Restore cumulative worker progress before live SSE updates and recover missed terminal state on idle heartbeats. Keep submitted interactions hidden while the command runs and record reconnect state in trace exports.
Worker activation now swaps the dispatch token for a unique owner value, so a
duplicate delivery of a running command can neither run nor release the
winner's lease. Terminal worker failures clear pending confirmed references and
settle the worker's own reloaded grant; the sweeper repairs, in a bounded pass,
reserved grants whose command already reached review/FAILED but whose
settlement write failed, never while a lease is live.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>