oasis_test 0.1.99 → 0.1.101

package/dist/index.js

@@ -2607,7 +2607,53 @@ var init_trace = __esm({
 });
 
 // ../contract/src/execution-continuity.ts
-var ExecutionAttemptNotFoundError;
+function isUserHandoffDeliverable(ref2) {
+  const kind = ref2.kind.trim().toLowerCase();
+  const id = ref2.id.trim();
+  const label = ref2.label?.trim().toLowerCase();
+  if (!id || !USER_HANDOFF_DELIVERABLE_KINDS.has(kind)) return false;
+  if (label && INTERNAL_HANDOFF_LABELS.has(label)) return false;
+  return !["attempt:", "checkpoint:", "handoff:", "op:", "run:", "runtime:"].some((prefix) => id.toLowerCase().startsWith(prefix));
+}
+function userHandoffDeliverables(refs) {
+  const seen = /* @__PURE__ */ new Set();
+  return refs.flatMap((ref2) => {
+    if (!isUserHandoffDeliverable(ref2)) return [];
+    const normalized4 = {
+      ...ref2,
+      kind: ref2.kind.trim(),
+      id: ref2.id.trim(),
+      ...ref2.label === void 0 ? {} : { label: ref2.label.trim() }
+    };
+    const key = `${normalized4.kind.toLowerCase()}\0${normalized4.id}\0${normalized4.version ?? ""}`;
+    if (seen.has(key)) return [];
+    seen.add(key);
+    return [normalized4];
+  });
+}
+function normalizeUserHandoff(outcome, _changedOutputs, authored) {
+  if (!authored) return null;
+  const status = outcome === "succeeded" ? "delivered" : "not_delivered";
+  if (authored.status !== status) {
+    throw new Error(`user handoff status ${authored.status} does not match outcome ${outcome}`);
+  }
+  const summary = authored.summary.trim();
+  if (!summary) throw new Error("user handoff summary is required");
+  if ([...summary].length > 400) {
+    throw new Error("user handoff summary exceeds 400 characters");
+  }
+  const nextStep = authored.nextStep.trim();
+  if ([...nextStep].length > 400) {
+    throw new Error("user handoff next step exceeds 400 characters");
+  }
+  return {
+    status,
+    summary,
+    deliverables: status === "delivered" ? userHandoffDeliverables(authored.deliverables) : [],
+    nextStep
+  };
+}
+var ExecutionAttemptNotFoundError, USER_HANDOFF_DELIVERABLE_KINDS, INTERNAL_HANDOFF_LABELS;
 var init_execution_continuity = __esm({
   "../contract/src/execution-continuity.ts"() {
     "use strict";
@@ -2618,6 +2664,40 @@ var init_execution_continuity = __esm({
         this.name = "ExecutionAttemptNotFoundError";
       }
     };
+    USER_HANDOFF_DELIVERABLE_KINDS = /* @__PURE__ */ new Set([
+      "artifact",
+      "audio",
+      "blob",
+      "code",
+      "commit",
+      "data",
+      "dataset",
+      "diff",
+      "document",
+      "file",
+      "html",
+      "image",
+      "link",
+      "markdown",
+      "markdown-document",
+      "output",
+      "report",
+      "repository",
+      "revision",
+      "text",
+      "url",
+      "video"
+    ]);
+    INTERNAL_HANDOFF_LABELS = /* @__PURE__ */ new Set([
+      "checkpoint",
+      "conclude",
+      "continuity-checkpoint",
+      "continuity-handoff",
+      "control",
+      "gap",
+      "op",
+      "operation"
+    ]);
   }
 });
 
@@ -3289,6 +3369,22 @@ async function assembleContext(args) {
   const actorLabels = args.resolveActorLabels ? await args.resolveActorLabels().catch(() => /* @__PURE__ */ new Map()) : /* @__PURE__ */ new Map();
   const actorLabel = (id) => id === void 0 ? "" : actorLabels.get(id) ?? id;
   const files = {};
+  const upstreamHandoffFiles = /* @__PURE__ */ new Map();
+  if (args.resolveUpstreamHandoff && artifact.workspace) {
+    for (const edge of artifact.inputs) {
+      if (edge.pinned === null) continue;
+      const content = await args.resolveUpstreamHandoff({
+        workOrderId: artifact.workspace,
+        downstreamNodeId: artifact.id,
+        upstreamNodeId: edge.to,
+        pinnedWorkId: edge.pinned
+      });
+      if (content) {
+        const dir = `inputs/${slug2(edge.to)}@${edge.pinned.slice(9, 17)}`;
+        upstreamHandoffFiles.set(`${dir}/${UPSTREAM_HANDOFF_BASENAME}`, content);
+      }
+    }
+  }
   if (canvasMode && artifact.description) files["DESIGN_BRIEF.md"] = artifact.description;
   if (closureReportMode && artifact.workspace) {
     const ledger = buildWorkorderLedger(model, artifact.workspace);
@@ -3928,7 +4024,16 @@ ${m2.spec.split("\n").map((l) => `  > ${l}`).join("\n")}`);
       ``,
       `## \u4F60\u7684\u8F93\u5165`,
       args.action === "review" ? `\u8BFB \`inputs/\` \u2014\u2014 \u5404\u4E0A\u6E38\u4E00\u4E2A\u6587\u4EF6\u5939\uFF1B**\u636E\u5B83\u6838\u5BF9\u5F53\u524D\u4EA7\u7269\u4E0E\u4E0A\u6E38\u662F\u5426\u4E00\u81F4**\uFF08\u6587\u672C\u7C7B=\u6587\u4EF6\uFF0C\u4EE3\u7801/\u5916\u90E8\u7C7B=\u6307\u9488\uFF09\uFF1A` : `\u8BFB \`inputs/\` \u2014\u2014 \u6BCF\u4E2A\u4E0A\u6E38\u4E00\u4E2A\u6587\u4EF6\u5939\uFF0C\u6309\u91CC\u9762\u5185\u5BB9\u529E\uFF08**\u6587\u672C\u7C7B=\u6587\u4EF6\uFF0C\u4EE3\u7801/\u5916\u90E8\u7C7B=\u6307\u9488**\uFF09\uFF1A`,
-      ...artifact.inputs.filter((e) => e.pinned !== null).length === 0 ? [`- \uFF08\u672C\u4EA7\u7269\u6682\u65E0\u5DF2\u5C31\u7EEA\u7684\u4E0A\u6E38\u8F93\u5165\uFF09`] : artifact.inputs.filter((e) => e.pinned !== null).map((e) => `- \`inputs/${slug2(e.to)}@${e.pinned.slice(9, 17)}/\` \u2190 ${e.to}${e.required ? "\uFF08required\uFF09" : ""}`)
+      ...artifact.inputs.filter((e) => e.pinned !== null).length === 0 ? [`- \uFF08\u672C\u4EA7\u7269\u6682\u65E0\u5DF2\u5C31\u7EEA\u7684\u4E0A\u6E38\u8F93\u5165\uFF09`] : artifact.inputs.filter((e) => e.pinned !== null).map((e) => `- \`inputs/${slug2(e.to)}@${e.pinned.slice(9, 17)}/\` \u2190 ${e.to}${e.required ? "\uFF08required\uFF09" : ""}`),
+      ...upstreamHandoffFiles.size === 0 ? [] : [
+        ``,
+        `### \u4E0A\u6E38\u4E1A\u52A1\u4EA4\u63A5\uFF08\u5F00\u5DE5\u524D\u5FC5\u8BFB\uFF09`,
+        `1. \u5148\u8BFB\u6BCF\u4E2A\u4E0A\u6E38\u76EE\u5F55\u4E2D\u7684 \`${UPSTREAM_HANDOFF_BASENAME}\`\u3002`,
+        `2. \u518D\u8BFB\u540C\u76EE\u5F55\u7684 \`CONTENT.md\`\u3001\`PIN.md\` \u548C\u5B9E\u9645\u4E1A\u52A1\u6587\u4EF6\u3002`,
+        `3. \u7528 handoff \u7406\u89E3\u4E0A\u6E38\u5B8C\u6210\u60C5\u51B5\u3001\u53D8\u66F4\u8F93\u51FA\u3001\u672A\u51B3\u4E8B\u9879\u3001\u98CE\u9669\u4E0E\u5EFA\u8BAE\u52A8\u4F5C\u3002`,
+        `4. \u7528 pinned inputs \u4E0E handoff \u4E2D\u7684 durable output \u5F15\u7528\u6838\u9A8C\u5B9E\u9645\u4EA7\u7269\uFF1Bhandoff \u662F\u4EA4\u63A5\u8BF4\u660E\uFF0C\u4E0D\u66FF\u4EE3\u4EA7\u7269\u4E8B\u5B9E\u3002`,
+        ...[...upstreamHandoffFiles.keys()].map((path26) => `- \u4EA4\u63A5\uFF1A\`${path26}\``)
+      ]
     ],
     ...skillsLines.length > 0 ? [``, `## \u4F60\u7684\u6280\u80FD\uFF08\u5DF2\u4E3A\u4F60\u542F\u7528\uFF0C\u6309\u9700\u8C03\u7528\uFF09`, ...skillsLines] : [],
     ``,
@@ -4029,6 +4134,17 @@ ${m2.spec.split("\n").map((l) => `  > ${l}`).join("\n")}`);
 required=${edge.required}
 ` + (latest && latest !== edge.pinned ? `\u6CE8\u610F\uFF1A\u4E0A\u6E38\u5DF2\u6709\u66F4\u65B0\u91CC\u7A0B\u7891 ${latest}\uFF08\u4F60 pin \u7684\u662F\u65E7\u7248\uFF09
 ` : "");
+    const handoffPath = `${dir}/${UPSTREAM_HANDOFF_BASENAME}`;
+    const handoff = upstreamHandoffFiles.get(handoffPath);
+    if (handoff !== void 0) {
+      const collision = Object.keys(files).find((file) => file.toLowerCase() === handoffPath.toLowerCase());
+      if (collision) {
+        throw new Error(
+          `upstream input ${edge.to}@${edge.pinned} uses system-reserved filename ${UPSTREAM_HANDOFF_BASENAME} (${collision})`
+        );
+      }
+      files[handoffPath] = handoff;
+    }
   }
   const limit = args.historyLimit ?? 20;
   const opLog = args.oplog ? (await args.oplog.read(artifactId)).slice(-limit).map((op) => `#${op.seq} ${op.timestamp} ${op.kind} by ${op.actor}`).join("\n") : "";
@@ -4100,7 +4216,7 @@ required=${c.required}
   }
   return { text: lines.join("\n"), files };
 }
-var slug2, WORKDIR_KEEP_BASENAME, WORKDIR_KEEP_DELIVERABLE, WORKDIR_KEEP_INPUTS, WORKDIR_KEEP_BODY, REVIEW_NOTE_MAX_CHARS, decodeText, REVIEW_ROLE_LENS_PLACEHOLDER, REVIEW_GATE_DIVISION_PLACEHOLDER;
+var slug2, UPSTREAM_HANDOFF_BASENAME, WORKDIR_KEEP_BASENAME, WORKDIR_KEEP_DELIVERABLE, WORKDIR_KEEP_INPUTS, WORKDIR_KEEP_BODY, REVIEW_NOTE_MAX_CHARS, decodeText, REVIEW_ROLE_LENS_PLACEHOLDER, REVIEW_GATE_DIVISION_PLACEHOLDER;
 var init_assembler = __esm({
   "../core/src/assembler.ts"() {
     "use strict";
@@ -4112,6 +4228,7 @@ var init_assembler = __esm({
     init_diff();
     init_workorder_ledger();
     slug2 = (id) => id.replace(/[^a-zA-Z0-9_-]+/g, "_");
+    UPSTREAM_HANDOFF_BASENAME = "_HANDOFF.md";
     WORKDIR_KEEP_BASENAME = ".oasis-keep";
     WORKDIR_KEEP_DELIVERABLE = `deliverable/${WORKDIR_KEEP_BASENAME}`;
     WORKDIR_KEEP_INPUTS = `inputs/${WORKDIR_KEEP_BASENAME}`;
@@ -5242,7 +5359,9 @@ var init_dispatcher = __esm({
           artifactId: args.artifactId,
           actor: args.actor,
           action: "produce",
-          ...args.part !== void 0 ? { part: args.part } : {}
+          ...args.part !== void 0 ? { part: args.part } : {},
+          ...args.engineWorkId !== void 0 ? { engineWorkId: args.engineWorkId } : {},
+          ...args.engineCompanyId !== void 0 ? { engineCompanyId: args.engineCompanyId } : {}
         }, args.bypassScheduling === true, args.dispatchId);
       }
       /** 新引擎回信 work（设计-最终 §回信轮）的 effect 调到此——派发收容回信会话（唯一写动作 `oasis reply`）。
@@ -5517,6 +5636,7 @@ var init_dispatcher = __esm({
           ...prevBriefSeq !== void 0 ? { prevBriefSeq } : {},
           ...this.opts.schema !== void 0 ? { schema: this.opts.schema } : {},
           ...codeRepo ? { codeRepo } : {},
+          ...this.opts.resolveUpstreamHandoff !== void 0 ? { resolveUpstreamHandoff: this.opts.resolveUpstreamHandoff } : {},
           ...this.opts.resolveActorContext !== void 0 ? { resolveActorContext: this.opts.resolveActorContext } : {},
           ...this.opts.resolveActorLabels !== void 0 ? { resolveActorLabels: this.opts.resolveActorLabels } : {},
           ...this.opts.resolveRoleBriefs !== void 0 ? { resolveRoleBriefs: this.opts.resolveRoleBriefs } : {},
@@ -5533,7 +5653,18 @@ var init_dispatcher = __esm({
             continuityArtifact.workspace,
             { jobKey, ...spec.part !== void 0 ? { part: spec.part } : {} }
           );
-          if (resumePack) bundle.files["execution/RESUME.md"] = resumePack;
+          if (resumePack) {
+            bundle.files["execution/RESUME.md"] = resumePack;
+            bundle.files["TASK.md"] += [
+              "",
+              "## \u6267\u884C\u6062\u590D\uFF08\u4EC5\u5F53\u524D\u8282\u70B9\uFF09",
+              "\u672C\u8F6E\u662F\u540C\u4E00\u8282\u70B9\u4E0A\u4E00\u6B21 Attempt \u4E2D\u65AD\u540E\u7684\u7EE7\u7EED\u6267\u884C\u3002\u5F00\u5DE5\u524D\u5148\u8BFB `execution/RESUME.md`\uFF0C",
+              "\u6838\u5BF9\u6700\u65B0 Checkpoint\u3001\u5DF2\u5B8C\u6210\u6B65\u9AA4\u3001durable outputs\u3001ExternalEffects \u4E0E\u672A\u51B3\u6B65\u9AA4\uFF1B",
+              "\u4ECE\u5C1A\u672A\u5B8C\u6210\u7684\u90E8\u5206\u7EE7\u7EED\uFF0C\u907F\u514D\u91CD\u590D\u5DF2\u7ECF\u786E\u8BA4\u5B8C\u6210\u7684\u6B65\u9AA4\u6216\u5916\u90E8\u526F\u4F5C\u7528\u3002",
+              "\u8FD9\u4EFD\u6062\u590D\u6750\u6599\u4E0D\u662F\u4E0A\u6E38\u8282\u70B9\u7684\u4E1A\u52A1\u4EA4\u63A5\uFF1B\u4E0A\u6E38\u4EA4\u63A5\u4ECD\u4EE5 `inputs/*/_HANDOFF.md` \u4E3A\u51C6\u3002",
+              ""
+            ].join("\n");
+          }
         }
         this.assertSpawnAttemptCurrent(jobKey, attempt);
         const limits = { wallClockMs: this.wallClockFor(spec.artifactId) };
@@ -5634,6 +5765,8 @@ var init_dispatcher = __esm({
           }
           const tsess = {
             runId: session.id,
+            ...spec.engineWorkId !== void 0 ? { engineWorkId: spec.engineWorkId } : {},
+            ...spec.engineCompanyId !== void 0 ? { engineCompanyId: spec.engineCompanyId } : {},
             // 运行时会话号落账：它是 cwd 目录名、也是 --resume 的键。不记的话 run 与它跑在哪个
             // 工作目录之间就断了链（只能靠 grep 包内容 + 比对时间戳去猜）。
             ...runtimeSessionId !== void 0 ? { runtimeSessionId } : {},
@@ -6146,10 +6279,12 @@ var init_dispatcher = __esm({
 });
 
 // ../engine/src/model.ts
-var DEFAULT_CONFIG, MAX_WORK_DURATION_MS, MAX_REVIEW_DURATION_MS, MAX_REVIEW_RETRIES, deriveWorkId, deriveReplyWorkId, deriveReviewId, deriveReplyId;
+var BUSINESS_HANDOFF_POLICY_FIELD, BUSINESS_HANDOFF_POLICY_EXEMPT, DEFAULT_CONFIG, MAX_WORK_DURATION_MS, MAX_REVIEW_DURATION_MS, MAX_REVIEW_RETRIES, deriveWorkId, deriveReplyWorkId, deriveReviewId, deriveReplyId;
 var init_model = __esm({
   "../engine/src/model.ts"() {
     "use strict";
+    BUSINESS_HANDOFF_POLICY_FIELD = "businessHandoffPolicy";
+    BUSINESS_HANDOFF_POLICY_EXEMPT = "exempt";
     DEFAULT_CONFIG = {
       maxRetries: 3
     };
@@ -6185,6 +6320,7 @@ function eventAnchors(e) {
       return { nodeId: e.nodeId, workId: e.workId };
     case "work.started":
     case "work.response":
+    case "work.handoff_recorded":
     case "work.timeout":
     case "work.accept":
     case "work.submit_output":
@@ -6612,6 +6748,7 @@ function scan(state, ctx) {
     if (wstate === "success" && node.latestAcceptId !== lw.id) {
       const reqs = state.requirementsOf(node.id);
       if (reqs.length === 0) {
+        if (!businessHandoffBarrierSatisfied(state, node.id, lw.id)) continue;
         events.push({
           kind: "work.accept",
           workorderId: state.workorder.id,
@@ -6641,6 +6778,7 @@ function tryToRun(state, nodeId, ctx, events) {
     if (e.kind !== "data" || !e.required) continue;
     const upstream = state.node(e.fromNodeId);
     if (!upstream?.latestAcceptId) return;
+    if (isBusinessDependencyEdge(state, e) && !businessHandoffBarrierSatisfied(state, upstream.id, upstream.latestAcceptId)) return;
   }
   if (state.hasQueuedWorkFor(nodeId)) return;
   const workId = deriveWorkId(nodeId, state.worksOf(nodeId).length + 1);
@@ -6742,6 +6880,7 @@ function processReviews(state, nodeId, workId, ctx, events) {
     }
   }
   if (shouldAccept) {
+    if (!businessHandoffBarrierSatisfied(state, nodeId, workId)) return;
     events.push({
       kind: "work.accept",
       workorderId: state.workorder.id,
@@ -6859,8 +6998,28 @@ function checkTerminated(state) {
   if (state.allIssues().some((i) => i.state === "open")) return false;
   const live = state.liveNodes();
   if (live.length === 0) return true;
+  for (const edge of state.allEdges()) {
+    if (!isBusinessDependencyEdge(state, edge)) continue;
+    const upstream = state.node(edge.fromNodeId);
+    if (!upstream?.latestWorkId || !businessHandoffBarrierSatisfied(state, upstream.id, upstream.latestWorkId)) return false;
+  }
   return live.every((n) => n.latestWorkId !== null && n.latestAcceptId === n.latestWorkId);
 }
+function isBusinessDependencyEdge(state, edge) {
+  const downstream = state.node(edge.toNodeId);
+  return edge.kind === "data" && edge.required && downstream?.fields?.[BUSINESS_HANDOFF_POLICY_FIELD] !== BUSINESS_HANDOFF_POLICY_EXEMPT;
+}
+function businessHandoffBarrierSatisfied(state, nodeId, workId) {
+  const work = state.work(workId);
+  if (!requiresBusinessHandoff(state, nodeId, work)) return true;
+  const node = state.node(nodeId);
+  return node?.latestWorkId === workId && work?.agentHandoffAttemptId !== null && work?.businessHandoffStatus === "delivered";
+}
+function requiresBusinessHandoff(state, nodeId, work) {
+  if (!state.edgesFrom(nodeId).some((edge) => isBusinessDependencyEdge(state, edge))) return false;
+  if (typeof work?.assigneeActorId === "string" && work.assigneeActorId.startsWith("actor:human:")) return false;
+  return true;
+}
 function activate(state, nodeId, _ctx) {
   const node = state.node(nodeId);
   if (!node) return "cancelled";
@@ -6993,6 +7152,10 @@ CREATE TABLE IF NOT EXISTS ${schema}.works (
   reply_to_issue_id text,
   output_version_no integer,
   conclusion        text,
+  -- NodeHandoff \u4E8B\u5B9E\u6E90\u7684\u6700\u5C0F\u8C03\u5EA6\u6295\u5F71\uFF1B\u4EC5 agent-authored handoff \u53EF\u5199\uFF0Csystem reconstruction \u4E0D\u5199\u3002
+  agent_handoff_attempt_id       text,
+  business_handoff_status        text CHECK (business_handoff_status IN ('delivered','not_delivered')),
+  business_handoff_recorded_at   timestamptz,
   acceptance_state  text CHECK (acceptance_state IN ('draft','accepted','rejected')),
   accepted_at       timestamptz,
   accepted_by       text,
@@ -7155,6 +7318,12 @@ CREATE TABLE IF NOT EXISTS ${schema}.event_handler_log (
 ALTER TABLE ${schema}.works   ADD COLUMN IF NOT EXISTS retry_at timestamptz;
 ALTER TABLE ${schema}.reviews ADD COLUMN IF NOT EXISTS retry_at timestamptz;
 ALTER TABLE ${schema}.works   ADD COLUMN IF NOT EXISTS status text;
+ALTER TABLE ${schema}.works   ADD COLUMN IF NOT EXISTS agent_handoff_attempt_id text;
+ALTER TABLE ${schema}.works   ADD COLUMN IF NOT EXISTS business_handoff_status text;
+ALTER TABLE ${schema}.works   ADD COLUMN IF NOT EXISTS business_handoff_recorded_at timestamptz;
+ALTER TABLE ${schema}.works DROP CONSTRAINT IF EXISTS works_business_handoff_status_check;
+ALTER TABLE ${schema}.works ADD CONSTRAINT works_business_handoff_status_check
+  CHECK (business_handoff_status IS NULL OR business_handoff_status IN ('delivered','not_delivered'));
 ALTER TABLE ${schema}.reviews ADD COLUMN IF NOT EXISTS status text;
 -- \u56DE\u4FE1 work\uFF08\u8BBE\u8BA1-\u6700\u7EC8 \xA7\u56DE\u4FE1\u8F6E\uFF09\uFF1A\u975E\u7A7A = \u5BF9\u8BE5 comment issue \u7684\u56DE\u4FE1\u8F6E\uFF0C\u4E0D\u8FDB\u8282\u70B9\u4E3B\u94FE
 ALTER TABLE ${schema}.works   ADD COLUMN IF NOT EXISTS reply_to_issue_id text;
@@ -12568,6 +12737,9 @@ var init_store_postgres = __esm({
             replyToIssueId: w2.reply_to_issue_id ?? null,
             outputVersionNo: w2.output_version_no,
             conclusion: w2.conclusion,
+            agentHandoffAttemptId: w2.agent_handoff_attempt_id ?? null,
+            businessHandoffStatus: w2.business_handoff_status ?? null,
+            businessHandoffRecordedAt: iso(w2.business_handoff_recorded_at),
             acceptanceState: w2.acceptance_state,
             acceptedAt: iso(w2.accepted_at),
             acceptedBy: w2.accepted_by,
@@ -12771,8 +12943,9 @@ var init_store_postgres = __esm({
                 `INSERT INTO ${this.s}.works
              (id,workorder_id,node_id,assignee_actor_id,created_at,started_at,ended_at,dead_at,cancelled_at,retry_at,status,outcome,
               outcome_detail,session_ref,continues_work_id,reply_to_issue_id,output_version_no,
-              node_version,conclusion,acceptance_state,accepted_at,accepted_by,rejected_reason,override_by,override_reason)
-             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25)
+              node_version,conclusion,agent_handoff_attempt_id,business_handoff_status,business_handoff_recorded_at,
+              acceptance_state,accepted_at,accepted_by,rejected_reason,override_by,override_reason)
+             VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28)
              ON CONFLICT (id) DO NOTHING`,
                 [
                   w2.id,
@@ -12794,6 +12967,9 @@ var init_store_postgres = __esm({
                   w2.outputVersionNo,
                   w2.nodeVersion,
                   w2.conclusion,
+                  w2.agentHandoffAttemptId,
+                  w2.businessHandoffStatus,
+                  w2.businessHandoffRecordedAt,
                   w2.acceptanceState,
                   w2.acceptedAt,
                   w2.acceptedBy,
@@ -13489,7 +13665,7 @@ var init_workorder = __esm({
 });
 
 // ../engine/src/handlers/work.ts
-var workCreate, workKill, workResponse, workStart, workSubmitOutput, workTimeout;
+var workCreate, workKill, workResponse, workHandoffRecorded, workStart, workSubmitOutput, workTimeout;
 var init_work = __esm({
   "../engine/src/handlers/work.ts"() {
     "use strict";
@@ -13522,6 +13698,9 @@ var init_work = __esm({
             replyToIssueId: e.replyToIssueId,
             outputVersionNo: null,
             conclusion: null,
+            agentHandoffAttemptId: null,
+            businessHandoffStatus: null,
+            businessHandoffRecordedAt: null,
             acceptanceState: null,
             acceptedAt: null,
             acceptedBy: null,
@@ -13554,6 +13733,9 @@ var init_work = __esm({
           continuesWorkId: e.continuesWorkId,
           outputVersionNo: null,
           conclusion: null,
+          agentHandoffAttemptId: null,
+          businessHandoffStatus: null,
+          businessHandoffRecordedAt: null,
           acceptanceState: null,
           acceptedAt: null,
           acceptedBy: null,
@@ -13637,8 +13819,34 @@ var init_work = __esm({
           });
           return;
         }
-        const status = e.outcome === "completed" && hasOutput(w2, state.artifactsOf(e.workId).length) ? "success" : "failed";
-        state.updateWork(e.workId, { endedAt: ctx.at, outcome: e.outcome, outcomeDetail: e.detail, status });
+        const businessFailed = w2.businessHandoffStatus === "not_delivered";
+        const status = e.outcome === "completed" && hasOutput(w2, state.artifactsOf(e.workId).length) && !businessFailed ? "success" : "failed";
+        state.updateWork(e.workId, {
+          endedAt: ctx.at,
+          outcome: businessFailed ? "failed" : e.outcome,
+          outcomeDetail: businessFailed ? { ...e.detail ?? {}, reason: "agent business handoff not delivered" } : e.detail,
+          status
+        });
+      }
+    };
+    workHandoffRecorded = {
+      name: "work/handoff-recorded",
+      kind: "work.handoff_recorded",
+      apply(e, state, ctx) {
+        const w2 = state.work(e.workId);
+        if (!w2 || e.producedBy !== "agent") return;
+        if (w2.agentHandoffAttemptId && w2.agentHandoffAttemptId !== e.attemptId) return;
+        state.updateWork(e.workId, {
+          agentHandoffAttemptId: e.attemptId,
+          businessHandoffStatus: e.status,
+          businessHandoffRecordedAt: ctx.at,
+          // handoff 可以在 work.response 后到达。明确未交付必须回到现有失败/重试路径。
+          ...e.status === "not_delivered" && w2.endedAt && !w2.deadAt ? {
+            status: "failed",
+            outcome: "failed",
+            outcomeDetail: { ...w2.outcomeDetail ?? {}, reason: "agent business handoff not delivered" }
+          } : {}
+        });
       }
     };
     workStart = {
@@ -13825,6 +14033,7 @@ var init_review = __esm({
     init_views2();
     init_kill();
     init_issue();
+    init_activate();
     reviewCreate = {
       name: "review/create",
       kind: "review.create",
@@ -13963,6 +14172,7 @@ var init_review = __esm({
         if (!w2 || w2.deadAt || w2.acceptanceState === "accepted") return;
         const node = state.node(w2.nodeId);
         if (!node) return;
+        if (!businessHandoffBarrierSatisfied(state, w2.nodeId, w2.id)) return;
         if (w2.replyToIssueId) {
           const issue2 = state.issue(w2.replyToIssueId);
           state.updateWork(e.workId, {
@@ -14089,6 +14299,7 @@ var init_handlers = __esm({
       erase(workCreate),
       erase(workStart),
       erase(workSubmitOutput),
+      erase(workHandoffRecorded),
       erase(workResponse),
       erase(workTimeout),
       erase(workKill),
@@ -14499,13 +14710,9 @@ var init_bus = __esm({
           // 这里按 store 找它 cancel。找不到 / 不是刚被 kill / 会话已退 → no-op。这是设计「节点重新运行 = 自动
           // kill 旧任务」的会话侧落地，否则改版重跑时旧 agent 会空转到墙钟超时、和 bypassScheduling 组合出双会话。
           cancelPreviousWork: async (nodeId, currentWorkId) => {
-            try {
-              const snap = await this.store.transaction((tx) => tx.loadWorkorder(record8.workorderId));
-              const prev = snap?.works.filter((w2) => w2.nodeId === nodeId && w2.id !== currentWorkId).sort((a, b2) => b2.createdAt.localeCompare(a.createdAt))[0];
-              if (prev && prev.deadAt) await this.io.cancelSession(prev.id);
-            } catch (err) {
-              console.warn(`[bus] cancelPreviousWork ${nodeId}: ${String(err)}`);
-            }
+            const snap = await this.store.transaction((tx) => tx.loadWorkorder(record8.workorderId));
+            const prev = snap?.works.filter((w2) => w2.nodeId === nodeId && w2.id !== currentWorkId).sort((a, b2) => b2.createdAt.localeCompare(a.createdAt))[0];
+            if (prev && prev.deadAt) await this.io.cancelSession(prev.id);
           },
           // ★ 设计 §workorder.sealed/paused「按 work.kill 逻辑杀」：killAllWorks 只置状态，会话取消在这里做——
           // apply 已把被杀 work/review 置 deadAt/cancelledAt，这里按 store 找它们仍挂着的会话 cancel
@@ -14757,6 +14964,7 @@ function nodeToArtifact(node, edges, requirements) {
   if (cleanFields) {
     if ("reviewRoles" in cleanFields) delete cleanFields.reviewRoles;
     if ("docType" in cleanFields) delete cleanFields.docType;
+    if (BUSINESS_HANDOFF_POLICY_FIELD in cleanFields) delete cleanFields[BUSINESS_HANDOFF_POLICY_FIELD];
   }
   return {
     id: node.id,
@@ -16779,7 +16987,11 @@ var init_kernel_bridge = __esm({
               const spawnTypeDef = this.schema.get(op.type);
               const spawnOwner = op.owner ?? (spawnTypeDef?.ownerRole ? this.actorForRole(spawnTypeDef.ownerRole) : _actor);
               const opFields = op.fields;
-              const mergedFields = opReviewRoles !== void 0 ? { ...opFields ?? {}, reviewRoles: opReviewRoles } : opFields;
+              const mergedFields = opReviewRoles !== void 0 || op.businessHandoffPolicy !== void 0 ? {
+                ...opFields ?? {},
+                ...opReviewRoles !== void 0 ? { reviewRoles: opReviewRoles } : {},
+                ...op.businessHandoffPolicy !== void 0 ? { [BUSINESS_HANDOFF_POLICY_FIELD]: op.businessHandoffPolicy } : {}
+              } : opFields;
               await this.commit({
                 companyId: "",
                 workorderId: wid,
@@ -38635,7 +38847,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes6, createHash: createHash15 } = require("crypto");
+    var { randomBytes: randomBytes6, createHash: createHash16 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -39303,7 +39515,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash15("sha1").update(key + GUID).digest("base64");
+        const digest = createHash16("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -39672,7 +39884,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash15 } = require("crypto");
+    var { createHash: createHash16 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -39979,7 +40191,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash15("sha1").update(key + GUID).digest("base64");
+        const digest = createHash16("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -147081,7 +147293,8 @@ function withClosureReport(plan, opts) {
         title: CLOSURE_REPORT_TITLE,
         description: closureReportTaskBook(),
         inputs: business.map((op) => ({ to: op.id, required: true })),
-        isFinalOutput: true
+        isFinalOutput: true,
+        businessHandoffPolicy: BUSINESS_HANDOFF_POLICY_EXEMPT
       }
     ]
   };
@@ -147091,6 +147304,7 @@ var init_closure_report = __esm({
   "../server/src/domains/collab/closure-report.ts"() {
     "use strict";
     init_src();
+    init_src2();
     init_src3();
     init_src3();
     CLOSURE_SPAWN = (op) => op.action === "spawn" && op.type === DELIVERY_SUMMARY_ARTIFACT_TYPE;
@@ -163072,7 +163286,8 @@ async function startOasisServer(opts) {
                 { nodeId: currentRuntimeId, runtimeKind: currentRuntimeKind }
               );
               const persistedUserMessage = persistTarget ? stripInjectedChatContext(body.message) : body.message;
-              const history = runtimeChanged && chatStore && persistTarget ? (await chatStore.listMessages(persistTarget.id, 20)).filter((message) => message.role !== "system" && !(message.role === "assistant" && message.status === "running")).map((message) => ({
+              const needsHistoryInjection = Boolean(persistTarget && (runtimeChanged || !persistTarget.runtimeSessionId));
+              const history = needsHistoryInjection && chatStore && persistTarget ? (await chatStore.listMessages(persistTarget.id, 20)).filter((message) => message.role !== "system" && !(message.role === "assistant" && message.status === "running")).map((message) => ({
                 role: message.role,
                 content: message.role === "user" ? stripInjectedChatContext(message.content) : message.content
               })) : [];
@@ -164761,8 +164976,12 @@ function mergeContinuityRefs(...lists) {
   }
   return [...refs.values()];
 }
-function systemHandoffFor(run) {
+function systemHandoffFor(run, checkpoint = null, effects = []) {
   const outcome = handoffOutcomeOf(run.status);
+  const terminalReason = run.errorMessage ?? run.exitReason ?? `status=${outcome}`;
+  const pendingEffects = effects.filter((effect) => effect.status === "pending").length;
+  const failedEffects = effects.filter((effect) => effect.status === "failed").length;
+  const progress = checkpoint ? `checkpoint=${checkpoint.checkpointId} completed=${checkpoint.completedStepIds.length} pending=${checkpoint.pendingSteps.length} recoverability=${checkpoint.recoverability}` : "no valid pre-terminal checkpoint";
   return {
     handoffId: `handoff:${run.id}`,
     attemptId: run.id,
@@ -164770,12 +164989,16 @@ function systemHandoffFor(run) {
     part: run.part,
     producedBy: "system_reconstructed",
     outcome,
-    summary: outcome === "succeeded" ? `Execution completed with ${run.outputRefs.length} durable output reference(s).` : outcome === "no-output" ? "Execution ended cleanly without a durable output." : `Execution ended with status ${outcome}.`,
+    summary: `[system_reconstructed] attempt=${run.id} outcome=${outcome} reason=${terminalReason}; ${progress}`.slice(0, 400),
     changedOutputs: structuredClone(run.outputRefs),
     unresolvedIssues: [],
-    risks: run.errorMessage ? [run.errorMessage.slice(0, 400)] : [],
-    nextActions: [],
-    verificationGaps: [],
+    risks: [
+      ...run.errorMessage ? [run.errorMessage.slice(0, 400)] : [],
+      ...pendingEffects || failedEffects ? [`external effects: pending=${pendingEffects}, failed=${failedEffects}`] : []
+    ],
+    nextActions: structuredClone(checkpoint?.pendingSteps ?? []),
+    verificationGaps: checkpoint ? [] : ["No valid pre-terminal checkpoint was available."],
+    userHandoff: null,
     createdAt: run.endedAt ?? run.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
   };
 }
@@ -164877,11 +165100,9 @@ var init_memory_trace_store = __esm({
         if (merged.nodeId && isTerminalStatus(merged.status)) {
           this.ensureTerminalCheckpointFor(merged);
           const existingHandoff = this.handoffs.get(id);
-          const handoff = existingHandoff ? {
-            ...existingHandoff,
-            outcome: handoffOutcomeOf(merged.status),
-            changedOutputs: structuredClone(existingHandoff.producedBy === "agent" ? existingHandoff.changedOutputs : merged.outputRefs)
-          } : systemHandoffFor(merged);
+          const checkpoint = (this.checkpoints.get(id) ?? []).filter((item) => item.trigger !== "attempt_terminal").at(-1) ?? null;
+          const effects = [...this.externalEffects.values()].filter((effect) => effect.attemptId === id);
+          const handoff = existingHandoff?.producedBy === "agent" ? existingHandoff : systemHandoffFor(merged, checkpoint, effects);
           this.handoffs.set(id, handoff);
           merged.handoffId = handoff.handoffId;
         }
@@ -165074,6 +165295,46 @@ var init_memory_trace_store = __esm({
       async listExternalEffects(nodeId) {
         return [...this.externalEffects.values()].filter((effect) => effect.nodeId === nodeId).sort((a, b2) => (a.occurredAt ?? "").localeCompare(b2.occurredAt ?? "") || a.idempotencyKey.localeCompare(b2.idempotencyKey)).map((effect) => structuredClone(effect));
       }
+      sortedExternalEffects(nodeId, status) {
+        const recency = (effect) => {
+          if (effect.occurredAt) return effect.occurredAt;
+          const run = this.runs.get(effect.attemptId);
+          return run?.endedAt ?? run?.updatedAt ?? run?.startedAt ?? "";
+        };
+        return [...this.externalEffects.values()].filter((effect) => effect.nodeId === nodeId && (status === void 0 || effect.status === status)).sort((a, b2) => recency(b2).localeCompare(recency(a)) || b2.idempotencyKey.localeCompare(a.idempotencyKey)).map((effect) => structuredClone(effect));
+      }
+      async getExternalEffectsForResume(nodeId, jobKey, part, succeededLimit, failedLimit) {
+        const inScope = (effect) => {
+          const run = this.runs.get(effect.attemptId);
+          return Boolean(run && executionJobKey(run) === jobKey && run.part === part);
+        };
+        const pending = this.sortedExternalEffects(nodeId, "pending").filter(inScope);
+        const succeeded = this.sortedExternalEffects(nodeId, "succeeded").filter(inScope);
+        const failed = this.sortedExternalEffects(nodeId, "failed").filter(inScope);
+        const includedSucceeded = succeeded.slice(0, succeededLimit);
+        const includedFailed = failed.slice(0, failedLimit);
+        return {
+          effects: [...pending, ...includedSucceeded, ...includedFailed],
+          summary: {
+            total: pending.length + succeeded.length + failed.length,
+            totalByStatus: { pending: pending.length, succeeded: succeeded.length, failed: failed.length },
+            includedByStatus: {
+              pending: pending.length,
+              succeeded: includedSucceeded.length,
+              failed: includedFailed.length
+            }
+          }
+        };
+      }
+      async queryExternalEffects(nodeId, options) {
+        const effects = this.sortedExternalEffects(nodeId, options.status);
+        return {
+          total: effects.length,
+          offset: options.offset,
+          limit: options.limit,
+          items: effects.slice(options.offset, options.offset + options.limit)
+        };
+      }
       async putHandoff(input) {
         const run = this.runs.get(input.attemptId);
         if (!run?.nodeId) throw new ExecutionAttemptNotFoundError(input.attemptId);
@@ -165095,6 +165356,11 @@ var init_memory_trace_store = __esm({
           risks: structuredClone(input.risks ?? []),
           nextActions: structuredClone(input.nextActions ?? []),
           verificationGaps: structuredClone(input.verificationGaps ?? []),
+          userHandoff: normalizeUserHandoff(
+            input.outcome,
+            input.changedOutputs ?? run.outputRefs,
+            input.userHandoff
+          ),
           createdAt: input.createdAt ?? this.now()
         };
         this.handoffs.set(input.attemptId, handoff);
@@ -165145,13 +165411,17 @@ var init_memory_trace_store = __esm({
           this.handoffs.set(handoff.attemptId, structuredClone({
             ...handoff,
             jobKey: handoff.jobKey ?? (run ? executionJobKey(run) : `attempt:${handoff.attemptId}`),
-            part: handoff.part ?? run?.part ?? null
+            part: handoff.part ?? run?.part ?? null,
+            userHandoff: handoff.userHandoff ?? null
           }));
         }
         for (const [id, run] of this.runs) {
           if (!run.nodeId || !isTerminalStatus(run.status)) continue;
           this.ensureTerminalCheckpointFor(run);
-          const handoff = this.handoffs.get(id) ?? systemHandoffFor(run);
+          const existingHandoff = this.handoffs.get(id);
+          const checkpoint = (this.checkpoints.get(id) ?? []).filter((item) => item.trigger !== "attempt_terminal").at(-1) ?? null;
+          const effects = [...this.externalEffects.values()].filter((effect) => effect.attemptId === id);
+          const handoff = existingHandoff?.producedBy === "agent" ? existingHandoff : systemHandoffFor(run, checkpoint, effects);
           this.handoffs.set(id, handoff);
           this.runs.set(id, { ...run, handoffId: handoff.handoffId });
         }
@@ -165936,6 +166206,13 @@ var init_test_engine = __esm({
   }
 });
 
+// ../testkit/src/engine-handoff.ts
+var init_engine_handoff = __esm({
+  "../testkit/src/engine-handoff.ts"() {
+    "use strict";
+  }
+});
+
 // ../testkit/src/index.ts
 var init_src7 = __esm({
   "../testkit/src/index.ts"() {
@@ -165952,6 +166229,7 @@ var init_src7 = __esm({
     init_memory_control_plane_store();
     init_memory_actor_memory_store();
     init_test_engine();
+    init_engine_handoff();
   }
 });
 
@@ -170212,7 +170490,9 @@ var init_sink = __esm({
           // 「这条 run 跑在哪个 cwd」才有据可查，Session 列也不再对 dispatch run 恒空。
           baseMetadata: {
             bundleManifest: session.bundleManifest,
-            ...session.runtimeSessionId ? { runtimeSessionId: session.runtimeSessionId } : {}
+            ...session.runtimeSessionId ? { runtimeSessionId: session.runtimeSessionId } : {},
+            ...session.engineWorkId ? { engineWorkId: session.engineWorkId } : {},
+            ...session.engineCompanyId ? { engineCompanyId: session.engineCompanyId } : {}
           },
           observedModel: null,
           checkpointState: {},
@@ -170427,7 +170707,21 @@ var init_sink = __esm({
             stream: "runtime",
             message: `exit code=${update.exit.code ?? "killed"} ops=${update.opRefs.length}`
           }]);
-          const status = update.exit.wallclockKilled ? "timeout" : update.exit.reason === "cancelled" ? "cancelled" : update.opRefs.length > 0 ? "succeeded" : update.exit.reason === "clean" ? "no-output" : "failed";
+          let terminalDurableRefs = [];
+          let checkpointPrevious = null;
+          if (this.continuityMode !== "off" && this.store.appendCheckpoint && this.store.listCheckpoints) {
+            checkpointPrevious = await this.latestCheckpoint(st);
+            const terminalInput = this.checkpointInput(st, checkpointPrevious, "attempt_terminal", update.exit.at);
+            terminalDurableRefs = terminalInput.durableRefs;
+          }
+          const opOutputRefs = update.opRefs.map((ref2) => ({
+            kind: "op",
+            id: ref2.id,
+            version: String(ref2.seq),
+            label: ref2.kind
+          }));
+          const hasDurableOutput = update.opRefs.length > 0 || terminalDurableRefs.length > 0;
+          const status = update.exit.wallclockKilled ? "timeout" : update.exit.reason === "timeout" ? "timeout" : update.exit.reason === "cancelled" ? "cancelled" : update.exit.reason === "output-limit" && hasDurableOutput ? "partial" : update.exit.reason && update.exit.reason !== "clean" || update.exit.code !== null && update.exit.code !== 0 ? "failed" : hasDurableOutput ? "succeeded" : update.exit.reason === "clean" ? "no-output" : "failed";
           const isErr = status === "failed" || status === "timeout";
           const errorFields = isErr ? { errorCode: update.exit.reason ?? "error", errorMessage: formatExitError(update.exit) } : {};
           const model = typeof update.exit.model === "string" && update.exit.model.trim() ? update.exit.model.trim() : st.observedModel;
@@ -170435,17 +170729,16 @@ var init_sink = __esm({
           if (exitRtId) st.baseMetadata = { ...st.baseMetadata, runtimeSessionId: exitRtId };
           const exitWorkdir = typeof update.exit.workdirRef === "string" && update.exit.workdirRef.trim() ? update.exit.workdirRef.trim() : void 0;
           if (exitWorkdir) st.baseMetadata = { ...st.baseMetadata, workdirRef: exitWorkdir };
-          const outputRefs = update.opRefs.map((ref2) => ({
-            kind: "op",
-            id: ref2.id,
-            version: String(ref2.seq),
-            label: ref2.kind
-          }));
+          const outputRefs = opOutputRefs.slice();
+          for (const ref2 of terminalDurableRefs) {
+            if (!outputRefs.some((item) => item.kind === ref2.kind && item.id === ref2.id && item.version === ref2.version)) {
+              outputRefs.push(ref2);
+            }
+          }
           if (this.continuityMode !== "off" && this.store.appendCheckpoint && this.store.listCheckpoints) {
-            const previous = await this.latestCheckpoint(st);
-            const terminalInput = this.checkpointInput(st, previous, "attempt_terminal", update.exit.at);
+            const terminalInput = this.checkpointInput(st, checkpointPrevious, "attempt_terminal", update.exit.at);
             const durableRefs = [...terminalInput.durableRefs];
-            for (const ref2 of outputRefs) {
+            for (const ref2 of opOutputRefs) {
               if (!durableRefs.some((item) => item.kind === ref2.kind && item.id === ref2.id && item.version === ref2.version)) {
                 durableRefs.push(ref2);
               }
@@ -170455,7 +170748,7 @@ var init_sink = __esm({
               pendingSteps: terminalInput.pendingSteps,
               completedStepIds: terminalInput.completedStepIds,
               durableRefs,
-              recoverability: outputRefs.length > 0 ? "full" : terminalInput.recoverability,
+              recoverability: hasDurableOutput ? "full" : terminalInput.recoverability,
               trigger: "attempt_terminal",
               createdAt: update.exit.at
             });
@@ -170465,7 +170758,10 @@ var init_sink = __esm({
             endedAt: update.exit.at,
             durationMs: update.exit.durationMs,
             exitCode: update.exit.code,
-            ...this.continuityMode !== "off" ? { outputRefs } : {},
+            // Attempt terminal => NodeHandoff is unconditional, including the `off` cohort. Keep the
+            // durable output facts on the Attempt in every cohort so storage can reconstruct an honest
+            // system handoff after an abnormal exit without depending on the continuity experiment.
+            outputRefs,
             // 退出事件带回的真实 runtime 会话 id 属血统，不随实验开关丢弃（ADR-0131）。
             ...exitRtId ? { runtimeSessionId: exitRtId } : {},
             ...errorFields,
@@ -180602,6 +180898,11 @@ function isRefArray(value) {
     return typeof ref2["kind"] === "string" && typeof ref2["id"] === "string" && (ref2["version"] === void 0 || typeof ref2["version"] === "string") && (ref2["label"] === void 0 || typeof ref2["label"] === "string");
   });
 }
+function isUserHandoff(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const handoff = value;
+  return (handoff["status"] === "delivered" || handoff["status"] === "not_delivered") && typeof handoff["summary"] === "string" && handoff["summary"].trim().length > 0 && typeof handoff["nextStep"] === "string" && isRefArray(handoff["deliverables"]);
+}
 function resolveAttemptWriter(req, requestedAttemptId) {
   const dispatchId = req.auth.dispatch?.dispatchId;
   if (requestedAttemptId === "current") {
@@ -180621,6 +180922,11 @@ function executionContinuityDomain(service) {
       if (!view) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u5DE5\u5355\uFF1A${req.params.id}`);
       return { status: 200, body: view };
     });
+    router.get("/api/execution-continuity/attempts/:id/recovery", async (req) => {
+      const view = await service.recoveryView(req.params.id, req.auth.companyId);
+      if (!view) throw new ApiError(404, "NOT_FOUND", `\u8BE5 Attempt \u6CA1\u6709\u5DF2\u6CE8\u5165\u7684\u91CD\u6D3E ResumePack\uFF1A${req.params.id}`);
+      return { status: 200, body: view };
+    });
     router.get("/api/execution-continuity/workorders/:id/nodes/:nodeId/resume-pack", async (req) => {
       const pack = await service.resumePack(
         req.params.id,
@@ -180631,6 +180937,25 @@ function executionContinuityDomain(service) {
       if (!pack) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u8282\u70B9\uFF1A${req.params.nodeId}`);
       return { status: 200, body: pack };
     });
+    router.get("/api/execution-continuity/workorders/:id/nodes/:nodeId/external-effects", async (req) => {
+      const statusRaw = req.query.get("status");
+      if (statusRaw !== null && !EXTERNAL_EFFECT_STATUSES.includes(statusRaw)) {
+        throw new ApiError(400, "BAD_REQUEST", "status \u5FC5\u987B\u662F pending / succeeded / failed");
+      }
+      const limit = Number(req.query.get("limit") ?? "50");
+      const offset = Number(req.query.get("offset") ?? "0");
+      if (!Number.isInteger(limit) || limit < 1 || limit > 200 || !Number.isInteger(offset) || offset < 0) {
+        throw new ApiError(400, "BAD_REQUEST", "limit \u5FC5\u987B\u662F 1..200\uFF0Coffset \u5FC5\u987B\u662F\u975E\u8D1F\u6574\u6570");
+      }
+      const page = await service.externalEffectHistory(
+        req.params.id,
+        req.params.nodeId,
+        req.auth.companyId,
+        { ...statusRaw ? { status: statusRaw } : {}, limit, offset }
+      );
+      if (!page) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u8282\u70B9\uFF1A${req.params.nodeId}`);
+      return { status: 200, body: page };
+    });
     router.post("/api/execution-continuity/attempts/:id/checkpoints", async (req) => {
       const attemptId = resolveAttemptWriter(req, req.params.id);
       const b2 = req.body ?? {};
@@ -180705,6 +181030,9 @@ function executionContinuityDomain(service) {
       if (b2.changedOutputs !== void 0 && !isRefArray(b2.changedOutputs) || b2.unresolvedIssues !== void 0 && !isStringArray(b2.unresolvedIssues) || b2.risks !== void 0 && !isStringArray(b2.risks) || b2.nextActions !== void 0 && !isStringArray(b2.nextActions) || b2.verificationGaps !== void 0 && !isStringArray(b2.verificationGaps)) {
         throw new ApiError(400, "BAD_REQUEST", "handoff arrays contain invalid values");
       }
+      if (!isUserHandoff(b2.userHandoff)) {
+        throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11\u5408\u6CD5\u7684 userHandoff\uFF1BAgent \u5FC5\u987B\u63D0\u4EA4\u672C\u6B21\u5DE5\u4F5C\u7684\u4E1A\u52A1\u4EA4\u63A5\u6458\u8981");
+      }
       const handoff = await service.handoff({
         attemptId,
         producedBy: "agent",
@@ -180714,13 +181042,14 @@ function executionContinuityDomain(service) {
         unresolvedIssues: Array.isArray(b2.unresolvedIssues) ? b2.unresolvedIssues : [],
         risks: Array.isArray(b2.risks) ? b2.risks : [],
         nextActions: Array.isArray(b2.nextActions) ? b2.nextActions : [],
-        verificationGaps: Array.isArray(b2.verificationGaps) ? b2.verificationGaps : []
+        verificationGaps: Array.isArray(b2.verificationGaps) ? b2.verificationGaps : [],
+        userHandoff: b2.userHandoff
       });
       return { status: 200, body: handoff };
     });
   };
 }
-var HANDOFF_OUTCOMES, AGENT_CHECKPOINT_TRIGGERS;
+var HANDOFF_OUTCOMES, AGENT_CHECKPOINT_TRIGGERS, EXTERNAL_EFFECT_STATUSES;
 var init_routes8 = __esm({
   "../server/src/domains/execution-continuity/routes.ts"() {
     "use strict";
@@ -180734,6 +181063,7 @@ var init_routes8 = __esm({
       "orphaned"
     ];
     AGENT_CHECKPOINT_TRIGGERS = ["agent", "plan_completed", "stage_completed"];
+    EXTERNAL_EFFECT_STATUSES = ["pending", "succeeded", "failed"];
   }
 });
 
@@ -180746,15 +181076,8 @@ function renderResumePack(pack) {
     `Node: ${pack.node.title} (${pack.node.nodeId})`,
     `Job: ${pack.jobKey ?? "unspecified"}`,
     `Part: ${pack.part ?? "whole-node"}`,
-    pack.node.description ? `Goal: ${pack.node.description}` : "",
-    "",
-    "## Upstream handoffs"
+    pack.node.description ? `Goal: ${pack.node.description}` : ""
   ].filter(Boolean);
-  if (pack.upstream.length === 0) lines.push("- None");
-  for (const item of pack.upstream) {
-    lines.push(`- ${item.node.title}: ${item.handoff?.summary || "No terminal handoff yet"}`);
-    for (const issue2 of item.handoff?.unresolvedIssues ?? []) lines.push(`  - unresolved: ${issue2}`);
-  }
   lines.push("", "## Previous attempt");
   if (!pack.previousAttempt) lines.push("- This is the first attempt.");
   else {
@@ -180766,14 +181089,40 @@ function renderResumePack(pack) {
     }
   }
   lines.push("", "## External effects");
-  if (pack.externalEffects.length === 0) lines.push("- None recorded");
+  const effectSummary = pack.externalEffectSummary;
+  if (effectSummary.total === 0) lines.push("- None recorded");
+  else {
+    const totals = effectSummary.totalByStatus;
+    const included = effectSummary.includedByStatus;
+    lines.push(
+      `- ${effectSummary.total} total; showing all ${included.pending} pending, latest ${included.succeeded} of ${totals.succeeded} succeeded, and latest ${included.failed} of ${totals.failed} retryable failed. Older records remain available through the history query.`
+    );
+  }
   for (const effect of pack.externalEffects) {
     const action = effect.status === "succeeded" ? "do not repeat" : effect.status === "pending" ? "execution uncertain; reconcile before retry" : "failed; retry allowed";
     lines.push(`- [${effect.status}/${effect.source}] ${effect.kind} \u2192 ${effect.target} (${action}; key ${effect.idempotencyKey})`);
   }
+  const snapshot = Buffer.from(JSON.stringify(pack), "utf8").toString("base64url");
+  lines.push("", `${RESUME_SNAPSHOT_PREFIX}${snapshot}${RESUME_SNAPSHOT_SUFFIX}`);
   return `${lines.join("\n")}
 `;
 }
+function parseResumePackSnapshot(content) {
+  const start = content.lastIndexOf(RESUME_SNAPSHOT_PREFIX);
+  if (start < 0) return null;
+  const encodedStart = start + RESUME_SNAPSHOT_PREFIX.length;
+  const end = content.indexOf(RESUME_SNAPSHOT_SUFFIX, encodedStart);
+  if (end < 0) return null;
+  try {
+    const value = JSON.parse(Buffer.from(content.slice(encodedStart, end), "base64url").toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+    const pack = value;
+    if (pack.scenario !== "first-run" && pack.scenario !== "redispatch" || !pack.node || typeof pack.node.nodeId !== "string" || !Array.isArray(pack.node.dependsOn) || !Array.isArray(pack.upstream) || !Array.isArray(pack.externalEffects) || !pack.externalEffectSummary) return null;
+    return pack;
+  } catch {
+    return null;
+  }
+}
 function renderCoordinatorView(view) {
   const lines = [
     "# Coordinator View",
@@ -180793,6 +181142,22 @@ function renderCoordinatorView(view) {
       `- State: ${node.nodeState}; attempt status: ${node.status}; attempt: ${node.attemptNo || "none"}`,
       `- Actor: ${node.actorId ?? "unassigned"}; role: ${node.role ?? "unassigned"}`
     );
+    if (node.recoverySource) {
+      const source = node.recoverySource;
+      lines.push(
+        `- Recovery source: Attempt ${source.recoveredFromAttempt.attemptNo ?? "?"} \u2192 Attempt ${source.currentAttempt.attemptNo ?? "?"}`
+      );
+      if (source.recoveryCheckpoint) {
+        lines.push(`  - Recovery checkpoint: #${source.recoveryCheckpoint.seq} (${source.recoveryCheckpoint.recoverability})`);
+        for (const step of source.recoveryCheckpoint.pendingSteps) lines.push(`    - Recovery pending: ${step}`);
+      }
+      if (source.recoveryHandoff?.producedBy === "agent") {
+        lines.push(`  - Recovery Agent handoff: ${source.recoveryHandoff.summary}`);
+      } else if (source.recoveryHandoff?.producedBy === "system_reconstructed") {
+        lines.push(`  - Recovery system reconstruction (not an Agent conclusion): ${source.recoveryHandoff.summary}`);
+      }
+      for (const risk of source.recoveryHandoff?.risks ?? []) lines.push(`    - Recovery risk: ${risk}`);
+    }
     if (node.blockedBy.length > 0) lines.push(`- Blocked by: ${node.blockedBy.join(", ")}`);
     if (node.progress) {
       lines.push(`- Latest checkpoint: ${node.progress.recoverability} at ${node.progress.lastCheckpointAt}`);
@@ -180847,12 +181212,42 @@ succeeds, use \`oasis continuity-effect\` with a stable key that the same node w
 
 ## Handoff
 
-Before terminal exit, run \`oasis continuity-handoff\` with a concise summary (maximum 400
+Before terminal exit, run \`oasis continuity-handoff\` with a concise technical summary (maximum 400
 characters), changed durable outputs, unresolved issues, risks, next actions, and verification gaps.
-The system reconstructs a minimal handoff if the process dies first; an agent-authored handoff is
-more useful.
+You must also provide \`--user-summary\` as short business-facing language for the people receiving
+the work. Say what you completed, what result you formed, and what downstream work can use; if not
+delivered, say only why and what must happen next. Use \`--user-next-step\` when downstream needs an
+instruction. List only openable business results in \`--user-deliverables\`; keep technical refs in
+\`--outputs\`, and never list conclude, gap, checkpoint, or op as a user deliverable. Do not use a
+generic success/output-count template or mention attempts, checkpoints, runtimes, recovery,
+infrastructure paths, or internal diagnostics there.
+The system reconstructs an internal handoff if the process dies first, but reconstructed content is
+never shown as a business handoff.
+`;
+}
+function renderBusinessHandoffProtocol() {
+  return `# Business handoff protocol
+
+Before terminal exit, run \`oasis continuity-handoff\`. The NodeHandoff and its userHandoff are a
+required completion barrier for business downstream work. A successful handoff must use outcome
+\`succeeded\`, include a non-empty \`--user-summary\` saying what was done, what result was formed,
+and what downstream can use, and may have zero files. If the work cannot be delivered, submit a
+non-success outcome with a user summary explaining why delivery failed and \`--user-next-step\`;
+that records the handoff but does not release downstream work. List only openable business results
+in \`--user-deliverables\`. Never use a generic success/output-count template or expose attempts,
+checkpoints, runtimes, recovery, infrastructure paths, or internal diagnostics in userHandoff.
 `;
 }
+function emptyExternalEffectProjection() {
+  return {
+    effects: [],
+    summary: {
+      total: 0,
+      totalByStatus: { pending: 0, succeeded: 0, failed: 0 },
+      includedByStatus: { pending: 0, succeeded: 0, failed: 0 }
+    }
+  };
+}
 function latestAttemptByNode(attempts) {
   const out = /* @__PURE__ */ new Map();
   for (const attempt of attempts) {
@@ -180862,10 +181257,11 @@ function latestAttemptByNode(attempts) {
   }
   return out;
 }
-function stateFromAttempt(attempt, handoff, checkpoint, now, stalledAfterMs) {
+function stateFromAttempt(attempt, handoff, checkpoint, now, stalledAfterMs, openToolCall) {
   if (attempt.status === "running" || attempt.status === "queued") {
-    const last = checkpoint?.createdAt ?? attempt.startedAt;
-    return now.getTime() - Date.parse(last) <= stalledAfterMs ? "running" : "stalled";
+    const lastActivityAt = attempt.lastProgressAt ?? checkpoint?.createdAt ?? attempt.startedAt;
+    if (openToolCall) return "running";
+    return now.getTime() - Date.parse(lastActivityAt) <= stalledAfterMs ? "running" : "stalled";
   }
   if (attempt.status === "succeeded") return "succeeded";
   if (attempt.status === "no-output") return handoff?.unresolvedIssues.length ? "blocked" : "no_change";
@@ -180888,22 +181284,26 @@ function waitingDescendants(source, reverse, states) {
   return [...found].sort();
 }
 function todoAction(node) {
-  if (node.handoffProducer === "agent" && node.nextActions[0]) return `Agent Handoff \u5EFA\u8BAE\u5173\u6CE8\uFF1A${node.nextActions[0]}`;
-  if (node.nodeState === "ready") return "\u8BE5\u8282\u70B9\u5DF2 ready\uFF0C\u7B49\u5F85 Oasis \u539F\u6709\u8C03\u5EA6\u673A\u5236\u5904\u7406";
-  if (node.nodeState === "blocked" && node.unresolvedIssues[0]) return `\u8BE5\u8282\u70B9\u5DF2 blocked\uFF1B\u672A\u51B3\u95EE\u9898\uFF1A${node.unresolvedIssues[0]}`;
-  if (!node.progress) return `\u8BE5\u8282\u70B9\u5DF2 ${node.nodeState}\uFF0C\u6CA1\u6709\u53EF\u7528 checkpoint`;
-  if (node.progress.recoverability === "full") return `\u8BE5\u8282\u70B9\u5DF2 ${node.nodeState}\uFF0C\u5B58\u5728\u6700\u65B0\u5B8C\u6574 checkpoint\uFF0C\u53EF\u7531\u534F\u8C03\u8005\u5224\u65AD\u540E\u7EED\u5904\u7406`;
-  if (node.progress.recoverability === "partial") return `\u8BE5\u8282\u70B9\u5DF2 ${node.nodeState}\uFF0C\u5B58\u5728\u6700\u65B0\u90E8\u5206\u53EF\u6062\u590D checkpoint\uFF0C\u9700\u8981\u5173\u6CE8\u5DF2\u6709\u4EA7\u51FA\u590D\u6838`;
-  return `\u8BE5\u8282\u70B9\u5DF2 ${node.nodeState}\uFF0C\u6700\u65B0 checkpoint \u4E0D\u53EF\u6062\u590D\uFF0C\u9700\u8981\u534F\u8C03\u8005\u5173\u6CE8`;
-}
-var DONE_STATES, BLOCKING_STATES, HANDOFF_OUTCOMES2, TODO_RANK, ExecutionContinuityService;
+  if (node.handoffProducer === "agent" && node.nextActions[0]) return `Agent Handoff: ${node.nextActions[0]}`;
+  if (node.nodeState === "ready") return "\u8282\u70B9 ready\uFF0C\u7B49\u5F85\u8C03\u5EA6";
+  if (node.nodeState === "blocked" && node.unresolvedIssues[0]) return `\u8282\u70B9 blocked\uFF1A${node.unresolvedIssues[0]}`;
+  if (!node.progress) return `\u8282\u70B9 ${node.nodeState}\uFF0C\u65E0 checkpoint`;
+  if (node.progress.recoverability === "full") return `\u8282\u70B9 ${node.nodeState}\uFF0Ccheckpoint \u5B8C\u6574\u53EF\u6062\u590D`;
+  if (node.progress.recoverability === "partial") return `\u8282\u70B9 ${node.nodeState}\uFF0Ccheckpoint \u90E8\u5206\u53EF\u6062\u590D\uFF0C\u9700\u5173\u6CE8\u5DF2\u6709\u4EA7\u51FA`;
+  return `\u8282\u70B9 ${node.nodeState}\uFF0Ccheckpoint \u4E0D\u53EF\u6062\u590D`;
+}
+var import_node_crypto32, DONE_STATES, BLOCKING_STATES, HANDOFF_OUTCOMES2, RESUME_EXTERNAL_EFFECT_LIMIT, RESUME_SNAPSHOT_PREFIX, RESUME_SNAPSHOT_SUFFIX, TODO_RANK, ExecutionContinuityService;
 var init_service7 = __esm({
   "../server/src/domains/execution-continuity/service.ts"() {
     "use strict";
     init_src();
+    import_node_crypto32 = require("node:crypto");
     DONE_STATES = /* @__PURE__ */ new Set(["succeeded", "no_change"]);
     BLOCKING_STATES = /* @__PURE__ */ new Set(["stalled", "failed", "blocked"]);
     HANDOFF_OUTCOMES2 = /* @__PURE__ */ new Set(["succeeded", "no-output", "failed", "cancelled", "timeout", "orphaned"]);
+    RESUME_EXTERNAL_EFFECT_LIMIT = 20;
+    RESUME_SNAPSHOT_PREFIX = "<!-- oasis-resume-pack-snapshot:v1:";
+    RESUME_SNAPSHOT_SUFFIX = " -->";
     TODO_RANK = {
       stalled: 0,
       failed: 1,
@@ -180918,6 +181318,8 @@ var init_service7 = __esm({
       stalledAfterMs;
       attemptVisibilityWaitMs;
       onCheckpointState;
+      readBundleFile;
+      onAgentHandoffPersisted;
       constructor(opts) {
         this.store = opts.store;
         this.mode = opts.mode;
@@ -180926,6 +181328,8 @@ var init_service7 = __esm({
         this.stalledAfterMs = opts.stalledAfterMs ?? 25 * 6e4;
         this.attemptVisibilityWaitMs = opts.attemptVisibilityWaitMs ?? 500;
         this.onCheckpointState = opts.onCheckpointState;
+        this.readBundleFile = opts.readBundleFile;
+        this.onAgentHandoffPersisted = opts.onAgentHandoffPersisted;
       }
       assertWritable() {
         if (this.mode === "off") throw new Error("execution continuity is disabled");
@@ -181001,12 +181405,22 @@ var init_service7 = __esm({
         });
       }
       async handoff(input) {
-        this.assertWritable();
         if (!HANDOFF_OUTCOMES2.has(input.outcome)) throw new Error(`invalid handoff outcome: ${input.outcome}`);
         if (!input.summary.trim()) throw new Error("handoff summary is required");
         if ([...input.summary].length > 400) throw new Error("handoff summary exceeds 400 characters");
-        await this.awaitAttempt(input.attemptId);
-        return this.afterAttemptVisible(() => this.store.putHandoff(input));
+        if (input.producedBy === "agent" && !input.userHandoff) {
+          throw new Error("agent-authored handoff requires userHandoff");
+        }
+        const userHandoff = input.userHandoff ? normalizeUserHandoff(input.outcome, input.changedOutputs ?? [], input.userHandoff) : void 0;
+        const attempt = await this.awaitAttempt(input.attemptId);
+        const handoff = await this.afterAttemptVisible(() => this.store.putHandoff({
+          ...input,
+          ...userHandoff ? { userHandoff } : {}
+        }));
+        if (handoff.producedBy === "agent" && handoff.userHandoff) {
+          await this.onAgentHandoffPersisted?.(attempt, handoff);
+        }
+        return handoff;
       }
       async afterAttemptVisible(write) {
         const deadline = Date.now() + this.attemptVisibilityWaitMs;
@@ -181028,38 +181442,86 @@ var init_service7 = __esm({
         const jobKey = scope.jobKey ?? currentAttempt?.jobKey ?? null;
         const part = scope.part !== void 0 ? scope.part : currentAttempt?.part ?? null;
         const attempts = allAttempts.filter((attempt) => attempt.id !== scope.excludeAttemptId);
-        const latest = latestAttemptByNode(attempts);
-        const previousAttempt = attempts.filter((attempt) => attempt.nodeId === nodeId).filter((attempt) => jobKey === null || attempt.jobKey === jobKey && attempt.part === part).sort((a, b2) => (b2.attemptNo ?? 0) - (a.attemptNo ?? 0))[0] ?? null;
-        const [previousHandoff, latestCheckpoint, externalEffects] = await Promise.all([
-          previousAttempt ? this.store.getHandoff(previousAttempt.id) : Promise.resolve(null),
-          previousAttempt ? this.store.getLatestCheckpoint(previousAttempt.id) : Promise.resolve(null),
-          this.store.listExternalEffects(nodeId)
+        const previousAttempt = attempts.filter((attempt) => attempt.nodeId === nodeId).filter((attempt) => !currentAttempt || (attempt.attemptNo ?? 0) < (currentAttempt.attemptNo ?? 0)).filter((attempt) => jobKey === null || attempt.jobKey === jobKey && attempt.part === part).sort((a, b2) => (b2.attemptNo ?? 0) - (a.attemptNo ?? 0))[0] ?? null;
+        if (!previousAttempt) return null;
+        const [previousHandoff, latestCheckpoint, externalEffectProjection] = await Promise.all([
+          this.store.getHandoff(previousAttempt.id),
+          this.store.getLatestCheckpoint(previousAttempt.id),
+          jobKey === null ? Promise.resolve(emptyExternalEffectProjection()) : this.store.getExternalEffectsForResume(
+            nodeId,
+            jobKey,
+            part,
+            RESUME_EXTERNAL_EFFECT_LIMIT,
+            RESUME_EXTERNAL_EFFECT_LIMIT
+          )
         ]);
-        const upstream = await Promise.all(node.dependsOn.map(async (upstreamId) => {
-          const upstreamNode = nodes.find((item) => item.nodeId === upstreamId) ?? {
-            nodeId: upstreamId,
-            title: upstreamId,
-            dependsOn: []
-          };
-          const attempt = latest.get(upstreamId) ?? null;
-          return {
-            node: upstreamNode,
-            attempt,
-            handoff: attempt ? await this.store.getHandoff(attempt.id) : null
-          };
-        }));
         return {
-          scenario: previousAttempt ? "redispatch" : "first-run",
+          scenario: "redispatch",
           jobKey,
           part,
           node,
-          upstream,
+          upstream: [],
           previousAttempt,
           previousHandoff,
           latestCheckpoint,
-          externalEffects
+          externalEffects: externalEffectProjection.effects,
+          externalEffectSummary: externalEffectProjection.summary
         };
       }
+      async recoveryView(attemptId, companyId) {
+        const attempt = await this.store.getAttempt(attemptId);
+        if (!attempt?.workOrderId || !attempt.nodeId || attempt.continuityMode !== "resume") return null;
+        const recoverySnapshot = this.readRecoverySnapshot(attempt);
+        if (!recoverySnapshot) return null;
+        const graph = await this.resolveGraph(attempt.workOrderId, companyId);
+        if (!graph.some((node) => node.nodeId === attempt.nodeId)) return null;
+        return {
+          workOrderId: attempt.workOrderId,
+          node: recoverySnapshot.node,
+          attempt,
+          recoverySnapshot
+        };
+      }
+      /**
+       * Resolves a Chat Session's durable WorkOrder links to the newest current node Attempt that has
+       * a verified historical recovery input. This deliberately does not inspect Chat run ids: Chat
+       * runs and Dispatcher Attempts are separate identities.
+       */
+      async latestRecoveryAttemptForWorkOrders(workOrderIds, companyId) {
+        const candidates = [];
+        for (const workOrderId of [...new Set(workOrderIds)]) {
+          const graph = await this.resolveGraph(workOrderId, companyId);
+          if (graph.length === 0) continue;
+          const nodeIds = new Set(graph.map((node) => node.nodeId));
+          const latest = latestAttemptByNode(await this.store.listAttempts(workOrderId));
+          for (const attempt of latest.values()) {
+            if (!attempt.nodeId || !nodeIds.has(attempt.nodeId) || !this.readRecoverySnapshot(attempt)) continue;
+            candidates.push({ workOrderId, nodeId: attempt.nodeId, attemptId: attempt.id, startedAt: attempt.startedAt });
+          }
+        }
+        candidates.sort((a, b2) => b2.startedAt.localeCompare(a.startedAt) || b2.attemptId.localeCompare(a.attemptId));
+        const candidate = candidates[0];
+        return candidate ? { workOrderId: candidate.workOrderId, nodeId: candidate.nodeId, attemptId: candidate.attemptId } : null;
+      }
+      readRecoverySnapshot(attempt) {
+        if (!attempt.nodeId || attempt.continuityMode !== "resume") return null;
+        const metadata = attempt.metadata;
+        const manifest = metadata && typeof metadata === "object" && !Array.isArray(metadata) ? metadata["bundleManifest"] : null;
+        const expectedHash = manifest && typeof manifest === "object" && !Array.isArray(manifest) ? manifest["execution/RESUME.md"] : null;
+        if (typeof expectedHash !== "string" || !this.readBundleFile) return null;
+        const injectedResume = this.readBundleFile(attempt.id, "execution/RESUME.md");
+        if (!injectedResume) return null;
+        const actualHash = (0, import_node_crypto32.createHash)("sha256").update(injectedResume).digest("hex");
+        if (actualHash !== expectedHash) return null;
+        const recoverySnapshot = parseResumePackSnapshot(injectedResume);
+        if (!recoverySnapshot || recoverySnapshot.scenario !== "redispatch" || !recoverySnapshot.previousAttempt || recoverySnapshot.node.nodeId !== attempt.nodeId || recoverySnapshot.jobKey !== attempt.jobKey || recoverySnapshot.part !== attempt.part) return null;
+        return recoverySnapshot;
+      }
+      async externalEffectHistory(workOrderId, nodeId, companyId, options) {
+        const nodes = await this.resolveGraph(workOrderId, companyId);
+        if (!nodes.some((node) => node.nodeId === nodeId)) return null;
+        return this.store.queryExternalEffects(nodeId, options);
+      }
       async coordinatorView(workOrderId, companyId) {
         const graph = await this.resolveGraph(workOrderId, companyId);
         if (graph.length === 0) return null;
@@ -181067,6 +181529,7 @@ var init_service7 = __esm({
         const latest = latestAttemptByNode(attempts);
         const handoffs = /* @__PURE__ */ new Map();
         const checkpoints = /* @__PURE__ */ new Map();
+        const recoverySnapshots = /* @__PURE__ */ new Map();
         await Promise.all([...latest.values()].map(async (attempt) => {
           const [handoff, points] = await Promise.all([
             this.store.getHandoff(attempt.id),
@@ -181074,6 +181537,7 @@ var init_service7 = __esm({
           ]);
           handoffs.set(attempt.id, handoff);
           checkpoints.set(attempt.id, points);
+          recoverySnapshots.set(attempt.id, this.readRecoverySnapshot(attempt));
         }));
         const stateByNode = /* @__PURE__ */ new Map();
         for (const node of graph) {
@@ -181088,11 +181552,21 @@ var init_service7 = __esm({
           const attempt = latest.get(node.nodeId) ?? null;
           const handoff = attempt ? handoffs.get(attempt.id) ?? null : null;
           const checkpoint = attempt ? checkpoints.get(attempt.id) ?? null : null;
+          const recoverySnapshot = attempt ? recoverySnapshots.get(attempt.id) ?? null : null;
+          const recoverySource = attempt && recoverySnapshot?.previousAttempt ? {
+            currentAttempt: attempt,
+            recoveredFromAttempt: recoverySnapshot.previousAttempt,
+            recoveryCheckpoint: recoverySnapshot.latestCheckpoint,
+            recoveryHandoff: recoverySnapshot.previousHandoff
+          } : null;
           const nodeState = stateByNode.get(node.nodeId);
+          const wasRecovered = recoverySource !== null;
+          const executionState = wasRecovered && nodeState === "failed" ? "recovery_failed" : BLOCKING_STATES.has(nodeState) ? "awaiting_coordinator" : wasRecovered ? "recovered" : nodeState === "running" ? "running" : null;
           const includeProgress = checkpoint && ["running", "stalled", "blocked", "failed"].includes(nodeState);
           return {
             nodeId: node.nodeId,
             title: node.title,
+            attemptId: attempt?.id ?? null,
             nodeState,
             status: attempt?.status ?? "not_started",
             actorId: attempt?.actorId ?? null,
@@ -181105,6 +181579,10 @@ var init_service7 = __esm({
             risks: handoff?.risks ?? [],
             verificationGaps: handoff?.verificationGaps ?? [],
             changedOutputs: handoff?.changedOutputs ?? [],
+            executionState,
+            latestCheckpoint: checkpoint,
+            handoff,
+            recoverySource,
             ...includeProgress ? { progress: {
               pendingSteps: checkpoint.pendingSteps,
               recoverability: checkpoint.recoverability,
@@ -181126,9 +181604,132 @@ var init_service7 = __esm({
           "blocked",
           "failed"
         ].map((state) => [state, nodes.filter((node) => node.nodeState === state).length]));
-        return { workOrderId, mode: this.mode, progress, nodes, dependencyBlocks, todo: todos };
-      }
-    };
+        const collaborationStatus = nodes.length > 0 && nodes.every((node) => DONE_STATES.has(node.nodeState)) ? "completed" : nodes.some((node) => BLOCKING_STATES.has(node.nodeState)) ? "needs_coordination" : "in_progress";
+        const handoffSummary = [...nodes].sort((a, b2) => Number(BLOCKING_STATES.has(b2.nodeState)) - Number(BLOCKING_STATES.has(a.nodeState))).map((node) => node.summary.trim()).find(Boolean) ?? "";
+        return { workOrderId, mode: this.mode, collaborationStatus, handoffSummary, progress, nodes, dependencyBlocks, todo: todos };
+      }
+    };
+  }
+});
+
+// ../server/src/domains/execution-continuity/handoff-work-bridge.ts
+function createAgentHandoffWorkBridge(opts) {
+  return async (attempt, handoff) => {
+    const metadata = attempt.metadata && typeof attempt.metadata === "object" && !Array.isArray(attempt.metadata) ? attempt.metadata : {};
+    const workId = typeof metadata["engineWorkId"] === "string" ? metadata["engineWorkId"] : null;
+    const companyId = typeof metadata["engineCompanyId"] === "string" ? metadata["engineCompanyId"] : opts.getDefaultCompanyId();
+    if (!workId || !attempt.workOrderId || !handoff.userHandoff) {
+      throw new Error(`agent handoff ${attempt.id} is missing engine Work lineage`);
+    }
+    const companyEngine = await opts.resolveEngine(companyId);
+    const engineBus = companyEngine.kernel.getBus?.();
+    if (!engineBus) throw new Error(`engine bus unavailable for ${companyId}`);
+    await engineBus.submitAndProcess({
+      companyId,
+      workorderId: attempt.workOrderId,
+      actorId: attempt.actorId,
+      event: {
+        kind: "work.handoff_recorded",
+        workorderId: attempt.workOrderId,
+        workId,
+        attemptId: attempt.id,
+        producedBy: "agent",
+        status: handoff.userHandoff.status
+      },
+      dedupKey: `agent-handoff:${attempt.id}:${handoff.userHandoff.status}`
+    });
+  };
+}
+var init_handoff_work_bridge = __esm({
+  "../server/src/domains/execution-continuity/handoff-work-bridge.ts"() {
+    "use strict";
+  }
+});
+
+// ../server/src/domains/execution-continuity/upstream-handoff-input.ts
+function renderRefs(refs) {
+  return refs.map(
+    (ref2) => `- ${ref2.kind}:${ref2.id}${ref2.version ? `@${ref2.version}` : ""}${ref2.label ? ` \u2014 ${ref2.label}` : ""}`
+  );
+}
+function renderList(title, values) {
+  return [
+    `## ${title}`,
+    ...values.length > 0 ? values.map((value) => `- ${value}`) : ["- None"],
+    ""
+  ];
+}
+function renderUpstreamNodeHandoff(handoff, source) {
+  if (handoff.producedBy !== "agent") {
+    throw new Error(`upstream business handoff ${handoff.handoffId} must be Agent-authored`);
+  }
+  return [
+    "# Upstream NodeHandoff",
+    "",
+    `Upstream node: ${source.upstreamNodeId}`,
+    `Pinned work: ${source.pinnedWorkId}`,
+    `Attempt: ${handoff.attemptId}`,
+    `Handoff: ${handoff.handoffId}`,
+    `Job: ${handoff.jobKey}`,
+    `Part: ${handoff.part ?? "whole-node"}`,
+    `Outcome: ${handoff.outcome}`,
+    "Produced by: agent",
+    `Created at: ${handoff.createdAt}`,
+    "",
+    "## Summary",
+    handoff.summary,
+    "",
+    "## Changed durable outputs",
+    ...handoff.changedOutputs.length > 0 ? renderRefs(handoff.changedOutputs) : ["- None"],
+    "",
+    ...renderList("Unresolved issues", handoff.unresolvedIssues),
+    ...renderList("Risks", handoff.risks),
+    ...renderList("Next actions", handoff.nextActions),
+    ...renderList("Verification gaps", handoff.verificationGaps),
+    "This handoff explains the upstream Agent's work. Verify referenced outputs against the pinned files in this directory and their authoritative durable systems.",
+    ""
+  ].join("\n");
+}
+function createUpstreamHandoffInputResolver(opts) {
+  return async (input) => {
+    const snapshot = await opts.loadWorkorder(input.workOrderId);
+    if (!snapshot) throw new Error(`workorder not found while assembling upstream handoff: ${input.workOrderId}`);
+    const edge = snapshot.edges.find(
+      (candidate) => candidate.fromNodeId === input.upstreamNodeId && candidate.toNodeId === input.downstreamNodeId
+    );
+    const downstream = snapshot.nodes.find((node) => node.id === input.downstreamNodeId);
+    const businessEdge = edge?.kind === "data" && edge.required && downstream?.fields?.[BUSINESS_HANDOFF_POLICY_FIELD] !== BUSINESS_HANDOFF_POLICY_EXEMPT;
+    if (!businessEdge) return null;
+    if (edge.pinnedWorkId !== input.pinnedWorkId) {
+      throw new Error(
+        `upstream handoff pin drift for ${input.upstreamNodeId}\u2192${input.downstreamNodeId}: bundle=${input.pinnedWorkId}, edge=${edge.pinnedWorkId ?? "none"}`
+      );
+    }
+    const work = snapshot.works.find(
+      (candidate) => candidate.id === input.pinnedWorkId && candidate.nodeId === input.upstreamNodeId
+    );
+    if (!work) throw new Error(`pinned upstream Work not found: ${input.pinnedWorkId}`);
+    if (typeof work.assigneeActorId === "string" && work.assigneeActorId.startsWith("actor:human:")) {
+      return null;
+    }
+    if (!work.agentHandoffAttemptId || work.businessHandoffStatus !== "delivered") {
+      throw new Error(`pinned upstream Work ${work.id} has no delivered Agent handoff projection`);
+    }
+    const handoff = await opts.getHandoff(work.agentHandoffAttemptId);
+    if (!handoff) throw new Error(`Agent NodeHandoff not found for Attempt ${work.agentHandoffAttemptId}`);
+    if (handoff.attemptId !== work.agentHandoffAttemptId || handoff.producedBy !== "agent" || handoff.outcome !== "succeeded" || handoff.userHandoff?.status !== "delivered") {
+      throw new Error(`invalid Agent NodeHandoff for pinned Work ${work.id}`);
+    }
+    return renderUpstreamNodeHandoff(handoff, {
+      upstreamNodeId: input.upstreamNodeId,
+      pinnedWorkId: input.pinnedWorkId
+    });
+  };
+}
+var init_upstream_handoff_input = __esm({
+  "../server/src/domains/execution-continuity/upstream-handoff-input.ts"() {
+    "use strict";
+    init_src2();
   }
 });
 
@@ -181144,6 +181745,8 @@ var init_execution_continuity2 = __esm({
     init_service7();
     init_service7();
     init_routes8();
+    init_handoff_work_bridge();
+    init_upstream_handoff_input();
   }
 });
 
@@ -181257,7 +181860,7 @@ function createChatSessionsDomain(opts) {
       if (!text.trim()) throw new ApiError(400, "BAD_REQUEST", "text required");
       const now = Date.now();
       sweepDrafts(now);
-      const id = `cd_${(0, import_node_crypto32.randomUUID)()}`;
+      const id = `cd_${(0, import_node_crypto33.randomUUID)()}`;
       drafts.set(id, { text, actor: req.auth.actor, expiresAt: now + DRAFT_TTL_MS });
       return { status: 201, body: { id, expiresInMs: DRAFT_TTL_MS } };
     });
@@ -181290,7 +181893,7 @@ function createChatSessionsDomain(opts) {
       const runtimeId = await currentRuntimeId(body.aiActorId) ?? "unknown";
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const session = {
-        id: (0, import_node_crypto32.randomUUID)(),
+        id: (0, import_node_crypto33.randomUUID)(),
         humanActorId: req.auth.actor,
         aiActorId: body.aiActorId,
         runtimeId,
@@ -181363,7 +181966,7 @@ function createChatSessionsDomain(opts) {
       if (body.role !== "user" && body.role !== "assistant") throw new ApiError(400, "BAD_REQUEST", "role must be user or assistant");
       const role = body.role;
       const msg = await store.appendMessage({
-        id: (0, import_node_crypto32.randomUUID)(),
+        id: (0, import_node_crypto33.randomUUID)(),
         sessionId: req.params.id,
         role,
         content: role === "user" ? stripInjectedChatContext(body.content) : body.content,
@@ -181400,6 +182003,18 @@ function createChatSessionsDomain(opts) {
       const items = allSummaries.filter((s2) => workOrderIds.includes(s2.id));
       return { status: 200, body: { items } };
     });
+    router.get("/api/chat-sessions/:id/execution-recovery-attempt", async (req) => {
+      const session = await store.getSession(req.params.id);
+      if (!session || session.humanActorId !== req.auth.actor) throw new ApiError(404, "NOT_FOUND", "session not found");
+      const workOrderIds = await store.listWorkOrdersForSession(req.params.id);
+      const candidate = workOrderIds.length && opts.resolveExecutionRecoveryAttempt ? await opts.resolveExecutionRecoveryAttempt(workOrderIds, req.auth.companyId) : null;
+      return {
+        status: 200,
+        body: {
+          attempt: candidate ? { chatSessionId: session.id, ...candidate } : null
+        }
+      };
+    });
     async function locateWorkdir(sessionId, actor) {
       const session = await store.getSession(sessionId);
       if (!session || session.humanActorId !== actor) throw new ApiError(404, "NOT_FOUND", "session not found");
@@ -181456,11 +182071,11 @@ function createChatSessionsDomain(opts) {
     });
   };
 }
-var import_node_crypto32, WORKDIR_READ_MAX_BYTES;
+var import_node_crypto33, WORKDIR_READ_MAX_BYTES;
 var init_chat_sessions = __esm({
   "../server/src/domains/chat-sessions/index.ts"() {
     "use strict";
-    import_node_crypto32 = require("node:crypto");
+    import_node_crypto33 = require("node:crypto");
     init_chat_session();
     init_router();
     init_workorders();
@@ -183197,7 +183812,7 @@ function playbooksDomain(opts) {
       opts.overrides.set(companyOf(req), ref2, nodeKey, nextOverride);
       try {
         await opts.audit?.({
-          id: `reg_${(0, import_node_crypto33.randomUUID)()}`,
+          id: `reg_${(0, import_node_crypto34.randomUUID)()}`,
           actor: req.auth.actor,
           kind: "registry_change",
           target: `playbook:${ref2}#${nodeKey}`,
@@ -183214,11 +183829,11 @@ function playbooksDomain(opts) {
     });
   };
 }
-var import_node_crypto33;
+var import_node_crypto34;
 var init_routes10 = __esm({
   "../server/src/domains/playbooks/routes.ts"() {
     "use strict";
-    import_node_crypto33 = require("node:crypto");
+    import_node_crypto34 = require("node:crypto");
     init_router();
     init_registry3();
     init_planner();
@@ -183351,11 +183966,11 @@ function remoteAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs) {
     entry.appendWaiters.push({ resolve: resolve9, timer });
   });
 }
-var import_node_crypto34, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_IDS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
+var import_node_crypto35, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_IDS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
 var init_daemon_adapter = __esm({
   "../server/src/daemon-adapter.ts"() {
     "use strict";
-    import_node_crypto34 = require("node:crypto");
+    import_node_crypto35 = require("node:crypto");
     STASH_TTL_MS = 5 * 6e4;
     STASH_MAX_FRAMES_PER_ID = 500;
     STASH_MAX_IDS = 50;
@@ -183370,7 +183985,7 @@ var init_daemon_adapter = __esm({
         this.stashEnabled = opts.stashUnknownFrames ?? false;
         hub.addMessageListener((_daemonId, msg) => this.onDaemonMessage(msg));
         hub.addDisconnectListener((daemonId) => this.onNodeDown(daemonId));
-        hub.addConnectListener((daemon) => this.onNodeUp(daemon.daemonId));
+        hub.addConnectListener((daemon) => this.onNodeUp(daemon));
       }
       pending = /* @__PURE__ */ new Map();
       nodeLostGraceMs;
@@ -183456,48 +184071,73 @@ var init_daemon_adapter = __esm({
         }
         return byActor;
       }
-      /** 收到任何回帧（started/event/output/exited）即视为派发已达，取消 ack 超时。 */
-      cancelAck(dispatchId) {
+      /** 派发送达/启动观测。供新 Engine 在 session_started 之前保存 nodeId 并建立 fencing 路由。 */
+      deliveryStatus(dispatchId) {
+        const entry = this.pending.get(dispatchId);
+        return entry ? { state: entry.deliveryState, nodeId: entry.nodeId } : void 0;
+      }
+      /** 收到 dispatch_received（或兼容旧节点的更强 started/event/output 证据）即取消送达超时。 */
+      confirmDelivery(dispatchId, state) {
         const entry = this.pending.get(dispatchId);
         if (entry?.ackTimer) {
           clearTimeout(entry.ackTimer);
           entry.ackTimer = void 0;
         }
+        if (entry) entry.deliveryState = state;
       }
       onNodeDown(daemonId) {
         if (this.reapTimers.has(daemonId)) return;
         if (![...this.pending.values()].some((e) => e.nodeId === daemonId && !e.exited)) return;
         const timer = setTimeout(() => {
           this.reapTimers.delete(daemonId);
-          this.reapNode(daemonId);
+          this.markNodeUnknown(daemonId);
         }, this.nodeLostGraceMs);
         timer.unref?.();
         this.reapTimers.set(daemonId, timer);
       }
-      onNodeUp(daemonId) {
+      onNodeUp(daemon) {
+        const daemonId = daemon.daemonId;
         const timer = this.reapTimers.get(daemonId);
         if (timer) {
           clearTimeout(timer);
           this.reapTimers.delete(daemonId);
         }
-      }
-      /** 节点失联超宽限期：收割其全部在途会话——合成可重试 exit，走 dispatcher 既有退避/重派。 */
-      reapNode(daemonId) {
-        const doomed = [];
+        if (!daemon.meta || daemon.meta.pendingDispatchIds === void 0) return;
+        for (const dispatchId of daemon.meta.pendingDispatchIds) this.confirmDelivery(dispatchId, "received");
+        for (const session of daemon.meta.activeSessions ?? []) this.confirmDelivery(session.dispatchId, "started");
+        const present = /* @__PURE__ */ new Set([
+          ...daemon.meta.pendingDispatchIds ?? [],
+          ...(daemon.meta.activeSessions ?? []).map((s2) => s2.dispatchId)
+        ]);
+        const absent = [];
         for (const [dispatchId, entry] of this.pending) {
-          if (entry.nodeId === daemonId && !entry.exited) doomed.push(dispatchId);
+          if (entry.nodeId === daemonId && !entry.exited && !present.has(dispatchId)) absent.push(dispatchId);
+        }
+        for (const dispatchId of absent) {
+          this.log(`[dispatch-delivery] ${dispatchId}\uFF1A\u8282\u70B9 ${daemonId} \u91CD\u8FDE\u5E76\u660E\u786E\u786E\u8BA4 session/pending \u5747\u4E0D\u5B58\u5728 \u2192 terminal`);
+          this.settle(dispatchId, {
+            code: null,
+            reason: "server-unreachable",
+            errorMessage: `\u8282\u70B9 ${daemonId} \u91CD\u8FDE\u540E\u7684\u5B58\u5728\u6027\u5FEB\u7167\u786E\u8BA4\u539F dispatch \u4E0D\u5B58\u5728`
+          });
         }
-        if (doomed.length === 0) return;
-        console.warn(
-          `[hub-adapter] \u8282\u70B9 ${daemonId} \u5931\u8054\u8D85 ${this.nodeLostGraceMs}ms\u2014\u2014\u6536\u5272\u5176 ${doomed.length} \u4E2A\u5728\u9014\u4F1A\u8BDD\uFF08\u5F52\u56E0 server-unreachable \u2192 \u9000\u907F/\u91CD\u6D3E\uFF09\uFF1A${doomed.join(", ")}`
-        );
-        for (const dispatchId of doomed) {
-          this.settle(dispatchId, { code: null, reason: "server-unreachable", errorMessage: `\u8282\u70B9 ${daemonId} \u5931\u8054\u8D85\u5BBD\u9650\u671F\uFF08${this.nodeLostGraceMs}ms\uFF09\uFF0C\u4F1A\u8BDD\u88AB\u6536\u5272\uFF08\u51B3\u7B56 0033\uFF09` });
+      }
+      /** 节点失联超宽限期：只报警，不把「暂时够不到」升级成「runtime 已死」。 */
+      markNodeUnknown(daemonId) {
+        const unknown2 = [];
+        for (const [dispatchId, entry] of this.pending) {
+          if (entry.nodeId === daemonId && !entry.exited) unknown2.push(dispatchId);
         }
+        if (unknown2.length === 0) return;
+        this.log(`[dispatch-delivery] \u8282\u70B9 ${daemonId} \u5931\u8054\u8D85 ${this.nodeLostGraceMs}ms\uFF1B${unknown2.length} \u4E2A\u6D3E\u53D1\u4FDD\u6301\u975E\u7EC8\u6001\uFF0C\u7B49\u5F85\u5B58\u5728\u6027\u786E\u8BA4\u6216 Work SLA\uFF1A${unknown2.join(", ")}`);
       }
       onDaemonMessage(msg) {
-        if (msg.type === "session_started") {
-          this.cancelAck(msg.dispatchId);
+        if (msg.type === "dispatch_received") {
+          this.confirmDelivery(msg.dispatchId, "received");
+          const entry = this.pending.get(msg.dispatchId);
+          if (entry) this.health?.recordReachable(entry.nodeId);
+        } else if (msg.type === "session_started") {
+          this.confirmDelivery(msg.dispatchId, "started");
           const entry = this.pending.get(msg.dispatchId);
           if (entry) this.health?.recordReachable(entry.nodeId);
         } else if (msg.type === "session_exited") {
@@ -183505,12 +184145,12 @@ var init_daemon_adapter = __esm({
           if (this.pending.has(msg.dispatchId)) this.settle(msg.dispatchId, info);
           else if (this.stashEnabled) this.stashFrame(msg.dispatchId, { type: "exit", info });
         } else if (msg.type === "session_event") {
-          this.cancelAck(msg.dispatchId);
+          this.confirmDelivery(msg.dispatchId, "started");
           const entry = this.pending.get(msg.dispatchId);
           if (!entry && this.stashEnabled) this.stashFrame(msg.dispatchId, { type: "event", event: msg.event });
           for (const cb of entry?.telemetryCbs ?? []) cb(msg.event);
         } else if (msg.type === "session_output") {
-          this.cancelAck(msg.dispatchId);
+          this.confirmDelivery(msg.dispatchId, "started");
           const entry = this.pending.get(msg.dispatchId);
           if (!entry && this.stashEnabled) this.stashFrame(msg.dispatchId, { type: "output", chunk: msg.chunk });
           for (const cb of entry?.outputCbs ?? []) cb(msg.chunk);
@@ -183526,7 +184166,7 @@ var init_daemon_adapter = __esm({
       async spawn(job) {
         const nodeId = job.binding?.nodeId;
         if (!nodeId) throw new Error("DaemonHubAdapter \u9700\u8981 job.binding.nodeId\uFF08\u8DEF\u7531\u9519\u8BEF\uFF09");
-        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto34.randomUUID)()}`;
+        const dispatchId = job.dispatchId ?? `dispatch:${(0, import_node_crypto35.randomUUID)()}`;
         const entry = {
           nodeId,
           ...job.binding?.runtimeKind ? { runtimeKind: job.binding.runtimeKind } : {},
@@ -183535,6 +184175,7 @@ var init_daemon_adapter = __esm({
           telemetryCbs: [],
           outputCbs: [],
           exited: void 0,
+          deliveryState: "awaiting_ack",
           ackTimer: void 0,
           appendWaiters: []
         };
@@ -183545,9 +184186,10 @@ var init_daemon_adapter = __esm({
         } else if (this.ackTimeoutMs > 0) {
           const timer = setTimeout(() => {
             const e = this.pending.get(dispatchId);
-            if (!e || e.exited) return;
-            this.log(`[dispatch-ack] ${dispatchId}\uFF08${job.artifactId}\uFF09\u6D3E\u53D1\u540E ${this.ackTimeoutMs}ms \u672A\u89C1\u56DE\u6267 \u2192 \u5224\u6D3E\u53D1\u4E22\u5931\uFF0C\u5408\u6210\u5931\u8D25\u91CD\u6D3E`);
-            this.settle(dispatchId, { code: null, reason: "server-unreachable", errorMessage: `\u6D3E\u53D1\u540E ${this.ackTimeoutMs}ms \u672A\u89C1\u4EFB\u4F55\u56DE\u6267\uFF08session_started/\u9000\u51FA\u5E27\uFF09\uFF0C\u5224\u6D3E\u53D1\u4E22\u5931\uFF08\u5E7D\u7075\u6D3E\u53D1\uFF0Cproposal \xA74.4\uFF09` });
+            if (!e || e.exited || e.deliveryState !== "awaiting_ack") return;
+            e.ackTimer = void 0;
+            e.deliveryState = "delivery_unknown";
+            this.log(`[dispatch-delivery] ${dispatchId}\uFF08${job.artifactId}\uFF09\u6D3E\u53D1\u540E ${this.ackTimeoutMs}ms \u672A\u89C1 dispatch_received \u2192 delivery_unknown\uFF08\u975E\u7EC8\u6001\uFF0C\u4E0D\u91CD\u6D3E\uFF09`);
           }, this.ackTimeoutMs);
           timer.unref?.();
           entry.ackTimer = timer;
@@ -183586,6 +184228,7 @@ var init_daemon_adapter = __esm({
             telemetryCbs: [],
             outputCbs: [],
             exited: stashed.exit,
+            deliveryState: "started",
             ackTimer: void 0,
             appendWaiters: []
           };
@@ -183689,7 +184332,7 @@ var init_daemon_adapter = __esm({
         }));
       }
       request(nodeId, buildFrame) {
-        const requestId = (0, import_node_crypto34.randomUUID)();
+        const requestId = (0, import_node_crypto35.randomUUID)();
         const sent = this.hub.dispatch(nodeId, buildFrame(requestId));
         if (!sent) return Promise.resolve({ ok: false, code: "NODE_OFFLINE" });
         return new Promise((resolve9) => {
@@ -183721,6 +184364,31 @@ var init_daemon_adapter = __esm({
   }
 });
 
+// ../server/src/dispatch-fence.ts
+function isExplicitlyDispatchFenced(run) {
+  const fence = metadataObject(run.metadata).dispatchFence;
+  return fence !== null && typeof fence === "object" && !Array.isArray(fence);
+}
+async function fenceDispatch(trace, dispatchId, reason, at = (/* @__PURE__ */ new Date()).toISOString()) {
+  const run = await trace.getRun(dispatchId);
+  if (!run) return false;
+  if (isExplicitlyDispatchFenced(run)) return true;
+  await trace.updateRun(dispatchId, {
+    metadata: {
+      ...metadataObject(run.metadata),
+      dispatchFence: { at, reason }
+    }
+  });
+  return true;
+}
+var metadataObject;
+var init_dispatch_fence = __esm({
+  "../server/src/dispatch-fence.ts"() {
+    "use strict";
+    metadataObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+  }
+});
+
 // ../server/src/side-map.ts
 var import_node_fs16, import_node_path21, FileSideMap;
 var init_side_map = __esm({
@@ -183772,13 +184440,13 @@ function classifyPage(page, lastPushedHash, serviceAccount) {
   if (sha(body) === lastPushedHash) return { kind: "echo" };
   return { kind: "human-edit", content: body, updatedBy: page.updatedBy };
 }
-var import_node_crypto35, sha, enc3, dec, MirrorEngine, MapMirrorIdentities;
+var import_node_crypto36, sha, enc3, dec, MirrorEngine, MapMirrorIdentities;
 var init_engine = __esm({
   "../server/src/mirror/engine.ts"() {
     "use strict";
-    import_node_crypto35 = require("node:crypto");
+    import_node_crypto36 = require("node:crypto");
     init_src();
-    sha = (s2) => (0, import_node_crypto35.createHash)("sha256").update(s2, "utf8").digest("hex");
+    sha = (s2) => (0, import_node_crypto36.createHash)("sha256").update(s2, "utf8").digest("hex");
     enc3 = (s2) => new TextEncoder().encode(s2);
     dec = (b2) => new TextDecoder().decode(b2);
     MirrorEngine = class {
@@ -183977,11 +184645,11 @@ function humanExitCause(exit) {
   const base = (exit.reason ? label[exit.reason] : void 0) ?? `\u4F1A\u8BDD\u5F02\u5E38\u7ED3\u675F\uFF08${exit.reason ?? "\u65E0\u9000\u51FA\u4FE1\u606F"}\uFF09`;
   return exit.errorMessage ? `${base}\uFF1A${exit.errorMessage.slice(0, 200)}` : base;
 }
-var import_node_crypto36, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_ESCALATION_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
+var import_node_crypto37, AUTONOMOUS_ETHOS, CONVERSATIONAL_ETHOS, SHARED_GRAPH_BODY, AUTONOMOUS_RECOVERY_TOOLS, HIGH_RISK_COMMANDS, COORDINATOR_SYSTEM_PROMPT, CONVERSATIONAL_RECOVERY_TOOLS, CONVERSATIONAL_ESCALATION_TOOLS, CONVERSATIONAL_MANAGER_BODY, MACHINE_EXIT_CODES, CoordinatorWorker;
 var init_worker = __esm({
   "../server/src/coordinator/worker.ts"() {
     "use strict";
-    import_node_crypto36 = require("node:crypto");
+    import_node_crypto37 = require("node:crypto");
     init_src3();
     init_identity();
     AUTONOMOUS_ETHOS = `\u4F60\u662F\u8FD9\u4E2A\u5DE5\u5355\u7684**\u7BA1\u7406\u8005**\u2014\u2014\u804C\u8D23\u662F\u8BA9\u5B83\u987A\u7545\u8DD1\u5B8C\u3002\u7CFB\u7EDF\u5728\u67D0\u4E2A\u8282\u70B9\u5361\u4F4F\u3001\u673A\u68B0\u5206\u8BCA\u786E\u8BA4"\u9700\u8981\u4F60"\u65F6\u5524\u8D77\u4F60\uFF08\u65E0\u4EBA\u5728\u573A\uFF0C\u4F60\u8FD9\u4E00\u8F6E\u628A\u80FD\u505A\u7684\u505A\u6389\uFF09\u3002\u4F60\u7684\u624B\u6BB5\u5F88\u5BBD\uFF1A
@@ -184227,7 +184895,7 @@ ${HIGH_RISK_COMMANDS}`;
         return this.deps.kernel.model.lastSeq.get(artifactId) ?? 0;
       }
       evaluationKey(kind, artifactId, evidence) {
-        const fingerprint = (0, import_node_crypto36.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
+        const fingerprint = (0, import_node_crypto37.createHash)("sha256").update(JSON.stringify(evidence)).digest("hex");
         return `${kind}:${artifactId}:${fingerprint}`;
       }
       artifactEvidence(id) {
@@ -184601,7 +185269,7 @@ ${ctx.nodeFault}
             this.deps.log?.(`[coordinator] ${workspace} \u5168\u5C40\u4E0A\u4E0B\u6587\u8BFB\u53D6\u5931\u8D25\uFF0C\u7EE7\u7EED\u6CBF\u7528\u539F\u534F\u8C03\u8005\u4EFB\u52A1\uFF1A${String(error2)}`);
           }
         }
-        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto36.randomUUID)();
+        const runtimeSessionId = opts?.resumeSessionId ?? (0, import_node_crypto37.randomUUID)();
         const job = {
           actor: actorId,
           actorToken: token,
@@ -184889,6 +185557,7 @@ var init_src8 = __esm({
     init_overrides();
     init_scheduler();
     init_daemon_adapter();
+    init_dispatch_fence();
     init_node_health();
     init_side_map();
     init_engine();
@@ -184907,11 +185576,11 @@ var init_src8 = __esm({
 });
 
 // ../storage/src/postgres.ts
-var import_node_crypto37, ident3, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
+var import_node_crypto38, ident3, isUniqueViolation, PostgresOplogStore, PostgresBlobStore;
 var init_postgres = __esm({
   "../storage/src/postgres.ts"() {
     "use strict";
-    import_node_crypto37 = require("node:crypto");
+    import_node_crypto38 = require("node:crypto");
     init_esm();
     init_src();
     ident3 = (s2) => {
@@ -185090,7 +185759,7 @@ var init_postgres = __esm({
         return new _PostgresBlobStore(pool, schema);
       }
       async put(bytes) {
-        const hash = (0, import_node_crypto37.createHash)("sha256").update(bytes).digest("hex");
+        const hash = (0, import_node_crypto38.createHash)("sha256").update(bytes).digest("hex");
         await this.pool.query(
           `INSERT INTO ${this.t} (hash, bytes, size, content_type) VALUES ($1, $2, $3, $4) ON CONFLICT (hash) DO NOTHING`,
           [hash, Buffer.from(bytes), bytes.byteLength, sniffContentType(bytes) ?? null]
@@ -187711,10 +188380,12 @@ var init_postgres_trace = __esm({
         risks             jsonb NOT NULL DEFAULT '[]'::jsonb,
         next_actions      jsonb NOT NULL DEFAULT '[]'::jsonb,
         verification_gaps jsonb NOT NULL DEFAULT '[]'::jsonb,
+        user_handoff      jsonb,
         created_at        text NOT NULL
       )`);
         await pool.query(`ALTER TABLE "${s2}".node_handoffs ADD COLUMN IF NOT EXISTS job_key text NOT NULL DEFAULT ''`);
         await pool.query(`ALTER TABLE "${s2}".node_handoffs ADD COLUMN IF NOT EXISTS part text`);
+        await pool.query(`ALTER TABLE "${s2}".node_handoffs ADD COLUMN IF NOT EXISTS user_handoff jsonb`);
         await pool.query(`
       UPDATE "${s2}".node_handoffs h
       SET job_key=COALESCE(NULLIF(h.job_key, ''), r.job_key, 'attempt:' || h.attempt_id), part=r.part
@@ -187775,7 +188446,19 @@ var init_postgres_trace = __esm({
       FOR EACH ROW EXECUTE FUNCTION "${s2}".ensure_terminal_execution_checkpoint()`);
         await pool.query(`
       CREATE OR REPLACE FUNCTION "${s2}".ensure_terminal_node_handoff() RETURNS trigger AS $$
-      DECLARE mapped_outcome text; generated_handoff_id text;
+      DECLARE
+        mapped_outcome text;
+        generated_handoff_id text;
+        terminal_reason text;
+        latest_checkpoint_id text;
+        latest_pending jsonb;
+        latest_completed jsonb;
+        latest_recoverability text;
+        pending_effects integer;
+        failed_effects integer;
+        reconstructed_summary text;
+        reconstructed_risks jsonb;
+        reconstructed_gaps jsonb;
       BEGIN
         IF NEW.node_id IS NULL OR NEW.status IN ('queued', 'running') THEN RETURN NEW; END IF;
         mapped_outcome := CASE NEW.status
@@ -187788,24 +188471,82 @@ var init_postgres_trace = __esm({
           ELSE 'failed'
         END;
         generated_handoff_id := 'handoff:' || NEW.id;
+        terminal_reason := COALESCE(NEW.error_message, NEW.exit_reason, 'status=' || mapped_outcome);
+        -- attempt_terminal \u662F\u7CFB\u7EDF\u5728\u540C\u4E00\u7EC8\u6001\u4E8B\u52A1\u5185\u8865\u7684\u5FEB\u7167\uFF1B\u91CD\u5EFA\u4F9D\u636E\u53EA\u8BA4\u7EC8\u6001\u4E4B\u524D\u5DF2\u7ECF\u5B58\u5728\u7684\u6709\u6548 checkpoint\u3002
+        SELECT checkpoint_id, pending_steps, completed_step_ids, recoverability
+        INTO latest_checkpoint_id, latest_pending, latest_completed, latest_recoverability
+        FROM "${s2}".execution_checkpoints
+        WHERE attempt_id=NEW.id AND trigger <> 'attempt_terminal'
+        ORDER BY seq DESC LIMIT 1;
+        SELECT
+          COUNT(*) FILTER (WHERE status='pending')::int,
+          COUNT(*) FILTER (WHERE status='failed')::int
+        INTO pending_effects, failed_effects
+        FROM "${s2}".external_effects WHERE attempt_id=NEW.id;
+        reconstructed_summary := left(
+          '[system_reconstructed] attempt=' || NEW.id || ' outcome=' || mapped_outcome ||
+          ' reason=' || terminal_reason || '; ' ||
+          CASE WHEN latest_checkpoint_id IS NULL
+            THEN 'no valid pre-terminal checkpoint'
+            ELSE 'checkpoint=' || latest_checkpoint_id ||
+              ' completed=' || jsonb_array_length(COALESCE(latest_completed, '[]'::jsonb)) ||
+              ' pending=' || jsonb_array_length(COALESCE(latest_pending, '[]'::jsonb)) ||
+              ' recoverability=' || latest_recoverability
+          END,
+          400
+        );
+        reconstructed_risks :=
+          CASE WHEN NEW.error_message IS NULL THEN '[]'::jsonb
+            ELSE jsonb_build_array(left(NEW.error_message, 400)) END ||
+          CASE WHEN COALESCE(pending_effects, 0) = 0 AND COALESCE(failed_effects, 0) = 0 THEN '[]'::jsonb
+            ELSE jsonb_build_array('external effects: pending=' || COALESCE(pending_effects, 0) ||
+              ', failed=' || COALESCE(failed_effects, 0)) END;
+        reconstructed_gaps := CASE WHEN latest_checkpoint_id IS NULL
+          THEN jsonb_build_array('No valid pre-terminal checkpoint was available.')
+          ELSE '[]'::jsonb END;
         INSERT INTO "${s2}".node_handoffs AS current_handoff
           (handoff_id, attempt_id, job_key, part, produced_by, outcome, summary, changed_outputs,
-           unresolved_issues, risks, next_actions, verification_gaps, created_at)
+           unresolved_issues, risks, next_actions, verification_gaps, user_handoff, created_at)
         VALUES
           (generated_handoff_id, NEW.id, COALESCE(NEW.job_key, NEW.trigger_ref, 'attempt:' || NEW.id), NEW.part,
            'system_reconstructed', mapped_outcome,
-           CASE WHEN mapped_outcome = 'succeeded'
-             THEN 'Execution completed with ' || jsonb_array_length(NEW.output_refs) || ' durable output reference(s).'
-             WHEN mapped_outcome = 'no-output' THEN 'Execution ended cleanly without a durable output.'
-             ELSE 'Execution ended with status ' || mapped_outcome || '.' END,
-           NEW.output_refs, '[]'::jsonb,
-           CASE WHEN NEW.error_message IS NULL THEN '[]'::jsonb ELSE jsonb_build_array(left(NEW.error_message, 400)) END,
-           '[]'::jsonb, '[]'::jsonb, COALESCE(NEW.ended_at, NEW.updated_at, NEW.started_at))
+           reconstructed_summary, NEW.output_refs, '[]'::jsonb, reconstructed_risks,
+           COALESCE(latest_pending, '[]'::jsonb), reconstructed_gaps, NULL,
+           COALESCE(NEW.ended_at, NEW.updated_at, NEW.started_at))
         ON CONFLICT (attempt_id) DO UPDATE SET
-          outcome=EXCLUDED.outcome,
+          produced_by=CASE
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.produced_by
+            ELSE EXCLUDED.produced_by
+          END,
+          outcome=CASE WHEN current_handoff.produced_by = 'agent'
+            THEN current_handoff.outcome ELSE EXCLUDED.outcome END,
+          summary=CASE
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.summary
+            ELSE EXCLUDED.summary
+          END,
           changed_outputs=CASE
-            WHEN current_handoff.produced_by = 'agent' THEN current_handoff.changed_outputs
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.changed_outputs
             ELSE EXCLUDED.changed_outputs
+          END,
+          unresolved_issues=CASE
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.unresolved_issues ELSE EXCLUDED.unresolved_issues END,
+          risks=CASE
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.risks ELSE EXCLUDED.risks END,
+          next_actions=CASE
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.next_actions ELSE EXCLUDED.next_actions END,
+          verification_gaps=CASE
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.verification_gaps ELSE EXCLUDED.verification_gaps END,
+          user_handoff=CASE
+            WHEN current_handoff.produced_by = 'agent'
+              THEN current_handoff.user_handoff
+            ELSE EXCLUDED.user_handoff
           END;
         NEW.handoff_id := COALESCE(NEW.handoff_id, generated_handoff_id);
         RETURN NEW;
@@ -188511,6 +189252,101 @@ var init_postgres_trace = __esm({
         );
         return r.rows.map(rowToExternalEffect);
       }
+      async getExternalEffectsForResume(nodeId, jobKey, part, succeededLimit, failedLimit) {
+        const recency = "COALESCE(e.occurred_at, r.ended_at, r.updated_at, r.started_at, '')";
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN TRANSACTION ISOLATION LEVEL REPEATABLE READ READ ONLY");
+          const counts2 = await client.query(
+            `SELECT COUNT(*)::int AS total,
+                COUNT(*) FILTER (WHERE e.status='pending')::int AS pending,
+                COUNT(*) FILTER (WHERE e.status='succeeded')::int AS succeeded,
+                COUNT(*) FILTER (WHERE e.status='failed')::int AS failed
+         FROM ${this.s}.external_effects e
+         INNER JOIN ${this.s}.agent_runs r ON r.id=e.attempt_id
+         WHERE e.node_id=$1
+           AND COALESCE(r.job_key, r.trigger_ref, 'attempt:' || r.id)=$2
+           AND r.part IS NOT DISTINCT FROM $3`,
+            [nodeId, jobKey, part]
+          );
+          const pending = await client.query(
+            `SELECT e.* FROM ${this.s}.external_effects e
+         LEFT JOIN ${this.s}.agent_runs r ON r.id=e.attempt_id
+         WHERE e.node_id=$1 AND e.status='pending'
+           AND COALESCE(r.job_key, r.trigger_ref, 'attempt:' || r.id)=$2
+           AND r.part IS NOT DISTINCT FROM $3
+         ORDER BY ${recency} DESC, e.idempotency_key DESC`,
+            [nodeId, jobKey, part]
+          );
+          const succeeded = await client.query(
+            `SELECT e.* FROM ${this.s}.external_effects e
+         LEFT JOIN ${this.s}.agent_runs r ON r.id=e.attempt_id
+         WHERE e.node_id=$1 AND e.status='succeeded'
+           AND COALESCE(r.job_key, r.trigger_ref, 'attempt:' || r.id)=$2
+           AND r.part IS NOT DISTINCT FROM $3
+         ORDER BY ${recency} DESC, e.idempotency_key DESC LIMIT $4`,
+            [nodeId, jobKey, part, succeededLimit]
+          );
+          const failed = await client.query(
+            `SELECT e.* FROM ${this.s}.external_effects e
+         LEFT JOIN ${this.s}.agent_runs r ON r.id=e.attempt_id
+         WHERE e.node_id=$1 AND e.status='failed'
+           AND COALESCE(r.job_key, r.trigger_ref, 'attempt:' || r.id)=$2
+           AND r.part IS NOT DISTINCT FROM $3
+         ORDER BY ${recency} DESC, e.idempotency_key DESC LIMIT $4`,
+            [nodeId, jobKey, part, failedLimit]
+          );
+          const totals = counts2.rows[0];
+          const totalByStatus = {
+            pending: Number(totals?.["pending"] ?? 0),
+            succeeded: Number(totals?.["succeeded"] ?? 0),
+            failed: Number(totals?.["failed"] ?? 0)
+          };
+          const projection = {
+            effects: [...pending.rows, ...succeeded.rows, ...failed.rows].map(rowToExternalEffect),
+            summary: {
+              total: Number(totals?.["total"] ?? 0),
+              totalByStatus,
+              includedByStatus: {
+                pending: pending.rowCount ?? 0,
+                succeeded: succeeded.rowCount ?? 0,
+                failed: failed.rowCount ?? 0
+              }
+            }
+          };
+          await client.query("COMMIT");
+          return projection;
+        } catch (error2) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw error2;
+        } finally {
+          client.release();
+        }
+      }
+      async queryExternalEffects(nodeId, options) {
+        const recency = "COALESCE(e.occurred_at, r.ended_at, r.updated_at, r.started_at, '')";
+        const [count2, page] = await Promise.all([
+          this.pool.query(
+            `SELECT COUNT(*)::int AS total FROM ${this.s}.external_effects
+         WHERE node_id=$1 AND ($2::text IS NULL OR status=$2)`,
+            [nodeId, options.status ?? null]
+          ),
+          this.pool.query(
+            `SELECT e.* FROM ${this.s}.external_effects e
+         LEFT JOIN ${this.s}.agent_runs r ON r.id=e.attempt_id
+         WHERE e.node_id=$1 AND ($2::text IS NULL OR e.status=$2)
+         ORDER BY ${recency} DESC, e.idempotency_key DESC LIMIT $3 OFFSET $4`,
+            [nodeId, options.status ?? null, options.limit, options.offset]
+          )
+        ]);
+        return {
+          total: Number(count2.rows[0]?.total ?? 0),
+          offset: options.offset,
+          limit: options.limit,
+          items: page.rows.map(rowToExternalEffect)
+        };
+      }
       async putHandoff(input) {
         if (!input.summary.trim()) throw new Error("handoff summary is required");
         if ([...input.summary].length > 400) throw new Error("handoff summary exceeds 400 characters");
@@ -188537,18 +189373,24 @@ var init_postgres_trace = __esm({
             risks: input.risks ?? [],
             nextActions: input.nextActions ?? [],
             verificationGaps: input.verificationGaps ?? [],
+            userHandoff: normalizeUserHandoff(
+              input.outcome,
+              input.changedOutputs ?? run.outputRefs,
+              input.userHandoff
+            ),
             createdAt: input.createdAt ?? this.now()
           };
           const saved = await client.query(
             `INSERT INTO ${this.s}.node_handoffs AS current_handoff
           (handoff_id, attempt_id, job_key, part, produced_by, outcome, summary, changed_outputs,
-           unresolved_issues, risks, next_actions, verification_gaps, created_at)
-         VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9::jsonb,$10::jsonb,$11::jsonb,$12::jsonb,$13)
+           unresolved_issues, risks, next_actions, verification_gaps, user_handoff, created_at)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9::jsonb,$10::jsonb,$11::jsonb,$12::jsonb,$13::jsonb,$14)
          ON CONFLICT (attempt_id) DO UPDATE SET
            produced_by=EXCLUDED.produced_by, outcome=EXCLUDED.outcome, summary=EXCLUDED.summary,
            changed_outputs=EXCLUDED.changed_outputs, unresolved_issues=EXCLUDED.unresolved_issues,
            risks=EXCLUDED.risks, next_actions=EXCLUDED.next_actions,
-           verification_gaps=EXCLUDED.verification_gaps, created_at=EXCLUDED.created_at
+           verification_gaps=EXCLUDED.verification_gaps, user_handoff=EXCLUDED.user_handoff,
+           created_at=EXCLUDED.created_at
          WHERE current_handoff.produced_by <> 'agent' OR EXCLUDED.produced_by = 'agent'
          RETURNING *`,
             [
@@ -188564,6 +189406,7 @@ var init_postgres_trace = __esm({
               JSON.stringify(handoff.risks),
               JSON.stringify(handoff.nextActions),
               JSON.stringify(handoff.verificationGaps),
+              JSON.stringify(handoff.userHandoff),
               handoff.createdAt
             ]
           );
@@ -189074,6 +189917,7 @@ var init_postgres_trace = __esm({
       risks: row.risks ?? [],
       nextActions: row.next_actions ?? [],
       verificationGaps: row.verification_gaps ?? [],
+      userHandoff: row.user_handoff ?? null,
       createdAt: row.created_at
     });
     rowToEvent2 = (row) => ({
@@ -189753,11 +190597,11 @@ var init_postgres_chat_sessions = __esm({
 });
 
 // ../storage/src/postgres-nodes.ts
-var import_node_crypto38, ident12, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToRuntime;
+var import_node_crypto39, ident12, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToRuntime;
 var init_postgres_nodes = __esm({
   "../storage/src/postgres-nodes.ts"() {
     "use strict";
-    import_node_crypto38 = require("node:crypto");
+    import_node_crypto39 = require("node:crypto");
     init_esm();
     ident12 = (s2) => {
       if (!/^[a-z_][a-z0-9_]*$/.test(s2)) throw new Error(`invalid schema name: ${s2}`);
@@ -189896,7 +190740,7 @@ var init_postgres_nodes = __esm({
         return store;
       }
       issue(nodeId) {
-        const token = `ont_${(0, import_node_crypto38.randomBytes)(24).toString("base64url")}`;
+        const token = `ont_${(0, import_node_crypto39.randomBytes)(24).toString("base64url")}`;
         this.cache.set(token, nodeId);
         void this.pool.query(`INSERT INTO ${this.s}.node_tokens (token,node_id) VALUES ($1,$2)`, [token, nodeId]);
         return token;
@@ -190107,11 +190951,11 @@ var init_postgres_type_registry = __esm({
 });
 
 // ../storage/src/postgres-actor-memory.ts
-var import_node_crypto39, matchClause, ident15, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
+var import_node_crypto40, matchClause, ident15, PostgresActorMemoryStore, rowToIndexEntry, rowToRecord;
 var init_postgres_actor_memory = __esm({
   "../storage/src/postgres-actor-memory.ts"() {
     "use strict";
-    import_node_crypto39 = require("node:crypto");
+    import_node_crypto40 = require("node:crypto");
     init_src();
     matchClause = (q) => q.requireMatch && q.keywords.length > 0 ? " WHERE m > 0" : "";
     ident15 = (s2) => {
@@ -190316,7 +191160,7 @@ var init_postgres_actor_memory = __esm({
       }
       async write(input, now) {
         if (input.memId === void 0) {
-          const memId = `mem:${(0, import_node_crypto39.randomUUID)()}`;
+          const memId = `mem:${(0, import_node_crypto40.randomUUID)()}`;
           const r2 = await this.pool.query(
             `INSERT INTO ${this.s}.actor_memories
            (mem_id, actor_id, project_id, keywords, content, version, created_at, updated_at, accessed_at, source_artifact_id, source_session_id)
@@ -190832,14 +191676,14 @@ var import_node_child_process16 = require("node:child_process");
 var fs29 = __toESM(require("node:fs"), 1);
 var os9 = __toESM(require("node:os"), 1);
 var path23 = __toESM(require("node:path"), 1);
-var import_node_crypto44 = require("node:crypto");
+var import_node_crypto45 = require("node:crypto");
 
 // ../cli/src/serve.ts
 var fs25 = __toESM(require("node:fs"), 1);
 var os5 = __toESM(require("node:os"), 1);
 var path19 = __toESM(require("node:path"), 1);
 var import_node_child_process12 = require("node:child_process");
-var import_node_crypto40 = require("node:crypto");
+var import_node_crypto41 = require("node:crypto");
 var import_node_url6 = require("node:url");
 init_src3();
 init_src8();
@@ -191692,6 +192536,7 @@ async function startServe(opts) {
   const executionContinuity = createExecutionContinuityDomain({
     store: traceStore,
     mode: continuityMode,
+    readBundleFile: (attemptId, relativePath) => trajReader.readBundleFile(attemptId, relativePath),
     onCheckpointState: async (attemptId, state) => {
       try {
         traceStoreSink.checkpointState(attemptId, state);
@@ -191700,6 +192545,10 @@ async function startServe(opts) {
         console.error(`[execution-continuity] checkpoint state mirror failed for ${attemptId}:`, error2);
       }
     },
+    onAgentHandoffPersisted: createAgentHandoffWorkBridge({
+      getDefaultCompanyId: () => defaultCompanyId,
+      resolveEngine: (companyId) => getEngine(companyId)
+    }),
     resolveGraph: async (workOrderId, companyId) => {
       const companyEngine = await getEngine(companyId ?? defaultCompanyId);
       return [...companyEngine.kernel.model.artifacts.values()].filter((artifact) => artifact.workspace === workOrderId).map((artifact) => ({
@@ -192178,7 +193027,7 @@ async function startServe(opts) {
         }));
       }
       const limits = { wallClockMs: SESSION_WALL_CLOCK_MS.planner };
-      const artifactId = `artifact:planner:${(0, import_node_crypto40.randomUUID)()}`;
+      const artifactId = `artifact:planner:${(0, import_node_crypto41.randomUUID)()}`;
       const handle = await chatRemoteAdapter.spawn({
         actor: planner.id,
         actorToken: issueSessionToken(planner.id, { artifactId, action: "plan-workorder", limits, binding }),
@@ -192265,7 +193114,15 @@ async function startServe(opts) {
       executionContinuity.register,
       automations.register,
       playbooks.register,
-      ...chatSessionStore ? [createChatSessionsDomain({ store: chatSessionStore, registry: registryStore, trace: traceStore, kernel, artifactState: artifactStateStore, workdir: () => workdirBridge ?? void 0 })] : []
+      ...chatSessionStore ? [createChatSessionsDomain({
+        store: chatSessionStore,
+        registry: registryStore,
+        trace: traceStore,
+        kernel,
+        artifactState: artifactStateStore,
+        workdir: () => workdirBridge ?? void 0,
+        resolveExecutionRecoveryAttempt: (workOrderIds, companyId) => executionContinuity.service.latestRecoveryAttemptForWorkOrders(workOrderIds, companyId)
+      })] : []
     ],
     workorderDrafts,
     assistants: assistantsService,
@@ -192496,7 +193353,9 @@ async function startServe(opts) {
      */
     isDispatchFenced: async (dispatchId) => {
       const r = await traceStore.getRun(dispatchId).catch(() => null);
-      if (!r || r.status === "running") return false;
+      if (!r) return false;
+      if (isExplicitlyDispatchFenced(r)) return true;
+      if (r.status === "running") return false;
       return INFERRED_DEATH.has(r.exitReason ?? "");
     },
     retainedSession: (key) => key.annotationId && key.artifactId ? allDispatchers().map((d) => d.retainedProduceSessionFor(key.artifactId)).find(Boolean) : coordinatorRef?.retainedSessionFor(key),
@@ -192552,10 +193411,10 @@ async function startServe(opts) {
           { nodeId: priorChatSession?.runtimeId, runtimeKind: priorChatSession?.runtimeKind },
           { nodeId: binding.nodeId, runtimeKind: binding.runtimeKind }
         ) : false;
-        const runtimeSessionId = sessionId ?? (0, import_node_crypto40.randomUUID)();
+        const runtimeSessionId = sessionId ?? (0, import_node_crypto41.randomUUID)();
         const resumeRuntimeSession = Boolean(sessionId);
-        const traceRunId = `chat-run:${(0, import_node_crypto40.randomUUID)()}`;
-        const artifactId = `artifact:chat:${(0, import_node_crypto40.randomUUID)()}`;
+        const traceRunId = `chat-run:${(0, import_node_crypto41.randomUUID)()}`;
+        const artifactId = `artifact:chat:${(0, import_node_crypto41.randomUUID)()}`;
         const traceStartedAt = (/* @__PURE__ */ new Date()).toISOString();
         let lastProgressTouchMs = 0;
         const PROGRESS_TOUCH_THROTTLE_MS2 = 2e4;
@@ -192950,6 +193809,9 @@ async function startServe(opts) {
           const prodMapping = dispatchToWork.get(msg.dispatchId);
           if (prodMapping && busRef) {
             workToSession.set(prodMapping.workId, { dispatchId: msg.dispatchId, daemonId });
+            if (prodMapping.nodeId !== daemonId) {
+              dispatchToWork.set(msg.dispatchId, { ...prodMapping, nodeId: daemonId });
+            }
             busRef.submit({
               companyId: "",
               workorderId: prodMapping.workorderId,
@@ -193077,6 +193939,7 @@ async function startServe(opts) {
   const dispatchedWorks = /* @__PURE__ */ new Set();
   const dispatchedReviews = /* @__PURE__ */ new Set();
   const dispatchToWork = /* @__PURE__ */ new Map();
+  const workToSession = /* @__PURE__ */ new Map();
   async function rebuildDispatchMappings(store) {
     try {
       const ids2 = await store.transaction((tx) => tx.listActiveWorkorders());
@@ -193102,7 +193965,6 @@ async function startServe(opts) {
       console.warn(`[new-engine] \u91CD\u5EFA dispatch \u6620\u5C04\u5931\u8D25: ${String(err)}`);
     }
   }
-  const workToSession = /* @__PURE__ */ new Map();
   const reviewToSession = /* @__PURE__ */ new Map();
   const dispatchToReview = /* @__PURE__ */ new Map();
   let busRef = null;
@@ -193168,7 +194030,7 @@ async function startServe(opts) {
           console.log(`[new-engine] dispatchWork ${workId} \u2192 ${rev.artifactId} / ${rev.author}${replyIssueId ? `\uFF08\u56DE\u4FE1 ${replyIssueId}\uFF09` : ""}`);
           const art = kernelModel.artifacts.get(rev.artifactId);
           const wid = art?.workspace ?? "";
-          const ledgerId = `dispatch:${(0, import_node_crypto40.randomUUID)()}`;
+          const ledgerId = `dispatch:${(0, import_node_crypto41.randomUUID)()}`;
           try {
             await dispatchLedger.insertOpen({
               id: ledgerId,
@@ -193184,7 +194046,7 @@ async function startServe(opts) {
           }
           let result;
           try {
-            result = replyIssueId && newEngineReplyWork ? await newEngineReplyWork(rev.artifactId, rev.author, replyIssueId, ledgerId) : await newEngineProduce(rev.artifactId, rev.author, ledgerId);
+            result = replyIssueId && newEngineReplyWork ? await newEngineReplyWork(rev.artifactId, rev.author, replyIssueId, ledgerId) : await newEngineProduce(rev.artifactId, rev.author, workId, ledgerId);
           } catch (err) {
             dispatchLedger.close(ledgerId, { outcome: "failed", reason: `dispatch error: ${err instanceof Error ? err.message : String(err)}` }).catch(ledgerWarn("close(error)"));
             console.log(`[new-engine] dispatchWork ${workId} \u6D3E\u53D1\u5F02\u5E38\uFF1A${String(err)} \u2192 \u7F6E work failed`);
@@ -193205,7 +194067,13 @@ async function startServe(opts) {
             return;
           }
           if (result?.dispatchId) {
-            dispatchToWork.set(result.dispatchId, { workId, workorderId: wid });
+            const delivery = dispatchRemoteAdapter?.deliveryStatus(result.dispatchId);
+            dispatchToWork.set(result.dispatchId, {
+              workId,
+              workorderId: wid,
+              ...delivery ? { nodeId: delivery.nodeId } : {}
+            });
+            if (delivery) workToSession.set(workId, { dispatchId: result.dispatchId, daemonId: delivery.nodeId });
             dispatchedWorks.add(workId);
           } else if (result?.kind === "spawn-failed" || result?.kind === "predispatch-timeout") {
             dispatchLedger.close(ledgerId, { outcome: "failed", reason: `dispatch ${result.kind}` }).catch(ledgerWarn("close(spawn-failed)"));
@@ -193238,7 +194106,7 @@ async function startServe(opts) {
           const kernelModel = newKernel.model;
           const art = kernelModel.artifacts.get(nodeId);
           const revWid = art?.workspace ?? "";
-          const ledgerId = `dispatch:${(0, import_node_crypto40.randomUUID)()}`;
+          const ledgerId = `dispatch:${(0, import_node_crypto41.randomUUID)()}`;
           try {
             await dispatchLedger.insertOpen({
               id: ledgerId,
@@ -193269,11 +194137,16 @@ async function startServe(opts) {
         },
         async cancelSession(ref2) {
           const workSess = workToSession.get(ref2);
-          if (workSess && hub) {
-            console.log(`[new-engine] cancelSession workId=${ref2} dispatchId=${workSess.dispatchId} daemon=${workSess.daemonId}`);
-            hub.dispatch(workSess.daemonId, { type: "kill", dispatchId: workSess.dispatchId });
+          const persistedWorkDispatch = [...dispatchToWork.entries()].find(([, mapping]) => mapping.workId === ref2);
+          if ((workSess || persistedWorkDispatch) && hub) {
+            const dispatchId = workSess?.dispatchId ?? persistedWorkDispatch[0];
+            const daemonId = workSess?.daemonId ?? persistedWorkDispatch[1].nodeId;
+            console.log(`[new-engine] cancelSession workId=${ref2} dispatchId=${dispatchId} daemon=${daemonId ?? "unknown"}`);
+            const fenced = await fenceDispatch(traceStore, dispatchId, "engine-cancel-before-successor");
+            if (!fenced) throw new Error(`\u627E\u4E0D\u5230 dispatch run ${dispatchId}\uFF0C\u62D2\u7EDD\u5728\u65E0 fencing \u65F6\u521B\u5EFA\u540E\u7EE7`);
+            if (daemonId) hub.dispatch(daemonId, { type: "kill", dispatchId });
             workToSession.delete(ref2);
-            dispatchLedger.close(workSess.dispatchId, { outcome: "cancelled", reason: "session-cancelled" }).catch(ledgerWarn("close(cancel-work)"));
+            dispatchLedger.close(dispatchId, { outcome: "cancelled", reason: "session-cancelled" }).catch(ledgerWarn("close(cancel-work)"));
             return;
           }
           const reviewSess = reviewToSession.get(ref2);
@@ -193496,7 +194369,15 @@ async function startServe(opts) {
           const out = await actorMemoryService.list({ actorId, artifactId }, { scope: "all", keywords: queryTerms, limit: MEMORY_INJECT_MAX, offset: 0 }).catch(() => null);
           return out?.items ?? [];
         },
-        ...continuityMode !== "off" ? { executionContinuityInstructions: renderContinuityProtocol() } : {},
+        resolveUpstreamHandoff: createUpstreamHandoffInputResolver({
+          loadWorkorder: async (workOrderId) => {
+            const store = companyEngine.kernel.getStore?.();
+            if (!store) throw new Error(`engine store unavailable for ${companyId}`);
+            return store.transaction((tx) => tx.loadWorkorder(workOrderId));
+          },
+          getHandoff: (attemptId) => traceStore.getHandoff(attemptId)
+        }),
+        executionContinuityInstructions: continuityMode === "off" ? renderBusinessHandoffProtocol() : renderContinuityProtocol(),
         ...continuityMode === "resume" ? {
           resolveExecutionResumePack: async (artifactId, workOrderId, scope) => {
             const pack = await executionContinuity.service.resumePack(workOrderId, artifactId, companyId, {
@@ -193577,8 +194458,15 @@ async function startServe(opts) {
       });
       const slot = { dispatcher: d, logged: 0, ticking: false };
       dispatchers.set(companyId, slot);
-      newEngineProduce = async (artifactId, actorId, dispatchId) => {
-        const result = await d.requestProduce({ artifactId, actor: actorId, bypassScheduling: true, ...dispatchId !== void 0 ? { dispatchId } : {} });
+      newEngineProduce = async (artifactId, actorId, workId, dispatchId) => {
+        const result = await d.requestProduce({
+          artifactId,
+          actor: actorId,
+          bypassScheduling: true,
+          engineWorkId: workId,
+          engineCompanyId: companyId,
+          ...dispatchId !== void 0 ? { dispatchId } : {}
+        });
         return { kind: result.kind, dispatchId: result.kind === "dispatched" ? result.dispatchId : void 0 };
       };
       newEngineReplyWork = async (artifactId, actorId, issueId, dispatchId) => {
@@ -194258,7 +195146,7 @@ var SessionManager = class {
 // ../cli/src/daemon/ws-client.ts
 init_wrapper();
 var import_node_os9 = require("node:os");
-var import_node_crypto41 = require("node:crypto");
+var import_node_crypto42 = require("node:crypto");
 init_src6();
 
 // ../cli/src/daemon/detect-adapters.ts
@@ -194610,6 +195498,10 @@ var DaemonWsClient = class {
   stopped = false;
   /** 收到 update 但有活跃会话时置真：延后到所有会话结束再自更新，避免打断执行中的 agent。 */
   pendingUpdate = false;
+  /** 已回 dispatch_received、尚未完成 runtime spawn 的派发；也随 hello 上报供重连对账。 */
+  pendingDispatchIds = /* @__PURE__ */ new Set();
+  /** setup 期间收到 kill 的派发。spawn 返回后先杀句柄，不得再宣告 session_started。 */
+  cancelledPendingDispatchIds = /* @__PURE__ */ new Set();
   /**
    * 回执 outbox（proposal run-ledger §4.2）：**服务端据以判决的帧**发出后先留一份，收到
    * 服务端 ack 才删；ws 抖动坏窗口发失败/丢失的帧，在重连时全量重发——投递升级 at-least-once，
@@ -194738,11 +195630,19 @@ var DaemonWsClient = class {
         const { dispatchId, job } = msg;
         const t0 = Date.now();
         log2("[node-cli]", `\u2190 dispatch  ${dispatchId}  artifact=${job.artifactId}`);
+        if (this.pendingDispatchIds.has(dispatchId) || this.sessions.get(dispatchId)) {
+          this.send({ type: "dispatch_received", dispatchId });
+          break;
+        }
+        this.pendingDispatchIds.add(dispatchId);
+        this.send({ type: "dispatch_received", dispatchId });
         try {
           if (this.preflight) {
             const preflightFailure = await preflightOasisAccess(job);
             if (preflightFailure) {
               log2("[node-cli]", `  preflight failed: ${preflightFailure.reason}`);
+              this.pendingDispatchIds.delete(dispatchId);
+              this.cancelledPendingDispatchIds.delete(dispatchId);
               this.sendKeyFrame(dispatchId, { type: "session_exited", dispatchId, sessionId: "preflight-failed", info: preflightFailure });
               return;
             }
@@ -194763,8 +195663,8 @@ var DaemonWsClient = class {
             actor: job.actor,
             ...job.action ? { action: job.action } : {}
           });
-          log2("[node-cli]", `  \u2192 session_started  id=${handle.id}  setup=${Date.now() - t0}ms`);
-          this.sendKeyFrame(dispatchId, { type: "session_started", dispatchId, sessionId: handle.id, jobArtifactId: job.artifactId });
+          this.pendingDispatchIds.delete(dispatchId);
+          const cancelledBeforeStart = this.cancelledPendingDispatchIds.delete(dispatchId);
           handle.onOutput?.((chunk) => this.sendStream({ type: "session_output", dispatchId, chunk }));
           handle.onTelemetry?.((event) => this.sendStream({ type: "session_event", dispatchId, event }));
           handle.onExit((info) => {
@@ -194773,7 +195673,16 @@ var DaemonWsClient = class {
             this.sendKeyFrame(dispatchId, { type: "session_exited", dispatchId, sessionId: handle.id, info });
             this.maybeRunPendingUpdate();
           });
+          if (cancelledBeforeStart) {
+            log2("[node-cli]", `  dispatch ${dispatchId} \u5728 setup \u671F\u95F4\u5DF2\u88AB fencing\uFF0Cspawn \u540E\u7ACB\u5373 kill`);
+            await handle.kill();
+          } else {
+            log2("[node-cli]", `  \u2192 session_started  id=${handle.id}  setup=${Date.now() - t0}ms`);
+            this.sendKeyFrame(dispatchId, { type: "session_started", dispatchId, sessionId: handle.id, jobArtifactId: job.artifactId });
+          }
         } catch (err) {
+          this.pendingDispatchIds.delete(dispatchId);
+          this.cancelledPendingDispatchIds.delete(dispatchId);
           log2("[node-cli]", `  spawn failed: ${err}`);
           const errorMessage = String(err?.stack ?? err).slice(0, 8e3);
           this.sendKeyFrame(dispatchId, { type: "session_exited", dispatchId, sessionId: "spawn-failed", info: { code: null, reason: "error", errorMessage } });
@@ -194783,7 +195692,9 @@ var DaemonWsClient = class {
       case "kill": {
         log2("[node-cli]", `\u2190 kill  dispatch=${msg.dispatchId}`);
         const killed = await this.sessions.kill(msg.dispatchId);
-        if (!killed) {
+        if (!killed && this.pendingDispatchIds.has(msg.dispatchId)) {
+          this.cancelledPendingDispatchIds.add(msg.dispatchId);
+        } else if (!killed) {
           this.sendKeyFrame(msg.dispatchId, { type: "session_exited", dispatchId: msg.dispatchId, sessionId: "missing-session", info: { code: null, reason: "timeout" } });
         }
         break;
@@ -194856,7 +195767,7 @@ var DaemonWsClient = class {
    */
   async queryArtifactStates(artifactIds, timeoutMs = 15e3) {
     if (artifactIds.length === 0) return {};
-    const requestId = (0, import_node_crypto41.randomUUID)();
+    const requestId = (0, import_node_crypto42.randomUUID)();
     return new Promise((resolve9, reject) => {
       const timer = setTimeout(() => {
         this.gcPending.delete(requestId);
@@ -194939,7 +195850,9 @@ var DaemonWsClient = class {
       ...this.daemonVersion ? { daemonVersion: this.daemonVersion } : {},
       connectorReadiness: inspectConnectorRuntimeReadiness(),
       ...this.nodeName ? { nodeName: this.nodeName } : {},
-      ...activeSessions.length > 0 ? { activeSessions } : {}
+      ...activeSessions.length > 0 ? { activeSessions } : {},
+      // 始终带字段（空数组也带）作为新协议能力标志；服务端仅对支持该字段的节点做缺席确认。
+      pendingDispatchIds: [...this.pendingDispatchIds]
     };
   }
 };
@@ -195143,7 +196056,7 @@ function forwardSignal(child, sig, killGroup = (pgid, signal) => {
 // ../cli/src/daemon/machine-id.ts
 var import_node_child_process14 = require("node:child_process");
 var import_node_fs20 = require("node:fs");
-var import_node_crypto42 = require("node:crypto");
+var import_node_crypto43 = require("node:crypto");
 var import_node_os12 = require("node:os");
 function linuxMachineId() {
   for (const p2 of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
@@ -195209,7 +196122,7 @@ var defaultSources = {
 function resolveNodeId(sources = {}) {
   const s2 = { ...defaultSources, ...sources };
   const material = `${s2.machineFingerprint()}:${s2.osUser()}`;
-  const digest = (0, import_node_crypto42.createHash)("sha256").update(material).digest("hex").slice(0, 12);
+  const digest = (0, import_node_crypto43.createHash)("sha256").update(material).digest("hex").slice(0, 12);
   return `node-${digest}`;
 }
 
@@ -195655,18 +196568,21 @@ var COMMAND_DECLS = {
     examples: ["oasis continuity-effect --kind send-message --target chat:release --key release-v1"]
   },
   "continuity-handoff": {
-    usage: "oasis continuity-handoff --outcome <status> --summary <text> [--outputs <json-array>] [--unresolved <json-string-array>] [--risks <json-string-array>] [--next <json-string-array>] [--verification-gaps <json-string-array>]",
-    description: "\u4E3A\u5F53\u524D\u6D3E\u53D1 attempt \u5199\u7ED3\u6784\u5316 NodeHandoff\uFF1B\u7CFB\u7EDF\u4ECD\u4F1A\u4E3A\u6F0F\u5199\u7684\u7EC8\u6001 attempt \u515C\u5E95\u91CD\u5EFA\u3002",
+    usage: "oasis continuity-handoff --outcome <status> --summary <text> --user-summary <text> [--user-deliverables <json-array>] [--user-next-step <text>] [--outputs <json-array>] [--unresolved <json-string-array>] [--risks <json-string-array>] [--next <json-string-array>] [--verification-gaps <json-string-array>]",
+    description: "\u4E3A\u5F53\u524D\u6D3E\u53D1 attempt \u5199\u6280\u672F\u578B NodeHandoff\uFF0C\u5E76\u5355\u72EC\u5199\u4F9B\u4F7F\u7528\u8005\u67E5\u770B\u7684 userHandoff\u3002",
     flags: [
       { name: "outcome", desc: "succeeded | no-output | failed | cancelled | timeout | orphaned", required: true },
       { name: "summary", desc: "\u4E0D\u8D85\u8FC7 400 \u5B57\u7684\u6458\u8981", required: true },
+      { name: "user-summary", desc: "\u505A\u4E86\u4EC0\u4E48\u3001\u5F62\u6210\u4EC0\u4E48\u7ED3\u679C\u3001\u4E0B\u6E38\u53EF\u57FA\u4E8E\u4EC0\u4E48\u7EE7\u7EED\uFF1B\u5931\u8D25\u65F6\u5199\u672A\u4EA4\u4ED8\u539F\u56E0", required: true },
+      { name: "user-deliverables", desc: "\u53EF\u6253\u5F00\u7684\u4E1A\u52A1\u4EA4\u4ED8\u7269\u5F15\u7528 JSON array\uFF1B\u4E0D\u8981\u586B conclude/gap/checkpoint/op" },
+      { name: "user-next-step", desc: "\u7ED9\u4E0B\u6E38\u6216\u5904\u7406\u963B\u585E\u8005\u7684\u7B80\u77ED\u4E0B\u4E00\u6B65" },
       { name: "outputs", desc: "\u53D8\u5316\u8F93\u51FA\u5F15\u7528 JSON array" },
       { name: "unresolved", desc: "\u672A\u89E3\u51B3\u95EE\u9898 JSON string array" },
       { name: "risks", desc: "\u98CE\u9669 JSON string array" },
       { name: "next", desc: "\u4E0B\u4E00\u6B65 JSON string array" },
       { name: "verification-gaps", desc: "\u9A8C\u8BC1\u7F3A\u53E3 JSON string array" }
     ],
-    examples: [`oasis continuity-handoff --outcome succeeded --summary "implemented and tested" --next '[]'`]
+    examples: [`oasis continuity-handoff --outcome succeeded --summary "implemented and tested" --user-summary "\u5F00\u53D1\u5DF2\u5B8C\u6210\u5E76\u901A\u8FC7\u6D4B\u8BD5\u3002" --user-deliverables '[{"kind":"artifact","id":"artifact:dev:x","label":"\u5F00\u53D1\u7ED3\u679C"}]' --user-next-step "\u4E0B\u6E38\u53EF\u5F00\u59CB\u9A8C\u6536\u3002" --next '[]'`]
   },
   "continuity-view": {
     usage: "oasis continuity-view <workOrderId>",
@@ -196443,13 +197359,13 @@ function ownFlagsFromDecl(command) {
 }
 
 // ../cli/src/connector-effect-runner.ts
-var import_node_crypto43 = require("node:crypto");
+var import_node_crypto44 = require("node:crypto");
 var import_node_child_process15 = require("node:child_process");
 init_src6();
 function stableKey(effect) {
   const keyFields = Object.fromEntries(Object.entries(effect.keyFields).sort(([a], [b2]) => a.localeCompare(b2)));
   const canonical = JSON.stringify({ kind: effect.kind, target: effect.target, keyFields });
-  return `sha256:${(0, import_node_crypto43.createHash)("sha256").update(canonical).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto44.createHash)("sha256").update(canonical).digest("hex")}`;
 }
 async function runConnectorEffect(connector, toolArgs, deps) {
   const effect = connector.describeExternalEffect?.(toolArgs) ?? null;
@@ -196579,7 +197495,7 @@ var USAGE = `oasis \u2014\u2014 artifact-centric \u534F\u4F5C\u5185\u6838 CLI\uF
   record-action <artifactId> --name <\u52A8\u4F5C\u540D> [--pass true] [--result <json>] [--params <json>]   # \xA79.2 grounding \u7559\u75D5\uFF1A\u4E3A action_vs_oplog \u8BB0\u4E00\u6761\u901A\u8FC7\u7684 tool_call\uFF08\u771F\u8DD1\u8FC7\u5065\u5EB7\u63A2\u9488\u540E record-action --name health_probe --pass true\uFF09\uFF1B\u58F0\u660E\u4E86 requiredActions \u7684\u7C7B\u578B\u6CA1\u6709\u5B83 conclude \u4F1A\u88AB\u673A\u68B0\u62E6
   continuity-checkpoint --pending <json-string-array> --recoverability full|partial|none [--trigger plan_completed|stage_completed] [--refs <json-array>] [--completed <json-string-array>]
   continuity-effect --kind <kind> --target <target> --key <stable-key>
-  continuity-handoff --outcome <status> --summary <text> [--outputs <json-array>] [--unresolved <json-string-array>] [--risks <json-string-array>] [--next <json-string-array>] [--verification-gaps <json-string-array>]
+  continuity-handoff --outcome <status> --summary <text> --user-summary <text> [--user-deliverables <json-array>] [--user-next-step <text>] [--outputs <json-array>] [--unresolved <json-string-array>] [--risks <json-string-array>] [--next <json-string-array>] [--verification-gaps <json-string-array>]
   continuity-view <workOrderId>                    # \u534F\u8C03\u89C6\u56FE\uFF1A\u516B\u6001\u8FDB\u5EA6\u3001\u4F9D\u8D56\u963B\u585E\u3001\u6309\u4F18\u5148\u7EA7 todo
   continuity-resume <workOrderId> <nodeId>         # \u8C03\u8BD5\u5F53\u524D\u8282\u70B9\u4F1A\u6536\u5230\u7684\u7ED3\u6784\u5316 ResumePack
   resolve   <annotationId> [--as resolved|wontfix|acknowledged]
@@ -197159,7 +198075,7 @@ async function runCli(argv, println = console.log, progressln = console.error) {
     const store = createNodeTokenStore(path23.join(dir, "node-tokens.json"));
     const sub = positional[0];
     if (sub === "issue") {
-      const id = flags.get("id") ?? `node-${(0, import_node_crypto44.randomUUID)()}`;
+      const id = flags.get("id") ?? `node-${(0, import_node_crypto45.randomUUID)()}`;
       const token2 = store.issue(id);
       println(token2);
       process.stderr.write(
@@ -197596,14 +198512,26 @@ Trace: ${run.traceRunId}`);
       break;
     }
     case "continuity-handoff": {
+      const outcome = need(flags, "outcome");
+      const changedOutputs = flags.has("outputs") ? parseArrayFlag(flags.get("outputs"), "outputs") : [];
+      const userSummary = need(flags, "user-summary").trim();
+      if (!userSummary) throw new Error("--user-summary \u4E0D\u80FD\u4E3A\u7A7A");
+      const userDeliverables = flags.has("user-deliverables") ? parseArrayFlag(flags.get("user-deliverables"), "user-deliverables") : [];
+      const userNextStep = flags.get("user-next-step")?.trim() ?? "";
       const result = await api.request("PUT", "/api/execution-continuity/attempts/current/handoff", {
-        outcome: need(flags, "outcome"),
+        outcome,
         summary: need(flags, "summary"),
-        changedOutputs: flags.has("outputs") ? parseArrayFlag(flags.get("outputs"), "outputs") : [],
+        changedOutputs,
         unresolvedIssues: flags.has("unresolved") ? parseStringArrayFlag(flags.get("unresolved"), "unresolved") : [],
         risks: flags.has("risks") ? parseStringArrayFlag(flags.get("risks"), "risks") : [],
         nextActions: flags.has("next") ? parseStringArrayFlag(flags.get("next"), "next") : [],
-        verificationGaps: flags.has("verification-gaps") ? parseStringArrayFlag(flags.get("verification-gaps"), "verification-gaps") : []
+        verificationGaps: flags.has("verification-gaps") ? parseStringArrayFlag(flags.get("verification-gaps"), "verification-gaps") : [],
+        userHandoff: {
+          status: outcome === "succeeded" ? "delivered" : "not_delivered",
+          summary: userSummary,
+          deliverables: outcome === "succeeded" ? userDeliverables : [],
+          nextStep: userNextStep
+        }
       });
       println(JSON.stringify(result, null, 2));
       break;
@@ -199338,7 +200266,7 @@ function syncRuntimeAssets(candidateRoots, binDir) {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "0.1.99" : "dev";
+var PKG_VERSION = true ? "0.1.101" : "dev";
 var OASIS_DIR = path25.join(os10.homedir(), ".oasis");
 var CONFIG_FILE = path25.join(OASIS_DIR, "node-config.json");
 var PID_FILE = path25.join(OASIS_DIR, "node.pid");
@@ -199507,7 +200435,7 @@ function selfUpdate() {
   const inner = `{ echo "[oasis] self-update \u2192 ${PKG_NAME}@latest (registry ${OFFICIAL}, \u5931\u8D25\u56DE\u843D\u9ED8\u8BA4\u6E90)"; sleep 2; { ${installOfficial} || ${installFallback}; } && ${printVersion} && ${startCmd}; } >> '${LOG_FILE}' 2>&1`;
   const hasSystemd = process.platform === "linux" && (() => {
     try {
-      (0, import_node_child_process16.execSync)("command -v systemd-run", { stdio: "ignore" });
+      (0, import_node_child_process16.execSync)("systemd-run --user --scope --quiet -- true", { stdio: "ignore" });
       return true;
     } catch {
       return false;