1 }, `${failed.length} check(s) still failing after ${maxCheckRounds} attempt(s); the task is closed as failed`, 'warn');
                 return 'give-up';
             }
+            // A Stop that came after every check had run: the round stands, and nothing more is sent.
+            if (deps.signal?.aborted)
+                return 'stopped';
             // The failures go back exactly the way step output does: a message with a file attached,
             // because a compiler's opinion belongs in a file and not in a chat bubble.
             const path = join(reportsDir, `checks-${checkRounds}.txt`);
-            // Check output is uploaded too, so it is redacted the same way a step report is.
-            const checkReport = redactSecrets(failureReport(outcomes), cfg.report.redactPatterns);
+            /*
+             * Check output is uploaded too, so it is redacted the same way a step report is — the file and
+             * the message beside it alike, with the operator's patterns on top of the built-in shapes. The
+             * message quotes each failing check's command and value, and it used to get the shapes only,
+             * so a key in a company's own format went to the chat in it while the file beside it hid it.
+             */
+            const checkReport = failureReport(outcomes, cfg.report.redactPatterns);
             await writeFile(path, checkReport, 'utf8');
             await record(`CHECKS ${checkRounds}`, checkReport);
-            const message = failureMessage(outcomes, checkRounds, maxCheckRounds);
+            const message = failureMessage(outcomes, checkRounds, maxCheckRounds, cfg.report.redactPatterns);
             await record(`CHECKS ${checkRounds} MESSAGE SENT`, message);
+            // Said as a step report's redaction is, so a checks round that hid something is not silent.
+            const redactions = failureRedactions(outcomes, cfg.report.redactPatterns);
+            if (redactions.length > 0) {
+                sink.event('report-redacted', { round: checkRounds, iteration: iterations, checks: true, redactions }, `redacted from the checks of round ${checkRounds} before upload: ${redactions.map((r) => `${r.count}× ${r.name}`).join(', ')}`, 'warn');
+            }
             await pacer.throttleSend();
             const before = await transport.sendAndConfirm(message, [path]);
             const next = await transport.waitForReply(before);
@@ -1040,6 +1301,7 @@ export async function runTask(transport, session, task, deps) {
          * `accept` — reviewed and passed, or not reviewed at all.
          * `retry` — the reviewer found problems and they have been sent back to the implementer.
          * `give-up` — the rounds are spent and the findings are still standing.
+         * `stopped` — the operator stopped the run while the review was going.
          */
         const gateOnReview = async (closing) => {
             if (!reviewWanted) {
@@ -1048,7 +1310,7 @@ export async function runTask(transport, session, task, deps) {
             }
             reviewRounds += 1;
             const model = effectiveModels(session, cfg).reviewModel;
-            const repoDir = session.vcs?.enabled ? (session.vcs.repoDir ?? '').trim() : '';
+            const repoDir = trackedRepoOf(session);
             /*
              * What changed, read from git rather than from anybody's account of it.
              *
@@ -1072,7 +1334,7 @@ export async function runTask(transport, session, task, deps) {
                     const picked = await transport.selectModel(model).catch((e) => ({ ok: false, current: null, reason: e.message }));
                     sink.event(picked.ok ? 'review-model-selected' : 'review-model-not-selected', { asked: model, current: picked.current }, picked.ok ? `the review runs on ${picked.current ?? model}` : `the review could not switch to "${model}": ${picked.reason ?? 'unknown reason'}`, picked.ok ? 'info' : 'warn');
                 }
-                outcome = await runReview(transport, session, task, {
+                outcome = await runReview(sendsUntilStopped(transport, signal), session, task, {
                     cfg,
                     authorizer,
                     signal,
@@ -1111,6 +1373,25 @@ export async function runTask(transport, session, task, deps) {
             }
             // A reviewer that left its own server listening once failed the work for it.
             roundLeftovers = [...roundLeftovers, ...(await reap(beforeReview, `review round ${reviewRounds}`))];
+            /*
+             * Stopped by the operator: neither a verdict on the work nor the machinery failing.
+             *
+             * The review reports a Stop the way it reports a broken browser — an error, "the run was
+             * stopped" — and an error accepts the work unreviewed (below), so a task stopped in its
+             * review was closed `done` and committed, and "Continue" could not carry it on. The round is
+             * recorded as cut short, and the task ends `aborted`, as every Stop ends it.
+             */
+            if (signal?.aborted) {
+                await saveReview({
+                    verdict: 'error',
+                    rounds: reviewRounds,
+                    stepsRun: outcome.stepsRun,
+                    problem: `the run was stopped by the operator during review round ${reviewRounds}, before a verdict was acted on`,
+                    model: model || undefined,
+                });
+                sink.event('review-stopped', { round: reviewRounds, stepsRun: outcome.stepsRun }, `the operator stopped the run during review round ${reviewRounds}; the work is neither accepted nor sent back`, 'warn');
+                return 'stopped';
+            }
             /*
              * Which findings an earlier round already raised.
              *
@@ -1233,6 +1514,9 @@ export async function runTask(transport, session, task, deps) {
                 return 'give-up';
             }
             sink.event('review-failed', { round: reviewRounds, findings: outcome.findings.length }, `the review found ${outcome.findings.length} problem(s); sending them back to be fixed`, 'warn');
+            // A Stop that came after the verdict: it stands on the record, and nothing more is sent.
+            if (signal?.aborted)
+                return 'stopped';
             await pacer.throttleSend();
             // The reviewer quotes output in its evidence, so the message gets the same treatment.
             // Recorded as sent, because what reached the chat is what the next question is about.
@@ -1260,6 +1544,54 @@ export async function runTask(transport, session, task, deps) {
                 : `an independent review found ${findings.length} problem(s) that were still there after ` +
                     `${maxReviewRounds} round(s) of fixing: ${listed}`;
         };
+        /**
+         * What a reported "done" comes to: the checks, then the review, either of which may end the
+         * task here. Null means the work went back to the chat and the loop goes on.
+         *
+         * One place for both ways a "done" arrives — on its own, and after the report of its last
+         * steps — which used to be two copies of the same lines, and the Stop has to be answered the
+         * same way in both. A Stop while the checks run, or during the review, ends the task `aborted`;
+         * one that comes after the checks have accepted the work ends it before a review conversation
+         * is opened for it. A verdict the checks reached on their own — out of rounds, no progress,
+         * checks that cannot run — stands.
+         *
+         * With the review switched off there is no conversation to keep from opening, and nothing left
+         * to judge once the checks have accepted the work: a Stop then leaves the task done, its review
+         * recorded as skipped. Ended `aborted` "before the review", it named a review that did not
+         * exist, and a batch that stops on a failure counted it as one and skipped the sessions after.
+         */
+        const settleDone = async (summary) => {
+            const verdict = await gateOnChecks();
+            if (verdict === 'stopped')
+                return await finish('aborted', 'stopped by the operator while the checks ran', summary, lastMarkdown);
+            if (verdict === 'environment') {
+                stopCode = 'environment';
+                return await finish('failed', shellProblemReason(environmentProblem), summary, lastMarkdown);
+            }
+            // Its stop code is set by the gate: every failing check was refused for good.
+            if (verdict === 'invalid')
+                return await finish('failed', checksFailedReason(lastOutcomes), summary, lastMarkdown);
+            if (verdict === 'give-up') {
+                if (noProgressReason)
+                    return await finish('blocked', noProgressReason, summary, lastMarkdown);
+                // Every failing check was refused before it ran: a verdict on the checks, not on the work.
+                if (lastOutcomes.some((o) => !o.passed) && lastOutcomes.every((o) => o.passed || o.refusedBeforeRunning))
+                    stopCode = 'invalid-check';
+                return await finish('failed', checksFailedReason(lastOutcomes), summary, lastMarkdown);
+            }
+            if (verdict === 'retry')
+                return null;
+            if (reviewWanted && signal?.aborted)
+                return await finish('aborted', 'stopped by the operator before the review', summary, lastMarkdown);
+            const reviewed = await gateOnReview(summary);
+            if (reviewed === 'stopped')
+                return await finish('aborted', 'stopped by the operator during the review', summary, lastMarkdown);
+            if (reviewed === 'accept')
+                return await finish('done', undefined, summary, lastMarkdown);
+            if (reviewed === 'give-up')
+                return await finish('blocked', reviewBlockedReason(), summary, lastMarkdown);
+            return null;
+        };
         let formatRetries = 0;
         /*
          * The anti-spin guards.
@@ -1319,8 +1651,10 @@ export async function runTask(transport, session, task, deps) {
                     await transport.dumpFailure(log.path('failures'), 'format-error');
                     stopCode = 'format-repair-exhausted';
                     limitHit = { setting: 'maxFormatRetries', value: cfg.limits.maxFormatRetries };
-                    return await finish('limit-reached', `format repair exhausted: ${formatRetries} replies in a row did not match the format (maxFormatRetries ${cfg.limits.maxFormatRetries}), ` +
-                        `the last because ${parsed.detail}. Nothing from those replies was run; the work so far is kept.`, undefined, lastMarkdown);
+                    return await finish('limit-reached', 
+                    // The parser's detail is a sentence of its own, often with its own full stop.
+                    sentences(`format repair exhausted: ${formatRetries} replies in a row did not match the format (maxFormatRetries ${cfg.limits.maxFormatRetries}), ` +
+                        `the last one refused for this: ${parsed.detail}`, 'Nothing from those replies was run; the work so far is kept.'), undefined, lastMarkdown);
                 }
                 await pacer.throttleSend();
                 const before = await transport.sendAndConfirm(formatErrorMessage(parsed, formatRetries, cfg.limits.maxFormatRetries));
@@ -1424,31 +1758,14 @@ export async function runTask(transport, session, task, deps) {
             if (blocked) {
                 sink.event('task-blocked', { tried: reply.tried, needed: reply.needed }, `the task was given up as blocked after ${reply.tried.length} approach(es)`, 'warn');
                 const early = reply.tried.length < minApproaches
-                    ? ` It gave up after ${reply.tried.length} of the ${minApproaches} approaches Settings ask for, having been asked ${earlyBlocks} time(s) for another.`
+                    ? `It gave up after ${reply.tried.length} of the ${minApproaches} approaches Settings ask for, having been asked ${earlyBlocks} time(s) for another.`
                     : '';
-                return await finish('blocked', blockedReason(reply.tried, reply.needed) + early, reply.summary, lastMarkdown);
+                return await finish('blocked', sentences(blockedReason(reply.tried, reply.needed), early), reply.summary, lastMarkdown);
             }
             if (done && reply.steps.length === 0) {
-                const verdict = await gateOnChecks();
-                if (verdict === 'environment') {
-                    stopCode = 'environment';
-                    return await finish('failed', shellProblemReason(environmentProblem), reply.summary, lastMarkdown);
-                }
-                if (verdict === 'give-up') {
-                    if (noProgressReason)
-                        return await finish('blocked', noProgressReason, reply.summary, lastMarkdown);
-                    // Every failing check was refused before it ran: a verdict on the checks, not on the work.
-                    if (lastOutcomes.some((o) => !o.passed) && lastOutcomes.every((o) => o.passed || o.refusedBeforeRunning))
-                        stopCode = 'invalid-check';
-                    return await finish('failed', checksFailedReason(lastOutcomes), reply.summary, lastMarkdown);
-                }
-                if (verdict === 'accept') {
-                    const reviewed = await gateOnReview(reply.summary);
-                    if (reviewed === 'accept')
-                        return await finish('done', undefined, reply.summary, lastMarkdown);
-                    if (reviewed === 'give-up')
-                        return await finish('blocked', reviewBlockedReason(), reply.summary, lastMarkdown);
-                }
+                const ended = await settleDone(reply.summary);
+                if (ended)
+                    return ended;
                 continue;
             }
             // --- execute -----------------------------------------------------------------
@@ -1508,10 +1825,15 @@ export async function runTask(transport, session, task, deps) {
                     t.status = 'waiting-approval';
                 });
                 sink.event('step-proposed', { id: step.id, description: describeStep(step) }, `step ${step.id}: ${describeStep(step)}`);
-                const decision = await authorizer.authorize(step, { sessionId: session.id, taskId: task.id, iteration: iterations, confinement });
+                const decided = await authorizer.authorize(step, { sessionId: session.id, taskId: task.id, iteration: iterations, confinement });
                 await setTask((t) => {
                     t.status = 'running';
                 });
+                // A Stop can land while the answer is awaited or written down, after the look at the signal
+                // above; whatever was decided, a stopped run does not start the step.
+                const decision = decided.action === 'run' && signal?.aborted
+                    ? { action: 'abort', reason: 'stopped by the operator', by: 'operator' }
+                    : decided;
                 if (decision.action === 'abort') {
                     results.push(refusedResult(step, decision.reason, decision.by === 'operator' ? 'operator' : 'runner'));
                     aborted = true;
@@ -1550,6 +1872,17 @@ export async function runTask(transport, session, task, deps) {
                     sameInARow: previous && previous.signature === signature ? previous.sameInARow + 1 : 1,
                 });
                 sink.event('step-finished', { id: step.id, outcome: result.outcome, exitCode: result.exitCode, durationMs: result.durationMs, shell: result.shell, requestedShell: result.requestedShell ?? null, shellPath: result.shellPath ?? '' }, `step ${step.id}: ${result.outcome}, exit ${result.exitCode}, ${(result.durationMs / 1000).toFixed(1)}s`);
+                /*
+                 * Stopped while it ran. The signal is looked at before each step, and after the last one
+                 * there is no next one to look before: the cut-short step's report was uploaded and the
+                 * chat's answer waited for before the top of the loop ended the task, a Stop that took as
+                 * long as a reply. It ends here instead, the way a Stop between steps does: the report is
+                 * written for the record, and nothing more is sent.
+                 */
+                if (signal?.aborted) {
+                    aborted = true;
+                    break;
+                }
                 /*
                  * The shell itself would not start. The same rule as in the check gate applies, for the
                  * same reason: nothing was learned about the work, and the next message would be asking
@@ -1622,9 +1955,6 @@ export async function runTask(transport, session, task, deps) {
             }
             if (aborted)
                 return await finish('aborted', 'the operator aborted the task', undefined, lastMarkdown);
-            // The files may have changed: the Desktop copies catch up, in the background (see RunDeps).
-            if (results.some((r) => r.outcome !== 'refused' && r.outcome !== 'aborted'))
-                deps.onWorkChanged?.();
             // A loop in which every round looks new: see `progress.ts`. After the report is written, so
             // the evidence the diagnosis points at is on disk.
             const stuck = progress.afterRound(await treeNow(), results);
@@ -1736,26 +2066,9 @@ export async function runTask(transport, session, task, deps) {
                 }
             }
             if (done) {
-                const verdict = await gateOnChecks();
-                if (verdict === 'environment') {
-                    stopCode = 'environment';
-                    return await finish('failed', shellProblemReason(environmentProblem), reply.summary, lastMarkdown);
-                }
-                if (verdict === 'give-up') {
-                    if (noProgressReason)
-                        return await finish('blocked', noProgressReason, reply.summary, lastMarkdown);
-                    // Every failing check was refused before it ran: a verdict on the checks, not on the work.
-                    if (lastOutcomes.some((o) => !o.passed) && lastOutcomes.every((o) => o.passed || o.refusedBeforeRunning))
-                        stopCode = 'invalid-check';
-                    return await finish('failed', checksFailedReason(lastOutcomes), reply.summary, lastMarkdown);
-                }
-                if (verdict === 'accept') {
-                    const reviewed = await gateOnReview(reply.summary);
-                    if (reviewed === 'accept')
-                        return await finish('done', undefined, reply.summary, lastMarkdown);
-                    if (reviewed === 'give-up')
-                        return await finish('blocked', reviewBlockedReason(), reply.summary, lastMarkdown);
-                }
+                const ended = await settleDone(reply.summary);
+                if (ended)
+                    return ended;
                 continue;
             }
             await pacer.settle();