sortie-dogs 0.10.20 → 0.10.23

package/README.md

@@ -198,7 +198,7 @@ not invent, probe, or translate variant names.
 - `freeTierFallbackModels`: ordered global last-resort model IDs. Default:
   `opencode/deepseek-v4-flash-free`; `[]` disables this fallback.
 - `dedicatedWorkerModel`: canonical stable serial target, default
-  `openai/gpt-5.6-sol` / `medium`. The v0.10 profile also supplies its explicit
+  `openai/gpt-6-sol` / `medium`. The v0.10 profile also supplies its explicit
   role routes below; do not infer the v0.10 worker route from this stable setting.
 - `consultation.strategy`: fixed advisor identity, optional `required`, and
   positive `maxCallsPerCandidate`; default one call and not required.
@@ -237,13 +237,13 @@ reuse the same evidence instead of spending the validation budget again.
 
 ### Default v0.10 routes
 
-- `dog-operator`: `openai/gpt-5.6-luna-fast` / `max`
-- `dogs-coordinator`: `openai/gpt-5.6-terra` / `xhigh`
-- `dog-worker-v010`: `openai/gpt-5.6-luna-fast` / `max`
-- `dog-scout-v010`: `openai/gpt-5.6-luna-fast` / `xhigh`
-- `dog-reviewer-v010`: `openai/gpt-5.6-terra` / `xhigh`
+- `dog-operator`: `openai/gpt-6-luna` / `max`
+- `dogs-coordinator`: `openai/gpt-6-sol` / `xhigh`
+- `dog-worker-v010`: `openai/gpt-6-luna` / `max`
+- `dog-scout-v010`: `openai/gpt-6-luna` / `xhigh`
+- `dog-reviewer-v010`: `openai/gpt-6-sol` / `xhigh`
 - `dog-advisor-v010`: preferred declared `anthropic/claude-opus-5`, otherwise
-  `openai/gpt-5.6-sol` / `xhigh`
+  `openai/gpt-6-sol` / `xhigh`
 
 An explicit model and variant selected in OpenCode remains authoritative for that
 session. Child role defaults fill absent native settings and may be overridden by

package/dist/core/operator-proposal.d.ts

@@ -1,11 +1,11 @@
 import type { RuntimeProfile } from "./runtime-profile.js";
-import { type OperatorPlan, type OperatorTask } from "./operator-runtime.js";
+import { type OperatorPlan, type OperatorState, type OperatorTask } from "./operator-runtime.js";
 export declare const DEFAULT_OPERATOR_PROPOSAL_BUDGET: Readonly<{
     max_reads: 45;
     max_submissions: 9;
 }>;
 export declare const OPERATOR_PROPOSAL_BUDGET_CAPS: Readonly<{
-    max_reads: 192;
+    max_reads: 228;
     max_submissions: 24;
 }>;
 export declare const OPERATOR_PROPOSAL_REVISION_CONTRACT: string;
@@ -94,6 +94,32 @@ export interface OperatorProposalState {
     /** Preparation may publish execution controls before approval commits; never revise that pinned plan. */
     approval_started?: boolean;
     root_revisions?: OperatorProposalRevision[];
+    /** Root-authorized cumulative increases; the submitted plan and its identity do not change. */
+    budget_revisions?: readonly {
+        readonly at: string;
+        readonly rationale: string;
+        readonly from: OperatorIntent["proposal_budget"];
+        readonly to: OperatorIntent["proposal_budget"];
+        readonly proposal_id: string;
+        readonly content_hash: string;
+        readonly goal_binding: OperatorProposalGoalBinding;
+    }[];
+    /** Submitted contracts displaced by a newly evidenced scope gap, never erased or approved. */
+    submitted_history?: readonly {
+        readonly archive_hash: string;
+        readonly proposal_id: string;
+        readonly revision: number;
+        readonly content_hash: string;
+        readonly missing_write_paths: readonly string[];
+    }[];
+    /** Immutable archive identities of earlier approved contracts on this root. */
+    approved_history?: readonly {
+        readonly archive_hash: string;
+        readonly intent_id: string;
+        readonly proposal_id: string;
+        readonly run_id: string;
+        readonly disposition: "completed" | "incomplete";
+    }[];
 }
 interface OperatorProposalIdentity {
     readonly proposal_id: string;
@@ -136,6 +162,7 @@ export declare class OperatorProposalRuntime {
     readonly projectRoot: string;
     constructor(projectRoot: string, profile: RuntimeProfile);
     private file;
+    private approvedArchiveFile;
     private spendFile;
     private readSpend;
     private saveSpend;
@@ -153,6 +180,13 @@ export declare class OperatorProposalRuntime {
     private resolveTask;
     begin(root: string, raw: unknown): Promise<OperatorProposalState>;
     private beginUnlocked;
+    private submittedArchiveFile;
+    /** Increase a submitted proposal's cumulative allowance without replacing its goal, plan or investigation. */
+    extendSubmittedBudget(root: string, actor: string, raw: unknown, currentGoal: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
+    /** Reopen only a newly diagnosed scope gap in a submitted plan, preserving its exact archived identity. */
+    reopenSubmittedScope(root: string, actor: string, raw: unknown, currentGoal: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
+    /** Explicit root-only transition after an approved contract's execution lane has ended. */
+    reviseApproved(root: string, actor: string, raw: unknown, readRun: () => Promise<OperatorState | undefined>, currentGoal: OperatorProposalGoalBinding, proveApprovedRunAncestry?: (oldGoalID: string, parentRunID: string) => Promise<boolean>): Promise<OperatorProposalState>;
     bindGoal(root: string, binding: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
     private bindGoalUnlocked;
     admit(root: string, callID: string, args: unknown, reserveBudget?: () => Promise<void>): Promise<OperatorTask>;

package/dist/core/operator-proposal.js

@@ -9,7 +9,7 @@ const text = (value) => typeof value === "string" && value.trim().length > 0 &&
 const ORIGINAL_REQUEST_MAX_CHARACTERS = 128 * 1024;
 const ORIGINAL_REQUEST_MAX_BYTES = 128 * 1024;
 export const DEFAULT_OPERATOR_PROPOSAL_BUDGET = Object.freeze({ max_reads: 45, max_submissions: 9 });
-export const OPERATOR_PROPOSAL_BUDGET_CAPS = Object.freeze({ max_reads: 192, max_submissions: 24 });
+export const OPERATOR_PROPOSAL_BUDGET_CAPS = Object.freeze({ max_reads: 228, max_submissions: 24 });
 export const OPERATOR_PROPOSAL_REVISION_CONTRACT = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,rationale:nonblank single-line string,patches:array}. " +
     "Pin the current submitted identity from operator_status. patches contains 1..32 {op,path,value} objects. " +
     "replace is allowed only at /coverage, /existing_surface, /uncovered, /negative_handling, /read_scope, /plan/units, /plan/acceptance_proof, " +
@@ -343,6 +343,9 @@ export class OperatorProposalRuntime {
         this.projectRoot = resolve(projectRoot);
     }
     file(root) { return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.json`); }
+    approvedArchiveFile(root, intentID, proposalHash, runID) {
+        return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.${intentID}.${proposalHash}.${hash(runID).slice(0, 16)}.approved.json`);
+    }
     spendFile(root) { return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.spend.json`); }
     async readSpend(root) {
         let source;
@@ -367,6 +370,12 @@ export class OperatorProposalRuntime {
             !/^sha256:[a-f0-9]{64}$/u.test(spend.retry.goal_binding.acceptance_fingerprint))) {
             throw new Error("operator-proposal-spend-invalid");
         }
+        if (spend.approved_history !== undefined && (!Array.isArray(spend.approved_history) ||
+            spend.approved_history.some(item => !record(item) || !/^[a-f0-9]{64}$/u.test(String(item.archive_hash)) ||
+                !identifier(item.intent_id) || !identifier(item.proposal_id) || !text(item.run_id) ||
+                !["completed", "incomplete"].includes(String(item.disposition))))) {
+            throw new Error("operator-proposal-spend-invalid");
+        }
         return spend;
     }
     async saveSpend(spend) {
@@ -543,11 +552,184 @@ export class OperatorProposalRuntime {
             goal_binding: spend.retry?.intent_hash === intentHash ? structuredClone(spend.retry.goal_binding) : null,
             proposal_call_id: null, proposal_session_id: null, read_count: spend.reads, read_paths: [], submission_count: spend.submissions, proposal_id: null,
             ...(spend.reads > 0 || spend.submissions > 0 ? { prior_spend: { reads: spend.reads, submissions: spend.submissions } } : {}),
-            proposal_revision: null, proposal_hash: null, proposal: null, approval_rationale: null };
+            proposal_revision: null, proposal_hash: null, proposal: null, approval_rationale: null,
+            ...(spend.approved_history ? { approved_history: structuredClone(spend.approved_history) } : {}) };
         this.assertBudgetAvailable(state);
         await this.save(state);
         return state;
     }
+    submittedArchiveFile(root, intentID, proposalHash) {
+        return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.${intentID}.${proposalHash}.submitted.json`);
+    }
+    /** Increase a submitted proposal's cumulative allowance without replacing its goal, plan or investigation. */
+    async extendSubmittedBudget(root, actor, raw, currentGoal) {
+        if (actor !== root)
+            throw new Error("operator-proposal-budget-revision-root-required");
+        return this.serial(root, async () => {
+            const state = await this.requiredUnlocked(root);
+            if (state.phase !== "submitted" || !state.proposal || !state.goal_binding || state.approval_started) {
+                throw new Error("operator-proposal-budget-revision-not-submitted");
+            }
+            if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "rationale", "proposal_budget"]) ||
+                !text(raw.proposal_id) || !Number.isSafeInteger(raw.revision) || !text(raw.content_hash) ||
+                !text(raw.rationale) || raw.rationale.length > 2000 || !record(raw.proposal_budget) ||
+                !exactSet(raw.proposal_budget, ["max_reads", "max_submissions"])) {
+                throw new Error("operator-proposal-budget-revision-invalid");
+            }
+            if (raw.proposal_id !== state.proposal_id || raw.revision !== state.proposal_revision ||
+                raw.content_hash !== state.proposal_hash)
+                throw new Error("operator-proposal-budget-revision-identity-mismatch");
+            if (JSON.stringify(currentGoal) !== JSON.stringify(state.goal_binding)) {
+                throw new Error("operator-proposal-budget-revision-goal-mismatch");
+            }
+            const before = state.intent.proposal_budget;
+            const budget = raw.proposal_budget;
+            const reads = budget.max_reads, submissions = budget.max_submissions;
+            if (!Number.isSafeInteger(reads) || !Number.isSafeInteger(submissions) ||
+                reads > OPERATOR_PROPOSAL_BUDGET_CAPS.max_reads || submissions > OPERATOR_PROPOSAL_BUDGET_CAPS.max_submissions ||
+                reads < before.max_reads || submissions < before.max_submissions ||
+                (reads === before.max_reads && submissions === before.max_submissions) ||
+                reads <= state.read_count || submissions <= state.submission_count) {
+                throw new Error("operator-proposal-budget-revision-range-invalid");
+            }
+            const next = { max_reads: reads, max_submissions: submissions };
+            const intent = { ...state.intent, proposal_budget: next };
+            // The intent hash protects the stored budget; the original intent ID and submitted proposal identity stay pinned.
+            const revised = { ...state, intent, intent_hash: hash(JSON.stringify(intent)),
+                budget_revisions: [...(state.budget_revisions ?? []), { at: new Date().toISOString(), rationale: raw.rationale,
+                        from: { ...before }, to: next, proposal_id: state.proposal_id, content_hash: state.proposal_hash,
+                        goal_binding: structuredClone(state.goal_binding) }] };
+            await this.save(revised);
+            return revised;
+        });
+    }
+    /** Reopen only a newly diagnosed scope gap in a submitted plan, preserving its exact archived identity. */
+    async reopenSubmittedScope(root, actor, raw, currentGoal) {
+        if (actor !== root)
+            throw new Error("operator-proposal-scope-reopen-root-required");
+        return this.serial(root, async () => {
+            const state = await this.requiredUnlocked(root);
+            if (state.phase !== "submitted" || !state.proposal || !state.goal_binding || state.approval_started) {
+                throw new Error("operator-proposal-scope-reopen-not-submitted");
+            }
+            if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "rationale", "missing_write_paths"]) ||
+                !text(raw.proposal_id) || !Number.isSafeInteger(raw.revision) || !text(raw.content_hash) ||
+                !text(raw.rationale) || raw.rationale.length > 2000 || !Array.isArray(raw.missing_write_paths) ||
+                raw.missing_write_paths.length < 1 || raw.missing_write_paths.length > 16 ||
+                !raw.missing_write_paths.every(normalizedRelativePath) ||
+                new Set(raw.missing_write_paths).size !== raw.missing_write_paths.length) {
+                throw new Error("operator-proposal-scope-reopen-invalid");
+            }
+            if (raw.proposal_id !== state.proposal_id || raw.revision !== state.proposal_revision ||
+                raw.content_hash !== state.proposal_hash)
+                throw new Error("operator-proposal-scope-reopen-identity-mismatch");
+            if (JSON.stringify(currentGoal) !== JSON.stringify(state.goal_binding)) {
+                throw new Error("operator-proposal-scope-reopen-goal-mismatch");
+            }
+            this.assertBudgetAvailable(state);
+            const oldWrites = state.proposal.write_scope;
+            const missing = raw.missing_write_paths;
+            if (missing.some(path => oldWrites.some(scope => path === scope || path.startsWith(`${scope}/`)) ||
+                !state.intent.allow_read.some(scope => path === scope || path.startsWith(`${scope}/`)))) {
+                throw new Error("operator-proposal-scope-reopen-path-invalid");
+            }
+            const archive = JSON.stringify({ submitted_proposal: state, missing_write_paths: missing, rationale: raw.rationale });
+            const archivePath = this.submittedArchiveFile(root, state.intent_id, state.proposal_hash);
+            try {
+                await writeFile(archivePath, archive, { flag: "wx", mode: 0o600 });
+            }
+            catch (error) {
+                if (error.code !== "EEXIST" || hash(await readFile(archivePath, "utf8")) !== hash(archive))
+                    throw error;
+            }
+            const reopened = { ...state, phase: "investigating", created_at: new Date().toISOString(),
+                prior_spend: { reads: state.read_count, submissions: state.submission_count },
+                proposal_call_id: null, proposal_session_id: null, read_paths: [], proposal_id: null, proposal_revision: null,
+                proposal_hash: null, proposal: null, approval_rationale: null,
+                submitted_history: [...(state.submitted_history ?? []), { archive_hash: hash(archive), proposal_id: state.proposal_id,
+                        revision: state.proposal_revision, content_hash: state.proposal_hash, missing_write_paths: missing }] };
+            await this.save(reopened);
+            return reopened;
+        });
+    }
+    /** Explicit root-only transition after an approved contract's execution lane has ended. */
+    async reviseApproved(root, actor, raw, readRun, currentGoal, proveApprovedRunAncestry) {
+        if (actor !== root)
+            throw new Error("operator-proposal-approved-revision-root-required");
+        return this.serial(root, async () => {
+            if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "operator_run_id", "rationale", "intent"]) ||
+                typeof raw.proposal_id !== "string" || !Number.isSafeInteger(raw.revision) || typeof raw.content_hash !== "string" ||
+                typeof raw.operator_run_id !== "string" || !text(raw.rationale)) {
+                throw new Error("operator-proposal-approved-revision-invalid");
+            }
+            const previous = await this.requiredUnlocked(root);
+            if (previous.phase !== "approved" || !previous.proposal || !previous.goal_binding) {
+                throw new Error("operator-proposal-approved-revision-not-approved");
+            }
+            if (raw.proposal_id !== previous.proposal_id || raw.revision !== previous.proposal_revision ||
+                raw.content_hash !== previous.proposal_hash)
+                throw new Error("operator-proposal-approved-revision-identity-mismatch");
+            const run = await readRun();
+            if (!run || !["cancelled", "completed"].includes(run.phase) || run.rootSessionID !== root ||
+                run.runID !== raw.operator_run_id ||
+                JSON.stringify(run.acceptance) !== JSON.stringify(previous.proposal.plan.acceptance)) {
+                throw new Error("operator-proposal-approved-revision-terminal-run-required");
+            }
+            const originalPlan = run.planHash === hash(JSON.stringify(previous.proposal.plan));
+            if (!originalPlan && (!run.parentRunID || !proveApprovedRunAncestry ||
+                !await proveApprovedRunAncestry(previous.goal_binding.goal_id, run.parentRunID))) {
+                throw new Error("operator-proposal-approved-revision-terminal-run-required");
+            }
+            if (!text(currentGoal.goal_id) || !Number.isSafeInteger(currentGoal.revision) || currentGoal.revision < 1 ||
+                !Number.isSafeInteger(currentGoal.scope_epoch) || currentGoal.scope_epoch < 1 ||
+                !/^sha256:[a-f0-9]{64}$/u.test(currentGoal.acceptance_fingerprint)) {
+                throw new Error("operator-proposal-goal-binding-invalid");
+            }
+            if (JSON.stringify(currentGoal) === JSON.stringify(previous.goal_binding)) {
+                throw new Error("operator-proposal-approved-revision-goal-revision-required");
+            }
+            const intent = parseIntent(raw.intent), intentHash = hash(JSON.stringify(intent));
+            if (intentHash === previous.intent_hash)
+                throw new Error("operator-proposal-approved-revision-intent-unchanged");
+            if (JSON.stringify(intent.requirements.slice(0, previous.intent.requirements.length)) !== JSON.stringify(previous.intent.requirements)) {
+                throw new Error("operator-proposal-approved-revision-acceptance-continuity-required");
+            }
+            const remainingReads = intent.proposal_budget.max_reads - previous.read_count;
+            const remainingSubmissions = intent.proposal_budget.max_submissions - previous.submission_count;
+            if (remainingReads <= 0 || remainingSubmissions <= 0) {
+                throw new OperatorProposalBudgetError({ status: "proposal-budget-exhausted",
+                    code: remainingReads <= 0 ? "operator-proposal-read-budget-exhausted" : "operator-proposal-submission-budget-exhausted",
+                    reads: previous.read_count, max_reads: intent.proposal_budget.max_reads, remaining_reads: Math.max(0, remainingReads),
+                    submissions: previous.submission_count, max_submissions: intent.proposal_budget.max_submissions,
+                    remaining_submissions: Math.max(0, remainingSubmissions),
+                    required_minimum_budget: { max_reads: previous.read_count + 1, max_submissions: previous.submission_count + 1 } });
+            }
+            const archive = JSON.stringify({ approved_proposal: previous, terminal_run: {
+                    run_id: run.runID, plan_hash: run.planHash, acceptance: run.acceptance, acceptance_fingerprint: run.acceptanceFingerprint,
+                    phase: run.phase, decision: run.decision, receipt: run.receipt, generation: run.generation,
+                    parent_run_id: originalPlan ? null : run.parentRunID
+                } });
+            const archivePath = this.approvedArchiveFile(root, previous.intent_id, previous.proposal_hash, run.runID);
+            try {
+                await writeFile(archivePath, archive, { flag: "wx", mode: 0o600 });
+            }
+            catch (error) {
+                if (error.code !== "EEXIST" || hash(await readFile(archivePath, "utf8")) !== hash(archive))
+                    throw error;
+            }
+            const state = { schema_version: "0.1", profile: this.profile.id, root_session_id: root,
+                intent_id: `intent-${intentHash.slice(0, 24)}`, intent_hash: intentHash, intent, created_at: new Date().toISOString(),
+                phase: "investigating", goal_binding: structuredClone(currentGoal),
+                prior_spend: { reads: previous.read_count, submissions: previous.submission_count },
+                proposal_call_id: null, proposal_session_id: null, read_count: previous.read_count, read_paths: [],
+                submission_count: previous.submission_count, proposal_id: null, proposal_revision: null, proposal_hash: null,
+                proposal: null, approval_rationale: null,
+                approved_history: [...(previous.approved_history ?? []), { archive_hash: hash(archive), intent_id: previous.intent_id,
+                        proposal_id: previous.proposal_id, run_id: run.runID, disposition: run.phase === "completed" ? "completed" : "incomplete" }] };
+            await this.save(state);
+            return state;
+        });
+    }
     async bindGoal(root, binding) {
         return this.serial(root, () => this.bindGoalUnlocked(root, binding));
     }
@@ -826,6 +1008,7 @@ export class OperatorProposalRuntime {
                 return undefined;
             await this.saveSpend({ schema_version: "0.1", profile: this.profile.id, root_session_id: root,
                 reads: state.read_count, submissions: state.submission_count,
+                ...(state.approved_history ? { approved_history: state.approved_history } : {}),
                 ...(state.goal_binding === null ? {} : { retry: { intent_hash: state.intent_hash, goal_binding: state.goal_binding } }) });
             await rm(this.file(root), { force: true });
             return state;
@@ -846,10 +1029,13 @@ export class OperatorProposalRuntime {
     packet(state) {
         return { status: state.phase, intent_id: state.intent_id, intent_hash: state.intent_hash,
             proposal_id: state.proposal_id, revision: state.proposal_revision, content_hash: state.proposal_hash, reads: state.read_count,
-            remaining_reads: state.intent.proposal_budget.max_reads - state.read_count, submissions: state.submission_count,
+            max_reads: state.intent.proposal_budget.max_reads, remaining_reads: state.intent.proposal_budget.max_reads - state.read_count,
+            submissions: state.submission_count, max_submissions: state.intent.proposal_budget.max_submissions,
             remaining_submissions: state.intent.proposal_budget.max_submissions - state.submission_count,
             task_admitted: state.proposal_call_id !== null, uncovered: state.proposal?.uncovered ?? [], proposal: state.proposal,
             approval_rationale: state.approval_rationale, root_revisions: state.root_revisions ?? [],
+            budget_revisions: state.budget_revisions ?? [], submitted_history: state.submitted_history ?? [],
+            approved_history: state.approved_history ?? [],
             revision_available: state.phase === "submitted" && !state.approval_started && state.submission_count < state.intent.proposal_budget.max_submissions };
     }
 }

package/dist/plugin/adaptive-remediation-host.d.ts

@@ -23,7 +23,7 @@ export interface AdaptiveReviewProvider {
         readonly fingerprint: string;
     }>;
 }
-export declare const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-5.6-sol";
+export declare const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-6-sol";
 export interface AdaptiveRemediationSessionClient extends OpenCodeModelAvailabilityClient {
     session: {
         create(input: {

package/dist/plugin/adaptive-remediation-host.js

@@ -10,7 +10,7 @@ import { produceWorktreeCommitArtifact, runContainedValidation } from "../core/w
 import { openCodeModel } from "./model-routing-hook.js";
 const SHA = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u;
 const HASH = /^[a-f0-9]{64}$/u;
-export const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-5.6-sol";
+export const DEFAULT_ADAPTIVE_REMEDIATION_MODEL = "openai/gpt-6-sol";
 const responseData = (value) => {
     if (value === null || typeof value !== "object")
         return {};

package/dist/plugin/index.js

@@ -1617,13 +1617,63 @@ export const SortieDogsPlugin = async (input, options) => {
                             !isRecord(part.state) || !["completed", "error"].includes(String(part.state.status)) ||
                             !isRecord(part.state.input) || typeof part.state.input.prompt !== "string")
                             continue;
-                        const proposal = reservation.unit_id.startsWith("proposal:");
                         const role = String(part.state.input.subagent_type);
-                        if (proposal ? role !== "dog-operator" : !["dog-worker", "dog-luna-worker"].includes(role))
+                        const prompt = part.state.input.prompt;
+                        const proposal = reservation.unit_id.startsWith("proposal:");
+                        let unitID;
+                        // The profiled client maps the external V2 `dogs-coordinator` to this canonical role.
+                        if (role === "dog-operator" &&
+                            (prompt.startsWith("SORTIE_OPERATOR_DELEGATE_REF ") ||
+                                prompt.startsWith("SORTIE_OPERATOR_PROPOSAL_TASK_REF "))) {
+                            // Native V2 stores the short Task handle, not the expanded child prompt. The
+                            // handle's owner and unit must agree with the durable reservation and call ID.
+                            const prefix = prompt.startsWith("SORTIE_OPERATOR_DELEGATE_REF ")
+                                ? "SORTIE_OPERATOR_DELEGATE_REF " : "SORTIE_OPERATOR_PROPOSAL_TASK_REF ";
+                            let ref;
+                            try {
+                                ref = JSON.parse(prompt.slice(prefix.length));
+                            }
+                            catch {
+                                continue;
+                            }
+                            if (!isRecord(ref) || ref.r !== root || !/^[a-f0-9]{64}$/u.test(String(ref.h)) ||
+                                (prefix.startsWith("SORTIE_OPERATOR_DELEGATE") && !/^[a-f0-9]{64}$/u.test(String(ref.p))))
+                                continue;
+                            if (prefix.startsWith("SORTIE_OPERATOR_DELEGATE")) {
+                                if (ref.k !== "delegate" || typeof ref.n !== "string" ||
+                                    !Number.isSafeInteger(ref.g) || ref.g < 1 ||
+                                    !reservation.unit_id.startsWith(`${ref.n}-`) ||
+                                    !/^[1-9][0-9]*$/u.test(reservation.unit_id.slice(ref.n.length + 1)))
+                                    continue;
+                                unitID = reservation.unit_id;
+                            }
+                            else {
+                                if (ref.k !== "proposal" || typeof ref.i !== "string" ||
+                                    reservation.unit_id !== `proposal:${ref.i}`)
+                                    continue;
+                                unitID = reservation.unit_id;
+                            }
+                        }
+                        else if (["dog-worker", "dog-luna-worker"].includes(role)) {
+                            if (prompt.startsWith("SORTIE_OPERATOR_TASK_REF ")) {
+                                let ref;
+                                try {
+                                    ref = JSON.parse(prompt.slice("SORTIE_OPERATOR_TASK_REF ".length));
+                                }
+                                catch {
+                                    continue;
+                                }
+                                if (!isRecord(ref) || ref.r !== root || !/^[a-f0-9]{64}$/u.test(String(ref.h)) ||
+                                    !/^[a-f0-9]{64}$/u.test(String(ref.p)) || typeof ref.t !== "string")
+                                    continue;
+                                unitID = ref.t;
+                            }
+                            else {
+                                unitID = handoffValue(handoffEntries(prompt), ["task_id"]) ?? part.callID;
+                            }
+                        }
+                        if (unitID === undefined || (proposal && role !== "dog-operator"))
                             continue;
-                        const unitID = proposal
-                            ? reservation.unit_id
-                            : handoffValue(handoffEntries(part.state.input.prompt), ["task_id"]) ?? part.callID;
                         if (unitID !== reservation.unit_id || goalFingerprint({ goal_id: state.goal_id, unit_id: unitID,
                             call_id: part.callID }) !== reservation.reservation_id)
                             continue;
@@ -4028,12 +4078,13 @@ export const SortieDogsPlugin = async (input, options) => {
     async function serializeChatTransition(sessionID, operation) {
         const previous = chatTransitions.get(sessionID) ?? Promise.resolve();
         const current = previous.catch(() => undefined).then(operation);
-        chatTransitions.set(sessionID, current);
+        const tail = current.then(() => undefined, () => undefined);
+        chatTransitions.set(sessionID, tail);
         try {
-            await current;
+            return await current;
         }
         finally {
-            if (chatTransitions.get(sessionID) === current)
+            if (chatTransitions.get(sessionID) === tail)
                 chatTransitions.delete(sessionID);
         }
     }
@@ -7338,11 +7389,132 @@ export const SortieDogsPlugin = async (input, options) => {
         assertActiveGoal: async (root, fingerprint) => {
             if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
                 throw new Error("operator-coordinator-required");
+            await recoverCompletedGoalReservations(root);
             const goal = await currentGoal(root);
             if (!goal || goal.phase !== "active" || goal.receipt !== null || goal.acceptance_fingerprint !== fingerprint || goal.outstanding_reservations.length) {
                 throw new Error("operator-resume-goal-identity-mismatch");
             }
         },
+        reconcileAbortedOperatorOrphan: root => serializeChatTransition(root, async () => {
+            if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
+                throw new Error("operator-coordinator-required");
+            const ledger = await goalLedger(root), initial = (await ledger.readGoal()).state;
+            if (initial.phase !== "active" || initial.goal_id === null || initial.receipt !== null) {
+                return { status: "unproven", reason: "active-goal-required" };
+            }
+            if (initial.outstanding_reservations.length === 0)
+                return { status: "no-orphan" };
+            if (initial.outstanding_reservations.length !== 1)
+                return { status: "unproven", reason: "multiple-reservations" };
+            const reservation = initial.outstanding_reservations[0];
+            const unitID = reservation.unit_id, runID = unitID.replace(/-[1-9][0-9]*$/u, "");
+            if (reservation.session_id !== root || runID === unitID || !/^operator-[a-f0-9-]+$/u.test(runID) ||
+                input.client?.session?.children === undefined || input.client.session.messages === undefined ||
+                input.client.session.abort === undefined) {
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "owned-native-lineage-unavailable" };
+            }
+            const sessionAPI = input.client.session;
+            const messages = async (id) => {
+                const response = await sessionAPI.messages({ path: { id }, query: { directory: input.directory } });
+                return isRecord(response) && Array.isArray(response.data) ? response.data.filter(isRecord) : [];
+            };
+            const children = async (id) => {
+                const response = await sessionAPI.children({ path: { id }, query: { directory: input.directory } });
+                return isRecord(response) && Array.isArray(response.data) ? response.data.filter(isRecord) : [];
+            };
+            const nativeTaskParts = (history) => history.flatMap(message => isRecord(message.info) && message.info.role === "assistant" && Array.isArray(message.parts)
+                ? message.parts.filter(part => isRecord(part) && part.type === "tool" && part.tool === "task") : []);
+            const refFrom = (part, prefix) => {
+                const state = isRecord(part.state) ? part.state : undefined;
+                const toolInput = isRecord(state?.input) ? state.input : undefined;
+                if (typeof toolInput?.prompt !== "string" || !toolInput.prompt.startsWith(prefix))
+                    return undefined;
+                try {
+                    const ref = JSON.parse(toolInput.prompt.slice(prefix.length));
+                    return isRecord(ref) ? ref : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            };
+            const rootParts = nativeTaskParts(await messages(root));
+            const parentTasks = rootParts.filter(part => {
+                const state = isRecord(part.state) ? part.state : undefined;
+                const ref = refFrom(part, "SORTIE_OPERATOR_DELEGATE_REF ");
+                return state?.status === "error" && isRecord(state.error) && state.error.type === "aborted" &&
+                    ref?.k === "delegate" && ref.r === root && ref.n === runID &&
+                    /^[a-f0-9]{64}$/u.test(String(ref.p)) && /^[a-f0-9]{64}$/u.test(String(ref.h)) &&
+                    Number.isSafeInteger(ref.g) && ref.g > 0 &&
+                    isRecord(state.time) && typeof state.time.end === "number";
+            });
+            if (parentTasks.length !== 1)
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "terminal-parent-unproven" };
+            const parentEnd = parentTasks[0].state.time.end;
+            const parentRef = refFrom(parentTasks[0], "SORTIE_OPERATOR_DELEGATE_REF ");
+            const candidates = [];
+            for (const delegate of await children(root)) {
+                if (typeof delegate.id !== "string" || delegate.parentID !== root || delegate.agent !== "dog-operator")
+                    continue;
+                const parts = nativeTaskParts(await messages(delegate.id));
+                for (const part of parts) {
+                    const ref = refFrom(part, "SORTIE_OPERATOR_TASK_REF ");
+                    if (ref?.r !== root || ref.n !== runID || ref.t !== unitID || typeof part.callID !== "string" ||
+                        ref.p !== parentRef.p || ref.g !== parentRef.g || !/^[a-f0-9]{64}$/u.test(String(ref.h)) ||
+                        goalFingerprint({ goal_id: initial.goal_id, unit_id: unitID, call_id: part.callID }) !== reservation.reservation_id ||
+                        !isRecord(part.state) || part.state.status !== "running")
+                        continue;
+                    for (const worker of await children(delegate.id)) {
+                        if (typeof worker.id !== "string" || worker.parentID !== delegate.id ||
+                            !["dog-worker", "dog-luna-worker"].includes(String(worker.agent)))
+                            continue;
+                        const history = await messages(worker.id);
+                        const claimed = history.some(message => isRecord(message.info) && message.info.role === "user" &&
+                            Array.isArray(message.parts) && message.parts.some(textPart => isRecord(textPart) &&
+                            textPart.type === "text" && typeof textPart.text === "string" &&
+                            handoffValue(handoffEntries(textPart.text), ["task_id"]) === unitID));
+                        const lastActivity = Math.max(0, ...history.flatMap(message => isRecord(message.info) && isRecord(message.info.time) &&
+                            typeof message.info.time.created === "number" ? [message.info.time.created] : []));
+                        if (claimed && lastActivity > 0 && lastActivity <= parentEnd) {
+                            candidates.push({ delegate: delegate.id, worker: worker.id, callID: part.callID });
+                        }
+                    }
+                }
+            }
+            if (candidates.length !== 1)
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "stale-child-lineage-unproven" };
+            const candidate = candidates[0];
+            for (const id of [candidate.worker, candidate.delegate]) {
+                const acknowledgement = await sessionAPI.abort({ path: { id }, query: { directory: input.directory } });
+                const response = isRecord(acknowledgement) && isRecord(acknowledgement.data) ? acknowledgement.data : acknowledgement;
+                if (!isRecord(response) || typeof response.interrupted !== "boolean") {
+                    return { status: "unproven", reservation_id: reservation.reservation_id, reason: "native-interrupt-unconfirmed" };
+                }
+            }
+            const current = (await ledger.readGoal()).state;
+            if (current.phase !== "active" || current.receipt !== null ||
+                current.goal_id !== initial.goal_id || current.revision !== initial.revision ||
+                current.scope_epoch !== initial.scope_epoch || current.acceptance_fingerprint !== initial.acceptance_fingerprint ||
+                current.outstanding_reservations.length !== 1 ||
+                current.outstanding_reservations[0].reservation_id !== reservation.reservation_id) {
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "goal-changed-during-interrupt" };
+            }
+            await ledger.appendGoal({ kind: "unit.settled", at: new Date().toISOString(), reservation_id: reservation.reservation_id,
+                receipt_id: goalFingerprint({ orphan_interrupted: candidate, reservation_id: reservation.reservation_id }),
+                goal_id: initial.goal_id, unit_id: unitID, disposition: "cancelled", result_class: "interrupted",
+                progress_fingerprint: null, evidence: [], elapsed_ms: null, cost_usd: null });
+            return { status: "settled", reservation_id: reservation.reservation_id, unit_id: unitID };
+        }),
+        proveApprovedRunAncestry: async (root, oldGoalID, parentRunID) => {
+            if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
+                throw new Error("operator-coordinator-required");
+            const { records } = await (await goalLedger(root)).readGoal();
+            if (!records.some(({ event }) => event.kind === "goal.accepted" && event.goal_id === oldGoalID))
+                return false;
+            return records.some(({ event }) => event.kind === "dispatch.reserved" && event.goal_id === oldGoalID &&
+                event.session_id === root && event.unit_id.startsWith(`${parentRunID}-`) &&
+                records.some(({ event: settled }) => settled.kind === "unit.settled" && settled.goal_id === oldGoalID &&
+                    settled.unit_id === event.unit_id && settled.reservation_id === event.reservation_id));
+        },
         retainOperatorContractRepairWorker: async (root, taskID, childSessionID) => {
             if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
                 throw new Error("operator-coordinator-required");

package/dist/plugin/model-cost.d.ts

@@ -1,9 +1,9 @@
 export declare const MODEL_COST_PRICING_SNAPSHOT: {
-    readonly checkedAt: "2026-09-14";
+    readonly checkedAt: "2026-09-23";
     readonly currency: "USD";
     readonly unit: "1M tokens";
-    readonly sources: readonly ["https://developers.openai.com/api/docs/pricing", "https://developers.openai.com/api/docs/models/gpt-6-astra", "https://developers.openai.com/api/docs/models/gpt-5.6-sol", "https://developers.openai.com/api/docs/models/gpt-5.6-terra", "https://developers.openai.com/api/docs/models/gpt-5.6-luna", "https://platform.claude.com/docs/en/about-claude/pricing"];
-    readonly assumptions: readonly ["OpenAI Standard pricing; requests above 272,000 total input/cache tokens use 2x input/cache and 1.5x output pricing.", "Anthropic Standard pricing with the 5-minute cache-write rate; Fast, Batch, Flex, regional, tool, and subscription charges are excluded.", "variant and serviceTier are separate; model variants do not alter the selected Standard token price.", "gpt-5.6-luna-fast has no published model page; its rates are the resolved host model catalog entry for openai/gpt-5.6-luna-fast, exactly twice the Luna Standard schedule. That entry declares no separate long-context band, so the shared OpenAI band above is applied rather than a second assumed schedule."];
+    readonly sources: readonly ["https://developers.openai.com/api/docs/pricing", "https://developers.openai.com/api/docs/models/gpt-6-astra", "https://developers.openai.com/api/docs/models/gpt-6-sol", "https://developers.openai.com/api/docs/models/gpt-6-luna", "https://developers.openai.com/api/docs/models/gpt-5.6-sol", "https://developers.openai.com/api/docs/models/gpt-5.6-terra", "https://developers.openai.com/api/docs/models/gpt-5.6-luna", "https://platform.claude.com/docs/en/about-claude/pricing"];
+    readonly assumptions: readonly ["OpenAI Standard pricing; requests above 272,000 total input/cache tokens use 2x input/cache and 1.5x output pricing.", "Anthropic Standard pricing with the 5-minute cache-write rate; Fast, Batch, Flex, regional, tool, and subscription charges are excluded.", "variant and serviceTier are separate; model variants do not alter the selected Standard token price.", "GPT-6 Sol and GPT-6 Luna use their official Standard schedules; Fast mode is a service tier priced separately and does not create a second model ID.", "gpt-5.6-luna-fast is retained only as a compatibility price for historical host catalog entries; it has no published model page and is exactly twice the GPT-5.6 Luna Standard schedule."];
 };
 export interface ModelCostUsage {
     readonly providerID: string | undefined;

package/dist/plugin/model-cost.js

@@ -1,10 +1,12 @@
 export const MODEL_COST_PRICING_SNAPSHOT = {
-    checkedAt: "2026-09-14",
+    checkedAt: "2026-09-23",
     currency: "USD",
     unit: "1M tokens",
     sources: [
         "https://developers.openai.com/api/docs/pricing",
         "https://developers.openai.com/api/docs/models/gpt-6-astra",
+        "https://developers.openai.com/api/docs/models/gpt-6-sol",
+        "https://developers.openai.com/api/docs/models/gpt-6-luna",
         "https://developers.openai.com/api/docs/models/gpt-5.6-sol",
         "https://developers.openai.com/api/docs/models/gpt-5.6-terra",
         "https://developers.openai.com/api/docs/models/gpt-5.6-luna",
@@ -14,11 +16,14 @@ export const MODEL_COST_PRICING_SNAPSHOT = {
         "OpenAI Standard pricing; requests above 272,000 total input/cache tokens use 2x input/cache and 1.5x output pricing.",
         "Anthropic Standard pricing with the 5-minute cache-write rate; Fast, Batch, Flex, regional, tool, and subscription charges are excluded.",
         "variant and serviceTier are separate; model variants do not alter the selected Standard token price.",
-        "gpt-5.6-luna-fast has no published model page; its rates are the resolved host model catalog entry for openai/gpt-5.6-luna-fast, exactly twice the Luna Standard schedule. That entry declares no separate long-context band, so the shared OpenAI band above is applied rather than a second assumed schedule.",
+        "GPT-6 Sol and GPT-6 Luna use their official Standard schedules; Fast mode is a service tier priced separately and does not create a second model ID.",
+        "gpt-5.6-luna-fast is retained only as a compatibility price for historical host catalog entries; it has no published model page and is exactly twice the GPT-5.6 Luna Standard schedule.",
     ],
 };
 const OPENAI = {
     "gpt-6-astra": { input: 10, cacheRead: 1, cacheWrite: 12.5, output: 50 },
+    "gpt-6-sol": { input: 2, cacheRead: 0.2, cacheWrite: 2.5, output: 10 },
+    "gpt-6-luna": { input: 0.1, cacheRead: 0.01, cacheWrite: 0.125, output: 0.5 },
     "gpt-5.6-sol": { input: 4, cacheRead: 0.4, cacheWrite: 5, output: 20 },
     "gpt-5.6": { input: 4, cacheRead: 0.4, cacheWrite: 5, output: 20 },
     "gpt-5.6-terra": { input: 2, cacheRead: 0.2, cacheWrite: 2.5, output: 12 },

package/dist/plugin/model-routing.d.ts

@@ -8,17 +8,17 @@ export interface RoleModelRoute {
 }
 export type ModelRoutingConfig = Readonly<Record<string, RoleModelRoute>>;
 /** The stable serial implementation route stays on Sol when Luna fan-out is unsafe or unavailable. */
-export declare const DEDICATED_WORKER_MODEL = "openai/gpt-5.6-sol";
+export declare const DEDICATED_WORKER_MODEL = "openai/gpt-6-sol";
 export declare const DEDICATED_WORKER_VARIANT = "medium";
 /** Luna executes only units admitted to the fabric; it is not the serial worker's fallback target. */
-export declare const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-5.6-luna";
+export declare const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-6-luna";
 export declare const LUNA_FABRIC_WORKER_VARIANT = "max";
 export declare const LUNA_FABRIC_WORKER_ROLE = "dog-luna-worker";
-/** The coordinator uses Terra High so routing and progress decisions do not bottleneck the workflow. */
-export declare const DEFAULT_COORDINATOR_MODEL = "openai/gpt-5.6-terra";
+/** The coordinator uses Sol 6 High so routing and progress decisions do not bottleneck the workflow. */
+export declare const DEFAULT_COORDINATOR_MODEL = "openai/gpt-6-sol";
 export declare const DEFAULT_COORDINATOR_VARIANT = "high";
 /** Compatibility names retained for the pre-v0.8 explicit Sol target. */
-export declare const ESCALATION_WORKER_MODEL = "openai/gpt-5.6-sol";
+export declare const ESCALATION_WORKER_MODEL = "openai/gpt-6-sol";
 export declare const ESCALATION_WORKER_VARIANT = "medium";
 export declare const DEDICATED_WORKER_ROLES: readonly ["implementation", "remediation", "blocker-resolution", "sol-worker-mk2a2", "dog-worker"];
 /** Ordered last-resort targets used only when the host proves a policy target unavailable. */
@@ -37,8 +37,8 @@ export declare const LUNA_FABRIC_WORKER_TARGET: ModelTarget;
 export declare const LUNA_FABRIC_WORKER_ROUTING: ModelRoutingConfig;
 export declare function fixedWorkerRouting(dedicatedTarget?: ModelTarget): ModelRoutingConfig;
 export declare const FIXED_MODEL_ROUTING: ModelRoutingConfig;
-export declare const RECOMMENDED_LUNA_MODEL = "openai/gpt-5.6-luna";
-/** Coordinator state and routing use Terra High; bounded evidence retrieval uses Luna High. */
+export declare const RECOMMENDED_LUNA_MODEL = "openai/gpt-6-luna";
+/** Coordinator state and routing use Sol 6 High; bounded evidence retrieval uses Luna High. */
 export declare const DEFAULT_COORDINATOR_ROUTING: ModelRoutingConfig;
 /** Evidence gathering is retrieval rather than reasoning, so the scout stays one effort tier lower. */
 export declare const RECOMMENDED_SCOUT_VARIANT = "high";

package/dist/plugin/model-routing.js

@@ -1,13 +1,13 @@
 import { CONSULTATION_ROLE_POLICY } from "../core/consultation.js";
 /** The stable serial implementation route stays on Sol when Luna fan-out is unsafe or unavailable. */
-export const DEDICATED_WORKER_MODEL = "openai/gpt-5.6-sol";
+export const DEDICATED_WORKER_MODEL = "openai/gpt-6-sol";
 export const DEDICATED_WORKER_VARIANT = "medium";
 /** Luna executes only units admitted to the fabric; it is not the serial worker's fallback target. */
-export const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-5.6-luna";
+export const LUNA_FABRIC_WORKER_MODEL = "openai/gpt-6-luna";
 export const LUNA_FABRIC_WORKER_VARIANT = "max";
 export const LUNA_FABRIC_WORKER_ROLE = "dog-luna-worker";
-/** The coordinator uses Terra High so routing and progress decisions do not bottleneck the workflow. */
-export const DEFAULT_COORDINATOR_MODEL = "openai/gpt-5.6-terra";
+/** The coordinator uses Sol 6 High so routing and progress decisions do not bottleneck the workflow. */
+export const DEFAULT_COORDINATOR_MODEL = "openai/gpt-6-sol";
 export const DEFAULT_COORDINATOR_VARIANT = "high";
 /** Compatibility names retained for the pre-v0.8 explicit Sol target. */
 export const ESCALATION_WORKER_MODEL = DEDICATED_WORKER_MODEL;
@@ -64,7 +64,7 @@ export function fixedWorkerRouting(dedicatedTarget = DEFAULT_DEDICATED_WORKER_TA
 export const FIXED_MODEL_ROUTING = fixedWorkerRouting();
 const fixedModelRoleSet = new Set(Object.keys(FIXED_MODEL_ROUTING));
 export const RECOMMENDED_LUNA_MODEL = LUNA_FABRIC_WORKER_MODEL;
-/** Coordinator state and routing use Terra High; bounded evidence retrieval uses Luna High. */
+/** Coordinator state and routing use Sol 6 High; bounded evidence retrieval uses Luna High. */
 export const DEFAULT_COORDINATOR_ROUTING = Object.freeze({
     "dog-coordinator": Object.freeze({
         preferred: Object.freeze({

package/dist/plugin/profiled.js

@@ -22,17 +22,17 @@ const SERIAL_OPTIONAL_ARGUMENTS = new Map([
             "scope", "trigger", "cause", "prevention", "evidence", "evidenceRef", "id", "promotedRef", "confirmation",
         ])],
 ]);
-const PREVIEW_WORKER_ROUTE = Object.freeze({ model: "openai/gpt-5.6-luna-fast", variant: "max" });
-const PREVIEW_SCOUT_ROUTE = Object.freeze({ model: "openai/gpt-5.6-luna-fast", variant: "xhigh" });
+const PREVIEW_WORKER_ROUTE = Object.freeze({ model: "openai/gpt-6-luna", variant: "max" });
+const PREVIEW_SCOUT_ROUTE = Object.freeze({ model: "openai/gpt-6-luna", variant: "xhigh" });
 /**
  * Contract authorship, not throughput. Qualification observed a cheaper operations model emit
  * structurally valid but under-scoped contracts: a write union narrower than the remediation the
  * review it also schedules demands, which strands an otherwise complete run on NEED_DECISION.
  */
-const PREVIEW_OPERATIONS_ROUTE = Object.freeze({ model: "openai/gpt-5.6-terra", variant: "xhigh" });
-const PREVIEW_PRIMARY_ROUTE = Object.freeze({ model: "openai/gpt-5.6-luna-fast", variant: "max" });
+const PREVIEW_OPERATIONS_ROUTE = Object.freeze({ model: "openai/gpt-6-sol", variant: "xhigh" });
+const PREVIEW_PRIMARY_ROUTE = Object.freeze({ model: "openai/gpt-6-luna", variant: "max" });
 /** Review must be able to reject the worker's output, so it never shares the worker's model family. */
-const PREVIEW_REVIEW_ROUTE = Object.freeze({ model: "openai/gpt-5.6-terra", variant: "xhigh" });
+const PREVIEW_REVIEW_ROUTE = Object.freeze({ model: "openai/gpt-6-sol", variant: "xhigh" });
 /** Every preview route the profile can bind a role to. Catalog declaration reads this one list. */
 const PREVIEW_ROUTES = Object.freeze([
     PREVIEW_PRIMARY_ROUTE, PREVIEW_WORKER_ROUTE, PREVIEW_SCOUT_ROUTE, PREVIEW_OPERATIONS_ROUTE,
@@ -55,9 +55,16 @@ export function processRemediationReplacementPacket(code, packet, cancelTool, pr
  */
 export function previewModelCatalog(routes = PREVIEW_ROUTES, base = BUILT_IN_MODEL_CATALOG.global ?? []) {
     const variantsOf = (model) => [...new Set(routes.filter(route => route.model === model).map(route => route.variant))];
-    const listed = new Set(base.map(entry => entry.model));
+    const mergedBase = new Map();
+    for (const entry of base) {
+        const prior = mergedBase.get(entry.model);
+        mergedBase.set(entry.model, prior === undefined
+            ? entry
+            : { model: entry.model, variants: [...new Set([...(prior.variants ?? []), ...(entry.variants ?? [])])] });
+    }
+    const listed = new Set(mergedBase.keys());
     return [
-        ...base.map(entry => {
+        ...[...mergedBase.values()].map(entry => {
             const variants = variantsOf(entry.model);
             return variants.length === 0
                 ? entry
@@ -398,6 +405,31 @@ export function createProfiledPlugin(profile, assetVersion) {
         const revisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
             ? stringSchema.describe(OPERATOR_PROPOSAL_REVISION_CONTRACT)
             : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_PROPOSAL_REVISION_CONTRACT };
+        const budgetRevisionContract = "Root-only: increase the cumulative read/submission limits of this exact unapproved submitted proposal. " +
+            "revision_json must encode exactly {proposal_id,revision,content_hash,rationale,proposal_budget:{max_reads,max_submissions}}. " +
+            "Pin the submitted identity from operator_status and supply user-authorized cumulative limits, strictly above retained spend and no lower than old limits. " +
+            "The current goal binding must still match. This changes neither proposal identity, ordered requirements, plan, goal, read evidence nor spent counters; " +
+            "it grants no new investigation Task, approval, execution or acceptance. Recompare the proposal before separately revising or approving it.";
+        const budgetRevisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(budgetRevisionContract)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: budgetRevisionContract };
+        const scopeReopenContract = "Root-only: after observing a newly missing implementation write path, reopen this exact unapproved submitted proposal " +
+            "for a bounded new investigation without cancellation or budget reset. revision_json must encode exactly " +
+            "{proposal_id,revision,content_hash,rationale,missing_write_paths:string[]}. Pin its current identity; every path must be an exact " +
+            "normalized repository-relative path absent from the submitted write scope and within the frozen intent.allow_read. " +
+            "The submitted contract is archived, ordered requirements, goal binding, intent, original source refs and cumulative spend are retained; " +
+            "old child and read paths grant no authority to the new child. This consumes a new goal dispatch unit only when its returned Task is admitted. " +
+            "Do not use this to retry a known field defect correctable by revise_operator_proposal or to claim any old acceptance.";
+        const scopeReopenSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(scopeReopenContract)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: scopeReopenContract };
+        const approvedRevisionContract = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,operator_run_id:string,rationale:nonblank single-line string,intent:object}. " +
+            "The intent has the exact begin_operator_proposal intent_json shape and a cumulative proposal_budget with room above all retained reads/submissions. " +
+            "Pin the approved proposal identity and the cancelled/completed run ID from operator_status. The new requirements must begin with every old ordered requirement byte-for-byte even if the active goal ID has changed. Only a root acting for a newly authorized active goal may revise; active/prepared runs, stale identity or unchanged goal binding are denied. " +
+            "Old acceptance, terminal status and proposal accounting remain durable. This returns an investigation Task, not implementation or acceptance.";
+        const approvedRevisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(approvedRevisionContract)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: approvedRevisionContract };
         const planContract = "plan_json must encode the exact operator plan object: schema_version, acceptance, acceptance_proof, source_refs, " +
             "goal_declaration, units, and optional git_lifecycle only. git_lifecycle exact shape is " +
             '{branch_create:{branch:string,start_ref:string},commit:{message:string},post_commit_validation:string[],remediation_reserve?:string[],remediation_scope_expansion?:string[]}. Its presence is root authorization for only a clean, non-overwriting ' +
@@ -424,6 +456,10 @@ export function createProfiledPlugin(profile, assetVersion) {
         const submitProposal = profileTool(profile, "sortie_submit_operator_proposal");
         const approveProposal = profileTool(profile, "sortie_approve_operator_proposal");
         const reviseProposal = profileTool(profile, "sortie_revise_operator_proposal");
+        const extendProposalBudget = profileTool(profile, "sortie_extend_operator_proposal_budget");
+        const reopenProposalScope = profileTool(profile, "sortie_reopen_operator_proposal_scope");
+        const reconcileOrphan = profileTool(profile, "sortie_reconcile_orphaned_operator_dispatch");
+        const reviseApprovedIntent = profileTool(profile, "sortie_revise_approved_operator_intent");
         async function stop(root, reason, retireRoot = true) {
             if (retireRoot)
                 retired.add(root);
@@ -560,13 +596,16 @@ export function createProfiledPlugin(profile, assetVersion) {
                     ? proposal.proposal_call_id !== null
                         ? "proposal Task is already admitted; do not redispatch it or call operator_next. Continue submission repairs only in the same active claimed child. If that child terminated or was interrupted without submission, an explicit root decision to retry may call cancel_operator with reason=plain to release this grant. Cancellation stops owned children and durably preserves cumulative reads/submissions and goal spend. Pass the returned retry_intent unchanged to begin_operator_proposal, then dispatch only its new exact Task within the remaining budget. Never reuse the terminated child, reset spend, or replace the goal or ordered requirements. Exhaustion requires an explicit cumulative budget revision, not a reset."
                         : proposal.submission_count >= proposal.intent.proposal_budget.max_submissions
-                            ? "proposal submission budget exhausted; do not call operator_next; report the bounded proposal failure"
+                            ? `proposal submission budget exhausted; do not call operator_next. For the exact same unapproved submitted proposal and active goal, an explicitly user-authorized cumulative increase can use ${extendProposalBudget}; retain all previous spend and compare the unchanged proposal again. Otherwise report the bounded failure.`
                             : "proposal is not submitted; do not call operator_next; complete or repair the bounded proposal submission"
                     : proposal?.phase === "submitted"
-                        ? `compare every original requirement with the exact proposal. For a known semantic defect, use ${reviseProposal} with its current identity and bounded field patches, then compare again; do not redispatch the ended child or cancel/reinvestigate the same defect. Approval preparation pins the plan and closes revision. Do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation, root-owned push/global apply and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation.`
-                        : "approved proposal has no operator run; do not call operator_next; reconcile the approval or preparation failure";
+                        ? `compare every original requirement with the exact proposal. For a known semantic defect, use ${reviseProposal} with its current identity and bounded field patches, then compare again; do not redispatch the ended child or cancel/reinvestigate the same defect. If exhausted, an explicitly user-authorized cumulative increase on this same submitted identity uses ${extendProposalBudget}. An observed missing implementation write path inside the frozen allow_read needs separate root-authorized ${reopenProposalScope}; this archives the old submission and returns a new read-only Task while retaining all spend. Approval preparation pins the plan and closes revision. Do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation, root-owned push/global apply and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation.`
+                        : state?.phase === "cancelled"
+                            ? `approved proposal remains pinned to a cancelled run. Do not call operator_next or reuse its Task. If the currently active goal differs, use ${reconcileOrphan} for one proven aborted native child reservation, then ${reviseApprovedIntent} with the exact cancelled run and retained ordered acceptance for a newly authorized investigation.`
+                            : "approved proposal has no operator run; do not call operator_next; reconcile the approval or preparation failure";
                 return JSON.stringify(state ? { ...await operatorPacket(state), ...(draft ? { pending_draft: draft } : {}),
-                    ...(proposal ? { proposal: proposalIdentity(proposal) } : {}) }
+                    ...(proposal ? { proposal: proposalIdentity(proposal), proposal_next_action: proposalNextAction } : {}),
+                    ...(state.phase === "cancelled" ? { orphan_recovery_action: `If the active goal has one reservation from an aborted owned V2 Task, use ${reconcileOrphan} only after native lineage and interrupt proof. If a terminal replacement run is still bound to a previous approved goal, use ${reviseApprovedIntent} with its exact identity, preserved ordered requirements and cumulative spend; it starts fresh investigation, not acceptance.` } : {}) }
                     : draft ? { ...draft, ...(proposal ? { proposal: proposals.packet(proposal) } : {}) }
                         : proposal ? { profile: profile.id, proposal: proposals.packet(proposal),
                             goal_binding: proposal.goal_binding, budget: await control.currentBudget(context.sessionID),
@@ -805,6 +844,33 @@ export function createProfiledPlugin(profile, assetVersion) {
                 return JSON.stringify({ ...proposals.packet(state), task: proposals.referenceTask(state),
                     dispatch_instruction: "Pass this short Task reference verbatim; do not append or paraphrase it." });
             } };
+        tools[reviseApprovedIntent] = { description: `Root-only: after a terminal cancelled/completed run, explicitly replace its approved proposal with a new user-authorized intent. Supply revision_json with exactly {proposal_id,revision,content_hash,operator_run_id,rationale,intent}; pin the approved identity and terminal run from operator_status. The intent has the exact ${beginProposal} intent_json shape and a cumulative proposal_budget strictly above retained reads/submissions. A current active goal with a changed binding and no outstanding reservations is required. The prior approved contract, ordered acceptance, terminal disposition and cumulative proposal spend are archived; the old run is never accepted, revived or overwritten. Active/prepared runs and stale identities are rejected. This grants one new investigation Task, not approval or execution.`,
+            args: { revision_json: approvedRevisionSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    let request;
+                    try {
+                        request = JSON.parse(args.revision_json);
+                    }
+                    catch {
+                        return JSON.stringify({ status: "invalid-approved-revision", code: "operator-proposal-approved-revision-json-invalid" });
+                    }
+                    try {
+                        const binding = await control.proposalGoalBinding(context.sessionID);
+                        await control.assertActiveGoal(context.sessionID, binding.acceptance_fingerprint);
+                        const revised = await proposals.reviseApproved(context.sessionID, context.sessionID, request, () => new OperatorRuntime(input.directory, profile).read(context.sessionID), binding, (oldGoalID, parentRunID) => control.proveApprovedRunAncestry(context.sessionID, oldGoalID, parentRunID));
+                        return JSON.stringify({ ...proposals.packet(revised), task: proposals.referenceTask(revised),
+                            dispatch_instruction: "Dispatch this new exact Task reference once; do not reuse the prior approved contract or its child." });
+                    }
+                    catch (error) {
+                        if (error instanceof OperatorProposalBudgetError)
+                            return JSON.stringify(error.diagnostic);
+                        if (!(error instanceof Error) || !error.message.startsWith("operator-proposal-"))
+                            throw error;
+                        return JSON.stringify({ status: "invalid-approved-revision", code: error.message });
+                    }
+                });
+            } };
         tools[submitProposal] = { description: "Proposal-child-only: submit a requirement-mapped contract proposal without editing source or starting workers. " + proposalContract + " Omit plan.acceptance; the host derives its exact ordered text from durable intent.requirements. A legacy explicit plan.acceptance is accepted only when byte-exact in content and order; null, subsets, reorder, normalization, and acceptance_ids aliases are rejected.",
             args: { proposal_json: proposalSchema }, execute: async (args, context) => {
                 const root = await rootFor(context.sessionID);
@@ -847,6 +913,57 @@ export function createProfiledPlugin(profile, assetVersion) {
                     }
                 });
             } };
+        tools[extendProposalBudget] = { description: budgetRevisionContract,
+            args: { revision_json: budgetRevisionSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    try {
+                        const binding = await control.proposalGoalBinding(context.sessionID);
+                        const revised = await proposals.extendSubmittedBudget(context.sessionID, context.sessionID, JSON.parse(args.revision_json), binding);
+                        return JSON.stringify({ ...proposals.packet(revised),
+                            next_action: "Compare all original ordered requirements against this unchanged proposal. Revise diagnosed fields within the remaining submission budget or explicitly approve; no worker was started." });
+                    }
+                    catch (error) {
+                        if (error instanceof SyntaxError)
+                            return JSON.stringify({ status: "invalid-budget-revision", code: "operator-proposal-budget-revision-json-invalid" });
+                        if (!(error instanceof Error) || !error.message.startsWith("operator-proposal-"))
+                            throw error;
+                        return JSON.stringify({ status: "invalid-budget-revision", code: error.message });
+                    }
+                });
+            } };
+        tools[reopenProposalScope] = { description: scopeReopenContract,
+            args: { revision_json: scopeReopenSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    try {
+                        const binding = await control.proposalGoalBinding(context.sessionID);
+                        await control.assertActiveGoal(context.sessionID, binding.acceptance_fingerprint);
+                        const reopened = await proposals.reopenSubmittedScope(context.sessionID, context.sessionID, JSON.parse(args.revision_json), binding);
+                        return JSON.stringify({ ...proposals.packet(reopened), task: proposals.referenceTask(reopened),
+                            dispatch_instruction: "Dispatch this new exact read-only Task once; investigate the newly missing surfaces and submit a complete plan. Never reuse the archived child or its read paths." });
+                    }
+                    catch (error) {
+                        if (error instanceof OperatorProposalBudgetError)
+                            return JSON.stringify(error.diagnostic);
+                        if (error instanceof SyntaxError)
+                            return JSON.stringify({ status: "invalid-scope-reopen", code: "operator-proposal-scope-reopen-json-invalid" });
+                        if (!(error instanceof Error) || !error.message.startsWith("operator-proposal-"))
+                            throw error;
+                        return JSON.stringify({ status: "invalid-scope-reopen", code: error.message });
+                    }
+                });
+            } };
+        tools[reconcileOrphan] = { description: "Root-only: after explicitly cancelling the operator, reconcile one orphaned goal reservation from an aborted native delegate and its still-running historical child Task. The host requires exact goal/call/Task identity, owned parent-child lineage, native timestamps, and acknowledged interruption of both owned sessions. It records interrupted lifecycle spend with no validation evidence or acceptance. If any proof is absent it returns unproven without settling the reservation; never use worker prose as proof.",
+            args: {}, execute: async (_args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    const run = await operators.read(context.sessionID);
+                    if (run?.phase !== "cancelled")
+                        return JSON.stringify({ status: "unproven", reason: "cancelled-operator-required" });
+                    return JSON.stringify(await control.reconcileAbortedOperatorOrphan(context.sessionID));
+                });
+            } };
         tools[approveProposal] = { description: "Root-only: record semantic comparison of the exact proposal revision/hash, then connect its immutable plan to the existing execution lane. " + OPERATOR_APPROVAL_CONTRACT,
             args: { approval_json: approvalSchema }, execute: async (args, context) => {
                 await requireRoot(context.sessionID);
@@ -886,7 +1003,8 @@ export function createProfiledPlugin(profile, assetVersion) {
                 });
             } };
         const ownTools = new Set([prepare, repair, next, status, cancel, complete, resume, resolveContractRepair,
-            beginProposal, submitProposal, approveProposal, reviseProposal]);
+            beginProposal, submitProposal, approveProposal, reviseProposal, extendProposalBudget, reopenProposalScope,
+            reconcileOrphan, reviseApprovedIntent]);
         const protocolMap = CANONICAL_AGENT_ROLES.map(role => `${role}=${profileAgent(profile, role)}`).join(", ");
         function rememberRendered(key, text) {
             renderedParts.set(key, goalFingerprint(text));

package/dist/plugin/runtime-bridge.d.ts

@@ -62,6 +62,13 @@ export interface RuntimeBridge {
         assertProposalExecutionBudget(rootSessionID: string, binding: OperatorProposalGoalBinding, executionUnits: number): Promise<void>;
         hasNoGoalReservation(rootSessionID: string, unitID: string, callID: string): Promise<boolean>;
         assertActiveGoal(rootSessionID: string, goalFingerprint: string): Promise<void>;
+        reconcileAbortedOperatorOrphan(rootSessionID: string): Promise<{
+            readonly status: "settled" | "no-orphan" | "unproven";
+            readonly reservation_id?: string;
+            readonly unit_id?: string;
+            readonly reason?: string;
+        }>;
+        proveApprovedRunAncestry(rootSessionID: string, oldGoalID: string, parentRunID: string): Promise<boolean>;
         retainOperatorContractRepairWorker(rootSessionID: string, taskID: string, childSessionID: string): Promise<void>;
         assertOperatorContractRepairValidationAvailable(rootSessionID: string, taskID: string, childSessionID: string): Promise<void>;
         remediationScopeExpansionAuthority(rootSessionID: string): Promise<string | undefined>;

package/dist/runtime-assets-v010.js

@@ -89,7 +89,7 @@ permission rejection shows a different project root, do not repeat that path; re
 const coordinatorContent = `---
 description: Sortie-dogs ${V010_RUNTIME_ASSET_VERSION} primary dog-operator — strategic authority with a bounded operations delegate.
 mode: primary
-model: openai/gpt-5.6-luna-fast
+model: openai/gpt-6-luna
 variant: max
 permission:
   question: allow
@@ -153,6 +153,14 @@ Every requirement entry must include kind="requirement" | "negative" | "quality"
 Use only authoritative_refs and allow_read for begin intent scope. project_root, source_refs, max_read_prefixes,
 authoritative_references, and other aliases are invalid. Do not guess a smaller contract after rejection: use this exact
 shape, preserving all ordered requirements, and omit proposal_budget only when the deterministic host default is intended.
+If the root already has an approved proposal, first finish or cancel its operator run. After a genuinely new user-authorized
+goal is active, use ${profile.toolPrefix}revise_approved_operator_intent with revision_json containing exactly the old
+proposal_id, revision, content_hash, terminal operator_run_id, a single-line rationale, and the complete new intent object.
+Pin the identity from operator_status. The host refuses active/prepared runs, stale identities, unchanged goal bindings,
+and budgets without room above cumulative proposal spend. It archives the old approved intent, ordered acceptance and
+terminal result before granting one new investigation Task. Within the same goal, retain the old ordered requirements
+byte-for-byte as a prefix of the new intent; a separate user-authorized goal may have a different order. No child, unit,
+acceptance or budget is revived or reset.
 Freeze product requirements from the original request, not extra implementation criteria invented from workflow
 bookkeeping. Keep proposal read/submission allowances in proposal_budget and host counters; do not turn spent
 budgets or your own reporting obligations into worker validation commands. Preserve any explicit user requirement.

package/dist/runtime-assets.d.ts

@@ -12,7 +12,7 @@ export declare const runtimeAssets: readonly [{
     readonly content: `---
 description: Canonical MkII coordinator packaged by Sortie-dogs
 mode: primary
-model: openai/gpt-5.6-terra
+model: openai/gpt-6-sol
 variant: high
 permission:
   question: allow
@@ -414,7 +414,7 @@ uses the run's shared time/cost limits. Use the existing compiled plan and Luna
 Call sortie_prepare_failure_swarm. Dispatch only its returned ready descriptors with
 dog-luna-worker and one failure_swarm_descriptor JSON line. The plugin binds source scope,
 read-only authority, distinct causes, cumulative budget, and the shared cancellable lifecycle.
-No diagnosis child may write or select a remedy. After findings finish, the coordinator (Terra by
+No diagnosis child may write or select a remedy. After findings finish, the coordinator (Sol 6 by
 default, or the user's explicitly selected coordinator) calls sortie_select_failure_diagnosis
 with swarm_id and one selection_json containing diagnosis_id, capsule_id, recovery_kind,
 proposal, and budget_request. Preserve its immutable scope/acceptance/validation contract and

package/dist/runtime-assets.js

@@ -241,7 +241,7 @@ export const runtimeAssets = [
         content: `---
 description: Canonical MkII coordinator packaged by Sortie-dogs
 mode: primary
-model: openai/gpt-5.6-terra
+model: openai/gpt-6-sol
 variant: high
 permission:
   question: allow
@@ -643,7 +643,7 @@ uses the run's shared time/cost limits. Use the existing compiled plan and Luna
 Call sortie_prepare_failure_swarm. Dispatch only its returned ready descriptors with
 dog-luna-worker and one failure_swarm_descriptor JSON line. The plugin binds source scope,
 read-only authority, distinct causes, cumulative budget, and the shared cancellable lifecycle.
-No diagnosis child may write or select a remedy. After findings finish, the coordinator (Terra by
+No diagnosis child may write or select a remedy. After findings finish, the coordinator (Sol 6 by
 default, or the user's explicitly selected coordinator) calls sortie_select_failure_diagnosis
 with swarm_id and one selection_json containing diagnosis_id, capsule_id, recovery_kind,
 proposal, and budget_request. Preserve its immutable scope/acceptance/validation contract and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.10.20",
+  "version": "0.10.23",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",