status, lastDecision, and stopContext together. The runtime decides which recovery is eligible; a model explanation cannot grant permission.| Stop | Recovery | Effect |
| Explicit refusal | Clarify | Add context and request a fresh evaluation; no automatic retry or override |
| Missing information | Clarify | Answer the executor's question within the original task |
| Missing exact approval | Approve | Approve the current immutable prepared transaction |
| Transient provider failure or invalid output | Retry | Resume without dispatching; the next step evaluates again |
| Missing configuration | Configure, then retry | Fix API settings and explicitly resume |
| Uncertain external effect | Review external result | No redispatch; inspect the receipt and evidence |
| Exhausted limit or unsupported capability | New run | Start a compatible task with new authority |
| Hard-policy termination | None | Authority is revoked |
123456789101112131415{ "status": "paused", "pendingPermit": null, "stopContext": { "version": 1, "category": "refusal", "source": "executor", "reasonCode": "EXECUTOR_REFUSAL", "message": "I cannot assist with an unauthorized transfer.", "recovery": "clarify", "attemptId": "55555555-5555-4555-8555-555555555555", "observationId": "44444444-4444-4444-8444-444444444444", "dispatch": "not_dispatched" } }
recovery is clarify. The original instruction and grants remain unchanged. The next step performs a fresh evaluation. If the transaction scope changes, create a new task.not_dispatched means no action was dispatched in the referenced attempt. It does not erase earlier effects. confirmed refers to recorded dispatch/effect evidence. unconfirmed means execution may have occurred and must be reviewed. unknown preserves uncertainty for records without enough evidence.403 with UNRESOLVED_DISPATCH requires external review, not another retry.