dsh-cindy-host 0.1.35 → 0.1.36

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.1.36 — 2026-11-06
+
+- Project proven native interruption identities and timestamp tuples consistently into session list/get, boundaries and reconnect updates. Clear non-pending/hidden/running presentation without fabricating transcript-clear or completion facts.
+- Serve existing interruption acknowledgement and committed-error dismissal calls through authenticated owner-scoped, revisioned native settings. Store hashed display preferences only, verify authoritative readback, guard source/controller/tail races, and overlay history without rewriting source events or receipt evidence.
+- Treat the pinned current Cindy continuation prompt as a new explicit durable human input with planMode:false. Capture and recheck the native tail around proven scoped plan-off, deduplicate continuations for that tail, and reconcile superseded/non-admitted refusals as removed receipts instead of retrying automatically. Legacy non-durable fallback refuses this control contract.
+- Extend Host/ledger/native-input regressions and opt-in read-only Cindy consumer contracts. Existing wire limitations remain explicit: no atomic CAS against unrelated desktop writers, screen-generation token in acknowledgement, immediate client rollback of failed ignores, or automatic replay of unknown tool outcomes.
+
 ## 0.1.35 — 2026-11-05
 
 - Show distinct native interruption, cancellation, sign-out, output-limit and blocked-turn notices without inventing model failures. Keep explicit native scheduled/started retries nonterminal, with safe known-code/count/delay details and stable live/history identities.

package/README.md

@@ -4,16 +4,20 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.35** adds native interruption, cancellation, output-limit and retry notices, cold-session diagnostic recovery and canonical tool-result pairing. It retains 0.1.34's question synchronization and safe model-failure display, plus the earlier regional authentication, reasoning streaming and native capability subsets.
+Version **0.1.36** adds native interruption banner/status metadata, owner-scoped interruption acknowledgement and error dismissal, and guarded manual continuation with verified native plan-mode off. It retains the earlier safe diagnostics, question synchronization, authentication, reasoning streaming and native capability subsets.
 
 It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.35
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.36
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.
 
+## 0.1.36: interruption controls
+
+The existing Cindy acknowledgement/dismissal actions update owner-scoped display preferences, not failure or completion facts. Manual continuation is a new human input; it verifies the current native tail and effective plan-mode off rather than retrying old tool calls. These changes are Host-only: Cindy is a read-only protocol/test dependency. See the [diagnostic protocol and limitations](<doc/model-errors.md>) for persistence, concurrency and current-client boundaries. Source contracts do not establish live-handset acceptance.
+
 ## 0.1.32: credentials without keytar
 
 No native npm credential module or C++ build toolchain is required. Linux uses `secret-tool` with an unlocked Secret Service (headless sessions need their own DBus/keyring setup); macOS uses the system Keychain through `/usr/bin/security`. Both keep the existing `DSH Cindy Host` service and installation-specific account.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",

package/src/cindy-channels.js

@@ -21,6 +21,7 @@ import { toGoalStatusPayload } from './host-goals.js';
 import { hostAttachmentsOf } from './host-attachments.js';
 import { historyLocateOptions, locateCommittedMessages, capReferenceRows } from './host-history-locate.js';
 import { assertNoStructuredSessionReferences } from './session-reference-boundary.js';
+import { continuationKind } from './continuation-protocol.js';
 
 async function deliveryReply(request, operation) {
   try { return invokeResult(request, await operation()); }
@@ -217,6 +218,8 @@ export const SUPPORTED_CHANNELS = Object.freeze([
   'local-db:sessions:list',
   'local-db:sessions:get',
   'local-db:messages:list',
+  'local-db:messages:dismiss-error',
+  'local-db:sessions:ack-interrupted',
   'local-db:messages:around',
   'local-db:messages:around-client-id',
   'local-db:sessions:patch-meta',
@@ -648,6 +651,14 @@ export function createChannelRouter({
       return invokeResult(request, sessionListPage(await sessionRows(), args));
     }
 
+    if (channel === 'local-db:sessions:ack-interrupted' || channel === 'local-db:messages:dismiss-error') {
+      const sid = args[0]; const cid = args[1]; const caps = capabilitiesNow();
+      if (typeof sid !== 'string' || !sid || args.length !== (channel === 'local-db:sessions:ack-interrupted' ? 1 : 2) || (channel === 'local-db:messages:dismiss-error' && (typeof cid !== 'string' || !cid))) return invokeError(request, 'INVALID_PARAMS', 'Session and message identities are required');
+      const action = channel === 'local-db:sessions:ack-interrupted' ? caps.ackInterrupted : caps.dismissError;
+      if (typeof action !== 'function') return invokeError(request, 'NOT_AVAILABLE', 'Diagnostic presentation actions are unavailable');
+      return deliveryReply(request, () => channel === 'local-db:sessions:ack-interrupted' ? action(sid, request.src) : action(sid, cid, request.src));
+    }
+
     if (channel === 'local-db:sessions:get') {
       const sessionId = String(args[0] ?? '');
       // A known blank session must be readable before its first enqueue. The
@@ -1164,6 +1175,8 @@ export function createChannelRouter({
         if (delivery) return deliveryReply(request, () => channel === 'maker:input:steer' ? delivery.steer(sessionId, args[1], args[2] ?? {}) : delivery.accept(sessionId, args[1], args[2] ?? {}));
       }
 
+      if (continuationKind(extractSendText(args[1]))) return invokeError(request, 'NOT_AVAILABLE', 'Safe manual continuation requires native durable input delivery');
+
       // A `steer` naming an item DSH already holds is a **promotion** of that
       // queued item, not a new message: the controller sends the queued row back
       // with `removeFromQueue`. Re-sending its text would duplicate it, which is

package/src/cindy-session-row.js

@@ -126,6 +126,7 @@ export function toCindySessionListRow(item, { now = () => new Date(), device, de
     // Not part of the stored row's contract, but harmless and honest: the
     // controller reads running state from `maker:list-active`, not from here.
     running: item.running === true,
+    ...(Object.hasOwn(item, 'activeTurnStartedAt') ? { activeTurnStartedAt: item.activeTurnStartedAt, interruptedTurnStartedAt: item.interruptedTurnStartedAt, lastTurnEndedAt: item.lastTurnEndedAt, clearedAt: item.clearedAt ?? null } : {}),
     // Which device this row came from. The controller's home aggregates sessions
     // from every linked computer and filters with
     // `canonicalDeviceId ?? deviceLinkDeviceId === selectedDeviceId`

package/src/continuation-protocol.js

@@ -0,0 +1,31 @@
+// Pinned Cindy maker-shared/syntheticTrigger constants; actual-consumer tests
+// assert byte equality. These are explicit manual inputs, never tool retries.
+const COMMON = ' Review the conversation above to determine how far the task progressed,'
+  + ' then continue from where it left off.'
+  + ' Do not repeat steps that already completed and had external effects'
+  + ' (messages or comments already sent, commits already pushed, files already written).';
+export const CONTINUE_INTERRUPTED = '[UI_ACTION_TRIGGER] The previous turn was interrupted because the app exited mid-run.' + COMMON;
+export const CONTINUE_ERROR = '[UI_ACTION_TRIGGER] The previous turn errored partway through.' + COMMON;
+export function continuationKind(text) { return text === CONTINUE_INTERRUPTED ? 'interrupted' : text === CONTINUE_ERROR ? 'error' : null; }
+
+/** Public native getters/projections prove the effective switch; never parse command prose. */
+export async function ensureNativeContinuationPlanOff({agent,controller,getService}) {
+  try {
+    const registry=agent?.ctx?.get?.('sessionProjections')??getService('sessionProjections');
+    const read=()=>controller?.get?.(agent)??registry?.stateOf?.(agent.session,'plan');
+    const off=()=>{const state=read();return state?.active===false&&state.pending!==true&&state.wanted!==true&&!state.running;};
+    // A logged projection alone cannot rule out a controller-private pending
+    // entry. Without the live getter, issue off even when logged active=false.
+    if(typeof controller?.get==='function'&&off())return;
+    if(typeof controller?.set==='function')await controller.set(agent,false);
+    else {
+      const commands=getService('commands');
+      if(typeof commands?.find!=='function'||typeof agent?.ctx?.get!=='function')throw Error('Native plan composition is not observable');
+      if(commands.find(agent,'plan')===undefined&&!controller)return; // exact resolved agent has no plan-mode owner
+      if(typeof commands.execute!=='function')throw Error('Native plan control is unavailable');
+      const result=await commands.execute(agent,'/plan off',[],AbortSignal.timeout(30000));
+      if(result?.result?.kind==='error')throw Error('Native plan-mode switch was refused');
+    }
+    if(!off())throw Error('Native plan-mode off is not committed');
+  } catch(cause) { throw Object.assign(new Error('Cannot verify native plan mode is off; continuation was not sent'),{code:'PLAN_MODE_UNAVAILABLE',cause}); }
+}

package/src/diagnostic-presentation.js

@@ -0,0 +1,65 @@
+import { createHash } from 'node:crypto';
+const hash = value => createHash('sha256').update(value).digest('hex');
+const unavailable = message => Object.assign(new Error(message), { code: 'NOT_AVAILABLE' });
+export const EMPTY_INTERRUPTION = Object.freeze({ activeTurnStartedAt: null, interruptedTurnStartedAt: null, lastTurnEndedAt: null, clearedAt: null });
+
+/** Presentation identities use the original turn/start, never a synthetic closer. */
+export function nativeInterruption(sessionId, start, end, priorEndedAt) {
+  if (end?.data?.reason?.kind !== 'interrupted' || !Number.isSafeInteger(start?.data?.turn) || start.data.turn < 0 || start?.data?.turn !== end?.data?.turn
+    || !Number.isSafeInteger(end.seq) || end.seq <= start?.seq || !Number.isFinite(end.time)
+    || !Number.isSafeInteger(start?.seq) || start.seq < 0 || !Number.isFinite(start.time) || start.time <= 0
+    || (Number.isFinite(priorEndedAt) && priorEndedAt >= start.time)) return null;
+  return { id: `${sessionId}:interrupted:${start.seq}:${start.time}:${start.data.turn}`,
+    startedAt: start.time, priorEndedAt: Number.isFinite(priorEndedAt) ? priorEndedAt : null };
+}
+export function advanceInterruptionMetadata(state, event, sessionId) {
+  const previous = state ?? { start: null, priorEndedAt: null, interruption: null };
+  if (event?.type === 'turn/start') return { ...previous, start: { seq: event.seq, time: event.time, data: { turn: event.data?.turn } }, interruption: null };
+  if (event?.type !== 'turn/end') return previous;
+  return { ...previous, interruption: nativeInterruption(sessionId, previous.start, event, previous.priorEndedAt),
+    priorEndedAt: event.data?.reason?.kind === 'interrupted' ? previous.priorEndedAt : Number.isFinite(event.time) ? event.time : previous.priorEndedAt };
+}
+export function diagnosticOwner(namespace, profile = '') {
+  return typeof namespace === 'string' && namespace ? hash(`${profile}|${namespace}`) : null;
+}
+export function preferenceHas(data, owner, sid, kind, id) {
+  return Boolean(owner && data?.[owner]?.[hash(sid)]?.[kind]?.[hash(id)] === true);
+}
+export function interruptionFields(candidate, running, hidden, data, owner, sid) {
+  if (!candidate || running || hidden || preferenceHas(data, owner, sid, 'interruptions', candidate.id)) return { ...EMPTY_INTERRUPTION };
+  return { activeTurnStartedAt: candidate.startedAt, interruptedTurnStartedAt: candidate.startedAt, lastTurnEndedAt: candidate.priorEndedAt, clearedAt: null };
+}
+export function projectDismissedErrors(rows, data, owner) {
+  return rows.map(row => row?.role === 'error' && preferenceHas(data, owner, row.sessionId, 'errors', row.clientId)
+    ? { ...row, content: { ...row.content, dismissed: true } } : row);
+}
+
+/** One transactional settings owner; no optimistic mirror of error/turn facts.
+ * Leaf writes preserve other grants/preferences. Revision conflicts are retried
+ * from describe, and successful writes are verified by authoritative readback. */
+export function diagnosticPreferenceStore(settings, ns) {
+  function describe() {
+    if (typeof settings?.describe !== 'function' || typeof settings?.mutate !== 'function') throw unavailable('Diagnostic preferences require revisioned native settings');
+    const entry = settings.describe().find(entry => entry.ns === ns);
+    if (!entry || !Number.isSafeInteger(entry.revision)) throw unavailable('Diagnostic settings namespace is unavailable');
+    return entry;
+  }
+  return {
+    snapshot() { try { return describe().value?.diagnosticPresentationV1 ?? {}; } catch { return {}; } },
+    async commit({ owner, sessionId, kind, id }, valid = () => true) {
+      if (!owner || !['interruptions', 'errors'].includes(kind)) throw unavailable('No authenticated diagnostic preference owner');
+      for (let attempt = 0; attempt < 3; attempt++) {
+        if (!valid()) throw unavailable('Diagnostic action scope changed');
+        const entry = describe();
+        if (preferenceHas(entry.value?.diagnosticPresentationV1, owner, sessionId, kind, id)) return;
+        try {
+          await settings.mutate(ns, [{ op: 'set', path: ['diagnosticPresentationV1', owner, hash(sessionId), kind, hash(id)], value: true }], entry.revision);
+        } catch (error) { if (error?.code === 'SETTINGS_CONFLICT') continue; throw error; }
+        if (!valid()) throw unavailable('Diagnostic action completed in an expired scope');
+        if (!preferenceHas(describe().value?.diagnosticPresentationV1, owner, sessionId, kind, id)) throw unavailable('Diagnostic preference was not committed');
+        return;
+      }
+      throw unavailable('Diagnostic settings changed concurrently; retry the action');
+    },
+  };
+}

package/src/dsh-input-delivery.js

@@ -1,6 +1,8 @@
 import { createAttachmentMaterializer, hostAttachmentsOf } from './host-attachments.js';
 import { foldSessionEvent } from './dsh-message-fold.js';
 import { interruptedTurnClosers } from '@deepseek-ai/dsh-session';
+import { turnStateFromEvents } from './turn-error.js';
+import { continuationKind } from './continuation-protocol.js';
 import { queuedRowFromController } from './host-input-queue.js';
 import { deliveryError } from './host-input-delivery-store.js';
 import { assertNoStructuredSessionReferences } from './session-reference-boundary.js';
@@ -23,7 +25,7 @@ export function durableInputEvidence(events,sessionId) {
   const inbox=Object.entries(queues).flatMap(([placement,items])=>items.map(message=>({id:message.id,clientId:message.source?.kind==='user'&&typeof message.source.rpcId==='string'?message.source.rpcId:message.id,placement,message,foreign:message.source?.kind!=='user'})));
   return {sessionId,users,inbox,throughSeq:events.length-1};
 }
-export function createDshInputDeliveryBackend({getServices,sessionController,getSession}){
+export function createDshInputDeliveryBackend({getServices,sessionController,getSession,ensurePlanModeOff}){
   let active=true;
   function services(){if(!active)throw deliveryError('DELIVERY_BACKEND_STOPPED','Input delivery service was detached');const s=getServices();if(!s.sessions||typeof s.sessions.flush!=='function'||!s.persistence||typeof s.persistence.open!=='function')throw deliveryError('DELIVERY_NOT_AVAILABLE','Durable DSH session services are not mounted');return s;}
   async function readLog(sid){
@@ -34,6 +36,17 @@ export function createDshInputDeliveryBackend({getServices,sessionController,get
   }
   async function agentFor(sid){const resolved=await sessionController.resolveAgent(sid);if(resolved?.error)throw resolved.error;if(!resolved?.agent)throw deliveryError('DELIVERY_AGENT_UNAVAILABLE','DSH did not resolve an agent');return resolved.agent;}
   async function flush(sid){const s=services();const session=s.sessions.get(sid);if(!session||!await s.sessions.flush(session))throw deliveryError('DELIVERY_DURABILITY_UNAVAILABLE','Cannot verify the DSH mutation durability');}
+  async function continuationTail(sid,kind,clientId) {
+    const persisted=await readLog(sid); const s=services();
+    const agent=s.agents?.get(sid);
+    if(agent?.status==='running')throw deliveryError('CONTINUATION_SUPERSEDED','The session has already started another turn');
+    const events=!s.sessions.get(sid)&&!agent?[...persisted,...interruptedTurnClosers(persisted)]:persisted;
+    const state=turnStateFromEvents(events,sid);
+    const id=kind==='interrupted'?state?.interruption?.id:state?.error?.clientId;
+    if(!id||state.running||events.some(event=>event.seq>state.boundarySeq&&event.type==='user/message'&&event.data?.source?.kind==='user'&&event.data.source.rpcId!==clientId)
+      ||durableInputEvidence(persisted,sid).inbox.some(item=>item.clientId!==clientId))throw deliveryError('CONTINUATION_SUPERSEDED','The original continuation tail is no longer current');
+    return id;
+  }
   const backend={
     available(){try{services();return true;}catch{return false;}},
     stop(){active=false;},
@@ -54,13 +67,26 @@ export function createDshInputDeliveryBackend({getServices,sessionController,get
       const materializer=createAttachmentMaterializer({fileSystem:getServices().fileSystem,resolveAttachmentRef,captureOnly:true});
       const owned=await materializer.materialize({attachments:incoming,signal:AbortSignal.timeout(30000)});
       if(owned.dropped.length)throw deliveryError('ATTACHMENT_UNAVAILABLE','Cannot durably receive all attachments: '+owned.dropped.map(x=>x.reason).join(', '));
+      const kind=continuationKind(text);
+      const continuation=kind?{kind,tailId:await continuationTail(sid,kind,row.clientId)}:null;
+      if(continuation&&row.createOpts?.planMode!==false)throw deliveryError('INVALID_PARAMS','Manual continuation requires explicit planMode:false');
       const queued=queuedRowFromController({clientId:row.clientId,text,session});if(!queued)throw deliveryError('DELIVERY_SESSION_UNAVAILABLE','Session working directory is unavailable');
-      return {payload:{text,assets:owned.parts,consumed:owned.consumed,mode},queued:{...queued,files:incoming,chatMessage:{...queued.chatMessage,...(row.chatMessage?.images?{images:row.chatMessage.images}:{})}}};
+      return {payload:{text,assets:owned.parts,consumed:owned.consumed,mode,...(continuation?{continuation}: {})},queued:{...queued,...(continuation?{createOpts:{...queued.createOpts,planMode:false}}:{}),files:incoming,chatMessage:{...queued.chatMessage,...(row.chatMessage?.images?{images:row.chatMessage.images}:{})}}};
     },
     async dispatch(entry,{releaseAttachmentRef}={}){
       assertNoStructuredSessionReferences(entry.request,entry.payload);
       let agent;
       try{agent=await agentFor(entry.sessionId);}catch(error){error.deliveryNotAdmitted=true;throw error;}
+      if(entry.payload.continuation) {
+        try {
+          const origin=entry.payload.continuation;
+          if(await continuationTail(entry.sessionId,origin.kind,entry.clientId)!==origin.tailId)throw deliveryError('CONTINUATION_SUPERSEDED','A newer task superseded this manual continuation');
+          if(typeof ensurePlanModeOff!=='function')throw deliveryError('PLAN_MODE_UNAVAILABLE','Cannot verify native plan mode is off');
+          await ensurePlanModeOff({sessionId:entry.sessionId,agent});
+          if(await continuationTail(entry.sessionId,origin.kind,entry.clientId)!==origin.tailId)throw deliveryError('CONTINUATION_SUPERSEDED','A newer task superseded this manual continuation');
+          services();
+        } catch(error) { error.deliveryNotAdmitted=true; if(error.code==='CONTINUATION_SUPERSEDED')error.deliverySuperseded=true; throw error; }
+      }
       const content=entry.payload.text?[{type:'text',text:entry.payload.text}]:[];
       for(const asset of entry.payload.assets??[]){
         if(asset.mediaType)content.push({type:'image',mediaType:asset.mediaType,data:asset.data,name:asset.name});

package/src/dsh-message-fold.js

@@ -18,6 +18,7 @@
 import { deriveEventMessage, isAppendSurfaceEvent } from '@deepseek-ai/dsh-session/surface';
 import { createReasoningStream } from './reasoning-stream.js';
 import { turnDiagnosticRow, turnStateFromEvents } from './turn-error.js';
+import { advanceInterruptionMetadata } from './diagnostic-presentation.js';
 import { toCindyMessageRows, toCindyMessages, hydrateImageAttachments } from './cindy-message-row.js';
 
 /** Default page size when the controller does not ask for one. */
@@ -383,12 +384,16 @@ export function createMessageReader({
     const entries = [];
     const reasoning = createReasoningStream(sessionId);
     let lastSeq = null;
+    let nativeMetadata = null;
+    let nativeValid = true;
     for (const event of events) {
       if (event === null || typeof event !== 'object') continue;
       // Every event's seq counts, not only the ones that render: contiguity is a
       // property of the log, and a caller comparing against renders would read a
       // gap as "nothing happened here".
+      if (!Number.isSafeInteger(event.seq) || event.seq < 0 || (lastSeq !== null && event.seq !== lastSeq + 1)) nativeValid = false;
       if (Number.isFinite(event.seq)) lastSeq = event.seq;
+      nativeMetadata = advanceInterruptionMetadata(nativeMetadata, event, sessionId);
       reasoning.consume(event);
       const diagnostic = turnDiagnosticRow(event, sessionId);
       if (diagnostic) {
@@ -418,7 +423,7 @@ export function createMessageReader({
         promptClientId: promptRpcIdOf(event),
       });
     }
-    return { entries, lastSeq, reasoning };
+    return { entries, lastSeq, reasoning, nativeValid, nativeMetadata: nativeValid ? nativeMetadata : null };
   }
 
   /** Drop the least recently used transcripts, keeping the window bounded. */
@@ -498,9 +503,9 @@ export function createMessageReader({
         // invalidation also detaches this flight so a post-invalidation read starts
         // fresh; an older completion must never overwrite that newer generation.
         if (seeding.get(sessionId) === flight && !flight.dirty) {
-          touch(sessionId, { rows, reasoning: read.reasoning, seq: read.lastSeq, at: clock });
+          touch(sessionId, { rows, reasoning: read.reasoning, seq: read.lastSeq, at: clock, nativeValid: read.nativeValid, nativeMetadata: read.nativeMetadata });
         }
-        return transcripts.get(sessionId) ?? { rows, reasoning: read.reasoning };
+        return transcripts.get(sessionId) ?? { rows, reasoning: read.reasoning, nativeMetadata: read.nativeMetadata };
       } finally {
         // Failure is not an authoritative empty transcript. Release this flight
         // on success or rejection, without deleting a newer read's ownership.
@@ -552,6 +557,7 @@ export function createMessageReader({
       transcripts.delete(sessionId);
       return false;
     }
+    if (entry.nativeValid !== false) entry.nativeMetadata = advanceInterruptionMetadata(entry.nativeMetadata, event, sessionId);
     entry.seq = seq;
     entry.at = ++clock;
     entry.reasoning.consume(event);
@@ -590,7 +596,7 @@ export function createMessageReader({
   readMessages.count = countRows;
   /** Exact project-grouping evidence derived from the same folded transcript. */
   readMessages.activity = async (sessionId) => {
-    const { rows } = await ensureTranscript(sessionId);
+    const { rows, nativeMetadata } = await ensureTranscript(sessionId);
     let userSendAt = null;
     for (let index = rows.length - 1; index >= 0; index -= 1) {
       const row = rows[index];
@@ -599,7 +605,7 @@ export function createMessageReader({
         break;
       }
     }
-    return { messageCount: rows.length, userSendAt };
+    return { messageCount: rows.length, userSendAt, ...(nativeMetadata ? { interruption: nativeMetadata.interruption } : {}) };
   };
   /**
    * The whole cached transcript, newest first.

package/src/dsh-plugin.js

@@ -3,6 +3,8 @@ import { createRequire } from 'node:module';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { createDshInputDeliveryBackend } from './dsh-input-delivery.js';
+import { diagnosticPreferenceStore } from './diagnostic-presentation.js';
+import { ensureNativeContinuationPlanOff } from './continuation-protocol.js';
 import { DEFAULT_HOST_SETTINGS, SETTINGS_NAMESPACE, validateHostSettings } from './host-settings.js';
 import { DshHostSource } from './dsh-host-source.js';
 import { createSessionControllerSource } from './dsh-session-source.js';
@@ -70,6 +72,7 @@ const HostSettingsSchema = Schema.object({
   deviceId: Schema.string().default(DEFAULT_HOST_SETTINGS.deviceId),
   deviceName: Schema.string().default(DEFAULT_HOST_SETTINGS.deviceName),
   sessionFlags: Schema.dict(SessionFlagSchema).default({}),
+  diagnosticPresentationV1: Schema.dict(Schema.dict(Schema.dict(Schema.dict(Schema.boolean())))).default({}),
 });
 
 /**
@@ -697,8 +700,12 @@ export function buildDshSource(ctx, serviceName, options = {}) {
       getServices: () => ({ ...deliveryServices, fileSystem: ctx.get('fs'), fileUploads: controls.fileUploads }),
       sessionController,
       getSession: (sessionId) => sessionSource.getSession(sessionId),
+      ensurePlanModeOff: ({agent}) => ensureNativeContinuationPlanOff({agent,controller:planModeFor(agent),getService:name=>ctx.get(name)}),
     });
-    const committedRows = (sessionId) => inputDeliveryBackend.available() ? inputDeliveryBackend.readRows(sessionId) : readMessages.all(sessionId);
+    const committedRows = async (sessionId) => {
+      const rows = await (inputDeliveryBackend.available() ? inputDeliveryBackend.readRows(sessionId) : readMessages.all(sessionId));
+      return options.projectMessages?.(rows) ?? rows;
+    };
     const historyView = readMessages === undefined
       ? undefined
       : createHistoryViewController({
@@ -1881,6 +1888,7 @@ export function apply(ctx, config) {
         // Delete/pin and old archive overlays persist here; new archives live in
         // DSH's native workspace registry, not this plugin's settings section.
         persistSessionFlags: sessionFlagsWriter(ctx.settings, settingsNamespace(SETTINGS_NAMESPACE)),
+        diagnosticPreferences: diagnosticPreferenceStore(ctx.settings, settingsNamespace(SETTINGS_NAMESPACE)),
         inputDeliveryDirectory: join(process.env.DSH_PROFILE_DIR || join(process.env.DSH_HOME || join(homedir(), '.dsh'), 'profiles', process.env.DSH_PROFILE || 'desktop'), 'state', 'dsh-cindy-host'),
 
         identityIsCurrent: () => admitted || (!runtimeDisposed && lease()),
@@ -1914,6 +1922,7 @@ export function apply(ctx, config) {
         // Read lazily: the runtime resolves after this seam is built, and the state changes on
         // every turn boundary.
         isSessionRunning: (sessionId) => runtime?.isSessionRunning?.(sessionId) === true,
+        projectMessages: rows => runtime?.projectMessages?.(rows) ?? rows,
         getProjectOrderOwner: () => runtime?.getProjectOrderOwner?.(),
       });
       // The filesystem is a separate service; the controller's file reads are

package/src/dsh-session-source.js

@@ -207,7 +207,7 @@ export function createSessionControllerSource({
       const value = result.value;
       if (!Number.isFinite(value?.messageCount) || value.messageCount < 0) return;
       if (value.userSendAt !== null && typeof value.userSendAt !== 'string') return;
-      const evidence = { messageCount: Math.floor(value.messageCount), userSendAt: value.userSendAt };
+      const evidence = { messageCount: Math.floor(value.messageCount), userSendAt: value.userSendAt, ...(Object.hasOwn(value, 'interruption') ? { interruption: value.interruption } : {}) };
       activityEvidenceCache.set(ids[index], evidence);
       out?.set(ids[index], evidence);
     });
@@ -359,7 +359,7 @@ export function createSessionControllerSource({
           ...(typeof selectedProvider === 'string' && selectedProvider !== '' ? { providerId: selectedProvider } : {}),
           ...(typeof selectedEffort === 'string' && selectedEffort !== '' ? { effort: selectedEffort } : {}),
           ...(currentPermission === undefined ? {} : { permissionMode: currentPermission }),
-          ...(activity === undefined ? {} : { messageCount: activity.messageCount, userSendAt: activity.userSendAt }),
+          ...(activity === undefined ? {} : { messageCount: activity.messageCount, userSendAt: activity.userSendAt, ...(Object.hasOwn(activity, 'interruption') ? { interruption: activity.interruption } : {}) }),
           blank: item.blank === true,
         };
       });

package/src/host-input-delivery.js

@@ -35,7 +35,7 @@ export function createInputDeliveryCoordinator({store,backend,baseProjection=()=
       if((e.phase==='stored'||e.phase==='DSH-pending')&&e.queued){const at=pending.findIndex(p=>p.clientId===e.clientId);if(at<0)pending.push(e.queued);else pending[at]=e.queued;}
     }
     const running=runningBySession.get(sid)??base.turnInProgress;
-    return {...base,...(typeof running==='boolean'?{turnInProgress:running}:{}),sessionId:sid,pendingQueue:pending,steeringQueueClientIds:[...steering],inputDeliveryVersion:1,clearBoundaryMs:store.boundary(sid),deliveryReceipts:ids.map(clientId=>{const e=store.get(sid,clientId);return{clientId,state:e?e.phase==='removed'?'removed':e.phase==='accepted'?'accepted':e.payload===undefined?'unknown':'pending':'unknown'};})};
+    return {...base,...(typeof running==='boolean'?{turnInProgress:running}:{}),sessionId:sid,pendingQueue:pending,steeringQueueClientIds:[...steering],inputDeliveryVersion:1,clearBoundaryMs:store.boundary(sid),deliveryReceipts:ids.map(clientId=>{const e=store.get(sid,clientId);return{clientId,state:e?e.phase==='removed'?'removed':e.phase==='accepted'?'accepted':e.payload===undefined?'unknown':'pending':'unknown',...(e?.removalReason?{reason:e.removalReason}:{})};})};
   }
   async function evidence(sid){
     const proof=await backend.evidence(sid);
@@ -85,7 +85,16 @@ export function createInputDeliveryCoordinator({store,backend,baseProjection=()=
         proof=await evidence(sid);
         const settled=store.get(sid,current.clientId);
         if(!terminal(settled.phase))save({...settled,phase:proof.inbox.some(item=>item.clientId===current.clientId)?'DSH-pending':'claimed',error:null});
-      }catch(error){const e=store.get(sid,current.clientId);if(!terminal(e.phase))save({...e,...(error.deliveryNotAdmitted?{phase:'stored',...(error.deliveryRetryMode?{payload:{...e.payload,mode:error.deliveryRetryMode}}:{}),nextAttemptAt:now()+Math.min(30000,1000*2**Math.min(e.attemptNo??1,5))}:{}),error:String(error?.code??'DELIVERY_ADMISSION_UNCERTAIN')});onError(error);if(error.deliveryNotAdmitted){notify(sid);break;}}
+      }catch(error){const e=store.get(sid,current.clientId);
+        if(error.deliverySuperseded||(error.deliveryNotAdmitted&&error.code==='PLAN_MODE_UNAVAILABLE')){
+          const checked=await evidence(sid);const latest=store.get(sid,current.clientId);
+          if(latest.phase==='accepted')continue;
+          // Fresh native ownership wins over this attempt's early refusal. Never
+          // roll DSH-pending back to stored and accidentally permit re-admission.
+          if(checked.inbox.some(item=>item.clientId===current.clientId)){notify(sid);onError(error);break;}
+          save({...latest,phase:'removed',payload:null,error:error.code,removalReason:error.deliverySuperseded?'continuation-superseded':'continuation-plan-mode-unavailable'});notify(sid);continue;
+        }
+        if(!terminal(e.phase))save({...e,...(error.deliveryNotAdmitted?{phase:'stored',...(error.deliveryRetryMode?{payload:{...e.payload,mode:error.deliveryRetryMode}}:{}),nextAttemptAt:now()+Math.min(30000,1000*2**Math.min(e.attemptNo??1,5))}:{}),error:String(error?.code??'DELIVERY_ADMISSION_UNCERTAIN')});onError(error);if(error.deliveryNotAdmitted){notify(sid);break;}}
       notify(sid);
     }
   }
@@ -115,14 +124,24 @@ export function createInputDeliveryCoordinator({store,backend,baseProjection=()=
         if(row.durableDelivery===true && !hasBoundary)throw deliveryError('INVALID_PARAMS','Durable input requires expectedClearBoundaryMs, including explicit null');
         const expectedBoundary=hasBoundary?options.expectedClearBoundaryMs:store.boundary(sid);
         if(!e && expectedBoundary!==store.boundary(sid))throw deliveryError('REMOTE_OPTIMISTIC_INPUT_CLEARED','REMOTE_OPTIMISTIC_INPUT_CLEARED: input clear boundary changed');
-        const prepared=await backend.prepare(sid,row,options);
+        const refuseContinuation = reason => {
+          const existing=store.get(sid,row.clientId);
+          if(existing?.phase==='removed')return view(sid,[row.clientId]);
+          if(existing)throw deliveryError('INPUT_DELIVERY_CONFLICT','clientId already belongs to an existing input');
+          save({sessionId:sid,clientId:row.clientId,phase:'removed',request:requestShape(row),rawFingerprint:raw,payload:null,queued:null,clearBoundaryMs:store.boundary(sid),createdAt:now(),attemptNo:0,cancelRequested:true,removalReason:reason});
+          notify(sid);return view(sid,[row.clientId]);
+        };
+        let prepared;
+        try{prepared=await backend.prepare(sid,row,options);}catch(error){if(error.code==='CONTINUATION_SUPERSEDED')return refuseContinuation('continuation-superseded');throw error;}
         if(!prepared || prepared.payload===undefined || !prepared.queued)throw deliveryError('DELIVERY_PREPARATION_FAILED','Host did not obtain complete replayable input');
         const {consumed: _transit,mode: _mode,...semanticPayload}=prepared.payload;const fingerprint=inputFingerprint(semanticPayload);e=store.get(sid,row.clientId);
         if(e){if(e.phase==='removed')return view(sid,[row.clientId]);if(e.fingerprint!==fingerprint)throw deliveryError('INPUT_DELIVERY_CONFLICT','clientId already belongs to a different input');return view(sid,[row.clientId]);}
         if(expectedBoundary!==store.boundary(sid))throw deliveryError('REMOTE_OPTIMISTIC_INPUT_CLEARED','REMOTE_OPTIMISTIC_INPUT_CLEARED: input was cleared during preparation');
+        const origin=prepared.payload.continuation;
+        if(origin&&store.list(sid).some(other=>other.clientId!==row.clientId&&other.phase!=='removed'&&other.continuation?.tailId===origin.tailId))return refuseContinuation('continuation-already-submitted');
         const preview=view(sid,[row.clientId]);preview.pendingQueue=[...preview.pendingQueue,prepared.queued];preview.deliveryReceipts=[{clientId:row.clientId,state:'pending'}];
         if(!validateProjection(preview))throw deliveryError('DELIVERY_TOO_LARGE','Input queue projection cannot fit the negotiated transport budget');
-        save({sessionId:sid,clientId:row.clientId,phase:'stored',request:requestShape(row),rawFingerprint:raw,fingerprint,payload:prepared.payload,queued:prepared.queued,clearBoundaryMs:store.boundary(sid),sendAtMs:options.sendAtMs??null,createdAt:now(),attemptNo:0,cancelRequested:false});
+        save({sessionId:sid,clientId:row.clientId,phase:'stored',request:requestShape(row),rawFingerprint:raw,fingerprint,payload:prepared.payload,...(origin?{continuation:origin}:{}),queued:prepared.queued,clearBoundaryMs:store.boundary(sid),sendAtMs:options.sendAtMs??null,createdAt:now(),attemptNo:0,cancelRequested:false});
         notify(sid);schedule(sid);return view(sid,[row.clientId]);
       });
     },

package/src/host-settings.js

@@ -5,7 +5,7 @@ export const SETTINGS_NAMESPACE = 'dsh-cindy-host';
 // Controller-only delete/pin metadata and legacy archive flags survive restart.
 // New archive/unarchive operations persist in DSH's native workspace registry;
 // legacy archived flags are retained until explicitly retired (see `session-flags.js`).
-export const DEFAULT_HOST_SETTINGS = Object.freeze({ transportEnabled: false, remoteControlEnabled: false, controllers: {}, deviceId: '', deviceName: '', sessionFlags: {} });
+export const DEFAULT_HOST_SETTINGS = Object.freeze({ transportEnabled: false, remoteControlEnabled: false, controllers: {}, deviceId: '', deviceName: '', sessionFlags: {}, diagnosticPresentationV1: {} });
 
 /**
  * The Host's own relay identity, when it has one.
@@ -46,6 +46,20 @@ export function validateHostSettings(value) {
   }
   // An absent section is valid — every settings file written before this field
   // existed has none, and rejecting it would fail the load instead of the flag.
+  if (value.diagnosticPresentationV1 !== undefined) {
+    const record = entry => entry !== null && typeof entry === 'object' && !Array.isArray(entry);
+    const data=value.diagnosticPresentationV1;
+    if(!record(data))throw new Error('Invalid diagnostic presentation preferences');
+    for(const sessions of Object.values(data)){
+      if(!record(sessions))throw new Error('Invalid diagnostic owner preferences');
+      for(const kinds of Object.values(sessions)){
+        if(!record(kinds))throw new Error('Invalid diagnostic session preferences');
+        for(const [kind,ids] of Object.entries(kinds)){
+          if(!['errors','interruptions'].includes(kind)||!record(ids)||Object.values(ids).some(flag=>typeof flag!=='boolean'))throw new Error('Invalid diagnostic dismissal preferences');
+        }
+      }
+    }
+  }
   if (value.sessionFlags !== undefined) {
     if (value.sessionFlags === null || typeof value.sessionFlags !== 'object') throw new Error('Invalid session flags');
     for (const [sessionId, flags] of Object.entries(value.sessionFlags)) {

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.35';
+export const HOST_PLUGIN_VERSION = '0.1.36';

package/src/host.js

@@ -37,6 +37,7 @@ import { ProjectionReadModelSink } from './projection-read-model-sink.js';
 import { publishLifecycle, runningStatusEvent, turnEventFor } from './session-publisher.js';
 import { createReasoningPublisher } from './reasoning-publisher.js';
 import { turnDiagnosticRow, turnDiagnosticPayload } from './turn-error.js';
+import { advanceInterruptionMetadata, diagnosticOwner, interruptionFields, projectDismissedErrors } from './diagnostic-presentation.js';
 import { acceptLink } from './host-authorization.js';
 import { AuthorizationPolicy } from './authorization-policy.js';
 import { HostStatus } from './host-status.js';
@@ -374,6 +375,69 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   let reminderObserverSource;
   let reminderObserverPort;
   const sessionMetaWrites = new Map();
+  const interruptionStates = new Map();
+  const nativePresentationMetadata = new Map();
+  const presentationData = () => options.diagnosticPreferences?.snapshot?.() ?? {};
+  const presentationOwner = () => diagnosticOwner(deliveryNamespace, options.inputDeliveryDirectory ?? '');
+  const presentationFields = (sid, running = false, candidate = interruptionStates.get(sid)) => interruptionFields(candidate, running, sessionIsHidden(sid), presentationData(), presentationOwner(), sid);
+  const projectMessages = rows => projectDismissedErrors(rows, presentationData(), presentationOwner());
+
+  async function refreshInterruption(sid, row) {
+    const owner = source; const revision = sourceRevision; const version = turnVersions.get(sid); const connection = generation;
+    const reader = options.resolveCapabilities?.()?.readMessages;
+    if (typeof reader?.turnState !== 'function') return;
+    const state = await reader.turnState(sid);
+    if (stopped || generation !== connection || source !== owner || sourceRevision !== revision || turnVersions.get(sid) !== version || options.resolveCapabilities?.()?.readMessages !== reader) throw Object.assign(new Error('Native session changed; synchronize again'), { code: 'NOT_AVAILABLE' });
+    let live = row;
+    if (typeof owner?.listSessionStates === 'function') {
+      const rows = await owner.listSessionStates(sid); live = rows.find(item => String(item.id) === sid);
+    }
+    if (stopped || generation !== connection || source !== owner || sourceRevision !== revision || turnVersions.get(sid) !== version || options.resolveCapabilities?.()?.readMessages !== reader || !live || typeof live.running !== 'boolean' || (nativeBoundaries.get(sid)?.seq ?? -1) > (state?.seq ?? -1)) throw Object.assign(new Error('Native session state is unavailable'), { code: 'NOT_AVAILABLE' });
+    if (Number.isSafeInteger(state?.boundarySeq)) nativeBoundaries.set(sid, { seq: state.boundarySeq, turn: state.nativeMetadata?.start?.data?.turn });
+    interruptionStates.set(sid, live.running || state?.running ? null : state?.interruption ?? null);
+    if (state?.nativeMetadata) nativePresentationMetadata.set(sid, state.nativeMetadata);
+  }
+
+  async function diagnosticAction(sid, peer, clientId) {
+    const scopeOwner = source; const revision = sourceRevision; const owner = presentationOwner(); const connection = generation;
+    const grant = current?.controllers?.[peer]?.grantRevision;
+    const valid = () => !stopped && active && owner && presentationOwner() === owner && source === scopeOwner && sourceRevision === revision
+      && generation === connection && acceptedControllers.has(peer) && policy.canAccept(peer) && !sessionIsHidden(sid)
+      && current?.controllers?.[peer]?.grantRevision === grant;
+    const requireCurrent = () => { if (!valid()) throw Object.assign(new Error('Diagnostic action scope is unavailable'), { code: 'NOT_AVAILABLE' }); };
+    requireCurrent();
+    const row = await (typeof source.getSession === 'function' ? source.getSession(sid) : source.listSessions().then(rows => rows.find(row => String(row.id) === sid)));
+    requireCurrent(); if (!row) throw Object.assign(new Error('Session does not exist'), { code: 'NOT_FOUND' });
+    const preferences = options.diagnosticPreferences;
+    if (typeof preferences?.commit !== 'function') throw Object.assign(new Error('Durable diagnostic preferences are unavailable'), { code: 'NOT_AVAILABLE' });
+    if (clientId === undefined) {
+      await refreshInterruption(sid, row); requireCurrent();
+      const candidate = interruptionStates.get(sid);
+      if (!candidate) return { ok: true };
+      await preferences.commit({ owner, sessionId: sid, kind: 'interruptions', id: candidate.id }, valid);
+      requireCurrent();
+      // Re-read after persistence; an in-flight old acknowledgement never clears a new interruption.
+      await refreshInterruption(sid, row); requireCurrent();
+      publishRowPatch(sid, presentationFields(sid, isSessionRunningNow(sid)));
+      routeInvoke.invalidateSessionRows();
+      return { ok: true };
+    }
+    const reader = options.resolveCapabilities?.()?.readAllMessages;
+    if (typeof reader !== 'function') throw Object.assign(new Error('Committed message history is unavailable'), { code: 'NOT_AVAILABLE' });
+    const rows = await reader(sid); requireCurrent();
+    const prefix = `${sid}:turn-error:`;
+    const message = rows.find(item => {
+      if (item.sessionId !== sid || item.clientId !== clientId || item.id !== clientId || item.role !== 'error' || typeof item.id !== 'string' || !item.id.startsWith(prefix)) return false;
+      const seq = Number(item.id.slice(prefix.length));
+      return Number.isSafeInteger(seq) && seq >= 0 && item.id === `${prefix}${seq}`;
+    });
+    if (!message) throw Object.assign(new Error('Host error message does not exist'), { code: 'NOT_FOUND' });
+    await preferences.commit({ owner, sessionId: sid, kind: 'errors', id: clientId }, valid); requireCurrent();
+    const [effective] = projectMessages([message]);
+    pushSessionUpdate(sid, 'local-db:messages:created', { sessionId: sid, message: effective });
+    pushHistoryViewChanged(sid);
+    return effective;
+  }
   function serializeSessionMeta(sessionId, operation) {
     const pending = (sessionMetaWrites.get(sessionId) ?? Promise.resolve()).then(operation);
     const settled = pending.then(() => {}, () => {});
@@ -384,7 +448,14 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   function projectSessionRows(rows) {
     const archived = source?.archive?.snapshot(); // Read the native set once per page, not once per row.
     const pinned = source?.archive?.pinSnapshot?.();
-    return sessionFlags.projectAll(rows).map(row => {
+    // Native settings describe can traverse every plugin: read once per page.
+    const data = presentationData(); const owner = presentationOwner();
+    const nativeReader = typeof options.resolveCapabilities?.()?.readMessages?.turnState === 'function';
+    return sessionFlags.projectAll(rows).map(original => {
+      const sid = String(original.id);
+      const native = nativeReader || Object.hasOwn(original, 'interruption');
+      const candidate = interruptionStates.has(sid) ? interruptionStates.get(sid) : original.interruption;
+      const row = native ? { ...original, ...interruptionFields(candidate, original.running === true || isSessionRunningNow(sid), sessionIsHidden(sid), data, owner, sid) } : original;
       if (archived?.has(String(row.id)) === true) {
         return { ...row, status: row.status === 'deleted' ? 'deleted' : 'archived', pinnedAt: null };
       }
@@ -761,6 +832,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     if (source !== next) {
       sourceRevision++;
       nativeBoundaries.clear();
+      interruptionStates.clear();
+      nativePresentationMetadata.clear();
       turnVersions.clear();
       terminalIdentities.clear();
       source?.manualCompact?.cancelAll('DSH source replaced');
@@ -982,6 +1055,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         live = Array.isArray(rows) ? rows.find(row => String(row?.id) === sessionId) : null;
       } else if (typeof owner?.getSession === 'function') live = await owner.getSession(sessionId);
       if (!valid() || !live || typeof live.running !== 'boolean') return;
+      interruptionStates.set(sessionId, live.running || state.running ? null : state.interruption ?? null);
+      if (state.nativeMetadata) nativePresentationMetadata.set(sessionId, state.nativeMetadata);
+      publishRowPatch(sessionId, presentationFields(sessionId, live.running));
       if (live.running) {
         setCachedRunning(sessionId, true);
         const payload = { sessionId, event: runningStatusEvent(state.retryNotice?.content ?? 'running') };
@@ -994,8 +1070,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       // No await after the final guard: a new boundary cannot interleave with send.
       setCachedRunning(sessionId, false);
       const diagnostic = state.error ?? state.notice;
-      const payload = diagnostic ? turnDiagnosticPayload(diagnostic) : { sessionId, event: { type: 'done' } };
-      sendNativeTerminal(deviceId, sessionId, payload, `end:${state.boundarySeq}`, diagnostic);
+      const [effective] = diagnostic ? projectMessages([diagnostic]) : [];
+      const payload = effective ? turnDiagnosticPayload(effective) : { sessionId, event: { type: 'done' } };
+      sendNativeTerminal(deviceId, sessionId, payload, `end:${state.boundarySeq}`, effective);
     } catch {
       if (!valid()) return;
       // Never reflect arbitrary upstream exception prose into remote diagnostics.
@@ -1444,6 +1521,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * chip instead of the picture.
    */
   async function pushSessionMessage(sessionId, message) {
+    [message] = projectMessages([message]);
     if (message?.role === 'user' && activeDelivery?.owns(sessionId, message.clientId)) {
       await new Promise(resolve => queueMicrotask(resolve));
       const proof = await activeDelivery.projection(sessionId, { deliveryClientIds: [message.clientId] });
@@ -1546,6 +1624,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         ? await source.getSession(sessionId)
         : (await source.listSessions()).find((candidate) => String(candidate.id) === sessionId);
       if (row == null) return undefined;
+      await refreshInterruption(sessionId, row);
       const [flagged] = projectSessionRows([row]);
       if (flagged !== undefined) sessionRowCache.set(String(flagged.id), flagged);
       return flagged;
@@ -1692,6 +1771,10 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       // the phone reaches any other screen watching the same session.
       pushGoalStatus: (sessionId, status) => pushSessionUpdate(sessionId, 'maker:goal:status-changed', { sessionId, goal: status }),
       ...provided,
+      ackInterrupted: (sid, peer) => diagnosticAction(sid, peer),
+      dismissError: (sid, cid, peer) => diagnosticAction(sid, peer, cid),
+      ...(typeof provided.readMessages === 'function' ? { readMessages: async (...args) => projectMessages(await provided.readMessages(...args)) } : {}),
+      ...(typeof provided.readAllMessages === 'function' ? { readAllMessages: async (...args) => projectMessages(await provided.readAllMessages(...args)) } : {}),
       /**
        * The plugin's send seam, carrying this Host's media access.
        *
@@ -1823,7 +1906,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       for (const deviceId of sessionSubscribers.get(sessionId) ?? []) void restoreWatchedTurnState(deviceId, sessionId);
       return;
     }
-    const diagnostic = turnDiagnosticRow(event, sessionId);
+    const rawDiagnostic = turnDiagnosticRow(event, sessionId);
+    const diagnostic = rawDiagnostic ? projectMessages([rawDiagnostic])[0] : null;
     const requiresNotice = diagnostic !== null || ['error', 'interrupted', 'max-tokens', 'aborted', 'blocked'].includes(event?.data?.reason?.kind);
     if (requiresNotice && !diagnostic) {
       recordHandlerError('turn-error', new Error('Invalid native failed-turn identity; history resynchronization required'));
@@ -1835,6 +1919,15 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       nativeBoundaries.set(sessionId, { seq: event.seq, turn: event.data?.turn });
     }
     turnVersions.set(sessionId, (turnVersions.get(sessionId) ?? 0) + 1);
+    if (event) {
+      const meta = advanceInterruptionMetadata(nativePresentationMetadata.get(sessionId), event, sessionId);
+      nativePresentationMetadata.set(sessionId, meta); interruptionStates.set(sessionId, meta.interruption);
+      if (event.data?.reason?.kind === 'interrupted' && !meta.start) {
+        interruptionStates.delete(sessionId);
+        void refreshInterruption(sessionId, sessionRowFor(sessionId)).then(() => publishRowPatch(sessionId, presentationFields(sessionId, isSessionRunningNow(sessionId))))
+          .catch(error => recordHandlerError('interruption-metadata', error));
+      }
+    }
     const timer = pendingReconciles.get(sessionId);
     if (timer !== undefined) {
       pendingReconciles.delete(sessionId);
@@ -1912,7 +2005,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    * @param running - the turn state DSH just reported.
    */
   function publishRowTurnState(sessionId, running) {
-    publishRowPatch(sessionId, { running, updatedAt: now().toISOString() });
+    publishRowPatch(sessionId, { running, ...presentationFields(sessionId, running), updatedAt: now().toISOString() });
   }
 
   /**
@@ -1931,7 +2024,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     for (const deviceId of sessionSubscribers.get(sessionId) ?? []) devices.add(deviceId);
     recordPush(sessionId, 'local-db:sessions:patched', devices.size, payload);
     if (devices.size === 0) return;
-    for (const dst of devices) send({ v: PROTOCOL_VERSION, kind: 'push', dst, payload: { channel: 'local-db:sessions:patched', payload } });
+    for (const dst of devices) if (acceptedControllers.has(dst) && policy.canAccept(dst)) send({ v: PROTOCOL_VERSION, kind: 'push', dst, payload: { channel: 'local-db:sessions:patched', payload } });
   }
 
   /**
@@ -2010,6 +2103,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       nativeBoundaries.set(sessionId, { seq: event.seq, turn: event.data?.turn });
     }
     turnVersions.set(sessionId, (turnVersions.get(sessionId) ?? 0) + 1);
+    interruptionStates.set(sessionId, null);
+    if (event) nativePresentationMetadata.set(sessionId, advanceInterruptionMetadata(nativePresentationMetadata.get(sessionId), event, sessionId));
     setCachedRunning(sessionId, true);
     pushSessionUpdate(sessionId, 'maker:event', { sessionId, event: runningStatusEvent() });
     publishRowTurnState(sessionId, true);
@@ -2651,6 +2746,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     sessionSubscribers.clear();
     liveTurnState.clear();
     nativeBoundaries.clear();
+    interruptionStates.clear();
+    nativePresentationMetadata.clear();
     turnVersions.clear();
     terminalIdentities.clear();
     subscriptionLeases.clear();
@@ -2851,6 +2948,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     }),
     /** Push one live session message to the controllers watching that session. */
     pushSessionMessage,
+    projectMessages,
     pushSessionReasoning: reasoningPublisher.noteEvent,
     // Only explicit native scheduled/started retry events assert ongoing work.
     // Failed attempts alone never terminate or start a turn.

package/src/turn-error.js

@@ -1,4 +1,5 @@
 /** Display-only native turn diagnostics. DSH owns failure, recovery and retry policy. */
+import { advanceInterruptionMetadata } from './diagnostic-presentation.js';
 const SAFE_MESSAGES = new Map([
   ['AUTH', 'Model authentication failed. Check the provider configuration.'],
   ['ACCOUNT_SIGNED_OUT', '任务已因退出 DeepSeek 登录而停止。'],
@@ -92,6 +93,7 @@ export function turnDiagnosticRow(event, sessionId) {
 
 /** Notices close the running flag without pretending cancellation is a model failure. */
 export function turnDiagnosticPayload(row) {
+  if (row.role === 'error' && row.content?.dismissed === true) return { sessionId: row.sessionId, persistId: row.clientId, event: { type: 'done', data: { reason: 'dsh-dismissed-error' } } };
   return row.role === 'error' ? turnErrorPayload(row) : { sessionId: row.sessionId, persistId: row.clientId,
     event: { type: 'done', data: { message: row.content, reason: 'dsh-turn-notice' } } };
 }
@@ -100,6 +102,7 @@ export function turnDiagnosticPayload(row) {
 export function turnStateFromEvents(events, sessionId) {
   if (!Array.isArray(events)) throw new TypeError('Native turn recovery requires a session event snapshot');
   let boundary = null;
+  let nativeMetadata = null;
   let retryNotice = null;
   let seq = -1;
   for (const event of events) {
@@ -108,17 +111,18 @@ export function turnStateFromEvents(events, sessionId) {
       throw new TypeError('Native turn recovery requires ordered unique event sequences');
     }
     seq = event.seq;
+    nativeMetadata = advanceInterruptionMetadata(nativeMetadata, event, sessionId);
     if (event.type === 'turn/start' || event.type === 'turn/end') { boundary = event; retryNotice = null; }
     else if (['step/start', 'assistant/message'].includes(event.type)) retryNotice = null;
     else if (boundary?.type === 'turn/start' && boundary.data?.turn === event.data?.turn
       && ['llm/retry', 'llm/retry-started'].includes(event.type)) retryNotice = turnDiagnosticRow(event, sessionId);
   }
   if (!boundary) return null;
-  if (boundary.type === 'turn/start') return { seq, boundarySeq: boundary.seq, running: true, error: null, ...(retryNotice ? { retryNotice } : {}) };
+  if (boundary.type === 'turn/start') return { seq, boundarySeq: boundary.seq, running: true, error: null, nativeMetadata, ...(retryNotice ? { retryNotice } : {}) };
   const diagnostic = turnDiagnosticRow(boundary, sessionId);
   const error = diagnostic?.role === 'error' ? diagnostic : null;
   // A malformed failure is not evidence of a successful ending.
   if (boundary.data?.reason?.kind === 'error' && !error) throw new TypeError('Invalid native failed-turn identity');
   if (['interrupted', 'max-tokens', 'blocked', 'aborted'].includes(boundary.data?.reason?.kind) && !diagnostic) throw new TypeError('Invalid native turn-notice identity');
-  return { seq, boundarySeq: boundary.seq, running: false, error, ...(diagnostic?.role === 'system' ? { notice: diagnostic } : {}) };
+  return { seq, boundarySeq: boundary.seq, running: false, error, nativeMetadata, interruption: nativeMetadata?.interruption ?? null, ...(diagnostic?.role === 'system' ? { notice: diagnostic } : {}) };
 }