dsh-codex-style-computer-use 1.2.1 → 1.3.0

package/lib/index.js

@@ -1,3 +1,4 @@
+import { installApprovalAttribution } from './approval-attribution.js'
 import { installHumanAttention } from './attention.js'
 // dsh-computer-use — DSH Cordis plugin
 //
@@ -36,23 +37,10 @@ import { installToolExposure, ACTIVATION_TOOL } from './exposure.js'
 import { scopeOf } from '@deepseek-ai/dsh-scope'
 import { createCycleGate, agentKeyOf } from './cycle.js'
 import { recoveryProblem } from './recovery.js'
+import { createCycleLifecycle } from './cycle-lifecycle.js'
+import { createTerminalCleanup } from './terminal-cleanup.js'
 import fs from 'node:fs'
 
-/**
- * Record the turn-end decision path where it can be INSPECTED AFTER THE FACT.
- *
- * The human asked twice "我还是没亲眼看到触发", and there is no way to read the host's own log from
- * here — so a feature whose whole job is to make itself visible had no way to be debugged. Both
- * outcomes are recorded, because "it did not fire" is the answer that actually needs a reason.
- * A diagnostic that can throw would be worse than none: it must never break a turn.
- */
-function diagTurnEnd (what) {
-  try {
-    const p = path.join(os.homedir(), '.dsh', 'data', 'computer-use', 'turn-end-diag.log')
-    fs.appendFileSync(p, `${new Date().toISOString()} ${what}\n`)
-  } catch { /* never break the turn for a log line */ }
-}
-
 /**
  * Build a REAL user message for `agent.steer()` / `agent.inject()`.
  *
@@ -114,10 +102,6 @@ import { fileURLToPath } from 'node:url'
 // never capturing it early — so a `ctx.inject(['userQuestions'], …)` callback that lands after this
 // module was applied is still picked up.
 let asker = null
-let agents = null
-// The verified Desktop-raiser, handed out by `enableHumanAttention` (see the return there). Used by
-// the turn-end decision card: a card the human never sees is the same as no card.
-let raiseHuman = null
 
 /**
  * Put ONE question on the shared client-UI card and wait for the human, with no countdown.
@@ -412,23 +396,11 @@ export const Config = Schema.object({
   annotateMarks: Schema.boolean().default(true).description('draw SoM boxes on screenshots'),
   // Compatibility with saved settings only. Elapsed time never ends a computer-use cycle.
   calmAfterMs: Schema.number().default(0).description('legacy setting; ignored — computer-use cycles have no idle timeout'),
-  // ---- WHAT THE 60 s TIMER DOES WHEN NOBODY ANSWERS (2026-09-15, the human's own design words) -------
-  // "如果60s没回复，超时之后自动进行分支判断，是否必须终结还是按照你自己的理解继续" — the timer is meant
-  // to BRANCH, not just stop. The shipped code implemented only the stop half and said so in a comment;
-  // the human asked why. It is a setting because the judgement is theirs to set up ONCE, rather than the
-  // agent improvising it at every timeout.
-  //   'stop'      — the timer makes NO decision: the machine stays with the human, the cycle stays open.
-  //   'recommended' — the timer executes the choice the CARD DECLARED as its recommendation. Note this is
-  //                   a judgement about the AGENT's next turn, never about the machine: it does not close
-  //                   the cycle and it does not release a human's brake.
-  // WHETHER THERE IS A RECOMMENDATION IS NOT CONFIGURED — IT IS READ FROM THE TASK (2026-09-15).
-  // A `turnEndAutoContinueMax` counter existed here for one revision; the human rejected it ("由且仅由问题
-  // 任务的情形决定，而不是几次 … 不应该这样硬编码设计"). The branch is now decided per turn by whether a real
-  // actuation reached the worker in that turn (see `turnSituation`), so there is no budget to configure.
+  // Compatibility with saved settings; automatic completion has no question or timer.
   turnEndTimeoutAction: Schema.union([
-    Schema.const('stop').description('no decision — wait for the human (default)'),
-    Schema.const('recommended').description('execute the recommendation the card declared'),
-  ]).default('stop').description('what the 60 s turn-end timer does when nobody answers'),
+    Schema.const('stop').description('legacy value; ignored'),
+    Schema.const('recommended').description('legacy value; ignored'),
+  ]).default('stop').description('legacy setting; ignored — ordinary completion releases computer use automatically'),
 })
 
 export function apply (ctx, config) {
@@ -438,41 +410,17 @@ export function apply (ctx, config) {
     return
   }
   if (!config.enabled) return
+  installApprovalAttribution(ctx, log)
   registerBundledSkill(ctx, log)
-  raiseHuman = enableHumanAttention(ctx, log)
+  enableHumanAttention(ctx, log)
   // THE QUESTION SERVICE, INJECTED LAZILY (merge-design.md §5.3 item 16 — defence in depth).
   // `inject` above already guarantees the service before `apply` runs; going through `ctx.inject` as
   // well means the tool does not depend on which of the two orderings the host happened to pick, and
   // that a service arriving later still lands. `enableHumanAttention` uses the same pattern for
   // `desktopRuntime` just above.
-  // `agents` IS READ NON-FATALLY, AND DELIBERATELY NOT IN THE INJECT LIST (review finding 4, 2026-09-15).
-  // Cordis semantics, verified in the library (`cordis/lib/index.js:1316-1328` `_refresh` → `_setEpoch`)
-  // and `Inject.resolve` (:1490-1498): a service listed in `inject` that is NOT available leaves the
-  // fiber's epoch INACTIVE and the callback NEVER RUNS — no call, no `undefined`, no error. Listing
-  // `agents` there would therefore couple the PRE-EXISTING `computer_ask` (which needs only
-  // `userQuestions`) to an unrelated service: one row-level override that disables the agents
-  // registry would silently leave `asker` null and make a working tool throw. Both services ship in
-  // the same base bundle today, so that is a hazard rather than a live break — and it is free to
-  // remove. `ctx.get` reads a service without declaring it (`cordis/lib/index.js:754-764`), which is
-  // exactly the "use it if it is there" this needs; the resolver degrades honestly without it.
   ctx.inject(['userQuestions'], (qctx) => {
     asker = qctx.userQuestions
-    agents = qctx.get('agents')
     if (!asker || typeof asker.ask !== 'function') log.warn('userQuestions injected but exposes no ask() — computer_ask cannot put a question on the card')
-    if (!agents || typeof agents.roots !== 'function') log.warn('agents registry unavailable — a turn-end card cannot verify its caller; it will log the refusal instead of raising a card in the wrong chat')
-  })
-  // ---- AND A SECOND, INDEPENDENT INJECTION FOR THE REGISTRY (review re-audit E1, 2026-09-15) --------
-  // `ctx.get('agents')` above is evaluated ONCE, when the userQuestions callback runs. If the registry
-  // was not active at that instant — dsh-base mounts `user-questions` before `agent`
-  // (`dsh-base/cordis.patch.yml:64` vs `:67`), so the ordering is a race this plugin does not control —
-  // or if it is re-registered later (plugin reload, a row re-enabled from the plugins UI), `agents`
-  // would stay null for the process lifetime and EVERY turn-end card would be refused silently.
-  // This assignment-only injection self-heals that: when the registry appears, cordis runs this
-  // callback and `agents` is set. It CANNOT hurt `asker`, because a listed service that never appears
-  // simply leaves this fiber's callback unrun — the coupling finding 4 was about is not reintroduced.
-  ctx.inject(['agents'], (actx) => {
-    agents = actx.agents
-    log.info('agents registry became available — turn-end cards can verify their caller')
   })
 
   // settings card (restart-applies) — same shape dsh-pocket/dsh-browser use
@@ -513,93 +461,6 @@ export function apply (ctx, config) {
     if (k) return String(k)
     return '<' + ((s.constructor && s.constructor.name) || typeof s) + '>'
   }
-  // ---- THE AGENT EVERY QUESTION MUST NAME (2026-09-15) -----------------------------------------
-  // MEASURED FAILURE, not a theory. The turn-end card was dispatched and the host answered
-  //   22:57:16.836  turn-end card: NO ANSWER (NO_PROVIDER) — nothing steered, no choice was made
-  // and no card was ever rendered — while the raiser itself worked fine (two seconds later it logged
-  // "Desktop already in front for pending question (1 question(s): computer_use_turn_end)").
-  //
-  // CAUSE (`@deepseek-ai/dsh-api-remotes/lib/index.js:115-124`): the remote forwarder that carries a
-  // question to the browser's card is a WATERFALL listener that begins
-  //     const carrierAgent = carrierKeyOf(this); if (carrierAgent === void 0) return next();
-  // so an agent-LESS request is never forwarded to the client's answerer
-  // (`dsh-client-ui-user-questions/lib/client.js:880`). Nobody accepts, and the service rejects with
-  // NO_PROVIDER. `dsh-user-questions/README.zh.md:41` says the same thing in words: "Web 回答者只接收带
-  // Agent scope 的请求；不含 agent 的程序化请求仍会交给本地未限定 scope 的 waterfall listener，若无人
-  // 接受则以 NO_PROVIDER 失败." The host's own `ask_user_question` always passes `agent: exec.agent`.
-  //
-  // WHY NOT SIMPLY PASS `bus.agent`: `ask()` validates it (`lib/index.js:56-60`) — it must be the
-  // registry's EXACT live instance (`agents.get(a.id) === a`, else CALLER_NOT_LIVE) AND a live ROOT
-  // (`agents.roots().includes(a)`, else DELEGATED_CALLER). `bus.agent` is the last tool caller, which
-  // is right in practice but unverified, and a wrong agent fails in exactly the same silent way this
-  // whole bug did. So the caller is verified FIRST and only replaced when the registry disapproves —
-  // and every replacement is logged, so a fallback can never masquerade as the normal path.
-  //
-  // "LIVE ROOT" IS NOT ENOUGH — IT MUST BE THE ROOT OF THIS SESSION (found by RUNNING this function,
-  // 2026-09-15, not by reading it). Liveness and rootness say nothing about WHICH chat the card is
-  // for: another session's live root passed both checks and was returned as `verified`, so a turn that
-  // ended in THIS chat could raise its card in another one. `session` is therefore part of the test,
-  // and a candidate that is a live root of some OTHER session is treated as rejected — never adopted
-  // merely because the registry does not object.
-  const rootAgentFor = (session, candidate) => {
-    try {
-      if (!agents || typeof agents.roots !== 'function') return { agent: candidate, ask: false, reason: 'no-registry' }
-      const roots = agents.roots()
-      const live = (a) => !!a && !!agents.get && agents.get(a.id) === a
-      const ofSession = (a) => !!a && session !== null && session !== undefined &&
-        sameSession(a.session || a.sessionId, session)
-      const isRoot = (a) => !!a && roots.includes(a)
-      // ---- EXACTLY ONE ROOT OWNS THIS SESSION; THAT ROOT IS THE CORRECT CALLER ------------------
-      // `roots()` is store-derived, so a fresh lookup cannot be stale; re-running `live` keeps the
-      // "exact live instance" guarantee explicit rather than inferred from the filter.
-      const same = roots.filter(ofSession)
-      if (live(candidate) && isRoot(candidate) && ofSession(candidate)) {
-        return { agent: candidate, ask: true, reason: 'verified' }
-      }
-      if (same.length === 1 && live(same[0])) {
-        return { agent: same[0], ask: true, reason: live(candidate) && isRoot(candidate) ? 'other-session-root' : 'registry-root-by-session' }
-      }
-      // ---- NOTHING VERIFIED: SAY SO, AND DO NOT LET THE CALLER ASK WITH THIS AGENT ---------------
-      // `ask:false` IS THE FIX, NOT A LABEL (review finding 2, 2026-09-15). The previous version
-      // returned the raw candidate here with `verified` withheld — but `ask()` accepts a live root of
-      // ANY session, so the card was raised in the WRONG CHAT. And a same-name note could not carry
-      // the distinction: 'other-session-root' is also the CORRECT substitution just above. So the
-      // decision travels as its own boolean, and `ask` remains a value only for the message.
-      let reason
-      if (live(candidate) && isRoot(candidate)) reason = 'other-session-root'
-      else if (!candidate) reason = 'no-candidate'
-      else if (!live(candidate)) reason = 'not-live-instance'
-      else if (!isRoot(candidate)) reason = 'not-a-root'
-      else reason = 'session-mismatch'
-      return { agent: candidate, ask: false, reason: `${reason}/roots=${roots.length}/match=${same.length}` }
-    } catch (e) {
-      return { agent: candidate, ask: false, reason: 'resolve-threw:' + ((e && e.message) || 'unknown') }
-    }
-  }
-
-  // ---- THE "CARD LOOP" HAD A DIFFERENT CAUSE, AND A SUPPRESSION FLAG WAS THE WRONG FIX -----------
-  // Measured at 23:22: selecting 继续 produced the card again 2 s later, and again 5 s after that, until
-  // the human cancelled it (`NO ANSWER (ASK_CANCELLED)`). A `suppressCardForTurn` flag was added for
-  // that — and the re-audit showed it was BACKWARDS, from the turn-end diagnostic file:
-  //
-  //   15:22:12.724Z CARD … ask=yes via=verified        ← the card the human answered
-  //   15:22:23.039  TypeError … reading 'kind'          ← the steer's bare object crashed the round
-  //   15:22:23.048Z FIRED kind=error / CARD …           ← 10 ms later — an ERRORED turn, not a new one
-  //   15:22:30.588Z FIRED kind=error / CARD …
-  //
-  // There was never an echo: 继续 → crash → the turn ended as `kind=error` → a card for the errored turn.
-  // The flag could not have suppressed that anyway — `steer` wakes the driver, the loop appends
-  // `turn/start` immediately, and the `turn/start` handler cleared the flag before the card ever read it.
-  // So it suppressed the case it was not meant to touch (a normal card-steered turn, where the human DOES
-  // want to be asked) and could never fire for the case that actually looped. It is REMOVED rather than
-  // repaired: the driver of that loop was the message-shape crash, and that is fixed at its source.
-  //
-  // WHAT DOES REMAIN TRUE: an errored turn raises the same decision card. That is deliberate — the human
-  // should still decide what happens to the machine — but the card now SAYS the turn errored, so it is
-  // not mistaken for an ordinary completion.
-  // THERE IS NO machine-wide suppression flag here. If a future measurement shows a genuine echo, it must
-  // be bound to (sessionKey, turn) and justified by evidence of that shape — not by this one.
-
   let inFlight = 0
   // Ctrl+Alt+Q cancels the turn ON PURPOSE. The abort that follows must never be mistaken for
   // the human hitting the stop button — that rule below re-armed the brake and left the red
@@ -681,6 +542,7 @@ export function apply (ctx, config) {
     return gate.claim({ session: s, agent: exec && exec.agent })
   }
 
+  const callOwners = new WeakMap()
   const ensureCycle = async (exec) => {
     const cl = claimOf(exec)
     // `gate.open` RESERVES ownership synchronously and THROWS for a foreign claim, so reaching the
@@ -707,6 +569,7 @@ export function apply (ctx, config) {
       log.warn('a computer-use exit record is still present after resume — a newer exit stands; the call that follows will be refused')
       return { opened: false, reason: 'a newer exit record stands' }
     })
+    if (exec && typeof exec === 'object') callOwners.set(exec, { claim: cl, cycleId: gate.snapshot().id })
     // THE MACHINE'S MAILBOX BELONGS TO THE OWNER (integration bug, 2026-09-13). Binding it in
     // `tools/pre-execute` meant EVERY caller rebound it — including one the gate was about to refuse
     // as foreign — so a Ctrl+Alt+Q could cancel the wrong session while the real owner kept working
@@ -719,125 +582,40 @@ export function apply (ctx, config) {
     return pending
   }
 
-  // Keep only in-flight accounting for owner lifecycle events. No idle timer: approval waits,
-  // thinking, and pauses keep the cycle until an explicit lifecycle event ends it.
-  // ---- WHAT THE CARD RECOMMENDS, AND WHAT THE TIMER THEREFORE DOES (2026-09-15) ---------------------
-  // ONE place decides both, so the card's text and the timer's behaviour cannot disagree — which is the
-  // defect the human caught: the card promised "I will not start an unattended turn" while the design
-  // words they remembered promised a branch.
-  //
-  // ---- AND THE BRANCH IS DECIDED BY THE TASK SITUATION, NOT BY A COUNTER ---------------------------
-  // The first implementation capped consecutive automatic continuations with a config number (default 2).
-  // The human rejected that design in one sentence: "由且仅由问题任务的情形决定，而不是几次。你现在刚我说
-  // 是两次，不应该这样硬编码设计." They are right, and the counter also solved the wrong problem: it rationed
-  // the TIMER, when what decides the branch is whether the work is still going.
-  //
-  // SO THE SITUATION IS READ FROM THE TASK, ONCE PER TURN:
-  //   * `turnSituation.action = true` — an actuation really reached the worker during this turn, so the task
-  //     was mid-motion when the turn ended. There IS somewhere to continue to.
-  //   * nothing was dispatched — the turn was observation, an error, or a wrap-up. There is nothing to
-  //     continue TO, so the timer makes no decision. That is the human's own rule, not a cap.
-  // It is written by the `onDispatch` hook (see `hooks`), which fires at the last statement before the tool
-  // body in `tools.js` — after every refusal has thrown — so "dispatched" is a fact, not an intention.
-  //
-  // ---- AND IT BELONGS TO ONE SESSION, NOT TO THE MACHINE (2026-09-16) ------------------------------
-  // `turn/start` is a HOST-WIDE event, so a turn starting in another chat would clear this value — and the
-  // mirror case is worse: chat A drives the machine, chat B starts a turn, chat A's turn ends, and A's card
-  // carries a recommendation read from a machine-wide flag. `owner` names the session the situation
-  // describes, and the timer only trusts it for that session.
-  //
-  // DECLARED BEFORE `hooks` ON PURPOSE: `hooks.onDispatch` closes over this object, and a body that reads a
-  // `const` from its temporal dead zone is a run-time error waiting for the first driving call.
-  const RECOMMEND_CONTINUE = '继续（按你自己的理解接着干）'
-  const RECOMMEND_STOP = null   // "no recommendation" is the honest value when the task says nothing
-  const turnSituation = { action: false, reason: '(no actuation reached the worker this turn)', owner: null, seq: [] }
-  /** Does the recorded situation describe THIS session's turn? */
-  const situationIsMine = (session) => !!turnSituation.owner && turnSituation.owner === sessionKey(session)
-
-  // ---- THE STAGNATION SIGNATURE: A COMPARISON, NOT A COUNT (2026-09-16) -----------------------------
-  // The human rejected a counter ("由且仅由问题任务的情形决定，而不是几次"). The remaining risk is a task that
-  // drives on EVERY turn — a poll or retry loop — which no situation gate can stop, because each turn does
-  // something. So the guard is a COMPARISON between two situations:
-  //   * `lastDrive` is the tool sequence that justified the last automatic continuation;
-  //   * if the next turn's sequence is IDENTICAL and the human has not answered in between, continuing is
-  //     not progress — the same thing was done again — so the timer stops and says so.
-  // It accumulates nothing, hardcodes no number, and any real progress changes the sequence. Its honest
-  // weakness: a task that legitimately repeats one identical step would stop one iteration early — which
-  // is the conservative direction, because the card is still raised and the human decides.
-  
-  let lastDrive = null          // { seq: string[] } — the sequence behind the last timer-driven continuation
-  let humanAnsweredSince = false
-  // ---- AND THE OBSERVATION-ONLY CASE (point 2, 2026-09-16) -----------------------------------------
-  // A turn that only looked (a screenshot, a UIA read) has no dispatch, so the situation gate above said
-  // "no recommendation" even when the work was plainly mid-task. `lastTurnDrove` carries the previous turn's
-  // state forward for exactly one turn: an observation turn that FOLLOWS a driving turn is still mid-task,
-  // so it may recommend once — and if the agent then keeps observing without driving, the same similarity
-  // check stops it (the sequence would repeat).
-  let lastTurnDrove = false
-  const stalledNow = (session) => !!lastDrive && !humanAnsweredSince && situationIsMine(session) &&
-    lastDrive.seq.length > 0 && lastDrive.seq.join('>') === turnSituation.seq.join('>')
-  /** Record the situation that justified a continuation, so the NEXT identical one can be recognised. */
-  const noteDrive = () => { lastDrive = { seq: [...turnSituation.seq] } }
-
-  const recommendContinueNow = (kind, session) => {
-    if (config.turnEndTimeoutAction !== 'recommended') return RECOMMEND_STOP
-    if ((kind || 'completed') !== 'completed') return RECOMMEND_STOP   // an errored turn is never continued
-    if (cu.stopped || brakeLatch()) return RECOMMEND_STOP             // a brake outranks a timer
-    // A SITUATION THAT DOES NOT BELONG TO THIS TURN IS NO SITUATION: without this, an actuation in another
-    // chat could recommend continuing in this one.
-    if (!situationIsMine(session)) return RECOMMEND_STOP
-    if (turnSituation.action) return continueOrStop(session)
-    // Observation-only turn: still mid-task if the PREVIOUS turn drove, and only when that situation is not
-    // itself a repetition of what the last automatic continuation already acted on.
-    if (lastTurnDrove && turnSituation.seq.length > 0) return continueOrStop(session)
-    return RECOMMEND_STOP
-  }
-  /**
-   * The ONE mapping from "there is work to continue" to the recommendation. The polarity lives here and
-   * nowhere else: an inverted ternary at a call site would continue exactly when the task did nothing, and
-   * the reviewer showed that regression can keep every other assertion green.
-   */
-  const continueOrStop = (session) => (stalledNow(session) ? RECOMMEND_STOP : RECOMMEND_CONTINUE)
-  /** Why the recommendation came out the way it did — for the log, which must not have to guess. */
-  const recommendationReason = (session) => {
-    if (stalledNow(session)) return '(the same sequence of tools was already continued for — repeating it is not progress)'
-    if (turnSituation.action) return turnSituation.reason
-    if (lastTurnDrove && turnSituation.seq.length > 0) return `(the previous turn drove the machine and this one only observed: ${turnSituation.seq.join('>')})`
-    return turnSituation.reason
-  }
+  const lifecycle = createCycleLifecycle({
+    gate, cu, claimOf, owner: () => ({ session: bus.driverSession, agent: bus.agent }),
+    paused: pausedOrAsking, inFlight: () => inFlight,
+    ownershipOf: exec => exec && typeof exec === 'object' ? callOwners.get(exec) : null,
+  })
+  cu.on('handoff', () => {
+    lifecycle.settle()?.catch(error => log.warn(`computer-use handback completion failed: ${error.message}`))
+  })
 
+  const terminalCleanup = createTerminalCleanup({
+    gate, cu, claimOf, owner: () => ({ session: bus.driverSession, agent: bus.agent }),
+    paused: pausedOrAsking, report: error => log.warn(`computer-use terminal cleanup failed: ${error.message}`),
+  })
   const hooks = {
-    // ---- THE TASK SITUATION IS WRITTEN AT THE DISPATCH DOOR, NOT AT THE POLICY DOOR (2026-09-16) -----
-    // `tools/pre-execute` runs BEFORE every refusal — the ownership verdict, the voided opening, the
-    // cancellation, and the policy/brake gates inside `reg`. Marking the situation there meant a call that
-    // was denied or refused could claim the task was in motion (and, worse in the other direction, a
-    // HIGH-RISK actuation the human had just APPROVED looks like `kind: 'ask'` at the policy door, so the
-    // timer would silently never recommend exactly when a dangerous action had just been authorised).
-    // `tools.js` calls this immediately before `inner(args, exec)` — the last statement before the tool
-    // body, after every refusal has already thrown. So this is the one place where "it was dispatched" is
-    // a fact rather than an intention, which is what the recommendation is supposed to rest on.
-    onDispatch: (exec) => {
-      try {
-        if (!exec || typeof exec.name !== 'string' || !exec.name.startsWith('computer_')) return
-        // ---- EVERY computer_* DISPATCH IS RECORDED, AND THIS LINE WAS MISSING (defect, 2026-09-16) -----
-        // The comment that used to sit here claimed "observation calls are recorded too". The code did the
-        // opposite: it returned early for a non-driving call, so `seq` held DRIVING calls only. Two
-        // consequences, both silent:
-        //   * the observation-only rule in `recommendContinueNow` (`lastTurnDrove && seq.length > 0`) could
-        //     never fire — `seq` was empty by construction on exactly the turn it was written for, so the
-        //     feature was dead code that read as working;
-        //   * `seq` could not serve as "this turn touched the machine at all", which is the fact the
-        //     turn-end gate now needs (a billed, immediately-failing turn must not raise a card).
-        // `seq` is the turn's SIGNATURE (which tools ran, in order); `action` stays the narrower claim
-        // (something was ACTUATED) because the recommendation's honesty rests on that distinction.
-        turnSituation.seq.push(`${exec.name}`)
-        if (!isDrivingCall(exec.name, exec.arguments || {})) return
-        turnSituation.action = true
-        turnSituation.reason = `(${exec.name} actuated the machine during this turn)`
-      } catch { /* a recommendation must never break a dispatch */ }
+    assertOwnership: (exec) => {
+      const owner = exec && typeof exec === 'object' ? callOwners.get(exec) : null
+      if (!owner) {
+        const error = new Error('COMPUTER_OWNER_REQUIRED: this call has no computer-use ownership claim; no input was dispatched.')
+        error.code = 'COMPUTER_OWNER_REQUIRED'; error.outcome = 'not-dispatched'; error.dshCycleRefusal = true
+        throw error
+      }
+      gate.assertOwnership(owner.claim, owner.cycleId)
+    },
+    releaseCycle: (exec, why) => lifecycle.release(exec, why),
+    onStart: (exec) => {
+      inFlight++
+      if (exec?.name === 'computer_ctrl' && exec.arguments?.action === 'release') {
+        callOwners.set(exec, { claim: claimOf(exec), cycleId: gate.snapshot().id })
+      }
+    },
+    onEnd: () => {
+      inFlight = Math.max(0, inFlight - 1)
+      lifecycle.settle()?.catch(error => log.warn(`computer-use deferred completion failed: ${error.message}`))
     },
-    onStart: () => { inFlight++ },
-    onEnd: () => { inFlight = Math.max(0, inFlight - 1) },
     // ---- THE WRAP-UP DIRECTIVE (2026-09-15) --------------------------------------------------------
     // WHAT WENT WRONG. A human brake (ESC, a mouse shake, the wheel, typing outside the host) engaged
     // the brake and steered a "WRAP UP NOW" notice into the turn — but `agent.steer` only delivers at a
@@ -1071,6 +849,7 @@ export function apply (ctx, config) {
       if (r && r.exited) { gate.mark('ended', { why: 'the ask window ended in an exit' }); return }
       if (!r || r.stopped) { gate.mark('paused', { why: 'the ask window ended with a stop standing' }); return }
       gate.mark('open', { why: 'the ask window closed with no brake (no human input)' })
+      terminalCleanup.resumePending()
     } catch { /* never break the host */ }
   })
 
@@ -1089,6 +868,7 @@ export function apply (ctx, config) {
       return
     }
     brakeWhy = ''      // the brake is off, so there is no reason left to hand to a refused call
+    if (terminalCleanup.resumePending()) return
     const version = gate.exitVersion()
     notice(
       '继续 — the human re-armed computer use with Ctrl+Alt+R: the brake is cleared and the red border ' +
@@ -1109,7 +889,7 @@ export function apply (ctx, config) {
     // late callback, not a queued call in this same turn — may move this id back to a live state; a
     // new cycle needs a new turn's first real call and gets a new id (lib/cycle.js).
     gate.mark('ended', { why: (e && e.why) || 'exit event' })
-    cu.calm().catch(() => {})
+    terminalCleanup.forget() // native exit already performed cleanup; never send a late calm
     selfAbortUntil = Date.now() + 8000
     // CAPTURE THE RECIPIENT BEFORE THE FIRST `await` (integration bug, 2026-09-13). The notice below
     // awaits message construction and delivery, and anything that rebinds `bus.agent` during that
@@ -1188,8 +968,7 @@ export function apply (ctx, config) {
         log.info(`agent/status idle while ${gate.state()} — the cycle stays alive (Ctrl+Alt+R resumes it)`)
         return
       }
-      gate.mark('ended', { why: 'owner agent idle', session: gate.ownerSessionKey(), agent: payload && payload.agent })
-      cu.calm().catch(() => {})
+      lifecycle.idle(payload.agent)?.catch(error => log.warn(`computer-use idle release failed: ${error.message}`))
     } catch { /* the indicator must never break the host */ }
   })
 
@@ -1201,7 +980,7 @@ export function apply (ctx, config) {
       const whoKey = agentKeyOf(payload && payload.agent)
       if (whoKey && gate.ownsAgent(whoKey)) {
         log.info(`owner agent disposed (${whoKey}) — releasing the machine for the next real call`)
-        gate.release('owner agent disposed')
+        terminalCleanup.request('owner agent disposed')
       }
     } catch { /* never break the host */ }
   })
@@ -1230,17 +1009,6 @@ export function apply (ctx, config) {
         // session's generation is all a turn boundary is allowed to do — and it is what gives a
         // brand-new session its qualification, since it never has to match a remembered driver.
         if (session) gate.noteTurnStart(session)
-        // A NEW TURN CLEARS THE TASK SITUATION. Per turn, never accumulated: the recommendation the timer
-        // may execute is about THIS turn's work, so the flag, the sequence and the owner all start empty.
-        // `lastTurnDrove` CARRIES THE PREVIOUS TURN FORWARD ON PURPOSE (the observation-only case), and the
-        // stagnation signature (`lastDrive`) is history, not per-turn state — resetting either here would
-        // silently disable both guards.
-        lastTurnDrove = turnSituation.action
-        turnSituation.action = false
-        turnSituation.reason = '(no actuation reached the worker this turn)'
-        turnSituation.owner = sessionKey(session)
-        turnSituation.seq = []
-        declaredRecommendation = undefined
         const owner = gate.ownerSessionKey()
         if (!owner || !session || sameSession(session, owner)) nudgedTurn = false
         // NOTHING IS OPENED HERE (A/B). The opener is the first real call of the turn — the only
@@ -1266,357 +1034,24 @@ export function apply (ctx, config) {
         if (selfAbortUntil && Date.now() < selfAbortUntil) {
           selfAbortUntil = 0
           log.warn(`turn ended ${kind} — caused by our own Ctrl+Alt+Q exit; NOT re-engaging the brake`)
-          cu.calm().catch(() => {})
           return
         }
         // Host cancellation is per request/turn; only the physical Ctrl+Esc path
         // raises an input-triggered persistent brake.
         log.warn(`turn ended ${kind} in a computer-use session — cancelling only its input`)
         recoveryEpoch++; temporaryPause = null
-        cu.cancelInputs?.()
         // An explicit Ctrl+Esc pause remains latched. Ordinary Host cancellation ends
         // this turn and its queued input without inventing a persistent human brake.
-        if (!cu.stopped) {
-          gate.mark('ended', { why: `owner turn ${kind}` })
-          cu.calm().catch(() => {})
-        }
+        terminalCleanup.request(`owner turn ${kind}`)
         return
       }
-      // ---- THE TURN ENDS; THE DECISION ABOUT THE CYCLE BELONGS TO THE CARD (2026-09-15) -----------
-      // This branch used to CLOSE the cycle first (`gate.mark('ended')`) and only then raise the card.
-      // `'ended'` is irreversible, so the FIRST turn end that reached here ended the cycle — and from
-      // the second turn onward `gate.ownsSession(...)` was false, the whole block was skipped, and the
-      // card could never fire again. Measured: one card at 22:30, then nothing for five turns while
-      // the log filled with `agent/status idle ignored (another agent)`. The human's report was exactly
-      // that: "我还是没亲眼看到触发".
-      //
-      // The human chose 甲: a completed turn NO LONGER closes the cycle on its own. The card decides,
-      // and "关闭周期" is one of its branches — which is also what they asked for in words ("你决定之后
-      // 再说，关闭整个周期，还是继续"). The old worry that motivated auto-closing ("不能让正常完成一律保留成
-      // 永远活着") is now handled by the card: an explicit branch, or the timeout default, ends it.
-      // A pause/ask still keeps the cycle alive for Ctrl+Alt+R, unchanged.
-      // ---- A TURN THAT NEVER TOUCHED THE MACHINE IS NOT A COMPUTER-USE SUSPENSION (defect, 2026-09-16) --
-      // THE DEATH LOOP THIS CLOSES, in the human's own words: "你卡进死循环了 不断弹卡片". Measured in
-      // `turn-end-diag.log`: eleven cards in two and a half minutes (02:38:03 → 02:40:40), every one of them
-      // `kind=error`, and the session transcript says why —
-      //   turn 146…156  reason={"kind":"error","error":{"message":"Insufficient Balance","code":"QUOTA"}}
-      // The account was out of credit, so EVERY turn died at step 1. Each death ended a turn, the turn-end
-      // gate asked for a decision about a MACHINE THAT HAD NOT BEEN TOUCHED, the human answered, and their
-      // answer started another turn that died the same way. The card was not wrong about the machine; it was
-      // answering a question nobody had asked, about a machine that was idle, forever.
-      // The honest predicate is already on hand: `turnSituation.seq` is the turn's own dispatch signature
-      // (every `computer_*` call the turn actually dispatched — see `hooks.onDispatch`). Empty means this
-      // turn never reached the machine, so there is no cycle decision to make and the card must not fire. A
-      // billing error, a provider outage or a chat-only turn is reported by the host's own "本轮运行失败";
-      // dressing it as a machine decision is what produced the loop.
-      // It also keeps the human's standing rule intact: "一旦挂起，任何挂起，都必须进入卡片" — a suspension
-      // OF THE MACHINE still always gets its card, and now a turn that suspended nothing no longer fakes one.
-      //
-      // THE RESIDUAL RISK, STATED RATHER THAN HIDDEN: `turnSituation` is ONE slot and `turn/start` is a
-      // host-wide event, so if another session (a background subagent, another chat) starts a turn between
-      // this turn's last dispatch and its end, that start resets `seq` and this gate then suppresses a card
-      // the owner had earned. The failure direction is the safe one — no card, the cycle stays open, and the
-      // machine was never touched by anyone in the meantime — and `recommendContinueNow` has depended on the
-      // same single slot since it was written. Making it exact means keying the situation BY SESSION, which
-      // is a change to the recommendation's own input and is not something to smuggle in behind a bug fix.
-      const touched = situationIsMine(session) && turnSituation.seq.length > 0
-      if (gate.ownsSession(sessionKey(session)) &&
-          gate.state() !== 'paused' && gate.state() !== 'asking' &&
-          !cu.stopped && !brakeLatch() && touched) {
-        diagTurnEnd(`FIRED kind=${kind || 'completed'} asker=${!!asker} raiseHuman=${!!raiseHuman} ` +
-          `seq=${turnSituation.seq.length} session=${String(sessionKey(session)).slice(0, 12)}`)
-        // ---- A COMPUTER-USE TURN MUST NOT END SILENTLY (2026-09-15, the human's standing rule) ----
-        // "一旦挂起，任何挂起，都必须进入卡片… 如果60s没回复，超时之后自动进行分支判断". Until now a
-        // turn end produced a taskbar toast and nothing else: the design's RAISE + CARD + 60 s branch
-        // was never implemented on this path. The 60 s clock that DID exist lived in the worker's
-        // `computer_ask` (`worker.cs:5430`) and was removed, correctly, by the ask merge — and the
-        // plugin-side branch was never added back.
-        //
-        // WHY A DETOUR RATHER THAN A CANCELLABLE CARD: the harness has no way to withdraw a pending
-        // card (checked during the merge — it ends by being answered, dismissed, or by the turn being
-        // torndown). So the card is NOT cancelled. A local timer simply stops waiting on it, which is
-        // the same thing the human asked for and needs no host API. The card may linger in the chat;
-        // answering it later changes nothing, because the race below has already settled.
-        //
-        // AUTO-DECISION: on timeout the agent DOES NOT continue driving on its own. A turn that ended
-        // by itself leaves the machine free and the human absent — starting a new turn unattended is
-        // the one outcome that cannot be undone. The human's own words allow either branch ("是否必须
-        // 终结还是按照你自己的理解继续"); stopping is the reversible one.
-        void askAtTurnEnd(session, kind)
-      } else {
-        // THE ANSWER THAT ACTUALLY NEEDS A REASON. Without this line "the card did not fire" has no
-        // explanation at all, which is exactly where this feature was stuck.
-        diagTurnEnd(`SKIPPED kind=${kind || 'completed'} state=${gate.state()} ` +
-          `owns=${gate.ownsSession(sessionKey(session))} stopped=${!!cu.stopped} latch=${!!brakeLatch()} ` +
-          `touched=${touched} seq=${turnSituation.seq.length} ` +
-          `session=${String(sessionKey(session)).slice(0, 12)}`)
-      }
+      // Ordinary completion releases computer use immediately. No question card,
+      // no recommendation timer, and no new conversation turn is created.
+      const completion = lifecycle.completeTurn(session, kind || 'completed')
+      completion?.catch(error => log.warn(`computer-use completion failed: ${error.message}`))
     } catch { /* never break the host */ }
   })
 
-  /**
-   * Raise the Desktop, show the decision card, and stop waiting after the timeout.
-   *
-   * Returns a promise that settles with `{answered, selected, custom, timedOut}` — never rejects.
-   * The card is deliberately left in place on timeout; see the call site for why that is the design
-   * and not an oversight.
-   */
-
-  async function askAtTurnEnd (session, kind) {
-    try {
-      if (!asker || typeof asker.ask !== 'function') return { answered: false, reason: 'no-asker' }
-      // ---- RESOLVE, RECORD, GUARD, AND ONLY THEN RAISE (review re-audit B, 2026-09-15) -------------
-      // The raise used to happen first, so a REFUSED card still restored and focused Desktop for a
-      // question that would never exist — the exact opposite of this file's own rule ("only raise when
-      // a human input is actually pending; never yank the human", see `enableHumanAttention`). Nothing
-      // is lost by reordering: `rootAgentFor` is fully synchronous, so the card loses zero latency, and
-      // the 60 s clock still starts only after the voucher exists (the old version armed a timer whose
-      // promise nobody would ever await).
-      const rp = rootAgentFor(session, bus.agent)
-      // The recommendation is fixed HERE, once, before the card is built — the timer later executes what
-      // the card said, never a fresh judgement made while nobody is watching.
-      const recommend = recommendContinueNow(kind, session)
-      // THE REASON IS CAPTURED HERE, WITH THE DECISION (review E4). `turnSituation` is MUTABLE and a
-      // `turn/start` can land during the 60 s wait, so logging `turnSituation.reason` at fire time could
-      // print "recommended because (no actuation reached the worker this turn)" — a sentence that
-      // contradicts itself. The reason that justified THIS card is the one recorded with it.
-      const recommendReason = recommendationReason(session)
-      // AND THE STALL VERDICT IS ALSO FIXED HERE, WITH THE DECISION. It was computed inside
-      // `recommendContinueNow`, and re-reading it 60 s later would compare against a `turnSituation` that a
-      // `turn/start` may have already replaced — the same mutability trap as the reason above.
-      const stalledAtDecision = stalledNow(session)
-      diagTurnEnd(`CARD kind=${kind || 'completed'} rec=${recommend ? 'yes' : (config.turnEndTimeoutAction === 'recommended' ? 'no(situation/brake)' : 'setting=stop')} ` +
-        `ask=${rp.ask ? 'yes' : 'NO'} via=${rp.reason} ` +
-        `agentId=${rp.agent && rp.agent.id ? String(rp.agent.id).slice(0, 8) : '-'}`)
-      // ---- NEVER ASK WITH AN AGENT THE REGISTRY DID NOT VOUCH FOR --------------------------------
-      // `ask:false` means the resolver could NOT prove this agent is the live root of the session whose
-      // turn just ended. Two ways that ends badly, both worse than no card:
-      //   * a live root of ANOTHER session is accepted by `ask()` — the card would appear in a
-      //     different chat, asking the human about a turn they are not looking at (review finding 2);
-      //   * an agent-less request is dropped by the forwarder (`api-remotes/lib/index.js:117`), so the
-      //     ask can only ever come back NO_PROVIDER — a guaranteed-useless round trip that already
-      //     cost one debugging round (review finding 3).
-      // The refusal is recorded in the turn-end diagnostic file BEFORE this return, so "the card did
-      // not fire" still has a written reason. `computer_ask` is unaffected: it asks through the
-      // worker's own path.
-      //
-      // THE INDICATOR IS NOT TOUCHED HERE, DELIBERATELY (review re-audit E2). A refusal marks nothing,
-      // so the cycle survives to the owner-idle edge, which is what cuts the border. If that edge has
-      // already passed, the indicator can linger until the next call or exit — the same outcome the
-      // pre-fix NO_PROVIDER produced, so this is not a regression, and guessing a closer here would
-      // mean a card-less turn silently ending a cycle the human may still want.
-      if (!rp.ask || !rp.agent) {
-        log.warn(`turn-end card: NOT raised — the registry did not vouch for a caller of this session (${rp.reason}); ` +
-          'no card is better than a card in the wrong chat (the cycle is left to the owner-idle edge)')
-        return { answered: false, reason: rp.reason || 'unverified-agent', timedOut: false }
-      }
-      if (rp.reason !== 'verified') log.warn(`turn-end card: the captured caller was not usable (${rp.reason}); naming ${String(rp.agent.id).slice(0, 8)} instead`)
-      // RAISE, THEN ASK — and do not await the raise: `raiseFor` only has to start the reveal, while
-      // the card must appear whatever the window operation does. The OUTCOME is recorded, though: "the
-      // human never saw the card" was the one fact nothing wrote down, and it took a human report
-      // ("没有把DSH激活放到我面前") to find it (defect, 2026-09-16).
-      Promise.resolve(raiseHuman?.(`turn-end:${Date.now()}`, `computer-use turn ended (${kind || 'completed'})`))
-        .then((shown) => diagTurnEnd(`RAISE shown=${shown !== false} kind=${kind || 'completed'}`))
-        .catch(() => {})
-      // ---- WHO RECEIVES THE HUMAN'S ANSWER (review finding 5, 2026-09-15) ------------------------
-      // The card is scoped to `rp.agent`, so the answer must go back to the SAME agent. Steering
-      // `bus.agent` — a different object whenever the resolver substituted one — would deliver the
-      // human's decision to a replaced or already-dead agent, inside a `try` that swallows the throw,
-      // i.e. the answer would vanish with no trace. Resolved once, used by every branch below.
-      const recipient = rp.agent || bus.agent
-      const ANSWER_TIMEOUT_MS = 60_000
-      let timer = null
-      const timedOut = new Promise((resolve) => {
-        timer = setTimeout(() => resolve({ answered: false, timedOut: true, reason: 'timeout' }), ANSWER_TIMEOUT_MS)
-      })
-      const asked = asker.ask({
-        // THE AGENT IS NOT OPTIONAL. See `rootAgentFor` for the measured NO_PROVIDER this fixes.
-        agent: rp.agent,
-        questions: [{
-          id: 'computer_use_turn_end',
-          header: 'computer-use 回合结束',
-          // THE CARD SAYS IT STAYS. The human's rule: "只要我没有任何反应，卡片就应该一直挂着，除非有
-          // 这个60秒超时之后你取消它，你决定之后再说" — and they must be TOLD they can still change
-          // their mind later, or the late-correction path is invisible to the only person who can use it.
-          // THE TURN'S OUTCOME IS ON THE CARD (review finding E3, 2026-09-15). An errored turn raises the
-          // same card as a completed one, which is right — the human must still decide what happens to the
-          // machine — but at 23:22 the crash produced "本轮运行失败" immediately followed by "这一回合结束了",
-          // with nothing saying the two were the same event. `kind` is already known here; saying it costs
-          // one line and removes the confusion at its source.
-          // ---- THE CARD SAYS WHAT THE TIMER WILL DO, AND THE TWO CANNOT DISAGREE (2026-09-15) --------
-          // The human's rule, in their words: "这个问题超时的情况下，如果你有推荐选项就走推荐，如果没有
-          // 推荐选项就停。而不是所有情况都一定有推荐选项，因为有些问题你确实是没有办法替我执行选择."
-          // So there are two honest texts and NO third one. The previous text claimed the timer always
-          // "按停处理", which was both wrong about the timer (it made no decision) and absent from the
-          // design; and it promised "不会自己开新回合" even in the mode where it will.
-          question: (kind === 'error'
-            ? '**这一回合是以错误结束的**（不是正常做完），要我怎么走？\n\n'
-            : '这一回合结束了。要我怎么走？\n\n') +
-            '· **卡片会一直挂着**，你多久后回来点都算数，而且**以你为准**（我会比对偏差并改成你的选择）。\n' +
-            (recommend
-              ? `· **60 秒内你不回复**，我走标着「推荐」的那一项：**${recommend}**。`
-              : '· **60 秒内你不回复**，我**不做决定、也不动机器**——这一题我没有替你选的立场，等你给策略。'),
-          options: [
-            { label: '继续（按你自己的理解接着干）', description: '等同于你按 Ctrl+Alt+R：我会开一个新回合继续。' },
-            { label: '停（等我给策略）', description: '我不动，周期留着，等你在聊天里写下下一步。' },
-            { label: '关闭周期（这一轮到此为止）', description: '收掉周期和指示器；下次要用 computer-use 需要新回合重新开。' },
-          ].map((o) => (o.label === recommend ? { ...o, description: `【推荐】${o.description}` } : o)),
-        }],
-      }).then((reply) => {
-        const a = reply && Array.isArray(reply.answers) ? reply.answers[0] : null
-        const selected = a && Array.isArray(a.selected) ? a.selected : []
-        const custom = a && typeof a.custom === 'string' && a.custom.trim() !== '' ? a.custom.trim() : undefined
-        // ---- WHAT THIS LINE DOES AND DOES NOT PROVE (corrected by review finding 11, 2026-09-15) ---
-        // It proves the ANSWERER ACCEPTED AND SETTLED the request — i.e. a browser answerer took it and
-        // the round trip completed — which is exactly what a NO_PROVIDER never reaches, so its
-        // presence/absence still separates "reached a card" from "reached nobody".
-        // It does NOT prove a card was RENDERED BEFORE the human touched anything: the client resolves
-        // this waterfall only on the answer (`dsh-client-ui-user-questions/lib/client.js:113-119`,
-        // `await pending.result`). An earlier version of this comment claimed otherwise; the claim was
-        // wrong, and a wrong witness is worse than none.
-        log.info(`turn-end decision card answered: selected=${JSON.stringify(selected)}` +
-          `${custom ? ` custom=${JSON.stringify(custom.slice(0, 40))}` : ''}`)
-        return { answered: true, selected, custom, timedOut: false }
-      }).catch((e) => ({ answered: false, reason: (e && e.code) || 'error', timedOut: false }))
-      const out = await Promise.race([asked, timedOut])
-      if (timer) clearTimeout(timer)
-      // ---- THE LATE HANDLER MUST BE ABOUT A LATE ANSWER (measured defect, 2026-09-15 23:40) ---------
-      // `asked.then(...)` used to be attached INSIDE this branch but unconditionally, so `asked` settling
-      // by the ordinary path ALSO ran it. Host log, the human's own click:
-      //   23:40:12.584  answered: selected=["继续…"]          ← the real answer, on time
-      //   23:40:12.585  turn-end card answered LATE …          ← same millisecond, the duplicate
-      //   23:40:14.846  the human SELECTED 继续 …              ← and the ordinary branch, 2 s later
-      // One click was handled TWICE. With the old bare-object steer both copies crashed; with the fixed
-      // message shape the duplicate would silently steer the human's text a second time. The flag makes
-      // the handler mean what its name and its log line say.
-      const settledLate = !!out.timedOut
-      if (out.timedOut) {
-        // ---- THE TIMER BRANCHES (2026-09-15, restored from the human's own design words) -------------
-        // "如果60s没回复，超时之后自动进行分支判断，是否必须终结还是按照你自己的理解继续", refined by them
-        // later the same night: "如果你有推荐选项就走推荐，如果没有推荐选项就停。而不是所有情况都一定有推荐
-        // 选项，因为有些问题你确实是没有办法替我执行选择."
-        // So: a declared recommendation is EXECUTED; without one the timer makes NO decision and touches
-        // nothing. Only the agent's next turn is ever at stake — never the cycle, never the brake.
-        if (recommend) {
-          // ---- THE GATE IS RE-CHECKED AT FIRE TIME, NOT ONLY WHEN THE CARD WAS BUILT (review A(ii)) --
-          // `recommendContinueNow` ran 60 s ago. In between, a human ESC / presence panic sets `cu.stopped`
-          // AND the STOP latch, and Ctrl+Alt+Q writes the EXITED record. Without this re-check the timer
-          // would still steer 继续 and wake a turn whose every `computer_*` call the plugin's own gates
-          // refuse — a billed turn that can only produce refusals, while the card had promised "我走标着
-          // 「推荐」的那一项". The machine was never at risk (the timer touches no cycle and no brake), but
-          // the promise would be false, and this file's rule is that a human act outranks a timer.
-          if (cu.stopped || brakeLatch()) {
-            log.warn('turn-end decision card timed out after 60 s, but the human braked during the wait — ' +
-              'the recommendation is WITHDRAWN (a timer never outranks a brake); nothing steered')
-          } else if (stalledAtDecision) {
-            log.warn('turn-end decision card timed out after 60 s — the situation has not changed since the last ' +
-              'automatic continuation (the same sequence of tools), so continuing is not progress; the timer ' +
-              'makes no decision and the human decides')
-          } else {
-            // THE SIGNATURE IS RECORDED WHEN THE CONTINUATION ACTUALLY HAPPENS, not when the card is built:
-            // a card that is never answered from must not spend the stall check on a turn that never ran.
-            noteDrive()
-            log.info(`turn-end decision card timed out after 60 s — executing the RECOMMENDED option ` +
-              `(${JSON.stringify(recommend)}); recommended because ${recommendReason}`)
-            if (recipient) {
-              void buildUserMessage(RECOMMEND_CONTINUE, 'turn-end-timeout', 'the 60 s timer executed the card\'s recommended option')
-                .then((m) => recipient.steer(m))
-                .catch((e) => log.warn(`the recommended option could not be delivered: ${(e && e.message) || 'unknown'}`))
-            }
-          }
-        } else {
-          log.info(`turn-end decision card timed out after 60 s — NO recommendation ${recommendReason}, ` +
-            'so the timer makes no decision and touches nothing: the machine stays with the human')
-        }
-        // ---- THE HUMAN MAY STILL ANSWER, AND THEIR ANSWER OUTRANKS THE TIMER (2026-09-15) ---------
-        // Their standing rule: "卡片挂着也行，我要是后面回来有点击或回复，你直接立即以我的输入为最高
-        // 优先，比对我不在期间的选择和最新输入是否有偏差". So the settled-by-timeout branch is NOT
-        // final: the SAME promise is kept and awaited a second time, out of band. When it resolves we
-        // compare what the timer chose against what they actually said, and report the deviation.
-        //
-        // WHY THIS CANNOT BE DONE AT THE CARD: the harness offers no way to withdraw a pending card,
-        // so "the timer decided" and "the card is still answerable" are both true at once. Rather than
-        // fight that, the late answer is treated as a CORRECTION — the truthful model of what it is.
-        void asked.then((late) => {
-          // Belt and braces: only a card that was still pending when the timer fired is "late".
-          if (!settledLate) return
-          if (!late || !late.answered) return
-          const lateText = late.custom || (Array.isArray(late.selected) && late.selected[0]) || ''
-          if (!lateText) return
-          // THE TIMER'S OUTCOME IS "NO DECISION", NOT "CHOSE 停". Saying the timer "chose 停" would be
-          // the same lie this branch was written to stop making: the timer decides only that the agent
-          // will NOT continue unattended. The human's late word therefore never CONTRADICTS the timer —
-          // it is the first decision anyone made, and it wins.
-          const deviation = true
-          log.warn(`turn-end card answered LATE (after the 60 s timer). The timer made NO decision ` +
-            `(the agent simply did not continue unattended); the human now says: ${JSON.stringify(lateText)}. ` +
-            (deviation
-              ? 'ACTING ON THE HUMAN\'S INPUT — it takes precedence, and it is the only decision on record.'
-              : 'No deviation.'))
-          if (deviation && recipient) {
-            // A REAL MESSAGE, NEVER A BARE OBJECT — see `buildUserMessage`. A raw `{text}` here crashes
-            // the harness's own inbox listener (`message.source.kind`) and the human sees the round fail.
-            void buildUserMessage(lateText, 'turn-end-late', 'the human answered the turn-end card late')
-              .then((m) => recipient.steer(m))
-              .catch((e) => log.warn(`late answer could not be delivered: ${(e && e.message) || 'unknown'}`))
-          }
-        }).catch(() => {})
-        return out
-      }
-      // A STRATEGY IN THE HUMAN'S OWN WORDS OUTRANKS THE MENU, exactly as the design intends ("其中一个
-      // 给出一个我的自由输入指令"): if they typed anything, that text is the instruction.
-      //
-      // DO NOT LOG A CHOICE NOBODY MADE (2026-09-15, caught by the human: "我啥都没按 笑死了 没有任何人工
-      // 输入"). This branch used to fall through to `the human chose 停` for EVERY input-less ending —
-      // a dismissed card, an aborted ask, an empty reply — so the log asserted a human decision that had
-      // never happened, and the human read it back as evidence. That is the SAME defect this session
-      // spent hours removing from the brake monitors ("a signal that cannot separate those two cases
-      // must not drive a brake"), committed here in prose form. Each ending now names itself, and only
-      // a REAL selection may be reported as a choice.
-      if (!out.answered) {
-        log.info(`turn-end card: NO ANSWER (${out.reason || 'unknown'}) — nothing steered, no choice was made`)
-        return out
-      }
-      // A REAL ANSWER CLEARS THE STALL HISTORY: the similarity rule exists to stop the TIMER talking to
-      // itself, never to overrule a human who is present and choosing.
-      humanAnsweredSince = true
-      const text = out.custom || (Array.isArray(out.selected) && out.selected[0]) || ''
-      if (!text) {
-        log.info('turn-end card: answered with an EMPTY selection (skipped or dismissed) — nothing steered, this is NOT a choice of 停')
-      } else if (out.custom) {
-        if (recipient) {
-          void buildUserMessage(out.custom, 'turn-end-strategy', 'the human typed a strategy at the turn-end card')
-            .then((m) => recipient.steer(m))
-            .catch((e) => log.warn(`the human's strategy could not be delivered: ${(e && e.message) || 'unknown'}`))
-        }
-        log.info(`turn-end card: the human TYPED a strategy (${JSON.stringify(out.custom.slice(0, 60))}) — steered into a new turn`)
-      } else if (/关闭周期/.test(text)) {
-        // THE THIRD BRANCH the human asked for ("关闭整个周期，还是继续"). This is the ending that used
-        // to happen automatically on every completed turn; now it is an explicit choice.
-        if (gate.mark('ended', { why: 'the human chose to close the cycle at the turn-end card' })) {
-          cu.calm().catch(() => {})
-          log.info(`turn-end card: the human SELECTED 关闭周期 (${JSON.stringify(text.slice(0, 40))}) — cycle closed, indicator cut`)
-        } else {
-          log.info('turn-end card: 关闭周期 was selected but the cycle was already ended — nothing to do')
-        }
-      } else if (/继续/.test(text)) {
-        // A REAL MESSAGE, NEVER A BARE OBJECT — this is the exact call the human's 继续 crashed on
-        // (measured 23:22:23, `Cannot read properties of undefined (reading 'kind')`).
-        if (recipient) {
-          void buildUserMessage('继续', 'turn-end-card', 'the human chose 继续 at the turn-end card')
-            .then((m) => recipient.steer(m))
-            .catch((e) => log.warn(`继续 could not be delivered: ${(e && e.message) || 'unknown'}`))
-        }
-        log.info(`turn-end card: the human SELECTED 继续 (${JSON.stringify(text.slice(0, 40))}) — steered, a new turn will start`)
-      } else if (/停/.test(text)) {
-        log.info(`turn-end card: the human SELECTED 停 (${JSON.stringify(text.slice(0, 40))}) — nothing steered, the cycle is left open for you`)
-      } else {
-        log.info(`turn-end card: an unrecognised selection ${JSON.stringify(text.slice(0, 40))} — nothing steered`)
-      }
-      return out
-    } catch { return { answered: false, reason: 'error' } }
-  }
-
   // approval gate — every computer_* tool call passes through the policy
   // pure function; its {kind: allow|deny|ask} rides the tools/pre-execute
   // waterfall into the harness approval UI (fail-closed, one-shot grants).