[santoshkumarradha]

A plan that finished before its engine restarted could reopen as interrupted, with saved files but no working acceptance door. Recovery now restores the existing explicit accept/refute decision, preserving its copy, crew, completion time and full worker/checker cost. It does not rerun finished work or automatically merge it, including with unattended approvals enabled.

Acceptance uses the existing landing path and records the actual commit. Conversation ownership, saved-branch checks and Stop admission remain enforced. Missing copies and failed checkpoint/page-receipt writes report actionable, truthful outcomes. If the last checkpoint predates the final charge, its price is restored from the existing ledger without charging again.

Validation with fictional data:

• Real terminal and engine: complete a worker/checker task, interrupt before landing, reconnect the same window, inspect preserved files, explicitly accept the restored card, and independently rerun the saved check in the landed checkout. The receipt's commit must be an ancestor of the resulting project HEAD.
• Live OpenRouter run: PASS in 21.38 s; all 24 recorded model receipts used exactly deepseek/deepseek-v4.1-flash, including auxiliary roles. Full task ledger and recovered/accepted receipt stayed at $0.007849236. Restart and acceptance added no model calls or charges.
• Scripted-provider real-engine run: PASS in 14.77 s; worker plus checker ledger, recovered/accepted receipt and displayed task price all matched $0.04. This is a separate deterministic test, not live-model evidence.
• Focused and race checks cover repeated restart, explicit acceptance/refusal, worker scope, Stop ordering, missing copies, changed branches, archived plans beside newer work, foreign conversations, receipt failures and cost restoration. make pr-ready passed. Its classifier reproduced the unrelated TestLowCreditReadSwapsOnlyAnUntouchedImplicitConversation failure on unchanged dev; that existing failure is not claimed fixed here.

Reproduce after make build:

go test -tags e2e ./internal/e2e -run '^TestCompletedPlanRecoversAndAcceptsOnTheRealEngine$' -count=1 -v -timeout 5m
CODEAF_E2E_MODEL=deepseek/deepseek-v4.1-flash go test -tags e2e ./internal/e2e -run '^TestCompletedPlanRecoveryLiveWorkflow$' -count=1 -v -timeout 5m

The live command requires a configured OpenRouter key; every role must remain on the recorded model.

Closes #1657.