sortie-dogs 0.10.18 → 0.10.20

package/README.md

@@ -28,8 +28,6 @@ implementation, validation, review, and model routing.
 Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) ·
 [Testing](docs/testing.md) · [CLI testing](docs/cli-testing.md)
 
-Release: [v0.10.6](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.10.6)
-
 > **Beta:** v0.10.x is under active stabilization. Runtime behavior,
 > configuration, and generated assets may still change before 1.0.
 
@@ -85,78 +83,23 @@ The v0.10 profile is serial by design. The stable profile's Luna fabric and
 parallel integration path are not exposed in this profile. More agents are not a
 goal; preserving quality while reducing unnecessary expensive work is.
 
-### SWE-bench policy from v0.10.6
-
-Starting with v0.10.6, development proceeds alongside recurring SWE-bench
-measurement. This is a measurement policy, not a claim that an unrun suite passed.
-
-- Freeze the task input, package/source snapshot, model routes, budgets, tools,
-  and stop endpoint before comparing runs.
-- Freeze the candidate only after all writers stop, then grade a separate copy
-  with one pinned official verifier execution.
-- Record benchmark completion, official task correctness, and harness terminal
-  state independently. A Sortie `DONE` or review `PASS` is not an official
-  verifier reward.
-- Record agent-to-freeze and verifier time separately, plus root and descendant
-  tokens, model steps, children, cache behavior, estimated cost, and coverage.
-- Keep infrastructure failure distinct from scored failure. Small or unmatched
-  samples remain case studies, not leaderboard or general success-rate claims.
-
-The pre-v0.10.6 local benchmark condition is closed historical evidence. New
-development decisions use SWE-bench measurements collected under the frozen
-contract in [Coding benchmark completion and correctness](docs/benchmark-completion-contract.md).
-
-### v0.10.14 SWE-bench Lite dev23 baseline
-
-The first complete v0.10.14 baseline was run against all 23 `dev` instances and
-graded with the pinned official harness. It is a fixed candidate baseline, not a
-leaderboard or general success-rate claim.
-
-- Candidate: `sortie-dogs@0.10.14`, package SHA-256
-  `f2caf67268a5f69b67a252a0d84bfc5ad09db82684aa8c1e0f5c49f8d2986993`.
-- Dataset: `princeton-nlp/SWE-bench_Lite`, revision
-  `6ec7bb89b9342f664a54a6e0a6ea6501d3437cc2`, split `dev`.
-- Conditions: pass@1, `attempts_per_instance=1`, `retry_count=0`, per-instance
-  inference limit `$1.50`, four independent inference slots, and official
-  scoring with `max_workers=1`.
-- Official score: **6/23 (26.1%)**. All 23 rows received an official result.
-- Resolved instances: `marshmallow-code__marshmallow-1343`,
-  `marshmallow-code__marshmallow-1359`, `pydicom__pydicom-1256`,
-  `pydicom__pydicom-1694`, `pylint-dev__astroid-1333`, and
-  `sqlfluff__sqlfluff-1733`.
-- Inference spend: `$15.7542788` under the separate `$50` v0.10.14 campaign.
-- Environment deviations retained in the result: five `pvlib` rows hit the
-  NumPy 2.0 removal of `np.Inf`, and `pyvista__pyvista-4315` lacked
-  `libGL.so.1`. These rows remain in the denominator and were not silently
-  removed.
-- Four non-successful inference terminals (`timeout` or `patch-index-failed`)
-  produced empty patches and are counted as unresolved official results.
-
-This baseline is the comparison point for any later v0.10.15 candidate. A
-later candidate must use its own package digest and preserve the same dataset,
-official scoring boundary, and declared budget conditions before its score is
-compared with this value.
-
-## Historical local case study
-
-These are completion-filtered local references on one frozen DeepSWE task,
-`datacurve/anko-typed-variable-bindings`, collected from 2026-09-14 through
-2026-09-18. They are not matched pairs or a leaderboard result.
-
-- Bare OpenCode: Verified PASS `0/3`, F2P `3/27`, median agent wall `24.5 min`,
-  median completed-run API-equivalent cost `$3.53`.
-- Sortie v0.9.12: Verified PASS `0/3`, F2P `23/27`, median wall `25.7 min`,
-  median completed-run cost `$2.85`; two additional interrupted attempts cost
-  an estimated `$6.20`.
-- Sortie v0.10.3 one-shot: Verified PASS `0/1`, F2P `7/9`, wall `22.7 min`,
-  estimated cost `$3.79`.
-- Sortie v0.10.5 one-shot: Verified PASS `1/1`, F2P `9/9`, P2P `94/94`, wall
-  `43.8 min`, estimated cost `$2.58`.
-
-The v0.10.5 result is one verified success, not a success rate. Historical rate
-schedules and endpoints differ, and the host-reported zero cost is not treated as
-a bill. See [definitions, frozen inputs, and limitations](docs/benchmark-reference.md)
-and [machine-readable values](docs/benchmarks/provisional-reference.json).
+### SWE-bench evaluation
+
+A frozen Sortie-dogs v0.10.14 build was evaluated on 23 fixed tasks.
+
+- Official verifier PASS: 6 / 23
+- Scored FAIL: 17 / 23
+- Infrastructure blocked: 0 / 23
+- Total estimated model cost: $15.75
+- Median agent runtime: 15.2 min
+
+The same Sortie-dogs candidate, model routes, budgets, tools, and verification
+procedure were held fixed for all tasks. This is one frozen evaluation, not a
+general success-rate claim.
+
+Full methodology and per-task results: [benchmark details](docs/benchmark-v0.10.14-dev23.md)
+
+Historical qualification references remain in [benchmark reference](docs/benchmark-reference.md).
 
 ## How v0.10.6 works
 

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2-root-revision1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1";
+export const V010_RUNTIME_ASSET_VERSION = "0.10.0-v0912-language4-cost-rpt10-compaction-ref2-proposal1-review-remediation1-surface4-proposal-recovery2-quality1-terminal2-route1-path1-permission2-prerequisite1-v2-bridge1-intent1-reflection1-cancel1-proposal-budget1-goal-recovery1-delegate-execute1-v2-depth1-process-replacement1-unstarted-v2-1-cold-turn1-return-report-v2-2-root-revision1";

package/dist/core/goal-declaration-format.d.ts

@@ -1,10 +1,23 @@
 /** Shared planner guidance and admission enums; no inferred acceptance or dispatch authority. */
 export declare const GOAL_DELIVERY_INTENTS: readonly ["design", "registration", "implementation", "repair", "controlled-change"];
 export declare const GOAL_DELIVERY_MODES: readonly ["planning-only", "mvp-first", "repair-first", "controlled-change"];
+export declare const GOAL_CRITERION_ENUMS: {
+    readonly build_boundary: readonly ["included", "excluded", "not-applicable"];
+    readonly proof_scope: readonly ["requested-full", "document-deliverable", "expected-negative"];
+    readonly expected_outcome: readonly ["pass", "fail"];
+    readonly source_binding: readonly ["declared", "current-protected"];
+    readonly candidate_binding: readonly ["declared", "current-protected"];
+};
 export declare function hasGoalCommandAliasConflict(values: Record<string, unknown>): boolean;
 /** Shared root fields are defaults too. Explicit defaults and then per-criterion
  * fields take precedence; no commands, identifiers or criteria are rewritten. */
 export declare function goalDeclarationDefaults(object: Record<string, unknown>): Record<string, unknown>;
+export interface GoalDeclarationFieldDiagnostic {
+    readonly pointer: string;
+    readonly expected: string;
+}
+/** Validate structured planner fields before immutable controls exist; expansion itself remains lossless. */
+export declare function goalDeclarationFieldDiagnostics(object: Record<string, unknown>): readonly GoalDeclarationFieldDiagnostic[];
 export declare const GOAL_DECLARATION_FORMAT: string;
 /** Normalize a shared declaration without guessing acceptance, coverage, delivery, or validation. */
 export declare function expandGoalDeclaration(value: unknown): string;

package/dist/core/goal-declaration-format.js

@@ -2,6 +2,13 @@ import { goalFingerprint } from "./goal-bound.js";
 /** Shared planner guidance and admission enums; no inferred acceptance or dispatch authority. */
 export const GOAL_DELIVERY_INTENTS = ["design", "registration", "implementation", "repair", "controlled-change"];
 export const GOAL_DELIVERY_MODES = ["planning-only", "mvp-first", "repair-first", "controlled-change"];
+export const GOAL_CRITERION_ENUMS = {
+    build_boundary: ["included", "excluded", "not-applicable"],
+    proof_scope: ["requested-full", "document-deliverable", "expected-negative"],
+    expected_outcome: ["pass", "fail"],
+    source_binding: ["declared", "current-protected"],
+    candidate_binding: ["declared", "current-protected"],
+};
 const CRITERION_FIELDS = ["criterion_id", "target", "entrypoint", "workload", "oracle_coverage", "build_boundary", "source",
     "candidate", "source_binding", "candidate_binding", "fixture", "proof_scope", "expected_outcome", "validation_command"];
 export function hasGoalCommandAliasConflict(values) {
@@ -23,6 +30,67 @@ export function goalDeclarationDefaults(object) {
         ? object.defaults : {};
     return { ...normalizedCriterionFields(object), ...normalizedCriterionFields(defaults) };
 }
+/** Validate structured planner fields before immutable controls exist; expansion itself remains lossless. */
+export function goalDeclarationFieldDiagnostics(object) {
+    const defects = new Map();
+    const add = (pointer, expected) => { defects.set(pointer, { pointer, expected }); };
+    const scalar = (value) => typeof value === "string" ? value.trim()
+        : typeof value === "boolean" || typeof value === "number" ? String(value) : undefined;
+    const singleLine = (value) => {
+        const text = scalar(value);
+        return text !== undefined && text.length > 0 && !/[\r\n]/u.test(String(value));
+    };
+    for (const [field, allowed, required] of [
+        ["delivery_intent", GOAL_DELIVERY_INTENTS, true], ["delivery_mode", GOAL_DELIVERY_MODES, false],
+        ["usable_path_established", ["true", "false"], true], ["controlled_change", ["true", "false"], true],
+    ]) {
+        if ((required || object[field] !== undefined) && (!singleLine(object[field]) || !allowed.some(item => item === scalar(object[field])))) {
+            add(`/goal_declaration/${field}`, allowed.join(" | "));
+        }
+    }
+    if (object.goal_acceptance_fingerprint !== undefined &&
+        !/^sha256:[a-f0-9]{64}$/u.test(String(object.goal_acceptance_fingerprint))) {
+        add("/goal_declaration/goal_acceptance_fingerprint", "sha256: followed by 64 lowercase hexadecimal characters");
+    }
+    const defaults = object.defaults !== null && typeof object.defaults === "object" && !Array.isArray(object.defaults)
+        ? object.defaults : undefined;
+    const criteria = Array.isArray(object.criteria) ? object.criteria : [];
+    for (const [index, raw] of criteria.entries()) {
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const criterion = raw;
+        const fieldValue = (field) => {
+            for (const [owner, prefix] of [[criterion, `/goal_declaration/criteria/${index}`],
+                [defaults, "/goal_declaration/defaults"], [object, "/goal_declaration"]]) {
+                if (!owner)
+                    continue;
+                for (const key of [`goal_${field}`, field])
+                    if (owner[key] !== undefined && owner[key] !== null) {
+                        return { value: owner[key], pointer: `${prefix}/${key}` };
+                    }
+            }
+            return { value: undefined, pointer: `/goal_declaration/${defaults ? "defaults/" : ""}${field}` };
+        };
+        for (const field of ["target", "entrypoint", "workload", "source", "candidate", "fixture"]) {
+            const { value, pointer } = fieldValue(field);
+            if (!singleLine(value))
+                add(pointer, "nonblank single-line scalar");
+        }
+        for (const [field, allowed] of Object.entries(GOAL_CRITERION_ENUMS)) {
+            const { value, pointer } = fieldValue(field);
+            if (value === undefined && (field === "source_binding" || field === "candidate_binding"))
+                continue;
+            if (!singleLine(value) || !allowed.some(item => item === scalar(value)))
+                add(pointer, allowed.join(" | "));
+        }
+        const oracle = fieldValue("oracle_coverage");
+        if (!Array.isArray(oracle.value) || oracle.value.length === 0 ||
+            !oracle.value.every(item => typeof item === "string" && item.length > 0 && item.length <= 512) ||
+            new Set(oracle.value).size !== oracle.value.length)
+            add(oracle.pointer, "nonempty unique string array; each string has 1..512 characters");
+    }
+    return [...defects.values()];
+}
 export const GOAL_DECLARATION_FORMAT = `Declare a goal once, then reference it with goal_declaration_path in the Task prompt.
 The referenced JSON may contain shared defaults and a criteria array; the host expands them privately.
 An inline ext["sortie-dogs/goal-declaration"] in the registered handoff is also supported.

package/dist/core/operator-proposal.d.ts

@@ -8,6 +8,7 @@ export declare const OPERATOR_PROPOSAL_BUDGET_CAPS: Readonly<{
     max_reads: 192;
     max_submissions: 24;
 }>;
+export declare const OPERATOR_PROPOSAL_REVISION_CONTRACT: string;
 export declare const OPERATOR_APPROVAL_CONTRACT: string;
 export interface OperatorIntentRequirement {
     readonly id: string;
@@ -90,6 +91,23 @@ export interface OperatorProposalState {
     proposal_hash: string | null;
     proposal: OperatorProposalPacket | null;
     approval_rationale: string | null;
+    /** Preparation may publish execution controls before approval commits; never revise that pinned plan. */
+    approval_started?: boolean;
+    root_revisions?: OperatorProposalRevision[];
+}
+interface OperatorProposalIdentity {
+    readonly proposal_id: string;
+    readonly revision: number;
+    readonly content_hash: string;
+}
+export interface OperatorProposalRevision {
+    readonly actor: string;
+    readonly at: string;
+    readonly rationale: string;
+    readonly from: OperatorProposalIdentity;
+    readonly to: OperatorProposalIdentity;
+    readonly patch_hash: string;
+    readonly paths: readonly string[];
 }
 export interface OperatorProposalBudgetDiagnostic {
     readonly status: "proposal-budget-exhausted";
@@ -112,15 +130,17 @@ export declare class OperatorProposalBudgetError extends Error {
 /** Durable pre-execution lane. It grants investigation and submission, never source mutation or execution. */
 export declare class OperatorProposalRuntime {
     readonly profile: RuntimeProfile;
-    private readonly states;
     private readonly pending;
     private serial;
+    private locked;
     readonly projectRoot: string;
     constructor(projectRoot: string, profile: RuntimeProfile);
     private file;
     private spendFile;
     private readSpend;
     private saveSpend;
+    /** A released investigation still belongs to its accepted order across a host restart. No grant is revived. */
+    continuationCheckpoint(root: string): Promise<string | undefined>;
     read(root: string): Promise<OperatorProposalState | undefined>;
     private readUnlocked;
     private save;
@@ -146,6 +166,11 @@ export declare class OperatorProposalRuntime {
     submit(root: string, actor: string, raw: unknown): Promise<OperatorProposalState>;
     submitJSON(root: string, actor: string, source: string): Promise<OperatorProposalState>;
     private submitUnlocked;
+    /** A read-free root correction of an ended child's submitted packet, never a new investigation grant. */
+    reviseJSON(root: string, actor: string, source: string): Promise<OperatorProposalState>;
+    private patchedPacket;
+    /** Close revision before any prepare/register side effect, including when that later step fails. */
+    pinApproval(root: string, raw: unknown): Promise<void>;
     approve(root: string, raw: unknown, commit?: boolean): Promise<OperatorProposalState>;
     private approveUnlocked;
     /**
@@ -159,3 +184,4 @@ export declare class OperatorProposalRuntime {
     private requiredUnlocked;
     packet(state: OperatorProposalState): unknown;
 }
+export {};

package/dist/core/operator-proposal.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { normalizeRelativePath } from "./path.js";
 import { OperatorContractError, parseOperatorPlan } from "./operator-runtime.js";
@@ -10,6 +10,18 @@ const ORIGINAL_REQUEST_MAX_CHARACTERS = 128 * 1024;
 const ORIGINAL_REQUEST_MAX_BYTES = 128 * 1024;
 export const DEFAULT_OPERATOR_PROPOSAL_BUDGET = Object.freeze({ max_reads: 45, max_submissions: 9 });
 export const OPERATOR_PROPOSAL_BUDGET_CAPS = Object.freeze({ max_reads: 192, max_submissions: 24 });
+export const OPERATOR_PROPOSAL_REVISION_CONTRACT = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,rationale:nonblank single-line string,patches:array}. " +
+    "Pin the current submitted identity from operator_status. patches contains 1..32 {op,path,value} objects. " +
+    "replace is allowed only at /coverage, /existing_surface, /uncovered, /negative_handling, /read_scope, /plan/units, /plan/acceptance_proof, " +
+    "/plan/units/<index>/{title,objective,read,validation,acceptance_indices}; add or replace is also allowed at " +
+    "/plan/goal_declaration/criteria/<index>/{validation_command,goal_validation_command}. No duplicate or overlapping paths. " +
+    "Read spellings may normalize separators and dot segments without traversal; read authority can only shrink. " +
+    "The exact write union, ordered acceptance, source_refs, intent, authoritative_refs, goal binding, goal defaults, criterion identities, git_lifecycle and budgets are immutable. " +
+    "Unit count cannot increase. The host derives the next revision, hash and budget_estimate, validates the complete packet, and records root-patch provenance atomically. " +
+    "Each authorized attempt, including malformed input or rejected patches, consumes one remaining submission; foreign/stale calls do not spend the live grant. No reads or execution units are granted or restored. " +
+    "Approval preparation or approval closes this revision lane. Revision never restarts a child, prepares a run, or approves anything. " +
+    "Compare every original requirement again before explicit approval with the new identity. Use only already observed evidence. " +
+    "Keep root-owned push/global apply and user-only acceptance pending until separately evidenced; worker tests never prove those obligations. Unrepresentable or unobserved requirements stay uncovered.";
 const OPERATOR_APPROVAL_IDENTITY_FIELDS = ["proposal_id", "revision", "content_hash", "compared_requirement_ids", "decision"];
 const OPERATOR_APPROVAL_RATIONALE_FIELDS = ["rationale", "comparison_rationale"];
 export const OPERATOR_APPROVAL_CONTRACT = "approval_json must encode one JSON object using exactly one six-field shape. " +
@@ -287,10 +299,9 @@ function parsePacket(value, state) {
 /** Durable pre-execution lane. It grants investigation and submission, never source mutation or execution. */
 export class OperatorProposalRuntime {
     profile;
-    states = new Map();
     pending = new Map();
     async serial(root, action) {
-        const result = (this.pending.get(root) ?? Promise.resolve()).then(action);
+        const result = (this.pending.get(root) ?? Promise.resolve()).then(() => this.locked(root, action));
         const tail = result.then(() => undefined, () => undefined);
         this.pending.set(root, tail);
         try {
@@ -301,6 +312,31 @@ export class OperatorProposalRuntime {
                 this.pending.delete(root);
         }
     }
+    async locked(root, action) {
+        await mkdir(join(this.projectRoot, this.profile.stateDirectory, "operator-proposals"), { recursive: true });
+        const lock = `${this.file(root)}.lock`;
+        let handle;
+        for (let attempt = 0; attempt < 100; attempt++) {
+            try {
+                handle = await open(lock, "wx", 0o600);
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, 10));
+            }
+        }
+        if (!handle)
+            throw new Error("operator-proposal-state-busy");
+        try {
+            return await action();
+        }
+        finally {
+            await handle.close();
+            await rm(lock, { force: true });
+        }
+    }
     projectRoot;
     constructor(projectRoot, profile) {
         this.profile = profile;
@@ -324,6 +360,13 @@ export class OperatorProposalRuntime {
             !Number.isSafeInteger(spend.reads) || spend.reads < 0 || !Number.isSafeInteger(spend.submissions) || spend.submissions < 0) {
             throw new Error("operator-proposal-spend-invalid");
         }
+        if (spend.retry !== undefined && (!record(spend.retry) || !/^[a-f0-9]{64}$/u.test(spend.retry.intent_hash) ||
+            !record(spend.retry.goal_binding) || !text(spend.retry.goal_binding.goal_id) ||
+            !Number.isSafeInteger(spend.retry.goal_binding.revision) || spend.retry.goal_binding.revision < 1 ||
+            !Number.isSafeInteger(spend.retry.goal_binding.scope_epoch) || spend.retry.goal_binding.scope_epoch < 1 ||
+            !/^sha256:[a-f0-9]{64}$/u.test(spend.retry.goal_binding.acceptance_fingerprint))) {
+            throw new Error("operator-proposal-spend-invalid");
+        }
         return spend;
     }
     async saveSpend(spend) {
@@ -338,13 +381,23 @@ export class OperatorProposalRuntime {
             await rm(temporary, { force: true }).catch(() => undefined);
         }
     }
+    /** A released investigation still belongs to its accepted order across a host restart. No grant is revived. */
+    async continuationCheckpoint(root) {
+        return this.serial(root, async () => {
+            const state = await this.readUnlocked(root);
+            if (state?.phase === "approved")
+                return undefined;
+            const retry = state?.goal_binding ? { intent_hash: state.intent_hash, goal_binding: state.goal_binding }
+                : state ? undefined : (await this.readSpend(root)).retry;
+            return retry === undefined ? undefined : JSON.stringify({ authority: "durable-proposal-continuity",
+                root_session_id: root, ...retry, status: state?.phase ?? "cancelled",
+                next_action: "Preserve the accepted goal and cumulative spend. Read operator_status; a cancelled proposal requires an explicit root retry decision and a new exact proposal Task, never revival of its old child." });
+        });
+    }
     async read(root) {
         return this.serial(root, () => this.readUnlocked(root));
     }
     async readUnlocked(root) {
-        const cached = this.states.get(root);
-        if (cached)
-            return structuredClone(cached);
         let source;
         try {
             source = await readFile(this.file(root), "utf8");
@@ -376,8 +429,7 @@ export class OperatorProposalRuntime {
         else {
             throw new Error("operator-proposal-state-invalid");
         }
-        this.states.set(root, state);
-        return structuredClone(state);
+        return state;
     }
     async save(state) {
         const directory = join(this.projectRoot, this.profile.stateDirectory, "operator-proposals");
@@ -390,7 +442,6 @@ export class OperatorProposalRuntime {
         finally {
             await rm(temporary, { force: true }).catch(() => undefined);
         }
-        this.states.set(state.root_session_id, structuredClone(state));
     }
     assertBudgetAvailable(state) {
         const remainingReads = state.intent.proposal_budget.max_reads - state.read_count;
@@ -489,7 +540,8 @@ export class OperatorProposalRuntime {
         const spend = await this.readSpend(root);
         const state = { schema_version: "0.1", profile: this.profile.id, root_session_id: root,
             intent_id: `intent-${intentHash.slice(0, 24)}`, intent_hash: intentHash, intent, created_at: new Date().toISOString(), phase: "investigating",
-            goal_binding: null, proposal_call_id: null, proposal_session_id: null, read_count: spend.reads, read_paths: [], submission_count: spend.submissions, proposal_id: null,
+            goal_binding: spend.retry?.intent_hash === intentHash ? structuredClone(spend.retry.goal_binding) : null,
+            proposal_call_id: null, proposal_session_id: null, read_count: spend.reads, read_paths: [], submission_count: spend.submissions, proposal_id: null,
             ...(spend.reads > 0 || spend.submissions > 0 ? { prior_spend: { reads: spend.reads, submissions: spend.submissions } } : {}),
             proposal_revision: null, proposal_hash: null, proposal: null, approval_rationale: null };
         this.assertBudgetAvailable(state);
@@ -617,6 +669,132 @@ export class OperatorProposalRuntime {
         await this.save(state);
         return state;
     }
+    /** A read-free root correction of an ended child's submitted packet, never a new investigation grant. */
+    async reviseJSON(root, actor, source) {
+        return this.serial(root, async () => {
+            if (root !== actor)
+                throw new Error("operator-proposal-revision-root-required");
+            const state = await this.requiredUnlocked(root);
+            if (state.phase !== "submitted" || !state.proposal || state.approval_started)
+                throw new Error("operator-proposal-not-revisable");
+            if (state.submission_count >= state.intent.proposal_budget.max_submissions)
+                throw new Error("operator-proposal-submission-budget-exhausted");
+            let request, candidate;
+            try {
+                if (Buffer.byteLength(source) > 128 * 1024)
+                    proposalError("/", "operator-proposal-revision-too-large", "maxBytes");
+                let raw;
+                try {
+                    raw = JSON.parse(source);
+                }
+                catch {
+                    proposalError("/", "operator-proposal-revision-json-invalid", "json");
+                }
+                if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "rationale", "patches"]) ||
+                    !text(raw.proposal_id) || !Number.isSafeInteger(raw.revision) || !text(raw.content_hash) ||
+                    !text(raw.rationale) || raw.rationale.length > 2000 || !Array.isArray(raw.patches) ||
+                    raw.patches.length < 1 || raw.patches.length > 32) {
+                    return proposalError("/", "operator-proposal-revision-invalid", "exact-identity-rationale-bounded-patches");
+                }
+                request = raw;
+                if (raw.proposal_id !== state.proposal_id || raw.revision !== state.proposal_revision || raw.content_hash !== state.proposal_hash) {
+                    throw new Error("operator-proposal-revision-identity-mismatch");
+                }
+                candidate = this.patchedPacket(state, raw.patches);
+            }
+            catch (error) {
+                if (error instanceof Error && error.message === "operator-proposal-revision-identity-mismatch")
+                    throw error;
+                // Rejections retain the old body/identity; only the same finite attempt counter advances.
+                state.submission_count++;
+                await this.save(state);
+                throw error;
+            }
+            const from = { proposal_id: state.proposal_id, revision: state.proposal_revision, content_hash: state.proposal_hash };
+            state.submission_count++;
+            state.proposal = candidate;
+            state.proposal_revision = candidate.revision;
+            state.proposal_hash = hash(JSON.stringify(candidate));
+            state.proposal_id = proposalID(state.intent_id, candidate.revision, state.proposal_hash);
+            (state.root_revisions ??= []).push({ actor, at: new Date().toISOString(), rationale: request.rationale,
+                from, to: { proposal_id: state.proposal_id, revision: candidate.revision, content_hash: state.proposal_hash },
+                patch_hash: hash(JSON.stringify(request.patches)), paths: request.patches.map(patch => patch.path) });
+            await this.save(state);
+            return state;
+        });
+    }
+    patchedPacket(state, patches) {
+        const before = state.proposal;
+        const draft = structuredClone(before);
+        const paths = [];
+        for (const [index, patch] of patches.entries()) {
+            const pointer = `/patches/${index}`;
+            if (!record(patch) || !exactSet(patch, ["op", "path", "value"]) || typeof patch.path !== "string") {
+                proposalError(pointer, "operator-proposal-revision-patch-invalid", "exact-op-path-value");
+            }
+            const entry = patch;
+            const command = /^\/plan\/goal_declaration\/criteria\/(0|[1-9][0-9]*)\/(validation_command|goal_validation_command)$/u.test(entry.path);
+            const replace = /^\/(coverage|existing_surface|uncovered|negative_handling|read_scope|plan\/(units|acceptance_proof))$/u.test(entry.path) ||
+                /^\/plan\/units\/(0|[1-9][0-9]*)\/(title|objective|read|validation|acceptance_indices)$/u.test(entry.path);
+            if (!(command && (entry.op === "add" || entry.op === "replace") || replace && entry.op === "replace") ||
+                paths.some(path => path === entry.path || path.startsWith(`${entry.path}/`) || entry.path.startsWith(`${path}/`))) {
+                proposalError(`${pointer}/path`, "operator-proposal-revision-path-denied", "nonoverlapping-allowlisted-field");
+            }
+            paths.push(entry.path);
+            const tokens = entry.path.slice(1).split("/");
+            let owner = draft;
+            for (const token of tokens.slice(0, -1)) {
+                if (owner === null || typeof owner !== "object" || !Object.hasOwn(owner, token)) {
+                    proposalError(`${pointer}/path`, "operator-proposal-revision-path-missing", "existing-parent");
+                }
+                owner = owner[token];
+            }
+            const key = tokens.at(-1);
+            if (owner === null || typeof owner !== "object" || (entry.op === "replace" && !Object.hasOwn(owner, key)) ||
+                (entry.op === "add" && Object.hasOwn(owner, key))) {
+                proposalError(`${pointer}/path`, "operator-proposal-revision-path-missing", "replace-existing-or-add-absent-field");
+            }
+            owner[key] = structuredClone(entry.value);
+        }
+        const normalizeReads = (value) => Array.isArray(value) ? value.map(path => {
+            if (typeof path !== "string")
+                return path;
+            try {
+                return normalizeRelativePath(path);
+            }
+            catch {
+                return proposalError("/read_scope", "operator-proposal-revision-read-invalid", "safe-relative-spelling");
+            }
+        }) : value;
+        draft.read_scope = normalizeReads(draft.read_scope);
+        if (Array.isArray(draft.plan.units))
+            for (const unit of draft.plan.units)
+                if (record(unit))
+                    unit.read = normalizeReads(unit.read);
+        draft.revision = before.revision + 1;
+        draft.budget_estimate = { proposal_reads: state.read_count, execution_units: draft.plan.units?.length };
+        const candidate = parsePacket(draft, state);
+        const within = (path, scopes) => scopes.some(scope => path === scope || path.startsWith(`${scope}/`));
+        if (candidate.read_scope.some(path => !within(path, before.read_scope)) ||
+            candidate.plan.units.flatMap(unit => unit.read).some(path => !within(path, before.plan.units.flatMap(unit => unit.read)))) {
+            proposalError("/read_scope", "operator-proposal-revision-read-expanded", "read-authority-only-shrinks");
+        }
+        if (candidate.plan.units.length > before.plan.units.length) {
+            proposalError("/plan/units", "operator-proposal-revision-units-expanded", "execution-unit-count-cannot-increase");
+        }
+        if (JSON.stringify({ ...candidate, revision: before.revision }) === JSON.stringify(before)) {
+            proposalError("/patches", "operator-proposal-revision-no-change", "substantive-correction-required");
+        }
+        return candidate;
+    }
+    /** Close revision before any prepare/register side effect, including when that later step fails. */
+    async pinApproval(root, raw) {
+        return this.serial(root, async () => {
+            const state = await this.approveUnlocked(root, raw, false);
+            state.approval_started = true;
+            await this.save(state);
+        });
+    }
     async approve(root, raw, commit = true) {
         return this.serial(root, () => this.approveUnlocked(root, raw, commit));
     }
@@ -647,9 +825,9 @@ export class OperatorProposalRuntime {
             if (!state || state.phase === "approved")
                 return undefined;
             await this.saveSpend({ schema_version: "0.1", profile: this.profile.id, root_session_id: root,
-                reads: state.read_count, submissions: state.submission_count });
+                reads: state.read_count, submissions: state.submission_count,
+                ...(state.goal_binding === null ? {} : { retry: { intent_hash: state.intent_hash, goal_binding: state.goal_binding } }) });
             await rm(this.file(root), { force: true });
-            this.states.delete(root);
             return state;
         });
     }
@@ -671,6 +849,7 @@ export class OperatorProposalRuntime {
             remaining_reads: state.intent.proposal_budget.max_reads - state.read_count, submissions: state.submission_count,
             remaining_submissions: state.intent.proposal_budget.max_submissions - state.submission_count,
             task_admitted: state.proposal_call_id !== null, uncovered: state.proposal?.uncovered ?? [], proposal: state.proposal,
-            approval_rationale: state.approval_rationale };
+            approval_rationale: state.approval_rationale, root_revisions: state.root_revisions ?? [],
+            revision_available: state.phase === "submitted" && !state.approval_started && state.submission_count < state.intent.proposal_budget.max_submissions };
     }
 }

package/dist/core/operator-runtime.js

@@ -4,7 +4,7 @@ import { lstat, mkdir, open, readFile, realpath, rename, rm, unlink, writeFile }
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { acceptanceContinuityFingerprint, inspectAcceptanceContinuity, normalizeAcceptanceCriteria, ACCEPTANCE_CONTINUITY_EXTENSION, MAX_ACCEPTANCE_CONTINUITY_BYTES, MAX_ACCEPTANCE_CRITERIA } from "./acceptance-continuity.js";
-import { expandGoalDeclaration, goalDeclarationDefaults, hasGoalCommandAliasConflict } from "./goal-declaration-format.js";
+import { expandGoalDeclaration, goalDeclarationDefaults, goalDeclarationFieldDiagnostics, hasGoalCommandAliasConflict } from "./goal-declaration-format.js";
 import { normalizeManifestPath, normalizeRelativePath } from "./path.js";
 import { CONTRACT_TEXT_LIMITS, validateHandoffSchema, validateOperationManifestSchema } from "./validate-schema.js";
 import { validateManifest } from "./validate-manifest.js";
@@ -235,6 +235,12 @@ export function parseOperatorPlan(value) {
             return planError("/git_lifecycle/post_commit_validation", "operator-git-post-commit-validation-invalid", "canonical-declared-goal-validations-must-be-exclusive-contiguous-final-unit-suffix", "repair-proof-mapping");
         }
     }
+    const declarationDefects = goalDeclarationFieldDiagnostics(value.goal_declaration);
+    if (declarationDefects.length)
+        throw new OperatorContractError(declarationDefects.map(defect => ({
+            document: "plan", pointer: defect.pointer, code: "operator-goal-field-invalid", rule: "declared-goal-field",
+            repair_kind: "repair-field", repair_paths: [defect.pointer], expected: defect.expected,
+        })));
     expandGoalDeclaration(value.goal_declaration);
     return { ...value, acceptance: normalizeAcceptanceCriteria(value.acceptance) };
 }
@@ -574,6 +580,21 @@ export class OperatorRuntime {
                 if (!record(patch) || !exactKeys(patch, ["op", "path", "value"]) || !["replace", "add"].includes(String(patch.op)) || typeof patch.path !== "string" || !Object.hasOwn(patch, "value")) {
                     throw new Error("operator-repair-invalid");
                 }
+                const goalFieldPath = /^\/goal_declaration\/(delivery_intent|delivery_mode|usable_path_established|controlled_change|goal_acceptance_fingerprint)$/.test(patch.path) ||
+                    /^\/goal_declaration\/(?:defaults\/|criteria\/(?:0|[1-9]\d*)\/)?(?:goal_)?(?:target|entrypoint|workload|source|candidate|fixture|oracle_coverage|build_boundary|proof_scope|expected_outcome|source_binding|candidate_binding)$/.test(patch.path);
+                if (goalFieldPath && Array.isArray(draft.diagnostics) && draft.diagnostics.some((item) => item.document === "plan" && item.pointer === patch.path && item.code === "operator-goal-field-invalid")) {
+                    // Only the exact invalid or missing field is editable; acceptance, valid declaration fields,
+                    // budgets and scope never become mutable just because another field was diagnosed.
+                    const keys = patch.path.slice(1).split("/");
+                    let owner = draft.plan;
+                    for (const key of keys.slice(0, -1))
+                        owner = owner?.[key];
+                    const key = keys.at(-1);
+                    if (!record(owner) || (patch.op === "replace" && !Object.hasOwn(owner, key)))
+                        throw new Error("operator-repair-path-forbidden");
+                    owner[key] = patch.value;
+                    continue;
+                }
                 const readMatch = /^\/units\/(0|[1-9]\d*)\/read\/(0|[1-9]\d*)$/.exec(patch.path);
                 if (readMatch) {
                     const unitIndex = Number(readMatch[1]), pathIndex = Number(readMatch[2]);

package/dist/plugin/index.d.ts

@@ -13,6 +13,8 @@ export interface OpenCodePluginInput {
     childLifecycleCheckWaitMs?: number;
     /** Installed-profile adapter only; never supplied by a model or project configuration. */
     runtimeBridge?: RuntimeBridge;
+    /** V2 has no assistant-part update API; return the canonical panel with explicit acceptance. */
+    returnReportTransport?: "tool-result";
     /** The host SDK client. Absent in hosts that construct the plugin without one. */
     client?: SessionMessageReader & RunMetricsClient & ContinuationClient & OpenCodeModelAvailabilityClient & {
         app?: {

package/dist/plugin/index.js

@@ -10,7 +10,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { lstat, mkdir, open, readFile, readdir, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { RUNTIME_ASSET_VERSION } from "../asset-version.js";
-import { GOAL_DECLARATION_FORMAT, GOAL_DELIVERY_INTENTS, GOAL_DELIVERY_MODES, expandGoalDeclaration } from "../core/goal-declaration-format.js";
+import { GOAL_DECLARATION_FORMAT, GOAL_DELIVERY_INTENTS, GOAL_DELIVERY_MODES, GOAL_CRITERION_ENUMS, expandGoalDeclaration } from "../core/goal-declaration-format.js";
 import { ACCEPTANCE_CONTINUITY_AUTHORITY, ACCEPTANCE_CONTINUITY_EXTENSION, ACCEPTANCE_CONTINUITY_SCHEMA_VERSION, acceptanceContinuityFingerprint, inspectAcceptanceContinuity, normalizeAcceptanceCriteria, } from "../core/acceptance-continuity.js";
 import { resolveGlobalConfigRoot } from "../core/initialize.js";
 import { admitLunaFabric } from "../core/luna-fabric-contract.js";
@@ -1770,11 +1770,14 @@ export const SortieDogsPlugin = async (input, options) => {
                     origin_user_message_id: ticket.origin_user_message_id,
                 } } };
     }
-    async function terminalGoal(sessionID, stopReason, status) {
+    async function terminalGoal(sessionID, stopReason, status, explicitAcceptance = false) {
         const ledger = await goalLedger(sessionID);
         const state = (await ledger.readGoal()).state;
         if (state.goal_id === null || state.receipt !== null || state.outstanding_reservations.length > 0 || state.acceptance_fingerprint === null)
             return state.receipt ?? undefined;
+        if (status === "succeeded" && !explicitAcceptance &&
+            await input.runtimeBridge?.requiresExplicitAcceptance?.(sessionID) === true)
+            return undefined;
         const records = (await ledger.readGoal()).records;
         const settledEvidence = records.flatMap(({ event }) => event.kind === "unit.settled" || event.kind === "unit.evidence-reconciled" ? event.evidence : []);
         if (status === "succeeded" && (state.acceptance_contract === null ||
@@ -1857,7 +1860,8 @@ export const SortieDogsPlugin = async (input, options) => {
         if (receipt === undefined && delivery === "failed") {
             receipt = await terminalGoal(sessionID, "stopped", "stopped").catch(() => undefined);
         }
-        else if (receipt === undefined && proved) {
+        else if (receipt === undefined && proved &&
+            await input.runtimeBridge?.requiresExplicitAcceptance?.(sessionID) !== true) {
             receipt = await terminalGoal(sessionID, "completed", "succeeded").catch(() => undefined);
         }
         else if (receipt === undefined && outcome === "INTERRUPTED") {
@@ -1934,19 +1938,19 @@ export const SortieDogsPlugin = async (input, options) => {
             const expectedOutcome = values.goal_expected_outcome;
             const sourceBinding = handoffValue(entries, ["goal_source_binding"]);
             const candidateBinding = handoffValue(entries, ["goal_candidate_binding"]);
-            if (buildBoundary !== undefined && buildBoundary !== "included" && buildBoundary !== "excluded" && buildBoundary !== "not-applicable") {
+            if (buildBoundary !== undefined && !GOAL_CRITERION_ENUMS.build_boundary.some(value => value === buildBoundary)) {
                 defects.push(contractDefect("contract", pointer("goal_build_boundary"), "goal_build_boundary_invalid"));
             }
-            if (proofScope !== undefined && proofScope !== "requested-full" && proofScope !== "document-deliverable" && proofScope !== "expected-negative") {
+            if (proofScope !== undefined && !GOAL_CRITERION_ENUMS.proof_scope.some(value => value === proofScope)) {
                 defects.push(contractDefect("contract", pointer("goal_proof_scope"), "goal_proof_scope_invalid"));
             }
-            if (expectedOutcome !== undefined && expectedOutcome !== "pass" && expectedOutcome !== "fail") {
+            if (expectedOutcome !== undefined && !GOAL_CRITERION_ENUMS.expected_outcome.some(value => value === expectedOutcome)) {
                 defects.push(contractDefect("contract", pointer("goal_expected_outcome"), "goal_expected_outcome_invalid"));
             }
-            if (sourceBinding !== undefined && sourceBinding !== "declared" && sourceBinding !== "current-protected") {
+            if (sourceBinding !== undefined && !GOAL_CRITERION_ENUMS.source_binding.some(value => value === sourceBinding)) {
                 defects.push(contractDefect("contract", pointer("goal_source_binding"), "goal_source_binding_invalid"));
             }
-            if (candidateBinding !== undefined && candidateBinding !== "declared" && candidateBinding !== "current-protected") {
+            if (candidateBinding !== undefined && !GOAL_CRITERION_ENUMS.candidate_binding.some(value => value === candidateBinding)) {
                 defects.push(contractDefect("contract", pointer("goal_candidate_binding"), "goal_candidate_binding_invalid"));
             }
             const declaredValidation = handoffValue(entries, ["validation"]);
@@ -7721,7 +7725,7 @@ export const SortieDogsPlugin = async (input, options) => {
                 throw new Error("operator-goal-stopped");
             // Same proof/freshness/reservation gate used by terminal text, requested
             // explicitly by the root instead of inferred from a model's wording.
-            const receipt = goal.receipt ?? await terminalGoal(sessionID, "completed", "succeeded");
+            const receipt = goal.receipt ?? await terminalGoal(sessionID, "completed", "succeeded", true);
             if (receipt?.status !== "succeeded")
                 return { status: "awaiting-evidence" };
             // Acceptance must return its receipt to the active tool call. Revoking

package/dist/plugin/profiled.js

@@ -1,6 +1,6 @@
 import { V010_RUNTIME_ASSET_VERSION } from "../asset-version.js";
 import { OperatorContractError, OperatorRuntime } from "../core/operator-runtime.js";
-import { DEFAULT_OPERATOR_PROPOSAL_BUDGET, OPERATOR_APPROVAL_CONTRACT, OPERATOR_PROPOSAL_BUDGET_CAPS, OperatorProposalBudgetError, OperatorProposalRuntime } from "../core/operator-proposal.js";
+import { DEFAULT_OPERATOR_PROPOSAL_BUDGET, OPERATOR_APPROVAL_CONTRACT, OPERATOR_PROPOSAL_BUDGET_CAPS, OPERATOR_PROPOSAL_REVISION_CONTRACT, OperatorProposalBudgetError, OperatorProposalRuntime } from "../core/operator-proposal.js";
 import { CANONICAL_AGENT_ROLES, canonicalAgent, profileAgent, profileTool, V010_RUNTIME_PROFILE } from "../core/runtime-profile.js";
 import { SortieDogsPlugin as canonicalPlugin } from "./index.js";
 import { taskChildSessionID } from "./task-result-repair.js";
@@ -8,7 +8,7 @@ import { relative, resolve, sep } from "node:path";
 import { readFile, realpath } from "node:fs/promises";
 import { BUILT_IN_MODEL_CATALOG } from "./model-routing.js";
 import { goalFingerprint } from "../core/goal-bound.js";
-import { decoratePreviewHeadings } from "./receipt-presentation.js";
+import { decoratePreviewHeadings, returnReportPanel } from "./receipt-presentation.js";
 import { sanitizeTerminalReport, terminalRunOutcome } from "./run-metrics.js";
 import { normalizeCommand } from "./gate.js";
 import { normalizeRelativePath } from "../core/path.js";
@@ -266,7 +266,11 @@ export function createProfiledPlugin(profile, assetVersion) {
         });
         const runtimeBridge = {
             profile, assetVersion,
-            continuationCheckpoint: root => operators.continuationCheckpoint(root),
+            continuationCheckpoint: async (root) => await operators.continuationCheckpoint(root) ?? await proposals.continuationCheckpoint(root),
+            requiresExplicitAcceptance: async (root) => {
+                const state = await operators.read(root);
+                return state !== undefined && state.phase !== "completed" && operatorTurnLifecycle.get(root) !== "historical";
+            },
             ownsCanonicalValidation: async (root, taskID, child, command) => {
                 const state = await operators.read(root);
                 if (state === undefined || state.phase === "cancelled" || state.phase === "completed")
@@ -391,6 +395,9 @@ export function createProfiledPlugin(profile, assetVersion) {
         const approvalSchema = record(stringSchema) && typeof stringSchema.describe === "function"
             ? stringSchema.describe(OPERATOR_APPROVAL_CONTRACT)
             : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_APPROVAL_CONTRACT };
+        const revisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(OPERATOR_PROPOSAL_REVISION_CONTRACT)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_PROPOSAL_REVISION_CONTRACT };
         const planContract = "plan_json must encode the exact operator plan object: schema_version, acceptance, acceptance_proof, source_refs, " +
             "goal_declaration, units, and optional git_lifecycle only. git_lifecycle exact shape is " +
             '{branch_create:{branch:string,start_ref:string},commit:{message:string},post_commit_validation:string[],remediation_reserve?:string[],remediation_scope_expansion?:string[]}. Its presence is root authorization for only a clean, non-overwriting ' +
@@ -416,6 +423,7 @@ export function createProfiledPlugin(profile, assetVersion) {
         const beginProposal = profileTool(profile, "sortie_begin_operator_proposal");
         const submitProposal = profileTool(profile, "sortie_submit_operator_proposal");
         const approveProposal = profileTool(profile, "sortie_approve_operator_proposal");
+        const reviseProposal = profileTool(profile, "sortie_revise_operator_proposal");
         async function stop(root, reason, retireRoot = true) {
             if (retireRoot)
                 retired.add(root);
@@ -486,7 +494,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 await registerPreparedGoal(context.sessionID, state);
                 return preparedTask(state);
             } };
-        tools[repair] = { description: "Repair a root-owned draft with named fields, git_lifecycle branch/start/message fields, or an already-declared criterion command. A diagnosed /units/i/read/j scope error may be replaced with a normalized repository-relative spelling of the same resource only: absolute inputs require an existing relative alias whose realpath is identical; read expansion, redirection, whole-array replacement and write-scope repair are forbidden. Empty patches revalidate the saved draft without resending it. Acceptance, unit count and write scope remain fixed.",
+        tools[repair] = { description: "Repair a root-owned draft with named fields, git_lifecycle branch/start/message fields, or an already-declared criterion command. A diagnosed operator-goal-field-invalid may repair only its exact invalid or missing goal declaration field using the reported expected values; valid fields, budgets and whole declaration replacement remain forbidden. A diagnosed /units/i/read/j scope error may be replaced with a normalized repository-relative spelling of the same resource only: absolute inputs require an existing relative alias whose realpath is identical; read expansion, redirection, whole-array replacement and write-scope repair are forbidden. Empty patches revalidate the saved draft without resending it. Acceptance, unit count and write scope remain fixed.",
             args: { draft_id: stringSchema, patches_json: stringSchema }, execute: async (args, context) => {
                 await requireRoot(context.sessionID);
                 let patches;
@@ -555,7 +563,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                             ? "proposal submission budget exhausted; do not call operator_next; report the bounded proposal failure"
                             : "proposal is not submitted; do not call operator_next; complete or repair the bounded proposal submission"
                     : proposal?.phase === "submitted"
-                        ? "compare and approve the exact proposal; do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation."
+                        ? `compare every original requirement with the exact proposal. For a known semantic defect, use ${reviseProposal} with its current identity and bounded field patches, then compare again; do not redispatch the ended child or cancel/reinvestigate the same defect. Approval preparation pins the plan and closes revision. Do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation, root-owned push/global apply and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation.`
                         : "approved proposal has no operator run; do not call operator_next; reconcile the approval or preparation failure";
                 return JSON.stringify(state ? { ...await operatorPacket(state), ...(draft ? { pending_draft: draft } : {}),
                     ...(proposal ? { proposal: proposalIdentity(proposal) } : {}) }
@@ -654,16 +662,27 @@ export function createProfiledPlugin(profile, assetVersion) {
                 if (!["awaiting-acceptance", "completed"].includes(state.phase) || state.units.some(unit => unit.status !== "succeeded")) {
                     return JSON.stringify({ status: "not-ready", packet: operators.packet(state) });
                 }
-                const goalFingerprint = await operators.completionGoalFingerprint(state);
+                const declarationFingerprint = await operators.completionGoalFingerprint(state);
                 if (state.phase === "awaiting-acceptance") {
-                    await relinkRegisteredGoal(context.sessionID, state, goalFingerprint);
-                    await control.assertActiveGoal(context.sessionID, goalFingerprint);
+                    await relinkRegisteredGoal(context.sessionID, state, declarationFingerprint);
+                    await control.assertActiveGoal(context.sessionID, declarationFingerprint);
                 }
-                const result = await control.completeRoot(context.sessionID, goalFingerprint);
+                const result = await control.completeRoot(context.sessionID, declarationFingerprint);
                 if (result.receipt)
                     await operators.terminal(context.sessionID, result.receipt);
+                let panel;
+                if (input.returnReportTransport === "tool-result" && result.receipt?.status === "succeeded") {
+                    const text = `✅ **DONE** \`${state.runID}\` — ${state.acceptance.length} acceptance requirements verified.\n\n` +
+                        `**変更点:** ${state.units.map(unit => unit.unit.title).join("; ")}\n\n` +
+                        `**確認結果:** PASS — ${[...new Set(state.units.flatMap(unit => unit.unit.validation))].join("; ")}\n\n**次:** なし`;
+                    const rendered = await control.renderReturnReport(context.sessionID, text, goalFingerprint(result.receipt)).catch(() => undefined);
+                    if (rendered)
+                        panel = returnReportPanel(rendered);
+                }
                 return JSON.stringify({ status: result.status, run_id: state.runID,
-                    acceptance_fingerprint: state.acceptanceFingerprint, receipt: result.receipt ?? null });
+                    acceptance_fingerprint: state.acceptanceFingerprint, receipt: result.receipt ?? null,
+                    ...(panel ? { return_report: panel,
+                        return_report_instruction: "Append return_report verbatim exactly once to your final answer as Markdown, outside any code fence. It is a host-authored receipt display, not a new task or input. Do not summarize, recalculate or request another model turn for it." } : {}) });
             } };
         tools[resume] = { description: "Reconcile a finished process-defect unit from native host validation records and unchanged source. For the exact first validation-only contract-repair continuation process defect, unchanged durable controls/candidate and available validation budget permit one same-worker validation-only retry; the result includes the exact Task to invoke. Never reimplements a unit or resets implementation/goal spend.",
             args: { run_id: stringSchema, acceptance_fingerprint: stringSchema }, execute: async (args, context) => {
@@ -808,6 +827,26 @@ export function createProfiledPlugin(profile, assetVersion) {
                         ...(contract ? { diagnostics: error.diagnostics, diagnostics_truncated: error.diagnostics_truncated } : {}) });
                 }
             } };
+        tools[reviseProposal] = { description: "Root-only: revise an unapproved submitted proposal using a hash-pinned field patch and the remaining submission allowance. " + OPERATOR_PROPOSAL_REVISION_CONTRACT,
+            args: { revision_json: revisionSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    try {
+                        const revised = await proposals.reviseJSON(context.sessionID, context.sessionID, args.revision_json);
+                        return JSON.stringify({ ...proposals.packet(revised),
+                            next_action: "Compare all original ordered requirements again. Explicitly approve only this new identity if every obligation is genuinely covered; no execution or approval was granted by revision." });
+                    }
+                    catch (error) {
+                        const contract = error instanceof OperatorContractError;
+                        if (!contract && (!(error instanceof Error) || !error.message.startsWith("operator-proposal-")))
+                            throw error;
+                        const state = await proposals.read(context.sessionID);
+                        return JSON.stringify({ status: "invalid-revision", code: error.message,
+                            ...(state ? { proposal: proposalIdentity(state) } : {}),
+                            ...(contract ? { diagnostics: error.diagnostics, diagnostics_truncated: error.diagnostics_truncated } : {}) });
+                    }
+                });
+            } };
         tools[approveProposal] = { description: "Root-only: record semantic comparison of the exact proposal revision/hash, then connect its immutable plan to the existing execution lane. " + OPERATOR_APPROVAL_CONTRACT,
             args: { approval_json: approvalSchema }, execute: async (args, context) => {
                 await requireRoot(context.sessionID);
@@ -837,6 +876,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                     if (approved.goal_binding === null)
                         throw new Error("operator-proposal-goal-binding-missing");
                     await control.assertProposalExecutionBudget(context.sessionID, approved.goal_binding, proposal.plan.units.length);
+                    await proposals.pinApproval(context.sessionID, approval);
                     const prepared = await operators.propose(context.sessionID, proposal.plan);
                     if (prepared.status !== "prepared")
                         throw new Error("operator-proposal-approved-plan-invalid");
@@ -846,7 +886,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 });
             } };
         const ownTools = new Set([prepare, repair, next, status, cancel, complete, resume, resolveContractRepair,
-            beginProposal, submitProposal, approveProposal]);
+            beginProposal, submitProposal, approveProposal, reviseProposal]);
         const protocolMap = CANONICAL_AGENT_ROLES.map(role => `${role}=${profileAgent(profile, role)}`).join(", ");
         function rememberRendered(key, text) {
             renderedParts.set(key, goalFingerprint(text));
@@ -978,8 +1018,9 @@ export function createProfiledPlugin(profile, assetVersion) {
                         output.parts.some(part => record(part) && part.type === "text" && typeof part.text === "string" && part.text.trim().length > 0);
                     if (realTurn) {
                         const state = await operators.read(chat.sessionID);
-                        if ((state !== undefined && (state.phase === "cancelled" || state.phase === "completed")) ||
-                            operatorTurnLifecycle.get(chat.sessionID) === "cancelled") {
+                        if (((state !== undefined && (state.phase === "cancelled" || state.phase === "completed")) ||
+                            operatorTurnLifecycle.get(chat.sessionID) === "cancelled") &&
+                            await runtimeBridge.continuationCheckpoint(chat.sessionID) === undefined) {
                             operatorTurnLifecycle.set(chat.sessionID, "historical");
                             const messageID = typeof chat.messageID === "string" && chat.messageID.length > 0
                                 ? chat.messageID

package/dist/plugin/receipt-presentation.d.ts

@@ -1,4 +1,6 @@
 import type { GoalTerminalReceipt } from "../core/goal-bound.js";
+/** Extract only the host card, excluding the terminal prose that follows it. */
+export declare function returnReportPanel(rendered: string): string | undefined;
 /** Cosmetic headings only; no acceptance or execution state is inferred. */
 export declare function decoratePreviewHeadings(text: string): string;
 /** Only a host-verified current receipt may supply a missing success heading. */

package/dist/plugin/receipt-presentation.js

@@ -1,4 +1,13 @@
 import { terminalRunOutcome } from "./run-metrics.js";
+/** Extract only the host card, excluding the terminal prose that follows it. */
+export function returnReportPanel(rendered) {
+    const summary = rendered.indexOf("<summary><strong>🐾 SORTIE DOGS — 帰還報告");
+    if (summary < 0)
+        return undefined;
+    const start = rendered.lastIndexOf("<details", summary);
+    const end = rendered.indexOf("\n</details>", summary);
+    return start < 0 || end < 0 ? undefined : rendered.slice(start, end + "\n</details>".length).trim();
+}
 /** Cosmetic headings only; no acceptance or execution state is inferred. */
 export function decoratePreviewHeadings(text) {
     const icons = { "変更点": "🔧", "確認結果": "🔍", "次": "➡️", changes: "🔧", validation: "🔍", next: "➡️" };

package/dist/plugin/runtime-bridge.d.ts

@@ -25,6 +25,7 @@ export interface RuntimeBridge {
     readonly defaultModelCatalog?: import("./model-routing.js").ModelCatalog;
     transformConfiguration?(value: unknown): unknown;
     continuationCheckpoint?(rootSessionID: string): Promise<string | undefined>;
+    requiresExplicitAcceptance?(rootSessionID: string): Promise<boolean>;
     ownsCanonicalValidation?(rootSessionID: string, unitID: string, childSessionID: string, command: string): Promise<boolean>;
     onSerialSettlement?(settlement: SerialDispatchSettlement): Promise<void>;
     onRootTerminal?(rootSessionID: string, receipt: GoalTerminalReceipt): Promise<void>;

package/dist/plugin/v2.d.ts

@@ -1,5 +1,4 @@
 import type { OpenCodeHooks, OpenCodePlugin } from "./index.js";
-export declare const V2_RETURN_REPORT_METADATA_KEY = "sortie-dogs/return-report";
 type JsonObject = Record<string, unknown>;
 type Registration = {
     dispose(): Promise<void> | void;
@@ -33,6 +32,7 @@ export interface OpenCodeV2Context {
         hook(name: "execute.before" | "execute.after", callback: (event: JsonObject) => Promise<void> | void): Promise<Registration>;
     };
     readonly session: {
+        list?(input: JsonObject): Promise<unknown>;
         get(input: {
             sessionID: string;
         }): Promise<unknown>;
@@ -46,6 +46,9 @@ export interface OpenCodeV2Context {
         switchModel(input: JsonObject): Promise<unknown>;
         hook(name: "prompt" | "context" | "compaction", callback: (event: JsonObject) => Promise<void> | void): Promise<Registration>;
     };
+    readonly message?: {
+        list(input: JsonObject): Promise<unknown>;
+    };
     readonly permission: {
         hook(name: "evaluate", callback: (event: JsonObject) => Promise<void> | void): Promise<Registration>;
     };
@@ -60,8 +63,8 @@ export interface OpenCodeV2Plugin {
     readonly id: string;
     setup(context: OpenCodeV2Context): Promise<(() => void) | void>;
 }
-/** V2 has no public assistant-part update API; publish one durable, non-resuming synthetic report card instead. */
-export declare function createV2ReturnReportPublisher(context: OpenCodeV2Context, hooks: OpenCodeHooks): (session: string) => Promise<void>;
+/** Observe terminal text for accounting only. Synthetic input is queued work, even with resume=false. */
+export declare function createV2ReturnReportFinalizer(context: OpenCodeV2Context, hooks: OpenCodeHooks): (session: string) => Promise<void>;
 export declare function createSortieDogsV2Plugin(legacyFactory?: OpenCodePlugin): OpenCodeV2Plugin;
 export declare const SortieDogsV2Plugin: OpenCodeV2Plugin;
 export default SortieDogsV2Plugin;

package/dist/plugin/v2.js

@@ -1,7 +1,4 @@
-import { createHash } from "node:crypto";
 import { SortieDogsV010Plugin } from "./profiled.js";
-const RETURN_REPORT_MARKER = "<summary><strong>🐾 SORTIE DOGS — 帰還報告";
-export const V2_RETURN_REPORT_METADATA_KEY = "sortie-dogs/return-report";
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -49,8 +46,17 @@ function legacyPart(value, session, message) {
         return { ...value, sessionID: session, messageID: message };
     const state = record(value.state) ? value.state : {};
     const output = toolContentText(state.content);
-    return { ...value, tool: string(value.name) ?? string(value.tool), callID: string(value.id), sessionID: session, messageID: message,
-        state: { ...state, ...(output === undefined ? {} : { output }) } };
+    const name = string(value.name) ?? string(value.tool);
+    const tool = name === "subagent" ? "task" : name === "shell" ? "bash" : name === "patch" ? "apply_patch" : name;
+    const time = record(value.time) ? value.time : undefined;
+    const metadata = record(state.metadata) ? { ...state.metadata } : undefined;
+    if (metadata && Array.isArray(metadata.files))
+        metadata.files = metadata.files.map(file => record(file) && typeof file.patch === "string"
+            ? { ...file, diff: file.patch } : file);
+    return { ...value, tool, callID: string(value.id), sessionID: session, messageID: message,
+        state: { ...state, input: legacyToolInput(name, state.input), ...(metadata ? { metadata } : {}),
+            ...(time ? { time: { start: time.ran ?? time.created, end: time.completed } } : {}),
+            ...(output === undefined ? {} : { output }) } };
 }
 function legacyMessage(value, session, agent) {
     if (!record(value) || typeof value.id !== "string" || typeof value.type !== "string")
@@ -62,13 +68,15 @@ function legacyMessage(value, session, agent) {
     }
     if (value.type !== "assistant") {
         if (value.type === "synthetic")
-            return { info: { id, sessionID: session, role: "system", time: value.time },
+            return { info: { id, sessionID: session, role: "user", agent, time: value.time },
                 parts: [{ id: `${id}-text`, sessionID: session, messageID: id, type: "text", text: String(value.text ?? ""), synthetic: true }] };
         return undefined;
     }
     const model = modelReference(value.model);
     return { info: { id, sessionID: session, role: "assistant", agent: string(value.agent) ?? agent,
-            ...(model === undefined ? {} : { model }), finish: value.finish, time: value.time, tokens: value.tokens, cost: value.cost },
+            ...(model === undefined ? {} : { model, providerID: model.providerID, modelID: model.modelID }),
+            ...(record(value.providerState) && typeof value.providerState.serviceTier === "string" ? { serviceTier: value.providerState.serviceTier } : {}),
+            ...(value.error === undefined ? {} : { error: value.error }), finish: value.finish, time: value.time, tokens: value.tokens, cost: value.cost },
         parts: array(value.content).flatMap(part => {
             const converted = legacyPart(part, session, id);
             return converted === undefined ? [] : [converted];
@@ -77,7 +85,8 @@ function legacyMessage(value, session, agent) {
 async function legacyMessages(context, id) {
     const [info, history] = await Promise.all([
         context.session.get({ sessionID: id }).catch(() => undefined),
-        context.session.context({ sessionID: id }).catch(() => []),
+        context.message ? nativePages(cursor => context.message.list({ sessionID: id, limit: 100, ...(cursor ? { cursor } : { order: "asc" }) }))
+            : context.session.context({ sessionID: id }),
     ]);
     const agent = record(info) ? string(info.agent) : undefined;
     return array(history).flatMap(value => {
@@ -85,6 +94,24 @@ async function legacyMessages(context, id) {
         return converted === undefined ? [] : [converted];
     });
 }
+async function nativePages(fetch) {
+    const items = [], seen = new Set();
+    let cursor;
+    for (let page = 0; page < 100; page += 1) {
+        const result = await fetch(cursor);
+        if (!record(result) || !Array.isArray(result.data) || !record(result.cursor))
+            throw new Error("v2-history-page-invalid");
+        items.push(...result.data);
+        const next = string(result.cursor.next);
+        if (!next)
+            return items;
+        if (seen.has(next))
+            throw new Error("v2-history-cursor-repeated");
+        seen.add(next);
+        cursor = next;
+    }
+    throw new Error("v2-history-page-limit");
+}
 function legacyClient(context) {
     const directory = context.location.directory;
     const session = {
@@ -101,7 +128,13 @@ function legacyClient(context) {
             return { data: id === undefined || wanted === undefined ? undefined
                     : (await legacyMessages(context, id)).find(message => record(message.info) && message.info.id === wanted) };
         },
-        children: async () => ({ data: [] }),
+        ...(context.session.list ? { children: async (request) => {
+                const id = sessionID(request);
+                if (id === undefined)
+                    throw new Error("v2-history-parent-missing");
+                return { data: await nativePages(cursor => context.session.list({ parentID: id, limit: 100,
+                        ...(cursor ? { cursor } : { order: "asc" }) })) };
+            } } : {}),
         abort: async (request) => {
             const id = sessionID(request);
             return id === undefined ? undefined : await context.session.interrupt({ sessionID: id, resume: false });
@@ -185,24 +218,8 @@ function assistantText(message) {
     return record(text) && typeof text.text === "string" ? text.text.trim() : undefined;
 }
 const V2_SUBAGENT_PROMPT_PREFIX = "You are a subagent spawned by another session.\n";
-function reportPanel(rendered) {
-    const summary = rendered.indexOf(RETURN_REPORT_MARKER);
-    if (summary < 0)
-        return undefined;
-    const details = rendered.lastIndexOf("<details", summary);
-    return rendered.slice(details < 0 ? summary : details).trim();
-}
-function reportIdentity(session, sourceMessageID, panel) {
-    return createHash("sha256").update(`${session}\0${sourceMessageID}\0${panel}`).digest("hex");
-}
-function reportMetadata(message) {
-    if (!record(message) || message.type !== "synthetic" || !record(message.metadata))
-        return undefined;
-    const value = message.metadata[V2_RETURN_REPORT_METADATA_KEY];
-    return record(value) ? value : undefined;
-}
-/** V2 has no public assistant-part update API; publish one durable, non-resuming synthetic report card instead. */
-export function createV2ReturnReportPublisher(context, hooks) {
+/** Observe terminal text for accounting only. Synthetic input is queued work, even with resume=false. */
+export function createV2ReturnReportFinalizer(context, hooks) {
     const active = new Map();
     return async (session) => {
         const previous = active.get(session) ?? Promise.resolve();
@@ -217,15 +234,6 @@ export function createV2ReturnReportPublisher(context, hooks) {
                 const base = assistantText(source);
                 const output = { text: base };
                 await hooks["experimental.text.complete"]?.({ sessionID: session, messageID: source.id }, output);
-                const panel = reportPanel(output.text);
-                if (panel === undefined)
-                    return;
-                const identity = reportIdentity(session, source.id, panel);
-                if (history.some(message => reportMetadata(message)?.identity === identity))
-                    return;
-                await context.session.synthetic({ sessionID: session, id: `sortie-report-${identity}`, text: panel,
-                    description: "Sortie Dogs return report", delivery: "queue", resume: false,
-                    metadata: { [V2_RETURN_REPORT_METADATA_KEY]: { schema_version: "0.1", identity, source_message_id: source.id } } });
                 return;
             }
         }).finally(() => { if (active.get(session) === operation)
@@ -311,9 +319,10 @@ export function createSortieDogsV2Plugin(legacyFactory = SortieDogsV010Plugin) {
     return {
         id: "sortie-dogs.v010",
         async setup(context) {
-            const hooks = await legacyFactory({ directory: context.location.directory, client: legacyClient(context) }, context.options ?? {});
+            const hooks = await legacyFactory({ directory: context.location.directory, client: legacyClient(context),
+                returnReportTransport: "tool-result" }, context.options ?? {});
             await registerV2Hooks(context, hooks);
-            const publish = createV2ReturnReportPublisher(context, hooks);
+            const finalize = createV2ReturnReportFinalizer(context, hooks);
             const controller = new AbortController();
             void (async () => {
                 for await (const event of context.event.subscribe({ signal: controller.signal })) {
@@ -327,7 +336,7 @@ export function createSortieDogsV2Plugin(legacyFactory = SortieDogsV010Plugin) {
                         if (id === undefined)
                             continue;
                         if (event.type === "session.execution.succeeded")
-                            await publish(id);
+                            await finalize(id);
                         if (event.type === "session.created" || event.type === "session.deleted" || event.type === "session.idle") {
                             const info = event.type === "session.created" ? await context.session.get({ sessionID: id }).catch(() => ({ id })) : { id };
                             await hooks.event?.({ event: { type: String(event.type), properties: { sessionID: id, info } } });

package/dist/runtime-assets-v010.js

@@ -23,6 +23,8 @@ Retain the canonical product's game-like user guidance and icons. Role separatio
 Use the user's language for prose, concise icon-led plan/progress/evidence blocks, and the canonical terminal heading
 after the host accepts the result. The host supplies the 🐾 return report, mission/proof, cost/pack and career panels;
 do not fabricate scores, counts, medals or success, and do not suppress these panels as redundant decoration.
+When complete_operator returns return_report, append that host-authored Markdown verbatim exactly once to the existing
+final answer, outside any code fence. Do not calculate its values or turn the panel into another task or model call.
 
 ${canonicalFixture("READABLE_OUTPUT_FIXTURE")}
 `;
@@ -166,7 +168,19 @@ report that specific limitation for a scope/design decision instead of inventing
 The proposal must map every original requirement ID to approach and validation, explicitly list uncovered IDs, preserve
 negative-condition handling, and include exact read/write/unit/GoalDeclaration plans and budget estimates. Its summary is
 not the source of truth and proposal reads are not acceptance evidence. Compare the submitted proposal directly with the
-original request. Only the root may call ${profile.toolPrefix}approve_operator_proposal with the exact proposal_id,
+original request. For a known defect in a submitted, unapproved proposal, the root may call
+${profile.toolPrefix}revise_operator_proposal with revision_json containing the current proposal_id, revision, content_hash,
+a substantive rationale, and 1..32 allowlisted {op,path,value} patches. Follow its exact schema; do not resend the full packet.
+Correct coverage/uncovered, observed surface claims, negative handling, unit/milestone/proof mapping, or shrink/normalize reads
+using only the completed investigation's evidence. Ordered requirements/acceptance, references, goal binding, budgets,
+criterion identities/defaults, Git authority and the exact write union stay fixed; execution unit count cannot increase.
+Successful and invalid patch attempts share the remaining submission allowance. Revision grants no new read, child or worker
+and requires no live proposal child. The host atomically records provenance and derives the next revision/hash.
+Approval preparation closes revision even if preparation later fails. Preserve that pinned plan for approval recovery.
+Never claim worker tests prove root-owned push/global apply or user-only acceptance; keep those obligations explicitly pending
+until their actual evidence exists. If existing contracts cannot express a required obligation, keep it uncovered and report
+the exact limitation instead of substituting a passing test. A root patch is not acceptance or automatic approval.
+Compare every original requirement again after revision. Only the root may call ${profile.toolPrefix}approve_operator_proposal with the exact proposal_id,
 revision, content_hash, ordered compared_requirement_ids, decision=approve, and a substantive comparison rationale.
 Uncovered requirements, stale hashes/revisions, another root, widened scope, rewritten acceptance, or reset proposal
 accounting must be rejected. Hash matching records identity; it never replaces this semantic root decision. Approval alone
@@ -219,7 +233,9 @@ directly (fast path); a larger plan returns ${operator}. Do not launch another i
 Do not manually reconstruct, translate, shorten, or append to that returned prompt. Do not add task_id to resume a
 fresh dispatch. If the exact Task is no longer in context, call operator_next once to retrieve it rather than guess.
 If prepare reports an invalid plan, repair only the reported JSON pointer using its code and repair_kind; preserve the
-original objective, acceptance, and unit count. Do not regenerate the full plan or send placeholder/probe plans. If it reports
+original objective, acceptance, and unit count. For operator-goal-field-invalid, use the exact expected enum or required
+field value at the diagnosed pointer; add a missing field without replacing defaults, criteria, budgets or the whole declaration.
+Do not regenerate the full plan or send placeholder/probe plans. If it reports
 an immutable active contract, read operator_status and reuse the existing next Task. Cancel only when an actual scope
 change or explicit stop requires it; do not cancel/recreate an unchanged plan to work around an admission error.
 Cancellation does not close the accepted user order. A replacement repair plan must keep the exact previous ordered

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.10.18",
+  "version": "0.10.20",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",