cueline 0.1.7 → 0.2.0

package/docs/assets/cueline-states-ja.svg

@@ -0,0 +1,48 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 424" width="1000" height="424" role="img" aria-label="CueLine の run 状態：ready、awaiting_controller、awaiting_caller、awaiting_caller_work、complete、blocked、cancelled と、それぞれの意味。">
+  <title>CueLine の run 状態</title>
+  <style>
+    text { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", "Hiragino Kaku Gothic ProN", "Yu Gothic", monospace }
+    .hd   { fill: #0F1720; font-size: 17px; letter-spacing: .02em }
+    .sub  { fill: #8B949E; font-size: 13.5px }
+    .rule { stroke: #E4E8EC; stroke-width: 1 }
+    .say  { fill: #C8553D; font-size: 15px }
+    .obs  { fill: #4A5561; font-size: 14px }
+    .foot { fill: #8B949E; font-size: 13.5px }
+    @media (prefers-color-scheme: dark) {
+      .hd { fill: #E6EDF3 }
+      .sub, .foot { fill: #7D8590 }
+      .rule { stroke: #21262D }
+      .say { fill: #E0674C }
+      .obs { fill: #ADBAC7 }
+    }
+  </style>
+
+  <text x="40" y="44" class="hd">run の状態</text>
+  <text x="40" y="64" class="sub">状態値は API のそのままの文字列</text>
+  <path d="M40 84H960" class="rule"/>
+
+  <text x="60" y="122" class="say">ready</text>
+  <text x="340" y="122" class="obs">作成済みで永続化済み。まだ何も送信していない</text>
+
+  <text x="60" y="156" class="say">awaiting_controller</text>
+  <text x="340" y="156" class="obs">永続的な送信を 1 回完了——観測のみ、再送は決してしない</text>
+
+  <text x="60" y="190" class="say">awaiting_caller</text>
+  <text x="340" y="190" class="obs">advise の引き渡し——調整のみ、副作用 claim なし</text>
+
+  <text x="60" y="224" class="say">awaiting_caller_work</text>
+  <text x="340" y="224" class="obs">work 保留——claim + start までは開始されない</text>
+
+  <text x="60" y="258" class="say">complete</text>
+  <text x="340" y="258" class="obs">最終成果物をそのまま返却。任意のアーカイブは 1 回だけ</text>
+
+  <text x="60" y="292" class="say">blocked</text>
+  <text x="340" y="292" class="obs">コントローラーが明確な理由つきで停止</text>
+
+  <text x="60" y="326" class="say">cancelled</text>
+  <text x="340" y="326" class="obs">永続的なキャンセル。開始済みの owner 不在の work は ambiguous に</text>
+
+  <path d="M40 352H960" class="rule"/>
+  <text x="40" y="378" class="foot">曖昧なものはすべて明示的な reconcile が必要——CueLine は再送も推測もしない。</text>
+  <text x="40" y="400" class="foot">ラウンド上限は既定 12。既定値以外の maxRounds は run 作成時に固定される。</text>
+</svg>

package/docs/assets/cueline-states-ko.svg

@@ -0,0 +1,48 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 424" width="1000" height="424" role="img" aria-label="CueLine run 상태: ready, awaiting_controller, awaiting_caller, awaiting_caller_work, complete, blocked, cancelled — 각 상태의 의미.">
+  <title>CueLine run 상태</title>
+  <style>
+    text { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", "Apple SD Gothic Neo", "Malgun Gothic", monospace }
+    .hd   { fill: #0F1720; font-size: 17px; letter-spacing: .02em }
+    .sub  { fill: #8B949E; font-size: 13.5px }
+    .rule { stroke: #E4E8EC; stroke-width: 1 }
+    .say  { fill: #C8553D; font-size: 15px }
+    .obs  { fill: #4A5561; font-size: 14px }
+    .foot { fill: #8B949E; font-size: 13.5px }
+    @media (prefers-color-scheme: dark) {
+      .hd { fill: #E6EDF3 }
+      .sub, .foot { fill: #7D8590 }
+      .rule { stroke: #21262D }
+      .say { fill: #E0674C }
+      .obs { fill: #ADBAC7 }
+    }
+  </style>
+
+  <text x="40" y="44" class="hd">run 상태</text>
+  <text x="40" y="64" class="sub">상태 값은 API 문자열 그대로입니다</text>
+  <path d="M40 84H960" class="rule"/>
+
+  <text x="60" y="122" class="say">ready</text>
+  <text x="340" y="122" class="obs">생성되고 영속화됨; 아직 아무것도 보내지 않음</text>
+
+  <text x="60" y="156" class="say">awaiting_controller</text>
+  <text x="340" y="156" class="obs">지속 전송 한 번 완료 — 관측만 하고 절대 재전송하지 않음</text>
+
+  <text x="60" y="190" class="say">awaiting_caller</text>
+  <text x="340" y="190" class="obs">advise 인계 — 조정 전용, 부작용 claim 없음</text>
+
+  <text x="60" y="224" class="say">awaiting_caller_work</text>
+  <text x="340" y="224" class="obs">work 대기 — claim + start 전에는 시작되지 않음</text>
+
+  <text x="60" y="258" class="say">complete</text>
+  <text x="340" y="258" class="obs">최종 결과를 그대로 반환; 선택적 보관은 정확히 한 번</text>
+
+  <text x="60" y="292" class="say">blocked</text>
+  <text x="340" y="292" class="obs">컨트롤러가 명확한 이유와 함께 중단</text>
+
+  <text x="60" y="326" class="say">cancelled</text>
+  <text x="340" y="326" class="obs">지속 취소; 시작된 owner 없는 work는 ambiguous가 됨</text>
+
+  <path d="M40 352H960" class="rule"/>
+  <text x="40" y="378" class="foot">모호한 것은 모두 명시적 reconcile이 필요합니다 — CueLine은 재전송도 추측도 하지 않습니다.</text>
+  <text x="40" y="400" class="foot">라운드 상한은 기본 12; 기본값이 아닌 maxRounds는 run 생성 시 고정됩니다.</text>
+</svg>

package/docs/assets/cueline-states-zh-CN.svg

@@ -0,0 +1,48 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 424" width="1000" height="424" role="img" aria-label="CueLine 运行状态：ready、awaiting_controller、awaiting_caller、awaiting_caller_work、complete、blocked、cancelled，以及每个状态的含义。">
+  <title>CueLine 运行状态</title>
+  <style>
+    text { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", "PingFang SC", "Microsoft YaHei", monospace }
+    .hd   { fill: #0F1720; font-size: 17px; letter-spacing: .02em }
+    .sub  { fill: #8B949E; font-size: 13.5px }
+    .rule { stroke: #E4E8EC; stroke-width: 1 }
+    .say  { fill: #C8553D; font-size: 15px }
+    .obs  { fill: #4A5561; font-size: 14px }
+    .foot { fill: #8B949E; font-size: 13.5px }
+    @media (prefers-color-scheme: dark) {
+      .hd { fill: #E6EDF3 }
+      .sub, .foot { fill: #7D8590 }
+      .rule { stroke: #21262D }
+      .say { fill: #E0674C }
+      .obs { fill: #ADBAC7 }
+    }
+  </style>
+
+  <text x="40" y="44" class="hd">运行状态</text>
+  <text x="40" y="64" class="sub">状态值为 API 原文字符串</text>
+  <path d="M40 84H960" class="rule"/>
+
+  <text x="60" y="122" class="say">ready</text>
+  <text x="340" y="122" class="obs">已创建且持久化；尚未发送任何内容</text>
+
+  <text x="60" y="156" class="say">awaiting_controller</text>
+  <text x="340" y="156" class="obs">已完成一次持久发送——只观测、绝不重发</text>
+
+  <text x="60" y="190" class="say">awaiting_caller</text>
+  <text x="340" y="190" class="obs">advise 交接——仅协调，无副作用 claim</text>
+
+  <text x="60" y="224" class="say">awaiting_caller_work</text>
+  <text x="340" y="224" class="obs">work 待办——claim + start 之前绝不开始</text>
+
+  <text x="60" y="258" class="say">complete</text>
+  <text x="340" y="258" class="obs">最终交付逐字返回；可选归档，恰好一次</text>
+
+  <text x="60" y="292" class="say">blocked</text>
+  <text x="340" y="292" class="obs">控制器附明确理由停下</text>
+
+  <text x="60" y="326" class="say">cancelled</text>
+  <text x="340" y="326" class="obs">持久取消；已开始的无主工作变为 ambiguous</text>
+
+  <path d="M40 352H960" class="rule"/>
+  <text x="40" y="378" class="foot">任何模糊状态都需要显式 reconcile——CueLine 绝不重发、绝不靠猜。</text>
+  <text x="40" y="400" class="foot">轮次上限默认 12；非默认 maxRounds 在创建 run 时即固定。</text>
+</svg>

package/docs/assets/cueline-states-zh-TW.svg

@@ -0,0 +1,48 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1000 424" width="1000" height="424" role="img" aria-label="CueLine 執行狀態：ready、awaiting_controller、awaiting_caller、awaiting_caller_work、complete、blocked、cancelled，以及每個狀態的意義。">
+  <title>CueLine 執行狀態</title>
+  <style>
+    text { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", "PingFang TC", "Microsoft JhengHei", monospace }
+    .hd   { fill: #0F1720; font-size: 17px; letter-spacing: .02em }
+    .sub  { fill: #8B949E; font-size: 13.5px }
+    .rule { stroke: #E4E8EC; stroke-width: 1 }
+    .say  { fill: #C8553D; font-size: 15px }
+    .obs  { fill: #4A5561; font-size: 14px }
+    .foot { fill: #8B949E; font-size: 13.5px }
+    @media (prefers-color-scheme: dark) {
+      .hd { fill: #E6EDF3 }
+      .sub, .foot { fill: #7D8590 }
+      .rule { stroke: #21262D }
+      .say { fill: #E0674C }
+      .obs { fill: #ADBAC7 }
+    }
+  </style>
+
+  <text x="40" y="44" class="hd">執行狀態</text>
+  <text x="40" y="64" class="sub">狀態值為 API 原文字串</text>
+  <path d="M40 84H960" class="rule"/>
+
+  <text x="60" y="122" class="say">ready</text>
+  <text x="340" y="122" class="obs">已建立且持久化；尚未送出任何東西</text>
+
+  <text x="60" y="156" class="say">awaiting_controller</text>
+  <text x="340" y="156" class="obs">已完成一次持久送出——只觀測、絕不重送</text>
+
+  <text x="60" y="190" class="say">awaiting_caller</text>
+  <text x="340" y="190" class="obs">advise 交接——僅協調，無副作用 claim</text>
+
+  <text x="60" y="224" class="say">awaiting_caller_work</text>
+  <text x="340" y="224" class="obs">work 待辦——claim + start 之前絕不開始</text>
+
+  <text x="60" y="258" class="say">complete</text>
+  <text x="340" y="258" class="obs">最終交付逐字回傳；選用封存，恰好一次</text>
+
+  <text x="60" y="292" class="say">blocked</text>
+  <text x="340" y="292" class="obs">主控端附明確理由停下</text>
+
+  <text x="60" y="326" class="say">cancelled</text>
+  <text x="340" y="326" class="obs">持久取消；已開始的無主工作轉為 ambiguous</text>
+
+  <path d="M40 352H960" class="rule"/>
+  <text x="40" y="378" class="foot">任何含糊狀態都需要明確 reconcile——CueLine 絕不重送、絕不用猜的。</text>
+  <text x="40" y="400" class="foot">輪數上限預設 12；非預設 maxRounds 在建立 run 時即固定。</text>
+</svg>

package/docs/controller-protocol.md

@@ -13,6 +13,12 @@ Every command must echo these values from the pending observation:
 
 A stale or mismatched value is rejected. CueLine parses only the **last complete** control envelope, which prevents an older example earlier in the assistant response from winning.
 
+### Not-sent retry identity
+
+Operator-confirmed not-sent recovery abandons the original request identity and creates exactly one new request ID. The controller sees the new identity in the next observation and must echo it. CueLine verifies that the regenerated prompt matches the abandoned checkpoint hash after replacing only the request ID; a changed instruction, observation, or other prompt content is not a recovery retry.
+
+The abandoned identity remains durable. If later browser evidence or a control envelope proves that the abandoned user message or response actually appeared, CueLine fails closed and requires manual review. It never accepts an old envelope as the new retry's result.
+
 ## Observation
 
 ```json

package/docs/multi-model-routing.md

@@ -0,0 +1,256 @@
+# Multi-model routing
+
+## What ships by default
+
+CueLine ships one enabled lane, `default`, with one candidate, `codex-default`. That candidate runs the bundled `codex exec --ignore-user-config` process route when process execution is explicitly authorized.
+
+Process execution is not the default. `startCueLineRun` and `runCueLine` default to `executor: "caller"`, which spawns no worker process at all. A controller dispatch is persisted and handed back to the current Codex for execution. Multi-model process routing is therefore an opt-in user configuration, not a CueLine code change.
+
+## What the controller can see
+
+For a process run, CueLine builds a routing instruction before every controller turn. ChatGPT Pro sees only:
+
+- enabled lane names;
+- enabled, currently available candidate IDs inside each lane.
+
+The controller never sees candidate `argv`, executable paths, wrapper contents, environment handling, or flags such as `--model`. It may select a lane and may name one advertised candidate with the optional `runner` field. CueLine validates that choice locally before any process starts.
+
+Candidate IDs are therefore the controller's menu. Encode both the model and intended purpose in each ID so the choice remains meaningful without exposing implementation details:
+
+- `claude-opus-4-8-advise`
+- `gemini-3-1-pro-advise`
+- `grok-4-5-advise-search`
+
+Keep IDs stable after they are used in durable runs. Change the `argv` behind an ID only when the new command preserves the same intended contract; otherwise add a new candidate ID.
+
+## Known limitations and wrapper boundaries
+
+The following constraints were verified against CueLine `0.1.7` and working local multi-model runners on 2026-07-16.
+
+### Candidates cannot define environment variables
+
+The routing schema accepts `id`, `argv`, `task_input`, and `enabled`. It has no `env` field.
+
+A worker CLI that requires environment setup must therefore use a wrapper script as `argv[0]`. For example, the Antigravity `agy` CLI needs `NO_BROWSER=1` for headless execution and should have API-key variables removed when the intended path is the existing CLI login. A wrapper can establish that environment before replacing itself with the real worker process.
+
+Keep secrets out of the routing JSON and wrapper source. Wrappers should unset conflicting variable names or inherit an already authorized local login; they should not embed credential values.
+
+### Candidate argv cannot branch on `advise` versus `work`
+
+CueLine expands fixed placeholders inside individual argv elements. `{mode}` expands to the literal `advise` or `work`. `{sandbox}` is the only mode-derived argument value: it expands to `read-only` for `advise` and `workspace-write` for `work`. Those values are designed for the Codex sandbox flag and are not a portable permission contract for other CLIs.
+
+The routing format has no conditional expression that can select one argv sequence for `advise` and another for `work`. For non-Codex workers, prefer an advise-only lane:
+
+- Claude: hardcode `--tools Read Glob Grep`.
+- Antigravity: hardcode `--mode plan`.
+- Grok: hardcode `--permission-mode plan`.
+
+Keep mutating `work` jobs on the bundled `default` lane unless a separate worker has an independently verified work-mode permission contract.
+
+### Registration is not a sandbox
+
+The runner contract states:
+
+> Registration is an allow-list, not a sandbox: the registered program still has the OS permissions of the local CueLine process.
+
+CueLine verifies that `argv[0]` came from the loaded routing configuration and launches it without a shell. That prevents the controller from supplying an arbitrary executable, but it does not reduce the executable's operating-system permissions.
+
+A registered non-Codex worker therefore runs with the full OS permissions of the local CueLine process. Its read-only behavior depends entirely on the CLI flags, wrapper behavior, credentials, and working directory chosen by the user.
+
+## Worked four-lane configuration
+
+This example keeps `work` on the bundled Codex route and adds three advise-only lanes:
+
+- `taste-final`: Claude Opus for final prose and judgment;
+- `long-context`: Gemini through an Antigravity wrapper;
+- `live-search`: Grok through a live-search wrapper.
+
+Create a private runner directory and replace `/absolute/path/to/cueline-runners` below with its real absolute path. Do not use `$HOME` or `~` inside JSON; CueLine passes argv directly and does not perform shell expansion.
+
+### Routing configuration
+
+```json
+{
+  "$schema": "/absolute/path/to/cueline/config/routing.schema.json",
+  "version": 1,
+  "lanes": {
+    "default": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "codex-default",
+          "argv": [
+            "codex",
+            "exec",
+            "--ignore-user-config",
+            "--skip-git-repo-check",
+            "--ephemeral",
+            "--color",
+            "never",
+            "-C",
+            "{workdir}",
+            "-s",
+            "{sandbox}",
+            "-"
+          ],
+          "task_input": "stdin"
+        }
+      ]
+    },
+    "taste-final": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "claude-opus-4-8-advise",
+          "argv": [
+            "claude",
+            "--disable-slash-commands",
+            "--model",
+            "claude-opus-4-8",
+            "--output-format",
+            "text",
+            "--effort",
+            "high",
+            "--tools",
+            "Read",
+            "Glob",
+            "Grep",
+            "-p",
+            "{task}"
+          ],
+          "task_input": "argv"
+        }
+      ]
+    },
+    "long-context": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "gemini-3-1-pro-advise",
+          "argv": [
+            "/absolute/path/to/cueline-runners/gemini-advise.sh",
+            "Gemini 3.1 Pro (High)"
+          ],
+          "task_input": "stdin"
+        }
+      ]
+    },
+    "live-search": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "grok-4-5-advise-search",
+          "argv": [
+            "/absolute/path/to/cueline-runners/grok-advise.sh",
+            "grok-4.5"
+          ],
+          "task_input": "stdin"
+        }
+      ]
+    }
+  }
+}
+```
+
+The `$schema` path is editor metadata; set it to the installed or checked-out `routing.schema.json` when schema-aware validation is desired. CueLine validates the routing object independently at load time.
+
+### Gemini wrapper
+
+Save as `gemini-advise.sh` and make it executable:
+
+```bash
+#!/usr/bin/env bash
+# CueLine advise-only Gemini runner through Antigravity.
+# argv: gemini-advise.sh "<agy model display string>"; task arrives on stdin.
+set -euo pipefail
+
+MODEL="${1:-Gemini 3.1 Pro (High)}"
+TASK="$(cat)"
+
+# Stay on the existing CLI login and avoid browser interaction.
+exec env -u GEMINI_API_KEY -u GOOGLE_API_KEY -u GOOGLE_AI_API_KEY \
+  NO_BROWSER=1 \
+  agy --dangerously-skip-permissions --add-dir "$PWD" \
+  --mode plan --model "$MODEL" \
+  --print-timeout 570s \
+  --print "$TASK"
+```
+
+`--dangerously-skip-permissions` disables Antigravity's interactive permission prompts; it does not make the process read-only. The enforced read-only intent in this wrapper comes from `--mode plan`. Verify that contract against the installed `agy` version before registering it.
+
+### Grok wrapper
+
+Save as `grok-advise.sh` and make it executable:
+
+```bash
+#!/usr/bin/env bash
+# CueLine advise-only Grok runner for live web and X search.
+# argv: grok-advise.sh "<model>"; task arrives on stdin.
+set -euo pipefail
+
+MODEL="${1:-grok-4.5}"
+
+TMP="$(mktemp)"
+trap '{ rm -- "$TMP"; } 2>/dev/null || true' EXIT
+cat > "$TMP"
+
+# Keep the subscription login path when an API-key variable would override it.
+unset XAI_API_KEY 2>/dev/null || true
+
+grok --cwd "$PWD" --model "$MODEL" \
+  --no-memory --no-subagents --no-plan --no-alt-screen \
+  --output-format plain --verbatim --permission-mode plan \
+  --prompt-file "$TMP"
+```
+
+Make both wrappers executable:
+
+```bash
+chmod 700 /absolute/path/to/cueline-runners/gemini-advise.sh
+chmod 700 /absolute/path/to/cueline-runners/grok-advise.sh
+```
+
+### Verify the routing file
+
+Point `CUELINE_CONFIG` at the completed file and inspect it through CueLine's real routing surface:
+
+```bash
+CUELINE_CONFIG=/absolute/path/to/routing.multimodel.json \
+  cueline routing --json
+```
+
+The command validates the file and checks whether each candidate's `argv[0]` is executable in the current environment. A valid file has this output shape:
+
+```json
+{
+  "version": "0.1.7",
+  "config": {
+    "path": "/absolute/path/to/routing.multimodel.json",
+    "valid": true
+  },
+  "availableLanes": 4,
+  "lanes": [
+    {
+      "name": "default",
+      "enabled": true,
+      "status": "available",
+      "selectedRunnerId": "codex-default"
+    }
+  ],
+  "findings": []
+}
+```
+
+The real `lanes` array contains one entry per configured lane. `availableLanes` may be less than four, and individual lanes may report `status: "unavailable"`, when a CLI or wrapper is not executable on the current `PATH` or at the configured absolute path. That is an availability result, not a schema-validation failure.
+
+Use the same `CUELINE_CONFIG` value when creating and continuing the process run. Process execution still requires both `executor: "process"` and `allowProcessExecution: true`.
+
+## What the controller sees
+
+With all four candidates available, the per-round routing instruction includes a line shaped like:
+
+```text
+Available routing lanes: default [codex-default]; taste-final [claude-opus-4-8-advise]; long-context [gemini-3-1-pro-advise]; live-search [grok-4-5-advise-search].
+```
+
+That is the complete routing menu exposed to ChatGPT Pro. The wrapper paths, CLI arguments, model flags, environment cleanup, and permission flags remain local.

package/docs/state-and-recovery.md

@@ -48,6 +48,8 @@ The controller turn is recorded before sending it through the browser. The built
 
 The absence of `controller_response_received` proves only that the local runtime did not record a response. It does **not** prove that ChatGPT did not answer. `run_failed` therefore retains the safe error message, stage, exact request ID, submission state, and known conversation URL. CueLine never treats a missing response event as permission to resend an ambiguous prompt.
 
+Submission checkpoints also bind the run, round, request ID, prompt hash, exact conversation URL, Pro model evidence, baseline user and assistant message counts, composer state, click-attempt state, and bounded DOM evidence. If the click throws, CueLine records the exception class and message plus any readable post-click DOM evidence before classification.
+
 ## Snapshot
 
 `snapshot.json` is a disposable materialized view of the event stream. CueLine writes a temporary file in the same directory and renames it over the destination. A snapshot records its state protocol, run ID, and last applied physical sequence. Loads replay the authoritative event stream from event 1 instead of trusting a snapshot that a retired owner could have replaced.
@@ -77,6 +79,34 @@ The run event log still records the controller-visible job transitions. A status
 - `controller_archive_pending` / `settle_controller_archive` means the controller run is already durably `complete`, but an explicitly enabled post-completion archive has not reached terminal proof. Only missing/released ownership may settle it. `archived`, `ambiguous`, and `failed` are terminal archive outcomes; never retry an `ambiguous` attempt.
 - `continueAllowed: false` forbids `continueCueLineRun`. A caller-work state may separately authorize only the exact claim/start/continue API action named by `safeNextAction`; it never authorizes a browser resend.
 
+## Operator-confirmed not-sent recovery
+
+`possibly_sent` remains non-retryable by default. If the operator directly inspects the exact ChatGPT conversation and confirms that the original user message is absent, a separate append-only recovery path can authorize one retry:
+
+```bash
+cueline run reconcile RUN_ID \
+  --request-id REQUEST_ID \
+  --not-sent-confirmed \
+  --conversation-url https://chatgpt.com/c/EXACT_CONVERSATION
+```
+
+The command does not drive the browser or send a message. It requires exactly one pending controller turn and validates the exact run, conversation, round, request ID, persisted prompt hash, and Pro model checkpoint. It also refuses recovery if a matching response or a command for the same or a newer controller round was accepted. Success appends `controller_turn_not_sent_confirmed` and `controller_turn_abandoned` with reason `operator_confirmed_not_sent`; old events remain unchanged.
+
+The next continuation creates exactly one new request ID for the same round. The regenerated prompt must match the abandoned checkpoint hash after substituting only the new request ID for the abandoned request ID. Any other content change records `CONTROLLER_NOT_SENT_PROMPT_MISMATCH` and freezes the run for manual review. A crash after the retry request is written resumes the same deterministic retry identity. Repeating the confirmation command is idempotent and never appends another confirmation, abandonment, or send.
+
+Status exposes `operatorConfirmation`, `abandonedRequestId`, `retryRequestId`, `promptHash`, and `resendBlockedReason`. Before the retry, `safeNextAction` is `retry`; after submission it is the normal `observe`. If later DOM or response evidence shows that the abandoned request actually appeared, CueLine records `CONTROLLER_NOT_SENT_CONFIRMATION_CONFLICT` or `CONTROLLER_NOT_SENT_RESPONSE_CONFLICT`, changes `safeNextAction` to `manual_review`, and refuses automatic resend or command acceptance.
+
+Existing manual-send path is distinct:
+
+```bash
+cueline run reconcile RUN_ID \
+  --request-id REQUEST_ID \
+  --manual-send-confirmed \
+  --conversation-url https://chatgpt.com/c/EXACT_CONVERSATION
+```
+
+`--manual-send-confirmed` says the original request was sent and must be observed under the same identity. `--not-sent-confirmed` says the original request definitely was not sent and must be abandoned. The flags are mutually exclusive.
+
 ## Continue behavior
 
 Always run `cueline run status <run-id> --json` before continuation. `continueCueLineRun` loads the exact `runId`, replays state as needed, and resumes the same persisted run. The public runtime also reuses the stored ChatGPT conversation URL unless an explicit compatible adapter is supplied.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cueline",
-  "version": "0.1.7",
+  "version": "0.2.0",
   "description": "A ChatGPT web conversation directs; CueLine validates each command and hands durable advice or explicitly claimed work to the current Codex.",
   "keywords": [
     "chatgpt",