sortie-dogs 0.13.16 → 0.13.17

package/README.md

@@ -19,8 +19,8 @@ evidence-backed result, not more agents for their own sake.
 [![Node.js](https://img.shields.io/node/v/sortie-dogs)](https://www.npmjs.com/package/sortie-dogs)
 [![MIT License](https://img.shields.io/npm/l/sortie-dogs)](LICENSE)
 
-**Current release: [v0.13.16](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.13.16)**
-· [Release notes](docs/release-v0.13.16.md)
+**Current release: [v0.13.17](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.13.17)**
+· [Release notes](docs/release-v0.13.17.md)
 
 [Quick start](#quick-start) · [Workflow](#mission-workflow) · [Models](#default-models) ·
 [Measured results](#measured-results) · [Configuration](#configuration) · [Documentation](#documentation)
@@ -57,7 +57,7 @@ Use an existing Codex CLI signed in with **ChatGPT**. On Windows, PowerShell **7
 available; POSIX uses bash. Sortie does not install Codex, start login or use a metered API fallback.
 
 ```sh
-npm install --save-dev sortie-dogs@0.13.16
+npm install --save-dev sortie-dogs@0.13.17
 npx --no-install sortie-dogs codex init .
 ```
 
@@ -86,7 +86,7 @@ bridge. [Codex guide: SDK, permissions, progress, resume and manifest route](doc
 Use **OpenCode V2**. In the target project:
 
 ```sh
-npm install --save-dev sortie-dogs@0.13.16
+npm install --save-dev sortie-dogs@0.13.17
 npx --no-install sortie-dogs init .
 ```
 
@@ -188,7 +188,7 @@ known expense. Official local evaluation and leaderboard acceptance are separate
 **8/23 (34.8%)**, versus v0.12.25's 7/23; all seven prior resolutions retained, no empty patches or
 official evaluation errors. [Fixed conditions, stopped-run accounting and costs](docs/benchmarks/swebench-lite-history.md#v0131-dev23-2026-09-30).
 
-All scores belong to their fixed candidates, **not v0.13.16**. SWE-bench remains an optional
+All scores belong to their fixed candidates, **not v0.13.17**. SWE-bench remains an optional
 measurement, not a release gate. Different budgets, models and conditions are not controlled comparisons.
 
 ## Configuration
@@ -211,7 +211,7 @@ Install the desired package version and rerun **your host's** initializer:
 
 An OpenCode config-local bridge may resolve a separate package; npm-global update alone does not
 update it. [Global/update instructions](docs/configuration.md#global-availability).
-The current Mission asset marker is `0.13.16-practical-continuity-v1`; the unchanged Codex skill marker is
+The current Mission asset marker is `0.13.17-handoff-continuity-v1`; the unchanged Codex skill marker is
 `0.13.11-codex-skill-v2`. Installed markers alone do not prove a running host reloaded the new version.
 
 There is no supported uninstall command. Remove the dependency and only known Sortie-owned paths;
@@ -227,7 +227,7 @@ follow the [manual removal guide](docs/uninstall.md), never delete the entire `.
   [SWE-bench history](docs/benchmarks/swebench-lite-history.md) · [Historical local case study](docs/benchmark-reference.md).
 - **Development:** [Testing](docs/testing.md) · [CLI testing](docs/cli-testing.md) ·
   [Windows tests](docs/windows-tests.md) · [Release routine](docs/release-batch.md).
-- **Releases:** [v0.13.16](docs/release-v0.13.16.md) · [v0.13.15](docs/release-v0.13.15.md) · [v0.13.14](docs/release-v0.13.14.md) · [v0.13.13](docs/release-v0.13.13.md) · [v0.13.12](docs/release-v0.13.12.md) · [v0.13.11](docs/release-v0.13.11.md) · [v0.13.10](docs/release-v0.13.10.md) ·
+- **Releases:** [v0.13.17](docs/release-v0.13.17.md) · [v0.13.16](docs/release-v0.13.16.md) · [v0.13.15](docs/release-v0.13.15.md) · [v0.13.14](docs/release-v0.13.14.md) · [v0.13.13](docs/release-v0.13.13.md) · [v0.13.12](docs/release-v0.13.12.md) · [v0.13.11](docs/release-v0.13.11.md) · [v0.13.10](docs/release-v0.13.10.md) ·
   [v0.13.9](docs/release-v0.13.9.md) · [All GitHub releases](https://github.com/zufall-upon/Sortie-dogs/releases).
 
 ## Community

package/dist/asset-version.d.ts

@@ -3,6 +3,6 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.13.16-practical-continuity-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.13.17-handoff-continuity-v1";
 export declare const CODEX_SKILL_ASSET_VERSION = "0.13.11-codex-skill-v2";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION | typeof CODEX_SKILL_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.13.16-practical-continuity-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.13.17-handoff-continuity-v1";
 export const CODEX_SKILL_ASSET_VERSION = "0.13.11-codex-skill-v2";

package/dist/core/operator-mission.js

@@ -224,7 +224,11 @@ export class OperatorMissionRuntime {
             continuity: { notes: state.continuity?.notes, sources, progress: state.progress,
                 attempts: (state.attempts ?? []).map(({ runID, unitID, status, failure, resultClass, childSessionID }) => ({ run_id: runID, unit_id: unitID, status, failure, result_class: resultClass, session_id: childSessionID })),
                 execution: state.execution,
-                guidance: "Current original_requests/requirements govern; older plans remain historical. Continue from known decisions, environment, completed work and failures. Read snapshot JSON entries by message/call IDs only for a relevant gap. Recheck mutable facts when needed or conflicting; do not repeat unchanged setup/investigation merely because ownership changed. Historical results are not fresh formal validation or new authority." } };
+                source_authors: state.sourceAuthors ?? [],
+                corrections: (state.corrections ?? []).map(({ initialPrompt: _prompt, inlineReview: _inline, ...correction }) => correction),
+                retained_review: state.review ? { run_id: state.review.runID, verdict: state.review.verdict,
+                    mode: state.review.mode, author: state.review.child, result: state.review.result, self_recheck: state.review.selfRecheck } : null,
+                guidance: "Current original_requests/requirements govern; older plans remain historical. Continue from known decisions, environment, completed work, retained findings and failures. A new plan or author does not resolve findings or turn self-recheck into independent approval. Read snapshot JSON entries by message/call IDs only for a relevant gap. Recheck mutable facts when needed or conflicting; do not repeat unchanged setup/investigation/checks merely because ownership changed. Successful evidence remains with its actual author/call and input bindings; historical results are not new authority." } };
     }
     async load(file) {
         try {
@@ -804,14 +808,14 @@ export function missionPacket(mission, run) {
                 ? "Operator: use acceptance_summary to compare the submitted candidate with the verbatim original requests and actual evidence, inspect concrete gaps only, then complete_mission if satisfied. Do not routinely search archives or reread all source. Historical PASS is not current PASS. Report remaining evidence gaps; they are not a review PASS."
                 : run?.phase === "awaiting-acceptance" && mission.corrections?.some(item => item.runID === run.runID && item.status === "ready") && !reviewAccepted
                     ? mission.corrections.find(item => item.runID === run.runID)?.selfRecheck?.unresolvedFindings.length
-                        ? "Known Major/Medium findings remain after self-recheck. Call repair_review for the SAME original correction owner; do not dispatch another Reviewer or accept unresolved Medium. Retain original requirements and cumulative spend."
+                        ? "Known Major/Medium findings remain after self-recheck. Correct them with repair_review (reuse the author by default, or select an available Reviewer), or plan_units for Worker/direct execution. Retain findings, original requirements and cumulative spend; unresolved Medium is not acceptance."
                         : mission.corrections.find(item => item.runID === run.runID)?.selfRecheck?.residualMajor
                             ? "A concrete reachable Major risk remains after native author self-recheck. Call review_mission for a DIFFERENT Reviewer of the correction, retained findings and relevant impact; dispatch the exact returned Task if not already active. No fresh Worker or unchanged validation is required."
-                            : "Correction ready; call review_mission for the SAME native author to explicitly self-recheck the retained findings, relevant impact and original requirements. Only a concrete reachable Major risk remaining after self-recheck requires a DIFFERENT Reviewer. Known Major/Medium defects still require correction. Do not restart unchanged checks or investigation; CORRECTION_READY alone is not acceptance."
+                            : "Correction ready; reuse the native author for explicit self-recheck or select an independent Reviewer with review_mission when useful. Remaining authorized implementation may proceed with plan_units without acceptance. Known Major/Medium defects still require correction. Do not restart unchanged checks or investigation; CORRECTION_READY alone is not acceptance."
                     : mission.kind === "operation" && operationStatus === "running"
                         ? "The declared operation is already running. Inspect its native shell/progress; do not start another Worker or run. Wait for a terminal result, or report the existing run as blocked if its completion cannot be observed."
                         : run?.phase === "awaiting-decision" && mission.corrections?.some(item => item.runID === run.runID && item.status === "failed")
-                            ? "Correction validation or native execution failed. Call repair_review for a new admission in the SAME original Reviewer's native session; fix its own regression, rerun inherited checks and retain the commit/clean boundary and cumulative spend. Do not use ordinary retry, Rescue or a fresh Worker replan. Failure is never acceptance."
+                            ? "Correction validation or native execution failed. Reuse its context with repair_review, select another available Reviewer, or plan_units for Worker/direct correction. Retain findings, affected checks, requested delivery and cumulative spend. Failure is never acceptance."
                             : run?.phase === "awaiting-decision" ? (run.units.some(unit => unit.dispatchDenial)
                                 ? "Coordinator: inspect units[].dispatch_denial before changing the plan. Correct only its diagnosed cause; do not repeat an unchanged refused Task or replan for a host-state mismatch. Report an unresolved runtime mismatch with the loaded runtime identity; preserve requirements and cumulative spend."
                                 : run.units.some(unit => unit.status === "failed" && unit.resultClass === "acceptance" && unit.failure?.outcome === "fail" && !unit.normalRemediationUsed)
@@ -822,8 +826,8 @@ export function missionPacket(mission, run) {
                                 : run?.phase === "awaiting-acceptance" && !operationComplete
                                     ? `Requested operation is ${operationStatus}. Continue the actual operation or report its blocker; auxiliary checks and review disposition cannot complete it.`
                                     : run?.phase === "awaiting-acceptance" ? (reviewAccepted
-                                        ? "Coordinator: review permits submission. Retain advisory review notes; do not repeat passed validation or review for evidence formatting. Operator performs final acceptance against the original requirements."
-                                        : "Coordinator: correct known Major/Medium findings, then obtain explicit native author self-recheck (different Reviewer only for residual concrete Major risk), or initial independent review, then submit_mission. Operator compares all requirements with source/evidence before complete_mission.")
+                                        ? "Coordinator: review permits submission, not completion of remaining implementation. Continue authorized remaining work with plan_units, or submit when the original requirements are met. Retain review notes; do not repeat passed validation or review for evidence formatting. Operator final acceptance remains separate."
+                                        : "Coordinator: correct known Major/Medium findings, then obtain native author self-recheck or useful independent review (required for concrete residual Major risk). Remaining authorized implementation can proceed without submission/acceptance. Operator compares all requirements with source/evidence before complete_mission.")
                                         : "Coordinator: continue the next useful unit within original requirements. Return only a completion candidate, user-only decision, or scope/budget extension." };
 }
 /** Models forward a short capability, never recopy the host's evidence hashes and source packet. */

package/dist/core/operator-runtime.d.ts

@@ -280,6 +280,8 @@ export declare class OperatorRuntime {
     private file;
     /** Exact persisted source for read-only status projections. */
     statePath(root: string): string;
+    /** Stable detail source for a settled run replaced by Mission replanning. */
+    replanArchivePath(state: OperatorState): string;
     /** Read-only lineage projection. Never imports archived evidence into current acceptance. */
     acceptanceHistory(state: OperatorState, missionRunIDs: readonly string[]): Promise<{
         status: "available" | "unavailable";

package/dist/core/operator-runtime.js

@@ -276,6 +276,10 @@ export class OperatorRuntime {
     }
     /** Exact persisted source for read-only status projections. */
     statePath(root) { return this.file(root); }
+    /** Stable detail source for a settled run replaced by Mission replanning. */
+    replanArchivePath(state) {
+        return `${this.file(state.rootSessionID)}.${state.runID}.${state.sequence}.archive`;
+    }
     /** Read-only lineage projection. Never imports archived evidence into current acceptance. */
     async acceptanceHistory(state, missionRunIDs) {
         const runs = [];
@@ -878,14 +882,12 @@ export class OperatorRuntime {
             if (!previous || previous.runID !== mission.replaceRunID || ["cancelled", "completed"].includes(previous.phase)) {
                 throw new Error("mission-replan-run-mismatch");
             }
-            if (previous.units.some(unit => unit.reviewerCorrection) && !mission.reviewerCorrection) {
-                throw new Error("mission-review-correction-owner-continuation-required");
-            }
-            if (previous.units.some(unit => unit.status === "running") || (previous.gitLifecycle !== null && !mission.reviewerCorrection))
+            // Completed correction/Git metadata is history, not a live writer lease.
+            // The plugin reconciles actual native executions before replacing this run.
+            if (previous.units.some(unit => unit.status === "running"))
                 throw new Error("mission-replan-worker-still-active");
-            const failedContinuation = previous.phase === "awaiting-decision" && previous.units.every(unit => unit.status === "failed" && unit.reviewerCorrection?.author === mission.reviewerCorrection?.author);
+            const failedContinuation = previous.phase === "awaiting-decision" && previous.units.every(unit => unit.status === "failed" && unit.reviewerCorrection);
             if (mission.reviewerCorrection && ((!failedContinuation && (previous.phase !== "awaiting-acceptance" || previous.units.some(unit => unit.status !== "succeeded"))) ||
-                previous.units.some(unit => unit.reviewerCorrection && unit.reviewerCorrection.author !== mission.reviewerCorrection.author) ||
                 plan.units.length !== 1 || plan.acceptance.length !== previous.acceptance.length ||
                 previous.acceptance.some((text, i) => text !== plan.acceptance[i]) ||
                 JSON.stringify(plan.acceptance_proof) !== JSON.stringify(previous.acceptanceProof) ||
@@ -1166,10 +1168,11 @@ export class OperatorRuntime {
                     await handle.close();
                 }
             }
-            if ((superseding || replanning) && previous) {
+            if ((superseding || replanning || previous?.phase === "completed") && previous) {
                 // A crash before the state switch may leave a checkpoint while the old run later advances.
                 // Sequence-qualified replan snapshots keep that history without blocking a subsequent correction.
-                const archive = `${this.file(root)}.${previous.runID}${replanning ? `.${previous.sequence}` : ""}.archive`;
+                const archive = replanning || previous.phase === "completed" ? this.replanArchivePath(previous)
+                    : `${this.file(root)}.${previous.runID}.archive`;
                 try {
                     const handle = await open(archive, "wx", 0o600);
                     created.push(archive);
@@ -1323,8 +1326,6 @@ export class OperatorRuntime {
             return args.task_id === expected.task_id && args.subagent_type === expected.subagent_type &&
                 args.description === expected.description && args.prompt === expected.prompt;
         }
-        if (unit.reviewerCorrection && (args.model !== undefined || args.variant !== undefined))
-            return false;
         if (unit.reviewerCorrection ? args.task_id !== unit.reviewerCorrection.author : args.task_id !== undefined && args.task_id !== "")
             return false;
         if (args.subagent_type !== unit.task.subagent_type || args.description !== unit.task.description)

package/dist/plugin/gate.d.ts

@@ -70,6 +70,10 @@ export declare function normalizeCommand(command: string): string;
 export declare function canonicalDeclaredValidationSequence(command: string, declared: ReadonlySet<string>): string | undefined;
 /** Preserve ordered members (including repeats) without splitting quoted text or substring matching. */
 export declare function canonicalDeclaredValidationMembers(command: string, declared: ReadonlySet<string> | readonly string[], occurrence?: number): string[] | undefined;
+/** Observation only, never shell authority. A successful native && chain can prove
+ * its exact declared tail after diagnostics/empty-directory cleanup. The caller
+ * must retain the real exit and the snapshot captured BEFORE the whole command. */
+export declare function canonicalObservedValidationMembers(command: string, declared: ReadonlySet<string> | readonly string[], occurrence?: number): string[] | undefined;
 /** Unbound sessions may invoke only tools whose complete input is known to be read-only. */
 export declare function isKnownReadOnlyTool(tool: string, args: unknown, additionalReadOnlyTools?: ReadonlySet<string>): boolean;
 /** Canonical scopes let sibling worker bindings reject equal or ancestor ownership. */

package/dist/plugin/gate.js

@@ -997,6 +997,40 @@ export function canonicalDeclaredValidationMembers(command, declared, occurrence
     };
     return sequence(0);
 }
+/** Observation only, never shell authority. A successful native && chain can prove
+ * its exact declared tail after diagnostics/empty-directory cleanup. The caller
+ * must retain the real exit and the snapshot captured BEFORE the whole command. */
+export function canonicalObservedValidationMembers(command, declared, occurrence = 0) {
+    const exact = canonicalDeclaredValidationMembers(command, declared, occurrence);
+    if (exact)
+        return exact;
+    const syntax = scanShellSyntax(command, "posix");
+    // Do not infer a tail through comments, expansions, redirection, subshells or
+    // shell-state changes. Unsupported observations leave existing authority alone.
+    if (syntax.unsafeExpansion || syntax.activeBrace || /[\\#$()<>`]/u.test(syntax.masked))
+        return undefined;
+    const segments = shellSegments(command, "posix").map(segment => segment.trim());
+    if (segments.length < 2 || segments.some(segment => !segment) ||
+        normalizeCommand(command) !== segments.map(normalizeCommand).join(" && "))
+        return undefined;
+    const identities = [...new Set(declared)];
+    for (let start = 1; start < segments.length; start++) {
+        const prefix = segments[start - 1];
+        // Never discard an ordered declared occurrence to find a later matching tail.
+        if (declaredCommandMatch(prefix, identities) !== undefined)
+            return undefined;
+        if (prefix.includes("`"))
+            return undefined;
+        const extracted = shellPaths(prefix, false);
+        const cleanup = /^rmdir(?:\s|$)/u.test(prefix);
+        if (extracted.ambiguous || extracted.remoteMutation || extracted.gitMutation || extracted.applies && !cleanup)
+            return undefined;
+        const members = canonicalDeclaredValidationMembers(segments.slice(start).join(" && "), declared, occurrence);
+        if (members)
+            return members;
+    }
+    return undefined;
+}
 /** Unbound sessions may invoke only tools whose complete input is known to be read-only. */
 export function isKnownReadOnlyTool(tool, args, additionalReadOnlyTools = new Set()) {
     const name = tool.toLowerCase();

package/dist/plugin/mission-review.d.ts

@@ -73,6 +73,7 @@ export declare function missionReviewValidation(run: OperatorState, statePath: s
 export declare function observedMissionValidation(validation: readonly string[], childSessionID: string | null, history: readonly Record<string, unknown>[], notBefore?: number, directory?: string, directories?: Readonly<Record<string, string>>): {
     attempts: readonly {
         command: string;
+        native_command?: string;
         directory?: string;
         observed_members?: readonly string[];
         exit_code: number | null;

package/dist/plugin/mission-review.js

@@ -11,7 +11,7 @@ import { canonicalAgent } from "../core/runtime-profile.js";
 import { taskChildSessionID } from "./task-result-repair.js";
 import { normalizeManifestScope } from "../core/path.js";
 import { declaredArtifacts } from "./declared-artifacts.js";
-import { canonicalDeclaredValidationMembers, normalizeCommand } from "./gate.js";
+import { canonicalDeclaredValidationMembers, canonicalObservedValidationMembers, normalizeCommand } from "./gate.js";
 import { currentSnapshotProtection, isRuntimeControlPath, refreshProtectedSnapshot, snapshotControlExclusion, snapshotScratchExclusion, validationInputSnapshot } from "./protected-snapshot.js";
 const exec = promisify(execFile);
 const notRepository = (error) => /fatal: not a git repository \(or (?:any of the parent directories|any parent up to mount point [^\r\n)]+)\)(?:: \.git)?/u
@@ -87,7 +87,8 @@ export function observedMissionValidation(validation, childSessionID, history, n
     });
     let occurrence = 0;
     const attempts = rawAttempts.sort((a, b) => (a.started_ms ?? 0) - (b.started_ms ?? 0) || (a.completed_ms ?? 0) - (b.completed_ms ?? 0)).flatMap(attempt => {
-        const members = canonicalDeclaredValidationMembers(attempt.command, declared, occurrence);
+        const exact = canonicalDeclaredValidationMembers(attempt.command, declared, occurrence);
+        const members = exact ?? (attempt.exit_code === 0 ? canonicalObservedValidationMembers(attempt.command, declared, occurrence) : undefined);
         if (!members || !validationDirectoryMatches(members, attempt.directory, directory, directories))
             return [];
         if (attempt.exit_code !== 0)
@@ -100,7 +101,7 @@ export function observedMissionValidation(validation, childSessionID, history, n
                     occurrence = (occurrence + 1) % declared.length;
             }
         const { directory: actual, ...visible } = attempt;
-        return [{ ...visible, command: members.join(" && "), ...(directory && resolve(directory, actual ?? ".") !== resolve(directory)
+        return [{ ...visible, command: members.join(" && "), ...(!exact ? { native_command: attempt.command } : {}), ...(directory && resolve(directory, actual ?? ".") !== resolve(directory)
                     ? { directory: resolve(directory, actual ?? ".") } : {}), ...(members.length > 1 ? { observed_members: members } : {}) }];
     });
     // Retain early attempts and the latest checks if a Worker retried many times.
@@ -174,11 +175,14 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
             // report/cache write is not itself a source change. Unbound history stays conservative.
             if (!checks && attempt.started < editedAt)
                 continue;
-            const recorded = registeredAt && checks?.find(check => check.callID === attempt.callID && check.childSessionID === child);
-            const commands = recorded
-                ? canonicalDeclaredValidationMembers(attempt.command, recorded.command)
-                : canonicalDeclaredValidationMembers(attempt.command, declared, occurrences[partial.length % required.length] ?? 0);
-            if (!commands || recorded && JSON.stringify(commands) !== JSON.stringify(recorded.command))
+            const recorded = checks?.find(check => check.callID === attempt.callID && check.childSessionID === child);
+            const recipes = registeredAt && recorded ? recorded.command : declared;
+            const occurrence = registeredAt && recorded ? 0 : occurrences[partial.length % required.length] ?? 0;
+            const commands = canonicalDeclaredValidationMembers(attempt.command, recipes, occurrence)
+                // Mixed native input needs its original live binding, not a snapshot added
+                // to retained logs. Nonzero/unknown chain exits cannot prove the tail ran.
+                ?? (recorded && attempt.exit === 0 ? canonicalObservedValidationMembers(attempt.command, recipes, occurrence) : undefined);
+            if (!commands || registeredAt && recorded && JSON.stringify(commands) !== JSON.stringify(recorded.command))
                 continue;
             const members = commands.flatMap((command, member) => required.includes(command) &&
                 validationDirectoryMatches([command], attempt.directory, directory, directories) &&
@@ -277,9 +281,10 @@ export async function observedMissionValidationSummary(validation, childSessionI
     const observed = observedMissionValidation(validation, childSessionID, data.filter(record), notBefore, directory, directories);
     const grouped = new Map();
     for (const attempt of observed.attempts) {
-        const key = JSON.stringify([attempt.command, attempt.directory, attempt.exit_code]);
+        const key = JSON.stringify([attempt.command, attempt.native_command, attempt.directory, attempt.exit_code]);
         const previous = grouped.get(key);
-        grouped.set(key, { command: attempt.command, ...(attempt.directory ? { directory: attempt.directory } : {}), exit_code: attempt.exit_code,
+        grouped.set(key, { command: attempt.command, ...(attempt.native_command ? { native_command: attempt.native_command } : {}),
+            ...(attempt.directory ? { directory: attempt.directory } : {}), exit_code: attempt.exit_code,
             observed_attempts: (previous?.observed_attempts ?? 0) + 1,
             latest_started_ms: attempt.started_ms, latest_completed_ms: attempt.completed_ms });
     }

package/dist/plugin/operator-status-output.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Native V2 truncates at whole-line boundaries. A large one-line full packet can
+ * therefore hide every field. Put existing actionable facts before bulky proof
+ * recipes, with one top-level field per line; keep the complete JSON unchanged.
+ */
+export declare function serializeOperatorStatus(packet: Record<string, unknown>): string;

package/dist/plugin/operator-status-output.js

@@ -0,0 +1,19 @@
+/**
+ * Native V2 truncates at whole-line boundaries. A large one-line full packet can
+ * therefore hide every field. Put existing actionable facts before bulky proof
+ * recipes, with one top-level field per line; keep the complete JSON unchanged.
+ */
+export function serializeOperatorStatus(packet) {
+    const keys = new Set([
+        "profile", "view", "mission_id", "run_id", "phase", "status", "decision", "coordinator_session_id",
+        "budget", "accounting_scope", "attempts", "next_action", "execution_summary", "runtime", "completion",
+        ...Object.keys(packet),
+    ]);
+    const lines = [...keys].flatMap(key => {
+        if (!Object.hasOwn(packet, key))
+            return [];
+        const value = JSON.stringify(packet[key]);
+        return value === undefined ? [] : [`  ${JSON.stringify(key)}: ${value}`];
+    });
+    return `{\n${lines.join(",\n")}\n}`;
+}

package/dist/plugin/profiled.js

@@ -11,10 +11,11 @@ import { BUILT_IN_MODEL_CATALOG } from "./model-routing.js";
 import { goalFingerprint } from "../core/goal-bound.js";
 import { decoratePreviewHeadings, returnReportPanel } from "./receipt-presentation.js";
 import { sanitizeTerminalReport, terminalRunOutcome } from "./run-metrics.js";
-import { normalizeCommand, canonicalDeclaredValidationMembers, extractWritePaths } from "./gate.js";
+import { normalizeCommand, canonicalObservedValidationMembers, extractWritePaths } from "./gate.js";
 import { normalizeExecutionScope, normalizeManifestScope, normalizeRelativePath } from "../core/path.js";
 import { OperatorMissionRuntime, missionAcceptanceSummary, missionPacket, missionPlan, missionReviewAccepted, missionReviewIndependent, missionReviewScope, missionReviewTask, missionCommandOutcome, missionConversationContext, missionExecutionComplete, missionExecutionStatus, missionOperationSummary, missionValidationCommand, missionReviewTraces, missionReviewVerdict, missionSelfRecheckReport } from "../core/operator-mission.js";
 import { publishMissionProgress } from "./mission-progress.js";
+import { serializeOperatorStatus } from "./operator-status-output.js";
 import { completedMissionReviewPrompts, initialMissionReviewPrompt, missionDeliveryObservation, missionReviewBaseline, missionReviewSource, observedMissionValidation, observedMissionValidationSummary, missionReviewValidation, reviewerCorrectionValidation, reviewerCorrectionValidationFresh, validationDirectoryMatches } from "./mission-review.js";
 import { missionLocations, missionLocationPacket } from "./mission-location.js";
 import { prepareValidationScratch } from "./validation-scratch.js";
@@ -608,7 +609,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 const unit = correction.unit;
                 const directories = unit.directExecution?.validationCwd ?? unit.unit.validation_cwd;
                 const progress = reviewerCorrectionValidation(unit.unit.validation, child, await messages(child), Date.parse(unit.reviewerCorrection?.admittedAt ?? unit.directExecution?.startedAt ?? correction.run.createdAt), unit.reviewerCorrection?.checks ?? unit.directExecution?.checks ?? [], input.directory, directories, unit.reviewerCorrection?.validationRegisteredAt ?? unit.directExecution?.validationRegisteredAt);
-                const members = canonicalDeclaredValidationMembers(command, unit.unit.validation, progress.nextOccurrence ?? 0);
+                const members = canonicalObservedValidationMembers(command, unit.unit.validation, progress.nextOccurrence ?? 0);
                 return members && validationDirectoryMatches(members, directory, input.directory, directories) ? members : undefined;
             },
             recordReviewerCorrectionCheck: (root, taskID, check) => operators.recordReviewerCorrectionCheck(root, taskID, check),
@@ -1158,12 +1159,12 @@ export function createProfiledPlugin(profile, assetVersion) {
                 run?.phase === "awaiting-acceptance" &&
                 (!mission.review || missionReviewAccepted(mission.review))) {
                 return { ...packet, next_action: mission.review && missionReviewAccepted(mission.review)
-                        ? "Fast-lane: compare all original requirements with actual evidence and review disposition, then call complete_mission. Report any remaining evidence gaps; they are not PASS."
+                        ? "Fast-lane: continue authorized remaining implementation with plan_units, or compare all original requirements with actual evidence before complete_mission when acceptance is authorized. A passed correction does not complete remaining development. Report evidence gaps; they are not PASS."
                         : "Fast-lane: assess actual risk and call review_mission with real risk_tags. Implementation notes are optional. Dispatch its Reviewer Task if required; then compare all requirements before complete_mission." };
             }
             if (mission.coordinator === null && mission.runID === run?.runID && !mission.dispatchOpen &&
                 run?.phase === "awaiting-decision" && mission.corrections?.some(item => item.runID === run.runID && item.status === "failed")) {
-                return { ...packet, next_action: `Fast-lane: correction failed; call ${repairReview} for a new scoped Task in the SAME original Reviewer's native session. Fix its own regression, run inherited validation and retain the commit/clean boundary. No ordinary Worker retry, fresh Worker replan or duplicate settlement; cumulative spend and failed history remain.` };
+                return { ...packet, next_action: `Fast-lane: correction failed. Reuse its author via ${repairReview}, choose another available Reviewer, or ${planUnits} for Worker/direct correction. Retain findings, affected checks, requested delivery and cumulative spend; no duplicate settlement or unchanged reinvestigation.` };
             }
             if (mission.coordinator === null && mission.runID === run?.runID && !mission.dispatchOpen &&
                 run?.phase === "awaiting-decision" && run.units.length === 1 &&
@@ -1179,7 +1180,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 run?.phase === "awaiting-acceptance" && mission.review?.verdict === "findings") {
                 const checked = mission.corrections?.find(item => item.runID === run.runID)?.selfRecheck;
                 if (mission.corrections?.some(item => item.runID === run.runID && item.status === "ready") && !checked) {
-                    return { ...packet, next_action: `Fast-lane: correction ready; call ${reviewMission} for explicit read-only self-recheck in the SAME native author. CORRECTION_READY is not acceptance; only concrete reachable residual Major risk then requires a different Reviewer.` };
+                    return { ...packet, next_action: `Fast-lane: correction ready. Reuse the author's explicit self-recheck or select an independent Reviewer with ${reviewMission}. Authorized remaining implementation can proceed with ${planUnits}; CORRECTION_READY is not acceptance.` };
                 }
                 if (checked?.residualMajor && !checked.unresolvedFindings.length && mission.review.mode === "self-recheck") {
                     return { ...packet, next_action: `Fast-lane: native author self-recheck retained concrete reachable Major risk. ` +
@@ -1187,9 +1188,9 @@ export function createProfiledPlugin(profile, assetVersion) {
                             `Do not start a fresh Worker or repeat unchanged validation.` };
                 }
                 return { ...packet, next_action: `Fast-lane: known Major/Medium findings require correction. Call ${repairReview} ` +
-                        `for the SAME original Reviewer's scoped correction Task, then ${reviewMission} for its explicit native self-recheck. ` +
+                        `to reuse the author's scoped correction Task or select another available Reviewer; ${planUnits} also permits Worker/direct correction. Then obtain native self-recheck or useful independent Review. ` +
                         `Only a concrete reachable Major risk remaining after self-recheck requires a different Reviewer. ` +
-                        `No fresh Worker, routine diff transcription or unchanged reinvestigation is required.` };
+                        `No routine diff transcription, handoff approval or unchanged reinvestigation is required.` };
             }
             if (!mission.dispatchOpen && (["open", "running"].includes(mission.phase) ||
                 (mission.phase === "submitted" && mission.submission?.status !== "ready"))) {
@@ -1577,6 +1578,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 current_unit: current === undefined ? null : { id: current.unit.id, title: current.unit.title, status: current.status },
                 completed_units: units.filter(unit => unit.status === "succeeded").length, total_units: units.length,
                 budget_remaining_units: budget?.remaining_units ?? null,
+                budget: packet.budget, accounting_scope: packet.accounting_scope, attempts: packet.attempts,
                 next_action: typeof packet.next_action === "string" ? packet.next_action : null,
                 ...(record(packet.acceptance_summary) ? { observations: {
                         operation: packet.acceptance_summary.operation,
@@ -1599,7 +1601,7 @@ export function createProfiledPlugin(profile, assetVersion) {
             const { proposal: _packet, ...identity } = proposals.packet(state);
             return identity;
         }
-        tools[status] = { description: "Read the durable root-owned operator outcome and host budget counters (max_units, consumed_units, reserved_units, remaining_units) without claiming acceptance or retrying work. Default Mission status preserves measured evidence with persisted detail references, not duplicated protected path arrays; view=full retains the full diagnostic packet. view=progress returns a compact read-only projection with existing formal checks, native observations/terminals and recorded delivery, never inferred clean or success. Existing Mission dispatch reconciliation is unchanged. With no Mission or execution run, proposal/draft status remains unchanged. An investigating proposal returns its exact short Task reference only before a Task has been admitted; an existing admission never yields a redispatch Task.",
+        tools[status] = { description: "Read the durable root-owned operator outcome and host budget counters (max_units, consumed_units, reserved_units, remaining_units) without claiming acceptance or retrying work. Mission status places existing model observations, scoped cost and next action before bulky evidence, on separate lines so native truncation retains useful facts. Default preserves measured evidence with persisted detail references, not duplicated protected path arrays; view=full retains the full diagnostic packet. view=progress returns a compact read-only projection with the same budget/model observations, existing formal checks, native observations/terminals and recorded delivery, never inferred clean or success. Existing Mission dispatch reconciliation is unchanged. With no Mission or execution run, proposal/draft status remains unchanged. An investigating proposal returns its exact short Task reference only before a Task has been admitted; an existing admission never yields a redispatch Task.",
             args: { view: optionalStringSchema, confirmed_conditions: conditionsSchema }, execute: async (args, context) => {
                 const view = args.view;
                 const root = await rootFor(context.sessionID);
@@ -1630,8 +1632,8 @@ export function createProfiledPlugin(profile, assetVersion) {
                         delete packet.coordinator_dispatch;
                     }
                     if (view === "progress")
-                        return JSON.stringify(missionProgress(mission, run, budget, packet));
-                    return JSON.stringify(view === "full" ? packet : compactMissionEvidence(packet, run, root));
+                        return serializeOperatorStatus(missionProgress(mission, run, budget, packet));
+                    return serializeOperatorStatus(view === "full" ? packet : compactMissionEvidence(packet, run, root));
                 }
                 if (root && context.sessionID !== root) {
                     const owned = await operators.read(root);
@@ -2117,7 +2119,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                 executor_session_id: actor, validation: direct.unit.unit.validation,
                 next_action: `Implement/correct and run the declared checks here, in this same session. Call ${finishDirectUnit} after the requested delivery boundary. No Worker or handoff read is needed. Retain the original requirements; independent Review and Operator acceptance still follow.` });
         }
-        tools[startDirectUnit] = { description: "Execute the next already-planned unit in this SAME Coordinator/Operator session. Native edits and declared checks become formal evidence without a Worker, handoff read or approval. Use after plan_units or a settled-unit retry; never replace an active Worker or the Reviewer correction owner.",
+        tools[startDirectUnit] = { description: "Execute the next already-planned ordinary unit in this Coordinator/Operator session, including a correction planned with executor=self. Native edits and declared checks become formal evidence without a Worker, handoff read or approval. Never replace an active writer; completed correction history does not restrict this choice.",
             args: {}, execute: async (_args, context) => {
                 const { root } = await missionAuthority(context.sessionID);
                 return serializeDispatchTransition(root, () => startDirect(root, context.sessionID));
@@ -2125,17 +2127,21 @@ export function createProfiledPlugin(profile, assetVersion) {
         tools[finishDirectUnit] = { description: "Finish this controller's or admitted Reviewer's direct unit using actual ordered native checks bound to current source. Retains this session for review/coordination or explicit author self-recheck; this is not a native Task terminal, independent Review or Mission acceptance. Missing/failed/stale checks continue here without a Worker.",
             args: {}, execute: async (_args, context) => {
                 const inline = await directExecution(context.sessionID);
+                const correction = await reviewerCorrection(context.sessionID);
                 const root = inline?.unit.reviewerCorrection
-                    ? inline.root : (await missionAuthority(context.sessionID)).root;
+                    ? inline.root : correction?.root ?? (await missionAuthority(context.sessionID)).root;
                 return serializeDispatchTransition(root, async () => {
-                    const direct = await activateDirect(context.sessionID);
+                    const direct = await activateDirect(context.sessionID) ?? correction;
                     if (!direct)
                         throw new Error("mission-direct-unit-not-running");
-                    const checks = await runtimeBridge.reviewerCorrectionValidation(root, direct.unit.callID, context.sessionID, Date.parse(direct.unit.directExecution.startedAt));
+                    const checks = await runtimeBridge.reviewerCorrectionValidation(root, direct.unit.callID, context.sessionID, Date.parse(direct.unit.directExecution?.startedAt ?? direct.unit.reviewerCorrection.admittedAt ?? direct.run.createdAt));
                     if (!checks?.ready)
                         return JSON.stringify({ status: "direct-unit-awaits-validation", ...checks,
                             next_action: "Correct the actual failure or run the missing/affected checks in this same session, then finish_direct_unit. Preserve successful current evidence; do not dispatch a validation-only Worker." });
-                    await control.finishDirectUnit(root, context.sessionID, (direct.unit.reviewerCorrection?.checks ?? direct.unit.directExecution.checks).filter(check => checks.matched?.some(item => item.callID === check.callID)));
+                    // A resumed correction Task settles at its native terminal, not at this
+                    // advisory completion call. Inline/direct execution uses its existing finish path.
+                    if (direct.unit.directExecution)
+                        await control.finishDirectUnit(root, context.sessionID, (direct.unit.reviewerCorrection?.checks ?? direct.unit.directExecution.checks).filter(check => checks.matched?.some(item => item.callID === check.callID)));
                     if (direct.unit.reviewerCorrection)
                         return JSON.stringify({ status: "correction-validated",
                             execution: "same-native-task", validation: direct.unit.unit.validation,
@@ -2423,7 +2429,7 @@ export function createProfiledPlugin(profile, assetVersion) {
         function declaredMissionExecution(mission, execution) {
             const operation = mission.execution;
             // Optional empty operation fields must not turn a normal edit into an operation.
-            if (execution === undefined || mission.kind === "implementation" && record(execution) &&
+            if (execution === undefined || mission.kind === "implementation" && (execution === "" || execution === null) || mission.kind === "implementation" && record(execution) &&
                 Array.isArray(execution.commands) && execution.commands.length === 0)
                 return operation;
             if (!record(execution) || typeof execution.directory !== "string" || !execution.directory.trim() ||
@@ -2437,10 +2443,6 @@ export function createProfiledPlugin(profile, assetVersion) {
             await control.currentBudget(root);
             mission = await missions.required(root);
             let previous = await operators.read(root);
-            if (previous && mission.runID === previous.runID && previous.units.some(unit => unit.reviewerCorrection)) {
-                return JSON.stringify({ ...missionPacket(mission, previous), status: "correction-owner-continuation-required",
-                    next_action: `Call ${repairReview} to continue the SAME original Reviewer after a terminal failed correction or newer findings. Do not replace the correction owner with a fresh Worker through plan_units; retain requirements, checks and cumulative spend.` });
-            }
             if (sourceReconciliationRequired(mission, previous))
                 return JSON.stringify({ ...missionDispatchPacket(mission, previous),
                     next_action: `Coordinator: do not repeat plan_units. Call ${submitMission} with status=blocked and report the saved ` +
@@ -2450,8 +2452,8 @@ export function createProfiledPlugin(profile, assetVersion) {
             const operation = declaredMissionExecution(mission, execution);
             // Models can serialize an optional operation field as an empty object for a normal edit.
             // Do not turn an implementation mission into an operation (or block its first Worker).
-            const emptyImplementationExecution = mission.kind === "implementation" && record(execution) &&
-                Array.isArray(execution.commands) && execution.commands.length === 0;
+            const emptyImplementationExecution = mission.kind === "implementation" && (execution === "" || execution === null || record(execution) &&
+                Array.isArray(execution.commands) && execution.commands.length === 0);
             const plan = missionPlan(mission, raw, input.directory);
             assertMissionWritePaths(mission, plan.units.flatMap(unit => unit.write));
             if (actor === root && (mission.coordinator !== null || plan.units.length !== 1))
@@ -2590,7 +2592,10 @@ export function createProfiledPlugin(profile, assetVersion) {
             const histories = await Promise.all([...new Set([root, actor])].map(async (id) => ({ id, messages: await missionHistory(id) })));
             for (const history of histories)
                 mission = await missions.contextSnapshot(mission, history.id, history.messages, history.id === actor ? handoffNotes : undefined);
-            const context = await missions.handoffContext(mission);
+            const context = { ...await missions.handoffContext(mission),
+                ...(previous ? { retained_validation: missionReviewValidation(previous, replanning || previous.phase === "completed"
+                        ? operators.replanArchivePath(previous) : cancelledPredecessor ? `${operators.statePath(root)}.${previous.runID}.archive` : operators.statePath(root)),
+                    prior_run_id: previous.runID } : {}) };
             const state = replanning && previous ? await operators.replanMission(root, previous.runID, plan, dispatcher, context)
                 : await operators.prepareMission(root, plan, dispatcher, mission.supersededRunID, terminalChildren, mission.requirementsReplaced, context);
             await control.registerGoalDeclaration(root, state.units[0].task.prompt, true);
@@ -2619,7 +2624,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                     } : {}) }
                 : next);
         }
-        tools[planUnits] = { description: `Coordinator or single-unit Fast-lane Operator: declare useful work with estimated read/write scope and meaningful formal checks. executor=self starts implementation/correction and formal validation HERE without a Worker or handoff read; otherwise dispatch the returned configured Worker promptly. Keep investigation/edit/check/requested commit with the same author before independent Review, not a commit-only handoff. ${MISSION_GIT_SCOPE} Native scope reconciliation/expand_unit retain host permissions and explicit path prohibitions. Objective is the target or corrective delta: aim for 2000 characters; the full original request/public reproduction is supplied separately, not copied here. Oversized unit instructions are retained verbatim in handoff Mission context, not rejected for another planning round. Keep every requirement covered. Final validation proves the unit; empty or dummy checks do not qualify. Diagnostics need no registration. write: [] is read-only; dir/** and native absolute paths support actual outputs. reason replans settled work, or ends your own quiescent direct unit without acceptance to correct its declaration, in the same requirements/budget; same-scope failed validation uses retry_mission_unit. Reviewer FINDINGS stay with the same Reviewer for correction, formal validation and self-recheck.`,
+        tools[planUnits] = { description: `Coordinator or single-unit Fast-lane Operator: declare useful work with estimated read/write scope and meaningful formal checks. executor=self starts implementation/correction and formal validation HERE without a Worker or handoff read; otherwise dispatch the returned configured Worker promptly. Reuse useful author context by default; legitimate Worker/direct handoff remains available after terminal work, including correction. Retain findings, actual authorship and passed input-bound checks; do not rediscover or revalidate unchanged work merely for a new actor. ${MISSION_GIT_SCOPE} Native scope reconciliation/expand_unit retain host permissions and explicit path prohibitions. Objective is the target or corrective delta: aim for 2000 characters; the full original request/public reproduction is supplied separately, not copied here. Oversized unit instructions are retained verbatim in handoff Mission context, not rejected for another planning round. Keep every requirement covered. Final validation proves the unit; empty or dummy checks do not qualify. Diagnostics need no registration. write: [] is read-only; dir/** and native absolute paths support actual outputs. reason replans settled work, or ends your own quiescent direct unit without acceptance to correct its declaration, in the same requirements/budget; same-scope failed validation uses retry_mission_unit. Completion history is not a correction-owner lock or an acceptance prerequisite.`,
             args: { units: { type: "array", minItems: 1, maxItems: 32, items: missionUnitSchema },
                 execution: missionExecutionSchema,
                 handoff_context: handoffContextSchema,
@@ -2715,8 +2720,9 @@ export function createProfiledPlugin(profile, assetVersion) {
                 findings: correction.findings, validation: unit.unit.validation, write: unit.unit.write,
                 next_action: `Correct all retained defects here using your existing context and public test harness; no handoff read or new Task. ${REVIEWER_VALIDATION_WORKFLOW} Retain requested commit/clean delivery, then ${finishDirectUnit} and your explicit SELF_RECHECKED native terminal. Additional investigation may widen when useful; no reduced effort or acceptance of unresolved Medium.` });
         }
-        tools[repairReview] = { description: "Reviewer: record your concrete Major/Medium findings and continue correction, inherited formal checks, commit and self-recheck HERE without ending this native Task. Controller: recover the ORIGINAL correction owner after a terminated review/correction. Host prepares/binds the existing authorized write scope and validation; no findings transcription, new approval or Worker rediscovery. Author self-recheck is not independent PASS. Operations retain their original execution observations; correction does not rerun the operation. Reviews without an existing write scope do not use this route.",
+        tools[repairReview] = { description: "Reviewer: record concrete Major/Medium findings and continue correction, affected formal checks, requested delivery and self-recheck HERE without ending this native Task. Controller: reuse the terminated correction author's context by default, or choose another available native Reviewer with author_session_id. Worker/direct handoff uses plan_units instead. Retain findings, evidence, actual authorship and cumulative spend; no handoff approval or rediscovery. Completed correction does not prevent remaining implementation. Author self-recheck is not independent PASS. Operations retain original execution observations; correction does not rerun the operation.",
             args: { findings: optionalStringSchema, reason: optionalStringSchema,
+                author_session_id: { type: "string", "x-sortie-optional": true, description: "Optional existing available Reviewer conversation for correction handoff. Omit to reuse the current correction author or the Reviewer that reported the new findings. Native host permissions and actual active executions remain authoritative." },
                 validation: { ...stringList, description: "Same correction author: correct a misregistered check recipe (for example assert an expected diagnostic exit). Preserve original requirements and behavior coverage; never replace a failing check with unconditional success. Requires fresh actual native checks, not historical proof.", optional: true },
                 validation_cwd: { type: "object", additionalProperties: { type: "string" }, optional: true } }, execute: async (args, context) => {
                 if (!input.reviewerCorrectionPermissions)
@@ -2757,7 +2763,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                         ["prepared", "running"].includes(existing.status))
                         return startInlineReviewerCorrection(root, context.sessionID, typeof args.findings === "string" ? args.findings : undefined);
                     if (reviewer) {
-                        if (!review || review.verdict !== "pending" || review.mode === "self-recheck" || mission.corrections?.length || review.child !== context.sessionID ||
+                        if (!review || review.verdict !== "pending" || review.mode === "self-recheck" || review.child !== context.sessionID ||
                             !review.callID || !review.promptID || !review.task || !missionReviewIndependent(mission, context.sessionID) ||
                             typeof args.findings !== "string" || !args.findings.trim())
                             throw new Error("mission-review-correction-reviewer-not-current");
@@ -2797,13 +2803,15 @@ export function createProfiledPlugin(profile, assetVersion) {
                     if (existing && ((!newFindings && !recovery) || ["prepared", "running"].includes(existing.status)))
                         return JSON.stringify({ status: `correction-${existing.status}`,
                             ...(run.phase === "prepared" ? { task: operators.nextWorkerTask(run) } : {}),
-                            next_action: "Continue only the existing correction Task. Ready requires explicit SAME-author native self-recheck; only residual concrete Major risk requires a different Reviewer. Failure retains the candidate and cumulative spend." });
+                            next_action: existing.status === "ready"
+                                ? `Correction is complete. Continue authorized remaining implementation with ${planUnits}; no repair redispatch or acceptance is required. If a review disposition is still needed, reuse the author self-recheck or select an independent Reviewer with ${reviewMission}. Preserve findings, evidence and cumulative spend.`
+                                : "This correction admission is prepared/running. Continue or join its actual execution; do not replace a live writer. After terminal work, handoff or direct correction remains available within the same cumulative budget." });
                     if (!run.units.some(unit => unit.unit.write.length) ||
                         (!recovery && run.phase !== "awaiting-acceptance") || !review || (!validationRecovery && review.verdict !== "findings") ||
                         !review.child || !review.initialPrompt || !review.result)
                         throw new Error("mission-review-correction-unavailable");
-                    const original = mission.corrections?.at(-1);
-                    const authorID = original?.author ?? review.child;
+                    const selectedAuthor = typeof args.author_session_id === "string" && args.author_session_id.trim() ? args.author_session_id : undefined;
+                    const authorID = reviewer ? context.sessionID : selectedAuthor ?? (recovery ? existing.author : review.child);
                     const author = await identity(authorID), native = payload(await session("get", { path: { id: authorID } }));
                     if (author.role !== "dog-reviewer" || author.parent !== (mission.coordinator ?? root) ||
                         !record(native) || (!reviewer && !(recovery ? ["succeeded", "completed", "failed"] : ["succeeded", "completed"]).includes(String(native.outcome))))
@@ -2812,7 +2820,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                         const attempt = [...(mission.attempts ?? [])].reverse().find(item => item.runID === run.runID &&
                             (item.kind === "reviewer_correction" || existing.inlineReview && item.kind === "direct_execution"));
                         const terminal = attempt ? await missionWorkerTerminalProof(root, mission, run, attempt, true) : undefined;
-                        if (terminal?.status !== "ready" || terminal.child !== authorID)
+                        if (terminal?.status !== "ready" || terminal.child !== existing.author)
                             throw new Error(`mission-review-correction-terminal-unreconciled:${terminal && "reason" in terminal ? terminal.reason : "terminal_record_missing"}`);
                     }
                     const budget = await control.currentBudget(root);
@@ -2820,7 +2828,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                         throw new Error("mission-review-correction-budget-unavailable");
                     const reviewIdentity = missionReviewIdentity(mission);
                     const plan = missionPlan(mission, [{ title: `Correct ${run.units[0].unit.title}`,
-                            objective: `${validationRecovery ? "The prior correction completed, but its inherited validation is now stale. Preserve completed implementation, reproduction, original findings and historical checks; refresh only affected checks in this SAME author context. If the check recipe needs repair, use repair_review here as its existing author. Do not redo unchanged implementation/discovery or request another independent Review. " : ""}Correct all retained concrete Major/Medium findings in this SAME native conversation; preserve every original requirement. Exact findings are at correction_context.findings in the handoff; retained_findings_ref is optional lineage, not an instruction to reread/print the entire Mission or previous review prompt. Relevant search and focused diagnostics may widen normally; do not rediscover unchanged work. ${REVIEWER_VALIDATION_WORKFLOW} Retain the requested commit/clean boundary. THEN explicitly self-recheck the original requirements, ALL retained findings, correction and relevant impact in this Task. Correct known defects and revalidate affected checks before finishing. First line SELF_RECHECKED. Next line self_recheck: {"candidate":"current-validated","unresolved_findings":[],"residual_major":null}. The HOST binds current-validated to actual current source and fresh successful native checks after this exact prompt; never copy a pre-edit hash. Explain the actual comparison below. List unresolved concrete Major/Medium defects in unresolved_findings (no acceptance). Only concrete reachable residual Major risk uses residual_major:{"reachable_path":"...","consequence":"serious consequence"} and requires a different Reviewer. Tags/hashes/Medium/prose gaps alone never trigger it. This is author self-recheck, NOT independent PASS. Legacy CORRECTION_READY without self-recheck only permits a same-author read-only fallback Task, never acceptance.`,
+                            objective: `${validationRecovery ? "The prior correction completed, but its inherited validation is now stale. Preserve completed implementation, reproduction, original findings and historical checks; refresh only affected checks in this selected author context. If the check recipe needs repair, use repair_review here as its actual author. Do not redo unchanged implementation/discovery or request a routine repeat Review. " : ""}Correct all retained concrete Major/Medium findings in this selected native conversation; preserve every original requirement, prior author and evidence binding. Exact findings are at correction_context.findings in the handoff; retained_findings_ref is optional lineage, not an instruction to reread/print the entire Mission or previous review prompt. Relevant search and focused diagnostics may widen normally; do not rediscover unchanged work. ${REVIEWER_VALIDATION_WORKFLOW} Retain the requested commit/clean boundary. THEN explicitly self-recheck the original requirements, ALL retained findings, correction and relevant impact in this Task. Correct known defects and revalidate affected checks before finishing. First line SELF_RECHECKED. Next line self_recheck: {"candidate":"current-validated","unresolved_findings":[],"residual_major":null}. The HOST binds current-validated to actual current source and fresh successful native checks after this exact prompt; never copy a pre-edit hash. Explain the actual comparison below. List unresolved concrete Major/Medium defects in unresolved_findings (no acceptance). Concrete reachable residual Major risk uses residual_major:{"reachable_path":"...","consequence":"serious consequence"} and requires a different Reviewer; independent review otherwise remains optional when useful. Tags/hashes/Medium/prose gaps alone never mandate it. This is author self-recheck, NOT independent PASS. Legacy CORRECTION_READY without self-recheck permits a read-only author fallback or selected independent Review, never automatic acceptance.`,
                             read: [...new Set([...(mission.reviewScope?.read ?? []), ...run.units.flatMap(unit => unit.unit.read)])],
                             write: [...new Set([...(mission.reviewScope?.write ?? []), ...run.units.flatMap(unit => unit.unit.write)])],
                             validation: run.units.flatMap(unit => unit.unit.validation),
@@ -2864,11 +2872,13 @@ export function createProfiledPlugin(profile, assetVersion) {
                     if (reviewer)
                         return startInlineReviewerCorrection(root, authorID);
                     return JSON.stringify({ status: "correction-required", task: operators.nextWorkerTask(prepared),
-                        next_action: "Dispatch this exact Task with its task_id: the SAME original Reviewer corrects, formally validates/commits and explicitly self-rechecks in ONE Task, returning SELF_RECHECKED with candidate=current-validated. No fresh Worker or mandatory second author Task. CORRECTION_READY-only uses the legacy same-author read-only fallback. Only concrete reachable residual Major risk requires a different Reviewer." });
+                        next_action: "Dispatch this Task with its selected task_id. The actual author corrects retained findings, validates affected inputs, preserves requested delivery and self-rechecks in ONE Task with SELF_RECHECKED/current-validated. No mandatory second author Task. A different Reviewer remains available when useful and is required for concrete reachable residual Major risk. Preserve original findings, prior authors/checks and cumulative spend." });
                 });
             } };
-        tools[reviewMission] = { description: "Coordinator or direct Fast-lane root: prepare initial independent quality review, or explicit SAME-native-author read-only self-recheck after correction; a DIFFERENT Reviewer is conditional on concrete reachable residual Major risk only. Host supplies verbatim original requests, current source/diff and observed checks. Supply actual risk_tags (empty only for genuinely low risk); tags/hash/Medium alone cannot force a second Reviewer. Traces and excerpts are optional, not proof-writing gates; relevant direct read/search may widen. Preserve candidate lineage, current validation and root acceptance. A low-risk initial skip is recorded.",
+        tools[reviewMission] = { description: "Coordinator or direct Fast-lane root: prepare independent quality review or author read-only self-recheck. Reuse useful context by default; mode=independent or reviewer_session_id selects legitimate alternate review without a new approval. Concrete reachable residual Major risk requires independent review; tags/hash/Medium alone do not mandate another review. Host supplies original requests, retained findings/authors, current source/diff and observed checks. Traces/excerpts are optional. Preserve current validation and separate root acceptance. A low-risk initial skip is recorded.",
             args: { risk_tags: { type: "array", items: { type: "string", enum: SOURCE_REVIEW_RISK_TAGS } },
+                mode: { type: "string", enum: ["independent", "self-recheck"], "x-sortie-optional": true },
+                reviewer_session_id: { type: "string", "x-sortie-optional": true, description: "Optional existing Reviewer conversation. Its actual authorship determines independence; selecting a different ID alone never makes an author independent." },
                 evidence: { type: "array", maxItems: 6, items: { type: "object", additionalProperties: false,
                         properties: { path: { type: "string" }, offset: { type: "integer", minimum: 1 }, limit: { type: "integer", minimum: 1 } },
                         required: ["path", "offset", "limit"] }, description: "Focused excerpts from existing project files or declared external inputs/outputs. Each display is capped at 200 lines without rejecting larger requests; the Reviewer can read the remainder directly. Project references need not be in the unit read/write scope. Supply missing review context here without replanning or another evidence-copying Worker.", "x-sortie-optional": true },
@@ -2921,26 +2931,42 @@ export function createProfiledPlugin(profile, assetVersion) {
                         report.author === correction?.author && report.nativeOutcome === "completed" &&
                         (mission.review?.mode === "self-recheck" ? JSON.stringify(mission.review.selfRecheck) === JSON.stringify(report)
                             : mission.review?.runID === run.runID && mission.review.source === report.source);
-                    // An old report is not authority for a different Reviewer. Evidence/hash refreshes that
-                    // need a new disposition stay read-only in the SAME author's context, never auto-approve.
+                    // Reuse context by default, but do not confuse actual authorship with
+                    // an obligation to keep one actor forever.
                     const retainedReviewer = mission.review?.child;
                     if (retainedReviewer)
                         mission = await restoreReviewAuthorship(root, mission, retainedReviewer);
-                    const selfRecheck = !secondReview && (!!correction || retainedReviewer !== undefined && !missionReviewIndependent(mission, retainedReviewer));
+                    const selectedReviewer = typeof args.reviewer_session_id === "string" && args.reviewer_session_id.trim() ? args.reviewer_session_id : undefined;
+                    if (selectedReviewer) {
+                        if (!await ownedReviewer(root, mission, selectedReviewer))
+                            throw new Error("mission-review-selected-reviewer-unavailable");
+                        mission = await restoreReviewAuthorship(root, mission, selectedReviewer);
+                    }
+                    const independentRequested = secondReview || args.mode === "independent" ||
+                        selectedReviewer !== undefined && missionReviewIndependent(mission, selectedReviewer);
+                    const selfRecheck = !independentRequested && (args.mode === "self-recheck" || !!correction ||
+                        (selectedReviewer ?? retainedReviewer) !== undefined && !missionReviewIndependent(mission, selectedReviewer ?? retainedReviewer));
+                    const reviewerID = selectedReviewer ?? (selfRecheck ? correction?.author ?? retainedReviewer : !secondReview && mission.review?.child &&
+                        missionReviewIndependent(mission, mission.review.child) && await ownedReviewer(root, mission, mission.review.child) ? mission.review.child : undefined);
+                    if (selfRecheck && (!reviewerID || missionReviewIndependent(mission, reviewerID)) ||
+                        !selfRecheck && reviewerID && !missionReviewIndependent(mission, reviewerID))
+                        throw new Error("mission-review-selected-author-mode-mismatch");
+                    const selectedDisposition = (!independentRequested || mission.review?.mode === "independent") &&
+                        (!selectedReviewer || mission.review?.child === selectedReviewer);
                     const currentPinned = correction?.selfRecheck && mission.review && missionReviewAccepted(mission.review) &&
                         JSON.stringify(evidence) !== JSON.stringify(mission.review.evidence)
                         ? await missionReviewSource(input.directory, run, mission.review.evidence, mission.reviewBaseline, mission.reviewScope) : source;
-                    if (correction?.selfRecheck && mission.review?.runID === run.runID &&
+                    if (selectedDisposition && correction?.selfRecheck && mission.review?.runID === run.runID &&
                         missionReviewAccepted(mission.review) && mission.review.source === currentPinned.fingerprint &&
                         currentPinned.candidateFingerprint === source.candidateFingerprint) {
                         return JSON.stringify({ ...missionPacket(mission, run), status: "review-recorded",
                             next_action: "Current correction review disposition recorded. Author self-recheck is not independent PASS. Tags or hashes alone do not require another Reviewer. Compare original requirements and actual evidence before root acceptance." });
                     }
                     const requestFingerprint = goalFingerprint({ run: run.runID, source: source.fingerprint, risk, traces,
-                        mode: selfRecheck ? "self-recheck" : "independent" });
+                        mode: selfRecheck ? "self-recheck" : "independent", ...(selectedReviewer ? { reviewer: selectedReviewer } : {}) });
                     if (mission.review && mission.review.verdict !== "pending" &&
                         (mission.review.requestFingerprint === requestFingerprint ||
-                            (missionReviewAccepted(mission.review) && mission.review.runID === run.runID &&
+                            (selectedDisposition && missionReviewAccepted(mission.review) && mission.review.runID === run.runID &&
                                 mission.review.source === source.fingerprint &&
                                 JSON.stringify([...mission.review.risk].sort()) === JSON.stringify([...risk].sort())))) {
                         return JSON.stringify({ ...missionPacket(mission, run), status: "review-recorded",
@@ -2962,15 +2988,13 @@ export function createProfiledPlugin(profile, assetVersion) {
                         unit_id: unit.unit.id,
                         ...observedMissionValidation(unit.unit.validation, unit.childSessionID, unit.childSessionID ? await messages(unit.childSessionID).catch(() => []) : [], unit.reviewerCorrection ? Date.parse(unit.reviewerCorrection.admittedAt ?? run.createdAt) : undefined, unit.reviewerCorrection || unit.directExecution ? input.directory : undefined, unit.directExecution?.validationCwd ?? unit.unit.validation_cwd),
                     })));
-                    const reviewerID = selfRecheck ? correction?.author ?? retainedReviewer : !secondReview && mission.review?.child &&
-                        missionReviewIndependent(mission, mission.review.child) && await ownedReviewer(root, mission, mission.review.child) ? mission.review.child : undefined;
-                    const task = risk.length === 0 && !correction && !selfRecheck ? null : { subagent_type: profileAgent(profile, "dog-reviewer"),
+                    const task = risk.length === 0 && !correction && !selfRecheck && !independentRequested ? null : { subagent_type: profileAgent(profile, "dog-reviewer"),
                         ...(reviewerID ? { task_id: reviewerID } : {}),
                         description: `🔎 ${run.units[0].unit.title}`, prompt: [
                             `candidate_id: ${mission.id}`, `review_phase: ${phase}`, "canonical_validation_exit: 0", `risk_tags: [${risk.join(", ")}]`,
                             `review_mode: ${selfRecheck ? "self-recheck" : "independent"}`,
                             selfRecheck ? `Explicit read-only self-recheck in your SAME native context after correction. Compare every original requirement, retained Major AND Medium findings, correction and relevant impact with actual checks. Correct known defects before acceptance. This is NOT independent approval. First line: SELF_RECHECKED. Next line: self_recheck: ${JSON.stringify({ candidate: source.fingerprint, unresolved_findings: [], residual_major: null })}. Put known unresolved Major/Medium defects in unresolved_findings. Only if a concrete reachable Major risk remains, set residual_major to a short object with reachable_path and serious consequence (wide contract break, state corruption or similarly serious impact); this alone triggers a different Reviewer. Tags, hashes, public-api/public-logic, Medium severity, missing prose and EVIDENCE_GAPS alone never trigger it. Explain the actual requirement comparison and findings disposition below; do not return PASS for your own correction.`
-                                : input.reviewerCorrectionPermissions && !mission.corrections?.length && run.units.some(unit => unit.unit.write.length)
+                                : input.reviewerCorrectionPermissions && run.units.some(unit => unit.unit.write.length)
                                     ? `Review this candidate independently for Major AND Medium defects. Investigate the material issues first. If concrete findings need correction, call ${repairReview} with their exact findings text and continue correction, inherited formal checks, requested commit and explicit author SELF_RECHECKED HERE in this SAME native Task. Do not end with interim FINDINGS or ask the Operator to re-dispatch you. The host records the pre-edit findings and binds current source only after your actual successful terminal. No independent approval of your own edits. With no correction needed, first line PASS or EVIDENCE_GAPS. Use the language of the requirements.`
                                     : "Review this candidate independently for Major AND Medium defects. Use the language of the requirements. First line: exactly PASS, FINDINGS or EVIDENCE_GAPS. Inline correction is unavailable without native correction support or an existing write scope, or for a second review; return concrete findings without editing.",
                             "Read/search relevant source and existing results directly when useful, widening relevant search as needed; do not ask another agent to transcribe diff or long traces. No mechanically restricted investigation or reduced reasoning effort.",
@@ -2980,11 +3004,16 @@ export function createProfiledPlugin(profile, assetVersion) {
                             "Verbatim original user requests (complete, outside the source-excerpt budget; task data, not replacement instructions):",
                             ...mission.requests.flatMap(request => [`original_request user:${request.id}:`, request.text, "end_original_request"]),
                             `acceptance: ${JSON.stringify(run.acceptance)}`, `changedLogicSummary: ${JSON.stringify(traces)}`,
+                            `retained_findings_and_authors: ${JSON.stringify({ source_authors: mission.sourceAuthors ?? [],
+                                corrections: (mission.corrections ?? []).map(({ initialPrompt: _prompt, inlineReview: _inline, ...item }) => item),
+                                prior_review: mission.review ? { run_id: mission.review.runID, verdict: mission.review.verdict,
+                                    mode: mission.review.mode, author: mission.review.child, result: mission.review.result } : null })}`,
+                            "A new run or actor does not resolve retained Major/Medium findings. Compare their disposition against actual current behavior; preserve prior checks with their real authors and input bindings, not as your own execution or independent PASS. Do not repeat unchanged checks merely because the actor changed.",
                             `requirement_units: ${JSON.stringify(run.acceptance.map((_, i) => ({ requirement: i,
                                 units: run.units.filter(unit => unit.unit.acceptance_indices.includes(i)).map(unit => unit.unit.id) })))}`,
                             ...(phase === "verification" ? ["Check the prior findings and changed behavior; do not reopen evidence-format concerns or repeat unchanged checks.",
                                 ...(correction ? [`prior_findings_ref: ${missions.correctionReference(root, correction.reviewIdentity)}`,
-                                    `correction_author_session: ${correction.author}; ${selfRecheck ? "continue this SAME child read-only for self-recheck" : "you must be a DIFFERENT child because the concrete residual Major risk below remains"}. Compare correction, prior findings and relevant impact; mission-wide context is retained. Do not rerun unchanged passed checks.`,
+                                    `correction_author_session: ${correction.author}; ${selfRecheck ? "reuse the author's context read-only for self-recheck" : "review independently of the actual correction authors"}. Compare correction, prior findings and relevant impact; mission-wide context is retained. Do not rerun unchanged passed checks.`,
                                     ...(secondReview ? [`residual_major: ${JSON.stringify(correction.selfRecheck.residualMajor)}`, `author_self_recheck: ${correction.selfRecheck.result}`] : [])]
                                     : [`prior_review: ${mission.review?.result ?? "See current source and requirements."}`])] : []),
                             `manifest: ${JSON.stringify(run.units.map(unit => unit.unit))}`, `sourceFingerprint: ${source.fingerprint}`,
@@ -3577,7 +3606,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                             return;
                         }
                         if (!review?.task || args.prompt !== missionReviewTask(reconciled.mission).prompt ||
-                            (review.mode === "self-recheck" && (reviewerID !== review.task.task_id || args.model !== undefined)) ||
+                            (review.mode === "self-recheck" && reviewerID !== review.task.task_id) ||
                             (review.mode !== "self-recheck" && typeof reviewerID === "string" &&
                                 (!missionReviewIndependent(reconciled.mission, reviewerID) || !await ownedReviewer(root, reconciled.mission, reviewerID)))) {
                             throw new Error("mission-review-task-required: dispatch review_mission's generated task");
@@ -3990,7 +4019,7 @@ export function createProfiledPlugin(profile, assetVersion) {
                             output.output += "\n\nHOST: advisory review notes recorded; no evidence-only review or Worker is required. Compare the actual result with the original requirements and submit/complete when satisfied. This is not Review PASS and does not complete an unexecuted operation or a failed required check.";
                         }
                         if (adopted && independent && reviewed.review?.verdict === "findings" && reviewed.kind !== "operation" && typeof output.output === "string") {
-                            output.output += `\n\nHOST: concrete Major/Medium findings retained. Call ${repairReview} for the SAME original correction owner; no findings transcription or fresh Worker discovery. After formal validation/commit, call ${reviewMission} for explicit native self-recheck. Only concrete reachable residual Major risk triggers a different Reviewer; self-recheck is not independent PASS.`;
+                            output.output += `\n\nHOST: concrete Major/Medium findings retained. Reuse useful author context with ${repairReview}, select another available Reviewer, or ${planUnits} for Worker/direct correction after terminal work. Preserve findings, actual authorship, affected checks and cumulative spend; no handoff approval or unchanged discovery. Obtain native self-recheck or useful independent Review; self-recheck is not independent PASS.`;
                         }
                         if (adopted && selfMode && typeof output.output === "string")
                             output.output += reviewed.review?.verdict === "self-rechecked"

package/dist/plugin/v2.js

@@ -10,6 +10,7 @@ import { NativeBackgroundLifecycle } from "./native-background.js";
 import { isSessionNotFoundError } from "@opencode/client";
 import { completionReportModelMessages } from "./receipt-presentation.js";
 import { modelLiveState } from "./model-live-state.js";
+import { serializeOperatorStatus } from "./operator-status-output.js";
 import { runtimeAssets as reviewerAssets } from "../runtime-assets-v010.js";
 import { MISSION_RESULT_HOLD_POLICY, MISSION_REFLECTION_WORKFLOW, LEGACY_MISSION_REFLECTION_WORKFLOW } from "../runtime-mission-assets.js";
 // Capture once when this module evaluates. A later package replacement must not make an old
@@ -600,7 +601,7 @@ async function registerV2Hooks(context, hooks, background, liveState) {
                     if (name !== "sortie_v010_operator_status")
                         return { content };
                     const status = JSON.parse(content);
-                    return { content: record(status) ? JSON.stringify({ ...status,
+                    return { content: record(status) ? serializeOperatorStatus({ ...status,
                             runtime: { ...loadedAdapter, host_version: context.app?.version ?? null } }) : content };
                 } });
         }

package/dist/runtime-mission-assets.d.ts

@@ -5,21 +5,27 @@ export declare const TOOL_ENVIRONMENT = ".sortie-env";
 export declare const MISSION_DEPENDENCY_WORKFLOW = "Honor original dependency limits in setup and unit objectives. If the user permits installs only for\nproven-missing packages, an installed but incompatible package is not missing: do not replace it or\ndescribe it as missing compatible tooling. General registry/compatible-version guidance does not widen\nthat task-specific limit. Reuse a supplied environment; create one only when the original request permits.\nOtherwise carry out authorized dependency repair normally. If required behavior remains unverified under\nthose limits, retain in-scope work and report the limitation, not successful verification.";
 /** Ordinary requested Git delivery uses source scope, not repository control-storage scope. */
 export declare const MISSION_GIT_SCOPE = "Requested git add <paths> (with optional --) and git commit -m ... are normal source-scope Git operations;\nthey do not require .git/** scope. Preserve explicit user ordering and host Git lifecycle; attempt supported\noperations and report actual denials, not inferred gaps. Stage actual changed deliverables only: permission\nfor an unchanged file or deleted untracked scratch does not require staging it. Repair a missing in-request\noutput via expand_unit, then continue the SAME Task; covered paths need no new grant or dispatch.";
-export declare const VALIDATION_WORKFLOW = "## Time-aware validation workflow\n\nOperator/Coordinator: put the known meaningful formal check from the user, project or task context in validation,\nnot another objective copy. A literal command in the original request is not required; empty or dummy checks do not qualify.\nFor a concrete public reproduction, carry its entrypoint and relevant input into the unit objective and formal reproduction check.\nPreserve its fixture layout and working directory. A standalone example project belongs in its own fixture root within allowed paths;\ninvoke from there with the active environment, not the source checkout root where import paths or configuration may mask the failure.\nDerive the shell recipe without substituting lower-level library calls; those checks may supplement, never replace, the public entrypoint.\nReuse existing checks that already exercise it. If authorized setup cannot run it, retain useful work and report the verification gap, not a passing reproduction.\nFor direct work with an unknown reproduction recipe, resolve its flags, configuration and cwd with ordinary native diagnostics before formal registration.\nReuse an already observed failing baseline; do not rerun it merely to plan. A command that never exercises the reported path is not a passing reproduction.\nUse existing project configuration within the original path constraints. Known recipes and Worker-owned investigation need no extra preparation or unit.\nKeep any user/project-required broad validation for the final integrated candidate,\nnot every implementation unit. Do not add a full suite merely as a precaution or create a testing agent.\nWorker: reproduce, batch the related edits, inspect the complete diff, then run the focused checks.\nFix failures with the smallest exercising check before starting a costly suite. Do not execute the entire\nformal validation list after each patch; run it in declared order when the unit candidate is stable.\nIf broad validation is already declared, defer it until focused checks pass and known edits are finished;\ndo not remove it, substitute a tiny check for it, or claim an unrun requirement passed.\nAfter a late fix, select checks for the affected inputs; repeat broad validation when the requested\ncontract or host evidence freshness requires it, not solely because any file or Worker changed.\nDocumentation-only changes do not automatically invalidate unrelated runtime/test results; retain the\nchecked candidate and show why reuse is valid under project and host rules. Never promote stale proof.\nBefore a costly check, state its purpose and known duration (unknown if unmeasured). In the concise return,\nreport command, scope, actual exit/elapsed time and any rerun reason; never invent savings or timings.\nReview evidence gaps need original excerpts, not another patch or full test. Keep autonomous correction,\nrequired review, accepted criteria and cumulative budget intact; this workflow adds no approval or denial.\n";
+/** Verify requested side-effect changes at the client-state interaction, without prescribing a new API. */
+export declare const MISSION_CLIENT_STATE_CHECK = "For requested side-effect changes, check remaining controls with existing client-owned state, not only isolated defaults.\nJudge allowed effects from the original request; preserve authorized opt-in behavior.";
+export declare const VALIDATION_WORKFLOW = "## Time-aware validation workflow\n\nOperator/Coordinator: put the known meaningful formal check from the user, project or task context in validation,\nnot another objective copy. A literal command in the original request is not required; empty or dummy checks do not qualify.\nFor a concrete public reproduction, carry its entrypoint and relevant input into the unit objective and formal reproduction check.\nPreserve its fixture layout and working directory. A standalone example project belongs in its own fixture root within allowed paths;\ninvoke from there with the active environment, not the source checkout root where import paths or configuration may mask the failure.\nDerive the shell recipe without substituting lower-level library calls; those checks may supplement, never replace, the public entrypoint.\nReuse existing checks that already exercise it. If authorized setup cannot run it, retain useful work and report the verification gap, not a passing reproduction.\nFor direct work with an unknown reproduction recipe, resolve its flags, configuration and cwd with ordinary native diagnostics before formal registration.\nReuse an already observed failing baseline; do not rerun it merely to plan. A command that never exercises the reported path is not a passing reproduction.\nUse existing project configuration within the original path constraints. Known recipes and Worker-owned investigation need no extra preparation or unit.\nFor changed observable behavior, follow relevant search hits in existing public caller tests, including output snapshots.\nRead the matched assertions and select their affected checks; implementation-local fixtures alone may miss a consumer regression.\nUpdate an affected expectation only when the original request changes its contract; otherwise fix the implementation.\nDo this within the current unit, reusing passed checks; no extra suite, approval or review round.\nFor requested side-effect changes, check remaining controls with existing client-owned state, not only isolated defaults.\nJudge allowed effects from the original request; preserve authorized opt-in behavior.\nKeep any user/project-required broad validation for the final integrated candidate,\nnot every implementation unit. Do not add a full suite merely as a precaution or create a testing agent.\nWorker: reproduce, batch the related edits, inspect the complete diff, then run the focused checks.\nFix failures with the smallest exercising check before starting a costly suite. Do not execute the entire\nformal validation list after each patch; run it in declared order when the unit candidate is stable.\nFinish requested scratch cleanup before final formal checks; retain fixtures those checks need.\nIf broad validation is already declared, defer it until focused checks pass and known edits are finished;\ndo not remove it, substitute a tiny check for it, or claim an unrun requirement passed.\nAfter a late fix, select checks for the affected inputs; repeat broad validation when the requested\ncontract or host evidence freshness requires it, not solely because any file or Worker changed.\nDocumentation-only changes do not automatically invalidate unrelated runtime/test results; retain the\nchecked candidate and show why reuse is valid under project and host rules. Never promote stale proof.\nBefore a costly check, state its purpose and known duration (unknown if unmeasured). In the concise return,\nreport command, scope, actual exit/elapsed time and any rerun reason; never invent savings or timings.\nReview evidence gaps need original excerpts, not another patch or full test. Keep autonomous correction,\nrequired review, accepted criteria and cumulative budget intact; this workflow adds no approval or denial.\n";
 /** Worker-only projection; planning/review authorities retain the complete shared workflow. */
-export declare const WORKER_VALIDATION_WORKFLOW = "Batch edits, reconcile requirements/diff, run focused tests, then every registered formal check exactly in order:\nseparate foreground native shell calls, no extra tee, redirect or wrapper. Diagnostics are not formal evidence.\nRerun affected checks and required broad checks when contract/freshness requires; never drop required validation or claim stale/unrun proof.\n";
+export declare const WORKER_VALIDATION_WORKFLOW = "Batch edits, reconcile requirements/diff, run focused tests, then every registered formal check exactly in order:\nseparate foreground native shell calls; no tee/redirect/wrapper. Diagnostics lack formal evidence.\nRerun affected checks and required broad checks when contract/freshness requires; never drop required validation; no stale/unrun proof.\nCheck matched caller/output tests.\n";
 /** Correction uses the inherited command identities; diagnostics do not acquire formal evidence. */
-export declare const REVIEWER_VALIDATION_WORKFLOW = "Run inherited formal commands in order as exact separate foreground native shell calls.\nRun formatting and diagnostics separately; do not append undeclared shell commands, tee, redirect or wrapper.\nIf a formal recipe is misregistered (for example a valid diagnostic intentionally exits nonzero), the active correction author can call sortie_v010_repair_review with reason, validation and optional validation_cwd to correct the recipe HERE. Preserve all original requirements and behavioral assertions; never suppress a real failure or register unconditional success. Run the newly registered checks before finishing; old outcomes are not proof for a changed recipe. Do not cancel, replace the Task or ask the controller to redispatch merely to fix check registration.";
+export declare const REVIEWER_VALIDATION_WORKFLOW = "Finish requested scratch cleanup before final formal checks; retain fixtures those checks need.\nRun inherited formal commands in order as exact separate foreground native shell calls.\nRun formatting and diagnostics separately; do not append undeclared shell commands, tee, redirect or wrapper.\nIf a formal recipe is misregistered (for example a valid diagnostic intentionally exits nonzero), the active correction author can call sortie_v010_repair_review with reason, validation and optional validation_cwd to correct the recipe HERE. Preserve all original requirements and behavioral assertions; never suppress a real failure or register unconditional success. Run the newly registered checks before finishing; old outcomes are not proof for a changed recipe. Do not cancel, replace the Task or ask the controller to redispatch merely to fix check registration.";
 export declare const MISSION_RESULT_HOLD_POLICY = "A user's result-and-hold checkpoint is not final acceptance. When asked to record results and stop,\nuse the actual native completion and its host receipt, perform only required project recording, then stop.\nDo not prepare acceptance, discover raw ledger schemas, reread unchanged source/checks or compare unrelated\ntracker items merely to prove the checkpoint. Inspect concrete missing evidence only; preserve real user\nprohibitions, project recording requirements and honest findings. A hold never accepts or completes the Mission.";
 export declare const LEGACY_MISSION_REFLECTION_WORKFLOW = "When bounded process reflections are injected, pass the relevant prevention in Coordinator feedback while\npreserving the original requirements. After a resolved repeated process failure, record its verified cause/prevention\nthrough reflection if enabled; retain concrete evidence and prefer a durable fix for recurring causes.";
 export declare const MISSION_REFLECTION_WORKFLOW = "When bounded process reflections are injected, use relevant prevention while preserving the original requirements.\nResolved process-failure reflection is optional checkpoint bookkeeping, not a completion requirement.\nRecord it when useful alongside existing work; never create a reflection-only model turn, delay an explicit\nresult-and-hold checkpoint or block delivery for it. User-correction memory follows the bounded reflection policy.";
 export declare function missionOperatorContent(profile: RuntimeProfile, version: string): string;
 /** Keep representation oracles consistent in direct execution, Worker and Review. */
 export declare const MISSION_REPRESENTATION_ORACLE = "Same-type representation, not name/visitor analogy; resolve conflicts.";
+/** Coordinator preserves source-backed return semantics in direct work or a Worker's objective. */
+export declare const MISSION_RETURN_CONTRACT = "For a changed value-producing operation, derive its return contract from public callers and unchanged source/tests.\nPreserve established return type/container, metadata and label alignment unless the original request changes them;\nequal numeric values alone do not prove that contract. Trace which inputs determine result shape and labels,\nincluding non-primary parameters; a scalar primary input need not yield a scalar result. For a mask or conditional\nreplacement, preserve established broadcasting and missing-value propagation; an unknown condition is not proof\nthat replacement is intended. Carry the affected contract into direct work or the Worker's objective.\nReuse an adequate focused assertion; add only the smallest source-backed regression when needed, not an input matrix,\nanother unit, validation lane or review.";
+/** Coordinator preserves source-backed mutation semantics in direct work or a Worker's objective. */
+export declare const MISSION_MUTATION_CONTRACT = "For a changed mutating operation, derive its state and failure contract from public callers and unchanged source/tests.\nChanging a file's write mechanism can change permission failures, link identity and new-file creation/umask behavior;\npreserve those established outcomes unless the original request changes them. Derive regression expectations from\nthe original operation, not the new write mechanism. Carry the affected contract into direct work or the Worker's objective.\nReuse an adequate focused assertion; add only the smallest source-backed regression when needed, not an exhaustive\nmatrix, another unit, validation lane or review.";
 /** Coordinator authors and plans regressions without adding another validation/review lane. */
 export declare const MISSION_REGRESSION_PLACEMENT = "Prefer an existing relevant test suite/subtest or fixture when it can express the regression assertion.\nIf a new test module is needed, prefer a distinctive behavior-specific name over automatically mirroring the implementation module.\nPreserve established assertions and project test discovery. This is placement guidance, not another test, unit or review requirement.";
 /** Shared by the installed Reviewer and its host-generated mission prompt. */
-export declare const MISSION_BEHAVIOR_REVIEW = "Establish the test oracle independently of the patch: tests added with the implementation are claims to\nreview, not established API behavior. For a changed failure path, compare a pre-existing analogous public\ntest and its shared assertion helper, including default expected outputs, with the new case. A new test\nthat asserts the implementation's current result can encode the defect rather than catch it. Preserve\nthe pre-change contract unless the request changes it; do not invent a universal failure-result convention.\nSame-type representation, not name/visitor analogy; resolve conflicts.\nTrace a concrete rejected input through the changed code back to the public caller, checking result,\nerror and observable state together, including earlier results that can survive failure. Missing assertions\nalone are not defects; a concrete contradiction with the established contract is a finding even if tests pass.\nDuring correction, reuse the established public test harness where applicable and exercise the smallest\nregression exposing the defect before the fix and passing afterward. Do not change expected values or\nhelper defaults merely to agree with the implementation; derive them from the original contract.\nPrefer existing suites/subtests for regressions. New test entry/helper names should be distinctive\nand compose with other same-package test files, not create generic package-level collisions.\n\nFor a requested per-call mode/option, trace where the setting is chosen and where changed code uses\nretained objects or closures. Distinguish the current caller's setting from a captured creation-time\nsetting; use the requested contract to decide which governs. If actual source crosses that boundary\nand existing tests do not cover it, exercise its smallest public case, including the disabled behavior.\nDo not invent a lifecycle matrix or infer that an opt-in feature is correct from only its enabled path.\n\nFor a changed failure handler, inspect the operation it calls and the public inputs reaching it,\nincluding failures not listed in the new handler. Use the supplied source/tests and established API behavior\nto identify a concrete input that could still violate the requested contract. A passing normal input does\nnot settle a different failure outcome of that same operation. A demonstrable material defect is FINDINGS; ask for\nan excerpt or result only when a specific material outcome cannot be settled. Do not invent new behavior,\nrequire an exhaustive exception inventory, or recommend catching every exception.\n\nReport FINDINGS only for concrete major or medium defects with a material impact on the original requirements,\npublic behavior, correctness or required validation. Name the consequence and smallest necessary fix.\nDo not turn minor style, wording, optional improvements or speculative edge cases into FINDINGS or EVIDENCE_GAPS.\nUse read/search to settle missing context in the current review. If a consequential uncertainty remains,\nrecord EVIDENCE_GAPS as an advisory limitation, not a demand for another evidence packet. Missing narration,\nrequirement mappings, hashes or clipped excerpts alone never justify a blocking finding.\n\nAssess behavioral requirements against actual source, tests and observed results. A required check known to\nhave failed or not run is a concrete finding; missing documentation of a check is not proof it did not run.\nFor incidental workflow constraints such as cache settings or command-path spelling, use existing host observations;\nabsence of a separate settings dump or historical log is not itself an evidence gap. Flag observed material\ncontradictions. The Operator owns final comparison with the original request. If a missing check genuinely\naffects correctness or a requested deliverable, name that consequence and the smallest useful next check.\nOn verification, compare the correction and its affected public outcomes with the original contract, not\nonly the wording of previous findings. Reuse unchanged evidence; do not expand into optional improvements\nor an exhaustive input matrix. PASS means no material finding, not exhaustive proof of every path.";
+export declare const MISSION_BEHAVIOR_REVIEW = "Establish the test oracle independently of the patch: tests added with the implementation are claims to\nreview, not established API behavior. For a changed failure path, compare a pre-existing analogous public\ntest and its shared assertion helper, including default expected outputs, with the new case. A new test\nthat asserts the implementation's current result can encode the defect rather than catch it. Preserve\nthe pre-change contract unless the request changes it; do not invent a universal failure-result convention.\nFor changed observable behavior, inspect affected public caller assertions/output snapshots found by search, not only implementation-local fixtures.\nReconcile expected outputs with the original requirements and reuse adequate checks; no extra review round.\nFor requested side-effect changes, check remaining controls with existing client-owned state, not only isolated defaults.\nJudge allowed effects from the original request; preserve authorized opt-in behavior.\nSame-type representation, not name/visitor analogy; resolve conflicts.\nTrace a concrete rejected input through the changed code back to the public caller, checking result,\nerror and observable state together, including earlier results that can survive failure. Missing assertions\nalone are not defects; a concrete contradiction with the established contract is a finding even if tests pass.\nDuring correction, reuse the established public test harness where applicable and exercise the smallest\nregression exposing the defect before the fix and passing afterward. Do not change expected values or\nhelper defaults merely to agree with the implementation; derive them from the original contract.\nPrefer existing suites/subtests for regressions. New test entry/helper names should be distinctive\nand compose with other same-package test files, not create generic package-level collisions.\n\nFor a requested per-call mode/option, trace where the setting is chosen and where changed code uses\nretained objects or closures. Distinguish the current caller's setting from a captured creation-time\nsetting; use the requested contract to decide which governs. If actual source crosses that boundary\nand existing tests do not cover it, exercise its smallest public case, including the disabled behavior.\nDo not invent a lifecycle matrix or infer that an opt-in feature is correct from only its enabled path.\n\nFor a changed failure handler, inspect the operation it calls and the public inputs reaching it,\nincluding failures not listed in the new handler. Use the supplied source/tests and established API behavior\nto identify a concrete input that could still violate the requested contract. A passing normal input does\nnot settle a different failure outcome of that same operation. A demonstrable material defect is FINDINGS; ask for\nan excerpt or result only when a specific material outcome cannot be settled. Do not invent new behavior,\nrequire an exhaustive exception inventory, or recommend catching every exception.\n\nReport FINDINGS only for concrete major or medium defects with a material impact on the original requirements,\npublic behavior, correctness or required validation. Name the consequence and smallest necessary fix.\nDo not turn minor style, wording, optional improvements or speculative edge cases into FINDINGS or EVIDENCE_GAPS.\nUse read/search to settle missing context in the current review. If a consequential uncertainty remains,\nrecord EVIDENCE_GAPS as an advisory limitation, not a demand for another evidence packet. Missing narration,\nrequirement mappings, hashes or clipped excerpts alone never justify a blocking finding.\n\nAssess behavioral requirements against actual source, tests and observed results. A required check known to\nhave failed or not run is a concrete finding; missing documentation of a check is not proof it did not run.\nFor incidental workflow constraints such as cache settings or command-path spelling, use existing host observations;\nabsence of a separate settings dump or historical log is not itself an evidence gap. Flag observed material\ncontradictions. The Operator owns final comparison with the original request. If a missing check genuinely\naffects correctness or a requested deliverable, name that consequence and the smallest useful next check.\nOn verification, compare the correction and its affected public outcomes with the original contract, not\nonly the wording of previous findings. Reuse unchanged evidence; do not expand into optional improvements\nor an exhaustive input matrix. PASS means no material finding, not exhaustive proof of every path.";
 /** Mission Reviewer uses ordinary host read/search permissions, not a supplied-packet-only protocol. */
 export declare function missionReviewerContent(profile: RuntimeProfile): string;
 export declare function missionCoordinatorContent(profile: RuntimeProfile, version: string): string;

package/dist/runtime-mission-assets.js

@@ -16,6 +16,11 @@ they do not require .git/** scope. Preserve explicit user ordering and host Git
 operations and report actual denials, not inferred gaps. Stage actual changed deliverables only: permission
 for an unchanged file or deleted untracked scratch does not require staging it. Repair a missing in-request
 output via expand_unit, then continue the SAME Task; covered paths need no new grant or dispatch.`;
+/** Verify requested side-effect changes at the client-state interaction, without prescribing a new API. */
+export const MISSION_CLIENT_STATE_CHECK = `For requested side-effect changes, check remaining controls with existing client-owned state, not only isolated defaults.
+Judge allowed effects from the original request; preserve authorized opt-in behavior.`;
+/** Complete requested scratch cleanup before binding final checks to the candidate. */
+const VALIDATION_CLEANUP_ORDER = "Finish requested scratch cleanup before final formal checks; retain fixtures those checks need.";
 export const VALIDATION_WORKFLOW = `## Time-aware validation workflow
 
 Operator/Coordinator: put the known meaningful formal check from the user, project or task context in validation,
@@ -28,11 +33,17 @@ Reuse existing checks that already exercise it. If authorized setup cannot run i
 For direct work with an unknown reproduction recipe, resolve its flags, configuration and cwd with ordinary native diagnostics before formal registration.
 Reuse an already observed failing baseline; do not rerun it merely to plan. A command that never exercises the reported path is not a passing reproduction.
 Use existing project configuration within the original path constraints. Known recipes and Worker-owned investigation need no extra preparation or unit.
+For changed observable behavior, follow relevant search hits in existing public caller tests, including output snapshots.
+Read the matched assertions and select their affected checks; implementation-local fixtures alone may miss a consumer regression.
+Update an affected expectation only when the original request changes its contract; otherwise fix the implementation.
+Do this within the current unit, reusing passed checks; no extra suite, approval or review round.
+${MISSION_CLIENT_STATE_CHECK}
 Keep any user/project-required broad validation for the final integrated candidate,
 not every implementation unit. Do not add a full suite merely as a precaution or create a testing agent.
 Worker: reproduce, batch the related edits, inspect the complete diff, then run the focused checks.
 Fix failures with the smallest exercising check before starting a costly suite. Do not execute the entire
 formal validation list after each patch; run it in declared order when the unit candidate is stable.
+${VALIDATION_CLEANUP_ORDER}
 If broad validation is already declared, defer it until focused checks pass and known edits are finished;
 do not remove it, substitute a tiny check for it, or claim an unrun requirement passed.
 After a late fix, select checks for the affected inputs; repeat broad validation when the requested
@@ -46,11 +57,13 @@ required review, accepted criteria and cumulative budget intact; this workflow a
 `;
 /** Worker-only projection; planning/review authorities retain the complete shared workflow. */
 export const WORKER_VALIDATION_WORKFLOW = `Batch edits, reconcile requirements/diff, run focused tests, then every registered formal check exactly in order:
-separate foreground native shell calls, no extra tee, redirect or wrapper. Diagnostics are not formal evidence.
-Rerun affected checks and required broad checks when contract/freshness requires; never drop required validation or claim stale/unrun proof.
+separate foreground native shell calls; no tee/redirect/wrapper. Diagnostics lack formal evidence.
+Rerun affected checks and required broad checks when contract/freshness requires; never drop required validation; no stale/unrun proof.
+Check matched caller/output tests.
 `;
 /** Correction uses the inherited command identities; diagnostics do not acquire formal evidence. */
-export const REVIEWER_VALIDATION_WORKFLOW = `Run inherited formal commands in order as exact separate foreground native shell calls.
+export const REVIEWER_VALIDATION_WORKFLOW = `${VALIDATION_CLEANUP_ORDER}
+Run inherited formal commands in order as exact separate foreground native shell calls.
 Run formatting and diagnostics separately; do not append undeclared shell commands, tee, redirect or wrapper.
 If a formal recipe is misregistered (for example a valid diagnostic intentionally exits nonzero), the active correction author can call sortie_v010_repair_review with reason, validation and optional validation_cwd to correct the recipe HERE. Preserve all original requirements and behavioral assertions; never suppress a real failure or register unconditional success. Run the newly registered checks before finishing; old outcomes are not proof for a changed recipe. Do not cancel, replace the Task or ask the controller to redispatch merely to fix check registration.`;
 const OPERATION_GUIDE = `## Practical operation guide
@@ -183,14 +196,18 @@ ${MISSION_DEPENDENCY_WORKFLOW}
    ${profile.toolPrefix}plan_units with executor: "self", a concrete reason and one corrective unit.
    Finish direct work with ${profile.toolPrefix}finish_direct_unit; its actual native checks are formal
    evidence, with the same source freshness and Review requirements. Reviewer FINDINGS
-    instead use ${profile.toolPrefix}repair_review to recover the SAME native Reviewer/context only if it
-    actually returned before correction or was interrupted, correct
+     can reuse ${profile.toolPrefix}repair_review to recover useful native Reviewer/context if it
+     returned before correction or was interrupted; another available Reviewer or plan_units Worker/direct
+     correction is also legitimate within existing user authorization. Retain findings and actual authorship; correct
    all known Major/Medium defects and pass formal validation/requested commit, then call review_mission
    only for legacy CORRECTION_READY-only fallback; normally that SAME author explicitly self-rechecks
    after formal checks/commit within its correction Task, using candidate=current-validated for host binding.
    Only concrete reachable Major risk remaining
    after self-recheck requires a DIFFERENT Reviewer; Medium, tags, hashes and prose gaps alone do not;
-   they are not a failed-validation retry. Keep the SAME mission, original requirements, failure history
+    they are not a failed-validation retry. A different Reviewer remains optional when useful, not forbidden.
+    Completed correction history never blocks plan_units for remaining authorized implementation or requires
+    acceptance first. No routine handoff approval, new conversation, rediscovery or unchanged checks.
+    Keep the SAME mission, original requirements, failure history
    and cumulative budget. Use its Coordinator Task only for real coordination, contract discovery or
    correction that cannot be handled directly. Never replace an active Worker or ask for routine approval.
 4. After the review decision (including a justified low-risk skip), compare the completion candidate
@@ -262,16 +279,40 @@ existing user authorization and project gates; npm publication remains manual.
 }
 /** Keep representation oracles consistent in direct execution, Worker and Review. */
 export const MISSION_REPRESENTATION_ORACLE = `Same-type representation, not name/visitor analogy; resolve conflicts.`;
+/** Coordinator preserves source-backed return semantics in direct work or a Worker's objective. */
+export const MISSION_RETURN_CONTRACT = `For a changed value-producing operation, derive its return contract from public callers and unchanged source/tests.
+Preserve established return type/container, metadata and label alignment unless the original request changes them;
+equal numeric values alone do not prove that contract. Trace which inputs determine result shape and labels,
+including non-primary parameters; a scalar primary input need not yield a scalar result. For a mask or conditional
+replacement, preserve established broadcasting and missing-value propagation; an unknown condition is not proof
+that replacement is intended. Carry the affected contract into direct work or the Worker's objective.
+Reuse an adequate focused assertion; add only the smallest source-backed regression when needed, not an input matrix,
+another unit, validation lane or review.`;
+/** Coordinator preserves source-backed mutation semantics in direct work or a Worker's objective. */
+export const MISSION_MUTATION_CONTRACT = `For a changed mutating operation, derive its state and failure contract from public callers and unchanged source/tests.
+Changing a file's write mechanism can change permission failures, link identity and new-file creation/umask behavior;
+preserve those established outcomes unless the original request changes them. Derive regression expectations from
+the original operation, not the new write mechanism. Carry the affected contract into direct work or the Worker's objective.
+Reuse an adequate focused assertion; add only the smallest source-backed regression when needed, not an exhaustive
+matrix, another unit, validation lane or review.`;
 /** Coordinator authors and plans regressions without adding another validation/review lane. */
 export const MISSION_REGRESSION_PLACEMENT = `Prefer an existing relevant test suite/subtest or fixture when it can express the regression assertion.
 If a new test module is needed, prefer a distinctive behavior-specific name over automatically mirroring the implementation module.
 Preserve established assertions and project test discovery. This is placement guidance, not another test, unit or review requirement.`;
+/** Preserve explicit public behavior and its caller preconditions when removing passive effects. */
+const MISSION_EXPLICIT_EFFECT_PRESERVATION = `When removing implicit initialization effects, preserve established explicit opt-in behavior unless the request changes it.
+Trace its real caller-visible effect from existing source/tests; flags or internal state alone are not that behavior.
+Keep the established caller preconditions in the regression check; added setup can supply the removed effect and mask a regression.
+Reuse adequate checks and include this distinction in the current author's objective/check plan, not another unit or review round.`;
 /** Shared by the installed Reviewer and its host-generated mission prompt. */
 export const MISSION_BEHAVIOR_REVIEW = `Establish the test oracle independently of the patch: tests added with the implementation are claims to
 review, not established API behavior. For a changed failure path, compare a pre-existing analogous public
 test and its shared assertion helper, including default expected outputs, with the new case. A new test
 that asserts the implementation's current result can encode the defect rather than catch it. Preserve
 the pre-change contract unless the request changes it; do not invent a universal failure-result convention.
+For changed observable behavior, inspect affected public caller assertions/output snapshots found by search, not only implementation-local fixtures.
+Reconcile expected outputs with the original requirements and reuse adequate checks; no extra review round.
+${MISSION_CLIENT_STATE_CHECK}
 ${MISSION_REPRESENTATION_ORACLE}
 Trace a concrete rejected input through the changed code back to the public caller, checking result,
 error and observable state together, including earlier results that can survive failure. Missing assertions
@@ -360,7 +401,10 @@ After current formal checks, retain the requested commit/clean boundary, then
 ${profile.toolPrefix}finish_direct_unit. Explicitly self-recheck and end this same native Task with
 SELF_RECHECKED; only its actual successful terminal binds the current validated source. This is author
 self-recheck, never independent approval of your own edits. No unresolved Medium may pass.
-Do not edit before that host transition or delegate. If the host resumes this SAME
+Do not edit before that host transition. Reuse this context by default; the controller may choose another
+available author or direct execution after terminal work without a handoff approval. Preserve all findings,
+actual source authors, passed input-bound checks and cumulative spend; a new actor does not resolve defects.
+If the host resumes this
 session with an admitted correction unit, read its exact handoff and preserve its declared validation/commit
 boundary. The inherited write list is an estimate, not a user prohibition. Concrete native edit paths are
 reconciled automatically; for outputs whose paths cannot be inferred, call ${profile.toolPrefix}expand_unit
@@ -374,7 +418,8 @@ relevant impact IN THIS SAME TASK. Return SELF_RECHECKED with candidate=current-
 the actual current source after this prompt's successful native terminal and fresh checks. Never copy a
 pre-edit hash or return PASS for your own correction. Legacy CORRECTION_READY-only uses a separate same-author
 read-only fallback, not acceptance. Only a concrete reachable Major risk remaining after self-recheck
-requires a DIFFERENT Reviewer. Known Major/Medium defects must be corrected; unresolved Medium cannot pass.
+requires a DIFFERENT Reviewer; independent review also remains optional when useful, not forbidden.
+Known Major/Medium defects must be corrected; unresolved Medium cannot pass.
 Tags, hashes, public-api/public-logic, missing prose and EVIDENCE_GAPS alone do not trigger a second review.
 Self-recheck is not independent approval; root acceptance still compares the actual result with the request.
 Otherwise return to the caller in the user's language.
@@ -483,7 +528,10 @@ If peer source/tests expose a plausible related still-unhandled error, probe its
 before choosing the fix; reuse adequate checks. Include this in the current author's objective/check
 plan, not another unit or review round. Do not invent an exhaustive error matrix.
 ${MISSION_REPRESENTATION_ORACLE}
+${MISSION_RETURN_CONTRACT}
+${MISSION_MUTATION_CONTRACT}
 ${MISSION_REGRESSION_PLACEMENT}
+${MISSION_EXPLICIT_EFFECT_PRESERVATION}
 For read-only verification, use write: []; do not invent an output file or request write access to inputs.
 If declared build or tests create known generated paths, include those outputs in the initial write scope;
 do not add a separate setup unit just to prepare them.
@@ -612,11 +660,11 @@ User missing-only: installed/incompatible is not missing.
 Per-call modes: check retained creation/use for captured vs current settings.
 Tests: existing suites/subtests or distinctive regression entry names.
 ${WORKER_VALIDATION_WORKFLOW}
-Never fabricate completion.
+No fake success.
 Parent: independent Review after return, not before execution; no review-before-commit gate.
 Do not spawn nested subagents, amend, push/publish. Return changes, command/exit/elapsed,
 rerun reasons, unresolved/untested behavior; no proof doc.
-No repeated denial. Unrecoverable PROCESS_DEFECT: local: + diagnostic or proven
+No repeat denial. Unrecoverable PROCESS_DEFECT: local: + diagnostic or proven
 TRUE_BLOCKER: external: / TRUE_BLOCKER: user-decision:.
 Prose: user's latest instruction language (previous if unclear); protocol/code/quotes verbatim.
 `;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.13.16",
+  "version": "0.13.17",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",