sortie-dogs 0.10.22 → 0.10.23

package/dist/core/operator-proposal.d.ts

@@ -5,7 +5,7 @@ export declare const DEFAULT_OPERATOR_PROPOSAL_BUDGET: Readonly<{
     max_submissions: 9;
 }>;
 export declare const OPERATOR_PROPOSAL_BUDGET_CAPS: Readonly<{
-    max_reads: 192;
+    max_reads: 228;
     max_submissions: 24;
 }>;
 export declare const OPERATOR_PROPOSAL_REVISION_CONTRACT: string;
@@ -94,6 +94,24 @@ export interface OperatorProposalState {
     /** Preparation may publish execution controls before approval commits; never revise that pinned plan. */
     approval_started?: boolean;
     root_revisions?: OperatorProposalRevision[];
+    /** Root-authorized cumulative increases; the submitted plan and its identity do not change. */
+    budget_revisions?: readonly {
+        readonly at: string;
+        readonly rationale: string;
+        readonly from: OperatorIntent["proposal_budget"];
+        readonly to: OperatorIntent["proposal_budget"];
+        readonly proposal_id: string;
+        readonly content_hash: string;
+        readonly goal_binding: OperatorProposalGoalBinding;
+    }[];
+    /** Submitted contracts displaced by a newly evidenced scope gap, never erased or approved. */
+    submitted_history?: readonly {
+        readonly archive_hash: string;
+        readonly proposal_id: string;
+        readonly revision: number;
+        readonly content_hash: string;
+        readonly missing_write_paths: readonly string[];
+    }[];
     /** Immutable archive identities of earlier approved contracts on this root. */
     approved_history?: readonly {
         readonly archive_hash: string;
@@ -162,8 +180,13 @@ export declare class OperatorProposalRuntime {
     private resolveTask;
     begin(root: string, raw: unknown): Promise<OperatorProposalState>;
     private beginUnlocked;
+    private submittedArchiveFile;
+    /** Increase a submitted proposal's cumulative allowance without replacing its goal, plan or investigation. */
+    extendSubmittedBudget(root: string, actor: string, raw: unknown, currentGoal: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
+    /** Reopen only a newly diagnosed scope gap in a submitted plan, preserving its exact archived identity. */
+    reopenSubmittedScope(root: string, actor: string, raw: unknown, currentGoal: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
     /** Explicit root-only transition after an approved contract's execution lane has ended. */
-    reviseApproved(root: string, actor: string, raw: unknown, readRun: () => Promise<OperatorState | undefined>, currentGoal: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
+    reviseApproved(root: string, actor: string, raw: unknown, readRun: () => Promise<OperatorState | undefined>, currentGoal: OperatorProposalGoalBinding, proveApprovedRunAncestry?: (oldGoalID: string, parentRunID: string) => Promise<boolean>): Promise<OperatorProposalState>;
     bindGoal(root: string, binding: OperatorProposalGoalBinding): Promise<OperatorProposalState>;
     private bindGoalUnlocked;
     admit(root: string, callID: string, args: unknown, reserveBudget?: () => Promise<void>): Promise<OperatorTask>;

package/dist/core/operator-proposal.js

@@ -9,7 +9,7 @@ const text = (value) => typeof value === "string" && value.trim().length > 0 &&
 const ORIGINAL_REQUEST_MAX_CHARACTERS = 128 * 1024;
 const ORIGINAL_REQUEST_MAX_BYTES = 128 * 1024;
 export const DEFAULT_OPERATOR_PROPOSAL_BUDGET = Object.freeze({ max_reads: 45, max_submissions: 9 });
-export const OPERATOR_PROPOSAL_BUDGET_CAPS = Object.freeze({ max_reads: 192, max_submissions: 24 });
+export const OPERATOR_PROPOSAL_BUDGET_CAPS = Object.freeze({ max_reads: 228, max_submissions: 24 });
 export const OPERATOR_PROPOSAL_REVISION_CONTRACT = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,rationale:nonblank single-line string,patches:array}. " +
     "Pin the current submitted identity from operator_status. patches contains 1..32 {op,path,value} objects. " +
     "replace is allowed only at /coverage, /existing_surface, /uncovered, /negative_handling, /read_scope, /plan/units, /plan/acceptance_proof, " +
@@ -558,8 +558,102 @@ export class OperatorProposalRuntime {
         await this.save(state);
         return state;
     }
+    submittedArchiveFile(root, intentID, proposalHash) {
+        return join(this.projectRoot, this.profile.stateDirectory, "operator-proposals", `${hash(root)}.${intentID}.${proposalHash}.submitted.json`);
+    }
+    /** Increase a submitted proposal's cumulative allowance without replacing its goal, plan or investigation. */
+    async extendSubmittedBudget(root, actor, raw, currentGoal) {
+        if (actor !== root)
+            throw new Error("operator-proposal-budget-revision-root-required");
+        return this.serial(root, async () => {
+            const state = await this.requiredUnlocked(root);
+            if (state.phase !== "submitted" || !state.proposal || !state.goal_binding || state.approval_started) {
+                throw new Error("operator-proposal-budget-revision-not-submitted");
+            }
+            if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "rationale", "proposal_budget"]) ||
+                !text(raw.proposal_id) || !Number.isSafeInteger(raw.revision) || !text(raw.content_hash) ||
+                !text(raw.rationale) || raw.rationale.length > 2000 || !record(raw.proposal_budget) ||
+                !exactSet(raw.proposal_budget, ["max_reads", "max_submissions"])) {
+                throw new Error("operator-proposal-budget-revision-invalid");
+            }
+            if (raw.proposal_id !== state.proposal_id || raw.revision !== state.proposal_revision ||
+                raw.content_hash !== state.proposal_hash)
+                throw new Error("operator-proposal-budget-revision-identity-mismatch");
+            if (JSON.stringify(currentGoal) !== JSON.stringify(state.goal_binding)) {
+                throw new Error("operator-proposal-budget-revision-goal-mismatch");
+            }
+            const before = state.intent.proposal_budget;
+            const budget = raw.proposal_budget;
+            const reads = budget.max_reads, submissions = budget.max_submissions;
+            if (!Number.isSafeInteger(reads) || !Number.isSafeInteger(submissions) ||
+                reads > OPERATOR_PROPOSAL_BUDGET_CAPS.max_reads || submissions > OPERATOR_PROPOSAL_BUDGET_CAPS.max_submissions ||
+                reads < before.max_reads || submissions < before.max_submissions ||
+                (reads === before.max_reads && submissions === before.max_submissions) ||
+                reads <= state.read_count || submissions <= state.submission_count) {
+                throw new Error("operator-proposal-budget-revision-range-invalid");
+            }
+            const next = { max_reads: reads, max_submissions: submissions };
+            const intent = { ...state.intent, proposal_budget: next };
+            // The intent hash protects the stored budget; the original intent ID and submitted proposal identity stay pinned.
+            const revised = { ...state, intent, intent_hash: hash(JSON.stringify(intent)),
+                budget_revisions: [...(state.budget_revisions ?? []), { at: new Date().toISOString(), rationale: raw.rationale,
+                        from: { ...before }, to: next, proposal_id: state.proposal_id, content_hash: state.proposal_hash,
+                        goal_binding: structuredClone(state.goal_binding) }] };
+            await this.save(revised);
+            return revised;
+        });
+    }
+    /** Reopen only a newly diagnosed scope gap in a submitted plan, preserving its exact archived identity. */
+    async reopenSubmittedScope(root, actor, raw, currentGoal) {
+        if (actor !== root)
+            throw new Error("operator-proposal-scope-reopen-root-required");
+        return this.serial(root, async () => {
+            const state = await this.requiredUnlocked(root);
+            if (state.phase !== "submitted" || !state.proposal || !state.goal_binding || state.approval_started) {
+                throw new Error("operator-proposal-scope-reopen-not-submitted");
+            }
+            if (!record(raw) || !exactSet(raw, ["proposal_id", "revision", "content_hash", "rationale", "missing_write_paths"]) ||
+                !text(raw.proposal_id) || !Number.isSafeInteger(raw.revision) || !text(raw.content_hash) ||
+                !text(raw.rationale) || raw.rationale.length > 2000 || !Array.isArray(raw.missing_write_paths) ||
+                raw.missing_write_paths.length < 1 || raw.missing_write_paths.length > 16 ||
+                !raw.missing_write_paths.every(normalizedRelativePath) ||
+                new Set(raw.missing_write_paths).size !== raw.missing_write_paths.length) {
+                throw new Error("operator-proposal-scope-reopen-invalid");
+            }
+            if (raw.proposal_id !== state.proposal_id || raw.revision !== state.proposal_revision ||
+                raw.content_hash !== state.proposal_hash)
+                throw new Error("operator-proposal-scope-reopen-identity-mismatch");
+            if (JSON.stringify(currentGoal) !== JSON.stringify(state.goal_binding)) {
+                throw new Error("operator-proposal-scope-reopen-goal-mismatch");
+            }
+            this.assertBudgetAvailable(state);
+            const oldWrites = state.proposal.write_scope;
+            const missing = raw.missing_write_paths;
+            if (missing.some(path => oldWrites.some(scope => path === scope || path.startsWith(`${scope}/`)) ||
+                !state.intent.allow_read.some(scope => path === scope || path.startsWith(`${scope}/`)))) {
+                throw new Error("operator-proposal-scope-reopen-path-invalid");
+            }
+            const archive = JSON.stringify({ submitted_proposal: state, missing_write_paths: missing, rationale: raw.rationale });
+            const archivePath = this.submittedArchiveFile(root, state.intent_id, state.proposal_hash);
+            try {
+                await writeFile(archivePath, archive, { flag: "wx", mode: 0o600 });
+            }
+            catch (error) {
+                if (error.code !== "EEXIST" || hash(await readFile(archivePath, "utf8")) !== hash(archive))
+                    throw error;
+            }
+            const reopened = { ...state, phase: "investigating", created_at: new Date().toISOString(),
+                prior_spend: { reads: state.read_count, submissions: state.submission_count },
+                proposal_call_id: null, proposal_session_id: null, read_paths: [], proposal_id: null, proposal_revision: null,
+                proposal_hash: null, proposal: null, approval_rationale: null,
+                submitted_history: [...(state.submitted_history ?? []), { archive_hash: hash(archive), proposal_id: state.proposal_id,
+                        revision: state.proposal_revision, content_hash: state.proposal_hash, missing_write_paths: missing }] };
+            await this.save(reopened);
+            return reopened;
+        });
+    }
     /** Explicit root-only transition after an approved contract's execution lane has ended. */
-    async reviseApproved(root, actor, raw, readRun, currentGoal) {
+    async reviseApproved(root, actor, raw, readRun, currentGoal, proveApprovedRunAncestry) {
         if (actor !== root)
             throw new Error("operator-proposal-approved-revision-root-required");
         return this.serial(root, async () => {
@@ -577,10 +671,15 @@ export class OperatorProposalRuntime {
                 throw new Error("operator-proposal-approved-revision-identity-mismatch");
             const run = await readRun();
             if (!run || !["cancelled", "completed"].includes(run.phase) || run.rootSessionID !== root ||
-                run.runID !== raw.operator_run_id || run.planHash !== hash(JSON.stringify(previous.proposal.plan)) ||
+                run.runID !== raw.operator_run_id ||
                 JSON.stringify(run.acceptance) !== JSON.stringify(previous.proposal.plan.acceptance)) {
                 throw new Error("operator-proposal-approved-revision-terminal-run-required");
             }
+            const originalPlan = run.planHash === hash(JSON.stringify(previous.proposal.plan));
+            if (!originalPlan && (!run.parentRunID || !proveApprovedRunAncestry ||
+                !await proveApprovedRunAncestry(previous.goal_binding.goal_id, run.parentRunID))) {
+                throw new Error("operator-proposal-approved-revision-terminal-run-required");
+            }
             if (!text(currentGoal.goal_id) || !Number.isSafeInteger(currentGoal.revision) || currentGoal.revision < 1 ||
                 !Number.isSafeInteger(currentGoal.scope_epoch) || currentGoal.scope_epoch < 1 ||
                 !/^sha256:[a-f0-9]{64}$/u.test(currentGoal.acceptance_fingerprint)) {
@@ -592,8 +691,7 @@ export class OperatorProposalRuntime {
             const intent = parseIntent(raw.intent), intentHash = hash(JSON.stringify(intent));
             if (intentHash === previous.intent_hash)
                 throw new Error("operator-proposal-approved-revision-intent-unchanged");
-            if (currentGoal.goal_id === previous.goal_binding.goal_id &&
-                JSON.stringify(intent.requirements.slice(0, previous.intent.requirements.length)) !== JSON.stringify(previous.intent.requirements)) {
+            if (JSON.stringify(intent.requirements.slice(0, previous.intent.requirements.length)) !== JSON.stringify(previous.intent.requirements)) {
                 throw new Error("operator-proposal-approved-revision-acceptance-continuity-required");
             }
             const remainingReads = intent.proposal_budget.max_reads - previous.read_count;
@@ -608,7 +706,8 @@ export class OperatorProposalRuntime {
             }
             const archive = JSON.stringify({ approved_proposal: previous, terminal_run: {
                     run_id: run.runID, plan_hash: run.planHash, acceptance: run.acceptance, acceptance_fingerprint: run.acceptanceFingerprint,
-                    phase: run.phase, decision: run.decision, receipt: run.receipt, generation: run.generation
+                    phase: run.phase, decision: run.decision, receipt: run.receipt, generation: run.generation,
+                    parent_run_id: originalPlan ? null : run.parentRunID
                 } });
             const archivePath = this.approvedArchiveFile(root, previous.intent_id, previous.proposal_hash, run.runID);
             try {
@@ -930,10 +1029,13 @@ export class OperatorProposalRuntime {
     packet(state) {
         return { status: state.phase, intent_id: state.intent_id, intent_hash: state.intent_hash,
             proposal_id: state.proposal_id, revision: state.proposal_revision, content_hash: state.proposal_hash, reads: state.read_count,
-            remaining_reads: state.intent.proposal_budget.max_reads - state.read_count, submissions: state.submission_count,
+            max_reads: state.intent.proposal_budget.max_reads, remaining_reads: state.intent.proposal_budget.max_reads - state.read_count,
+            submissions: state.submission_count, max_submissions: state.intent.proposal_budget.max_submissions,
             remaining_submissions: state.intent.proposal_budget.max_submissions - state.submission_count,
             task_admitted: state.proposal_call_id !== null, uncovered: state.proposal?.uncovered ?? [], proposal: state.proposal,
-            approval_rationale: state.approval_rationale, root_revisions: state.root_revisions ?? [], approved_history: state.approved_history ?? [],
+            approval_rationale: state.approval_rationale, root_revisions: state.root_revisions ?? [],
+            budget_revisions: state.budget_revisions ?? [], submitted_history: state.submitted_history ?? [],
+            approved_history: state.approved_history ?? [],
             revision_available: state.phase === "submitted" && !state.approval_started && state.submission_count < state.intent.proposal_budget.max_submissions };
     }
 }

package/dist/plugin/index.js

@@ -1617,13 +1617,63 @@ export const SortieDogsPlugin = async (input, options) => {
                             !isRecord(part.state) || !["completed", "error"].includes(String(part.state.status)) ||
                             !isRecord(part.state.input) || typeof part.state.input.prompt !== "string")
                             continue;
-                        const proposal = reservation.unit_id.startsWith("proposal:");
                         const role = String(part.state.input.subagent_type);
-                        if (proposal ? role !== "dog-operator" : !["dog-worker", "dog-luna-worker"].includes(role))
+                        const prompt = part.state.input.prompt;
+                        const proposal = reservation.unit_id.startsWith("proposal:");
+                        let unitID;
+                        // The profiled client maps the external V2 `dogs-coordinator` to this canonical role.
+                        if (role === "dog-operator" &&
+                            (prompt.startsWith("SORTIE_OPERATOR_DELEGATE_REF ") ||
+                                prompt.startsWith("SORTIE_OPERATOR_PROPOSAL_TASK_REF "))) {
+                            // Native V2 stores the short Task handle, not the expanded child prompt. The
+                            // handle's owner and unit must agree with the durable reservation and call ID.
+                            const prefix = prompt.startsWith("SORTIE_OPERATOR_DELEGATE_REF ")
+                                ? "SORTIE_OPERATOR_DELEGATE_REF " : "SORTIE_OPERATOR_PROPOSAL_TASK_REF ";
+                            let ref;
+                            try {
+                                ref = JSON.parse(prompt.slice(prefix.length));
+                            }
+                            catch {
+                                continue;
+                            }
+                            if (!isRecord(ref) || ref.r !== root || !/^[a-f0-9]{64}$/u.test(String(ref.h)) ||
+                                (prefix.startsWith("SORTIE_OPERATOR_DELEGATE") && !/^[a-f0-9]{64}$/u.test(String(ref.p))))
+                                continue;
+                            if (prefix.startsWith("SORTIE_OPERATOR_DELEGATE")) {
+                                if (ref.k !== "delegate" || typeof ref.n !== "string" ||
+                                    !Number.isSafeInteger(ref.g) || ref.g < 1 ||
+                                    !reservation.unit_id.startsWith(`${ref.n}-`) ||
+                                    !/^[1-9][0-9]*$/u.test(reservation.unit_id.slice(ref.n.length + 1)))
+                                    continue;
+                                unitID = reservation.unit_id;
+                            }
+                            else {
+                                if (ref.k !== "proposal" || typeof ref.i !== "string" ||
+                                    reservation.unit_id !== `proposal:${ref.i}`)
+                                    continue;
+                                unitID = reservation.unit_id;
+                            }
+                        }
+                        else if (["dog-worker", "dog-luna-worker"].includes(role)) {
+                            if (prompt.startsWith("SORTIE_OPERATOR_TASK_REF ")) {
+                                let ref;
+                                try {
+                                    ref = JSON.parse(prompt.slice("SORTIE_OPERATOR_TASK_REF ".length));
+                                }
+                                catch {
+                                    continue;
+                                }
+                                if (!isRecord(ref) || ref.r !== root || !/^[a-f0-9]{64}$/u.test(String(ref.h)) ||
+                                    !/^[a-f0-9]{64}$/u.test(String(ref.p)) || typeof ref.t !== "string")
+                                    continue;
+                                unitID = ref.t;
+                            }
+                            else {
+                                unitID = handoffValue(handoffEntries(prompt), ["task_id"]) ?? part.callID;
+                            }
+                        }
+                        if (unitID === undefined || (proposal && role !== "dog-operator"))
                             continue;
-                        const unitID = proposal
-                            ? reservation.unit_id
-                            : handoffValue(handoffEntries(part.state.input.prompt), ["task_id"]) ?? part.callID;
                         if (unitID !== reservation.unit_id || goalFingerprint({ goal_id: state.goal_id, unit_id: unitID,
                             call_id: part.callID }) !== reservation.reservation_id)
                             continue;
@@ -4028,12 +4078,13 @@ export const SortieDogsPlugin = async (input, options) => {
     async function serializeChatTransition(sessionID, operation) {
         const previous = chatTransitions.get(sessionID) ?? Promise.resolve();
         const current = previous.catch(() => undefined).then(operation);
-        chatTransitions.set(sessionID, current);
+        const tail = current.then(() => undefined, () => undefined);
+        chatTransitions.set(sessionID, tail);
         try {
-            await current;
+            return await current;
         }
         finally {
-            if (chatTransitions.get(sessionID) === current)
+            if (chatTransitions.get(sessionID) === tail)
                 chatTransitions.delete(sessionID);
         }
     }
@@ -7338,11 +7389,132 @@ export const SortieDogsPlugin = async (input, options) => {
         assertActiveGoal: async (root, fingerprint) => {
             if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
                 throw new Error("operator-coordinator-required");
+            await recoverCompletedGoalReservations(root);
             const goal = await currentGoal(root);
             if (!goal || goal.phase !== "active" || goal.receipt !== null || goal.acceptance_fingerprint !== fingerprint || goal.outstanding_reservations.length) {
                 throw new Error("operator-resume-goal-identity-mismatch");
             }
         },
+        reconcileAbortedOperatorOrphan: root => serializeChatTransition(root, async () => {
+            if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
+                throw new Error("operator-coordinator-required");
+            const ledger = await goalLedger(root), initial = (await ledger.readGoal()).state;
+            if (initial.phase !== "active" || initial.goal_id === null || initial.receipt !== null) {
+                return { status: "unproven", reason: "active-goal-required" };
+            }
+            if (initial.outstanding_reservations.length === 0)
+                return { status: "no-orphan" };
+            if (initial.outstanding_reservations.length !== 1)
+                return { status: "unproven", reason: "multiple-reservations" };
+            const reservation = initial.outstanding_reservations[0];
+            const unitID = reservation.unit_id, runID = unitID.replace(/-[1-9][0-9]*$/u, "");
+            if (reservation.session_id !== root || runID === unitID || !/^operator-[a-f0-9-]+$/u.test(runID) ||
+                input.client?.session?.children === undefined || input.client.session.messages === undefined ||
+                input.client.session.abort === undefined) {
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "owned-native-lineage-unavailable" };
+            }
+            const sessionAPI = input.client.session;
+            const messages = async (id) => {
+                const response = await sessionAPI.messages({ path: { id }, query: { directory: input.directory } });
+                return isRecord(response) && Array.isArray(response.data) ? response.data.filter(isRecord) : [];
+            };
+            const children = async (id) => {
+                const response = await sessionAPI.children({ path: { id }, query: { directory: input.directory } });
+                return isRecord(response) && Array.isArray(response.data) ? response.data.filter(isRecord) : [];
+            };
+            const nativeTaskParts = (history) => history.flatMap(message => isRecord(message.info) && message.info.role === "assistant" && Array.isArray(message.parts)
+                ? message.parts.filter(part => isRecord(part) && part.type === "tool" && part.tool === "task") : []);
+            const refFrom = (part, prefix) => {
+                const state = isRecord(part.state) ? part.state : undefined;
+                const toolInput = isRecord(state?.input) ? state.input : undefined;
+                if (typeof toolInput?.prompt !== "string" || !toolInput.prompt.startsWith(prefix))
+                    return undefined;
+                try {
+                    const ref = JSON.parse(toolInput.prompt.slice(prefix.length));
+                    return isRecord(ref) ? ref : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            };
+            const rootParts = nativeTaskParts(await messages(root));
+            const parentTasks = rootParts.filter(part => {
+                const state = isRecord(part.state) ? part.state : undefined;
+                const ref = refFrom(part, "SORTIE_OPERATOR_DELEGATE_REF ");
+                return state?.status === "error" && isRecord(state.error) && state.error.type === "aborted" &&
+                    ref?.k === "delegate" && ref.r === root && ref.n === runID &&
+                    /^[a-f0-9]{64}$/u.test(String(ref.p)) && /^[a-f0-9]{64}$/u.test(String(ref.h)) &&
+                    Number.isSafeInteger(ref.g) && ref.g > 0 &&
+                    isRecord(state.time) && typeof state.time.end === "number";
+            });
+            if (parentTasks.length !== 1)
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "terminal-parent-unproven" };
+            const parentEnd = parentTasks[0].state.time.end;
+            const parentRef = refFrom(parentTasks[0], "SORTIE_OPERATOR_DELEGATE_REF ");
+            const candidates = [];
+            for (const delegate of await children(root)) {
+                if (typeof delegate.id !== "string" || delegate.parentID !== root || delegate.agent !== "dog-operator")
+                    continue;
+                const parts = nativeTaskParts(await messages(delegate.id));
+                for (const part of parts) {
+                    const ref = refFrom(part, "SORTIE_OPERATOR_TASK_REF ");
+                    if (ref?.r !== root || ref.n !== runID || ref.t !== unitID || typeof part.callID !== "string" ||
+                        ref.p !== parentRef.p || ref.g !== parentRef.g || !/^[a-f0-9]{64}$/u.test(String(ref.h)) ||
+                        goalFingerprint({ goal_id: initial.goal_id, unit_id: unitID, call_id: part.callID }) !== reservation.reservation_id ||
+                        !isRecord(part.state) || part.state.status !== "running")
+                        continue;
+                    for (const worker of await children(delegate.id)) {
+                        if (typeof worker.id !== "string" || worker.parentID !== delegate.id ||
+                            !["dog-worker", "dog-luna-worker"].includes(String(worker.agent)))
+                            continue;
+                        const history = await messages(worker.id);
+                        const claimed = history.some(message => isRecord(message.info) && message.info.role === "user" &&
+                            Array.isArray(message.parts) && message.parts.some(textPart => isRecord(textPart) &&
+                            textPart.type === "text" && typeof textPart.text === "string" &&
+                            handoffValue(handoffEntries(textPart.text), ["task_id"]) === unitID));
+                        const lastActivity = Math.max(0, ...history.flatMap(message => isRecord(message.info) && isRecord(message.info.time) &&
+                            typeof message.info.time.created === "number" ? [message.info.time.created] : []));
+                        if (claimed && lastActivity > 0 && lastActivity <= parentEnd) {
+                            candidates.push({ delegate: delegate.id, worker: worker.id, callID: part.callID });
+                        }
+                    }
+                }
+            }
+            if (candidates.length !== 1)
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "stale-child-lineage-unproven" };
+            const candidate = candidates[0];
+            for (const id of [candidate.worker, candidate.delegate]) {
+                const acknowledgement = await sessionAPI.abort({ path: { id }, query: { directory: input.directory } });
+                const response = isRecord(acknowledgement) && isRecord(acknowledgement.data) ? acknowledgement.data : acknowledgement;
+                if (!isRecord(response) || typeof response.interrupted !== "boolean") {
+                    return { status: "unproven", reservation_id: reservation.reservation_id, reason: "native-interrupt-unconfirmed" };
+                }
+            }
+            const current = (await ledger.readGoal()).state;
+            if (current.phase !== "active" || current.receipt !== null ||
+                current.goal_id !== initial.goal_id || current.revision !== initial.revision ||
+                current.scope_epoch !== initial.scope_epoch || current.acceptance_fingerprint !== initial.acceptance_fingerprint ||
+                current.outstanding_reservations.length !== 1 ||
+                current.outstanding_reservations[0].reservation_id !== reservation.reservation_id) {
+                return { status: "unproven", reservation_id: reservation.reservation_id, reason: "goal-changed-during-interrupt" };
+            }
+            await ledger.appendGoal({ kind: "unit.settled", at: new Date().toISOString(), reservation_id: reservation.reservation_id,
+                receipt_id: goalFingerprint({ orphan_interrupted: candidate, reservation_id: reservation.reservation_id }),
+                goal_id: initial.goal_id, unit_id: unitID, disposition: "cancelled", result_class: "interrupted",
+                progress_fingerprint: null, evidence: [], elapsed_ms: null, cost_usd: null });
+            return { status: "settled", reservation_id: reservation.reservation_id, unit_id: unitID };
+        }),
+        proveApprovedRunAncestry: async (root, oldGoalID, parentRunID) => {
+            if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
+                throw new Error("operator-coordinator-required");
+            const { records } = await (await goalLedger(root)).readGoal();
+            if (!records.some(({ event }) => event.kind === "goal.accepted" && event.goal_id === oldGoalID))
+                return false;
+            return records.some(({ event }) => event.kind === "dispatch.reserved" && event.goal_id === oldGoalID &&
+                event.session_id === root && event.unit_id.startsWith(`${parentRunID}-`) &&
+                records.some(({ event: settled }) => settled.kind === "unit.settled" && settled.goal_id === oldGoalID &&
+                    settled.unit_id === event.unit_id && settled.reservation_id === event.reservation_id));
+        },
         retainOperatorContractRepairWorker: async (root, taskID, childSessionID) => {
             if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
                 throw new Error("operator-coordinator-required");

package/dist/plugin/profiled.js

@@ -405,9 +405,27 @@ export function createProfiledPlugin(profile, assetVersion) {
         const revisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
             ? stringSchema.describe(OPERATOR_PROPOSAL_REVISION_CONTRACT)
             : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: OPERATOR_PROPOSAL_REVISION_CONTRACT };
+        const budgetRevisionContract = "Root-only: increase the cumulative read/submission limits of this exact unapproved submitted proposal. " +
+            "revision_json must encode exactly {proposal_id,revision,content_hash,rationale,proposal_budget:{max_reads,max_submissions}}. " +
+            "Pin the submitted identity from operator_status and supply user-authorized cumulative limits, strictly above retained spend and no lower than old limits. " +
+            "The current goal binding must still match. This changes neither proposal identity, ordered requirements, plan, goal, read evidence nor spent counters; " +
+            "it grants no new investigation Task, approval, execution or acceptance. Recompare the proposal before separately revising or approving it.";
+        const budgetRevisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(budgetRevisionContract)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: budgetRevisionContract };
+        const scopeReopenContract = "Root-only: after observing a newly missing implementation write path, reopen this exact unapproved submitted proposal " +
+            "for a bounded new investigation without cancellation or budget reset. revision_json must encode exactly " +
+            "{proposal_id,revision,content_hash,rationale,missing_write_paths:string[]}. Pin its current identity; every path must be an exact " +
+            "normalized repository-relative path absent from the submitted write scope and within the frozen intent.allow_read. " +
+            "The submitted contract is archived, ordered requirements, goal binding, intent, original source refs and cumulative spend are retained; " +
+            "old child and read paths grant no authority to the new child. This consumes a new goal dispatch unit only when its returned Task is admitted. " +
+            "Do not use this to retry a known field defect correctable by revise_operator_proposal or to claim any old acceptance.";
+        const scopeReopenSchema = record(stringSchema) && typeof stringSchema.describe === "function"
+            ? stringSchema.describe(scopeReopenContract)
+            : { ...(record(stringSchema) ? stringSchema : { type: "string" }), description: scopeReopenContract };
         const approvedRevisionContract = "revision_json must encode exactly {proposal_id:string,revision:positive integer,content_hash:string,operator_run_id:string,rationale:nonblank single-line string,intent:object}. " +
             "The intent has the exact begin_operator_proposal intent_json shape and a cumulative proposal_budget with room above all retained reads/submissions. " +
-            "Pin the approved proposal identity and the cancelled/completed run ID from operator_status. For the same goal, the new requirements must begin with every old ordered requirement byte-for-byte. Only a root acting for a newly authorized active goal may revise; active/prepared runs, stale identity or unchanged goal binding are denied. " +
+            "Pin the approved proposal identity and the cancelled/completed run ID from operator_status. The new requirements must begin with every old ordered requirement byte-for-byte even if the active goal ID has changed. Only a root acting for a newly authorized active goal may revise; active/prepared runs, stale identity or unchanged goal binding are denied. " +
             "Old acceptance, terminal status and proposal accounting remain durable. This returns an investigation Task, not implementation or acceptance.";
         const approvedRevisionSchema = record(stringSchema) && typeof stringSchema.describe === "function"
             ? stringSchema.describe(approvedRevisionContract)
@@ -438,6 +456,9 @@ export function createProfiledPlugin(profile, assetVersion) {
         const submitProposal = profileTool(profile, "sortie_submit_operator_proposal");
         const approveProposal = profileTool(profile, "sortie_approve_operator_proposal");
         const reviseProposal = profileTool(profile, "sortie_revise_operator_proposal");
+        const extendProposalBudget = profileTool(profile, "sortie_extend_operator_proposal_budget");
+        const reopenProposalScope = profileTool(profile, "sortie_reopen_operator_proposal_scope");
+        const reconcileOrphan = profileTool(profile, "sortie_reconcile_orphaned_operator_dispatch");
         const reviseApprovedIntent = profileTool(profile, "sortie_revise_approved_operator_intent");
         async function stop(root, reason, retireRoot = true) {
             if (retireRoot)
@@ -575,13 +596,16 @@ export function createProfiledPlugin(profile, assetVersion) {
                     ? proposal.proposal_call_id !== null
                         ? "proposal Task is already admitted; do not redispatch it or call operator_next. Continue submission repairs only in the same active claimed child. If that child terminated or was interrupted without submission, an explicit root decision to retry may call cancel_operator with reason=plain to release this grant. Cancellation stops owned children and durably preserves cumulative reads/submissions and goal spend. Pass the returned retry_intent unchanged to begin_operator_proposal, then dispatch only its new exact Task within the remaining budget. Never reuse the terminated child, reset spend, or replace the goal or ordered requirements. Exhaustion requires an explicit cumulative budget revision, not a reset."
                         : proposal.submission_count >= proposal.intent.proposal_budget.max_submissions
-                            ? "proposal submission budget exhausted; do not call operator_next; report the bounded proposal failure"
+                            ? `proposal submission budget exhausted; do not call operator_next. For the exact same unapproved submitted proposal and active goal, an explicitly user-authorized cumulative increase can use ${extendProposalBudget}; retain all previous spend and compare the unchanged proposal again. Otherwise report the bounded failure.`
                             : "proposal is not submitted; do not call operator_next; complete or repair the bounded proposal submission"
                     : proposal?.phase === "submitted"
-                        ? `compare every original requirement with the exact proposal. For a known semantic defect, use ${reviseProposal} with its current identity and bounded field patches, then compare again; do not redispatch the ended child or cancel/reinvestigate the same defect. Approval preparation pins the plan and closes revision. Do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation, root-owned push/global apply and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation.`
-                        : "approved proposal has no operator run; do not call operator_next; reconcile the approval or preparation failure";
+                        ? `compare every original requirement with the exact proposal. For a known semantic defect, use ${reviseProposal} with its current identity and bounded field patches, then compare again; do not redispatch the ended child or cancel/reinvestigate the same defect. If exhausted, an explicitly user-authorized cumulative increase on this same submitted identity uses ${extendProposalBudget}. An observed missing implementation write path inside the frozen allow_read needs separate root-authorized ${reopenProposalScope}; this archives the old submission and returns a new read-only Task while retaining all spend. Approval preparation pins the plan and closes revision. Do not call operator_next before approval prepares a run. Approval authorizes implementation, not product acceptance. Preserve every required live measurement, consultation, root-owned push/global apply and user approval as pending acceptance obligations; canonical commands do not substitute for them. Use the host budget counters, not plan.goal_declaration.goal_budget_units, for remaining capacity; approval validates the retained goal binding and execution budget. A bounded diagnostic run may use cancel_operator after admission without inventing a plan validation command for cancellation.`
+                        : state?.phase === "cancelled"
+                            ? `approved proposal remains pinned to a cancelled run. Do not call operator_next or reuse its Task. If the currently active goal differs, use ${reconcileOrphan} for one proven aborted native child reservation, then ${reviseApprovedIntent} with the exact cancelled run and retained ordered acceptance for a newly authorized investigation.`
+                            : "approved proposal has no operator run; do not call operator_next; reconcile the approval or preparation failure";
                 return JSON.stringify(state ? { ...await operatorPacket(state), ...(draft ? { pending_draft: draft } : {}),
-                    ...(proposal ? { proposal: proposalIdentity(proposal) } : {}) }
+                    ...(proposal ? { proposal: proposalIdentity(proposal), proposal_next_action: proposalNextAction } : {}),
+                    ...(state.phase === "cancelled" ? { orphan_recovery_action: `If the active goal has one reservation from an aborted owned V2 Task, use ${reconcileOrphan} only after native lineage and interrupt proof. If a terminal replacement run is still bound to a previous approved goal, use ${reviseApprovedIntent} with its exact identity, preserved ordered requirements and cumulative spend; it starts fresh investigation, not acceptance.` } : {}) }
                     : draft ? { ...draft, ...(proposal ? { proposal: proposals.packet(proposal) } : {}) }
                         : proposal ? { profile: profile.id, proposal: proposals.packet(proposal),
                             goal_binding: proposal.goal_binding, budget: await control.currentBudget(context.sessionID),
@@ -834,7 +858,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                     try {
                         const binding = await control.proposalGoalBinding(context.sessionID);
                         await control.assertActiveGoal(context.sessionID, binding.acceptance_fingerprint);
-                        const revised = await proposals.reviseApproved(context.sessionID, context.sessionID, request, () => new OperatorRuntime(input.directory, profile).read(context.sessionID), binding);
+                        const revised = await proposals.reviseApproved(context.sessionID, context.sessionID, request, () => new OperatorRuntime(input.directory, profile).read(context.sessionID), binding, (oldGoalID, parentRunID) => control.proveApprovedRunAncestry(context.sessionID, oldGoalID, parentRunID));
                         return JSON.stringify({ ...proposals.packet(revised), task: proposals.referenceTask(revised),
                             dispatch_instruction: "Dispatch this new exact Task reference once; do not reuse the prior approved contract or its child." });
                     }
@@ -889,6 +913,57 @@ export function createProfiledPlugin(profile, assetVersion) {
                     }
                 });
             } };
+        tools[extendProposalBudget] = { description: budgetRevisionContract,
+            args: { revision_json: budgetRevisionSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    try {
+                        const binding = await control.proposalGoalBinding(context.sessionID);
+                        const revised = await proposals.extendSubmittedBudget(context.sessionID, context.sessionID, JSON.parse(args.revision_json), binding);
+                        return JSON.stringify({ ...proposals.packet(revised),
+                            next_action: "Compare all original ordered requirements against this unchanged proposal. Revise diagnosed fields within the remaining submission budget or explicitly approve; no worker was started." });
+                    }
+                    catch (error) {
+                        if (error instanceof SyntaxError)
+                            return JSON.stringify({ status: "invalid-budget-revision", code: "operator-proposal-budget-revision-json-invalid" });
+                        if (!(error instanceof Error) || !error.message.startsWith("operator-proposal-"))
+                            throw error;
+                        return JSON.stringify({ status: "invalid-budget-revision", code: error.message });
+                    }
+                });
+            } };
+        tools[reopenProposalScope] = { description: scopeReopenContract,
+            args: { revision_json: scopeReopenSchema }, execute: async (args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    try {
+                        const binding = await control.proposalGoalBinding(context.sessionID);
+                        await control.assertActiveGoal(context.sessionID, binding.acceptance_fingerprint);
+                        const reopened = await proposals.reopenSubmittedScope(context.sessionID, context.sessionID, JSON.parse(args.revision_json), binding);
+                        return JSON.stringify({ ...proposals.packet(reopened), task: proposals.referenceTask(reopened),
+                            dispatch_instruction: "Dispatch this new exact read-only Task once; investigate the newly missing surfaces and submit a complete plan. Never reuse the archived child or its read paths." });
+                    }
+                    catch (error) {
+                        if (error instanceof OperatorProposalBudgetError)
+                            return JSON.stringify(error.diagnostic);
+                        if (error instanceof SyntaxError)
+                            return JSON.stringify({ status: "invalid-scope-reopen", code: "operator-proposal-scope-reopen-json-invalid" });
+                        if (!(error instanceof Error) || !error.message.startsWith("operator-proposal-"))
+                            throw error;
+                        return JSON.stringify({ status: "invalid-scope-reopen", code: error.message });
+                    }
+                });
+            } };
+        tools[reconcileOrphan] = { description: "Root-only: after explicitly cancelling the operator, reconcile one orphaned goal reservation from an aborted native delegate and its still-running historical child Task. The host requires exact goal/call/Task identity, owned parent-child lineage, native timestamps, and acknowledged interruption of both owned sessions. It records interrupted lifecycle spend with no validation evidence or acceptance. If any proof is absent it returns unproven without settling the reservation; never use worker prose as proof.",
+            args: {}, execute: async (_args, context) => {
+                await requireRoot(context.sessionID);
+                return serializeDispatchTransition(context.sessionID, async () => {
+                    const run = await operators.read(context.sessionID);
+                    if (run?.phase !== "cancelled")
+                        return JSON.stringify({ status: "unproven", reason: "cancelled-operator-required" });
+                    return JSON.stringify(await control.reconcileAbortedOperatorOrphan(context.sessionID));
+                });
+            } };
         tools[approveProposal] = { description: "Root-only: record semantic comparison of the exact proposal revision/hash, then connect its immutable plan to the existing execution lane. " + OPERATOR_APPROVAL_CONTRACT,
             args: { approval_json: approvalSchema }, execute: async (args, context) => {
                 await requireRoot(context.sessionID);
@@ -928,7 +1003,8 @@ export function createProfiledPlugin(profile, assetVersion) {
                 });
             } };
         const ownTools = new Set([prepare, repair, next, status, cancel, complete, resume, resolveContractRepair,
-            beginProposal, submitProposal, approveProposal, reviseProposal, reviseApprovedIntent]);
+            beginProposal, submitProposal, approveProposal, reviseProposal, extendProposalBudget, reopenProposalScope,
+            reconcileOrphan, reviseApprovedIntent]);
         const protocolMap = CANONICAL_AGENT_ROLES.map(role => `${role}=${profileAgent(profile, role)}`).join(", ");
         function rememberRendered(key, text) {
             renderedParts.set(key, goalFingerprint(text));

package/dist/plugin/runtime-bridge.d.ts

@@ -62,6 +62,13 @@ export interface RuntimeBridge {
         assertProposalExecutionBudget(rootSessionID: string, binding: OperatorProposalGoalBinding, executionUnits: number): Promise<void>;
         hasNoGoalReservation(rootSessionID: string, unitID: string, callID: string): Promise<boolean>;
         assertActiveGoal(rootSessionID: string, goalFingerprint: string): Promise<void>;
+        reconcileAbortedOperatorOrphan(rootSessionID: string): Promise<{
+            readonly status: "settled" | "no-orphan" | "unproven";
+            readonly reservation_id?: string;
+            readonly unit_id?: string;
+            readonly reason?: string;
+        }>;
+        proveApprovedRunAncestry(rootSessionID: string, oldGoalID: string, parentRunID: string): Promise<boolean>;
         retainOperatorContractRepairWorker(rootSessionID: string, taskID: string, childSessionID: string): Promise<void>;
         assertOperatorContractRepairValidationAvailable(rootSessionID: string, taskID: string, childSessionID: string): Promise<void>;
         remediationScopeExpansionAuthority(rootSessionID: string): Promise<string | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.10.22",
+  "version": "0.10.23",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",