fix(cli): keep operation delivery paused after stop

[Dante-dan]

Related issue

Closes #675

Problem / pressure

Stopping a session cancels its current ACP turn, but a completed background Operation can still create a Delivery turn afterward. That makes an explicitly stopped conversation appear to continue by itself, and a daemon restart or partial metadata failure can reopen the same race.

Summary

• Persist the assistant turn that paused automatic Operation delivery when Stop completes.
• Gate Delivery scheduling on the canonical pause marker, the durable Stop request, and a process-local fail-closed fallback.
• Clear the pause only when a real user-authored turn acquires dispatch ownership; goal and Delivery turns cannot resume it.
• Recover idempotently after restart, including when cancellation history or the canonical marker failed to persist, and preserve a newer queued user turn.
• Document the invariant in English and Chinese and cover it with coordinator, execution-service, and bounded race-model tests.

Visual explanation

flowchart TD
  S[User presses Stop] --> R[Durable lastCanceledTurn request]
  R --> C[Cancel active ACP turn]
  C --> P[Persist canonical delivery-pause marker]
  P -->|success| K[Consume Stop request atomically]
  P -->|write fails| F[Keep durable request + local fail-closed barrier]
  F --> H[Daemon restart heals canonical marker]
  K --> G[Operation completion stays pending]
  H --> G
  G --> U[Real user-authored turn]
  U --> X[Clear pause/request, then run turn]

Loading

Before / after

Before	After
A late Operation completion could enqueue a Delivery after Stop.	Stop pauses Delivery for the session and retains completed Operation work.
Restart and independent metadata-write failures could lose the pause.	Durable request, canonical marker, and process-local fallback recover fail-closed and idempotently.
Background goal/Delivery work could become the next activity.	Only a new user-authored turn explicitly resumes automatic delivery.

Test plan

• corepack pnpm --filter lody exec vitest run src/orchestration/operation-coordinator.test.ts src/orchestration/operation-model.test.ts tests/session-execution-service.test.ts (227 tests passed)
• corepack pnpm --filter lody typecheck
• corepack pnpm lint (0 errors)
• corepack pnpm format
• node .github/scripts/check-pr-body.mjs --body-file <pr-body>
• git diff --check

Context handoff

Instructions for reviewing agents

• Review focus: Trace Stop finalization and restart recovery in session-execution-service.ts, then verify all coordinator delivery gates.
• Decisions to challenge: Check the choice to treat the durable exact-match Stop request as a recovery receipt when cancelled history is unavailable.
• Plausible failures / evidence gaps: No device-specific behavior changed; the main residual risk is an unmodeled cross-replica ordering around metadata visibility.

Authoring context

• User goal / directives: Stop must halt the old conversation's background continuation, remain idempotent despite event side effects, and require explicit user activity to resume.
• Constraints / non-goals: Preserve completed Operation results for later delivery and do not make goal or internal Delivery turns count as user resumption.
• Risk-bearing decisions: The pause is session metadata; a durable Stop request and process-local barrier keep failures fail-closed until the canonical marker is established.
• Destructive or irreversible behavior: No data is deleted; completed deliveries remain pending, and a real user turn clears the pause before taking dispatch ownership.
• Deliberately not done or tested: Device-specific behavior is outside this daemon/session-metadata change; replica and restart behavior is exercised through deterministic tests.
• Unknowns / confidence: Confidence is high after targeted race/restart coverage and independent review; cross-device behavior relies on the existing replicated session metadata contract.

Original user prompt

Show original prompt

#675： Stop 之后应该停止旧对话，不要再后台续跑，必须用户显式恢复才能恢复。需要处理好事件的副作用，保持幂等性