cueline 0.4.2 → 0.4.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cueline",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Use a ChatGPT web conversation as the text controller for durable local advice or explicitly claimed work executed by the current Codex.",
   "author": {
     "name": "CueLine contributors"

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cueline",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Use a ChatGPT web conversation as the text controller for durable local advice or explicitly claimed work executed by the current Codex.",
   "author": {
     "name": "CueLine contributors"

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## 0.4.4 - 2026-07-19
+
+### Fixed
+
+- Accept plain objects created in another Node realm when canonicalizing
+  durable state. A controller driving CueLine from a separate vm/context hands
+  over objects whose `Object.prototype` has a different identity; the
+  non-plain-object guard rejected them as `CANONICAL_JSON_UNSUPPORTED_Object`,
+  aborting `RunStore.load` before operator-confirmed not-sent recovery could
+  write anything. Plainness is now judged by prototype-chain shape plus the
+  `[object Object]` brand, so foreign plain data canonicalizes identically
+  while Date/Map/Set/RegExp, typed arrays, and class instances from any realm
+  stay rejected.
+
+### Verification
+
+- New unit and regression tests build cross-realm values with `node:vm`:
+  foreign plain objects and JSON-parsed specs canonicalize and hash exactly
+  like same-realm values, foreign non-plain objects still throw, and job spec
+  hashes recompute for specs materialized in a controller realm. The full
+  suite passes 653/653.
+- A real wedged run (`reconciliation_required`, round 68) loads past the
+  previous crash point with zero durable writes and no resend.
+
+## 0.4.3 - 2026-07-19
+
+### Fixed
+
+- Reject injected browser objects before any durable continuation write unless
+  `sendTurn` is callable and split `submitTurn` / `observeTurn` methods are
+  supplied as a callable pair. The stable `BROWSER_ADAPTER_INVALID` error lists
+  only missing method names. A narrow legacy recovery recognizes only the exact
+  pre-submission `browser.sendTurn is not a function` event shape, requires a
+  fresh idle Pro observation of the exact conversation with the request absent,
+  and then abandons the old request for one round-preserving retry.
+- Capture child stdin/stdout/stderr stream errors in the process runner. An
+  early-exiting worker can emit `EPIPE` while CueLine is still writing a large
+  stdin task; the stream error is now bounded into job evidence while the real
+  child exit status remains authoritative, instead of crashing the controller
+  loop and concurrent jobs.
+
+### Verification
+
+- Release candidate preflight passes all 649 tests plus metadata agreement,
+  typecheck, plugin validation, shell install tests, package contents, and diff
+  hygiene.
+- Runtime regression proves an invalid built-in IAB module object returns
+  `BROWSER_ADAPTER_INVALID` with round, pending turns, and event sequence
+  unchanged; the legacy recovery fixture abandons and retries exactly once.
+- A 5 MB stdin regression against an immediately exiting child completes
+  without an uncaught `EPIPE`.
+
 ## 0.4.2 - 2026-07-18
 
 ### Fixed

package/README.ja.md

@@ -22,11 +22,11 @@
 
 CueLine は独立した実装で、**ランタイムの npm 依存はゼロ**です。Omnilane のラッパーではありません。
 
-## 最新リリース：0.4.2
+## 最新リリース：0.4.4
 
-- 再起動後、完了済みの添付型 ChatGPT Pro 応答を受理できない問題を修正しました。新しいページのハイドレーションで永続 baseline より少ない履歴 assistant ノードしかマウントされない場合でも、正確な run／round／request envelope で応答を受理できます。exact URL、二重の Pro 証拠、user count、ハイドレーション、idle の安全チェックは fail-closed のままです。実際の round 35 は再送ゼロ・重複 job ゼロで復旧し、559/559 テストに合格しました。
+- 別の Node realm(コントローラの vm/context)から渡された純粋なオブジェクトを永続状態の正規化で受理するように修正しました。not-sent 復旧のために古い run を読み込む際、`CANONICAL_JSON_UNSUPPORTED_Object` で中断しなくなります。どの realm の Date/Map/Set/RegExp、typed array、クラスインスタンスも引き続き拒否されます。653/653 テストに合格しました。
 
-詳細は [changelog](CHANGELOG.md#042---2026-07-18) またはバージョン指定の [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2) を参照してください。
+詳細は [changelog](CHANGELOG.md#044---2026-07-19) またはバージョン指定の [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4) を参照してください。
 
 ## 1 回の実行は実際にどう進むか
 
@@ -67,15 +67,15 @@ ChatGPT Pro のサブスクリプションと、選択された Pro モデルは
 npm レジストリからインストールします。
 
 ```bash
-npm install -g cueline@0.4.2
+npm install -g cueline@0.4.4
 cueline install
 cueline doctor
 ```
 
-フォールバックとして、[v0.4.2 リリース](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2) のパッケージ済み tarball をインストールすることもできます。同じリリースに `.sha256` チェックサムも置いてあります。
+フォールバックとして、[v0.4.4 リリース](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4) のパッケージ済み tarball をインストールすることもできます。同じリリースに `.sha256` チェックサムも置いてあります。
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.2/cueline-0.4.2.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.4/cueline-0.4.4.tgz
 cueline install
 cueline doctor
 ```
@@ -182,7 +182,7 @@ CLI はブラウザーを駆動しません。状態を書き込むコマンド
 
 ```console
 $ cueline doctor
-CueLine 0.4.2
+CueLine 0.4.4
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.ko.md

@@ -22,11 +22,11 @@
 
 CueLine은 독립적인 구현이며 **런타임 npm 의존성이 전혀 없습니다**. Omnilane을 감싼 래퍼가 아닙니다.
 
-## 최신 릴리스: 0.4.2
+## 최신 릴리스: 0.4.4
 
-- 재시작 후 완료된 첨부형 ChatGPT Pro 응답을 수락하지 못하는 문제를 수정했습니다. 새 페이지 하이드레이션에서 영속 baseline보다 적은 과거 assistant 노드만 마운트되어도 정확한 run／round／request envelope로 응답을 수락합니다. exact URL, 이중 Pro 증거, user count, 하이드레이션, idle 안전 검사는 fail-closed 상태로 유지됩니다. 실제 round 35는 재전송과 중복 job 없이 복구되었고 559/559 테스트를 통과했습니다.
+- 다른 Node realm(컨트롤러 vm/context)에서 넘어온 순수 객체를 영속 상태 정규화에서 수락하도록 수정했습니다. not-sent 복구를 위해 이전 run을 로드할 때 더 이상 `CANONICAL_JSON_UNSUPPORTED_Object`로 중단되지 않습니다. 어떤 realm의 Date/Map/Set/RegExp, typed array, 클래스 인스턴스는 계속 거부됩니다. 653/653 테스트를 통과했습니다.
 
-전체 내용은 [changelog](CHANGELOG.md#042---2026-07-18) 또는 버전이 지정된 [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2)에서 확인할 수 있습니다.
+전체 내용은 [changelog](CHANGELOG.md#044---2026-07-19) 또는 버전이 지정된 [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4)에서 확인할 수 있습니다.
 
 ## 실행 한 번은 실제로 이렇게 흘러갑니다
 
@@ -67,15 +67,15 @@ ChatGPT Pro 구독과 선택된 Pro 모델은 서로 다른 것입니다. 계정
 npm 레지스트리에서 설치합니다:
 
 ```bash
-npm install -g cueline@0.4.2
+npm install -g cueline@0.4.4
 cueline install
 cueline doctor
 ```
 
-대안으로, [v0.4.2 릴리스](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2)의 패키지 tarball을 설치할 수도 있습니다. 같은 릴리스에 `.sha256` 체크섬도 함께 있습니다.
+대안으로, [v0.4.4 릴리스](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4)의 패키지 tarball을 설치할 수도 있습니다. 같은 릴리스에 `.sha256` 체크섬도 함께 있습니다.
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.2/cueline-0.4.2.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.4/cueline-0.4.4.tgz
 cueline install
 cueline doctor
 ```
@@ -182,7 +182,7 @@ CLI는 브라우저를 구동하지 않습니다. 상태를 쓰는 명령 전에
 
 ```console
 $ cueline doctor
-CueLine 0.4.2
+CueLine 0.4.4
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.md

@@ -22,11 +22,15 @@ The web page never touches your machine and has no local tools. It only emits on
 
 CueLine is a standalone implementation with **no runtime npm dependencies**. It is not a wrapper around Omnilane.
 
-## Latest release: 0.4.2
+## Latest release: 0.4.4
 
-- Fixed reboot recovery for an already completed attachment-backed ChatGPT Pro response. CueLine now accepts an exact run/round/request envelope even when fresh page hydration mounts fewer historical assistant nodes than the durable baseline, while keeping exact URL, dual Pro evidence, user-count, hydration, and idle checks fail-closed. The real round 35 response was recovered with zero resend and no duplicate job; 559/559 tests passed.
+- Accepts plain objects that arrive from another Node realm (a controller
+  vm/context) when canonicalizing durable state, so loading an old run for
+  operator-confirmed not-sent recovery no longer aborts with
+  `CANONICAL_JSON_UNSUPPORTED_Object`. Date/Map/Set/RegExp, typed arrays, and
+  class instances from any realm are still rejected; 653/653 tests pass.
 
-Read the complete [changelog](CHANGELOG.md#042---2026-07-18) or the versioned [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2).
+Read the complete [changelog](CHANGELOG.md#044---2026-07-19) or the versioned [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4).
 
 ## How a run actually goes
 
@@ -69,15 +73,15 @@ You need Node.js 22+, Codex with its built-in Browser, and — for the bundled d
 Install from the npm registry:
 
 ```bash
-npm install -g cueline@0.4.2
+npm install -g cueline@0.4.4
 cueline install
 cueline doctor
 ```
 
-As a fallback, install the packaged tarball from the [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2), which also carries its `.sha256` checksum:
+As a fallback, install the packaged tarball from the [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4), which also carries its `.sha256` checksum:
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.2/cueline-0.4.2.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.4/cueline-0.4.4.tgz
 cueline install
 cueline doctor
 ```
@@ -210,7 +214,7 @@ The CLI does not drive the browser. Run `cueline help` for every positional argu
 
 ```console
 $ cueline doctor
-CueLine 0.4.2
+CueLine 0.4.4
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.zh-CN.md

@@ -22,11 +22,11 @@
 
 CueLine 是独立实现，**没有任何运行时 npm 依赖**，也不是 Omnilane 的包装层。
 
-## 最新版本：0.4.2
+## 最新版本：0.4.4
 
-- 修复重启后无法接收已完成附件型 ChatGPT Pro 回复的问题。即使全新页面水合后挂载的历史 assistant 节点少于持久 baseline，CueLine 也能用精确的 run／round／request envelope 接受回复；exact URL、双 Pro 证据、user count、水合与 idle 安全门仍保持 fail-closed。真实 round 35 已零重发、零重复 job 恢复；559/559 测试通过。
+- 修复跨 Node realm(控制端 vm/context)的纯对象在持久状态规范化时被误判为特殊对象的问题:加载旧 run 进行 not-sent 恢复不再以 `CANONICAL_JSON_UNSUPPORTED_Object` 中止。任一 realm 的 Date/Map/Set/RegExp、typed array 与类实例仍会被拒绝;653/653 测试通过。
 
-完整内容请查看 [changelog](CHANGELOG.md#042---2026-07-18) 或版本化的 [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2)。
+完整内容请查看 [changelog](CHANGELOG.md#044---2026-07-19) 或版本化的 [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4)。
 
 ## 一次运行实际是怎么走的
 
@@ -67,15 +67,15 @@ ChatGPT Pro 订阅套餐与“选定的 Pro 模型”是两回事。账号或个
 从 npm registry 安装：
 
 ```bash
-npm install -g cueline@0.4.2
+npm install -g cueline@0.4.4
 cueline install
 cueline doctor
 ```
 
-作为后备，也可以安装 [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2) 上的打包 tarball，该 release 同时附带它的 `.sha256` 校验值：
+作为后备，也可以安装 [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4) 上的打包 tarball，该 release 同时附带它的 `.sha256` 校验值：
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.2/cueline-0.4.2.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.4/cueline-0.4.4.tgz
 cueline install
 cueline doctor
 ```
@@ -184,7 +184,7 @@ CLI 不驱动浏览器。执行写入状态的命令前，先用 `cueline help`
 
 ```console
 $ cueline doctor
-CueLine 0.4.2
+CueLine 0.4.4
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/README.zh-TW.md

@@ -22,11 +22,11 @@
 
 CueLine 是獨立實作，**沒有任何 runtime npm 相依套件**，也不是 Omnilane 的包裝層。
 
-## 最新版本：0.4.2
+## 最新版本：0.4.4
 
-- 修復重開機後無法接收已完成附件型 ChatGPT Pro 回覆的問題。即使全新頁面水合後掛載的歷史 assistant 節點少於持久 baseline，CueLine 也能用精確的 run／round／request envelope 接受回覆；exact URL、雙 Pro 證據、user count、水合與 idle 安全閘門仍維持 fail-closed。真實 round 35 已零重送、零重複 job 復原；559/559 測試通過。
+- 修復跨 Node realm(控制端 vm/context)的純物件在持久狀態正規化時被誤判為特殊物件的問題:載入舊 run 進行 not-sent 復原不再以 `CANONICAL_JSON_UNSUPPORTED_Object` 中止。任一 realm 的 Date/Map/Set/RegExp、typed array 與類別實例仍會被拒絕;653/653 測試通過。
 
-完整內容請看 [changelog](CHANGELOG.md#042---2026-07-18) 或版本化的 [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2)。
+完整內容請看 [changelog](CHANGELOG.md#044---2026-07-19) 或版本化的 [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4)。
 
 ## 一次執行實際上怎麼跑
 
@@ -67,15 +67,15 @@ ChatGPT Pro 訂閱方案與「選定的 Pro 模型」是兩回事。帳號或個
 從 npm registry 安裝：
 
 ```bash
-npm install -g cueline@0.4.2
+npm install -g cueline@0.4.4
 cueline install
 cueline doctor
 ```
 
-作為備援，也可以安裝 [v0.4.2 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.2) 上的打包 tarball，該 release 同時附上它的 `.sha256` 校驗碼：
+作為備援，也可以安裝 [v0.4.4 release](https://github.com/Seraphim0916/cueline/releases/tag/v0.4.4) 上的打包 tarball，該 release 同時附上它的 `.sha256` 校驗碼：
 
 ```bash
-npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.2/cueline-0.4.2.tgz
+npm install -g https://github.com/Seraphim0916/cueline/releases/download/v0.4.4/cueline-0.4.4.tgz
 cueline install
 cueline doctor
 ```
@@ -193,7 +193,7 @@ CLI 不驅動瀏覽器。執行寫入狀態的命令前，先用 `cueline help`
 
 ```console
 $ cueline doctor
-CueLine 0.4.2
+CueLine 0.4.4
 status	ok
 node	22.14.0	ok
 config	/usr/local/lib/node_modules/cueline/config/routing.default.json	valid

package/config/routing.multimodel.example.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "./routing.schema.json",
+  "version": 1,
+  "lanes": {
+    "default": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "codex-default",
+          "argv": [
+            "codex",
+            "exec",
+            "--ignore-user-config",
+            "--skip-git-repo-check",
+            "--ephemeral",
+            "--color",
+            "never",
+            "-C",
+            "{workdir}",
+            "-s",
+            "{sandbox}",
+            "-"
+          ],
+          "task_input": "stdin"
+        }
+      ]
+    },
+    "live-search": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "grok-advise-search",
+          "argv": [
+            "grok",
+            "--no-memory",
+            "--no-subagents",
+            "--no-plan",
+            "--no-alt-screen",
+            "--output-format",
+            "plain",
+            "--verbatim",
+            "--permission-mode",
+            "plan",
+            "-p",
+            "{task}"
+          ],
+          "task_input": "argv"
+        }
+      ]
+    },
+    "taste-final": {
+      "enabled": true,
+      "candidates": [
+        {
+          "id": "claude-opus-4-8-advise",
+          "argv": [
+            "claude",
+            "--disable-slash-commands",
+            "--model",
+            "claude-opus-4-8",
+            "--output-format",
+            "text",
+            "--effort",
+            "high",
+            "--tools",
+            "Read",
+            "Glob",
+            "Grep",
+            "-p",
+            "{task}"
+          ],
+          "task_input": "argv"
+        }
+      ]
+    }
+  }
+}

package/dist/src/api-controller-handoff.js

@@ -8,7 +8,74 @@ import { JobStatusStore } from "./jobs/status.js";
 import { defaultCueLineHome } from "./state/paths.js";
 import { readRuntimeLease, retireDeadRuntimeLease, RuntimeLease, } from "./state/runtime-lease.js";
 import { readAuthoritativeRunEvents } from "./state/store.js";
+import { readCancellationObservation } from "./state/cancellation.js";
 import { isDefinitelyNotSentObservation, isSubmittedTurnRecoveryCandidate, } from "./core/submitted-turn-recovery.js";
+function eventPayload(event) {
+    return typeof event.payload === "object" &&
+        event.payload !== null &&
+        !Array.isArray(event.payload)
+        ? event.payload
+        : {};
+}
+function isLegacyPreSubmissionAdapterFailure(events, turn) {
+    if (turn.submissionState !== "possibly_sent" ||
+        turn.selectedModelLabel !== null ||
+        turn.baselineUserMessageCount !== null ||
+        turn.baselineAssistantMessageCount !== null ||
+        turn.baselineLastUserMessageHash !== null ||
+        turn.composerPromptState !== null ||
+        turn.submissionCheckpointContract !== null) {
+        return false;
+    }
+    const requestedIndexes = events.flatMap((event, index) => {
+        const payload = eventPayload(event);
+        return event.type === "controller_turn_requested" &&
+            payload.request_id === turn.requestId &&
+            payload.round === turn.round
+            ? [index]
+            : [];
+    });
+    if (requestedIndexes.length !== 1)
+        return false;
+    const requestedIndex = requestedIndexes[0];
+    const immediateFailure = events[requestedIndex + 1];
+    if (immediateFailure?.type !== "run_failed")
+        return false;
+    const failure = eventPayload(immediateFailure);
+    if (failure.code !== "CUELINE_INTERNAL" ||
+        failure.message !== "browser.sendTurn is not a function" ||
+        failure.request_id !== turn.requestId ||
+        failure.stage !== "controller_turn" ||
+        failure.submission_state !== "requested") {
+        return false;
+    }
+    return !events.slice(requestedIndex + 1).some((event) => {
+        const payload = eventPayload(event);
+        if ((event.type === "controller_turn_submission_started" ||
+            event.type === "controller_turn_submitted" ||
+            event.type === "controller_response_received") &&
+            payload.request_id === turn.requestId) {
+            return true;
+        }
+        if (event.type !== "controller_command_accepted")
+            return false;
+        const command = typeof payload.command === "object" &&
+            payload.command !== null &&
+            !Array.isArray(payload.command)
+            ? payload.command
+            : {};
+        return (command.request_id === turn.requestId ||
+            (typeof command.round === "number" && command.round >= turn.round));
+    });
+}
+function isLegacyDefinitelyNotSentObservation(evidence, conversationUrl) {
+    return (sameChatGptConversationUrl(evidence.conversationUrl, conversationUrl) &&
+        /^Pro(?:\s|$)/i.test(evidence.selectedModelLabel ?? "") &&
+        evidence.hydrated === true &&
+        evidence.requestMessageFound === false &&
+        evidence.isAnswering === false &&
+        evidence.observedUserMessageCount !== null);
+}
 export async function confirmManualControllerSubmission(runId, options) {
     const environment = options.environment ?? runtimeEnvironment();
     const home = options.home ?? defaultCueLineHome(environment);
@@ -149,6 +216,11 @@ export async function confirmControllerTurnNotSent(runId, options) {
         if ((state.pendingControllerTurns ?? []).length !== 1) {
             throw new CueLineError("OTHER_CONTROLLER_TURNS_PENDING", "Operator-confirmed not-sent recovery requires exactly one pending controller turn.");
         }
+        const cancellation = await readCancellationObservation(home, runId);
+        if (cancellation.runRequested || cancellation.jobRequests.length > 0) {
+            throw new CueLineError("CONTROLLER_NOT_SENT_STATE_INVALID", "Not-sent recovery is forbidden while run or job cancellation is pending.");
+        }
+        const events = await readAuthoritativeRunEvents(home, runId);
         const exactAmbiguousFailure = turn.submissionState !== "possibly_sent" ||
             state.lastFailure?.code !== "CONTROLLER_SUBMISSION_AMBIGUOUS" ||
             state.lastFailure.requestId !== turn.requestId
@@ -160,7 +232,12 @@ export async function confirmControllerTurnNotSent(runId, options) {
         const evidenceGatedSubmittedTurn = options.browser !== undefined &&
             candidateConversationUrl !== undefined &&
             isSubmittedTurnRecoveryCandidate(turn, candidateConversationUrl);
-        if (!exactAmbiguousFailure && !evidenceGatedSubmittedTurn) {
+        const legacyPreSubmissionFailure = options.browser !== undefined &&
+            candidateConversationUrl !== undefined &&
+            isLegacyPreSubmissionAdapterFailure(events, turn);
+        if (!exactAmbiguousFailure &&
+            !evidenceGatedSubmittedTurn &&
+            !legacyPreSubmissionFailure) {
             throw new CueLineError("CONTROLLER_NOT_SENT_STATE_INVALID", "Not-sent recovery requires either the exact ambiguous submission failure or a fresh evidence-gated submitted turn.");
         }
         if (turn.retryOfRequestId !== undefined && turn.retryOfRequestId !== null) {
@@ -181,19 +258,15 @@ export async function confirmControllerTurnNotSent(runId, options) {
         if (!isExactChatGptConversationUrl(conversationUrl)) {
             throw new CueLineError("CONTROLLER_RECONCILIATION_CONVERSATION_MISMATCH", "Operator-confirmed not-sent recovery requires an exact ChatGPT conversation URL.");
         }
-        if (turn.selectedModelLabel === null || !/^Pro(?:\s|$)/i.test(turn.selectedModelLabel)) {
+        if (!legacyPreSubmissionFailure &&
+            (turn.selectedModelLabel === null || !/^Pro(?:\s|$)/i.test(turn.selectedModelLabel))) {
             throw new CueLineError("CONTROLLER_RECONCILIATION_MODEL_UNVERIFIED", "The pending turn lacks exact Pro composer model evidence.");
         }
         if (!/^[0-9a-f]{64}$/.test(turn.promptHash)) {
             throw new CueLineError("CONTROLLER_RECONCILIATION_PROMPT_HASH_INVALID", "The pending turn lacks a valid prompt hash.");
         }
-        const events = await readAuthoritativeRunEvents(home, runId);
         for (const event of events) {
-            const payload = typeof event.payload === "object" &&
-                event.payload !== null &&
-                !Array.isArray(event.payload)
-                ? event.payload
-                : {};
+            const payload = eventPayload(event);
             if (event.type === "controller_response_received" &&
                 payload.request_id === options.requestId) {
                 throw new CueLineError("CONTROLLER_RECONCILIATION_SUPERSEDED", "A controller response for this request was already received; refusing not-sent recovery.");
@@ -211,7 +284,7 @@ export async function confirmControllerTurnNotSent(runId, options) {
             }
         }
         let submittedEvidence;
-        if (evidenceGatedSubmittedTurn) {
+        if (evidenceGatedSubmittedTurn || legacyPreSubmissionFailure) {
             const browser = options.browser;
             if (browser.observeSubmittedTurn === undefined) {
                 throw new CueLineError("CONTROLLER_NOT_SENT_EVIDENCE_REQUIRED", "The normally submitted turn requires a fresh read-only Browser observation before it can be confirmed not sent.");
@@ -221,16 +294,23 @@ export async function confirmControllerTurnNotSent(runId, options) {
                 round: turn.round,
                 requestId: turn.requestId,
                 prompt: turn.prompt,
-                baselineUserMessageCount: turn.baselineUserMessageCount,
-                ...(turn.baselineAssistantMessageCount === null
-                    ? {}
-                    : { baselineAssistantMessageCount: turn.baselineAssistantMessageCount }),
+                ...(typeof turn.baselineUserMessageCount === "number"
+                    ? { baselineUserMessageCount: turn.baselineUserMessageCount }
+                    : {}),
+                ...(typeof turn.baselineAssistantMessageCount === "number"
+                    ? { baselineAssistantMessageCount: turn.baselineAssistantMessageCount }
+                    : {}),
                 ...(turn.composerPromptState === "attachment_ready"
                     ? { attachmentPromptExpected: true }
                     : {}),
+                ...(legacyPreSubmissionFailure
+                    ? { legacyPreSubmissionRecovery: true }
+                    : {}),
             });
             if (observation.status !== "definitely_not_sent" ||
-                !isDefinitelyNotSentObservation(turn, conversationUrl, observation.evidence)) {
+                !(legacyPreSubmissionFailure
+                    ? isLegacyDefinitelyNotSentObservation(observation.evidence, conversationUrl)
+                    : isDefinitelyNotSentObservation(turn, conversationUrl, observation.evidence))) {
                 throw new CueLineError("CONTROLLER_NOT_SENT_EVIDENCE_INSUFFICIENT", "The fresh conversation observation did not prove baseline-equal, request-absent, Pro-idle not-sent evidence.");
             }
             submittedEvidence = observation.evidence;
@@ -246,14 +326,19 @@ export async function confirmControllerTurnNotSent(runId, options) {
                     : {};
                 return typeof payload.round === "number" && payload.round < turn.round;
             }).length;
+        const selectedModelLabel = submittedEvidence?.selectedModelLabel ?? turn.selectedModelLabel;
+        if (selectedModelLabel === null) {
+            throw new CueLineError("CONTROLLER_RECONCILIATION_MODEL_UNVERIFIED", "Not-sent recovery lacks exact Pro composer model evidence.");
+        }
+        const recoveryBaselineUserMessageCount = submittedEvidence?.baselineUserMessageCount ?? derivedBaselineUserMessageCount;
         if (existingRecovery === null) {
             await store.append("controller_turn_not_sent_confirmed", {
                 round: turn.round,
                 request_id: turn.requestId,
                 prompt_hash: turn.promptHash,
                 conversation_url: conversationUrl,
-                selected_model_label: turn.selectedModelLabel,
-                baseline_user_message_count: derivedBaselineUserMessageCount,
+                selected_model_label: selectedModelLabel,
+                baseline_user_message_count: recoveryBaselineUserMessageCount,
                 ...(submittedEvidence === undefined
                     ? { operator_confirmation: true }
                     : {
@@ -262,8 +347,10 @@ export async function confirmControllerTurnNotSent(runId, options) {
                         is_answering: false,
                         page_hydrated: true,
                         submission_state: "definitely_not_sent",
-                        confirmation_source: "fresh_read_only_observation",
-                        operator_confirmation: true,
+                        confirmation_source: legacyPreSubmissionFailure
+                            ? "legacy_pre_submission_adapter_failure"
+                            : "fresh_read_only_observation",
+                        operator_confirmation: !legacyPreSubmissionFailure,
                     }),
             });
         }
@@ -271,12 +358,14 @@ export async function confirmControllerTurnNotSent(runId, options) {
             await store.append("controller_turn_abandoned", {
                 round: turn.round,
                 request_id: turn.requestId,
-                reason: "operator_confirmed_not_sent",
+                reason: legacyPreSubmissionFailure
+                    ? "legacy_pre_submission_adapter_failure"
+                    : "operator_confirmed_not_sent",
                 round_not_consumed: true,
                 prompt_hash: turn.promptHash,
                 conversation_url: conversationUrl,
-                selected_model_label: turn.selectedModelLabel,
-                baseline_user_message_count: derivedBaselineUserMessageCount,
+                selected_model_label: selectedModelLabel,
+                baseline_user_message_count: recoveryBaselineUserMessageCount,
                 ...(submittedEvidence === undefined
                     ? { operator_confirmation: true }
                     : {
@@ -285,8 +374,10 @@ export async function confirmControllerTurnNotSent(runId, options) {
                         is_answering: false,
                         page_hydrated: true,
                         submission_state: "definitely_not_sent",
-                        confirmation_source: "fresh_read_only_observation",
-                        operator_confirmation: true,
+                        confirmation_source: legacyPreSubmissionFailure
+                            ? "legacy_pre_submission_adapter_failure"
+                            : "fresh_read_only_observation",
+                        operator_confirmation: !legacyPreSubmissionFailure,
                     }),
             });
         }