sortie-dogs 0.12.9 → 0.12.11

package/dist/asset-version.d.ts

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.12.9-mission-resume-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.12.11-operation-recovery-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,4 +3,4 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.12.9-mission-resume-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.12.11-operation-recovery-v1";

package/dist/core/goal-bound.d.ts

@@ -37,6 +37,8 @@ export interface GoalEvidence {
         readonly manifest_path: string;
         readonly source_paths: readonly string[];
         readonly candidate_paths: readonly string[];
+        /** Missing on legacy evidence: retain its original all-paths snapshot recipe. */
+        readonly source_policy?: "project-files-v1";
     };
     readonly execution: {
         readonly command: readonly string[];

package/dist/core/goal-bound.js

@@ -61,7 +61,8 @@ export function validGoalEvidence(value, state) {
     const protectedBindingValid = protectedBinding !== undefined && HASH.test(protectedBinding.manifest_hash) &&
         text(protectedBinding.project_root) && text(protectedBinding.manifest_path) && Array.isArray(protectedBinding.source_paths) &&
         protectedBinding.source_paths.every(text) && Array.isArray(protectedBinding.candidate_paths) &&
-        protectedBinding.candidate_paths.every(text);
+        protectedBinding.candidate_paths.every(text) &&
+        (protectedBinding.source_policy === undefined || protectedBinding.source_policy === "project-files-v1");
     const matches = criteria.length > 0 && criteria.length === value.measurement.criterion_ids.length &&
         criteria.every((criterion) => criterion.target === value.measurement.target &&
             criterion.entrypoint === value.measurement.entrypoint && criterion.workload === value.measurement.workload &&

package/dist/core/operator-mission.js

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { normalizeRelativePath } from "./path.js";
+import { normalizeRelativeScope } from "./path.js";
 import { parseOperatorPlan } from "./operator-runtime.js";
 import { profileAgent } from "./runtime-profile.js";
 const digest = (value) => createHash("sha256").update(value).digest("hex");
@@ -286,7 +286,7 @@ export function missionPlan(mission, raw) {
             const entries = value[field] ?? [];
             if (!Array.isArray(entries) || !entries.every(item => typeof item === "string"))
                 throw new Error(`mission-unit-${index + 1}: ${field} must be paths`);
-            return [...new Set(entries.map(item => normalizeRelativePath(item)))];
+            return [...new Set(entries.map(item => normalizeRelativeScope(item)))];
         };
         const ids = value.requirement_ids ?? mission.requirements.map(item => item.id);
         if (!Array.isArray(ids) || ids.length === 0 || !ids.every(id => mission.requirements.some(item => item.id === id))) {
@@ -331,26 +331,36 @@ export function missionPlan(mission, raw) {
         units });
 }
 export function missionPacket(mission, run) {
+    const currentReview = mission.review !== undefined && mission.review.runID === (run?.runID ?? mission.runID);
+    const reviewAccepted = currentReview && missionReviewAccepted(mission.review);
     return { mission_id: mission.id, phase: mission.phase, coordinator_session_id: mission.coordinator,
         requirements: mission.requirements, original_request_refs: mission.requests.map(item => `user:${item.id}`),
         submission: mission.submission, progress: mission.progress,
+        execution_summary: { completed_units: run?.units.filter(unit => unit.status === "succeeded").length ?? 0,
+            running_units: run?.units.filter(unit => unit.status === "running").map(unit => ({ id: unit.unit.id, title: unit.unit.title, child_session_id: unit.childSessionID })) ?? [],
+            pending_units: run?.units.filter(unit => unit.status === "pending").length ?? 0,
+            failed_units: run?.units.filter(unit => unit.status === "failed").length ?? 0,
+            historical_failed_attempts: mission.progress.filter(unit => unit.status === "failed").length,
+            accepted: mission.phase === "completed" },
         review: mission.review ? { risk_tags: mission.review.risk, verdict: mission.review.verdict,
+            run_id: mission.review.runID, current_run: currentReview,
             source_fingerprint: mission.review.source, reviewer_session_id: mission.review.child ?? null,
             result: mission.review.result ?? null, evidence_gap_reviews: mission.review.evidenceGapReviews ?? 0,
-            evidence_gap_review_limit: MISSION_EVIDENCE_GAP_REVIEW_LIMIT, accepted: missionReviewAccepted(mission.review),
-            passed: mission.review.verdict === "PASS", permits_submission: missionReviewAccepted(mission.review) } : null,
+            evidence_gap_review_limit: MISSION_EVIDENCE_GAP_REVIEW_LIMIT, accepted: reviewAccepted,
+            passed: currentReview && mission.review.verdict === "PASS", permits_submission: reviewAccepted } : null,
         ...(run ? { run_id: run.runID, status: run.phase, decision: run.decision,
             units: run.units.map(unit => ({ id: unit.unit.id, title: unit.unit.title, status: unit.status,
                 child_session_id: unit.childSessionID, result_class: unit.resultClass, evidence: unit.evidence })) } : {}),
-        next_action: mission.phase === "submitted" && mission.submission?.status === "ready"
-            ? "Operator: compare the submitted candidate with the original requirements and actual evidence, then complete_mission if satisfied. Report remaining evidence gaps; they are not a review PASS."
-            : run?.phase === "awaiting-decision" ? "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative."
-                : run?.phase === "awaiting-acceptance" ? (mission.review?.verdict === "evidence-gaps" && !missionReviewAccepted(mission.review)
-                    ? "Coordinator: the Reviewer found only missing evidence. Supply it through review_mission traces (or at most one evidence-only unit) and re-review once; do not re-implement. At the evidence-gap limit, submit_mission ready with the gaps listed."
-                    : mission.review && missionReviewAccepted(mission.review)
-                        ? "Coordinator: review permits submission. Submit the candidate with any remaining gaps; do not repeat passed validation or review. Operator performs final acceptance."
-                        : "Coordinator: address recorded findings or obtain the required independent review, then submit_mission. Operator compares all requirements with source/evidence before complete_mission.")
-                    : "Coordinator: continue the next useful unit within original requirements. Return only a completion candidate, user-only decision, or scope/budget extension." };
+        next_action: mission.phase === "completed" ? "Mission completed. Report the accepted result and retained review gaps; no further dispatch or completion call is needed."
+            : mission.phase === "submitted" && mission.submission?.status === "ready"
+                ? "Operator: compare the submitted candidate with the original requirements and actual evidence, then complete_mission if satisfied. Report remaining evidence gaps; they are not a review PASS."
+                : run?.phase === "awaiting-decision" ? "Coordinator: correct the cause and call plan_units with the remaining work and all requirements; budget is cumulative."
+                    : run?.phase === "awaiting-acceptance" ? (currentReview && mission.review?.verdict === "evidence-gaps" && !reviewAccepted
+                        ? "Coordinator: the Reviewer found only missing evidence. Supply it through review_mission traces (or at most one evidence-only unit) and re-review once; do not re-implement. At the evidence-gap limit, submit_mission ready with the gaps listed."
+                        : reviewAccepted
+                            ? "Coordinator: review permits submission. Submit the candidate with any remaining gaps; do not repeat passed validation or review. Operator performs final acceptance."
+                            : "Coordinator: address recorded findings or obtain the required independent review, then submit_mission. Operator compares all requirements with source/evidence before complete_mission.")
+                        : "Coordinator: continue the next useful unit within original requirements. Return only a completion candidate, user-only decision, or scope/budget extension." };
 }
 /** Models forward a short capability, never recopy the host's evidence hashes and source packet. */
 export function missionReviewTask(mission) {

package/dist/core/operator-runtime.d.ts

@@ -248,7 +248,11 @@ export declare class OperatorRuntime {
         sessionID: string;
         callID: string;
     }, supersededRunID?: string, terminalChildren?: readonly string[]): Promise<OperatorState>;
-    retireMissionRun(root: string): Promise<void>;
+    /** Stage a settled mission's replacement; rejected preparation never cancels the usable run. */
+    replanMission(root: string, runID: string, raw: unknown, dispatcher?: {
+        sessionID: string;
+        callID: string;
+    }): Promise<OperatorState>;
     private prepareOnce;
     operatorTask(state: OperatorState): OperatorTask;
     /** Root-visible handle for the bounded operations delegate; its contract stays host-internal. */

package/dist/core/operator-runtime.js

@@ -5,7 +5,7 @@ import { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { acceptanceContinuityFingerprint, inspectAcceptanceContinuity, normalizeAcceptanceCriteria, ACCEPTANCE_CONTINUITY_EXTENSION, MAX_ACCEPTANCE_CONTINUITY_BYTES, MAX_ACCEPTANCE_CRITERIA } from "./acceptance-continuity.js";
 import { expandGoalDeclaration, goalDeclarationDefaults, goalDeclarationFieldDiagnostics, hasGoalCommandAliasConflict } from "./goal-declaration-format.js";
-import { normalizeManifestPath, normalizeRelativePath } from "./path.js";
+import { normalizeManifestPath, normalizeManifestScope, normalizeRelativePath } from "./path.js";
 import { CONTRACT_TEXT_LIMITS, validateHandoffSchema, validateOperationManifestSchema } from "./validate-schema.js";
 import { validateManifest } from "./validate-manifest.js";
 import { profileAgent, RUNTIME_PROFILES } from "./runtime-profile.js";
@@ -44,7 +44,10 @@ const text = (value) => typeof value === "string" && value.trim().length > 0 &&
 export function operatorGitPathAuthorized(path, scopes, platform = process.platform) {
     const key = (value) => platform === "win32" ? value.toLowerCase() : value;
     const candidate = key(path);
-    return scopes.some(scope => candidate === key(scope) || candidate.startsWith(`${key(scope)}/`));
+    return scopes.some(scope => {
+        const base = key(normalizeManifestScope(scope).path);
+        return candidate === base || candidate.startsWith(`${base}/`);
+    });
 }
 const contractError = (diagnostic) => { throw new OperatorContractError([diagnostic]); };
 const planError = (pointer, code, rule, repair_kind = "repair-field") => contractError({ document: "plan", pointer, code, rule, repair_kind });
@@ -175,7 +178,7 @@ export function parseOperatorPlan(value) {
     for (const [unitIndex, unit] of value.units.entries()) {
         if (!record(unit) || !exactKeys(unit, ["id", "title", "objective", "read", "write", "validation", "acceptance_indices"]) ||
             !identifier(unit.id) || ids.has(unit.id) || !text(unit.title) || !text(unit.objective) ||
-            !strings(unit.read) || !strings(unit.write, true) || !strings(unit.validation, true))
+            !strings(unit.read) || !strings(unit.write) || !strings(unit.validation, true))
             return planError(`/units/${unitIndex}`, "operator-unit-invalid", "operator-unit-shape");
         unit.validation.forEach((command, index) => rejectValidationAnnotation(command, `/units/${unitIndex}/validation/${index}`));
         ids.add(unit.id);
@@ -686,19 +689,9 @@ export class OperatorRuntime {
     prepareMission(root, raw, dispatcher, supersededRunID, terminalChildren = []) {
         return this.serial(root, () => this.prepareOnce(root, raw, undefined, { dispatcher, supersededRunID, terminalChildren }));
     }
-    retireMissionRun(root) {
-        return this.serial(root, async () => {
-            const state = await this.required(root);
-            if (state.units.some(unit => unit.status === "running") || state.gitLifecycle !== null)
-                throw new Error("mission-replan-worker-still-active");
-            if (["cancelled", "completed"].includes(state.phase))
-                return;
-            // Keep the old run and proof for inspection. Replanning does not erase failed checks or spend.
-            await writeFile(`${this.file(root)}.${state.runID}.archive`, JSON.stringify(state), { flag: "wx", mode: 0o600 });
-            state.phase = "cancelled";
-            state.decision = "mission-replan";
-            await this.save(state);
-        });
+    /** Stage a settled mission's replacement; rejected preparation never cancels the usable run. */
+    replanMission(root, runID, raw, dispatcher) {
+        return this.serial(root, () => this.prepareOnce(root, raw, undefined, { dispatcher, replaceRunID: runID }));
     }
     async prepareOnce(root, raw, scopeApprovalTurnID, mission) {
         const previous = await this.read(root);
@@ -725,6 +718,16 @@ export class OperatorRuntime {
         }
         const plan = parseOperatorPlan(immutableReplacement);
         const validatedPlanHash = hash(JSON.stringify(plan));
+        const replanning = mission?.replaceRunID !== undefined;
+        if (replanning) {
+            if (!previous || previous.runID !== mission.replaceRunID || ["cancelled", "completed"].includes(previous.phase)) {
+                throw new Error("mission-replan-run-mismatch");
+            }
+            if (previous.units.some(unit => unit.status === "running") || previous.gitLifecycle !== null)
+                throw new Error("mission-replan-worker-still-active");
+            if (previous.planHash === validatedPlanHash)
+                return previous;
+        }
         if (mission?.supersededRunID !== undefined && previous?.supersededRunID === mission.supersededRunID &&
             previous.planHash === validatedPlanHash && previous.phase !== "cancelled")
             return previous;
@@ -750,14 +753,17 @@ export class OperatorRuntime {
         if (plan.git_lifecycle !== undefined) {
             await ensureGitManagedStateExcluded(this.projectRoot, this.profile, this.gitPath);
         }
-        if (previous && !["completed", "cancelled"].includes(previous.phase)) {
+        if (previous && !replanning && !["completed", "cancelled"].includes(previous.phase)) {
             if (previous.planHash === validatedPlanHash)
                 return previous;
             throw new Error("operator-active-contract-immutable");
         }
         // Cancellation stops execution, not the accepted user order. A replacement
         // plan must carry the original ordered criteria; only a completed root clears them.
-        const parent = (!superseding || retainAcceptance) && previous?.phase === "cancelled" ? previous : undefined;
+        // Treat the predecessor as retired only in this staged replacement. Its durable state remains
+        // intact through schema checks, control writes and archive creation, until save atomically switches it.
+        const parent = replanning ? { ...previous, phase: "cancelled", decision: "mission-replan" }
+            : (!superseding || retainAcceptance) && previous?.phase === "cancelled" ? previous : undefined;
         if (parent && ["explicit-cancellation", "agent-changed"].includes(parent.decision ?? "")) {
             const cancelled = parent.units.flatMap(unit => (parent.decision === "agent-changed" || unit.status === "cancelled") && unit.childSessionID !== null
                 ? [unit.childSessionID] : []);
@@ -897,13 +903,15 @@ export class OperatorRuntime {
             const contents = [JSON.stringify(handoff), JSON.stringify(manifest)];
             controls.push({ path: handoffPath, content: contents[0] }, { path: manifestPath, content: contents[1] });
             const prompt = ["role: implementation", `task_id: ${taskID}`, `project_root: ${this.projectRoot}`,
-                `source_manifest: ${unit.write.join(", ")}`, `operation_manifest: ${manifestRelative}`, `handoff_path: ${handoffPath}`,
+                `source_manifest: ${(unit.write.length ? unit.write : unit.read).join(", ") || "none"}`, `operation_manifest: ${manifestRelative}`, `handoff_path: ${handoffPath}`,
                 `goal_declaration_path: ${declarationPath}`, "acceptance:", ...plan.acceptance.map(value => `  - ${value}`),
                 "validation:", ...unit.validation.map(value => `  - ${value}`),
                 mission ? "Read-only investigation commands are unrestricted. Use shell to reproduce and diagnose without asking for command registration. Keep all writes, including generated/transient outputs and cleanup, inside unit.write. Run formal validation exactly as listed, in order and in separate calls, so the host records its real result. If a write scope or formal check must change, return the precise change to your Coordinator; it can extend/redeclare immediately within the original requirements. Diagnostic success is not formal acceptance evidence."
                     : "Execute validation in its declared order. Earlier entries may be approved generator, build, formatter, or exact cleanup commands required before canonical criterion tests. Every persistent or transient generator output must be declared in unit.write. Cleanup may remove only declared unit.write outputs and must be an explicit ordered command after generation and before post-commit or canonical validation; never add an ignore rule or remove an undeclared path. If any necessary command, input, output, or cleanup is missing, do not run an undeclared command or variant and do not use resume evidence tooling to invent permission; return a contract-repair decision.",
                 "Preserve existing public API success and error return semantics unless acceptance explicitly changes them, and cover those compatibility boundaries in the declared validation.",
-                "Do not spawn nested subagents for consultation. Required consultations belong to the root before dispatch; use the confirmed decisions and evidence declared in the unit objective and inputs. If required consultation results or user decisions are missing, return the exact contract gap to the parent instead of attempting a deeper Task, inventing consent, or asking the user to repeat an already recorded decision.",
+                mission
+                    ? "Do not spawn nested subagents for consultation. Required technical or user decisions that must precede implementation belong to the root before dispatch; use the confirmed decisions and evidence declared in the unit objective and inputs. If a required prior decision is missing, return the exact contract gap to the parent instead of implementing dependent changes, inventing consent, or asking the user to repeat an already recorded decision. Independent SourceReview is a separate post-implementation and post-validation review: do not require it before implementation or formal validation, and do not stop this Task solely because it has not yet occurred. Complete the assigned implementation and all listed formal validation commands, then return the real evidence so the Coordinator can dispatch the independent review_mission with applicable risk_tags (for example, public-logic). Do not conduct or delegate that independent review yourself. Reflect supplied prior Reviewer FINDINGS within this unit's scope."
+                    : "Do not spawn nested subagents for consultation. Required consultations belong to the root before dispatch; use the confirmed decisions and evidence declared in the unit objective and inputs. If required consultation results or user decisions are missing, return the exact contract gap to the parent instead of attempting a deeper Task, inventing consent, or asking the user to repeat an already recorded decision.",
                 ...(plan.git_lifecycle !== undefined && index === plan.units.length - 1 ? [
                     `git_post_commit_validation: ${JSON.stringify(plan.git_lifecycle.post_commit_validation)}`,
                     "Complete every source write before invoking any git_post_commit_validation command. Its first exact invocation is the host commit boundary; after it, source mutation and undeclared shell commands are denied. Run every listed command and return its real evidence.",
@@ -944,10 +952,19 @@ export class OperatorRuntime {
                     await handle.close();
                 }
             }
-            if (superseding && previous) {
-                const archive = `${this.file(root)}.${previous.runID}.archive`;
+            if ((superseding || replanning) && previous) {
+                // A crash before the state switch may leave a checkpoint while the old run later advances.
+                // Sequence-qualified replan snapshots keep that history without blocking a subsequent correction.
+                const archive = `${this.file(root)}.${previous.runID}${replanning ? `.${previous.sequence}` : ""}.archive`;
                 try {
-                    await writeFile(archive, JSON.stringify(previous), { flag: "wx", mode: 0o600 });
+                    const handle = await open(archive, "wx", 0o600);
+                    created.push(archive);
+                    try {
+                        await handle.writeFile(JSON.stringify(previous));
+                    }
+                    finally {
+                        await handle.close();
+                    }
                 }
                 catch (error) {
                     if (error.code !== "EEXIST" ||

package/dist/core/path.d.ts

@@ -21,3 +21,10 @@ export declare function normalizeRelativePath(input: string): string;
  * error instead of being resolved away.
  */
 export declare function normalizeManifestPath(input: string): ManifestPath;
+/** A trailing /** (or slash) declares a directory, including one not created yet.
+ * Tool destinations still use normalizeManifestPath: this notation belongs to declarations only.
+ */
+export declare function normalizeManifestScope(input: string): ManifestPath & {
+    readonly directory: boolean;
+};
+export declare function normalizeRelativeScope(input: string): string;

package/dist/core/path.js

@@ -52,3 +52,18 @@ export function normalizeManifestPath(input) {
     }
     return { kind: "relative", path: normalizeRelativePath(input) };
 }
+/** A trailing /** (or slash) declares a directory, including one not created yet.
+ * Tool destinations still use normalizeManifestPath: this notation belongs to declarations only.
+ */
+export function normalizeManifestScope(input) {
+    const unified = input.replaceAll("\\", "/");
+    const directory = unified.endsWith("/**") || unified.endsWith("/");
+    const path = unified.endsWith("/**") ? unified.slice(0, -3) : unified;
+    return { ...normalizeManifestPath(path), directory };
+}
+export function normalizeRelativeScope(input) {
+    const scope = normalizeManifestScope(input);
+    if (scope.kind !== "relative")
+        throw new RelativePathError("absolute");
+    return scope.path + (scope.directory ? "/**" : "");
+}

package/dist/core/validate-manifest.js

@@ -31,7 +31,7 @@ function collectManifestPaths(paths, pointer, diagnostics) {
     paths.forEach((path, index) => {
         let normalized;
         try {
-            normalized = pathUtils.normalizeManifestPath(path);
+            normalized = pathUtils.normalizeManifestScope(path);
         }
         catch (error) {
             if (!(error instanceof pathUtils.RelativePathError))
@@ -48,7 +48,7 @@ function collectManifestPaths(paths, pointer, diagnostics) {
         else if (normalized.kind === "relative") {
             // Absolute manifest targets authorize tools only. Handoff scope/source and Git paths remain
             // repository-relative and therefore never compare equal to an external target.
-            normalizedPaths.add(normalized.path);
+            normalizedPaths.add(normalized.path + (normalized.directory ? "/**" : ""));
         }
     });
     return normalizedPaths;
@@ -79,7 +79,7 @@ function addPathDiagnostics(diagnostics, paths, allowed, code, pointer) {
     const reported = new Set();
     paths.forEach((path, index) => {
         const normalized = normalizePath(path);
-        if (normalized !== undefined && (allowed.has(normalized) || reported.has(normalized)))
+        if (normalized !== undefined && (scopeAllows(allowed, normalized) || reported.has(normalized)))
             return;
         if (normalized !== undefined)
             reported.add(normalized);
@@ -91,6 +91,10 @@ function addPathDiagnostics(diagnostics, paths, allowed, code, pointer) {
         });
     });
 }
+function scopeAllows(scopes, path) {
+    return scopes.has(path) || [...scopes].some(scope => scope.endsWith("/**") &&
+        (path === scope.slice(0, -3) || path.startsWith(scope.slice(0, -2))));
+}
 /** Compare one schema-valid handoff with one schema-valid operation manifest. */
 export function validateManifest(handoff, manifest, changedPaths, changedPathsProvided, options = {}) {
     const diagnostics = [];
@@ -105,7 +109,7 @@ export function validateManifest(handoff, manifest, changedPaths, changedPathsPr
     handoff.sources?.forEach((source, index) => {
         const normalized = normalizePath(source.path);
         if (normalized !== undefined &&
-            (readableOrWritable.has(normalized) || reportedSources.has(normalized)))
+            (scopeAllows(readableOrWritable, normalized) || reportedSources.has(normalized)))
             return;
         if (normalized !== undefined)
             reportedSources.add(normalized);

package/dist/plugin/gate.js

@@ -2,7 +2,7 @@ import { execFile } from "node:child_process";
 import { lstat, realpath } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve, win32 } from "node:path";
 import { promisify } from "node:util";
-import { RelativePathError, normalizeManifestPath, normalizeRelativePath } from "../core/path.js";
+import { RelativePathError, normalizeManifestPath, normalizeManifestScope, normalizeRelativePath } from "../core/path.js";
 import { validateOperationManifestSchema } from "../core/validate-schema.js";
 export class WriteDeniedError extends Error {
     reason;
@@ -144,6 +144,13 @@ function curlOutput(tokens) {
                 return undefined;
             continue;
         }
+        if (token === "-w" || token === "--write-out" || token.startsWith("--write-out=")) {
+            const format = token.startsWith("--write-out=") ? token.slice(12) : tokens[++index];
+            // curl write-out can open additional files or read a format file. Only stdout metadata is pathless.
+            if (format === undefined || format.startsWith("@") || /%output\{/u.test(format))
+                return undefined;
+            continue;
+        }
         if (token === "-o" || token === "--output") {
             const candidate = tokens[++index];
             if (candidate === undefined || candidate.startsWith("-") || output !== undefined)
@@ -259,8 +266,40 @@ function isRemoteGitHubMutation(tokens) {
 function isReadOnlyGitCommand(tokens) {
     const command = tokens[1]?.toLowerCase() ?? "";
     return READ_ONLY_GIT_COMMANDS.has(command) ||
+        (command === "tag" && tokens.length >= 3 && ["--points-at", "--contains", "--list", "-l"].includes(tokens[2]) &&
+            tokens.slice(3).every(token => !token.startsWith("-"))) ||
         (command === "branch" && tokens.length === 3 && tokens[2] === "--show-current");
 }
+function gitArchiveOutput(tokens) {
+    let output, tree = false, paths = false;
+    for (let index = 2; index < tokens.length; index++) {
+        const token = tokens[index];
+        if (token === "--" && tree) {
+            paths = true;
+            continue;
+        }
+        if (paths || !token.startsWith("-")) {
+            tree = true;
+            continue;
+        }
+        if (token === "-o" || token === "--output") {
+            const value = tokens[++index];
+            if (!value || value.startsWith("-") || output !== undefined)
+                return undefined;
+            output = value;
+        }
+        else if (token.startsWith("--output=")) {
+            if (output !== undefined || !token.slice(9))
+                return undefined;
+            output = token.slice(9);
+        }
+        else if (/^--(?:format|prefix)=.+$/u.test(token) || /^-[0-9]$/u.test(token))
+            continue;
+        else
+            return undefined;
+    }
+    return tree ? { output } : undefined;
+}
 function exactGitAddPaths(tokens) {
     if (tokens.length < 4 || tokens[2] !== "--")
         return undefined;
@@ -632,6 +671,18 @@ function shellPaths(command, powershell, depth = 0) {
             else
                 ambiguous = true;
         }
+        else if (executable === "git" && tokens[1] === "archive") {
+            const archive = gitArchiveOutput(tokens);
+            if (archive === undefined) {
+                applies = true;
+                ambiguous = true;
+                issue ??= commandIssue(source, "unsupported-git-archive-form", "use git archive --format=tar --output=<scoped-file> <local-ref>");
+            }
+            else if (archive.output !== undefined) {
+                applies = true;
+                paths.push(archive.output);
+            }
+        }
         else if (executable === "git" && isReadOnlyGitCommand(tokens)) {
             // Explicitly read-only git subcommands.
         }
@@ -677,8 +728,10 @@ function shellPaths(command, powershell, depth = 0) {
         ...(issue ? { issue } : {}),
     };
 }
-function issuePath(issue) {
-    return `segment=${issue.segment}; cause=${issue.cause}; hint=${issue.hint}; retry=false; action=return-denial-to-coordinator`;
+function issuePath(issue, formatCorrection = false) {
+    return `segment=${issue.segment}; cause=${issue.cause}; hint=${issue.hint}; ` + (formatCorrection
+        ? "retry=after-format-correction; action=correct-format-within-current-manifest; preserve operation and destinations; otherwise return exact required correction to Coordinator"
+        : "retry=false; action=return-denial-to-coordinator");
 }
 export function describeUnclassifiedCommand(tool, args) {
     const extracted = extractWritePaths(tool, args);
@@ -925,7 +978,7 @@ function isWithin(root, target) {
 }
 async function canonicalManifestScopes(project, entries) {
     const scopes = await Promise.all(entries.map(async (entry) => {
-        const normalized = normalizeManifestPath(entry);
+        const normalized = normalizeManifestScope(entry);
         const absolute = normalized.kind === "relative"
             ? project.absolute(normalized.path)
             : resolve(normalized.path);
@@ -987,10 +1040,13 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
         }
     }
     const writable = new Set();
+    const explicitDirectories = new Set();
     const externalEntries = [];
     try {
         for (const entry of manifest.write) {
-            const normalized = normalizeManifestPath(entry);
+            const normalized = normalizeManifestScope(entry);
+            if (normalized.directory)
+                explicitDirectories.add(normalized.path);
             if (normalized.kind === "relative")
                 writable.add(normalized.path);
             else {
@@ -1015,7 +1071,7 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
             }
         }
         catch (error) {
-            if ((declaredDirectories.has(path) || inferredDirectories.has(path)) &&
+            if ((explicitDirectories.has(path) || declaredDirectories.has(path) || inferredDirectories.has(path)) &&
                 isRecord(error) && error.code === "ENOENT") {
                 writableDirectories.push({ path, realPath: await nearestExistingRealPath(project.absolute(path)) });
             }
@@ -1059,7 +1115,11 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
             if (!isRecord(error) || error.code !== "ENOENT") {
                 throw new WriteDeniedError("manifest-unavailable", "<unknown>", { cause: error });
             }
-            externalFiles.push({ path, anchorRealPath: await nearestExistingRealPath(resolve(path, "..")) });
+            if (explicitDirectories.has(path.replaceAll("\\", "/"))) {
+                externalDirectories.push({ path, realPath: await nearestExistingRealPath(path) });
+            }
+            else
+                externalFiles.push({ path, anchorRealPath: await nearestExistingRealPath(resolve(path, "..")) });
         }
     }
     const matchingExternalScopes = (absolute) => ({
@@ -1192,7 +1252,9 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
                 return;
             if (extracted.ambiguous || (extracted.paths.length === 0 && !extracted.gitCommit)) {
                 if (extracted.issue !== undefined) {
-                    throw new WriteDeniedError("unclassified-command", issuePath(extracted.issue));
+                    const formatCorrection = options?.investigativeShell === true &&
+                        ["unsupported-curl-form", "unsupported-git-archive-form", "unsupported-webrequest-form"].includes(extracted.issue.cause);
+                    throw new WriteDeniedError("unclassified-command", issuePath(extracted.issue, formatCorrection));
                 }
                 throw new WriteDeniedError("path-required", "<missing-path>");
             }
@@ -1208,7 +1270,15 @@ export async function createWriteGate(project, value, toolDirectory = project.ro
                         throw new WriteDeniedError("project-boundary", path, { cause: error });
                     }
                 }
-                await checkPath(nativeFileTool ? resolve(toolDirectory, path) : path);
+                try {
+                    await checkPath(nativeFileTool ? resolve(toolDirectory, path) : path);
+                }
+                catch (error) {
+                    if (options?.investigativeShell && error instanceof WriteDeniedError && error.reason === "manifest-scope") {
+                        error.message += " Coordinator: expand_unit with the exact missing output directory as dir/**, preserving settled units and cumulative spend; then dispatch the returned Task. No user approval is needed for an in-request correction.";
+                    }
+                    throw error;
+                }
             }
             if (extracted.gitCommit)
                 await checkCachedSet();

package/dist/plugin/goal-completion.d.ts

@@ -0,0 +1,17 @@
+import { type GoalEvidence, type GoalFlightState } from "../core/goal-bound.js";
+export interface CompletionBlocker {
+    readonly reason: "active-reservations" | "missing-contract" | "missing-evidence" | "missing-binding" | "snapshot-unavailable" | "source-changed" | "candidate-changed";
+    readonly criterion_id?: string;
+    readonly source_paths?: readonly string[];
+    readonly candidate_paths?: readonly string[];
+    readonly expected?: string;
+    readonly actual?: string;
+    readonly legacy_control_snapshot?: boolean;
+    readonly next_action: string;
+}
+export interface CompletionReadiness {
+    readonly ready: boolean;
+    readonly blockers: readonly CompletionBlocker[];
+}
+/** The same read-only decision drives completion and public status, without settling or rerunning work. */
+export declare function goalCompletionReadiness(state: GoalFlightState, evidence: readonly GoalEvidence[]): Promise<CompletionReadiness>;

package/dist/plugin/goal-completion.js

@@ -0,0 +1,55 @@
+import { validGoalEvidence } from "../core/goal-bound.js";
+import { isRuntimeControlPath, refreshProtectedSnapshot } from "./protected-snapshot.js";
+/** The same read-only decision drives completion and public status, without settling or rerunning work. */
+export async function goalCompletionReadiness(state, evidence) {
+    const blockers = [];
+    if (state.outstanding_reservations.length)
+        blockers.push({ reason: "active-reservations",
+            next_action: "Reconcile the outstanding native tasks before acceptance; do not repeat completion while work is reserved." });
+    if (!state.goal_id || !state.acceptance_fingerprint || !state.acceptance_contract?.criteria.length) {
+        blockers.push({ reason: "missing-contract", next_action: "Restore the current run's registered goal and unchanged requirements before completion." });
+    }
+    const snapshots = new Map();
+    for (const criterion of state.acceptance_contract?.criteria ?? []) {
+        const proof = [...evidence].reverse().find(entry => entry.measurement.criterion_ids.includes(criterion.criterion_id) && validGoalEvidence(entry, state));
+        if (!state.satisfied_criteria.includes(criterion.criterion_id) || !proof) {
+            blockers.push({ reason: "missing-evidence", criterion_id: criterion.criterion_id,
+                next_action: "Coordinator: obtain the missing criterion evidence within the existing requirements and cumulative budget; retain already valid checks." });
+            continue;
+        }
+        if (criterion.source_binding !== "current-protected" && criterion.candidate_binding !== "current-protected")
+            continue;
+        const binding = proof.protected_binding;
+        if (!binding) {
+            blockers.push({ reason: "missing-binding", criterion_id: criterion.criterion_id,
+                next_action: "Coordinator: obtain host-observed validation bound to this criterion; prose cannot replace a missing snapshot." });
+            continue;
+        }
+        const key = JSON.stringify(binding);
+        let pending = snapshots.get(key);
+        if (!pending) {
+            pending = refreshProtectedSnapshot(binding.project_root, binding).catch(() => undefined);
+            snapshots.set(key, pending);
+        }
+        const current = await pending;
+        const scope = { criterion_id: criterion.criterion_id, source_paths: binding.source_paths, candidate_paths: binding.candidate_paths };
+        if (!current) {
+            blockers.push({ ...scope, reason: "snapshot-unavailable",
+                next_action: "Inspect the pinned manifest and declared paths for missing, changed or unreadable files. Correct the identified cause before validation or completion; do not retry unchanged." });
+            continue;
+        }
+        if (criterion.source_binding === "current-protected" && current.source !== proof.identity.source) {
+            const legacy = !binding.source_policy && binding.source_paths.some(path => path === "" || path === "." || isRuntimeControlPath(path));
+            blockers.push({ ...scope, reason: "source-changed", expected: proof.identity.source, actual: current.source,
+                ...(legacy ? { legacy_control_snapshot: true } : {}),
+                next_action: legacy
+                    ? "Legacy evidence includes mutable runtime/Git records. Coordinator: obtain fresh evidence with the current snapshot policy in the same mission and cumulative budget. Do not edit the ledger, reset requirements, or repeat completion unchanged."
+                    : "Coordinator: inspect the changed source scopes and validate only the affected criterion after the candidate is settled; do not repeat unrelated passed checks or completion unchanged." });
+        }
+        if (criterion.candidate_binding === "current-protected" && current.candidate !== proof.identity.candidate) {
+            blockers.push({ ...scope, reason: "candidate-changed", expected: proof.identity.candidate, actual: current.candidate,
+                next_action: "Coordinator: the declared output changed after validation. Validate the intended current candidate and update its review before final acceptance; do not repeat completion unchanged." });
+        }
+    }
+    return { ready: blockers.length === 0, blockers };
+}

package/dist/plugin/index.js

@@ -7,7 +7,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { createHash, randomUUID } from "node:crypto";
-import { lstat, mkdir, open, readFile, readdir, readlink, realpath, rm, stat, writeFile } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, realpath, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { RUNTIME_ASSET_VERSION } from "../asset-version.js";
 import { GOAL_DECLARATION_FORMAT, GOAL_DELIVERY_INTENTS, GOAL_DELIVERY_MODES, GOAL_CRITERION_ENUMS, expandGoalDeclaration } from "../core/goal-declaration-format.js";
@@ -18,7 +18,7 @@ import { admitLunaFabric } from "../core/luna-fabric-contract.js";
 import { summarizeExperienceEvidence } from "../core/experience-evidence-summary.js";
 import { selectExperienceRoute } from "../core/experience-route-policy.js";
 import { resolveExperienceRouting } from "../core/experience-routing-runtime.js";
-import { normalizeManifestPath, normalizeRelativePath, RelativePathError } from "../core/path.js";
+import { normalizeRelativePath, RelativePathError } from "../core/path.js";
 import { ScopeLeaseError, ScopeLeaseRegistry } from "../core/scope-lease-registry.js";
 import { produceWorktreeCommitArtifact, recoverWorktreeCommitArtifact, resolveValidationExecutable, WorktreeCommitArtifactError, } from "../core/worktree-commit-artifact.js";
 import { normalizeWorktreeScope } from "../core/worktree-scope.js";
@@ -51,6 +51,8 @@ import { collectRunMetrics, createSortieResult, createGoalReport, insertRunMetri
 import { STABLE_RUNTIME_PROFILE } from "../core/runtime-profile.js";
 import { evidenceFromObservedExecution } from "../core/observed-goal-evidence.js";
 import { receiptBoundTerminalText } from "./receipt-presentation.js";
+import { protectedSnapshot, refreshProtectedSnapshot } from "./protected-snapshot.js";
+import { goalCompletionReadiness } from "./goal-completion.js";
 const INPUT_LIMITS = { config: 64 * 1024, manifest: 512 * 1024, handoff: 2 * 1024 * 1024, parallel: 512 * 1024 };
 const INSPECTION_CACHE = { maximum: 256, ttlMilliseconds: 30 * 60 * 1000 };
 const ACTIVE_SESSION_CACHE = { maximum: 256, ttlMilliseconds: 30 * 60 * 1000 };
@@ -233,94 +235,6 @@ async function durableScopeRoot(projectRoot) {
         return undefined;
     }
 }
-async function protectedScopeDigest(projectRoot, paths, manifestHash) {
-    const entries = [];
-    const canonicalRoot = await realpath(projectRoot);
-    const visit = async (absolute) => {
-        const scoped = relative(projectRoot, absolute).replaceAll("\\", "/");
-        if (scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped))
-            return false;
-        const metadata = await lstat(absolute).catch((error) => {
-            if (isRecord(error) && error.code === "ENOENT")
-                return undefined;
-            throw error;
-        });
-        if (metadata === undefined) {
-            entries.push([scoped, "missing"]);
-            return true;
-        }
-        if (metadata.isSymbolicLink()) {
-            // Package managers place executable links under node_modules/.bin. Record
-            // both the link and its target bytes, but never follow a link out of the
-            // project or recurse through a linked directory (which may form a cycle).
-            const target = await realpath(absolute).catch(() => undefined);
-            if (target === undefined)
-                return false;
-            const relativeTarget = relative(canonicalRoot, target);
-            if (relativeTarget === ".." || relativeTarget.startsWith("../") || isAbsolute(relativeTarget) ||
-                !(await stat(target)).isFile())
-                return false;
-            const link = await readlink(absolute);
-            const contents = await readFile(target);
-            entries.push([scoped, `symlink:${link}`, createHash("sha256").update(contents).digest("hex")]);
-            return true;
-        }
-        if (metadata.isDirectory()) {
-            entries.push([scoped, "directory"]);
-            const children = await readdir(absolute);
-            for (const child of children.sort())
-                if (!await visit(join(absolute, child)))
-                    return false;
-            return true;
-        }
-        if (!metadata.isFile())
-            return false;
-        entries.push([scoped, "file", createHash("sha256").update(await readFile(absolute)).digest("hex")]);
-        return true;
-    };
-    for (const path of [...new Set(paths)].sort())
-        if (!await visit(path))
-            return undefined;
-    return goalFingerprint({ manifest_hash: `sha256:${manifestHash}`, entries });
-}
-async function protectedSnapshot(authorization) {
-    const manifestSource = await readFile(authorization.manifestPath).catch(() => undefined);
-    if (manifestSource === undefined)
-        return undefined;
-    const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
-    if (manifestHash !== authorization.manifestHash)
-        return undefined;
-    const relativePath = relative(authorization.projectRoot, authorization.manifestPath).replaceAll("\\", "/");
-    const manifest = JSON.parse(manifestSource.toString("utf8"));
-    const actualPaths = (entries) => entries.map((entry) => {
-        const path = normalizeManifestPath(entry);
-        return path.kind === "relative" ? resolve(authorization.projectRoot, path.path) : resolve(path.path);
-    });
-    // Ownership keys may be case-folded even on POSIX (for example DrvFS). Hash the actual manifest paths.
-    const candidatePaths = actualPaths(manifest.write);
-    const sourcePaths = [...new Set([...actualPaths(manifest.read), ...candidatePaths])];
-    const source = await protectedScopeDigest(authorization.projectRoot, sourcePaths, manifestHash);
-    const candidate = await protectedScopeDigest(authorization.projectRoot, candidatePaths, manifestHash);
-    if (source === undefined || candidate === undefined || relativePath.startsWith("../") || isAbsolute(relativePath))
-        return undefined;
-    return { binding: { manifest_hash: `sha256:${manifestHash}`, project_root: authorization.projectRoot,
-            manifest_path: relativePath,
-            source_paths: sourcePaths.map((path) => relative(authorization.projectRoot, path).replaceAll("\\", "/")),
-            candidate_paths: candidatePaths.map((path) => relative(authorization.projectRoot, path).replaceAll("\\", "/")) },
-        source, candidate };
-}
-async function refreshProtectedSnapshot(projectRoot, binding) {
-    const manifestPath = resolve(projectRoot, binding.manifest_path);
-    const manifestSource = await readFile(manifestPath).catch(() => undefined);
-    if (manifestSource === undefined)
-        return undefined;
-    const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
-    if (`sha256:${manifestHash}` !== binding.manifest_hash)
-        return undefined;
-    const source = await protectedScopeDigest(projectRoot, binding.source_paths.map((path) => resolve(projectRoot, path)), manifestHash);
-    const candidate = await protectedScopeDigest(projectRoot, binding.candidate_paths.map((path) => resolve(projectRoot, path)), manifestHash);
-    return source === undefined || candidate === undefined ? undefined : { source, candidate };
-}
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1919,34 +1833,23 @@ export const SortieDogsPlugin = async (input, options) => {
                     origin_user_message_id: ticket.origin_user_message_id,
                 } } };
     }
-    async function terminalGoal(sessionID, stopReason, status, explicitAcceptance = false) {
+    async function terminalGoal(sessionID, stopReason, status, explicitAcceptance = false, onReadiness) {
         const ledger = await goalLedger(sessionID);
-        const state = (await ledger.readGoal()).state;
-        if (state.goal_id === null || state.receipt !== null || state.outstanding_reservations.length > 0 || state.acceptance_fingerprint === null)
-            return state.receipt ?? undefined;
+        const { state, records } = await ledger.readGoal();
+        if (state.receipt !== null)
+            return state.receipt;
         if (status === "succeeded" && !explicitAcceptance &&
             await input.runtimeBridge?.requiresExplicitAcceptance?.(sessionID) === true)
             return undefined;
-        const records = (await ledger.readGoal()).records;
         const settledEvidence = records.flatMap(({ event }) => event.kind === "unit.settled" || event.kind === "unit.evidence-reconciled" ? event.evidence : []);
-        if (status === "succeeded" && (state.acceptance_contract === null ||
-            state.acceptance_contract.criteria.length === 0 ||
-            !state.acceptance_contract.criteria.every(({ criterion_id }) => state.satisfied_criteria.includes(criterion_id))))
-            return undefined;
-        if (status === "succeeded" && state.acceptance_contract !== null) {
-            for (const criterion of state.acceptance_contract.criteria) {
-                if (criterion.source_binding !== "current-protected" && criterion.candidate_binding !== "current-protected")
-                    continue;
-                const evidence = [...settledEvidence].reverse().find((entry) => entry.measurement.criterion_ids.includes(criterion.criterion_id) && validGoalEvidence(entry, state));
-                if (evidence?.protected_binding === undefined)
-                    return undefined;
-                const current = await refreshProtectedSnapshot(evidence.protected_binding.project_root, evidence.protected_binding).catch(() => undefined);
-                if (current === undefined ||
-                    (criterion.source_binding === "current-protected" && current.source !== evidence.identity.source) ||
-                    (criterion.candidate_binding === "current-protected" && current.candidate !== evidence.identity.candidate))
-                    return undefined;
-            }
+        if (status === "succeeded") {
+            const readiness = await goalCompletionReadiness(state, settledEvidence);
+            onReadiness?.(readiness);
+            if (!readiness.ready)
+                return undefined;
         }
+        if (state.goal_id === null || state.outstanding_reservations.length > 0 || state.acceptance_fingerprint === null)
+            return undefined;
         const started = [...records].reverse().find(({ event }) => event.kind === "goal.accepted")?.event.at ?? new Date().toISOString();
         const ended = new Date().toISOString();
         const startTime = Date.parse(started);
@@ -7857,7 +7760,10 @@ export const SortieDogsPlugin = async (input, options) => {
                 return null;
             const reserved = state.outstanding_reservations.length;
             return { max_units: state.budget.max_units, consumed_units: state.consumed_units,
-                reserved_units: reserved, remaining_units: Math.max(0, state.budget.max_units - state.consumed_units - reserved) };
+                reserved_units: reserved, remaining_units: Math.max(0, state.budget.max_units - state.consumed_units - reserved),
+                settled_cost_usd: state.consumed_cost_usd, cost_limit_usd: state.budget.cost_usd,
+                cost_status: state.consumed_cost_usd === null ? "unknown-usage" : reserved > 0 ? "in-flight-not-final" : "settled",
+                cost_note: "Goal Worker ledger only; excludes unfinalized native requests, orchestration/review and external campaign spend. Zero settled cost does not mean free execution." };
         },
         registerGoalDeclaration: async (root, prompt, missionRevision) => {
             if (!isCoordinatorSession(root) && !await recoverCoordinatorRoot(root))
@@ -8006,6 +7912,10 @@ export const SortieDogsPlugin = async (input, options) => {
             return !snapshot.records.some(({ event }) => event.kind === "dispatch.reserved" && event.reservation_id === expected);
         },
         recoverUnitEvidence,
+        completionReadiness: async (root) => {
+            const { state, records } = await (await goalLedger(root)).readGoal();
+            return goalCompletionReadiness(state, records.flatMap(({ event }) => event.kind === "unit.settled" || event.kind === "unit.evidence-reconciled" ? event.evidence : []));
+        },
         completeRoot: async (sessionID, acceptanceFingerprint) => {
             if (!isCoordinatorSession(sessionID) && !await recoverCoordinatorRoot(sessionID))
                 throw new Error("operator-coordinator-required");
@@ -8017,9 +7927,10 @@ export const SortieDogsPlugin = async (input, options) => {
                 throw new Error("operator-goal-stopped");
             // Same proof/freshness/reservation gate used by terminal text, requested
             // explicitly by the root instead of inferred from a model's wording.
-            const receipt = goal.receipt ?? await terminalGoal(sessionID, "completed", "succeeded", true);
+            let completion;
+            const receipt = goal.receipt ?? await terminalGoal(sessionID, "completed", "succeeded", true, result => { completion = result; });
             if (receipt?.status !== "succeeded")
-                return { status: "awaiting-evidence" };
+                return { status: "awaiting-evidence", completion };
             // Acceptance must return its receipt to the active tool call. Revoking
             // continuation timers is not a user-requested session cancellation.
             await continuation.stopAutomaticRecovery(sessionID, false, true);

package/dist/plugin/mission-review.js

@@ -8,6 +8,7 @@ import { TOOL_ENVIRONMENT } from "../runtime-mission-assets.js";
 import { MISSION_REVIEW_REFERENCE } from "../core/operator-mission.js";
 import { canonicalAgent } from "../core/runtime-profile.js";
 import { taskChildSessionID } from "./task-result-repair.js";
+import { normalizeManifestScope } from "../core/path.js";
 const exec = promisify(execFile);
 const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 /** Recover from native completion records, never from the pending review's inherited child ID. */
@@ -75,7 +76,7 @@ export async function completedMissionReviewPrompts(mission, profile, root, requ
 /** Pin all scoped tracked/untracked source bytes, including deletions; display a bounded excerpt only. */
 export async function missionReviewSource(directory, run) {
     const hash = createHash("sha256").update(JSON.stringify(run.units.map(unit => ({ unit: unit.unit, hashes: unit.hashes }))));
-    const writes = [...new Set(run.units.flatMap(unit => unit.unit.write))];
+    const writes = [...new Set(run.units.flatMap(unit => unit.unit.write).map(path => path === "." ? path : normalizeManifestScope(path).path))];
     if (writes.length === 0)
         return { fingerprint: `sha256:${hash.digest("hex")}`,
             excerpt: "[Read-only units: no declared output files. Review the supplied observations, traces and validation evidence.]" };

package/dist/plugin/profiled.js

@@ -751,7 +751,9 @@ export function createProfiledPlugin(profile, assetVersion) {
                         : `Use these host counters, not the model-authored goal_budget_units estimate. Continue the same-goal remediation in this turn within unchanged acceptance and approved scope; normal time, cost, validation and dispatch gates still apply. ${packet.next_action}`;
                 packet.next_action = `${counters} ${action}`;
             }
-            return { ...packet, budget };
+            const completion = state.phase === "awaiting-acceptance" ? await control.completionReadiness(state.rootSessionID) : undefined;
+            return { ...packet, budget, ...(completion ? { completion,
+                    ...(!completion.ready ? { next_action: completion.blockers.map(item => item.next_action).join("\n") } : {}) } : {}) };
         }
         /**
          * Proposal accounting without the submitted packet body.
@@ -772,7 +774,15 @@ export function createProfiledPlugin(profile, assetVersion) {
                 const mission = root && context.sessionID === root ? await reconcileMissionDispatch(root) : root ? await missions.read(root) : undefined;
                 // Observation is available to every owned role. Only the root reconciles dispatch above.
                 if (mission) {
-                    return JSON.stringify({ ...missionDispatchPacket(mission, await operators.read(root)), budget: await control.currentBudget(root) });
+                    const run = await operators.read(root);
+                    const completion = run?.phase === "awaiting-acceptance" ? await control.completionReadiness(root) : undefined;
+                    return JSON.stringify({ ...missionDispatchPacket(mission, run), budget: await control.currentBudget(root),
+                        ...(completion ? { completion, ...(!completion.ready ? { next_action: completion.blockers.map(item => item.next_action).join("\n") } : {}) } : {}) });
+                }
+                if (root && context.sessionID !== root) {
+                    const owned = await operators.read(root);
+                    if (owned?.units.some(unit => unit.childSessionID === context.sessionID))
+                        return JSON.stringify(await operatorPacket(owned));
                 }
                 await requireRoot(context.sessionID);
                 const relocated = await relocatedMission(context.sessionID);
@@ -910,13 +920,16 @@ export function createProfiledPlugin(profile, assetVersion) {
                 if (input.returnReportTransport === "tool-result" && result.receipt?.status === "succeeded") {
                     const text = `✅ **DONE** \`${state.runID}\` — ${state.acceptance.length} acceptance requirements verified.\n\n` +
                         `**変更点:** ${state.units.map(unit => unit.unit.title).join("; ")}\n\n` +
-                        `**確認結果:** PASS — ${[...new Set(state.units.flatMap(unit => unit.unit.validation))].join("; ")}\n\n**次:** なし`;
+                        `**確認結果:** 宣言検証合格 — ${[...new Set(state.units.flatMap(unit => unit.unit.validation))].join("; ")}` +
+                        (mission?.review ? `\n独立レビュー: ${mission.review.verdict === "evidence-gaps" ? "証拠不足を残して受入れ（レビューPASSではない）" : mission.review.verdict}.` : "") + "\n\n**次:** なし";
                     const rendered = await control.renderReturnReport(context.sessionID, text, goalFingerprint(result.receipt)).catch(() => undefined);
                     if (rendered)
                         panel = returnReportPanel(rendered);
                 }
                 return JSON.stringify({ status: result.status, run_id: state.runID,
                     acceptance_fingerprint: state.acceptanceFingerprint, receipt: result.receipt ?? null,
+                    ...(result.completion ? { completion: result.completion,
+                        next_action: result.completion.blockers.map(item => item.next_action).join("\n") } : {}),
                     ...(panel ? { return_report: panel,
                         return_report_instruction: "Append return_report verbatim exactly once to your final answer as Markdown, outside any code fence. It is a host-authored receipt display, not a new task or input. Do not summarize, recalculate or request another model turn for it." } : {}) });
             } };
@@ -1228,14 +1241,15 @@ export function createProfiledPlugin(profile, assetVersion) {
             if (actor === root && (mission.coordinator !== null || plan.units.length !== 1))
                 throw new Error("mission-coordinator-required: dispatch the returned Coordinator task");
             const same = previous?.planHash === createHash("sha256").update(JSON.stringify(plan)).digest("hex");
-            if (previous && !["completed", "cancelled"].includes(previous.phase) && !same) {
+            const replanning = previous && !["completed", "cancelled"].includes(previous.phase) && !same;
+            if (replanning) {
                 if (!reason?.trim())
                     throw new Error("mission-replan-reason-required: name the observed correction or write-scope extension");
-                await operators.retireMissionRun(root);
             }
             const budget = await control.currentBudget(root);
             if (budget && budget.remaining_units < plan.units.length && !same)
-                throw new Error("mission-budget-exhausted: report the required cumulative extension to Operator");
+                throw new Error(`mission-budget-exhausted: plan needs ${plan.units.length} units; ${budget.remaining_units} remain. ` +
+                    "The current run is retained. Correct the plan within the remaining budget, or report a necessary cumulative extension to Operator.");
             // Cancellation marks the durable units before interrupting their native sessions. A cancelled
             // status alone therefore cannot prove the old Worker stopped or its reservation settled.
             const cancelledPredecessor = previous?.phase === "cancelled" &&
@@ -1247,8 +1261,9 @@ export function createProfiledPlugin(profile, assetVersion) {
                     get: async (id) => payload(await session("get", { path: { id }, query: { directory: input.directory } })),
                     children: async (id) => payload(await session("children", { path: { id }, query: { directory: input.directory } })),
                 }) : [];
-            const state = await operators.prepareMission(root, plan, actor === root ? undefined
-                : { sessionID: actor, callID: mission.callID }, mission.supersededRunID, terminalChildren);
+            const dispatcher = actor === root ? undefined : { sessionID: actor, callID: mission.callID };
+            const state = replanning ? await operators.replanMission(root, previous.runID, plan, dispatcher)
+                : await operators.prepareMission(root, plan, dispatcher, mission.supersededRunID, terminalChildren);
             await restorePriorAcceptance(root, state);
             await control.registerGoalDeclaration(root, state.units[0].task.prompt, true);
             control.enableUnits(root, state.units.filter(unit => unit.status === "pending").length);
@@ -1262,7 +1277,7 @@ export function createProfiledPlugin(profile, assetVersion) {
             });
             return JSON.stringify(await operators.next(root, actor));
         }
-        tools[planUnits] = { description: "Coordinator (or single-unit Fast-lane Operator): declare useful units, then dispatch the returned Worker immediately. Host generates IDs, handoff, manifest and proof mapping. Keep every original requirement covered. Final validation command in each unit proves that unit; read-only diagnostic commands need no registration. Recalling with reason replaces settled work within unchanged requirements and cumulative budget; include required scope extensions here.",
+        tools[planUnits] = { description: "Coordinator (or single-unit Fast-lane Operator): declare useful units, then dispatch the returned Worker immediately. Host generates IDs, handoff, manifest and proof mapping. Keep every original requirement covered. Use write: [] for read-only verification; use dir/** for directory outputs including not-yet-created trees. Final validation command in each unit proves that unit; read-only diagnostic commands need no registration. Recalling with reason replaces settled work within unchanged requirements and cumulative budget; include required scope extensions here. Rejected budget, contract or control-storage preparation preserves the existing run so you can correct the plan directly.",
             args: { units: { type: "array", minItems: 1, maxItems: 32, items: { type: "object", additionalProperties: false,
                         properties: { title: { type: "string" }, objective: { type: "string" }, read: stringList, write: stringList,
                             validation: stringList, requirement_ids: stringList }, required: ["title", "objective", "write", "validation"] } },
@@ -1310,6 +1325,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                         `candidate_id: ${mission.id}`, `review_phase: ${phase}`, "canonical_validation_exit: 0", `risk_tags: [${risk.join(", ")}]`,
                         "Review this candidate independently. Use the language of the requirements/traces. Invoke no tools. First line: exactly PASS, FINDINGS or EVIDENCE_GAPS.",
                         "Use EVIDENCE_GAPS only when no finding establishes a source/test defect and every finding is proof the supplied artifact cannot settle, including process history later established on the base. Any concrete defect uses FINDINGS.",
+                        "This Reviewer's native outcome and final acceptance can only be observed after this review. List those as deferred Operator checks, not as a reason to request another review. Still assess all available source, validation and historical evidence independently.",
                         `acceptance: ${JSON.stringify(run.acceptance)}`, `changedLogicSummary: ${JSON.stringify(traces)}`,
                         ...run.acceptance.map((_, i) => `acceptance[${i}] -> changedLogicSummary[${i}]`),
                         `manifest: ${JSON.stringify(run.units.map(unit => unit.unit))}`, `sourceFingerprint: ${source.fingerprint}`,
@@ -1347,8 +1363,7 @@ export function createProfiledPlugin(profile, assetVersion) {
         tools[completeMission] = { description: "Operator only: after comparing the original request, source, actual checks and required independent review, explicitly accept the whole mission. Returns the measured 🐾 report on success; never treat Worker start or one passing check as completion.",
             args: {}, execute: async (_args, context) => {
                 await requireRoot(context.sessionID);
-                const mission = await missions.required(context.sessionID);
-                await assertMissionReview(context.sessionID, mission);
+                await missions.required(context.sessionID);
                 const run = await operators.required(context.sessionID);
                 const result = await tools[complete].execute({ run_id: run.runID, acceptance_fingerprint: run.acceptanceFingerprint }, context);
                 if (JSON.parse(result).status === "succeeded")
@@ -1630,7 +1645,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                     const allowedRelease = request.tool === release;
                     const allowedValidation = ["bash", "shell"].includes(request.tool.toLowerCase()) && typeof args.command === "string" &&
                         repairAccess.expected_command !== null && normalizeCommand(args.command) === repairAccess.expected_command;
-                    if (!allowedRead && !allowedBind && !allowedRelease && !allowedValidation) {
+                    if (request.tool !== status && !allowedRead && !allowedBind && !allowedRelease && !allowedValidation) {
                         throw new Error("operator-contract-repair-validation-only");
                     }
                 }

package/dist/plugin/protected-snapshot.d.ts

@@ -0,0 +1,18 @@
+import { type GoalEvidence } from "../core/goal-bound.js";
+type Binding = NonNullable<GoalEvidence["protected_binding"]>;
+/** Live orchestration/Git bookkeeping is readable context, not the source being validated. */
+export declare function isRuntimeControlPath(path: string): boolean;
+export declare function protectedSnapshot(authorization: {
+    manifestPath: string;
+    manifestHash: string;
+    projectRoot: string;
+}): Promise<{
+    readonly binding: Binding;
+    readonly source: string;
+    readonly candidate: string;
+} | undefined>;
+export declare function refreshProtectedSnapshot(projectRoot: string, binding: Binding): Promise<{
+    readonly source: string;
+    readonly candidate: string;
+} | undefined>;
+export {};

package/dist/plugin/protected-snapshot.js

@@ -0,0 +1,98 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir, readlink, realpath, stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { goalFingerprint } from "../core/goal-bound.js";
+import { normalizeManifestScope } from "../core/path.js";
+import { RUNTIME_PROFILES } from "../core/runtime-profile.js";
+const controlRoots = new Set([".git", ...Object.values(RUNTIME_PROFILES).map(profile => profile.stateDirectory)]);
+/** Live orchestration/Git bookkeeping is readable context, not the source being validated. */
+export function isRuntimeControlPath(path) {
+    const first = path.replaceAll("\\", "/").split("/")[0];
+    return controlRoots.has(process.platform === "win32" ? first.toLowerCase() : first);
+}
+async function protectedScopeDigest(projectRoot, paths, manifestHash, sourcePolicy) {
+    const entries = [];
+    const canonicalRoot = await realpath(projectRoot);
+    const visit = async (absolute) => {
+        const scoped = relative(projectRoot, absolute).replaceAll("\\", "/");
+        if (scoped === ".." || scoped.startsWith("../") || isAbsolute(scoped))
+            return false;
+        if (sourcePolicy === "project-files-v1" && isRuntimeControlPath(scoped))
+            return true;
+        const metadata = await lstat(absolute).catch((error) => {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        });
+        if (metadata === undefined) {
+            entries.push([scoped, "missing"]);
+            return true;
+        }
+        if (metadata.isSymbolicLink()) {
+            const target = await realpath(absolute).catch(() => undefined);
+            if (target === undefined)
+                return false;
+            const relativeTarget = relative(canonicalRoot, target);
+            if (relativeTarget === ".." || relativeTarget.startsWith("../") || isAbsolute(relativeTarget) ||
+                !(await stat(target)).isFile())
+                return false;
+            const link = await readlink(absolute);
+            entries.push([scoped, `symlink:${link}`, createHash("sha256").update(await readFile(target)).digest("hex")]);
+            return true;
+        }
+        if (metadata.isDirectory()) {
+            entries.push([scoped, "directory"]);
+            for (const child of (await readdir(absolute)).sort())
+                if (!await visit(join(absolute, child)))
+                    return false;
+            return true;
+        }
+        if (!metadata.isFile())
+            return false;
+        entries.push([scoped, "file", createHash("sha256").update(await readFile(absolute)).digest("hex")]);
+        return true;
+    };
+    for (const path of [...new Set(paths)].sort())
+        if (!await visit(path))
+            return undefined;
+    return goalFingerprint({ manifest_hash: `sha256:${manifestHash}`, entries });
+}
+export async function protectedSnapshot(authorization) {
+    const manifestSource = await readFile(authorization.manifestPath).catch(() => undefined);
+    if (manifestSource === undefined)
+        return undefined;
+    const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
+    if (manifestHash !== authorization.manifestHash)
+        return undefined;
+    const relativePath = relative(authorization.projectRoot, authorization.manifestPath).replaceAll("\\", "/");
+    const manifest = JSON.parse(manifestSource.toString("utf8"));
+    const actualPaths = (entries) => entries.map((entry) => {
+        const path = normalizeManifestScope(entry);
+        return path.kind === "relative" ? resolve(authorization.projectRoot, path.path) : resolve(path.path);
+    });
+    const candidatePaths = actualPaths(manifest.write);
+    const sourcePaths = [...new Set([...actualPaths(manifest.read), ...candidatePaths])];
+    const source = await protectedScopeDigest(authorization.projectRoot, sourcePaths, manifestHash, "project-files-v1");
+    // Explicit outputs and the exact operation manifest remain pinned, including control-like paths.
+    const candidate = await protectedScopeDigest(authorization.projectRoot, candidatePaths, manifestHash);
+    if (source === undefined || candidate === undefined || relativePath.startsWith("../") || isAbsolute(relativePath))
+        return undefined;
+    return { binding: { manifest_hash: `sha256:${manifestHash}`, project_root: authorization.projectRoot,
+            manifest_path: relativePath, source_policy: "project-files-v1",
+            source_paths: sourcePaths.map(path => relative(authorization.projectRoot, path).replaceAll("\\", "/")),
+            candidate_paths: candidatePaths.map(path => relative(authorization.projectRoot, path).replaceAll("\\", "/")) }, source, candidate };
+}
+export async function refreshProtectedSnapshot(projectRoot, binding) {
+    const manifestSource = await readFile(resolve(projectRoot, binding.manifest_path)).catch(() => undefined);
+    if (manifestSource === undefined)
+        return undefined;
+    const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
+    if (`sha256:${manifestHash}` !== binding.manifest_hash)
+        return undefined;
+    // Legacy evidence retains its original recipe; a new policy cannot relabel stale proof as fresh.
+    if (binding.source_policy !== undefined && binding.source_policy !== "project-files-v1")
+        return undefined;
+    const source = await protectedScopeDigest(projectRoot, binding.source_paths.map(path => resolve(projectRoot, path)), manifestHash, binding.source_policy);
+    const candidate = await protectedScopeDigest(projectRoot, binding.candidate_paths.map(path => resolve(projectRoot, path)), manifestHash);
+    return source === undefined || candidate === undefined ? undefined : { source, candidate };
+}

package/dist/plugin/runtime-bridge.d.ts

@@ -105,9 +105,11 @@ export interface RuntimeBridge {
             manifestHash: string;
             goalFingerprint: string;
         }): Promise<readonly GoalEvidence[]>;
+        completionReadiness(rootSessionID: string): Promise<import("./goal-completion.js").CompletionReadiness>;
         completeRoot(rootSessionID: string, acceptanceFingerprint: string): Promise<{
             status: "succeeded" | "awaiting-evidence";
             receipt?: GoalTerminalReceipt;
+            completion?: import("./goal-completion.js").CompletionReadiness;
         }>;
         stopAutomaticRecovery(rootSessionID: string): Promise<void>;
         stopRoot(rootSessionID: string): Promise<void>;

package/dist/runtime-mission-assets.js

@@ -3,6 +3,17 @@ import { STRATEGY_TRIGGERS, SOURCE_REVIEW_RISK_TAGS } from "./core/consultation.
 import { SCOUT_EVIDENCE_CODES } from "./core/scout-contract.js";
 /** Repository-local dependency environment shared by all units; excluded from reviewed and captured source. */
 export const TOOL_ENVIRONMENT = ".sortie-env";
+const OPERATION_GUIDE = `## Practical operation guide
+
+Use file paths for exact outputs and dir/** for a directory tree, including a directory that does not
+exist yet. The host interprets dir/** consistently for writes, validation fingerprints and review.
+Create the directory with mkdir -p dir; do not add parent directories merely to make child writes work.
+For local source snapshots use git archive --format=tar --output=dir/source.tar <local-ref>.
+For tag observation use git tag --points-at <commit>. For HTTPS downloads use curl -fLsS -o dir/file <url>;
+--write-out '%{http_code} %{size_download}\\n' may print metadata to stdout. Declare all actual outputs.
+Reuse pinned artifacts and successful checks when the request permits and the inputs are unchanged.
+Do not repeat candidate discovery, dependency setup or validation merely because a Worker changed.
+`;
 function controls(profile, names) {
     return names.map(name => `  ${profile.toolPrefix}${name}: true`).join("\n");
 }
@@ -62,6 +73,10 @@ Ordinary defects return to Coordinator, not the user. Ask through question only
 an extension beyond the original requirements, or a cumulative budget increase. Resume the same work after
 the answer. Do not reset spend, silently shrink acceptance, or create substitute goals.
 
+When bounded process reflections are injected, pass the relevant prevention in Coordinator feedback while
+preserving the original requirements. After a resolved repeated process failure, record its verified cause/prevention
+through reflection if enabled; retain concrete evidence and prefer a durable fix for recurring causes.
+
 Retain 🐾 Sortie presentation and measured return panels. Append complete_mission's return_report verbatim
 once. Do not invent scores, medals, costs, savings, models or successful checks. Release/publish requires the
 existing user authorization and project gates; npm publication remains manual.
@@ -98,6 +113,7 @@ through shell. There is no proposal/approval/contract-repair round trip in this
 Investigate only enough to start the first useful Worker. Prefer a targeted read/reproduction over a broad
 inventory or speculative full design. Call ${profile.toolPrefix}plan_units with concise units:
 title, objective, read/write file or directory scopes, validation commands, optionally requirement_ids.
+For read-only verification, use write: []; do not invent an output file or request write access to inputs.
 Keep all original requirements covered; omitted requirement_ids means all. Last validation command proves
 that unit. If your quick check shows repository-declared dependencies or the test runner are missing, keep
 setup inside the first unit: declare its checks through the repository-local tool environment ${TOOL_ENVIRONMENT}/
@@ -111,10 +127,16 @@ For a needed write-scope addition within the original request, call expand_unit
 reason; the host returns a replacement contract without Operator approval. For a changed approach, formal
 check or reviewer finding, call plan_units with the corrected units and a short observed reason. Replanning
 preserves every requirement, failed-check history and cumulative budget. Never replace an active Worker.
+Rejected budget/contract checks or control-storage preparation leave the old run available. Correct the
+reported cause and call plan_units again; a local plan repair needs no cancellation or user approval.
+On a returned denial, correct the exact command form or output scope before redispatch; reuse established
+candidate identity, setup and evidence in the next objective instead of requesting the entire investigation again.
 Workers freely investigate within their unit and execute exact formal checks for host recording. Do not
 require them to predeclare exploratory commands. Require meaningful evidence, not extra testing for its
 own sake. Do not repeat passed checks unless source changes or unresolved concerns justify it.
 
+${OPERATION_GUIDE}
+
 Scout is optional for one precise missing fact. Its prompt includes missing_evidence_code:
 ${SCOUT_EVIDENCE_CODES.join(" | ")}, an exact project_root and at most four known_paths.
 Advisor is optional for one material decision; include strategy_trigger: ${STRATEGY_TRIGGERS.join(" | ")}.
@@ -180,7 +202,13 @@ are complete. Never fabricate logs, costs or exits. Do not stage outside declare
 publish, or take over Coordinator decisions. The parent releases your write binding after return.
 
 A local tool/permission/handoff defect returns PROCESS_DEFECT: local: <condition> and its exact diagnostic
-once to Coordinator. Do not repeat the same refused operation. Only a proven external dependency or
+once to Coordinator when its remedy requires a changed contract. If the host explicitly returns
+action=correct-format-within-current-manifest, correct the supported command form in this same Task,
+preserving the operation, inputs and destinations, then continue. An unchanged denied request is not a correction.
+If correcting the form changes the intended operation or requires another output, return the exact required
+correction to Coordinator. Do not repeat the same refused operation. Only a proven external dependency or
 user-only choice uses TRUE_BLOCKER: external: <condition> or TRUE_BLOCKER: user-decision: <condition>.
+
+${OPERATION_GUIDE}
 `;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.12.9",
+  "version": "0.12.11",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",