sortie-dogs 0.9.8 → 0.9.10

package/README.md

@@ -1,13 +1,13 @@
 # Sortie-dogs
 
-**Add a bounded, cost-aware execution loop to OpenCode without taking OpenCode over.**
-
-Sortie-dogs is an opt-in overlay, not a replacement. It stays passive until you
-invoke `/sortie` or select `dog-coordinator`. Standard OpenCode agents and
-unrelated sessions remain available and unchanged.
-
-> **Project status: Beta.** v0.9.x is under active stabilization. Runtime
-> behavior, configuration, and runtime assets may still change before 1.0.
+**Add a bounded, cost-aware execution loop to OpenCode without taking OpenCode over.**
+
+Sortie-dogs is an opt-in overlay, not a replacement. It stays passive until you
+invoke `/sortie` or select `dog-coordinator`. Standard OpenCode agents and
+unrelated sessions remain available and unchanged.
+
+> **Project status: Beta.** v0.9.x is under active stabilization. Runtime
+> behavior, configuration, and runtime assets may still change before 1.0.
 
 [![npm](https://img.shields.io/npm/v/sortie-dogs)](https://www.npmjs.com/package/sortie-dogs)
 [![license](https://img.shields.io/npm/l/sortie-dogs)](LICENSE)
@@ -15,63 +15,63 @@ unrelated sessions remain available and unchanged.
 
 ![Sortie-dogs coordinating a bounded implementation workflow](https://raw.githubusercontent.com/zufall-upon/Sortie-dogs/main/docs/assets/sortie-workflow.gif)
 
-Sortie-dogs turns selected work into a scoped plan, optional evidence gathering,
-bounded implementation, canonical validation, and evidence-backed completion.
+Sortie-dogs turns selected work into a scoped plan, optional evidence gathering,
+bounded implementation, canonical validation, and evidence-backed completion.
 
 Requirements: Node.js 22.6 or newer, npm, and OpenCode.
 
-Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) · [CLI testing](docs/cli-testing.md)
-
-Release: [v0.9.8](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.9.8)
-
-## Why Sortie-dogs?
-
-### Invisible until invited
-
-Use normal OpenCode normally. Sortie activates only for `/sortie` or
-`dog-coordinator`; it does not disable or replace OpenCode's standard agents.
-
-### Spend strong models only where they matter
-
-Lower-cost models handle bounded retrieval and parallel volume work. Stronger
-models are reserved for implementation, escalation, and independent review.
-
-### Return with proof
-
-Writes stay scoped, and completion requires validation evidence. Every completed
-run can return a concise Speed / Cost / Proof debrief.
-
-## Designed to coexist with OpenCode
-
-Sortie-dogs adds a workflow to your existing setup rather than replacing it.
-
-- It does not disable OpenCode's native agents or replace standard roles such as
-  `build`, `plan`, `explore`, or `general`.
-- Ordinary sessions are not automatically converted into Sortie workflows.
-- Project-local initialization is the recommended setup and does not change
-  user settings.
-- Global runtime availability and cross-project reflection require separate,
-  explicit opt-in. Reflection is disabled by default.
-- Unknown or user-owned runtime files are preserved rather than overwritten.
-- Manual removal targets only known Sortie-owned runtime assets.
-
-Use OpenCode normally. Invoke the pack only when you want it.
-
-## Quick start
-
-Install the public npm package in the project and generate the project-local
-OpenCode runtime files:
+Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) · [CLI testing](docs/cli-testing.md)
+
+Release: [v0.9.10](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.9.10)
+
+## Why Sortie-dogs?
+
+### Invisible until invited
+
+Use normal OpenCode normally. Sortie activates only for `/sortie` or
+`dog-coordinator`; it does not disable or replace OpenCode's standard agents.
+
+### Spend strong models only where they matter
+
+Lower-cost models handle bounded retrieval and parallel volume work. Stronger
+models are reserved for implementation, escalation, and independent review.
+
+### Return with proof
+
+Writes stay scoped, and completion requires validation evidence. Every completed
+run can return a concise Speed / Cost / Proof debrief.
+
+## Designed to coexist with OpenCode
+
+Sortie-dogs adds a workflow to your existing setup rather than replacing it.
+
+- It does not disable OpenCode's native agents or replace standard roles such as
+  `build`, `plan`, `explore`, or `general`.
+- Ordinary sessions are not automatically converted into Sortie workflows.
+- Project-local initialization is the recommended setup and does not change
+  user settings.
+- Global runtime availability and cross-project reflection require separate,
+  explicit opt-in. Reflection is disabled by default.
+- Unknown or user-owned runtime files are preserved rather than overwritten.
+- Manual removal targets only known Sortie-owned runtime assets.
+
+Use OpenCode normally. Invoke the pack only when you want it.
+
+## Quick start
+
+Install the public npm package in the project and generate the project-local
+OpenCode runtime files:
 
 ```sh
 npm install --save-dev sortie-dogs
-npx sortie-dogs init .
-```
-
-This is the recommended setup. Runtime assets stay project-local.
-
-Installing the runtime assets does not load the plugin, and without the plugin
-every role runs on whichever model the caller happened to use. Add the package
-to the `plugin` array in the project's `.opencode/opencode.json`:
+npx sortie-dogs init .
+```
+
+This is the recommended setup. Runtime assets stay project-local.
+
+Installing the runtime assets does not load the plugin, and without the plugin
+every role runs on whichever model the caller happened to use. Add the package
+to the `plugin` array in the project's `.opencode/opencode.json`:
 
 ```json
 {
@@ -82,8 +82,8 @@ to the `plugin` array in the project's `.opencode/opencode.json`:
 Restart OpenCode afterwards. A `plugin` entry must name the package, not a
 subpath: `sortie-dogs/plugin` is an import specifier, not a plugin specifier.
 
-`dog-coordinator` defaults to `openai/gpt-5.6-terra` with the `high` variant; `dog-scout` defaults to
-`openai/gpt-5.6-luna`. To pin either role to another model, save this
+`dog-coordinator` defaults to `openai/gpt-5.6-terra` with the `high` variant; `dog-scout` defaults to
+`openai/gpt-5.6-luna`. To pin either role to another model, save this
 as `.opencode/sortie-dogs.json`:
 
 ```json
@@ -166,83 +166,83 @@ Optional settings in `.opencode/sortie-dogs.json`:
 {
   "operationManifestPath": "operation-manifest.json",
   "handoffPaths": ["handoff.json"],
-  "readOnlyTools": ["my_mcp_search"],
-  "dedicatedWorkerModel": { "model": "provider/model", "variant": "deep" },
-  "continuation": { "enabled": true, "maxAutoContinues": 10 },
-  "reflection": {
-    "enabled": false,
-    "layers": { "run": true, "project": true, "global": false },
-    "maxInjectedTokens": 500
-  }
-}
-```
-
-The same schema may be saved globally as
-`~/.config/opencode/sortie-dogs.json` (on Windows,
-`%USERPROFILE%\.config\opencode\sortie-dogs.json`). Precedence is built-in
-defaults, global file, project file, `SORTIE_DOGS_CONFIG`, then plugin factory
-options. OpenCode plugin normalization may omit factory options, so use the
-global file for durable global settings.
+  "readOnlyTools": ["my_mcp_search"],
+  "dedicatedWorkerModel": { "model": "provider/model", "variant": "deep" },
+  "continuation": { "enabled": true, "maxAutoContinues": 10 },
+  "reflection": {
+    "enabled": false,
+    "layers": { "run": true, "project": true, "global": false },
+    "maxInjectedTokens": 500
+  }
+}
+```
+
+The same schema may be saved globally as
+`~/.config/opencode/sortie-dogs.json` (on Windows,
+`%USERPROFILE%\.config\opencode\sortie-dogs.json`). Precedence is built-in
+defaults, global file, project file, `SORTIE_DOGS_CONFIG`, then plugin factory
+options. OpenCode plugin normalization may omit factory options, so use the
+global file for durable global settings.
 
 - `operationManifestPath` moves the manifest; the path is project-relative.
-- `handoffPaths` lists the handoff files the plugin inspects. A worker can only
+- `handoffPaths` lists the handoff files the plugin inspects. A worker can only
   bind after one of these files passes inspection, so an empty list disables
   binding entirely. Relative entries are also candidate-relative in a nested
   repository: a child candidate may use its own `handoff.json` while OpenCode is
   opened at the parent workspace. For operational work the coordinator creates
   that valid handoff before dispatch and sends its exact absolute path; the
-  binding child must use the built-in Read tool on it immediately before bind.
-  New coordinator contracts are emitted under the candidate-relative
-  `.sortie-dogs/contracts/` directory as `handoff.<id>.json` and
-  `<id>.operation-manifest.json`. The directory is ignored by this repository's
-  `.gitignore`; legacy root/scoped paths and configured custom paths remain
-  readable and preflight-compatible, but are never moved or deleted.
-  Remove the directory only when no Sortie run is active.
+  binding child must use the built-in Read tool on it immediately before bind.
+  New coordinator contracts are emitted under the candidate-relative
+  `.sortie-dogs/contracts/` directory as `handoff.<id>.json` and
+  `<id>.operation-manifest.json`. The directory is ignored by this repository's
+  `.gitignore`; legacy root/scoped paths and configured custom paths remain
+  readable and preflight-compatible, but are never moved or deleted.
+  Remove the directory only when no Sortie run is active.
 - `readOnlyTools` adds host-specific tool names that never change files, such as
   MCP tools. Unknown tools are denied for a bound session by default.
-- `dedicatedWorkerModel` selects the serial implementation target used by
-  `implementation`, `remediation`, `blocker-resolution`, `sol-worker-mk2a2`, and
-  `dog-worker`. It defaults to `openai/gpt-5.6-sol` with variant `medium`.
-  The installed `dog-luna-worker` fabric route remains fixed to
-  `openai/gpt-5.6-luna` with variant `max`; pointing the serial target at that
+- `dedicatedWorkerModel` selects the serial implementation target used by
+  `implementation`, `remediation`, `blocker-resolution`, `sol-worker-mk2a2`, and
+  `dog-worker`. It defaults to `openai/gpt-5.6-sol` with variant `medium`.
+  The installed `dog-luna-worker` fabric route remains fixed to
+  `openai/gpt-5.6-luna` with variant `max`; pointing the serial target at that
   Luna model is invalid because it would collapse the two route identities. The
   coordinator dispatches this role only for a ready descriptor of a prepared
-  `luna-fabric` run; a `sol-serial` run keeps `dog-worker`.
+  `luna-fabric` run; a `sol-serial` run keeps `dog-worker`.
 - `continuation` bounds the batch loop. After a terminal unit and its checkpoint,
   `dog-coordinator` calls `sortie_compact_and_continue`, which compacts the run
   and resumes the same root session on the next independent unit. Only a root
   `dog-coordinator` session is ever resumed: a child session is never promoted and
   another coordinator is never adopted. Set `enabled` to `false` to keep every
-  batch manual, lower `maxAutoContinues` (default and maximum `10`) to change the
-  ceiling, and set `summarizeModel` to override the latest coordinator
-  model used for compaction. Normal OpenCode auto-compaction keeps the
-  host's auto-continue behavior; Sortie suppresses it only while its own
-  explicitly queued rollover owns the resume.
-  Every terminal root-coordinator response that does not resume another unit
-  compacts without auto-continuing, so completed tool output is not carried into
-  the next user request.
-- `reflection` is an opt-in process-prevention companion for an activated root
-  `dog-coordinator`. It is disabled by default. Run and project layers default
-  to enabled after opt-in; the cross-project global storage layer remains
-  disabled unless explicitly enabled. Child and non-coordinator sessions fail
-  closed, and `SORTIE_REFLECTION=0` is an immediate kill switch. The coordinator
-  injects the governing `REFLECTION_POLICY` only while reflection is enabled.
-  `maxInjectedTokens` budgets the dynamic `SORTIE_PROCESS_REFLECTIONS` heading
-  and persisted entry lines; the policy is outside that entry budget.
-  The coordinator
-  evaluates it only after a resolved blocker/review defect and at a terminal
-  unit, with a maximum of three records per run; routine bugs and external
-  failures are never journaled.
-
-## Example run
+  batch manual, lower `maxAutoContinues` (default and maximum `10`) to change the
+  ceiling, and set `summarizeModel` to override the latest coordinator
+  model used for compaction. Normal OpenCode auto-compaction keeps the
+  host's auto-continue behavior; Sortie suppresses it only while its own
+  explicitly queued rollover owns the resume.
+  Every terminal root-coordinator response that does not resume another unit
+  compacts without auto-continuing, so completed tool output is not carried into
+  the next user request.
+- `reflection` is an opt-in process-prevention companion for an activated root
+  `dog-coordinator`. It is disabled by default. Run and project layers default
+  to enabled after opt-in; the cross-project global storage layer remains
+  disabled unless explicitly enabled. Child and non-coordinator sessions fail
+  closed, and `SORTIE_REFLECTION=0` is an immediate kill switch. The coordinator
+  injects the governing `REFLECTION_POLICY` only while reflection is enabled.
+  `maxInjectedTokens` budgets the dynamic `SORTIE_PROCESS_REFLECTIONS` heading
+  and persisted entry lines; the policy is outside that entry budget.
+  The coordinator
+  evaluates it only after a resolved blocker/review defect and at a terminal
+  unit, with a maximum of three records per run; routine bugs and external
+  failures are never journaled.
+
+## Example run
 
 An illustrative low-risk run stays bounded and reports its gates:
 
 ```text
 You: /sortie Add the requested behavior
 dog-coordinator: manifest confirmed
-dog-scout: skipped — no concrete evidence gap
-dog-worker: implementation complete
+dog-scout: skipped — no concrete evidence gap
+dog-worker: implementation complete
 validation: npm test — PASS
 review: skipped — low risk
 dog-coordinator: completion evidence accepted
@@ -252,8 +252,8 @@ dog-coordinator: completion evidence accepted
 
 1. **Brief and plan** — `dog-coordinator` turns the request into acceptance
    criteria, a write manifest, and validation requirements.
-2. **Optional scout** — one bounded, read-only investigation runs only for a
-   concrete pre-worker evidence gap.
+2. **Optional scout** — one bounded, read-only investigation runs only for a
+   concrete pre-worker evidence gap.
 3. **Dedicated worker** — the dedicated worker implements only the approved
    manifest and also owns scoped remediation or blocker resolution.
 4. **Canonical validation** — the declared test or build command must produce
@@ -305,16 +305,16 @@ untouched.
 
 ## Model routing
 
-Default routes split work by required capability and repeated-context cost.
-Sortie-dogs keeps retrieval on Luna, coordinator routing on Terra, and independent
-review on Sol unless the host declares another target.
+Default routes split work by required capability and repeated-context cost.
+Sortie-dogs keeps retrieval on Luna, coordinator routing on Terra, and independent
+review on Sol unless the host declares another target.
 
-`dog-coordinator` defaults to `openai/gpt-5.6-terra` with the `high` variant. Coordinator quality controls
-planning and forward progress, so Terra High is the default balance between capability and cost.
-Project or global `modelRouting` can override
-this default. If the host proves Terra unavailable,
-the existing availability policy uses a configured free-tier fallback when present
-and otherwise preserves the session model.
+`dog-coordinator` defaults to `openai/gpt-5.6-terra` with the `high` variant. Coordinator quality controls
+planning and forward progress, so Terra High is the default balance between capability and cost.
+Project or global `modelRouting` can override
+this default. If the host proves Terra unavailable,
+the existing availability policy uses a configured free-tier fallback when present
+and otherwise preserves the session model.
 
 `dog-scout` defaults to `openai/gpt-5.6-luna` with the `high` variant, since
 gathering bounded evidence is retrieval rather than reasoning and that tier is
@@ -322,46 +322,46 @@ where the curve gives the most per unit of cost. Nobody selects a model for a
 session the loop spawns, which is why delegated roles carry defaults and the
 coordinator does not. Project-local routing can override this default.
 
-The `implementation`, `remediation`, `blocker-resolution`, `sol-worker-mk2a2`,
-and `dog-worker` roles always use the stable serial target,
-`openai/gpt-5.6-sol` with the `medium` variant. `dedicatedWorkerModel` may move
-that serial target when a host cannot serve it. The installed `dog-luna-worker`
-route is separately fixed to `openai/gpt-5.6-luna` with the `max` variant. Its
+The `implementation`, `remediation`, `blocker-resolution`, `sol-worker-mk2a2`,
+and `dog-worker` roles always use the stable serial target,
+`openai/gpt-5.6-sol` with the `medium` variant. `dedicatedWorkerModel` may move
+that serial target when a host cannot serve it. The installed `dog-luna-worker`
+route is separately fixed to `openai/gpt-5.6-luna` with the `max` variant. Its
 shared worker contract requires one validated fabric descriptor: the coordinator
-admits a v0.8 DAG contract with `sortie_admit_luna_fabric`, prepares it with
-`sortie_prepare_luna_fabric`, and materializes only the current ready wave, with
-at most five distinct Luna units. The complete DAG may contain up to 64 units.
-After every active artifact is verified, `sortie_advance_luna_fabric_wave`
-integrates them into a runtime-owned hidden candidate, cleans those worktrees,
-and creates fresh worktrees from that exact snapshot. After the final wave,
-`sortie_validate_luna_fabric_candidate` runs canonical validation once and
-`sortie_accept_luna_fabric_candidate` records review before one target CAS.
-Declared shared-path ownership serializes overlapping units
-across waves; unowned overlap or any admission defect routes the whole job back
-to one `dog-worker`. The fabric never duplicates one unit across lanes.
-`modelRouting` cannot replace either fixed
-route, and a serial override naming the Luna fabric model is invalid rather than
-silently collapsing both identities. Version 0.7.0 routed `dog-worker` to Luna
-Max; v0.8 intentionally preserves that history while splitting stable Sol and
-fabric Luna roles. Other explicit routes try the preferred target, then ordered
-fallbacks. Roles without a built-in default or explicit route keep OpenCode's
-already selected model.
+admits a v0.8 DAG contract with `sortie_admit_luna_fabric`, prepares it with
+`sortie_prepare_luna_fabric`, and materializes only the current ready wave, with
+at most five distinct Luna units. The complete DAG may contain up to 64 units.
+After every active artifact is verified, `sortie_advance_luna_fabric_wave`
+integrates them into a runtime-owned hidden candidate, cleans those worktrees,
+and creates fresh worktrees from that exact snapshot. After the final wave,
+`sortie_validate_luna_fabric_candidate` runs canonical validation once and
+`sortie_accept_luna_fabric_candidate` records review before one target CAS.
+Declared shared-path ownership serializes overlapping units
+across waves; unowned overlap or any admission defect routes the whole job back
+to one `dog-worker`. The fabric never duplicates one unit across lanes.
+`modelRouting` cannot replace either fixed
+route, and a serial override naming the Luna fabric model is invalid rather than
+silently collapsing both identities. Version 0.7.0 routed `dog-worker` to Luna
+Max; v0.8 intentionally preserves that history while splitting stable Sol and
+fabric Luna roles. Other explicit routes try the preferred target, then ordered
+fallbacks. Roles without a built-in default or explicit route keep OpenCode's
+already selected model.
 
 `dog-reviewer` and `dog-advisor` must never inherit the caller's model, because
 review and strategy lose their value when they run on the model that produced
 the candidate. Both default to `anthropic/claude-opus-5` when the catalog
 declares it, and otherwise fall back to `openai/gpt-5.6-sol` with the `xhigh`
-variant. That fallback uses higher effort than the Sol Medium worker because
-review has to be able to reject work the worker just produced. Moving
-`dedicatedWorkerModel` does not change consultation policy. Nothing here requires
-a particular vendor: both roles stay fully configurable, so declare whichever
-model you can actually serve.
+variant. That fallback uses higher effort than the Sol Medium worker because
+review has to be able to reject work the worker just produced. Moving
+`dedicatedWorkerModel` does not change consultation policy. Nothing here requires
+a particular vendor: both roles stay fully configurable, so declare whichever
+model you can actually serve.
 
 ```json
 {
   "modelRouting": {
-    "dog-coordinator": {
-      "preferred": { "model": "openai/gpt-5.6-luna", "variant": "max" }
+    "dog-coordinator": {
+      "preferred": { "model": "openai/gpt-5.6-luna", "variant": "max" }
     },
     "dog-scout": {
       "preferred": { "model": "openai/gpt-5.6-luna", "variant": "high" }
@@ -375,8 +375,8 @@ model you can actually serve.
     }
   },
   "modelCatalog": {
-    "project": [
-      { "model": "openai/gpt-5.6-sol", "variants": ["medium", "xhigh"] },
+    "project": [
+      { "model": "openai/gpt-5.6-sol", "variants": ["medium", "xhigh"] },
       { "model": "openai/gpt-5.6-luna", "variants": ["max", "high"] },
       { "model": "anthropic/claude-opus-5" }
     ]
@@ -397,52 +397,52 @@ coordinator. `dog-reviewer` independently checks high-risk candidates after
 canonical validation. Neither role implements, stages, commits, or acts as a
 user-facing worker.
 
-## Optional global availability
-
-If you intentionally want the Sortie roles available across projects, install
-the CLI and runtime assets globally:
-
-```sh
-npm install --global sortie-dogs
-sortie-dogs init --global
-```
-
-This writes canonical Sortie runtime assets to OpenCode's global configuration;
-it does not make project-local initialization global. Load the plugin from the
-global `~/.config/opencode/opencode.json` when using these assets:
-
-```json
-{
-  "plugin": ["sortie-dogs"]
-}
-```
-
-Project-local configuration and plugin loading remain available when a project
-needs its own settings or dependency.
-
-## Updates and migration
+## Optional global availability
+
+If you intentionally want the Sortie roles available across projects, install
+the CLI and runtime assets globally:
+
+```sh
+npm install --global sortie-dogs
+sortie-dogs init --global
+```
+
+This writes canonical Sortie runtime assets to OpenCode's global configuration;
+it does not make project-local initialization global. Load the plugin from the
+global `~/.config/opencode/opencode.json` when using these assets:
+
+```json
+{
+  "plugin": ["sortie-dogs"]
+}
+```
+
+Project-local configuration and plugin loading remain available when a project
+needs its own settings or dependency.
+
+## Updates and migration
 
 After replacing the dependency with a newer release asset, run:
 
 ```sh
-npx sortie-dogs init .
-```
-
-After initialization, fully restart the OpenCode host before resuming a coordinator or opening a
-fresh session. Plugin modules are process-scoped, so a new session alone cannot load the update.
-
-`init` is idempotent. It updates files owned by Sortie-dogs, migrates recognized
+npx sortie-dogs init .
+```
+
+After initialization, fully restart the OpenCode host before resuming a coordinator or opening a
+fresh session. Plugin modules are process-scoped, so a new session alone cannot load the update.
+
+`init` is idempotent. It updates files owned by Sortie-dogs, migrates recognized
 older runtime files, and records the installed version in
 `.opencode/sortie-dogs.version`. Conflicting or unrecognized files remain
 untouched and initialization stops safely. User-owned configuration—including
 `.opencode/sortie-dogs.json`—and standard OpenCode files are preserved.
 
-## Maintainer releases
-
-The [release batch guide](docs/release-batch.md) covers fixed-tarball CLI verification,
-global application, resumable GitHub publication, and manual npm publication checks.
-
-## Safe manual removal
+## Maintainer releases
+
+The [release batch guide](docs/release-batch.md) covers fixed-tarball CLI verification,
+global application, resumable GitHub publication, and manual npm publication checks.
+
+## Safe manual removal
 
 There is no supported Sortie-dogs uninstall command. Remove the npm dependency
 separately, then follow the [safe manual removal guide](docs/uninstall.md) to

package/dist/asset-version.d.ts

@@ -2,5 +2,5 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export declare const RUNTIME_ASSET_VERSION = "0.3.84-dispatch-recovery-v1";
+export declare const RUNTIME_ASSET_VERSION = "0.3.86-codegen-proof-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -2,4 +2,4 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export const RUNTIME_ASSET_VERSION = "0.3.84-dispatch-recovery-v1";
+export const RUNTIME_ASSET_VERSION = "0.3.86-codegen-proof-v1";

package/dist/core/goal-bound.js

@@ -119,7 +119,7 @@ export function reduceGoalFlight(records) {
             continue;
         requireState(instant(event.at), "invalid", "Goal event timestamp is invalid.");
         if (event.kind === "goal.accepted") {
-            requireState(state.goal_id === null || state.phase === "terminal", "transition", "An active goal already owns this root.");
+            requireState(state.goal_id === null || state.phase === "terminal" || state.phase === "stopped", "transition", "An active goal already owns this root.");
             requireState(text(event.goal_id) && HASH.test(event.acceptance_fingerprint) && text(event.origin_user_message_id) &&
                 text(event.origin_session_id) && text(event.selected_agent) && event.budget.max_units > 0 &&
                 validAcceptanceContract(event.acceptance_contract), "invalid", "Accepted goal identity is incomplete.");
@@ -221,7 +221,7 @@ export function reduceGoalFlight(records) {
                 event.consumed >= 0 && event.consumed <= event.limit && event.operation_id.length > 0 && event.evidence_key.length > 0, "invalid", "Validation admission is malformed.");
             if (event.decision === "ALLOW") {
                 requireState(event.scope !== null && event.consumed === state.validation_budget.consumed + 1 &&
-                    (state.validation_budget.limit === null || state.validation_budget.limit === event.limit) &&
+                    (state.validation_budget.limit === null || event.limit >= state.validation_budget.limit) &&
                     !state.validation_budget.evidence_keys.includes(event.evidence_key) &&
                     !state.validation_budget.reservations.some((entry) => entry.reservation_id === event.reservation_id), "budget", "Validation admission is stale, duplicated, or exhausted.");
                 state = { ...state, validation_budget: { consumed: event.consumed, limit: event.limit,

package/dist/core/goal-declaration-format.js

@@ -2,38 +2,38 @@ import { goalFingerprint } from "./goal-bound.js";
 /** Shared planner guidance and admission enums; no inferred acceptance or dispatch authority. */
 export const GOAL_DELIVERY_INTENTS = ["design", "registration", "implementation", "repair", "controlled-change"];
 export const GOAL_DELIVERY_MODES = ["planning-only", "mvp-first", "repair-first", "controlled-change"];
-export const GOAL_DECLARATION_FORMAT = `Declare a goal once, then reference it with goal_declaration_path in the Task prompt.
-The referenced JSON may contain shared defaults and a criteria array; the host expands them privately.
-An inline ext["sortie-dogs/goal-declaration"] in the registered handoff is also supported.
-Existing accepted goals need no repeated declaration; budget-only revisions retain their criteria.
-Legacy flat goal_* fields remain supported. No need to rewrite unrelated files or repeat common fields for each criterion.
-delivery_intent must be exactly one of: ${GOAL_DELIVERY_INTENTS.join(" | ")}. Never use prose or a boolean.
-delivery_mode is a separate optional enum: ${GOAL_DELIVERY_MODES.join(" | ")}.
-Use flat key: value lines. Each criterion begins with its own goal_criterion_id: line.
-For legacy flat input each criterion has a goal_criterion_id line. Prefer shared JSON defaults for multiple criteria.
-Replace every placeholder with the accepted task's actual value; preserve its acceptance and validation:
-goal_acceptance_fingerprint: <sha256: followed by exactly 64 lowercase hexadecimal characters>
-delivery_intent: implementation
-delivery_mode: mvp-first
-usable_path_established: false
-controlled_change: false
-goal_budget_units: <accepted positive integer>
-goal_criterion_id: <stable criterion id>
-goal_target: <requested behavior>
-goal_entrypoint: <real entrypoint>
-goal_workload: <requested workload>
-goal_oracle_coverage: ["<actual oracle>"]
-goal_build_boundary: <included | excluded | not-applicable>
-goal_source: <fixed source label>
-goal_candidate: <fixed candidate label>
-goal_source_binding: current-protected
-goal_candidate_binding: current-protected
-goal_fixture: <actual fixture identity>
-goal_proof_scope: requested-full
-goal_expected_outcome: pass
-goal_validation_command: <exact operation manifest validation command>
-The example's implementation/mvp-first selections apply only to an implementation without its usable path;
-select other enum values only from the accepted request. A declaration rejection launches no child.
+export const GOAL_DECLARATION_FORMAT = `Declare a goal once, then reference it with goal_declaration_path in the Task prompt.
+The referenced JSON may contain shared defaults and a criteria array; the host expands them privately.
+An inline ext["sortie-dogs/goal-declaration"] in the registered handoff is also supported.
+Existing accepted goals need no repeated declaration; budget-only revisions retain their criteria.
+Legacy flat goal_* fields remain supported. No need to rewrite unrelated files or repeat common fields for each criterion.
+delivery_intent must be exactly one of: ${GOAL_DELIVERY_INTENTS.join(" | ")}. Never use prose or a boolean.
+delivery_mode is a separate optional enum: ${GOAL_DELIVERY_MODES.join(" | ")}.
+Use flat key: value lines. Each criterion begins with its own goal_criterion_id: line.
+For legacy flat input each criterion has a goal_criterion_id line. Prefer shared JSON defaults for multiple criteria.
+Replace every placeholder with the accepted task's actual value; preserve its acceptance and validation:
+goal_acceptance_fingerprint: <sha256: followed by exactly 64 lowercase hexadecimal characters>
+delivery_intent: implementation
+delivery_mode: mvp-first
+usable_path_established: false
+controlled_change: false
+goal_budget_units: <accepted positive integer>
+goal_criterion_id: <stable criterion id>
+goal_target: <requested behavior>
+goal_entrypoint: <real entrypoint>
+goal_workload: <requested workload>
+goal_oracle_coverage: ["<actual oracle>"]
+goal_build_boundary: <included | excluded | not-applicable>
+goal_source: <fixed source label>
+goal_candidate: <fixed candidate label>
+goal_source_binding: current-protected
+goal_candidate_binding: current-protected
+goal_fixture: <actual fixture identity>
+goal_proof_scope: requested-full
+goal_expected_outcome: pass
+goal_validation_command: <exact operation manifest validation command>
+The example's implementation/mvp-first selections apply only to an implementation without its usable path;
+select other enum values only from the accepted request. A declaration rejection launches no child.
 Repair the Task prompt's named fields, not unrelated files; retry only with the corrected declaration.`;
 /** Normalize a shared declaration without guessing acceptance, coverage, delivery, or validation. */
 export function expandGoalDeclaration(value) {

package/dist/core/run-flight-ledger.js

@@ -824,6 +824,16 @@ export class RunFlightLedger {
             throw new RunFlightLedgerError("conflict", "Ledger lock remained busy.");
         try {
             const records = await this.#readGoalRecords();
+            if (event.kind === "goal.accepted") {
+                const prior = records.find(({ event: stored }) => stored.kind === "goal.accepted" &&
+                    stored.origin_user_message_id === event.origin_user_message_id);
+                if (prior !== undefined) {
+                    if (recordHash(1, null, { ...event, at: prior.event.at }) !== recordHash(1, null, prior.event)) {
+                        throw new RunFlightLedgerError("transition", "Accepted goal conflicts with its durable user message identity.");
+                    }
+                    return reduceGoalFlight(records);
+                }
+            }
             if (event.kind === "goal.reported" && records.some(({ event: stored }) => stored.kind === "goal.reported" &&
                 stored.goal_id === event.goal_id && stored.report?.terminal_key === event.report.terminal_key)) {
                 return reduceGoalFlight(records);