From bdf603e6f1e8dbd81ca08644186b1fe3ddbc6bec Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Tue, 13 Oct 2026 12:23:51 +0800
Subject: [PATCH 01/11] feat(collaboration): reconcile request revisions with
 governed Goal effects

Signed-off-by: song <liusongstep@gmail.com>
---
 .../dashboard/src/data/chat-model.ts          |   5 +-
 apps/presentation/dashboard/src/data/chat.ts  |   1 +
 .../dashboard/src/data/request-control.ts     |  47 +++
 .../personal-workspace/collaboration-card.css |  13 +
 .../personal-workspace/collaboration-card.tsx |  37 +-
 .../personal-workspace-model.ts               |   1 +
 .../personal-workspace/request-control.tsx    | 155 +++++++
 .../return-delivery-status.tsx                |   3 +-
 .../manager_context/presentation.py           |  47 ++-
 .../capabilities/manager_context/roundtrip.py |  27 +-
 .../capabilities/manager_context/tracking.py  |  22 +
 loopx/cli_commands/manager_inbox.py           |  46 ++-
 loopx/collaboration_mcp.py                    |  26 +-
 loopx/control_plane/collaboration/inbox.py    |  97 ++++-
 .../collaboration/inbox_receipts.ts           |  59 +--
 .../collaboration/peer_context_observation.py |   7 +-
 loopx/control_plane/collaboration/peers.py    |  11 +-
 .../collaboration/request_amendment.py        | 182 ++++++++
 .../collaboration/request_control.ts          | 388 ++++++++++++++++++
 .../collaboration/request_control_contract.ts |   9 +
 .../collaboration/request_control_source.py   | 142 +++++++
 .../collaboration/result_publication.ts       |  55 ++-
 .../collaboration/semantic_request.ts         |  25 ++
 .../collaboration/source_chat_observation.py  |  16 +
 .../control_plane/effect_runtime_handlers.ts  |   7 +-
 .../goals/goal_amendment_authority.ts         | 216 ++++++++--
 .../goals/goal_amendment_runtime.py           |  43 +-
 loopx/presentation/configuration_api.py       |   4 +
 loopx/presentation/goal_amendment_api.py      |  14 +-
 loopx/presentation/goal_source_routing.py     |  16 +
 loopx/presentation/request_control_api.py     | 104 +++++
 .../project_registry_io_manifest_v1.json      |  42 +-
 tsconfig.control-plane.json                   |   1 +
 33 files changed, 1705 insertions(+), 163 deletions(-)
 create mode 100644 apps/presentation/dashboard/src/data/request-control.ts
 create mode 100644 apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx
 create mode 100644 loopx/control_plane/collaboration/request_amendment.py
 create mode 100644 loopx/control_plane/collaboration/request_control.ts
 create mode 100644 loopx/control_plane/collaboration/request_control_contract.ts
 create mode 100644 loopx/control_plane/collaboration/request_control_source.py
 create mode 100644 loopx/presentation/goal_source_routing.py
 create mode 100644 loopx/presentation/request_control_api.py

diff --git a/apps/presentation/dashboard/src/data/chat-model.ts b/apps/presentation/dashboard/src/data/chat-model.ts
index 66bb18b38e..470185c6fe 100644
--- a/apps/presentation/dashboard/src/data/chat-model.ts
+++ b/apps/presentation/dashboard/src/data/chat-model.ts
@@ -88,6 +88,9 @@ export type CollaborationReadback = {
   agent_id: string;
   goal_id?: string;
   decision_reason?: string;
+  request_revision?: number;
+  control_route?: import("./request-control").RequestControlRoute;
+  request_control?: import("./request-control").RequestControlView | null;
   brief: {
     purpose: string;
     context: string;
@@ -98,7 +101,7 @@ export type CollaborationReadback = {
   };
   read_status: string;
   decision: string;
-  returns: { phase: string; status: string }[];
+  returns: { phase: string; status: string; request_revision?: number | null }[];
 };
 
 export type ChatRouteCandidate = {
diff --git a/apps/presentation/dashboard/src/data/chat.ts b/apps/presentation/dashboard/src/data/chat.ts
index a2e8722828..1cced23c35 100644
--- a/apps/presentation/dashboard/src/data/chat.ts
+++ b/apps/presentation/dashboard/src/data/chat.ts
@@ -801,6 +801,7 @@ export type ChatVisibleMessage = {
   return_delivery?: {
     schema_version: "manager_return_delivery_status_v0";
     phase: "decision" | "conclusion";
+    request_revision?: number | null;
     status: string;
     created_at?: string | null;
     delivered_at?: string | null;
diff --git a/apps/presentation/dashboard/src/data/request-control.ts b/apps/presentation/dashboard/src/data/request-control.ts
new file mode 100644
index 0000000000..4d57e8a422
--- /dev/null
+++ b/apps/presentation/dashboard/src/data/request-control.ts
@@ -0,0 +1,47 @@
+import {z} from "zod";
+import {requestJson} from "./chat";
+import {REQUEST_CONTROL_SCHEMA, REQUEST_AMENDMENT_OUTCOMES, REQUEST_CONTROL_STATES,
+  REQUEST_OBSERVATION_STATES} from "../../../../../loopx/control_plane/collaboration/request_control_contract.js";
+
+export const requestControlRouteSchema = z.object({available: z.boolean().optional(), goal_id: z.string(), goal_instance_id: z.string(),
+  agent_id: z.string(), request_id: z.string(), session_id: z.string(), turn_id: z.string()});
+export type RequestControlRoute = z.infer<typeof requestControlRouteSchema>;
+export function requestControlRouteKey(route: RequestControlRoute) {
+  return JSON.stringify([route.goal_id, route.goal_instance_id, route.agent_id, route.request_id, route.session_id, route.turn_id]);
+}
+export const requestBriefSchema = z.object({schema_version: z.literal("collaboration_brief_v0"), purpose: z.string(), context: z.string(),
+  constraints: z.array(z.string()), inputs: z.array(z.object({ref: z.string(), description: z.string(), sha256: z.string().optional(),
+    delegation: z.object({operation_id: z.string(), ref: z.string(), relation: z.enum(["responds_to", "revises", "uses"])}).optional()})),
+  acceptance: z.array(z.string()), return_requirement: z.string()});
+export type RequestBrief = z.infer<typeof requestBriefSchema>;
+const terminalSchema = z.object({operation_id: z.string(), reservation_digest: z.string(), outcome: z.enum(REQUEST_AMENDMENT_OUTCOMES),
+  goal_changed: z.boolean(), goal_revision: z.number().nullable(), todo_id: z.string().nullable(), receipt_sha256: z.string(),
+  goal_ref: z.object({goal_id: z.string(), goal_instance_id: z.string()})});
+export const requestControlViewSchema = z.object({schema_version: z.literal(REQUEST_CONTROL_SCHEMA),
+  request_id: z.string(), goal_ref: z.object({goal_id: z.string(), goal_instance_id: z.string()}), receiver_agent_id: z.string(),
+  revision: z.number().int().positive(), control_version: z.number().int().nonnegative(), revision_digest: z.string(), brief: requestBriefSchema,
+  reason: z.string(), read_at: z.string().nullable(), read_readback: z.enum(REQUEST_OBSERVATION_STATES),
+  assessment: z.object({decision: z.enum(["adopt", "defer", "reject", "no_change"]), reason: z.string(), assessed_at: z.string()}).nullable(),
+  assessment_readback: z.enum(REQUEST_OBSERVATION_STATES),
+  control_state: z.enum(REQUEST_CONTROL_STATES),
+  cancellation: z.object({operation_id: z.string(), reason: z.string(), requested_at: z.string()}).nullable(),
+  active_reservation: z.object({digest: z.string(), binding: z.object({request_revision: z.number(), operation_id: z.string()})}).nullable(),
+  terminal_effects: z.array(z.object({digest: z.string(), binding: z.object({request_revision: z.number(), operation_id: z.string()}), terminal: terminalSchema})),
+  execution_authority_granted: z.literal(false)});
+export type RequestControlView = z.infer<typeof requestControlViewSchema>;
+export const pendingRequestControlSchema = z.object({route: requestControlRouteSchema, operation: z.enum(["revise", "cancel", "recover"]),
+  parameters: z.record(z.string(), z.unknown()), execute: z.literal(true)});
+export type PendingRequestControl = z.infer<typeof pendingRequestControlSchema>;
+const responseSchema = z.object({ok: z.boolean(), view: requestControlViewSchema.nullable().optional(),
+  request_control: requestControlViewSchema.nullable().optional(), effect: terminalSchema.nullable().optional(),
+  readback_errors: z.array(z.string()).optional(), effect_recovery: z.object({readback_errors: z.array(z.string()).optional()}).optional()});
+function routing(route: RequestControlRoute) {const {available: _available, ...fields} = route; return fields;}
+export async function fetchRequestControl(route: RequestControlRoute) {
+  const response = responseSchema.parse(await requestJson<unknown>(`/api/chat/request-control?${new URLSearchParams(routing(route))}`));
+  if (!response.ok || !response.view) throw new Error("Current request readback is unavailable.");
+  return response.view;
+}
+export async function applyRequestControl(request: PendingRequestControl, execute = true) {
+  return responseSchema.parse(await requestJson<unknown>("/api/chat/request-control", {method: "POST",
+    body: JSON.stringify({...routing(request.route), operation: request.operation, parameters: request.parameters, execute})}));
+}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css b/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css
index 63d5a2cf29..a249553572 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css
+++ b/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css
@@ -8,3 +8,16 @@
 .personal-collaboration ul { padding-left: 20px; }
 .personal-collaboration small { display: block; font-family: var(--font-mono); font-size: var(--text-caption); line-height: var(--leading-caption); }
 .personal-collaboration summary:focus-visible { outline: 2px solid var(--color-link, #0070f3); outline-offset: 2px; }
+.personal-request-control { border-top: 1px solid var(--color-border); margin-top: 16px; padding-top: 12px; }
+.personal-request-control form, .personal-request-control label { display: grid; gap: 6px; }
+.personal-request-control form { gap: 12px; margin-top: 12px; }
+.personal-request-control input, .personal-request-control textarea { width: 100%; min-width: 0; box-sizing: border-box; }
+.personal-request-control textarea { min-height: 72px; resize: vertical; }
+.personal-request-control fieldset { min-width: 0; margin: 0; border: 0; padding: 0; }
+.personal-request-input { display: grid; gap: 8px; margin: 10px 0; padding-bottom: 10px; border-bottom: 1px solid var(--color-border); }
+.personal-request-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.personal-request-help { color: var(--color-text-secondary); }
+.personal-request-control button { min-height: 44px; padding: 8px 12px; border: 1px solid var(--pw-line-strong); border-radius: 6px; background: var(--pw-card); color: inherit; cursor: pointer; }
+.personal-request-control button:disabled { opacity: .5; cursor: default; }
+.personal-request-control :is(button, input, textarea):focus-visible { outline: 2px solid var(--pw-blue); outline-offset: 2px; }
+.personal-request-control :is(input, textarea) { padding: 8px 10px; border: 1px solid var(--pw-line-strong); border-radius: 6px; background: var(--pw-card); color: var(--pw-text); font: inherit; }
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.tsx b/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.tsx
index a73cf7b34b..64d097b870 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.tsx
@@ -1,4 +1,7 @@
 import type { CollaborationReadback } from "../../data/chat-model";
+import {useEffect, useState} from "react";
+import type {RequestControlView} from "../../data/request-control";
+import {RequestControl} from "./request-control";
 import { useWorkspaceI18n } from "./i18n";
 import "./collaboration-card.css";
 
@@ -23,11 +26,26 @@ const copy = {
 
 export function CollaborationCard({ request }: { request?: CollaborationReadback }) {
   const { locale } = useWorkspaceI18n();
+  const [observed, setObserved] = useState<RequestControlView | null>(null);
+  const [unavailable, setUnavailable] = useState(false);
+  const [editing, setEditing] = useState(false);
+  const [detailsOpen, setDetailsOpen] = useState(false);
+  useEffect(() => {setObserved(null); setUnavailable(false);}, [request?.request_id]);
+  useEffect(() => {
+    if (request?.request_control && observed && request.request_control.control_version >= observed.control_version) {
+      setObserved(null); setUnavailable(false);
+    }
+  }, [request?.request_control]);
   if (!request) return null;
   const c = copy[locale];
-  const brief = request.brief;
+  const brief = observed?.brief ?? request.brief;
+  const revision = observed?.revision ?? request.request_revision;
+  const readStatus = unavailable ? "unavailable" : observed ? observed.read_readback === "recorded" ? "supplied"
+    : observed.read_readback === "unavailable" ? "unavailable" : "pending" : request.read_status;
+  const recordedDecision = unavailable ? "unavailable" : observed ? observed.assessment?.decision
+    ?? (observed.assessment_readback === "unavailable" ? "unavailable" : "pending") : request.decision;
   const decision = (() => {
-    switch (request.decision) {
+    switch (recordedDecision) {
       case "adopt": return c.adopt;
       case "defer": return c.defer;
       case "reject": return c.reject;
@@ -36,23 +54,30 @@ export function CollaborationCard({ request }: { request?: CollaborationReadback
       default: return c.unknown;
     }
   })();
-  const conclusion = request.returns.find((reply) => reply.phase === "conclusion");
+  const conclusion = request.returns.find((reply) => reply.phase === "conclusion" &&
+    (revision === undefined || (reply.request_revision === undefined ? 1 : reply.request_revision) === revision));
+  const decisionReason = observed ? observed.assessment?.reason : request.decision_reason;
   return <section className="personal-collaboration" aria-label={c.title}>
     <header><strong>{brief.purpose}</strong><span>{c.owner}: {request.goal_id ? `${request.goal_id} / ` : ""}{request.agent_id}</span></header>
     <p className="personal-collaboration-status">
-      <span>{request.read_status === "supplied" ? c.supplied : request.read_status === "unavailable" ? c.unavailable : c.pending}</span>
+      {revision !== undefined ? <span>{locale === "zh-CN" ? "请求版本" : "Request revision"} {revision}</span> : null}
+      <span>{readStatus === "supplied" ? c.supplied : readStatus === "unavailable" ? c.unavailable : c.pending}</span>
       <span>{c.decision}: {decision}</span>
       {conclusion ? <span>{conclusion.status === "delivered" ? c.delivered
         : conclusion.status === "queued" ? c.result : c.unverified}</span> : null}
     </p>
-    {request.decision_reason ? <p>{c.reason}: {request.decision_reason}</p> : null}
-    <details>
+    {decisionReason && !unavailable ? <p>{c.reason}: {decisionReason}</p> : null}
+    <details onToggle={event => setDetailsOpen(event.currentTarget.open)}>
       <summary>{c.details}</summary>
+      {request.control_route ? <RequestControl route={request.control_route} active={detailsOpen}
+        onReadback={value => {setObserved(value); setUnavailable(value === null);}} onEditing={setEditing} /> : null}
+      {!editing && <>
       <h4>{c.context}</h4><p>{brief.context}</p>
       {brief.constraints.length ? <><h4>{c.constraints}</h4><ul>{brief.constraints.map((item, i) => <li key={i}>{item}</li>)}</ul></> : null}
       {brief.inputs.length ? <><h4>{c.inputs}</h4><ul>{brief.inputs.map((input, i) => <li key={i}><code>{input.ref}</code> — {input.description}{input.sha256 ? <small>sha256:{input.sha256}</small> : null}</li>)}</ul></> : null}
       <h4>{c.acceptance}</h4><ul>{brief.acceptance.map((item, i) => <li key={i}>{item}</li>)}</ul>
       <h4>{c.return}</h4><p>{brief.return_requirement}</p>
+      </>}
     </details>
   </section>;
 }
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-model.ts b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-model.ts
index 2b433edd93..0a0d1259e1 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-model.ts
+++ b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-model.ts
@@ -385,6 +385,7 @@ export type WorkspaceReturnDelivery = {
   error?: string | null;
   status: string;
   verification?: "reconciled_after_restart";
+  request_revision?: number | null;
 };
 
 export type WorkspaceImageAttachment = {
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx b/apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx
new file mode 100644
index 0000000000..35d50ccc14
--- /dev/null
+++ b/apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx
@@ -0,0 +1,155 @@
+import {useCallback, useEffect, useRef, useState} from "react";
+import {ChatApiError} from "../../data/chat";
+import {applyRequestControl, fetchRequestControl, pendingRequestControlSchema, requestControlRouteKey,
+  type PendingRequestControl, type RequestBrief, type RequestControlRoute, type RequestControlView} from "../../data/request-control";
+import {useWorkspaceI18n} from "./i18n";
+
+const words = {
+  "zh-CN": {open: "修正或取消请求", refresh: "重新读取", edit: "修正内容", save: "保存修正", cancel: "取消请求", recover: "核对原操作",
+    revision: "请求版本", pending: "目标变更仍待核对", cancelling: "取消已记录，原操作仍待核对", cancelled: "请求已取消", current: "当前请求",
+    committed: "已写入目标", aborted: "已中止，未写入目标", rejected: "目标未接受这项变更", goalRevision: "目标版本",
+    limitation: "取消会停止这项请求的新变更；已经写入目标的任务会保留。", retained: "已记录的变更不代表任务执行或验收完成。",
+    purpose: "请求内容", context: "背景与补充", constraints: "约束（每行一项）", acceptance: "验收要求（每行一项）", expected: "需要回传",
+    inputs: "输入材料", ref: "工作区内的相对路径", description: "材料说明", digest: "版本摘要（可选）", add: "添加材料", remove: "移除材料",
+    reason: "修正原因（可选）", defaultReason: "在原对话中修正请求", cancelReason: "原请求发起者取消请求", close: "收起编辑",
+    unknown: "结果尚未确认。原操作已保留，可重新核对。", retry: "重试原操作", stale: "请求已有新修订。已重新读取，请基于当前内容修改。",
+    historical: "这是历史 Goal 实例的请求，当前界面仅保留回读。", loading: "正在读取请求…", error: "暂时无法读取当前请求。", storage: "无法保存恢复信息，本次操作尚未发送。",
+  },
+  en: {open: "Revise or cancel request", refresh: "Refresh", edit: "Revise content", save: "Save revision", cancel: "Cancel request", recover: "Recover original operation",
+    revision: "Request revision", pending: "Goal effect needs reconciliation", cancelling: "Cancellation recorded; original operation still needs reconciliation", cancelled: "Request cancelled", current: "Current request",
+    committed: "Committed to Goal", aborted: "Aborted without a Goal change", rejected: "Goal change rejected", goalRevision: "Goal revision",
+    limitation: "Cancellation stops new changes for this request. Work already committed to the Goal is retained.", retained: "A recorded change does not prove task execution or acceptance.",
+    purpose: "Request", context: "Context & corrections", constraints: "Constraints (one per line)", acceptance: "Acceptance (one per line)", expected: "Expected return",
+    inputs: "Input materials", ref: "Relative workspace path", description: "Description", digest: "Version digest (optional)", add: "Add material", remove: "Remove material",
+    reason: "Revision reason (optional)", defaultReason: "Request revised in the original conversation", cancelReason: "Original requester cancelled the request", close: "Close editor",
+    unknown: "The outcome is not confirmed. The original operation is retained for recovery.", retry: "Retry original operation", stale: "The request changed. Its current revision has been loaded for editing.",
+    historical: "This request belongs to a historical Goal instance and remains read-only here.", loading: "Reading the request…", error: "Current request readback is unavailable.", storage: "Recovery data could not be saved. The operation was not sent.",
+  },
+};
+const lines = (value: string) => value.split("\n").map(row => row.trim()).filter(Boolean);
+
+export function RequestControl({route, active, onReadback, onEditing}: {route: RequestControlRoute; active: boolean;
+  onReadback: (view: RequestControlView | null) => void; onEditing: (editing: boolean) => void}) {
+  const {locale} = useWorkspaceI18n(); const c = words[locale];
+  const [opened, setOpened] = useState(false), [view, setView] = useState<RequestControlView | null>(null);
+  const [draft, setDraft] = useState<RequestBrief | null>(null), [reason, setReason] = useState("");
+  const [pending, setPending] = useState<PendingRequestControl | null>(null), [busy, setBusy] = useState(false), [error, setError] = useState("");
+  const generation = useRef(0), onRead = useRef(onReadback); onRead.current = onReadback;
+  const editNotice = useRef(onEditing); editNotice.current = onEditing;
+  useEffect(() => {editNotice.current(draft !== null);}, [draft !== null]);
+  const storageKey = `loopx.request-control.${route.goal_instance_id}.${route.session_id}.${route.request_id}`;
+  const routeKey = requestControlRouteKey(route);
+  const show = useCallback((value: RequestControlView | null) => {setView(value); onRead.current(value);}, []);
+  const remember = (value: PendingRequestControl | null) => {
+    if (value) sessionStorage.setItem(storageKey, JSON.stringify(value)); else sessionStorage.removeItem(storageKey);
+    setPending(value);
+  };
+  const load = useCallback(async () => {
+    const observed = ++generation.current;
+    try {
+      const value = await fetchRequestControl(route);
+      if (observed === generation.current) {show(value); return value;}
+    } catch (failure) {
+      if (observed === generation.current) {show(null); setError(failure instanceof Error ? failure.message : c.error);}
+    }
+    return null;
+  }, [routeKey, show, c.error]); // Route identity, not caller object allocation, owns this read.
+  useEffect(() => {
+    generation.current++; setOpened(false); setDraft(null); setReason(""); setPending(null); setError(""); setView(null); setBusy(false);
+    try {
+      const raw = sessionStorage.getItem(storageKey);
+      if (raw) {
+        const saved = pendingRequestControlSchema.parse(JSON.parse(raw));
+        if (requestControlRouteKey(saved.route) === routeKey) {setPending(saved); setOpened(true); void load();}
+      }
+    } catch {setError(c.unknown);}
+    return () => {generation.current++;};
+  }, [storageKey, routeKey]);
+  useEffect(() => {
+    if (active && !opened && route.available !== false) {setOpened(true); void load();}
+  }, [active, opened, route.available, load]);
+
+  async function submit(request: PendingRequestControl) {
+    const observed = ++generation.current;
+    setBusy(true); setError("");
+    if (pending === null && request.operation !== "recover") {
+      try {
+        await applyRequestControl(request, false);
+        if (observed !== generation.current) return;
+      } catch (failure) {
+        if (observed !== generation.current) return;
+        setBusy(false);
+        if (failure instanceof ChatApiError && failure.payload.error_code === "request_basis_changed") {
+          setDraft(null); await load(); setError(c.stale);
+        } else setError(failure instanceof Error ? failure.message : c.error);
+        return;
+      }
+    }
+    try {remember(request);} catch {setBusy(false); setError(c.storage); return;}
+    try {
+      const result = await applyRequestControl(request);
+      if (observed !== generation.current) return;
+      const current = result.view ?? result.request_control ?? null;
+      show(current);
+      if (!result.ok || !current) {
+        setError(result.readback_errors?.join(" ") || result.effect_recovery?.readback_errors?.join(" ") || c.unknown);
+        return;
+      }
+      remember(null); setDraft(null); setReason("");
+    } catch (failure) {
+      if (observed !== generation.current) return;
+      show(null);
+      if (failure instanceof ChatApiError && failure.payload.error_code === "request_basis_changed") {
+        remember(null); setDraft(null); setBusy(false);
+        await load(); setError(c.stale);
+      } else setError(failure instanceof Error ? `${c.unknown} ${failure.message}` : c.unknown);
+    } finally {if (observed === generation.current) setBusy(false);}
+  }
+  function operation(kind: "revise" | "cancel" | "recover") {
+    if (kind !== "recover" && !view) return;
+    const parameters = kind === "recover" ? {} : {operation_id: `request-${kind}-${crypto.randomUUID()}`,
+      expected_revision: view!.revision, expected_digest: view!.revision_digest,
+      reason: kind === "cancel" ? c.cancelReason : reason.trim() || c.defaultReason,
+      ...(kind === "revise" ? {brief: draft} : {})};
+    void submit({route, operation: kind, parameters, execute: true});
+  }
+  if (route.available === false) return <p>{c.historical}</p>;
+  if (!opened) return null;
+  const terminal = view?.terminal_effects.at(-1);
+  return <section className="personal-request-control" aria-label={c.open}>
+    {!view && <p><strong>{busy ? c.loading : c.error}</strong></p>}
+    {view && view.control_state !== "open" && <p role="status">{view.control_state === "cancelled" ? c.cancelled : view.control_state === "cancellation_pending" ? c.cancelling
+      : view.control_state === "effect_pending" ? c.pending : c.current}</p>}
+    {terminal && <p>{c.revision} {terminal.binding.request_revision}: {c[terminal.terminal.outcome]}
+      {terminal.terminal.goal_revision !== null ? ` · ${c.goalRevision} ${terminal.terminal.goal_revision}` : ""}</p>}
+    {view?.terminal_effects.length ? <p className="personal-request-help">{c.retained}</p> : null}
+    <p className="personal-request-help">{c.limitation}</p>
+    {error && <p role="alert">{error}</p>}
+    <div className="personal-request-actions">
+      <button type="button" disabled={busy} onClick={() => void load()}>{c.refresh}</button>
+      {pending ? <button type="button" disabled={busy} onClick={() => void submit(pending)}>{c.retry}</button> : <>
+        {view && !view.cancellation && <button type="button" disabled={busy} onClick={() => {setDraft(structuredClone(view.brief)); setReason("");}}>{c.edit}</button>}
+        {view && !view.cancellation && <button type="button" disabled={busy} onClick={() => operation("cancel")}>{c.cancel}</button>}
+        {view?.active_reservation && <button type="button" disabled={busy} onClick={() => operation("recover")}>{c.recover}</button>}
+      </>}
+    </div>
+    {draft && <form onSubmit={event => {event.preventDefault(); operation("revise");}}>
+      <label>{c.purpose}<input aria-label={c.purpose} value={draft.purpose} disabled={busy || !!pending} onChange={e => setDraft({...draft, purpose: e.target.value})} required /></label>
+      <label>{c.context}<textarea aria-label={c.context} value={draft.context} disabled={busy || !!pending} onChange={e => setDraft({...draft, context: e.target.value})} required /></label>
+      <label>{c.constraints}<textarea aria-label={c.constraints} value={draft.constraints.join("\n")} disabled={busy || !!pending} onChange={e => setDraft({...draft, constraints: lines(e.target.value)})} /></label>
+      <label>{c.acceptance}<textarea aria-label={c.acceptance} value={draft.acceptance.join("\n")} disabled={busy || !!pending} onChange={e => setDraft({...draft, acceptance: lines(e.target.value)})} required /></label>
+      <label>{c.expected}<textarea aria-label={c.expected} value={draft.return_requirement} disabled={busy || !!pending} onChange={e => setDraft({...draft, return_requirement: e.target.value})} required /></label>
+      <fieldset><legend>{c.inputs}</legend>{draft.inputs.map((input, index) => <div className="personal-request-input" key={index}>
+        <label>{c.ref}<input aria-label={c.ref} value={input.ref} disabled={busy || !!pending} onChange={e => setDraft({...draft, inputs: draft.inputs.map((old, i) => i === index ? {...old, ref: e.target.value} : old)})} required /></label>
+        <label>{c.description}<input aria-label={c.description} value={input.description} disabled={busy || !!pending} onChange={e => setDraft({...draft, inputs: draft.inputs.map((old, i) => i === index ? {...old, description: e.target.value} : old)})} required /></label>
+        <label>{c.digest}<input aria-label={c.digest} value={input.sha256 ?? ""} disabled={busy || !!pending} onChange={e => setDraft({...draft, inputs: draft.inputs.map((old, i) => {
+          if (i !== index) return old; const next = {...old}; if (e.target.value) next.sha256 = e.target.value; else delete next.sha256; return next;
+        })})} /></label>
+        <button type="button" disabled={busy || !!pending} onClick={() => setDraft({...draft, inputs: draft.inputs.filter((_, i) => i !== index)})}>{c.remove}</button>
+      </div>)}<button type="button" disabled={busy || !!pending || draft.inputs.length >= 12} onClick={() => setDraft({...draft, inputs: [...draft.inputs, {ref: "", description: ""}]})}>{c.add}</button></fieldset>
+      <label>{c.reason}<input aria-label={c.reason} value={reason} disabled={busy || !!pending} onChange={e => setReason(e.target.value)} /></label>
+      <div className="personal-request-actions"><button disabled={busy || !!pending} type="submit">{c.save}</button>
+        <button disabled={busy || !!pending} type="button" onClick={() => setDraft(null)}>{c.close}</button></div>
+    </form>}
+  </section>;
+}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/return-delivery-status.tsx b/apps/presentation/dashboard/src/features/personal-workspace/return-delivery-status.tsx
index 6e99a368a8..00da89919b 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/return-delivery-status.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/return-delivery-status.tsx
@@ -2,7 +2,7 @@ import { useWorkspaceI18n } from "./i18n";
 import type { WorkspaceReturnDelivery } from "./personal-workspace-model";
 
 export function ReturnDeliveryStatus({ delivery }: { delivery?: WorkspaceReturnDelivery }) {
-  const { t } = useWorkspaceI18n();
+  const { t, locale } = useWorkspaceI18n();
   if (!delivery) return null;
   const label = delivery.status === "delivered"
     ? delivery.verification === "reconciled_after_restart"
@@ -23,6 +23,7 @@ export function ReturnDeliveryStatus({ delivery }: { delivery?: WorkspaceReturnD
   return (
     <small className={`personal-return-delivery is-${tone}`} role="status">
       {label}
+      {delivery.request_revision !== undefined ? ` · ${locale === "zh-CN" ? "请求版本" : "Request revision"} ${delivery.request_revision ?? (locale === "zh-CN" ? "未知" : "unknown")}` : ""}
     </small>
   );
 }
diff --git a/loopx/capabilities/manager_context/presentation.py b/loopx/capabilities/manager_context/presentation.py
index 7fcef9953b..acc6bd9f45 100644
--- a/loopx/capabilities/manager_context/presentation.py
+++ b/loopx/capabilities/manager_context/presentation.py
@@ -1,14 +1,16 @@
 """Owner-local collaboration readback in the conversation that delegated it."""
 
-from . import _read, _root
+from . import _read, _root, _hash
 from .tracking import _entry, _receipt
-from .roundtrip import _original_delivery_facts, reply_status
+from .roundtrip import reply_status
+from ...control_plane.collaboration.source_chat_observation import original_delivery_facts
 from ...chat import redact_local_paths
 from ...control_plane.collaboration import conversation_scope
 from ...control_plane.collaboration.goal_instance_scope import (
     collaboration_goal_scope,
     decide_collaboration_lifecycle,
 )
+from ...control_plane.collaboration.inbox import controlled_request_readback
 
 
 def project_collaboration(store, root, session_id, messages, *, registry):
@@ -44,6 +46,7 @@ def project_collaboration(store, root, session_id, messages, *, registry):
         except (OSError, ValueError, TypeError):
             continue
     result = []
+    revision_labels = {}
     for message in messages:
         tid = message.get("turn_id")
         if not tid or carriers.get(tid) != message.get("message_id"):
@@ -72,9 +75,9 @@ def project_collaboration(store, root, session_id, messages, *, registry):
                     scope=scope,
                 )
                 route = _read(_root(root) / "roundtrips" / (row["request_id"] + ".json"))
-                decide_collaboration_lifecycle(
+                lifetime = decide_collaboration_lifecycle(
                     scope, operation="original_request_inspect", record=row, route=route,
-                    initial_delivery=_original_delivery_facts(row, route, turn, source_id=row["source_id"]),
+                    initial_delivery=original_delivery_facts(row, route, turn, source_id=row["source_id"]),
                 )
             if (
                 route.get("session_id") != session_id
@@ -99,10 +102,7 @@ def safe(value):
                     return {key: safe(item) for key, item in value.items()}
                 return value
 
-            result.append(
-                {
-                    **message,
-                    "collaboration": {
+            collaboration = {
                         "schema_version": "collaboration_request_readback_v0",
                         "request_id": row["request_id"],
                         "agent_id": row["agent_id"],
@@ -118,10 +118,33 @@ def safe(value):
                         else decision.get("decision", "pending"),
                         "decision_reason": safe(decision.get("reason", "")) if not error else "",
                         "returns": reply_status(root, row),
-                    },
-                }
-            )
+            }
+            if scope.exact:
+                collaboration["control_route"] = {"available": lifetime.get("mode") == "current_instance",
+                    "goal_id": row["goal_id"], "goal_instance_id": row["goal_ref"]["goal_instance_id"],
+                    "agent_id": row["agent_id"], "request_id": row["request_id"], "session_id": session_id, "turn_id": tid}
+            controlled = controlled_request_readback(root, row)
+            if controlled is not None:
+                current = controlled.get("readback")
+                collaboration["request_control"] = safe(controlled.get("request_control_view"))
+                collaboration["receipt_warnings"] = controlled["warnings"]
+                if current is not None:
+                    collaboration.update(brief=safe(current["brief"]), request_revision=current["request_revision"],
+                        read_status=current["card_read_status"], decision=current["card_decision"],
+                        decision_reason=safe(current["decision"]["reason"] or ""))
+                else:
+                    collaboration.update(read_status="unavailable", decision="unavailable", decision_reason="")
+                revisions = controlled.get("result_revisions")
+                for reply in collaboration["returns"]:
+                    key = reply.get("result_key", reply["phase"])
+                    revision = next((value["request_revision"] for value in revisions or [] if value["result_key"] == key), None)
+                    reply["request_revision"] = revision
+                    revision_labels["handoff." + _hash([row["request_id"], key])] = revision
+            result.append({**message, "collaboration": collaboration})
         except (OSError, ValueError, KeyError, TypeError):
             # Missing readback is not a change to the saved conversation.
             result.append(message)
-    return result
+    return [{**message, "return_delivery": {**message["return_delivery"],
+             "request_revision": revision_labels[message["message_id"]]}}
+            if message.get("message_id") in revision_labels and isinstance(message.get("return_delivery"), dict)
+            else message for message in result]
diff --git a/loopx/capabilities/manager_context/roundtrip.py b/loopx/capabilities/manager_context/roundtrip.py
index 47a837895c..e5e8712f15 100644
--- a/loopx/capabilities/manager_context/roundtrip.py
+++ b/loopx/capabilities/manager_context/roundtrip.py
@@ -39,6 +39,7 @@
     prior_result_delivered,
 )
 from ...control_plane.content_digest import BARE_SHA256_PATTERN
+from ...control_plane.collaboration.source_chat_observation import original_delivery_facts
 from ...chat import ChatMessagePayloadConflictError
 
 DELIVERY_STATUSES = {
@@ -232,6 +233,7 @@ def report(
     update_id=None,
     attachment_refs=None,
     workspace=None,
+    request_revision=None,
 ):
     """Chat audience adapter; the shared Inbox owns result validation/persistence."""
     if scope is None and registry is not None:
@@ -256,6 +258,7 @@ def report(
                 update_id=update_id,
                 attachment_refs=attachment_refs,
                 workspace=workspace,
+                request_revision=request_revision,
             )
     row = _entry(root, goal_id, agent_id, request_id, scope=scope)
     route = _route(root, row, scope=scope)
@@ -285,6 +288,7 @@ def report(
             route=route,
             update_id=update_id,
             attachments=attachments,
+            request_revision=request_revision,
         ),
         "status": (
             "queued_for_requester"
@@ -390,21 +394,6 @@ def project_chat_session_snapshot(root, store, session_id, *, registry):
     return snapshot
 
 
-def _original_delivery_facts(row, route, turn, *, source_id):
-    # Adapt trusted store/authority facts only. The common typed owner decides
-    # whether a committed handoff survived a lost caller response.
-    identity = {key: row[key] for key in ("request_id", "goal_id", "agent_id", "source_id", "goal_ref") if key in row}
-    return {
-        "request": identity,
-        "route": route,
-        "authorized_source_id": source_id,
-        "turn": {
-            "client_turn_id": turn.get("client_turn_id"),
-            "status": turn.get("status"),
-            "context_handoff_receipt": (turn.get("response") or {}).get("context_handoff_receipt"),
-        },
-    }
-
 
 def _exact_return_scope(registry, reply):
     return collaboration_goal_scope(
@@ -465,7 +454,7 @@ def _exact_return_context(root, registry, store, path, state_path, now):
             operation="original_return_admit",
             record=row,
             route=route,
-            initial_delivery=_original_delivery_facts(row, route, turn, source_id=grant.get("source_id")),
+            initial_delivery=original_delivery_facts(row, route, turn, source_id=grant.get("source_id")),
         )
         with _request_lock(
             root,
@@ -584,7 +573,7 @@ def _write_exact_return_state(
             record=row,
             route=route,
             initial_delivery=(
-                _original_delivery_facts(row, route, turn, source_id=context["source_id"])
+                original_delivery_facts(row, route, turn, source_id=context["source_id"])
                 if isinstance(turn, dict) else None
             ),
         )
@@ -1059,7 +1048,7 @@ def drain(root, registry, store, external_sender, *, now=None, cancelled=lambda:
                 with collaboration_goal_scope(registry, goal_id=row["goal_id"], agents=()) as scope:
                     decide_collaboration_lifecycle(
                         scope, operation="original_return_admit", record=row, route=route,
-                        initial_delivery=_original_delivery_facts(row, route, turn, source_id=grant.get("source_id")),
+                        initial_delivery=original_delivery_facts(row, route, turn, source_id=grant.get("source_id")),
                     )
                 if (
                     path.stem == "decision"
@@ -1414,7 +1403,7 @@ def recover_source_chat_provenance(root, registry, store, *, cancelled=lambda: F
                     continue
                 decide_collaboration_lifecycle(
                     scope, operation="original_return_admit", record=row, route=route,
-                    initial_delivery=_original_delivery_facts(row, route, turn,
+                    initial_delivery=original_delivery_facts(row, route, turn,
                                                                source_id=grant.get("source_id")),
                 )
                 if cancelled():
diff --git a/loopx/capabilities/manager_context/tracking.py b/loopx/capabilities/manager_context/tracking.py
index 155d672ffa..d1f3c9e2c9 100644
--- a/loopx/capabilities/manager_context/tracking.py
+++ b/loopx/capabilities/manager_context/tracking.py
@@ -11,6 +11,7 @@
     _now as _now,
     _receipt as _receipt,
     record_read as record_read,
+    controlled_request_readback,
 )
 from ...control_plane.collaboration.goal_instance_scope import (
     collaboration_goal_scope,
@@ -148,6 +149,27 @@ def query(
             item["decision"]["reason"] = decision.get("reason")
         else:
             item["decision"]["reason_visibility"] = "owner_only"
+        controlled = controlled_request_readback(root, row)
+        if controlled is not None:
+            item["warnings"] += controlled["warnings"]
+            current = controlled.get("readback")
+            if current is not None:
+                item.update(request_revision=current["request_revision"], read=current["read"], decision=dict(current["decision"]))
+                if owner_scope:
+                    item["brief"] = current["brief"]
+                    item["request_control"] = controlled["request_control_view"]
+                else:
+                    item["decision"].pop("reason", None)
+                    item["decision"]["reason_visibility"] = "owner_only"
+                    item["request_control"] = {"control_state": controlled["request_control_view"]["control_state"]}
+            else:
+                item["request_control"] = None
+                item["read"] = {"status": "unavailable", "at": None}
+                item["decision"] = {"status": "unavailable", "at": None}
+            revisions = controlled.get("result_revisions")
+            for reply in item["return_replies"]:
+                key = reply.get("result_key", reply["phase"])
+                reply["request_revision"] = next((value["request_revision"] for value in revisions or [] if value["result_key"] == key), None)
         projected.append(item)
     return {
         "source": "manager_context_receipts_and_core_todos",
diff --git a/loopx/cli_commands/manager_inbox.py b/loopx/cli_commands/manager_inbox.py
index fc9e5e8476..2a5ed9f735 100644
--- a/loopx/cli_commands/manager_inbox.py
+++ b/loopx/cli_commands/manager_inbox.py
@@ -29,6 +29,7 @@ def register_manager_inbox(subparsers, add_format):
             "link",
             "report",
             "status",
+            "control",
             "configure-read-scope",
             "configure-delivery-scope",
             "configure-ssh-read-scope",
@@ -53,6 +54,12 @@ def register_manager_inbox(subparsers, add_format):
     parser.add_argument("--brief-file", help="For request: collaboration_brief_v0 JSON file.")
     parser.add_argument("--parent-request-id", help="For request: an inbox request received by the sender.")
     parser.add_argument("--goal-id")
+    parser.add_argument("--goal-instance-id", help="Exact source Goal instance for request control.")
+    parser.add_argument("--control-operation", choices=("inspect", "revise", "cancel", "recover"),
+                        help="For control: inspect, correct, cancel or recover this original request.")
+    parser.add_argument("--control-file", help="For control: bounded JSON operation parameters; no source or effect facts.")
+    parser.add_argument("--request-revision", type=int, help="For acknowledge/report: the supplied request revision; omitted means original revision 1.")
+    parser.add_argument("--request-digest", help="For acknowledge: the supplied request revision digest.")
     parser.add_argument("--agent-id", help="Agent identity; for delivery grants, omit to cover all current/future Agents in --goal-id.")
     parser.add_argument("--channel-id")
     parser.add_argument("--ssh-host")
@@ -81,6 +88,38 @@ def register_manager_inbox(subparsers, add_format):
 
 def handle_manager_inbox(args, registry_path, runtime_root):
     try:
+        if args.manager_inbox_action != "control" and any(getattr(args, key, None) is not None for key in ("control_operation", "control_file", "goal_instance_id")):
+            raise ValueError("request control routing flags require the control action")
+        if getattr(args, "request_revision", None) is not None and args.manager_inbox_action not in {"acknowledge", "report"}:
+            raise ValueError("--request-revision is only supported for acknowledge/report")
+        if getattr(args, "request_digest", None) is not None and args.manager_inbox_action != "acknowledge":
+            raise ValueError("--request-digest is only supported for acknowledge")
+        if args.manager_inbox_action == "control":
+            from ..control_plane.collaboration.request_amendment import control_request
+            from ..control_plane.goals.goal_ref_validation import exact_goal_ref
+
+            if not args.goal_instance_id or not args.request_id or not args.control_operation:
+                raise ValueError("control requires --goal-instance-id, --request-id and --control-operation")
+            receiver = args.peer_agent_id or args.agent_id
+            if not receiver:
+                raise ValueError("control requires the original receiver in --peer-agent-id")
+            parameters = {}
+            if args.control_file:
+                with Path(args.control_file).open("rb") as stream:
+                    raw = stream.read(128_001)
+                if len(raw) > 128_000:
+                    raise ValueError("request control parameters are too large")
+                parameters = json.loads(raw)
+                if not isinstance(parameters, dict) or "operation_id" in parameters:
+                    raise ValueError("control parameters must be an object; use --operation-id for retry identity")
+            if args.control_operation in {"revise", "cancel"}:
+                parameters["operation_id"] = args.operation_id
+            result = control_request(registry_path=registry_path, runtime_root=runtime_root,
+                goal_ref=exact_goal_ref(args.goal_id, args.goal_instance_id), receiver_agent_id=receiver,
+                request_id=args.request_id, actor_agent_id=args.agent_id, operation=args.control_operation,
+                parameters=parameters, execute=args.execute)
+            print(json.dumps(result, ensure_ascii=False, indent=2))
+            return 0 if result["ok"] else 1
         local_delivery_scope = getattr(args, "local_delivery_scope", None)
         sender_id = getattr(args, "sender_id", None)
         if args.manager_inbox_action != "configure-delivery-scope" and (local_delivery_scope is not None or sender_id is not None):
@@ -196,7 +235,9 @@ def handle_manager_inbox(args, registry_path, runtime_root):
             result["followthrough"] += (
                 " CLI: record assessment with manager-inbox acknowledge; optionally associate existing work "
                 "with manager-inbox link. Return audience-ready results with manager-inbox report "
-                "--phase conclusion --reply-text; use --phase decision for meaningful interim news."
+                "--phase conclusion --reply-text; use --phase decision for meaningful interim news. "
+                "When request_revision is supplied, acknowledge with --request-revision and --request-digest, "
+                "and report with --request-revision. Omitted revision stays bound to original revision 1."
             )
         elif args.manager_inbox_action == "report":
             from ..capabilities.manager_context.roundtrip import report
@@ -210,6 +251,7 @@ def handle_manager_inbox(args, registry_path, runtime_root):
                 args.reply_text or "",
                 update_id=getattr(args, "update_id", None),
                 attachment_refs=getattr(args, "attachment_ref", None),
+                request_revision=getattr(args, "request_revision", None),
                 workspace=Path.cwd(),
                 registry=registry_path,
             )
@@ -250,6 +292,8 @@ def handle_manager_inbox(args, registry_path, runtime_root):
                 args.decision or "",
                 args.reason or "",
                 registry=registry_path,
+                request_revision=getattr(args, "request_revision", None),
+                request_revision_digest=getattr(args, "request_digest", None),
             )
     except (OSError, ValueError) as exc:
         result = {"ok": False, "error": str(exc)}
diff --git a/loopx/collaboration_mcp.py b/loopx/collaboration_mcp.py
index e23b40fbc8..b08234c536 100644
--- a/loopx/collaboration_mcp.py
+++ b/loopx/collaboration_mcp.py
@@ -276,6 +276,8 @@ def assess_request(
         request_id: str,
         decision: Literal["adopt", "defer", "reject", "no_change"],
         reason: str,
+        request_revision: int | None = None,
+        request_digest: str | None = None,
     ) -> dict:
         """Record your independent decision; this does not change task ownership or priority."""
         check_scope()
@@ -288,6 +290,8 @@ def assess_request(
             reason,
             registry=registry,
             caller_goal_ref=caller_goal_ref,
+            request_revision=request_revision,
+            request_revision_digest=request_digest,
         )
 
     @server.tool()
@@ -343,7 +347,7 @@ def request_peer(
         + conversation_answer_instruction()
     ))
     def return_result(request_id: str, text: str, update_id: str | None = None,
-                      attachment_refs: list[str] | None = None) -> dict:
+                      attachment_refs: list[str] | None = None, request_revision: int | None = None) -> dict:
         """Return a conclusion to the original requester. For a later changed fact,
         append an update with a stable update_id; retry with the same id and text.
         Neither a blocker nor a returned result certifies completion of the work.
@@ -362,11 +366,31 @@ def return_result(request_id: str, text: str, update_id: str | None = None,
             text,
             update_id=update_id,
             attachment_refs=attachment_refs,
+            request_revision=request_revision,
             workspace=workspace,
             registry=registry,
             caller_goal_ref=caller_goal_ref,
         )
 
+    if caller_goal_ref is not None:
+        @server.tool()
+        def control_peer_request(request_id: str, receiver_agent_id: str,
+                                 operation: Literal["inspect", "revise", "cancel", "recover"],
+                                 parameters: dict | None = None, execute: bool = False) -> dict:
+            """Control your own exact-profile peer request using its current revision/digest.
+
+            Revise/cancel need a stable operation_id in parameters. Preview by
+            default. Recovery reads the original effect; cancellation remains
+            pending until its original Goal terminal receipt is linked. It does
+            not revoke committed Goal work or grant new execution permission.
+            """
+            from .control_plane.collaboration.request_amendment import control_request
+
+            check_scope()
+            return control_request(registry_path=registry, runtime_root=root, goal_ref=caller_goal_ref,
+                receiver_agent_id=receiver_agent_id, request_id=request_id, actor_agent_id=agent_id,
+                operation=operation, parameters=parameters, execute=execute)
+
     @server.tool()
     def consume_peer_result(request_id: str, result_key: str = "conclusion") -> dict:
         """Acknowledge a read peer result, using its result_key for a later update.
diff --git a/loopx/control_plane/collaboration/inbox.py b/loopx/control_plane/collaboration/inbox.py
index 657f2c241f..df8b4ff7fb 100644
--- a/loopx/control_plane/collaboration/inbox.py
+++ b/loopx/control_plane/collaboration/inbox.py
@@ -207,6 +207,13 @@ def append_batch():
                 if lifecycle.get("kind") == "omit":
                     continue
             item = {**row, "inbox_state": state["kind"]}
+            item.pop("request_control", None)
+            if state.get("request_control_view") is not None:
+                view = state["request_control_view"]
+                item.update(original_brief=row["brief"], brief=view["brief"], request_control_view=view,
+                    request_revision=view["revision"], request_revision_digest=view["revision_digest"])
+                item["source_request"] = {"request_id": row["request_id"], "request_revision": view["revision"],
+                    "request_digest": view["revision_digest"]}
             item["recorded_decision"] = state["recorded_decision"]
             if state["recorded_decision"] is not None:
                 item["receiver_decision_recorded"] = True
@@ -214,6 +221,8 @@ def append_batch():
             if state["warnings"]:
                 item["warnings"] = state["warnings"]
                 item["next_action"] = "Receiver receipt readback is unavailable or conflicting; recover the original receipt before continuing this request. Do not repeat the decision, result or execution. Other requests can continue."
+            elif state.get("request_control_view") is not None:
+                item["next_action"] = state["request_control_view"]["receiver_instruction"]
             items.append(item)
             if len(items) == 21:
                 break
@@ -311,6 +320,16 @@ def _pending_receipt_states(runtime_root, rows):
             "decision": _observe_receipt(root / "decisions" / (request_id + ".json")),
             "conclusion": _observe_receipt(root / "replies" / request_id / "conclusion.json"),
         }
+        if "request_control" in row:
+            observation["request"] = row
+            observation["read"] = _observe_receipt(root / "reads" / (request_id + ".json"))
+            results = []
+            for path in result_paths(root / "replies" / request_id):
+                try:
+                    results.append(_result_observation(path.stem, _read(path)))
+                except (OSError, ValueError, TypeError):
+                    results.append({"unavailable": True})
+            observation["results"] = results
         size = len(json.dumps(observation, separators=(",", ":")).encode())
         # The existing bridge serializes ASCII-escaped JSON and admits 2 MiB.
         # Leave room for its envelope; legal Unicode replies must not turn
@@ -329,6 +348,13 @@ def _pending_receipt_states(runtime_root, rows):
     return states
 
 
+def controlled_request_readback(root: Path, row: dict[str, Any]) -> dict[str, Any] | None:
+    """Reuse the actual inbox/result owners for every current request surface."""
+    if "request_control" not in row:
+        return None
+    return _pending_receipt_states(root, [row])[0]
+
+
 def acknowledge(
     runtime_root: Path,
     goal_id: str,
@@ -340,6 +366,8 @@ def acknowledge(
     registry: Path | None = None,
     caller_goal_ref: dict[str, str] | None = None,
     scope: CollaborationGoalScope | None = None,
+    request_revision: int | None = None,
+    request_revision_digest: str | None = None,
 ) -> dict:
     if scope is None and registry is not None:
         from .goal_instance_scope import collaboration_goal_scope
@@ -358,6 +386,8 @@ def acknowledge(
                 decision,
                 reason,
                 scope=goal_scope,
+                request_revision=request_revision,
+                request_revision_digest=request_revision_digest,
             )
     if not BARE_SHA256_PATTERN.fullmatch(request_id):
         raise ValueError("invalid context request id")
@@ -386,6 +416,29 @@ def acknowledge(
     value = {"request_id": request_id, **target, "decision": decision, "reason": reason}
     path = _root(runtime_root) / "decisions" / (request_id + ".json")
     with _request_lock(runtime_root, request_id, scope, path.with_suffix(".lock")):
+        current = _entry(runtime_root, goal_id, agent_id, request_id, scope=scope)
+        if "request_control" in current:
+            from ..effect_runtime import EffectRuntimeRejected, effect_runtime_result
+            from .goal_instance_scope import goal_accepts_collaboration
+
+            prior, prior_error = _receipt(runtime_root, "decisions", current)
+            read, read_error = _receipt(runtime_root, "reads", current)
+            try:
+                plan = effect_runtime_result("collaboration.request.assess", {
+                    "entry": current, "actor_agent_id": agent_id, "observed_at": _now(),
+                    "goal_active": scope is not None and goal_accepts_collaboration(scope.goal),
+                    "revision": request_revision, "revision_digest": request_revision_digest,
+                    "decision": decision, "reason": reason, "legacy_assessment": prior or None,
+                    "legacy_assessment_unavailable": bool(prior_error), "legacy_read": read or None, "legacy_read_unavailable": bool(read_error)})
+            except EffectRuntimeRejected as exc:
+                raise ValueError(str(exc)) from exc
+            if plan["changed"]:
+                entry_path = _root(runtime_root) / "entries" / _hash(_target(goal_id, agent_id, scope)) / (request_id + ".json")
+                _write(entry_path, plan["entry"])
+            return {"ok": True, **value, "request_revision": plan["result"]["revision"],
+                "current_request_revision": plan["view"]["revision"], "request_control": plan["view"]}
+        if request_revision is not None or request_revision_digest is not None:
+            raise ValueError("explicit revision assessment requires a controlled request")
         if path.exists():
             if {k: v for k, v in _read(path).items() if k != "decided_at"} != value:
                 raise ValueError("context decision already recorded")
@@ -442,6 +495,20 @@ def record_read(
             scope,
             path.with_suffix(".lock"),
         ):
+            stored = _entry(root, row["goal_id"], row["agent_id"], row["request_id"], scope=scope)
+            if "request_control" in stored:
+                from ..effect_runtime import effect_runtime_result
+
+                decision, error = _receipt(root, "decisions", stored)
+                plan = effect_runtime_result("collaboration.request.record_read", {
+                    "entry": stored, "actor_agent_id": row["agent_id"], "observed_at": _now(),
+                    "revision": row.get("request_revision"), "revision_digest": row.get("request_revision_digest"),
+                    "legacy_assessment": decision or None, "legacy_assessment_unavailable": bool(error)})
+                if plan["changed"]:
+                    entry_path = _root(root) / "entries" / _hash(_target(row["goal_id"], row["agent_id"], scope)) / (row["request_id"] + ".json")
+                    _write(entry_path, plan["entry"])
+                row["request_read_receipt"] = plan["readback"]
+                continue
             if not path.exists():
                 _write(
                     path,
@@ -524,12 +591,10 @@ def record_result(
     route: dict[str, Any] | None = None,
     update_id: str | None = None,
     attachments: list[dict[str, Any]] | None = None,
+    request_revision: int | None = None,
 ):
     """Persist a receiver conclusion; the transport adapter validates its audience."""
     request_id = row["request_id"]
-    decision, error = _receipt(root, "decisions", row)
-    if error or not decision:
-        raise ValueError("record the receiver decision before returning a reply")
     if scope is not None:
         from .goal_instance_scope import decide_collaboration_lifecycle
 
@@ -543,11 +608,16 @@ def record_result(
 
     folder = _root(root) / "replies" / request_id
     with _request_lock(root, request_id, scope, folder / "report.lock"):
+        row = _entry(root, row["goal_id"], row["agent_id"], request_id, scope=scope)
+        decision, error = _receipt(root, "decisions", row)
+        if "request_control" not in row and (error or not decision):
+            raise ValueError("record the receiver decision before returning a reply")
         observations = [_result_observation(path.stem, _read(path)) for path in result_paths(folder)]
         try:
             plan = effect_runtime_result("collaboration.result.plan_publication", {
                 "request": row, "phase": phase, "text": text,
-                "decision": decision["decision"], "update_id": update_id,
+                "decision": decision.get("decision"), "update_id": update_id,
+                "request_revision": request_revision, "legacy_assessment": decision or None,
                 "attachments": attachments,
                 "results": observations,
             })
@@ -558,7 +628,8 @@ def record_result(
             _write(path, plan["value"] | {"created_at": _now()})
     return {
         "ok": True, "request_id": request_id, "phase": phase, "delivered": False,
-        **({"result_key": plan["result_key"]} if update_id is not None else {}),
+        **({"result_key": plan["result_key"]} if update_id is not None or "request_revision" in plan else {}),
+        **({key: plan[key] for key in ("request_revision", "current_request_revision")} if "request_revision" in plan else {}),
     }
 
 
@@ -571,7 +642,7 @@ def result_paths(folder: Path):
                                           path.stem != "decision", path.stem))
 
 
-def result_identity_matches(reply, row, path):
+def inspect_result_identity(reply, row, path):
     from ..effect_runtime import EffectRuntimeRejected, effect_runtime_result
 
     try:
@@ -579,15 +650,22 @@ def result_identity_matches(reply, row, path):
         if reply.get("update_id") is not None:
             observations = [_result_observation(candidate.stem, _read(candidate))
                             for candidate in result_paths(path.parent)]
-        effect_runtime_result("collaboration.result.plan_publication", {
+        legacy = _observe_receipt(path.parent.parent.parent / "decisions" / (row["request_id"] + ".json")) if (
+            "request_control" in row or "request_revision" in reply) else {}
+        inspected = effect_runtime_result("collaboration.result.plan_publication", {
             "request": row, "phase": reply.get("phase"), "text": reply.get("text"),
             "decision": reply.get("decision"), "update_id": reply.get("update_id"),
             "attachments": reply.get("attachments"),
+            "request_revision": reply.get("request_revision"), "legacy_assessment": legacy.get("value"),
             "results": observations,
         })
     except (EffectRuntimeRejected, OSError, ValueError):
-        return False
-    return reply.get("result_key", reply.get("phase")) == path.stem
+        return None
+    return inspected if reply.get("result_key", reply.get("phase")) == path.stem else None
+
+
+def result_identity_matches(reply, row, path):
+    return inspect_result_identity(reply, row, path) is not None
 
 
 def _result_observation(key, value):
@@ -600,6 +678,7 @@ def _result_observation(key, value):
         "value": {field: value[field] for field in (
             "request_id", "goal_id", "agent_id", "source_id", "goal_ref", "phase",
             "decision", "result_key", "previous_result_key", "update_id", "attachments",
+            "request_revision", "request_revision_digest",
         ) if field in value},
         "text_chars": len(text),
         "text_sha256": hashlib.sha256(text.encode()).hexdigest(),
diff --git a/loopx/control_plane/collaboration/inbox_receipts.ts b/loopx/control_plane/collaboration/inbox_receipts.ts
index 98b2df574e..d0ef78c9b7 100644
--- a/loopx/control_plane/collaboration/inbox_receipts.ts
+++ b/loopx/control_plane/collaboration/inbox_receipts.ts
@@ -1,13 +1,14 @@
 import type { JsonObject } from "../effect_program.ts";
 import { EffectRuntimeRequestError } from "../effect_runtime_errors.ts";
 import { jsonObject, requireBoolean, requireJsonObject, requireStringLiteral } from "../runtime_decode.ts";
-import { parseExactGoalRef } from "../goals/goal_instance_identity.ts";
+import {receiverDecision, sameRequest} from "./semantic_request.ts";
 import { ENVELOPED_SHA256_PATTERN } from "../content_digest.ts";
+import {requestControlView} from "./request_control.ts";
+import {collaborationResultObservations} from "./result_publication.ts";
 
 type Observation =
   | Readonly<{ state: "absent" | "unavailable" }>
   | Readonly<{ state: "read"; value: JsonObject | null }>;
-type Decision = "adopt" | "defer" | "reject" | "no_change";
 type Warning = "decision_unreadable_or_conflicting" | "conclusion_unreadable_or_conflicting"
   | "decision_missing_for_conclusion";
 type InboxState = "pending" | "awaiting_conclusion" | "settled" | "receipt_unavailable";
@@ -61,33 +62,45 @@ function observation(value: unknown): Observation {
   return state === "read" ? { state, value: jsonObject(row.value) } : { state };
 }
 
-function sameGoalRef(left: unknown, right: unknown): boolean {
-  if (left === undefined && right === undefined) return true;
-  const a = parseExactGoalRef(left);
-  const b = parseExactGoalRef(right);
-  return a.kind === "parsed" && b.kind === "parsed"
-    && a.value.goalId.value === b.value.goalId.value
-    && a.value.goalInstanceId.value === b.value.goalInstanceId.value;
-}
-
-export function sameRequest(receipt: JsonObject | null, request: JsonObject, source: boolean): receipt is JsonObject {
-  return receipt !== null && ["request_id", "goal_id", "agent_id"].every((key) => receipt[key] === request[key])
-    && sameGoalRef(receipt.goal_ref, request.goal_ref)
-    && (!source || receipt.source_id === request.source_id);
-}
-
-export function receiverDecision(value: unknown): Decision | null {
-  switch (value) {
-    case "adopt": case "defer": case "reject": case "no_change": return value;
-    default: return null;
-  }
-}
 
 function inspect(value: unknown): JsonObject {
   const row = requireJsonObject(value, "inbox observation");
   const request = requireJsonObject(row.request, "inbox request");
   const routePresent = requireBoolean(row.route_present, "return route presence");
   const decision = observation(row.decision);
+  if (Object.hasOwn(request, "request_control")) {
+    let view: JsonObject | null = null;
+    let readback: JsonObject | null = null;
+    try {
+      const legacy = decision.state === "read" ? decision.value : null;
+      const priorRead = observation(row.read);
+      view = requestControlView(request, legacy, decision.state === "unavailable",
+        priorRead.state === "read" ? priorRead.value : null, priorRead.state === "unavailable");
+      const recorded = receiverDecision((view.assessment as JsonObject | null)?.decision);
+      const readAt = view.read_at, readUnavailable = view.read_readback === "unavailable";
+      const a = view.assessment as JsonObject | null;
+      readback = {request_revision: view.revision, request_revision_digest: view.revision_digest, brief: view.brief,
+        read: {status: readUnavailable ? "unavailable" : readAt !== null ? "supplied_to_receiver" : recorded ? "decision_exists_read_receipt_missing" : "not_recorded", at: readAt},
+        decision: {status: recorded ?? (view.assessment_readback === "unavailable" ? "unavailable" : "not_recorded"),
+          at: a?.assessed_at ?? null, reason: a?.reason ?? null},
+        card_read_status: readUnavailable ? "unavailable" : readAt !== null ? "supplied" : "pending",
+        card_decision: recorded ?? (view.assessment_readback === "unavailable" ? "unavailable" : "pending")};
+      const results = collaborationResultObservations(request, row.results, recorded, legacy);
+      const answered = results.some(result => result.value.phase === "conclusion"
+        && (result.value.request_revision ?? 1) === view!.revision);
+      const warnings: Warning[] = view.assessment_readback === "unavailable" ? ["decision_unreadable_or_conflicting"] : [];
+      const kind: InboxState = warnings.length ? "receipt_unavailable"
+        : view.control_state === "cancelled" ? "settled"
+        : view.active_reservation !== null ? "awaiting_conclusion"
+        : !recorded ? "pending" : answered ? "settled" : "awaiting_conclusion";
+      return {kind, recorded_decision: recorded, warnings, request_control_view: view, readback,
+        result_revisions: results.map(result => ({result_key: result.key, request_revision: result.value.request_revision ?? 1}))};
+    } catch (error) {
+      if (!(error instanceof EffectRuntimeRequestError)) throw error;
+      return {kind: "receipt_unavailable", recorded_decision: null,
+        warnings: ["conclusion_unreadable_or_conflicting"], request_control_view: view, readback, result_revisions: null};
+    }
+  }
   const conclusion = observation(row.conclusion);
   const recorded = decision.state === "read" && sameRequest(decision.value, request, false)
     ? receiverDecision(decision.value.decision) : null;
diff --git a/loopx/control_plane/collaboration/peer_context_observation.py b/loopx/control_plane/collaboration/peer_context_observation.py
index 104376f451..c7c0c7535a 100644
--- a/loopx/control_plane/collaboration/peer_context_observation.py
+++ b/loopx/control_plane/collaboration/peer_context_observation.py
@@ -20,7 +20,8 @@ def require_parent_context_access(root, registry, parent, target_agent_id, *, sc
             break
         ancestor_id = original.get("parent_request_id")
         if not ancestor_id:
-            return  # An independent local peer request has no source context.
+            # An independent local peer request has no inherited source grant.
+            return {"local_source": True, "source_id": original["source_id"]}
         original = _entry(root, scope.goal_id, original["source_agent_id"],
                           ancestor_id, scope=scope)
 
@@ -29,7 +30,8 @@ def require_parent_context_access(root, registry, parent, target_agent_id, *, sc
         "origin": "web" if str(original.get("source_id", "")).startswith("web:") else "unknown",
     }
     grant = None
-    if not conversation_scope(conversation, origin=conversation["origin"])["private_conversation"]:
+    local_source = conversation_scope(conversation, origin=conversation["origin"])["private_conversation"]
+    if not local_source:
         # Use the original provider/store provenance and the existing source
         # authority owner. Reading must not recover or rewrite a return route.
         from .source_chat_observation import observe_source_chat
@@ -54,3 +56,4 @@ def require_parent_context_access(root, registry, parent, target_agent_id, *, sc
         })
     except EffectRuntimeRejected as exc:
         raise ValueError(str(exc)) from exc
+    return {"local_source": local_source, "source_id": original["source_id"]}
diff --git a/loopx/control_plane/collaboration/peers.py b/loopx/control_plane/collaboration/peers.py
index 9759c29938..e62d24ef4d 100644
--- a/loopx/control_plane/collaboration/peers.py
+++ b/loopx/control_plane/collaboration/peers.py
@@ -263,12 +263,13 @@ def _collect_returns(root, goal_id, agent_id, *, scope=None):
             "source_id"
         ) != operation.get("source_id"):
             raise ValueError("peer return scope mismatch")
-        from .inbox import result_paths, result_identity_matches
+        from .inbox import result_paths, inspect_result_identity
 
         for path in result_paths(_root(root) / "replies" / row["request_id"]):
             if path.stem == "decision":
                 continue
             reply = _read(path)
+            inspected = inspect_result_identity(reply, row, path)
             if (
                 any(
                     reply.get(k) != row.get(k)
@@ -282,7 +283,7 @@ def _collect_returns(root, goal_id, agent_id, *, scope=None):
                     if k in row
                 )
                 or reply.get("phase") != "conclusion"
-                or not result_identity_matches(reply, row, path)
+                or inspected is None
             ):
                 raise ValueError("peer reply identity conflict")
             route = _read(_root(root) / "roundtrips" / (row["request_id"] + ".json"))
@@ -320,7 +321,8 @@ def _collect_returns(root, goal_id, agent_id, *, scope=None):
                     **({"result_key": path.stem} if path.stem != "conclusion" else {}),
                     "agent_id": row["agent_id"],
                     "parent_request_id": row.get("parent_request_id"),
-                    "brief": row["brief"],
+                    "brief": inspected.get("request_brief", row["brief"]),
+                    **({key: inspected[key] for key in ("request_revision", "current_request_revision")} if "request_revision" in inspected else {}),
                     "text": reply["text"],
                     "decision": reply["decision"],
                     "created_at": reply["created_at"],
@@ -698,6 +700,7 @@ def return_result(
     caller_goal_ref=None,
     scope=None,
     update_id=None,
+    request_revision=None,
 ):
     """Route by the saved recipient, never by an Agent's coordinator role."""
     if scope is None and registry is not None:
@@ -715,6 +718,7 @@ def return_result(
                 text,
                 scope=goal_scope,
                 update_id=update_id,
+                request_revision=request_revision,
             )
     row = _entry(root, goal_id, agent_id, request_id, scope=scope)
     if row.get("source_kind") != "peer":
@@ -744,6 +748,7 @@ def return_result(
             scope=scope,
             route=route,
             update_id=update_id,
+            request_revision=request_revision,
         ),
         "status": "queued_for_requester",
     }
diff --git a/loopx/control_plane/collaboration/request_amendment.py b/loopx/control_plane/collaboration/request_amendment.py
new file mode 100644
index 0000000000..25fe720cb2
--- /dev/null
+++ b/loopx/control_plane/collaboration/request_amendment.py
@@ -0,0 +1,182 @@
+"""Source/Goal IO choreography for one reserved work-graph amendment.
+
+Each owner's typed transaction decides its own transition. No request lock is
+held over Goal IO, and no caller-authored terminal outcome enters the linker.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any, Mapping
+
+from .request_control_source import _execute, execute_request_control, request_amendment_snapshot
+from ..effect_runtime import EffectRuntimeRejected, effect_runtime_result
+from ..goals.goal_amendment_runtime import _execute_goal_amendment
+from ..projects.registry_codec import load_project_registry
+
+
+def _root(registry: Path, supplied: Path | None) -> Path:
+    configured = load_project_registry(registry).get("common_runtime_root")
+    if not isinstance(configured, str) or not configured:
+        raise ValueError("request effect requires its registered runtime root")
+    root = Path(configured).expanduser().resolve()
+    if supplied is not None and supplied.expanduser().resolve() != root:
+        raise ValueError("request effect runtime differs from its source")
+    return root
+
+
+def request_proposal_context(*, registry_path: Path, runtime_root: Path | None, goal_ref: Mapping[str, str],
+                             receiver_agent_id: str, reference: Any) -> tuple[Path, dict[str, Any]]:
+    if not isinstance(reference, dict) or set(reference) != {"request_id", "request_revision", "request_digest"}:
+        raise ValueError("an exact source request reference is required")
+    root = _root(registry_path, runtime_root)
+    snapshot = request_amendment_snapshot(registry_path=registry_path, runtime_root=root, goal_ref=goal_ref,
+        receiver_agent_id=receiver_agent_id, request_id=reference["request_id"], actor_agent_id=receiver_agent_id,
+        requested_basis=reference)
+    return root, {"entry": snapshot["_entry"]}
+
+
+def _reservation(snapshot: Mapping[str, Any], operation_id: Any) -> dict[str, Any] | None:
+    view = snapshot["view"]
+    records = list(view["terminal_effects"])
+    if view["active_reservation"] is not None:
+        records.append(view["active_reservation"])
+    return next((row for row in records if row["binding"]["operation_id"] == operation_id), None)
+
+
+def _goal(registry: Path, root: Path, ref: Mapping[str, str], receiver: str,
+          operation: str, parameters: Mapping[str, Any], *, context=None, execute=False):
+    return _execute_goal_amendment(registry_path=registry, runtime_root=root, goal_id=ref["goal_id"],
+        goal_instance_id=ref["goal_instance_id"], actor_agent_id=None if operation == "receipt" else receiver,
+        operation=operation, parameters=parameters, request_context=context, execute=execute)
+
+
+def _finish(*, registry: Path, root: Path, ref: Mapping[str, str], receiver: str, actor: str | None,
+            snapshot: dict[str, Any], reservation: dict[str, Any], execute: bool,
+            attempt_observation: Mapping[str, Any] | None = None) -> dict[str, Any]:
+    """Re-read the actual Goal receipt, then link it at the request owner."""
+    terminal = None
+    errors = []
+    bound = reservation["binding"]
+    try:
+        readback = _goal(registry, root, ref, receiver, "receipt", {"receipt_operation_id": bound["operation_id"]})
+        observation = effect_runtime_result("goal.amendment.request_receipt", {
+            "entry": snapshot["_entry"], "reservation_digest": reservation["digest"], "receipt": readback})
+        terminal = observation["terminal"]
+        if terminal is not None and execute:
+            _execute(registry_path=registry, runtime_root=root, goal_ref=ref, receiver_agent_id=receiver,
+                request_id=bound["request_id"], actor_agent_id=actor, operation="settle",
+                parameters={"operation_id": "settle:" + reservation["digest"], "reservation_digest": reservation["digest"]},
+                terminal_receipt=terminal, execute=True)
+    except (OSError, ValueError, EffectRuntimeRejected) as exc:
+        errors.append(str(exc))
+    current = True
+    try:
+        snapshot = request_amendment_snapshot(registry_path=registry, runtime_root=root, goal_ref=ref,
+            receiver_agent_id=receiver, request_id=bound["request_id"], actor_agent_id=actor)
+    except (OSError, ValueError, EffectRuntimeRejected) as exc:
+        current = False
+        errors.append(str(exc))
+    result = effect_runtime_result("collaboration.request.amendment_readback", {
+        "entry": snapshot["_entry"], "reservation_digest": reservation["digest"], "terminal": terminal,
+        "legacy_assessment": snapshot["_legacy_assessment"],
+        "legacy_assessment_unavailable": snapshot["_legacy_assessment_unavailable"],
+        "legacy_read": snapshot["_legacy_read"], "legacy_read_unavailable": snapshot["_legacy_read_unavailable"], "source_current": current})
+    if errors:
+        result["readback_errors"] = errors
+    if attempt_observation:
+        result["attempt_observation"] = dict(attempt_observation)
+    return result
+
+
+def execute_request_amendment(*, registry_path: Path, runtime_root: Path | None, goal_ref: Mapping[str, str],
+                              receiver_agent_id: str, parameters: Mapping[str, Any], execute: bool) -> dict[str, Any]:
+    if set(parameters) != {"source_request", "operation_id", "proposal_id", "proposal_digest"}:
+        raise ValueError("request-derived commit needs the original proposal, source basis and operation id")
+    reference = parameters["source_request"]
+    if not isinstance(reference, dict) or set(reference) != {"request_id", "request_revision", "request_digest"}:
+        raise ValueError("an exact source request reference is required")
+    root = _root(registry_path, runtime_root)
+    snapshot = request_amendment_snapshot(registry_path=registry_path, runtime_root=root, goal_ref=goal_ref,
+        receiver_agent_id=receiver_agent_id, request_id=reference["request_id"], actor_agent_id=receiver_agent_id,
+        requested_basis=reference)
+    reference = snapshot["_request_reference"]
+    reservation = _reservation(snapshot, parameters["operation_id"])
+    if reservation is None:
+        # Resolve from the real Goal owner, not caller-provided policy/basis.
+        goal = _goal(registry_path, root, goal_ref, receiver_agent_id, "request_basis", {})
+        if goal.get("ok") is not True or not isinstance(goal.get("intent"), dict):
+            raise ValueError("current Goal amendment authority is unavailable")
+        proposal = next((row for row in goal["intent"]["proposals"] if row["proposal_id"] == parameters["proposal_id"]), None)
+        if (proposal is None or proposal["digest"] != parameters["proposal_digest"]
+                or proposal.get("source_request") != reference or proposal["proposer_agent_id"] != receiver_agent_id):
+            raise ValueError("the original source-derived proposal does not match this request")
+        amendment = {key: proposal[key] for key in ("proposal_id", "base_goal_revision", "base_intent_digest", "base_work_digest")}
+        amendment.update(proposal_digest=proposal["digest"], operation_id=parameters["operation_id"],
+            authority_source_sha256=goal["authority_source_sha256"])
+        snapshot = _execute(registry_path=registry_path, runtime_root=root, goal_ref=goal_ref,
+            receiver_agent_id=receiver_agent_id, request_id=reference["request_id"], actor_agent_id=receiver_agent_id,
+            operation="reserve", parameters={"operation_id": parameters["operation_id"],
+                "expected_revision": reference["request_revision"], "expected_digest": reference["request_digest"]},
+            resolved_amendment=amendment, execute=execute, include_entry=True)
+        reservation = snapshot["result"]["reservation"]
+    bound = reservation["binding"]
+    if (bound["proposal_id"] != parameters["proposal_id"] or bound["proposal_digest"] != parameters["proposal_digest"]
+            or {"request_id": bound["request_id"], "request_revision": bound["request_revision"], "request_digest": bound["request_digest"]} != reference):
+        raise ValueError("original reserved effect identity conflict")
+    context = {"entry": snapshot["_entry"], "reservation_digest": reservation["digest"], "preview": not execute}
+    effect = {key: parameters[key] for key in ("operation_id", "proposal_id", "proposal_digest")}
+    if not execute:
+        preview = _goal(registry_path, root, goal_ref, receiver_agent_id, "commit", effect, context=context)
+        return {**preview, "request_preview": snapshot["view"], "request_reservation_recorded": not snapshot.get("planned", False)}
+    try:
+        attempted = _goal(registry_path, root, goal_ref, receiver_agent_id, "commit", effect, context=context, execute=True)
+        observation = {key: attempted[key] for key in ("status", "reason_code", "reason") if key in attempted}
+    except (OSError, ValueError, EffectRuntimeRejected) as exc:
+        # A failed response does not establish no effect. The exact receipt
+        # read below owns that conclusion and keeps an absent result pending.
+        observation = {"error": str(exc)}
+    return _finish(registry=registry_path, root=root, ref=goal_ref, receiver=receiver_agent_id,
+        actor=receiver_agent_id, snapshot=snapshot, reservation=reservation, execute=True, attempt_observation=observation)
+
+
+def recover_request_amendment(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+                              receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
+                              execute: bool = False) -> dict[str, Any]:
+    root = _root(registry_path, runtime_root)
+    snapshot = request_amendment_snapshot(registry_path=registry_path, runtime_root=root, goal_ref=goal_ref,
+        receiver_agent_id=receiver_agent_id, request_id=request_id, actor_agent_id=actor_agent_id)
+    reservation = snapshot["view"]["active_reservation"]
+    if reservation is None:
+        return {key: value for key, value in snapshot.items() if not key.startswith("_")}
+    observation = None
+    if execute and snapshot["view"]["recovery_operation"] == "abort_request":
+        bound = reservation["binding"]
+        try:
+            attempted = _goal(registry_path, root, goal_ref, receiver_agent_id, "abort_request",
+                {key: bound[key] for key in ("operation_id", "proposal_id", "proposal_digest")},
+                context={"entry": snapshot["_entry"], "reservation_digest": reservation["digest"]}, execute=True)
+            observation = {key: attempted[key] for key in ("status", "reason_code", "reason") if key in attempted}
+        except (OSError, ValueError, EffectRuntimeRejected) as exc:
+            observation = {"error": str(exc)}  # Read the receipt; never infer an abort.
+    return _finish(registry=registry_path, root=root, ref=goal_ref, receiver=receiver_agent_id,
+        actor=actor_agent_id, snapshot=snapshot, reservation=reservation, execute=execute, attempt_observation=observation)
+
+
+def control_request(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+                    receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
+                    operation: str, parameters: Mapping[str, Any] | None = None, execute: bool = False) -> dict[str, Any]:
+    """Shared source UI/CLI path; cancellation settles only through its owner."""
+    common = dict(registry_path=registry_path, runtime_root=runtime_root, goal_ref=goal_ref,
+        receiver_agent_id=receiver_agent_id, request_id=request_id, actor_agent_id=actor_agent_id)
+    if operation == "recover":
+        if parameters:
+            raise ValueError("request recovery takes its binding from the original source")
+        return recover_request_amendment(**common, execute=execute)
+    if operation not in {"inspect", "revise", "cancel"}:
+        raise ValueError("source request control operation is unsupported")
+    result = execute_request_control(**common, operation=operation, parameters=parameters, execute=execute)
+    if execute and (operation == "cancel" or result["view"].get("recovery_operation") == "abort_request"):
+        recovery = recover_request_amendment(**common, execute=True)
+        return {**result, "ok": recovery["ok"], "view": recovery.get("request_control", recovery.get("view")),
+            "effect_recovery": recovery}
+    return result
diff --git a/loopx/control_plane/collaboration/request_control.ts b/loopx/control_plane/collaboration/request_control.ts
new file mode 100644
index 0000000000..71f3ac0b09
--- /dev/null
+++ b/loopx/control_plane/collaboration/request_control.ts
@@ -0,0 +1,388 @@
+/** Revision and reserved-effect facts in the existing exact request record.
+ * The host holds the original request lock and authenticates source/receipt IO.
+ * This owner never runs a Goal effect or treats a timeout as its terminal result.
+ */
+import type {JsonObject} from "../effect_program.ts";
+import {EffectRuntimeRequestError} from "../effect_runtime_errors.ts";
+import {requireJsonObject} from "../runtime_decode.ts";
+import {canonicalAuthoritySha256} from "../coordination/authority_store_codec.ts";
+import {parseExactGoalRef} from "../goals/goal_instance_identity.ts";
+import {normalizeCollaborationBrief, planCollaborationRequestPublication, receiverDecision, sameRequest, type ReceiverDecision} from "./semantic_request.ts";
+import {BARE_SHA256_PATTERN} from "../content_digest.ts";
+import {REQUEST_CONTROL_SCHEMA, REQUEST_AMENDMENT_RESULT_SCHEMA, REQUEST_AMENDMENT_OUTCOMES,
+  type RequestAmendmentOutcome} from "./request_control_contract.ts";
+type Revision = {revision: number; brief: JsonObject; reason: string; created_at: string;
+  read_at: string | null; assessment: {decision: ReceiverDecision; reason: string; assessed_at: string} | null};
+type Reservation = {binding: JsonObject; digest: string; terminal: JsonObject | null};
+type Control = {schema_version: typeof REQUEST_CONTROL_SCHEMA; request_sha256: string;
+  revisions: Revision[]; cancellation: JsonObject | null; reservations: Reservation[];
+  operations: {operation_id: string; request_sha256: string; result: JsonObject}[]};
+const MAX_OPERATIONS = 64, MAX_REVISIONS = 8, MAX_RESERVATIONS = 16;
+const OP_FIELDS = {
+  inspect: [], revise: ["expected_revision", "expected_digest", "brief", "reason"],
+  cancel: ["expected_revision", "expected_digest", "reason"],
+  read: ["revision", "revision_digest"], assess: ["revision", "revision_digest", "decision", "reason"],
+  reserve: ["expected_revision", "expected_digest"], settle: ["reservation_digest"],
+} as const;
+function ensure(value: unknown, message: string, code = "invalid_request"): asserts value {
+  if (!value) throw new EffectRuntimeRequestError(message, code);
+}
+function obj(value: unknown, name: string): JsonObject {return requireJsonObject(value, name);}
+function keys(value: JsonObject, fields: readonly string[]): void {
+  ensure(Object.keys(value).length === fields.length && fields.every(k => Object.hasOwn(value, k)), "request control fields are invalid");
+}
+function text(value: unknown, name: string, max = 2000): string {
+  ensure(typeof value === "string" && value.trim() === value && value.length > 0 && value.length <= max && !value.includes("\0"), `${name} must be bounded nonempty text`);
+  return value;
+}
+function id(value: unknown, name: string): string {
+  const result = text(value, name, 160);
+  ensure(/^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(result), `${name} must be a safe identifier`); return result;
+}
+function digest(value: unknown, name: string): string {
+  ensure(typeof value === "string" && BARE_SHA256_PATTERN.test(value), `${name} must be SHA-256`); return value;
+}
+function integer(value: unknown, name: string): number {
+  ensure(Number.isSafeInteger(value) && Number(value) > 0, `${name} must be a positive integer`); return Number(value);
+}
+function timestamp(value: unknown): string {
+  const result = text(value, "request observation time", 64);
+  ensure(Number.isFinite(Date.parse(result)), "request observation time is invalid"); return result;
+}
+function array(value: unknown, max: number): unknown[] {ensure(Array.isArray(value) && value.length <= max, "request control capacity exceeded"); return value;}
+function same(a: unknown, b: unknown): boolean {return canonicalAuthoritySha256(a) === canonicalAuthoritySha256(b);}
+function recoverableRecordBytes(entry: JsonObject, state: Control): number {
+  const retained = structuredClone(state);
+  const active = retained.reservations.find(row => row.terminal === null);
+  if (retained.cancellation === null) {
+    // JSON escaping can cost six bytes per permitted UTF-16 code unit, even
+    // though ordinary CJK text costs three. Account for the declared input
+    // bounds, not an assumed short English cancellation message.
+    retained.cancellation = {operation_id: "c".repeat(160), reason: "\u0001".repeat(2000), requested_at: "0".repeat(64)};
+    retained.operations.push({operation_id: "c".repeat(160), request_sha256: "f".repeat(64),
+      result: {operation: "cancel", revision: retained.revisions.length, reserved_effect_pending: active !== undefined}});
+  }
+  if (active) {
+    const terminal = {operation_id: active.binding.operation_id, reservation_digest: active.digest, outcome: "committed",
+      goal_ref: active.binding.goal_ref, goal_changed: true, goal_revision: Number.MAX_SAFE_INTEGER,
+      todo_id: "t".repeat(160), receipt_sha256: "f".repeat(64)};
+    active.terminal = terminal;
+    retained.operations.push({operation_id: "s".repeat(160), request_sha256: "f".repeat(64), result: {operation: "settle", terminal}});
+  }
+  return Buffer.byteLength(JSON.stringify({...entry, request_control: retained}), "utf8");
+}
+function goalRef(value: unknown): JsonObject {
+  const ref = obj(value, "request Goal reference"); keys(ref, ["goal_id", "goal_instance_id"]);
+  ensure(parseExactGoalRef(ref).kind === "parsed", "request needs an exact Goal instance"); return ref;
+}
+export function requestOriginalDigest(entry: JsonObject): string {
+  return canonicalAuthoritySha256(Object.fromEntries(Object.entries(entry).filter(([key]) =>
+    !["instruction", "delivered_at", "source_channel", "request_control"].includes(key))));
+}
+function initial(entry: JsonObject): Control {
+  ensure(entry.schema_version === "loopx_manager_context_entry_v2", "request control requires the exact-instance source profile");
+  const ref = goalRef(entry.goal_ref);
+  ensure(ref.goal_id === entry.goal_id && !Object.hasOwn(entry, "execution_binding_id"), "request profile cannot control an independently bound host execution");
+  digest(entry.request_id, "request_id"); id(entry.agent_id, "receiver Agent"); text(entry.source_id, "source_id", 512);
+  return {schema_version: REQUEST_CONTROL_SCHEMA, request_sha256: requestOriginalDigest(entry),
+    revisions: [{revision: 1, brief: normalizeCollaborationBrief(entry.brief), reason: "Original request",
+      created_at: timestamp(entry.delivered_at), read_at: null, assessment: null}],
+    cancellation: null, reservations: [], operations: []};
+}
+export function requestRevisionDigest(entry: JsonObject, revision: Revision): string {
+  return canonicalAuthoritySha256({request_sha256: requestOriginalDigest(entry), revision: revision.revision,
+    brief: revision.brief, reason: revision.reason});
+}
+export function normalizeRequestBasis(value: unknown): JsonObject {
+  const row = obj(value, "source request basis"); keys(row, ["request_id", "request_revision", "request_digest"]);
+  return {request_id: digest(row.request_id, "source request id"), request_revision: integer(row.request_revision, "source request revision"),
+    request_digest: digest(row.request_digest, "source request digest")};
+}
+function binding(value: unknown, entry: JsonObject, revisions: Revision[], epoch: number): JsonObject {
+  const row = obj(value, "request amendment binding");
+  keys(row, ["request_id", "request_revision", "request_digest", "receiver_agent_id", "goal_ref", "attempt_epoch",
+    "authority_source_sha256", "proposal_id", "proposal_digest", "base_goal_revision", "base_intent_digest", "base_work_digest", "operation_id"]);
+  const rev = revisions[integer(row.request_revision, "request revision") - 1];
+  ensure(rev && row.request_id === entry.request_id && row.receiver_agent_id === entry.agent_id
+    && row.request_digest === requestRevisionDigest(entry, rev) && same(goalRef(row.goal_ref), entry.goal_ref)
+    && row.attempt_epoch === epoch, "request amendment binding identity mismatch");
+  for (const key of ["authority_source_sha256", "proposal_digest", "base_intent_digest", "base_work_digest"]) digest(row[key], key);
+  id(row.proposal_id, "proposal_id"); id(row.operation_id, "effect operation_id"); integer(row.base_goal_revision, "base Goal revision");
+  return row;
+}
+export function requestTerminalSummary(value: unknown, reservation: Reservation): JsonObject {
+  const row = obj(value, "Goal terminal receipt");
+  keys(row, ["operation_id", "reservation_digest", "outcome", "goal_ref", "goal_changed", "goal_revision", "todo_id", "receipt_sha256"]);
+  ensure(row.operation_id === reservation.binding.operation_id && row.reservation_digest === reservation.digest
+    && same(row.goal_ref, reservation.binding.goal_ref)
+    && REQUEST_AMENDMENT_OUTCOMES.includes(row.outcome as RequestAmendmentOutcome), "Goal terminal receipt does not match the reserved operation");
+  digest(row.receipt_sha256, "Goal terminal receipt digest");
+  ensure(row.goal_changed === (row.outcome === "committed"), "Goal terminal receipt has inconsistent effect facts");
+  if (row.goal_changed) {
+    ensure(integer(row.goal_revision, "resulting Goal revision") === Number(reservation.binding.base_goal_revision) + 1,
+      "committed Goal revision does not follow the reserved basis");
+    id(row.todo_id, "created Todo");
+  } else ensure(row.goal_revision === null && row.todo_id === null, "no-effect terminal receipt cannot claim Goal work");
+  return row;
+}
+export function readRequestControl(entry: JsonObject): Control {
+  const original = initial(entry);
+  if (!Object.hasOwn(entry, "request_control")) return original;
+  const raw = obj(entry.request_control, "request_control");
+  keys(raw, ["schema_version", "request_sha256", "revisions", "cancellation", "reservations", "operations"]);
+  ensure(raw.schema_version === REQUEST_CONTROL_SCHEMA && raw.request_sha256 === original.request_sha256, "request control source identity changed");
+  const revisions: Revision[] = array(raw.revisions, MAX_REVISIONS).map((value, i) => {
+    const row = obj(value, "request revision"); keys(row, ["revision", "brief", "reason", "created_at", "read_at", "assessment"]);
+    ensure(row.revision === i + 1, "request revisions must be complete and ordered");
+    const brief = normalizeCollaborationBrief(row.brief);
+    ensure(same(brief, row.brief), "request revision brief is not canonical");
+    let assessment: Revision["assessment"] = null;
+    if (row.assessment !== null) {
+      const a = obj(row.assessment, "request assessment"); keys(a, ["decision", "reason", "assessed_at"]);
+      const decision = receiverDecision(a.decision); ensure(decision !== null, "request assessment is invalid");
+      assessment = {decision, reason: text(a.reason, "assessment reason"), assessed_at: timestamp(a.assessed_at)};
+    }
+    return {revision: i + 1, brief, reason: text(row.reason, "revision reason"), created_at: timestamp(row.created_at),
+      read_at: row.read_at === null ? null : timestamp(row.read_at), assessment};
+  });
+  ensure(revisions.length > 0 && same(revisions[0].brief, original.revisions[0].brief)
+    && revisions[0].reason === original.revisions[0].reason && revisions[0].created_at === original.revisions[0].created_at,
+  "request control must preserve the original declaration");
+  const reservations: Reservation[] = array(raw.reservations, MAX_RESERVATIONS).map((value, i) => {
+    const row = obj(value, "request reservation"); keys(row, ["binding", "digest", "terminal"]);
+    const bound = binding(row.binding, entry, revisions, i + 1);
+    ensure(row.digest === canonicalAuthoritySha256(bound), "request reservation digest changed");
+    const result: Reservation = {binding: bound, digest: String(row.digest), terminal: null};
+    if (row.terminal !== null) result.terminal = requestTerminalSummary(row.terminal, result);
+    return result;
+  });
+  ensure(reservations.filter(r => r.terminal === null).length <= 1
+    && reservations.slice(0, -1).every(r => r.terminal !== null)
+    && new Set(reservations.map(r => r.binding.operation_id)).size === reservations.length, "request has conflicting effect reservations");
+  let cancellation: JsonObject | null = null;
+  if (raw.cancellation !== null) {
+    const c = obj(raw.cancellation, "request cancellation"); keys(c, ["operation_id", "reason", "requested_at"]);
+    cancellation = {operation_id: id(c.operation_id, "cancellation operation"), reason: text(c.reason, "cancellation reason"), requested_at: timestamp(c.requested_at)};
+  }
+  const operations = array(raw.operations, MAX_OPERATIONS).map(value => {
+    const row = obj(value, "request operation receipt"); keys(row, ["operation_id", "request_sha256", "result"]);
+    return {operation_id: id(row.operation_id, "request operation"), request_sha256: digest(row.request_sha256, "request operation digest"), result: obj(row.result, "request operation result")};
+  });
+  ensure(new Set(operations.map(r => r.operation_id)).size === operations.length, "duplicate request operation receipt");
+  return {schema_version: REQUEST_CONTROL_SCHEMA, request_sha256: original.request_sha256, revisions, cancellation, reservations, operations};
+}
+function assessmentObservation(entry: JsonObject, revision: Revision, legacy: unknown): {value: Revision["assessment"]; unavailable: boolean} {
+  if (revision.assessment !== null || revision.revision !== 1 || legacy === null) return {value: revision.assessment, unavailable: false};
+  try {
+    const row = obj(legacy, "original receiver assessment"), decision = receiverDecision(row.decision);
+    ensure(sameRequest(row, entry, false) && decision !== null, "original receiver assessment conflicts with the request");
+    return {value: {decision, reason: text(row.reason, "original assessment reason"), assessed_at: timestamp(row.decided_at)}, unavailable: false};
+  } catch (error) {
+    if (!(error instanceof EffectRuntimeRequestError)) throw error;
+    return {value: null, unavailable: true};
+  }
+}
+export function requestRevisionReceiptContext(entry: JsonObject, requested: unknown, legacy: unknown = null): JsonObject {
+  const state = readRequestControl(entry), number = integer(requested ?? 1, "result request revision");
+  const revision = state.revisions[number - 1];
+  ensure(revision, "result refers to an unknown request revision");
+  return {revision: number, revision_digest: requestRevisionDigest(entry, revision), current_revision: state.revisions.length,
+    assessment: assessmentObservation(entry, revision, legacy).value, read_at: revision.read_at, brief: revision.brief};
+}
+/** Host receipt for the content actually supplied by the existing inbox read.
+ * Legacy consumers without a revision marker supplied the immutable original.
+ */
+export function recordControlledRequestRead(params: JsonObject): JsonObject {
+  const entry = obj(params.entry, "read request"), state = readRequestControl(entry);
+  const revision = state.revisions[integer(params.revision ?? 1, "supplied request revision") - 1];
+  ensure(revision, "supplied request revision is unavailable");
+  const basis = requestRevisionDigest(entry, revision);
+  ensure(params.revision_digest == null ? revision.revision === 1 : params.revision_digest === basis,
+    "supplied request digest does not match its revision");
+  const plan = planRequestControl({entry, input: {operation: "read", operation_id: "read:" + basis,
+    revision: revision.revision, revision_digest: basis}, source: {actor: "receiver", actor_agent_id: params.actor_agent_id,
+    observed_at: params.observed_at, legacy_assessment: params.legacy_assessment ?? null,
+    legacy_assessment_unavailable: params.legacy_assessment_unavailable === true}});
+  return {...plan, readback: {supplied_revision: revision.revision, revision_digest: basis,
+    current_revision_at_record: state.revisions.length, model_comprehension_verified: false}};
+}
+export function recordControlledRequestAssessment(params: JsonObject): JsonObject {
+  const entry = obj(params.entry, "assessed request"), state = readRequestControl(entry);
+  const revision = state.revisions[integer(params.revision ?? 1, "assessed request revision") - 1];
+  ensure(revision, "assessed request revision is unavailable");
+  const basis = requestRevisionDigest(entry, revision);
+  ensure(params.revision_digest == null ? revision.revision === 1 : params.revision_digest === basis,
+    "assessed request digest does not match its revision");
+  const decision = receiverDecision(params.decision), reason = text(params.reason, "assessment reason");
+  ensure(decision !== null && params.actor_agent_id === entry.agent_id, "request assessment actor or decision is invalid");
+  const recorded = assessmentObservation(entry, revision, params.legacy_assessment ?? null).value;
+  if (recorded !== null) {
+    ensure(recorded.decision === decision && recorded.reason === reason, "request revision already has a different assessment");
+    return {changed: false, replayed: true, entry, result: {revision: revision.revision, decision},
+      view: requestControlView(entry, params.legacy_assessment ?? null, params.legacy_assessment_unavailable === true,
+        params.legacy_read ?? null, params.legacy_read_unavailable === true)};
+  }
+  return planRequestControl({entry, input: {operation: "assess", operation_id: "assess:" + canonicalAuthoritySha256({basis, decision, reason}),
+    revision: revision.revision, revision_digest: basis, decision, reason}, source: {actor: "receiver", actor_agent_id: params.actor_agent_id,
+    goal_active: params.goal_active, observed_at: params.observed_at, legacy_assessment: params.legacy_assessment ?? null,
+    legacy_assessment_unavailable: params.legacy_assessment_unavailable === true,
+    legacy_read: params.legacy_read ?? null, legacy_read_unavailable: params.legacy_read_unavailable === true}});
+}
+export function requestControlView(entry: JsonObject, legacyAssessment: unknown = null, legacyUnavailable = false,
+    legacyRead: unknown = null, legacyReadUnavailable = false): JsonObject {
+  const state = readRequestControl(entry), current = state.revisions.at(-1)!;
+  const active = state.reservations.find(r => r.terminal === null) ?? null;
+  const correctionPending = active !== null && Number(active.binding.request_revision) < current.revision;
+  const observed = assessmentObservation(entry, current, legacyAssessment), recorded = observed.value;
+  let readAt = current.read_at, readUnavailable = false;
+  if (readAt === null && current.revision === 1) {
+    if (legacyRead !== null) {
+      const value = typeof legacyRead === "object" && !Array.isArray(legacyRead) ? legacyRead as JsonObject : null;
+      if (sameRequest(value, entry, false) && value.kind === "receiver_cli_read" && typeof value.read_at === "string") readAt = value.read_at;
+      else readUnavailable = true;
+    }
+    readUnavailable ||= legacyReadUnavailable;
+  }
+  const instruction = active
+    ? `Recover original effect ${active.binding.operation_id} before another effect for this request. ${state.cancellation || correctionPending ? "The source control is pending its terminal receipt, not proof of no change." : "A timeout does not release the reservation."}`
+    : state.cancellation ? "This request is cancelled. Retain historical results and committed Goal changes; do not start new work for this request."
+    : `Use request revision ${current.revision} and its exact digest for assessment and request-derived effects. Return results with request_revision=${current.revision}; earlier observations remain bound to their original revisions. Request context grants no new Goal or execution permission.`;
+  return {schema_version: REQUEST_CONTROL_SCHEMA, request_id: entry.request_id, goal_ref: entry.goal_ref,
+    receiver_agent_id: entry.agent_id, revision: current.revision, control_version: state.operations.length,
+    revision_digest: requestRevisionDigest(entry, current),
+    brief: current.brief, reason: current.reason, read_at: readAt,
+    read_readback: readAt !== null ? "recorded" : readUnavailable ? "unavailable" : "not_recorded",
+    assessment: recorded,
+    assessment_readback: recorded !== null ? "recorded" : current.revision === 1 && (legacyUnavailable || observed.unavailable) ? "unavailable" : "not_recorded",
+    control_state: state.cancellation ? (active ? "cancellation_pending" : "cancelled") : (active ? "effect_pending" : "open"),
+    cancellation: state.cancellation, active_reservation: active,
+    recovery_operation: active === null ? null : state.cancellation || correctionPending ? "abort_request" : "read_receipt",
+    receiver_instruction: instruction,
+    terminal_effects: state.reservations.filter(r => r.terminal !== null),
+    execution_authority_granted: false};
+}
+
+export function planRequestControl(params: JsonObject): JsonObject {
+  const entry = obj(params.entry, "request entry"), input = obj(params.input, "request operation");
+  const source = obj(params.source, "authenticated request source");
+  const project = (value: JsonObject) => requestControlView(value, source.legacy_assessment ?? null,
+    source.legacy_assessment_unavailable === true, source.legacy_read ?? null, source.legacy_read_unavailable === true);
+  const operation = String(input.operation);
+  ensure(Object.hasOwn(OP_FIELDS, operation), "unsupported request control operation");
+  const op = operation as keyof typeof OP_FIELDS;
+  keys(input, op === "inspect" ? ["operation"] : ["operation", "operation_id", ...OP_FIELDS[op]]);
+  const state = readRequestControl(entry);
+  let requestedBasis: JsonObject | null = null;
+  if (source.requested_basis != null) {
+    requestedBasis = normalizeRequestBasis(source.requested_basis);
+    const revision = state.revisions[Number(requestedBasis.request_revision) - 1];
+    ensure(revision && requestedBasis.request_id === entry.request_id && requestedBasis.request_digest === requestRevisionDigest(entry, revision),
+      "source request basis does not identify a retained revision");
+  }
+  if (op === "inspect") return {changed: false, verified_request_basis: requestedBasis,
+    view: project(entry)};
+  const operationId = id(input.operation_id, "request operation_id");
+  const requestSha = canonicalAuthoritySha256({input,
+    ...(op === "settle" ? {} : {actor: source.actor, actor_agent_id: source.actor_agent_id ?? null}),
+    ...(op === "reserve" ? {amendment: source.amendment} : {}), ...(op === "settle" ? {terminal: source.terminal} : {})});
+  ensure(source.actor === "source" || source.actor === "receiver", "request actor is not authenticated");
+  if (source.actor === "receiver") ensure(source.actor_agent_id === entry.agent_id, "request receiver identity mismatch");
+  else ensure(entry.source_kind === "peer" ? source.actor_agent_id === entry.source_agent_id : source.actor_agent_id === null,
+    "request source actor identity mismatch");
+  const original = state.operations.find(row => row.operation_id === operationId);
+  if (original) {
+    ensure(original.request_sha256 === requestSha, "request operation identity conflict", "request_operation_conflict");
+    return {changed: false, replayed: true, result: original.result, entry,
+      view: project(entry)};
+  }
+  const now = timestamp(source.observed_at), current = state.revisions.at(-1)!;
+  const active = state.reservations.find(r => r.terminal === null);
+  if (op === "revise" || op === "assess" || op === "reserve") ensure(source.goal_active === true,
+    "inactive Goal permits request cancellation and recovery, not new request work");
+  let result: JsonObject;
+  if (op === "revise" || op === "cancel" || op === "reserve") {
+    ensure(input.expected_revision === current.revision && input.expected_digest === requestRevisionDigest(entry, current),
+      "request basis changed; inspect the original request before retrying", "request_basis_changed");
+  }
+  if (op === "revise" || op === "cancel") {
+    ensure(source.actor === "source", "only the authenticated source may correct or cancel this request");
+    ensure(state.cancellation === null, "request cancellation already recorded; recover its original operation");
+    if (op === "revise") {
+      ensure(state.revisions.length < MAX_REVISIONS, "request revision capacity exceeded");
+      state.revisions.push({revision: current.revision + 1, brief: normalizeCollaborationBrief(input.brief),
+        reason: text(input.reason, "correction reason"), created_at: now, read_at: null, assessment: null});
+    } else state.cancellation = {operation_id: operationId, reason: text(input.reason, "cancellation reason"), requested_at: now};
+    result = {operation: op, revision: state.revisions.length, reserved_effect_pending: !!active};
+  } else if (op === "read" || op === "assess") {
+    ensure(source.actor === "receiver", "only this request receiver may record consumption");
+    const revision = state.revisions[integer(input.revision, "observed revision") - 1];
+    ensure(revision && input.revision_digest === requestRevisionDigest(entry, revision), "observed request revision identity mismatch");
+    if (op === "read") revision.read_at ??= now;
+    else {
+      ensure(revision === current && state.cancellation === null, "a stale or cancelled request cannot receive a new assessment");
+      const decision = receiverDecision(input.decision); ensure(decision !== null, "receiver decision is invalid");
+      const value = {decision, reason: text(input.reason, "assessment reason"), assessed_at: now};
+      ensure(revision.assessment === null, "request revision already assessed; recover its original operation");
+      revision.assessment = value;
+    }
+    result = {operation: op, revision: revision.revision};
+  } else if (op === "reserve") {
+    ensure(source.actor === "receiver" && state.cancellation === null && !active, "request cannot reserve another effect");
+    ensure(assessmentObservation(entry, current, source.legacy_assessment ?? null).value?.decision === "adopt", "receiver must adopt this exact request revision before reserving an effect");
+    ensure(state.reservations.length < MAX_RESERVATIONS, "request effect capacity exceeded");
+    const amendment = obj(source.amendment, "source-resolved amendment");
+    const bound = binding({...amendment, request_id: entry.request_id, request_revision: current.revision,
+      request_digest: requestRevisionDigest(entry, current), receiver_agent_id: entry.agent_id,
+      goal_ref: entry.goal_ref, attempt_epoch: state.reservations.length + 1}, entry, state.revisions, state.reservations.length + 1);
+    ensure(!state.reservations.some(r => r.binding.operation_id === bound.operation_id), "effect operation already reserved; recover its original request receipt");
+    const reservation: Reservation = {binding: bound, digest: canonicalAuthoritySha256(bound), terminal: null};
+    state.reservations.push(reservation); result = {operation: op, reservation};
+  } else {
+    const reserved = state.reservations.find(r => r.digest === input.reservation_digest);
+    ensure(reserved, "original request reservation is unavailable");
+    const terminal = requestTerminalSummary(source.terminal, reserved);
+    ensure(reserved.terminal === null || same(reserved.terminal, terminal), "request terminal result conflicts with its original Goal receipt");
+    reserved.terminal = terminal; result = {operation: op, terminal};
+  }
+  // Leave room for a cancellation and its terminal linkage. Neither a full
+  // history nor an oversized correction may strand an admitted effect.
+  const limit = op === "settle" ? MAX_OPERATIONS : op === "cancel" ? MAX_OPERATIONS - 1 : MAX_OPERATIONS - 2;
+  ensure(state.operations.length < limit, "request operation capacity reached; preserve and recover existing operations");
+  state.operations.push({operation_id: operationId, request_sha256: requestSha, result});
+  const updated = {...entry, request_control: state};
+  const bytes = op === "settle" ? Buffer.byteLength(JSON.stringify(updated), "utf8") : recoverableRecordBytes(entry, state);
+  ensure(bytes <= 128000, "request record capacity reached; preserve cancellation and terminal recovery space");
+  readRequestControl(updated);
+  return {changed: true, replayed: false, result, entry: updated,
+    view: project(updated)};
+}
+
+/** Internal lifecycle state is not part of the original sender's request.
+ * Validate it through its owner before excluding it from replay comparison.
+ */
+export function planControlledRequestPublication(params: JsonObject): JsonObject {
+  const request = obj(params.request, "request");
+  ensure(!Object.hasOwn(request, "request_control"), "request control cannot be supplied by an ingress caller");
+  const entry = params.entry === null ? null : obj(params.entry, "entry");
+  if (entry === null || !Object.hasOwn(entry, "request_control")) return planCollaborationRequestPublication(params);
+  readRequestControl(entry);
+  const original = {...entry}; delete original.request_control;
+  const plan = planCollaborationRequestPublication({...params, entry: original});
+  return {...plan, entry};
+}
+
+/** Current request readback and historical Goal outcome are independent facts. */
+export function requestAmendmentReadback(params: JsonObject): JsonObject {
+  const entry = obj(params.entry, "request source snapshot"), state = readRequestControl(entry);
+  const reservation = state.reservations.find(row => row.digest === params.reservation_digest);
+  ensure(reservation, "request effect recovery requires its original reservation");
+  const terminal = params.terminal === null ? null : requestTerminalSummary(params.terminal, reservation);
+  const current = params.source_current === true;
+  const linked = current && terminal !== null && reservation.terminal !== null && same(reservation.terminal, terminal);
+  return {schema_version: REQUEST_AMENDMENT_RESULT_SCHEMA, ok: linked, request_id: entry.request_id,
+    goal_ref: entry.goal_ref, effect: terminal, request_linked: linked,
+    request_control: current ? requestControlView(entry, params.legacy_assessment ?? null, params.legacy_assessment_unavailable === true,
+      params.legacy_read ?? null, params.legacy_read_unavailable === true) : null,
+    recovery_required: !linked, effect_operation_id: reservation.binding.operation_id,
+    execution_authority_granted: false};
+}
diff --git a/loopx/control_plane/collaboration/request_control_contract.ts b/loopx/control_plane/collaboration/request_control_contract.ts
new file mode 100644
index 0000000000..b4a769b2a7
--- /dev/null
+++ b/loopx/control_plane/collaboration/request_control_contract.ts
@@ -0,0 +1,9 @@
+/** Bounded request-control wire vocabulary, shared with its frontend decoder.
+ * These facts do not classify the overall Goal or grant execution authority.
+ */
+export const REQUEST_CONTROL_SCHEMA = "collaboration_request_control_v0";
+export const REQUEST_AMENDMENT_RESULT_SCHEMA = "collaboration_request_amendment_result_v0";
+export const REQUEST_AMENDMENT_OUTCOMES = ["committed", "aborted", "rejected"] as const;
+export type RequestAmendmentOutcome = typeof REQUEST_AMENDMENT_OUTCOMES[number];
+export const REQUEST_CONTROL_STATES = ["open", "effect_pending", "cancellation_pending", "cancelled"] as const;
+export const REQUEST_OBSERVATION_STATES = ["recorded", "unavailable", "not_recorded"] as const;
diff --git a/loopx/control_plane/collaboration/request_control_source.py b/loopx/control_plane/collaboration/request_control_source.py
new file mode 100644
index 0000000000..bf310894b5
--- /dev/null
+++ b/loopx/control_plane/collaboration/request_control_source.py
@@ -0,0 +1,142 @@
+"""Authenticated source and atomic-file adapter for request control.
+
+Request and Goal transactions never hold each other's locks. A reservation is
+durable before the Goal call; only an independently read terminal Goal receipt
+can release it. Public callers cannot supply amendment/terminal source facts.
+"""
+from __future__ import annotations
+
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any, Iterator, Mapping
+
+from .goal_instance_scope import collaboration_goal_scope, decide_collaboration_lifecycle, goal_accepts_collaboration
+from .inbox import _entry, _hash, _now, _read, _receipt, _request_lock, _root, _target, _write
+from .peer_context_observation import require_parent_context_access
+from ..effect_runtime import EffectRuntimeRejected, effect_runtime_result
+from ..content_digest import BARE_SHA256_PATTERN
+from ..projects.registry_codec import load_project_registry
+
+
+class RequestControlRejected(ValueError):
+    """Keep the typed owner's refusal code through CLI/HTTP adapters."""
+
+    def __init__(self, message: str, diagnostic_code: str):
+        super().__init__(message)
+        self.diagnostic_code = diagnostic_code
+
+
+@contextmanager
+def _locked_request(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+                    receiver_agent_id: str, request_id: str) -> Iterator[tuple[Any, Path, dict[str, Any]]]:
+    if not isinstance(request_id, str) or not BARE_SHA256_PATTERN.fullmatch(request_id):
+        raise ValueError("invalid controlled request id")
+    with collaboration_goal_scope(registry_path, goal_id=goal_ref["goal_id"], agents=(),
+        caller_goal_ref=dict(goal_ref), require_active=False, lock_registry=True) as scope:
+        if not scope.exact:
+            raise ValueError("request control requires the exact source-session profile")
+        registry = load_project_registry(registry_path)
+        configured_root = registry.get("common_runtime_root")
+        if not isinstance(configured_root, str) or Path(configured_root).expanduser().resolve() != runtime_root.resolve():
+            raise ValueError("request control runtime does not match its registered source")
+        decide_collaboration_lifecycle(scope, operation="request_create")
+        path = _root(runtime_root) / "entries" / _hash(_target(scope.goal_id, receiver_agent_id, scope)) / (request_id + ".json")
+        with _request_lock(runtime_root, request_id, scope, path.with_suffix(".lock")):
+            entry = _entry(runtime_root, scope.goal_id, receiver_agent_id, request_id, scope=scope)
+            yield scope, path, entry
+
+
+def _actor(root: Path, registry: Path, scope: Any, entry: dict[str, Any], actor_agent_id: str | None) -> str:
+    source = require_parent_context_access(root, registry, entry, entry["agent_id"], scope=scope)
+    if not source["local_source"]:
+        raise ValueError("request effect control is not qualified for an external source")
+    if actor_agent_id == entry["agent_id"]:
+        from ...agent_registry import registered_agent_ids_for_goal
+
+        if actor_agent_id not in registered_agent_ids_for_goal(scope.goal):
+            raise ValueError("the receiving Agent is no longer registered")
+        return "receiver"
+    if entry.get("source_kind") == "peer":
+        if actor_agent_id != entry.get("source_agent_id"):
+            raise ValueError("only the original requester or receiver may control this request")
+        from ...agent_registry import registered_agent_ids_for_goal
+
+        if actor_agent_id not in registered_agent_ids_for_goal(scope.goal):
+            raise ValueError("the original requesting Agent is no longer registered")
+        return "source"
+    if actor_agent_id is not None:
+        raise ValueError("an Agent cannot impersonate the original conversation owner")
+    # A local operator must still resolve this request's exact, current source
+    # and grant. A raw session id, Goal alias or request hash is not authority.
+    from .source_grant_observation import source_context_target_authority
+    from .source_chat_observation import observe_source_chat, original_delivery_facts
+
+    route = _read(_root(root) / "roundtrips" / (entry["request_id"] + ".json"))
+    session, turn = observe_source_chat(root, route)
+    grant = source_context_target_authority(root, session=session, turn=turn,
+        target={"goal_id": entry["goal_id"], "agent_id": entry["agent_id"]})
+    decide_collaboration_lifecycle(scope, operation="original_request_inspect", record=entry, route=route,
+        initial_delivery=original_delivery_facts(entry, route, turn, source_id=grant.get("source_id")))
+    if grant.get("source_id") != entry["source_id"]:
+        raise ValueError("request source grant no longer matches its original principal")
+    return "source"
+
+
+def _execute(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+             receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
+             operation: str, parameters: Mapping[str, Any], execute: bool,
+             resolved_amendment: Mapping[str, Any] | None = None,
+             terminal_receipt: Mapping[str, Any] | None = None, include_entry: bool = False,
+             requested_basis: Mapping[str, Any] | None = None) -> dict[str, Any]:
+    with _locked_request(registry_path=registry_path, runtime_root=runtime_root, goal_ref=goal_ref,
+                         receiver_agent_id=receiver_agent_id, request_id=request_id) as (scope, path, entry):
+        role = _actor(runtime_root, registry_path, scope, entry, actor_agent_id)
+        decision, error = _receipt(runtime_root, "decisions", entry)
+        read, read_error = _receipt(runtime_root, "reads", entry)
+        source = {"actor": role, "actor_agent_id": actor_agent_id, "observed_at": _now(),
+            "goal_active": goal_accepts_collaboration(scope.goal),
+            "legacy_assessment": decision or None,
+            "legacy_assessment_unavailable": bool(error),
+            "legacy_read": read or None, "legacy_read_unavailable": bool(read_error),
+            "amendment": dict(resolved_amendment) if resolved_amendment is not None else None,
+            "terminal": dict(terminal_receipt) if terminal_receipt is not None else None,
+            "requested_basis": dict(requested_basis) if requested_basis is not None else None}
+        try:
+            plan = effect_runtime_result("collaboration.request.control", {
+                "entry": entry, "input": {**parameters, "operation": operation}, "source": source})
+        except EffectRuntimeRejected as exc:
+            raise RequestControlRejected(str(exc), exc.diagnostic_code) from exc
+        if plan["changed"] and execute:
+            _write(path, plan["entry"])
+            if _read(path) != plan["entry"]:
+                raise ValueError("request control write readback is unavailable; retry the original operation")
+        return {"ok": True, "executed": bool(execute and plan["changed"]),
+            "planned": bool(not execute and plan["changed"]), "replayed": plan.get("replayed", False),
+            "result": plan.get("result"), "view": plan["view"], "execution_authority_granted": False,
+            **({"_entry": plan.get("entry", entry), "_legacy_assessment": decision or None,
+                "_legacy_assessment_unavailable": bool(error),
+                "_legacy_read": read or None, "_legacy_read_unavailable": bool(read_error),
+                "_request_reference": plan.get("verified_request_basis")} if include_entry else {})}
+
+
+def request_amendment_snapshot(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+                               receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
+                               requested_basis: Mapping[str, Any] | None = None) -> dict[str, Any]:
+    """Internal authenticated snapshot; never expose the source entry as status."""
+    return _execute(registry_path=registry_path, runtime_root=runtime_root, goal_ref=goal_ref,
+        receiver_agent_id=receiver_agent_id, request_id=request_id, actor_agent_id=actor_agent_id,
+        operation="inspect", parameters={}, execute=False, include_entry=True, requested_basis=requested_basis)
+
+
+def execute_request_control(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+                            receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
+                            operation: str, parameters: Mapping[str, Any] | None = None,
+                            execute: bool = False) -> dict[str, Any]:
+    if operation not in {"inspect", "revise", "cancel", "read", "assess"}:
+        raise ValueError("request control operation is unavailable at this entrypoint")
+    params = dict(parameters or {})
+    if set(params) & {"operation", "source", "entry", "terminal", "amendment"}:
+        raise ValueError("request parameters cannot supply source-owned facts")
+    return _execute(registry_path=registry_path, runtime_root=runtime_root, goal_ref=goal_ref,
+        receiver_agent_id=receiver_agent_id, request_id=request_id, actor_agent_id=actor_agent_id,
+        operation=operation, parameters=params, execute=execute)
diff --git a/loopx/control_plane/collaboration/result_publication.ts b/loopx/control_plane/collaboration/result_publication.ts
index 1925f47103..d4af7b14c1 100644
--- a/loopx/control_plane/collaboration/result_publication.ts
+++ b/loopx/control_plane/collaboration/result_publication.ts
@@ -3,8 +3,8 @@ import { BARE_SHA256_PATTERN } from "../content_digest.ts";
 import type { JsonObject } from "../effect_program.ts";
 import { EffectRuntimeRequestError } from "../effect_runtime_errors.ts";
 import { requireJsonObject, requireStringLiteral } from "../runtime_decode.ts";
-import { receiverDecision, sameRequest } from "./inbox_receipts.ts";
-import { workspaceRef } from "./semantic_request.ts";
+import { receiverDecision, sameRequest, workspaceRef } from "./semantic_request.ts";
+import {requestRevisionReceiptContext} from "./request_control.ts";
 
 // Local storage keys, not task status or authority. Updates keep the existing
 // conclusion phase and append immutable observations in publication order.
@@ -51,21 +51,17 @@ export function resultAttachments(value: unknown): JsonObject[] {
   return files;
 }
 
-export function planCollaborationResult(params: JsonObject): JsonObject {
-  const request = requireJsonObject(params.request, "result request");
-  const phase = requireStringLiteral(params.phase, ["decision", "conclusion"], "result phase");
-  const decision = receiverDecision(params.decision);
-  const attachments = resultAttachments(params.attachments);
-  if (decision === null) throw new EffectRuntimeRequestError("a receiver decision is required");
-  if (typeof params.text !== "string" || !params.text.trim() || Array.from(params.text).length > 20000) {
-    throw new EffectRuntimeRequestError("bounded reply text is required");
-  }
-  if (!Array.isArray(params.results)) throw new EffectRuntimeRequestError("result observations are required");
-  const results = params.results.map((item) => {
+export function collaborationResultObservations(request: JsonObject, observations: unknown,
+    decision: string | null, legacyAssessment: unknown = null) {
+  if (!Array.isArray(observations)) throw new EffectRuntimeRequestError("result observations are required");
+  const results = observations.map((item) => {
     const record = requireJsonObject(item, "result observation");
     const value = requireJsonObject(record.value, "result receipt");
+    const historical = (request.request_control !== undefined || value.request_revision !== undefined) ? requestRevisionReceiptContext(request, value.request_revision, legacyAssessment) : null;
     if (typeof record.key !== "string" || !sameRequest(value, request, true)
-        || value.decision !== decision || typeof record.text_chars !== "number"
+        || value.decision !== (historical === null ? decision : (historical.assessment as JsonObject | null)?.decision)
+        || (value.request_revision_digest !== undefined && value.request_revision_digest !== historical?.revision_digest)
+        || typeof record.text_chars !== "number"
         || !Number.isSafeInteger(record.text_chars) || record.text_chars < 1 || record.text_chars > 20000
         || typeof record.text_sha256 !== "string" || !BARE_SHA256_PATTERN.test(record.text_sha256)) {
       throw new EffectRuntimeRequestError("result receipt identity or content conflict");
@@ -95,9 +91,31 @@ export function planCollaborationResult(params: JsonObject): JsonObject {
       throw new EffectRuntimeRequestError("result receipt identity conflict");
     }
   }
+  return results;
+}
+
+export function planCollaborationResult(params: JsonObject): JsonObject {
+  const request = requireJsonObject(params.request, "result request");
+  const phase = requireStringLiteral(params.phase, ["decision", "conclusion"], "result phase");
+  const controlled = request.request_control !== undefined || params.request_revision != null;
+  // Old commands always name original revision 1. They never inherit the new
+  // head merely because a correction arrived while their result was in flight.
+  const context = controlled ? requestRevisionReceiptContext(request, params.request_revision, params.legacy_assessment ?? null) : null;
+  const decision = receiverDecision(context === null ? params.decision : (context.assessment as JsonObject | null)?.decision);
+  const attachments = resultAttachments(params.attachments);
+  if (decision === null) throw new EffectRuntimeRequestError("a receiver decision is required");
+  if (typeof params.text !== "string" || !params.text.trim() || Array.from(params.text).length > 20000) {
+    throw new EffectRuntimeRequestError("bounded reply text is required");
+  }
+  const results = collaborationResultObservations(request, params.results, decision, params.legacy_assessment ?? null);
+  const updates = results.filter((r) => UPDATE_KEY.test(r.key)).sort((a, b) => a.key.localeCompare(b.key));
+  const previous = updates.at(-1)?.key ?? "conclusion";
   const conclusion = results.find((r) => r.key === "conclusion");
   if (updates.length && !conclusion) throw new EffectRuntimeRequestError("initial conclusion is required");
-  const updateId = params.update_id;
+  const revision = context?.revision ?? 1;
+  const primaryUpdate = `request-revision-${revision}`;
+  const initialForRevision = conclusion && (conclusion.value.request_revision ?? 1) === revision;
+  const updateId = params.update_id ?? (controlled && phase === "conclusion" && conclusion && !initialForRevision ? primaryUpdate : null);
   const isUpdate = updateId !== undefined && updateId !== null;
   if (isUpdate && (typeof updateId !== "string" || !UPDATE_ID.test(updateId))) {
     throw new EffectRuntimeRequestError("a bounded update id is required");
@@ -109,17 +127,20 @@ export function planCollaborationResult(params: JsonObject): JsonObject {
   const value: JsonObject = Object.fromEntries(["request_id", "goal_id", "agent_id", "source_id", "goal_ref"]
     .filter((key) => request[key] !== undefined).map((key) => [key, request[key]]));
   Object.assign(value, { phase, decision, text: params.text.trim() });
+  if (context !== null) Object.assign(value, {request_revision: context.revision, request_revision_digest: context.revision_digest});
   if (attachments.length) value.attachments = attachments;
   const key = old?.key ?? (isUpdate ? `conclusion-${String(updates.length + 1).padStart(8, "0")}` : phase);
   if (isUpdate) Object.assign(value, { result_key: key, update_id: updateId, previous_result_key: old?.value.previous_result_key ?? previous });
   if (old && (old.textSha256 !== createHash("sha256").update(String(value.text)).digest("hex") || old.value.phase !== phase
+      || (old.value.request_revision ?? 1) !== revision
       || JSON.stringify(old.attachments) !== JSON.stringify(attachments))) {
     throw new EffectRuntimeRequestError("reply already committed; conflicting replacement rejected; use a stable update_id for a later conclusion");
   }
-  if (!old && phase === "decision" && conclusion) {
+  if (!old && phase === "decision" && conclusion && (conclusion.value.request_revision ?? 1) === revision) {
     throw new EffectRuntimeRequestError("cannot publish an intermediate decision after conclusion");
   }
-  return { result_key: key, value, replay: old !== undefined };
+  return { result_key: key, value, replay: old !== undefined,
+    ...(context === null ? {} : {request_revision: context.revision, current_request_revision: context.current_revision, request_brief: context.brief}) };
 }
 
 /** Transport observations cannot let an update overtake an uncertain send. */
diff --git a/loopx/control_plane/collaboration/semantic_request.ts b/loopx/control_plane/collaboration/semantic_request.ts
index d8ce2a058d..e37dfff355 100644
--- a/loopx/control_plane/collaboration/semantic_request.ts
+++ b/loopx/control_plane/collaboration/semantic_request.ts
@@ -3,6 +3,9 @@ import { EffectRuntimeRequestError } from "../effect_runtime_errors.ts";
 import { requireJsonObject, requireNonEmptyString } from "../runtime_decode.ts";
 import { BARE_SHA256_PATTERN } from "../content_digest.ts";
 import { isDeepStrictEqual } from "node:util";
+import {parseExactGoalRef} from "../goals/goal_instance_identity.ts";
+
+export type ReceiverDecision = "adopt" | "defer" | "reject" | "no_change";
 
 const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,159}$/;
 
@@ -151,3 +154,25 @@ export function planCollaborationRequestPublication(params: JsonObject): JsonObj
     entry: entry ?? original,
   };
 }
+
+function sameGoalRef(left: unknown, right: unknown): boolean {
+  if (left === undefined && right === undefined) return true;
+  const a = parseExactGoalRef(left);
+  const b = parseExactGoalRef(right);
+  return a.kind === "parsed" && b.kind === "parsed"
+    && a.value.goalId.value === b.value.goalId.value
+    && a.value.goalInstanceId.value === b.value.goalInstanceId.value;
+}
+
+export function sameRequest(receipt: JsonObject | null, request: JsonObject, source: boolean): receipt is JsonObject {
+  return receipt !== null && ["request_id", "goal_id", "agent_id"].every((key) => receipt[key] === request[key])
+    && sameGoalRef(receipt.goal_ref, request.goal_ref)
+    && (!source || receipt.source_id === request.source_id);
+}
+
+export function receiverDecision(value: unknown): ReceiverDecision | null {
+  switch (value) {
+    case "adopt": case "defer": case "reject": case "no_change": return value;
+    default: return null;
+  }
+}
diff --git a/loopx/control_plane/collaboration/source_chat_observation.py b/loopx/control_plane/collaboration/source_chat_observation.py
index 8228027671..4c203c18d1 100644
--- a/loopx/control_plane/collaboration/source_chat_observation.py
+++ b/loopx/control_plane/collaboration/source_chat_observation.py
@@ -51,3 +51,19 @@ def trusted_source_chat_root(store, route):
     root = store.root.parent.resolve()
     observe_source_chat(root, {**route, "source_chat_runtime_root": str(root)})
     return str(root)
+
+
+def original_delivery_facts(row, route, turn, *, source_id):
+    # Adapt trusted store/authority facts only. The common typed owner decides
+    # whether a committed handoff survived a lost caller response.
+    identity = {key: row[key] for key in ("request_id", "goal_id", "agent_id", "source_id", "goal_ref") if key in row}
+    return {
+        "request": identity,
+        "route": route,
+        "authorized_source_id": source_id,
+        "turn": {
+            "client_turn_id": turn.get("client_turn_id"),
+            "status": turn.get("status"),
+            "context_handoff_receipt": (turn.get("response") or {}).get("context_handoff_receipt"),
+        },
+    }
diff --git a/loopx/control_plane/effect_runtime_handlers.ts b/loopx/control_plane/effect_runtime_handlers.ts
index d07e0c1b2f..acb771dbe5 100644
--- a/loopx/control_plane/effect_runtime_handlers.ts
+++ b/loopx/control_plane/effect_runtime_handlers.ts
@@ -624,7 +624,12 @@ export function createEffectRuntimeHandlers(
       lazyHandler(() => import("./collaboration/semantic_request.ts"), ({normalizeCollaborationRequest}) => (params) => normalizeCollaborationRequest(params.request)),
     ],
     ["collaboration.source_context.normalize", lazyHandler(() => import("./collaboration/semantic_request.ts"), ({normalizeCollaborationSourceContext}) => normalizeCollaborationSourceContext)],
-    ["collaboration.request.plan_publication", lazyHandler(() => import("./collaboration/semantic_request.ts"), ({planCollaborationRequestPublication}) => planCollaborationRequestPublication)],
+    ["collaboration.request.plan_publication", lazyHandler(() => import("./collaboration/request_control.ts"), ({planControlledRequestPublication}) => planControlledRequestPublication)],
+    ["collaboration.request.control", lazyHandler(() => import("./collaboration/request_control.ts"), ({planRequestControl}) => planRequestControl)],
+    ["collaboration.request.record_read", lazyHandler(() => import("./collaboration/request_control.ts"), ({recordControlledRequestRead}) => recordControlledRequestRead)],
+    ["collaboration.request.assess", lazyHandler(() => import("./collaboration/request_control.ts"), ({recordControlledRequestAssessment}) => recordControlledRequestAssessment)],
+    ["collaboration.request.amendment_readback", lazyHandler(() => import("./collaboration/request_control.ts"), ({requestAmendmentReadback}) => requestAmendmentReadback)],
+    ["goal.amendment.request_receipt", lazyHandler(() => import("./goals/goal_amendment_authority.ts"), ({projectRequestAmendmentReceipt}) => projectRequestAmendmentReceipt)],
     ["collaboration.inbox.inspect_receipts", lazyHandler(() => import("./collaboration/inbox_receipts.ts"), ({inspectCollaborationInboxReceipts}) => inspectCollaborationInboxReceipts)],
     ["collaboration.inbox.receiver_followthrough", lazyHandler(() => import("./collaboration/inbox_receipts.ts"), ({projectReceiverFollowthrough}) => projectReceiverFollowthrough)],
     ["collaboration.result.plan_publication", lazyHandler(() => import("./collaboration/result_publication.ts"), ({planCollaborationResult}) => planCollaborationResult)],
diff --git a/loopx/control_plane/goals/goal_amendment_authority.ts b/loopx/control_plane/goals/goal_amendment_authority.ts
index b4d9490be8..f1900205eb 100644
--- a/loopx/control_plane/goals/goal_amendment_authority.ts
+++ b/loopx/control_plane/goals/goal_amendment_authority.ts
@@ -18,15 +18,19 @@ import {parseQuotaAccountingOwner, withBorrowedQuotaAccountingOwner} from "../qu
 import {EffectRuntimeConflictError} from "../effect_runtime_errors.ts";
 import {registryAuthoritySourceCheck, uncheckedAuthoritySource, type AuthoritySourceCheck} from "../coordination/authority_source.ts";
 import {readGoalAcceptanceLifecycle, sameExactGoalRef} from "./acceptance_lifecycle.ts";
+import {readRequestControl, requestControlView, requestTerminalSummary, normalizeRequestBasis} from "../collaboration/request_control.ts";
+import type {RequestAmendmentOutcome} from "../collaboration/request_control_contract.ts";
 
 export const SHARED_GOAL_INTENT_SCHEMA = "shared_goal_intent_v0";
 export const GOAL_AMENDMENT_OPERATION_SCHEMA = "goal_amendment_operation_v0";
 export const GOAL_AMENDMENT_RESULT_SCHEMA = "goal_amendment_result_v0";
 export const GOAL_AMENDMENT_PROPOSAL_SCHEMA = "goal_work_graph_amendment_v0";
+export const GOAL_REQUEST_AMENDMENT_PROPOSAL_SCHEMA = "goal_request_work_graph_amendment_v0";
 const LIMITS = {templates: 16, proposals: 64, created: 256, peers: 128, bytes: 256 * 1024};
-const OPERATION_FIELDS = {inspect: [], configure: ["root_intent", "policy", "expected_provider_revision"],
+const OPERATION_FIELDS = {inspect: [], request_basis: [], configure: ["root_intent", "policy", "expected_provider_revision"],
     propose: ["proposal_id", "template_id", "base_goal_revision", "base_intent_digest", "base_work_digest", "evidence_refs", "replan_obligation_id"],
-    commit: ["proposal_id", "proposal_digest"], adopt: ["base_goal_revision", "base_intent_digest", "base_work_digest"], receipt: ["receipt_operation_id"], claim: ["todo_id", "expected_provider_revision", "base_goal_revision", "base_intent_digest", "base_work_digest", "lease_request"]} as const;
+    commit: ["proposal_id", "proposal_digest"], abort_request: ["proposal_id", "proposal_digest"],
+    adopt: ["base_goal_revision", "base_intent_digest", "base_work_digest"], receipt: ["receipt_operation_id"], claim: ["todo_id", "expected_provider_revision", "base_goal_revision", "base_intent_digest", "base_work_digest", "lease_request"]} as const;
 type Operation = keyof typeof OPERATION_FIELDS;
 type GoalRef = {goal_id: string; goal_instance_id: string};
 interface Template extends JsonObject {id: string; todo: JsonObject; digest: string}
@@ -39,11 +43,12 @@ interface Policy extends JsonObject {
   eligible_agents: string[]; templates: Template[]; max_created_todos: number; out_of_policy: "reject";
 }
 interface Proposal extends JsonObject {
-  schema_version: typeof GOAL_AMENDMENT_PROPOSAL_SCHEMA;
+  schema_version: typeof GOAL_AMENDMENT_PROPOSAL_SCHEMA | typeof GOAL_REQUEST_AMENDMENT_PROPOSAL_SCHEMA;
   proposal_id: string; proposer_agent_id: string; goal_ref: GoalRef;
   base_goal_revision: number; base_intent_digest: string; base_work_digest: string;
   template_id: string; template_digest: string; evidence_refs: string[];
   replan_obligation_id: string | null; digest: string;
+  source_request?: JsonObject;
 }
 interface IntentState extends JsonObject {
   schema_version: typeof SHARED_GOAL_INTENT_SCHEMA; goal_ref: GoalRef;
@@ -148,9 +153,11 @@ function readIntent(head: JsonObject): IntentState | null {
   const proposals = list(raw.proposals, "proposals", LIMITS.proposals).map(v => {
     const p = object(v, "stored proposal");
     keys(p, ["schema_version", "proposal_id", "proposer_agent_id", "goal_ref", "base_goal_revision", "base_intent_digest", "base_work_digest",
-      "template_id", "template_digest", "evidence_refs", "replan_obligation_id", "digest"]);
+      "template_id", "template_digest", "evidence_refs", "replan_obligation_id", "digest"], ["source_request"]);
     const {digest, ...content} = p;
-    requireValue(digest === canonicalAuthoritySha256(content) && p.schema_version === GOAL_AMENDMENT_PROPOSAL_SCHEMA && same(p.goal_ref, goalRef), "stored amendment proposal is corrupt");
+    requireValue(digest === canonicalAuthoritySha256(content) && same(p.goal_ref, goalRef), "stored amendment proposal is corrupt");
+    requireValue(p.schema_version === (p.source_request === undefined ? GOAL_AMENDMENT_PROPOSAL_SCHEMA : GOAL_REQUEST_AMENDMENT_PROPOSAL_SCHEMA), "stored proposal source schema is invalid");
+    if (p.source_request !== undefined) requestBasis(p.source_request);
     id(p.proposal_id, "proposal id");
     requireValue(rules.eligible_agents.includes(id(p.proposer_agent_id, "proposal Agent")), "stored proposal actor is outside the root policy");
     integer(p.base_goal_revision, "proposal revision", 1, revision);
@@ -196,11 +203,42 @@ function view(head: AuthorityStoreHead, goalRef: GoalRef, agents: string[], sour
 }
 function command(request: JsonObject, op: Operation) {
   const content = Object.fromEntries(Object.entries(request).filter(([key]) => !["runtime_root", "source", "observed_at", "dry_run"].includes(key)));
+  const reservation = requestReservation(request);
+  // Commit and conditional abort compete for ONE original operation receipt.
+  // Later request controls cannot change this immutable binding's identity.
+  const identity = reservation === null ? {op, ...content}
+    : {goal_ref: request.goal_ref, reservation: reservation.binding, reservation_digest: reservation.digest};
   return new CoordinationCommandReceipt({result_schema: GOAL_AMENDMENT_RESULT_SCHEMA,
     identity: {schema_version: GOAL_AMENDMENT_OPERATION_SCHEMA, goal_id: String(ref(request.goal_ref).goal_id),
-      operation_id: id(request.operation_id, "operation_id"), request_sha256: canonicalAuthoritySha256({op, ...content})},
+      operation_id: id(request.operation_id, "operation_id"), request_sha256: canonicalAuthoritySha256(identity)},
     failure, decode: commandReceiptResult});
 }
+/** Normalize an independently read Goal receipt under the same identity owner
+ * used for commit/abort. A missing receipt cannot prove no effect occurred.
+ */
+export function projectRequestAmendmentReceipt(params: JsonObject): JsonObject {
+  const entry = object(params.entry, "source-owned request"), control = readRequestControl(entry);
+  const reservation = control.reservations.find(row => row.digest === params.reservation_digest);
+  requireValue(reservation, "original request reservation is unavailable");
+  const b = reservation.binding;
+  const request = {operation: "commit", operation_id: b.operation_id, goal_ref: entry.goal_ref, actor_agent_id: entry.agent_id,
+    proposal_id: b.proposal_id, proposal_digest: b.proposal_digest,
+    source: {request_entry: entry, request_reservation_digest: reservation.digest}};
+  const received = object(params.receipt, "original Goal receipt readback");
+  if (received.status === "missing") return {found: false, terminal: null};
+  requireValue(received.status === "found", "original Goal receipt remains unavailable");
+  const records = list(received.receipts, "Goal receipt records", 1);
+  requireValue(records.length === 1, "original Goal receipt is incomplete");
+  const original = object(records[0], "original Goal operation");
+  requireValue(Object.entries(command(request, "commit").contract.identity).every(([key, value]) => original[key] === value),
+    "Goal receipt does not identify the reserved request operation");
+  const result = commandReceiptResult(original).fields;
+  const terminal = requestTerminalSummary({operation_id: b.operation_id, reservation_digest: result.reservation_digest,
+    outcome: result.request_outcome, goal_ref: result.goal_ref, goal_changed: result.goal_changed,
+    goal_revision: result.goal_revision, todo_id: result.todo_id ?? null, receipt_sha256: canonicalAuthoritySha256(original)}, reservation);
+  requireValue(result.terminal_recorded === true, "Goal operation lacks a recorded terminal decision");
+  return {found: true, terminal};
+}
 function requireOpenObligation(source: JsonObject, obligation: unknown, actor: string, goalRef: GoalRef): void {
   const rows = list(source.open_replan_obligations, "source replan inventory", 128).map(v => object(v, "source obligation"));
   requireValue(rows.some(row => row.obligation_id === obligation && row.goal_id === goalRef.goal_id && row.required === true
@@ -211,6 +249,103 @@ function currentBasis(request: JsonObject, state: IntentState, head: JsonObject)
     "goal_amendment_needs_rebase");
 }
 
+function requestBasis(value: unknown): JsonObject {
+  return normalizeRequestBasis(value);
+}
+function requestReservation(request: JsonObject) {
+  if (request.operation !== "commit" && request.operation !== "abort_request") return null;
+  const source = object(request.source, "source");
+  if (source.request_entry === undefined) {
+    requireValue(request.operation !== "abort_request", "conditional abort requires an authenticated request reservation"); return null;
+  }
+  const entry = object(source.request_entry, "source-owned request entry"), control = readRequestControl(entry);
+  const reservation = control.reservations.find(row => row.digest === source.request_reservation_digest);
+  requireValue(reservation && same(entry.goal_ref, request.goal_ref) && entry.agent_id === request.actor_agent_id,
+    "amendment request reservation belongs to another Goal or receiver");
+  const b = reservation.binding;
+  requireValue(b.operation_id === request.operation_id && b.proposal_id === request.proposal_id && b.proposal_digest === request.proposal_digest,
+    "amendment request reservation binding mismatch");
+  if (request.operation === "abort_request") requireValue(control.cancellation !== null || control.revisions.length > Number(b.request_revision),
+    "request owner has not authorized cancellation or correction of this effect");
+  return reservation;
+}
+async function requestAuthorityDigest(store: AuthorityStore, request: JsonObject): Promise<string> {
+  const identity = await store.storeIdentity();
+  requireValue(identity.status === "available", "request effect authority identity is unavailable");
+  const source = object(request.source, "source");
+  const registry = source.registry_source === undefined ? null : object(source.registry_source, "registry source");
+  return canonicalAuthoritySha256({store_identity: identity.store_identity, goal_ref: request.goal_ref,
+    runtime_root: request.runtime_root ?? null, registry_path: registry?.path ?? null});
+}
+function planWorkCommit(request: JsonObject, state: IntentState, loaded: AuthorityStoreHead, source: JsonObject,
+    agents: string[], actor: string, now: string): {next: JsonObject; result: JsonObject} {
+  const goalRef = ref(request.goal_ref);
+  requireValue(same(state.goal_ref, goalRef) && state.policy.eligible_agents.includes(actor), "actor is outside the current Goal amendment policy");
+  const proposal = state.proposals.find(p => p.proposal_id === request.proposal_id);
+  requireValue(proposal && proposal.digest === request.proposal_digest && proposal.proposer_agent_id === actor, "amendment proposal identity mismatch");
+  requireValue(proposal.source_request === undefined || requestReservation(request) !== null,
+    "request-derived amendment requires its original reservation; source context cannot be discarded");
+  currentBasis(proposal, state, loaded.head);
+  requireOpenObligation(source, proposal.replan_obligation_id, actor, goalRef);
+  requireValue(state.adoptions[actor]?.goal_revision === state.goal_revision, "Agent must adopt the current Goal basis");
+  requireValue(state.created_todo_ids.length < state.policy.max_created_todos, "amendment creation capacity exceeded");
+  const template = state.policy.templates.find(t => t.id === proposal.template_id && t.digest === proposal.template_digest);
+  requireValue(template, "amendment template changed");
+  const todoId = amendmentTodoId(goalRef, proposal.proposal_id), index = indexCoordinationProjection(loaded.head, goalRef.goal_id);
+  const plan = planCoordinationTodoCreate({goal_id: goalRef.goal_id, operation_id: String(request.operation_id), actor_agent_id: actor,
+    registered_agents: agents, dry_run: true, now: new Date(now), todo: {...template.todo, schema_version: TODO_DOMAIN_ITEM_SCHEMA,
+      todo_id: todoId, role: "agent", task_class: "advancement_task", status: "open", done: false, archive_state: "active"}},
+    index.todos, object(loaded.head.todo_read_model, "Todo read model").schema_version);
+  requireValue(plan.status === "planned", "amendment Todo is already satisfied or conflicts; revise the proposal");
+  const commit = prepareCoordinationProjectionCommit({goal_id: goalRef.goal_id, operation_id: String(request.operation_id),
+    expected_provider_revision: loaded.provider_revision, projection: loaded.head,
+    mutations: [{kind: "todo_upsert", todo: object(plan.todo, "planned Todo")}]});
+  const updated = structuredClone(state); updated.goal_revision++; updated.created_todo_ids.push(todoId);
+  return {next: {...commit.next_projection, shared_goal_intent: updated}, result: {changed: true, goal_ref: goalRef,
+    canonical_effect: "committed", proposal_id: proposal.proposal_id, proposal_digest: proposal.digest,
+    prior_goal_revision: state.goal_revision, goal_revision: updated.goal_revision, intent_digest: state.intent_digest,
+    todo_id: todoId, todo: plan.todo, lease_disposition: "unaffected", lease_basis_digest: canonicalAuthoritySha256([...index.leases]),
+    replan_obligation_id: proposal.replan_obligation_id, replan_settlement: proposal.replan_obligation_id === null ? "not_required" : "pending",
+    peer_adoption: "pending"}};
+}
+async function settleReservedAmendment(store: AuthorityStore, request: JsonObject, state: IntentState | null,
+    loaded: AuthorityStoreHead, source: JsonObject, agents: string[], actor: string,
+    receipt: CoordinationCommandReceipt<typeof GOAL_AMENDMENT_RESULT_SCHEMA>, sourceCurrent: AuthoritySourceCheck): Promise<JsonObject> {
+  const reservation = requestReservation(request)!;
+  const b = reservation.binding, goalRef = ref(request.goal_ref);
+  requireValue(b.authority_source_sha256 === await requestAuthorityDigest(store, request),
+    "reserved effect belongs to another authority source; recover its original store before retrying");
+  requireValue(state !== null && same(state.goal_ref, goalRef), "original request Goal intent is unavailable");
+  const proposal = state.proposals.find(p => p.proposal_id === request.proposal_id);
+  requireValue(proposal && proposal.digest === b.proposal_digest && proposal.proposer_agent_id === actor && proposal.source_request !== undefined
+    && same(proposal.source_request, {request_id: b.request_id, request_revision: b.request_revision, request_digest: b.request_digest})
+    && proposal.base_goal_revision === b.base_goal_revision && proposal.base_intent_digest === b.base_intent_digest
+    && proposal.base_work_digest === b.base_work_digest, "reservation does not authenticate this source-derived proposal");
+  let next = loaded.head, outcome: RequestAmendmentOutcome = "aborted";
+  let result: JsonObject = {changed: false, goal_ref: goalRef, canonical_effect: "none", goal_revision: null};
+  if (request.operation === "commit") {
+    try {
+      const planned = planWorkCommit(request, state, loaded, source, agents, actor, text(request.observed_at, "observed_at", 64));
+      next = planned.next; result = planned.result; outcome = "committed";
+    } catch (error) {
+      if (!(error instanceof AuthorityStoreProtocolError)) throw error;
+      outcome = "rejected";
+      result.reason_code = error instanceof GoalAmendmentRebase ? error.reasonCode : "goal_amendment_rejected";
+      result.reason = error.message;
+    }
+  }
+  if (!await sourceCurrent()) return failure("authority_source_changed", "Request Goal source changed before its terminal decision");
+  bounded(next.shared_goal_intent);
+  result = {...result, request_outcome: outcome, reservation_digest: reservation.digest,
+    source_request: proposal.source_request, goal_changed: outcome === "committed", execution_authority_granted: false};
+  if (request.dry_run === true) return {schema_version: GOAL_AMENDMENT_RESULT_SCHEMA, status: "planned", ...result,
+    changed: false, canonical_effect: "none", goal_changed: false, request_outcome: null, terminal_recorded: false, dry_run: true};
+  return {...await receipt.commit(store, {expected_provider_revision: loaded.provider_revision, operation_id: String(request.operation_id),
+    next_projection: next, events: [{schema_version: GOAL_AMENDMENT_OPERATION_SCHEMA, operation: "request_terminal",
+      goal_ref: goalRef, operation_id: request.operation_id, request_outcome: outcome, reservation_digest: reservation.digest}],
+    receipts: [{...receipt.contract.identity, result: {...result, terminal_recorded: true}}]}), execution_authority_granted: false};
+}
+
 /** The source adapter holds the exact Goal lifecycle and registry guards until
  * this call returns. No source-supplied boolean alone can replace that contract. */
 export async function executeGoalAmendment(store: AuthorityStore, value: unknown, sourceCurrent: AuthoritySourceCheck = uncheckedAuthoritySource): Promise<JsonObject> {
@@ -219,7 +354,7 @@ export async function executeGoalAmendment(store: AuthorityStore, value: unknown
   // Success is operation-specific: a missing receipt is a completed historical
   // lookup, but missing authority cannot successfully inspect or perform work.
   // Transports must not maintain their own, diverging status classifications.
-  const ok = request.operation === "inspect" ? result.status === "loaded"
+  const ok = request.operation === "inspect" || request.operation === "request_basis" ? result.status === "loaded"
     : request.operation === "receipt" ? result.status === "found" || result.status === "missing"
     : ["planned", "applied", "recovered", "replayed", "no_change"].includes(String(result.status));
   return {...result, ok, ...(!ok && result.status === "missing" ? {
@@ -232,26 +367,31 @@ async function executeAmendmentOperation(store: AuthorityStore, value: unknown,
   const request = object(value, "Goal amendment request"); bounded(request);
   const op = request.operation as Operation;
   requireValue(Object.hasOwn(OPERATION_FIELDS, op), "unsupported Goal amendment operation");
-  keys(request, ["operation", "goal_ref", "actor_agent_id", "source", ...OPERATION_FIELDS[op]], ["runtime_root", "observed_at", "dry_run", "operation_id"]);
+  keys(request, ["operation", "goal_ref", "actor_agent_id", "source", ...OPERATION_FIELDS[op]],
+    ["runtime_root", "observed_at", "dry_run", "operation_id", ...(op === "propose" ? ["source_request"] : [])]);
   const goalRef = ref(request.goal_ref), source = object(request.source, "source-owned facts");
-  keys(source, ["profile_id", "current_goal_ref", "gate", "registered_agents", "open_replan_obligations", "goal_status", "root_commitments"], ["registry_source", "accounting_admission"]);
+  keys(source, ["profile_id", "current_goal_ref", "gate", "registered_agents", "open_replan_obligations", "goal_status", "root_commitments"],
+    ["registry_source", "accounting_admission", "request_entry", "request_reservation_digest", "request_preview"]);
+  requireValue(source.request_preview !== true || request.dry_run === true, "a preview reservation cannot authorize a Goal effect");
   const agents = strings(source.registered_agents, "registered Agents", LIMITS.peers).map(v => id(v, "Agent"));
   const actor = request.actor_agent_id === null ? null : id(request.actor_agent_id, "actor Agent");
-  requireValue(actor === null || agents.includes(actor), "amendment actor is not currently registered");
+  requireValue(op === "abort_request" || actor === null || agents.includes(actor), "amendment actor is not currently registered");
   if (op === "receipt") {
     const receipt = await store.readReceipt(id(request.receipt_operation_id, "receipt operation"));
     if (receipt.status === "found") requireValue(receipt.receipts.length === 1 && receipt.receipts[0].schema_version === GOAL_AMENDMENT_OPERATION_SCHEMA
       && same(object(receipt.receipts[0].result, "amendment receipt").goal_ref, goalRef), "historical amendment receipt belongs to another Goal instance or operation");
     return {schema_version: GOAL_AMENDMENT_RESULT_SCHEMA, ...receipt, historical_only: true, execution_authority_granted: false};
   }
-  const receipt = op === "inspect" || op === "claim" ? null : command(request, op);
+  const receipt = op === "inspect" || op === "request_basis" || op === "claim" ? null : command(request, op);
   if (receipt && request.dry_run !== true) {
     const replay = await receipt.read(store);
     if (replay !== null) return {...replay, historical_only: true, execution_authority_granted: false};
   }
   if (!await sourceCurrent()) return failure("authority_source_changed", "Source Goal registration changed; inspect before retrying");
   const readiness = sourceGoalMutationReadiness({...source, requested_goal_ref: goalRef});
-  if (op !== "inspect" && readiness.kind === "reject") return failure(readiness.code, "Goal lifetime does not admit this mutation");
+  if (op === "abort_request") requireValue(source.profile_id === "source_session_v1" && same(source.current_goal_ref, goalRef),
+    "conditional abort requires the original exact source Goal");
+  else if (op !== "inspect" && op !== "request_basis" && readiness.kind === "reject") return failure(readiness.code, "Goal lifetime does not admit this mutation");
   const observation = receipt ? await receipt.observe(store) : {kind: "authority" as const, authority: await store.loadAuthority()};
   if (observation.kind === "receipt") return {...observation.result, historical_only: true, execution_authority_granted: false};
   const loaded = observation.authority;
@@ -261,12 +401,17 @@ async function executeAmendmentOperation(store: AuthorityStore, value: unknown,
   // A timed-out caller releases its source locks while the RPC can still be
   // queued. Recreation serializes this canonical retirement fence under the
   // same writer lock, so delayed old-instance requests cannot pass cached facts.
-  if (op !== "inspect" && lifecycle !== null &&
-      (lifecycle.state !== "active" || !sameExactGoalRef(lifecycle.goal_ref, goalRef))) {
+  if (op !== "inspect" && op !== "request_basis" && lifecycle !== null &&
+      ((lifecycle.state !== "active" && op !== "abort_request") || !sameExactGoalRef(lifecycle.goal_ref, goalRef))) {
     return failure("stale_goal_instance", "The canonical Goal lifetime is retiring or has changed");
   }
   const state = readIntent(loaded.head);
   if (op === "inspect") return view(loaded, goalRef, agents, source);
+  if (op === "request_basis") return {...view(loaded, goalRef, agents, source), authority_source_sha256: await requestAuthorityDigest(store, request)};
+  if (requestReservation(request) !== null) {
+    requireValue(actor !== null && receipt !== null, "reserved request effect requires its receiver and original operation");
+    return settleReservedAmendment(store, request, state, loaded, source, agents, actor, receipt, sourceCurrent);
+  }
   if (op === "claim") {
     requireValue(state !== null && same(state.goal_ref, goalRef) && actor !== null, "current exact Goal intent is unavailable");
     requireValue(state.created_todo_ids.includes(String(request.todo_id)), "claim must target work created by this Goal amendment owner");
@@ -332,36 +477,23 @@ async function executeAmendmentOperation(store: AuthorityStore, value: unknown,
       requireValue(/^replan-[a-f0-9]{16}$/.test(obligation), "invalid replan obligation id");
       requireOpenObligation(source, obligation, actor, goalRef);
       const evidence = evidenceRefs(request.evidence_refs);
-      const content = {schema_version: GOAL_AMENDMENT_PROPOSAL_SCHEMA as typeof GOAL_AMENDMENT_PROPOSAL_SCHEMA, proposal_id: proposalId, proposer_agent_id: actor, goal_ref: goalRef,
+      let sourceRequest: JsonObject | undefined;
+      if (request.source_request !== undefined) {
+        sourceRequest = requestBasis(request.source_request);
+        const entry = object(source.request_entry, "source-owned request entry"), current = requestControlView(entry);
+        requireValue(same(entry.goal_ref, goalRef) && entry.agent_id === actor && current.cancellation === null
+          && same(sourceRequest, {request_id: current.request_id, request_revision: current.revision, request_digest: current.revision_digest}),
+        "source request changed before proposal admission");
+      }
+      const content = {schema_version: (sourceRequest === undefined ? GOAL_AMENDMENT_PROPOSAL_SCHEMA : GOAL_REQUEST_AMENDMENT_PROPOSAL_SCHEMA) as Proposal["schema_version"],
+        proposal_id: proposalId, proposer_agent_id: actor, goal_ref: goalRef,
         base_goal_revision: state.goal_revision, base_intent_digest: state.intent_digest, base_work_digest: workDigest(loaded.head),
-        template_id: template.id, template_digest: template.digest, evidence_refs: evidence, replan_obligation_id: obligation};
+        template_id: template.id, template_digest: template.digest, evidence_refs: evidence, replan_obligation_id: obligation,
+        ...(sourceRequest === undefined ? {} : {source_request: sourceRequest})};
       const proposal: Proposal = {...content, digest: canonicalAuthoritySha256(content)};
       updated.proposals.push(proposal); result = {changed: true, goal_ref: goalRef, canonical_effect: "none", proposal};
     } else {
-      const proposal = state.proposals.find(p => p.proposal_id === request.proposal_id);
-      requireValue(proposal && proposal.digest === request.proposal_digest && proposal.proposer_agent_id === actor, "amendment proposal identity mismatch");
-      currentBasis(proposal, state, loaded.head);
-      requireOpenObligation(source, proposal.replan_obligation_id, actor, goalRef);
-      requireValue(state.adoptions[actor]?.goal_revision === state.goal_revision, "Agent must adopt the current Goal basis");
-      requireValue(state.created_todo_ids.length < state.policy.max_created_todos, "amendment creation capacity exceeded");
-      const template = state.policy.templates.find(t => t.id === proposal.template_id && t.digest === proposal.template_digest);
-      requireValue(template, "amendment template changed");
-      const todoId = amendmentTodoId(goalRef, proposal.proposal_id);
-      const index = indexCoordinationProjection(loaded.head, goalRef.goal_id);
-      const plan = planCoordinationTodoCreate({goal_id: goalRef.goal_id, operation_id: String(request.operation_id), actor_agent_id: actor,
-        registered_agents: agents, dry_run: true, now: new Date(now), todo: {...template.todo, schema_version: TODO_DOMAIN_ITEM_SCHEMA,
-          todo_id: todoId, role: "agent", task_class: "advancement_task", status: "open", done: false, archive_state: "active"}},
-        index.todos, object(loaded.head.todo_read_model, "Todo read model").schema_version);
-      requireValue(plan.status === "planned", "amendment Todo is already satisfied or conflicts; revise the proposal");
-      const commit = prepareCoordinationProjectionCommit({goal_id: goalRef.goal_id, operation_id: String(request.operation_id),
-        expected_provider_revision: loaded.provider_revision, projection: loaded.head,
-        mutations: [{kind: "todo_upsert", todo: object(plan.todo, "planned Todo")}]});
-      updated.goal_revision++; updated.created_todo_ids.push(todoId); next = {...commit.next_projection, shared_goal_intent: updated};
-      result = {changed: true, goal_ref: goalRef, canonical_effect: "committed", proposal_id: proposal.proposal_id, proposal_digest: proposal.digest,
-        prior_goal_revision: state.goal_revision, goal_revision: updated.goal_revision, intent_digest: state.intent_digest,
-        todo_id: todoId, todo: plan.todo, lease_disposition: "unaffected", lease_basis_digest: canonicalAuthoritySha256([...index.leases]),
-        replan_obligation_id: proposal.replan_obligation_id, replan_settlement: proposal.replan_obligation_id === null ? "not_required" : "pending",
-        peer_adoption: "pending"};
+      ({next, result} = planWorkCommit(request, state, loaded, source, agents, actor, now));
     }
   }
   if (!await sourceCurrent()) return failure("authority_source_changed", "Source Goal registration changed before commit");
@@ -381,10 +513,10 @@ export async function goalAmendmentLocal(value: unknown): Promise<JsonObject> {
   try {
     const source = object(request.source, "source");
     const observationOwner = parseQuotaAccountingOwner({runtimeRoot: root, goalId: goal.goal_id,
-      goalRefValue: request.operation === "inspect" || request.operation === "receipt" ? source.current_goal_ref : goal,
+      goalRefValue: ["inspect", "request_basis", "receipt"].includes(String(request.operation)) ? source.current_goal_ref : goal,
       sourceAdmissionValue: source.accounting_admission});
     return await withBorrowedQuotaAccountingOwner(observationOwner, async () =>
-      withCanonicalWriter(root, goal.goal_id, request.operation === "inspect" || request.operation === "receipt" || request.dry_run === true,
+      withCanonicalWriter(root, goal.goal_id, ["inspect", "request_basis", "receipt"].includes(String(request.operation)) || request.dry_run === true,
         async () => executeGoalAmendment(await openLocalAuthorityStore(root, goal.goal_id), request,
           registryAuthoritySourceCheck({registry_source: source.registry_source}, true))));
   } catch (error) {
diff --git a/loopx/control_plane/goals/goal_amendment_runtime.py b/loopx/control_plane/goals/goal_amendment_runtime.py
index ee4439c32a..f6bdfea3e6 100644
--- a/loopx/control_plane/goals/goal_amendment_runtime.py
+++ b/loopx/control_plane/goals/goal_amendment_runtime.py
@@ -49,11 +49,12 @@ def _replan_readback(derived: Mapping[str, Any], inventory: list[dict[str, Any]]
     return rows
 
 
-def execute_goal_amendment(
+def _execute_goal_amendment(
     *, registry_path: Path, goal_id: str, goal_instance_id: str,
     operation: str, actor_agent_id: str | None,
     parameters: Mapping[str, Any] | None = None,
     runtime_root: Path | None = None, execute: bool = False,
+    request_context: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
     requested = exact_goal_ref(goal_id, goal_instance_id)
     parameters = dict(parameters or {})
@@ -67,13 +68,13 @@ def execute_goal_amendment(
         raise ValueError("source Goal requires its configured runtime root")
     root = Path(configured_root).expanduser().resolve()
     lock_goal_ref = requested
-    if operation in {"inspect", "receipt"}:
+    if operation in {"inspect", "request_basis", "receipt"}:
         lock_goal_ref, _ = current_goal_ref(initial, goal_id=goal_id, require_active=False)
     with quota_accounting_admission(runtime_root=root, registry_path=registry_path,
         goal_id=goal_id, goal_ref=lock_goal_ref, operation="goal_amendment_source_read") as admission:
         with source_session_registry_transaction(registry_path, operation="goal_amendment_source_read") as transaction:
             registry = transaction.payload_copy()
-            goal_ref, goal = current_goal_ref(registry, goal_id=goal_id, require_active=operation not in {"inspect", "receipt"})
+            goal_ref, goal = current_goal_ref(registry, goal_id=goal_id, require_active=operation not in {"inspect", "request_basis", "receipt", "abort_request"})
             configured = registry.get("common_runtime_root")
             if not isinstance(configured, str) or not configured:
                 raise ValueError("source Goal requires its configured runtime root")
@@ -97,6 +98,12 @@ def execute_goal_amendment(
                 "registry_source": transaction.source_read_witness(), "accounting_admission": admission,
                 "gate": gate, "goal_status": goal.get("status"), "registered_agents": agents,
                 "open_replan_obligations": obligations}
+            if request_context is not None:
+                source["request_entry"] = dict(request_context["entry"])
+                if request_context.get("reservation_digest") is not None:
+                    source["request_reservation_digest"] = request_context["reservation_digest"]
+                if request_context.get("preview") is True:
+                    source["request_preview"] = True
             common = {"goal_ref": requested, "actor_agent_id": actor_agent_id,
                 "runtime_root": str(root), "observed_at": now_utc_iso(), "source": source}
 
@@ -120,7 +127,7 @@ def inspect() -> dict[str, Any]:
                 result = effect_runtime_result("goal.amendment.execute", {
                     **parameters, **common, "operation": operation, "dry_run": not execute,
                 }, timeout=CANONICAL_AUTHORITY_WRITE_TIMEOUT_SECONDS)
-                if isinstance(result, dict) and operation != "receipt" and result.get("ok") is True and result.get("status") != "planned":
+                if isinstance(result, dict) and operation not in {"receipt", "request_basis"} and result.get("request_outcome") is None and result.get("ok") is True and result.get("status") != "planned":
                     # Current consumption is a separate readback; never rewrite
                     # the original operation's committed receipt or pending fact.
                     result["current_projection"] = inspect()
@@ -128,3 +135,31 @@ def inspect() -> dict[str, Any]:
     if not isinstance(result, dict):
         raise TypeError("Goal amendment owner returned an invalid result")
     return result
+
+
+def execute_goal_amendment(
+    *, registry_path: Path, goal_id: str, goal_instance_id: str,
+    operation: str, actor_agent_id: str | None,
+    parameters: Mapping[str, Any] | None = None,
+    runtime_root: Path | None = None, execute: bool = False,
+) -> dict[str, Any]:
+    """Route explicit request-derived work through its source reservation owner."""
+    params = dict(parameters or {})
+    if operation in {"abort_request", "request_basis"}:
+        raise ValueError("request effect recovery must use its original request entrypoint")
+    if "source_request" not in params:
+        return _execute_goal_amendment(registry_path=registry_path, goal_id=goal_id, goal_instance_id=goal_instance_id,
+            operation=operation, actor_agent_id=actor_agent_id, parameters=params, runtime_root=runtime_root, execute=execute)
+    if operation not in {"propose", "commit"} or actor_agent_id is None:
+        raise ValueError("source request context requires an explicit receiver proposal or commit")
+    from ..collaboration.request_amendment import execute_request_amendment, request_proposal_context
+
+    if operation == "commit":
+        return execute_request_amendment(registry_path=registry_path, runtime_root=runtime_root,
+            goal_ref=exact_goal_ref(goal_id, goal_instance_id), receiver_agent_id=actor_agent_id,
+            parameters=params, execute=execute)
+    root, context = request_proposal_context(registry_path=registry_path, runtime_root=runtime_root,
+        goal_ref=exact_goal_ref(goal_id, goal_instance_id), receiver_agent_id=actor_agent_id, reference=params["source_request"])
+    return _execute_goal_amendment(registry_path=registry_path, goal_id=goal_id, goal_instance_id=goal_instance_id,
+        operation="propose", actor_agent_id=actor_agent_id, parameters=params, runtime_root=root,
+        execute=execute, request_context=context)
diff --git a/loopx/presentation/configuration_api.py b/loopx/presentation/configuration_api.py
index a3ee395afc..a311b296dc 100644
--- a/loopx/presentation/configuration_api.py
+++ b/loopx/presentation/configuration_api.py
@@ -5,6 +5,7 @@
 from . import configuration_backup_api as backup_api
 from . import goal_ownership_api as ownership_api
 from . import goal_amendment_api as amendment_api
+from . import request_control_api as request_api
 from . import goal_storage_api as storage_api
 from .. import chat_usage_statistics_api as usage_api
 from .. import chat_goal_configuration_api as goal_api
@@ -14,6 +15,7 @@
 
 
 class ChatConfigurationRequestMixin(
+    request_api.RequestControlMixin,
     amendment_api.GoalAmendmentRequestMixin,
     storage_api.GoalStorageRequestMixin,
     ownership_api.GoalOwnershipRequestMixin,
@@ -28,6 +30,7 @@ class ChatConfigurationRequestMixin(
 
     def _configuration_get_routes(self) -> dict[str, Callable[[], None]]:
         return {
+            request_api.REQUEST_CONTROL_PATH: self._request_control_read,
             amendment_api.CHAT_GOAL_AMENDMENT_PATH: self._amendment_inspect,
             storage_api.CHAT_GOAL_STORAGE_PATH: self._storage_inspect,
             ownership_api.CHAT_GOAL_OWNERSHIP_PATH: self._ownership_inspect,
@@ -40,6 +43,7 @@ def _configuration_get_routes(self) -> dict[str, Callable[[], None]]:
 
     def _configuration_post_routes(self) -> dict[str, Callable[[], None]]:
         return {
+            request_api.REQUEST_CONTROL_PATH: self._request_control_write,
             amendment_api.CHAT_GOAL_AMENDMENT_PATH: self._amendment_configure,
             f"{storage_api.CHAT_GOAL_STORAGE_PATH}/preview": lambda: self._storage_update(action="plan-migration"),
             f"{storage_api.CHAT_GOAL_STORAGE_PATH}/apply": lambda: self._storage_update(action="migrate"),
diff --git a/loopx/presentation/goal_amendment_api.py b/loopx/presentation/goal_amendment_api.py
index d8a96f2060..5808b77918 100644
--- a/loopx/presentation/goal_amendment_api.py
+++ b/loopx/presentation/goal_amendment_api.py
@@ -14,21 +14,11 @@
 from ..control_plane.goals.goal_amendment_runtime import execute_goal_amendment
 from ..control_plane.goals.source_session_registry_state import current_goal_ref
 from ..control_plane.projects.registry_codec import load_project_registry
-from ..control_plane.runtime.runtime_projection_route import resolve_goal_source_runtime_route
+from .goal_source_routing import source_registry_for_goal
 
 CHAT_GOAL_AMENDMENT_PATH = "/api/chat/goal-amendment"
 
 
-def _source_registry(invoked: Path, goal_id: str) -> Path:
-    payload = load_project_registry(invoked)
-    if payload.get("profile_id") == "source_session_v1":
-        return invoked
-    route = resolve_goal_source_runtime_route(registry_path=invoked, goal_id=goal_id)
-    path = route.get("source_registry")
-    if not isinstance(path, str) or not path:
-        raise ValueError("Goal source authority could not be resolved")
-    return Path(path)
-
 
 def _public(value: dict[str, Any]) -> dict[str, Any]:
     # Full canonical work is used by the owning replan reader, not dumped into
@@ -68,7 +58,7 @@ def _amendment_source(self, goal_id: Any) -> Path:
         selected = getattr(self.server, "selected_goal_id", None)
         if selected and selected != goal_id:
             raise ValueError("Goal is outside this workspace")
-        return _source_registry(self.server.registry_path, goal_id)
+        return source_registry_for_goal(self.server.registry_path, goal_id)
 
     def _amendment_inspect(self) -> None:
         try:
diff --git a/loopx/presentation/goal_source_routing.py b/loopx/presentation/goal_source_routing.py
new file mode 100644
index 0000000000..179ef2a70b
--- /dev/null
+++ b/loopx/presentation/goal_source_routing.py
@@ -0,0 +1,16 @@
+"""Metadata-only source route shared by named Goal settings owners."""
+from pathlib import Path
+
+from ..control_plane.projects.registry_codec import load_project_registry
+from ..control_plane.runtime.runtime_projection_route import resolve_goal_source_runtime_route
+
+
+def source_registry_for_goal(invoked: Path, goal_id: str) -> Path:
+    payload = load_project_registry(invoked)
+    if payload.get("profile_id") == "source_session_v1":
+        return invoked
+    route = resolve_goal_source_runtime_route(registry_path=invoked, goal_id=goal_id)
+    path = route.get("source_registry")
+    if not isinstance(path, str) or not path:
+        raise ValueError("Goal source authority could not be resolved")
+    return Path(path)
diff --git a/loopx/presentation/request_control_api.py b/loopx/presentation/request_control_api.py
new file mode 100644
index 0000000000..3dd43c11d0
--- /dev/null
+++ b/loopx/presentation/request_control_api.py
@@ -0,0 +1,104 @@
+"""Source-owner request controls on the conversation that created the request."""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+from urllib.parse import parse_qs, urlparse
+
+from ..chat import redact_local_paths
+from ..feedback import validate_goal_id
+from ..control_plane.collaboration import conversation_scope
+from ..control_plane.collaboration.goal_instance_scope import collaboration_goal_scope, decide_collaboration_lifecycle
+from ..control_plane.collaboration.inbox import _entry, _read, _root
+from ..control_plane.collaboration.request_amendment import control_request
+from ..control_plane.collaboration.source_chat_observation import is_source_chat_host
+from ..control_plane.effect_runtime import EffectRuntimeRemoteError, EffectRuntimeStartupError
+from ..control_plane.goals.goal_ref_validation import exact_goal_ref
+from ..control_plane.projects.registry_codec import load_project_registry
+from ..capabilities.manager_context import target_authority
+from ..control_plane.collaboration.source_chat_observation import original_delivery_facts
+from .goal_source_routing import source_registry_for_goal
+
+REQUEST_CONTROL_PATH = "/api/chat/request-control"
+_ROUTING = {"goal_id", "goal_instance_id", "agent_id", "request_id", "session_id", "turn_id"}
+
+
+def _operator_payload(value: Any) -> Any:
+    """Preserve the authorized editable brief; redact diagnostic locations."""
+    if isinstance(value, str):
+        return redact_local_paths(value)
+    if isinstance(value, list):
+        return [_operator_payload(item) for item in value]
+    if isinstance(value, dict):
+        return {key: item if key == "brief" else _operator_payload(item) for key, item in value.items()}
+    return value
+
+
+class RequestControlMixin:
+    server: Any
+    path: str
+
+    def _send_json(self, payload: dict[str, Any], *, status: int = 200) -> None:
+        raise NotImplementedError
+
+    def _send_error(self, message: str, **kwargs: Any) -> None:
+        raise NotImplementedError
+
+    def _read_json(self, *, max_bytes: int = 256 * 1024) -> dict[str, Any]:
+        raise NotImplementedError
+
+    def _request_control_source(self, body: dict[str, Any]) -> dict[str, Any]:
+        if any(not isinstance(body.get(key), str) or not body[key] for key in _ROUTING):
+            raise ValueError("original conversation and exact request identities are required")
+        validate_goal_id(body["goal_id"])
+        selected = getattr(self.server, "selected_goal_id", None)
+        if selected and selected != body["goal_id"]:
+            raise ValueError("request is outside this Goal workspace")
+        registry = source_registry_for_goal(self.server.registry_path, body["goal_id"])
+        configured = load_project_registry(registry).get("common_runtime_root")
+        if not isinstance(configured, str) or not configured:
+            raise ValueError("request source runtime is unavailable")
+        root = Path(configured).expanduser().resolve()
+        ref = exact_goal_ref(body["goal_id"], body["goal_instance_id"])
+        store = self.server.chat_store
+        session = store.load_session(body["session_id"])
+        turn = store.load_turn(body["session_id"], body["turn_id"])
+        if not session or not turn or not conversation_scope(session, origin=turn.get("origin"))["private_conversation"]:
+            raise ValueError("request control requires its original private conversation")
+        with collaboration_goal_scope(registry, goal_id=body["goal_id"], agents=(), caller_goal_ref=ref) as scope:
+            row = _entry(root, body["goal_id"], body["agent_id"], body["request_id"], scope=scope)
+            route = _read(_root(root) / "roundtrips" / (body["request_id"] + ".json"))
+            if (row.get("source_kind") == "peer" or route.get("session_id") != session["session_id"]
+                    or route.get("client_turn_id") != turn["client_turn_id"]
+                    or not is_source_chat_host(root, route, store)):
+                raise ValueError("browser cannot control another source or impersonate a requesting Agent")
+            grant = target_authority(root, session=session, turn=turn,
+                target={"goal_id": body["goal_id"], "agent_id": body["agent_id"]})
+            decide_collaboration_lifecycle(scope, operation="original_request_inspect", record=row, route=route,
+                initial_delivery=original_delivery_facts(row, route, turn, source_id=grant["source_id"]))
+        return dict(registry_path=registry, runtime_root=root, goal_ref=ref, receiver_agent_id=body["agent_id"],
+            request_id=body["request_id"], actor_agent_id=None)
+
+    def _request_control_read(self) -> None:
+        try:
+            query = parse_qs(urlparse(self.path).query, keep_blank_values=True)
+            if set(query) != _ROUTING or any(len(value) != 1 for value in query.values()):
+                raise ValueError("request routing fields are required exactly once")
+            result = control_request(**self._request_control_source({key: values[0] for key, values in query.items()}), operation="inspect")
+            self._send_json(_operator_payload(result))
+        except (OSError, ValueError, TypeError, KeyError, EffectRuntimeRemoteError, EffectRuntimeStartupError) as exc:
+            self._send_error(redact_local_paths(str(exc)), status=400, error_code="request_control_unavailable")
+
+    def _request_control_write(self) -> None:
+        try:
+            body = self._read_json(max_bytes=128000)
+            if (set(body) != _ROUTING | {"operation", "parameters", "execute"}
+                    or body["operation"] not in {"revise", "cancel", "recover"}
+                    or not isinstance(body["parameters"], dict) or type(body["execute"]) is not bool):
+                raise ValueError("only original source correction, cancellation or recovery is accepted here")
+            result = control_request(**self._request_control_source(body), operation=body["operation"],
+                parameters=body["parameters"], execute=body["execute"])
+            self._send_json(_operator_payload(result))
+        except (OSError, ValueError, TypeError, KeyError, EffectRuntimeRemoteError, EffectRuntimeStartupError) as exc:
+            code = getattr(exc, "diagnostic_code", "request_control_unavailable")
+            self._send_error(redact_local_paths(str(exc)), status=409 if code == "request_basis_changed" else 400, error_code=code)
diff --git a/loopx/semantics/project_registry_io_manifest_v1.json b/loopx/semantics/project_registry_io_manifest_v1.json
index e66c9a1fa3..090c4cfdbe 100644
--- a/loopx/semantics/project_registry_io_manifest_v1.json
+++ b/loopx/semantics/project_registry_io_manifest_v1.json
@@ -303,7 +303,7 @@
     },
     {
       "site": "loopx/capabilities/manager_context/roundtrip.py::<module>.drain::codec_read:load_project_registry#1",
-      "line": 996,
+      "line": 985,
       "column": 22,
       "kind": "codec_read",
       "api": "load_project_registry",
@@ -823,7 +823,7 @@
     },
     {
       "site": "loopx/cli_commands/manager_inbox.py::<module>.handle_manager_inbox::codec_read:load_project_registry#1",
-      "line": 134,
+      "line": 173,
       "column": 20,
       "kind": "codec_read",
       "api": "load_project_registry",
@@ -1109,6 +1109,22 @@
       "api": "load_project_registry",
       "classification": "codec_api"
     },
+    {
+      "site": "loopx/control_plane/collaboration/request_amendment.py::<module>._root::codec_read:load_project_registry#1",
+      "line": 18,
+      "column": 18,
+      "kind": "codec_read",
+      "api": "load_project_registry",
+      "classification": "codec_api"
+    },
+    {
+      "site": "loopx/control_plane/collaboration/request_control_source.py::<module>._locked_request::codec_read:load_project_registry#1",
+      "line": 38,
+      "column": 20,
+      "kind": "codec_read",
+      "api": "load_project_registry",
+      "classification": "codec_api"
+    },
     {
       "site": "loopx/control_plane/collaboration/source_grant_observation.py::<module>._source_registry_recipients::codec_read:load_project_registry#1",
       "line": 128,
@@ -1454,16 +1470,16 @@
       "classification": "codec_api"
     },
     {
-      "site": "loopx/control_plane/goals/goal_amendment_runtime.py::<module>.execute_goal_amendment::codec_read:load_project_registry#1",
-      "line": 64,
+      "site": "loopx/control_plane/goals/goal_amendment_runtime.py::<module>._execute_goal_amendment::codec_read:load_project_registry#1",
+      "line": 65,
       "column": 15,
       "kind": "codec_read",
       "api": "load_project_registry",
       "classification": "codec_api"
     },
     {
-      "site": "loopx/control_plane/goals/goal_amendment_runtime.py::<module>.execute_goal_amendment::codec_transaction:source_session_registry_transaction#1",
-      "line": 74,
+      "site": "loopx/control_plane/goals/goal_amendment_runtime.py::<module>._execute_goal_amendment::codec_transaction:source_session_registry_transaction#1",
+      "line": 75,
       "column": 14,
       "kind": "codec_transaction",
       "api": "source_session_registry_transaction",
@@ -2183,20 +2199,28 @@
     },
     {
       "site": "loopx/presentation/goal_amendment_api.py::<module>.GoalAmendmentRequestMixin._amendment_inspect::codec_read:load_project_registry#1",
-      "line": 80,
+      "line": 70,
       "column": 24,
       "kind": "codec_read",
       "api": "load_project_registry",
       "classification": "codec_api"
     },
     {
-      "site": "loopx/presentation/goal_amendment_api.py::<module>._source_registry::codec_read:load_project_registry#1",
-      "line": 23,
+      "site": "loopx/presentation/goal_source_routing.py::<module>.source_registry_for_goal::codec_read:load_project_registry#1",
+      "line": 9,
       "column": 15,
       "kind": "codec_read",
       "api": "load_project_registry",
       "classification": "codec_api"
     },
+    {
+      "site": "loopx/presentation/request_control_api.py::<module>.RequestControlMixin._request_control_source::codec_read:load_project_registry#1",
+      "line": 58,
+      "column": 22,
+      "kind": "codec_read",
+      "api": "load_project_registry",
+      "classification": "codec_api"
+    },
     {
       "site": "loopx/project_map.py::<module>.read_only_project_map_run::codec_read:load_registry#1",
       "line": 477,
diff --git a/tsconfig.control-plane.json b/tsconfig.control-plane.json
index 944eb01a76..8353f2fce2 100644
--- a/tsconfig.control-plane.json
+++ b/tsconfig.control-plane.json
@@ -61,6 +61,7 @@
     "loopx/control_plane/goals/goal_amendment_proposal.ts",
     "loopx/control_plane/goals/goal_amendment_authority.ts",
     "tests/control_plane_ts/goal_amendment_authority.test.ts",
+    "tests/control_plane_ts/request_control.test.ts",
     "loopx/control_plane/goals/goal_instance_identity.ts",
     "loopx/control_plane/goals/chat_session_lifecycle.ts",
     "loopx/control_plane/quota/settlement_workspace_causality.ts",

From 74ff13b6c62619a9f142f276d23f5b69794d9e37 Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Tue, 13 Oct 2026 12:23:51 +0800
Subject: [PATCH 02/11] test(collaboration): qualify request cancellation and
 revision recovery

Signed-off-by: song <liusongstep@gmail.com>
---
 .../smoke/request-control-browser-smoke.mjs   |  97 ++++
 .../smoke/request-control-http-fixture.py     | 352 +++++++++++++++
 .../test_source_session_registry_denial.py    |  10 +-
 .../test_chat_request_control.py              |  68 +++
 .../test_request_amendment_recovery.py        | 415 ++++++++++++++++++
 .../goal_amendment_authority.test.ts          |  67 +++
 .../control_plane_ts/request_control.test.ts  | 146 ++++++
 7 files changed, 1154 insertions(+), 1 deletion(-)
 create mode 100644 apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
 create mode 100644 apps/presentation/dashboard/smoke/request-control-http-fixture.py
 create mode 100644 tests/control_plane/test_chat_request_control.py
 create mode 100644 tests/control_plane/test_request_amendment_recovery.py
 create mode 100644 tests/control_plane_ts/request_control.test.ts

diff --git a/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs b/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
new file mode 100644
index 0000000000..8ca3771311
--- /dev/null
+++ b/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
@@ -0,0 +1,97 @@
+// Real source registry, canonical SQLite, Chat entrance, request controls and Agent CLI.
+// Synthetic progress only; no model runs or user runtime activation.
+import assert from 'node:assert/strict';
+import {spawn} from 'node:child_process';
+import {readFile,mkdtemp,mkdir,rm} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {resolve} from 'node:path';
+import {createServer} from 'node:net';
+import {createInterface} from 'node:readline';
+import {testPythonCommand} from '../../../../scripts/test-python.mjs';
+import {launchBrowser,loadPlaywright} from '../../../../examples/dashboard-browser-smoke-support.mjs';
+const repo=resolve(import.meta.dirname,'../../../..');
+const output=resolve(repo,'output/playwright/request-control');await mkdir(output,{recursive:true});
+const root=await mkdtemp(resolve(tmpdir(),'request-control-browser-'));
+const socket=createServer();await new Promise(r=>socket.listen(0,'127.0.0.1',r));const port=socket.address().port;await new Promise(r=>socket.close(r));
+const command=testPythonCommand(await readFile(resolve(repo,'apps/presentation/dashboard/smoke/request-control-http-fixture.py'),'utf8'),{repoRoot:repo});
+const child=spawn(command.command,[...command.args,root,String(port)],{cwd:root,env:{...process.env,LOOPX_USAGE_PING:'0',TMPDIR:root,NODE_OPTIONS:'--experimental-sqlite'},stdio:['pipe','pipe','pipe']});
+let stderr='';child.stderr.on('data',x=>stderr+=String(x));
+const lines=createInterface({input:child.stdout});const replies=[];const waiting=[];
+let readyResolve,readyReject;const ready=new Promise((r,j)=>{readyResolve=r;readyReject=j;});
+lines.on('line',line=>{if(line.startsWith('Serving LoopX Chat'))readyResolve();if(line.startsWith('FIXTURE ')){const v=JSON.parse(line.slice(8));if(waiting.length)waiting.shift()(v);else replies.push(v);}});
+child.once('exit',code=>readyReject(Error(`fixture exited ${code}: ${stderr}`)));
+async function fixture(op){const result=new Promise(r=>replies.length?r(replies.shift()):waiting.push(r));child.stdin.write(op+'\n');const value=await result;assert.equal(value.fixture_error,undefined);return value;}
+let browser,page;
+try{
+ let timer; try {await Promise.race([ready,new Promise((_,j)=>{timer=setTimeout(()=>j(Error('startup timeout '+stderr)),90000);})]);} finally {clearTimeout(timer);}
+ browser=await launchBrowser(loadPlaywright().chromium);page=await browser.newPage({viewport:{width:1440,height:1100}});
+ await page.addInitScript(()=>!localStorage.getItem('loopx-pw-locale')&&localStorage.setItem('loopx-pw-locale','zh-CN'));
+ const errors=[];page.on('pageerror',e=>errors.push(e.message));
+ const writes=[];let drop=true;let droppedResolve;const dropped=new Promise(r=>{droppedResolve=r;});
+ await page.route('**/api/chat/request-control',async route=>{
+  if(route.request().method()!=='POST'||route.request().postDataJSON().execute!==true)return route.continue();
+  const body=route.request().postDataJSON();writes.push(body);
+  const response=await route.fetch();
+  if(drop&&body.operation==='revise'&&response.ok()){drop=false;await route.abort();droppedResolve();}else await route.fulfill({response});
+ });
+ await page.goto(`http://127.0.0.1:${port}/chat/`);
+ async function enter(){
+  await page.getByRole('navigation',{name:'管家视图'}).getByRole('button',{name:/^(Chat|对话)$/}).click();
+  await page.getByText('Please verify this contract. Preserve the constraints and return findings.',{exact:true}).waitFor();
+  const card=page.locator('.personal-collaboration').first();
+  await card.getByText('查看交办内容',{exact:true}).click();
+  const open=card.getByRole('button',{name:'修正或取消请求',exact:true});
+  if(await open.count())await open.click();
+  await card.locator('.personal-request-control').waitFor();
+  return card;
+ }
+ let card=await enter();let panel=card.locator('.personal-request-control');
+ await panel.getByRole('button',{name:'修正内容',exact:true}).click();
+ await panel.getByLabel('背景与补充',{exact:true}).fill('Use corrected evidence for this contract');
+ await panel.getByRole('button',{name:'保存修正',exact:true}).click();
+ await dropped;
+ await page.waitForFunction(()=>[...document.querySelectorAll('button')].find(b=>b.textContent==='重试原操作')?.disabled===false);
+ assert.equal((await fixture('inspect')).revision,2);
+ await page.reload();card=await enter();panel=card.locator('.personal-request-control');
+ await panel.getByRole('button',{name:'重试原操作',exact:true}).click();
+ await panel.getByRole('button',{name:'修正内容',exact:true}).waitFor();
+ assert.deepEqual(writes[0],writes[1]);assert.equal((await fixture('inspect')).revision,2);
+ await panel.getByRole('button',{name:'修正内容',exact:true}).click();
+ await panel.getByLabel('背景与补充',{exact:true}).fill('A stale editor must not overwrite another correction');
+ await fixture('correct');
+ await panel.getByRole('button',{name:'保存修正',exact:true}).click();
+ await panel.getByText('请求已有新修订。已重新读取，请基于当前内容修改。',{exact:true}).waitFor();
+ await panel.getByRole('button',{name:'修正内容',exact:true}).click();
+ assert.equal(await panel.getByLabel('背景与补充',{exact:true}).inputValue(),'Correction from another authorized view');
+ await panel.getByRole('button',{name:'收起编辑',exact:true}).click();
+ await fixture('receiver');await fixture('reserve');
+ await panel.getByRole('button',{name:'重新读取',exact:true}).click();
+ await panel.getByText('目标变更仍待核对',{exact:true}).waitFor();
+ await panel.screenshot({path:resolve(output,'pending-effect.png')});
+ const failedRead=async route=>route.abort();
+ await page.route('**/api/chat/request-control?*',failedRead);
+ await panel.getByRole('button',{name:'重新读取',exact:true}).click();
+ await page.waitForFunction(()=>![...document.querySelectorAll('.personal-request-control button')].some(b=>b.textContent==='取消请求'));
+ assert.equal(await panel.getByRole('button',{name:'取消请求',exact:true}).count(),0);
+ await page.unroute('**/api/chat/request-control?*',failedRead);
+ await panel.getByRole('button',{name:'重新读取',exact:true}).click();
+ await panel.getByRole('button',{name:'取消请求',exact:true}).waitFor();
+ await panel.getByRole('button',{name:'取消请求',exact:true}).click();
+ await panel.getByText('请求已取消',{exact:true}).waitFor();
+ assert.equal((await fixture('inspect')).terminal_effects[0].terminal.outcome,'aborted');
+ await panel.screenshot({path:resolve(output,'cancelled.png')});
+ await page.screenshot({path:resolve(output,'whole-viewport.png')});
+ await page.setViewportSize({width:390,height:844});
+ assert.ok(await page.locator('body').evaluate(e=>e.scrollWidth<=innerWidth+1));
+ await panel.screenshot({path:resolve(output,'narrow.png')});
+ await page.evaluate(()=>localStorage.setItem('loopx-pw-locale','en'));
+ await page.reload();
+ await page.getByRole('navigation',{name:'Manager view'}).getByRole('button',{name:'Chat',exact:true}).click();
+ const english=page.locator('.personal-collaboration').first();
+ await english.getByText('View delegation details',{exact:true}).click();
+ await english.getByText('Request cancelled',{exact:true}).waitFor();
+ await english.screenshot({path:resolve(output,'english.png')});
+ assert.deepEqual(errors,[]);
+ console.log('PASS: real source registration, normal Chat entrance, original request correction, unknown reply/reload, stale edit, independent receiver CLI, reserved effect and cancellation terminal readback.');
+}catch(error){if(page){await page.screenshot({path:resolve(output,'failure.png'),fullPage:true}).catch(()=>{});await (await import('node:fs/promises')).writeFile(resolve(output,'failure.txt'),await page.locator('body').innerText());}throw error;}
+finally{await page?.unrouteAll({behavior:"ignoreErrors"}).catch(()=>{});await browser?.close();child.kill('SIGTERM');await new Promise(r=>child.exitCode!==null?r():child.once('exit',r));lines.close();await rm(root,{recursive:true,force:true});}
diff --git a/apps/presentation/dashboard/smoke/request-control-http-fixture.py b/apps/presentation/dashboard/smoke/request-control-http-fixture.py
new file mode 100644
index 0000000000..49c90430bd
--- /dev/null
+++ b/apps/presentation/dashboard/smoke/request-control-http-fixture.py
@@ -0,0 +1,352 @@
+import json
+import signal
+import subprocess
+import sys
+import tempfile
+import threading
+from pathlib import Path
+from loopx.chat_server import serve_chat
+from loopx.chat_store import ChatSessionStore
+from loopx.capabilities.manager_context import deliver
+from loopx.control_plane.goals.goal_amendment_runtime import execute_goal_amendment
+from loopx.control_plane.collaboration.request_control_source import execute_request_control
+from loopx.control_plane.effect_runtime import restart_effect_runtime
+
+root = Path(sys.argv[1])
+port = int(sys.argv[2])
+tempfile.tempdir = str(root)
+registry = root / "project/.loopx/registry.json"
+runtime = root / "runtime"
+
+
+def cli(*args):
+    p = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "loopx.cli",
+            "--registry",
+            str(registry),
+            "--runtime-root",
+            str(runtime),
+            "--format",
+            "json",
+            *args,
+        ],
+        cwd=root,
+        capture_output=True,
+        text=True,
+        timeout=80,
+    )
+    assert p.returncode == 0, (p.stdout, p.stderr)
+    return json.loads(p.stdout)
+
+
+created = cli(
+    "project",
+    "register",
+    "--project-id",
+    "request-recovery",
+    "--project-kind",
+    "work",
+    "--knowledge-root",
+    str(root / "project"),
+    "--goal-id",
+    "request-goal",
+    "--objective",
+    "Verify the public contract",
+    "--non-goal",
+    "No remote changes",
+    "--acceptance",
+    "Independent validation passes",
+    "--next-effect",
+    "Inspect the current contract",
+    "--stop-condition",
+    "Stop when the Goal is inactive",
+    "--goal-instance-profile",
+    "source_session_v1",
+    "--operation-id",
+    "create-goal",
+    "--registered-agent",
+    "agent-a",
+    "--registered-agent",
+    "agent-b",
+    "--canonical-storage",
+    "sqlite",
+)
+ref = created["goal_ref"]
+(root / "registration.json").write_text(json.dumps(created))
+# Synthetic typed progress supplies a real replan-reader input, not model evidence.
+runs = runtime / "goals/request-goal/runs/index.jsonl"
+runs.parent.mkdir(parents=True, exist_ok=True)
+rows = [
+    {
+        "generated_at": f"2026-09-01T00:0{i}:00+00:00",
+        "goal_id": "request-goal",
+        "goal_ref": ref,
+        "agent_id": "agent-a",
+        "classification": "bounded_replan_progress",
+        "turn_instance_id": f"synthetic-{i}",
+        "progress_observation": {
+            "schema_version": "typed_progress_observation_v0",
+            "result_class": "blocked",
+            "surface_id": "contract",
+            "hypothesis_id": "request-gap",
+            "probe_kind": "check",
+            "evidence_ids": ["synthetic-evidence"],
+        },
+    }
+    for i in range(2)
+]
+runs.write_text("".join(json.dumps(r) + "\n" for r in rows))
+
+
+def goal(op, params=None, actor="agent-a", execute=False):
+    return execute_goal_amendment(
+        registry_path=registry,
+        runtime_root=runtime,
+        goal_id=ref["goal_id"],
+        goal_instance_id=ref["goal_instance_id"],
+        operation=op,
+        actor_agent_id=actor,
+        parameters=params,
+        execute=execute,
+    )
+
+
+def basis(v):
+    return {
+        "base_goal_revision": v["intent"]["goal_revision"],
+        "base_intent_digest": v["intent"]["intent_digest"],
+        "base_work_digest": v["work_digest"],
+    }
+
+
+v = goal("inspect", actor=None)
+root_config = {
+    "operation_id": "root-policy",
+    "expected_provider_revision": v["provider_revision"],
+    "root_intent": {
+        **{
+            k: v["source_commitments"][k]
+            for k in ("objective", "non_goals", "acceptance")
+        },
+        "permission_scope": {
+            "write_scopes": ["tests/**"],
+            "capabilities": ["filesystem_write"],
+        },
+        "stop_conditions": [v["source_commitments"]["stop_condition"]],
+        "terminal_conditions": ["Accepted result returned"],
+    },
+    "policy": {
+        "out_of_policy": "reject",
+        "eligible_agents": ["agent-a", "agent-b"],
+        "max_created_todos": 4,
+        "templates": [
+            {
+                "id": "check",
+                "todo": {
+                    "text": "Verify the public contract",
+                    "action_kind": "validate",
+                    "target_key": "contract-check",
+                    "required_write_scopes": ["tests/**"],
+                    "required_capabilities": ["filesystem_write"],
+                },
+            }
+        ],
+    },
+}
+assert goal("configure", root_config, actor=None, execute=True)["ok"]
+store = ChatSessionStore(runtime)
+session = store.create_session(
+    goal_id="loopx-manager",
+    agent_id="codex",
+    adapter_kind="codex_app_server",
+    upstream_thread_id="synthetic-owner",
+    channel_id="manager",
+    session_id="request-owner",
+)
+turn, _ = store.create_turn(
+    session["session_id"],
+    client_turn_id="original-source",
+    message="Please verify this contract. Preserve the constraints and return findings.",
+    origin="web",
+)
+brief = {
+    "schema_version": "collaboration_brief_v0",
+    "purpose": "Verify this contract",
+    "context": "Use the original contract fixture",
+    "constraints": ["No remote changes"],
+    "inputs": [],
+    "acceptance": ["Independent validation passes"],
+    "return_requirement": "Return checked findings",
+}
+receipt = deliver(
+    runtime,
+    registry,
+    session=session,
+    turn=turn,
+    request={"goal_id": ref["goal_id"], "agent_id": "agent-a", "brief": brief},
+    source_store=store,
+)
+store.update_turn(
+    session["session_id"],
+    turn["turn_id"],
+    status="completed",
+    response={"message": "Request recorded", "context_handoff_receipt": receipt},
+)
+store.finalize_managed_turn_completion(session["session_id"], turn["turn_id"])
+rid = receipt["request_id"]
+route = {
+    **ref,
+    "agent_id": "agent-a",
+    "request_id": rid,
+    "session_id": session["session_id"],
+    "turn_id": turn["turn_id"],
+}
+(root / "request-route.json").write_text(json.dumps(route))
+
+
+def inspect():
+    return execute_request_control(
+        registry_path=registry,
+        runtime_root=runtime,
+        goal_ref=ref,
+        receiver_agent_id="agent-a",
+        request_id=rid,
+        actor_agent_id=None,
+        operation="inspect",
+    )["view"]
+
+
+def commands():
+    try:
+        for line in sys.stdin:
+            operation = line.strip()
+            if operation == "inspect":
+                result = inspect()
+            elif operation == "receiver":
+                packet = cli(
+                    "manager-inbox",
+                    "read",
+                    "--goal-id",
+                    ref["goal_id"],
+                    "--agent-id",
+                    "agent-a",
+                )
+                item = next(x for x in packet["items"] if x["request_id"] == rid)
+                cli(
+                    "manager-inbox",
+                    "acknowledge",
+                    "--goal-id",
+                    ref["goal_id"],
+                    "--agent-id",
+                    "agent-a",
+                    "--request-id",
+                    rid,
+                    "--decision",
+                    "adopt",
+                    "--reason",
+                    "Use current source",
+                    "--request-revision",
+                    str(item["request_revision"]),
+                    "--request-digest",
+                    item["request_revision_digest"],
+                )
+                result = {"receiver_revision": item["request_revision"]}
+            elif operation == "reserve":
+                v = goal("inspect")
+                goal("adopt", {**basis(v), "operation_id": "adopt-root"}, execute=True)
+                source = inspect()
+                reference = {
+                    "request_id": rid,
+                    "request_revision": source["revision"],
+                    "request_digest": source["revision_digest"],
+                }
+                proposed = goal(
+                    "propose",
+                    {
+                        **basis(v),
+                        "source_request": reference,
+                        "operation_id": "source-proposal",
+                        "proposal_id": "request-work",
+                        "template_id": "check",
+                        "evidence_refs": ["evidence:request-gap"],
+                        "replan_obligation_id": v["replan_observations"][0][
+                            "obligation_id"
+                        ],
+                    },
+                    execute=True,
+                )
+                assert proposed["ok"], proposed
+                from loopx.control_plane.collaboration import (
+                    request_amendment as io_adapter,
+                )
+
+                real = io_adapter._goal
+
+                def lost(*a, **kw):
+                    if a[4] == "commit" and kw.get("execute"):
+                        raise OSError("Synthetic loss before known Goal outcome")
+                    return real(*a, **kw)
+
+                io_adapter._goal = lost
+                try:
+                    result = goal(
+                        "commit",
+                        {
+                            "operation_id": "reserved-effect",
+                            "source_request": reference,
+                            "proposal_id": "request-work",
+                            "proposal_digest": proposed["proposal"]["digest"],
+                        },
+                        execute=True,
+                    )
+                finally:
+                    io_adapter._goal = real
+                assert result["request_linked"] is False and result["effect"] is None, (
+                    result
+                )
+            elif operation == "correct":
+                current = inspect()
+                result = execute_request_control(
+                    registry_path=registry,
+                    runtime_root=runtime,
+                    goal_ref=ref,
+                    receiver_agent_id="agent-a",
+                    request_id=rid,
+                    actor_agent_id=None,
+                    operation="revise",
+                    parameters={
+                        "operation_id": "separate-owner-correction",
+                        "expected_revision": current["revision"],
+                        "expected_digest": current["revision_digest"],
+                        "brief": {
+                            **current["brief"],
+                            "context": "Correction from another authorized view",
+                        },
+                        "reason": "Source changed",
+                    },
+                    execute=True,
+                )
+            else:
+                raise ValueError(operation)
+            print("FIXTURE " + json.dumps(result), flush=True)
+    except Exception as exc:
+        print("FIXTURE " + json.dumps({"fixture_error": str(exc)}), flush=True)
+
+
+threading.Thread(target=commands, daemon=True).start()
+signal.signal(signal.SIGTERM, lambda *_: sys.exit(0))
+try:
+    serve_chat(
+        registry_path=registry,
+        runtime_root_override=runtime,
+        scan_roots=[root / "project"],
+        port=port,
+        codex_bin="missing-synthetic-codex",
+        claude_bin="missing-synthetic-claude",
+        kiro_cli_bin="missing-synthetic-kiro",
+    )
+finally:
+    restart_effect_runtime()
diff --git a/tests/architecture/test_source_session_registry_denial.py b/tests/architecture/test_source_session_registry_denial.py
index 7a335c5daf..95ef24e75a 100644
--- a/tests/architecture/test_source_session_registry_denial.py
+++ b/tests/architecture/test_source_session_registry_denial.py
@@ -13,6 +13,10 @@
     "loopx/control_plane/goals/goal_amendment_runtime.py",
     "loopx/control_plane/goals/source_session_registration.py",
     "loopx/presentation/goal_amendment_api.py",
+    "loopx/presentation/goal_source_routing.py",
+    "loopx/presentation/request_control_api.py",
+    "loopx/control_plane/collaboration/request_control_source.py",
+    "loopx/control_plane/collaboration/request_amendment.py",
     "loopx/attached_session.py",
     "loopx/bootstrap.py",
     "loopx/capabilities/manager_context/__init__.py",
@@ -79,7 +83,11 @@ def test_direct_project_registry_loaders_have_source_session_denial() -> None:
         "loopx/chat_server.py": {"serve_chat"},
         "loopx/chat_status_api.py": {"_status"},
         "loopx/control_plane/coordination/new_goal_storage_transport.py": {"initialize_goal_storage_target"},
-        "loopx/presentation/goal_amendment_api.py": {"_source_registry", "_amendment_inspect"},
+        "loopx/presentation/goal_amendment_api.py": {"_amendment_inspect"},
+        "loopx/presentation/goal_source_routing.py": {"source_registry_for_goal"},
+        "loopx/presentation/request_control_api.py": {"_request_control_source"},
+        "loopx/control_plane/collaboration/request_control_source.py": {"_locked_request"},
+        "loopx/control_plane/collaboration/request_amendment.py": {"_root"},
     }
     for relative, functions in named_readers.items():
         tree = ast.parse((REPO_ROOT / relative).read_text(encoding="utf-8"))
diff --git a/tests/control_plane/test_chat_request_control.py b/tests/control_plane/test_chat_request_control.py
new file mode 100644
index 0000000000..3f4f42ba33
--- /dev/null
+++ b/tests/control_plane/test_chat_request_control.py
@@ -0,0 +1,68 @@
+from __future__ import annotations
+
+from urllib.parse import urlencode
+
+from test_chat_goal_amendment import api as api
+from test_goal_amendment_authority import source_goal as source_goal
+from test_request_amendment_recovery import BRIEF
+from loopx.capabilities.manager_context import deliver
+from loopx.chat_store import ChatSessionStore
+
+
+def _source(api):
+    call, f, server = api
+    store = ChatSessionStore(f["runtime"])
+    server.chat_store = store
+    session = store.create_session(goal_id="loopx-manager", agent_id="codex", adapter_kind="codex_app_server",
+        upstream_thread_id="request-control-fixture", channel_id="manager")
+    turn, _ = store.create_turn(session["session_id"], client_turn_id="request-source", message="Check the current contract", origin="web")
+    delivered = deliver(f["runtime"], f["registry"], session=session, turn=turn,
+        request={"goal_id": f["ref"]["goal_id"], "agent_id": "agent-a", "brief": BRIEF}, source_store=store)
+    store.update_turn(session["session_id"], turn["turn_id"], status="completed", response={"context_handoff_receipt": delivered})
+    store.finalize_managed_turn_completion(session["session_id"], turn["turn_id"])
+    store.append_message(session["session_id"], role="user", text=turn["message"], turn_id=turn["turn_id"], origin="web")
+    route = {**f["ref"], "agent_id": "agent-a", "request_id": delivered["request_id"],
+        "session_id": session["session_id"], "turn_id": turn["turn_id"]}
+
+    def request(body=None, routing=None):
+        return call(body, path="/api/chat/request-control" + ("?" + urlencode(routing or route) if body is None else ""))
+    return request, call, route
+
+
+def test_original_conversation_controls_revision_and_replays_unknown_reply(api):
+    request, call, route = _source(api)
+    code, first = request()
+    assert code == 200 and first["view"]["revision"] == 1, first
+    body = {**route, "operation": "revise", "execute": False, "parameters": {
+        "operation_id": "browser-correction", "expected_revision": 1, "expected_digest": first["view"]["revision_digest"],
+        "brief": {**BRIEF, "context": "Use the corrected evidence"}, "reason": "Source correction"}}
+    assert request(body)[1]["planned"] is True
+    assert request()[1]["view"]["revision"] == 1
+    body["execute"] = True
+    code, applied = request(body)
+    assert code == 200 and applied["view"]["revision"] == 2, applied
+    assert request(body)[1]["replayed"] is True
+    stale = {**body, "parameters": {**body["parameters"], "operation_id": "stale-source"}}
+    code, refusal = request(stale)
+    assert code == 409 and refusal["error_code"] == "request_basis_changed", refusal
+    code, snapshot = call(path="/api/chat/sessions/" + route["session_id"])
+    assert code == 200
+    card = next(message["collaboration"] for message in snapshot["messages"] if message.get("collaboration"))
+    assert card["control_route"]["available"] is True and card["request_revision"] == 2
+    assert card["brief"]["context"] == "Use the corrected evidence" and card["decision"] == "pending"
+    current = request()[1]["view"]
+    cancel = {**route, "operation": "cancel", "execute": True, "parameters": {"operation_id": "browser-cancel",
+        "expected_revision": current["revision"], "expected_digest": current["revision_digest"], "reason": "Stop this request"}}
+    assert request(cancel)[1]["view"]["control_state"] == "cancelled"
+
+
+def test_browser_cannot_rebind_source_or_write_a_receiver_observation(api):
+    request, _, route = _source(api)
+    before = request()[1]["view"]
+    code, _ = request(routing={**route, "session_id": "another-session"})
+    assert code == 400
+    code, _ = request({**route, "operation": "assess", "execute": True, "parameters": {"decision": "adopt"}})
+    assert code == 400
+    code, _ = request({**route, "operation": "cancel", "execute": True, "parameters": {}, "actor_agent_id": "agent-a"})
+    assert code == 400
+    assert request()[1]["view"] == before
diff --git a/tests/control_plane/test_request_amendment_recovery.py b/tests/control_plane/test_request_amendment_recovery.py
new file mode 100644
index 0000000000..d314577621
--- /dev/null
+++ b/tests/control_plane/test_request_amendment_recovery.py
@@ -0,0 +1,415 @@
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+
+import pytest
+
+from test_goal_amendment_authority import source_goal as source_goal
+from test_goal_amendment_authority import _call as goal_call, _root as goal_root, _basis as goal_basis
+from loopx.control_plane.collaboration.peers import request as peer_request
+from loopx.control_plane.collaboration.request_control_source import execute_request_control
+from loopx.control_plane.collaboration.request_amendment import recover_request_amendment, control_request
+from loopx.control_plane.collaboration.inbox import _root, acknowledge
+from loopx.cli import main
+from loopx.collaboration_mcp import register_collaboration_tools
+from loopx.control_plane.projects.registry_codec import source_session_registry_transaction
+
+
+BRIEF = {"schema_version": "collaboration_brief_v0", "purpose": "Validate this contract",
+    "context": "Keep the original Goal constraints", "constraints": ["No remote writes"], "inputs": [],
+    "acceptance": ["Independent check passes"], "return_requirement": "Return the check result"}
+
+
+def _request(f):
+    return peer_request(f["runtime"], f["registry"], f["ref"]["goal_id"], "agent-b", "agent-a", "request-check", BRIEF,
+        caller_goal_ref=f["ref"])
+
+
+def _control(f, request_id, operation, parameters=None, *, actor="agent-b", execute=True):
+    return execute_request_control(registry_path=f["registry"], runtime_root=f["runtime"], goal_ref=f["ref"],
+        receiver_agent_id="agent-a", request_id=request_id, actor_agent_id=actor, operation=operation,
+        parameters=parameters, execute=execute)
+
+
+def _basis(view):
+    return {"expected_revision": view["revision"], "expected_digest": view["revision_digest"]}
+
+
+def _inbox(f, capsys, action, *args, actor="agent-a"):
+    command = ["--registry", str(f["registry"]), "--runtime-root", str(f["runtime"]), "--format", "json",
+        "manager-inbox", action, "--goal-id", f["ref"]["goal_id"], "--agent-id", actor, *args]
+    code = main(command)
+    return code, json.loads(capsys.readouterr().out)
+
+
+def _proposal(f, tmp_path, capsys):
+    delivered = _request(f)
+    rid = delivered["request_id"]
+    acknowledge(f["runtime"], f["ref"]["goal_id"], "agent-a", rid, "adopt", "Check the current source",
+        registry=f["registry"], caller_goal_ref=f["ref"])
+    view = _control(f, rid, "inspect", actor="agent-a")["view"]
+    source = {"request_id": rid, "request_revision": view["revision"], "request_digest": view["revision_digest"]}
+    code, goal = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    assert code == 0
+    assert goal_call(f, tmp_path, capsys, "configure", goal_root(goal), agent=None, operation_id="root", execute=True)[0] == 0
+    _, goal = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    assert goal_call(f, tmp_path, capsys, "adopt", goal_basis(goal), operation_id="adopt-root", execute=True)[0] == 0
+    code, proposed = goal_call(f, tmp_path, capsys, "propose", {**goal_basis(goal), "proposal_id": "request-proposal",
+        "template_id": "check", "evidence_refs": ["evidence:request-gap"], "replan_obligation_id": f["obligation"],
+        "source_request": source}, operation_id="propose-source", execute=True)
+    assert code == 0, proposed
+    proposal = proposed["proposal"]
+    return rid, {"source_request": source, "proposal_id": proposal["proposal_id"], "proposal_digest": proposal["digest"]}
+
+
+def test_actual_source_request_correction_cancel_and_same_operation_recovery(source_goal):
+    f = source_goal
+    delivered = _request(f)
+    rid = delivered["request_id"]
+    entry_path = next(_root(f["runtime"]).glob("entries/*/" + rid + ".json"))
+    original_bytes = entry_path.read_bytes()
+    original = json.loads(original_bytes)
+    view = _control(f, rid, "inspect")["view"]
+    assert entry_path.read_bytes() == original_bytes
+    params = {"operation_id": "correct-1", **_basis(view), "brief": {**BRIEF, "context": "The input has changed"},
+        "reason": "Read the corrected input"}
+    preview = _control(f, rid, "revise", params, execute=False)
+    assert preview["planned"] is True and preview["executed"] is False
+    assert entry_path.read_bytes() == original_bytes
+    applied = _control(f, rid, "revise", params)
+    assert applied["view"]["revision"] == 2
+    saved = entry_path.read_bytes()
+    assert _control(f, rid, "revise", params)["replayed"] is True
+    assert entry_path.read_bytes() == saved
+    stored = json.loads(saved)
+    assert {k: v for k, v in stored.items() if k != "request_control"} == original
+    assert _request(f) == {**delivered, "replayed": True}
+    assert entry_path.read_bytes() == saved
+    with pytest.raises(ValueError, match="basis changed"):
+        _control(f, rid, "revise", {**params, "operation_id": "stale-correction"})
+    with pytest.raises(ValueError, match="authenticated source"):
+        _control(f, rid, "cancel", {"operation_id": "receiver-cancel", **_basis(applied["view"]), "reason": "Cancel"}, actor="agent-a")
+    cancelled = _control(f, rid, "cancel", {"operation_id": "source-cancel", **_basis(applied["view"]), "reason": "Stop"})
+    assert cancelled["view"]["control_state"] == "cancelled"
+    assert cancelled["view"]["terminal_effects"] == []
+
+
+def test_request_control_refuses_wrong_actor_namespace_and_untrusted_effect_facts(source_goal, tmp_path):
+    f = source_goal
+    rid = _request(f)["request_id"]
+    with pytest.raises(ValueError, match="original requester or receiver"):
+        _control(f, rid, "inspect", actor="not-the-sender")
+    with pytest.raises(ValueError, match="runtime does not match"):
+        execute_request_control(registry_path=f["registry"], runtime_root=tmp_path / "unrelated", goal_ref=f["ref"],
+            receiver_agent_id="agent-a", request_id=rid, actor_agent_id="agent-b", operation="inspect")
+    with pytest.raises(ValueError, match="source-owned"):
+        _control(f, rid, "inspect", {"terminal": {"outcome": "committed"}})
+    with pytest.raises(ValueError, match="unavailable at this entrypoint"):
+        _control(f, rid, "settle", {"reservation_digest": "a" * 64})
+    with pytest.raises(ValueError, match="invalid controlled request"):
+        _control(f, "../not-a-request", "inspect")
+
+
+def test_real_request_reservation_goal_commit_and_terminal_linkage(source_goal, tmp_path, capsys):
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    before = {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")}
+    code, preview = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=False)
+    assert code == 0, preview
+    assert preview["goal_changed"] is False and preview["terminal_recorded"] is False
+    assert {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")} == before
+    code, applied = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
+    assert code == 0, applied
+    assert applied["effect"]["outcome"] == "committed"
+    assert applied["effect"]["goal_revision"] == 2
+    assert applied["request_linked"] is True and applied["request_control"]["active_reservation"] is None
+    _, goal = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    assert goal["intent"]["created_todo_ids"] == [applied["effect"]["todo_id"]]
+    saved = {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")}
+    code, replayed = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
+    assert code == 0 and replayed["effect"] == applied["effect"]
+    assert {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")} == saved
+    assert goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]["provider_revision"] == goal["provider_revision"]
+    assert _control(f, rid, "inspect")["view"]["terminal_effects"][0]["terminal"] == applied["effect"]
+
+
+def _recover(f, rid, *, execute=True):
+    return recover_request_amendment(registry_path=f["registry"], runtime_root=f["runtime"], goal_ref=f["ref"],
+        receiver_agent_id="agent-a", request_id=rid, actor_agent_id="agent-b", execute=execute)
+
+
+def _cancel(f, rid):
+    view = _control(f, rid, "inspect")["view"]
+    return _control(f, rid, "cancel", {"operation_id": "cancel-race", **_basis(view), "reason": "Stop this request"})
+
+
+@pytest.mark.parametrize("winner", ["commit", "abort"])
+def test_request_cancellation_competes_for_one_real_goal_terminal_record(source_goal, tmp_path, capsys, monkeypatch, winner):
+    from loopx.control_plane.collaboration import request_amendment as io
+
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    actual = io._goal
+    observations = []
+
+    def race(registry, root, ref, receiver, operation, parameters, **kwargs):
+        if operation != "commit" or not kwargs.get("execute"):
+            return actual(registry, root, ref, receiver, operation, parameters, **kwargs)
+        if winner == "commit":
+            response = actual(registry, root, ref, receiver, operation, parameters, **kwargs)
+        assert _cancel(f, rid)["view"]["control_state"] == "cancellation_pending"
+        observations.append(_recover(f, rid))
+        if winner == "abort":
+            response = actual(registry, root, ref, receiver, operation, parameters, **kwargs)
+        return response
+
+    monkeypatch.setattr(io, "_goal", race)
+    code, result = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
+    assert code == 0, result
+    expected = "committed" if winner == "commit" else "aborted"
+    assert result["effect"]["outcome"] == expected
+    assert observations[0]["effect"] == result["effect"]
+    assert result["request_linked"] is True
+    assert result["request_control"]["control_state"] == "cancelled"
+    _, goal = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    assert goal["intent"]["goal_revision"] == (2 if winner == "commit" else 1)
+    assert len(goal["intent"]["created_todo_ids"]) == (1 if winner == "commit" else 0)
+
+
+def test_lost_request_linkage_keeps_known_goal_effect_and_recovers_without_reapplying(source_goal, tmp_path, capsys, monkeypatch):
+    from loopx.control_plane.collaboration import request_amendment as io
+
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    actual = io._execute
+
+    def lose_link(**kwargs):
+        if kwargs["operation"] == "settle":
+            raise OSError("request linkage unavailable")
+        return actual(**kwargs)
+
+    with monkeypatch.context() as unavailable:
+        unavailable.setattr(io, "_execute", lose_link)
+        code, result = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
+    assert code == 1 and result["request_linked"] is False
+    assert result["effect"]["outcome"] == "committed" and result["effect"]["goal_changed"] is True
+    assert result["request_control"]["control_state"] == "effect_pending"
+    _, goal = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    recovered = _recover(f, rid)
+    assert recovered["ok"] and recovered["effect"] == result["effect"]
+    assert goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]["provider_revision"] == goal["provider_revision"]
+
+
+def test_unknown_goal_outcome_survives_new_process_and_late_commit_after_abort(source_goal, tmp_path, capsys, monkeypatch):
+    from loopx.control_plane.collaboration import request_amendment as io
+
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    actual = io._goal
+    queued = []
+
+    def stop_before_effect(*args, **kwargs):
+        if args[4] == "commit" and kwargs.get("execute"):
+            queued.append((args, kwargs))
+            raise OSError("worker exited before a known Goal outcome")
+        return actual(*args, **kwargs)
+
+    with monkeypatch.context() as crashed:
+        crashed.setattr(io, "_goal", stop_before_effect)
+        code, pending = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
+    assert code == 1 and pending["effect"] is None and pending["recovery_required"] is True
+    assert _control(f, rid, "inspect")["view"]["active_reservation"] is not None
+    replacement_code, replacement = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="new-identity-cannot-reassign", execute=True)
+    assert replacement_code == 1 and "cannot reserve another effect" in str(replacement)
+    assert _cancel(f, rid)["view"]["control_state"] == "cancellation_pending"
+    cancelled = _recover(f, rid)
+    assert cancelled["effect"]["outcome"] == "aborted"
+    delayed = actual(*queued[0][0], **queued[0][1])
+    assert delayed["request_outcome"] == "aborted" and delayed["goal_changed"] is False
+    request_file = tmp_path / "late-commit.json"
+    request_file.write_text(json.dumps(commit))
+    restarted = subprocess.run([sys.executable, "-m", "loopx.cli", "--registry", str(f["registry"]),
+        "--runtime-root", str(f["runtime"]), "--format", "json", "goal-amendment-proposal", "--governed", "commit",
+        "--goal-id", f["ref"]["goal_id"], "--goal-instance-id", f["ref"]["goal_instance_id"], "--agent-id", "agent-a",
+        "--operation-id", "commit-request", "--request-json", str(request_file), "--execute"],
+        cwd=tmp_path, text=True, capture_output=True, timeout=30)
+    assert restarted.returncode == 0, restarted.stderr + restarted.stdout
+    assert json.loads(restarted.stdout)["effect"] == cancelled["effect"]
+    stripped = {key: commit[key] for key in ("proposal_id", "proposal_digest")}
+    code, refusal = goal_call(f, tmp_path, capsys, "commit", stripped, operation_id="source-context-cannot-be-dropped", execute=True)
+    assert code == 1 and "source context cannot be discarded" in str(refusal)
+    assert goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]["intent"]["created_todo_ids"] == []
+
+
+def test_reserved_basis_rejection_keeps_independent_goal_work(source_goal, tmp_path, capsys):
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    _, before = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    code, independent = goal_call(f, tmp_path, capsys, "propose", {**goal_basis(before), "proposal_id": "independent-work",
+        "template_id": "check", "evidence_refs": ["evidence:independent-work"], "replan_obligation_id": f["obligation"]},
+        operation_id="independent-proposal", execute=True)
+    assert code == 0, independent
+    code, changed = goal_call(f, tmp_path, capsys, "commit", {"proposal_id": "independent-work",
+        "proposal_digest": independent["proposal"]["digest"]}, operation_id="independent-commit", execute=True)
+    assert code == 0, changed
+    _, canonical = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    code, rejected = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="obsolete-request-commit", execute=True)
+    assert code == 0 and rejected["request_linked"] is True, rejected
+    assert rejected["effect"]["outcome"] == "rejected" and rejected["effect"]["goal_changed"] is False
+    after = goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]
+    assert after["intent"] == canonical["intent"] and after["work_items"] == canonical["work_items"]
+    assert _control(f, rid, "inspect")["view"]["active_reservation"] is None
+
+
+def test_correction_before_reservation_refuses_obsolete_source_without_goal_mutation(source_goal, tmp_path, capsys):
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    current = _control(f, rid, "inspect")["view"]
+    _control(f, rid, "revise", {"operation_id": "correction-before-commit", **_basis(current),
+        "brief": {**BRIEF, "context": "The source was corrected"}, "reason": "Use new evidence"})
+    code, refusal = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
+    assert code == 1 and "basis changed" in str(refusal)
+    view = _control(f, rid, "inspect")["view"]
+    assert view["active_reservation"] is None and view["terminal_effects"] == []
+    assert view["revision"] == 2
+    assert goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]["intent"]["created_todo_ids"] == []
+
+
+def test_receiver_cli_reads_assesses_and_returns_the_correct_revision(source_goal, tmp_path, capsys):
+    f = source_goal
+    rid = _request(f)["request_id"]
+    assert _inbox(f, capsys, "acknowledge", "--request-id", rid, "--decision", "adopt", "--reason", "Original assessment")[0] == 0
+    assert _inbox(f, capsys, "report", "--request-id", rid, "--reply-text", "Original result")[0] == 0
+    original_decision = (_root(f["runtime"]) / "decisions" / (rid + ".json")).read_bytes()
+    original_result = (_root(f["runtime"]) / "replies" / rid / "conclusion.json").read_bytes()
+    view = _control(f, rid, "inspect")["view"]
+    _control(f, rid, "revise", {"operation_id": "correction-2", **_basis(view),
+        "brief": {**BRIEF, "context": "Use the corrected source"}, "reason": "Source correction"})
+    code, supplied = _inbox(f, capsys, "read")
+    assert code == 0, supplied
+    item = next(item for item in supplied["items"] if item["request_id"] == rid)
+    assert item["request_revision"] == 2 and item["brief"]["context"] == "Use the corrected source"
+    assert item["recorded_decision"] is None
+    assert item["request_read_receipt"]["supplied_revision"] == 2
+    assert "request_control" not in item
+    assert _control(f, rid, "inspect")["view"]["read_at"] is not None
+    code, assessed = _inbox(f, capsys, "acknowledge", "--request-id", rid, "--decision", "adopt", "--reason", "Use the correction",
+        "--request-revision", "2", "--request-digest", item["request_revision_digest"])
+    assert code == 0 and assessed["request_revision"] == 2, assessed
+    code, answer = _inbox(f, capsys, "report", "--request-id", rid, "--reply-text", "Revised result", "--request-revision", "2")
+    assert code == 0 and answer["request_revision"] == 2, answer
+    assert answer["result_key"] != "conclusion"
+    code, historical = _inbox(f, capsys, "report", "--request-id", rid, "--reply-text", "Original result")
+    assert code == 0 and historical["request_revision"] == 1 and historical["current_request_revision"] == 2, historical
+    assert (_root(f["runtime"]) / "decisions" / (rid + ".json")).read_bytes() == original_decision
+    assert (_root(f["runtime"]) / "replies" / rid / "conclusion.json").read_bytes() == original_result
+    assert all(item["request_id"] != rid for item in _inbox(f, capsys, "read")[1]["items"])
+    current = _control(f, rid, "inspect")["view"]
+    _control(f, rid, "revise", {"operation_id": "correction-3", **_basis(current),
+        "brief": {**BRIEF, "context": "A further correction"}, "reason": "Preserve new context"})
+    late = _inbox(f, capsys, "report", "--request-id", rid, "--reply-text", "Later evidence for original work", "--update-id", "old-evidence")
+    assert late[0] == 0 and late[1]["request_revision"] == 1
+    pending = next(item for item in _inbox(f, capsys, "read")[1]["items"] if item["request_id"] == rid)
+    assert pending["request_revision"] == 3 and pending["recorded_decision"] is None
+    assert pending["inbox_state"] == "pending"
+
+
+def test_bound_mcp_consumers_keep_revision_and_return_relations(source_goal):
+    f = source_goal
+    rid = _request(f)["request_id"]
+
+    class Server:
+        def __init__(self):
+            self.tools = {}
+
+        def tool(self, **_kwargs):
+            def register(function):
+                self.tools[function.__name__] = function
+                return function
+            return register
+
+    requester, receiver = Server(), Server()
+    for server, actor in [(requester, "agent-b"), (receiver, "agent-a")]:
+        register_collaboration_tools(server, f["runtime"], f["registry"], f["ref"]["goal_id"], actor, f["state"].parent)
+    view = requester.tools["control_peer_request"](rid, "agent-a", "inspect")["view"]
+    requester.tools["control_peer_request"](rid, "agent-a", "revise", {"operation_id": "mcp-revision", **_basis(view),
+        "brief": {**BRIEF, "context": "MCP current source"}, "reason": "Source corrected"}, execute=True)
+    current = receiver.tools["read_context"]()["items"][0]
+    assert current["request_revision"] == 2
+    receiver.tools["assess_request"](rid, "adopt", "Assess revision two", request_revision=2, request_digest=current["request_revision_digest"])
+    receiver.tools["return_result"](rid, "Result for revision two", request_revision=2)
+    result = requester.tools["read_context"]()["peer_returns"]["items"][0]
+    assert result["request_revision"] == 2 and result["current_request_revision"] == 2
+    assert result["brief"]["context"] == "MCP current source" and result["text"] == "Result for revision two"
+
+
+@pytest.mark.parametrize("unavailable", ["assessment", "receiver"])
+def test_source_can_settle_cancellation_without_reusing_lost_receiver_authority(source_goal, tmp_path, capsys, monkeypatch, unavailable):
+    from loopx.control_plane.collaboration import request_amendment as io
+
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    actual = io._goal
+
+    def stop_before_effect(*args, **kwargs):
+        if args[4] == "commit" and kwargs.get("execute"):
+            raise OSError("unknown effect")
+        return actual(*args, **kwargs)
+
+    with monkeypatch.context() as stopped:
+        stopped.setattr(io, "_goal", stop_before_effect)
+        assert goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)[0] == 1
+    if unavailable == "assessment":
+        (_root(f["runtime"]) / "decisions" / (rid + ".json")).write_text("{unavailable")
+        assert _control(f, rid, "inspect")["view"]["assessment_readback"] == "unavailable"
+    else:
+        with source_session_registry_transaction(f["registry"], operation="test_remove_receiver") as transaction:
+            data = transaction.payload_copy()
+            data["goals"][0]["coordination"]["registered_agents"] = ["agent-b"]
+            transaction.commit(data)
+    assert _cancel(f, rid)["view"]["control_state"] == "cancellation_pending"
+    recovered = _recover(f, rid)
+    assert recovered["request_linked"] is True and recovered["effect"]["outcome"] == "aborted", recovered
+    assert recovered["request_control"]["control_state"] == "cancelled"
+    assert goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]["intent"]["created_todo_ids"] == []
+
+
+def test_source_correction_aborts_unknown_effect_and_next_revision_can_continue(source_goal, tmp_path, capsys, monkeypatch):
+    from loopx.control_plane.collaboration import request_amendment as io
+
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    actual = io._goal
+
+    def unknown(*args, **kwargs):
+        if args[4] == "commit" and kwargs.get("execute"):
+            raise OSError("unknown original effect")
+        return actual(*args, **kwargs)
+
+    with monkeypatch.context() as stopped:
+        stopped.setattr(io, "_goal", unknown)
+        assert goal_call(f, tmp_path, capsys, "commit", commit, operation_id="old-effect", execute=True)[0] == 1
+    current = _control(f, rid, "inspect")["view"]
+    corrected = control_request(registry_path=f["registry"], runtime_root=f["runtime"], goal_ref=f["ref"],
+        receiver_agent_id="agent-a", request_id=rid, actor_agent_id="agent-b", operation="revise", execute=True,
+        parameters={"operation_id": "correct-unknown", **_basis(current), "brief": {**BRIEF, "context": "Continue from corrected source"}, "reason": "Use the new input"})
+    assert corrected["ok"] and corrected["view"]["control_state"] == "open", corrected
+    assert corrected["view"]["cancellation"] is None
+    assert corrected["effect_recovery"]["effect"]["outcome"] == "aborted"
+    revised = corrected["view"]
+    assert _inbox(f, capsys, "acknowledge", "--request-id", rid, "--decision", "adopt", "--reason", "Use revision two",
+        "--request-revision", "2", "--request-digest", revised["revision_digest"])[0] == 0
+    _, current_goal = goal_call(f, tmp_path, capsys, "inspect", agent=None)
+    source = {"request_id": rid, "request_revision": 2, "request_digest": revised["revision_digest"]}
+    code, proposal = goal_call(f, tmp_path, capsys, "propose", {**goal_basis(current_goal), "source_request": source,
+        "proposal_id": "corrected-proposal", "template_id": "check", "evidence_refs": ["evidence:corrected-source"],
+        "replan_obligation_id": f["obligation"]}, operation_id="propose-correction", execute=True)
+    assert code == 0, proposal
+    new_commit = {"source_request": source, "proposal_id": "corrected-proposal", "proposal_digest": proposal["proposal"]["digest"]}
+    code, applied = goal_call(f, tmp_path, capsys, "commit", new_commit, operation_id="new-effect", execute=True)
+    assert code == 0 and applied["effect"]["outcome"] == "committed", applied
+    old = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="old-effect", execute=True)[1]
+    assert old["effect"]["outcome"] == "aborted"
+    assert len(goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]["intent"]["created_todo_ids"]) == 1
diff --git a/tests/control_plane_ts/goal_amendment_authority.test.ts b/tests/control_plane_ts/goal_amendment_authority.test.ts
index 4350f1a267..dd5f417869 100644
--- a/tests/control_plane_ts/goal_amendment_authority.test.ts
+++ b/tests/control_plane_ts/goal_amendment_authority.test.ts
@@ -11,6 +11,8 @@ import {SqliteAuthorityStore} from "../../loopx/control_plane/coordination/sqlit
 import {coordinationTodoReadModel} from "../../loopx/control_plane/coordination/coordination_projection.ts";
 import {TODO_DOMAIN_READ_RECORD_SCHEMA} from "../../loopx/control_plane/coordination/coordination_state_contract.ts";
 import {executeGoalAmendment} from "../../loopx/control_plane/goals/goal_amendment_authority.ts";
+import {projectRequestAmendmentReceipt} from "../../loopx/control_plane/goals/goal_amendment_authority.ts";
+import {planRequestControl, requestControlView} from "../../loopx/control_plane/collaboration/request_control.ts";
 import {executeCoordinationTodoClaim} from "../../loopx/control_plane/coordination/todo_claim.ts";
 import {canonicalAuthoritySha256} from "../../loopx/control_plane/coordination/authority_store_codec.ts";
 import type {JsonObject} from "../../loopx/control_plane/effect_program.ts";
@@ -32,6 +34,71 @@ function basis(view: JsonObject): JsonObject {
   return {base_goal_revision: intent.goal_revision, base_intent_digest: intent.intent_digest, base_work_digest: view.work_digest};
 }
 for (const provider of ["file", "sqlite", "postgresql"] as const) {
+  for (const winner of ["commit", "abort_request", "correction"] as const) {
+    test(`${provider}: one request terminal wins ${winner}, including concurrent retry and lost linkage`,
+      {skip: provider === "postgresql" && !process.env.LOOPX_TEST_POSTGRES_URL}, async t => {
+      const directory = await mkdtemp(join(tmpdir(), "request-amendment-owner-"));
+      t.after(() => rm(directory, {recursive: true, force: true}));
+      let store: AuthorityStore;
+      if (provider === "postgresql") {
+        const pool = new Pool({connectionString: process.env.LOOPX_TEST_POSTGRES_URL}); t.after(() => pool.end());
+        const database = {connect: async () => {const client = await pool.connect(); return {
+          query: (sql: string, values?: readonly unknown[]) => client.query(sql, values ? [...values] : undefined), release: () => client.release()};}};
+        await installPostgreSqlAuthorityStoreSchema(database, "postgresql:" + "b".repeat(32));
+        store = new PostgreSqlAuthorityStore(database, {tenant_id: directory, goal_id: goalRef.goal_id});
+      } else store = provider === "file" ? new FileAuthorityStore(directory, goalRef.goal_id) : new SqliteAuthorityStore(directory, goalRef.goal_id);
+      await store.commitAuthority({expected_provider_revision: null, operation_id: "seed", events: [], receipts: [], next_projection: {
+        goal_id: goalRef.goal_id, todos: [], leases: [], todo_read_model: coordinationTodoReadModel([], TODO_DOMAIN_READ_RECORD_SCHEMA)}});
+      const initial = await store.loadAuthority(); if (initial.status !== "loaded") throw new Error("missing");
+      await executeGoalAmendment(store, request("configure", {actor_agent_id: null, operation_id: "root", root_intent: rootIntent,
+        policy, expected_provider_revision: initial.provider_revision}));
+      const goal = await executeGoalAmendment(store, request("request_basis"));
+      await executeGoalAmendment(store, request("adopt", {...basis(goal), operation_id: "adopt-root"}));
+      let entry: JsonObject = {schema_version: "loopx_manager_context_entry_v2", request_id: "a".repeat(64), goal_id: goalRef.goal_id,
+        goal_ref: goalRef, agent_id: "agent-a", source_kind: "peer", source_agent_id: "agent-b", source_id: "peer:source", delivered_at: "2026-10-12T00:00:00Z",
+        brief: {schema_version: "collaboration_brief_v0", purpose: "Validate the contract", context: "Use the current source", constraints: ["No remote changes"],
+          inputs: [], acceptance: ["Independent check passes"], return_requirement: "Return findings"}};
+      const legacy = {request_id: entry.request_id, goal_ref: goalRef, goal_id: goalRef.goal_id, agent_id: "agent-a",
+        decision: "adopt", reason: "Check this request", decided_at: entry.delivered_at};
+      const control = (operation: string, fields: JsonObject, actor: "source" | "receiver", extra: JsonObject = {}) => {
+        const result = planRequestControl({entry, input: {operation, ...fields}, source: {actor, actor_agent_id: actor === "source" ? "agent-b" : "agent-a",
+          goal_active: true, observed_at: entry.delivered_at, legacy_assessment: legacy, ...extra}});
+        if (result.changed) entry = result.entry as JsonObject; return result;
+      };
+      const observed = requestControlView(entry, legacy);
+      const sourceRequest = {request_id: entry.request_id, request_revision: observed.revision, request_digest: observed.revision_digest};
+      const prepared = await executeGoalAmendment(store, request("propose", {...basis(goal), operation_id: "propose", proposal_id: "request-proposal",
+        template_id: "contract-check", replan_obligation_id: obligation, evidence_refs: ["evidence:request"],
+        source_request: sourceRequest, source: {...source, request_entry: entry}}));
+      const proposal = prepared.proposal as JsonObject;
+      const reserved = control("reserve", {operation_id: "reserve", expected_revision: observed.revision, expected_digest: observed.revision_digest}, "receiver",
+        {amendment: {operation_id: "effect", proposal_id: proposal.proposal_id, proposal_digest: proposal.digest, ...basis(goal),
+          authority_source_sha256: goal.authority_source_sha256}});
+      const reservation = (reserved.result as JsonObject).reservation as JsonObject;
+      const oldSource = structuredClone(entry);
+      if (winner === "correction") control("revise", {operation_id: "correct", expected_revision: observed.revision,
+        expected_digest: observed.revision_digest, brief: {...entry.brief as JsonObject, context: "Use the corrected input"}, reason: "Input changed"}, "source");
+      else control("cancel", {operation_id: "cancel", expected_revision: observed.revision, expected_digest: observed.revision_digest, reason: "Stop this request"}, "source");
+      const effect = (operation: "commit" | "abort_request", snapshot: JsonObject) => request(operation, {
+        operation_id: "effect", proposal_id: proposal.proposal_id, proposal_digest: proposal.digest,
+        source: {...source, request_entry: snapshot, request_reservation_digest: reservation.digest}});
+      const before = await store.loadAuthority();
+      const first = await executeGoalAmendment(store, effect(winner === "correction" ? "abort_request" : winner, winner === "commit" ? oldSource : entry));
+      assert.equal(first.request_outcome, winner === "commit" ? "committed" : "aborted");
+      const retries = await Promise.all([executeGoalAmendment(store, effect("commit", oldSource)), executeGoalAmendment(store, effect("abort_request", entry))]);
+      assert.ok(retries.every(row => row.request_outcome === first.request_outcome));
+      const receipt = await executeGoalAmendment(store, request("receipt", {receipt_operation_id: "effect"}));
+      const terminal = projectRequestAmendmentReceipt({entry, reservation_digest: reservation.digest, receipt}).terminal as JsonObject;
+      assert.equal((requestControlView(entry).active_reservation as JsonObject).digest, reservation.digest);
+      control("settle", {operation_id: "link", reservation_digest: reservation.digest}, "source", {terminal});
+      assert.equal(requestControlView(entry).active_reservation, null);
+      assert.equal(requestControlView(entry).control_state, winner === "correction" ? "open" : "cancelled");
+      const after = await store.loadAuthority(); if (after.status !== "loaded" || before.status !== "loaded") throw new Error("missing");
+      assert.equal((after.head.todos as unknown[]).length, winner === "commit" ? 1 : 0);
+      if (winner !== "commit") assert.deepEqual(after.head, before.head);
+      assert.equal((receipt.receipts as unknown[]).length, 1);
+    });
+  }
   test(`${provider}: governed commit publishes one work item and basis; response loss replays original receipt`, {skip: provider === "postgresql" && !process.env.LOOPX_TEST_POSTGRES_URL}, async t => {
     const directory = await mkdtemp(join(tmpdir(), "amendment-owner-"));t.after(() => rm(directory, {recursive: true, force: true}));
     let store: AuthorityStore;
diff --git a/tests/control_plane_ts/request_control.test.ts b/tests/control_plane_ts/request_control.test.ts
new file mode 100644
index 0000000000..d3d6bb9d89
--- /dev/null
+++ b/tests/control_plane_ts/request_control.test.ts
@@ -0,0 +1,146 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import {planRequestControl, planControlledRequestPublication, requestControlView} from "../../loopx/control_plane/collaboration/request_control.ts";
+import type {JsonObject} from "../../loopx/control_plane/effect_program.ts";
+
+const brief = {schema_version: "collaboration_brief_v0", purpose: "Validate the draft", context: "Keep the original constraints",
+  constraints: ["Do not publish"], inputs: [], acceptance: ["Independent check passes"], return_requirement: "Return findings"};
+const ref = {goal_id: "request-goal", goal_instance_id: "ginst_" + "a".repeat(32)};
+const original = {schema_version: "loopx_manager_context_entry_v2", request_id: "a".repeat(64), goal_id: ref.goal_id,
+  goal_ref: ref, agent_id: "receiver", source_kind: "peer", source_agent_id: "requester", source_id: "peer:original",
+  parent_request_id: null, inherited_context: null, message: brief.purpose, brief, instruction: "Original guide"};
+const at = "2026-01-01T00:00:00Z";
+const legacy = {request_id: original.request_id, goal_id: ref.goal_id, goal_ref: ref, agent_id: original.agent_id,
+  decision: "adopt", reason: "Check this request", decided_at: at};
+const amendment = {authority_source_sha256: "b".repeat(64), proposal_id: "proposal-1", proposal_digest: "c".repeat(64),
+  base_goal_revision: 1, base_intent_digest: "d".repeat(64), base_work_digest: "e".repeat(64), operation_id: "commit-1"};
+function fixture() {
+  let entry: JsonObject = {...original, delivered_at: at};
+  const view = () => requestControlView(entry, legacy);
+  const basis = () => ({expected_revision: view().revision, expected_digest: view().revision_digest});
+  const run = (operation: string, params: JsonObject, actor = "source", extras: JsonObject = {}) => {
+    const result = planRequestControl({entry, input: {operation, ...params}, source: {
+      actor, actor_agent_id: actor === "receiver" ? "receiver" : "requester", observed_at: at,
+      goal_active: true, legacy_assessment: legacy, amendment, ...extras}});
+    if (result.changed) entry = result.entry as JsonObject;
+    return result;
+  };
+  const reserve = () => run("reserve", {operation_id: "reserve-1", ...basis()}, "receiver");
+  const terminal = (outcome: "committed" | "aborted" | "rejected") => {
+    const active = view().active_reservation as JsonObject;
+    return {operation_id: "commit-1", reservation_digest: active.digest, outcome, goal_ref: ref,
+      goal_changed: outcome === "committed", goal_revision: outcome === "committed" ? 2 : null,
+      todo_id: outcome === "committed" ? "todo-created" : null, receipt_sha256: "f".repeat(64)};
+  };
+  return {view, basis, run, reserve, terminal, entry: () => entry};
+}
+
+test("request correction preserves original identity and does not inherit old assessment", () => {
+  const f = fixture(), old = f.basis();
+  assert.equal(f.entry().request_control, undefined);
+  f.run("revise", {operation_id: "correction-1", ...old, brief: {...brief, context: "Use the corrected input"}, reason: "Input changed"});
+  assert.equal(f.view().revision, 2); assert.equal(f.view().assessment, null);
+  assert.deepEqual(f.entry().brief, brief);
+  assert.throws(() => f.run("reserve", {operation_id: "reserve-old", ...old}, "receiver"), /basis changed/);
+  assert.throws(f.reserve, /adopt this exact/);
+  const projected = planControlledRequestPublication({request: {...original, instruction: "New generated guide"}, operation: original, entry: f.entry()});
+  assert.equal(projected.replayed, true); assert.deepEqual(projected.entry, f.entry());
+  assert.throws(() => planControlledRequestPublication({request: {...original, brief: {...brief, purpose: "Other task"}}, operation: original, entry: f.entry()}), /identity conflict/);
+});
+
+test("cancellation before reservation prevents any new effect", () => {
+  const f = fixture(), basis = f.basis();
+  const input = {operation_id: "cancel-1", ...basis, reason: "Stop this request"};
+  f.run("cancel", input);
+  assert.equal(f.view().control_state, "cancelled");
+  assert.throws(f.reserve, /cannot reserve/);
+  const before = structuredClone(f.entry());
+  assert.equal(f.run("cancel", input).replayed, true);
+  assert.deepEqual(f.entry(), before);
+  assert.throws(() => f.run("cancel", {...input, reason: "Different cancellation"}), /identity conflict/);
+});
+
+for (const outcome of ["committed", "aborted", "rejected"] as const) {
+  test(`pending cancellation only settles from the exact ${outcome} Goal receipt`, () => {
+    const f = fixture(); f.reserve();
+    f.run("cancel", {operation_id: "cancel-1", ...f.basis(), reason: "Stop this request"});
+    assert.equal(f.view().control_state, "cancellation_pending");
+    const terminal = f.terminal(outcome);
+    assert.throws(() => f.run("settle", {operation_id: "link-1", reservation_digest: terminal.reservation_digest}, "receiver",
+      {terminal: {...terminal, operation_id: "another-commit"}}), /does not match/);
+    f.run("settle", {operation_id: "link-1", reservation_digest: terminal.reservation_digest}, "receiver", {terminal});
+    assert.equal(f.view().control_state, "cancelled");
+    assert.equal(f.view().active_reservation, null);
+    assert.deepEqual((f.view().terminal_effects as JsonObject[])[0].terminal, terminal);
+    // The original reservation receipt stays readable after cancellation;
+    // its historical replay is not a fresh effect or a reopened fence.
+    assert.equal(f.reserve().replayed, true);
+    assert.equal(f.view().active_reservation, null);
+    assert.throws(() => f.run("reserve", {operation_id: "reserve-new", ...f.basis()}, "receiver",
+      {amendment: {...amendment, operation_id: "commit-new"}}), /cannot reserve/);
+  });
+}
+
+test("correction during an effect preserves its old revision until receipt linkage", () => {
+  const f = fixture(); f.reserve(); const reserved = structuredClone(f.view().active_reservation);
+  f.run("revise", {operation_id: "correct-2", ...f.basis(), brief: {...brief, purpose: "Check revised draft"}, reason: "Draft changed"});
+  assert.equal(f.view().revision, 2); assert.deepEqual(f.view().active_reservation, reserved);
+  const current = f.view();
+  f.run("assess", {operation_id: "assess-2", revision: current.revision, revision_digest: current.revision_digest,
+    decision: "adopt", reason: "Use the revised source"}, "receiver");
+  assert.throws(() => f.run("reserve", {operation_id: "reserve-2", ...f.basis()}, "receiver",
+    {amendment: {...amendment, operation_id: "commit-2", proposal_id: "proposal-2"}}), /cannot reserve/);
+  const terminal = f.terminal("aborted");
+  f.run("settle", {operation_id: "link-1", reservation_digest: terminal.reservation_digest}, "receiver", {terminal});
+  const result = f.run("reserve", {operation_id: "reserve-2", ...f.basis()}, "receiver",
+    {amendment: {...amendment, operation_id: "commit-2", proposal_id: "proposal-2"}});
+  const bound = ((result.result as JsonObject).reservation as JsonObject).binding as JsonObject;
+  assert.equal(bound.attempt_epoch, 2); assert.equal(bound.request_revision, 2);
+});
+
+test("read evidence stays with the supplied revision; a receiver cannot correct source intent", () => {
+  const f = fixture(), initial = f.view();
+  assert.throws(() => f.run("revise", {operation_id: "forged-change", ...f.basis(), brief, reason: "Change"}, "receiver"), /authenticated source/);
+  f.run("revise", {operation_id: "source-change", ...f.basis(), brief: {...brief, context: "Corrected"}, reason: "Source correction"});
+  f.run("read", {operation_id: "read-old", revision: initial.revision, revision_digest: initial.revision_digest}, "receiver");
+  assert.equal(f.view().read_at, null);
+  assert.throws(() => f.run("assess", {operation_id: "assess-old", revision: initial.revision,
+    revision_digest: initial.revision_digest, decision: "adopt", reason: "Old source"}, "receiver"), /stale/);
+});
+
+test("every admitted large request effect keeps space for cancellation and terminal linkage", () => {
+  let admitted = 0;
+  for (const characters of [28000, 30000, 31000, 32000]) {
+    let entry: JsonObject = {...original, message: "界".repeat(characters),
+      brief: {...brief, context: "x".repeat(5500)}, delivered_at: at};
+    const run = (operation: string, fields: JsonObject, actor: string, extra: JsonObject = {}) => {
+      const result = planRequestControl({entry, input: {operation, ...fields}, source: {actor,
+        actor_agent_id: actor === "source" ? "requester" : "receiver", goal_active: true,
+        observed_at: at, legacy_assessment: legacy, amendment, ...extra}});
+      if (result.changed) entry = result.entry as JsonObject;
+      return result;
+    };
+    let view = requestControlView(entry, legacy);
+    try {
+      run("revise", {operation_id: "large-revision", expected_revision: view.revision, expected_digest: view.revision_digest,
+        brief: {...brief, context: "y".repeat(5500)}, reason: "r".repeat(2000)}, "source");
+      view = requestControlView(entry, legacy);
+      run("assess", {operation_id: "large-assessment", revision: view.revision, revision_digest: view.revision_digest,
+        decision: "adopt", reason: "Read the revision"}, "receiver");
+      run("reserve", {operation_id: "large-reserve", expected_revision: view.revision, expected_digest: view.revision_digest}, "receiver");
+    } catch (error) {
+      assert.match(String(error), /capacity/); continue;
+    }
+    admitted++;
+    view = requestControlView(entry, legacy);
+    const reservation = view.active_reservation as JsonObject;
+    run("cancel", {operation_id: "c".repeat(160), expected_revision: view.revision, expected_digest: view.revision_digest,
+      reason: "界".repeat(2000)}, "source");
+    const terminal = {operation_id: "commit-1", reservation_digest: reservation.digest, outcome: "aborted", goal_ref: ref,
+      goal_changed: false, goal_revision: null, todo_id: null, receipt_sha256: "f".repeat(64)};
+    run("settle", {operation_id: "s".repeat(160), reservation_digest: reservation.digest}, "receiver", {terminal});
+    assert.equal(requestControlView(entry).control_state, "cancelled");
+    assert.ok(Buffer.byteLength(JSON.stringify(entry), "utf8") <= 128000);
+  }
+  assert.ok(admitted > 0, "The workload must exercise an admitted reservation");
+});

From c0b68cb3fbf5698651d25ee6433007d5f405eaaf Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Tue, 13 Oct 2026 12:23:51 +0800
Subject: [PATCH 03/11] docs(collaboration): describe source request control
 and recovery

Signed-off-by: song <liusongstep@gmail.com>
---
 ...oal-alignment-and-governed-amendment-v0.md | 100 ++++++++++++++++++
 ...ignment-and-governed-amendment-v0.zh-CN.md |  70 ++++++++++++
 2 files changed, 170 insertions(+)

diff --git a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
index 55fe8c4f8b..9cac30e6a2 100644
--- a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
+++ b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
@@ -986,6 +986,106 @@ stops new operations; retain historical readers and fences and use the existing
 lifecycle owner for forward retirement. Never remove committed intent to resume
 an old writer.
 
+### 9.4 Local request-derived changes and cancellation recovery
+
+The local candidate now connects §5.1 to the existing request and Goal owners.
+It requires an exact `source_session_v1` Goal, the configured local runtime,
+existing canonical File/SQLite authority, frozen Goal intent/policy, and a
+local private request addressed to a registered receiver. An independently
+bound host execution or external source is not qualified by this profile.
+No command below activates a Goal, launches a model, or grants more work scope.
+
+The existing request entry retains its original message, brief and identity.
+Its `collaboration_request_control_v0` field owns ordered corrections, per-revision
+read/assessment facts, one unresolved effect reservation and operation receipts.
+`request_control_contract.ts` owns the bounded wire values shared by the Goal
+owner and frontend. These are request-domain contracts, not additional entries
+or proof claims in the original 26-vocabulary acceptance.
+
+A `goal_request_work_graph_amendment_v0` proposal carries an exact
+`source_request` reference: `request_id`, `request_revision`, `request_digest`.
+Before commit the request owner reserves the original operation with that
+reference, receiver, proposal, Goal/work/intent basis and actual authority-source
+identity. The Goal owner's existing work planner still decides the allowed delta.
+Commit and source-authorized conditional abort compete for the same durable
+operation receipt. A lost response remains unresolved until that receipt is read
+and linked back to the request; an absent receipt or a fresh operation id does
+not release the reservation. A definitive stale Goal basis records `rejected`
+without changing Goal work. Current request state and the historical Goal outcome
+are separate observations.
+
+A correction may advance the request while the old reserved effect is unknown.
+The source entry attempts conditional abort after recording that correction.
+The old binding remains immutable; another effect cannot begin until its exact
+terminal receipt is linked. Cancellation before reservation closes admission.
+Cancellation after reservation remains pending; if commit already won, the
+result reports that committed Goal change and retains its created work. It does
+not claim rollback, cancel independent Goal work, or settle its execution or
+acceptance. Source/provider identity changes retain a recovery hold rather than
+writing an abort into another authority store.
+
+**Owner journey.** Open the original private conversation's delegation details.
+Edit the brief or cancel the request there; Goal/receiver/source identities are
+already bound to the original message. Saving validates and writes in one user
+gesture. A failed current read clears current controls. Unknown write responses
+retain the original request across reload; retry that exact operation. A typed
+stale-basis refusal reloads the latest revision for editing. Pending cancellation
+and committed/aborted/rejected outcomes remain distinct. Historical Goal instances
+remain read-only here; this is not restored-runtime authorization.
+
+**Receiver journey.** `manager-inbox read` supplies the current brief, revision,
+digest and `source_request` reference. Acknowledge with `--request-revision N
+--request-digest DIGEST`, and report with `--request-revision N`. MCP
+`assess_request` and `return_result` accept the same explicit revision fields.
+An omitted revision continues to name original revision 1; late original results
+remain appendable without satisfying a newer request. A new revision's first
+conclusion uses the existing immutable result-update chain automatically.
+Returned peer and conversation results identify their source revision.
+
+Use the existing governed proposal fields plus `source_request` when proposing
+this request's fixed-template work. Commit with the retained `proposal_id`,
+`proposal_digest`, `source_request` and stable `--operation-id`; the adapter
+reserves and links through the real owners. Removing source context from a
+request-derived proposal does not make its commit independent.
+
+The original requester can inspect, revise, cancel or recover through:
+
+```sh
+loopx --registry REGISTRY --runtime-root RUNTIME --format json manager-inbox control \
+  --goal-id GOAL --goal-instance-id INSTANCE --agent-id REQUESTER \
+  --peer-agent-id RECEIVER --request-id REQUEST --control-operation inspect
+```
+
+For `revise`/`cancel`, supply `--operation-id` and `--control-file` containing
+`expected_revision`, `expected_digest`, `reason`, and (for revise) the complete
+`brief`; use `--execute` to write. Omit `--agent-id` only for the authenticated
+original local conversation owner. `recover --execute` reads the original
+terminal receipt and may conditionally abort an already cancelled or superseded reservation;
+it never reassigns an unknown effect. The bound peer MCP `control_peer_request`
+uses the same source owner. Browser writes cannot impersonate a receiver/peer.
+
+Limits: eight request revisions, sixteen effect reservations, sixty-four request
+operation receipts and the existing 128,000-byte entry read boundary. Admission
+reserves space for a maximum legal cancellation and terminal linkage, including
+JSON escaping; oversized new work is refused before persistence. Replays do not
+consume additional capacity. Source text and artifacts keep their existing
+owners and limits; there is no new automatic private-locator service.
+
+Validation combines actual source registration, request IO, canonical File/SQLite
+transactions, independent CLI/MCP consumers, original-conversation HTTP and
+packaged UI; shared Goal transactions also require isolated real PostgreSQL.
+Synthetic source progress observations are not model behavior. General request
+reassignment, arbitrary host effects, live Lark/model qualification, restored
+writer activation and whole M2/G1 acceptance remain unqualified. Existing Lark
+tracking consumes the same revision/control facts with its audience filtering;
+no live transport send is inferred from readback tests.
+
+Before use, the code can be reverted. After control/proposal records exist,
+stop new admission and retain readers, original request/Goal receipts and fences.
+Do not erase the control field or roll back only one side to make work eligible.
+Restoration and a wider runtime/profile rollout retain their existing ownership
+and qualification gates.
+
 ## 10. Staged delivery
 
 1. **Stage 0 — characterization and RFC.** Record own-lane, unclaimed,
diff --git a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
index ac56394739..a03118844d 100644
--- a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
+++ b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
@@ -806,6 +806,76 @@ Root/proposal/adoption/commit 历史用 `--governed receipt`，JSON 请求包含
 amendment 和真实模型协作仍单独待验。禁用入口只停止新操作；保留历史 reader/fence，
 使用既有生命周期 owner 前向退休，不能删除 intent 来恢复旧 writer。
 
+### 9.4 本地来源请求变更与取消恢复
+
+本地候选已将 §5.1 接到既有请求与 Goal owner。首个 profile 要求精确的
+`source_session_v1` Goal、配置的本地 runtime、既有 canonical File/SQLite、已固定的
+目标意图和策略，以及交给注册接收者的本地私有请求。独立绑定的 Host 执行和外部
+来源尚未获此 profile 资格；这些入口不激活 Goal、不启动模型，也不扩展工作权限。
+
+原请求条目保留最初的消息、brief 和身份，其 `collaboration_request_control_v0`
+字段保存有序修正、各修订的读取/判断、唯一未决 effect 预留和操作回执。
+`request_control_contract.ts` 统一 Goal owner 与前端的有界 wire 值；它们属于请求
+领域契约，不扩张原 26 项词表验收，也不新增其形式证明声明。
+
+`goal_request_work_graph_amendment_v0` 提案携带 `source_request` 的
+`request_id`、`request_revision`、`request_digest`。提交前，请求 owner 将原操作、
+接收者、提案、Goal/work/intent basis 和实际 authority source 身份固定为预留；
+Goal 仍复用既有工作规划规则。提交和来源授权的条件中止竞争同一持久终态回执。
+丢响应、缺回执或换一个操作 ID 都不能释放预留；必须读取并关联原终态。明确过期
+的 Goal basis 写入 `rejected` 终态但不修改工作。当前请求状态与历史 Goal 结果分开。
+
+预留后仍可修正请求。记录修正后，来源入口对旧预留尝试条件中止；旧绑定保持不变，终态关联前不能开始第二个 effect。预留前
+取消关闭准入；预留后取消保持待核对。若提交先赢，显示已发生的目标变更并保留
+新增工作，不声称回滚、取消独立 Goal 工作或完成其执行/验收。来源或 provider
+身份变化会保留恢复缺口，不在另一个 store 中伪造中止。
+
+**用户路径：** 打开原私有对话中的交办详情，就地修改 brief 或取消；无需重填
+Goal、接收者或来源标识。保存以一次用户操作完成校验和写入。读取失败清除当前
+控制视图；未知写入结果跨刷新保留原请求，重试仍用同一操作。类型化 basis 过期
+拒绝会重新读取当前版本供编辑。取消待核对与已提交/已中止/已拒绝分别展示。
+历史 Goal 实例在此只读，不授予恢复后的运行权。
+
+**接收者路径：** `manager-inbox read` 提供当前 brief、修订、摘要和
+`source_request`。判断使用 `--request-revision N --request-digest DIGEST`，结果
+回传使用 `--request-revision N`；MCP `assess_request`、`return_result` 支持同一
+修订字段。省略修订仍指原始版本 1，迟到证据不会被重绑到新版本；新修订的首次
+结论自动使用既有不可变结果更新链。同伴和原对话回读都标识来源修订。
+
+为此请求提出固定模板变更时，在既有 governed proposal 字段中保留
+`source_request`。提交使用原 `proposal_id`、`proposal_digest`、`source_request`
+及稳定 `--operation-id`；适配器贯通真实预留与回执关联。删除提案来源上下文不能
+把来源请求变更伪装成独立提交。
+
+原发起者通过以下命令查询、修正、取消或恢复：
+
+```sh
+loopx --registry REGISTRY --runtime-root RUNTIME --format json manager-inbox control \
+  --goal-id GOAL --goal-instance-id INSTANCE --agent-id REQUESTER \
+  --peer-agent-id RECEIVER --request-id REQUEST --control-operation inspect
+```
+
+`revise`/`cancel` 携带 `--operation-id` 和 `--control-file`，JSON 包含
+`expected_revision`、`expected_digest`、`reason`，修正另含完整 `brief`；写入需要
+`--execute`。只有原本地对话的已验证 owner 可省略 `--agent-id`。`recover --execute`
+读取原终态，可条件中止已取消或已被修正取代的预留，不能重派未知 effect。绑定同伴的 MCP
+`control_peer_request` 复用同一 owner；浏览器不能模拟接收者或同伴。
+
+容量为八个修订、十六个 effect 预留、六十四个请求操作回执，并保留既有
+128,000 字节条目读取边界。新工作准入按合法取消说明的最大 JSON 编码成本和
+终态关联预留空间，超限在落盘前拒绝；重放不新增容量占用。来源正文/产物沿用
+原 owner 和边界，没有新的私有 locator 自动发现服务。
+
+验收覆盖真实来源注册、请求 IO、File/SQLite Goal 事务、独立 CLI/MCP 消费者、
+原对话 HTTP 和打包界面；共享 Goal 事务还须经过隔离真实 PostgreSQL。合成进度
+不是模型行为。通用重派、任意 Host effect、真实飞书/模型、恢复后 writer 激活和
+完整 M2/G1 仍未获资格。飞书 tracking 复用相同修订/控制事实和受众过滤，不能把
+回读测试当成真实发送证据。
+
+使用前可回退代码；产生新控制/提案记录后，应停止新准入并保留 reader、原请求与
+Goal 回执及 fence。不能删除 control 字段或只回滚其中一个 owner 来恢复可执行性。
+恢复与更广 runtime/profile 的推广仍遵循原 owner 和资格门限。
+
 ## 10. 分阶段交付
 
 1. **Stage 0 — characterization 与 RFC。** 记录 own-lane、unclaimed、

From 1e60496067ade46673c1e7bef14c0af89a007020 Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Tue, 13 Oct 2026 12:35:22 +0800
Subject: [PATCH 04/11] refactor(collaboration): type source and receipt
 adapters

Signed-off-by: song <liusongstep@gmail.com>
---
 loopx/control_plane/collaboration/inbox.py           |  7 ++++---
 .../collaboration/peer_context_observation.py        |  7 ++++++-
 .../control_plane/collaboration/request_amendment.py |  7 +++++--
 .../collaboration/source_chat_observation.py         | 12 +++++++-----
 4 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/loopx/control_plane/collaboration/inbox.py b/loopx/control_plane/collaboration/inbox.py
index df8b4ff7fb..8b9b052d58 100644
--- a/loopx/control_plane/collaboration/inbox.py
+++ b/loopx/control_plane/collaboration/inbox.py
@@ -447,11 +447,12 @@ def acknowledge(
     return {"ok": True, **value}
 
 
-def _now():
+def _now() -> str:
     return datetime.now(timezone.utc).isoformat()
 
 
-def _entry(root, goal_id, agent_id, request_id, *, scope=None):
+def _entry(root: Path, goal_id: str, agent_id: str, request_id: str, *,
+           scope: CollaborationGoalScope | None = None) -> dict[str, Any]:
     if not isinstance(request_id, str) or not BARE_SHA256_PATTERN.fullmatch(request_id):
         raise ValueError("invalid context request id")
     target = _target(goal_id, agent_id, scope)
@@ -524,7 +525,7 @@ def record_read(
                 )
 
 
-def _receipt(root, lane, row):
+def _receipt(root: Path, lane: str, row: dict[str, Any]) -> tuple[dict[str, Any], str | None]:
     path = _root(root) / lane / (row["request_id"] + ".json")
     if not path.exists():
         return {}, None
diff --git a/loopx/control_plane/collaboration/peer_context_observation.py b/loopx/control_plane/collaboration/peer_context_observation.py
index c7c0c7535a..fc57060a5b 100644
--- a/loopx/control_plane/collaboration/peer_context_observation.py
+++ b/loopx/control_plane/collaboration/peer_context_observation.py
@@ -1,11 +1,16 @@
 """Observe existing parent records and source grants for typed peer admission."""
 
+from pathlib import Path
+from typing import Any
+
+from .goal_instance_scope import CollaborationGoalScope
 from .inbox import _entry, _read, _root
 from . import conversation_scope
 from ..effect_runtime import EffectRuntimeRejected, effect_runtime_result
 
 
-def require_parent_context_access(root, registry, parent, target_agent_id, *, scope):
+def require_parent_context_access(root: Path, registry: Path, parent: dict[str, Any], target_agent_id: str,
+                                  *, scope: CollaborationGoalScope) -> dict[str, Any]:
     # Follow references, not recursively copied context or model-authored claims.
     # Every row is loaded under the same Goal instance and addressed recipient.
     original = parent
diff --git a/loopx/control_plane/collaboration/request_amendment.py b/loopx/control_plane/collaboration/request_amendment.py
index 25fe720cb2..857dee3414 100644
--- a/loopx/control_plane/collaboration/request_amendment.py
+++ b/loopx/control_plane/collaboration/request_amendment.py
@@ -44,7 +44,8 @@ def _reservation(snapshot: Mapping[str, Any], operation_id: Any) -> dict[str, An
 
 
 def _goal(registry: Path, root: Path, ref: Mapping[str, str], receiver: str,
-          operation: str, parameters: Mapping[str, Any], *, context=None, execute=False):
+          operation: str, parameters: Mapping[str, Any], *, context: Mapping[str, Any] | None = None,
+          execute: bool = False) -> dict[str, Any]:
     return _execute_goal_amendment(registry_path=registry, runtime_root=root, goal_id=ref["goal_id"],
         goal_instance_id=ref["goal_instance_id"], actor_agent_id=None if operation == "receipt" else receiver,
         operation=operation, parameters=parameters, request_context=context, execute=execute)
@@ -81,6 +82,8 @@ def _finish(*, registry: Path, root: Path, ref: Mapping[str, str], receiver: str
         "legacy_assessment": snapshot["_legacy_assessment"],
         "legacy_assessment_unavailable": snapshot["_legacy_assessment_unavailable"],
         "legacy_read": snapshot["_legacy_read"], "legacy_read_unavailable": snapshot["_legacy_read_unavailable"], "source_current": current})
+    if not isinstance(result, dict):
+        raise TypeError("request effect owner returned an invalid readback")
     if errors:
         result["readback_errors"] = errors
     if attempt_observation:
@@ -166,7 +169,7 @@ def control_request(*, registry_path: Path, runtime_root: Path, goal_ref: Mappin
                     receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
                     operation: str, parameters: Mapping[str, Any] | None = None, execute: bool = False) -> dict[str, Any]:
     """Shared source UI/CLI path; cancellation settles only through its owner."""
-    common = dict(registry_path=registry_path, runtime_root=runtime_root, goal_ref=goal_ref,
+    common: dict[str, Any] = dict(registry_path=registry_path, runtime_root=runtime_root, goal_ref=goal_ref,
         receiver_agent_id=receiver_agent_id, request_id=request_id, actor_agent_id=actor_agent_id)
     if operation == "recover":
         if parameters:
diff --git a/loopx/control_plane/collaboration/source_chat_observation.py b/loopx/control_plane/collaboration/source_chat_observation.py
index 4c203c18d1..e6c5549ab5 100644
--- a/loopx/control_plane/collaboration/source_chat_observation.py
+++ b/loopx/control_plane/collaboration/source_chat_observation.py
@@ -5,25 +5,26 @@
 """
 
 from pathlib import Path
+from typing import Any
 
 from ...chat_store import (
-    CHAT_SESSION_SCHEMA_VERSION, CHAT_TURN_SCHEMA_VERSION, _opaque_id, _read_json,
+    CHAT_SESSION_SCHEMA_VERSION, CHAT_TURN_SCHEMA_VERSION, ChatSessionStore, _opaque_id, _read_json,
 )
 
 
-def _source_chat_root(coordination_root, route):
+def _source_chat_root(coordination_root: Path, route: dict[str, Any]) -> Path:
     locator = route.get("source_chat_runtime_root", str(Path(coordination_root).resolve()))
     if not isinstance(locator, str) or not locator or not Path(locator).is_absolute():
         raise ValueError("original source Chat store provenance is invalid")
     return Path(locator).resolve()
 
 
-def is_source_chat_host(coordination_root, route, store):
+def is_source_chat_host(coordination_root: Path, route: dict[str, Any], store: ChatSessionStore) -> bool:
     """Match frozen provenance before a host admits or mutates a shared return."""
     return _source_chat_root(coordination_root, route) == store.root.parent.resolve()
 
 
-def observe_source_chat(coordination_root, route):
+def observe_source_chat(coordination_root: Path, route: dict[str, Any]) -> tuple[dict[str, Any], dict[str, Any]]:
     source_root = _source_chat_root(coordination_root, route)
     session_id = _opaque_id(route.get("session_id"), field="session_id")
     client_turn_id = _opaque_id(route.get("client_turn_id"), field="client_turn_id")
@@ -53,7 +54,8 @@ def trusted_source_chat_root(store, route):
     return str(root)
 
 
-def original_delivery_facts(row, route, turn, *, source_id):
+def original_delivery_facts(row: dict[str, Any], route: dict[str, Any], turn: dict[str, Any],
+                            *, source_id: str | None) -> dict[str, Any]:
     # Adapt trusted store/authority facts only. The common typed owner decides
     # whether a committed handoff survived a lost caller response.
     identity = {key: row[key] for key in ("request_id", "goal_id", "agent_id", "source_id", "goal_ref") if key in row}

From 41b22a51a1116bd75aa5d47fec7356e27be0935d Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Tue, 13 Oct 2026 12:57:10 +0800
Subject: [PATCH 05/11] fix(collaboration): return interim progress for each
 request revision

Signed-off-by: song <liusongstep@gmail.com>
---
 .../smoke/request-control-browser-smoke.mjs   |  5 +-
 .../smoke/request-control-http-fixture.py     | 25 +++++++-
 ...oal-alignment-and-governed-amendment-v0.md |  4 ++
 ...ignment-and-governed-amendment-v0.zh-CN.md |  4 +-
 .../capabilities/manager_context/roundtrip.py | 19 +++---
 loopx/control_plane/collaboration/inbox.py    |  4 +-
 .../collaboration/result_publication.ts       | 27 ++++++--
 .../project_registry_io_manifest_v1.json      |  2 +-
 .../test_chat_request_control.py              | 62 +++++++++++++++++++
 .../test_request_amendment_recovery.py        | 37 +++++++++++
 10 files changed, 168 insertions(+), 21 deletions(-)

diff --git a/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs b/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
index 8ca3771311..8a878c0408 100644
--- a/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
+++ b/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
@@ -64,7 +64,10 @@ try{
  await panel.getByRole('button',{name:'修正内容',exact:true}).click();
  assert.equal(await panel.getByLabel('背景与补充',{exact:true}).inputValue(),'Correction from another authorized view');
  await panel.getByRole('button',{name:'收起编辑',exact:true}).click();
- await fixture('receiver');await fixture('reserve');
+ await fixture('receiver');await fixture('interim');
+ await page.reload();card=await enter();panel=card.locator('.personal-request-control');
+ await page.getByText('Checking the corrected request',{exact:true}).waitFor();
+ await fixture('reserve');
  await panel.getByRole('button',{name:'重新读取',exact:true}).click();
  await panel.getByText('目标变更仍待核对',{exact:true}).waitFor();
  await panel.screenshot({path:resolve(output,'pending-effect.png')});
diff --git a/apps/presentation/dashboard/smoke/request-control-http-fixture.py b/apps/presentation/dashboard/smoke/request-control-http-fixture.py
index 49c90430bd..6e62527a71 100644
--- a/apps/presentation/dashboard/smoke/request-control-http-fixture.py
+++ b/apps/presentation/dashboard/smoke/request-control-http-fixture.py
@@ -9,7 +9,9 @@
 from loopx.chat_store import ChatSessionStore
 from loopx.capabilities.manager_context import deliver
 from loopx.control_plane.goals.goal_amendment_runtime import execute_goal_amendment
-from loopx.control_plane.collaboration.request_control_source import execute_request_control
+from loopx.control_plane.collaboration.request_control_source import (
+    execute_request_control,
+)
 from loopx.control_plane.effect_runtime import restart_effect_runtime
 
 root = Path(sys.argv[1])
@@ -254,6 +256,27 @@ def commands():
                     item["request_revision_digest"],
                 )
                 result = {"receiver_revision": item["request_revision"]}
+            elif operation == "interim":
+                current = inspect()
+                result = cli(
+                    "manager-inbox",
+                    "report",
+                    "--goal-id",
+                    ref["goal_id"],
+                    "--agent-id",
+                    "agent-a",
+                    "--request-id",
+                    rid,
+                    "--phase",
+                    "decision",
+                    "--reply-text",
+                    "Checking the corrected request",
+                    "--request-revision",
+                    str(current["revision"]),
+                )
+                from loopx.capabilities.manager_context.roundtrip import drain
+
+                drain(runtime, registry, store, lambda *_: None)
             elif operation == "reserve":
                 v = goal("inspect")
                 goal("adopt", {**basis(v), "operation_id": "adopt-root"}, execute=True)
diff --git a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
index 9cac30e6a2..0f5fc8f85c 100644
--- a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
+++ b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
@@ -1040,6 +1040,10 @@ digest and `source_request` reference. Acknowledge with `--request-revision N
 An omitted revision continues to name original revision 1; late original results
 remain appendable without satisfying a newer request. A new revision's first
 conclusion uses the existing immutable result-update chain automatically.
+For a conversation return, `--phase decision` retains one immutable interim
+update per revision. An older conclusion cannot suppress a newer revision's
+interim update; an available conclusion for that same revision supersedes its
+unsent interim update. Original decision/result records remain unchanged.
 Returned peer and conversation results identify their source revision.
 
 Use the existing governed proposal fields plus `source_request` when proposing
diff --git a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
index a03118844d..ccb803db1f 100644
--- a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
+++ b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
@@ -840,7 +840,9 @@ Goal、接收者或来源标识。保存以一次用户操作完成校验和写
 `source_request`。判断使用 `--request-revision N --request-digest DIGEST`，结果
 回传使用 `--request-revision N`；MCP `assess_request`、`return_result` 支持同一
 修订字段。省略修订仍指原始版本 1，迟到证据不会被重绑到新版本；新修订的首次
-结论自动使用既有不可变结果更新链。同伴和原对话回读都标识来源修订。
+结论自动使用既有不可变结果更新链。原对话回传的 `--phase decision` 按修订
+保留一条不可变中途进展；旧结论不能压掉新修订的进展，同一修订已有结论时才
+收起尚未发送的进展。原始判断与结果记录保持不变。同伴和原对话回读都标识来源修订。
 
 为此请求提出固定模板变更时，在既有 governed proposal 字段中保留
 `source_request`。提交使用原 `proposal_id`、`proposal_digest`、`source_request`
diff --git a/loopx/capabilities/manager_context/roundtrip.py b/loopx/capabilities/manager_context/roundtrip.py
index e5e8712f15..13ab78e69b 100644
--- a/loopx/capabilities/manager_context/roundtrip.py
+++ b/loopx/capabilities/manager_context/roundtrip.py
@@ -35,7 +35,7 @@
     _request_lock,
     iter_result_paths,
     result_paths,
-    result_identity_matches,
+    inspect_result_identity,
     prior_result_delivered,
 )
 from ...control_plane.content_digest import BARE_SHA256_PATTERN
@@ -301,7 +301,7 @@ def report(
 def reply_status(root, row):
     result = []
     for path in result_paths(_root(root) / "replies" / row["request_id"]):
-        phase = "decision" if path.stem == "decision" else "conclusion"
+        phase = "decision" if path.stem == "decision" or path.stem.startswith("decision-") else "conclusion"
         state_path = path.with_name(path.stem + ".delivery.json")
         try:
             reply = _read(path)
@@ -416,9 +416,10 @@ def _exact_return_context(root, registry, store, path, state_path, now):
             reply["request_id"],
             scope=scope,
         )
+        inspected = inspect_result_identity(reply, row, path)
         if (
             path.parent.name != row["request_id"]
-            or not result_identity_matches(reply, row, path)
+            or inspected is None
             or any(
                 reply.get(key) != row.get(key)
                 for key in ("source_id", "goal_ref")
@@ -498,9 +499,7 @@ def _exact_return_context(root, registry, store, path, state_path, now):
                 and now.isoformat() < state["retry_at"]
             ):
                 return None
-            if path.stem == "decision" and (
-                path.parent / "conclusion.json"
-            ).exists():
+            if inspected["interim_superseded"]:
                 _write(
                     state_path,
                     {
@@ -1018,9 +1017,10 @@ def drain(root, registry, store, external_sender, *, now=None, cancelled=lambda:
                 row = _entry(
                     root, reply["goal_id"], reply["agent_id"], reply["request_id"]
                 )
+                inspected = inspect_result_identity(reply, row, path)
                 if (
                     path.parent.name != row["request_id"]
-                    or not result_identity_matches(reply, row, path)
+                    or inspected is None
                     or reply.get("source_id") != row["source_id"]
                 ):
                     raise ValueError("return_reply_identity_mismatch")
@@ -1050,10 +1050,7 @@ def drain(root, registry, store, external_sender, *, now=None, cancelled=lambda:
                         scope, operation="original_return_admit", record=row, route=route,
                         initial_delivery=original_delivery_facts(row, route, turn, source_id=grant.get("source_id")),
                     )
-                if (
-                    path.stem == "decision"
-                    and (path.parent / "conclusion.json").exists()
-                ):
+                if inspected["interim_superseded"]:
                     _write(
                         state_path,
                         {"status": "superseded", "reason": "conclusion_ready"},
diff --git a/loopx/control_plane/collaboration/inbox.py b/loopx/control_plane/collaboration/inbox.py
index 8b9b052d58..4d43398b03 100644
--- a/loopx/control_plane/collaboration/inbox.py
+++ b/loopx/control_plane/collaboration/inbox.py
@@ -638,7 +638,7 @@ def result_paths(folder: Path):
     """Enumerate the result-store layout, excluding delivery and lock sidecars."""
     paths = [path for path in folder.glob("*.json")
              if path.stem in {"decision", "conclusion"}
-             or re.fullmatch(r"conclusion-[0-9]{8}", path.stem)]
+             or re.fullmatch(r"(?:conclusion|decision)-[0-9]{8}", path.stem)]
     return sorted(paths, key=lambda path: (path.stem not in {"decision", "conclusion"},
                                           path.stem != "decision", path.stem))
 
@@ -648,7 +648,7 @@ def inspect_result_identity(reply, row, path):
 
     try:
         observations = [_result_observation(path.stem, reply)]
-        if reply.get("update_id") is not None:
+        if reply.get("update_id") is not None or reply.get("phase") == "decision":
             observations = [_result_observation(candidate.stem, _read(candidate))
                             for candidate in result_paths(path.parent)]
         legacy = _observe_receipt(path.parent.parent.parent / "decisions" / (row["request_id"] + ".json")) if (
diff --git a/loopx/control_plane/collaboration/result_publication.ts b/loopx/control_plane/collaboration/result_publication.ts
index d4af7b14c1..ce42acea48 100644
--- a/loopx/control_plane/collaboration/result_publication.ts
+++ b/loopx/control_plane/collaboration/result_publication.ts
@@ -9,6 +9,12 @@ import {requestRevisionReceiptContext} from "./request_control.ts";
 // Local storage keys, not task status or authority. Updates keep the existing
 // conclusion phase and append immutable observations in publication order.
 const UPDATE_KEY = /^conclusion-[0-9]{8}$/;
+// One immutable interim observation per source revision, in the same result
+// store. The original decision key and conclusion update chain stay readable.
+const REVISION_DECISION_KEY = /^decision-[0-9]{8}$/;
+function decisionKey(revision: number): string {
+  return revision === 1 ? "decision" : `decision-${String(revision).padStart(8, "0")}`;
+}
 const UPDATE_ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,119}$/;
 
 export function resultAttachmentRefs(params: JsonObject): JsonObject {
@@ -87,6 +93,15 @@ export function collaborationResultObservations(request: JsonObject, observation
     previous = receipt.key;
   }
   for (const receipt of results.filter((r) => !UPDATE_KEY.test(r.key))) {
+    if (REVISION_DECISION_KEY.test(receipt.key)) {
+      if (receipt.value.phase !== "decision" || receipt.value.result_key !== receipt.key
+          || typeof receipt.value.request_revision !== "number" || receipt.value.request_revision <= 1
+          || receipt.key !== decisionKey(receipt.value.request_revision)
+          || receipt.value.update_id !== undefined || receipt.value.previous_result_key !== undefined) {
+        throw new EffectRuntimeRequestError("revision decision receipt identity conflict");
+      }
+      continue;
+    }
     if (!["decision", "conclusion"].includes(receipt.key) || receipt.value.phase !== receipt.key) {
       throw new EffectRuntimeRequestError("result receipt identity conflict");
     }
@@ -123,23 +138,27 @@ export function planCollaborationResult(params: JsonObject): JsonObject {
   if (isUpdate && (phase !== "conclusion" || !conclusion)) {
     throw new EffectRuntimeRequestError("a result update requires an initial conclusion");
   }
-  const old = isUpdate ? updates.find((r) => r.value.update_id === updateId) : results.find((r) => r.key === phase);
+  const initialKey = phase === "decision" ? decisionKey(Number(revision)) : phase;
+  const old = isUpdate ? updates.find((r) => r.value.update_id === updateId) : results.find((r) => r.key === initialKey);
   const value: JsonObject = Object.fromEntries(["request_id", "goal_id", "agent_id", "source_id", "goal_ref"]
     .filter((key) => request[key] !== undefined).map((key) => [key, request[key]]));
   Object.assign(value, { phase, decision, text: params.text.trim() });
   if (context !== null) Object.assign(value, {request_revision: context.revision, request_revision_digest: context.revision_digest});
   if (attachments.length) value.attachments = attachments;
-  const key = old?.key ?? (isUpdate ? `conclusion-${String(updates.length + 1).padStart(8, "0")}` : phase);
+  const key = old?.key ?? (isUpdate ? `conclusion-${String(updates.length + 1).padStart(8, "0")}` : initialKey);
+  if (phase === "decision" && key !== phase) value.result_key = key;
   if (isUpdate) Object.assign(value, { result_key: key, update_id: updateId, previous_result_key: old?.value.previous_result_key ?? previous });
   if (old && (old.textSha256 !== createHash("sha256").update(String(value.text)).digest("hex") || old.value.phase !== phase
       || (old.value.request_revision ?? 1) !== revision
       || JSON.stringify(old.attachments) !== JSON.stringify(attachments))) {
     throw new EffectRuntimeRequestError("reply already committed; conflicting replacement rejected; use a stable update_id for a later conclusion");
   }
-  if (!old && phase === "decision" && conclusion && (conclusion.value.request_revision ?? 1) === revision) {
+  const interimSuperseded = phase === "decision" && results.some(r =>
+    r.value.phase === "conclusion" && (r.value.request_revision ?? 1) === revision);
+  if (!old && interimSuperseded) {
     throw new EffectRuntimeRequestError("cannot publish an intermediate decision after conclusion");
   }
-  return { result_key: key, value, replay: old !== undefined,
+  return { result_key: key, value, replay: old !== undefined, interim_superseded: interimSuperseded,
     ...(context === null ? {} : {request_revision: context.revision, current_request_revision: context.current_revision, request_brief: context.brief}) };
 }
 
diff --git a/loopx/semantics/project_registry_io_manifest_v1.json b/loopx/semantics/project_registry_io_manifest_v1.json
index 090c4cfdbe..3019ae47b9 100644
--- a/loopx/semantics/project_registry_io_manifest_v1.json
+++ b/loopx/semantics/project_registry_io_manifest_v1.json
@@ -303,7 +303,7 @@
     },
     {
       "site": "loopx/capabilities/manager_context/roundtrip.py::<module>.drain::codec_read:load_project_registry#1",
-      "line": 985,
+      "line": 984,
       "column": 22,
       "kind": "codec_read",
       "api": "load_project_registry",
diff --git a/tests/control_plane/test_chat_request_control.py b/tests/control_plane/test_chat_request_control.py
index 3f4f42ba33..abfeb00618 100644
--- a/tests/control_plane/test_chat_request_control.py
+++ b/tests/control_plane/test_chat_request_control.py
@@ -66,3 +66,65 @@ def test_browser_cannot_rebind_source_or_write_a_receiver_observation(api):
     code, _ = request({**route, "operation": "cancel", "execute": True, "parameters": {}, "actor_agent_id": "agent-a"})
     assert code == 400
     assert request()[1]["view"] == before
+
+
+def test_revised_request_interim_return_is_independent_of_old_results(api, capsys):
+    from test_request_amendment_recovery import _inbox
+    from loopx.capabilities.manager_context.roundtrip import drain
+    from loopx.control_plane.collaboration.inbox import _root
+
+    request, call, route = _source(api)
+    _, f, server = api
+    rid = route["request_id"]
+    assert _inbox(f, capsys, "acknowledge", "--request-id", rid,
+        "--decision", "adopt", "--reason", "Original assessment")[0] == 0
+    assert _inbox(f, capsys, "report", "--request-id", rid, "--phase", "decision",
+        "--reply-text", "Checking original evidence")[0] == 0
+    original = _root(f["runtime"]) / "replies" / rid / "decision.json"
+    original_bytes = original.read_bytes()
+    assert _inbox(f, capsys, "report", "--request-id", rid,
+        "--reply-text", "Original conclusion")[0] == 0
+
+    def revise(number):
+        current = request()[1]["view"]
+        body = {**route, "operation": "revise", "execute": True, "parameters": {
+            "operation_id": f"correction-{number}", "expected_revision": current["revision"],
+            "expected_digest": current["revision_digest"], "brief": {**BRIEF, "context": f"New evidence {number}"},
+            "reason": "Source correction"}}
+        code, result = request(body)
+        assert code == 200, result
+        current = result["view"]
+        assert _inbox(f, capsys, "acknowledge", "--request-id", rid, "--decision", "adopt",
+            "--reason", "Read revised evidence", "--request-revision", str(number),
+            "--request-digest", current["revision_digest"])[0] == 0
+
+    def report(number, text, phase="decision"):
+        code, result = _inbox(f, capsys, "report", "--request-id", rid, "--phase", phase,
+            "--reply-text", text, "--request-revision", str(number))
+        assert code == 0, result
+        return result
+
+    def returned():
+        drain(f["runtime"], f["registry"], server.chat_store, lambda *_: None)
+        code, snapshot = call(path="/api/chat/sessions/" + route["session_id"])
+        assert code == 200
+        return [row for row in snapshot["messages"] if row.get("origin") == "manager_followup"]
+
+    revise(2)
+    second = report(2, "Checking corrected evidence")
+    assert report(2, "Checking corrected evidence")["result_key"] == second["result_key"]
+    messages = returned()
+    current = next(row for row in messages if "Checking corrected evidence" in row["text"])
+    assert current["return_delivery"]["request_revision"] == 2
+    assert current["return_delivery"]["phase"] == "decision"
+    assert all("Checking original evidence" not in row["text"] for row in messages)
+    assert original.read_bytes() == original_bytes
+    report(2, "Corrected conclusion", "conclusion")
+    returned()
+    revise(3)
+    report(3, "An interim update superseded by its own result")
+    report(3, "Third revision conclusion", "conclusion")
+    messages = returned()
+    assert all("An interim update superseded" not in row["text"] for row in messages)
+    assert sum("Third revision conclusion" in row["text"] for row in messages) == 1
+    assert len(returned()) == len(messages)
diff --git a/tests/control_plane/test_request_amendment_recovery.py b/tests/control_plane/test_request_amendment_recovery.py
index d314577621..9a4f032e92 100644
--- a/tests/control_plane/test_request_amendment_recovery.py
+++ b/tests/control_plane/test_request_amendment_recovery.py
@@ -316,6 +316,43 @@ def test_receiver_cli_reads_assesses_and_returns_the_correct_revision(source_goa
     assert pending["inbox_state"] == "pending"
 
 
+def test_unknown_request_effect_does_not_block_a_new_independent_request(source_goal, tmp_path, capsys, monkeypatch):
+    from loopx.control_plane.collaboration import request_amendment as io
+
+    f = source_goal
+    rid, commit = _proposal(f, tmp_path, capsys)
+    original = io._goal
+
+    def lost(*args, **kwargs):
+        if args[4] == "commit" and kwargs.get("execute"):
+            raise OSError("Effect outcome is unknown")
+        return original(*args, **kwargs)
+
+    with monkeypatch.context() as changed:
+        changed.setattr(io, "_goal", lost)
+        code, pending = goal_call(f, tmp_path, capsys, "commit", commit,
+            operation_id="pending-request-effect", execute=True)
+        assert code == 1 and pending["effect"] is None, pending
+    second = peer_request(f["runtime"], f["registry"], f["ref"]["goal_id"], "agent-b", "agent-a",
+        "independent-request", BRIEF, caller_goal_ref=f["ref"])["request_id"]
+    assert second != rid
+    acknowledge(f["runtime"], f["ref"]["goal_id"], "agent-a", second, "adopt", "Independent request",
+        registry=f["registry"], caller_goal_ref=f["ref"])
+    basis = _control(f, second, "inspect")["view"]
+    source = {"request_id": second, "request_revision": basis["revision"], "request_digest": basis["revision_digest"]}
+    current = goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]
+    code, proposed = goal_call(f, tmp_path, capsys, "propose", {**goal_basis(current), "proposal_id": "independent-proposal",
+        "template_id": "check", "evidence_refs": ["evidence:independent-request"], "replan_obligation_id": f["obligation"],
+        "source_request": source}, operation_id="propose-independent", execute=True)
+    assert code == 0, proposed
+    code, result = goal_call(f, tmp_path, capsys, "commit", {"source_request": source,
+        "proposal_id": proposed["proposal"]["proposal_id"], "proposal_digest": proposed["proposal"]["digest"]},
+        operation_id="commit-independent", execute=True)
+    assert code == 0 and result["effect"]["outcome"] == "committed", result
+    assert _control(f, rid, "inspect")["view"]["active_reservation"] is not None
+    assert _control(f, second, "inspect")["view"]["active_reservation"] is None
+
+
 def test_bound_mcp_consumers_keep_revision_and_return_relations(source_goal):
     f = source_goal
     rid = _request(f)["request_id"]

From 1675f570d32f06cc3b564e1511e6bbe3126bfa60 Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Tue, 13 Oct 2026 13:18:20 +0800
Subject: [PATCH 06/11] fix(collaboration): scope revision guidance to
 controlled request reads

Signed-off-by: song <liusongstep@gmail.com>
---
 loopx/cli_commands/manager_inbox.py                    | 9 ++++++---
 tests/control_plane/test_request_amendment_recovery.py | 3 +++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/loopx/cli_commands/manager_inbox.py b/loopx/cli_commands/manager_inbox.py
index 2a5ed9f735..40ac411cd0 100644
--- a/loopx/cli_commands/manager_inbox.py
+++ b/loopx/cli_commands/manager_inbox.py
@@ -235,10 +235,13 @@ def handle_manager_inbox(args, registry_path, runtime_root):
             result["followthrough"] += (
                 " CLI: record assessment with manager-inbox acknowledge; optionally associate existing work "
                 "with manager-inbox link. Return audience-ready results with manager-inbox report "
-                "--phase conclusion --reply-text; use --phase decision for meaningful interim news. "
-                "When request_revision is supplied, acknowledge with --request-revision and --request-digest, "
-                "and report with --request-revision. Omitted revision stays bound to original revision 1."
+                "--phase conclusion --reply-text; use --phase decision for meaningful interim news."
             )
+            if any(item.get("request_revision") is not None for item in result.get("items", [])):
+                result["followthrough"] += (
+                    " When request_revision is supplied, acknowledge with --request-revision and --request-digest, "
+                    "and report with --request-revision. Omitted revision stays bound to original revision 1."
+                )
         elif args.manager_inbox_action == "report":
             from ..capabilities.manager_context.roundtrip import report
 
diff --git a/tests/control_plane/test_request_amendment_recovery.py b/tests/control_plane/test_request_amendment_recovery.py
index 9a4f032e92..7a1ded6f23 100644
--- a/tests/control_plane/test_request_amendment_recovery.py
+++ b/tests/control_plane/test_request_amendment_recovery.py
@@ -280,6 +280,8 @@ def test_correction_before_reservation_refuses_obsolete_source_without_goal_muta
 def test_receiver_cli_reads_assesses_and_returns_the_correct_revision(source_goal, tmp_path, capsys):
     f = source_goal
     rid = _request(f)["request_id"]
+    code, original = _inbox(f, capsys, "read")
+    assert code == 0 and "When request_revision is supplied" not in original["followthrough"]
     assert _inbox(f, capsys, "acknowledge", "--request-id", rid, "--decision", "adopt", "--reason", "Original assessment")[0] == 0
     assert _inbox(f, capsys, "report", "--request-id", rid, "--reply-text", "Original result")[0] == 0
     original_decision = (_root(f["runtime"]) / "decisions" / (rid + ".json")).read_bytes()
@@ -291,6 +293,7 @@ def test_receiver_cli_reads_assesses_and_returns_the_correct_revision(source_goa
     assert code == 0, supplied
     item = next(item for item in supplied["items"] if item["request_id"] == rid)
     assert item["request_revision"] == 2 and item["brief"]["context"] == "Use the corrected source"
+    assert "When request_revision is supplied" in supplied["followthrough"]
     assert item["recorded_decision"] is None
     assert item["request_read_receipt"]["supplied_revision"] == 2
     assert "request_control" not in item

From 9df4a0cadf16b4526b2b22791626bba38de4b249 Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Wed, 14 Oct 2026 12:37:03 +0800
Subject: [PATCH 07/11] Preserve injected replan configuration across request
 amendment callers

Signed-off-by: song <liusongstep@gmail.com>
---
 .../smoke/request-control-http-fixture.py     |  2 ++
 loopx/cli_commands/manager_inbox.py           |  3 ++
 loopx/collaboration_mcp.py                    |  2 ++
 .../collaboration/request_amendment.py        | 34 +++++++++++++------
 .../goals/goal_amendment_runtime.py           |  8 +++--
 loopx/presentation/request_control_api.py     |  5 ++-
 .../project_registry_io_manifest_v1.json      |  6 ++--
 .../test_request_amendment_recovery.py        | 23 +++++++++++--
 8 files changed, 64 insertions(+), 19 deletions(-)

diff --git a/apps/presentation/dashboard/smoke/request-control-http-fixture.py b/apps/presentation/dashboard/smoke/request-control-http-fixture.py
index 6e62527a71..c580e99633 100644
--- a/apps/presentation/dashboard/smoke/request-control-http-fixture.py
+++ b/apps/presentation/dashboard/smoke/request-control-http-fixture.py
@@ -8,6 +8,7 @@
 from loopx.chat_server import serve_chat
 from loopx.chat_store import ChatSessionStore
 from loopx.capabilities.manager_context import deliver
+from loopx.capabilities.todo_replan_cadence.machine_defaults import resolve_todo_replan_cadence_goal
 from loopx.control_plane.goals.goal_amendment_runtime import execute_goal_amendment
 from loopx.control_plane.collaboration.request_control_source import (
     execute_request_control,
@@ -105,6 +106,7 @@ def cli(*args):
 
 def goal(op, params=None, actor="agent-a", execute=False):
     return execute_goal_amendment(
+        replan_configuration_reader=resolve_todo_replan_cadence_goal,
         registry_path=registry,
         runtime_root=runtime,
         goal_id=ref["goal_id"],
diff --git a/loopx/cli_commands/manager_inbox.py b/loopx/cli_commands/manager_inbox.py
index 40ac411cd0..f62cf1f3e5 100644
--- a/loopx/cli_commands/manager_inbox.py
+++ b/loopx/cli_commands/manager_inbox.py
@@ -114,7 +114,10 @@ def handle_manager_inbox(args, registry_path, runtime_root):
                     raise ValueError("control parameters must be an object; use --operation-id for retry identity")
             if args.control_operation in {"revise", "cancel"}:
                 parameters["operation_id"] = args.operation_id
+            from ..capabilities.todo_replan_cadence.machine_defaults import resolve_todo_replan_cadence_goal
+
             result = control_request(registry_path=registry_path, runtime_root=runtime_root,
+                replan_configuration_reader=resolve_todo_replan_cadence_goal,
                 goal_ref=exact_goal_ref(args.goal_id, args.goal_instance_id), receiver_agent_id=receiver,
                 request_id=args.request_id, actor_agent_id=args.agent_id, operation=args.control_operation,
                 parameters=parameters, execute=args.execute)
diff --git a/loopx/collaboration_mcp.py b/loopx/collaboration_mcp.py
index b08234c536..32966f1898 100644
--- a/loopx/collaboration_mcp.py
+++ b/loopx/collaboration_mcp.py
@@ -385,9 +385,11 @@ def control_peer_request(request_id: str, receiver_agent_id: str,
             not revoke committed Goal work or grant new execution permission.
             """
             from .control_plane.collaboration.request_amendment import control_request
+            from .capabilities.todo_replan_cadence.machine_defaults import resolve_todo_replan_cadence_goal
 
             check_scope()
             return control_request(registry_path=registry, runtime_root=root, goal_ref=caller_goal_ref,
+                replan_configuration_reader=resolve_todo_replan_cadence_goal,
                 receiver_agent_id=receiver_agent_id, request_id=request_id, actor_agent_id=agent_id,
                 operation=operation, parameters=parameters, execute=execute)
 
diff --git a/loopx/control_plane/collaboration/request_amendment.py b/loopx/control_plane/collaboration/request_amendment.py
index 857dee3414..c7dc8da637 100644
--- a/loopx/control_plane/collaboration/request_amendment.py
+++ b/loopx/control_plane/collaboration/request_amendment.py
@@ -6,6 +6,7 @@
 from __future__ import annotations
 
 from pathlib import Path
+from collections.abc import Callable
 from typing import Any, Mapping
 
 from .request_control_source import _execute, execute_request_control, request_amendment_snapshot
@@ -45,21 +46,25 @@ def _reservation(snapshot: Mapping[str, Any], operation_id: Any) -> dict[str, An
 
 def _goal(registry: Path, root: Path, ref: Mapping[str, str], receiver: str,
           operation: str, parameters: Mapping[str, Any], *, context: Mapping[str, Any] | None = None,
+          replan_configuration_reader: Callable[[Mapping[str, Any], Path], Mapping[str, Any]],
           execute: bool = False) -> dict[str, Any]:
     return _execute_goal_amendment(registry_path=registry, runtime_root=root, goal_id=ref["goal_id"],
         goal_instance_id=ref["goal_instance_id"], actor_agent_id=None if operation == "receipt" else receiver,
-        operation=operation, parameters=parameters, request_context=context, execute=execute)
+        operation=operation, parameters=parameters, request_context=context, execute=execute,
+        replan_configuration_reader=replan_configuration_reader)
 
 
 def _finish(*, registry: Path, root: Path, ref: Mapping[str, str], receiver: str, actor: str | None,
             snapshot: dict[str, Any], reservation: dict[str, Any], execute: bool,
+            replan_configuration_reader: Callable[[Mapping[str, Any], Path], Mapping[str, Any]],
             attempt_observation: Mapping[str, Any] | None = None) -> dict[str, Any]:
     """Re-read the actual Goal receipt, then link it at the request owner."""
     terminal = None
     errors = []
     bound = reservation["binding"]
     try:
-        readback = _goal(registry, root, ref, receiver, "receipt", {"receipt_operation_id": bound["operation_id"]})
+        readback = _goal(registry, root, ref, receiver, "receipt", {"receipt_operation_id": bound["operation_id"]},
+            replan_configuration_reader=replan_configuration_reader)
         observation = effect_runtime_result("goal.amendment.request_receipt", {
             "entry": snapshot["_entry"], "reservation_digest": reservation["digest"], "receipt": readback})
         terminal = observation["terminal"]
@@ -92,6 +97,7 @@ def _finish(*, registry: Path, root: Path, ref: Mapping[str, str], receiver: str
 
 
 def execute_request_amendment(*, registry_path: Path, runtime_root: Path | None, goal_ref: Mapping[str, str],
+                              replan_configuration_reader: Callable[[Mapping[str, Any], Path], Mapping[str, Any]],
                               receiver_agent_id: str, parameters: Mapping[str, Any], execute: bool) -> dict[str, Any]:
     if set(parameters) != {"source_request", "operation_id", "proposal_id", "proposal_digest"}:
         raise ValueError("request-derived commit needs the original proposal, source basis and operation id")
@@ -106,7 +112,8 @@ def execute_request_amendment(*, registry_path: Path, runtime_root: Path | None,
     reservation = _reservation(snapshot, parameters["operation_id"])
     if reservation is None:
         # Resolve from the real Goal owner, not caller-provided policy/basis.
-        goal = _goal(registry_path, root, goal_ref, receiver_agent_id, "request_basis", {})
+        goal = _goal(registry_path, root, goal_ref, receiver_agent_id, "request_basis", {},
+            replan_configuration_reader=replan_configuration_reader)
         if goal.get("ok") is not True or not isinstance(goal.get("intent"), dict):
             raise ValueError("current Goal amendment authority is unavailable")
         proposal = next((row for row in goal["intent"]["proposals"] if row["proposal_id"] == parameters["proposal_id"]), None)
@@ -129,20 +136,24 @@ def execute_request_amendment(*, registry_path: Path, runtime_root: Path | None,
     context = {"entry": snapshot["_entry"], "reservation_digest": reservation["digest"], "preview": not execute}
     effect = {key: parameters[key] for key in ("operation_id", "proposal_id", "proposal_digest")}
     if not execute:
-        preview = _goal(registry_path, root, goal_ref, receiver_agent_id, "commit", effect, context=context)
+        preview = _goal(registry_path, root, goal_ref, receiver_agent_id, "commit", effect, context=context,
+            replan_configuration_reader=replan_configuration_reader)
         return {**preview, "request_preview": snapshot["view"], "request_reservation_recorded": not snapshot.get("planned", False)}
     try:
-        attempted = _goal(registry_path, root, goal_ref, receiver_agent_id, "commit", effect, context=context, execute=True)
+        attempted = _goal(registry_path, root, goal_ref, receiver_agent_id, "commit", effect, context=context, execute=True,
+            replan_configuration_reader=replan_configuration_reader)
         observation = {key: attempted[key] for key in ("status", "reason_code", "reason") if key in attempted}
     except (OSError, ValueError, EffectRuntimeRejected) as exc:
         # A failed response does not establish no effect. The exact receipt
         # read below owns that conclusion and keeps an absent result pending.
         observation = {"error": str(exc)}
     return _finish(registry=registry_path, root=root, ref=goal_ref, receiver=receiver_agent_id,
-        actor=receiver_agent_id, snapshot=snapshot, reservation=reservation, execute=True, attempt_observation=observation)
+        actor=receiver_agent_id, snapshot=snapshot, reservation=reservation, execute=True, attempt_observation=observation,
+        replan_configuration_reader=replan_configuration_reader)
 
 
 def recover_request_amendment(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+                              replan_configuration_reader: Callable[[Mapping[str, Any], Path], Mapping[str, Any]],
                               receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
                               execute: bool = False) -> dict[str, Any]:
     root = _root(registry_path, runtime_root)
@@ -157,15 +168,18 @@ def recover_request_amendment(*, registry_path: Path, runtime_root: Path, goal_r
         try:
             attempted = _goal(registry_path, root, goal_ref, receiver_agent_id, "abort_request",
                 {key: bound[key] for key in ("operation_id", "proposal_id", "proposal_digest")},
-                context={"entry": snapshot["_entry"], "reservation_digest": reservation["digest"]}, execute=True)
+                context={"entry": snapshot["_entry"], "reservation_digest": reservation["digest"]}, execute=True,
+                replan_configuration_reader=replan_configuration_reader)
             observation = {key: attempted[key] for key in ("status", "reason_code", "reason") if key in attempted}
         except (OSError, ValueError, EffectRuntimeRejected) as exc:
             observation = {"error": str(exc)}  # Read the receipt; never infer an abort.
     return _finish(registry=registry_path, root=root, ref=goal_ref, receiver=receiver_agent_id,
-        actor=actor_agent_id, snapshot=snapshot, reservation=reservation, execute=execute, attempt_observation=observation)
+        actor=actor_agent_id, snapshot=snapshot, reservation=reservation, execute=execute, attempt_observation=observation,
+        replan_configuration_reader=replan_configuration_reader)
 
 
 def control_request(*, registry_path: Path, runtime_root: Path, goal_ref: Mapping[str, str],
+                    replan_configuration_reader: Callable[[Mapping[str, Any], Path], Mapping[str, Any]],
                     receiver_agent_id: str, request_id: str, actor_agent_id: str | None,
                     operation: str, parameters: Mapping[str, Any] | None = None, execute: bool = False) -> dict[str, Any]:
     """Shared source UI/CLI path; cancellation settles only through its owner."""
@@ -174,12 +188,12 @@ def control_request(*, registry_path: Path, runtime_root: Path, goal_ref: Mappin
     if operation == "recover":
         if parameters:
             raise ValueError("request recovery takes its binding from the original source")
-        return recover_request_amendment(**common, execute=execute)
+        return recover_request_amendment(**common, execute=execute, replan_configuration_reader=replan_configuration_reader)
     if operation not in {"inspect", "revise", "cancel"}:
         raise ValueError("source request control operation is unsupported")
     result = execute_request_control(**common, operation=operation, parameters=parameters, execute=execute)
     if execute and (operation == "cancel" or result["view"].get("recovery_operation") == "abort_request"):
-        recovery = recover_request_amendment(**common, execute=True)
+        recovery = recover_request_amendment(**common, execute=True, replan_configuration_reader=replan_configuration_reader)
         return {**result, "ok": recovery["ok"], "view": recovery.get("request_control", recovery.get("view")),
             "effect_recovery": recovery}
     return result
diff --git a/loopx/control_plane/goals/goal_amendment_runtime.py b/loopx/control_plane/goals/goal_amendment_runtime.py
index 7f865e0e84..9847b13c35 100644
--- a/loopx/control_plane/goals/goal_amendment_runtime.py
+++ b/loopx/control_plane/goals/goal_amendment_runtime.py
@@ -152,6 +152,7 @@ def inspect() -> dict[str, Any]:
 def execute_goal_amendment(
     *, registry_path: Path, goal_id: str, goal_instance_id: str,
     operation: str, actor_agent_id: str | None,
+    replan_configuration_reader: Callable[[Mapping[str, Any], Path], Mapping[str, Any]],
     parameters: Mapping[str, Any] | None = None,
     runtime_root: Path | None = None, execute: bool = False,
 ) -> dict[str, Any]:
@@ -161,7 +162,8 @@ def execute_goal_amendment(
         raise ValueError("request effect recovery must use its original request entrypoint")
     if "source_request" not in params:
         return _execute_goal_amendment(registry_path=registry_path, goal_id=goal_id, goal_instance_id=goal_instance_id,
-            operation=operation, actor_agent_id=actor_agent_id, parameters=params, runtime_root=runtime_root, execute=execute)
+            operation=operation, actor_agent_id=actor_agent_id, parameters=params, runtime_root=runtime_root, execute=execute,
+            replan_configuration_reader=replan_configuration_reader)
     if operation not in {"propose", "commit"} or actor_agent_id is None:
         raise ValueError("source request context requires an explicit receiver proposal or commit")
     from ..collaboration.request_amendment import execute_request_amendment, request_proposal_context
@@ -169,9 +171,9 @@ def execute_goal_amendment(
     if operation == "commit":
         return execute_request_amendment(registry_path=registry_path, runtime_root=runtime_root,
             goal_ref=exact_goal_ref(goal_id, goal_instance_id), receiver_agent_id=actor_agent_id,
-            parameters=params, execute=execute)
+            parameters=params, execute=execute, replan_configuration_reader=replan_configuration_reader)
     root, context = request_proposal_context(registry_path=registry_path, runtime_root=runtime_root,
         goal_ref=exact_goal_ref(goal_id, goal_instance_id), receiver_agent_id=actor_agent_id, reference=params["source_request"])
     return _execute_goal_amendment(registry_path=registry_path, goal_id=goal_id, goal_instance_id=goal_instance_id,
         operation="propose", actor_agent_id=actor_agent_id, parameters=params, runtime_root=root,
-        execute=execute, request_context=context)
+        execute=execute, request_context=context, replan_configuration_reader=replan_configuration_reader)
diff --git a/loopx/presentation/request_control_api.py b/loopx/presentation/request_control_api.py
index 3dd43c11d0..0bd535d6d9 100644
--- a/loopx/presentation/request_control_api.py
+++ b/loopx/presentation/request_control_api.py
@@ -16,6 +16,7 @@
 from ..control_plane.goals.goal_ref_validation import exact_goal_ref
 from ..control_plane.projects.registry_codec import load_project_registry
 from ..capabilities.manager_context import target_authority
+from ..capabilities.todo_replan_cadence.machine_defaults import resolve_todo_replan_cadence_goal
 from ..control_plane.collaboration.source_chat_observation import original_delivery_facts
 from .goal_source_routing import source_registry_for_goal
 
@@ -84,7 +85,8 @@ def _request_control_read(self) -> None:
             query = parse_qs(urlparse(self.path).query, keep_blank_values=True)
             if set(query) != _ROUTING or any(len(value) != 1 for value in query.values()):
                 raise ValueError("request routing fields are required exactly once")
-            result = control_request(**self._request_control_source({key: values[0] for key, values in query.items()}), operation="inspect")
+            result = control_request(**self._request_control_source({key: values[0] for key, values in query.items()}), operation="inspect",
+                replan_configuration_reader=resolve_todo_replan_cadence_goal)
             self._send_json(_operator_payload(result))
         except (OSError, ValueError, TypeError, KeyError, EffectRuntimeRemoteError, EffectRuntimeStartupError) as exc:
             self._send_error(redact_local_paths(str(exc)), status=400, error_code="request_control_unavailable")
@@ -97,6 +99,7 @@ def _request_control_write(self) -> None:
                     or not isinstance(body["parameters"], dict) or type(body["execute"]) is not bool):
                 raise ValueError("only original source correction, cancellation or recovery is accepted here")
             result = control_request(**self._request_control_source(body), operation=body["operation"],
+                replan_configuration_reader=resolve_todo_replan_cadence_goal,
                 parameters=body["parameters"], execute=body["execute"])
             self._send_json(_operator_payload(result))
         except (OSError, ValueError, TypeError, KeyError, EffectRuntimeRemoteError, EffectRuntimeStartupError) as exc:
diff --git a/loopx/semantics/project_registry_io_manifest_v1.json b/loopx/semantics/project_registry_io_manifest_v1.json
index f7939e4ac2..116c41afd4 100644
--- a/loopx/semantics/project_registry_io_manifest_v1.json
+++ b/loopx/semantics/project_registry_io_manifest_v1.json
@@ -823,7 +823,7 @@
     },
     {
       "site": "loopx/cli_commands/manager_inbox.py::<module>.handle_manager_inbox::codec_read:load_project_registry#1",
-      "line": 173,
+      "line": 176,
       "column": 20,
       "kind": "codec_read",
       "api": "load_project_registry",
@@ -1111,7 +1111,7 @@
     },
     {
       "site": "loopx/control_plane/collaboration/request_amendment.py::<module>._root::codec_read:load_project_registry#1",
-      "line": 18,
+      "line": 19,
       "column": 18,
       "kind": "codec_read",
       "api": "load_project_registry",
@@ -2223,7 +2223,7 @@
     },
     {
       "site": "loopx/presentation/request_control_api.py::<module>.RequestControlMixin._request_control_source::codec_read:load_project_registry#1",
-      "line": 58,
+      "line": 59,
       "column": 22,
       "kind": "codec_read",
       "api": "load_project_registry",
diff --git a/tests/control_plane/test_request_amendment_recovery.py b/tests/control_plane/test_request_amendment_recovery.py
index 7a1ded6f23..014ed17d61 100644
--- a/tests/control_plane/test_request_amendment_recovery.py
+++ b/tests/control_plane/test_request_amendment_recovery.py
@@ -13,6 +13,7 @@
 from loopx.control_plane.collaboration.request_amendment import recover_request_amendment, control_request
 from loopx.control_plane.collaboration.inbox import _root, acknowledge
 from loopx.cli import main
+from loopx.capabilities.todo_replan_cadence.machine_defaults import resolve_todo_replan_cadence_goal
 from loopx.collaboration_mcp import register_collaboration_tools
 from loopx.control_plane.projects.registry_codec import source_session_registry_transaction
 
@@ -112,10 +113,22 @@ def test_request_control_refuses_wrong_actor_namespace_and_untrusted_effect_fact
         _control(f, "../not-a-request", "inspect")
 
 
-def test_real_request_reservation_goal_commit_and_terminal_linkage(source_goal, tmp_path, capsys):
+def test_real_request_reservation_goal_commit_and_terminal_linkage(source_goal, tmp_path, capsys, monkeypatch):
     f = source_goal
     rid, commit = _proposal(f, tmp_path, capsys)
     before = {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")}
+    # The current Goal configuration reader must pass through both the public
+    # request wrapper and its reserved-effect caller after integration.
+    from loopx.capabilities.todo_replan_cadence import machine_defaults
+
+    def unavailable(*_args, **_kwargs):
+        raise OSError("synthetic current configuration unavailable")
+
+    with monkeypatch.context() as missing_config:
+        missing_config.setattr(machine_defaults, "resolve_todo_replan_cadence_goal", unavailable)
+        code, refused = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=False)
+        assert code == 1 and "configuration unavailable" in str(refused), refused
+    assert {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")} == before
     code, preview = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=False)
     assert code == 0, preview
     assert preview["goal_changed"] is False and preview["terminal_recorded"] is False
@@ -128,7 +141,11 @@ def test_real_request_reservation_goal_commit_and_terminal_linkage(source_goal,
     _, goal = goal_call(f, tmp_path, capsys, "inspect", agent=None)
     assert goal["intent"]["created_todo_ids"] == [applied["effect"]["todo_id"]]
     saved = {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")}
-    code, replayed = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
+    # Already committed history remains recoverable even if current proposal
+    # configuration is unavailable; it cannot authorize a new effect.
+    with monkeypatch.context() as missing_config:
+        missing_config.setattr(machine_defaults, "resolve_todo_replan_cadence_goal", unavailable)
+        code, replayed = goal_call(f, tmp_path, capsys, "commit", commit, operation_id="commit-request", execute=True)
     assert code == 0 and replayed["effect"] == applied["effect"]
     assert {p.relative_to(_root(f["runtime"])): p.read_bytes() for p in _root(f["runtime"]).rglob("*.json")} == saved
     assert goal_call(f, tmp_path, capsys, "inspect", agent=None)[1]["provider_revision"] == goal["provider_revision"]
@@ -137,6 +154,7 @@ def test_real_request_reservation_goal_commit_and_terminal_linkage(source_goal,
 
 def _recover(f, rid, *, execute=True):
     return recover_request_amendment(registry_path=f["registry"], runtime_root=f["runtime"], goal_ref=f["ref"],
+        replan_configuration_reader=resolve_todo_replan_cadence_goal,
         receiver_agent_id="agent-a", request_id=rid, actor_agent_id="agent-b", execute=execute)
 
 
@@ -433,6 +451,7 @@ def unknown(*args, **kwargs):
         assert goal_call(f, tmp_path, capsys, "commit", commit, operation_id="old-effect", execute=True)[0] == 1
     current = _control(f, rid, "inspect")["view"]
     corrected = control_request(registry_path=f["registry"], runtime_root=f["runtime"], goal_ref=f["ref"],
+        replan_configuration_reader=resolve_todo_replan_cadence_goal,
         receiver_agent_id="agent-a", request_id=rid, actor_agent_id="agent-b", operation="revise", execute=True,
         parameters={"operation_id": "correct-unknown", **_basis(current), "brief": {**BRIEF, "context": "Continue from corrected source"}, "reason": "Use the new input"})
     assert corrected["ok"] and corrected["view"]["control_state"] == "open", corrected

From 75002e186e269ccb5bfe4d8da84fbbfc77588f1b Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Wed, 14 Oct 2026 12:37:03 +0800
Subject: [PATCH 08/11] Verify complete request retention before sending
 corrections

Signed-off-by: song <liusongstep@gmail.com>
---
 .../smoke/request-control-browser-smoke.mjs   | 45 ++++++++++++++++++-
 .../personal-workspace/request-control.tsx    |  8 +++-
 ...oal-alignment-and-governed-amendment-v0.md |  7 ++-
 ...ignment-and-governed-amendment-v0.zh-CN.md |  4 +-
 4 files changed, 58 insertions(+), 6 deletions(-)

diff --git a/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs b/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
index 8a878c0408..2275fe168a 100644
--- a/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
+++ b/apps/presentation/dashboard/smoke/request-control-browser-smoke.mjs
@@ -11,7 +11,7 @@ import {testPythonCommand} from '../../../../scripts/test-python.mjs';
 import {launchBrowser,loadPlaywright} from '../../../../examples/dashboard-browser-smoke-support.mjs';
 const repo=resolve(import.meta.dirname,'../../../..');
 const output=resolve(repo,'output/playwright/request-control');await mkdir(output,{recursive:true});
-const root=await mkdtemp(resolve(tmpdir(),'request-control-browser-'));
+const root=await mkdtemp(resolve(tmpdir(),'rc-'));
 const socket=createServer();await new Promise(r=>socket.listen(0,'127.0.0.1',r));const port=socket.address().port;await new Promise(r=>socket.close(r));
 const command=testPythonCommand(await readFile(resolve(repo,'apps/presentation/dashboard/smoke/request-control-http-fixture.py'),'utf8'),{repoRoot:repo});
 const child=spawn(command.command,[...command.args,root,String(port)],{cwd:root,env:{...process.env,LOOPX_USAGE_PING:'0',TMPDIR:root,NODE_OPTIONS:'--experimental-sqlite'},stdio:['pipe','pipe','pipe']});
@@ -48,6 +48,47 @@ try{
  let card=await enter();let panel=card.locator('.personal-request-control');
  await panel.getByRole('button',{name:'修正内容',exact:true}).click();
  await panel.getByLabel('背景与补充',{exact:true}).fill('Use corrected evidence for this contract');
+ // A successful storage call is not proof that the whole original request can
+ // survive a lost reply and reload. Fault only browser retention; the real
+ // request/Goal owners and the response-loss route above stay in place.
+ await page.evaluate(()=>{
+  const set=Storage.prototype.setItem,get=Storage.prototype.getItem;
+  window.requestRetentionFault='drop';
+  Storage.prototype.setItem=function(key,value){
+   if(key.startsWith('loopx.request-control.')){
+    if(window.requestRetentionFault==='drop')return;
+    if(window.requestRetentionFault==='changed-content'){
+     const saved=JSON.parse(value);saved.parameters.brief.context='Different retained content';
+     return set.call(this,key,JSON.stringify(saved));
+    }
+   }
+   return set.call(this,key,value);
+  };
+  Storage.prototype.getItem=function(key){
+   if(key.startsWith('loopx.request-control.')&&window.requestRetentionFault==='unreadable')throw Error('Storage read unavailable');
+   return get.call(this,key);
+  };
+ });
+ for(const fault of ['drop','changed-content','unreadable']){
+  await page.evaluate(value=>{window.requestRetentionFault=value;},fault);
+  await panel.getByRole('button',{name:'保存修正',exact:true}).click();
+  await panel.getByText('无法保存恢复信息，本次操作尚未发送。',{exact:true}).waitFor();
+  assert.equal(writes.length,0,'unrecoverable request must never execute');
+  assert.equal((await fixture('inspect')).revision,1);
+  assert.equal(await panel.getByLabel('背景与补充',{exact:true}).inputValue(),'Use corrected evidence for this contract');
+  assert.equal(await panel.getByLabel('背景与补充',{exact:true}).isEnabled(),true);
+  assert.equal(await panel.getByRole('button',{name:'重试原操作',exact:true}).count(),0);
+ }
+ await panel.screenshot({path:resolve(output,'retention-unavailable.png')});
+ await page.evaluate(()=>{
+  window.requestRetentionFault=null;
+  for(const key of Object.keys(sessionStorage))if(key.startsWith('loopx.request-control.'))sessionStorage.removeItem(key);
+ });
+ await page.reload();card=await enter();panel=card.locator('.personal-request-control');
+ assert.equal(await panel.getByRole('button',{name:'重试原操作',exact:true}).count(),0);
+ assert.equal((await fixture('inspect')).revision,1);
+ await panel.getByRole('button',{name:'修正内容',exact:true}).click();
+ await panel.getByLabel('背景与补充',{exact:true}).fill('Use corrected evidence for this contract');
  await panel.getByRole('button',{name:'保存修正',exact:true}).click();
  await dropped;
  await page.waitForFunction(()=>[...document.querySelectorAll('button')].find(b=>b.textContent==='重试原操作')?.disabled===false);
@@ -95,6 +136,6 @@ try{
  await english.getByText('Request cancelled',{exact:true}).waitFor();
  await english.screenshot({path:resolve(output,'english.png')});
  assert.deepEqual(errors,[]);
- console.log('PASS: real source registration, normal Chat entrance, original request correction, unknown reply/reload, stale edit, independent receiver CLI, reserved effect and cancellation terminal readback.');
+ console.log('PASS: real source registration, normal Chat entrance, silent-drop/changed-content/unreadable retention refuses execution and preserves draft, original request correction, unknown reply/reload/exact retry, stale edit, independent receiver CLI, reserved effect and cancellation terminal readback.');
 }catch(error){if(page){await page.screenshot({path:resolve(output,'failure.png'),fullPage:true}).catch(()=>{});await (await import('node:fs/promises')).writeFile(resolve(output,'failure.txt'),await page.locator('body').innerText());}throw error;}
 finally{await page?.unrouteAll({behavior:"ignoreErrors"}).catch(()=>{});await browser?.close();child.kill('SIGTERM');await new Promise(r=>child.exitCode!==null?r():child.once('exit',r));lines.close();await rm(root,{recursive:true,force:true});}
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx b/apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx
index 35d50ccc14..e158d9d0f5 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/request-control.tsx
@@ -41,7 +41,13 @@ export function RequestControl({route, active, onReadback, onEditing}: {route: R
   const routeKey = requestControlRouteKey(route);
   const show = useCallback((value: RequestControlView | null) => {setView(value); onRead.current(value);}, []);
   const remember = (value: PendingRequestControl | null) => {
-    if (value) sessionStorage.setItem(storageKey, JSON.stringify(value)); else sessionStorage.removeItem(storageKey);
+    if (value) {
+      const serialized = JSON.stringify(value);
+      sessionStorage.setItem(storageKey, serialized);
+      // As with steering retention, dispatch only after the complete original
+      // request can be read back for an exact retry after response loss/reload.
+      if (sessionStorage.getItem(storageKey) !== serialized) throw new Error(c.storage);
+    } else sessionStorage.removeItem(storageKey);
     setPending(value);
   };
   const load = useCallback(async () => {
diff --git a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
index 0f5fc8f85c..f6e684b80e 100644
--- a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
+++ b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.md
@@ -1027,8 +1027,11 @@ writing an abort into another authority store.
 **Owner journey.** Open the original private conversation's delegation details.
 Edit the brief or cancel the request there; Goal/receiver/source identities are
 already bound to the original message. Saving validates and writes in one user
-gesture. A failed current read clears current controls. Unknown write responses
-retain the original request across reload; retry that exact operation. A typed
+gesture. A failed current read clears current controls. Before dispatch, read
+back the complete retained request, including its route, operation, basis and
+content. If retention fails, keep the editable page draft and send no mutation;
+an in-memory value alone does not establish reload recovery. Unknown write responses
+retain that original request across reload; retry that exact operation. A typed
 stale-basis refusal reloads the latest revision for editing. Pending cancellation
 and committed/aborted/rejected outcomes remain distinct. Historical Goal instances
 remain read-only here; this is not restored-runtime authorization.
diff --git a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
index ccb803db1f..533c139d31 100644
--- a/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
+++ b/docs/architecture/rfcs/shared-goal-alignment-and-governed-amendment-v0.zh-CN.md
@@ -832,7 +832,9 @@ Goal 仍复用既有工作规划规则。提交和来源授权的条件中止竞
 
 **用户路径：** 打开原私有对话中的交办详情，就地修改 brief 或取消；无需重填
 Goal、接收者或来源标识。保存以一次用户操作完成校验和写入。读取失败清除当前
-控制视图；未知写入结果跨刷新保留原请求，重试仍用同一操作。类型化 basis 过期
+控制视图。派发前读回完整保留请求，包括来源路由、操作、依据与内容；保留失败则
+留下可编辑的页面草稿，不发送变更，不能仅凭内存值声称可跨刷新恢复。未知写入结果
+跨刷新保留该原请求，重试仍用同一操作。类型化 basis 过期
 拒绝会重新读取当前版本供编辑。取消待核对与已提交/已中止/已拒绝分别展示。
 历史 Goal 实例在此只读，不授予恢复后的运行权。
 

From 4746c41141b165c34a6de40ce1fc75a838ce2f24 Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Wed, 14 Oct 2026 12:53:25 +0800
Subject: [PATCH 09/11] Group request-specific source reader assertions with
 collaboration

Signed-off-by: song <liusongstep@gmail.com>
---
 .../test_source_session_registry_denial.py           | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/architecture/test_source_session_registry_denial.py b/tests/architecture/test_source_session_registry_denial.py
index 5f7552c090..e085b83710 100644
--- a/tests/architecture/test_source_session_registry_denial.py
+++ b/tests/architecture/test_source_session_registry_denial.py
@@ -16,9 +16,6 @@
     "loopx/control_plane/goals/source_session_registration.py",
     "loopx/presentation/goal_amendment_api.py",
     "loopx/presentation/goal_source_routing.py",
-    "loopx/presentation/request_control_api.py",
-    "loopx/control_plane/collaboration/request_control_source.py",
-    "loopx/control_plane/collaboration/request_amendment.py",
     "loopx/attached_session.py",
     "loopx/bootstrap.py",
     "loopx/capabilities/manager_context/__init__.py",
@@ -31,6 +28,9 @@
     "loopx/configure_goal.py",
     "loopx/control_plane/collaboration/goal_instance_scope.py",
     "loopx/control_plane/collaboration/peers.py",
+    "loopx/control_plane/collaboration/request_control_source.py",
+    "loopx/control_plane/collaboration/request_amendment.py",
+    "loopx/presentation/request_control_api.py",
     "loopx/control_plane/collaboration/source_grant_observation.py",
     "loopx/control_plane/goals/first_party_host_admission.py",
     "loopx/control_plane/goals/source_session_recreation.py",
@@ -128,14 +128,14 @@ def test_direct_project_registry_loaders_have_source_session_denial() -> None:
     # native creation tests additionally prove the executable refusal boundary.
     metadata_readers = {
         **METADATA_READER_FUNCTIONS,
+        "loopx/control_plane/collaboration/request_control_source.py": {"_locked_request"},
+        "loopx/control_plane/collaboration/request_amendment.py": {"_root"},
+        "loopx/presentation/request_control_api.py": {"_request_control_source"},
         "loopx/chat_server.py": {"serve_chat"},
         "loopx/chat_status_api.py": {"_status"},
         "loopx/control_plane/coordination/new_goal_storage_transport.py": {"initialize_goal_storage_target"},
         "loopx/presentation/goal_amendment_api.py": {"_amendment_inspect"},
         "loopx/presentation/goal_source_routing.py": {"source_registry_for_goal"},
-        "loopx/presentation/request_control_api.py": {"_request_control_source"},
-        "loopx/control_plane/collaboration/request_control_source.py": {"_locked_request"},
-        "loopx/control_plane/collaboration/request_amendment.py": {"_root"},
     }
     for relative, expected in metadata_readers.items():
         tree = ast.parse((REPO_ROOT / relative).read_text(encoding="utf-8"))

From 6a9dca388c2d243391c8a9339afb6b87b9536584 Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Wed, 14 Oct 2026 06:12:33 -0400
Subject: [PATCH 10/11] test(digest): pin request_control as a canonical digest
 consumer

The request-control owner reads the shared SHA-256 matchers, so the
single-owner guard must list it; otherwise typescript-core fails on the
integrated head.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: song <liusongstep@gmail.com>
---
 tests/control_plane_ts/content_digest_single_owner.test.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/control_plane_ts/content_digest_single_owner.test.ts b/tests/control_plane_ts/content_digest_single_owner.test.ts
index 8d049af41f..045703def0 100644
--- a/tests/control_plane_ts/content_digest_single_owner.test.ts
+++ b/tests/control_plane_ts/content_digest_single_owner.test.ts
@@ -100,6 +100,7 @@ const CANONICAL_CONSUMERS = [
   "control_plane/collaboration/delegation_result_use.ts",
   "control_plane/collaboration/goal_instance_lifecycle.ts",
   "control_plane/collaboration/inbox_receipts.ts",
+  "control_plane/collaboration/request_control.ts",
   "control_plane/collaboration/result_publication.ts",
   "control_plane/collaboration/return_delivery.ts",
   "control_plane/collaboration/semantic_request.ts",

From a46eabd4de0298f741a422ac2aa29248c3682c8a Mon Sep 17 00:00:00 2001
From: song <liusongstep@gmail.com>
Date: Wed, 14 Oct 2026 06:47:41 -0400
Subject: [PATCH 11/11] fix(dashboard): use defined workspace tokens in request
 controls

The request-control rules referenced --color-border and
--color-text-secondary, which no stylesheet defines, so each declaration
was silently dropped. Main's CSS custom-property check now rejects them.
Use the personal-workspace line and muted tokens that the surrounding
collaboration card rules already rely on.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: song <liusongstep@gmail.com>
---
 .../src/features/personal-workspace/collaboration-card.css  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css b/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css
index a249553572..c9a01e4019 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css
+++ b/apps/presentation/dashboard/src/features/personal-workspace/collaboration-card.css
@@ -8,15 +8,15 @@
 .personal-collaboration ul { padding-left: 20px; }
 .personal-collaboration small { display: block; font-family: var(--font-mono); font-size: var(--text-caption); line-height: var(--leading-caption); }
 .personal-collaboration summary:focus-visible { outline: 2px solid var(--color-link, #0070f3); outline-offset: 2px; }
-.personal-request-control { border-top: 1px solid var(--color-border); margin-top: 16px; padding-top: 12px; }
+.personal-request-control { border-top: 1px solid var(--pw-line); margin-top: 16px; padding-top: 12px; }
 .personal-request-control form, .personal-request-control label { display: grid; gap: 6px; }
 .personal-request-control form { gap: 12px; margin-top: 12px; }
 .personal-request-control input, .personal-request-control textarea { width: 100%; min-width: 0; box-sizing: border-box; }
 .personal-request-control textarea { min-height: 72px; resize: vertical; }
 .personal-request-control fieldset { min-width: 0; margin: 0; border: 0; padding: 0; }
-.personal-request-input { display: grid; gap: 8px; margin: 10px 0; padding-bottom: 10px; border-bottom: 1px solid var(--color-border); }
+.personal-request-input { display: grid; gap: 8px; margin: 10px 0; padding-bottom: 10px; border-bottom: 1px solid var(--pw-line); }
 .personal-request-actions { display: flex; flex-wrap: wrap; gap: 8px; }
-.personal-request-help { color: var(--color-text-secondary); }
+.personal-request-help { color: var(--pw-muted); }
 .personal-request-control button { min-height: 44px; padding: 8px 12px; border: 1px solid var(--pw-line-strong); border-radius: 6px; background: var(--pw-card); color: inherit; cursor: pointer; }
 .personal-request-control button:disabled { opacity: .5; cursor: default; }
 .personal-request-control :is(button, input, textarea):focus-visible { outline: 2px solid var(--pw-blue); outline-offset: 2px; }