fix(cli): keep operation delivery paused after stop

[Dante-dan]

Related issue

Closes #675

Problem / pressure

Stopping a session cancels its current ACP turn, but a completed background Operation can still create a Delivery turn afterward. That makes an explicitly stopped conversation appear to continue by itself, and a daemon restart or partial metadata failure can reopen the same race.

Summary

• Persist the assistant turn that paused automatic Operation delivery when Stop completes.
• Gate Delivery scheduling on the canonical pause marker, the durable Stop request, and a process-local fail-closed fallback.
• Clear the pause only when a real user-authored turn acquires dispatch ownership; goal and Delivery turns cannot resume it.
• Recover idempotently after restart, including when cancellation history or the canonical marker failed to persist, and preserve a newer queued user turn.
• Document the invariant in English and Chinese and cover it with coordinator, execution-service, and bounded race-model tests.

Visual explanation

flowchart TD
  S[User presses Stop] --> R[Durable lastCanceledTurn request]
  R --> C[Cancel active ACP turn]
  C --> P[Persist canonical delivery-pause marker]
  P -->|success| K[Consume Stop request atomically]
  P -->|write fails| F[Keep durable request + local fail-closed barrier]
  F --> H[Daemon restart heals canonical marker]
  K --> G[Operation completion stays pending]
  H --> G
  G --> U[Real user-authored turn]
  U --> X[Clear pause/request, then run turn]

Loading

Before / after

Before	After
A late Operation completion could enqueue a Delivery after Stop.	Stop pauses Delivery for the session and retains completed Operation work.
Restart and independent metadata-write failures could lose the pause.	Durable request, canonical marker, and process-local fallback recover fail-closed and idempotently.
Background goal/Delivery work could become the next activity.	Only a new user-authored turn explicitly resumes automatic delivery.

Test plan

• pnpm --filter lody exec vitest run src/orchestration/operation-coordinator.test.ts src/orchestration/operation-model.test.ts tests/session-execution-service.test.ts (245 tests passed on merge head 2cd7ca98)
• pnpm typecheck (full workspace passed)
• pnpm lint (0 errors)
• pnpm format
• pnpm run docs check and node .github/scripts/check-pr-body.mjs --body-file <pr-body>
• git diff upstream/main --check
• Full pnpm check did not complete in the local sandbox: without a writable Lody data dir, 11 terminal-cleanup tests hit EPERM at ~/.lody-oss; a global LODY_DATA_DIR makes a separate HOME-isolation test share state. The terminal-cleanup suite passed 14/14 with isolated LODY_DATA_DIR; the speculative-worktree suite passed under default data-dir settings. Full remote CI remains pending on this head.

Context handoff

Instructions for reviewing agents

• Review focus: Trace Stop finalization and restart recovery in session-execution-service.ts, then verify all coordinator delivery gates.
• Decisions to challenge: Check the choice to treat the durable exact-match Stop request as a recovery receipt when cancelled history is unavailable.
• Plausible failures / evidence gaps: No device-specific behavior changed; the main residual risk is an unmodeled cross-replica ordering around metadata visibility.

Authoring context

• User goal / directives: Stop must halt the old conversation's background continuation, remain idempotent despite event side effects, and require explicit user activity to resume.
• Constraints / non-goals: Preserve completed Operation results for later delivery and do not make goal or internal Delivery turns count as user resumption.
• Risk-bearing decisions: The pause is session metadata; a durable Stop request and process-local barrier keep failures fail-closed until the canonical marker is established.
• Destructive or irreversible behavior: No data is deleted; completed deliveries remain pending, and a real user turn clears the pause before taking dispatch ownership.
• Deliberately not done or tested: Device-specific behavior is outside this daemon/session-metadata change; replica and restart behavior is exercised through deterministic tests.
• Unknowns / confidence: Confidence is high after targeted race/restart coverage and independent review; cross-device behavior relies on the existing replicated session metadata contract.

Original user prompt

Show original prompt

#675： Stop 之后应该停止旧对话，不要再后台续跑，必须用户显式恢复才能恢复。需要处理好事件的副作用，保持幂等性

Shared conversation

Status: unavailable
Reason: This authoring environment does not provide a public HTTP(S) conversation URL. No private conversation content is included in this PR.