sortie-dogs 0.9.8 → 0.9.9

package/README.md

@@ -22,7 +22,7 @@ Requirements: Node.js 22.6 or newer, npm, and OpenCode.
 
 Guides: [日本語](docs/guide-ja.md) · [简体中文](docs/guide-zh-CN.md) · [CLI testing](docs/cli-testing.md)
 
-Release: [v0.9.8](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.9.8)
+Release: [v0.9.9](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.9.9)
 
 ## Why Sortie-dogs?
 

package/dist/asset-version.d.ts

@@ -2,5 +2,5 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export declare const RUNTIME_ASSET_VERSION = "0.3.84-dispatch-recovery-v1";
+export declare const RUNTIME_ASSET_VERSION = "0.3.86-codegen-proof-v1";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION;

package/dist/asset-version.js

@@ -2,4 +2,4 @@
  * Version of the installable runtime assets. Kept in its own module so the plugin can compare an
  * installed project marker without importing every asset body.
  */
-export const RUNTIME_ASSET_VERSION = "0.3.84-dispatch-recovery-v1";
+export const RUNTIME_ASSET_VERSION = "0.3.86-codegen-proof-v1";

package/dist/core/goal-bound.js

@@ -221,7 +221,7 @@ export function reduceGoalFlight(records) {
                 event.consumed >= 0 && event.consumed <= event.limit && event.operation_id.length > 0 && event.evidence_key.length > 0, "invalid", "Validation admission is malformed.");
             if (event.decision === "ALLOW") {
                 requireState(event.scope !== null && event.consumed === state.validation_budget.consumed + 1 &&
-                    (state.validation_budget.limit === null || state.validation_budget.limit === event.limit) &&
+                    (state.validation_budget.limit === null || event.limit >= state.validation_budget.limit) &&
                     !state.validation_budget.evidence_keys.includes(event.evidence_key) &&
                     !state.validation_budget.reservations.some((entry) => entry.reservation_id === event.reservation_id), "budget", "Validation admission is stale, duplicated, or exhausted.");
                 state = { ...state, validation_budget: { consumed: event.consumed, limit: event.limit,

package/dist/plugin/continuation.js

@@ -483,6 +483,8 @@ export function createContinuationHooks(client, directory, policySource, timings
             return false;
         if (terminalCheckpoint(text))
             return false;
+        if (topLevelProtocolLines(text).some(({ line }) => /^status\s*:\s*IN_PROGRESS(?:\s|$)/iu.test(line)))
+            return true;
         if (/➡️\s*(?:次action|next_action)\s*:\s*\S/iu.test(text))
             return true;
         if (checkpointStatus(text) === "BLOCKED" && !trueBlockerReport(text))
@@ -1009,6 +1011,7 @@ export function createContinuationHooks(client, directory, policySource, timings
                         state.stepRecoveryActive = false;
                         clearTimer(state.stepRecoveryTimer);
                         state.stepRecoveryTimer = undefined;
+                        state.stepRecoveryDeferredReport = undefined;
                         resetRecoveryStall(state);
                         if (state.notRequiredRevision !== state.turnRevision &&
                             !output.text.includes(ROLLOVER_MARKER) &&
@@ -1031,7 +1034,17 @@ export function createContinuationHooks(client, directory, policySource, timings
                     }
                     else if (nonTerminalProgress(state.latestCoordinatorReport) ||
                         (state.stepRecoveryActive && !terminalCheckpoint(state.latestCoordinatorReport))) {
-                        if (input.allowStepRecoveryFallback !== false) {
+                        if (input.allowStepRecoveryFallback === false) {
+                            state.stepRecoveryDeferredReport = state.latestCoordinatorReport;
+                        }
+                        else if (state.stepRecoveryDeferredReport === state.latestCoordinatorReport) {
+                            // A completed text-part event is not message completion. Release its deferred
+                            // recovery only when the persisted assistant message later confirms completion.
+                            state.stepRecoveryDeferredReport = undefined;
+                            state.idleDeferred = true;
+                        }
+                        else {
+                            state.stepRecoveryDeferredReport = undefined;
                             scheduleStepRecovery(input.sessionID, state, state.latestCoordinatorReport);
                         }
                     }
@@ -1162,6 +1175,7 @@ export function createContinuationHooks(client, directory, policySource, timings
                 state.attempts = 0;
             state.directUsed = false;
             state.latestCoordinatorReport = undefined;
+            state.stepRecoveryDeferredReport = undefined;
             if (!synthetic) {
                 state.lastStepContinueReport = undefined;
                 state.lastStepContinueRevision = undefined;
@@ -1182,6 +1196,7 @@ export function createContinuationHooks(client, directory, policySource, timings
             state.stepRecoveryTimer = undefined;
             if (tool !== CONTINUATION_CAPABILITY) {
                 state.latestCoordinatorReport = undefined;
+                state.stepRecoveryDeferredReport = undefined;
             }
         },
         blocksTool(sessionID) {

package/dist/plugin/index.js

@@ -1134,6 +1134,7 @@ export const SortieDogsPlugin = async (input, options) => {
     const hostGoalExecutions = new Map();
     const goalValidationDefects = new Set();
     const goalDeclarationAuthority = new Map();
+    const explicitUserGoalUnitLimits = new Map();
     const pendingRealGoalTurns = new Map();
     const pendingGoalRecoveries = new Map();
     const scheduledGoalRecoveries = new Map();
@@ -1389,7 +1390,11 @@ export const SortieDogsPlugin = async (input, options) => {
                         `unit:${unitID}`, "source_snapshot", "candidate", "command", "scope", "exit_code"]))], reason: "acceptance" };
             let reservation;
             try {
-                reservation = await ledger.reserveValidation(request, goal.budget?.max_units ?? 1);
+                // A changed candidate produces a new evidence key and must not become a user-facing blocker
+                // merely because earlier necessary validations consumed the initial estimate. Duplicate
+                // evidence remains denied by reserveValidation before this limit is considered.
+                const validationLimit = Math.max(goal.budget?.max_units ?? 1, goal.validation_budget.consumed + 1);
+                reservation = await ledger.reserveValidation(request, validationLimit);
             }
             catch (error) {
                 throw denyValidation(`authority-unavailable:${error instanceof Error ? error.name : "unknown"}`);
@@ -1895,8 +1900,14 @@ export const SortieDogsPlugin = async (input, options) => {
         }
         const declaration = validated.declaration;
         const units = Number(handoffValue(entries, ["goal_budget_units"]));
-        const maxUnits = Number.isSafeInteger(units) && units >= state.consumed_units && units > 0
-            ? units : state.budget?.max_units ?? 32;
+        const declaredUnits = Number.isSafeInteger(units) && units >= state.consumed_units && units > 0
+            ? units : undefined;
+        // A model-authored Task declaration must not silently shrink the host's policy allowance.
+        // It may request more capacity, while explicit later budget revisions remain cumulative.
+        const explicitUserLimit = explicitUserGoalUnitLimits.get(sessionID);
+        const maxUnits = declaredUnits === undefined ? state.budget?.max_units ?? 32 :
+            state.budget?.source === "policy-default" && explicitUserLimit !== declaredUnits
+                ? Math.max(state.budget.max_units, declaredUnits) : declaredUnits;
         const declaredTime = Number(handoffValue(entries, ["goal_budget_time_ms"]));
         const declaredCost = Number(handoffValue(entries, ["goal_budget_cost_usd"]));
         const timeBudget = Number.isFinite(declaredTime) && declaredTime > 0 ? declaredTime : state.budget?.time_ms ?? null;
@@ -1923,7 +1934,8 @@ export const SortieDogsPlugin = async (input, options) => {
             session_id: sessionID, selected_agent: state.selected_agent ?? COORDINATOR_AGENT,
             delivery: declaration.delivery, budget: { max_units: maxUnits,
                 time_ms: timeBudget, cost_usd: costBudget,
-                source: Number.isSafeInteger(units) ? "accepted-plan" : state.budget?.source ?? "policy-default" },
+                source: declaredUnits !== undefined && maxUnits !== state.budget?.max_units
+                    ? "accepted-plan" : state.budget?.source ?? "policy-default" },
             acceptance_contract: declaration.contract, reset_no_progress: true });
         goalDeclarationAuthority.delete(sessionID);
         return state;
@@ -2354,6 +2366,9 @@ export const SortieDogsPlugin = async (input, options) => {
     const bootstrapIdleWarnings = new Set();
     const coordinatorTaskCalls = new Map();
     const coordinatorTaskWatchdogs = new Map();
+    // A deleted root is terminal for its current host lifetime. Retain only a bounded tombstone so
+    // late generic events and already queued watchdog callbacks cannot recreate recovery state.
+    const terminalCoordinatorTaskWatchdogs = new Set();
     const chatTransitions = new Map();
     const reflectionOwnedRoots = new Set();
     const reflectionClosingRoots = new Set();
@@ -3886,6 +3901,8 @@ export const SortieDogsPlugin = async (input, options) => {
         }
     }
     function beginCoordinatorTask(sessionID, callID) {
+        if (terminalCoordinatorTaskWatchdogs.has(sessionID))
+            return;
         const calls = coordinatorTaskCalls.get(sessionID) ?? new Set();
         calls.add(callID);
         coordinatorTaskCalls.set(sessionID, calls);
@@ -3921,7 +3938,7 @@ export const SortieDogsPlugin = async (input, options) => {
         coordinatorTaskWatchdogs.delete(sessionID);
     }
     function armCoordinatorTaskWatchdog(sessionID, activity) {
-        if (!coordinatorTaskCalls.has(sessionID))
+        if (terminalCoordinatorTaskWatchdogs.has(sessionID) || !coordinatorTaskCalls.has(sessionID))
             return;
         const state = coordinatorTaskWatchdogs.get(sessionID) ?? {
             generation: 0,
@@ -3942,10 +3959,18 @@ export const SortieDogsPlugin = async (input, options) => {
     }
     function touchCoordinatorTaskWatchdog(sessionID) {
         const root = coordinatorRootForSession(sessionID);
-        if (root !== undefined && coordinatorTaskWatchdogs.has(root)) {
+        if (root !== undefined && !terminalCoordinatorTaskWatchdogs.has(root) && coordinatorTaskWatchdogs.has(root)) {
             armCoordinatorTaskWatchdog(root, Date.now());
         }
     }
+    function disarmDeletedCoordinatorTaskWatchdog(sessionID) {
+        terminalCoordinatorTaskWatchdogs.delete(sessionID);
+        terminalCoordinatorTaskWatchdogs.add(sessionID);
+        while (terminalCoordinatorTaskWatchdogs.size > ACTIVE_SESSION_CACHE.maximum) {
+            terminalCoordinatorTaskWatchdogs.delete(terminalCoordinatorTaskWatchdogs.values().next().value);
+        }
+        abortCoordinatorTasks(sessionID);
+    }
     function sessionOwnedByRoot(sessionID, rootID) {
         return sessionID === rootID || sessionRoots.get(sessionID) === rootID || sessionParents.get(sessionID) === rootID;
     }
@@ -3974,6 +3999,8 @@ export const SortieDogsPlugin = async (input, options) => {
         return [...reasons].sort();
     }
     async function sweepCoordinatorTaskWatchdog(sessionID, generation) {
+        if (terminalCoordinatorTaskWatchdogs.has(sessionID))
+            return;
         const state = coordinatorTaskWatchdogs.get(sessionID);
         const calls = coordinatorTaskCalls.get(sessionID);
         if (state === undefined || calls === undefined || state.generation !== generation || state.recovering)
@@ -3990,7 +4017,8 @@ export const SortieDogsPlugin = async (input, options) => {
             return;
         }
         const reasons = await watchdogProtectedReasons(sessionID);
-        if (coordinatorTaskWatchdogs.get(sessionID) !== state || state.generation !== generation)
+        if (terminalCoordinatorTaskWatchdogs.has(sessionID) ||
+            coordinatorTaskWatchdogs.get(sessionID) !== state || state.generation !== generation)
             return;
         if (reasons.length > 0) {
             state.recovering = false;
@@ -4003,8 +4031,11 @@ export const SortieDogsPlugin = async (input, options) => {
             return;
         }
         const callIDs = [...calls];
+        if (terminalCoordinatorTaskWatchdogs.has(sessionID))
+            return;
         const result = await continuation.recoverStalledTask(sessionID, callIDs);
-        if (coordinatorTaskWatchdogs.get(sessionID) !== state || state.generation !== generation)
+        if (terminalCoordinatorTaskWatchdogs.has(sessionID) ||
+            coordinatorTaskWatchdogs.get(sessionID) !== state || state.generation !== generation)
             return;
         if (result === "recovered") {
             appLogInfo("batch-watchdog.recovered", sessionID, {
@@ -5630,11 +5661,11 @@ export const SortieDogsPlugin = async (input, options) => {
             await serializeChatTransition(chatInput.sessionID, async () => {
                 const parentID = chatParentID(chatInput);
                 const synthetic = output.parts.some((part) => isRecord(part) && part.synthetic === true);
+                const selectedAgent = chatInput.agent ?? output.message.agent;
                 if (parentID !== undefined)
                     rememberParent(chatInput.sessionID, parentID);
                 touchCoordinatorTaskWatchdog(chatInput.sessionID);
                 const coordinatorRoot = isCoordinatorSession(chatInput.sessionID);
-                const selectedAgent = chatInput.agent ?? output.message.agent;
                 if (chatInput.agent !== undefined && output.message.agent !== chatInput.agent) {
                     output.message.agent = chatInput.agent;
                 }
@@ -5662,6 +5693,10 @@ export const SortieDogsPlugin = async (input, options) => {
                 }
                 const coordinatorOrigin = parentID === undefined && requestedCoordinator;
                 if (coordinatorOrigin) {
+                    // A proven explicit real root turn may reuse a host session identifier after deletion. Child
+                    // lineage rejection above runs first, so only a new root lifetime clears the tombstone.
+                    if (!synthetic)
+                        terminalCoordinatorTaskWatchdogs.delete(chatInput.sessionID);
                     if (!synthetic)
                         interruptedCoordinatorMessages.delete(chatInput.sessionID);
                     if (synthetic) {
@@ -5672,6 +5707,12 @@ export const SortieDogsPlugin = async (input, options) => {
                     else if (messageID !== undefined) {
                         await acceptRealGoalTurn(chatInput.sessionID, messageID, selectedAgent, output.parts);
                         goalDeclarationAuthority.set(chatInput.sessionID, messageID);
+                        const explicitUnits = /^\s*goal_budget_units:\s*([1-9][0-9]*)\s*$/imu
+                            .exec(output.parts.map(textPart).filter((text) => text !== undefined).join("\n"))?.[1];
+                        if (explicitUnits === undefined)
+                            explicitUserGoalUnitLimits.delete(chatInput.sessionID);
+                        else
+                            explicitUserGoalUnitLimits.set(chatInput.sessionID, Number(explicitUnits));
                     }
                     else if (selectedAgent !== undefined) {
                         // Some native hosts persist the user message only after this hook returns. Defer to the
@@ -6630,6 +6671,10 @@ export const SortieDogsPlugin = async (input, options) => {
             }
             if (eventSessionID === undefined)
                 return;
+            // Deletion is terminal for watchdog recovery. Disarm synchronously before any generic event
+            // processing can await, touch activity, or let a queued sweep recover the cancelled root.
+            if (event.type === "session.deleted")
+                disarmDeletedCoordinatorTaskWatchdog(eventSessionID);
             if (event.type === "message.updated" && info !== undefined) {
                 rememberCoordinatorInterruption(eventSessionID, info);
                 await acceptPersistedRealGoalEvent(eventSessionID, info);
@@ -6723,7 +6768,6 @@ export const SortieDogsPlugin = async (input, options) => {
             touchCoordinatorTaskWatchdog(eventSessionID);
             if (event.type === "session.deleted") {
                 fastLane.forget(eventSessionID);
-                abortCoordinatorTasks(eventSessionID);
                 if (reflectionStore !== undefined && reflectionConfiguration?.layers.run && reflectionOwnedRoots.has(eventSessionID)) {
                     reflectionClosingRoots.add(eventSessionID);
                     await waitForReflections(eventSessionID);

package/dist/runtime-assets.d.ts

@@ -7,7 +7,7 @@ export interface RuntimeAsset {
 }
 export declare const runtimeAssets: readonly [{
     readonly name: "dog-coordinator";
-    readonly version: "0.3.84-dispatch-recovery-v1";
+    readonly version: "0.3.86-codegen-proof-v1";
     readonly installPath: "agent/dog-coordinator.md";
     readonly content: `---
 description: Canonical MkII coordinator packaged by Sortie-dogs
@@ -1386,6 +1386,14 @@ explicitly record dog-reviewer skipped and permit staging. For a high-risk candi
 dog-reviewer only after canonical validation passes and require its PASS before the coordinator
 stages or commits. Return reviewer findings through dog-coordinator and fail closed while
 unreviewed. If dog-reviewer is unavailable or does not return PASS, fail closed before staging.
+Before risk classification or terminal DONE, require one criterion-level trace per accepted criterion:
+criterion -> changed or inspected implementation path -> concrete exercising test/input/branch -> PASS.
+An aggregate validation command without that mapping is insufficient. Multi-form criteria must cover their
+materially distinct syntax, value-shape, scope, and error paths; any missing path remains UNPROVEN and requires
+continued implementation or validation. Include the complete trace in every high-risk SourceReview artifact.
+Any generated input/output pair in the changed manifest is high risk and requires SourceReview. DONE requires
+generator command evidence, post-generation candidate identity, generated-output stability, and canonical
+validation after generation. Reject evidence produced only before regeneration.
 
 GATE_POLICY_FIXTURE
     risk_rule: high when source_manifest has an entry outside test/, validation level is targeted, or operation_manifest mutates non-artifact state; a qualifying artifact-only candidate is low-risk despite operation_manifest
@@ -1420,11 +1428,19 @@ At each checkpoint and terminal return, preserve concise proof internally. The u
 return MUST begin with its conclusion: no plan, progress, assessment, Evidence heading, or preamble.
 Use exactly one of DONE, INTERRUPTED, BLOCKED, or NEED_DECISION with one status emoji and a short
 Japanese conclusion. Then render Japanese \u5909\u66F4\u70B9, \u78BA\u8A8D\u7D50\u679C, and \u6B21 paragraphs without bullets or decorative
-emoji. The plugin injects measured Speed, Cost, and \u9054\u6210 paragraphs in a collapsed Japanese mission debrief card,
-with one fixed icon per section, observed pack/model usage, validation/review, and evidence-backed traits.
+emoji. After those paragraphs, always render one durable fallback card in the same assistant message:
+<details>
+<summary><strong>\uD83D\uDC3E SORTIE DOGS \u2014 \u5E30\u9084\u5831\u544A</strong></summary>
+
+**\u4EFB\u52D9:** <same short conclusion>
+**\u78BA\u8A8D:** <concise validation/review summary without internal identifiers>
+
+</details>
+The plugin replaces that exact persisted card in place with measured Speed, Cost, and \u9054\u6210 paragraphs,
+one fixed icon per section, observed pack/model usage, validation/review, and evidence-backed traits.
 Its Markdown token bars and PACK RECORD summarize retained project goals, with coverage and team titles;
 they never imply lifetime history, XP, levels, unmeasured savings, or a leaderboard rank.
-Never write the card, its metrics, or its badges yourself. Do not estimate or fabricate them.
+Never write measured metrics, token bars, PACK RECORD, traits, or badges yourself. Do not estimate or fabricate them.
 Use \u4EFB\u52D9\u5B8C\u4E86 for DONE, \u4E2D\u65AD\u5E30\u9084\uFF08\u672A\u5B8C\u4E86\uFF09 for INTERRUPTED, \u5916\u90E8\u8981\u56E0\u3067\u5F85\u6A5F\uFF08\u672A\u5B8C\u4E86\uFF09 for BLOCKED,
 and \u6307\u793A\u5F85\u3061\uFF08\u672A\u5B8C\u4E86\uFF09 for NEED_DECISION; preserve the machine status token and first-line checkpoint.
 Never render a user-facing Evidence heading or Evidence details block, evidence reference, internal reason code,
@@ -1452,10 +1468,10 @@ TERMINAL_STATUS_SEMANTICS_FIXTURE
 END_TERMINAL_STATUS_SEMANTICS_FIXTURE
 
 RUNTIME_ASSET_VERSION_SYNC_FIXTURE
-    runtime_version: 0.3.84-dispatch-recovery-v1
+    runtime_version: 0.3.86-codegen-proof-v1
     shared_marker: src/asset-version.ts
-    packaged_expectation: test/plugin-loader.test.ts uses 0.3.84-dispatch-recovery-v1
-    initialize_expectation: test/initialize.test.ts uses 0.3.84-dispatch-recovery-v1
+    packaged_expectation: test/plugin-loader.test.ts uses 0.3.86-codegen-proof-v1
+    initialize_expectation: test/initialize.test.ts uses 0.3.86-codegen-proof-v1
     rule: runtime asset versions, shared marker, packaged expectation, and initialize expectation change together
 END_RUNTIME_ASSET_VERSION_SYNC_FIXTURE
 
@@ -1478,32 +1494,32 @@ END_INTERNAL_TERMINAL_PROOF_FIXTURE
 `;
 }, {
     readonly name: "dog-worker";
-    readonly version: "0.3.84-dispatch-recovery-v1";
+    readonly version: "0.3.86-codegen-proof-v1";
     readonly installPath: "agent/dog-worker.md";
     readonly content: string;
 }, {
     readonly name: "dog-luna-worker";
-    readonly version: "0.3.84-dispatch-recovery-v1";
+    readonly version: "0.3.86-codegen-proof-v1";
     readonly installPath: "agent/dog-luna-worker.md";
     readonly content: string;
 }, {
     readonly name: "dog-scout";
-    readonly version: "0.3.84-dispatch-recovery-v1";
+    readonly version: "0.3.86-codegen-proof-v1";
     readonly installPath: "agent/dog-scout.md";
     readonly content: "---\ndescription: Bounded evidence scout for dog-coordinator\nmode: subagent\nsteps: 8\npermission:\n  bash: deny\n  webfetch: deny\n  task: deny\n  question: deny\n  glob: deny\n  grep: deny\n  edit: deny\n  list: deny\n  write: deny\n  patch: deny\ntools:\n  bash: false\n  webfetch: false\n  task: false\n  question: false\n  glob: false\n  grep: false\n  edit: false\n  list: false\n  write: false\n  patch: false\n---\n# dog-scout\n\nAccept one concrete missing_evidence_code: manifest, validation, or owner-risk. Accept only an\nexplicit absolute project_root and a known_paths list of at most four paths from dog-coordinator.\nResolve only that evidence key from those paths under project_root; never resolve a path against the\nsession directory. Use Read only, with at most 120 lines and no more than one read per supplied path.\nDo not resolve a second key, explore, invoke another tool, retry, edit, stage, commit, or become user-facing.\n\nWhen project_root is missing, or a supplied path does not resolve under it, or a resolved path is\nunreadable, report that dispatch defect as the facts for the requested key and name the exact paths.\nDo not retry, guess another root, or answer from an unread path.\n\nReturn exactly one concise JSON object of at most 800 characters with exactly these keys:\nmissing_evidence_code, facts, evidence_paths, risks. Use no Markdown, code fence, commentary, or raw log. Return it only\nto dog-coordinator. Write the facts and risks prose in the language the dispatch uses for its own\nprose; keep the keys, paths, commands, and identifiers verbatim.\n";
 }, {
     readonly name: "dog-reviewer";
-    readonly version: "0.3.84-dispatch-recovery-v1";
+    readonly version: "0.3.86-codegen-proof-v1";
     readonly installPath: "agent/dog-reviewer.md";
-    readonly content: "---\ndescription: Independent source reviewer for dog-coordinator\nmode: subagent\npermission:\n  bash: deny\n  webfetch: deny\n  task: deny\n  question: deny\n  glob: deny\n  grep: deny\n  edit: deny\n  list: deny\n  write: deny\n  patch: deny\n  read: deny\ntools:\n  bash: false\n  webfetch: false\n  task: false\n  question: false\n  glob: false\n  grep: false\n  edit: false\n  list: false\n  write: false\n  patch: false\n  read: false\n---\n# dog-reviewer\n\nAccept only one bounded SourceReview request from dog-coordinator after canonical\nvalidation for one high-risk candidate. Review only the supplied acceptance criteria, exact\nmanifest, changedLogicSummary, supplied changed-code excerpts, and validation evidence. Confirm every acceptance item explicitly\nmaps to at least one changedLogicSummary entry and assess that changed logic against the mapped\nacceptance item. Missing or incomplete coverage is a concrete finding, never PASS.\nRequire one indexed acceptance[i] -> changedLogicSummary[j] mapping line per acceptance item and\nreject a missing index or unequal mapping count before assessing the changed logic.\nDo not request raw logs or full source files, review low-risk candidates, expand scope, or dispatch\nanother agent.\nTreat those supplied fields as the complete bounded SourceReview artifact; use only that artifact and invoke no tools.\nDo not infer that a branch or exemption is absent from source because a prose summary omits it.\nIf the supplied excerpts do not establish a claim, report an evidence gap and request the exact\nbranch/helper excerpt in the next artifact; do not prescribe a source fix for an unproven defect.\n\nReturn one concise PASS or concrete-finding response only to dog-coordinator before the\ncoordinator commit. Write every finding, evidence, and required-fix sentence in the language the\nsupplied artifact uses for its own prose, one statement per line, and keep verdict values,\nidentifiers, paths, and commands verbatim. Do not implement, remediate, resolve blockers, edit,\nstage, commit, or become user-facing. Remain host-routed: do not require or identify a provider, vendor, model, variant,\nor transport.\n";
+    readonly content: "---\ndescription: Independent source reviewer for dog-coordinator\nmode: subagent\npermission:\n  bash: deny\n  webfetch: deny\n  task: deny\n  question: deny\n  glob: deny\n  grep: deny\n  edit: deny\n  list: deny\n  write: deny\n  patch: deny\n  read: deny\ntools:\n  bash: false\n  webfetch: false\n  task: false\n  question: false\n  glob: false\n  grep: false\n  edit: false\n  list: false\n  write: false\n  patch: false\n  read: false\n---\n# dog-reviewer\n\nAccept only one bounded SourceReview request from dog-coordinator after canonical\nvalidation for one high-risk candidate. Review only the supplied acceptance criteria, exact\nmanifest, changedLogicSummary, supplied changed-code excerpts, and validation evidence. Confirm every acceptance item explicitly\nmaps to at least one changedLogicSummary entry and assess that changed logic against the mapped\nacceptance item. Missing or incomplete coverage is a concrete finding, never PASS.\nRequire one indexed acceptance[i] -> changedLogicSummary[j] mapping line per acceptance item and\nreject a missing index or unequal mapping count before assessing the changed logic.\nAlso require each acceptance item to map to a concrete exercising test/input/branch and result. A broad\nsuite PASS without criterion-level exercise evidence is insufficient. When one item contains materially\ndifferent syntax forms, value shapes, scopes, or error paths, reject PASS unless representative traces cover\neach path or the artifact proves they share one implementation path.\nWhen changed files include generator inputs or checked-in generated outputs, require the canonical generator\ncommand, a stable post-generation diff, and validation executed after generation. Reject PASS if helper logic\nexists only in a generated output, regeneration removes behavior, or validation predates the generated candidate.\nDo not request raw logs or full source files, review low-risk candidates, expand scope, or dispatch\nanother agent.\nTreat those supplied fields as the complete bounded SourceReview artifact; use only that artifact and invoke no tools.\nDo not infer that a branch or exemption is absent from source because a prose summary omits it.\nIf the supplied excerpts do not establish a claim, report an evidence gap and request the exact\nbranch/helper excerpt in the next artifact; do not prescribe a source fix for an unproven defect.\n\nReturn one concise PASS or concrete-finding response only to dog-coordinator before the\ncoordinator commit. Write every finding, evidence, and required-fix sentence in the language the\nsupplied artifact uses for its own prose, one statement per line, and keep verdict values,\nidentifiers, paths, and commands verbatim. Do not implement, remediate, resolve blockers, edit,\nstage, commit, or become user-facing. Remain host-routed: do not require or identify a provider, vendor, model, variant,\nor transport.\n";
 }, {
     readonly name: "dog-advisor";
-    readonly version: "0.3.84-dispatch-recovery-v1";
+    readonly version: "0.3.86-codegen-proof-v1";
     readonly installPath: "agent/dog-advisor.md";
     readonly content: "---\ndescription: Focused technical advisor for dog-coordinator\nmode: subagent\npermission:\n  bash: deny\n  webfetch: deny\n  task: deny\n  question: deny\n  glob: deny\n  grep: deny\n  edit: deny\n  list: deny\n  write: deny\n  patch: deny\n  read: deny\ntools:\n  bash: false\n  webfetch: false\n  task: false\n  question: false\n  glob: false\n  grep: false\n  edit: false\n  list: false\n  write: false\n  patch: false\n  read: false\n---\n# dog-advisor\n\nAccept only one bounded Strategy request from dog-coordinator for one candidate and one focused\nquestion. Use only the supplied acceptance criteria, exact manifest, constraints, and concise\nevidence. Do not request raw logs or full source files, expand scope, or dispatch another agent.\nTreat those supplied fields as the complete bounded Strategy artifact; use only that artifact and invoke no tools.\nReject every SourceReview request and return the rejection only to dog-coordinator; SourceReview is\ndog-reviewer-only work.\n\nReturn concise options and one recommendation only to dog-coordinator. Write every option,\nrecommendation, and consideration in the language the supplied request uses for its own prose, one\nstatement per line, and keep identifiers, paths, and commands verbatim. Do not perform\nSourceReview, implement, remediate, resolve blockers, edit, stage, commit, or become user-facing.\nImplementation remains dog-worker work. Remain host-routed: do not require or identify a\nprovider, vendor, model, variant, or transport.\n";
 }, {
     readonly name: "sortie";
-    readonly version: "0.3.84-dispatch-recovery-v1";
+    readonly version: "0.3.86-codegen-proof-v1";
     readonly installPath: "command/sortie.md";
     readonly content: "---\ndescription: Start the canonical Sortie-dogs MkII workflow\nagent: dog-coordinator\n---\nRequest: $ARGUMENTS\n\n1. If $ARGUMENTS is empty, request task context and stop; give project init guidance first.\n2. Do not preflight installed runtime assets. The plugin reports version skew without adding model\n   turns; proceed from task evidence and project instructions.\n3. On restart or re-entry, reconstruct context from project-local durable artifacts and the\n   latest bounded handoff or checkpoint. Preserve both manifests and ordered validation history;\n   resume the same task through dog-coordinator with only the required delta.\n4. Otherwise transfer request and project context to dog-coordinator. Frontmatter is the single coordinator\n   transfer; never route a worker to the user.\n";
 }];

package/dist/runtime-assets.js

@@ -1,5 +1,5 @@
 import { GOAL_DECLARATION_FORMAT } from "./core/goal-declaration-format.js";
-const ASSET_VERSION = "0.3.84-dispatch-recovery-v1";
+const ASSET_VERSION = "0.3.86-codegen-proof-v1";
 // Kept local so source-mode CLI execution does not load the plugin graph.
 const BACKLOG_DRAIN_CAPABILITY = "sortie_enable_backlog_drain";
 const PARALLEL_PREPARE_CAPABILITY = "sortie_prepare_parallel_dispatch";
@@ -97,6 +97,21 @@ is terminal for those causes. Only an external dependency or user-controlled dec
 and every terminal BLOCKED report must include its own line in the exact form TRUE_BLOCKER: external: <condition>
 or TRUE_BLOCKER: user-decision: <condition>. Never stage outside exact manifest paths, use
 git add -A, amend, push, or perform coordinator-owned commit work.
+Validation budget exhaustion, host counters, local routing, and unavailable host capabilities are process
+defects, never TRUE_BLOCKER: external and never a reason to ask the user for an internal route. Return the
+typed defect to dog-coordinator for autonomous repair. A changed candidate may run the next declared
+validation; an unchanged duplicate remains forbidden.
+
+Before returning canonical PASS, build a criterion-level trace for every accepted criterion. Each trace
+must name the criterion, the changed implementation path or inspected existing path, the concrete test
+case/input form or static branch that exercises it, and PASS or UNPROVEN. A broad suite result alone does
+not prove every criterion. Split criteria that cover multiple syntax forms, value shapes, scopes, or error
+paths into representative paths. If any accepted edge remains UNPROVEN, add a manifest-authorized check or
+return the evidence gap; never report completion from aggregate validation alone.
+Treat generated-source boundaries as high risk. If a manifest changes a generator input, grammar, schema,
+template, or a checked-in generated output, identify the repository's canonical generator and run it before
+the final validation. Prove the regenerated output is stable and that canonical validation ran against that
+post-generation candidate; tests against a hand-edited generated file are insufficient.
 
 ## Parallel immutable commit artifact
 
@@ -1584,7 +1599,7 @@ CONTRACT_PREFLIGHT_FIXTURE
     repair: fix the named pointer; an unchanged resend earns retry-exhausted
 END_CONTRACT_PREFLIGHT_FIXTURE
 
-## Validation, review, and commit gates
+## Validation, review, and commit gates
 
 The coordinator owns every staging and commit action. Reject and report any worker attempt to
 stage or commit. Run the canonical validation before staging; a nonzero exit blocks both staging
@@ -1592,7 +1607,15 @@ and commit. Classify candidate risk only after canonical validation. For a low-r
 explicitly record dog-reviewer skipped and permit staging. For a high-risk candidate, run
 dog-reviewer only after canonical validation passes and require its PASS before the coordinator
 stages or commits. Return reviewer findings through dog-coordinator and fail closed while
-unreviewed. If dog-reviewer is unavailable or does not return PASS, fail closed before staging.
+unreviewed. If dog-reviewer is unavailable or does not return PASS, fail closed before staging.
+Before risk classification or terminal DONE, require one criterion-level trace per accepted criterion:
+criterion -> changed or inspected implementation path -> concrete exercising test/input/branch -> PASS.
+An aggregate validation command without that mapping is insufficient. Multi-form criteria must cover their
+materially distinct syntax, value-shape, scope, and error paths; any missing path remains UNPROVEN and requires
+continued implementation or validation. Include the complete trace in every high-risk SourceReview artifact.
+Any generated input/output pair in the changed manifest is high risk and requires SourceReview. DONE requires
+generator command evidence, post-generation candidate identity, generated-output stability, and canonical
+validation after generation. Reject evidence produced only before regeneration.
 
 GATE_POLICY_FIXTURE
     risk_rule: high when source_manifest has an entry outside test/, validation level is targeted, or operation_manifest mutates non-artifact state; a qualifying artifact-only candidate is low-risk despite operation_manifest
@@ -1627,11 +1650,19 @@ At each checkpoint and terminal return, preserve concise proof internally. The u
 return MUST begin with its conclusion: no plan, progress, assessment, Evidence heading, or preamble.
 Use exactly one of DONE, INTERRUPTED, BLOCKED, or NEED_DECISION with one status emoji and a short
 Japanese conclusion. Then render Japanese 変更点, 確認結果, and 次 paragraphs without bullets or decorative
-emoji. The plugin injects measured Speed, Cost, and 達成 paragraphs in a collapsed Japanese mission debrief card,
-with one fixed icon per section, observed pack/model usage, validation/review, and evidence-backed traits.
+emoji. After those paragraphs, always render one durable fallback card in the same assistant message:
+<details>
+<summary><strong>🐾 SORTIE DOGS — 帰還報告</strong></summary>
+
+**任務:** <same short conclusion>
+**確認:** <concise validation/review summary without internal identifiers>
+
+</details>
+The plugin replaces that exact persisted card in place with measured Speed, Cost, and 達成 paragraphs,
+one fixed icon per section, observed pack/model usage, validation/review, and evidence-backed traits.
 Its Markdown token bars and PACK RECORD summarize retained project goals, with coverage and team titles;
 they never imply lifetime history, XP, levels, unmeasured savings, or a leaderboard rank.
-Never write the card, its metrics, or its badges yourself. Do not estimate or fabricate them.
+Never write measured metrics, token bars, PACK RECORD, traits, or badges yourself. Do not estimate or fabricate them.
 Use 任務完了 for DONE, 中断帰還（未完了） for INTERRUPTED, 外部要因で待機（未完了） for BLOCKED,
 and 指示待ち（未完了） for NEED_DECISION; preserve the machine status token and first-line checkpoint.
 Never render a user-facing Evidence heading or Evidence details block, evidence reference, internal reason code,
@@ -1786,6 +1817,13 @@ maps to at least one changedLogicSummary entry and assess that changed logic aga
 acceptance item. Missing or incomplete coverage is a concrete finding, never PASS.
 Require one indexed acceptance[i] -> changedLogicSummary[j] mapping line per acceptance item and
 reject a missing index or unequal mapping count before assessing the changed logic.
+Also require each acceptance item to map to a concrete exercising test/input/branch and result. A broad
+suite PASS without criterion-level exercise evidence is insufficient. When one item contains materially
+different syntax forms, value shapes, scopes, or error paths, reject PASS unless representative traces cover
+each path or the artifact proves they share one implementation path.
+When changed files include generator inputs or checked-in generated outputs, require the canonical generator
+command, a stable post-generation diff, and validation executed after generation. Reject PASS if helper logic
+exists only in a generated output, regeneration removes behavior, or validation predates the generated candidate.
 Do not request raw logs or full source files, review low-risk candidates, expand scope, or dispatch
 another agent.
 Treat those supplied fields as the complete bounded SourceReview artifact; use only that artifact and invoke no tools.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",