gestalt-mobile 0.17.3 → 0.18.1

package/dist/client/index.html

@@ -16,8 +16,8 @@ SPDX-License-Identifier: AGPL-3.0-or-later
     <link rel="icon" href="/icons/gestalt-mobile-192.png" />
     <link rel="apple-touch-icon" href="/icons/gestalt-mobile-180.png" />
     <title>Gestalt Mobile</title>
-    <script type="module" crossorigin src="/assets/index-Ba_4zoY1.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-e2lJ5XqL.css">
+    <script type="module" crossorigin src="/assets/index-D4ZAKUN3.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CJBtrNWw.css">
   </head>
   <body>
     <div id="app"></div>

package/dist/server/server/app.js

@@ -15,6 +15,8 @@ import { registerSessionRoutes } from './features/sessions/register-routes.js';
 import { registerProblemHandler } from './platform/http/problem-handler.js';
 import { registerAuthorizationBoundary } from './platform/http/authorization-boundary.js';
 import { registerSkillRoutes } from './features/skills/register-routes.js';
+import { registerOrgPlanAttentionRoutes } from './features/org-plan-attention/register-routes.js';
+import { registerAutopilotRoutes } from './features/autopilot/register-routes.js';
 export async function buildApp(deps) {
     // Keep the default boundary finite even when an endpoint forgot a narrower schema.
     const app = fastify({ logger: false, bodyLimit: 1024 * 1024 });
@@ -41,6 +43,10 @@ export async function buildApp(deps) {
     if (deps.bootstrap)
         registerGetBootstrap(app, deps.bootstrap);
     registerSessionRoutes(app, deps);
+    if (deps.autopilot)
+        registerAutopilotRoutes(app, deps.autopilot, deps.sessionRoutes?.idempotency);
+    if (deps.orgPlanAttention)
+        registerOrgPlanAttentionRoutes(app, deps.orgPlanAttention);
     registerPlanRoutes(app, deps);
     registerGitRoutes(app, deps);
     registerSkillRoutes(app, deps);

package/dist/server/server/composition.js

@@ -3,7 +3,7 @@
  * Designed by Denis Roio <jaromil@dyne.org>
  * SPDX-License-Identifier: AGPL-3.0-or-later
  */
-import { randomBytes, randomUUID } from 'node:crypto';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
@@ -32,6 +32,8 @@ import { GitSummaryCache } from './platform/git/git-summary-cache.js';
 import { SessionSupervisor } from './platform/runtime/session-supervisor.js';
 import { mapWithConcurrency } from './platform/runtime/concurrency.js';
 import { RelaySession } from './features/sessions/model/relay-session.js';
+import { AgentActivityRegistry } from './features/agent-activity/registry.js';
+import { decodeAgentActivityFact } from './platform/codex/activity-facts.js';
 import { resolvedServerRequestId, toPendingInteraction } from './platform/codex/server-request.js';
 import { isValidInteractionResponse, isValidQuizInteractionResponse, } from './features/sessions/interaction/response-validator.js';
 import { promoteRecentThread } from './features/sessions/promote-recent-thread/use-case.js';
@@ -42,10 +44,13 @@ import { compileSkillOverride } from './features/skills/model/skill-profile.js';
 import { SupervisedPlanRegistry } from './features/plans/application/supervised-plan-registry.js';
 import { FilesystemPlanStatusSource } from './platform/plans/filesystem-plan-status-source.js';
 import { FilesystemWorkspacePlanCatalog } from './platform/plans/filesystem-workspace-plan-catalog.js';
-import { OrgPlanCommandValidator } from './platform/plans/org-plan-command-validator.js';
 import { checkpointPlanMeasurement } from './platform/plans/plan-measurement-command.js';
 import { PlanMeasurementRefresh } from './platform/plans/plan-measurement-refresh.js';
+import { SqliteAutopilotStore } from './platform/persistence/sqlite-autopilot-store.js';
+import { AutopilotCoordinator } from './features/autopilot/application/service.js';
+import { AUTOPILOT_CONTINUATION_PROMPT, defaultAutopilotPolicy, } from './features/autopilot/application/policy.js';
 import { createRelyingPartyConfig } from './config.js';
+import { parseOrgPlanAttention } from '../shared/contracts/org-plan-attention.js';
 const generatedProtocolVersion = 'codex-cli 0.144.3';
 export async function composeRelayApp(options) {
     const passkeyAuthEnabled = options.passkeyAuthEnabled ?? true;
@@ -70,23 +75,147 @@ export async function composeRelayApp(options) {
         throw error;
     }
     const sessions = new SqliteSessionRepository(database);
+    // Only sessions found while opening the relay database belong to a previous
+    // process. A listen hook can run after a new session has already started in
+    // this process; detaching that live writer would make restore and activity
+    // reconciliation race their own owner.
+    const persistedSessionIds = new Set(sessions.list().map((session) => session.id));
     const journal = new SqliteEventJournal(database);
     const interactions = new SqlitePendingInteractionStore(database);
     const idempotency = new SqliteIdempotencyStore(database);
+    const autopilotStore = new SqliteAutopilotStore(database);
+    const attentionResolutionOperations = new Map();
     const supervisedPlans = new SupervisedPlanRegistry();
     const planStatusSource = new FilesystemPlanStatusSource(join(dirname(databasePath), 'plans'));
     const planMeasurementHelperPath = options.planMeasurementHelperPath ?? process.env.GESTALT_MOBILE_ORG_PLAN_HELPER;
     const withPendingInteractions = (session) => (session ? { ...session, pendingInteractions: interactions.list(session.id) } : null);
     const events = new SessionEventBus();
+    const attentionTransitions = {
+        subscribe: (sessionId, listener) => events.subscribe(sessionId, (event) => {
+            if (event.type !== 'org-plan.attention-required' &&
+                event.type !== 'org-plan.attention-resolved')
+                return;
+            const payload = event.payload;
+            if (typeof payload.requestId !== 'string')
+                return;
+            listener({
+                kind: event.type === 'org-plan.attention-required'
+                    ? 'required'
+                    : payload.outcome === 'failed'
+                        ? 'failed'
+                        : 'resolved',
+                requestId: payload.requestId,
+                occurredAt: event.occurredAt,
+            });
+        }),
+    };
+    options.onAttentionTransitions?.(attentionTransitions);
+    const activity = new AgentActivityRegistry((snapshot, occurredAt) => events.publish(journal.append(snapshot.sessionId, 'agent.activity.updated', snapshot, occurredAt)), {
+        // Evidence arms one bounded reconciliation; healthy sessions are never polled.
+        schedule: options.activitySchedule ??
+            ((callback, delayMs) => {
+                const timer = setTimeout(callback, delayMs);
+                return () => clearTimeout(timer);
+            }),
+        now: () => new Date().toISOString(),
+        diagnostic: options.activityDiagnostic ??
+            ((sessionId, code) => console.warn(`agent activity ${code} session=${sessionId}`)),
+        reconcile: async (sessionId) => {
+            const session = sessions.find(sessionId);
+            if (!session || !runtime)
+                return;
+            const history = await runtime.readHistory(session);
+            const occurredAt = new Date().toISOString();
+            activity.observe({
+                sessionId,
+                occurredAt,
+                kind: history.activeTurnId ? 'turnStarted' : 'turnCompleted',
+                ...(session.threadId ? { threadId: session.threadId } : {}),
+                ...(history.activeTurnId ? { turnId: history.activeTurnId } : {}),
+            });
+            activity.childrenReconciled(sessionId, occurredAt, await runtime.listDirectChildren(session));
+        },
+    });
+    const autopilot = new AutopilotCoordinator({
+        store: autopilotStore,
+        now: () => new Date().toISOString(),
+        policy: defaultAutopilotPolicy,
+        plan: (sessionId) => {
+            const plan = supervisedPlans.find(sessionId);
+            const identity = supervisedPlans.identity(sessionId);
+            return plan && identity ? { plan, identity } : null;
+        },
+        session: (sessionId) => sessions.find(sessionId),
+        activity: (sessionId) => options.autopilotActivity
+            ? options.autopilotActivity(sessionId)
+            : activity.snapshot(sessionId, new Date().toISOString()),
+        pendingInteraction: (sessionId) => interactions.list(sessionId).length > 0,
+        reconcile: async (sessionId) => {
+            if (options.autopilotReconcile)
+                return options.autopilotReconcile(sessionId);
+            await activity.refresh(sessionId);
+            return {
+                compatible: activity.snapshot(sessionId, new Date().toISOString()).confidence === 'fresh',
+            };
+        },
+        schedule: options.autopilotSchedule ??
+            ((callback, delayMs) => {
+                const timer = setTimeout(callback, delayMs);
+                return () => clearTimeout(timer);
+            }),
+        nextControlId: (sessionId, generation) => `autopilot-${generation}-${createHash('sha256').update(`${sessionId}:${randomUUID()}`).digest('hex').slice(0, 16)}`,
+        turnStarter: {
+            start: async (sessionId, controlId, generation) => {
+                const current = () => {
+                    const state = autopilotStore.find(sessionId);
+                    return Boolean(state &&
+                        state.requestedEnabled &&
+                        state.generation === generation &&
+                        state.lastControlId === controlId);
+                };
+                if (!current())
+                    throw new Error('AUTOPILOT_START_UNAVAILABLE');
+                const session = sessions.find(sessionId);
+                if (!session || !runtime || session.activeTurnId || interactions.list(sessionId).length)
+                    throw new Error('AUTOPILOT_START_UNAVAILABLE');
+                // A relay restart can leave a durable, otherwise eligible session without this
+                // process's writer. Reacquire through the normal ownership boundary before a
+                // synthetic start; never bypass its single-writer and replacement semantics.
+                const writer = await runtime.ensureWriter(session, new Date().toISOString());
+                if (!current() || writer.session.activeTurnId || interactions.list(sessionId).length)
+                    throw new Error('AUTOPILOT_START_UNAVAILABLE');
+                await options.autopilotBeforeTurnAccepted?.({ sessionId, controlId });
+                const started = await runtime.startTurn(writer.session, AUTOPILOT_CONTINUATION_PROMPT, controlId, new Date().toISOString());
+                if (!started.activeTurnId)
+                    throw new Error('AUTOPILOT_START_UNAVAILABLE');
+                sessions.save(started);
+                await options.autopilotAfterTurnAccepted?.({
+                    sessionId,
+                    controlId,
+                    turnId: started.activeTurnId,
+                });
+                activity.observe({
+                    sessionId,
+                    occurredAt: started.updatedAt,
+                    kind: 'turnStarted',
+                    ...(started.threadId ? { threadId: started.threadId } : {}),
+                    ...(started.activeTurnId ? { turnId: started.activeTurnId } : {}),
+                });
+            },
+        },
+        publish: (sessionId, type, payload, occurredAt, outboxId) => {
+            if (!sessions.find(sessionId))
+                return;
+            events.publish(journal.append(sessionId, type, payload, occurredAt, outboxId));
+        },
+    });
+    options.onAutopilotCoordinator?.(autopilot);
     const workspaces = new FilesystemWorkspaceCatalog(root);
     const models = new CodexModelCatalog(root, options.launchAppServer ?? launchCodexAppServer);
     const skillProfiles = new FilesystemSkillProfileStore(options.homeDirectory ?? homedir());
     const skillCatalog = (profile) => new CodexSkillCatalog(profile, options.launchAppServer ?? launchCodexAppServer);
     const editorSkillCatalog = new CachedSkillCatalog((profile, workspace) => skillCatalog(profile).list(workspace));
-    const workspacePlanCatalog = new FilesystemWorkspacePlanCatalog(new OrgPlanCommandValidator({
-        ...(planMeasurementHelperPath ? { helperPath: planMeasurementHelperPath } : {}),
-        discoverSkills: async (workspace) => (await skillCatalog('default').list(workspace)).skills,
-    }));
+    const workspacePlanCatalog = new FilesystemWorkspacePlanCatalog();
     const resolveSkills = async (session) => {
         const catalog = await skillCatalog(session.profile).list(session.workspacePath);
         if (session.effectiveSkillSelection)
@@ -118,20 +247,46 @@ export async function composeRelayApp(options) {
             .snapshot(sessionId)
             .find((item) => item.requestId === requestId);
         events.publish(journal.append(sessionId, 'interaction.resolved', { requestId, turnId: interaction?.turnId ?? null, resolvedAt: occurredAt, outcome }, occurredAt));
+        if (interaction?.kind === 'orgPlanAttention')
+            events.publish(journal.append(sessionId, 'org-plan.attention-resolved', { requestId, turnId: interaction.turnId ?? null, resolvedAt: occurredAt, outcome }, occurredAt));
+    };
+    const publishAttentionSettlement = (sessionId, requestId, occurredAt, outcome) => {
+        const remaining = interactions.list(sessionId);
+        const attention = remaining.find((item) => item.kind === 'orgPlanAttention');
+        activity.observe({
+            sessionId,
+            occurredAt,
+            kind: 'interactionResolved',
+            hasPendingInteraction: remaining.length > 0,
+            ...(attention ? { attentionReason: attention.payload.reason } : {}),
+        });
+        publishInteractionResolved(sessionId, requestId, occurredAt, outcome);
     };
-    const dismissPendingInteractions = (sessionId, occurredAt) => {
+    const dismissPendingInteractions = (sessionId, occurredAt, outcome = 'dismissed') => {
         for (const interaction of interactions.list(sessionId)) {
-            if (interactions.resolve(sessionId, interaction.requestId, occurredAt, 'dismissed'))
-                publishInteractionResolved(sessionId, interaction.requestId, occurredAt, 'dismissed');
+            if (interactions.resolve(sessionId, interaction.requestId, occurredAt, outcome))
+                publishInteractionResolved(sessionId, interaction.requestId, occurredAt, outcome);
         }
     };
-    const runtime = options.startAppServers
+    let closing = false;
+    let runtime = null;
+    runtime = options.startAppServers
         ? new CodexSessionRuntime(options.launchAppServer ?? launchCodexAppServer, undefined, (sessionId, notification) => {
             const occurredAt = new Date().toISOString();
+            const activityFact = decodeAgentActivityFact(sessionId, occurredAt, notification);
+            if (activityFact)
+                activity.observe(activityFact);
             const resolvedRequestId = resolvedServerRequestId(notification);
-            if (resolvedRequestId &&
-                interactions.resolve(sessionId, resolvedRequestId, occurredAt, 'dismissed'))
-                publishInteractionResolved(sessionId, resolvedRequestId, occurredAt, 'dismissed');
+            if (resolvedRequestId) {
+                const interaction = interactions.find(sessionId, resolvedRequestId);
+                const outcome = interaction?.kind === 'orgPlanAttention' ? 'failed' : 'dismissed';
+                if (interactions.resolve(sessionId, resolvedRequestId, occurredAt, outcome)) {
+                    if (outcome === 'failed')
+                        publishAttentionSettlement(sessionId, resolvedRequestId, occurredAt, outcome);
+                    else
+                        publishInteractionResolved(sessionId, resolvedRequestId, occurredAt, outcome);
+                }
+            }
             const currentSession = sessions.find(sessionId);
             const normalized = normalizeCodexNotification(sessionId, 0, occurredAt, notification, currentSession?.workspacePath, currentSession?.activeTurnId);
             if (!normalized)
@@ -143,6 +298,7 @@ export async function composeRelayApp(options) {
                 if (session && turnId && session.activeTurnId === turnId) {
                     completedSession = RelaySession.rehydrate(session).completeTurn(turnId, occurredAt).snapshot;
                     sessions.save(completedSession);
+                    autopilot.turnCompleted(sessionId);
                 }
                 planMeasurementRefresh?.refreshNow(sessionId);
             }
@@ -160,14 +316,28 @@ export async function composeRelayApp(options) {
                 requestedAt: new Date().toISOString(),
             };
             interactions.add(sessionId, interaction);
+            activity.observe({
+                sessionId,
+                occurredAt: interaction.requestedAt,
+                kind: 'interactionPending',
+                ...(interaction.kind === 'orgPlanAttention'
+                    ? { attentionReason: interaction.payload.reason }
+                    : {}),
+            });
             const updated = RelaySession.rehydrate(session).requestInteraction(interaction, new Date().toISOString()).snapshot;
             sessions.save(updated);
             events.publish(journal.append(sessionId, 'interaction.requested', interaction, updated.updatedAt));
+            if (interaction.kind === 'orgPlanAttention')
+                events.publish(journal.append(sessionId, 'org-plan.attention-required', interaction, updated.updatedAt));
+            autopilot.evaluate(sessionId);
             return true;
         }, (sessionId) => {
-            dismissPendingInteractions(sessionId, new Date().toISOString());
+            activity.disconnected(sessionId, new Date().toISOString());
+            dismissPendingInteractions(sessionId, new Date().toISOString(), 'failed');
             recoverExitedSession(sessionId);
         }, resolveSkills, planStatusSource, (sessionId, update) => {
+            if (closing)
+                return;
             supervisedPlans.accept(sessionId, update);
             planMeasurementRefresh?.accept(sessionId, update);
             if (update.kind === 'updated') {
@@ -185,6 +355,7 @@ export async function composeRelayApp(options) {
                 }
                 events.publish(journal.append(sessionId, 'plan.updated', { plan: update.plan, reason: update.reason }, occurredAt));
             }
+            autopilot.planUpdated(sessionId);
         }, options.planMeasurementBaseUrl, 30_000, 64, root)
         : null;
     if (runtime && planMeasurementHelperPath) {
@@ -196,8 +367,19 @@ export async function composeRelayApp(options) {
         }, (planPath, stepId, snapshot) => checkpointPlanMeasurement(planMeasurementHelperPath, planPath, stepId, snapshot));
     }
     const saveSession = (session) => {
+        const prior = sessions.find(session.id);
         sessions.save(session);
         events.publish(journal.append(session.id, 'session.updated', session, session.updatedAt));
+        const becameRuntimeReady = prior &&
+            prior.state !== 'ready' &&
+            prior.state !== 'turnActive' &&
+            (session.state === 'ready' || session.state === 'turnActive');
+        if (runtime &&
+            session.threadId &&
+            (!prior || prior.threadId !== session.threadId || becameRuntimeReady))
+            void activity.refresh(session.id);
+        if (becameRuntimeReady)
+            autopilot.restore(session.id);
     };
     if (runtime) {
         const supervisor = new SessionSupervisor(async (sessionId) => {
@@ -206,7 +388,8 @@ export async function composeRelayApp(options) {
                 return;
             const recovering = RelaySession.rehydrate(session).beginRecovery(new Date().toISOString()).snapshot;
             saveSession(recovering);
-            saveSession(await runtime.restore(recovering, new Date().toISOString()));
+            const restored = await runtime.restore(recovering, new Date().toISOString());
+            saveSession(restored);
         }, (sessionId) => {
             const session = sessions.find(sessionId);
             if (session)
@@ -217,8 +400,10 @@ export async function composeRelayApp(options) {
         recoverExitedSession = (sessionId) => {
             supervisor.cancel(sessionId);
             const session = sessions.find(sessionId);
-            if (session)
+            if (session) {
+                autopilot.cancel(sessionId, 'sessionEnded');
                 saveSession(RelaySession.rehydrate(session).stop(new Date().toISOString()).snapshot);
+            }
         };
     }
     let authorization;
@@ -313,11 +498,15 @@ export async function composeRelayApp(options) {
                     ? async (session, settings) => {
                         const now = new Date().toISOString();
                         dismissPendingInteractions(session.id, now);
-                        return runtime.start(session, now, settings);
+                        const started = await runtime.start(session, now, settings);
+                        return started;
                     }
                     : undefined,
                 startTurn: runtime
-                    ? async (session, text, clientUserMessageId) => runtime.startTurn(session, text, clientUserMessageId, new Date().toISOString())
+                    ? async (session, text, clientUserMessageId) => {
+                        autopilot.manualSend(session.id);
+                        return runtime.startTurn(session, text, clientUserMessageId, new Date().toISOString());
+                    }
                     : undefined,
                 ensureWriter: runtime
                     ? (session) => {
@@ -331,7 +520,21 @@ export async function composeRelayApp(options) {
                         return runtime.release(id);
                     }
                     : undefined,
-                onTurnStarted: (session) => planMeasurementRefresh?.refreshNow(session.id),
+                onTurnStarted: (session) => {
+                    activity.observe({
+                        sessionId: session.id,
+                        occurredAt: session.updatedAt,
+                        kind: 'turnStarted',
+                        ...(session.threadId ? { threadId: session.threadId } : {}),
+                        ...(session.activeTurnId ? { turnId: session.activeTurnId } : {}),
+                    });
+                    planMeasurementRefresh?.refreshNow(session.id);
+                },
+                agentActivity: (id) => activity.snapshot(id, new Date().toISOString()),
+                autopilotSnapshot: (id) => autopilot.snapshot(id),
+                autopilotControlTurns: (id) => autopilot.acceptedControlTurns(id),
+                autopilotAudit: (id, limit) => journal.autopilotAuditTail(id, limit),
+                refreshActivity: (id) => activity.refresh(id),
                 models,
                 readHistory: runtime ? (session) => runtime.readHistory(session) : undefined,
                 currentSequence: (sessionId) => journal.since(sessionId, 0).at(-1)?.sequence ?? 0,
@@ -339,8 +542,20 @@ export async function composeRelayApp(options) {
                     ? (session, turnId) => runtime.interruptTurn(session, turnId)
                     : undefined,
                 restore: runtime
-                    ? (session) => runtime.restoreWithOutcome(session, new Date().toISOString())
+                    ? async (session) => {
+                        const restored = await runtime.restoreWithOutcome(session, new Date().toISOString());
+                        // An exit can be reported while resume is resolving. Do not let the
+                        // route persist a stale ready snapshot over that recovered exit.
+                        if (!runtime.ownsWriter(session.id))
+                            return {
+                                ...restored,
+                                session: RelaySession.rehydrate(restored.session).stop(new Date().toISOString())
+                                    .snapshot,
+                            };
+                        return restored;
+                    }
                     : undefined,
+                ownsWriter: runtime ? (id) => runtime.ownsWriter(id) : undefined,
                 promoteRecent: runtime
                     ? (thread) => promoteRecentThread(thread, {
                         createId: randomUUID,
@@ -350,13 +565,22 @@ export async function composeRelayApp(options) {
                         read: (session) => runtime.readHistory(session),
                     })
                     : undefined,
-                release: (session) => RelaySession.rehydrate(session).release(new Date().toISOString()).snapshot,
-                remove: (id) => sessions.remove(id),
+                release: (session) => {
+                    autopilot.cancel(session.id, 'sessionEnded');
+                    return RelaySession.rehydrate(session).release(new Date().toISOString()).snapshot;
+                },
+                remove: (id) => {
+                    autopilot.cancel(id, 'sessionEnded');
+                    activity.dispose(id);
+                    sessions.remove(id);
+                },
                 idempotency,
                 close: runtime
                     ? (id) => {
+                        autopilot.cancel(id, 'sessionEnded');
                         planMeasurementRefresh?.stop(id);
                         dismissPendingInteractions(id, new Date().toISOString());
+                        activity.dispose(id);
                         return runtime.release(id);
                     }
                     : undefined,
@@ -364,6 +588,17 @@ export async function composeRelayApp(options) {
                     ? (sessionId, requestId, value) => runtime.resolveServerRequest(sessionId, requestId, value) ? 'accepted' : 'cleared'
                     : undefined,
                 interactionResolved: (sessionId, requestId, occurredAt, outcome) => {
+                    const remaining = interactions.list(sessionId);
+                    const attention = remaining.find((item) => item.kind === 'orgPlanAttention');
+                    activity.observe({
+                        sessionId,
+                        occurredAt,
+                        kind: 'interactionResolved',
+                        hasPendingInteraction: remaining.length > 0,
+                        ...(attention
+                            ? { attentionReason: attention.payload.reason }
+                            : {}),
+                    });
                     publishInteractionResolved(sessionId, requestId, occurredAt, outcome);
                 },
             },
@@ -384,12 +619,14 @@ export async function composeRelayApp(options) {
                 removeStatus: (id) => planStatusSource.remove(id, supervisedPlans.identity(id) ?? undefined),
                 clear: (id) => supervisedPlans.clear(id),
                 closed: (id) => {
+                    autopilot.cancel(id, 'planRemoved');
                     planMeasurementRefresh?.stop(id);
                     const occurredAt = new Date().toISOString();
                     events.publish(journal.append(id, 'plan.closed', {}, occurredAt));
                 },
             },
             workspacePlanRoutes: { workspaces, plans: workspacePlanCatalog },
+            autopilot,
             ...(runtime
                 ? {
                     planMeasurementRoutes: {
@@ -415,9 +652,108 @@ export async function composeRelayApp(options) {
                         return false;
                     if (interaction.kind === 'quiz')
                         return isValidQuizInteractionResponse(interaction.payload, value);
+                    // Attention must use its operation-keyed boundary; generic interaction
+                    // responses deliberately cannot bypass durable operation identity.
+                    if (interaction.kind === 'orgPlanAttention')
+                        return false;
                     return isValidInteractionResponse(interaction.kind, value);
                 },
             },
+            orgPlanAttention: {
+                exists: (id) => sessions.find(id) !== null,
+                reader: {
+                    active: (sessionId) => {
+                        const interaction = interactions
+                            .list(sessionId)
+                            .find((item) => item.kind === 'orgPlanAttention');
+                        const attention = interaction ? parseOrgPlanAttention(interaction.payload) : null;
+                        return interaction && attention
+                            ? {
+                                requestId: interaction.requestId,
+                                turnId: interaction.turnId ?? null,
+                                requestedAt: interaction.requestedAt ?? null,
+                                attention,
+                            }
+                            : null;
+                    },
+                },
+                resolver: {
+                    resolve: async ({ sessionId, requestId, operationKey, response }) => {
+                        const scope = `org-plan-attention:${sessionId}:${requestId}`;
+                        const stored = idempotency.get(scope, operationKey);
+                        if (stored)
+                            return JSON.parse(stored.body);
+                        const terminal = interactions.terminalOperation(sessionId, requestId);
+                        if (terminal)
+                            return terminal.operationKey === operationKey
+                                ? terminal.outcome === 'failed'
+                                    ? { kind: 'writerCleared', resolvedAt: terminal.resolvedAt }
+                                    : { kind: 'replayed', resolvedAt: terminal.resolvedAt }
+                                : { kind: 'staleOperation' };
+                        const key = `${scope}:${operationKey}`;
+                        const inFlight = attentionResolutionOperations.get(key);
+                        if (inFlight)
+                            return inFlight;
+                        const operation = (async () => {
+                            const interaction = interactions.find(sessionId, requestId);
+                            if (!interaction || interaction.kind !== 'orgPlanAttention')
+                                return { kind: 'noActive' };
+                            const claim = interactions.claimOperation(sessionId, requestId, operationKey);
+                            if (claim === 'resolved') {
+                                const resolved = interactions.resolved(sessionId, requestId);
+                                return resolved
+                                    ? { kind: 'replayed', resolvedAt: resolved.resolvedAt }
+                                    : { kind: 'staleOperation' };
+                            }
+                            if (claim === 'stale')
+                                return { kind: 'staleOperation' };
+                            if (claim === 'missing')
+                                return { kind: 'noActive' };
+                            // A durable capability belongs to the session/thread, not the
+                            // relay process.  A supported stopped writer is retryable;
+                            // missing capability identifies a pre-rollout legacy thread.
+                            if (sessions.find(sessionId)?.attentionToolCapability !== 'supported')
+                                return { kind: 'legacyUnsupported' };
+                            if (!runtime)
+                                return { kind: 'writerUnavailable' };
+                            if (!interactions.beginDelivery(sessionId, requestId, operationKey))
+                                return { kind: 'staleOperation' };
+                            const writer = runtime.attentionWriterState(sessionId, requestId);
+                            if (writer === 'unavailable') {
+                                interactions.retryDelivery(sessionId, requestId, operationKey);
+                                return { kind: 'writerUnavailable' };
+                            }
+                            const resolvedAt = new Date().toISOString();
+                            if (writer === 'cleared') {
+                                if (!interactions.settleOperation(sessionId, requestId, operationKey, resolvedAt, 'failed'))
+                                    return { kind: 'staleOperation' };
+                                publishAttentionSettlement(sessionId, requestId, resolvedAt, 'failed');
+                                return { kind: 'writerCleared', resolvedAt };
+                            }
+                            if (!runtime.resolveServerRequest(sessionId, requestId, response)) {
+                                // The state check and delivery are synchronous, but retain a
+                                // defensive retry path for a future runtime implementation.
+                                interactions.retryDelivery(sessionId, requestId, operationKey);
+                                return { kind: 'writerUnavailable' };
+                            }
+                            if (!interactions.settleOperation(sessionId, requestId, operationKey, resolvedAt, 'answered'))
+                                return { kind: 'staleOperation' };
+                            const accepted = { kind: 'accepted', resolvedAt };
+                            idempotency.put(scope, operationKey, 202, JSON.stringify({ kind: 'replayed', resolvedAt }));
+                            publishAttentionSettlement(sessionId, requestId, resolvedAt, 'answered');
+                            return accepted;
+                        })();
+                        attentionResolutionOperations.set(key, operation);
+                        try {
+                            return await operation;
+                        }
+                        finally {
+                            attentionResolutionOperations.delete(key);
+                        }
+                    },
+                },
+                transitions: attentionTransitions,
+            },
             gitSummary: {
                 workspaces,
                 inspect: async (path) => {
@@ -453,10 +789,18 @@ export async function composeRelayApp(options) {
         throw error;
     }
     const detachActiveSessions = async () => {
-        await mapWithConcurrency(sessions.list().filter((session) => session.threadId !== null), 2, async (session) => {
-            if (session.desiredState === 'active')
+        await mapWithConcurrency(sessions
+            .list()
+            .filter((session) => persistedSessionIds.has(session.id) && session.threadId !== null), 2, async (session) => {
+            // The status lease must repopulate the authoritative plan projection before
+            // a durable coordinator is restored. Writer detachment is a process concern,
+            // not a human disable: a later fenced continuation can reacquire it safely.
+            if (session.desiredState === 'active') {
                 saveSession(RelaySession.rehydrate(session).stop(new Date().toISOString()).snapshot);
+                await runtime?.release(session.id);
+            }
             await runtime?.watchPlanStatus(session);
+            autopilot.restore(session.id);
         });
     };
     app.addHook('onListen', async () => {
@@ -466,9 +810,22 @@ export async function composeRelayApp(options) {
         await detachActiveSessions();
     });
     app.addHook('onClose', async () => {
+        closing = true;
         planMeasurementRefresh?.stopAll();
-        for (const session of sessions.list())
-            dismissPendingInteractions(session.id, new Date().toISOString());
+        for (const session of sessions.list()) {
+            autopilot.dispose(session.id);
+            activity.dispose(session.id);
+            // Relay shutdown only releases this process's writer.  A typed attention
+            // request remains a durable human-visible blocker for the next relay
+            // instance; only an app-server-cleared request is a failed audit outcome.
+            for (const interaction of interactions.list(session.id)) {
+                if (interaction.kind === 'orgPlanAttention')
+                    continue;
+                const occurredAt = new Date().toISOString();
+                if (interactions.resolve(session.id, interaction.requestId, occurredAt, 'dismissed'))
+                    publishInteractionResolved(session.id, interaction.requestId, occurredAt, 'dismissed');
+            }
+        }
         runtime?.stopAll();
         planStatusSource.closeAll();
         database.close();