Merge codex/goal-session into codex/commands

packages/core/agent/README.md

@@ -54,7 +54,7 @@ Turn and step boundaries and the model token stream are durable `session/event`
 
 The handle every plugin programs against:
 
-- `agent.send(content, options?)` — queue a message; starts a turn when idle. Content and resolved source become one detached, deeply frozen lossless-JSON record before `agent/queued` and enqueue; invalid data throws synchronously, and caller or notification-listener in-place mutation cannot change the log or model input (`agent/prompt-submit` still rewrites by returning replacement content).
+- `agent.send(content, options?)` — queue a message; starts a turn when idle. Omitting `options.source` attests direct human input as `{ kind: 'user' }` and may authorize policy consumers, so plugins, schedulers, and other non-human producers provide their own source. Content and resolved source become one detached, deeply frozen lossless-JSON record before `agent/queued` and enqueue; invalid data throws synchronously, and caller or notification-listener in-place mutation cannot change the log or model input (`agent/prompt-submit` still rewrites by returning replacement content).
 - `agent.steer(content, options?)` — steer a running turn (inject between steps); uses the same owned acceptance boundary and behaves like `send` when idle
 - `agent.inject(content, options?)` — accept detached in-session context without running the model; the next request sees its `context/message`. `options.envelope` defaults to the canonical `<context>` framing and may be `'raw'` when the caller owns a complete familiar frame; `options.meta` persists opaque JSON state without rendering it. While a turn is open it joins that turn, deferring FIFO while the current tool batch executes and draining before turn close if execution is interrupted; while idle it is wrapped in a one-shot `injection` turn and durability checkpoint ([the turn-enclosure invariant](../../../.agents/notes/implemented/architecture/2026-06-15-turn-enclosure-invariant.md)).
 - `agent.cancel(reason?)` — cancel ALL pending work: an effective call emits `agent/cancel-requested` before it clears the queued + steering FIFOs, aborts the in-flight step, and drops a turn about to start (the pre-step window). Observers may synchronize their own state but cannot veto cancellation. A UI/ACP `session/cancel` maps to this. The single public stop primitive. Idle with nothing pending → a safe no-op with no notification.

packages/core/agent/src/types.ts

@@ -25,7 +25,10 @@ export interface AgentOptions {
   model?: string
 }
 
-/** Message options; an omitted source resolves to `{ kind: 'user' }`, so plugins must label their own content. */
+/**
+ * Message options. An omitted source attests direct human input as `{ kind: 'user' }`
+ * and may authorize policy consumers, so non-human producers must label their content.
+ */
 export interface SendOptions {
   source?: MessageSource
 }

packages/goal/goal-session/README.md

@@ -30,7 +30,8 @@ The retained prompt names the JSON-quoted objective and `round/maxGoalRounds`, t
 | Durable turn outcome | Goal action | Automatic retry |
 |---|---|---|
 | `completed` with goal still active and armed | admit the next round, or mark `budget-limited` at the cap | yes |
-| broad cancellation / `aborted` | `paused` | no |
+| cancellation of a reserved/admitted goal round, or its `aborted` outcome | `paused` | no |
+| cancellation with no goal-round attempt | keep durable phase; disarm activation | no |
 | `error` with `RATE_LIMIT` | `usage-limited` | no |
 | other `error`, `max-tokens`, or a non-stale prompt rejection | `blocked` | no |
 | durability failure, disposal, interruption, or unknown future outcome | disarm or block for inspection | no |
@@ -39,11 +40,11 @@ A goal mutation made during its round supersedes settlement of the older revisio
 
 ## Lifecycle and durability
 
-`goal/changed` creates a durability obligation. Before queuing work, the driver awaits `ctx.sessions.flush()` and rechecks both the goal revision and competing input after the await. A closing flush failure arrives through `agent/error`; the driver disarms before another round can start.
+`goal/changed` creates a durability obligation. Before queuing work, the driver awaits `ctx.sessions.flush()` and rechecks both the goal revision and competing input after the await. A closing flush failure arrives through `agent/error`; the driver associates it with the exact closed turn even if a later one-shot injection has appended another turn, then disarms before another round can start.
 
 Activation is never inherited when this plugin loads over an existing agent. `GoalService.disarm()` removes process-local authority without changing durable phase, revision, or history; explicit human-authorized resume records the later reactivation. The same rule applies after session resume and fork through the goal domain's `agent/session-start` handling.
 
-Cancellation is observe-before-act: the concrete loop emits `agent/cancel-requested` before clearing queues or aborting a step, allowing this plugin to pause and disarm the exact active goal. Plugin teardown closes admission, disarms every live goal, cancels an admitted round, and awaits the driver plus agent quiescence while its event fence remains installed.
+Cancellation is observe-before-act: the concrete loop emits `agent/cancel-requested` before clearing queues or aborting a step. The plugin durably pauses an active goal only when the cancellation owns a reserved or admitted goal attempt; cancellation of unrelated human work merely disarms process-local continuation. If the pause mutation fails, the driver falls back to disarming. Plugin teardown closes admission, disarms every live goal, cancels an admitted round, and awaits the driver plus agent quiescence while its event fence remains installed.
 
 ## Model Experience
 

packages/goal/goal-session/src/index.ts

@@ -276,8 +276,8 @@ export function apply(ctx: Context): void {
     /** Mark a post-turn persistence failure before idle scheduling can run. */
     ctx.on('agent/error', (agent, turn) => {
       const state = stateFor(agent)
-      const last = agent.session.events.at(-1)
-      if (last?.type !== 'turn/end' || last.data.turn !== turn) return
+      const closed = agent.session.events.some(event => event.type === 'turn/end' && event.data.turn === turn)
+      if (!closed) return
       if (state.attempt?.turn === turn) state.flushFailedTurns.add(turn)
       disarm(state)
     })
@@ -312,11 +312,21 @@ export function apply(ctx: Context): void {
     })
     ctx.on('agent/cancel-requested', (agent, reason) => {
       const state = stateFor(agent)
+      const attempt = state.attempt
       state.attempt = undefined
       state.competingQueued = false
       const goal = currentGoal(state)
       if (goal?.phase === 'active' && goal.activation === 'armed') {
-        applyOutcome(state, goal, { kind: 'pause', reason })
+        if (attempt === undefined) {
+          disarm(state)
+          return
+        }
+        try {
+          applyOutcome(state, goal, { kind: 'pause', reason })
+        } catch (error: unknown) {
+          ctx.logger.warn(`goal-session: could not pause cancelled goal for agent "${agent.id}": ${renderThrown(error)}`)
+          disarm(state)
+        }
       }
     })
     ctx.on('goal/changed', (agent) => {

packages/goal/goal-session/tests/goal-session.spec.ts

@@ -402,12 +402,17 @@ describe('same-session goal driving', () => {
     expect(test.adapter.requests).toHaveLength(0)
   })
 
-  it('disarms an admitted round whose closing durability checkpoint fails', async () => {
+  it('disarms an admitted round when a later injection hides its failed closing checkpoint', async () => {
     const test = await harness([textResponse('not durable')])
+    let injected = false
     test.ctx.on('session/flush', (session) => {
       const lastStart = session.events.findLast(event => event.type === 'turn/start')
       if (lastStart?.type === 'turn/start' && lastStart.data.trigger.kind === 'message'
-        && lastStart.data.trigger.source.kind === 'goal') {
+        && lastStart.data.trigger.source.kind === 'goal' && !injected) {
+        injected = true
+        test.agent.inject([{ type: 'text', text: 'concurrent completion notice' }], {
+          source: { kind: 'plugin', plugin: 'test' },
+        })
         return Promise.reject(new Error('round flush failed'))
       }
     })
@@ -421,6 +426,10 @@ describe('same-session goal driving', () => {
 
     expect(goal?.phase).toBe('active')
     expect(test.adapter.requests).toHaveLength(1)
+    const turns = test.agent.session.events.filter(event => event.type === 'turn/start')
+    const goalTurn = turns.findIndex(event => event.data.trigger.source.kind === 'goal')
+    const injectedTurn = turns.findIndex(event => event.data.trigger.source.kind === 'plugin')
+    expect(injectedTurn).toBeGreaterThan(goalTurn)
   })
 
   it('blocks the goal when a custom agent rejects the otherwise valid send', async () => {
@@ -559,6 +568,42 @@ describe('same-session goal driving', () => {
     expect(test.adapter.requests).toHaveLength(0)
   })
 
+  it('disarms without durably pausing when cancellation belongs to unrelated human work', async () => {
+    const test = await harness(['hang'])
+    test.agent.send([{ type: 'text', text: 'inspect something first' }])
+    await waitForRequests(test.adapter, 1)
+    const created = test.ctx.goals.create(test.agent, { objective: 'continue after inspection' })
+
+    test.agent.cancel('cancel the inspection')
+    await test.agent.whenIdle()
+
+    expect(test.ctx.goals.get(test.agent)).toMatchObject({
+      id: created.id,
+      revision: created.revision,
+      phase: 'active',
+      activation: 'disarmed',
+      roundsStarted: 0,
+    })
+  })
+
+  it('falls back to disarming when a cancelled reservation cannot be paused', async () => {
+    const test = await harness([])
+    const cancel = test.ctx.on('agent/queued', (agent, _content, info) => {
+      if (agent !== test.agent || info.source.kind !== 'goal') return
+      cancel()
+      vi.spyOn(test.ctx.goals, 'pause').mockImplementationOnce(() => {
+        throw new Error('pause failed')
+      })
+      agent.cancel('cancel the reserved goal round')
+    })
+    test.ctx.goals.create(test.agent, { objective: 'fail closed after cancellation' })
+
+    const goal = await waitForGoal(test.ctx, test.agent, current => current?.activation === 'disarmed')
+
+    expect(goal).toMatchObject({ phase: 'active', revision: 1, roundsStarted: 0 })
+    expect(test.adapter.requests).toHaveLength(0)
+  })
+
   it('blocks admission when downstream cancellation clears the reservation', async () => {
     const test = await harness([])
     let cancelled = false

packages/goal/goal/README.md

@@ -21,7 +21,7 @@ At most one goal is current. Creation produces an active revision-one goal and a
 
 Every non-clear mutation appends a complete versioned snapshot through `agent.inject()`; clear appends a revisioned tombstone. The raw `context/message`, its `{ kind: 'goal' }` source, and its metadata must agree exactly. Replay rejects malformed shapes, source/content drift, discontinuous revisions, illegal lifecycle transitions, non-monotonic per-goal timestamps, and non-sequential goal rounds. Mutation timestamps clamp against the preceding goal update when wall time moves backward.
 
-Injection may append immediately or wait in an active tool-batch FIFO. The service overlays accepted pending changes in memory and reconciles each exact payload when it enters the log, so consecutive model-tool mutations see their own latest revisions without treating an unlogged cache as durable state. `goal/changed` fires after the append or enqueue succeeds; listener failures are contained.
+Injection may append immediately or wait in an active tool-batch FIFO. The service overlays accepted pending changes in memory and reconciles each exact payload when it enters the log, so consecutive model-tool mutations see their own latest revisions without treating an unlogged cache as durable state. Reentrant append observers see each accepted mutation exactly once, and incremental replay retains its cursor at the first corrupt event. `goal/changed` fires after the append or enqueue succeeds; listener failures are contained.
 
 Activation is never persisted. A fresh cache and every `agent/session-start` edge disarm it even when replay finds an active durable phase. A continuation driver also calls `disarm()` before unload or after durability uncertainty. Session resume, fork, and driver replacement therefore retain the objective, phase, revisions, and admitted-round count without initiating work; a later explicit resume mutation must arm continuation.
 
@@ -51,3 +51,4 @@ Append-only within an epoch: each mutation follows the reusable request prefix a
 - **Round-count budget only** — `maxGoalRounds` does not meter tokens, currency, wall time, or provider quotas.
 - **No independent evaluator** — the caller that records completion or blocking is authoritative; evaluator-backed certification is deferred to a separate policy layer.
 - **One current goal** — parallel objectives and a separate goal database are intentionally absent; history remains available in the session log after replacement or clear.
+- **Trusted in-process producers** — a plugin with direct `Session` access can append counterfeit goal metadata. Strict replay detects malformed or inconsistent records and leaves goal access failed at that record until the log is repaired; this is integrity detection, not plugin isolation.

packages/goal/goal/src/index.ts

@@ -64,12 +64,19 @@ export interface ResolvedConfig {
   defaultMaxGoalRounds: number
 }
 
+/** One accepted mutation waiting to enter or be observed in the session log. */
+interface PendingGoalChange {
+  readonly change: GoalChangeMeta
+  readonly activation: GoalActivation
+  applied: boolean
+}
+
 /** Process-local cache plus mutations waiting in the active tool-batch FIFO. */
 interface GoalCache {
   readonly state: GoalFoldState
   activation: GoalActivation
   observedSeq: number
-  readonly pending: GoalChangeMeta[]
+  readonly pending: PendingGoalChange[]
 }
 
 /** Validate a caller-visible positive safe-integer round cap. */
@@ -373,15 +380,21 @@ export class GoalService extends Service {
         const change = decodeGoalEvent(event)
         if (change !== undefined) {
           const pending = cache.pending[0]
-          if (pending !== undefined && sameChange(pending, change)) {
+          if (pending !== undefined && sameChange(pending.change, change)) {
+            if (!pending.applied) {
+              applyGoalChange(cache.state, change)
+              cache.activation = pending.activation
+              pending.applied = true
+            }
             cache.pending.shift()
+            cache.observedSeq += 1
             continue
           }
         }
       }
       applyGoalEvent(cache.state, event)
+      cache.observedSeq += 1
     }
-    cache.observedSeq = session.seq
   }
 
   /** Build a new revision with one replacement phase. */
@@ -479,14 +492,26 @@ export class GoalService extends Service {
     const meta = snapshotJsonValue(change) as JsonValue | undefined
     /* v8 ignore next -- validated goal changes contain only finite JSON primitives and records */
     if (meta === undefined) throw new Error('goal change is not losslessly JSON-serializable')
-    agent.inject(renderGoalChange(change), {
-      source: { kind: 'goal', goalId: ref.id, revision: ref.revision, round: 0 },
-      envelope: 'raw',
-      meta,
-    })
-    cache.pending.push(change)
-    applyGoalChange(cache.state, change)
-    cache.activation = activation
+    const pending: PendingGoalChange = { change, activation, applied: false }
+    cache.pending.push(pending)
+    try {
+      agent.inject(renderGoalChange(change), {
+        source: { kind: 'goal', goalId: ref.id, revision: ref.revision, round: 0 },
+        envelope: 'raw',
+        meta,
+      })
+    } catch (error: unknown) {
+      const index = cache.pending.indexOf(pending)
+      /* v8 ignore next -- a committed goal append cannot reject after its contained observers run */
+      if (index < 0) throw new Error('goal injection failed after its pending mutation was reconciled', { cause: error })
+      cache.pending.splice(index, 1)
+      throw error
+    }
+    if (!pending.applied) {
+      applyGoalChange(cache.state, change)
+      cache.activation = activation
+      pending.applied = true
+    }
     this.sync(agent.session, cache)
     const goal = this.view(cache)
     const notification: GoalChanged = {

packages/goal/goal/tests/goal.spec.ts

@@ -249,6 +249,25 @@ describe('GoalService creation and replay', () => {
     expect(ctx.goals.resume(agent, goal)).toMatchObject({ revision: 2, activation: 'armed' })
   })
 
+  it('removes the service and its session-start listener with the providing fiber', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    const fiber = await ctx.plugin(GoalService)
+    const first = ctx.goals
+    const stub = stubAgent('goal-hmr')
+    ctx.agents.register(stub.agent)
+    const goal = first.create(stub.agent, { objective: 'survive service reload' })
+
+    await fiber.dispose()
+    expect(ctx.get('goals')).toBeUndefined()
+    agentEvents(ctx, stub.agent).emit('agent/session-start', 'resume')
+    expect(first.get(stub.agent)).toMatchObject({ id: goal.id, activation: 'armed' })
+
+    await ctx.plugin(GoalService)
+    expect(ctx.goals).not.toBe(first)
+    expect(ctx.goals.get(stub.agent)).toMatchObject({ id: goal.id, activation: 'disarmed' })
+  })
+
   it('requires the exact live registry instance for reads and mutations', async () => {
     const { ctx, agent } = await harness()
     const impostor = { ...agent, session: new Session(agent.id) }
@@ -418,6 +437,46 @@ describe('GoalService mutations', () => {
     expect(foldGoal(session.events)).toMatchObject({ goal: { revision: 3, phase: 'paused' } })
   })
 
+  it('publishes a mutation consistently to a reentrant session observer', async () => {
+    const ctx = new Context()
+    await ctx.plugin(SessionStore)
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(GoalService)
+    const stub = stubAgentForSession(ctx.sessions.create(SessionId('goal-reentrant-observer')))
+    ctx.agents.register(stub.agent)
+    let observed: ReturnType<GoalService['get']>
+    ctx.on('session/event', (session, event) => {
+      if (session === stub.session && event.type === 'context/message') observed = ctx.goals.get(stub.agent)
+    })
+
+    const created = ctx.goals.create(stub.agent, { objective: 'publish once' })
+
+    expect(observed).toEqual(created)
+    expect(ctx.goals.get(stub.agent)).toEqual(created)
+    expect(foldGoal(stub.session.events)).toMatchObject({ goal: { id: created.id, revision: 1 } })
+  })
+
+  it('rolls back a pending mutation when injection rejects before append', async () => {
+    const ctx = new Context()
+    await ctx.plugin(AgentRegistry)
+    await ctx.plugin(GoalService)
+    const stub = stubAgent('goal-rejected-injection')
+    const append = stub.agent.inject.bind(stub.agent)
+    let reject = true
+    stub.agent.inject = (content, options) => {
+      if (reject) throw new Error('injection rejected')
+      append(content, options)
+    }
+    ctx.agents.register(stub.agent)
+
+    expect(() => ctx.goals.create(stub.agent, { objective: 'first attempt' })).toThrow('injection rejected')
+    reject = false
+    expect(ctx.goals.create(stub.agent, { objective: 'second attempt' })).toMatchObject({
+      objective: 'second attempt',
+      revision: 1,
+    })
+  })
+
   it('rejects deferred goal mutations that enter the log out of FIFO order', async () => {
     const test = await harness()
     test.setDeferred(true)
@@ -461,6 +520,39 @@ describe('GoalService mutations', () => {
       activation: 'disarmed',
     })
   })
+
+  it('reports the same corrupt unseen event after committing its valid prefix', async () => {
+    const { ctx, agent, session } = await harness()
+    expect(ctx.goals.get(agent)).toBeUndefined()
+    const change: GoalSnapshotChangeMeta = {
+      kind: 'goal/change',
+      version: 1,
+      operation: 'create',
+      goal: {
+        id: GoalId('goal-valid-prefix'),
+        revision: 1,
+        objective: 'valid prefix',
+        phase: 'active',
+        maxGoalRounds: 4,
+      },
+      roundsStarted: 0,
+      createdAt: 12,
+      updatedAt: 12,
+    }
+    appendInjection(session, renderGoalChange(change), {
+      source: { kind: 'goal', goalId: change.goal.id, revision: 1, round: 0 },
+      envelope: 'raw',
+      meta: change as never,
+    })
+    appendInjection(session, [{ type: 'text', text: 'corrupt' }], {
+      source: { kind: 'goal', goalId: change.goal.id, revision: 2, round: 0 },
+      envelope: 'raw',
+      meta: { ...change, operation: 'edit', extra: true } as never,
+    })
+
+    expect(() => ctx.goals.get(agent)).toThrow('invalid shape')
+    expect(() => ctx.goals.get(agent)).toThrow('invalid shape')
+  })
 })
 
 describe('goal replay validation', () => {

packages/goal/tool-goal/README.md

@@ -10,12 +10,14 @@ The model-facing control surface for [`ctx.goals`](../goal/README.md): `get_goal
 
 All calls are exclusive, so a model-ordered batch observes earlier mutations and their new revisions. ACP and other clients receive pure generic cards: read for `get_goal`, other for mutations.
 
-A successful mutation that leaves the goal stopped contributes the existing terminal `agent/turn-stop` decision for that physical turn. A later same-turn resume clears the contribution. This avoids an extra model request after pause, block, or completion without changing ordinary loop continuation.
+An autonomous goal round that successfully reports `complete` or `blocked` contributes the existing terminal `agent/turn-stop` decision for that physical turn. Direct-human mutations never contribute this stop: the assistant may acknowledge the change and concurrent human steering remains available to the loop.
 
 ## Authority
 
 Execution requires the exact live `exec.agent`, its inherited `AgentRegistry` initiator, running status, and an open turn. Create, edit, pause, and resume additionally require an accepted `{ kind: 'user' }` message or steering event in a runtime-root agent's current turn. Durable fork lineage does not demote a resumed root; live subagent ownership does.
 
+`{ kind: 'user' }` is a host attestation. `Agent.send()` and `steer()` assign it when their caller omits a source, so plugins, schedulers, and other non-human producers must pass their own source rather than inheriting human authority.
+
 Complete and blocked also accept the exact current goal round: a goal-sourced `user/message` whose id, revision, and round equal the folded current goal. A goal-round blocked call is mechanically rejected until `blockedAfterConsecutiveRounds`; the model judges whether the same condition actually persisted. Direct human authority may stop a goal immediately.
 
 ## Config
@@ -70,4 +72,5 @@ Schemas are prefix-stable while their definitions and visibility are unchanged.
 - **Semantic intent remains model judgment** — execution can prove direct human provenance, not whether a request is substantial enough to merit a goal.
 - **Same-condition blocking remains model judgment** — the runtime enforces distinct admitted-round count, not semantic equivalence of obstacles; an independent evaluator is deferred.
 - **No scheduling or UI commands** — these tools mutate state only; the same-session driver and human command surfaces are separate stack layers.
+- **Goal-round authority requires a driver** — the autonomous `complete`/`blocked` path is dormant unless a continuation driver admits goal-sourced user turns; mounting this tool package alone does not create them.
 - **Prompt registration is independent of filtering** — a scope may hide the tools while retaining their guidance unless the deployment scopes both registrations together.

packages/goal/tool-goal/src/authority.ts

@@ -62,7 +62,11 @@ export function goalToolExecution(ctx: Context, exec: ToolRunContext): GoalToolE
   return { agent, ...openTurn(agent) }
 }
 
-/** Whether an accepted human message appears in the current root-agent turn. */
+/**
+ * Whether host-attested human input appears in the current root-agent turn.
+ * An omitted `Agent.send()` / `steer()` source resolves to `user`, so non-human
+ * producers must supply their own source rather than inheriting this authority.
+ */
 function hasDirectHumanInput(ctx: Context, execution: GoalToolExecution): boolean {
   if (!ctx.agents.roots().includes(execution.agent)) return false
   return execution.events.some(event =>

packages/goal/tool-goal/src/index.ts

@@ -50,8 +50,8 @@ const CREATE_DESCRIPTION =
   + 'trivial single-turn work. Execution rejects non-human and subagent authority.'
 
 const GET_DESCRIPTION =
-  'Read the current same-session goal, including its exact id/revision, durable phase, admitted '
-  + 'round count, cap, and live process-local activation. Call this before updating a goal.'
+  'Read the current same-session goal, including its exact id/revision, objective, phase, completed '
+  + 'continuation rounds, round limit, and whether another continuation is armed. Call this before updating a goal.'
 
 /** Render policy guidance with its deployment-selected blocked threshold. */
 function guidance(blockedAfter: number): string {
@@ -107,13 +107,14 @@ function present(title: string, kind: 'read' | 'other', rawInput?: unknown): Gen
   return { card: 'generic', title, kind, ...rawInput === undefined ? {} : { rawInput } }
 }
 
-/** Remember whether one successful mutation makes this turn terminal. */
+/** Remember whether one autonomous terminal report should stop this turn. */
 function observeMutation(
   terminalTurns: WeakMap<Agent, number>,
   execution: GoalToolExecution,
   goal: GoalView,
+  autonomousTerminal: boolean,
 ): void {
-  if (goal.phase === 'active' && goal.activation === 'armed') {
+  if (!autonomousTerminal || (goal.phase === 'active' && goal.activation === 'armed')) {
     terminalTurns.delete(execution.agent)
     return
   }
@@ -123,6 +124,8 @@ function observeMutation(
 /** Register the three Codex-shaped goal tools and their shared policy section. */
 export function apply(ctx: Context, config: Config): void {
   const resolved = resolveConfig(config)
+  // A stale entry cannot match a later loop turn because turn numbers increase
+  // monotonically within the agent's fixed session.
   const terminalTurns = new WeakMap<Agent, number>()
   ctx.on('agent/turn-stop', (agent, turn) => {
     if (terminalTurns.get(agent) !== turn) return undefined
@@ -160,7 +163,7 @@ export function apply(ctx: Context, config: Config): void {
       },
       max_goal_rounds: {
         type: 'number',
-        description: 'Optional positive safe-integer cap; omission uses the goal-domain deployment default.',
+        description: 'Optional positive safe-integer limit on automatic continuation rounds.',
       },
     },
     execute(args, exec) {
@@ -170,7 +173,7 @@ export function apply(ctx: Context, config: Config): void {
         objective: args.objective,
         ...args.max_goal_rounds === undefined ? {} : { maxGoalRounds: args.max_goal_rounds },
       })
-      observeMutation(terminalTurns, execution, goal)
+      observeMutation(terminalTurns, execution, goal, false)
       return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
     },
     presentCall: args => present('Create goal', 'other', args.objective),
@@ -179,8 +182,8 @@ export function apply(ctx: Context, config: Config): void {
   ctx.tools.register(defineTool({
     name: 'update_goal',
     description: 'Update the exact current goal revision. edit, pause, and resume require a direct '
-      + 'top-level human turn. complete and blocked additionally accept the exact admitted goal '
-      + 'round. blocked is rejected before the configured minimum round count; the model remains '
+      + 'top-level human request. During an automatic continuation of the current goal, complete '
+      + 'and blocked are also allowed. blocked is rejected before the configured minimum round count; the model remains '
       + 'responsible for judging that the same condition persisted across those rounds.',
     parameters: {
       goal_id: { type: 'string', required: true, description: 'Exact id returned by get_goal.' },
@@ -204,27 +207,33 @@ export function apply(ctx: Context, config: Config): void {
       if (args.action === 'edit') {
         requireDirectHuman(ctx, execution)
         const goal = ctx.goals.edit(execution.agent, ref, replacements)
-        observeMutation(terminalTurns, execution, goal)
+        observeMutation(terminalTurns, execution, goal, false)
         return Promise.resolve([{
           type: 'text',
           text: renderGoal(goal),
         }])
       }
+      if (args.action === 'pause' || args.action === 'resume') {
+        requireDirectHuman(ctx, execution)
+        if (args.objective !== undefined || args.max_goal_rounds !== undefined) {
+          throw new HarnessError(
+            'objective and max_goal_rounds are valid only with action edit',
+            'GOAL_TOOL_INVALID_UPDATE',
+          )
+        }
+        const goal = args.action === 'pause'
+          ? ctx.goals.pause(execution.agent, ref)
+          : ctx.goals.resume(execution.agent, ref)
+        observeMutation(terminalTurns, execution, goal, false)
+        return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
+      }
+      const authority = completionAuthority(ctx, execution)
       if (args.objective !== undefined || args.max_goal_rounds !== undefined) {
         throw new HarnessError(
           'objective and max_goal_rounds are valid only with action edit',
           'GOAL_TOOL_INVALID_UPDATE',
         )
       }
-      if (args.action === 'pause' || args.action === 'resume') {
-        requireDirectHuman(ctx, execution)
-        const goal = args.action === 'pause'
-          ? ctx.goals.pause(execution.agent, ref)
-          : ctx.goals.resume(execution.agent, ref)
-        observeMutation(terminalTurns, execution, goal)
-        return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
-      }
-      const authority = completionAuthority(ctx, execution)
       if (args.action === 'blocked' && authority.kind === 'goal-round'
         && authority.goal.roundsStarted < resolved.blockedAfterConsecutiveRounds) {
         throw new HarnessError(
@@ -236,7 +245,7 @@ export function apply(ctx: Context, config: Config): void {
       const goal = args.action === 'complete'
         ? ctx.goals.complete(execution.agent, ref)
         : ctx.goals.block(execution.agent, ref)
-      observeMutation(terminalTurns, execution, goal)
+      observeMutation(terminalTurns, execution, goal, authority.kind === 'goal-round')
       return Promise.resolve([{ type: 'text', text: renderGoal(goal) }])
     },
     presentCall: args => present(

packages/goal/tool-goal/tests/tool-goal.e2e.ts

@@ -101,7 +101,7 @@ describe('goal tools through a real Loader, app, and stdio process', () => {
     expect(stdout).toContain('goal-tools e2e ready.')
     expect(stdout).toContain('GOAL CREATED')
     expect(stdout).toContain(PAUSED_RESULT)
-    expect(stdout).not.toContain('UNEXPECTED CONTINUATION AFTER PAUSE')
+    expect(stdout).toContain('GOAL PAUSED')
 
     const logs = await jsonlFiles(join(workdir as string, '.sessions'))
     expect(logs).toHaveLength(1)

packages/goal/tool-goal/tests/tool-goal.spec.ts

@@ -7,7 +7,7 @@ import GoalService, { GoalId } from '@deepseek-ai/dsh-goal'
 import type { GoalRef } from '@deepseek-ai/dsh-goal'
 import { CallId } from '@deepseek-ai/dsh-llm'
 import type { ContentBlock, MessageSource } from '@deepseek-ai/dsh-llm'
-import { Session, SessionId } from '@deepseek-ai/dsh-session'
+import { SESSION_FORMAT_VERSION, Session, SessionId } from '@deepseek-ai/dsh-session'
 import SystemPrompt from '@deepseek-ai/dsh-system-prompt'
 import ToolRegistry from '@deepseek-ai/dsh-tools'
 import type { ToolExecutionResult } from '@deepseek-ai/dsh-tools'
@@ -20,8 +20,8 @@ interface StubAgent {
 }
 
 /** Build one registry-compatible live agent whose injections append in place. */
-function stubAgent(rawId: string): StubAgent {
-  const session = new Session(SessionId(rawId))
+function stubAgent(rawId: string, supplied?: Session): StubAgent {
+  const session = supplied ?? new Session(SessionId(rawId))
   let status: AgentStatus = 'running'
   const agent: Agent = {
     id: session.id,
@@ -219,6 +219,42 @@ describe('goal tool execution authority', () => {
     expect(childResult.error?.code).toBe('GOAL_TOOL_AUTHORITY_REQUIRED')
   })
 
+  it('rejects stale agent objects and agents outside running status through the executor', async () => {
+    const { ctx, root } = await harness()
+    openTurn(root, { kind: 'user' })
+    const stale = { ...root.agent }
+    const staleResult = await execute(ctx, 'get_goal', {}, stale, stale)
+    expect(staleResult.error?.code).toBe('GOAL_TOOL_DRIVER_REQUIRED')
+
+    root.setStatus('idle')
+    const idleResult = await execute(ctx, 'get_goal', {}, root.agent)
+    expect(idleResult.error?.code).toBe('GOAL_TOOL_DRIVER_REQUIRED')
+  })
+
+  it('treats a fork resumed as a runtime root as direct-human authority', async () => {
+    const { ctx, root } = await harness()
+    const originalTurn = openTurn(root, { kind: 'user' })
+    const created = ctx.goals.create(root.agent, { objective: 'resume the fork' })
+    closeTurn(root, originalTurn)
+    const forkId = SessionId('goal-tool-resumed-fork')
+    const forkSession = new Session(forkId, root.session.events, {
+      version: SESSION_FORMAT_VERSION,
+      id: forkId,
+      createdAt: Date.now(),
+      parentSession: root.session.id,
+      seedLength: root.session.seq,
+    })
+    const fork = stubAgent(forkId, forkSession)
+    ctx.agents.register(fork.agent)
+    expect(ctx.goals.get(fork.agent)).toMatchObject({ id: created.id, activation: 'disarmed' })
+
+    openTurn(fork, { kind: 'user' }, '继续这个目标')
+    const resumed = await execute(ctx, 'update_goal', {
+      goal_id: created.id, revision: created.revision, action: 'resume',
+    }, fork.agent)
+    expect(resultGoal(resumed)).toMatchObject({ id: created.id, revision: 2, phase: 'active' })
+  })
+
   it('rejects calls before a turn and after its end boundary', async () => {
     const { ctx, root } = await harness()
     const before = await execute(ctx, 'get_goal', {}, root.agent)
@@ -237,6 +273,10 @@ describe('goal tool execution authority', () => {
       goal_id: 'goal-missing', revision: 1, action: 'complete',
     }, root.agent)
     expect(result.error?.code).toBe('GOAL_TOOL_AUTHORITY_REQUIRED')
+    const malformed = await execute(ctx, 'update_goal', {
+      goal_id: 'goal-missing', revision: 1, action: 'pause', objective: 'probe',
+    }, root.agent)
+    expect(malformed.error?.code).toBe('GOAL_TOOL_AUTHORITY_REQUIRED')
   })
 
   it('accepts direct human steering in a goal-sourced root turn', async () => {
@@ -290,16 +330,29 @@ describe('goal tool state transitions', () => {
     expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', 1)).toBeUndefined()
   })
 
-  it('stops the current turn after a successful stopped-state mutation', async () => {
+  it('terminal-stops an autonomous completion but leaves a human pause interactive', async () => {
     const { ctx, root } = await harness()
-    openTurn(root, { kind: 'user' })
+    const humanTurn = openTurn(root, { kind: 'user' })
     const created = ctx.goals.create(root.agent, { objective: 'pause cleanly' })
     const paused = await execute(ctx, 'update_goal', {
       goal_id: created.id, revision: created.revision, action: 'pause',
     }, root.agent)
     expect(resultGoal(paused)).toMatchObject({ phase: 'paused' })
-    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', 1)).toEqual({ action: 'stop' })
-    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', 1)).toBeUndefined()
+    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', humanTurn)).toBeUndefined()
+    const resumed = resultGoal(await execute(ctx, 'update_goal', {
+      goal_id: created.id, revision: 2, action: 'resume',
+    }, root.agent))
+    closeTurn(root, humanTurn)
+
+    const roundTurn = openTurn(root, {
+      kind: 'goal', goalId: created.id, revision: resumed['revision'] as number, round: 1,
+    })
+    const complete = await execute(ctx, 'update_goal', {
+      goal_id: created.id, revision: resumed['revision'], action: 'complete',
+    }, root.agent)
+    expect(resultGoal(complete)).toMatchObject({ phase: 'complete' })
+    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', roundTurn)).toEqual({ action: 'stop' })
+    expect(await agentEvents(ctx, root.agent).serial('agent/turn-stop', roundTurn)).toBeUndefined()
   })
 
   it('rearms a restored active goal only after a new direct human prompt', async () => {